[rpms/openssl] rebase_40beta: drop weak ciphers from the default TLS ciphersuite list

[rpms/openssl] rebase_40beta: drop weak ciphers from the default TLS ciphersuite list

[Tomas Mraz]

            A new commit has been pushed.

            Repo   : rpms/openssl
            Branch : rebase_40beta
            Commit : dc728e2d8bdb640557032ec02ab55abc9f4fc702
            Author : Tomas Mraz <tmraz@fedoraproject.org>
            Date   : 2013-12-18T15:55:26+01:00
            Stats  : +264/-17 in 4 file(s)
            URL    : https://src.fedoraproject.org/rpms/openssl/c/dc728e2d8bdb640557032ec02ab55abc9f4fc702?branch=rebase_40beta

            Log:
            drop weak ciphers from the default TLS ciphersuite list

- add back some symbols that were dropped with update to 1.0.1 branch
- more FIPS validation requirement changes

---
diff --git a/openssl-1.0.1e-compat-symbols.patch b/openssl-1.0.1e-compat-symbols.patch
new file mode 100644
index 0000000..25a9d02
--- /dev/null
+++ b/openssl-1.0.1e-compat-symbols.patch
@@ -0,0 +1,46 @@
+diff -up openssl-1.0.1e/crypto/dsa/dsa_key.c.compat openssl-1.0.1e/crypto/dsa/dsa_key.c
+--- openssl-1.0.1e/crypto/dsa/dsa_key.c.compat	2013-11-26 14:36:35.000000000 +0100
++++ openssl-1.0.1e/crypto/dsa/dsa_key.c	2013-12-11 16:34:58.638549687 +0100
+@@ -68,6 +68,11 @@
+ #include <openssl/fips.h>
+ #include <openssl/evp.h>
+ 
++/* just a compatibility symbol - no-op */
++void FIPS_corrupt_dsa_keygen(void)
++	{
++	}
++
+ static int fips_check_dsa(DSA *dsa)
+ 	{
+ 	EVP_PKEY *pk;
+diff -up openssl-1.0.1e/crypto/engine/eng_all.c.compat openssl-1.0.1e/crypto/engine/eng_all.c
+--- openssl-1.0.1e/crypto/engine/eng_all.c.compat	2013-11-26 14:36:35.000000000 +0100
++++ openssl-1.0.1e/crypto/engine/eng_all.c	2013-12-11 16:32:13.512820424 +0100
+@@ -62,6 +62,11 @@
+ #include <openssl/fips.h>
+ #endif
+ 
++/* just backwards compatibility symbol - no-op */
++void ENGINE_load_aesni (void)
++{
++}
++
+ void ENGINE_load_builtin_engines(void)
+ 	{
+ 	/* Some ENGINEs need this */
+diff -up openssl-1.0.1e/crypto/fips/fips.c.compat openssl-1.0.1e/crypto/fips/fips.c
+--- openssl-1.0.1e/crypto/fips/fips.c.compat	2013-11-26 14:36:35.000000000 +0100
++++ openssl-1.0.1e/crypto/fips/fips.c	2013-12-11 16:38:52.524831858 +0100
+@@ -111,6 +111,12 @@ int FIPS_module_mode(void)
+ 	return ret;
+ 	}
+ 
++/* just a compat symbol - return NULL */
++const void *FIPS_rand_check(void)
++	{
++	return NULL;
++	}
++
+ int FIPS_selftest_failed(void)
+     {
+     int ret = 0;

diff --git a/openssl-1.0.1e-new-fips-reqs.patch b/openssl-1.0.1e-new-fips-reqs.patch
index cdc042b..d438490 100644
--- a/openssl-1.0.1e-new-fips-reqs.patch
+++ b/openssl-1.0.1e-new-fips-reqs.patch
@@ -1,6 +1,131 @@
+diff -up openssl-1.0.1e/crypto/bn/bn.h.fips-reqs openssl-1.0.1e/crypto/bn/bn.h
+--- openssl-1.0.1e/crypto/bn/bn.h.fips-reqs	2013-11-26 14:36:35.000000000 +0100
++++ openssl-1.0.1e/crypto/bn/bn.h	2013-12-13 11:58:58.623821669 +0100
+@@ -386,9 +386,11 @@ int BN_GENCB_call(BN_GENCB *cb, int a, i
+  * of Applied Cryptography [Menezes, van Oorschot, Vanstone; CRC Press 1996];
+  * original paper: Damgaard, Landrock, Pomerance: Average case error estimates
+  * for the strong probable prime test. -- Math. Comp. 61 (1993) 177-194) */
+-#define BN_prime_checks_for_size(b) ((b) >= 1300 ?  2 : \
+-                                (b) >=  850 ?  3 : \
+-                                (b) >=  650 ?  4 : \
++/* FIPS 186-4 specifies error rate given the security strength of the
++ * resulting RSA key bit size. So the error rate is 2^-112 or 2^-128 for
++ * 1024 and 1536 bit keys.
++ */
++#define BN_prime_checks_for_size(b) ((b) >= 1300 ?  4 : \
+                                 (b) >=  550 ?  5 : \
+                                 (b) >=  450 ?  6 : \
+                                 (b) >=  400 ?  7 : \
+diff -up openssl-1.0.1e/crypto/dh/dh_gen.c.fips-reqs openssl-1.0.1e/crypto/dh/dh_gen.c
+--- openssl-1.0.1e/crypto/dh/dh_gen.c.fips-reqs	2013-11-26 14:36:35.000000000 +0100
++++ openssl-1.0.1e/crypto/dh/dh_gen.c	2013-12-11 16:50:54.181130000 +0100
+@@ -125,7 +125,7 @@ static int dh_builtin_genparams(DH *ret,
+ 		return 0;
+ 		}
+ 
+-	if (FIPS_mode() && (prime_len < OPENSSL_DH_FIPS_MIN_MODULUS_BITS))
++	if (FIPS_mode() && (prime_len < OPENSSL_DH_FIPS_MIN_MODULUS_BITS_GEN))
+ 		{
+ 		DHerr(DH_F_DH_BUILTIN_GENPARAMS, DH_R_KEY_SIZE_TOO_SMALL);
+ 		goto err;
+diff -up openssl-1.0.1e/crypto/dh/dh.h.fips-reqs openssl-1.0.1e/crypto/dh/dh.h
+--- openssl-1.0.1e/crypto/dh/dh.h.fips-reqs	2013-11-26 14:36:35.000000000 +0100
++++ openssl-1.0.1e/crypto/dh/dh.h	2013-12-11 16:51:18.345675737 +0100
+@@ -78,6 +78,7 @@
+ #endif
+ 
+ #define OPENSSL_DH_FIPS_MIN_MODULUS_BITS 1024
++#define OPENSSL_DH_FIPS_MIN_MODULUS_BITS_GEN 2048
+ 
+ #define DH_FLAG_CACHE_MONT_P     0x01
+ #define DH_FLAG_NO_EXP_CONSTTIME 0x02 /* new with 0.9.7h; the built-in DH
+diff -up openssl-1.0.1e/crypto/dh/dh_check.c.fips-reqs openssl-1.0.1e/crypto/dh/dh_check.c
+--- openssl-1.0.1e/crypto/dh/dh_check.c.fips-reqs	2013-02-11 16:26:04.000000000 +0100
++++ openssl-1.0.1e/crypto/dh/dh_check.c	2013-12-11 18:02:26.759075219 +0100
+@@ -134,7 +134,33 @@ int DH_check_pub_key(const DH *dh, const
+ 	BN_sub_word(q,1);
+ 	if (BN_cmp(pub_key,q)>=0)
+ 		*ret|=DH_CHECK_PUBKEY_TOO_LARGE;
++#ifdef OPENSSL_FIPS
++	if (FIPS_mode())
++		{
++		BN_CTX *ctx = NULL;
+ 
++		ctx = BN_CTX_new();
++		if (ctx == NULL)
++			goto err;
++
++		if (BN_mod_exp_mont(q, pub_key, dh->q, dh->p, ctx, NULL) <= 0)
++			{
++			BN_CTX_free(ctx);
++			goto err;
++			}
++		if (!BN_is_one(q))
++			{
++			/* it would be more correct to add new return flag 
++			 * for this test, but we do not want to do it
++			 * so just error out
++			 */
++			BN_CTX_free(ctx);
++			goto err;
++			}
++		
++		BN_CTX_free(ctx);
++		}
++#endif
+ 	ok = 1;
+ err:
+ 	if (q != NULL) BN_free(q);
+diff -up openssl-1.0.1e/crypto/dsa/dsa_gen.c.fips-reqs openssl-1.0.1e/crypto/dsa/dsa_gen.c
+--- openssl-1.0.1e/crypto/dsa/dsa_gen.c.fips-reqs	2013-11-26 14:36:35.000000000 +0100
++++ openssl-1.0.1e/crypto/dsa/dsa_gen.c	2013-12-11 16:47:25.882425812 +0100
+@@ -159,7 +159,6 @@ int dsa_builtin_paramgen(DSA *ret, size_
+ 	    }
+ 
+ 	if (FIPS_module_mode() &&
+-	    (bits != 1024 || qbits != 160) &&
+ 	    (bits != 2048 || qbits != 224) &&
+ 	    (bits != 2048 || qbits != 256) &&
+ 	    (bits != 3072 || qbits != 256))
+diff -up openssl-1.0.1e/crypto/dsa/dsa.h.fips-reqs openssl-1.0.1e/crypto/dsa/dsa.h
+--- openssl-1.0.1e/crypto/dsa/dsa.h.fips-reqs	2013-11-26 14:36:35.000000000 +0100
++++ openssl-1.0.1e/crypto/dsa/dsa.h	2013-12-13 11:53:04.637827187 +0100
+@@ -89,6 +89,7 @@
+ #endif
+ 
+ #define OPENSSL_DSA_FIPS_MIN_MODULUS_BITS 1024
++#define OPENSSL_DSA_FIPS_MIN_MODULUS_BITS_GEN 2048
+ 
+ #define DSA_FLAG_CACHE_MONT_P	0x01
+ #define DSA_FLAG_NO_EXP_CONSTTIME       0x02 /* new with 0.9.7h; the built-in DSA
+@@ -254,9 +255,9 @@ int	DSAparams_print_fp(FILE *fp, const D
+ int	DSA_print_fp(FILE *bp, const DSA *x, int off);
+ #endif
+ 
+-#define DSS_prime_checks 50
+-/* Primality test according to FIPS PUB 186[-1], Appendix 2.1:
+- * 50 rounds of Rabin-Miller */
++#define DSS_prime_checks 64
++/* Primality test according to FIPS PUB 186[-4], Appendix 2.1:
++ * 64 rounds of Rabin-Miller */
+ #define DSA_is_prime(n, callback, cb_arg) \
+ 	BN_is_prime(n, DSS_prime_checks, callback, NULL, cb_arg)
+ 
+diff -up openssl-1.0.1e/crypto/dsa/dsa_key.c.fips-reqs openssl-1.0.1e/crypto/dsa/dsa_key.c
+--- openssl-1.0.1e/crypto/dsa/dsa_key.c.fips-reqs	2013-12-11 16:34:58.000000000 +0100
++++ openssl-1.0.1e/crypto/dsa/dsa_key.c	2013-12-11 16:47:57.815146894 +0100
+@@ -127,7 +127,7 @@ static int dsa_builtin_keygen(DSA *dsa)
+ 
+ #ifdef OPENSSL_FIPS
+ 	if (FIPS_mode() && !(dsa->flags & DSA_FLAG_NON_FIPS_ALLOW)
+-		&& (BN_num_bits(dsa->p) < OPENSSL_DSA_FIPS_MIN_MODULUS_BITS))
++		&& (BN_num_bits(dsa->p) < OPENSSL_DSA_FIPS_MIN_MODULUS_BITS_GEN))
+ 		{
+ 		DSAerr(DSA_F_DSA_BUILTIN_KEYGEN, DSA_R_KEY_SIZE_TOO_SMALL);
+ 		goto err;
 diff -up openssl-1.0.1e/crypto/fips/fips_drbg_rand.c.fips-reqs openssl-1.0.1e/crypto/fips/fips_drbg_rand.c
---- openssl-1.0.1e/crypto/fips/fips_drbg_rand.c.fips-reqs	2013-11-15 16:54:49.000000000 +0100
-+++ openssl-1.0.1e/crypto/fips/fips_drbg_rand.c	2013-11-19 14:48:38.935251819 +0100
+--- openssl-1.0.1e/crypto/fips/fips_drbg_rand.c.fips-reqs	2013-11-26 14:36:35.551708593 +0100
++++ openssl-1.0.1e/crypto/fips/fips_drbg_rand.c	2013-11-26 14:36:35.601709689 +0100
 @@ -77,7 +77,8 @@ static int fips_drbg_bytes(unsigned char
  	int rv = 0;
  	unsigned char *adin = NULL;
@@ -50,8 +175,8 @@ diff -up openssl-1.0.1e/crypto/fips/fips_drbg_rand.c.fips-reqs openssl-1.0.1e/cr
  	}
  
 diff -up openssl-1.0.1e/crypto/fips/fips_rsa_selftest.c.fips-reqs openssl-1.0.1e/crypto/fips/fips_rsa_selftest.c
---- openssl-1.0.1e/crypto/fips/fips_rsa_selftest.c.fips-reqs	2013-11-15 16:54:49.390224209 +0100
-+++ openssl-1.0.1e/crypto/fips/fips_rsa_selftest.c	2013-11-15 16:54:49.427225021 +0100
+--- openssl-1.0.1e/crypto/fips/fips_rsa_selftest.c.fips-reqs	2013-11-26 14:36:35.555708680 +0100
++++ openssl-1.0.1e/crypto/fips/fips_rsa_selftest.c	2013-11-26 14:36:35.601709689 +0100
 @@ -340,6 +340,42 @@ static const unsigned char kat_RSA_X931_
    0x60, 0x83, 0x18, 0x88, 0xA3, 0xF5, 0x59, 0xC3
  };
@@ -123,7 +248,7 @@ diff -up openssl-1.0.1e/crypto/fips/fips_rsa_selftest.c.fips-reqs openssl-1.0.1e
  	}
 diff -up openssl-1.0.1e/crypto/modes/gcm128.c.fips-reqs openssl-1.0.1e/crypto/modes/gcm128.c
 --- openssl-1.0.1e/crypto/modes/gcm128.c.fips-reqs	2013-02-11 16:26:04.000000000 +0100
-+++ openssl-1.0.1e/crypto/modes/gcm128.c	2013-11-15 16:54:49.427225021 +0100
++++ openssl-1.0.1e/crypto/modes/gcm128.c	2013-11-26 14:36:35.601709689 +0100
 @@ -898,6 +898,10 @@ int CRYPTO_gcm128_encrypt(GCM128_CONTEXT
  # endif
  #endif
@@ -147,8 +272,8 @@ diff -up openssl-1.0.1e/crypto/modes/gcm128.c.fips-reqs openssl-1.0.1e/crypto/mo
  	if (mlen>((U64(1)<<36)-32) || (sizeof(len)==8 && mlen<len))
  		return -1;
 diff -up openssl-1.0.1e/crypto/modes/modes_lcl.h.fips-reqs openssl-1.0.1e/crypto/modes/modes_lcl.h
---- openssl-1.0.1e/crypto/modes/modes_lcl.h.fips-reqs	2013-11-15 16:54:48.995215544 +0100
-+++ openssl-1.0.1e/crypto/modes/modes_lcl.h	2013-11-15 16:54:49.427225021 +0100
+--- openssl-1.0.1e/crypto/modes/modes_lcl.h.fips-reqs	2013-11-26 14:36:35.089698458 +0100
++++ openssl-1.0.1e/crypto/modes/modes_lcl.h	2013-11-26 14:36:35.601709689 +0100
 @@ -115,6 +115,7 @@ struct gcm128_context {
  	unsigned int mres, ares;
  	block128_f block;
@@ -158,8 +283,8 @@ diff -up openssl-1.0.1e/crypto/modes/modes_lcl.h.fips-reqs openssl-1.0.1e/crypto
  
  struct xts128_context {
 diff -up openssl-1.0.1e/crypto/rand/md_rand.c.fips-reqs openssl-1.0.1e/crypto/rand/md_rand.c
---- openssl-1.0.1e/crypto/rand/md_rand.c.fips-reqs	2013-11-15 16:54:49.000000000 +0100
-+++ openssl-1.0.1e/crypto/rand/md_rand.c	2013-11-19 14:43:00.592829775 +0100
+--- openssl-1.0.1e/crypto/rand/md_rand.c.fips-reqs	2013-11-26 14:36:35.557708724 +0100
++++ openssl-1.0.1e/crypto/rand/md_rand.c	2013-11-26 14:36:35.602709711 +0100
 @@ -143,12 +143,6 @@ static long md_count[2]={0,0};
  static double entropy=0;
  static int initialized=0;
@@ -333,8 +458,8 @@ diff -up openssl-1.0.1e/crypto/rand/md_rand.c.fips-reqs openssl-1.0.1e/crypto/ra
  	return ret;
  	}
 diff -up openssl-1.0.1e/crypto/rand/rand.h.fips-reqs openssl-1.0.1e/crypto/rand/rand.h
---- openssl-1.0.1e/crypto/rand/rand.h.fips-reqs	2013-11-19 14:32:25.182891113 +0100
-+++ openssl-1.0.1e/crypto/rand/rand.h	2013-11-19 14:32:03.546416472 +0100
+--- openssl-1.0.1e/crypto/rand/rand.h.fips-reqs	2013-11-26 14:36:35.558708746 +0100
++++ openssl-1.0.1e/crypto/rand/rand.h	2013-11-26 14:36:35.602709711 +0100
 @@ -124,6 +124,8 @@ void RAND_set_fips_drbg_type(int type, i
  int RAND_init_fips(void);
  #endif
@@ -345,8 +470,8 @@ diff -up openssl-1.0.1e/crypto/rand/rand.h.fips-reqs openssl-1.0.1e/crypto/rand/
  /* The following lines are auto generated by the script mkerr.pl. Any changes
   * made after this point may be overwritten when the script is next run.
 diff -up openssl-1.0.1e/crypto/rand/rand_lcl.h.fips-reqs openssl-1.0.1e/crypto/rand/rand_lcl.h
---- openssl-1.0.1e/crypto/rand/rand_lcl.h.fips-reqs	2013-11-15 16:54:49.122218330 +0100
-+++ openssl-1.0.1e/crypto/rand/rand_lcl.h	2013-11-15 16:54:49.427225021 +0100
+--- openssl-1.0.1e/crypto/rand/rand_lcl.h.fips-reqs	2013-11-26 14:36:35.239701748 +0100
++++ openssl-1.0.1e/crypto/rand/rand_lcl.h	2013-11-26 14:36:35.602709711 +0100
 @@ -112,7 +112,7 @@
  #ifndef HEADER_RAND_LCL_H
  #define HEADER_RAND_LCL_H
@@ -358,7 +483,7 @@ diff -up openssl-1.0.1e/crypto/rand/rand_lcl.h.fips-reqs openssl-1.0.1e/crypto/r
  #if !defined(USE_MD5_RAND) && !defined(USE_SHA1_RAND) && !defined(USE_MDC2_RAND) && !defined(USE_MD2_RAND)
 diff -up openssl-1.0.1e/crypto/rand/rand_lib.c.fips-reqs openssl-1.0.1e/crypto/rand/rand_lib.c
 --- openssl-1.0.1e/crypto/rand/rand_lib.c.fips-reqs	2013-02-11 16:26:04.000000000 +0100
-+++ openssl-1.0.1e/crypto/rand/rand_lib.c	2013-11-19 14:44:22.422624833 +0100
++++ openssl-1.0.1e/crypto/rand/rand_lib.c	2013-11-26 14:36:35.602709711 +0100
 @@ -181,6 +181,41 @@ int RAND_status(void)
  	return 0;
  	}
@@ -416,3 +541,58 @@ diff -up openssl-1.0.1e/crypto/rand/rand_lib.c.fips-reqs openssl-1.0.1e/crypto/r
  	return 1;
  	}
  
+diff -up openssl-1.0.1e/crypto/rsa/rsa_gen.c.fips-reqs openssl-1.0.1e/crypto/rsa/rsa_gen.c
+--- openssl-1.0.1e/crypto/rsa/rsa_gen.c.fips-reqs	2013-11-26 14:36:35.000000000 +0100
++++ openssl-1.0.1e/crypto/rsa/rsa_gen.c	2013-12-11 16:45:18.661552527 +0100
+@@ -182,7 +182,7 @@ static int rsa_builtin_keygen(RSA *rsa,
+ 	    	return 0;
+ 	    	}
+ 
+-		if (bits < OPENSSL_RSA_FIPS_MIN_MODULUS_BITS)
++		if (bits < OPENSSL_RSA_FIPS_MIN_MODULUS_BITS_GEN)
+ 		    {
+ 		    FIPSerr(FIPS_F_RSA_BUILTIN_KEYGEN,FIPS_R_KEY_TOO_SHORT);
+ 		    return 0;
+diff -up openssl-1.0.1e/crypto/rsa/rsa.h.fips-reqs openssl-1.0.1e/crypto/rsa/rsa.h
+--- openssl-1.0.1e/crypto/rsa/rsa.h.fips-reqs	2013-11-26 14:36:35.000000000 +0100
++++ openssl-1.0.1e/crypto/rsa/rsa.h	2013-12-11 16:45:05.937265150 +0100
+@@ -166,6 +166,8 @@ struct rsa_st
+ 
+ #define OPENSSL_RSA_FIPS_MIN_MODULUS_BITS 1024
+ 
++#define OPENSSL_RSA_FIPS_MIN_MODULUS_BITS_GEN 2048
++
+ #ifndef OPENSSL_RSA_SMALL_MODULUS_BITS
+ # define OPENSSL_RSA_SMALL_MODULUS_BITS	3072
+ #endif
+diff -up openssl-1.0.1e/ssl/t1_enc.c.fips-reqs openssl-1.0.1e/ssl/t1_enc.c
+--- openssl-1.0.1e/ssl/t1_enc.c.fips-reqs	2013-02-11 16:26:04.000000000 +0100
++++ openssl-1.0.1e/ssl/t1_enc.c	2013-11-26 14:36:35.603709733 +0100
+@@ -291,6 +291,27 @@ static int tls1_PRF(long digest_mask,
+ err:
+ 	return ret;
+ }
++
++int private_tls1_PRF(long digest_mask,
++		     const void *seed1, int seed1_len,
++		     const void *seed2, int seed2_len,
++		     const void *seed3, int seed3_len,
++		     const void *seed4, int seed4_len,
++		     const void *seed5, int seed5_len,
++		     const unsigned char *sec, int slen,
++		     unsigned char *out1,
++		     unsigned char *out2, int olen)
++	{
++	return tls1_PRF(digest_mask,
++		seed1, seed1_len,
++		seed2, seed2_len,
++		seed3, seed3_len,
++		seed4, seed4_len,
++		seed5, seed5_len,
++		sec, slen,
++		out1, out2, olen);
++	}
++
+ static int tls1_generate_key_block(SSL *s, unsigned char *km,
+ 	     unsigned char *tmp, int num)
+ 	{

diff --git a/openssl-1.0.1e-weak-ciphers.patch b/openssl-1.0.1e-weak-ciphers.patch
new file mode 100644
index 0000000..8657345
--- /dev/null
+++ b/openssl-1.0.1e-weak-ciphers.patch
@@ -0,0 +1,12 @@
+diff -up openssl-1.0.1e/ssl/ssl.h.weak-ciphers openssl-1.0.1e/ssl/ssl.h
+--- openssl-1.0.1e/ssl/ssl.h.weak-ciphers	2013-12-18 15:50:40.881620314 +0100
++++ openssl-1.0.1e/ssl/ssl.h	2013-12-18 14:25:25.596566704 +0100
+@@ -331,7 +331,7 @@ extern "C" {
+ /* The following cipher list is used by default.
+  * It also is substituted when an application-defined cipher list string
+  * starts with 'DEFAULT'. */
+-#define SSL_DEFAULT_CIPHER_LIST	"ALL:!aNULL:!eNULL:!SSLv2"
++#define SSL_DEFAULT_CIPHER_LIST	"ALL:!aNULL:!eNULL:!SSLv2:!EXPORT:!RC2:!DES"
+ /* As of OpenSSL 1.0.0, ssl_create_cipher_list() in ssl/ssl_ciph.c always
+  * starts with a reasonable order, and all we have to do for DEFAULT is
+  * throwing out anonymous and unencrypted ciphersuites!

diff --git a/openssl.spec b/openssl.spec
index 3490af4..1964920 100644
--- a/openssl.spec
+++ b/openssl.spec
@@ -21,7 +21,7 @@
 Summary: Utilities from the general purpose cryptography library with TLS implementation
 Name: openssl
 Version: 1.0.1e
-Release: 34%{?dist}
+Release: 35%{?dist}
 Epoch: 1
 # We have to remove certain patented algorithms from the openssl source
 # tarball with the hobble-openssl script which is included below.
@@ -75,7 +75,9 @@ Patch71: openssl-1.0.1e-manfix.patch
 Patch72: openssl-1.0.1e-fips-ctor.patch
 Patch73: openssl-1.0.1e-ecc-suiteb.patch
 Patch74: openssl-1.0.1e-no-md5-verify.patch
-Patch75: openssl-1.0.1e-new-fips-reqs.patch
+Patch75: openssl-1.0.1e-compat-symbols.patch
+Patch76: openssl-1.0.1e-new-fips-reqs.patch
+Patch77: openssl-1.0.1e-weak-ciphers.patch
 # Backported fixes including security fixes
 Patch81: openssl-1.0.1-beta2-padlock64.patch
 Patch82: openssl-1.0.1e-backports.patch
@@ -191,7 +193,9 @@ cp %{SOURCE12} %{SOURCE13} crypto/ec/
 %patch72 -p1 -b .fips-ctor
 %patch73 -p1 -b .suiteb
 %patch74 -p1 -b .no-md5-verify
-%patch75 -p1 -b .fips-reqs
+%patch75 -p1 -b .compat
+%patch76 -p1 -b .fips-reqs
+%patch77 -p1 -b .weak-ciphers
 
 %patch81 -p1 -b .padlock64
 %patch82 -p1 -b .backports
@@ -462,6 +466,11 @@ rm -rf $RPM_BUILD_ROOT/%{_libdir}/fipscanister.*
 %postun libs -p /sbin/ldconfig
 
 %changelog
+* Wed Dec 18 2013 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-35
+- drop weak ciphers from the default TLS ciphersuite list
+- add back some symbols that were dropped with update to 1.0.1 branch
+- more FIPS validation requirement changes
+
 * Tue Nov 19 2013 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-34
 - fix locking and reseeding problems with FIPS drbg