From 20a21be60e1f4bff55b5d15ca2c7a078292fe522 Mon Sep 17 00:00:00 2001 From: Nicolas Bouchinet Date: Oct 21 2020 18:48:32 +0000 Subject: Remove ec_curve patches Signed-off-by: Nicolas Bouchinet --- diff --git a/openssl-1.1.1-fips-curves.patch b/openssl-1.1.1-fips-curves.patch index 33e9fc5..0ea6665 100644 --- a/openssl-1.1.1-fips-curves.patch +++ b/openssl-1.1.1-fips-curves.patch @@ -1,111 +1,3 @@ -diff -up openssl-1.1.1g/crypto/ec/ec_curve.c.fips-curves openssl-1.1.1g/crypto/ec/ec_curve.c ---- openssl-1.1.1g/crypto/ec/ec_curve.c.fips-curves 2020-05-18 12:59:54.839643980 +0200 -+++ openssl-1.1.1g/crypto/ec/ec_curve.c 2020-05-18 12:59:54.852644093 +0200 -@@ -13,6 +13,7 @@ - #include - #include - #include -+#include - #include "internal/nelem.h" - - typedef struct { -@@ -237,6 +238,7 @@ static const struct { - - typedef struct _ec_list_element_st { - int nid; -+ int fips_allowed; - const EC_CURVE_DATA *data; - const EC_METHOD *(*meth) (void); - const char *comment; -@@ -246,23 +248,23 @@ static const ec_list_element curve_list[ - /* prime field curves */ - /* secg curves */ - #ifndef OPENSSL_NO_EC_NISTP_64_GCC_128 -- {NID_secp224r1, &_EC_NIST_PRIME_224.h, EC_GFp_nistp224_method, -+ {NID_secp224r1, 1, &_EC_NIST_PRIME_224.h, EC_GFp_nistp224_method, - "NIST/SECG curve over a 224 bit prime field"}, - #else -- {NID_secp224r1, &_EC_NIST_PRIME_224.h, 0, -+ {NID_secp224r1, 1, &_EC_NIST_PRIME_224.h, 0, - "NIST/SECG curve over a 224 bit prime field"}, - #endif -- {NID_secp256k1, &_EC_SECG_PRIME_256K1.h, 0, -+ {NID_secp256k1, 0, &_EC_SECG_PRIME_256K1.h, 0, - "SECG curve over a 256 bit prime field"}, - /* SECG secp256r1 is the same as X9.62 prime256v1 and hence omitted */ -- {NID_secp384r1, &_EC_NIST_PRIME_384.h, -+ {NID_secp384r1, 1, &_EC_NIST_PRIME_384.h, - # if defined(S390X_EC_ASM) - EC_GFp_s390x_nistp384_method, - # else - 0, - # endif - "NIST/SECG curve over a 384 bit prime field"}, -- {NID_secp521r1, &_EC_NIST_PRIME_521.h, -+ {NID_secp521r1, 1, &_EC_NIST_PRIME_521.h, - # if defined(S390X_EC_ASM) - EC_GFp_s390x_nistp521_method, - # elif !defined(OPENSSL_NO_EC_NISTP_64_GCC_128) -@@ -272,7 +274,7 @@ static const ec_list_element curve_list[ - # endif - "NIST/SECG curve over a 521 bit prime field"}, - /* X9.62 curves */ -- {NID_X9_62_prime256v1, &_EC_X9_62_PRIME_256V1.h, -+ {NID_X9_62_prime256v1, 1, &_EC_X9_62_PRIME_256V1.h, - #if defined(ECP_NISTZ256_ASM) - EC_GFp_nistz256_method, - # elif defined(S390X_EC_ASM) -@@ -404,6 +406,10 @@ EC_GROUP *EC_GROUP_new_by_curve_name(int - - for (i = 0; i < curve_list_length; i++) - if (curve_list[i].nid == nid) { -+ if (!curve_list[i].fips_allowed && FIPS_mode()) { -+ ECerr(EC_F_EC_GROUP_NEW_BY_CURVE_NAME, EC_R_NOT_A_NIST_PRIME); -+ return NULL; -+ } - ret = ec_group_new_from_data(curve_list[i]); - break; - } -@@ -418,19 +424,31 @@ EC_GROUP *EC_GROUP_new_by_curve_name(int - - size_t EC_get_builtin_curves(EC_builtin_curve *r, size_t nitems) - { -- size_t i, min; -+ size_t i, j, num; -+ int fips_mode = FIPS_mode(); - -- if (r == NULL || nitems == 0) -- return curve_list_length; -+ num = curve_list_length; -+ if (fips_mode) -+ for (i = 0; i < curve_list_length; i++) { -+ if (!curve_list[i].fips_allowed) -+ --num; -+ } - -- min = nitems < curve_list_length ? nitems : curve_list_length; -+ if (r == NULL || nitems == 0) { -+ return num; -+ } - -- for (i = 0; i < min; i++) { -- r[i].nid = curve_list[i].nid; -- r[i].comment = curve_list[i].comment; -+ for (i = 0, j = 0; i < curve_list_length; i++) { -+ if (j >= nitems) -+ break; -+ if (!fips_mode || curve_list[i].fips_allowed) { -+ r[j].nid = curve_list[i].nid; -+ r[j].comment = curve_list[i].comment; -+ ++j; -+ } - } - -- return curve_list_length; -+ return num; - } - - /* Functions to translate between common NIST curve names and NIDs */ diff -up openssl-1.1.1g/ssl/t1_lib.c.fips-curves openssl-1.1.1g/ssl/t1_lib.c --- openssl-1.1.1g/ssl/t1_lib.c.fips-curves 2020-05-18 12:59:54.797643616 +0200 +++ openssl-1.1.1g/ssl/t1_lib.c 2020-05-18 13:03:54.748725463 +0200 diff --git a/openssl-1.1.1-s390x-ecc.patch b/openssl-1.1.1-s390x-ecc.patch index 6b5963f..00aa775 100644 --- a/openssl-1.1.1-s390x-ecc.patch +++ b/openssl-1.1.1-s390x-ecc.patch @@ -83,47 +83,6 @@ diff -up openssl-1.1.1g/crypto/ec/build.info.s390x-ecc openssl-1.1.1g/crypto/ec/ GENERATE[x25519-x86_64.s]=asm/x25519-x86_64.pl $(PERLASM_SCHEME) GENERATE[x25519-ppc64.s]=asm/x25519-ppc64.pl $(PERLASM_SCHEME) -diff -up openssl-1.1.1g/crypto/ec/ec_curve.c.s390x-ecc openssl-1.1.1g/crypto/ec/ec_curve.c ---- openssl-1.1.1g/crypto/ec/ec_curve.c.s390x-ecc 2020-05-18 12:45:40.753233375 +0200 -+++ openssl-1.1.1g/crypto/ec/ec_curve.c 2020-05-18 12:45:42.663249975 +0200 -@@ -255,20 +255,29 @@ static const ec_list_element curve_list[ - {NID_secp256k1, &_EC_SECG_PRIME_256K1.h, 0, - "SECG curve over a 256 bit prime field"}, - /* SECG secp256r1 is the same as X9.62 prime256v1 and hence omitted */ -- {NID_secp384r1, &_EC_NIST_PRIME_384.h, 0, -+ {NID_secp384r1, &_EC_NIST_PRIME_384.h, -+# if defined(S390X_EC_ASM) -+ EC_GFp_s390x_nistp384_method, -+# else -+ 0, -+# endif - "NIST/SECG curve over a 384 bit prime field"}, --#ifndef OPENSSL_NO_EC_NISTP_64_GCC_128 -- {NID_secp521r1, &_EC_NIST_PRIME_521.h, EC_GFp_nistp521_method, -- "NIST/SECG curve over a 521 bit prime field"}, --#else -- {NID_secp521r1, &_EC_NIST_PRIME_521.h, 0, -+ {NID_secp521r1, &_EC_NIST_PRIME_521.h, -+# if defined(S390X_EC_ASM) -+ EC_GFp_s390x_nistp521_method, -+# elif !defined(OPENSSL_NO_EC_NISTP_64_GCC_128) -+ EC_GFp_nistp521_method, -+# else -+ 0, -+# endif - "NIST/SECG curve over a 521 bit prime field"}, --#endif - /* X9.62 curves */ - {NID_X9_62_prime256v1, &_EC_X9_62_PRIME_256V1.h, - #if defined(ECP_NISTZ256_ASM) - EC_GFp_nistz256_method, --#elif !defined(OPENSSL_NO_EC_NISTP_64_GCC_128) -+# elif defined(S390X_EC_ASM) -+ EC_GFp_s390x_nistp256_method, -+# elif !defined(OPENSSL_NO_EC_NISTP_64_GCC_128) - EC_GFp_nistp256_method, - #else - 0, diff -up openssl-1.1.1g/crypto/ec/ecdsa_ossl.c.s390x-ecc openssl-1.1.1g/crypto/ec/ecdsa_ossl.c --- openssl-1.1.1g/crypto/ec/ecdsa_ossl.c.s390x-ecc 2020-05-18 12:45:40.784233644 +0200 +++ openssl-1.1.1g/crypto/ec/ecdsa_ossl.c 2020-05-18 12:45:42.664249983 +0200