From eca676db7ab5e46b4611d0eb575d2019ad34c0e6 Mon Sep 17 00:00:00 2001
From: Tomas Mraz <tmraz@fedoraproject.org>
Date: Thu, 24 Oct 2013 10:40:18 +0200
Subject: [PATCH] do not advertise ECC curves we do not support (#1022493)

---
 ...b.patch => openssl-1.0.1e-ecc-suiteb.patch | 41 +++++++++++++++++--
 openssl.spec                                  |  7 +++-
 2 files changed, 43 insertions(+), 5 deletions(-)
 rename openssl-1.0.1e-speed-suiteb.patch => openssl-1.0.1e-ecc-suiteb.patch (72%)

diff --git a/openssl-1.0.1e-speed-suiteb.patch b/openssl-1.0.1e-ecc-suiteb.patch
similarity index 72%
rename from openssl-1.0.1e-speed-suiteb.patch
rename to openssl-1.0.1e-ecc-suiteb.patch
index a5135d3..95b192a 100644
--- a/openssl-1.0.1e-speed-suiteb.patch
+++ b/openssl-1.0.1e-ecc-suiteb.patch
@@ -1,6 +1,6 @@
 diff -up openssl-1.0.1e/apps/speed.c.suiteb openssl-1.0.1e/apps/speed.c
---- openssl-1.0.1e/apps/speed.c.suiteb	2013-09-27 15:57:09.947894307 +0200
-+++ openssl-1.0.1e/apps/speed.c	2013-09-27 15:57:52.528852804 +0200
+--- openssl-1.0.1e/apps/speed.c.suiteb	2013-10-18 17:38:22.288870517 +0200
++++ openssl-1.0.1e/apps/speed.c	2013-10-18 17:38:22.336871572 +0200
 @@ -966,49 +966,21 @@ int MAIN(int argc, char **argv)
  		else
  #endif
@@ -73,7 +73,7 @@ diff -up openssl-1.0.1e/apps/speed.c.suiteb openssl-1.0.1e/apps/speed.c
  			BIO_printf(bio_err,"ecdh\n");
  #endif
  
-@@ -1181,11 +1149,11 @@ int MAIN(int argc, char **argv)
+@@ -1184,11 +1152,11 @@ int MAIN(int argc, char **argv)
  		    if (!FIPS_mode() || i != R_DSA_512)
  			dsa_doit[i]=1;
  #ifndef OPENSSL_NO_ECDSA
@@ -87,3 +87,38 @@ diff -up openssl-1.0.1e/apps/speed.c.suiteb openssl-1.0.1e/apps/speed.c
  			ecdh_doit[i]=1;
  #endif
  		}
+diff -up openssl-1.0.1e/ssl/t1_lib.c.suiteb openssl-1.0.1e/ssl/t1_lib.c
+--- openssl-1.0.1e/ssl/t1_lib.c.suiteb	2013-02-11 16:26:04.000000000 +0100
++++ openssl-1.0.1e/ssl/t1_lib.c	2013-10-24 09:41:11.892179845 +0200
+@@ -204,31 +204,8 @@ static int nid_list[] =
+ 
+ static int pref_list[] =
+ 	{
+-		NID_sect571r1, /* sect571r1 (14) */ 
+-		NID_sect571k1, /* sect571k1 (13) */ 
+-		NID_secp521r1, /* secp521r1 (25) */	
+-		NID_sect409k1, /* sect409k1 (11) */ 
+-		NID_sect409r1, /* sect409r1 (12) */
+ 		NID_secp384r1, /* secp384r1 (24) */
+-		NID_sect283k1, /* sect283k1 (9) */
+-		NID_sect283r1, /* sect283r1 (10) */ 
+-		NID_secp256k1, /* secp256k1 (22) */ 
+ 		NID_X9_62_prime256v1, /* secp256r1 (23) */ 
+-		NID_sect239k1, /* sect239k1 (8) */ 
+-		NID_sect233k1, /* sect233k1 (6) */
+-		NID_sect233r1, /* sect233r1 (7) */ 
+-		NID_secp224k1, /* secp224k1 (20) */ 
+-		NID_secp224r1, /* secp224r1 (21) */
+-		NID_sect193r1, /* sect193r1 (4) */ 
+-		NID_sect193r2, /* sect193r2 (5) */ 
+-		NID_secp192k1, /* secp192k1 (18) */
+-		NID_X9_62_prime192v1, /* secp192r1 (19) */ 
+-		NID_sect163k1, /* sect163k1 (1) */
+-		NID_sect163r1, /* sect163r1 (2) */
+-		NID_sect163r2, /* sect163r2 (3) */
+-		NID_secp160k1, /* secp160k1 (15) */
+-		NID_secp160r1, /* secp160r1 (16) */ 
+-		NID_secp160r2, /* secp160r2 (17) */ 
+ 	};
+ 
+ int tls1_ec_curve_id2nid(int curve_id)
diff --git a/openssl.spec b/openssl.spec
index bd655d2..a843a76 100644
--- a/openssl.spec
+++ b/openssl.spec
@@ -21,7 +21,7 @@
 Summary: Utilities from the general purpose cryptography library with TLS implementation
 Name: openssl
 Version: 1.0.1e
-Release: 28%{?dist}
+Release: 29%{?dist}
 Epoch: 1
 # We have to remove certain patented algorithms from the openssl source
 # tarball with the hobble-openssl script which is included below.
@@ -73,7 +73,7 @@ Patch69: openssl-1.0.1c-dh-1024.patch
 Patch70: openssl-1.0.1e-fips-ec.patch
 Patch71: openssl-1.0.1e-manfix.patch
 Patch72: openssl-1.0.1e-fips-ctor.patch
-Patch73: openssl-1.0.1e-speed-suiteb.patch
+Patch73: openssl-1.0.1e-ecc-suiteb.patch
 # Backported fixes including security fixes
 Patch81: openssl-1.0.1-beta2-padlock64.patch
 Patch82: openssl-1.0.1e-backports.patch
@@ -456,6 +456,9 @@ rm -rf $RPM_BUILD_ROOT/%{_libdir}/fipscanister.*
 %postun libs -p /sbin/ldconfig
 
 %changelog
+* Thu Oct 24 2013 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-29
+- do not advertise ECC curves we do not support (#1022493)
+
 * Wed Oct 16 2013 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-28
 - only ECC NIST Suite B curves support
 - drop -fips subpackage