259f0441ec
- Update to 3.2.0:
* The BLAKE2b hash algorithm supports a configurable output length
by setting the "size" parameter.
* Enable extra Arm64 optimization on Windows for GHASH, RAND and
AES.
* Added a function to delete objects from store by URI -
OSSL_STORE_delete() and the corresponding provider-storemgmt API
function OSSL_FUNC_store_delete().
* Added OSSL_FUNC_store_open_ex() provider-storemgmt API function to
pass a passphrase callback when opening a store.
* Changed the default salt length used by PBES2 KDF's (PBKDF2 and
scrypt) from 8 bytes to 16 bytes. The PKCS5 (RFC 8018) standard
uses a 64 bit salt length for PBE, and recommends a minimum of 64
bits for PBES2. For FIPS compliance PBKDF2 requires a salt length
of 128 bits. This affects OpenSSL command line applications such
as "genrsa" and "pkcs8" and API's such as
PEM_write_bio_PrivateKey() that are reliant on the default value.
The additional commandline option 'saltlen' has been added to the
OpenSSL command line applications for "pkcs8" and "enc" to allow
the salt length to be set to a non default value.
* Changed the default value of the ess_cert_id_alg configuration
option which is used to calculate the TSA's public key
certificate identifier. The default algorithm is updated to be
sha256 instead of sha1.
* Added optimization for SM2 algorithm on aarch64. It uses a huge
precomputed table for point multiplication of the base point,
which increases the size of libcrypto from 4.4 MB to 4.9 MB. A
new configure option no-sm2-precomp has been added to disable the
precomputed table.
* Added client side support for QUIC
OBS-URL: https://build.opensuse.org/request/show/1129505
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-3?expand=0&rev=80
84 lines
2.3 KiB
Diff
84 lines
2.3 KiB
Diff
From aa3aebf132959e7e44876042efaf9ff24ffe0f2b Mon Sep 17 00:00:00 2001
|
|
From: rpm-build <rpm-build>
|
|
Date: Mon, 31 Jul 2023 09:41:27 +0200
|
|
Subject: [PATCH 09/35] 0009-Add-Kernel-FIPS-mode-flag-support.patch
|
|
|
|
Patch-name: 0009-Add-Kernel-FIPS-mode-flag-support.patch
|
|
Patch-id: 9
|
|
Patch-status: |
|
|
# Add check to see if fips flag is enabled in kernel
|
|
From-dist-git-commit: 9409bc7044cf4b5773639cce20f51399888c45fd
|
|
---
|
|
crypto/context.c | 36 ++++++++++++++++++++++++++++++++++++
|
|
include/internal/provider.h | 3 +++
|
|
2 files changed, 39 insertions(+)
|
|
|
|
Index: openssl-3.2.0/crypto/context.c
|
|
===================================================================
|
|
--- openssl-3.2.0.orig/crypto/context.c
|
|
+++ openssl-3.2.0/crypto/context.c
|
|
@@ -17,6 +17,41 @@
|
|
#include "crypto/decoder.h"
|
|
#include "crypto/context.h"
|
|
|
|
+# include <sys/types.h>
|
|
+# include <sys/stat.h>
|
|
+# include <fcntl.h>
|
|
+# include <unistd.h>
|
|
+# include <openssl/evp.h>
|
|
+
|
|
+# define FIPS_MODE_SWITCH_FILE "/proc/sys/crypto/fips_enabled"
|
|
+
|
|
+static int kernel_fips_flag;
|
|
+
|
|
+static void read_kernel_fips_flag(void)
|
|
+{
|
|
+ char buf[2] = "0";
|
|
+ int fd;
|
|
+
|
|
+ if (ossl_safe_getenv("OPENSSL_FORCE_FIPS_MODE") != NULL) {
|
|
+ buf[0] = '1';
|
|
+ } else if ((fd = open(FIPS_MODE_SWITCH_FILE, O_RDONLY)) >= 0) {
|
|
+ while (read(fd, buf, sizeof(buf)) < 0 && errno == EINTR) ;
|
|
+ close(fd);
|
|
+ }
|
|
+
|
|
+ if (buf[0] == '1') {
|
|
+ kernel_fips_flag = 1;
|
|
+ }
|
|
+
|
|
+ return;
|
|
+}
|
|
+
|
|
+int ossl_get_kernel_fips_flag()
|
|
+{
|
|
+ return kernel_fips_flag;
|
|
+}
|
|
+
|
|
+
|
|
struct ossl_lib_ctx_st {
|
|
CRYPTO_RWLOCK *lock, *rand_crngt_lock;
|
|
OSSL_EX_DATA_GLOBAL global;
|
|
@@ -368,6 +403,7 @@ static int default_context_inited = 0;
|
|
|
|
DEFINE_RUN_ONCE_STATIC(default_context_do_init)
|
|
{
|
|
+ read_kernel_fips_flag();
|
|
if (!CRYPTO_THREAD_init_local(&default_context_thread_local, NULL))
|
|
goto err;
|
|
|
|
Index: openssl-3.2.0/include/internal/provider.h
|
|
===================================================================
|
|
--- openssl-3.2.0.orig/include/internal/provider.h
|
|
+++ openssl-3.2.0/include/internal/provider.h
|
|
@@ -112,6 +112,9 @@ int ossl_provider_init_as_child(OSSL_LIB
|
|
const OSSL_DISPATCH *in);
|
|
void ossl_provider_deinit_child(OSSL_LIB_CTX *ctx);
|
|
|
|
+/* FIPS flag access */
|
|
+int ossl_get_kernel_fips_flag(void);
|
|
+
|
|
# ifdef __cplusplus
|
|
}
|
|
# endif
|