jonathan/openssl
1
0
Fork 0
forked from rpms/openssl
Code Pull Requests Activity

Provide relevant diagnostics when FIPS checksum is corrupted

Browse Source 
Resolves: RHEL-5317
This commit is contained in:
Dmitry Belyavskiy 2023-10-12 14:07:54 +02:00
parent d30c497ed1
commit 131e7d1602
2 changed files with 9 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
0032-Force-fips.patch
View File

@ -151,7 +151,7 @@ diff -up openssl-3.0.1/crypto/provider_conf.c.fipsact openssl-3.0.1/crypto/provi
} else { } else {
OSSL_PROVIDER_INFO entry; OSSL_PROVIDER_INFO entry;
@@ -306,6 +317,30 @@ static int provider_conf_init(CONF_IMODU @@ -306,6 +317,33 @@ static int provider_conf_init(CONF_IMODU
return 0; return 0;
} }
@ -173,6 +173,9 @@ diff -up openssl-3.0.1/crypto/provider_conf.c.fipsact openssl-3.0.1/crypto/provi
+ if (provider_conf_activate(libctx, "fips", NULL, NULL, 0, NULL) != 1) + if (provider_conf_activate(libctx, "fips", NULL, NULL, 0, NULL) != 1)
+ return 0; + return 0;
+ } + }
+ /* provider_conf_load can return 1 even wwhen the test is failed so check explicitly */
+ if (OSSL_PROVIDER_available(libctx, "fips") != 1)
+ return 0;
+ if (provider_conf_activate(libctx, "base", NULL, NULL, 0, NULL) != 1) + if (provider_conf_activate(libctx, "base", NULL, NULL, 0, NULL) != 1)
+ return 0; + return 0;
+ if (EVP_default_properties_enable_fips(libctx, 1) != 1) + if (EVP_default_properties_enable_fips(libctx, 1) != 1)

6
openssl.spec
View File

@ -29,7 +29,7 @@ print(string.sub(hash, 0, 16))
Summary: Utilities from the general purpose cryptography library with TLS implementation Summary: Utilities from the general purpose cryptography library with TLS implementation
Name: openssl Name: openssl
Version: 3.0.7 Version: 3.0.7
Release: 24%{?dist} Release: 25%{?dist}
Epoch: 1 Epoch: 1
# We have to remove certain patented algorithms from the openssl source # We have to remove certain patented algorithms from the openssl source
# tarball with the hobble-openssl script which is included below. # tarball with the hobble-openssl script which is included below.
@ -522,6 +522,10 @@ ln -s /etc/crypto-policies/back-ends/openssl_fips.config $RPM_BUILD_ROOT%{_sysco
%ldconfig_scriptlets libs %ldconfig_scriptlets libs
%changelog %changelog
* Mon Oct 16 2023 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.7-25
- Provide relevant diagnostics when FIPS checksum is corrupted
Resolves: RHEL-5317
* Wed Jul 12 2023 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.7-24 * Wed Jul 12 2023 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.7-24
- Make FIPS module configuration more crypto-policies friendly - Make FIPS module configuration more crypto-policies friendly
Related: rhbz#2216256 Related: rhbz#2216256