jonathan/openssl
1
0
Fork 0
forked from rpms/openssl
Code Pull Requests Activity
536 Commits 9 Branches 54 Tags 6.5 MiB
0eaa0014c9
Commit Graph

443 Commits

Author SHA1 Message Date
Clemens Lang
0eaa0014c9 Fix a FIXME in the openssl.cnf(5) manpage 
Signed-off-by: Clemens Lang <cllang@redhat.com>
 2022-04-20 15:47:59 +02:00
Clemens Lang
0967bb5953 ELN: Disable SHA-1 by default using CentOS patches 
ELN should ideally be ahead of CentOS and RHEL with policy changes, but
due to time constraints was not. Fix that by bringing the current CentOS
9 / RHEL 9 state of SHA-1 disabling to ELN.

Due to differences in their lifecycles, Fedora's packages will stay at
allowing SHA-1 by default for now. There is a plan to gradually catch up
to the ELN state over the next few releases.

Signed-off-by: Clemens Lang <cllang@redhat.com>
 2022-04-20 15:18:07 +02:00
Clemens Lang
82a6212c47 Silence rpmlint false positives 
capi.so is only useful on Windows, it does not matter that it does not
have dependency information.

The invalid URL warnings are expected for packages with hobbled source
code archives.

We explicitly allow the use of SSL_CTX_set_cipher_list in the openssl(1)
binary.

Signed-off-by: Clemens Lang <cllang@redhat.com>
 2022-04-07 18:14:35 +02:00
Clemens Lang
432cfa2baa Allow disabling of SHA1 signatures 
NOTE: This patch is ported from CentOS 9 / RHEL 9, where it defaults to
denying SHA1 signatures. On Fedora, the default is – for now – to allow
SHA1 signatures.

In order to phase out SHA1 signatures, introduce a new configuration
option in the alg_section named 'rh-allow-sha1-signatures'. This option
defaults to true. If set to false, any signature creation or
verification operations that involve SHA1 as digest will fail.

This also affects TLS, where the signature_algorithms extension of any
ClientHello message sent by OpenSSL will no longer include signatures
with the SHA1 digest if rh-allow-sha1-signatures is false. For servers
that request a client certificate, the same also applies for
CertificateRequest messages sent by them.

Resolves: rhbz#2070977
Related: rhbz#2031742, rhbz#2062640
Signed-off-by: Clemens Lang <cllang@redhat.com>
 2022-04-07 18:14:04 +02:00
Dmitry Belyavskiy
a0bd929a42 Update to openssl 3.0.2 
Related: rhbz#2064453
 2022-03-18 10:41:13 +01:00
Fedora Release Engineering
b9f33d724e - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild 
Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
 2022-01-20 22:29:33 +00:00
Sahana Prasad
347681c6b2 Rebase to upstream version 3.0.0 
Signed-off-by: Sahana Prasad <sahana@redhat.com>
 2021-09-09 17:27:21 +02:00
Fedora Release Engineering
5de10d4810 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild 
Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
 2021-07-22 17:20:55 +00:00
Sahana Prasad
0f5f931f9a update to version 1.1.1k 
Signed-off-by: Sahana Prasad <sahana@redhat.com>
 2021-03-26 07:37:03 +01:00
Sahana Prasad
b023ffe39f Upgrade to version 1.1.1.j 
Signed-off-by: Sahana Prasad <sahana@redhat.com>
 2021-03-03 15:08:11 +01:00
Sahana Prasad
fb8e66a58f Fix regression in X509_verify_cert() #bz1916594 
Signed-off-by: Sahana Prasad <sahana@redhat.com>
 2021-02-10 14:56:08 +01:00
Fedora Release Engineering
d34c6392bf - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild 
Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
 2021-01-26 22:36:18 +00:00
Tom Stellard
c89aeae26c Add BuildRequires: make 
https://fedoraproject.org/wiki/Changes/Remove_make_from_BuildRoot
 2021-01-07 06:39:07 +00:00
Tomas Mraz
a07706cf0e Update to the 1.1.1i release fixing CVE-2020-1971 2020-12-09 10:49:38 +01:00
Sahana Prasad
3413ff9700 Upgrade to version 1.1.1h 
Signed-off-by: Sahana Prasad <sahana@redhat.com>
 2020-11-09 10:41:15 +01:00
Jakub Jelen
261f10a200 Do not ship in main package manuals (or aliases) to tools from perl subpackage 2020-10-23 10:06:51 +02:00
Fedora Release Engineering
7ae2c9cd85 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild 
Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
 2020-07-28 12:48:57 +00:00
Tom Stellard
a75e581407 Use make macros 
https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro
 2020-07-21 20:31:48 +00:00
Tomas Mraz
067d5800f2 Additional FIPS mode check for EC key generation 2020-07-20 14:51:05 +02:00
Tomas Mraz
04d5ef4d72 Further changes for SP 800-56A rev3 requirements 2020-07-17 12:41:39 +02:00
Tomas Mraz
7f27ca925c Drop long ago obsolete part of the FIPS patch 2020-06-23 15:55:16 +02:00
Tomas Mraz
f023424321 Rewire FIPS_drbg API to use the RAND_DRBG 2020-06-22 13:43:12 +02:00
Tomas Mraz
ef93cf994d SHA1 is allowed in @SECLEVEL=2 only if allowed by TLS SigAlgs configuration 
Also some small TLS protocol fixes/changes:

Disallow dropping Extended Master Secret extension on renegotiation
Return alert from s_server if ALPN protocol does not match
 2020-06-05 17:39:16 +02:00
Tomas Mraz
b9c80ecf85 Add FIPS selftest for PBKDF2 and KBKDF 
Also more adjustments to the FIPS DH handling
 2020-06-03 16:30:12 +02:00
Tomas Mraz
9833eff277 Use the well known DH groups in TLS 2020-05-26 09:28:42 +02:00
Tomas Mraz
8746bcba4c Allow only well known DH groups in the FIPS mode 2020-05-25 18:52:45 +02:00
Adam Williamson
7396eb055e Re-apply change from -2 now we have fixed nosync to work with it 2020-05-21 13:04:18 -07:00
Adam Williamson
87eaf879ac Revert the change from -2 as it seems to cause segfaults 2020-05-19 18:35:16 -07:00
Tomas Mraz
1e6a98d9e9 pull some fixes and improvements from RHEL-8 2020-05-18 13:26:53 +02:00
Tomas Mraz
89a24d69fc FIPS module installed state definition is modified 2020-05-15 17:45:44 +02:00
Tomas Mraz
5888d1863e update to the 1.1.1g release 2020-04-23 13:47:52 +02:00
Tomas Mraz
5004ccfb25 update to the 1.1.1f release 2020-04-07 16:50:53 +02:00
Tomas Mraz
ea310218f3 revert the unexpected EOF error reporting change 
it is too disruptive for the stable release branch
 2020-03-26 15:14:08 +01:00
Tomas Mraz
c9936c55c2 Additional perl module buildrequires 2020-03-20 13:30:41 +01:00
Tomas Mraz
30d45eb047 Add BuildRequires perl(FindBin) 2020-03-20 12:44:34 +01:00
Tomas Mraz
c11b71fd2f update to the 1.1.1e release 
add selftest of the RAND_DRBG implementation
fix incorrect error return value from FIPS_selftest_dsa
 2020-03-19 17:44:25 +01:00
Tomas Mraz
b9b156fb97 apply Intel CET support patches by hjl (#1788699) 2020-02-17 11:54:47 +01:00
Fedora Release Engineering
898af7893c - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild 
Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
 2020-01-29 20:25:04 +00:00
Tomas Mraz
b8a97dc1d8 allow zero length parameters in KDF_CTX_ctrl() 2019-11-21 14:49:21 +01:00
Tomas Mraz
0536b721ef backport of SSKDF from master 2019-11-14 16:13:49 +01:00
Tomas Mraz
266efa3055 backport of KBKDF and KRB5KDF from master 2019-11-13 13:43:05 +01:00
Tomas Mraz
f1c4ba61a3 Multiple fixes 
re-enable the stitched AES-CBC-SHA implementations
make AES-GCM work in FIPS mode again
enable TLS-1.2 AES-CCM ciphers in FIPS mode
fix openssl speed errors in FIPS mode
 2019-10-03 17:43:23 +02:00
Tomas Mraz
f6a62c4c2c update to the 1.1.1d release 2019-09-13 17:25:44 +02:00
Tomas Mraz
c44b3f96fe Bump release correctly 2019-09-06 17:18:46 +02:00
Tomas Mraz
45ebb7fdc2 upstream fix for status request extension non-compliance (#1737471) 2019-09-06 17:02:18 +02:00
Fedora Release Engineering
dba4c3b578 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild 
Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
 2019-07-25 23:35:44 +00:00
Tomas Mraz
8419f769c7 Do not try to use EC groups disallowed in FIPS mode in TLS 
Also fix Valgrind regression with constant-time code
 2019-06-24 15:13:12 +02:00
Tomas Mraz
a71f5ae7ab add upstream patch to defer sending KeyUpdate 
(after pending writes are complete)
 2019-06-03 16:05:45 +02:00
Tomas Mraz
4784e45765 fix use of uninitialized memory 2019-05-30 11:55:39 +02:00
Tomas Mraz
31d61b19d5 update to the 1.1.1c release 2019-05-29 17:23:31 +02:00