public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
* [rpms/openssl] rebase_40beta: Backport patches to fix external providers compatibility issues
@ 2026-06-09 12:45 Simo Sorce
0 siblings, 0 replies; only message in thread
From: Simo Sorce @ 2026-06-09 12:45 UTC (permalink / raw)
To: git-commits
A new commit has been pushed.
Repo : rpms/openssl
Branch : rebase_40beta
Commit : e9a051193338320cfd00dfe44efbaa174bf0522f
Author : Simo Sorce <simo@redhat.com>
Date : 2022-11-16T14:27:12-05:00
Stats : +756/-2 in 7 file(s)
URL : https://src.fedoraproject.org/rpms/openssl/c/e9a051193338320cfd00dfe44efbaa174bf0522f?branch=rebase_40beta
Log:
Backport patches to fix external providers compatibility issues
---
diff --git a/.gitignore b/.gitignore
index 45b4c39..57006f1 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,6 +1,5 @@
.build*.log
clog
-000*.patch
*.src.rpm
openssl-1.0.0a-usa.tar.bz2
/openssl-1.0.0b-usa.tar.bz2
diff --git a/0081-EVP_PKEY_eq-regain-compatibility-with-the-3.0.0-FIPS.patch b/0081-EVP_PKEY_eq-regain-compatibility-with-the-3.0.0-FIPS.patch
new file mode 100644
index 0000000..660b237
--- /dev/null
+++ b/0081-EVP_PKEY_eq-regain-compatibility-with-the-3.0.0-FIPS.patch
@@ -0,0 +1,41 @@
+From c342004e07fd2c03a672f79353d13554fe0ffdaf Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Mr=C3=A1z?= <tomas@openssl.org>
+Date: Tue, 13 Sep 2022 14:37:05 +1000
+Subject: [PATCH] EVP_PKEY_eq: regain compatibility with the 3.0.0 FIPS
+ provider
+
+Reviewed-by: Matt Caswell <matt@openssl.org>
+Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
+Reviewed-by: Paul Dale <pauli@openssl.org>
+(Merged from https://github.com/openssl/openssl/pull/19201)
+---
+ crypto/evp/p_lib.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/crypto/evp/p_lib.c b/crypto/evp/p_lib.c
+index 170cb89cb0..c8c342b3e9 100644
+--- a/crypto/evp/p_lib.c
++++ b/crypto/evp/p_lib.c
+@@ -339,9 +339,16 @@ int EVP_PKEY_eq(const EVP_PKEY *a, const EVP_PKEY *b)
+ if (a == NULL || b == NULL)
+ return 0;
+
+- if (a->keymgmt != NULL || b->keymgmt != NULL)
+- return evp_pkey_cmp_any(a, b, (SELECT_PARAMETERS
+- | OSSL_KEYMGMT_SELECT_KEYPAIR));
++ if (a->keymgmt != NULL || b->keymgmt != NULL) {
++ int selection = SELECT_PARAMETERS;
++
++ if (evp_keymgmt_util_has((EVP_PKEY *)a, OSSL_KEYMGMT_SELECT_PUBLIC_KEY)
++ && evp_keymgmt_util_has((EVP_PKEY *)b, OSSL_KEYMGMT_SELECT_PUBLIC_KEY))
++ selection |= OSSL_KEYMGMT_SELECT_PUBLIC_KEY;
++ else
++ selection |= OSSL_KEYMGMT_SELECT_KEYPAIR;
++ return evp_pkey_cmp_any(a, b, selection);
++ }
+
+ /* All legacy keys */
+ if (a->type != b->type)
+--
+2.38.1
+
diff --git a/0082-Propagate-selection-all-the-way-on-key-export.patch b/0082-Propagate-selection-all-the-way-on-key-export.patch
new file mode 100644
index 0000000..d09fc63
--- /dev/null
+++ b/0082-Propagate-selection-all-the-way-on-key-export.patch
@@ -0,0 +1,221 @@
+From 98642df4ba886818900ab7e6b23703544e6addd4 Mon Sep 17 00:00:00 2001
+From: Simo Sorce <simo@redhat.com>
+Date: Thu, 10 Nov 2022 10:46:32 -0500
+Subject: [PATCH 1/3] Propagate selection all the way on key export
+
+EVP_PKEY_eq() is used to check, among other things, if a certificate
+public key corresponds to a private key. When the private key belongs to
+a provider that does not allow to export private keys this currently
+fails as the internal functions used to import/export keys ignored the
+selection given (which specifies that only the public key needs to be
+considered) and instead tries to export everything.
+
+This patch allows to propagate the selection all the way down including
+adding it in the cache so that a following operation actually looking
+for other selection parameters does not mistakenly pick up an export
+containing only partial information.
+
+Signed-off-by: Simo Sorce <simo@redhat.com>
+
+Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
+Reviewed-by: Tomas Mraz <tomas@openssl.org>
+(Merged from https://github.com/openssl/openssl/pull/19648)
+
+diff --git a/crypto/evp/keymgmt_lib.c b/crypto/evp/keymgmt_lib.c
+index b06730dc7a..2d0238ee27 100644
+--- a/crypto/evp/keymgmt_lib.c
++++ b/crypto/evp/keymgmt_lib.c
+@@ -93,7 +93,8 @@ int evp_keymgmt_util_export(const EVP_PKEY *pk, int selection,
+ export_cb, export_cbarg);
+ }
+
+-void *evp_keymgmt_util_export_to_provider(EVP_PKEY *pk, EVP_KEYMGMT *keymgmt)
++void *evp_keymgmt_util_export_to_provider(EVP_PKEY *pk, EVP_KEYMGMT *keymgmt,
++ int selection)
+ {
+ struct evp_keymgmt_util_try_import_data_st import_data;
+ OP_CACHE_ELEM *op;
+@@ -127,7 +128,7 @@ void *evp_keymgmt_util_export_to_provider(EVP_PKEY *pk, EVP_KEYMGMT *keymgmt)
+ */
+ if (pk->dirty_cnt == pk->dirty_cnt_copy) {
+ /* If this key is already exported to |keymgmt|, no more to do */
+- op = evp_keymgmt_util_find_operation_cache(pk, keymgmt);
++ op = evp_keymgmt_util_find_operation_cache(pk, keymgmt, selection);
+ if (op != NULL && op->keymgmt != NULL) {
+ void *ret = op->keydata;
+
+@@ -157,13 +158,13 @@ void *evp_keymgmt_util_export_to_provider(EVP_PKEY *pk, EVP_KEYMGMT *keymgmt)
+ /* Setup for the export callback */
+ import_data.keydata = NULL; /* evp_keymgmt_util_try_import will create it */
+ import_data.keymgmt = keymgmt;
+- import_data.selection = OSSL_KEYMGMT_SELECT_ALL;
++ import_data.selection = selection;
+
+ /*
+ * The export function calls the callback (evp_keymgmt_util_try_import),
+ * which does the import for us. If successful, we're done.
+ */
+- if (!evp_keymgmt_util_export(pk, OSSL_KEYMGMT_SELECT_ALL,
++ if (!evp_keymgmt_util_export(pk, selection,
+ &evp_keymgmt_util_try_import, &import_data))
+ /* If there was an error, bail out */
+ return NULL;
+@@ -173,7 +174,7 @@ void *evp_keymgmt_util_export_to_provider(EVP_PKEY *pk, EVP_KEYMGMT *keymgmt)
+ return NULL;
+ }
+ /* Check to make sure some other thread didn't get there first */
+- op = evp_keymgmt_util_find_operation_cache(pk, keymgmt);
++ op = evp_keymgmt_util_find_operation_cache(pk, keymgmt, selection);
+ if (op != NULL && op->keydata != NULL) {
+ void *ret = op->keydata;
+
+@@ -196,7 +197,8 @@ void *evp_keymgmt_util_export_to_provider(EVP_PKEY *pk, EVP_KEYMGMT *keymgmt)
+ evp_keymgmt_util_clear_operation_cache(pk, 0);
+
+ /* Add the new export to the operation cache */
+- if (!evp_keymgmt_util_cache_keydata(pk, keymgmt, import_data.keydata)) {
++ if (!evp_keymgmt_util_cache_keydata(pk, keymgmt, import_data.keydata,
++ selection)) {
+ CRYPTO_THREAD_unlock(pk->lock);
+ evp_keymgmt_freedata(keymgmt, import_data.keydata);
+ return NULL;
+@@ -232,7 +234,8 @@ int evp_keymgmt_util_clear_operation_cache(EVP_PKEY *pk, int locking)
+ }
+
+ OP_CACHE_ELEM *evp_keymgmt_util_find_operation_cache(EVP_PKEY *pk,
+- EVP_KEYMGMT *keymgmt)
++ EVP_KEYMGMT *keymgmt,
++ int selection)
+ {
+ int i, end = sk_OP_CACHE_ELEM_num(pk->operation_cache);
+ OP_CACHE_ELEM *p;
+@@ -243,14 +246,14 @@ OP_CACHE_ELEM *evp_keymgmt_util_find_operation_cache(EVP_PKEY *pk,
+ */
+ for (i = 0; i < end; i++) {
+ p = sk_OP_CACHE_ELEM_value(pk->operation_cache, i);
+- if (keymgmt == p->keymgmt)
++ if (keymgmt == p->keymgmt && (p->selection & selection) == selection)
+ return p;
+ }
+ return NULL;
+ }
+
+-int evp_keymgmt_util_cache_keydata(EVP_PKEY *pk,
+- EVP_KEYMGMT *keymgmt, void *keydata)
++int evp_keymgmt_util_cache_keydata(EVP_PKEY *pk, EVP_KEYMGMT *keymgmt,
++ void *keydata, int selection)
+ {
+ OP_CACHE_ELEM *p = NULL;
+
+@@ -266,6 +269,7 @@ int evp_keymgmt_util_cache_keydata(EVP_PKEY *pk,
+ return 0;
+ p->keydata = keydata;
+ p->keymgmt = keymgmt;
++ p->selection = selection;
+
+ if (!EVP_KEYMGMT_up_ref(keymgmt)) {
+ OPENSSL_free(p);
+@@ -391,7 +395,8 @@ int evp_keymgmt_util_match(EVP_PKEY *pk1, EVP_PKEY *pk2, int selection)
+ ok = 1;
+ if (keydata1 != NULL) {
+ tmp_keydata =
+- evp_keymgmt_util_export_to_provider(pk1, keymgmt2);
++ evp_keymgmt_util_export_to_provider(pk1, keymgmt2,
++ selection);
+ ok = (tmp_keydata != NULL);
+ }
+ if (ok) {
+@@ -411,7 +416,8 @@ int evp_keymgmt_util_match(EVP_PKEY *pk1, EVP_PKEY *pk2, int selection)
+ ok = 1;
+ if (keydata2 != NULL) {
+ tmp_keydata =
+- evp_keymgmt_util_export_to_provider(pk2, keymgmt1);
++ evp_keymgmt_util_export_to_provider(pk2, keymgmt1,
++ selection);
+ ok = (tmp_keydata != NULL);
+ }
+ if (ok) {
+diff --git a/crypto/evp/p_lib.c b/crypto/evp/p_lib.c
+index 70d17ec37e..905e9c9ce4 100644
+--- a/crypto/evp/p_lib.c
++++ b/crypto/evp/p_lib.c
+@@ -1822,6 +1822,7 @@ void *evp_pkey_export_to_provider(EVP_PKEY *pk, OSSL_LIB_CTX *libctx,
+ {
+ EVP_KEYMGMT *allocated_keymgmt = NULL;
+ EVP_KEYMGMT *tmp_keymgmt = NULL;
++ int selection = OSSL_KEYMGMT_SELECT_ALL;
+ void *keydata = NULL;
+ int check;
+
+@@ -1883,7 +1884,8 @@ void *evp_pkey_export_to_provider(EVP_PKEY *pk, OSSL_LIB_CTX *libctx,
+ if (pk->ameth->dirty_cnt(pk) == pk->dirty_cnt_copy) {
+ if (!CRYPTO_THREAD_read_lock(pk->lock))
+ goto end;
+- op = evp_keymgmt_util_find_operation_cache(pk, tmp_keymgmt);
++ op = evp_keymgmt_util_find_operation_cache(pk, tmp_keymgmt,
++ selection);
+
+ /*
+ * If |tmp_keymgmt| is present in the operation cache, it means
+@@ -1938,7 +1940,7 @@ void *evp_pkey_export_to_provider(EVP_PKEY *pk, OSSL_LIB_CTX *libctx,
+ EVP_KEYMGMT_free(tmp_keymgmt); /* refcnt-- */
+
+ /* Check to make sure some other thread didn't get there first */
+- op = evp_keymgmt_util_find_operation_cache(pk, tmp_keymgmt);
++ op = evp_keymgmt_util_find_operation_cache(pk, tmp_keymgmt, selection);
+ if (op != NULL && op->keymgmt != NULL) {
+ void *tmp_keydata = op->keydata;
+
+@@ -1949,7 +1951,8 @@ void *evp_pkey_export_to_provider(EVP_PKEY *pk, OSSL_LIB_CTX *libctx,
+ }
+
+ /* Add the new export to the operation cache */
+- if (!evp_keymgmt_util_cache_keydata(pk, tmp_keymgmt, keydata)) {
++ if (!evp_keymgmt_util_cache_keydata(pk, tmp_keymgmt, keydata,
++ selection)) {
+ CRYPTO_THREAD_unlock(pk->lock);
+ evp_keymgmt_freedata(tmp_keymgmt, keydata);
+ keydata = NULL;
+@@ -1964,7 +1967,7 @@ void *evp_pkey_export_to_provider(EVP_PKEY *pk, OSSL_LIB_CTX *libctx,
+ }
+ #endif /* FIPS_MODULE */
+
+- keydata = evp_keymgmt_util_export_to_provider(pk, tmp_keymgmt);
++ keydata = evp_keymgmt_util_export_to_provider(pk, tmp_keymgmt, selection);
+
+ end:
+ /*
+diff --git a/include/crypto/evp.h b/include/crypto/evp.h
+index f601b72807..dbbdcccbda 100644
+--- a/include/crypto/evp.h
++++ b/include/crypto/evp.h
+@@ -589,6 +589,7 @@ int evp_cipher_asn1_to_param_ex(EVP_CIPHER_CTX *c, ASN1_TYPE *type,
+ typedef struct {
+ EVP_KEYMGMT *keymgmt;
+ void *keydata;
++ int selection;
+ } OP_CACHE_ELEM;
+
+ DEFINE_STACK_OF(OP_CACHE_ELEM)
+@@ -778,12 +779,14 @@ EVP_PKEY *evp_keymgmt_util_make_pkey(EVP_KEYMGMT *keymgmt, void *keydata);
+
+ int evp_keymgmt_util_export(const EVP_PKEY *pk, int selection,
+ OSSL_CALLBACK *export_cb, void *export_cbarg);
+-void *evp_keymgmt_util_export_to_provider(EVP_PKEY *pk, EVP_KEYMGMT *keymgmt);
++void *evp_keymgmt_util_export_to_provider(EVP_PKEY *pk, EVP_KEYMGMT *keymgmt,
++ int selection);
+ OP_CACHE_ELEM *evp_keymgmt_util_find_operation_cache(EVP_PKEY *pk,
+- EVP_KEYMGMT *keymgmt);
++ EVP_KEYMGMT *keymgmt,
++ int selection);
+ int evp_keymgmt_util_clear_operation_cache(EVP_PKEY *pk, int locking);
+-int evp_keymgmt_util_cache_keydata(EVP_PKEY *pk,
+- EVP_KEYMGMT *keymgmt, void *keydata);
++int evp_keymgmt_util_cache_keydata(EVP_PKEY *pk, EVP_KEYMGMT *keymgmt,
++ void *keydata, int selection);
+ void evp_keymgmt_util_cache_keyinfo(EVP_PKEY *pk);
+ void *evp_keymgmt_util_fromdata(EVP_PKEY *target, EVP_KEYMGMT *keymgmt,
+ int selection, const OSSL_PARAM params[]);
+--
+2.38.1
+
diff --git a/0083-Update-documentation-for-keymgmt-export-utils.patch b/0083-Update-documentation-for-keymgmt-export-utils.patch
new file mode 100644
index 0000000..9639360
--- /dev/null
+++ b/0083-Update-documentation-for-keymgmt-export-utils.patch
@@ -0,0 +1,52 @@
+From 504427eb5f32108dd64ff7858012863fe47b369b Mon Sep 17 00:00:00 2001
+From: Simo Sorce <simo@redhat.com>
+Date: Thu, 10 Nov 2022 16:58:28 -0500
+Subject: [PATCH 2/3] Update documentation for keymgmt export utils
+
+Change function prototypes and explain how to use the selection
+argument.
+
+Signed-off-by: Simo Sorce <simo@redhat.com>
+
+Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
+Reviewed-by: Tomas Mraz <tomas@openssl.org>
+(Merged from https://github.com/openssl/openssl/pull/19648)
+
+diff --git a/doc/internal/man3/evp_keymgmt_util_export_to_provider.pod b/doc/internal/man3/evp_keymgmt_util_export_to_provider.pod
+index 1fee9f6ff9..7099e44964 100644
+--- a/doc/internal/man3/evp_keymgmt_util_export_to_provider.pod
++++ b/doc/internal/man3/evp_keymgmt_util_export_to_provider.pod
+@@ -20,12 +20,14 @@ OP_CACHE_ELEM
+
+ int evp_keymgmt_util_export(const EVP_PKEY *pk, int selection,
+ OSSL_CALLBACK *export_cb, void *export_cbarg);
+- void *evp_keymgmt_util_export_to_provider(EVP_PKEY *pk, EVP_KEYMGMT *keymgmt);
++ void *evp_keymgmt_util_export_to_provider(EVP_PKEY *pk, EVP_KEYMGMT *keymgmt,
++ int selection);
+ OP_CACHE_ELEM *evp_keymgmt_util_find_operation_cache(EVP_PKEY *pk,
+- EVP_KEYMGMT *keymgmt);
++ EVP_KEYMGMT *keymgmt,
++ int selection);
+ int evp_keymgmt_util_clear_operation_cache(EVP_PKEY *pk, int locking);
+- int evp_keymgmt_util_cache_keydata(EVP_PKEY *pk,
+- EVP_KEYMGMT *keymgmt, void *keydata);
++ int evp_keymgmt_util_cache_keydata(EVP_PKEY *pk, EVP_KEYMGMT *keymgmt,
++ void *keydata, int selection);
+ void evp_keymgmt_util_cache_keyinfo(EVP_PKEY *pk);
+ void *evp_keymgmt_util_fromdata(EVP_PKEY *target, EVP_KEYMGMT *keymgmt,
+ int selection, const OSSL_PARAM params[]);
+@@ -65,6 +67,11 @@ evp_keymgmt_util_fromdata() can be used to add key object data to a
+ given key I<target> via a B<EVP_KEYMGMT> interface. This is used as a
+ helper for L<EVP_PKEY_fromdata(3)>.
+
++In all functions that take a I<selection> argument, the selection is used to
++constraint the information requested on export. It is also used in the cache
++so that key data is guaranteed to contain all the information requested in
++the selection.
++
+ =head1 RETURN VALUES
+
+ evp_keymgmt_export_to_provider() and evp_keymgmt_util_fromdata()
+--
+2.38.1
+
diff --git a/0084-Add-test-for-EVP_PKEY_eq.patch b/0084-Add-test-for-EVP_PKEY_eq.patch
new file mode 100644
index 0000000..06a3bae
--- /dev/null
+++ b/0084-Add-test-for-EVP_PKEY_eq.patch
@@ -0,0 +1,357 @@
+From e5202fbd461cb6c067874987998e91c6093e5267 Mon Sep 17 00:00:00 2001
+From: Simo Sorce <simo@redhat.com>
+Date: Fri, 11 Nov 2022 12:18:26 -0500
+Subject: [PATCH 3/3] Add test for EVP_PKEY_eq
+
+This tests that the comparison work even if a provider can only return
+a public key.
+
+Signed-off-by: Simo Sorce <simo@redhat.com>
+
+Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
+Reviewed-by: Tomas Mraz <tomas@openssl.org>
+(Merged from https://github.com/openssl/openssl/pull/19648)
+
+diff --git a/test/fake_rsaprov.c b/test/fake_rsaprov.c
+index d556551bb6..5e92e72d4b 100644
+--- a/test/fake_rsaprov.c
++++ b/test/fake_rsaprov.c
+@@ -22,24 +22,34 @@ static OSSL_FUNC_keymgmt_has_fn fake_rsa_keymgmt_has;
+ static OSSL_FUNC_keymgmt_query_operation_name_fn fake_rsa_keymgmt_query;
+ static OSSL_FUNC_keymgmt_import_fn fake_rsa_keymgmt_import;
+ static OSSL_FUNC_keymgmt_import_types_fn fake_rsa_keymgmt_imptypes;
++static OSSL_FUNC_keymgmt_export_fn fake_rsa_keymgmt_export;
++static OSSL_FUNC_keymgmt_export_types_fn fake_rsa_keymgmt_exptypes;
+ static OSSL_FUNC_keymgmt_load_fn fake_rsa_keymgmt_load;
+
+ static int has_selection;
+ static int imptypes_selection;
++static int exptypes_selection;
+ static int query_id;
+
++struct fake_rsa_keydata {
++ int selection;
++ int status;
++};
++
+ static void *fake_rsa_keymgmt_new(void *provctx)
+ {
+- unsigned char *keydata = OPENSSL_zalloc(1);
++ struct fake_rsa_keydata *key;
+
+- TEST_ptr(keydata);
++ if (!TEST_ptr(key = OPENSSL_zalloc(sizeof(struct fake_rsa_keydata))))
++ return NULL;
+
+ /* clear test globals */
+ has_selection = 0;
+ imptypes_selection = 0;
++ exptypes_selection = 0;
+ query_id = 0;
+
+- return keydata;
++ return key;
+ }
+
+ static void fake_rsa_keymgmt_free(void *keydata)
+@@ -67,14 +77,104 @@ static const char *fake_rsa_keymgmt_query(int id)
+ static int fake_rsa_keymgmt_import(void *keydata, int selection,
+ const OSSL_PARAM *p)
+ {
+- unsigned char *fake_rsa_key = keydata;
++ struct fake_rsa_keydata *fake_rsa_key = keydata;
+
+ /* key was imported */
+- *fake_rsa_key = 1;
++ fake_rsa_key->status = 1;
+
+ return 1;
+ }
+
++static unsigned char fake_rsa_n[] =
++ "\x00\xAA\x36\xAB\xCE\x88\xAC\xFD\xFF\x55\x52\x3C\x7F\xC4\x52\x3F"
++ "\x90\xEF\xA0\x0D\xF3\x77\x4A\x25\x9F\x2E\x62\xB4\xC5\xD9\x9C\xB5"
++ "\xAD\xB3\x00\xA0\x28\x5E\x53\x01\x93\x0E\x0C\x70\xFB\x68\x76\x93"
++ "\x9C\xE6\x16\xCE\x62\x4A\x11\xE0\x08\x6D\x34\x1E\xBC\xAC\xA0\xA1"
++ "\xF5";
++
++static unsigned char fake_rsa_e[] = "\x11";
++
++static unsigned char fake_rsa_d[] =
++ "\x0A\x03\x37\x48\x62\x64\x87\x69\x5F\x5F\x30\xBC\x38\xB9\x8B\x44"
++ "\xC2\xCD\x2D\xFF\x43\x40\x98\xCD\x20\xD8\xA1\x38\xD0\x90\xBF\x64"
++ "\x79\x7C\x3F\xA7\xA2\xCD\xCB\x3C\xD1\xE0\xBD\xBA\x26\x54\xB4\xF9"
++ "\xDF\x8E\x8A\xE5\x9D\x73\x3D\x9F\x33\xB3\x01\x62\x4A\xFD\x1D\x51";
++
++static unsigned char fake_rsa_p[] =
++ "\x00\xD8\x40\xB4\x16\x66\xB4\x2E\x92\xEA\x0D\xA3\xB4\x32\x04\xB5"
++ "\xCF\xCE\x33\x52\x52\x4D\x04\x16\xA5\xA4\x41\xE7\x00\xAF\x46\x12"
++ "\x0D";
++
++static unsigned char fake_rsa_q[] =
++ "\x00\xC9\x7F\xB1\xF0\x27\xF4\x53\xF6\x34\x12\x33\xEA\xAA\xD1\xD9"
++ "\x35\x3F\x6C\x42\xD0\x88\x66\xB1\xD0\x5A\x0F\x20\x35\x02\x8B\x9D"
++ "\x89";
++
++static unsigned char fake_rsa_dmp1[] =
++ "\x59\x0B\x95\x72\xA2\xC2\xA9\xC4\x06\x05\x9D\xC2\xAB\x2F\x1D\xAF"
++ "\xEB\x7E\x8B\x4F\x10\xA7\x54\x9E\x8E\xED\xF5\xB4\xFC\xE0\x9E\x05";
++
++static unsigned char fake_rsa_dmq1[] =
++ "\x00\x8E\x3C\x05\x21\xFE\x15\xE0\xEA\x06\xA3\x6F\xF0\xF1\x0C\x99"
++ "\x52\xC3\x5B\x7A\x75\x14\xFD\x32\x38\xB8\x0A\xAD\x52\x98\x62\x8D"
++ "\x51";
++
++static unsigned char fake_rsa_iqmp[] =
++ "\x36\x3F\xF7\x18\x9D\xA8\xE9\x0B\x1D\x34\x1F\x71\xD0\x9B\x76\xA8"
++ "\xA9\x43\xE1\x1D\x10\xB2\x4D\x24\x9F\x2D\xEA\xFE\xF8\x0C\x18\x26";
++
++OSSL_PARAM *fake_rsa_key_params(int priv)
++{
++ if (priv) {
++ OSSL_PARAM params[] = {
++ OSSL_PARAM_BN(OSSL_PKEY_PARAM_RSA_N, fake_rsa_n,
++ sizeof(fake_rsa_n) -1),
++ OSSL_PARAM_BN(OSSL_PKEY_PARAM_RSA_E, fake_rsa_e,
++ sizeof(fake_rsa_e) -1),
++ OSSL_PARAM_BN(OSSL_PKEY_PARAM_RSA_D, fake_rsa_d,
++ sizeof(fake_rsa_d) -1),
++ OSSL_PARAM_BN(OSSL_PKEY_PARAM_RSA_FACTOR1, fake_rsa_p,
++ sizeof(fake_rsa_p) -1),
++ OSSL_PARAM_BN(OSSL_PKEY_PARAM_RSA_FACTOR2, fake_rsa_q,
++ sizeof(fake_rsa_q) -1),
++ OSSL_PARAM_BN(OSSL_PKEY_PARAM_RSA_EXPONENT1, fake_rsa_dmp1,
++ sizeof(fake_rsa_dmp1) -1),
++ OSSL_PARAM_BN(OSSL_PKEY_PARAM_RSA_EXPONENT2, fake_rsa_dmq1,
++ sizeof(fake_rsa_dmq1) -1),
++ OSSL_PARAM_BN(OSSL_PKEY_PARAM_RSA_COEFFICIENT1, fake_rsa_iqmp,
++ sizeof(fake_rsa_iqmp) -1),
++ OSSL_PARAM_END
++ };
++ return OSSL_PARAM_dup(params);
++ } else {
++ OSSL_PARAM params[] = {
++ OSSL_PARAM_BN(OSSL_PKEY_PARAM_RSA_N, fake_rsa_n,
++ sizeof(fake_rsa_n) -1),
++ OSSL_PARAM_BN(OSSL_PKEY_PARAM_RSA_E, fake_rsa_e,
++ sizeof(fake_rsa_e) -1),
++ OSSL_PARAM_END
++ };
++ return OSSL_PARAM_dup(params);
++ }
++}
++
++static int fake_rsa_keymgmt_export(void *keydata, int selection,
++ OSSL_CALLBACK *param_callback, void *cbarg)
++{
++ OSSL_PARAM *params = NULL;
++ int ret;
++
++ if (selection & OSSL_KEYMGMT_SELECT_PRIVATE_KEY)
++ return 0;
++
++ if (!TEST_ptr(params = fake_rsa_key_params(0)))
++ return 0;
++
++ ret = param_callback(params, cbarg);
++ OSSL_PARAM_free(params);
++ return ret;
++}
++
+ static const OSSL_PARAM fake_rsa_import_key_types[] = {
+ OSSL_PARAM_BN(OSSL_PKEY_PARAM_RSA_N, NULL, 0),
+ OSSL_PARAM_BN(OSSL_PKEY_PARAM_RSA_E, NULL, 0),
+@@ -95,19 +195,33 @@ static const OSSL_PARAM *fake_rsa_keymgmt_imptypes(int selection)
+ return fake_rsa_import_key_types;
+ }
+
++static const OSSL_PARAM fake_rsa_export_key_types[] = {
++ OSSL_PARAM_BN(OSSL_PKEY_PARAM_RSA_N, NULL, 0),
++ OSSL_PARAM_BN(OSSL_PKEY_PARAM_RSA_E, NULL, 0),
++ OSSL_PARAM_END
++};
++
++static const OSSL_PARAM *fake_rsa_keymgmt_exptypes(int selection)
++{
++ /* record global for checking */
++ exptypes_selection = selection;
++
++ return fake_rsa_export_key_types;
++}
++
+ static void *fake_rsa_keymgmt_load(const void *reference, size_t reference_sz)
+ {
+- unsigned char *key = NULL;
++ struct fake_rsa_keydata *key = NULL;
+
+- if (reference_sz != sizeof(key))
++ if (reference_sz != sizeof(*key))
+ return NULL;
+
+- key = *(unsigned char **)reference;
+- if (*key != 1)
++ key = *(struct fake_rsa_keydata **)reference;
++ if (key->status != 1)
+ return NULL;
+
+ /* detach the reference */
+- *(unsigned char **)reference = NULL;
++ *(struct fake_rsa_keydata **)reference = NULL;
+
+ return key;
+ }
+@@ -129,7 +243,7 @@ static void *fake_rsa_gen(void *genctx, OSSL_CALLBACK *osslcb, void *cbarg)
+ {
+ unsigned char *gctx = genctx;
+ static const unsigned char inited[] = { 1 };
+- unsigned char *keydata;
++ struct fake_rsa_keydata *keydata;
+
+ if (!TEST_ptr(gctx)
+ || !TEST_mem_eq(gctx, sizeof(*gctx), inited, sizeof(inited)))
+@@ -138,7 +252,7 @@ static void *fake_rsa_gen(void *genctx, OSSL_CALLBACK *osslcb, void *cbarg)
+ if (!TEST_ptr(keydata = fake_rsa_keymgmt_new(NULL)))
+ return NULL;
+
+- *keydata = 2;
++ keydata->status = 2;
+ return keydata;
+ }
+
+@@ -156,6 +270,9 @@ static const OSSL_DISPATCH fake_rsa_keymgmt_funcs[] = {
+ { OSSL_FUNC_KEYMGMT_IMPORT, (void (*)(void))fake_rsa_keymgmt_import },
+ { OSSL_FUNC_KEYMGMT_IMPORT_TYPES,
+ (void (*)(void))fake_rsa_keymgmt_imptypes },
++ { OSSL_FUNC_KEYMGMT_EXPORT, (void (*)(void))fake_rsa_keymgmt_export },
++ { OSSL_FUNC_KEYMGMT_EXPORT_TYPES,
++ (void (*)(void))fake_rsa_keymgmt_exptypes },
+ { OSSL_FUNC_KEYMGMT_LOAD, (void (*)(void))fake_rsa_keymgmt_load },
+ { OSSL_FUNC_KEYMGMT_GEN_INIT, (void (*)(void))fake_rsa_gen_init },
+ { OSSL_FUNC_KEYMGMT_GEN, (void (*)(void))fake_rsa_gen },
+@@ -191,14 +308,14 @@ static int fake_rsa_sig_sign_init(void *ctx, void *provkey,
+ const OSSL_PARAM params[])
+ {
+ unsigned char *sigctx = ctx;
+- unsigned char *keydata = provkey;
++ struct fake_rsa_keydata *keydata = provkey;
+
+ /* we must have a ctx */
+ if (!TEST_ptr(sigctx))
+ return 0;
+
+ /* we must have some initialized key */
+- if (!TEST_ptr(keydata) || !TEST_int_gt(keydata[0], 0))
++ if (!TEST_ptr(keydata) || !TEST_int_gt(keydata->status, 0))
+ return 0;
+
+ /* record that sign init was called */
+@@ -289,7 +406,7 @@ static int fake_rsa_st_load(void *loaderctx,
+ unsigned char *storectx = loaderctx;
+ OSSL_PARAM params[4];
+ int object_type = OSSL_OBJECT_PKEY;
+- void *key = NULL;
++ struct fake_rsa_keydata *key = NULL;
+ int rv = 0;
+
+ switch (*storectx) {
+@@ -307,7 +424,7 @@ static int fake_rsa_st_load(void *loaderctx,
+ /* The address of the key becomes the octet string */
+ params[2] =
+ OSSL_PARAM_construct_octet_string(OSSL_OBJECT_PARAM_REFERENCE,
+- &key, sizeof(key));
++ &key, sizeof(*key));
+ params[3] = OSSL_PARAM_construct_end();
+ rv = object_cb(params, object_cbarg);
+ *storectx = 1;
+diff --git a/test/fake_rsaprov.h b/test/fake_rsaprov.h
+index 57de1ecf8d..190c46a285 100644
+--- a/test/fake_rsaprov.h
++++ b/test/fake_rsaprov.h
+@@ -12,3 +12,4 @@
+ /* Fake RSA provider implementation */
+ OSSL_PROVIDER *fake_rsa_start(OSSL_LIB_CTX *libctx);
+ void fake_rsa_finish(OSSL_PROVIDER *p);
++OSSL_PARAM *fake_rsa_key_params(int priv);
+diff --git a/test/provider_pkey_test.c b/test/provider_pkey_test.c
+index 5c398398f4..3b190baa5e 100644
+--- a/test/provider_pkey_test.c
++++ b/test/provider_pkey_test.c
+@@ -176,6 +176,67 @@ end:
+ return ret;
+ }
+
++static int test_pkey_eq(void)
++{
++ OSSL_PROVIDER *deflt = NULL;
++ OSSL_PROVIDER *fake_rsa = NULL;
++ EVP_PKEY *pkey_fake = NULL;
++ EVP_PKEY *pkey_dflt = NULL;
++ EVP_PKEY_CTX *ctx = NULL;
++ OSSL_PARAM *params = NULL;
++ int ret = 0;
++
++ if (!TEST_ptr(fake_rsa = fake_rsa_start(libctx)))
++ return 0;
++
++ if (!TEST_ptr(deflt = OSSL_PROVIDER_load(libctx, "default")))
++ goto end;
++
++ /* Construct a public key for fake-rsa */
++ if (!TEST_ptr(params = fake_rsa_key_params(0))
++ || !TEST_ptr(ctx = EVP_PKEY_CTX_new_from_name(libctx, "RSA",
++ "provider=fake-rsa"))
++ || !TEST_true(EVP_PKEY_fromdata_init(ctx))
++ || !TEST_true(EVP_PKEY_fromdata(ctx, &pkey_fake, EVP_PKEY_PUBLIC_KEY,
++ params))
++ || !TEST_ptr(pkey_fake))
++ goto end;
++
++ EVP_PKEY_CTX_free(ctx);
++ ctx = NULL;
++ OSSL_PARAM_free(params);
++ params = NULL;
++
++ /* Construct a public key for default */
++ if (!TEST_ptr(params = fake_rsa_key_params(0))
++ || !TEST_ptr(ctx = EVP_PKEY_CTX_new_from_name(libctx, "RSA",
++ "provider=default"))
++ || !TEST_true(EVP_PKEY_fromdata_init(ctx))
++ || !TEST_true(EVP_PKEY_fromdata(ctx, &pkey_dflt, EVP_PKEY_PUBLIC_KEY,
++ params))
++ || !TEST_ptr(pkey_dflt))
++ goto end;
++
++ EVP_PKEY_CTX_free(ctx);
++ ctx = NULL;
++ OSSL_PARAM_free(params);
++ params = NULL;
++
++ /* now test for equality */
++ if (!TEST_int_eq(EVP_PKEY_eq(pkey_fake, pkey_dflt), 1))
++ goto end;
++
++ ret = 1;
++end:
++ fake_rsa_finish(fake_rsa);
++ OSSL_PROVIDER_unload(deflt);
++ EVP_PKEY_CTX_free(ctx);
++ EVP_PKEY_free(pkey_fake);
++ EVP_PKEY_free(pkey_dflt);
++ OSSL_PARAM_free(params);
++ return ret;
++}
++
+ static int test_pkey_store(int idx)
+ {
+ OSSL_PROVIDER *deflt = NULL;
+@@ -235,6 +296,7 @@ int setup_tests(void)
+
+ ADD_TEST(test_pkey_sig);
+ ADD_TEST(test_alternative_keygen_init);
++ ADD_TEST(test_pkey_eq);
+ ADD_ALL_TESTS(test_pkey_store, 2);
+
+ return 1;
+--
+2.38.1
+
diff --git a/0085-Drop-explicit-check-for-engines-in-opt_legacy_okay.patch b/0085-Drop-explicit-check-for-engines-in-opt_legacy_okay.patch
new file mode 100644
index 0000000..57a0919
--- /dev/null
+++ b/0085-Drop-explicit-check-for-engines-in-opt_legacy_okay.patch
@@ -0,0 +1,75 @@
+From 2fea56832780248af2aba2e4433ece2d18428515 Mon Sep 17 00:00:00 2001
+From: Simo Sorce <simo@redhat.com>
+Date: Mon, 14 Nov 2022 10:25:15 -0500
+Subject: [PATCH] Drop explicit check for engines in opt_legacy_okay
+
+The providers indication should always indicate that this is not a
+legacy request.
+This makes a check for engines redundant as the default return is that
+legacy is ok if there are no explicit providers.
+
+Fixes #19662
+
+Signed-off-by: Simo Sorce <simo@redhat.com>
+
+Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
+Reviewed-by: Paul Dale <pauli@openssl.org>
+Reviewed-by: Tomas Mraz <tomas@openssl.org>
+(Merged from https://github.com/openssl/openssl/pull/19671)
+---
+ apps/lib/apps.c | 8 --------
+ test/recipes/20-test_legacy_okay.t | 23 +++++++++++++++++++++++
+ 2 files changed, 23 insertions(+), 8 deletions(-)
+ create mode 100755 test/recipes/20-test_legacy_okay.t
+
+diff --git a/apps/lib/apps.c b/apps/lib/apps.c
+index 3d52e030ab7e258f9cd983b2d9755d954cb3aee5..bbe0d009efb35fcf1a902c86cbddc61e657e57f1 100644
+--- a/apps/lib/apps.c
++++ b/apps/lib/apps.c
+@@ -3405,14 +3405,6 @@ int opt_legacy_okay(void)
+ {
+ int provider_options = opt_provider_option_given();
+ int libctx = app_get0_libctx() != NULL || app_get0_propq() != NULL;
+-#ifndef OPENSSL_NO_ENGINE
+- ENGINE *e = ENGINE_get_first();
+-
+- if (e != NULL) {
+- ENGINE_free(e);
+- return 1;
+- }
+-#endif
+ /*
+ * Having a provider option specified or a custom library context or
+ * property query, is a sure sign we're not using legacy.
+diff --git a/test/recipes/20-test_legacy_okay.t b/test/recipes/20-test_legacy_okay.t
+new file mode 100755
+index 0000000000000000000000000000000000000000..183499f3fd93f97e8a4a30681a9f383d2f6e0c56
+--- /dev/null
++++ b/test/recipes/20-test_legacy_okay.t
+@@ -0,0 +1,23 @@
++#! /usr/bin/env perl
++# Copyright 2020-2021 The OpenSSL Project Authors. All Rights Reserved.
++#
++# Licensed under the Apache License 2.0 (the "License"). You may not use
++# this file except in compliance with the License. You can obtain a copy
++# in the file LICENSE in the source distribution or at
++# https://www.openssl.org/source/license.html
++
++use strict;
++use warnings;
++
++use OpenSSL::Test;
++
++setup("test_legacy");
++
++plan tests => 3;
++
++ok(run(app(['openssl', 'rand', '-out', 'rand.txt', '256'])), "Generate random file");
++
++ok(run(app(['openssl', 'dgst', '-sha256', 'rand.txt'])), "Generate a digest");
++
++ok(!run(app(['openssl', 'dgst', '-sha256', '-propquery', 'foo=1',
++ 'rand.txt'])), "Fail to generate a digest");
+--
+2.38.1
+
diff --git a/openssl.spec b/openssl.spec
index 3110d38..287ab80 100644
--- a/openssl.spec
+++ b/openssl.spec
@@ -29,7 +29,7 @@ print(string.sub(hash, 0, 16))
Summary: Utilities from the general purpose cryptography library with TLS implementation
Name: openssl
Version: 3.0.5
-Release: 6%{?dist}
+Release: 7%{?dist}
Epoch: 1
# We have to remove certain patented algorithms from the openssl source
# tarball with the hobble-openssl script which is included below.
@@ -186,6 +186,12 @@ Patch78: 0078-Add-FIPS-indicator-parameter-to-HKDF.patch
Patch79: 0079-Fix-AES-GCM-on-Power-8-CPUs.patch
#CVE-2022-3602
Patch80: 0080-CVE-2022-3602.patch
+#Provider interface fixes
+Patch81: 0081-EVP_PKEY_eq-regain-compatibility-with-the-3.0.0-FIPS.patch
+Patch82: 0082-Propagate-selection-all-the-way-on-key-export.patch
+Patch83: 0083-Update-documentation-for-keymgmt-export-utils.patch
+Patch84: 0084-Add-test-for-EVP_PKEY_eq.patch
+Patch85: 0085-Drop-explicit-check-for-engines-in-opt_legacy_okay.patch
License: ASL 2.0
URL: http://www.openssl.org/
@@ -523,6 +529,9 @@ install -m644 %{SOURCE9} \
%ldconfig_scriptlets libs
%changelog
+* Wed Nov 16 2022 Simo sorce <simo@redhat.com> - 1:3.0.5-7
+- Backport patches to fix external providers compatibility issues
+
* Tue Nov 01 2022 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.5-6
- CVE-2022-3602: X.509 Email Address Buffer Overflow
- CVE-2022-3786: X.509 Email Address Buffer Overflow
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2026-06-09 12:45 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-06-09 12:45 [rpms/openssl] rebase_40beta: Backport patches to fix external providers compatibility issues Simo Sorce
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox