public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
From: Tomas Mraz <tmraz@fedoraproject.org>
To: git-commits@fedoraproject.org
Subject: [rpms/openssl] rebase_40beta: do not advertise ECC curves we do not support (#1022493)
Date: Tue, 09 Jun 2026 12:43:07 GMT [thread overview]
Message-ID: <178100898705.1.15880147449591540367.rpms-openssl-eca676db7ab5@fedoraproject.org> (raw)
A new commit has been pushed.
Repo : rpms/openssl
Branch : rebase_40beta
Commit : eca676db7ab5e46b4611d0eb575d2019ad34c0e6
Author : Tomas Mraz <tmraz@fedoraproject.org>
Date : 2013-10-24T10:40:18+02:00
Stats : +129/-91 in 3 file(s)
URL : https://src.fedoraproject.org/rpms/openssl/c/eca676db7ab5e46b4611d0eb575d2019ad34c0e6?branch=rebase_40beta
Log:
do not advertise ECC curves we do not support (#1022493)
---
diff --git a/openssl-1.0.1e-ecc-suiteb.patch b/openssl-1.0.1e-ecc-suiteb.patch
new file mode 100644
index 0000000..95b192a
--- /dev/null
+++ b/openssl-1.0.1e-ecc-suiteb.patch
@@ -0,0 +1,124 @@
+diff -up openssl-1.0.1e/apps/speed.c.suiteb openssl-1.0.1e/apps/speed.c
+--- openssl-1.0.1e/apps/speed.c.suiteb 2013-10-18 17:38:22.288870517 +0200
++++ openssl-1.0.1e/apps/speed.c 2013-10-18 17:38:22.336871572 +0200
+@@ -966,49 +966,21 @@ int MAIN(int argc, char **argv)
+ else
+ #endif
+ #ifndef OPENSSL_NO_ECDSA
+- if (strcmp(*argv,"ecdsap160") == 0) ecdsa_doit[R_EC_P160]=2;
+- else if (strcmp(*argv,"ecdsap192") == 0) ecdsa_doit[R_EC_P192]=2;
+- else if (strcmp(*argv,"ecdsap224") == 0) ecdsa_doit[R_EC_P224]=2;
+- else if (strcmp(*argv,"ecdsap256") == 0) ecdsa_doit[R_EC_P256]=2;
++ if (strcmp(*argv,"ecdsap256") == 0) ecdsa_doit[R_EC_P256]=2;
+ else if (strcmp(*argv,"ecdsap384") == 0) ecdsa_doit[R_EC_P384]=2;
+- else if (strcmp(*argv,"ecdsap521") == 0) ecdsa_doit[R_EC_P521]=2;
+- else if (strcmp(*argv,"ecdsak163") == 0) ecdsa_doit[R_EC_K163]=2;
+- else if (strcmp(*argv,"ecdsak233") == 0) ecdsa_doit[R_EC_K233]=2;
+- else if (strcmp(*argv,"ecdsak283") == 0) ecdsa_doit[R_EC_K283]=2;
+- else if (strcmp(*argv,"ecdsak409") == 0) ecdsa_doit[R_EC_K409]=2;
+- else if (strcmp(*argv,"ecdsak571") == 0) ecdsa_doit[R_EC_K571]=2;
+- else if (strcmp(*argv,"ecdsab163") == 0) ecdsa_doit[R_EC_B163]=2;
+- else if (strcmp(*argv,"ecdsab233") == 0) ecdsa_doit[R_EC_B233]=2;
+- else if (strcmp(*argv,"ecdsab283") == 0) ecdsa_doit[R_EC_B283]=2;
+- else if (strcmp(*argv,"ecdsab409") == 0) ecdsa_doit[R_EC_B409]=2;
+- else if (strcmp(*argv,"ecdsab571") == 0) ecdsa_doit[R_EC_B571]=2;
+ else if (strcmp(*argv,"ecdsa") == 0)
+ {
+- for (i=0; i < EC_NUM; i++)
++ for (i=R_EC_P256; i <= R_EC_P384; i++)
+ ecdsa_doit[i]=1;
+ }
+ else
+ #endif
+ #ifndef OPENSSL_NO_ECDH
+- if (strcmp(*argv,"ecdhp160") == 0) ecdh_doit[R_EC_P160]=2;
+- else if (strcmp(*argv,"ecdhp192") == 0) ecdh_doit[R_EC_P192]=2;
+- else if (strcmp(*argv,"ecdhp224") == 0) ecdh_doit[R_EC_P224]=2;
+- else if (strcmp(*argv,"ecdhp256") == 0) ecdh_doit[R_EC_P256]=2;
++ if (strcmp(*argv,"ecdhp256") == 0) ecdh_doit[R_EC_P256]=2;
+ else if (strcmp(*argv,"ecdhp384") == 0) ecdh_doit[R_EC_P384]=2;
+- else if (strcmp(*argv,"ecdhp521") == 0) ecdh_doit[R_EC_P521]=2;
+- else if (strcmp(*argv,"ecdhk163") == 0) ecdh_doit[R_EC_K163]=2;
+- else if (strcmp(*argv,"ecdhk233") == 0) ecdh_doit[R_EC_K233]=2;
+- else if (strcmp(*argv,"ecdhk283") == 0) ecdh_doit[R_EC_K283]=2;
+- else if (strcmp(*argv,"ecdhk409") == 0) ecdh_doit[R_EC_K409]=2;
+- else if (strcmp(*argv,"ecdhk571") == 0) ecdh_doit[R_EC_K571]=2;
+- else if (strcmp(*argv,"ecdhb163") == 0) ecdh_doit[R_EC_B163]=2;
+- else if (strcmp(*argv,"ecdhb233") == 0) ecdh_doit[R_EC_B233]=2;
+- else if (strcmp(*argv,"ecdhb283") == 0) ecdh_doit[R_EC_B283]=2;
+- else if (strcmp(*argv,"ecdhb409") == 0) ecdh_doit[R_EC_B409]=2;
+- else if (strcmp(*argv,"ecdhb571") == 0) ecdh_doit[R_EC_B571]=2;
+ else if (strcmp(*argv,"ecdh") == 0)
+ {
+- for (i=0; i < EC_NUM; i++)
++ for (i=R_EC_P256; i <= R_EC_P384; i++)
+ ecdh_doit[i]=1;
+ }
+ else
+@@ -1097,15 +1069,11 @@ int MAIN(int argc, char **argv)
+ BIO_printf(bio_err,"dsa512 dsa1024 dsa2048\n");
+ #endif
+ #ifndef OPENSSL_NO_ECDSA
+- BIO_printf(bio_err,"ecdsap160 ecdsap192 ecdsap224 ecdsap256 ecdsap384 ecdsap521\n");
+- BIO_printf(bio_err,"ecdsak163 ecdsak233 ecdsak283 ecdsak409 ecdsak571\n");
+- BIO_printf(bio_err,"ecdsab163 ecdsab233 ecdsab283 ecdsab409 ecdsab571\n");
++ BIO_printf(bio_err,"ecdsap256 ecdsap384\n");
+ BIO_printf(bio_err,"ecdsa\n");
+ #endif
+ #ifndef OPENSSL_NO_ECDH
+- BIO_printf(bio_err,"ecdhp160 ecdhp192 ecdhp224 ecdhp256 ecdhp384 ecdhp521\n");
+- BIO_printf(bio_err,"ecdhk163 ecdhk233 ecdhk283 ecdhk409 ecdhk571\n");
+- BIO_printf(bio_err,"ecdhb163 ecdhb233 ecdhb283 ecdhb409 ecdhb571\n");
++ BIO_printf(bio_err,"ecdhp256 ecdhp384\n");
+ BIO_printf(bio_err,"ecdh\n");
+ #endif
+
+@@ -1184,11 +1152,11 @@ int MAIN(int argc, char **argv)
+ if (!FIPS_mode() || i != R_DSA_512)
+ dsa_doit[i]=1;
+ #ifndef OPENSSL_NO_ECDSA
+- for (i=0; i<EC_NUM; i++)
++ for (i=R_EC_P256; i <= R_EC_P384; i++)
+ ecdsa_doit[i]=1;
+ #endif
+ #ifndef OPENSSL_NO_ECDH
+- for (i=0; i<EC_NUM; i++)
++ for (i=R_EC_P256; i <= R_EC_P384; i++)
+ ecdh_doit[i]=1;
+ #endif
+ }
+diff -up openssl-1.0.1e/ssl/t1_lib.c.suiteb openssl-1.0.1e/ssl/t1_lib.c
+--- openssl-1.0.1e/ssl/t1_lib.c.suiteb 2013-02-11 16:26:04.000000000 +0100
++++ openssl-1.0.1e/ssl/t1_lib.c 2013-10-24 09:41:11.892179845 +0200
+@@ -204,31 +204,8 @@ static int nid_list[] =
+
+ static int pref_list[] =
+ {
+- NID_sect571r1, /* sect571r1 (14) */
+- NID_sect571k1, /* sect571k1 (13) */
+- NID_secp521r1, /* secp521r1 (25) */
+- NID_sect409k1, /* sect409k1 (11) */
+- NID_sect409r1, /* sect409r1 (12) */
+ NID_secp384r1, /* secp384r1 (24) */
+- NID_sect283k1, /* sect283k1 (9) */
+- NID_sect283r1, /* sect283r1 (10) */
+- NID_secp256k1, /* secp256k1 (22) */
+ NID_X9_62_prime256v1, /* secp256r1 (23) */
+- NID_sect239k1, /* sect239k1 (8) */
+- NID_sect233k1, /* sect233k1 (6) */
+- NID_sect233r1, /* sect233r1 (7) */
+- NID_secp224k1, /* secp224k1 (20) */
+- NID_secp224r1, /* secp224r1 (21) */
+- NID_sect193r1, /* sect193r1 (4) */
+- NID_sect193r2, /* sect193r2 (5) */
+- NID_secp192k1, /* secp192k1 (18) */
+- NID_X9_62_prime192v1, /* secp192r1 (19) */
+- NID_sect163k1, /* sect163k1 (1) */
+- NID_sect163r1, /* sect163r1 (2) */
+- NID_sect163r2, /* sect163r2 (3) */
+- NID_secp160k1, /* secp160k1 (15) */
+- NID_secp160r1, /* secp160r1 (16) */
+- NID_secp160r2, /* secp160r2 (17) */
+ };
+
+ int tls1_ec_curve_id2nid(int curve_id)
diff --git a/openssl-1.0.1e-speed-suiteb.patch b/openssl-1.0.1e-speed-suiteb.patch
deleted file mode 100644
index a5135d3..0000000
--- a/openssl-1.0.1e-speed-suiteb.patch
+++ /dev/null
@@ -1,89 +0,0 @@
-diff -up openssl-1.0.1e/apps/speed.c.suiteb openssl-1.0.1e/apps/speed.c
---- openssl-1.0.1e/apps/speed.c.suiteb 2013-09-27 15:57:09.947894307 +0200
-+++ openssl-1.0.1e/apps/speed.c 2013-09-27 15:57:52.528852804 +0200
-@@ -966,49 +966,21 @@ int MAIN(int argc, char **argv)
- else
- #endif
- #ifndef OPENSSL_NO_ECDSA
-- if (strcmp(*argv,"ecdsap160") == 0) ecdsa_doit[R_EC_P160]=2;
-- else if (strcmp(*argv,"ecdsap192") == 0) ecdsa_doit[R_EC_P192]=2;
-- else if (strcmp(*argv,"ecdsap224") == 0) ecdsa_doit[R_EC_P224]=2;
-- else if (strcmp(*argv,"ecdsap256") == 0) ecdsa_doit[R_EC_P256]=2;
-+ if (strcmp(*argv,"ecdsap256") == 0) ecdsa_doit[R_EC_P256]=2;
- else if (strcmp(*argv,"ecdsap384") == 0) ecdsa_doit[R_EC_P384]=2;
-- else if (strcmp(*argv,"ecdsap521") == 0) ecdsa_doit[R_EC_P521]=2;
-- else if (strcmp(*argv,"ecdsak163") == 0) ecdsa_doit[R_EC_K163]=2;
-- else if (strcmp(*argv,"ecdsak233") == 0) ecdsa_doit[R_EC_K233]=2;
-- else if (strcmp(*argv,"ecdsak283") == 0) ecdsa_doit[R_EC_K283]=2;
-- else if (strcmp(*argv,"ecdsak409") == 0) ecdsa_doit[R_EC_K409]=2;
-- else if (strcmp(*argv,"ecdsak571") == 0) ecdsa_doit[R_EC_K571]=2;
-- else if (strcmp(*argv,"ecdsab163") == 0) ecdsa_doit[R_EC_B163]=2;
-- else if (strcmp(*argv,"ecdsab233") == 0) ecdsa_doit[R_EC_B233]=2;
-- else if (strcmp(*argv,"ecdsab283") == 0) ecdsa_doit[R_EC_B283]=2;
-- else if (strcmp(*argv,"ecdsab409") == 0) ecdsa_doit[R_EC_B409]=2;
-- else if (strcmp(*argv,"ecdsab571") == 0) ecdsa_doit[R_EC_B571]=2;
- else if (strcmp(*argv,"ecdsa") == 0)
- {
-- for (i=0; i < EC_NUM; i++)
-+ for (i=R_EC_P256; i <= R_EC_P384; i++)
- ecdsa_doit[i]=1;
- }
- else
- #endif
- #ifndef OPENSSL_NO_ECDH
-- if (strcmp(*argv,"ecdhp160") == 0) ecdh_doit[R_EC_P160]=2;
-- else if (strcmp(*argv,"ecdhp192") == 0) ecdh_doit[R_EC_P192]=2;
-- else if (strcmp(*argv,"ecdhp224") == 0) ecdh_doit[R_EC_P224]=2;
-- else if (strcmp(*argv,"ecdhp256") == 0) ecdh_doit[R_EC_P256]=2;
-+ if (strcmp(*argv,"ecdhp256") == 0) ecdh_doit[R_EC_P256]=2;
- else if (strcmp(*argv,"ecdhp384") == 0) ecdh_doit[R_EC_P384]=2;
-- else if (strcmp(*argv,"ecdhp521") == 0) ecdh_doit[R_EC_P521]=2;
-- else if (strcmp(*argv,"ecdhk163") == 0) ecdh_doit[R_EC_K163]=2;
-- else if (strcmp(*argv,"ecdhk233") == 0) ecdh_doit[R_EC_K233]=2;
-- else if (strcmp(*argv,"ecdhk283") == 0) ecdh_doit[R_EC_K283]=2;
-- else if (strcmp(*argv,"ecdhk409") == 0) ecdh_doit[R_EC_K409]=2;
-- else if (strcmp(*argv,"ecdhk571") == 0) ecdh_doit[R_EC_K571]=2;
-- else if (strcmp(*argv,"ecdhb163") == 0) ecdh_doit[R_EC_B163]=2;
-- else if (strcmp(*argv,"ecdhb233") == 0) ecdh_doit[R_EC_B233]=2;
-- else if (strcmp(*argv,"ecdhb283") == 0) ecdh_doit[R_EC_B283]=2;
-- else if (strcmp(*argv,"ecdhb409") == 0) ecdh_doit[R_EC_B409]=2;
-- else if (strcmp(*argv,"ecdhb571") == 0) ecdh_doit[R_EC_B571]=2;
- else if (strcmp(*argv,"ecdh") == 0)
- {
-- for (i=0; i < EC_NUM; i++)
-+ for (i=R_EC_P256; i <= R_EC_P384; i++)
- ecdh_doit[i]=1;
- }
- else
-@@ -1097,15 +1069,11 @@ int MAIN(int argc, char **argv)
- BIO_printf(bio_err,"dsa512 dsa1024 dsa2048\n");
- #endif
- #ifndef OPENSSL_NO_ECDSA
-- BIO_printf(bio_err,"ecdsap160 ecdsap192 ecdsap224 ecdsap256 ecdsap384 ecdsap521\n");
-- BIO_printf(bio_err,"ecdsak163 ecdsak233 ecdsak283 ecdsak409 ecdsak571\n");
-- BIO_printf(bio_err,"ecdsab163 ecdsab233 ecdsab283 ecdsab409 ecdsab571\n");
-+ BIO_printf(bio_err,"ecdsap256 ecdsap384\n");
- BIO_printf(bio_err,"ecdsa\n");
- #endif
- #ifndef OPENSSL_NO_ECDH
-- BIO_printf(bio_err,"ecdhp160 ecdhp192 ecdhp224 ecdhp256 ecdhp384 ecdhp521\n");
-- BIO_printf(bio_err,"ecdhk163 ecdhk233 ecdhk283 ecdhk409 ecdhk571\n");
-- BIO_printf(bio_err,"ecdhb163 ecdhb233 ecdhb283 ecdhb409 ecdhb571\n");
-+ BIO_printf(bio_err,"ecdhp256 ecdhp384\n");
- BIO_printf(bio_err,"ecdh\n");
- #endif
-
-@@ -1181,11 +1149,11 @@ int MAIN(int argc, char **argv)
- if (!FIPS_mode() || i != R_DSA_512)
- dsa_doit[i]=1;
- #ifndef OPENSSL_NO_ECDSA
-- for (i=0; i<EC_NUM; i++)
-+ for (i=R_EC_P256; i <= R_EC_P384; i++)
- ecdsa_doit[i]=1;
- #endif
- #ifndef OPENSSL_NO_ECDH
-- for (i=0; i<EC_NUM; i++)
-+ for (i=R_EC_P256; i <= R_EC_P384; i++)
- ecdh_doit[i]=1;
- #endif
- }
diff --git a/openssl.spec b/openssl.spec
index bd655d2..a843a76 100644
--- a/openssl.spec
+++ b/openssl.spec
@@ -21,7 +21,7 @@
Summary: Utilities from the general purpose cryptography library with TLS implementation
Name: openssl
Version: 1.0.1e
-Release: 28%{?dist}
+Release: 29%{?dist}
Epoch: 1
# We have to remove certain patented algorithms from the openssl source
# tarball with the hobble-openssl script which is included below.
@@ -73,7 +73,7 @@ Patch69: openssl-1.0.1c-dh-1024.patch
Patch70: openssl-1.0.1e-fips-ec.patch
Patch71: openssl-1.0.1e-manfix.patch
Patch72: openssl-1.0.1e-fips-ctor.patch
-Patch73: openssl-1.0.1e-speed-suiteb.patch
+Patch73: openssl-1.0.1e-ecc-suiteb.patch
# Backported fixes including security fixes
Patch81: openssl-1.0.1-beta2-padlock64.patch
Patch82: openssl-1.0.1e-backports.patch
@@ -456,6 +456,9 @@ rm -rf $RPM_BUILD_ROOT/%{_libdir}/fipscanister.*
%postun libs -p /sbin/ldconfig
%changelog
+* Thu Oct 24 2013 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-29
+- do not advertise ECC curves we do not support (#1022493)
+
* Wed Oct 16 2013 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-28
- only ECC NIST Suite B curves support
- drop -fips subpackage
reply other threads:[~2026-06-09 12:43 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=178100898705.1.15880147449591540367.rpms-openssl-eca676db7ab5@fedoraproject.org \
--to=tmraz@fedoraproject.org \
--cc=git-commits@fedoraproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox