44 changed files with 10198 additions and 13519 deletions
--- a/.gitignore
+++ b/.gitignore
@ -1,4 +1,3 @@
-SOURCES/gmp-6.2.1.tar.xz
-SOURCES/gnutls-3.7.6.tar.xz
-SOURCES/gnutls-3.7.6.tar.xz.sig
-SOURCES/gnutls-release-keyring.gpg
+SOURCES/gnutls-3.6.16.tar.xz
+SOURCES/gnutls-3.6.16.tar.xz.sig
+SOURCES/gpgkey-462225C3B46F34879FC8496CD605848ED7E69871.gpg
--- a/.gnutls.metadata
+++ b/.gnutls.metadata
@ -1,4 +1,3 @@
-0578d48607ec0e272177d175fd1807c30b00fdf2 SOURCES/gmp-6.2.1.tar.xz
-47591374259451fe2cd86c5fe7c345e769a6c79b SOURCES/gnutls-3.7.6.tar.xz
-0ebda3673eafa2ab34068a7ea798d6e385440d56 SOURCES/gnutls-3.7.6.tar.xz.sig
-befcf25b9dcd1d36b8bdb754c80c639eca45baa0 SOURCES/gnutls-release-keyring.gpg
+6ba8fb898dcf4b4046b60662ba97df835593e687 SOURCES/gnutls-3.6.16.tar.xz
+b41ac56ff6cca4539c8b084db2c84e8bc21d60ac SOURCES/gnutls-3.6.16.tar.xz.sig
+648ec46f9539fe756fb90131b85ae4759ed2ed21 SOURCES/gpgkey-462225C3B46F34879FC8496CD605848ED7E69871.gpg
--- a/SOURCES/gmp-6.2.1-intel-cet.patch
+++ b/SOURCES/gmp-6.2.1-intel-cet.patch
--- a/SOURCES/gnutls-3.6.13-enable-intel-cet.patch
+++ b/SOURCES/gnutls-3.6.13-enable-intel-cet.patch
--- a/SOURCES/gnutls-3.6.14-fips-dh-selftests.patch
+++ b/SOURCES/gnutls-3.6.14-fips-dh-selftests.patch
@ -0,0 +1,204 @@
+From f09b7627a63defb1c55e9965fb05e0bbddb90247 Mon Sep 17 00:00:00 2001
+From: Daiki Ueno <ueno@gnu.org>
+Date: Tue, 6 Oct 2020 11:54:21 +0200
+Subject: [PATCH] fips: use larger prime for DH self-tests
+
+According to FIPS140-2 IG 7.5, the minimum key size of FFC through
+2030 is defined as 2048 bits.  This updates the relevant self-test
+using ffdhe3072 defined in RFC 7919.
+
+Signed-off-by: Daiki Ueno <ueno@gnu.org>
+---
+ lib/crypto-selftests-pk.c | 142 ++++++++++++++++++++++++++++++++++----
+ lib/dh-primes.c           |   4 --
+ 2 files changed, 130 insertions(+), 16 deletions(-)
+
+diff --git a/lib/crypto-selftests-pk.c b/lib/crypto-selftests-pk.c
+index 70b0f618f..9b7c692a8 100644
+--- a/lib/crypto-selftests-pk.c
+++ b/lib/crypto-selftests-pk.c
+@@ -620,32 +620,150 @@ static int test_dh(void)
+ 	gnutls_pk_params_st priv;
+ 	gnutls_pk_params_st pub;
+ 	gnutls_datum_t out = {NULL, 0};
+
+	/* FFDHE 3072 test vector provided by Stephan Mueller in:
+	 * https://gitlab.com/gnutls/gnutls/-/merge_requests/1342#note_424430996
+	 */
+ 	static const uint8_t known_dh_k[] = {
+-		0x10, 0x25, 0x04, 0xb5, 0xc6, 0xc2, 0xcb, 
+-		0x0c, 0xe9, 0xc5, 0x58, 0x0d, 0x22, 0x62};
+-	static const uint8_t test_p[] = {
+-		0x24, 0x85, 0xdd, 0x3a, 0x74, 0x42, 0xe4, 
+-		0xb3, 0xf1, 0x0b, 0x13, 0xf9, 0x17, 0x4d };
+-	static const uint8_t test_g[] = { 0x02 };
+		0xec, 0xb3, 0x85, 0x0c, 0x72, 0x55, 0x55, 0xc2, 0x98, 0x36,
+		0xbe, 0x75, 0x9e, 0xc9, 0x9d, 0x8b, 0x16, 0xa6, 0xe6, 0x84,
+		0x33, 0x12, 0x80, 0x1d, 0xac, 0xde, 0x6a, 0xd7, 0x3b, 0x1e,
+		0x15, 0xca, 0x5d, 0x26, 0xb3, 0x0a, 0x35, 0xf4, 0xbb, 0xad,
+		0x71, 0xcb, 0x03, 0x1a, 0xcb, 0xfb, 0x83, 0xf0, 0xa8, 0xde,
+		0xed, 0x5e, 0x3d, 0x98, 0xd2, 0xb0, 0xef, 0xad, 0xdf, 0x32,
+		0xa0, 0x16, 0x7d, 0x0e, 0x29, 0xd8, 0x85, 0xca, 0x12, 0x97,
+		0x56, 0xab, 0x6a, 0x26, 0xa4, 0x46, 0x3d, 0x87, 0xd7, 0xe0,
+		0xb4, 0x3e, 0x28, 0x75, 0xac, 0x59, 0xc5, 0x71, 0x3a, 0x24,
+		0x15, 0x76, 0x98, 0x72, 0x94, 0x2d, 0xd0, 0x0e, 0xbc, 0x9a,
+		0x77, 0xd4, 0xe2, 0xb2, 0x76, 0x54, 0x4a, 0x56, 0xbe, 0x0b,
+		0x43, 0xf8, 0x21, 0x6f, 0x54, 0x32, 0xde, 0xb7, 0xd5, 0xb7,
+		0x08, 0x00, 0xd2, 0x57, 0x8c, 0x0b, 0x8b, 0x02, 0x3e, 0xdb,
+		0x72, 0x54, 0x3a, 0xc0, 0x50, 0x66, 0xbc, 0xc9, 0x67, 0xf5,
+		0x22, 0x28, 0xf2, 0x3c, 0x51, 0x94, 0x61, 0x26, 0x9a, 0xc6,
+		0x42, 0x0e, 0x8b, 0x42, 0xad, 0x79, 0x40, 0xa9, 0x0b, 0xdc,
+		0x84, 0xd5, 0x71, 0x83, 0x94, 0xd9, 0x83, 0x2f, 0x08, 0x74,
+		0xbc, 0x37, 0x6a, 0x3e, 0x1e, 0xbc, 0xcc, 0x09, 0x23, 0x30,
+		0x79, 0x01, 0x39, 0xf6, 0xe3, 0xa8, 0xc0, 0xfa, 0x7e, 0xdb,
+		0x0b, 0x71, 0x3e, 0x4f, 0x1f, 0x69, 0x84, 0xa6, 0x58, 0x6c,
+		0x36, 0x2c, 0xcc, 0xb4, 0x7c, 0x94, 0xec, 0x06, 0x0b, 0x11,
+		0x53, 0x95, 0xe6, 0x05, 0x43, 0xa4, 0xe4, 0xea, 0x1d, 0x4f,
+		0xdc, 0xd0, 0x38, 0x0e, 0x32, 0xa1, 0xde, 0xd9, 0x8d, 0xd8,
+		0x20, 0xac, 0x04, 0x83, 0xf8, 0x1b, 0x55, 0x52, 0x16, 0x20,
+		0xe3, 0x2e, 0x6d, 0x11, 0x15, 0x29, 0x2f, 0x3a, 0x7c, 0x80,
+		0x0a, 0x71, 0x3d, 0x31, 0x9c, 0x1b, 0x73, 0x59, 0xe1, 0x0d,
+		0x27, 0xc5, 0xc0, 0x6a, 0x72, 0x3a, 0x5b, 0xd6, 0xf6, 0x50,
+		0xe6, 0x69, 0x48, 0x1e, 0xfd, 0xeb, 0x4a, 0x47, 0x73, 0xfb,
+		0x88, 0x14, 0xea, 0x6d, 0x36, 0xe1, 0x4c, 0x2c, 0xf9, 0x04,
+		0xc1, 0xb7, 0x29, 0xfc, 0x5d, 0x02, 0x5d, 0x1c, 0x4d, 0x31,
+		0x4a, 0x51, 0x3f, 0xa4, 0x45, 0x19, 0x29, 0xc4, 0x32, 0xa6,
+		0x45, 0xdb, 0x94, 0x3a, 0xbd, 0x76, 0x2c, 0xd6, 0x1a, 0xb1,
+		0xff, 0xe7, 0x62, 0x75, 0x16, 0xe5, 0x0b, 0xa3, 0x3a, 0x93,
+		0x84, 0xd6, 0xad, 0xc2, 0x24, 0x68, 0x3d, 0xd6, 0x07, 0xe4,
+		0xbe, 0x5a, 0x49, 0x31, 0x06, 0xad, 0x3f, 0x31, 0x4a, 0x1c,
+		0xf7, 0x58, 0xdf, 0x34, 0xcb, 0xc8, 0xa9, 0x07, 0x24, 0x42,
+		0x63, 0xa5, 0x8e, 0xdd, 0x37, 0x78, 0x92, 0x68, 0x3f, 0xd8,
+		0x2f, 0xea, 0x8c, 0xf1, 0x8e, 0xd4, 0x8b, 0xa7, 0x3f, 0xa0,
+		0xfa, 0xaf, 0xf0, 0x35,
+	};
+ 	static const uint8_t test_x[] = {
+-		0x06, 0x2c, 0x96, 0xae, 0x0e, 0x9e, 0x9b, 
+-		0xbb, 0x41, 0x51, 0x7a, 0xa7, 0xc5, 0xfe };
+		0x16, 0x5c, 0xa6, 0xe0, 0x9b, 0x87, 0xfa, 0x2d, 0xbc, 0x13,
+		0x20, 0xcd, 0xac, 0x4e, 0xcc, 0x60, 0x1e, 0x48, 0xec, 0xbe,
+		0x73, 0x0c, 0xa8, 0x6b, 0x6e, 0x2a, 0xee, 0xdd, 0xd8, 0xf3,
+		0x2d, 0x5f, 0x75, 0xf3, 0x07, 0x94, 0x88, 0x3d, 0xb1, 0x38,
+		0xcf, 0xae, 0x4a, 0xcc, 0xcb, 0x6a, 0x80, 0xbc, 0xeb, 0x3b,
+		0xaa, 0x0b, 0x18, 0x74, 0x58, 0x7c, 0x3e, 0x74, 0xef, 0xb6,
+		0xd3, 0x15, 0xee, 0x73, 0x29, 0x88, 0x7b, 0x65, 0x02, 0x39,
+		0x33, 0xec, 0x22, 0x06, 0x8c, 0x5b, 0xd6, 0x2f, 0x4c, 0xf7,
+		0xe0, 0x97, 0x6d, 0x2a, 0x90, 0x36, 0xfe, 0x1a, 0x44, 0x4d,
+		0x9d, 0x41, 0x4b, 0xcb, 0xec, 0x25, 0xf4, 0xc3, 0xa5, 0x91,
+		0xd0, 0x90, 0xc9, 0x34, 0x7b, 0xba, 0x27, 0x30, 0x5a, 0xa2,
+		0x21, 0x58, 0xce, 0x88, 0x25, 0x39, 0xaf, 0xf1, 0x17, 0x02,
+		0x12, 0xf8, 0x55, 0xdc, 0xd2, 0x08, 0x5b, 0xd3, 0xc7, 0x8e,
+		0xcf, 0x29, 0x85, 0x85, 0xdb, 0x5c, 0x08, 0xc2, 0xd7, 0xb0,
+		0x33, 0x0e, 0xe3, 0xb9, 0x2c, 0x1a, 0x1d, 0x4b, 0xe5, 0x76,
+		0x8f, 0xd3, 0x14, 0xb6, 0x8c, 0xdc, 0x9a, 0xe8, 0x15, 0x60,
+		0x60, 0x5e, 0xaa, 0xf9, 0xfa, 0xa6, 0xb2, 0x4f, 0xff, 0x46,
+		0xc1, 0x5e, 0x93, 0x50, 0x90, 0x7e, 0x4c, 0x26, 0xd7, 0xbb,
+		0x21, 0x05, 0x3d, 0x27, 0xc5, 0x9b, 0x0d, 0x46, 0x69, 0xe4,
+		0x74, 0x87, 0x74, 0x55, 0xee, 0x5f, 0xe5, 0x72, 0x04, 0x46,
+		0x1f, 0x2e, 0x55, 0xc7, 0xcc, 0x2b, 0x2b, 0x39, 0x6d, 0x90,
+		0x60, 0x31, 0x37, 0x5b, 0x44, 0xde, 0xfd, 0xf2, 0xd1, 0xc6,
+		0x9c, 0x12, 0x82, 0xcc, 0x7c, 0xb1, 0x0e, 0xa9, 0x95, 0x9d,
+		0xe0, 0xa8, 0x3e, 0xc1, 0xa3, 0x4a, 0x6a, 0x37, 0x59, 0x17,
+		0x93, 0x63, 0x1e, 0xbf, 0x04, 0xa3, 0xaa, 0xc0, 0x1d, 0xc4,
+		0x6d, 0x7a, 0xdc, 0x69, 0x9c, 0xb0, 0x22, 0x56, 0xd9, 0x76,
+		0x92, 0x2d, 0x1e, 0x62, 0xae, 0xfd, 0xd6, 0x9b, 0xfd, 0x08,
+		0x2c, 0x95, 0xec, 0xe7, 0x02, 0x43, 0x62, 0x68, 0x1a, 0xaf,
+		0x46, 0x59, 0xb7, 0xce, 0x8e, 0x42, 0x24, 0xae, 0xf7, 0x0e,
+		0x9a, 0x3b, 0xf8, 0x77, 0xdf, 0x26, 0x85, 0x9f, 0x45, 0xad,
+		0x8c, 0xa9, 0x54, 0x9c, 0x46, 0x44, 0xd5, 0x8a, 0xe9, 0xcc,
+		0x34, 0x5e, 0xc5, 0xd1, 0x42, 0x6f, 0x44, 0xf3, 0x0f, 0x90,
+		0x3a, 0x32, 0x1a, 0x9c, 0x2a, 0x63, 0xec, 0x21, 0xb4, 0xfc,
+		0xfa, 0xa5, 0xcf, 0xe7, 0x9e, 0x43, 0xc7, 0x49, 0x56, 0xbc,
+		0x50, 0xc5, 0x84, 0xf0, 0x42, 0xc8, 0x6a, 0xf1, 0x78, 0xe4,
+		0xaa, 0x06, 0x37, 0xe1, 0x30, 0xf7, 0x65, 0x97, 0xca, 0xfd,
+		0x35, 0xfa, 0xeb, 0x48, 0x6d, 0xaa, 0x45, 0x46, 0x9d, 0xbc,
+		0x1d, 0x98, 0x17, 0x45, 0xa3, 0xee, 0x21, 0xa0, 0x97, 0x38,
+		0x80, 0xc5, 0x28, 0x1f,
+	};
+ 	static const uint8_t test_y[] = { /* y=g^x mod p */
+-		0x1e, 0xca, 0x23, 0x2a, 0xfd, 0x34, 0xe1, 
+-		0x10, 0x7a, 0xff, 0xaf, 0x2d, 0xaa, 0x53 };
+		0x93, 0xeb, 0x5c, 0x37, 0x1d, 0x3c, 0x06, 0x6f, 0xbf, 0xbe,
+		0x96, 0x51, 0x26, 0x58, 0x81, 0x36, 0xc6, 0x4f, 0x9a, 0x34,
+		0xc4, 0xc5, 0xa8, 0xa3, 0x2c, 0x41, 0x76, 0xa8, 0xc6, 0xc0,
+		0xa0, 0xc8, 0x51, 0x36, 0xc4, 0x40, 0x4e, 0x2c, 0x69, 0xf7,
+		0x51, 0xbb, 0xb0, 0xd6, 0xf5, 0xdb, 0x40, 0x29, 0x50, 0x3b,
+		0x8a, 0xf9, 0xf3, 0x53, 0x78, 0xfc, 0x86, 0xe9, 0xf1, 0xe9,
+		0xac, 0x85, 0x13, 0x65, 0x62, 0x22, 0x04, 0x1b, 0x14, 0x2a,
+		0xf4, 0x8f, 0x2f, 0xf1, 0x2f, 0x81, 0xd6, 0x18, 0x0e, 0x76,
+		0x91, 0x43, 0xb2, 0xfc, 0x7c, 0x6f, 0x0c, 0x45, 0x37, 0x31,
+		0x31, 0x58, 0x5c, 0xdf, 0x42, 0x24, 0x7a, 0xba, 0x8b, 0x7f,
+		0x79, 0x06, 0x07, 0xef, 0xd6, 0x06, 0xeb, 0xcb, 0x3c, 0xbd,
+		0xbc, 0xe5, 0xff, 0xfd, 0x62, 0x15, 0x0c, 0x40, 0x46, 0x37,
+		0xef, 0xd0, 0xa1, 0xde, 0x63, 0x4f, 0x20, 0x0b, 0x45, 0x7d,
+		0x06, 0x77, 0xfd, 0x23, 0xc1, 0x32, 0x8a, 0x89, 0x65, 0x16,
+		0xe8, 0x48, 0x12, 0x1c, 0x25, 0x33, 0x2d, 0xbd, 0xd8, 0x9f,
+		0x1c, 0x9d, 0xbc, 0xe3, 0x08, 0x60, 0x87, 0x1a, 0xc6, 0x06,
+		0x36, 0xd2, 0xac, 0x09, 0x6d, 0x99, 0x02, 0x89, 0xc6, 0x12,
+		0x93, 0x8c, 0x4b, 0xd0, 0x7e, 0x36, 0x8a, 0xd6, 0xa0, 0x97,
+		0x4f, 0x97, 0x3f, 0x97, 0x0b, 0xfe, 0x05, 0xfc, 0xc8, 0xef,
+		0x21, 0x4d, 0x4a, 0x06, 0x6e, 0xb4, 0xa6, 0x4f, 0xe1, 0xdd,
+		0x44, 0x06, 0xfa, 0xd5, 0x0e, 0x54, 0xf5, 0x54, 0x3e, 0x8c,
+		0xb9, 0x85, 0x86, 0x00, 0x40, 0x98, 0xe7, 0x01, 0xdd, 0x93,
+		0x9d, 0x95, 0xea, 0xf0, 0xd3, 0x99, 0x4b, 0xeb, 0xd5, 0x79,
+		0x47, 0xa4, 0xad, 0x2a, 0xe0, 0x4d, 0x36, 0x3b, 0x46, 0x10,
+		0x96, 0xbb, 0x48, 0xe9, 0xa1, 0x78, 0x01, 0x35, 0x0a, 0x5c,
+		0x7b, 0x3f, 0xf5, 0xf7, 0xb1, 0xe3, 0x97, 0x17, 0x4d, 0x76,
+		0x10, 0x8d, 0x68, 0x4c, 0x94, 0x7d, 0xee, 0x0e, 0x20, 0x8b,
+		0xce, 0x7d, 0x0a, 0xa3, 0x51, 0xfb, 0xe6, 0xcf, 0xf0, 0x0e,
+		0x7f, 0x3c, 0xd4, 0xef, 0x56, 0x31, 0xb2, 0x95, 0xf0, 0x5f,
+		0x4b, 0x9c, 0x03, 0x9e, 0xae, 0xb1, 0xc1, 0x46, 0xd7, 0xc0,
+		0x4f, 0xb0, 0xf6, 0x6c, 0xe1, 0xe9, 0x2a, 0x97, 0xe0, 0x3f,
+		0x3a, 0x93, 0x04, 0xcd, 0x41, 0x7d, 0x45, 0x03, 0xb3, 0x40,
+		0x20, 0xe6, 0xad, 0x2d, 0xd3, 0xf7, 0x32, 0x7b, 0xcc, 0x4f,
+		0x81, 0x18, 0x4c, 0x50, 0x77, 0xc4, 0xb7, 0x6a, 0x4d, 0x05,
+		0xd8, 0x6d, 0xbf, 0x6f, 0xba, 0x1d, 0x38, 0x78, 0x87, 0xd2,
+		0x8e, 0xc2, 0x6d, 0xb6, 0xed, 0x66, 0x61, 0xa8, 0xb9, 0x19,
+		0x0e, 0x93, 0xd1, 0xcd, 0x5b, 0xbe, 0x19, 0x05, 0x52, 0x43,
+		0xd6, 0xc1, 0x07, 0x3c, 0x6a, 0x62, 0xbd, 0x33, 0x9b, 0x1b,
+		0x02, 0x42, 0x61, 0x14,
+	};
+ 
+ 	gnutls_pk_params_init(&priv);
+ 	gnutls_pk_params_init(&pub);
+ 	
+ 	priv.algo = pub.algo = GNUTLS_PK_DH;
+ 	
+-	ret = _gnutls_mpi_init_scan(&priv.params[DH_P], test_p, sizeof(test_p));
+	ret = _gnutls_mpi_init_scan(&priv.params[DH_P],
+				    gnutls_ffdhe_3072_group_prime.data,
+				    gnutls_ffdhe_3072_group_prime.size);
+ 	if (ret < 0) {
+ 		gnutls_assert();
+ 		goto cleanup;
+ 	}
+ 
+-	ret = _gnutls_mpi_init_scan(&priv.params[DH_G], test_g, sizeof(test_g));
+	ret = _gnutls_mpi_init_scan(&priv.params[DH_G],
+				    gnutls_ffdhe_3072_group_generator.data,
+				    gnutls_ffdhe_3072_group_generator.size);
+ 	if (ret < 0) {
+ 		gnutls_assert();
+ 		goto cleanup;
+diff --git a/lib/dh-primes.c b/lib/dh-primes.c
+index a440b5b98..94b69e345 100644
+--- a/lib/dh-primes.c
+++ b/lib/dh-primes.c
+@@ -23,8 +23,6 @@
+ #include "gnutls_int.h"
+ #include <gnutls/gnutls.h>
+ 
+-#if defined(ENABLE_DHE) || defined(ENABLE_ANON)
+-
+ #include "dh.h"
+ 
+ static const unsigned char ffdhe_generator = 0x02;
+@@ -1934,5 +1932,3 @@ _gnutls_dh_prime_match_fips_approved(const uint8_t *prime,
+ 
+ 	return 0;
+ }
+-
+-#endif
+-- 
+2.26.2
+
--- a/SOURCES/gnutls-3.6.14-fips-kdf-selftests.patch
+++ b/SOURCES/gnutls-3.6.14-fips-kdf-selftests.patch
@ -0,0 +1,713 @@
+From 93c0e3ba4d2cfee86b32f28f33303a2193c4133c Mon Sep 17 00:00:00 2001
+From: Daiki Ueno <ueno@gnu.org>
+Date: Mon, 5 Oct 2020 16:12:46 +0200
+Subject: [PATCH 1/4] fips: add self-tests for HKDF
+
+FIPS140-2 IG D.8 mandates self-test on approved KDF algorithms.  As
+the guidance only requires running a single instance of each KDF
+mechanism, this only exercises HKDF-Extract and HKDF-Expand operations
+with HMAC-SHA-256 as the underlying MAC.
+
+Although HKDF is non-approved, it would be sensible to do that as it
+will be approved in FIPS140-3.
+
+Signed-off-by: Daiki Ueno <ueno@gnu.org>
+---
+ devel/libgnutls-latest-x86_64.abi |   1 +
+ lib/crypto-selftests.c            | 159 ++++++++++++++++++++++++++++++
+ lib/fips.c                        |   7 ++
+ lib/includes/gnutls/self-test.h   |   1 +
+ lib/libgnutls.map                 |   1 +
+ 5 files changed, 169 insertions(+)
+
+diff --git a/lib/crypto-selftests.c b/lib/crypto-selftests.c
+index 7a1c7729c..bd148b6af 100644
+--- a/lib/crypto-selftests.c
+++ b/lib/crypto-selftests.c
+@@ -2917,3 +2917,162 @@ int gnutls_digest_self_test(unsigned flags, gnutls_digest_algorithm_t digest)
+ 
+ 	return 0;
+ }
+
+struct hkdf_vectors_st {
+	const uint8_t *ikm;
+	unsigned int ikm_size;
+	const uint8_t *salt;
+	unsigned int salt_size;
+	const uint8_t *prk;
+	unsigned int prk_size;
+	const uint8_t *info;
+	unsigned int info_size;
+	const uint8_t *okm;
+	unsigned int okm_size;
+};
+
+const struct hkdf_vectors_st hkdf_sha256_vectors[] = {
+	/* RFC 5869: A.1. Test Case 1: Basic test case with SHA-256 */
+	{
+		STR(ikm, ikm_size,
+		    "\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b"
+		    "\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b"),
+		STR(salt, salt_size,
+		    "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c"),
+		STR(prk, prk_size,
+		    "\x07\x77\x09\x36\x2c\x2e\x32\xdf\x0d\xdc\x3f\x0d\xc4\x7b"
+		    "\xba\x63\x90\xb6\xc7\x3b\xb5\x0f\x9c\x31\x22\xec\x84\x4a"
+		    "\xd7\xc2\xb3\xe5"),
+		STR(info, info_size,
+		    "\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9"),
+		STR(okm, okm_size,
+		    "\x3c\xb2\x5f\x25\xfa\xac\xd5\x7a\x90\x43\x4f\x64\xd0\x36"
+		    "\x2f\x2a\x2d\x2d\x0a\x90\xcf\x1a\x5a\x4c\x5d\xb0\x2d\x56"
+		    "\xec\xc4\xc5\xbf\x34\x00\x72\x08\xd5\xb8\x87\x18\x58\x65"),
+	},
+	/* RFC 5869: A.2. Test Case 2: Test with SHA-256 and longer inputs/outputs */
+	{
+		STR(ikm, ikm_size,
+		    "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d"
+		    "\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b"
+		    "\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29"
+		    "\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37"
+		    "\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45"
+		    "\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f"),
+		STR(salt, salt_size,
+		    "\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d"
+		    "\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b"
+		    "\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89"
+		    "\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97"
+		    "\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5"
+		    "\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf"),
+		STR(prk, prk_size,
+		    "\x06\xa6\xb8\x8c\x58\x53\x36\x1a\x06\x10\x4c\x9c\xeb\x35"
+		    "\xb4\x5c\xef\x76\x00\x14\x90\x46\x71\x01\x4a\x19\x3f\x40"
+		    "\xc1\x5f\xc2\x44"),
+		STR(info, info_size,
+		    "\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd"
+		    "\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb"
+		    "\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9"
+		    "\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7"
+		    "\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5"
+		    "\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff"),
+		STR(okm, okm_size,
+		    "\xb1\x1e\x39\x8d\xc8\x03\x27\xa1\xc8\xe7\xf7\x8c\x59\x6a"
+		    "\x49\x34\x4f\x01\x2e\xda\x2d\x4e\xfa\xd8\xa0\x50\xcc\x4c"
+		    "\x19\xaf\xa9\x7c\x59\x04\x5a\x99\xca\xc7\x82\x72\x71\xcb"
+		    "\x41\xc6\x5e\x59\x0e\x09\xda\x32\x75\x60\x0c\x2f\x09\xb8"
+		    "\x36\x77\x93\xa9\xac\xa3\xdb\x71\xcc\x30\xc5\x81\x79\xec"
+		    "\x3e\x87\xc1\x4c\x01\xd5\xc1\xf3\x43\x4f\x1d\x87"),
+	},
+};
+
+static int test_hkdf(gnutls_mac_algorithm_t mac,
+		     const struct hkdf_vectors_st *vectors,
+		     size_t vectors_size, unsigned flags)
+{
+	unsigned int i;
+
+	for (i = 0; i < vectors_size; i++) {
+		gnutls_datum_t ikm, prk, salt, info;
+		uint8_t output[4096];
+		int ret;
+
+		ikm.data = (void *) vectors[i].ikm;
+		ikm.size = vectors[i].ikm_size;
+		salt.data = (void *) vectors[i].salt;
+		salt.size = vectors[i].salt_size;
+
+		ret = gnutls_hkdf_extract(mac, &ikm, &salt, output);
+		if (ret < 0) {
+			_gnutls_debug_log("error extracting HKDF: MAC-%s\n",
+					  gnutls_mac_get_name(mac));
+			return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
+		}
+
+		if (memcmp(output, vectors[i].prk, vectors[i].prk_size) != 0) {
+			_gnutls_debug_log
+			    ("HKDF extract: MAC-%s test vector failed!\n",
+			     gnutls_mac_get_name(mac));
+
+			return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
+		}
+
+		prk.data = (void *) vectors[i].prk;
+		prk.size = vectors[i].prk_size;
+		info.data = (void *) vectors[i].info;
+		info.size = vectors[i].info_size;
+
+		ret = gnutls_hkdf_expand(mac, &prk, &info,
+					 output, vectors[i].okm_size);
+		if (ret < 0) {
+			_gnutls_debug_log("error extracting HKDF: MAC-%s\n",
+					  gnutls_mac_get_name(mac));
+			return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
+		}
+
+		if (memcmp(output, vectors[i].okm, vectors[i].okm_size) != 0) {
+			_gnutls_debug_log
+			    ("HKDF expand: MAC-%s test vector failed!\n",
+			     gnutls_mac_get_name(mac));
+
+			return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
+		}
+	}
+
+	_gnutls_debug_log
+	    ("HKDF: MAC-%s self check succeeded\n",
+	     gnutls_mac_get_name(mac));
+
+	return 0;
+}
+
+/*-
+ * gnutls_hkdf_self_test:
+ * @flags: GNUTLS_SELF_TEST_FLAG flags
+ * @mac: the message authentication algorithm to use
+ *
+ * This function will run self tests on HKDF with the provided mac.
+ *
+ * Returns: Zero or a negative error code on error.
+ *
+ * Since: 3.3.0-FIPS140
+ -*/
+int gnutls_hkdf_self_test(unsigned flags, gnutls_mac_algorithm_t mac)
+{
+	int ret;
+
+	if (flags & GNUTLS_SELF_TEST_FLAG_ALL)
+		mac = GNUTLS_MAC_UNKNOWN;
+
+	switch (mac) {
+	case GNUTLS_MAC_UNKNOWN:
+		CASE(GNUTLS_MAC_SHA256, test_hkdf, hkdf_sha256_vectors);
+
+		break;
+	default:
+		return gnutls_assert_val(GNUTLS_E_NO_SELF_TEST);
+	}
+
+	return 0;
+}
+diff --git a/lib/fips.c b/lib/fips.c
+index f8b10f750..48891ed57 100644
+--- a/lib/fips.c
+++ b/lib/fips.c
+@@ -423,6 +423,13 @@ int _gnutls_fips_perform_self_checks2(void)
+ 		goto error;
+ 	}
+ 
+	/* HKDF */
+	ret = gnutls_hkdf_self_test(0, GNUTLS_MAC_SHA256);
+	if (ret < 0) {
+		gnutls_assert();
+		goto error;
+	}
+
+ 	if (_gnutls_rnd_ops.self_test == NULL) {
+ 		gnutls_assert();
+ 		goto error;
+diff --git a/lib/includes/gnutls/self-test.h b/lib/includes/gnutls/self-test.h
+index aacbe94ca..9b7be8159 100644
+--- a/lib/includes/gnutls/self-test.h
+++ b/lib/includes/gnutls/self-test.h
+@@ -34,5 +34,6 @@ int gnutls_cipher_self_test(unsigned flags, gnutls_cipher_algorithm_t cipher);
+ int gnutls_mac_self_test(unsigned flags, gnutls_mac_algorithm_t mac);
+ int gnutls_digest_self_test(unsigned flags, gnutls_digest_algorithm_t digest);
+ int gnutls_pk_self_test(unsigned flags, gnutls_pk_algorithm_t pk);
+int gnutls_hkdf_self_test(unsigned flags, gnutls_mac_algorithm_t mac);
+ 
+ #endif
+diff --git a/lib/libgnutls.map b/lib/libgnutls.map
+index 61276e534..386b66f83 100644
+--- a/lib/libgnutls.map
+++ b/lib/libgnutls.map
+@@ -1347,6 +1347,7 @@ GNUTLS_FIPS140_3_4 {
+ 	gnutls_pk_self_test;
+ 	gnutls_mac_self_test;
+ 	gnutls_digest_self_test;
+	gnutls_hkdf_self_test;
+ 	#for FIPS140-2 validation
+ 	drbg_aes_reseed;
+ 	drbg_aes_init;
+-- 
+2.26.2
+
+
+From 31cc94275cd267f4e0db60999cc932fd76d43d5a Mon Sep 17 00:00:00 2001
+From: Daiki Ueno <ueno@gnu.org>
+Date: Mon, 5 Oct 2020 16:59:50 +0200
+Subject: [PATCH 2/4] fips: add self-tests for PBKDF2
+
+FIPS140-2 IG D.8 mandates self-tests on approved KDF algorithms.  As
+the guidance only requires running a single instance of each KDF
+mechanism, this only exercises PBKDF2 with HMAC-SHA-256 as the
+underlying MAC algorithm.
+
+Signed-off-by: Daiki Ueno <ueno@gnu.org>
+---
+ devel/libgnutls-latest-x86_64.abi |   1 +
+ lib/crypto-selftests.c            | 107 ++++++++++++++++++++++++++++++
+ lib/fips.c                        |   7 ++
+ lib/includes/gnutls/self-test.h   |   1 +
+ lib/libgnutls.map                 |   1 +
+ 5 files changed, 117 insertions(+)
+
+diff --git a/lib/crypto-selftests.c b/lib/crypto-selftests.c
+index bd148b6af..c4b0bd207 100644
+--- a/lib/crypto-selftests.c
+++ b/lib/crypto-selftests.c
+@@ -3076,3 +3076,110 @@ int gnutls_hkdf_self_test(unsigned flags, gnutls_mac_algorithm_t mac)
+ 
+ 	return 0;
+ }
+
+struct pbkdf2_vectors_st {
+	const uint8_t *key;
+	size_t key_size;
+	const uint8_t *salt;
+	size_t salt_size;
+	unsigned iter_count;
+	const uint8_t *output;
+	size_t output_size;
+};
+
+const struct pbkdf2_vectors_st pbkdf2_sha256_vectors[] = {
+	/* RFC 7914: 11. Test Vectors for PBKDF2 with HMAC-SHA-256 */
+	{
+		STR(key, key_size, "passwd"),
+		STR(salt, salt_size, "salt"),
+		.iter_count = 1,
+		STR(output, output_size,
+		    "\x55\xac\x04\x6e\x56\xe3\x08\x9f\xec\x16\x91\xc2\x25\x44"
+		    "\xb6\x05\xf9\x41\x85\x21\x6d\xde\x04\x65\xe6\x8b\x9d\x57"
+		    "\xc2\x0d\xac\xbc\x49\xca\x9c\xcc\xf1\x79\xb6\x45\x99\x16"
+		    "\x64\xb3\x9d\x77\xef\x31\x7c\x71\xb8\x45\xb1\xe3\x0b\xd5"
+		    "\x09\x11\x20\x41\xd3\xa1\x97\x83"),
+	},
+	/* RFC 7914: 11. Test Vectors for PBKDF2 with HMAC-SHA-256 */
+	{
+		STR(key, key_size, "Password"),
+		STR(salt, salt_size, "NaCl"),
+		.iter_count = 80000,
+		STR(output, output_size,
+		    "\x4d\xdc\xd8\xf6\x0b\x98\xbe\x21\x83\x0c\xee\x5e\xf2\x27"
+		    "\x01\xf9\x64\x1a\x44\x18\xd0\x4c\x04\x14\xae\xff\x08\x87"
+		    "\x6b\x34\xab\x56\xa1\xd4\x25\xa1\x22\x58\x33\x54\x9a\xdb"
+		    "\x84\x1b\x51\xc9\xb3\x17\x6a\x27\x2b\xde\xbb\xa1\xd0\x78"
+		    "\x47\x8f\x62\xb3\x97\xf3\x3c\x8d"),
+	},
+};
+
+static int test_pbkdf2(gnutls_mac_algorithm_t mac,
+		       const struct pbkdf2_vectors_st *vectors,
+		       size_t vectors_size, unsigned flags)
+{
+	unsigned int i;
+
+	for (i = 0; i < vectors_size; i++) {
+		gnutls_datum_t key, salt;
+		uint8_t output[4096];
+		int ret;
+
+		key.data = (void *) vectors[i].key;
+		key.size = vectors[i].key_size;
+		salt.data = (void *) vectors[i].salt;
+		salt.size = vectors[i].salt_size;
+
+		ret = gnutls_pbkdf2(mac, &key, &salt, vectors[i].iter_count,
+				    output, vectors[i].output_size);
+		if (ret < 0) {
+			_gnutls_debug_log("error calculating PBKDF2: MAC-%s\n",
+					  gnutls_mac_get_name(mac));
+			return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
+		}
+
+		if (memcmp(output, vectors[i].output, vectors[i].output_size) != 0) {
+			_gnutls_debug_log
+			    ("PBKDF2: MAC-%s test vector failed!\n",
+			     gnutls_mac_get_name(mac));
+
+			return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
+		}
+	}
+
+	_gnutls_debug_log
+	    ("PBKDF2: MAC-%s self check succeeded\n",
+	     gnutls_mac_get_name(mac));
+
+	return 0;
+}
+
+/*-
+ * gnutls_pbkdf2_self_test:
+ * @flags: GNUTLS_SELF_TEST_FLAG flags
+ * @mac: the message authentication algorithm to use
+ *
+ * This function will run self tests on PBKDF2 with the provided mac.
+ *
+ * Returns: Zero or a negative error code on error.
+ *
+ * Since: 3.3.0-FIPS140
+ -*/
+int gnutls_pbkdf2_self_test(unsigned flags, gnutls_mac_algorithm_t mac)
+{
+	int ret;
+
+	if (flags & GNUTLS_SELF_TEST_FLAG_ALL)
+		mac = GNUTLS_MAC_UNKNOWN;
+
+	switch (mac) {
+	case GNUTLS_MAC_UNKNOWN:
+		CASE(GNUTLS_MAC_SHA256, test_pbkdf2, pbkdf2_sha256_vectors);
+
+		break;
+	default:
+		return gnutls_assert_val(GNUTLS_E_NO_SELF_TEST);
+	}
+
+	return 0;
+}
+diff --git a/lib/fips.c b/lib/fips.c
+index 48891ed57..7cfab1049 100644
+--- a/lib/fips.c
+++ b/lib/fips.c
+@@ -430,6 +430,13 @@ int _gnutls_fips_perform_self_checks2(void)
+ 		goto error;
+ 	}
+ 
+	/* PBKDF2 */
+	ret = gnutls_pbkdf2_self_test(0, GNUTLS_MAC_SHA256);
+	if (ret < 0) {
+		gnutls_assert();
+		goto error;
+	}
+
+ 	if (_gnutls_rnd_ops.self_test == NULL) {
+ 		gnutls_assert();
+ 		goto error;
+diff --git a/lib/includes/gnutls/self-test.h b/lib/includes/gnutls/self-test.h
+index 9b7be8159..958c0da8f 100644
+--- a/lib/includes/gnutls/self-test.h
+++ b/lib/includes/gnutls/self-test.h
+@@ -35,5 +35,6 @@ int gnutls_mac_self_test(unsigned flags, gnutls_mac_algorithm_t mac);
+ int gnutls_digest_self_test(unsigned flags, gnutls_digest_algorithm_t digest);
+ int gnutls_pk_self_test(unsigned flags, gnutls_pk_algorithm_t pk);
+ int gnutls_hkdf_self_test(unsigned flags, gnutls_mac_algorithm_t mac);
+int gnutls_pbkdf2_self_test(unsigned flags, gnutls_mac_algorithm_t mac);
+ 
+ #endif
+diff --git a/lib/libgnutls.map b/lib/libgnutls.map
+index 386b66f83..f5537a386 100644
+--- a/lib/libgnutls.map
+++ b/lib/libgnutls.map
+@@ -1348,6 +1348,7 @@ GNUTLS_FIPS140_3_4 {
+ 	gnutls_mac_self_test;
+ 	gnutls_digest_self_test;
+ 	gnutls_hkdf_self_test;
+	gnutls_pbkdf2_self_test;
+ 	#for FIPS140-2 validation
+ 	drbg_aes_reseed;
+ 	drbg_aes_init;
+-- 
+2.26.2
+
+
+From d1a3235e8c829855969d00364d8b5456fce2c78c Mon Sep 17 00:00:00 2001
+From: Daiki Ueno <ueno@gnu.org>
+Date: Mon, 5 Oct 2020 17:44:30 +0200
+Subject: [PATCH 3/4] fips: add self-tests for TLS-PRF
+
+FIPS140-2 IG D.8 mandates self-tests on approved KDF algorithms.  As
+the guidance only requires to run a single instance of each KDF
+mechanism, this only exercises TLS1.2 PRF with HMAC-SHA-256 as the
+underlying MAC algorithm.
+
+Signed-off-by: Daiki Ueno <ueno@gnu.org>
+---
+ devel/libgnutls-latest-x86_64.abi |   1 +
+ lib/crypto-selftests.c            | 196 ++++++++++++++++++++++++++++++
+ lib/fips.c                        |   7 ++
+ lib/includes/gnutls/self-test.h   |   1 +
+ lib/libgnutls.map                 |   1 +
+ 5 files changed, 206 insertions(+)
+
+diff --git a/lib/crypto-selftests.c b/lib/crypto-selftests.c
+index c4b0bd207..b740936d6 100644
+--- a/lib/crypto-selftests.c
+++ b/lib/crypto-selftests.c
+@@ -3183,3 +3183,199 @@ int gnutls_pbkdf2_self_test(unsigned flags, gnutls_mac_algorithm_t mac)
+ 
+ 	return 0;
+ }
+
+struct tlsprf_vectors_st {
+	const uint8_t *key;
+	size_t key_size;
+	const uint8_t *label;
+	size_t label_size;
+	const uint8_t *seed;
+	size_t seed_size;
+	const uint8_t *output;
+	size_t output_size;
+};
+
+const struct tlsprf_vectors_st tls10prf_vectors[] = {
+	/* tests/tls10-prf.c: test1 */
+	{
+		STR(key, key_size,
+		    "\x26\x3b\xdb\xbb\x6f\x6d\x4c\x66\x4e\x05\x8d\x0a\xa9\xd3"
+		    "\x21\xbe"),
+		STR(label, label_size,
+		    "test label"),
+		STR(seed, seed_size,
+		    "\xb9\x20\x57\x3b\x19\x96\x01\x02\x4f\x04\xd6\xdc\x61\x96"
+		    "\x6e\x65"),
+		STR(output, output_size,
+		    "\x66\x17\x99\x37\x65\xfa\x6c\xa7\x03\xd1\x9e\xc7\x0d\xd5"
+		    "\xdd\x16\x0f\xfc\xc0\x77\x25\xfa\xfb\x71\x4a\x9f\x81\x5a"
+		    "\x2a\x30\xbf\xb7\xe3\xbb\xfb\x7e\xee\x57\x4b\x3b\x61\x3e"
+		    "\xb7\xfe\x80\xee\xc9\x69\x1d\x8c\x1b\x0e\x2d\x9b\x3c\x8b"
+		    "\x4b\x02\xb6\xb6\xd6\xdb\x88\xe2\x09\x46\x23\xef\x62\x40"
+		    "\x60\x7e\xda\x7a\xbe\x3c\x84\x6e\x82\xa3"),
+	},
+};
+
+const struct tlsprf_vectors_st tls12prf_sha256_vectors[] = {
+	/* tests/tls12-prf.c: sha256_test1 */
+	{
+		STR(key, key_size,
+		    "\x04\x50\xb0\xea\x9e\xcd\x36\x02\xee\x0d\x76\xc5\xc3\xc8"
+		    "\x6f\x4a"),
+		STR(label, label_size,
+		    "test label"),
+		STR(seed, seed_size,
+		    "\x20\x7a\xcc\x02\x54\xb8\x67\xf5\xb9\x25\xb4\x5a\x33\x60"
+		    "\x1d\x8b"),
+		STR(output, output_size,
+		    "\xae\x67\x9e\x0e\x71\x4f\x59\x75\x76\x37\x68\xb1\x66\x97"
+		    "\x9e\x1d"),
+	},
+	/* tests/tls12-prf.c: sha256_test2 */
+	{
+		STR(key, key_size,
+		    "\x34\x20\x4a\x9d\xf0\xbe\x6e\xb4\xe9\x25\xa8\x02\x7c\xf6"
+		    "\xc6\x02"),
+		STR(label, label_size,
+		    "test label"),
+		STR(seed, seed_size,
+		    "\x98\xb2\xc4\x0b\xcd\x66\x4c\x83\xbb\x92\x0c\x18\x20\x1a"
+		    "\x63\x95"),
+		STR(output, output_size,
+		    "\xaf\xa9\x31\x24\x53\xc2\x2f\xa8\x3d\x2b\x51\x1b\x37\x2d"
+		    "\x73\xa4\x02\xa2\xa6\x28\x73\x23\x9a\x51\xfa\xde\x45\x08"
+		    "\x2f\xaf\x3f\xd2\xbb\x7f\xfb\x3e\x9b\xf3\x6e\x28\xb3\x14"
+		    "\x1a\xab\xa4\x84\x00\x53\x32\xa9\xf9\xe3\x88\xa4\xd3\x29"
+		    "\xf1\x58\x7a\x4b\x31\x7d\xa0\x77\x08\xea\x1b\xa9\x5a\x53"
+		    "\xf8\x78\x67\x24\xbd\x83\xce\x4b\x03\xaf"),
+	},
+	/* tests/tls12-prf.c: sha256_test3 */
+	{
+		STR(key, key_size,
+		    "\xa3\x69\x1a\xa1\xf6\x81\x4b\x80\x59\x2b\xf1\xcf\x2a\xcf"
+		    "\x16\x97"),
+		STR(label, label_size,
+		    "test label"),
+		STR(seed, seed_size,
+		    "\x55\x23\xd4\x1e\x32\x0e\x69\x4d\x0c\x1f\xf5\x73\x4d\x83"
+		    "\x0b\x93\x3e\x46\x92\x70\x71\xc9\x26\x21"),
+		STR(output, output_size,
+		    "\x6a\xd0\x98\x4f\xa0\x6f\x78\xfe\x16\x1b\xd4\x6d\x7c\x26"
+		    "\x1d\xe4\x33\x40\xd7\x28\xdd\xdc\x3d\x0f\xf0\xdd\x7e\x0d"),
+	},
+	/* tests/tls12-prf.c: sha256_test4 */
+	{
+		STR(key, key_size,
+		    "\x21\x0e\xc9\x37\x06\x97\x07\xe5\x46\x5b\xc4\x6b\xf7\x79"
+		    "\xe1\x04\x10\x8b\x18\xfd\xb7\x93\xbe\x7b\x21\x8d\xbf\x14"
+		    "\x5c\x86\x41\xf3"),
+		STR(label, label_size,
+		    "test label"),
+		STR(seed, seed_size,
+		    "\x1e\x35\x1a\x0b\xaf\x35\xc7\x99\x45\x92\x43\x94\xb8\x81"
+		    "\xcf\xe3\x1d\xae\x8f\x1c\x1e\xd5\x4d\x3b"),
+		STR(output, output_size,
+		    "\x76\x53\xfa\x80\x9c\xde\x3b\x55\x3c\x4a\x17\xe2\xcd\xbc"
+		    "\xc9\x18\xf3\x65\x27\xf2\x22\x19\xa7\xd7\xf9\x5d\x97\x24"
+		    "\x3f\xf2\xd5\xde\xe8\x26\x5e\xf0\xaf\x03"),
+	},
+};
+
+const struct tlsprf_vectors_st tls12prf_sha384_vectors[] = {
+	/* tests/tls12-prf.c: sha384_test1
+	 * https://www.ietf.org/mail-archive/web/tls/current/msg03416.html
+	 */
+	{
+		STR(key, key_size,
+		    "\xb8\x0b\x73\x3d\x6c\xee\xfc\xdc\x71\x56\x6e\xa4\x8e\x55"
+		    "\x67\xdf"),
+		STR(label, label_size,
+		    "test label"),
+		STR(seed, seed_size,
+		    "\xcd\x66\x5c\xf6\xa8\x44\x7d\xd6\xff\x8b\x27\x55\x5e\xdb"
+		    "\x74\x65"),
+		STR(output, output_size,
+		    "\x7b\x0c\x18\xe9\xce\xd4\x10\xed\x18\x04\xf2\xcf\xa3\x4a"
+		    "\x33\x6a\x1c\x14\xdf\xfb\x49\x00\xbb\x5f\xd7\x94\x21\x07"
+		    "\xe8\x1c\x83\xcd\xe9\xca\x0f\xaa\x60\xbe\x9f\xe3\x4f\x82"
+		    "\xb1\x23\x3c\x91\x46\xa0\xe5\x34\xcb\x40\x0f\xed\x27\x00"
+		    "\x88\x4f\x9d\xc2\x36\xf8\x0e\xdd\x8b\xfa\x96\x11\x44\xc9"
+		    "\xe8\xd7\x92\xec\xa7\x22\xa7\xb3\x2f\xc3\xd4\x16\xd4\x73"
+		    "\xeb\xc2\xc5\xfd\x4a\xbf\xda\xd0\x5d\x91\x84\x25\x9b\x5b"
+		    "\xf8\xcd\x4d\x90\xfa\x0d\x31\xe2\xde\xc4\x79\xe4\xf1\xa2"
+		    "\x60\x66\xf2\xee\xa9\xa6\x92\x36\xa3\xe5\x26\x55\xc9\xe9"
+		    "\xae\xe6\x91\xc8\xf3\xa2\x68\x54\x30\x8d\x5e\xaa\x3b\xe8"
+		    "\x5e\x09\x90\x70\x3d\x73\xe5\x6f"),
+	},
+};
+
+static int test_tlsprf(gnutls_mac_algorithm_t mac,
+		       const struct tlsprf_vectors_st *vectors,
+		       size_t vectors_size, unsigned flags)
+{
+	unsigned int i;
+
+	for (i = 0; i < vectors_size; i++) {
+		char output[4096];
+		int ret;
+
+		ret = _gnutls_prf_raw(mac,
+				      vectors[i].key_size, vectors[i].key,
+				      vectors[i].label_size, (const char *)vectors[i].label,
+				      vectors[i].seed_size, vectors[i].seed,
+				      vectors[i].output_size, output);
+		if (ret < 0) {
+			_gnutls_debug_log("error calculating TLS-PRF: MAC-%s\n",
+					  gnutls_mac_get_name(mac));
+			return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
+		}
+
+		if (memcmp(output, vectors[i].output, vectors[i].output_size) != 0) {
+			_gnutls_debug_log
+			    ("TLS-PRF: MAC-%s test vector failed!\n",
+			     gnutls_mac_get_name(mac));
+
+			return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
+		}
+	}
+
+	_gnutls_debug_log
+	    ("TLS-PRF: MAC-%s self check succeeded\n",
+	     gnutls_mac_get_name(mac));
+
+	return 0;
+}
+
+/*-
+ * gnutls_tlsprf_self_test:
+ * @flags: GNUTLS_SELF_TEST_FLAG flags
+ * @mac: the message authentication algorithm to use
+ *
+ * This function will run self tests on TLS-PRF with the provided mac.
+ *
+ * Returns: Zero or a negative error code on error.
+ *
+ * Since: 3.3.0-FIPS140
+ -*/
+int gnutls_tlsprf_self_test(unsigned flags, gnutls_mac_algorithm_t mac)
+{
+	int ret;
+
+	if (flags & GNUTLS_SELF_TEST_FLAG_ALL)
+		mac = GNUTLS_MAC_UNKNOWN;
+
+	switch (mac) {
+	case GNUTLS_MAC_UNKNOWN:
+		NON_FIPS_CASE(GNUTLS_MAC_MD5_SHA1, test_tlsprf, tls10prf_vectors);
+		FALLTHROUGH;
+		CASE(GNUTLS_MAC_SHA256, test_tlsprf, tls12prf_sha256_vectors);
+		FALLTHROUGH;
+		CASE(GNUTLS_MAC_SHA384, test_tlsprf, tls12prf_sha384_vectors);
+
+		break;
+	default:
+		return gnutls_assert_val(GNUTLS_E_NO_SELF_TEST);
+	}
+
+	return 0;
+}
+diff --git a/lib/fips.c b/lib/fips.c
+index 7cfab1049..30d396b2c 100644
+--- a/lib/fips.c
+++ b/lib/fips.c
+@@ -437,6 +437,13 @@ int _gnutls_fips_perform_self_checks2(void)
+ 		goto error;
+ 	}
+ 
+	/* TLS-PRF */
+	ret = gnutls_tlsprf_self_test(0, GNUTLS_MAC_SHA256);
+	if (ret < 0) {
+		gnutls_assert();
+		goto error;
+	}
+
+ 	if (_gnutls_rnd_ops.self_test == NULL) {
+ 		gnutls_assert();
+ 		goto error;
+diff --git a/lib/includes/gnutls/self-test.h b/lib/includes/gnutls/self-test.h
+index 958c0da8f..88b5a8dbf 100644
+--- a/lib/includes/gnutls/self-test.h
+++ b/lib/includes/gnutls/self-test.h
+@@ -36,5 +36,6 @@ int gnutls_digest_self_test(unsigned flags, gnutls_digest_algorithm_t digest);
+ int gnutls_pk_self_test(unsigned flags, gnutls_pk_algorithm_t pk);
+ int gnutls_hkdf_self_test(unsigned flags, gnutls_mac_algorithm_t mac);
+ int gnutls_pbkdf2_self_test(unsigned flags, gnutls_mac_algorithm_t mac);
+int gnutls_tlsprf_self_test(unsigned flags, gnutls_mac_algorithm_t mac);
+ 
+ #endif
+diff --git a/lib/libgnutls.map b/lib/libgnutls.map
+index f5537a386..643d400a1 100644
+--- a/lib/libgnutls.map
+++ b/lib/libgnutls.map
+@@ -1349,6 +1349,7 @@ GNUTLS_FIPS140_3_4 {
+ 	gnutls_digest_self_test;
+ 	gnutls_hkdf_self_test;
+ 	gnutls_pbkdf2_self_test;
+	gnutls_tlsprf_self_test;
+ 	#for FIPS140-2 validation
+ 	drbg_aes_reseed;
+ 	drbg_aes_init;
+-- 
+2.26.2
+
+
+From af3df0102fc377591a6de3112b034d4a492fc92c Mon Sep 17 00:00:00 2001
+From: Daiki Ueno <ueno@gnu.org>
+Date: Mon, 5 Oct 2020 17:59:46 +0200
+Subject: [PATCH 4/4] fips: run CMAC self-tests
+
+FIPS140-2 IG D.8 mandates self-tests on CMAC.
+
+Signed-off-by: Daiki Ueno <ueno@gnu.org>
+---
+ lib/fips.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/lib/fips.c b/lib/fips.c
+index 30d396b2c..51567953d 100644
+--- a/lib/fips.c
+++ b/lib/fips.c
+@@ -398,6 +398,12 @@ int _gnutls_fips_perform_self_checks2(void)
+ 		goto error;
+ 	}
+ 
+	ret = gnutls_mac_self_test(0, GNUTLS_MAC_AES_CMAC_256);
+	if (ret < 0) {
+		gnutls_assert();
+		goto error;
+	}
+
+ 	/* PK */
+ 	ret = gnutls_pk_self_test(0, GNUTLS_PK_RSA);
+ 	if (ret < 0) {
+-- 
+2.26.2
+
--- a/SOURCES/gnutls-3.6.16-cpuid.patch
+++ b/SOURCES/gnutls-3.6.16-cpuid.patch
@ -0,0 +1,247 @@
+From 300c6315d2e644ae81b43fa2dd7bbf68b3afb5b2 Mon Sep 17 00:00:00 2001
+From: Daiki Ueno <ueno@gnu.org>
+Date: Thu, 18 Nov 2021 19:02:03 +0100
+Subject: [PATCH 1/2] accelerated: fix CPU feature detection for Intel CPUs
+
+This fixes read_cpuid_vals to correctly read the CPUID quadruple, as
+well as to set the bit the ustream CRYPTOGAMS uses to identify Intel
+CPUs.
+
+Suggested by Rafael Gieschke in:
+https://gitlab.com/gnutls/gnutls/-/issues/1282
+
+Signed-off-by: Daiki Ueno <ueno@gnu.org>
+---
+ lib/accelerated/x86/x86-common.c | 91 +++++++++++++++++++++++++-------
+ 1 file changed, 71 insertions(+), 20 deletions(-)
+
+diff --git a/lib/accelerated/x86/x86-common.c b/lib/accelerated/x86/x86-common.c
+index 3845c6b4c9..cf615ef24f 100644
+--- a/lib/accelerated/x86/x86-common.c
+++ b/lib/accelerated/x86/x86-common.c
+@@ -81,15 +81,38 @@ unsigned int _gnutls_x86_cpuid_s[4];
+ # define bit_AVX 0x10000000
+ #endif
+ 
+-#ifndef OSXSAVE_MASK
+-/* OSXSAVE|FMA|MOVBE */
+-# define OSXSAVE_MASK (0x8000000|0x1000|0x400000)
+#ifndef bit_AVX2
+# define bit_AVX2 0x00000020
+#endif
+
+#ifndef bit_AVX512F
+# define bit_AVX512F 0x00010000
+#endif
+
+#ifndef bit_AVX512IFMA
+# define bit_AVX512IFMA 0x00200000
+#endif
+
+#ifndef bit_AVX512BW
+# define bit_AVX512BW 0x40000000
+#endif
+
+#ifndef bit_AVX512VL
+# define bit_AVX512VL 0x80000000
+#endif
+
+#ifndef bit_OSXSAVE
+# define bit_OSXSAVE 0x8000000
+ #endif
+ 
+ #ifndef bit_MOVBE
+ # define bit_MOVBE 0x00400000
+ #endif
+ 
+#ifndef OSXSAVE_MASK
+# define OSXSAVE_MASK (bit_OSXSAVE|bit_MOVBE)
+#endif
+
+ #define via_bit_PADLOCK (0x3 << 6)
+ #define via_bit_PADLOCK_PHE (0x3 << 10)
+ #define via_bit_PADLOCK_PHE_SHA512 (0x3 << 25)
+@@ -127,7 +150,7 @@ static unsigned read_cpuid_vals(unsigned int vals[4])
+ 	unsigned t1, t2, t3;
+ 	vals[0] = vals[1] = vals[2] = vals[3] = 0;
+ 
+-	if (!__get_cpuid(1, &t1, &vals[0], &vals[1], &t2))
+	if (!__get_cpuid(1, &t1, &t2, &vals[1], &vals[0]))
+ 		return 0;
+ 	/* suppress AVX512; it works conditionally on certain CPUs on the original code */
+ 	vals[1] &= 0xfffff7ff;
+@@ -145,7 +168,7 @@ static unsigned check_4th_gen_intel_features(unsigned ecx)
+ {
+ 	uint32_t xcr0;
+ 
+-	if ((ecx & OSXSAVE_MASK) != OSXSAVE_MASK)
+	if ((ecx & bit_OSXSAVE) != bit_OSXSAVE)
+ 		return 0;
+ 
+ #if defined(_MSC_VER) && !defined(__clang__)
+@@ -233,10 +256,7 @@ static unsigned check_sha(void)
+ #ifdef ASM_X86_64
+ static unsigned check_avx_movbe(void)
+ {
+-	if (check_4th_gen_intel_features(_gnutls_x86_cpuid_s[1]) == 0)
+-		return 0;
+-
+-	return ((_gnutls_x86_cpuid_s[1] & bit_AVX));
+	return (_gnutls_x86_cpuid_s[1] & bit_AVX);
+ }
+ 
+ static unsigned check_pclmul(void)
+@@ -514,33 +534,47 @@ void register_x86_padlock_crypto(unsigned capabilities)
+ }
+ #endif
+ 
+-static unsigned check_intel_or_amd(void)
+enum x86_cpu_vendor {
+	X86_CPU_VENDOR_OTHER,
+	X86_CPU_VENDOR_INTEL,
+	X86_CPU_VENDOR_AMD,
+};
+
+static enum x86_cpu_vendor check_x86_cpu_vendor(void)
+ {
+ 	unsigned int a, b, c, d;
+ 
+-	if (!__get_cpuid(0, &a, &b, &c, &d))
+-		return 0;
+	if (!__get_cpuid(0, &a, &b, &c, &d)) {
+		return X86_CPU_VENDOR_OTHER;
+	}
+ 
+-	if ((memcmp(&b, "Genu", 4) == 0 &&
+-	     memcmp(&d, "ineI", 4) == 0 &&
+-	     memcmp(&c, "ntel", 4) == 0) ||
+-	    (memcmp(&b, "Auth", 4) == 0 &&
+-	     memcmp(&d, "enti", 4) == 0 && memcmp(&c, "cAMD", 4) == 0)) {
+-		return 1;
+	if (memcmp(&b, "Genu", 4) == 0 &&
+	    memcmp(&d, "ineI", 4) == 0 &&
+	    memcmp(&c, "ntel", 4) == 0) {
+		return X86_CPU_VENDOR_INTEL;
+ 	}
+ 
+-	return 0;
+	if (memcmp(&b, "Auth", 4) == 0 &&
+	    memcmp(&d, "enti", 4) == 0 &&
+	    memcmp(&c, "cAMD", 4) == 0) {
+		return X86_CPU_VENDOR_AMD;
+	}
+
+	return X86_CPU_VENDOR_OTHER;
+ }
+ 
+ static
+ void register_x86_intel_crypto(unsigned capabilities)
+ {
+ 	int ret;
+	enum x86_cpu_vendor vendor;
+ 
+ 	memset(_gnutls_x86_cpuid_s, 0, sizeof(_gnutls_x86_cpuid_s));
+ 
+-	if (check_intel_or_amd() == 0)
+	vendor = check_x86_cpu_vendor();
+	if (vendor == X86_CPU_VENDOR_OTHER) {
+ 		return;
+	}
+ 
+ 	if (capabilities == 0) {
+ 		if (!read_cpuid_vals(_gnutls_x86_cpuid_s))
+@@ -549,6 +583,23 @@ void register_x86_intel_crypto(unsigned capabilities)
+ 		capabilities_to_intel_cpuid(capabilities);
+ 	}
+ 
+	/* CRYPTOGAMS uses the (1 << 30) bit as an indicator of Intel CPUs */
+	if (vendor == X86_CPU_VENDOR_INTEL) {
+		_gnutls_x86_cpuid_s[0] |= 1 << 30;
+	} else {
+		_gnutls_x86_cpuid_s[0] &= ~(1 << 30);
+	}
+
+	if (!check_4th_gen_intel_features(_gnutls_x86_cpuid_s[1])) {
+		_gnutls_x86_cpuid_s[1] &= ~bit_AVX;
+
+		/* Clear AVX2 bits as well, according to what OpenSSL does.
+		 * Should we clear bit_AVX512DQ, bit_AVX512PF, bit_AVX512ER, and
+		 * bit_AVX512CD? */
+		_gnutls_x86_cpuid_s[2] &= ~(bit_AVX2|bit_AVX512F|bit_AVX512IFMA|
+					    bit_AVX512BW|bit_AVX512BW);
+	}
+
+ 	if (check_ssse3()) {
+ 		_gnutls_debug_log("Intel SSSE3 was detected\n");
+ 
+-- 
+2.37.3
+
+
+From cd509dac9e6d1bf76fd12c72c1fd61f1708c254a Mon Sep 17 00:00:00 2001
+From: Daiki Ueno <ueno@gnu.org>
+Date: Mon, 15 Aug 2022 09:39:18 +0900
+Subject: [PATCH 2/2] accelerated: clear AVX bits if it cannot be queried
+ through XSAVE
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The algorithm to detect AVX is described in 14.3 of "Intel® 64 and IA-32
+Architectures Software Developer’s Manual".
+
+GnuTLS previously only followed that algorithm when registering the
+crypto backend, while the CRYPTOGAMS derived SHA code assembly expects
+that the extension bits are propagated to _gnutls_x86_cpuid_s.
+
+Signed-off-by: Daiki Ueno <ueno@gnu.org>
+---
+ lib/accelerated/x86/x86-common.c | 18 ++++++++++++++++--
+ 1 file changed, 16 insertions(+), 2 deletions(-)
+
+diff --git a/lib/accelerated/x86/x86-common.c b/lib/accelerated/x86/x86-common.c
+index cf615ef24f..655d0c65f2 100644
+--- a/lib/accelerated/x86/x86-common.c
+++ b/lib/accelerated/x86/x86-common.c
+@@ -210,7 +210,8 @@ static void capabilities_to_intel_cpuid(unsigned capabilities)
+ 	}
+ 
+ 	if (capabilities & INTEL_AVX) {
+-		if ((a[1] & bit_AVX) && check_4th_gen_intel_features(a[1])) {
+		if ((a[1] & bit_AVX) && (a[1] & bit_MOVBE) &&
+		    check_4th_gen_intel_features(a[1])) {
+ 			_gnutls_x86_cpuid_s[1] |= bit_AVX|bit_MOVBE;
+ 		} else {
+ 			_gnutls_debug_log
+@@ -256,7 +257,7 @@ static unsigned check_sha(void)
+ #ifdef ASM_X86_64
+ static unsigned check_avx_movbe(void)
+ {
+-	return (_gnutls_x86_cpuid_s[1] & bit_AVX);
+	return (_gnutls_x86_cpuid_s[1] & (bit_AVX|bit_MOVBE)) == (bit_AVX|bit_MOVBE);
+ }
+ 
+ static unsigned check_pclmul(void)
+@@ -579,6 +580,19 @@ void register_x86_intel_crypto(unsigned capabilities)
+ 	if (capabilities == 0) {
+ 		if (!read_cpuid_vals(_gnutls_x86_cpuid_s))
+ 			return;
+		if (!check_4th_gen_intel_features(_gnutls_x86_cpuid_s[1])) {
+			_gnutls_x86_cpuid_s[1] &= ~bit_AVX;
+
+			/* Clear AVX2 bits as well, according to what
+			 * OpenSSL does.  Should we clear
+			 * bit_AVX512DQ, bit_AVX512PF, bit_AVX512ER,
+			 * and bit_AVX512CD? */
+			_gnutls_x86_cpuid_s[2] &= ~(bit_AVX2|
+						    bit_AVX512F|
+						    bit_AVX512IFMA|
+						    bit_AVX512BW|
+						    bit_AVX512BW);
+		}
+ 	} else {
+ 		capabilities_to_intel_cpuid(capabilities);
+ 	}
+-- 
+2.37.3
+
--- a/SOURCES/gnutls-3.6.16-deterministic-ecdsa-fixes.patch
+++ b/SOURCES/gnutls-3.6.16-deterministic-ecdsa-fixes.patch
@ -0,0 +1,474 @@
+From 0d39e4120bc5ece53c86c5802c546259b8ca286a Mon Sep 17 00:00:00 2001
+From: Daiki Ueno <ueno@gnu.org>
+Date: Fri, 12 Jan 2024 17:56:58 +0900
+Subject: [PATCH] nettle: avoid normalization of mpz_t in deterministic ECDSA
+
+This removes function calls that potentially leak bit-length of a
+private key used to calculate a nonce in deterministic ECDSA.  Namely:
+
+- _gnutls_dsa_compute_k has been rewritten to work on always
+  zero-padded mp_limb_t arrays instead of mpz_t
+- rnd_mpz_func has been replaced with rnd_datum_func, which is backed
+  by a byte array instead of an mpz_t value
+
+Signed-off-by: Daiki Ueno <ueno@gnu.org>
+---
+ lib/nettle/int/dsa-compute-k.c    | 84 +++++++++++++++++++------------
+ lib/nettle/int/dsa-compute-k.h    | 31 +++++++++---
+ lib/nettle/int/ecdsa-compute-k.c  | 71 +++++++++-----------------
+ lib/nettle/int/ecdsa-compute-k.h  |  8 +--
+ lib/nettle/pk.c                   | 79 ++++++++++++++++++++---------
+ tests/sign-verify-deterministic.c |  2 +-
+ 6 files changed, 158 insertions(+), 117 deletions(-)
+
+diff --git a/lib/nettle/int/dsa-compute-k.c b/lib/nettle/int/dsa-compute-k.c
+index 17d63318c4..ddeb6f6d1e 100644
+--- a/lib/nettle/int/dsa-compute-k.c
+++ b/lib/nettle/int/dsa-compute-k.c
+@@ -31,33 +31,37 @@
+ #include "mpn-base256.h"
+ #include <string.h>
+ 
+-#define BITS_TO_LIMBS(bits) (((bits) + GMP_NUMB_BITS - 1) / GMP_NUMB_BITS)
+-
+-/* The maximum size of q, choosen from the fact that we support
+- * 521-bit elliptic curve generator and 512-bit DSA subgroup at
+- * maximum. */
+-#define MAX_Q_BITS 521
+-#define MAX_Q_SIZE ((MAX_Q_BITS + 7) / 8)
+-#define MAX_Q_LIMBS BITS_TO_LIMBS(MAX_Q_BITS)
+-
+-#define MAX_HASH_BITS (MAX_HASH_SIZE * 8)
+-#define MAX_HASH_LIMBS BITS_TO_LIMBS(MAX_HASH_BITS)
+-
+-int
+-_gnutls_dsa_compute_k(mpz_t k,
+-		      const mpz_t q,
+-		      const mpz_t x,
+-		      gnutls_mac_algorithm_t mac,
+-		      const uint8_t *digest,
+-		      size_t length)
+/* For mini-gmp */
+#ifndef GMP_LIMB_BITS
+#define GMP_LIMB_BITS GMP_NUMB_BITS
+#endif
+
+static inline int is_zero_limb(mp_limb_t x)
+{
+	x |= (x << 1);
+	return ((x >> 1) - 1) >> (GMP_LIMB_BITS - 1);
+}
+
+static int sec_zero_p(const mp_limb_t *ap, mp_size_t n)
+{
+	volatile mp_limb_t w;
+	mp_size_t i;
+
+	for (i = 0, w = 0; i < n; i++)
+		w |= ap[i];
+
+	return is_zero_limb(w);
+}
+
+int _gnutls_dsa_compute_k(mp_limb_t *h, const mp_limb_t *q, const mp_limb_t *x,
+			  mp_size_t qn, mp_bitcnt_t q_bits,
+			  gnutls_mac_algorithm_t mac, const uint8_t *digest,
+			  size_t length)
+ {
+ 	uint8_t V[MAX_HASH_SIZE];
+ 	uint8_t K[MAX_HASH_SIZE];
+ 	uint8_t xp[MAX_Q_SIZE];
+ 	uint8_t tp[MAX_Q_SIZE];
+-	mp_limb_t h[MAX(MAX_Q_LIMBS, MAX_HASH_LIMBS)];
+-	mp_bitcnt_t q_bits = mpz_sizeinbase (q, 2);
+-	mp_size_t qn = mpz_size(q);
+ 	mp_bitcnt_t h_bits = length * 8;
+ 	mp_size_t hn = BITS_TO_LIMBS(h_bits);
+ 	size_t nbytes = (q_bits + 7) / 8;
+@@ -66,6 +70,7 @@ _gnutls_dsa_compute_k(mpz_t k,
+ 	mp_limb_t cy;
+ 	gnutls_hmac_hd_t hd;
+ 	int ret = 0;
+	mp_limb_t scratch[MAX_Q_LIMBS];
+ 
+ 	if (unlikely(q_bits > MAX_Q_BITS))
+ 		return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
+@@ -73,7 +78,7 @@ _gnutls_dsa_compute_k(mpz_t k,
+ 		return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
+ 
+ 	/* int2octets(x) */
+-	mpn_get_base256(xp, nbytes, mpz_limbs_read(x), qn);
+	mpn_get_base256(xp, nbytes, x, qn);
+ 
+ 	/* bits2octets(h) */
+ 	mpn_set_base256(h, hn, digest, length);
+@@ -97,12 +102,12 @@ _gnutls_dsa_compute_k(mpz_t k,
+ 			mpn_rshift(h, h, hn, shift % GMP_NUMB_BITS);
+ 	}
+ 
+-	cy = mpn_sub_n(h, h, mpz_limbs_read(q), qn);
+	cy = mpn_sub_n(h, h, q, qn);
+ 	/* Fall back to addmul_1, if nettle is linked with mini-gmp. */
+ #ifdef mpn_cnd_add_n
+-	mpn_cnd_add_n(cy, h, h, mpz_limbs_read(q), qn);
+	mpn_cnd_add_n(cy, h, h, q, qn);
+ #else
+-	mpn_addmul_1(h, mpz_limbs_read(q), qn, cy != 0);
+	mpn_addmul_1(h, q, qn, cy != 0);
+ #endif
+ 	mpn_get_base256(tp, nbytes, h, qn);
+ 
+@@ -178,12 +183,8 @@ _gnutls_dsa_compute_k(mpz_t k,
+ 		if (tlen * 8 > q_bits)
+ 			mpn_rshift (h, h, qn, tlen * 8 - q_bits);
+ 		/* Check if k is in [1,q-1] */
+-		if (!mpn_zero_p (h, qn) &&
+-		    mpn_cmp (h, mpz_limbs_read(q), qn) < 0) {
+-			mpn_copyi(mpz_limbs_write(k, qn), h, qn);
+-			mpz_limbs_finish(k, qn);
+		if (!sec_zero_p(h, qn) && mpn_sub_n(scratch, h, q, qn))
+ 			break;
+-		}
+ 
+ 		ret = gnutls_hmac_init(&hd, mac, K, length);
+ 		if (ret < 0)
+@@ -207,3 +208,24 @@ _gnutls_dsa_compute_k(mpz_t k,
+ 
+ 	return ret;
+ }
+
+/* cancel-out dsa_sign's addition of 1 to random data */
+void _gnutls_dsa_compute_k_finish(uint8_t *k, size_t nbytes, mp_limb_t *h,
+				  mp_size_t n)
+{
+	/* Fall back to sub_1, if nettle is linked with mini-gmp. */
+#ifdef mpn_sec_sub_1
+	mp_limb_t t[MAX_Q_LIMBS];
+
+	mpn_sec_sub_1(h, h, n, 1, t);
+#else
+	mpn_sub_1(h, h, n, 1);
+#endif
+	mpn_get_base256(k, nbytes, h, n);
+}
+
+void _gnutls_ecdsa_compute_k_finish(uint8_t *k, size_t nbytes, mp_limb_t *h,
+				    mp_size_t n)
+{
+	mpn_get_base256(k, nbytes, h, n);
+}
+diff --git a/lib/nettle/int/dsa-compute-k.h b/lib/nettle/int/dsa-compute-k.h
+index 64e90e0ca2..e88fce0a6d 100644
+--- a/lib/nettle/int/dsa-compute-k.h
+++ b/lib/nettle/int/dsa-compute-k.h
+@@ -26,12 +26,29 @@
+ #include <gnutls/gnutls.h>
+ #include <nettle/bignum.h> /* includes gmp.h */
+ 
+-int
+-_gnutls_dsa_compute_k(mpz_t k,
+-		      const mpz_t q,
+-		      const mpz_t x,
+-		      gnutls_mac_algorithm_t mac,
+-		      const uint8_t *digest,
+-		      size_t length);
+#define BITS_TO_LIMBS(bits) (((bits) + GMP_NUMB_BITS - 1) / GMP_NUMB_BITS)
+
+/* The maximum size of q, chosen from the fact that we support
+ * 521-bit elliptic curve generator and 512-bit DSA subgroup at
+ * maximum. */
+#define MAX_Q_BITS 521
+#define MAX_Q_SIZE ((MAX_Q_BITS + 7) / 8)
+#define MAX_Q_LIMBS BITS_TO_LIMBS(MAX_Q_BITS)
+
+#define MAX_HASH_BITS (MAX_HASH_SIZE * 8)
+#define MAX_HASH_LIMBS BITS_TO_LIMBS(MAX_HASH_BITS)
+
+#define DSA_COMPUTE_K_ITCH MAX(MAX_Q_LIMBS, MAX_HASH_LIMBS)
+
+int _gnutls_dsa_compute_k(mp_limb_t *h, const mp_limb_t *q, const mp_limb_t *x,
+			  mp_size_t qn, mp_bitcnt_t q_bits,
+			  gnutls_mac_algorithm_t mac, const uint8_t *digest,
+			  size_t length);
+
+void _gnutls_dsa_compute_k_finish(uint8_t *k, size_t nbytes, mp_limb_t *h,
+				  mp_size_t n);
+
+void _gnutls_ecdsa_compute_k_finish(uint8_t *k, size_t nbytes, mp_limb_t *h,
+				    mp_size_t n);
+ 
+ #endif /* GNUTLS_LIB_NETTLE_INT_DSA_COMPUTE_K_H */
+diff --git a/lib/nettle/int/ecdsa-compute-k.c b/lib/nettle/int/ecdsa-compute-k.c
+index 94914ebdfa..819302c1c7 100644
+--- a/lib/nettle/int/ecdsa-compute-k.c
+++ b/lib/nettle/int/ecdsa-compute-k.c
+@@ -29,67 +29,46 @@
+ #include "dsa-compute-k.h"
+ #include "gnutls_int.h"
+ 
+-static inline int
+-_gnutls_ecc_curve_to_dsa_q(mpz_t *q, gnutls_ecc_curve_t curve)
+int _gnutls_ecc_curve_to_dsa_q(mpz_t q, gnutls_ecc_curve_t curve)
+ {
+ 	switch (curve) {
+ #ifdef ENABLE_NON_SUITEB_CURVES
+ 	case GNUTLS_ECC_CURVE_SECP192R1:
+-		mpz_init_set_str(*q,
+-				 "FFFFFFFFFFFFFFFFFFFFFFFF99DEF836"
+-				 "146BC9B1B4D22831",
+-				 16);
+		mpz_set_str(q,
+			    "FFFFFFFFFFFFFFFFFFFFFFFF99DEF836"
+			    "146BC9B1B4D22831",
+			    16);
+ 		return 0;
+ 	case GNUTLS_ECC_CURVE_SECP224R1:
+-		mpz_init_set_str(*q,
+-				 "FFFFFFFFFFFFFFFFFFFFFFFFFFFF16A2"
+-				 "E0B8F03E13DD29455C5C2A3D",
+-				 16);
+		mpz_set_str(q,
+			    "FFFFFFFFFFFFFFFFFFFFFFFFFFFF16A2"
+			    "E0B8F03E13DD29455C5C2A3D",
+			    16);
+ 		return 0;
+ #endif
+ 	case GNUTLS_ECC_CURVE_SECP256R1:
+-		mpz_init_set_str(*q,
+-				 "FFFFFFFF00000000FFFFFFFFFFFFFFFF"
+-				 "BCE6FAADA7179E84F3B9CAC2FC632551",
+-				 16);
+		mpz_set_str(q,
+			    "FFFFFFFF00000000FFFFFFFFFFFFFFFF"
+			    "BCE6FAADA7179E84F3B9CAC2FC632551",
+			    16);
+ 		return 0;
+ 	case GNUTLS_ECC_CURVE_SECP384R1:
+-		mpz_init_set_str(*q,
+-				 "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
+-				 "FFFFFFFFFFFFFFFFC7634D81F4372DDF"
+-				 "581A0DB248B0A77AECEC196ACCC52973",
+-				 16);
+		mpz_set_str(q,
+			    "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
+			    "FFFFFFFFFFFFFFFFC7634D81F4372DDF"
+			    "581A0DB248B0A77AECEC196ACCC52973",
+			    16);
+ 		return 0;
+ 	case GNUTLS_ECC_CURVE_SECP521R1:
+-		mpz_init_set_str(*q,
+-				 "1FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
+-				 "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
+-				 "FFA51868783BF2F966B7FCC0148F709A"
+-				 "5D03BB5C9B8899C47AEBB6FB71E91386"
+-				 "409",
+-				 16);
+		mpz_set_str(q,
+			    "1FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
+			    "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
+			    "FFA51868783BF2F966B7FCC0148F709A"
+			    "5D03BB5C9B8899C47AEBB6FB71E91386"
+			    "409",
+			    16);
+ 		return 0;
+ 	default:
+ 		return gnutls_assert_val(GNUTLS_E_UNSUPPORTED_SIGNATURE_ALGORITHM);
+ 	}
+ }
+-
+-int
+-_gnutls_ecdsa_compute_k (mpz_t k,
+-			 gnutls_ecc_curve_t curve,
+-			 const mpz_t x,
+-			 gnutls_mac_algorithm_t mac,
+-			 const uint8_t *digest,
+-			 size_t length)
+-{
+-	mpz_t q;
+-	int ret;
+-
+-	ret = _gnutls_ecc_curve_to_dsa_q(&q, curve);
+-	if (ret < 0)
+-		return gnutls_assert_val(ret);
+-
+-	ret = _gnutls_dsa_compute_k (k, q, x, mac, digest, length);
+-	mpz_clear(q);
+-	return ret;
+-}
+diff --git a/lib/nettle/int/ecdsa-compute-k.h b/lib/nettle/int/ecdsa-compute-k.h
+index 7ca401d6e4..a7e612bcab 100644
+--- a/lib/nettle/int/ecdsa-compute-k.h
+++ b/lib/nettle/int/ecdsa-compute-k.h
+@@ -26,12 +26,6 @@
+ #include <gnutls/gnutls.h>
+ #include <nettle/bignum.h> /* includes gmp.h */
+ 
+-int
+-_gnutls_ecdsa_compute_k (mpz_t k,
+-			 gnutls_ecc_curve_t curve,
+-			 const mpz_t x,
+-			 gnutls_mac_algorithm_t mac,
+-			 const uint8_t *digest,
+-			 size_t length);
+int _gnutls_ecc_curve_to_dsa_q(mpz_t q, gnutls_ecc_curve_t curve);
+ 
+ #endif /* GNUTLS_LIB_NETTLE_INT_ECDSA_COMPUTE_K_H */
+diff --git a/lib/nettle/pk.c b/lib/nettle/pk.c
+index 588e9df502..b19fe3804a 100644
+--- a/lib/nettle/pk.c
+++ b/lib/nettle/pk.c
+@@ -102,10 +102,16 @@ static void rnd_nonce_func(void *_ctx, size_t length, uint8_t * data)
+ 	}
+ }
+ 
+-static void rnd_mpz_func(void *_ctx, size_t length, uint8_t * data)
+static void rnd_datum_func(void *ctx, size_t length, uint8_t *data)
+ {
+-	mpz_t *k = _ctx;
+-	nettle_mpz_get_str_256 (length, data, *k);
+	gnutls_datum_t *d = ctx;
+
+	if (length > d->size) {
+		memset(data, 0, length - d->size);
+		memcpy(data + (length - d->size), d->data, d->size);
+	} else {
+		memcpy(data, d->data, length);
+	}
+ }
+ 
+ static void rnd_nonce_func_fallback(void *_ctx, size_t length, uint8_t * data)
+@@ -976,7 +982,10 @@ _wrap_nettle_pk_sign(gnutls_pk_algorithm_t algo,
+ 			struct dsa_signature sig;
+ 			int curve_id = pk_params->curve;
+ 			const struct ecc_curve *curve;
+-			mpz_t k;
+			mpz_t q;
+			/* 521-bit elliptic curve generator at maximum */
+			uint8_t buf[(521 + 7) / 8];
+			gnutls_datum_t k = { NULL, 0 };
+ 			void *random_ctx;
+ 			nettle_random_func *random_func;
+ 
+@@ -1005,19 +1014,32 @@ _wrap_nettle_pk_sign(gnutls_pk_algorithm_t algo,
+ 				hash_len = vdata->size;
+ 			}
+ 
+-			mpz_init(k);
+			mpz_init(q);
+
+ 			if (_gnutls_get_lib_state() == LIB_STATE_SELFTEST ||
+ 			    (sign_params->flags & GNUTLS_PK_FLAG_REPRODUCIBLE)) {
+-				ret = _gnutls_ecdsa_compute_k(k,
+-							      curve_id,
+-							      pk_params->params[ECC_K],
+-							      DIG_TO_MAC(sign_params->dsa_dig),
+-							      vdata->data,
+-							      vdata->size);
+				mp_limb_t h[DSA_COMPUTE_K_ITCH];
+
+				ret = _gnutls_ecc_curve_to_dsa_q(q, curve_id);
+ 				if (ret < 0)
+ 					goto ecdsa_cleanup;
+
+				ret = _gnutls_dsa_compute_k(
+					h, mpz_limbs_read(q), priv.p,
+					ecc_size(priv.ecc), ecc_bit_size(priv.ecc),
+					DIG_TO_MAC(sign_params->dsa_dig), vdata->data,
+					vdata->size);
+				if (ret < 0)
+					goto ecdsa_cleanup;
+
+				k.data = buf;
+				k.size = (ecc_bit_size(priv.ecc) + 7) / 8;
+
+				_gnutls_ecdsa_compute_k_finish(k.data, k.size, h,
+							       ecc_size(priv.ecc));
+
+ 				random_ctx = &k;
+-				random_func = rnd_mpz_func;
+				random_func = rnd_datum_func;
+ 			} else {
+ 				random_ctx = NULL;
+ 				random_func = rnd_nonce_func;
+@@ -1038,7 +1060,7 @@ _wrap_nettle_pk_sign(gnutls_pk_algorithm_t algo,
+  ecdsa_cleanup:
+ 			dsa_signature_clear(&sig);
+ 			ecc_scalar_zclear(&priv);
+-			mpz_clear(k);
+			mpz_clear(q);
+ 
+ 			if (ret < 0) {
+ 				gnutls_assert();
+@@ -1051,7 +1073,9 @@ _wrap_nettle_pk_sign(gnutls_pk_algorithm_t algo,
+ 			struct dsa_params pub;
+ 			bigint_t priv;
+ 			struct dsa_signature sig;
+-			mpz_t k;
+			/* 512-bit DSA subgroup at maximum */
+			uint8_t buf[(512 + 7) / 8];
+			gnutls_datum_t k = { NULL, 0 };
+ 			void *random_ctx;
+ 			nettle_random_func *random_func;
+ 
+@@ -1074,21 +1098,27 @@ _wrap_nettle_pk_sign(gnutls_pk_algorithm_t algo,
+ 				hash_len = vdata->size;
+ 			}
+ 
+-			mpz_init(k);
+ 			if (_gnutls_get_lib_state() == LIB_STATE_SELFTEST ||
+ 			    (sign_params->flags & GNUTLS_PK_FLAG_REPRODUCIBLE)) {
+-				ret = _gnutls_dsa_compute_k(k,
+-							    pub.q,
+-							    TOMPZ(priv),
+-							    DIG_TO_MAC(sign_params->dsa_dig),
+-							    vdata->data,
+-							    vdata->size);
+				mp_limb_t h[DSA_COMPUTE_K_ITCH];
+
+				ret = _gnutls_dsa_compute_k(
+					h, mpz_limbs_read(pub.q),
+					mpz_limbs_read(TOMPZ(priv)), mpz_size(pub.q),
+					mpz_sizeinbase(pub.q, 2),
+					DIG_TO_MAC(sign_params->dsa_dig), vdata->data,
+					vdata->size);
+ 				if (ret < 0)
+ 					goto dsa_fail;
+-				/* cancel-out dsa_sign's addition of 1 to random data */
+-				mpz_sub_ui (k, k, 1);
+
+				k.data = buf;
+				k.size = (mpz_sizeinbase(pub.q, 2) + 7) / 8;
+
+				_gnutls_dsa_compute_k_finish(k.data, k.size, h,
+							     mpz_size(pub.q));
+
+ 				random_ctx = &k;
+-				random_func = rnd_mpz_func;
+				random_func = rnd_datum_func;
+ 			} else {
+ 				random_ctx = NULL;
+ 				random_func = rnd_nonce_func;
+@@ -1108,7 +1138,6 @@ _wrap_nettle_pk_sign(gnutls_pk_algorithm_t algo,
+ 
+  dsa_fail:
+ 			dsa_signature_clear(&sig);
+-			mpz_clear(k);
+ 
+ 			if (ret < 0) {
+ 				gnutls_assert();
+diff --git a/tests/sign-verify-deterministic.c b/tests/sign-verify-deterministic.c
+index 6e907288ee..25aa553a59 100644
+--- a/tests/sign-verify-deterministic.c
+++ b/tests/sign-verify-deterministic.c
+@@ -197,7 +197,7 @@ void doit(void)
+ 					      &signature);
+ 		if (ret < 0)
+ 			testfail("gnutls_pubkey_verify_data2\n");
+-		success(" - pass");
+		success(" - pass\n");
+ 
+ 	next:
+ 		gnutls_free(signature.data);
+-- 
+2.44.0
+
--- a/SOURCES/gnutls-3.6.16-doc-p11tool-ckaid.patch
+++ b/SOURCES/gnutls-3.6.16-doc-p11tool-ckaid.patch
@ -0,0 +1,14 @@
+--- gnutls-3.7.2/doc/manpages/p11tool.1	2021-05-29 10:15:22.000000000 +0200
+++ gnutls-3.7.2-bootstrapped/doc/manpages/p11tool.1	2021-06-28 09:35:23.000000000 +0200
+@@ -230,8 +230,9 @@
+ .NOP \f\*[B-Font]\-\-write\f[]
+ Writes the loaded objects to a PKCS #11 token.
+ .sp
+-It can be used to write private, public keys, certificates or secret keys to a token. Must be combined with
+-    one of \--load-privkey, \--load-pubkey, \--load-certificate option.
+It can be used to write private, public keys, certificates or secret keys to a token. Must be combined with one of \--load-privkey, \--load-pubkey, \--load-certificate option.
+.sp
+When writing a certificate object, its CKA_ID is set to the same CKA_ID of the corresponding public key, if it exists on the token; otherwise it will be derived from the X.509 Subject Key Identifier of the certificate. If this behavior is undesired, write the public key to the token beforehand.
+ .TP
+ .NOP \f\*[B-Font]\-\-delete\f[]
+ Deletes the objects matching the given PKCS #11 URL.
--- a/SOURCES/gnutls-3.6.16-pkcs7-verify.patch
+++ b/SOURCES/gnutls-3.6.16-pkcs7-verify.patch
@ -1,17 +1,19 @@
-From 57afc290cd3ce2e9752a0ce5cba41ecc78fdc1bd Mon Sep 17 00:00:00 2001
-From: rpm-build <rpm-build>
-Date: Sun, 31 Jul 2022 10:39:53 +0900
-Subject: [PATCH] gnutls-3.7.6-pkcs7-verify.patch
+From e5dc27d1a457d1b3abc0582cd133910dff0fc309 Mon Sep 17 00:00:00 2001
+From: Zoltan Fridrich <zfridric@redhat.com>
+Date: Fri, 22 Jul 2022 12:00:11 +0200
+Subject: [PATCH] Fix double free during gnutls_pkcs7_verify

+Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>
 ---
+ .gitignore                       |   1 +
 lib/x509/pkcs7.c                 |   3 +-
- tests/Makefile.am                |   2 +-
+ tests/Makefile.am                |   3 +-
 tests/pkcs7-verify-double-free.c | 215 +++++++++++++++++++++++++++++++
- 3 files changed, 218 insertions(+), 2 deletions(-)
+ 4 files changed, 220 insertions(+), 2 deletions(-)
 create mode 100644 tests/pkcs7-verify-double-free.c

 diff --git a/lib/x509/pkcs7.c b/lib/x509/pkcs7.c
-index 1f35fab..d5be7f4 100644
+index 0ff55ba04b..878f867862 100644
 --- a/lib/x509/pkcs7.c
 +++ b/lib/x509/pkcs7.c
@@ -1318,7 +1318,8 @@ gnutls_x509_crt_t find_signer(gnutls_pkcs7_t pkcs7, gnutls_x509_trust_list_t tl,
@ -25,21 +27,22 @@ index 1f35fab..d5be7f4 100644
 					break;
 				}
 diff --git a/tests/Makefile.am b/tests/Makefile.am
-index 26e39fb..7a7a4af 100644
+index b04cb081b4..0563d3c754 100644
 --- a/tests/Makefile.am
 +++ b/tests/Makefile.am
-@@ -233,7 +233,7 @@ ctests += mini-record-2 simple gnutls_hmac_fast set_pkcs12_cred cert certuniquei
+@@ -220,7 +220,8 @@ ctests += mini-record-2 simple gnutls_hmac_fast set_pkcs12_cred cert certuniquei
+ 	 sign-verify-newapi sign-verify-deterministic iov aead-cipher-vec \
 	 tls13-without-timeout-func buffer status-request-revoked \
- 	 set_x509_ocsp_multi_cli kdf-api keylog-func handshake-write \
- 	 x509cert-dntypes id-on-xmppAddr tls13-compat-mode ciphersuite-name \
-	 x509-upnconstraint
-+	 x509-upnconstraint pkcs7-verify-double-free
- 
- ctests += tls-channel-binding
+ 	 set_x509_ocsp_multi_cli kdf-api keylog-func \
+-	 dtls_hello_random_value tls_hello_random_value x509cert-dntypes
+	 dtls_hello_random_value tls_hello_random_value x509cert-dntypes \
+	 pkcs7-verify-double-free
 
+ if HAVE_SECCOMP_TESTS
+ ctests += dtls-with-seccomp tls-with-seccomp dtls-client-with-seccomp tls-client-with-seccomp
 diff --git a/tests/pkcs7-verify-double-free.c b/tests/pkcs7-verify-double-free.c
 new file mode 100644
-index 0000000..fadf307
+index 0000000000..fadf307829
 --- /dev/null
 +++ b/tests/pkcs7-verify-double-free.c
@@ -0,0 +1,215 @@
@ -259,5 +262,5 @@ index 0000000..fadf307
 +	gnutls_pkcs7_deinit(pkcs7);
 +}
 -- 
-2.37.1
+2.37.2

--- a/SOURCES/gnutls-3.6.16-rehandshake-tickets.patch
+++ b/SOURCES/gnutls-3.6.16-rehandshake-tickets.patch
@ -1,7 +1,24 @@
-diff --color -ruNp a/lib/ext/session_ticket.c b/lib/ext/session_ticket.c
--- a/lib/ext/session_ticket.c	2022-05-10 13:55:00.000000000 +0200
-+++ b/lib/ext/session_ticket.c	2022-11-15 13:30:20.491830382 +0100
-@@ -624,6 +624,12 @@ gnutls_session_ticket_enable_server(gnut
+From 9b50d94bf1c8e749d7dfc593c89e689a161444ae Mon Sep 17 00:00:00 2001
+From: rpm-build <rpm-build>
+Date: Mon, 26 Jun 2023 09:30:03 +0200
+Subject: [PATCH] gnutls-3.6.16-rehandshake-tickets.patch
+
+Signed-off-by: rpm-build <rpm-build>
+---
+ lib/ext/session_ticket.c         |   6 ++
+ lib/ext/session_ticket.h         |   1 +
+ lib/libgnutls.map                |   2 +
+ lib/state.c                      |   1 +
+ tests/Makefile.am                |   3 +-
+ tests/tls12-rehandshake-ticket.c | 152 +++++++++++++++++++++++++++++++
+ 6 files changed, 164 insertions(+), 1 deletion(-)
+ create mode 100644 tests/tls12-rehandshake-ticket.c
+
+diff --git a/lib/ext/session_ticket.c b/lib/ext/session_ticket.c
+index 8f22462..8d83a6c 100644
+--- a/lib/ext/session_ticket.c
+++ b/lib/ext/session_ticket.c
+@@ -618,6 +618,12 @@ gnutls_session_ticket_enable_server(gnutls_session_t session,
 	return 0;
 }
 
@ -14,30 +31,33 @@ diff --color -ruNp a/lib/ext/session_ticket.c b/lib/ext/session_ticket.c
 /*
  * Return zero if session tickets haven't been enabled.
  */
-diff --color -ruNp a/lib/ext/session_ticket.h b/lib/ext/session_ticket.h
--- a/lib/ext/session_ticket.h	2022-02-22 15:34:48.000000000 +0100
-+++ b/lib/ext/session_ticket.h	2022-11-15 13:30:20.491830382 +0100
-@@ -36,5 +36,6 @@ int _gnutls_encrypt_session_ticket(gnutl
+diff --git a/lib/ext/session_ticket.h b/lib/ext/session_ticket.h
+index da804ec..660c9d3 100644
+--- a/lib/ext/session_ticket.h
+++ b/lib/ext/session_ticket.h
+@@ -36,5 +36,6 @@ int _gnutls_encrypt_session_ticket(gnutls_session_t session,
 int _gnutls_decrypt_session_ticket(gnutls_session_t session,
 				   const gnutls_datum_t *ticket_data,
 				   gnutls_datum_t *state);
 +void _gnutls_session_ticket_disable_server(gnutls_session_t session);
 
 #endif /* GNUTLS_LIB_EXT_SESSION_TICKET_H */
-diff --color -ruNp a/lib/libgnutls.map b/lib/libgnutls.map
--- a/lib/libgnutls.map	2022-11-15 13:12:57.781688194 +0100
-+++ b/lib/libgnutls.map	2022-11-15 13:30:20.492830401 +0100
-@@ -1510,4 +1510,6 @@ GNUTLS_PRIVATE_3_4 {
+diff --git a/lib/libgnutls.map b/lib/libgnutls.map
+index d2f7c0a..6748b3a 100644
+--- a/lib/libgnutls.map
+++ b/lib/libgnutls.map
+@@ -1432,4 +1432,6 @@ GNUTLS_PRIVATE_3_4 {
+ 	_gnutls_buffer_unescape;
+ 	_gnutls_buffer_pop_datum;
 	_gnutls_buffer_clear;
- 	# needed by tests/cipher-alignment
- 	_gnutls_crypto_register_cipher;
 +	# needed by tests/tls12-rehandshake-cert-ticket
 +	_gnutls_session_ticket_disable_server;
 } GNUTLS_3_4;
-diff --color -ruNp a/lib/state.c b/lib/state.c
--- a/lib/state.c	2022-05-16 17:10:08.000000000 +0200
-+++ b/lib/state.c	2022-11-15 13:30:20.493830420 +0100
-@@ -545,6 +545,7 @@ void _gnutls_handshake_internal_state_cl
+diff --git a/lib/state.c b/lib/state.c
+index 817a7b8..f1e9daa 100644
+--- a/lib/state.c
+++ b/lib/state.c
+@@ -452,6 +452,7 @@ void _gnutls_handshake_internal_state_clear(gnutls_session_t session)
 	session->internals.tfo.connect_addrlen = 0;
 	session->internals.tfo.connect_only = 0;
 	session->internals.early_data_received = 0;
@ -45,21 +65,25 @@ diff --color -ruNp a/lib/state.c b/lib/state.c
 }
 
 /**
-diff --color -ruNp a/tests/Makefile.am b/tests/Makefile.am
--- a/tests/Makefile.am	2022-11-15 13:12:58.209696462 +0100
-+++ b/tests/Makefile.am	2022-11-15 13:30:20.494830440 +0100
-@@ -234,7 +234,7 @@ ctests += mini-record-2 simple gnutls_hm
- 	 set_x509_ocsp_multi_cli kdf-api keylog-func handshake-write \
- 	 x509cert-dntypes id-on-xmppAddr tls13-compat-mode ciphersuite-name \
- 	 x509-upnconstraint xts-key-check pkcs7-verify-double-free \
-	 fips-rsa-sizes
-+	 fips-rsa-sizes tls12-rehandshake-ticket
+diff --git a/tests/Makefile.am b/tests/Makefile.am
+index 0563d3c..7c5f5c4 100644
+--- a/tests/Makefile.am
+++ b/tests/Makefile.am
+@@ -221,7 +221,8 @@ ctests += mini-record-2 simple gnutls_hmac_fast set_pkcs12_cred cert certuniquei
+ 	 tls13-without-timeout-func buffer status-request-revoked \
+ 	 set_x509_ocsp_multi_cli kdf-api keylog-func \
+ 	 dtls_hello_random_value tls_hello_random_value x509cert-dntypes \
+-	 pkcs7-verify-double-free
+	 pkcs7-verify-double-free \
+	 tls12-rehandshake-ticket
 
- ctests += tls-channel-binding
- 
-diff --color -ruNp a/tests/tls12-rehandshake-ticket.c b/tests/tls12-rehandshake-ticket.c
--- a/tests/tls12-rehandshake-ticket.c	1970-01-01 01:00:00.000000000 +0100
-+++ b/tests/tls12-rehandshake-ticket.c	2022-11-15 13:30:20.495830459 +0100
+ if HAVE_SECCOMP_TESTS
+ ctests += dtls-with-seccomp tls-with-seccomp dtls-client-with-seccomp tls-client-with-seccomp
+diff --git a/tests/tls12-rehandshake-ticket.c b/tests/tls12-rehandshake-ticket.c
+new file mode 100644
+index 0000000..f96e46e
+--- /dev/null
+++ b/tests/tls12-rehandshake-ticket.c
@@ -0,0 +1,152 @@
 +/*
 + * Copyright (C) 2022 Red Hat, Inc.
@ -213,3 +237,6 @@ diff --color -ruNp a/tests/tls12-rehandshake-ticket.c b/tests/tls12-rehandshake-
 +{
 +	run();
 +}
+-- 
+2.41.0
+
--- a/SOURCES/gnutls-3.6.16-rsa-psk-timing-followup.patch
+++ b/SOURCES/gnutls-3.6.16-rsa-psk-timing-followup.patch
@ -1,4 +1,4 @@
-From a27c2e9574d2f29dbf674bd8863f29f7a0a9b9a0 Mon Sep 17 00:00:00 2001
+From fe912c5dba49dcecbd5c32bf8184e60a949af452 Mon Sep 17 00:00:00 2001
 From: Daiki Ueno <ueno@gnu.org>
 Date: Wed, 10 Jan 2024 19:13:17 +0900
 Subject: [PATCH] rsa-psk: minimize branching after decryption
--- a/SOURCES/gnutls-3.6.16-rsa-psk-timing.patch
+++ b/SOURCES/gnutls-3.6.16-rsa-psk-timing.patch
@ -1,7 +1,7 @@
-From 36b576644e4b90256bb485200ac6feca211f2b22 Mon Sep 17 00:00:00 2001
+From e007a54432c98618bde500649817d153225abf6b Mon Sep 17 00:00:00 2001
 From: rpm-build <rpm-build>
-Date: Mon, 11 Dec 2023 10:47:04 +0900
-Subject: [PATCH] gnutls-3.7.6-rsa-psk-timing.patch
+Date: Thu, 7 Dec 2023 11:52:08 +0900
+Subject: [PATCH] gnutls-3.6.16-rsa-psk-timing.patch

 Signed-off-by: rpm-build <rpm-build>
 ---
@ -150,10 +150,10 @@ index 1a9dab5..93c2dc9 100644
 	/* find the key of this username
 	 */
 diff --git a/lib/gnutls_int.h b/lib/gnutls_int.h
-index c6bf154..b59fb7c 100644
+index 31cec5c..815f69b 100644
 --- a/lib/gnutls_int.h
 +++ b/lib/gnutls_int.h
-@@ -988,7 +988,6 @@ struct gnutls_priority_st {
+@@ -971,7 +971,6 @@ struct gnutls_priority_st {
 	bool _no_etm;
 	bool _no_ext_master_secret;
 	bool _allow_key_usage_violation;
@ -161,7 +161,7 @@ index c6bf154..b59fb7c 100644
 	bool _dumbfw;
 	unsigned int _dh_prime_bits;	/* old (deprecated) variable */
 
-@@ -1006,7 +1005,6 @@ struct gnutls_priority_st {
+@@ -989,7 +988,6 @@ struct gnutls_priority_st {
 	      (x)->no_etm = 1; \
 	      (x)->no_ext_master_secret = 1; \
 	      (x)->allow_key_usage_violation = 1; \
@ -169,7 +169,7 @@ index c6bf154..b59fb7c 100644
 	      (x)->dumbfw = 1
 
 #define ENABLE_PRIO_COMPAT(x) \
-@@ -1015,7 +1013,6 @@ struct gnutls_priority_st {
+@@ -998,7 +996,6 @@ struct gnutls_priority_st {
 	      (x)->_no_etm = 1; \
 	      (x)->_no_ext_master_secret = 1; \
 	      (x)->_allow_key_usage_violation = 1; \
@ -177,7 +177,7 @@ index c6bf154..b59fb7c 100644
 	      (x)->_dumbfw = 1
 
 /* DH and RSA parameters types.
-@@ -1140,7 +1137,6 @@ typedef struct {
+@@ -1123,7 +1120,6 @@ typedef struct {
 	bool no_etm;
 	bool no_ext_master_secret;
 	bool allow_key_usage_violation;
@ -186,10 +186,10 @@ index c6bf154..b59fb7c 100644
 
 	/* old (deprecated) variable. This is used for both srp_prime_bits
 diff --git a/lib/priority.c b/lib/priority.c
-index 4adf4c7..423cbd3 100644
+index 0a284ae..67ec887 100644
 --- a/lib/priority.c
 +++ b/lib/priority.c
-@@ -701,7 +701,6 @@ gnutls_priority_set(gnutls_session_t session, gnutls_priority_t priority)
+@@ -681,7 +681,6 @@ gnutls_priority_set(gnutls_session_t session, gnutls_priority_t priority)
 	COPY_TO_INTERNALS(no_etm);
 	COPY_TO_INTERNALS(no_ext_master_secret);
 	COPY_TO_INTERNALS(allow_key_usage_violation);
--- a/SOURCES/gnutls-3.6.16-tls12-cert-type.patch
+++ b/SOURCES/gnutls-3.6.16-tls12-cert-type.patch
@ -0,0 +1,125 @@
+From 339bef12f478b3a12c59571c53645e31280baf7e Mon Sep 17 00:00:00 2001
+From: Daiki Ueno <ueno@gnu.org>
+Date: Fri, 14 May 2021 15:59:37 +0200
+Subject: [PATCH] cert auth: filter out unsupported cert types from TLS 1.2 CR
+
+When the server is advertising signature algorithms in TLS 1.2
+CertificateRequest, it shouldn't send certificate_types not backed by
+any of those algorithms.
+
+Signed-off-by: Daiki Ueno <ueno@gnu.org>
+---
+ lib/auth/cert.c                         | 76 +++++++++++++++++++++++--
+ tests/suite/tls-fuzzer/gnutls-cert.json | 19 +++++++
+ 2 files changed, 89 insertions(+), 6 deletions(-)
+
+diff --git a/lib/auth/cert.c b/lib/auth/cert.c
+index 3073a33d3..0b0f04b2b 100644
+--- a/lib/auth/cert.c
+++ b/lib/auth/cert.c
+@@ -64,6 +64,16 @@ typedef enum CertificateSigType { RSA_SIGN = 1, DSA_SIGN = 2, ECDSA_SIGN = 64,
+ #endif
+ } CertificateSigType;
+ 
+enum CertificateSigTypeFlags {
+	RSA_SIGN_FLAG = 1,
+	DSA_SIGN_FLAG = 1 << 1,
+	ECDSA_SIGN_FLAG = 1 << 2,
+#ifdef ENABLE_GOST
+	GOSTR34102012_256_SIGN_FLAG = 1 << 3,
+	GOSTR34102012_512_SIGN_FLAG = 1 << 4
+#endif
+};
+
+ /* Moves data from an internal certificate struct (gnutls_pcert_st) to
+  * another internal certificate struct (cert_auth_info_t), and deinitializes
+  * the former.
+@@ -1281,6 +1291,7 @@ _gnutls_gen_cert_server_cert_req(gnutls_session_t session,
+ 	uint8_t tmp_data[CERTTYPE_SIZE];
+ 	const version_entry_st *ver = get_version(session);
+ 	unsigned init_pos = data->length;
+	enum CertificateSigTypeFlags flags;
+ 
+ 	if (unlikely(ver == NULL))
+ 		return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);
+@@ -1297,18 +1308,71 @@ _gnutls_gen_cert_server_cert_req(gnutls_session_t session,
+ 		return GNUTLS_E_INSUFFICIENT_CREDENTIALS;
+ 	}
+ 
+-	i = 1;
+	if (_gnutls_version_has_selectable_sighash(ver)) {
+		size_t j;
+
+		flags = 0;
+		for (j = 0; j < session->internals.priorities->sigalg.size; j++) {
+			const gnutls_sign_entry_st *se =
+				session->internals.priorities->sigalg.entry[j];
+			switch (se->pk) {
+			case GNUTLS_PK_RSA:
+			case GNUTLS_PK_RSA_PSS:
+				flags |= RSA_SIGN_FLAG;
+				break;
+			case GNUTLS_PK_DSA:
+				flags |= DSA_SIGN_FLAG;
+				break;
+			case GNUTLS_PK_ECDSA:
+				flags |= ECDSA_SIGN_FLAG;
+				break;
+ #ifdef ENABLE_GOST
+-	if (_gnutls_kx_is_vko_gost(session->security_parameters.cs->kx_algorithm)) {
+-		tmp_data[i++] = GOSTR34102012_256_SIGN;
+-		tmp_data[i++] = GOSTR34102012_512_SIGN;
+-	} else
+			case GNUTLS_PK_GOST_12_256:
+				flags |= GOSTR34102012_256_SIGN_FLAG;
+				break;
+			case GNUTLS_PK_GOST_12_512:
+				flags |= GOSTR34102012_512_SIGN_FLAG;
+				break;
+#endif
+			default:
+				gnutls_assert();
+				_gnutls_debug_log(
+					"%s is unsupported for cert request\n",
+					gnutls_pk_get_name(se->pk));
+			}
+		}
+
+	} else {
+#ifdef ENABLE_GOST
+		if (_gnutls_kx_is_vko_gost(session->security_parameters.
+					   cs->kx_algorithm)) {
+			flags = GOSTR34102012_256_SIGN_FLAG |
+				GOSTR34102012_512_SIGN_FLAG;
+		} else
+ #endif
+-	{
+		{
+			flags = RSA_SIGN_FLAG | DSA_SIGN_FLAG | ECDSA_SIGN_FLAG;
+		}
+	}
+
+	i = 1;
+	if (flags & RSA_SIGN_FLAG) {
+ 		tmp_data[i++] = RSA_SIGN;
+	}
+	if (flags & DSA_SIGN_FLAG) {
+ 		tmp_data[i++] = DSA_SIGN;
+	}
+	if (flags & ECDSA_SIGN_FLAG) {
+ 		tmp_data[i++] = ECDSA_SIGN;
+ 	}
+#ifdef ENABLE_GOST
+	if (flags & GOSTR34102012_256_SIGN_FLAG) {
+		tmp_data[i++] = GOSTR34102012_256_SIGN;
+	}
+	if (flags & GOSTR34102012_512_SIGN_FLAG) {
+		tmp_data[i++] = GOSTR34102012_512_SIGN;
+	}
+#endif
+ 	tmp_data[0] = i - 1;
+ 
+ 	ret = _gnutls_buffer_append_data(data, tmp_data, i);
+-- 
+2.31.1
+
--- a/SOURCES/gnutls-3.6.16-trust-ca-sha1.patch
+++ b/SOURCES/gnutls-3.6.16-trust-ca-sha1.patch
@ -0,0 +1,283 @@
+From c2409e479df41620bceac314c76cabb1d35a4075 Mon Sep 17 00:00:00 2001
+From: Daiki Ueno <ueno@gnu.org>
+Date: Mon, 3 May 2021 16:35:43 +0200
+Subject: [PATCH] x509/verify: treat SHA-1 signed CA in the trusted set
+ differently
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Suppose there is a certificate chain ending with an intermediate CA:
+EE → ICA1 → ICA2.  If the system trust store contains a root CA
+generated with the same key as ICA2 but signed with a prohibited
+algorithm, such as SHA-1, the library previously reported a
+verification failure, though the situation is not uncommon during a
+transition period of root CA.
+
+This changes the library behavior such that the check on signature
+algorithm will be skipped when examining the trusted root CA.
+
+Signed-off-by: Daiki Ueno <ueno@gnu.org>
+---
+ lib/x509/verify.c   |  26 ++++---
+ tests/test-chains.h | 165 ++++++++++++++++++++++++++++++++++++++++++++
+ 2 files changed, 182 insertions(+), 9 deletions(-)
+
+diff --git a/lib/x509/verify.c b/lib/x509/verify.c
+index fd7c6a164..a50b5ea44 100644
+--- a/lib/x509/verify.c
+++ b/lib/x509/verify.c
+@@ -415,14 +415,19 @@ unsigned _gnutls_is_broken_sig_allowed(const gnutls_sign_entry_st *se, unsigned
+ #define CASE_SEC_PARAM(profile, level) \
+ 	case profile: \
+ 		sym_bits = gnutls_sec_param_to_symmetric_bits(level); \
+-		hash = gnutls_sign_get_hash_algorithm(sigalg); \
+-		entry = mac_to_entry(hash); \
+-		if (hash <= 0 || entry == NULL) { \
+		se = _gnutls_sign_to_entry(sigalg); \
+		if (unlikely(se == NULL)) { \
+			_gnutls_cert_log("cert", crt); \
+			_gnutls_debug_log(#level": certificate's signature algorithm is unknown\n"); \
+			return gnutls_assert_val(0); \
+		} \
+		if (unlikely(se->hash == GNUTLS_DIG_UNKNOWN)) {	\
+ 			_gnutls_cert_log("cert", crt); \
+ 			_gnutls_debug_log(#level": certificate's signature hash is unknown\n"); \
+ 			return gnutls_assert_val(0); \
+ 		} \
+-		if (_gnutls_sign_get_hash_strength(sigalg) < sym_bits) { \
+		if (!trusted && \
+		    _gnutls_sign_get_hash_strength(sigalg) < sym_bits) { \
+ 			_gnutls_cert_log("cert", crt); \
+ 			_gnutls_debug_log(#level": certificate's signature hash strength is unacceptable (is %u bits, needed %u)\n", _gnutls_sign_get_hash_strength(sigalg), sym_bits); \
+ 			return gnutls_assert_val(0); \
+@@ -449,19 +454,22 @@ unsigned _gnutls_is_broken_sig_allowed(const gnutls_sign_entry_st *se, unsigned
+  * @crt: a certificate
+  * @issuer: the certificates issuer (allowed to be NULL)
+  * @sigalg: the signature algorithm used
+ * @trusted: whether @crt is treated as trusted (e.g., present in the system
+ *           trust list); if it is true, the check on signature algorithm will
+ *           be skipped
+  * @flags: the specified verification flags
+  */
+ static unsigned is_level_acceptable(
+ 	gnutls_x509_crt_t crt, gnutls_x509_crt_t issuer,
+-	gnutls_sign_algorithm_t sigalg, unsigned flags)
+	gnutls_sign_algorithm_t sigalg, bool trusted,
+	unsigned flags)
+ {
+ 	gnutls_certificate_verification_profiles_t profile = GNUTLS_VFLAGS_TO_PROFILE(flags);
+-	const mac_entry_st *entry;
+ 	int issuer_pkalg = 0, pkalg, ret;
+ 	unsigned bits = 0, issuer_bits = 0, sym_bits = 0;
+ 	gnutls_pk_params_st params;
+ 	gnutls_sec_param_t sp;
+-	int hash;
+	const gnutls_sign_entry_st *se;
+ 	gnutls_certificate_verification_profiles_t min_profile;
+ 
+ 	min_profile = _gnutls_get_system_wide_verification_profile();
+@@ -798,7 +806,7 @@ verify_crt(gnutls_x509_crt_t cert,
+ 	}
+ 
+ 	if (sigalg >= 0 && se) {
+-		if (is_level_acceptable(cert, issuer, sigalg, flags) == 0) {
+		if (is_level_acceptable(cert, issuer, sigalg, false, flags) == 0) {
+ 			MARK_INVALID(GNUTLS_CERT_INSECURE_ALGORITHM);
+ 		}
+ 
+@@ -893,7 +901,7 @@ unsigned check_ca_sanity(const gnutls_x509_crt_t issuer,
+ 
+ 	/* we explicitly allow CAs which we do not support their self-algorithms
+ 	 * to pass. */
+-	if (ret >= 0 && !is_level_acceptable(issuer, NULL, sigalg, flags)) {
+	if (ret >= 0 && !is_level_acceptable(issuer, NULL, sigalg, true, flags)) {
+ 		status |= GNUTLS_CERT_INSECURE_ALGORITHM|GNUTLS_CERT_INVALID;
+ 	}
+ 
+diff --git a/tests/test-chains.h b/tests/test-chains.h
+index 9b06b85f5..64f50fabf 100644
+--- a/tests/test-chains.h
+++ b/tests/test-chains.h
+@@ -4106,6 +4106,163 @@ static const char *superseding_ca[] = {
+ 	NULL
+ };
+ 
+static const char *rsa_sha1_in_trusted[] = {
+	"-----BEGIN CERTIFICATE-----\n"
+	"MIID0jCCAoqgAwIBAgIUezaBB7f4TW75oc3UV57oJvXmbBYwDQYJKoZIhvcNAQEL\n"
+	"BQAwGTEXMBUGA1UEAxMOR251VExTIHRlc3QgQ0EwHhcNMjEwNTAzMTQyNzIxWhcN\n"
+	"MjIwNTAzMTQyNzIxWjA3MRgwFgYDVQQDEw90ZXN0LmdudXRscy5vcmcxGzAZBgNV\n"
+	"BAoTEkdudVRMUyB0ZXN0IHNlcnZlcjCCAVIwDQYJKoZIhvcNAQEBBQADggE/ADCC\n"
+	"AToCggExALRrJ5glr8H/HsqwfvTYvO1DhmdUXdq0HsKQX4M8AhH8E3KFsoikZUEL\n"
+	"dl8jvoqf/nlLczsux0s8vxbJl1U1F/OhckswwuAnlBLzVgDmzoJLEV2kHpv6+rkb\n"
+	"Kk0Ytbql5gzHqKihbaqIhNyWDrJsHDWq58eUPfnVx8KiDUuzbnr3CF/FCc0Vkxr3\n"
+	"mN8qTGaJJO0f0BZjgWWlWDuhzSVim5mBVAgXGOx8LwiiOyhXMp0XRwqG+2KxQZnm\n"
+	"+96o6iB+8xvuuuqaIWQpkvKtc+UZBZ03U+IRnxhfIrriiw0AjJ4vp4c9QL5KoqWS\n"
+	"CAwuYcBYfJqZ4dasgzklzz4b7eujbZ3LxTjewcdumzQUvjA+gpAeuUqaduTvMwxG\n"
+	"ojFy9sNhC/iqZ4n0peV2N6Epn4B5qnUCAwEAAaOBkzCBkDAMBgNVHRMBAf8EAjAA\n"
+	"MBoGA1UdEQQTMBGCD3Rlc3QuZ251dGxzLm9yZzATBgNVHSUEDDAKBggrBgEFBQcD\n"
+	"ATAPBgNVHQ8BAf8EBQMDB6AAMB0GA1UdDgQWBBRIIzRTCokxOEpa6sq20qbezh0r\n"
+	"GDAfBgNVHSMEGDAWgBQedyNtZzEfkQebli/s/MhG/ozhAzANBgkqhkiG9w0BAQsF\n"
+	"AAOCATEAXs8lOV231HQerhSGEjZJz0vBuA3biKYlu3cwCTKvF6EOyYMSWOnfqqD0\n"
+	"eDhpo1pzGtUa2zYLHagb+sU2NSTe0sqP+PK1giUg8X8/tRtWKk1p/m76yK/3iaty\n"
+	"flgz+eMai4xQu2FvAJzIASFjM9R+Pgpcf/zdvkiUPv8Rdm9FieyAZnJSo9hJHLxN\n"
+	"x60tfC5yyswdbGGW0GbJ2kr+xMfVZvxgO/x6AXlOaUGQ+jZAu9eJwFQMDW5h5/S1\n"
+	"PJkIt7f7jkU33cG+BawcjhT0GzxuvDnnCG0L7/z7bR+Sw2kNKqHbHorzv91R20Oh\n"
+	"CIISJPkiiP+mYcglTp1d9gw09GwSkGbldb9ibfc0hKyxiImFfIiTqDbXJcpKH98o\n"
+	"W8hWkb20QURlY+QM5MD49znfhPKMTQ==\n"
+	"-----END CERTIFICATE-----\n",
+	"-----BEGIN CERTIFICATE-----\n"
+	"MIID2TCCAkGgAwIBAgIUWsb4DATcefXbo0WrBfgqVMvPGawwDQYJKoZIhvcNAQEL\n"
+	"BQAwHjEcMBoGA1UEAxMTR251VExTIHRlc3Qgcm9vdCBDQTAeFw0yMTA1MDMxNDI2\n"
+	"MzVaFw0yMjA1MDMxNDI2MzVaMBkxFzAVBgNVBAMTDkdudVRMUyB0ZXN0IENBMIIB\n"
+	"UjANBgkqhkiG9w0BAQEFAAOCAT8AMIIBOgKCATEAnORCsX1unl//fy2d1054XduI\n"
+	"g/3CqVBaT3Hca65SEoDwh0KiPtQoOgZLdKY2cobGs/ojYtOjcs0KnlPYdmtjEh6W\n"
+	"EhuJU95v4TQdC4OLMiE56eIGq252hZAbHoTL84Q14DxQWGuzQK830iml7fbw2WcI\n"
+	"cRQ8vFGs8SzfXw63+MI6Fq6iMAQIqP08WzGmRRzL5wvCiPhCVkrPmwbXoABub6AA\n"
+	"sYwWPJB91M9/lx5gFH5k9/iPfi3s2Kg3F8MOcppqFYjxDSnsfiz6eMh1+bYVIAo3\n"
+	"67vGVYHigXMEZC2FezlwIHaZzpEoFlY3a7LFJ00yrjQ910r8UE+CEMTYzE40D0ol\n"
+	"CMo7FA9RCjeO3bUIoYaIdVTUGWEGHWSeoxGei9Gkm6u+ASj8f+i0jxdD2qXsewID\n"
+	"AQABo2QwYjAPBgNVHRMBAf8EBTADAQH/MA8GA1UdDwEB/wQFAwMHBAAwHQYDVR0O\n"
+	"BBYEFB53I21nMR+RB5uWL+z8yEb+jOEDMB8GA1UdIwQYMBaAFCApU0Q1pxZL+AW3\n"
+	"GctysPWxl+SfMA0GCSqGSIb3DQEBCwUAA4IBgQBbboeDr/rLT1tZWrdHq8FvflGm\n"
+	"EpxZIRU4DdDD/SUCWSPQvjBq0MvuKxs5FfJCKrDf2kS2qlZ1rO0AuWwREoDeTOEc\n"
+	"arjFoCry+JQ+USqS5F4gsp4XlYvli27iMp3dlnhFXEQQy7/y+gM5c9wnMi8v/LUz\n"
+	"AV6QHX0fkb4XeazeJ+Nq0EkjqiYxylN6mP+5LAEMBG/wGviAoviQ5tN9zdoQs/nT\n"
+	"3jTw3cOauuPjdcOTfo71+/MtBzhPchgNIyQo4aB40XVWsLAoruL/3CFFlTniihtd\n"
+	"zA2zA7JvbuuKx6BOv2IbWOUweb732ZpYbDgEcXp/6Cj/SIUGxidpEgdCJGqyqdC7\n"
+	"b58ujxclC6QTcicw+SX5LBox8WGLfj+x+V3uVBz9+EK608xphTj4kLh9peII9v3n\n"
+	"vBUoZRTiUTCvH4AJJgAfa3mYrSxzueuqBOwXcvZ+8OJ0J1CP21pmK5nxR7f1nm9Q\n"
+	"sYA1VHfC2dtyAYlByeF5iHl5hFR6vy1jJyzxg2M=\n"
+	"-----END CERTIFICATE-----\n",
+	NULL
+};
+
+static const char *rsa_sha1_in_trusted_ca[] = {
+	/* This CA is generated with the same key as rsa_sha1_in_trusted[1], but
+	 * self-signed using SHA-1.
+	 */
+	"-----BEGIN CERTIFICATE-----\n"
+	"MIIDYzCCAhugAwIBAgIUahO8CvYPHTAltKCC2rAIcXUiLlAwDQYJKoZIhvcNAQEF\n"
+	"BQAwGTEXMBUGA1UEAxMOR251VExTIHRlc3QgQ0EwHhcNMjEwNTAzMTQyMDM1WhcN\n"
+	"MjIwNTAzMTQyMDM1WjAZMRcwFQYDVQQDEw5HbnVUTFMgdGVzdCBDQTCCAVIwDQYJ\n"
+	"KoZIhvcNAQEBBQADggE/ADCCAToCggExAJzkQrF9bp5f/38tnddOeF3biIP9wqlQ\n"
+	"Wk9x3GuuUhKA8IdCoj7UKDoGS3SmNnKGxrP6I2LTo3LNCp5T2HZrYxIelhIbiVPe\n"
+	"b+E0HQuDizIhOeniBqtudoWQGx6Ey/OENeA8UFhrs0CvN9Ippe328NlnCHEUPLxR\n"
+	"rPEs318Ot/jCOhauojAECKj9PFsxpkUcy+cLwoj4QlZKz5sG16AAbm+gALGMFjyQ\n"
+	"fdTPf5ceYBR+ZPf4j34t7NioNxfDDnKaahWI8Q0p7H4s+njIdfm2FSAKN+u7xlWB\n"
+	"4oFzBGQthXs5cCB2mc6RKBZWN2uyxSdNMq40PddK/FBPghDE2MxONA9KJQjKOxQP\n"
+	"UQo3jt21CKGGiHVU1BlhBh1knqMRnovRpJurvgEo/H/otI8XQ9ql7HsCAwEAAaND\n"
+	"MEEwDwYDVR0TAQH/BAUwAwEB/zAPBgNVHQ8BAf8EBQMDBwQAMB0GA1UdDgQWBBQe\n"
+	"dyNtZzEfkQebli/s/MhG/ozhAzANBgkqhkiG9w0BAQUFAAOCATEAYLm/4DfUp+mA\n"
+	"S/23a2bwybJoPCMzKZpi+veXkqoq/a/BCUkFpqnjpVjz0ujVKK121oeOPBAa/mG1\n"
+	"Y3fJYP+b3PloL/6xj/8680TveGirCr0Rp/8XWa8lt+Ge8DM3mfTGWFTWHa0lD9VK\n"
+	"gjV1oNZNLe5SKA6dJLAp/NjCxc/vuOkThQPeaoO5Iy/Z6m7CpTLO7T4syJFtDmSn\n"
+	"Pa/yFUDTgJYFlGVM+KC1r8bhZ6Ao1CAXTcT5Lcbe/aCcyk6B3J2AnYsqPMVNEVhb\n"
+	"9eMGO/WG24hMLy6eb1r/yL8uQ/uGi2rRlNJN8GTg09YR7l5fHrHxuHc/sme0jsnJ\n"
+	"wtqGLCJsrh7Ae1fKVUueO00Yx9BGuzLswMvnT5f0oYs0jrXgMrTbIWS/DjOcYIHb\n"
+	"w3SV1ZRcNg==\n"
+	"-----END CERTIFICATE-----\n",
+	NULL
+};
+
+static const char *rsa_sha1_not_in_trusted[] = {
+	"-----BEGIN CERTIFICATE-----\n"
+	"MIID0jCCAoqgAwIBAgIUNCvPV9OvyuVMtnkC3ZAvh959h4MwDQYJKoZIhvcNAQEL\n"
+	"BQAwGTEXMBUGA1UEAxMOR251VExTIHRlc3QgQ0EwHhcNMjEwNTA0MDg0NzAzWhcN\n"
+	"MjIwNTA0MDg0NzAzWjA3MRgwFgYDVQQDEw90ZXN0LmdudXRscy5vcmcxGzAZBgNV\n"
+	"BAoTEkdudVRMUyB0ZXN0IHNlcnZlcjCCAVIwDQYJKoZIhvcNAQEBBQADggE/ADCC\n"
+	"AToCggExALRrJ5glr8H/HsqwfvTYvO1DhmdUXdq0HsKQX4M8AhH8E3KFsoikZUEL\n"
+	"dl8jvoqf/nlLczsux0s8vxbJl1U1F/OhckswwuAnlBLzVgDmzoJLEV2kHpv6+rkb\n"
+	"Kk0Ytbql5gzHqKihbaqIhNyWDrJsHDWq58eUPfnVx8KiDUuzbnr3CF/FCc0Vkxr3\n"
+	"mN8qTGaJJO0f0BZjgWWlWDuhzSVim5mBVAgXGOx8LwiiOyhXMp0XRwqG+2KxQZnm\n"
+	"+96o6iB+8xvuuuqaIWQpkvKtc+UZBZ03U+IRnxhfIrriiw0AjJ4vp4c9QL5KoqWS\n"
+	"CAwuYcBYfJqZ4dasgzklzz4b7eujbZ3LxTjewcdumzQUvjA+gpAeuUqaduTvMwxG\n"
+	"ojFy9sNhC/iqZ4n0peV2N6Epn4B5qnUCAwEAAaOBkzCBkDAMBgNVHRMBAf8EAjAA\n"
+	"MBoGA1UdEQQTMBGCD3Rlc3QuZ251dGxzLm9yZzATBgNVHSUEDDAKBggrBgEFBQcD\n"
+	"ATAPBgNVHQ8BAf8EBQMDB6AAMB0GA1UdDgQWBBRIIzRTCokxOEpa6sq20qbezh0r\n"
+	"GDAfBgNVHSMEGDAWgBQedyNtZzEfkQebli/s/MhG/ozhAzANBgkqhkiG9w0BAQsF\n"
+	"AAOCATEAWs/Qa1Ebydwo4Ke2KEdy5cUTSZjnoz93XpbrP9W60MJ4d2DIQPcYUcLF\n"
+	"+glez+mRtVXDRtH5V/4yZX1EdgrPVQGeVlO5HbNiYyYw/Yj3H6kzWtUbBxdOAOE/\n"
+	"/ul8RCKKMfvYBHCBgjBMW0aFm31Q1Z8m8nanBusyJ0DG1scBHu4/3vTCZthZAxc5\n"
+	"3l3t/jjsNRS+k5t6Ay8nEY1tAZSGVqN8qufzO2NBO06sQagp09FTfDh581OBcVtF\n"
+	"X7O0cffAWHk3JoywzEWFEAhVPqFlk07wG2O+k+fYZfavsJko5q+yWkxu8RDh4wAx\n"
+	"7UzKudGOQ+NhfYJ7N7V1/RFg1z75gE3GTUX7qmGZEVDOsMyiuUeYg8znyYpBV55Q\n"
+	"4BNr0ukwmwOdvUf+ksCu6PdOGaqThA==\n"
+	"-----END CERTIFICATE-----\n",
+	/* ICA with SHA1 signature */
+	"-----BEGIN CERTIFICATE-----\n"
+	"MIID2TCCAkGgAwIBAgIUYaKJkQft87M1TF+Jd30py3yIq4swDQYJKoZIhvcNAQEF\n"
+	"BQAwHjEcMBoGA1UEAxMTR251VExTIHRlc3Qgcm9vdCBDQTAeFw0yMTA1MDQwODQ1\n"
+	"NDdaFw0yMjA1MDQwODQ1NDdaMBkxFzAVBgNVBAMTDkdudVRMUyB0ZXN0IENBMIIB\n"
+	"UjANBgkqhkiG9w0BAQEFAAOCAT8AMIIBOgKCATEAnORCsX1unl//fy2d1054XduI\n"
+	"g/3CqVBaT3Hca65SEoDwh0KiPtQoOgZLdKY2cobGs/ojYtOjcs0KnlPYdmtjEh6W\n"
+	"EhuJU95v4TQdC4OLMiE56eIGq252hZAbHoTL84Q14DxQWGuzQK830iml7fbw2WcI\n"
+	"cRQ8vFGs8SzfXw63+MI6Fq6iMAQIqP08WzGmRRzL5wvCiPhCVkrPmwbXoABub6AA\n"
+	"sYwWPJB91M9/lx5gFH5k9/iPfi3s2Kg3F8MOcppqFYjxDSnsfiz6eMh1+bYVIAo3\n"
+	"67vGVYHigXMEZC2FezlwIHaZzpEoFlY3a7LFJ00yrjQ910r8UE+CEMTYzE40D0ol\n"
+	"CMo7FA9RCjeO3bUIoYaIdVTUGWEGHWSeoxGei9Gkm6u+ASj8f+i0jxdD2qXsewID\n"
+	"AQABo2QwYjAPBgNVHRMBAf8EBTADAQH/MA8GA1UdDwEB/wQFAwMHBAAwHQYDVR0O\n"
+	"BBYEFB53I21nMR+RB5uWL+z8yEb+jOEDMB8GA1UdIwQYMBaAFCApU0Q1pxZL+AW3\n"
+	"GctysPWxl+SfMA0GCSqGSIb3DQEBBQUAA4IBgQAewBcAGUGX28I5PDtuJkxoHonD\n"
+	"muHdXpYnrz1YXN4b7odNXockz++Xovgj126fo+PeWgmaaCic98ZcGnyVTi9+3oqN\n"
+	"2Bf4NNfyzSccgZZTphzbwjMcnc983HLQgsLSAOVivPHj5GEN58EWWamc9yA0VjGn\n"
+	"cuYmFN2dlFA8/ClEbVGu3UXBe6OljR5zUr+6oiSp2J+Rl7SerVSHlst07iU2tkeB\n"
+	"dlfOD5CquUGSka3SKvEfvu5SwYrCQVfYB6eMLInm7A0/ca0Jn3Oh4fMf2rIg/E3K\n"
+	"qsopxsu8BXrLoGK4MxbxPA65JpczhZgilQQi3e3RIvxrvyD2qamjaNbyG5cr8mW4\n"
+	"VOLf3vUORbkTi5sE7uRMu2B3z3N7ajsuQM8RHB17hOCB2FO/8rermq/oeJNtx57L\n"
+	"5s5NxCHYTksQ4gkpR4gfTIO/zwXJSwGa/Zi2y2wIi/1qr7lppBsKV2rDWX7QiIeA\n"
+	"PxOxyJA2eSeqCorz9vk3aHXleSpxsWGgKiJVmV0=\n"
+	"-----END CERTIFICATE-----\n",
+	NULL
+};
+
+static const char *rsa_sha1_not_in_trusted_ca[] = {
+	"-----BEGIN CERTIFICATE-----\n"
+	"MIIEDTCCAnWgAwIBAgIUd5X8NZput+aNPEd9h92r4KAu16MwDQYJKoZIhvcNAQEL\n"
+	"BQAwHjEcMBoGA1UEAxMTR251VExTIHRlc3Qgcm9vdCBDQTAeFw0yMTA1MDMxNDI1\n"
+	"MDNaFw0yMjA1MDMxNDI1MDNaMB4xHDAaBgNVBAMTE0dudVRMUyB0ZXN0IHJvb3Qg\n"
+	"Q0EwggGiMA0GCSqGSIb3DQEBAQUAA4IBjwAwggGKAoIBgQCsFAaMb/iRN+OFqQNh\n"
+	"OkkXGZlb+eLerLuB9ELnYwyLIh4MTXh0RjFZdCQLsQHfY/YFv0C50rmoXTA/d3Ef\n"
+	"K/P243KjX0XBWjO9TBuN0zth50eq94zf69yxA/a+kmT+O5YLfhi2ELM5F3IjOUoZ\n"
+	"lL0IGlFJwauAkaNylp/Evd5nW7g5DUJvMm4A3RXNfZt9gAD4lPRwryQq9jxT48Xu\n"
+	"fB0kAPEG/l/Izbz2rYin5+nySL+a0CSNuEbITxidtMhveB747oR0QS2sMQKji1ur\n"
+	"pRJ945SHiYJIgVuFAJc9StikSyIrxZgK45kAzcQAyRWWKiMNH5PprGFYJp+ypwhm\n"
+	"1t8Bphj2RFJAG3XRRZF/9uJIYc5mEHCsZFZ/IFRaKqyN30kAUijgNt+lW5mZXVFU\n"
+	"aqzV2zHjSG8jsGdia3cfBP46Z1q2eAh5jOCucTq1F7qZdVhOFmP9jFE6Uy5Kbwgc\n"
+	"kNAnsEllQeJQL2odVa7woKkZZ4M/c72X5tpBU38Rs3krn3sCAwEAAaNDMEEwDwYD\n"
+	"VR0TAQH/BAUwAwEB/zAPBgNVHQ8BAf8EBQMDBwQAMB0GA1UdDgQWBBQgKVNENacW\n"
+	"S/gFtxnLcrD1sZfknzANBgkqhkiG9w0BAQsFAAOCAYEAaZMV71mZ9FYoVdpho61h\n"
+	"WWPs5GppQLJ1w70DNtGZ+lFrk/KopeDvOu1i61QLWRzcZCZMl+npiX1KH5kjVo3v\n"
+	"C9G8kdMW6EVRk5p6qCJMPFN2U+grMMp50aY5kmw+/v+Lhk5T/VG93l63P91FkUre\n"
+	"o8qhOudJExoUnR1uB9M6HMAxVn8Lm/N1LGPiP6A6Pboo716H7mg/A7pv9zoZ6jUp\n"
+	"7x693mA/b3I/QpDx/nJcmcdqxgEuW+aRlFXgnYZRFAawxi+5M9EwCWbkSTO4OMHP\n"
+	"Qlvak3tJO+wb92b0cICOOtzIPgQ+caiLg9d0FvesALmQzDmNmtqynoO85+Ia2Ywh\n"
+	"nxKPlpeImhLN9nGl9sOeW2m4mnA5r0h1vgML4v/MWL4TQhXallc31uFNj5HyFaTh\n"
+	"6Mr0g3GeQgN0jpT+aIOiKuW9fLts54+Ntj1NN40slqi3Y+/Yd6xhj+NgmbRvybZu\n"
+	"tnYFXKC0Q+QUf38horqG2Mc3/uh8MOm0eYUXwGJOdXYD\n"
+	"-----END CERTIFICATE-----\n",
+	NULL
+};
+
+ #if defined __clang__ || __GNUC__ > 4 || (__GNUC__ == 4 && __GNUC_MINOR__ >= 5)
+ #  pragma GCC diagnostic push
+ #  pragma GCC diagnostic ignored "-Wunused-variable"
+@@ -4275,6 +4432,14 @@ static struct
+   { "ed448 - ok", ed448, &ed448[0], GNUTLS_PROFILE_TO_VFLAGS(GNUTLS_PROFILE_ULTRA),
+     0, NULL, 1584352960, 1},
+   { "superseding - ok", superseding, superseding_ca, 0, 0, 0, 1590928011 },
+  { "rsa-sha1 in trusted - ok",
+    rsa_sha1_in_trusted, rsa_sha1_in_trusted_ca,
+    GNUTLS_PROFILE_TO_VFLAGS(GNUTLS_PROFILE_MEDIUM),
+    0, NULL, 1620052390, 1},
+  { "rsa-sha1 not in trusted - not ok",
+    rsa_sha1_not_in_trusted, rsa_sha1_not_in_trusted_ca,
+    GNUTLS_PROFILE_TO_VFLAGS(GNUTLS_PROFILE_MEDIUM),
+    GNUTLS_CERT_INSECURE_ALGORITHM | GNUTLS_CERT_INVALID, NULL, 1620118136, 1},
+   { NULL, NULL, NULL, 0, 0}
+ };
+ 
+-- 
+2.31.1
+
--- a/SOURCES/gnutls-3.6.4-no-now-guile.patch
+++ b/SOURCES/gnutls-3.6.4-no-now-guile.patch
@ -1,6 +1,8 @@
--- a/guile/src/Makefile.in	2019-03-27 11:51:55.984398001 +0100
-+++ b/guile/src/Makefile.in	2019-03-27 11:52:27.259626076 +0100
-@@ -1472,7 +1472,7 @@
+diff --git a/guile/src/Makefile.in b/guile/src/Makefile.in
+index 95e1e9c..1dfc88e 100644
+--- a/guile/src/Makefile.in
+++ b/guile/src/Makefile.in
+@@ -1483,7 +1483,7 @@ guileextension_LTLIBRARIES = guile-gnutls-v-2.la
 # Use '-module' to build a "dlopenable module", in Libtool terms.
 # Use '-undefined' to placate Libtool on Windows; see
 # <https://lists.gnutls.org/pipermail/gnutls-devel/2014-December/007294.html>.
--- a/SOURCES/gnutls-3.7.2-enable-intel-cet.patch
+++ b/SOURCES/gnutls-3.7.2-enable-intel-cet.patch
--- a/SOURCES/gnutls-3.7.2-no-explicit-init.patch
+++ b/SOURCES/gnutls-3.7.2-no-explicit-init.patch
@ -1,32 +0,0 @@
-From 36a92d984020df16296784a7ad613c9693469d23 Mon Sep 17 00:00:00 2001
-From: rpm-build <rpm-build>
-Date: Tue, 21 Dec 2021 16:28:09 +0100
-Subject: [PATCH 1/2] Remove GNUTLS_NO_EXPLICIT_INIT compatibility
-
-Signed-off-by: rpm-build <rpm-build>
---
- lib/global.c | 8 --------
- 1 file changed, 8 deletions(-)
-
-diff --git a/lib/global.c b/lib/global.c
-index 3731418..1384045 100644
--- a/lib/global.c
-+++ b/lib/global.c
-@@ -500,14 +500,6 @@ static void _CONSTRUCTOR lib_init(void)
- 			return;
- 	}
- 
-	e = secure_getenv("GNUTLS_NO_EXPLICIT_INIT");
-	if (e != NULL) {
-		_gnutls_debug_log("GNUTLS_NO_EXPLICIT_INIT is deprecated; use GNUTLS_NO_IMPLICIT_INIT\n");
-		ret = atoi(e);
-		if (ret == 1)
-			return;
-	}
-
- 	ret = _gnutls_global_init(1);
- 	if (ret < 0) {
- 		fprintf(stderr, "Error in GnuTLS initialization: %s\n", gnutls_strerror(ret));
-- 
-2.31.1
-
--- a/SOURCES/gnutls-3.7.3-disable-config-reload.patch
+++ b/SOURCES/gnutls-3.7.3-disable-config-reload.patch
@ -1,26 +0,0 @@
-diff --git a/lib/priority.c b/lib/priority.c
-index 9feec47fe2..40511710fd 100644
--- a/lib/priority.c
-+++ b/lib/priority.c
-@@ -2001,13 +2001,14 @@ char *_gnutls_resolve_priorities(const char* priorities)
- 		additional++;
- 	}
- 
-	/* Always try to refresh the cached data, to allow it to be
-	 * updated without restarting all applications.
-	 */
-	ret = _gnutls_update_system_priorities(false /* defer_system_wide */);
-	if (ret < 0) {
-		_gnutls_debug_log("failed to update system priorities: %s\n",
-				  gnutls_strerror(ret));
-+	/* If priority string is not constructed yet, construct and finalize */
-+	if (!system_wide_config.priority_string) {
-+		ret = _gnutls_update_system_priorities(false
-+		                                       /* defer_system_wide */);
-+		if (ret < 0) {
-+			_gnutls_debug_log("failed to update system priorities: "
-+			                  " %s\n", gnutls_strerror(ret));
-+		}
- 	}
- 
- 	do {
--- a/SOURCES/gnutls-3.7.3-fips-dsa-post.patch
+++ b/SOURCES/gnutls-3.7.3-fips-dsa-post.patch
@ -1,29 +0,0 @@
-From 0a29639ad24072afbd79b2ceede9976e51b9e2af Mon Sep 17 00:00:00 2001
-From: rpm-build <rpm-build>
-Date: Fri, 1 Jul 2022 16:46:07 +0900
-Subject: [PATCH] fips: don't run POST for DSA
-
-Signed-off-by: rpm-build <<rpm-build>>
---
- lib/fips.c | 5 -----
- 1 file changed, 5 deletions(-)
-
-diff --git a/lib/fips.c b/lib/fips.c
-index 656d43e..c776690 100644
--- a/lib/fips.c
-+++ b/lib/fips.c
-@@ -523,11 +523,6 @@ int _gnutls_fips_perform_self_checks2(void)
- 		return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
- 	}
- 
-	ret = gnutls_pk_self_test(0, GNUTLS_PK_DSA);
-	if (ret < 0) {
-		return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
-	}
-
- 	ret = gnutls_pk_self_test(0, GNUTLS_PK_EC);
- 	if (ret < 0) {
- 		return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
-- 
-2.36.1
-
--- a/SOURCES/gnutls-3.7.6-aes-gcm-pt-limit.patch
+++ b/SOURCES/gnutls-3.7.6-aes-gcm-pt-limit.patch
@ -1,720 +0,0 @@
-From 2f61f102169e4d6652c9b82246353cd276366809 Mon Sep 17 00:00:00 2001
-From: Daiki Ueno <ueno@gnu.org>
-Date: Mon, 27 Jun 2022 11:14:50 +0900
-Subject: [PATCH] cipher: limit plaintext length supplied to AES-GCM
-
-According to SP800-38D 5.2.1.1, input data length of AES-GCM
-encryption function must be less than or equal to 2^39-256 bits.
-
-Signed-off-by: Daiki Ueno <ueno@gnu.org>
---
- NEWS                                         |  3 +
- lib/accelerated/aarch64/aes-aarch64.h        | 15 ++++
- lib/accelerated/aarch64/aes-gcm-aarch64.c    |  9 +++
- lib/accelerated/x86/aes-gcm-padlock.c        | 29 ++++---
- lib/accelerated/x86/aes-gcm-x86-aesni.c      | 30 +++++---
- lib/accelerated/x86/aes-gcm-x86-pclmul-avx.c |  9 +++
- lib/accelerated/x86/aes-gcm-x86-pclmul.c     |  9 +++
- lib/accelerated/x86/aes-gcm-x86-ssse3.c      | 30 +++++---
- lib/accelerated/x86/aes-x86.h                | 15 ++++
- lib/nettle/cipher.c                          | 41 ++++++++++
- tests/slow/cipher-api-test.c                 | 79 ++++++++++++++++++++
- 11 files changed, 240 insertions(+), 29 deletions(-)
-
-diff --git a/lib/accelerated/aarch64/aes-aarch64.h b/lib/accelerated/aarch64/aes-aarch64.h
-index 692d8620d7..0e64f4ed8d 100644
--- a/lib/accelerated/aarch64/aes-aarch64.h
-+++ b/lib/accelerated/aarch64/aes-aarch64.h
-@@ -20,6 +20,21 @@ typedef struct {
- 	if (s != 16 && s != 24 && s != 32) \
- 		return GNUTLS_E_INVALID_REQUEST
- 
-+#include <intprops.h>
-+#define AES_GCM_ENCRYPT_MAX_BYTES ((1ULL << 36) - 32)
-+static inline int
-+record_aes_gcm_encrypt_size(size_t *counter, size_t size) {
-+	size_t sum;
-+
-+	if (!INT_ADD_OK(*counter, size, &sum) ||
-+	    sum > AES_GCM_ENCRYPT_MAX_BYTES) {
-+		return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
-+	}
-+	*counter = sum;
-+
-+	return 0;
-+}
-+
- int aes_v8_set_encrypt_key(const unsigned char *userKey, int bits, AES_KEY *key);  
- int aes_v8_set_decrypt_key(const unsigned char *userKey, int bits, AES_KEY *key);
- void aes_v8_cbc_encrypt(const unsigned char *in, unsigned char *out,
-diff --git a/lib/accelerated/aarch64/aes-gcm-aarch64.c b/lib/accelerated/aarch64/aes-gcm-aarch64.c
-index 901bd9f60f..be1e69c784 100644
--- a/lib/accelerated/aarch64/aes-gcm-aarch64.c
-+++ b/lib/accelerated/aarch64/aes-gcm-aarch64.c
-@@ -62,6 +62,7 @@ struct aes_gcm_ctx {
- 	struct gcm128_context gcm;
- 	unsigned finished;
- 	unsigned auth_finished;
-+	size_t rekey_counter;
- };
- 
- void gcm_init_v8(u128 Htable[16], const uint64_t Xi[2]);
-@@ -116,6 +117,7 @@ aes_gcm_cipher_setkey(void *_ctx, const void *userkey, size_t keysize)
- 	ctx->gcm.H.u[1] = bswap_64(ctx->gcm.H.u[1]);
- 
- 	gcm_init_v8(ctx->gcm.Htable, ctx->gcm.H.u);
-+	ctx->rekey_counter = 0;
- 
- 	return 0;
- }
-@@ -141,6 +143,7 @@ static int aes_gcm_setiv(void *_ctx, const void *iv, size_t iv_size)
- 	ctx->gcm.Yi.c[GCM_BLOCK_SIZE - 1] = 2;
- 	ctx->finished = 0;
- 	ctx->auth_finished = 0;
-+	ctx->rekey_counter = 0;
- 	return 0;
- }
- 
-@@ -229,6 +232,7 @@ aes_gcm_encrypt(void *_ctx, const void *src, size_t src_size,
- 	int exp_blocks = blocks * GCM_BLOCK_SIZE;
- 	int rest = src_size - (exp_blocks);
- 	uint32_t counter;
-+	int ret;
- 
- 	if (unlikely(ctx->finished))
- 		return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
-@@ -236,6 +240,11 @@ aes_gcm_encrypt(void *_ctx, const void *src, size_t src_size,
- 	if (unlikely(length < src_size))
- 		return gnutls_assert_val(GNUTLS_E_SHORT_MEMORY_BUFFER);
- 
-+	ret = record_aes_gcm_encrypt_size(&ctx->rekey_counter, src_size);
-+	if (ret < 0) {
-+		return gnutls_assert_val(ret);
-+	}
-+
- 	if (blocks > 0) {
- 		ctr32_encrypt_blocks(src, dst,
- 				     blocks,
-diff --git a/lib/accelerated/x86/aes-gcm-padlock.c b/lib/accelerated/x86/aes-gcm-padlock.c
-index a9c7441d65..739883ab1b 100644
--- a/lib/accelerated/x86/aes-gcm-padlock.c
-+++ b/lib/accelerated/x86/aes-gcm-padlock.c
-@@ -43,7 +43,10 @@
-  * Actually padlock doesn't include GCM mode. We just use
-  * the ECB part of padlock and nettle for everything else.
-  */
-struct gcm_padlock_aes_ctx GCM_CTX(struct padlock_ctx);
-+struct gcm_padlock_aes_ctx {
-+	struct GCM_CTX(struct padlock_ctx) inner;
-+	size_t rekey_counter;
-+};
- 
- static void padlock_aes_encrypt(const void *_ctx,
- 				size_t length, uint8_t * dst,
-@@ -78,7 +81,7 @@ static void padlock_aes256_set_encrypt_key(struct padlock_ctx *_ctx,
- 
- static void aes_gcm_deinit(void *_ctx)
- {
-	struct padlock_ctx *ctx = _ctx;
-+	struct gcm_padlock_aes_ctx *ctx = _ctx;
- 
- 	zeroize_temp_key(ctx, sizeof(*ctx));
- 	gnutls_free(ctx);
-@@ -108,14 +111,15 @@ aes_gcm_cipher_setkey(void *_ctx, const void *key, size_t keysize)
- 	struct gcm_padlock_aes_ctx *ctx = _ctx;
- 
- 	if (keysize == 16) {
-		GCM_SET_KEY(ctx, padlock_aes128_set_encrypt_key, padlock_aes_encrypt,
-+		GCM_SET_KEY(&ctx->inner, padlock_aes128_set_encrypt_key, padlock_aes_encrypt,
- 			    key);
- 	} else if (keysize == 32) {
-		GCM_SET_KEY(ctx, padlock_aes256_set_encrypt_key, padlock_aes_encrypt,
-+		GCM_SET_KEY(&ctx->inner, padlock_aes256_set_encrypt_key, padlock_aes_encrypt,
- 			    key);
- 	} else
- 		return GNUTLS_E_INVALID_REQUEST;
- 
-+	ctx->rekey_counter = 0;
- 	return 0;
- }
- 
-@@ -126,8 +130,9 @@ static int aes_gcm_setiv(void *_ctx, const void *iv, size_t iv_size)
- 	if (iv_size != GCM_BLOCK_SIZE - 4)
- 		return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
- 
-	GCM_SET_IV(ctx, iv_size, iv);
-+	GCM_SET_IV(&ctx->inner, iv_size, iv);
- 
-+	ctx->rekey_counter = 0;
- 	return 0;
- }
- 
-@@ -136,11 +141,17 @@ aes_gcm_encrypt(void *_ctx, const void *src, size_t src_size,
- 		void *dst, size_t length)
- {
- 	struct gcm_padlock_aes_ctx *ctx = _ctx;
-+	int ret;
- 
- 	if (unlikely(length < src_size))
- 		return gnutls_assert_val(GNUTLS_E_SHORT_MEMORY_BUFFER);
- 
-	GCM_ENCRYPT(ctx, padlock_aes_encrypt, src_size, dst, src);
-+	ret = record_aes_gcm_encrypt_size(&ctx->rekey_counter, src_size);
-+	if (ret < 0) {
-+		return gnutls_assert_val(ret);
-+	}
-+
-+	GCM_ENCRYPT(&ctx->inner, padlock_aes_encrypt, src_size, dst, src);
- 
- 	return 0;
- }
-@@ -154,7 +165,7 @@ aes_gcm_decrypt(void *_ctx, const void *src, size_t src_size,
- 	if (unlikely(dst_size < src_size))
- 		return gnutls_assert_val(GNUTLS_E_SHORT_MEMORY_BUFFER);
- 
-	GCM_DECRYPT(ctx, padlock_aes_encrypt, src_size, dst, src);
-+	GCM_DECRYPT(&ctx->inner, padlock_aes_encrypt, src_size, dst, src);
- 	return 0;
- }
- 
-@@ -162,7 +173,7 @@ static int aes_gcm_auth(void *_ctx, const void *src, size_t src_size)
- {
- 	struct gcm_padlock_aes_ctx *ctx = _ctx;
- 
-	GCM_UPDATE(ctx, src_size, src);
-+	GCM_UPDATE(&ctx->inner, src_size, src);
- 
- 	return 0;
- }
-@@ -171,7 +182,7 @@ static void aes_gcm_tag(void *_ctx, void *tag, size_t tagsize)
- {
- 	struct gcm_padlock_aes_ctx *ctx = _ctx;
- 
-	GCM_DIGEST(ctx, padlock_aes_encrypt, tagsize, tag);
-+	GCM_DIGEST(&ctx->inner, padlock_aes_encrypt, tagsize, tag);
- }
- 
- #include "aes-gcm-aead.h"
-diff --git a/lib/accelerated/x86/aes-gcm-x86-aesni.c b/lib/accelerated/x86/aes-gcm-x86-aesni.c
-index b0edaebfba..3be63ddd97 100644
--- a/lib/accelerated/x86/aes-gcm-x86-aesni.c
-+++ b/lib/accelerated/x86/aes-gcm-x86-aesni.c
-@@ -36,12 +36,14 @@
- #include <x86-common.h>
- #include <byteswap.h>
- #include <nettle/gcm.h>
-#include <aes-x86.h>
- 
- /* GCM mode 
-  * It is used when the CPU doesn't include the PCLMUL instructions.
-  */
-struct gcm_x86_aes_ctx GCM_CTX(AES_KEY);
-+struct gcm_x86_aes_ctx {
-+	struct GCM_CTX(AES_KEY) inner;
-+	size_t rekey_counter;
-+};
- 
- static void x86_aes_encrypt(const void *_ctx,
- 				size_t length, uint8_t * dst,
-@@ -101,17 +103,18 @@ aes_gcm_cipher_setkey(void *_ctx, const void *key, size_t length)
- 	struct gcm_x86_aes_ctx *ctx = _ctx;
- 
- 	if (length == 16) {
-		GCM_SET_KEY(ctx, x86_aes128_set_encrypt_key, x86_aes_encrypt,
-+		GCM_SET_KEY(&ctx->inner, x86_aes128_set_encrypt_key, x86_aes_encrypt,
- 			    key);
- 	} else if (length == 24) {
-		GCM_SET_KEY(ctx, x86_aes192_set_encrypt_key, x86_aes_encrypt,
-+		GCM_SET_KEY(&ctx->inner, x86_aes192_set_encrypt_key, x86_aes_encrypt,
- 			    key);
- 	} else if (length == 32) {
-		GCM_SET_KEY(ctx, x86_aes256_set_encrypt_key, x86_aes_encrypt,
-+		GCM_SET_KEY(&ctx->inner, x86_aes256_set_encrypt_key, x86_aes_encrypt,
- 			    key);
- 	} else
- 		return GNUTLS_E_INVALID_REQUEST;
- 
-+	ctx->rekey_counter = 0;
- 	return 0;
- }
- 
-@@ -122,8 +125,9 @@ static int aes_gcm_setiv(void *_ctx, const void *iv, size_t iv_size)
- 	if (iv_size != GCM_BLOCK_SIZE - 4)
- 		return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
- 
-	GCM_SET_IV(ctx, iv_size, iv);
-+	GCM_SET_IV(&ctx->inner, iv_size, iv);
- 
-+	ctx->rekey_counter = 0;
- 	return 0;
- }
- 
-@@ -132,11 +136,17 @@ aes_gcm_encrypt(void *_ctx, const void *src, size_t src_size,
- 		void *dst, size_t length)
- {
- 	struct gcm_x86_aes_ctx *ctx = _ctx;
-+	int ret;
- 
- 	if (unlikely(length < src_size))
- 		return gnutls_assert_val(GNUTLS_E_SHORT_MEMORY_BUFFER);
- 
-	GCM_ENCRYPT(ctx, x86_aes_encrypt, src_size, dst, src);
-+	ret = record_aes_gcm_encrypt_size(&ctx->rekey_counter, src_size);
-+	if (ret < 0) {
-+		return gnutls_assert_val(ret);
-+	}
-+
-+	GCM_ENCRYPT(&ctx->inner, x86_aes_encrypt, src_size, dst, src);
- 
- 	return 0;
- }
-@@ -150,7 +160,7 @@ aes_gcm_decrypt(void *_ctx, const void *src, size_t src_size,
- 	if (unlikely(dst_size < src_size))
- 		return gnutls_assert_val(GNUTLS_E_SHORT_MEMORY_BUFFER);
- 
-	GCM_DECRYPT(ctx, x86_aes_encrypt, src_size, dst, src);
-+	GCM_DECRYPT(&ctx->inner, x86_aes_encrypt, src_size, dst, src);
- 	return 0;
- }
- 
-@@ -158,7 +168,7 @@ static int aes_gcm_auth(void *_ctx, const void *src, size_t src_size)
- {
- 	struct gcm_x86_aes_ctx *ctx = _ctx;
- 
-	GCM_UPDATE(ctx, src_size, src);
-+	GCM_UPDATE(&ctx->inner, src_size, src);
- 
- 	return 0;
- }
-@@ -167,7 +177,7 @@ static void aes_gcm_tag(void *_ctx, void *tag, size_t tagsize)
- {
- 	struct gcm_x86_aes_ctx *ctx = _ctx;
- 
-	GCM_DIGEST(ctx, x86_aes_encrypt, tagsize, tag);
-+	GCM_DIGEST(&ctx->inner, x86_aes_encrypt, tagsize, tag);
- }
- 
- static void aes_gcm_deinit(void *_ctx)
-diff --git a/lib/accelerated/x86/aes-gcm-x86-pclmul-avx.c b/lib/accelerated/x86/aes-gcm-x86-pclmul-avx.c
-index 21aef94440..fbefe432f4 100644
--- a/lib/accelerated/x86/aes-gcm-x86-pclmul-avx.c
-+++ b/lib/accelerated/x86/aes-gcm-x86-pclmul-avx.c
-@@ -61,6 +61,7 @@ struct aes_gcm_ctx {
- 	struct gcm128_context gcm;
- 	unsigned finished;
- 	unsigned auth_finished;
-+	size_t rekey_counter;
- };
- 
- void gcm_init_avx(u128 Htable[16], const uint64_t Xi[2]);
-@@ -116,6 +117,7 @@ aes_gcm_cipher_setkey(void *_ctx, const void *userkey, size_t keysize)
- 
- 	gcm_init_avx(ctx->gcm.Htable, ctx->gcm.H.u);
- 
-+	ctx->rekey_counter = 0;
- 	return 0;
- }
- 
-@@ -140,6 +142,7 @@ static int aes_gcm_setiv(void *_ctx, const void *iv, size_t iv_size)
- 	ctx->gcm.Yi.c[GCM_BLOCK_SIZE - 1] = 2;
- 	ctx->finished = 0;
- 	ctx->auth_finished = 0;
-+	ctx->rekey_counter = 0;
- 	return 0;
- }
- 
-@@ -184,6 +187,7 @@ aes_gcm_encrypt(void *_ctx, const void *src, size_t src_size,
- 	int exp_blocks = blocks * GCM_BLOCK_SIZE;
- 	int rest = src_size - (exp_blocks);
- 	uint32_t counter;
-+	int ret;
- 
- 	if (unlikely(ctx->finished))
- 		return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
-@@ -191,6 +195,11 @@ aes_gcm_encrypt(void *_ctx, const void *src, size_t src_size,
- 	if (unlikely(length < src_size))
- 		return gnutls_assert_val(GNUTLS_E_SHORT_MEMORY_BUFFER);
- 
-+	ret = record_aes_gcm_encrypt_size(&ctx->rekey_counter, src_size);
-+	if (ret < 0) {
-+		return gnutls_assert_val(ret);
-+	}
-+
- 	if (blocks > 0) {
- 		aesni_ctr32_encrypt_blocks(src, dst,
- 					   blocks,
-diff --git a/lib/accelerated/x86/aes-gcm-x86-pclmul.c b/lib/accelerated/x86/aes-gcm-x86-pclmul.c
-index e6b4990cbf..5385acbb6b 100644
--- a/lib/accelerated/x86/aes-gcm-x86-pclmul.c
-+++ b/lib/accelerated/x86/aes-gcm-x86-pclmul.c
-@@ -60,6 +60,7 @@ struct aes_gcm_ctx {
- 	struct gcm128_context gcm;
- 	unsigned finished;
- 	unsigned auth_finished;
-+	size_t rekey_counter;
- };
- 
- void gcm_init_clmul(u128 Htable[16], const uint64_t Xi[2]);
-@@ -116,6 +117,7 @@ aes_gcm_cipher_setkey(void *_ctx, const void *userkey, size_t keysize)
- 
- 	gcm_init_clmul(ctx->gcm.Htable, ctx->gcm.H.u);
- 
-+	ctx->rekey_counter = 0;
- 	return 0;
- }
- 
-@@ -140,6 +142,7 @@ static int aes_gcm_setiv(void *_ctx, const void *iv, size_t iv_size)
- 	ctx->gcm.Yi.c[GCM_BLOCK_SIZE - 1] = 2;
- 	ctx->finished = 0;
- 	ctx->auth_finished = 0;
-+	ctx->rekey_counter = 0;
- 	return 0;
- }
- 
-@@ -184,6 +187,7 @@ aes_gcm_encrypt(void *_ctx, const void *src, size_t src_size,
- 	int exp_blocks = blocks * GCM_BLOCK_SIZE;
- 	int rest = src_size - (exp_blocks);
- 	uint32_t counter;
-+	int ret;
- 
- 	if (unlikely(ctx->finished))
- 		return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
-@@ -191,6 +195,11 @@ aes_gcm_encrypt(void *_ctx, const void *src, size_t src_size,
- 	if (unlikely(length < src_size))
- 		return gnutls_assert_val(GNUTLS_E_SHORT_MEMORY_BUFFER);
- 
-+	ret = record_aes_gcm_encrypt_size(&ctx->rekey_counter, src_size);
-+	if (ret < 0) {
-+		return gnutls_assert_val(ret);
-+	}
-+
- 	if (blocks > 0) {
- 		aesni_ctr32_encrypt_blocks(src, dst,
- 					   blocks,
-diff --git a/lib/accelerated/x86/aes-gcm-x86-ssse3.c b/lib/accelerated/x86/aes-gcm-x86-ssse3.c
-index 7a2ac50869..f074cb1096 100644
--- a/lib/accelerated/x86/aes-gcm-x86-ssse3.c
-+++ b/lib/accelerated/x86/aes-gcm-x86-ssse3.c
-@@ -36,13 +36,15 @@
- #include <x86-common.h>
- #include <byteswap.h>
- #include <nettle/gcm.h>
-#include <aes-x86.h>
- #include <assert.h>
- 
- /* GCM mode 
-  * It is used when the CPU doesn't include the PCLMUL instructions.
-  */
-struct gcm_x86_aes_ctx GCM_CTX(AES_KEY);
-+struct gcm_x86_aes_ctx {
-+	struct GCM_CTX(AES_KEY) inner;
-+	size_t rekey_counter;
-+};
- 
- static void x86_aes_encrypt(const void *_ctx,
- 				size_t length, uint8_t * dst,
-@@ -110,17 +112,18 @@ aes_gcm_cipher_setkey(void *_ctx, const void *key, size_t keysize)
- 	struct gcm_x86_aes_ctx *ctx = _ctx;
- 
- 	if (keysize == 16) {
-		GCM_SET_KEY(ctx, x86_aes_128_set_encrypt_key, x86_aes_encrypt,
-+		GCM_SET_KEY(&ctx->inner, x86_aes_128_set_encrypt_key, x86_aes_encrypt,
- 			    key);
- 	} else if (keysize == 24) {
-		GCM_SET_KEY(ctx, x86_aes_192_set_encrypt_key, x86_aes_encrypt,
-+		GCM_SET_KEY(&ctx->inner, x86_aes_192_set_encrypt_key, x86_aes_encrypt,
- 			    key);
- 	} else if (keysize == 32) {
-		GCM_SET_KEY(ctx, x86_aes_256_set_encrypt_key, x86_aes_encrypt,
-+		GCM_SET_KEY(&ctx->inner, x86_aes_256_set_encrypt_key, x86_aes_encrypt,
- 			    key);
- 	} else
- 		return GNUTLS_E_INVALID_REQUEST;
- 
-+	ctx->rekey_counter = 0;
- 	return 0;
- }
- 
-@@ -131,8 +134,9 @@ static int aes_gcm_setiv(void *_ctx, const void *iv, size_t iv_size)
- 	if (iv_size != GCM_BLOCK_SIZE - 4)
- 		return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
- 
-	GCM_SET_IV(ctx, iv_size, iv);
-+	GCM_SET_IV(&ctx->inner, iv_size, iv);
- 
-+	ctx->rekey_counter = 0;
- 	return 0;
- }
- 
-@@ -141,11 +145,17 @@ aes_gcm_encrypt(void *_ctx, const void *src, size_t src_size,
- 		void *dst, size_t length)
- {
- 	struct gcm_x86_aes_ctx *ctx = _ctx;
-+	int ret;
- 
- 	if (unlikely(length < src_size))
- 		return gnutls_assert_val(GNUTLS_E_SHORT_MEMORY_BUFFER);
- 
-	GCM_ENCRYPT(ctx, x86_aes_encrypt, src_size, dst, src);
-+	ret = record_aes_gcm_encrypt_size(&ctx->rekey_counter, src_size);
-+	if (ret < 0) {
-+		return gnutls_assert_val(ret);
-+	}
-+
-+	GCM_ENCRYPT(&ctx->inner, x86_aes_encrypt, src_size, dst, src);
- 
- 	return 0;
- }
-@@ -159,7 +169,7 @@ aes_gcm_decrypt(void *_ctx, const void *src, size_t src_size,
- 	if (unlikely(dst_size < src_size))
- 		return gnutls_assert_val(GNUTLS_E_SHORT_MEMORY_BUFFER);
- 
-	GCM_DECRYPT(ctx, x86_aes_encrypt, src_size, dst, src);
-+	GCM_DECRYPT(&ctx->inner, x86_aes_encrypt, src_size, dst, src);
- 	return 0;
- }
- 
-@@ -167,7 +177,7 @@ static int aes_gcm_auth(void *_ctx, const void *src, size_t src_size)
- {
- 	struct gcm_x86_aes_ctx *ctx = _ctx;
- 
-	GCM_UPDATE(ctx, src_size, src);
-+	GCM_UPDATE(&ctx->inner, src_size, src);
- 
- 	return 0;
- }
-@@ -176,7 +186,7 @@ static void aes_gcm_tag(void *_ctx, void *tag, size_t tagsize)
- {
- 	struct gcm_x86_aes_ctx *ctx = _ctx;
- 
-	GCM_DIGEST(ctx, x86_aes_encrypt, tagsize, tag);
-+	GCM_DIGEST(&ctx->inner, x86_aes_encrypt, tagsize, tag);
- }
- 
- static void aes_gcm_deinit(void *_ctx)
-diff --git a/lib/accelerated/x86/aes-x86.h b/lib/accelerated/x86/aes-x86.h
-index 023b5f7be6..349d3d5d9c 100644
--- a/lib/accelerated/x86/aes-x86.h
-+++ b/lib/accelerated/x86/aes-x86.h
-@@ -22,6 +22,21 @@ typedef struct {
- 	if (s != 16 && s != 24 && s != 32) \
- 		return GNUTLS_E_INVALID_REQUEST
- 
-+#include <intprops.h>
-+#define AES_GCM_ENCRYPT_MAX_BYTES ((1ULL << 36) - 32)
-+static inline int
-+record_aes_gcm_encrypt_size(size_t *counter, size_t size) {
-+	size_t sum;
-+
-+	if (!INT_ADD_OK(*counter, size, &sum) ||
-+	    sum > AES_GCM_ENCRYPT_MAX_BYTES) {
-+		return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
-+	}
-+	*counter = sum;
-+
-+	return 0;
-+}
-+
- void aesni_ecb_encrypt(const unsigned char *in, unsigned char *out,
- 		       size_t len, const AES_KEY * key, int enc);
- 
-diff --git a/lib/nettle/cipher.c b/lib/nettle/cipher.c
-index ab4c46d2d0..b41862d1ea 100644
--- a/lib/nettle/cipher.c
-+++ b/lib/nettle/cipher.c
-@@ -63,6 +63,7 @@
- #include <nettle/xts.h>
- #include <nettle/siv-cmac.h>
- #include <fips.h>
-+#include <intprops.h>
- 
- struct nettle_cipher_ctx;
- 
-@@ -120,8 +121,23 @@ struct nettle_cipher_ctx {
- 	unsigned iv_size;
- 
- 	bool enc;
-+	size_t rekey_counter;
- };
- 
-+#define AES_GCM_ENCRYPT_MAX_BYTES ((1ULL << 36) - 32)
-+static inline int
-+record_aes_gcm_encrypt_size(size_t *counter, size_t size) {
-+	size_t sum;
-+
-+	if (!INT_ADD_OK(*counter, size, &sum) ||
-+	    sum > AES_GCM_ENCRYPT_MAX_BYTES) {
-+		return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
-+	}
-+	*counter = sum;
-+
-+	return 0;
-+}
-+
- static void
- _stream_encrypt(struct nettle_cipher_ctx *ctx, size_t length, uint8_t * dst,
- 		const uint8_t * src)
-@@ -1133,6 +1149,16 @@ wrap_nettle_cipher_setkey(void *_ctx, const void *key, size_t keysize)
- 	else
- 		ctx->cipher->set_decrypt_key(ctx->ctx_ptr, key);
- 
-+	switch (ctx->cipher->algo) {
-+	case GNUTLS_CIPHER_AES_128_GCM:
-+	case GNUTLS_CIPHER_AES_192_GCM:
-+	case GNUTLS_CIPHER_AES_256_GCM:
-+		ctx->rekey_counter = 0;
-+		break;
-+	default:
-+		break;
-+	}
-+
- 	return 0;
- }
- 
-@@ -1147,6 +1173,7 @@ wrap_nettle_cipher_setiv(void *_ctx, const void *iv, size_t iv_size)
- 	case GNUTLS_CIPHER_AES_192_GCM:
- 	case GNUTLS_CIPHER_AES_256_GCM:
- 		FIPS_RULE(iv_size < GCM_IV_SIZE, GNUTLS_E_INVALID_REQUEST, "access to short GCM nonce size\n");
-+		ctx->rekey_counter = 0;
- 		break;
- 	case GNUTLS_CIPHER_SALSA20_256:
- 	case GNUTLS_CIPHER_ESTREAM_SALSA20_256:
-@@ -1207,10 +1234,24 @@ wrap_nettle_cipher_encrypt(void *_ctx, const void *plain, size_t plain_size,
- 			   void *encr, size_t encr_size)
- {
- 	struct nettle_cipher_ctx *ctx = _ctx;
-+	int ret;
- 
- 	if (unlikely(ctx->cipher->encrypt == NULL))
- 		return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
- 
-+	switch (ctx->cipher->algo) {
-+	case GNUTLS_CIPHER_AES_128_GCM:
-+	case GNUTLS_CIPHER_AES_192_GCM:
-+	case GNUTLS_CIPHER_AES_256_GCM:
-+		ret = record_aes_gcm_encrypt_size(&ctx->rekey_counter, plain_size);
-+		if (ret < 0) {
-+			return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
-+		}
-+		break;
-+	default:
-+		break;
-+	}
-+
- 	ctx->cipher->encrypt(ctx, plain_size, encr, plain);
- 
- 	return 0;
-diff --git a/tests/slow/cipher-api-test.c b/tests/slow/cipher-api-test.c
-index fc880bcc9f..1d267ce312 100644
--- a/tests/slow/cipher-api-test.c
-+++ b/tests/slow/cipher-api-test.c
-@@ -21,6 +21,7 @@
-  */
- 
- #include <config.h>
-+#include <limits.h>
- #include <stdint.h>
- #include <stdio.h>
- #include <string.h>
-@@ -48,6 +49,11 @@ int main(int argc, char **argv)
- #include <assert.h>
- #include <utils.h>
- 
-+#define AES_GCM_ENCRYPT_PLAINTEXT_MAX ((1ULL << 36) - 32)
-+#if SIZE_MAX >= AES_GCM_ENCRYPT_PLAINTEXT_MAX
-+#define TEST_AES_GCM_ENCRYPT_PLAINTEXT_SIZE 1
-+#endif
-+
- static void tls_log_func(int level, const char *str)
- {
- 	fprintf(stderr, "<%d>| %s", level, str);
-@@ -401,6 +407,74 @@ static void test_aead_invalid_short_decrypt(int algo)
- 	return;
- }
- 
-+#ifdef TEST_AES_GCM_ENCRYPT_PLAINTEXT_SIZE
-+/* Test whether an invalid call to gnutls_cipher_encrypt() with too
-+ * long message is caught */
-+static void test_aead_invalid_too_long_encrypt(int algo)
-+{
-+	int ret;
-+	gnutls_cipher_hd_t ch;
-+	uint8_t key16[64];
-+	uint8_t iv16[32];
-+	uint8_t data[128];
-+	gnutls_datum_t key, iv;
-+
-+	if (algo != GNUTLS_CIPHER_AES_128_GCM &&
-+	    algo != GNUTLS_CIPHER_AES_192_GCM &&
-+	    algo != GNUTLS_CIPHER_AES_256_GCM) {
-+		return;
-+	}
-+
-+	key.data = key16;
-+	key.size = gnutls_cipher_get_key_size(algo);
-+	assert(key.size <= sizeof(key16));
-+
-+	iv.data = iv16;
-+	iv.size = gnutls_cipher_get_iv_size(algo);
-+	assert(iv.size <= sizeof(iv16));
-+
-+	memset(iv.data, 0xff, iv.size);
-+	memset(key.data, 0xfe, key.size);
-+	memset(data, 0xfa, sizeof(data));
-+
-+	gnutls_global_set_log_function(tls_log_func);
-+	if (debug)
-+		gnutls_global_set_log_level(4711);
-+
-+	ret = global_init();
-+	if (ret < 0) {
-+		fail("Cannot initialize library\n"); /*errcode 1 */
-+	}
-+
-+	ret = gnutls_cipher_init(&ch, algo, &key, &iv);
-+	if (ret < 0)
-+		fail("gnutls_cipher_init failed\n"); /*errcode 1 */
-+
-+	/* Test exceeding AES-GCM plaintext limit */
-+	ret = gnutls_cipher_encrypt(ch, data, sizeof(data));
-+	if (ret < 0)
-+		fail("could not encrypt data\n");
-+
-+	/* A few blocks larger than AES_GCM_ENCRYPT_PLAINTEXT_MAX combined with
-+	 * the previous call.  Use NULL for PLAINTEXT so the access to the first
-+	 * block always results in page fault (in case the limit is not
-+	 * enforced).
-+	 */
-+	ret = gnutls_cipher_encrypt(ch, NULL, AES_GCM_ENCRYPT_PLAINTEXT_MAX);
-+	if (ret >= 0)
-+		fail("succeeded in encrypting too long data\n");
-+	if (ret != GNUTLS_E_INVALID_REQUEST)
-+		fail("wrong kind of error on encrypting too long data,"
-+		     "%s instead of GNUTLS_E_INVALID_REQUEST\n",
-+		     gnutls_strerror_name(ret));
-+
-+	gnutls_cipher_deinit(ch);
-+
-+	gnutls_global_deinit();
-+	return;
-+}
-+#endif
-+
- static void check_status(int status)
- {
- 	if (WEXITSTATUS(status) != 0 ||
-@@ -464,6 +538,11 @@ void start(const char *name, int algo, unsigned aead)
- 
- 		success("trying %s: test_aead_invalid_short_decrypt\n", name);
- 		fork_subtest(test_aead_invalid_short_decrypt, algo);
-+
-+#if TEST_AES_GCM_ENCRYPT_PLAINTEXT_SIZE
-+		success("trying %s: test_aead_invalid_too_long_encrypt\n", name);
-+		fork_subtest(test_aead_invalid_too_long_encrypt, algo);
-+#endif
- 	}
- }
- 
-- 
-2.37.1
-
--- a/SOURCES/gnutls-3.7.6-ca-xsigned.patch
+++ b/SOURCES/gnutls-3.7.6-ca-xsigned.patch
@ -1,183 +0,0 @@
-From 2e5f198d9440e508be13cdbad6e3f3ab47898037 Mon Sep 17 00:00:00 2001
-From: Daiki Ueno <ueno@gnu.org>
-Date: Thu, 11 Jan 2024 15:45:11 +0900
-Subject: [PATCH] x509: detect loop in certificate chain
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-There can be a loop in a certificate chain, when multiple CA
-certificates are cross-signed with each other, such as A → B, B → C,
-and C → A.  Previously, the verification logic was not capable of
-handling this scenario while sorting the certificates in the chain in
-_gnutls_sort_clist, resulting in an assertion failure.  This patch
-properly detects such loop and aborts further processing in a graceful
-manner.
-
-Signed-off-by: Daiki Ueno <ueno@gnu.org>
---
- lib/x509/common.c   |   4 ++
- tests/test-chains.h | 125 ++++++++++++++++++++++++++++++++++++++++++++
- 2 files changed, 129 insertions(+)
-
-diff --git a/lib/x509/common.c b/lib/x509/common.c
-index ca0b71cb69..1a022f91af 100644
--- a/lib/x509/common.c
-+++ b/lib/x509/common.c
-@@ -1796,6 +1796,10 @@ unsigned int _gnutls_sort_clist(gnutls_x509_crt_t *clist,
- 			break;
- 		}
- 
-+		if (insorted[prev]) { /* loop detected */
-+			break;
-+		}
-+
- 		sorted[i] = clist[prev];
- 		insorted[prev] = 1;
- 	}
-diff --git a/tests/test-chains.h b/tests/test-chains.h
-index dd7ccf0e40..09a5461ebf 100644
--- a/tests/test-chains.h
-+++ b/tests/test-chains.h
-@@ -4263,6 +4263,129 @@ static const char *rsa_sha1_not_in_trusted_ca[] = {
- 	NULL
- };
- 
-+static const char *cross_signed[] = {
-+	/* server (signed by A1) */
-+	"-----BEGIN CERTIFICATE-----\n"
-+	"MIIBqDCCAVqgAwIBAgIUejlil+8DBffazcnMNwyOOP6yCCowBQYDK2VwMBoxGDAW\n"
-+	"BgNVBAMTD0ludGVybWVkaWF0ZSBBMTAgFw0yNDAxMTEwNjI3MjJaGA85OTk5MTIz\n"
-+	"MTIzNTk1OVowNzEbMBkGA1UEChMSR251VExTIHRlc3Qgc2VydmVyMRgwFgYDVQQD\n"
-+	"Ew90ZXN0LmdudXRscy5vcmcwKjAFBgMrZXADIQA1ZVS0PcNeTPQMZ+FuVz82AHrj\n"
-+	"qL5hWEpCDgpG4M4fxaOBkjCBjzAMBgNVHRMBAf8EAjAAMBoGA1UdEQQTMBGCD3Rl\n"
-+	"c3QuZ251dGxzLm9yZzATBgNVHSUEDDAKBggrBgEFBQcDATAOBgNVHQ8BAf8EBAMC\n"
-+	"B4AwHQYDVR0OBBYEFGtEUv+JSt+zPoO3lu0IiObZVoiNMB8GA1UdIwQYMBaAFPnY\n"
-+	"v6Pw0IvKSqIlb6ewHyEAmTA3MAUGAytlcANBAAS2lyc87kH/aOvNKzPjqDwUYxPA\n"
-+	"CfYjyaKea2d0DZLBM5+Bjnj/4aWwTKgVTJzWhLJcLtaSdVHrXqjr9NhEhQ0=\n"
-+	"-----END CERTIFICATE-----\n",
-+	/* A1 (signed by A) */
-+	"-----BEGIN CERTIFICATE-----\n"
-+	"MIIBUjCCAQSgAwIBAgIUe/R+NVp04e74ySw2qgI6KZgFR20wBQYDK2VwMBExDzAN\n"
-+	"BgNVBAMTBlJvb3QgQTAgFw0yNDAxMTEwNjI1MDFaGA85OTk5MTIzMTIzNTk1OVow\n"
-+	"GjEYMBYGA1UEAxMPSW50ZXJtZWRpYXRlIEExMCowBQYDK2VwAyEAlkTNqwz973sy\n"
-+	"u3whMjSiUMs77CZu5YA7Gi5KcakExrKjYzBhMA8GA1UdEwEB/wQFMAMBAf8wDgYD\n"
-+	"VR0PAQH/BAQDAgIEMB0GA1UdDgQWBBT52L+j8NCLykqiJW+nsB8hAJkwNzAfBgNV\n"
-+	"HSMEGDAWgBRbYgOkRGsd3Z74+CauX4htzLg0lzAFBgMrZXADQQBM0NBaFVPd3cTJ\n"
-+	"DSaZNT34fsHuJk4eagpn8mBxKQpghq4s8Ap+nYtp2KiXjcizss53PeLXVnkfyLi0\n"
-+	"TLVBHvUJ\n"
-+	"-----END CERTIFICATE-----\n",
-+	/* A (signed by B) */
-+	"-----BEGIN CERTIFICATE-----\n"
-+	"MIIBSDCB+6ADAgECAhQtdJpg+qlPcLoRW8iiztJUD4xNvDAFBgMrZXAwETEPMA0G\n"
-+	"A1UEAxMGUm9vdCBCMCAXDTI0MDExMTA2MTk1OVoYDzk5OTkxMjMxMjM1OTU5WjAR\n"
-+	"MQ8wDQYDVQQDEwZSb290IEEwKjAFBgMrZXADIQA0vDYyg3tgotSETL1Wq2hBs32p\n"
-+	"WbnINkmOSNmOiZlGHKNjMGEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMC\n"
-+	"AgQwHQYDVR0OBBYEFFtiA6REax3dnvj4Jq5fiG3MuDSXMB8GA1UdIwQYMBaAFJFA\n"
-+	"s2rg6j8w9AKItRnOOOjG2FG6MAUGAytlcANBAPv674p9ek5GjRcRfVQhgN+kQlHU\n"
-+	"u774wL3Vx3fWA1E7+WchdMzcHrPoa5OKtKmxjIKUTO4SeDZL/AVpvulrWwk=\n"
-+	"-----END CERTIFICATE-----\n",
-+	/* A (signed by C) */
-+	"-----BEGIN CERTIFICATE-----\n"
-+	"MIIBSDCB+6ADAgECAhReNpCiVn7eFDUox3mvM5qE942AVzAFBgMrZXAwETEPMA0G\n"
-+	"A1UEAxMGUm9vdCBDMCAXDTI0MDExMTA2MjEyMVoYDzk5OTkxMjMxMjM1OTU5WjAR\n"
-+	"MQ8wDQYDVQQDEwZSb290IEIwKjAFBgMrZXADIQAYX92hS97OGKbMzwrD7ReVifwM\n"
-+	"3iz5tnfQHWQSkvvYMKNjMGEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMC\n"
-+	"AgQwHQYDVR0OBBYEFJFAs2rg6j8w9AKItRnOOOjG2FG6MB8GA1UdIwQYMBaAFEh/\n"
-+	"XKjIuMeEavX5QVoy39Q+GhnwMAUGAytlcANBAIwghH3gelXty8qtoTGIEJb0+EBv\n"
-+	"BH4YOUh7TamxjxkjvvIhDA7ZdheofFb7NrklJco7KBcTATUSOvxakYRP9Q8=\n"
-+	"-----END CERTIFICATE-----\n",
-+	/* B1 (signed by B) */
-+	"-----BEGIN CERTIFICATE-----\n"
-+	"MIIBUjCCAQSgAwIBAgIUfpmrVDc1XBA5/7QYMyGBuB9mTtUwBQYDK2VwMBExDzAN\n"
-+	"BgNVBAMTBlJvb3QgQjAgFw0yNDAxMTEwNjI1MjdaGA85OTk5MTIzMTIzNTk1OVow\n"
-+	"GjEYMBYGA1UEAxMPSW50ZXJtZWRpYXRlIEIxMCowBQYDK2VwAyEAh6ZTuJWsweVB\n"
-+	"a5fsye5iq89kWDC2Y/Hlc0htLmjzMP+jYzBhMA8GA1UdEwEB/wQFMAMBAf8wDgYD\n"
-+	"VR0PAQH/BAQDAgIEMB0GA1UdDgQWBBTMQu37PKyLjKfPODZgxYCaayff+jAfBgNV\n"
-+	"HSMEGDAWgBSRQLNq4Oo/MPQCiLUZzjjoxthRujAFBgMrZXADQQBblmguY+lnYvOK\n"
-+	"rAZJnqpEUGfm1tIFyu3rnlE7WOVcXRXMIoNApLH2iHIipQjlvNWuSBFBTC1qdewh\n"
-+	"/e+0cgQB\n"
-+	"-----END CERTIFICATE-----\n",
-+	/* B (signed by A) */
-+	"-----BEGIN CERTIFICATE-----\n"
-+	"MIIBSDCB+6ADAgECAhRpEm+dWNX6DMZh/nottkFfFFrXXDAFBgMrZXAwETEPMA0G\n"
-+	"A1UEAxMGUm9vdCBBMCAXDTI0MDExMTA2MTcyNloYDzk5OTkxMjMxMjM1OTU5WjAR\n"
-+	"MQ8wDQYDVQQDEwZSb290IEIwKjAFBgMrZXADIQAYX92hS97OGKbMzwrD7ReVifwM\n"
-+	"3iz5tnfQHWQSkvvYMKNjMGEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMC\n"
-+	"AgQwHQYDVR0OBBYEFJFAs2rg6j8w9AKItRnOOOjG2FG6MB8GA1UdIwQYMBaAFFti\n"
-+	"A6REax3dnvj4Jq5fiG3MuDSXMAUGAytlcANBAFvmcK3Ida5ViVYDzxKVLPcPsCHe\n"
-+	"3hxz99lBrerJC9iJSvRYTJoPBvjTxDYnBn5EFrQYMrUED+6i71lmGXNU9gs=\n"
-+	"-----END CERTIFICATE-----\n",
-+	/* B (signed by C) */
-+	"-----BEGIN CERTIFICATE-----\n"
-+	"MIIBSDCB+6ADAgECAhReNpCiVn7eFDUox3mvM5qE942AVzAFBgMrZXAwETEPMA0G\n"
-+	"A1UEAxMGUm9vdCBDMCAXDTI0MDExMTA2MjEyMVoYDzk5OTkxMjMxMjM1OTU5WjAR\n"
-+	"MQ8wDQYDVQQDEwZSb290IEIwKjAFBgMrZXADIQAYX92hS97OGKbMzwrD7ReVifwM\n"
-+	"3iz5tnfQHWQSkvvYMKNjMGEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMC\n"
-+	"AgQwHQYDVR0OBBYEFJFAs2rg6j8w9AKItRnOOOjG2FG6MB8GA1UdIwQYMBaAFEh/\n"
-+	"XKjIuMeEavX5QVoy39Q+GhnwMAUGAytlcANBAIwghH3gelXty8qtoTGIEJb0+EBv\n"
-+	"BH4YOUh7TamxjxkjvvIhDA7ZdheofFb7NrklJco7KBcTATUSOvxakYRP9Q8=\n"
-+	"-----END CERTIFICATE-----\n",
-+	/* C1 (signed by C) */
-+	"-----BEGIN CERTIFICATE-----\n"
-+	"MIIBUjCCAQSgAwIBAgIUSKsfY1wD3eD2VmaaK1wt5naPckMwBQYDK2VwMBExDzAN\n"
-+	"BgNVBAMTBlJvb3QgQzAgFw0yNDAxMTEwNjI1NDdaGA85OTk5MTIzMTIzNTk1OVow\n"
-+	"GjEYMBYGA1UEAxMPSW50ZXJtZWRpYXRlIEMxMCowBQYDK2VwAyEA/t7i1chZlKkV\n"
-+	"qxJOrmmyATn8XnpK+nV/iT4OMHSHfAyjYzBhMA8GA1UdEwEB/wQFMAMBAf8wDgYD\n"
-+	"VR0PAQH/BAQDAgIEMB0GA1UdDgQWBBRmpF3JjoP3NiBzE5J5ANT0bvfRmjAfBgNV\n"
-+	"HSMEGDAWgBRIf1yoyLjHhGr1+UFaMt/UPhoZ8DAFBgMrZXADQQAeRBXv6WCTOp0G\n"
-+	"3wgd8bbEGrrILfpi+qH7aj/MywgkPIlppDYRQ3jL6ASd+So/408dlE0DV9DXKBi0\n"
-+	"725XUUYO\n"
-+	"-----END CERTIFICATE-----\n",
-+	/* C (signed by A) */
-+	"-----BEGIN CERTIFICATE-----\n"
-+	"MIIBSDCB+6ADAgECAhRvbZv3SRTjDOiAbyFWHH4y0yMZkjAFBgMrZXAwETEPMA0G\n"
-+	"A1UEAxMGUm9vdCBBMCAXDTI0MDExMTA2MTg1MVoYDzk5OTkxMjMxMjM1OTU5WjAR\n"
-+	"MQ8wDQYDVQQDEwZSb290IEMwKjAFBgMrZXADIQDxm6Ubhsa0gSa1vBCIO5e+qZEH\n"
-+	"8Oocz+buNHfIJbh5NaNjMGEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMC\n"
-+	"AgQwHQYDVR0OBBYEFEh/XKjIuMeEavX5QVoy39Q+GhnwMB8GA1UdIwQYMBaAFFti\n"
-+	"A6REax3dnvj4Jq5fiG3MuDSXMAUGAytlcANBAPl+SyiOfXJnjSWx8hFMhJ7w92mn\n"
-+	"tkGifCFHBpUhYcBIMeMtLw0RBLXqaaN0EKlTFimiEkLClsU7DKYrpEEJegs=\n"
-+	"-----END CERTIFICATE-----\n",
-+	/* C (signed by B) */
-+	"-----BEGIN CERTIFICATE-----\n"
-+	"MIIBSDCB+6ADAgECAhQU1OJWRVOLrGrgJiLwexd1/MwKkTAFBgMrZXAwETEPMA0G\n"
-+	"A1UEAxMGUm9vdCBCMCAXDTI0MDExMTA2MjAzMFoYDzk5OTkxMjMxMjM1OTU5WjAR\n"
-+	"MQ8wDQYDVQQDEwZSb290IEMwKjAFBgMrZXADIQDxm6Ubhsa0gSa1vBCIO5e+qZEH\n"
-+	"8Oocz+buNHfIJbh5NaNjMGEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMC\n"
-+	"AgQwHQYDVR0OBBYEFEh/XKjIuMeEavX5QVoy39Q+GhnwMB8GA1UdIwQYMBaAFJFA\n"
-+	"s2rg6j8w9AKItRnOOOjG2FG6MAUGAytlcANBALXeyuj8vj6Q8j4l17VzZwmJl0gN\n"
-+	"bCGoKMl0J/0NiN/fQRIsdbwQDh0RUN/RN3I6DTtB20ER6f3VdnzAh8nXkQ4=\n"
-+	"-----END CERTIFICATE-----\n",
-+	NULL
-+};
-+
-+static const char *cross_signed_ca[] = {
-+	/* A (self-signed) */
-+	"-----BEGIN CERTIFICATE-----\n"
-+	"MIIBJzCB2qADAgECAhQs1Ur+gzPs1ISxs3Tbs700q0CZcjAFBgMrZXAwETEPMA0G\n"
-+	"A1UEAxMGUm9vdCBBMCAXDTI0MDExMTA2MTYwMFoYDzk5OTkxMjMxMjM1OTU5WjAR\n"
-+	"MQ8wDQYDVQQDEwZSb290IEEwKjAFBgMrZXADIQA0vDYyg3tgotSETL1Wq2hBs32p\n"
-+	"WbnINkmOSNmOiZlGHKNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMC\n"
-+	"AgQwHQYDVR0OBBYEFFtiA6REax3dnvj4Jq5fiG3MuDSXMAUGAytlcANBAHrVv7E9\n"
-+	"5scuOVCH9gNRRm8Z9SUoLakRHAPnySdg6z/kI3vOgA/OM7reArpnW8l1H2FapgpL\n"
-+	"bDeZ2XJH+BdVFwg=\n"
-+	"-----END CERTIFICATE-----\n",
-+	NULL
-+};
-+
- #if defined __clang__ || __GNUC__ > 4 || (__GNUC__ == 4 && __GNUC_MINOR__ >= 5)
- #  pragma GCC diagnostic push
- #  pragma GCC diagnostic ignored "-Wunused-variable"
-@@ -4442,6 +4565,8 @@ static struct
-     rsa_sha1_not_in_trusted, rsa_sha1_not_in_trusted_ca,
-     GNUTLS_PROFILE_TO_VFLAGS(GNUTLS_PROFILE_MEDIUM),
-     GNUTLS_CERT_INSECURE_ALGORITHM | GNUTLS_CERT_INVALID, NULL, 1620118136, 1},
-+  { "cross signed - ok", cross_signed, cross_signed_ca, 0, 0, 0,
-+    1704955300 },
-   { NULL, NULL, NULL, 0, 0}
- };
- 
-- 
-2.43.0
-
--- a/SOURCES/gnutls-3.7.6-cpuid-fixes.patch
+++ b/SOURCES/gnutls-3.7.6-cpuid-fixes.patch
@ -1,119 +0,0 @@
-From 8ff391fa011e02c88b0d099061ca62e88ab68011 Mon Sep 17 00:00:00 2001
-From: Daiki Ueno <ueno@gnu.org>
-Date: Mon, 15 Aug 2022 09:39:18 +0900
-Subject: [PATCH] accelerated: clear AVX bits if it cannot be queried through
- XSAVE
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-The algorithm to detect AVX is described in 14.3 of "Intel® 64 and IA-32
-Architectures Software Developer’s Manual".
-
-GnuTLS previously only followed that algorithm when registering the
-crypto backend, while the CRYPTOGAMS derived SHA code assembly expects
-that the extension bits are propagated to _gnutls_x86_cpuid_s.
-
-Signed-off-by: Daiki Ueno <ueno@gnu.org>
---
- lib/accelerated/x86/x86-common.c | 49 +++++++++++++++++++++++++-------
- 1 file changed, 38 insertions(+), 11 deletions(-)
-
-diff --git a/lib/accelerated/x86/x86-common.c b/lib/accelerated/x86/x86-common.c
-index 7ddaa594e6..b7a88ddeca 100644
--- a/lib/accelerated/x86/x86-common.c
-+++ b/lib/accelerated/x86/x86-common.c
-@@ -81,6 +81,26 @@ unsigned int _gnutls_x86_cpuid_s[4];
- # define bit_AVX 0x10000000
- #endif
- 
-+#ifndef bit_AVX2
-+# define bit_AVX2 0x00000020
-+#endif
-+
-+#ifndef bit_AVX512F
-+# define bit_AVX512F 0x00010000
-+#endif
-+
-+#ifndef bit_AVX512IFMA
-+# define bit_AVX512IFMA 0x00200000
-+#endif
-+
-+#ifndef bit_AVX512BW
-+# define bit_AVX512BW 0x40000000
-+#endif
-+
-+#ifndef bit_AVX512VL
-+# define bit_AVX512VL 0x80000000
-+#endif
-+
- #ifndef bit_OSXSAVE
- # define bit_OSXSAVE 0x8000000
- #endif
-@@ -89,10 +109,6 @@ unsigned int _gnutls_x86_cpuid_s[4];
- # define bit_MOVBE 0x00400000
- #endif
- 
-#ifndef OSXSAVE_MASK
-# define OSXSAVE_MASK (bit_OSXSAVE|bit_MOVBE)
-#endif
-
- #define bit_PADLOCK (0x3 << 6)
- #define bit_PADLOCK_PHE (0x3 << 10)
- #define bit_PADLOCK_PHE_SHA512 (0x3 << 25)
-@@ -148,7 +164,7 @@ static unsigned check_4th_gen_intel_features(unsigned ecx)
- {
- 	uint32_t xcr0;
- 
-	if ((ecx & OSXSAVE_MASK) != OSXSAVE_MASK)
-+	if ((ecx & bit_OSXSAVE) != bit_OSXSAVE)
- 		return 0;
- 
- #if defined(_MSC_VER) && !defined(__clang__)
-@@ -190,8 +206,9 @@ static void capabilities_to_intel_cpuid(unsigned capabilities)
- 	}
- 
- 	if (capabilities & INTEL_AVX) {
-		if ((a[1] & bit_AVX) && check_4th_gen_intel_features(a[1])) {
-			_gnutls_x86_cpuid_s[1] |= bit_AVX|OSXSAVE_MASK;
-+		if ((a[1] & bit_AVX) && (a[1] & bit_MOVBE) &&
-+		    check_4th_gen_intel_features(a[1])) {
-+			_gnutls_x86_cpuid_s[1] |= bit_AVX|bit_MOVBE;
- 		} else {
- 			_gnutls_debug_log
- 			    ("AVX acceleration requested but not available\n");
-@@ -236,10 +253,7 @@ static unsigned check_sha(void)
- #ifdef ASM_X86_64
- static unsigned check_avx_movbe(void)
- {
-	if (check_4th_gen_intel_features(_gnutls_x86_cpuid_s[1]) == 0)
-		return 0;
-
-	return ((_gnutls_x86_cpuid_s[1] & bit_AVX));
-+	return (_gnutls_x86_cpuid_s[1] & (bit_AVX|bit_MOVBE)) == (bit_AVX|bit_MOVBE);
- }
- 
- static unsigned check_pclmul(void)
-@@ -884,6 +898,19 @@ void register_x86_intel_crypto(unsigned capabilities)
- 	if (capabilities == 0) {
- 		if (!read_cpuid_vals(_gnutls_x86_cpuid_s))
- 			return;
-+		if (!check_4th_gen_intel_features(_gnutls_x86_cpuid_s[1])) {
-+			_gnutls_x86_cpuid_s[1] &= ~bit_AVX;
-+
-+			/* Clear AVX2 bits as well, according to what
-+			 * OpenSSL does.  Should we clear
-+			 * bit_AVX512DQ, bit_AVX512PF, bit_AVX512ER,
-+			 * and bit_AVX512CD? */
-+			_gnutls_x86_cpuid_s[2] &= ~(bit_AVX2|
-+						    bit_AVX512F|
-+						    bit_AVX512IFMA|
-+						    bit_AVX512BW|
-+						    bit_AVX512BW);
-+		}
- 	} else {
- 		capabilities_to_intel_cpuid(capabilities);
- 	}
-- 
-2.37.2
-
--- a/SOURCES/gnutls-3.7.6-drbg-reseed.patch
+++ b/SOURCES/gnutls-3.7.6-drbg-reseed.patch
@ -1,41 +0,0 @@
-From 3035e884b3abc68bcebff5adec5bd8819bbc6d7b Mon Sep 17 00:00:00 2001
-From: rpm-build <rpm-build>
-Date: Fri, 5 Aug 2022 16:16:42 +0900
-Subject: [PATCH] gnutls-3.7.6-drbg-reseed.patch
-
-Signed-off-by: rpm-build <rpm-build>
---
- lib/nettle/sysrng-linux.c | 10 +++++++++-
- 1 file changed, 9 insertions(+), 1 deletion(-)
-
-diff --git a/lib/nettle/sysrng-linux.c b/lib/nettle/sysrng-linux.c
-index 6b3971c..dae9061 100644
--- a/lib/nettle/sysrng-linux.c
-+++ b/lib/nettle/sysrng-linux.c
-@@ -31,6 +31,9 @@
- # include <num.h>
- # include <errno.h>
- # include <rnd-common.h>
-+# include "fips.h"
-+#else
-+# define _gnutls_fips_mode_enabled() 0
- #endif
- 
- #include <sys/types.h>
-@@ -103,7 +106,12 @@ static int force_getrandom(void *buf, size_t buflen, unsigned int flags)
- static int _rnd_get_system_entropy_getrandom(void* _rnd, size_t size)
- {
- 	int ret;
-	ret = force_getrandom(_rnd, size, 0);
-+	unsigned int flags = 0;
-+
-+	if (_gnutls_fips_mode_enabled()) {
-+		flags |= 2/*GRND_RANDOM*/;
-+	}
-+	ret = force_getrandom(_rnd, size, flags);
- 	if (ret == -1) {
- 		int e = errno;
- 		gnutls_assert();
-- 
-2.37.1
-
--- a/SOURCES/gnutls-3.7.6-fips-ccm-taglen.patch
+++ b/SOURCES/gnutls-3.7.6-fips-ccm-taglen.patch
@ -1,331 +0,0 @@
-From 26b2caef673aba8bfd10db3b1b8117f941c18e58 Mon Sep 17 00:00:00 2001
-From: Daiki Ueno <ueno@gnu.org>
-Date: Fri, 21 Oct 2022 15:48:39 +0900
-Subject: [PATCH] cipher: add restriction on CCM tag length under FIPS mode
-
-This change prohibits any use of tag length other than 4, 6, 8, 10,
-12, 14, and 16 bytes in CCM used under FIPS mode, in accordance with
-SP800-38C A.1.  While use of tag lengths smaller than 8 bytes is not
-recommended, we simply allow 4 and 6 bytes tags for now.
-
-Signed-off-by: Daiki Ueno <ueno@gnu.org>
---
- lib/accelerated/aarch64/aes-ccm-aarch64.c | 39 ++++++++++
- lib/accelerated/x86/aes-ccm-x86-aesni.c   | 39 ++++++++++
- lib/nettle/cipher.c                       | 55 ++++++++++++++
- tests/fips-test.c                         | 87 ++++++++++++++++++++++-
- 4 files changed, 218 insertions(+), 2 deletions(-)
-
-diff --git a/lib/accelerated/aarch64/aes-ccm-aarch64.c b/lib/accelerated/aarch64/aes-ccm-aarch64.c
-index a2ba259e99..b415d4ddfb 100644
--- a/lib/accelerated/aarch64/aes-ccm-aarch64.c
-+++ b/lib/accelerated/aarch64/aes-ccm-aarch64.c
-@@ -36,6 +36,7 @@
- #include <byteswap.h>
- #include <nettle/ccm.h>
- #include <aes-aarch64.h>
-+#include <fips.h>
- 
- typedef struct ccm_aarch64_aes_ctx {
- 	AES_KEY key;
-@@ -103,6 +104,25 @@ aes_ccm_aead_encrypt(void *_ctx,
- 	if (unlikely(encr_size < plain_size + tag_size))
- 		return gnutls_assert_val(GNUTLS_E_SHORT_MEMORY_BUFFER);
- 
-+	/* SP800-38C A.1 says Tlen must be a multiple of 16 between 32
-+	 * and 128.
-+	 */
-+	switch (tag_size) {
-+	case 4: case 6:
-+		/* SP800-38C B.2 says Tlen smaller than 64 should not be used
-+		 * under sufficient restriction. We simply allow those for now.
-+		 */
-+		FALLTHROUGH;
-+	case 8: case 10: case 12: case 14: case 16:
-+		break;
-+	default:
-+		if (_gnutls_fips_mode_enabled()) {
-+			_gnutls_switch_fips_state(GNUTLS_FIPS140_OP_ERROR);
-+			return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
-+		}
-+		break;
-+	}
-+
- 	ccm_encrypt_message(&ctx->key, aarch64_aes_encrypt,
- 			    nonce_size, nonce,
- 			    auth_size, auth,
-@@ -129,6 +149,25 @@ aes_ccm_aead_decrypt(void *_ctx,
- 	if (unlikely(plain_size < encr_size - tag_size))
- 		return gnutls_assert_val(GNUTLS_E_SHORT_MEMORY_BUFFER);
- 
-+	/* SP800-38C A.1 says Tlen must be a multiple of 16 between 32
-+	 * and 128.
-+	 */
-+	switch (tag_size) {
-+	case 4: case 6:
-+		/* SP800-38C B.2 says Tlen smaller than 64 should not be used
-+		 * under sufficient restriction. We simply allow those for now.
-+		 */
-+		FALLTHROUGH;
-+	case 8: case 10: case 12: case 14: case 16:
-+		break;
-+	default:
-+		if (_gnutls_fips_mode_enabled()) {
-+			_gnutls_switch_fips_state(GNUTLS_FIPS140_OP_ERROR);
-+			return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
-+		}
-+		break;
-+	}
-+
- 	ret = ccm_decrypt_message(&ctx->key, aarch64_aes_encrypt,
- 				  nonce_size, nonce,
- 				  auth_size, auth,
-diff --git a/lib/accelerated/x86/aes-ccm-x86-aesni.c b/lib/accelerated/x86/aes-ccm-x86-aesni.c
-index 701c0f992a..9ebbdd7b2a 100644
--- a/lib/accelerated/x86/aes-ccm-x86-aesni.c
-+++ b/lib/accelerated/x86/aes-ccm-x86-aesni.c
-@@ -37,6 +37,7 @@
- #include <byteswap.h>
- #include <nettle/ccm.h>
- #include <aes-x86.h>
-+#include <fips.h>
- 
- typedef struct ccm_x86_aes_ctx {
- 	AES_KEY key;
-@@ -95,6 +96,25 @@ aes_ccm_aead_encrypt(void *_ctx,
- 	if (unlikely(encr_size < plain_size + tag_size))
- 		return gnutls_assert_val(GNUTLS_E_SHORT_MEMORY_BUFFER);
- 
-+	/* SP800-38C A.1 says Tlen must be a multiple of 16 between 32
-+	 * and 128.
-+	 */
-+	switch (tag_size) {
-+	case 4: case 6:
-+		/* SP800-38C B.2 says Tlen smaller than 64 should not be used
-+		 * under sufficient restriction. We simply allow those for now.
-+		 */
-+		FALLTHROUGH;
-+	case 8: case 10: case 12: case 14: case 16:
-+		break;
-+	default:
-+		if (_gnutls_fips_mode_enabled()) {
-+			_gnutls_switch_fips_state(GNUTLS_FIPS140_OP_ERROR);
-+			return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
-+		}
-+		break;
-+	}
-+
- 	ccm_encrypt_message(&ctx->key, x86_aes_encrypt,
- 			    nonce_size, nonce,
- 			    auth_size, auth,
-@@ -121,6 +141,25 @@ aes_ccm_aead_decrypt(void *_ctx,
- 	if (unlikely(plain_size < encr_size - tag_size))
- 		return gnutls_assert_val(GNUTLS_E_SHORT_MEMORY_BUFFER);
- 
-+	/* SP800-38C A.1 says Tlen must be a multiple of 16 between 32
-+	 * and 128.
-+	 */
-+	switch (tag_size) {
-+	case 4: case 6:
-+		/* SP800-38C B.2 says Tlen smaller than 64 should not be used
-+		 * under sufficient restriction. We simply allow those for now.
-+		 */
-+		FALLTHROUGH;
-+	case 8: case 10: case 12: case 14: case 16:
-+		break;
-+	default:
-+		if (_gnutls_fips_mode_enabled()) {
-+			_gnutls_switch_fips_state(GNUTLS_FIPS140_OP_ERROR);
-+			return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
-+		}
-+		break;
-+	}
-+
- 	ret = ccm_decrypt_message(&ctx->key, x86_aes_encrypt,
- 				  nonce_size, nonce,
- 				  auth_size, auth,
-diff --git a/lib/nettle/cipher.c b/lib/nettle/cipher.c
-index 9c2ce19e7e..8c23d11252 100644
--- a/lib/nettle/cipher.c
-+++ b/lib/nettle/cipher.c
-@@ -1253,6 +1253,34 @@ wrap_nettle_cipher_aead_encrypt(void *_ctx,
- 		ctx->cipher->tag(ctx->ctx_ptr, tag_size, ((uint8_t*)encr) + plain_size);
- 	} else {
- 		/* CCM-style cipher */
-+
-+		switch (ctx->cipher->algo) {
-+		case GNUTLS_CIPHER_AES_128_CCM:
-+		case GNUTLS_CIPHER_AES_256_CCM:
-+			/* SP800-38C A.1 says Tlen must be a multiple of 16
-+			 * between 32 and 128.
-+			 */
-+			switch (tag_size) {
-+			case 4: case 6:
-+				/* SP800-38C B.2 says Tlen smaller than 64
-+				 * should not be used under sufficient
-+				 * restriction. We simply allow those for now.
-+				 */
-+				FALLTHROUGH;
-+			case 8: case 10: case 12: case 14: case 16:
-+				break;
-+			default:
-+				if (_gnutls_fips_mode_enabled()) {
-+					_gnutls_switch_fips_state(GNUTLS_FIPS140_OP_ERROR);
-+					return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
-+				}
-+				break;
-+			}
-+			break;
-+		default:
-+			break;
-+		}
-+
- 		ctx->cipher->aead_encrypt(ctx,
- 					  nonce_size, nonce,
- 					  auth_size, auth,
-@@ -1302,6 +1330,33 @@ wrap_nettle_cipher_aead_decrypt(void *_ctx,
- 		if (unlikely(plain_size < encr_size))
- 			return gnutls_assert_val(GNUTLS_E_SHORT_MEMORY_BUFFER);
- 
-+		switch (ctx->cipher->algo) {
-+		case GNUTLS_CIPHER_AES_128_CCM:
-+		case GNUTLS_CIPHER_AES_256_CCM:
-+			/* SP800-38C A.1 says Tlen must be a multiple of 16
-+			 * between 32 and 128.
-+			 */
-+			switch (tag_size) {
-+			case 4: case 6:
-+				/* SP800-38C B.2 says Tlen smaller than 64
-+				 * should not be used under sufficient
-+				 * restriction. We simply allow those for now.
-+				 */
-+				FALLTHROUGH;
-+			case 8: case 10: case 12: case 14: case 16:
-+				break;
-+			default:
-+				if (_gnutls_fips_mode_enabled()) {
-+					_gnutls_switch_fips_state(GNUTLS_FIPS140_OP_ERROR);
-+					return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
-+				}
-+				break;
-+			}
-+			break;
-+		default:
-+			break;
-+		}
-+
- 		ret = ctx->cipher->aead_decrypt(ctx,
- 						nonce_size, nonce,
- 						auth_size, auth,
-diff --git a/tests/fips-test.c b/tests/fips-test.c
-index f7556d7bbb..c43503fba0 100644
--- a/tests/fips-test.c
-+++ b/tests/fips-test.c
-@@ -1,4 +1,5 @@
- #include <config.h>
-+#include <stdbool.h>
- #include <stdint.h>
- #include <stdio.h>
- #include <string.h>
-@@ -213,14 +214,96 @@ test_cipher_disallowed(gnutls_cipher_algorithm_t cipher)
- 	FIPS_POP_CONTEXT(ERROR);
- }
- 
-+static void
-+test_ccm_cipher(gnutls_cipher_algorithm_t cipher, size_t tag_length,
-+		bool expect_encryption_fail,
-+		gnutls_fips140_operation_state_t expected_state)
-+{
-+	int ret;
-+	unsigned key_size = gnutls_cipher_get_key_size(cipher);
-+	gnutls_aead_cipher_hd_t h;
-+	gnutls_datum_t key = { key_data, key_size };
-+	unsigned char buffer[256];
-+	size_t length;
-+	gnutls_memset(key_data, 0, key_size);
-+
-+	FIPS_PUSH_CONTEXT();
-+	ret = gnutls_aead_cipher_init(&h, cipher, &key);
-+	if (ret < 0) {
-+		fail("gnutls_aead_cipher_init failed for %s\n",
-+		     gnutls_cipher_get_name(cipher));
-+	}
-+	FIPS_POP_CONTEXT(APPROVED);
-+
-+	fips_push_context(fips_context);
-+	memset(buffer, 0, sizeof(buffer));
-+	length = sizeof(buffer);
-+	ret = gnutls_aead_cipher_encrypt(h, iv_data,
-+					 gnutls_cipher_get_iv_size(cipher),
-+					 NULL, 0, tag_length,
-+					 buffer, length - tag_length,
-+					 buffer, &length);
-+	if (expect_encryption_fail) {
-+		if (ret != GNUTLS_E_INVALID_REQUEST) {
-+			fail("gnutls_aead_cipher_encrypt(%s) returned %d "
-+			     "while %d is expected\n",
-+			     gnutls_cipher_get_name(cipher),
-+			     ret, GNUTLS_E_INVALID_REQUEST);
-+		}
-+	} else if (ret < 0) {
-+		fail("gnutls_aead_cipher_encrypt failed for %s\n",
-+		     gnutls_cipher_get_name(cipher));
-+	}
-+	fips_pop_context(fips_context, expected_state);
-+
-+	fips_push_context(fips_context);
-+	length = sizeof(buffer);
-+	ret = gnutls_aead_cipher_decrypt(h, iv_data,
-+					 gnutls_cipher_get_iv_size(cipher),
-+					 NULL, 0, tag_length,
-+					 buffer, length,
-+					 buffer, &length);
-+	if (expect_encryption_fail) {
-+		if (ret != GNUTLS_E_INVALID_REQUEST) {
-+			fail("gnutls_aead_cipher_decrypt(%s) returned %d "
-+			     "while %d is expected\n",
-+			     gnutls_cipher_get_name(cipher),
-+			     ret, GNUTLS_E_INVALID_REQUEST);
-+		}
-+	} else if (ret < 0) {
-+		fail("gnutls_aead_cipher_decrypt failed for %s\n",
-+		     gnutls_cipher_get_name(cipher));
-+	}
-+	fips_pop_context(fips_context, expected_state);
-+
-+	gnutls_aead_cipher_deinit(h);
-+}
-+
- static inline void
- test_ciphers(void)
- {
-+	size_t i;
-+
- 	test_cipher_approved(GNUTLS_CIPHER_AES_128_CBC);
- 	test_cipher_approved(GNUTLS_CIPHER_AES_192_CBC);
- 	test_cipher_approved(GNUTLS_CIPHER_AES_256_CBC);
-	test_aead_cipher_approved(GNUTLS_CIPHER_AES_128_CCM);
-	test_aead_cipher_approved(GNUTLS_CIPHER_AES_256_CCM);
-+
-+	/* Check for all allowed Tlen */
-+	for (i = 4; i <= 16; i += 2) {
-+		test_ccm_cipher(GNUTLS_CIPHER_AES_128_CCM, i,
-+				false, GNUTLS_FIPS140_OP_APPROVED);
-+		test_ccm_cipher(GNUTLS_CIPHER_AES_256_CCM, i,
-+				false, GNUTLS_FIPS140_OP_APPROVED);
-+	}
-+	test_ccm_cipher(GNUTLS_CIPHER_AES_128_CCM, 3,
-+			true, GNUTLS_FIPS140_OP_ERROR);
-+	test_ccm_cipher(GNUTLS_CIPHER_AES_256_CCM, 3,
-+			true, GNUTLS_FIPS140_OP_ERROR);
-+	test_ccm_cipher(GNUTLS_CIPHER_AES_128_CCM, 5,
-+			true, GNUTLS_FIPS140_OP_ERROR);
-+	test_ccm_cipher(GNUTLS_CIPHER_AES_256_CCM, 5,
-+			true, GNUTLS_FIPS140_OP_ERROR);
-+
- 	test_aead_cipher_approved(GNUTLS_CIPHER_AES_128_CCM_8);
- 	test_aead_cipher_approved(GNUTLS_CIPHER_AES_256_CCM_8);
- 	test_cipher_approved(GNUTLS_CIPHER_AES_128_CFB8);
-- 
-2.38.1
-
--- a/SOURCES/gnutls-3.7.6-fips-ecdsa-hash-check.patch
+++ b/SOURCES/gnutls-3.7.6-fips-ecdsa-hash-check.patch
@ -1,427 +0,0 @@
-From 171b934a8c054e98b110892cae4130e1db64e656 Mon Sep 17 00:00:00 2001
-From: rpm-build <rpm-build>
-Date: Thu, 29 Sep 2022 21:28:19 +0900
-Subject: [PATCH] gnutls-3.7.6-fips-ecdsa-hash-check.patch
-
---
- lib/crypto-backend.h |  12 ++--
- lib/nettle/pk.c      |  33 +++++-----
- lib/privkey.c        |  42 ++++++++----
- lib/pubkey.c         |   5 +-
- tests/fips-test.c    | 150 ++++++++++++++++++++++++++++++++++++++++++-
- 5 files changed, 205 insertions(+), 37 deletions(-)
-
-diff --git a/lib/crypto-backend.h b/lib/crypto-backend.h
-index f0f68c3..4dd1ae2 100644
--- a/lib/crypto-backend.h
-+++ b/lib/crypto-backend.h
-@@ -247,11 +247,13 @@ typedef enum {
- 	GNUTLS_PK_FLAG_RSA_PSS_FIXED_SALT_LENGTH = 4
- } gnutls_pk_flag_t;
- 
-#define FIX_SIGN_PARAMS(params, flags, dig) do {		\
-	if ((flags) & GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE) {	\
-		(params).flags |= GNUTLS_PK_FLAG_REPRODUCIBLE;	\
-		(params).dsa_dig = (dig);			\
-	}							\
-+#define FIX_SIGN_PARAMS(params, flags, dig) do {			\
-+	if ((flags) & GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE) {		\
-+		(params).flags |= GNUTLS_PK_FLAG_REPRODUCIBLE;		\
-+	}								\
-+	if ((params).pk == GNUTLS_PK_DSA || (params).pk == GNUTLS_PK_ECDSA) { \
-+		(params).dsa_dig = (dig);				\
-+	}								\
- } while (0)
- 
- void gnutls_pk_params_release(gnutls_pk_params_st * p);
-diff --git a/lib/nettle/pk.c b/lib/nettle/pk.c
-index f38016b..c098e2a 100644
--- a/lib/nettle/pk.c
-+++ b/lib/nettle/pk.c
-@@ -1104,8 +1104,16 @@ _wrap_nettle_pk_sign(gnutls_pk_algorithm_t algo,
- 			me = _gnutls_dsa_q_to_hash(pk_params,
- 						   &hash_len);
- 
-+			if (hash_len > vdata->size) {
-+				gnutls_assert();
-+				_gnutls_debug_log
-+				    ("Security level of algorithm requires hash %s(%d) or better\n",
-+				     _gnutls_mac_get_name(me), hash_len);
-+				hash_len = vdata->size;
-+			}
-+
- 			/* Only SHA-2 is allowed in FIPS 140-3 */
-			switch (me->id) {
-+			switch (DIG_TO_MAC(sign_params->dsa_dig)) {
- 			case GNUTLS_MAC_SHA256:
- 			case GNUTLS_MAC_SHA384:
- 			case GNUTLS_MAC_SHA512:
-@@ -1115,14 +1123,6 @@ _wrap_nettle_pk_sign(gnutls_pk_algorithm_t algo,
- 				not_approved = true;
- 			}
- 
-			if (hash_len > vdata->size) {
-				gnutls_assert();
-				_gnutls_debug_log
-				    ("Security level of algorithm requires hash %s(%d) or better\n",
-				     _gnutls_mac_get_name(me), hash_len);
-				hash_len = vdata->size;
-			}
-
- 			mpz_init(k);
- 			if (_gnutls_get_lib_state() == LIB_STATE_SELFTEST ||
- 			    (sign_params->flags & GNUTLS_PK_FLAG_REPRODUCIBLE)) {
-@@ -1545,7 +1545,6 @@ _wrap_nettle_pk_verify(gnutls_pk_algorithm_t algo,
- 			struct dsa_signature sig;
- 			int curve_id = pk_params->curve;
- 			const struct ecc_curve *curve;
-			const mac_entry_st *me;
- 
- 			curve = get_supported_nist_curve(curve_id);
- 			if (curve == NULL) {
-@@ -1571,11 +1570,14 @@ _wrap_nettle_pk_verify(gnutls_pk_algorithm_t algo,
- 			memcpy(sig.r, tmp[0], SIZEOF_MPZT);
- 			memcpy(sig.s, tmp[1], SIZEOF_MPZT);
- 
-			me = _gnutls_dsa_q_to_hash(pk_params, &hash_len);
-+			(void)_gnutls_dsa_q_to_hash(pk_params, &hash_len);
-+
-+			if (hash_len > vdata->size)
-+				hash_len = vdata->size;
- 
- 			/* SHA-1 is allowed for SigVer in FIPS 140-3 in legacy
- 			 * mode */
-			switch (me->id) {
-+			switch (DIG_TO_MAC(sign_params->dsa_dig)) {
- 			case GNUTLS_MAC_SHA1:
- 			case GNUTLS_MAC_SHA256:
- 			case GNUTLS_MAC_SHA384:
-@@ -1586,9 +1588,6 @@ _wrap_nettle_pk_verify(gnutls_pk_algorithm_t algo,
- 				not_approved = true;
- 			}
- 
-			if (hash_len > vdata->size)
-				hash_len = vdata->size;
-
- 			ret =
- 			    ecdsa_verify(&pub, hash_len, vdata->data,
- 					 &sig);
-@@ -2390,8 +2389,10 @@ static int pct_test(gnutls_pk_algorithm_t algo, const gnutls_pk_params_st* param
- 
- 	if (algo == GNUTLS_PK_DSA || algo == GNUTLS_PK_EC) {
- 		unsigned hash_len;
-+		const mac_entry_st *me;
- 
-		_gnutls_dsa_q_to_hash(params, &hash_len);
-+		me = _gnutls_dsa_q_to_hash(params, &hash_len);
-+		spki.dsa_dig = MAC_TO_DIG(me->id);
- 		gen_data = gnutls_malloc(hash_len);
- 		gnutls_rnd(GNUTLS_RND_NONCE, gen_data, hash_len);
- 
-diff --git a/lib/privkey.c b/lib/privkey.c
-index 0b77443..2069fc0 100644
--- a/lib/privkey.c
-+++ b/lib/privkey.c
-@@ -1251,27 +1251,36 @@ gnutls_privkey_sign_hash2(gnutls_privkey_t signer,
- 		se = _gnutls_sign_to_entry(GNUTLS_SIGN_RSA_RAW);
- 	} else {
- 		se = _gnutls_sign_to_entry(algo);
-		if (unlikely(se == NULL))
-			return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
-
-+		if (unlikely(se == NULL)) {
-+			ret = gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
-+			goto cleanup;
-+		}
- 	}
- 
- 	ret = _gnutls_privkey_get_spki_params(signer, &params);
- 	if (ret < 0) {
- 		gnutls_assert();
-		return ret;
-+		goto cleanup;
- 	}
- 
- 	ret = _gnutls_privkey_update_spki_params(signer, se->pk, se->hash,
- 					         flags, &params);
- 	if (ret < 0) {
- 		gnutls_assert();
-		return ret;
-+		goto cleanup;
- 	}
- 
- 	FIX_SIGN_PARAMS(params, flags, se->hash);
- 
-	return privkey_sign_prehashed(signer, se, hash_data, signature, &params);
-+	ret = privkey_sign_prehashed(signer, se, hash_data, signature, &params);
-+
-+ cleanup:
-+	if (ret < 0) {
-+		_gnutls_switch_fips_state(GNUTLS_FIPS140_OP_ERROR);
-+	} else {
-+		_gnutls_switch_fips_state(GNUTLS_FIPS140_OP_NOT_APPROVED);
-+	}
-+	return ret;
- }
- 
- int
-@@ -1366,14 +1375,14 @@ gnutls_privkey_sign_hash(gnutls_privkey_t signer,
- 	ret = _gnutls_privkey_get_spki_params(signer, &params);
- 	if (ret < 0) {
- 		gnutls_assert();
-		return ret;
-+		goto cleanup;
- 	}
- 
- 	ret = _gnutls_privkey_update_spki_params(signer, signer->pk_algorithm,
- 					       hash_algo, flags, &params);
- 	if (ret < 0) {
- 		gnutls_assert();
-		return ret;
-+		goto cleanup;
- 	}
- 
- 	/* legacy callers of this API could use a hash algorithm of 0 (unknown)
-@@ -1391,13 +1400,22 @@ gnutls_privkey_sign_hash(gnutls_privkey_t signer,
- 		se = _gnutls_pk_to_sign_entry(params.pk, hash_algo);
- 	}
- 
-	if (unlikely(se == NULL))
-		return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
-+	if (unlikely(se == NULL)) {
-+		ret = gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
-+		goto cleanup;
-+	}
- 
- 	FIX_SIGN_PARAMS(params, flags, hash_algo);
- 
-	return privkey_sign_prehashed(signer, se,
-				      hash_data, signature, &params);
-+	ret = privkey_sign_prehashed(signer, se,
-+				     hash_data, signature, &params);
-+ cleanup:
-+	if (ret < 0) {
-+		_gnutls_switch_fips_state(GNUTLS_FIPS140_OP_ERROR);
-+	} else {
-+		_gnutls_switch_fips_state(GNUTLS_FIPS140_OP_NOT_APPROVED);
-+	}
-+	return ret;
- }
- 
- static int
-diff --git a/lib/pubkey.c b/lib/pubkey.c
-index eba1f5b..35126f3 100644
--- a/lib/pubkey.c
-+++ b/lib/pubkey.c
-@@ -1985,7 +1985,7 @@ gnutls_pubkey_import_dsa_raw(gnutls_pubkey_t key,
-  * parameters (if any) with the signature algorithm */
- static
- int fixup_spki_params(const gnutls_pk_params_st *key_params, const gnutls_sign_entry_st *se,
-		       const mac_entry_st *me, gnutls_x509_spki_st *params)
-+		      const mac_entry_st *me, gnutls_x509_spki_st *params)
- {
- 	unsigned bits;
- 
-@@ -2018,6 +2018,9 @@ int fixup_spki_params(const gnutls_pk_params_st *key_params, const gnutls_sign_e
- 
- 		if (params->rsa_pss_dig != se->hash)
- 			return gnutls_assert_val(GNUTLS_E_CONSTRAINT_ERROR);
-+	} else if (params->pk == GNUTLS_PK_DSA ||
-+		   params->pk == GNUTLS_PK_ECDSA) {
-+		params->dsa_dig = se->hash;
- 	}
- 
- 	return 0;
-diff --git a/tests/fips-test.c b/tests/fips-test.c
-index 788f4ab..ec0f4b4 100644
--- a/tests/fips-test.c
-+++ b/tests/fips-test.c
-@@ -80,8 +80,22 @@ static const gnutls_datum_t rsa2342_sha1_sig = {
- 	.size = sizeof(rsa2342_sha1_sig_data),
- };
- 
-+static const uint8_t ecc256_sha1_sig_data[] = {
-+	0x30, 0x45, 0x02, 0x21, 0x00, 0x9a, 0x28, 0xc9, 0xbf, 0xc8, 0x70, 0x4f, 
-+	0x27, 0x2d, 0xe1, 0x66, 0xc4, 0xa5, 0xc6, 0xf2, 0xdc, 0x33, 0xb9, 0x41, 
-+	0xdf, 0x78, 0x98, 0x8a, 0x22, 0x4d, 0x29, 0x37, 0xa0, 0x0f, 0x6f, 0xd4, 
-+	0xed, 0x02, 0x20, 0x0b, 0x15, 0xca, 0x30, 0x09, 0x2d, 0x55, 0x44, 0xb4, 
-+	0x1d, 0x3f, 0x48, 0x7a, 0xc3, 0xd1, 0x2a, 0xc1, 0x0e, 0x47, 0xfa, 0xe6, 
-+	0xe9, 0x0f, 0x03, 0xe2, 0x01, 0x4e, 0xe4, 0x73, 0x37, 0xa7, 0x90, 
-+};
-+
-+static const gnutls_datum_t ecc256_sha1_sig = {
-+	.data = (unsigned char *)ecc256_sha1_sig_data,
-+	.size = sizeof(ecc256_sha1_sig_data),
-+};
-+
- static void
-rsa_import_keypair(gnutls_privkey_t *privkey, gnutls_pubkey_t *pubkey,
-+import_keypair(gnutls_privkey_t *privkey, gnutls_pubkey_t *pubkey,
- 		   const char *filename)
- {
- 	const char *srcdir;
-@@ -274,6 +288,8 @@ void doit(void)
- 	gnutls_datum_t signature;
- 	unsigned int bits;
- 	uint8_t hmac[64];
-+	uint8_t hash[64];
-+	gnutls_datum_t hashed_data;
- 	uint8_t pbkdf2[64];
- 	gnutls_datum_t temp_key = { NULL, 0 };
- 
-@@ -473,7 +489,7 @@ void doit(void)
- 
- 	/* Import 2432-bit RSA key; not a security function */
- 	FIPS_PUSH_CONTEXT();
-	rsa_import_keypair(&privkey, &pubkey, "rsa-2432.pem");
-+	import_keypair(&privkey, &pubkey, "rsa-2432.pem");
- 	FIPS_POP_CONTEXT(INITIAL);
- 
- 	/* Create a signature with 2432-bit RSA and SHA256; approved */
-@@ -519,7 +535,7 @@ void doit(void)
- 
- 	/* Import 512-bit RSA key; not a security function */
- 	FIPS_PUSH_CONTEXT();
-	rsa_import_keypair(&privkey, &pubkey, "rsa-512.pem");
-+	import_keypair(&privkey, &pubkey, "rsa-512.pem");
- 	FIPS_POP_CONTEXT(INITIAL);
- 
- 	/* Create a signature with 512-bit RSA and SHA256; not approved */
-@@ -543,6 +559,134 @@ void doit(void)
- 	gnutls_pubkey_deinit(pubkey);
- 	gnutls_privkey_deinit(privkey);
- 
-+	/* Import ECDSA key; not a security function */
-+	FIPS_PUSH_CONTEXT();
-+	import_keypair(&privkey, &pubkey, "ecc256.pem");
-+	FIPS_POP_CONTEXT(INITIAL);
-+
-+	/* Create a signature with ECDSA and SHA256; approved */
-+	FIPS_PUSH_CONTEXT();
-+	ret = gnutls_privkey_sign_data2(privkey, GNUTLS_SIGN_ECDSA_SHA256, 0,
-+					&data, &signature);
-+	if (ret < 0) {
-+		fail("gnutls_privkey_sign_data2 failed\n");
-+	}
-+	FIPS_POP_CONTEXT(APPROVED);
-+
-+	/* Verify a signature with ECDSA and SHA256; approved */
-+	FIPS_PUSH_CONTEXT();
-+	ret = gnutls_pubkey_verify_data2(pubkey, GNUTLS_SIGN_ECDSA_SHA256, 0,
-+					 &data, &signature);
-+	if (ret < 0) {
-+		fail("gnutls_pubkey_verify_data2 failed\n");
-+	}
-+	FIPS_POP_CONTEXT(APPROVED);
-+	gnutls_free(signature.data);
-+
-+	/* Create a signature with ECDSA and SHA256 (old API); approved */
-+	FIPS_PUSH_CONTEXT();
-+	ret = gnutls_privkey_sign_data(privkey, GNUTLS_DIG_SHA256, 0,
-+				       &data, &signature);
-+	if (ret < 0) {
-+		fail("gnutls_privkey_sign_data failed\n");
-+	}
-+	FIPS_POP_CONTEXT(APPROVED);
-+
-+	/* Create a SHA256 hashed data for 2-pass signature API; not a
-+	 * crypto operation */
-+	FIPS_PUSH_CONTEXT();
-+	ret = gnutls_hash_fast(GNUTLS_DIG_SHA256, data.data, data.size, hash);
-+	if (ret < 0) {
-+		fail("gnutls_hash_fast failed\n");
-+	}
-+	hashed_data.data = hash;
-+	hashed_data.size = 32;
-+	FIPS_POP_CONTEXT(INITIAL);
-+
-+	/* Create a signature with ECDSA and SHA256 (2-pass API); not-approved */
-+	FIPS_PUSH_CONTEXT();
-+	ret = gnutls_privkey_sign_hash2(privkey, GNUTLS_SIGN_ECDSA_SHA256, 0,
-+					&hashed_data, &signature);
-+	if (ret < 0) {
-+		fail("gnutls_privkey_sign_hash2 failed\n");
-+	}
-+	FIPS_POP_CONTEXT(NOT_APPROVED);
-+	gnutls_free(signature.data);
-+
-+	/* Create a signature with ECDSA and SHA256 (2-pass old API); not-approved */
-+	FIPS_PUSH_CONTEXT();
-+	ret = gnutls_privkey_sign_hash(privkey, GNUTLS_DIG_SHA256, 0,
-+					&hashed_data, &signature);
-+	if (ret < 0) {
-+		fail("gnutls_privkey_sign_hash failed\n");
-+	}
-+	FIPS_POP_CONTEXT(NOT_APPROVED);
-+	gnutls_free(signature.data);
-+
-+	/* Create a signature with ECDSA and SHA-1; not approved */
-+	FIPS_PUSH_CONTEXT();
-+	ret = gnutls_privkey_sign_data2(privkey, GNUTLS_SIGN_ECDSA_SHA1, 0,
-+					&data, &signature);
-+	if (ret < 0) {
-+		fail("gnutls_privkey_sign_data2 failed\n");
-+	}
-+	FIPS_POP_CONTEXT(NOT_APPROVED);
-+
-+	/* Verify a signature created with ECDSA and SHA-1; approved */
-+	FIPS_PUSH_CONTEXT();
-+	ret = gnutls_pubkey_verify_data2(pubkey, GNUTLS_SIGN_ECDSA_SHA1,
-+					 GNUTLS_VERIFY_ALLOW_SIGN_WITH_SHA1, &data,
-+					 &ecc256_sha1_sig);
-+	if (ret < 0) {
-+		fail("gnutls_pubkey_verify_data2 failed\n");
-+	}
-+	FIPS_POP_CONTEXT(APPROVED);
-+	gnutls_free(signature.data);
-+
-+	/* Create a signature with ECDSA and SHA-1 (old API); not approved */
-+	FIPS_PUSH_CONTEXT();
-+	ret = gnutls_privkey_sign_data(privkey, GNUTLS_DIG_SHA1, 0,
-+					&data, &signature);
-+	if (ret < 0) {
-+		fail("gnutls_privkey_sign_data failed\n");
-+	}
-+	FIPS_POP_CONTEXT(NOT_APPROVED);
-+	gnutls_free(signature.data);
-+
-+	/* Create a SHA1 hashed data for 2-pass signature API; not a
-+	 * crypto operation */
-+	FIPS_PUSH_CONTEXT();
-+	ret = gnutls_hash_fast(GNUTLS_DIG_SHA1, data.data, data.size, hash);
-+	if (ret < 0) {
-+		fail("gnutls_hash_fast failed\n");
-+	}
-+	hashed_data.data = hash;
-+	hashed_data.size = 20;
-+	FIPS_POP_CONTEXT(INITIAL);
-+
-+	/* Create a signature with ECDSA and SHA1 (2-pass API); not-approved */
-+	FIPS_PUSH_CONTEXT();
-+	ret = gnutls_privkey_sign_hash2(privkey, GNUTLS_SIGN_ECDSA_SHA1, 0,
-+					&hashed_data, &signature);
-+	if (ret < 0) {
-+		fail("gnutls_privkey_sign_hash2 failed\n");
-+	}
-+	FIPS_POP_CONTEXT(NOT_APPROVED);
-+	gnutls_free(signature.data);
-+
-+	/* Create a signature with ECDSA and SHA1 (2-pass old API); not-approved */
-+	FIPS_PUSH_CONTEXT();
-+	ret = gnutls_privkey_sign_hash(privkey, GNUTLS_DIG_SHA1, 0,
-+					&hashed_data, &signature);
-+	if (ret < 0) {
-+		fail("gnutls_privkey_sign_hash failed\n");
-+	}
-+	FIPS_POP_CONTEXT(NOT_APPROVED);
-+	gnutls_free(signature.data);
-+
-+	gnutls_pubkey_deinit(pubkey);
-+	gnutls_privkey_deinit(privkey);
-+
-         /* Test RND functions */
- 	FIPS_PUSH_CONTEXT();
- 	ret = gnutls_rnd(GNUTLS_RND_RANDOM, key16, sizeof(key16));
-- 
-2.37.3
-
--- a/SOURCES/gnutls-3.7.6-fips-ems.patch
+++ b/SOURCES/gnutls-3.7.6-fips-ems.patch
@ -1,805 +0,0 @@
-From 4751e1e2d4012404af9bc52535aa73ac88bc7bea Mon Sep 17 00:00:00 2001
-From: rpm-build <rpm-build>
-Date: Thu, 13 Jul 2023 16:14:08 +0200
-Subject: [PATCH] gnutls-3.7.6-fips-ems.patch
-
---
- doc/cha-gtls-app.texi                         |   5 +
- lib/gnutls_int.h                              |   6 +
- lib/handshake.c                               |  35 ++++-
- lib/nettle/int/tls1-prf.c                     |  19 +++
- lib/priority.c                                |  41 +++++
- lib/priority_options.gperf                    |   1 +
- tests/Makefile.am                             |   4 +-
- tests/multi-alerts.c                          |   8 +
- tests/no-extensions.c                         |   7 +
- .../ocsp-tests/ocsp-must-staple-connection.sh |  60 +++----
- tests/rehandshake-ext-secret.c                |   8 +
- tests/resume.c                                |  26 ++-
- tests/status-request.c                        |   8 +-
- tests/system-override-session-hash.sh         | 144 +++++++++++++++++
- tests/tls-force-ems.c                         | 148 ++++++++++++++++++
- 15 files changed, 477 insertions(+), 43 deletions(-)
- create mode 100755 tests/system-override-session-hash.sh
- create mode 100644 tests/tls-force-ems.c
-
-diff --git a/doc/cha-gtls-app.texi b/doc/cha-gtls-app.texi
-index bd44478..57e7d50 100644
--- a/doc/cha-gtls-app.texi
-+++ b/doc/cha-gtls-app.texi
-@@ -1547,6 +1547,11 @@ This is implied by the PFS keyword.
- will prevent the advertizing the TLS extended master secret (session hash)
- extension.
- 
-+@item %FORCE_SESSION_HASH @tab
-+negotiate the TLS extended master secret (session hash) extension.
-+Specifying both %NO_SESSION_HASH and %FORCE_SESSION_HASH is not
-+supported, and the behavior is undefined.
-+
- @item %SERVER_PRECEDENCE @tab
- The ciphersuite will be selected according to server priorities
- and not the client's.
-diff --git a/lib/gnutls_int.h b/lib/gnutls_int.h
-index 8c7bdaa..c6bf154 100644
--- a/lib/gnutls_int.h
-+++ b/lib/gnutls_int.h
-@@ -926,6 +926,11 @@ typedef struct sign_algo_list_st {
- 
- #include "atomic.h"
- 
-+typedef enum ext_master_secret_t {
-+	EMS_REQUEST,
-+	EMS_REQUIRE
-+} ext_master_secret_t;
-+
- /* For the external api */
- struct gnutls_priority_st {
- 	priority_st protocol;
-@@ -965,6 +970,7 @@ struct gnutls_priority_st {
- 	bool force_etm;
- 	unsigned int additional_verify_flags;
- 	bool tls13_compat_mode;
-+	ext_master_secret_t force_ext_master_secret;
- 
- 	/* TLS_FALLBACK_SCSV */
- 	bool fallback;
-diff --git a/lib/handshake.c b/lib/handshake.c
-index 21edc5e..1e33b84 100644
--- a/lib/handshake.c
-+++ b/lib/handshake.c
-@@ -875,6 +875,15 @@ read_client_hello(gnutls_session_t session, uint8_t * data,
- 	if (_gnutls_version_priority(session, vers->id) < 0)
- 		return gnutls_assert_val(GNUTLS_E_UNSUPPORTED_VERSION_PACKET);
- 
-+	/* check if EMS is required */
-+	if (!vers->tls13_sem && vers->id != GNUTLS_SSL3 &&
-+	    vers->id != GNUTLS_DTLS0_9 &&
-+	    session->internals.priorities->force_ext_master_secret ==
-+		    EMS_REQUIRE &&
-+	    !session->security_parameters.ext_master_secret) {
-+		return gnutls_assert_val(GNUTLS_E_INSUFFICIENT_SECURITY);
-+	}
-+
- 	_gnutls_handshake_log("HSK[%p]: Selected version %s\n", session, vers->name);
- 
- 	/* select appropriate compression method */
-@@ -2062,11 +2071,27 @@ read_server_hello(gnutls_session_t session,
- 	if (ret < 0)
- 		return gnutls_assert_val(ret);
- 
-	/* check if EtM is required */
-	if (!vers->tls13_sem && session->internals.priorities->force_etm && !session->security_parameters.etm) {
-		const cipher_entry_st *cipher = cipher_to_entry(session->security_parameters.cs->block_algorithm);
-		if (_gnutls_cipher_type(cipher) == CIPHER_BLOCK)
-			return gnutls_assert_val(GNUTLS_E_UNWANTED_ALGORITHM);
-+	if (!vers->tls13_sem) {
-+		/* check if EtM is required */
-+		if (session->internals.priorities->force_etm &&
-+		    !session->security_parameters.etm) {
-+			const cipher_entry_st *cipher =
-+			    cipher_to_entry(session->security_parameters.
-+					    cs->block_algorithm);
-+			if (_gnutls_cipher_type(cipher) == CIPHER_BLOCK)
-+				return
-+				    gnutls_assert_val
-+				    (GNUTLS_E_UNWANTED_ALGORITHM);
-+		}
-+
-+		/* check if EMS is required */
-+		if (vers->id != GNUTLS_SSL3 && vers->id != GNUTLS_DTLS0_9 &&
-+		    session->internals.priorities->force_ext_master_secret ==
-+			    EMS_REQUIRE &&
-+		    !session->security_parameters.ext_master_secret) {
-+			return
-+			    gnutls_assert_val(GNUTLS_E_INSUFFICIENT_SECURITY);
-+		}
- 	}
- 
- 
-diff --git a/lib/nettle/int/tls1-prf.c b/lib/nettle/int/tls1-prf.c
-index 19ca5d3..fd9b5a4 100644
--- a/lib/nettle/int/tls1-prf.c
-+++ b/lib/nettle/int/tls1-prf.c
-@@ -28,6 +28,7 @@
- #endif
- 
- #include <gnutls_int.h>
-+#include "fips.h"
- 
- #include <stdlib.h>
- #include <string.h>
-@@ -152,8 +153,26 @@ tls12_prf(void *mac_ctx,
- 	  size_t seed_size, const uint8_t *seed,
- 	  size_t length, uint8_t *dst)
- {
-+#define MASTER_SECRET "master secret"
-+#define MASTER_SECRET_SIZE (sizeof(MASTER_SECRET) - 1)
-+
- 	P_hash(mac_ctx, update, digest, digest_size,
- 		seed_size, seed, label_size, label, length, dst);
- 
-+	/* Since May 16, 2023, the use of extended master secret is
-+	 * mandatory according to FIPS 140-3 IG D.Q.  Instead of
-+	 * allowing the "extended master secret" label specifically,
-+	 * we mark the use of non-EMS label, i.e., "master secret" as
-+	 * non-approved, because it is still useful to call the
-+	 * gnutls_prf_raw function with arbitrary label, e.g., in
-+	 * self-tests.
-+	 */
-+	if (label_size == MASTER_SECRET_SIZE &&
-+	    memcmp(label, MASTER_SECRET, MASTER_SECRET_SIZE) == 0) {
-+		_gnutls_switch_fips_state(GNUTLS_FIPS140_OP_NOT_APPROVED);
-+	} else {
-+		_gnutls_switch_fips_state(GNUTLS_FIPS140_OP_APPROVED);
-+	}
-+
- 	return 1;
- }
-diff --git a/lib/priority.c b/lib/priority.c
-index d163d81..4adf4c7 100644
--- a/lib/priority.c
-+++ b/lib/priority.c
-@@ -906,6 +906,12 @@ static void enable_no_ext_master_secret(gnutls_priority_t c)
- {
- 	c->_no_ext_master_secret = 1;
- }
-+
-+static void enable_force_ext_master_secret(gnutls_priority_t c)
-+{
-+	c->force_ext_master_secret = EMS_REQUIRE;
-+}
-+
- static void enable_no_etm(gnutls_priority_t c)
- {
- 	c->_no_etm = 1;
-@@ -1040,6 +1046,9 @@ struct cfg {
- 	gnutls_kx_algorithm_t kxs[MAX_ALGOS+1];
- 	gnutls_sign_algorithm_t sigs[MAX_ALGOS+1];
- 	gnutls_protocol_t versions[MAX_ALGOS+1];
-+
-+	ext_master_secret_t force_ext_master_secret;
-+	bool force_ext_master_secret_set;
- };
- 
- static inline void
-@@ -1141,6 +1150,8 @@ cfg_steal(struct cfg *dst, struct cfg *src)
- 
- 	dst->allowlisting = src->allowlisting;
- 	dst->ktls_enabled = src->ktls_enabled;
-+	dst->force_ext_master_secret = src->force_ext_master_secret;
-+	dst->force_ext_master_secret_set = src->force_ext_master_secret_set;
- 	memcpy(dst->ciphers, src->ciphers, sizeof(src->ciphers));
- 	memcpy(dst->macs, src->macs, sizeof(src->macs));
- 	memcpy(dst->groups, src->groups, sizeof(src->groups));
-@@ -1748,6 +1759,21 @@ static int cfg_ini_handler(void *_ctx, const char *section, const char *name, co
- 			}
- 			cfg->kxs[i] = algo;
- 			cfg->kxs[i+1] = 0;
-+		} else if (c_strcasecmp(name, "tls-session-hash") == 0) {
-+			if (c_strcasecmp(value, "request") == 0) {
-+				cfg->force_ext_master_secret = EMS_REQUEST;
-+				cfg->force_ext_master_secret_set = true;
-+			} else if (c_strcasecmp(value, "require") == 0) {
-+				cfg->force_ext_master_secret = EMS_REQUIRE;
-+				cfg->force_ext_master_secret_set = true;
-+			} else {
-+				_gnutls_debug_log(
-+					"cfg: unknown value for %s: %s\n", name,
-+					value);
-+				if (fail_on_invalid_config)
-+					return 0;
-+				goto exit;
-+			}
- 		} else {
- 			_gnutls_debug_log("unknown parameter %s\n", name);
- 			if (fail_on_invalid_config)
-@@ -2744,6 +2770,12 @@ gnutls_priority_init(gnutls_priority_t * priority_cache,
- 	(*priority_cache)->min_record_version = 1;
- 	gnutls_atomic_init(&(*priority_cache)->usage_cnt);
- 
-+	if (_gnutls_fips_mode_enabled()) {
-+		(*priority_cache)->force_ext_master_secret = EMS_REQUIRE;
-+	} else {
-+		(*priority_cache)->force_ext_master_secret = EMS_REQUEST;
-+	}
-+
- 	if (system_wide_config.allowlisting && !priorities) {
- 		priorities = "@" LEVEL_SYSTEM;
- 	}
-@@ -2997,6 +3029,15 @@ gnutls_priority_init(gnutls_priority_t * priority_cache,
- 			goto error;
- 	}
- 
-+	/* This needs to be done after parsing modifiers, as
-+	 * tls-session-hash has precedence over modifiers.
-+	 */
-+	if (system_wide_config.force_ext_master_secret_set) {
-+		(*priority_cache)->force_ext_master_secret =
-+			system_wide_config.force_ext_master_secret;
-+		(*priority_cache)->_no_ext_master_secret = false;
-+	}
-+
- 	ret = set_ciphersuite_list(*priority_cache);
- 	if (ret < 0) {
- 		if (err_pos)
-diff --git a/lib/priority_options.gperf b/lib/priority_options.gperf
-index 5a041b7..5bb250a 100644
--- a/lib/priority_options.gperf
-+++ b/lib/priority_options.gperf
-@@ -13,6 +13,7 @@ NO_TICKETS_TLS12, enable_no_tickets_tls12
- NO_ETM, enable_no_etm
- FORCE_ETM, enable_force_etm
- NO_SESSION_HASH, enable_no_ext_master_secret
-+FORCE_SESSION_HASH, enable_force_ext_master_secret
- STATELESS_COMPRESSION, dummy_func
- VERIFY_ALLOW_BROKEN, enable_verify_allow_broken
- VERIFY_ALLOW_SIGN_RSA_MD5, enable_verify_allow_rsa_md5
-diff --git a/tests/Makefile.am b/tests/Makefile.am
-index 23d309d..e5f7fa6 100644
--- a/tests/Makefile.am
-+++ b/tests/Makefile.am
-@@ -77,7 +77,7 @@ EXTRA_DIST = suppressions.valgrind eagain-common.h cert-common.h test-chains.h \
- 	testpkcs11-certs/client.key testpkcs11-certs/server.crt testpkcs11-certs/server-tmpl \
- 	testpkcs11-certs/ca.key testpkcs11-certs/client.crt testpkcs11-certs/client-tmpl testpkcs11-certs/server.key \
- 	crt_type-neg-common.c \
-	system-override-default-priority-string.bad.config system-override-default-priority-string.none.config system-override-default-priority-string.only-tls13.config \
-+	system-override-default-priority-string.bad.config system-override-default-priority-string.none.config system-override-default-priority-string.only-tls13.config system-override-session-hash.sh \
- 	client-secrets.h server-secrets.h
- 
- AM_CFLAGS = $(WARN_CFLAGS) $(WERROR_CFLAGS)
-@@ -234,7 +234,7 @@ ctests += mini-record-2 simple gnutls_hmac_fast set_pkcs12_cred cert certuniquei
- 	 set_x509_ocsp_multi_cli kdf-api keylog-func handshake-write \
- 	 x509cert-dntypes id-on-xmppAddr tls13-compat-mode ciphersuite-name \
- 	 x509-upnconstraint cipher-padding xts-key-check pkcs7-verify-double-free \
-	 fips-rsa-sizes tls12-rehandshake-ticket
-+	 fips-rsa-sizes tls12-rehandshake-ticket tls-force-ems
- 
- ctests += tls-channel-binding
- 
-diff --git a/tests/multi-alerts.c b/tests/multi-alerts.c
-index 84a412c..27be63b 100644
--- a/tests/multi-alerts.c
-+++ b/tests/multi-alerts.c
-@@ -198,6 +198,14 @@ void doit(void)
- 	int sockets[2];
- 	int err;
- 
-+	/* This test does not work under FIPS, as extended master
-+	 * secret extension needs to be negotiated through extensions,
-+	 * but the fixture does not contain the extension.
-+	 */
-+	if (gnutls_fips140_mode_enabled()) {
-+		exit(77);
-+	}
-+
- 	err = socketpair(AF_UNIX, SOCK_STREAM, 0, sockets);
- 	if (err == -1) {
- 		perror("socketpair");
-diff --git a/tests/no-extensions.c b/tests/no-extensions.c
-index 3bd9d06..e5b9578 100644
--- a/tests/no-extensions.c
-+++ b/tests/no-extensions.c
-@@ -205,6 +205,13 @@ void start(const char *prio, gnutls_protocol_t exp_version)
- 
- void doit(void)
- {
-+	/* This test does not work under FIPS, as extended master
-+	 * secret extension needs to be negotiated through extensions.
-+	 */
-+	if (gnutls_fips140_mode_enabled()) {
-+		exit(77);
-+	}
-+
- 	start("NORMAL:-VERS-ALL:+VERS-TLS1.0:%NO_EXTENSIONS", GNUTLS_TLS1_0);
- 	start("NORMAL:-VERS-ALL:+VERS-TLS1.1:%NO_EXTENSIONS", GNUTLS_TLS1_1);
- 	start("NORMAL:-VERS-ALL:+VERS-TLS1.2:%NO_EXTENSIONS", GNUTLS_TLS1_2);
-diff --git a/tests/ocsp-tests/ocsp-must-staple-connection.sh b/tests/ocsp-tests/ocsp-must-staple-connection.sh
-index 049491a..594e854 100755
--- a/tests/ocsp-tests/ocsp-must-staple-connection.sh
-+++ b/tests/ocsp-tests/ocsp-must-staple-connection.sh
-@@ -402,39 +402,43 @@ kill "${TLS_SERVER_PID}"
- wait "${TLS_SERVER_PID}"
- unset TLS_SERVER_PID
- 
-echo "=== Test 7: OSCP response error - client doesn't send status_request ==="
-
-eval "${GETPORT}"
-# Port for gnutls-serv
-TLS_SERVER_PORT=$PORT
-PORT=${TLS_SERVER_PORT}
-launch_bare_server \
-	  datefudge "${TESTDATE}" \
-	  "${SERV}" --echo --disable-client-cert \
-	  --x509keyfile="${srcdir}/ocsp-tests/certs/server_good.key" \
-	  --x509certfile="${SERVER_CERT_FILE}" \
-	  --port="${TLS_SERVER_PORT}" \
-	  --ocsp-response="${srcdir}/ocsp-tests/response3.der" --ignore-ocsp-response-errors
-TLS_SERVER_PID="${!}"
-wait_server $TLS_SERVER_PID
-+if test "${GNUTLS_FORCE_FIPS_MODE}" != 1; then
-+
-+    echo "=== Test 7: OSCP response error - client doesn't send status_request ==="
-+
-+    eval "${GETPORT}"
-+    # Port for gnutls-serv
-+    TLS_SERVER_PORT=$PORT
-+    PORT=${TLS_SERVER_PORT}
-+    launch_bare_server \
-+	datefudge "${TESTDATE}" \
-+	"${SERV}" --echo --disable-client-cert \
-+	--x509keyfile="${srcdir}/ocsp-tests/certs/server_good.key" \
-+	--x509certfile="${SERVER_CERT_FILE}" \
-+	--port="${TLS_SERVER_PORT}" \
-+	--ocsp-response="${srcdir}/ocsp-tests/response3.der" --ignore-ocsp-response-errors
-+    TLS_SERVER_PID="${!}"
-+    wait_server $TLS_SERVER_PID
-+
-+    wait_for_port "${TLS_SERVER_PORT}"
-+
-+    echo "test 123456" | \
-+	datefudge -s "${TESTDATE}" \
-+		  "${CLI}" --priority "NORMAL:%NO_EXTENSIONS" --ocsp --x509cafile="${srcdir}/ocsp-tests/certs/ca.pem" \
-+		  --port="${TLS_SERVER_PORT}" localhost
-+    rc=$?
- 
-wait_for_port "${TLS_SERVER_PORT}"
-+    if test "${rc}" != "0"; then
-+	echo "Connecting to server with valid certificate and OCSP error response failed"
-+	exit ${rc}
-+    fi
- 
-echo "test 123456" | \
-    datefudge -s "${TESTDATE}" \
-	      "${CLI}" --priority "NORMAL:%NO_EXTENSIONS" --ocsp --x509cafile="${srcdir}/ocsp-tests/certs/ca.pem" \
-	      --port="${TLS_SERVER_PORT}" localhost
-rc=$?
-+    kill "${TLS_SERVER_PID}"
-+    wait "${TLS_SERVER_PID}"
-+    unset TLS_SERVER_PID
- 
-if test "${rc}" != "0"; then
-    echo "Connecting to server with valid certificate and OCSP error response failed"
-    exit ${rc}
- fi
- 
-kill "${TLS_SERVER_PID}"
-wait "${TLS_SERVER_PID}"
-unset TLS_SERVER_PID
-
- echo "=== Test 8: OSCP response error - client sends status_request, no TLS feature extension ==="
- 
- eval "${GETPORT}"
-diff --git a/tests/rehandshake-ext-secret.c b/tests/rehandshake-ext-secret.c
-index 94279f0..8d68c9b 100644
--- a/tests/rehandshake-ext-secret.c
-+++ b/tests/rehandshake-ext-secret.c
-@@ -142,6 +142,14 @@ static void try(unsigned onclient)
- 
- void doit(void)
- {
-+	/* This test does not work with TLS 1.2 under FIPS, as
-+	 * extended master secret extension needs to be negotiated
-+	 * through extensions, while %NO_SESSION_HASH is set.
-+	 */
-+	if (gnutls_fips140_mode_enabled()) {
-+		exit(77);
-+	}
-+
- 	try(0);
- 	reset_buffers();
- 	try(1);
-diff --git a/tests/resume.c b/tests/resume.c
-index 93838c0..aa3c60c 100644
--- a/tests/resume.c
-+++ b/tests/resume.c
-@@ -91,6 +91,7 @@ struct params_res {
- 	int change_ciphersuite;
- 	int early_start;
- 	int no_early_start;
-+	int no_fips;
- };
- 
- pid_t child;
-@@ -126,16 +127,18 @@ struct params_res resume_tests[] = {
- 	 .enable_session_ticket_client = ST_NONE,
- 	 .expect_resume = 0,
- 	 .first_no_ext_master = 0,
-	 .second_no_ext_master = 1},
-+	 .second_no_ext_master = 1,
-+	 .no_fips = 1},
- 	{.desc = "try to resume from db (none -> ext master secret)",
- 	 .enable_db = 1,
- 	 .enable_session_ticket_server = ST_NONE,
- 	 .enable_session_ticket_client = ST_NONE,
- 	 .expect_resume = 0,
- 	 .first_no_ext_master = 1,
-	 .second_no_ext_master = 0},
-#endif
-#if defined(TLS13)
-+	 .second_no_ext_master = 0,
-+	 .no_fips = 1},
-+# endif
-+# if defined(TLS13)
- 	/* only makes sense under TLS1.3 as negotiation involves a new
- 	 * handshake with different parameters */
- 	{.desc = "try to resume from session ticket (different cipher order)",
-@@ -211,14 +214,17 @@ struct params_res resume_tests[] = {
- 	 .enable_session_ticket_client = ST_ALL,
- 	 .expect_resume = 0,
- 	 .first_no_ext_master = 0,
-	 .second_no_ext_master = 1},
-	{.desc = "try to resume from session ticket (none -> ext master secret)",
-+	 .second_no_ext_master = 1,
-+	 .no_fips = 1},
-+	{.desc =
-+	 "try to resume from session ticket (none -> ext master secret)",
- 	 .enable_db = 0,
- 	 .enable_session_ticket_server = ST_ALL,
- 	 .enable_session_ticket_client = ST_ALL,
- 	 .expect_resume = 0,
- 	 .first_no_ext_master = 1,
-	 .second_no_ext_master = 0},
-+	 .second_no_ext_master = 0,
-+	 .no_fips = 1},
- 	{.desc = "try to resume from session ticket (server only)",
- 	  .enable_db = 0,
- 	  .enable_session_ticket_server = ST_ALL,
-@@ -942,6 +948,12 @@ void doit(void)
- 		int client_sds[SESSIONS], server_sds[SESSIONS];
- 		int j;
- 
-+		if (resume_tests[i].no_fips && gnutls_fips140_mode_enabled()) {
-+			success("skipping %s under FIPS mode\n",
-+				resume_tests[i].desc);
-+			continue;
-+		}
-+
- 		printf("%s\n", resume_tests[i].desc);
- 
- 		for (j = 0; j < SESSIONS; j++) {
-diff --git a/tests/status-request.c b/tests/status-request.c
-index 07c7918..cd2cc54 100644
--- a/tests/status-request.c
-+++ b/tests/status-request.c
-@@ -289,7 +289,13 @@ void start(const char *prio)
- 
- void doit(void)
- {
-	start("NORMAL:-VERS-ALL:+VERS-TLS1.2");
-+	/* This test does not work with TLS 1.2 under FIPS, as
-+	 * extended master secret extension needs to be negotiated
-+	 * through extensions.
-+	 */
-+	if (!gnutls_fips140_mode_enabled()) {
-+		start("NORMAL:-VERS-ALL:+VERS-TLS1.2");
-+	}
- 	start("NORMAL:-VERS-ALL:+VERS-TLS1.3");
- 	start("NORMAL");
- }
-diff --git a/tests/system-override-session-hash.sh b/tests/system-override-session-hash.sh
-new file mode 100755
-index 0000000..97f11fa
--- /dev/null
-+++ b/tests/system-override-session-hash.sh
-@@ -0,0 +1,144 @@
-+#!/bin/sh
-+
-+# Copyright (C) 2021 Red Hat, Inc.
-+#
-+# Author: Alexander Sosedkin
-+#
-+# This file is part of GnuTLS.
-+#
-+# GnuTLS is free software; you can redistribute it and/or modify it
-+# under the terms of the GNU General Public License as published by the
-+# Free Software Foundation; either version 3 of the License, or (at
-+# your option) any later version.
-+#
-+# GnuTLS is distributed in the hope that it will be useful, but
-+# WITHOUT ANY WARRANTY; without even the implied warranty of
-+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-+# General Public License for more details.
-+#
-+# You should have received a copy of the GNU General Public License
-+# along with GnuTLS.  If not, see <https://www.gnu.org/licenses/>.
-+
-+: ${srcdir=.}
-+: ${SERV=../src/gnutls-serv${EXEEXT}}
-+: ${CLI=../src/gnutls-cli${EXEEXT}}
-+
-+if ! test -x "${SERV}"; then
-+	exit 77
-+fi
-+
-+if ! test -x "${CLI}"; then
-+	exit 77
-+fi
-+
-+${CLI} --fips140-mode
-+if test $? = 0;then
-+	echo "Cannot run this test in FIPS140 mode"
-+	exit 77
-+fi
-+
-+. "${srcdir}/scripts/common.sh"
-+
-+testdir=`create_testdir cfg`
-+
-+cat <<_EOF_ > "$testdir/request.cfg"
-+[overrides]
-+
-+tls-session-hash = request
-+_EOF_
-+
-+cat <<_EOF_ > "$testdir/require.cfg"
-+[overrides]
-+
-+tls-session-hash = require
-+_EOF_
-+
-+eval "${GETPORT}"
-+
-+KEY=${srcdir}/../doc/credentials/x509/key-rsa-pss.pem
-+CERT=${srcdir}/../doc/credentials/x509/cert-rsa-pss.pem
-+CA=${srcdir}/../doc/credentials/x509/ca.pem
-+
-+unset GNUTLS_SYSTEM_PRIORITY_FILE
-+unset GNUTLS_DEBUG_LEVEL
-+
-+launch_server --echo --priority "NORMAL:-VERS-ALL:+VERS-TLS1.2" --x509keyfile ${KEY} --x509certfile ${CERT}
-+PID=$!
-+wait_server ${PID}
-+
-+export GNUTLS_SYSTEM_PRIORITY_FILE="$testdir/request.cfg"
-+export GNUTLS_DEBUG_LEVEL=3
-+
-+"${CLI}" -p "${PORT}" 127.0.0.1 --priority "NORMAL:-VERS-ALL:+VERS-TLS1.2" --verify-hostname=localhost --x509cafile ${CA} --logfile="$testdir/client.log" </dev/null >/dev/null ||
-+	fail "expected connection to succeed (1)"
-+
-+# "tls-session-hash" has precedence over %FORCE_SESSION_HASH
-+"${CLI}" -p "${PORT}" 127.0.0.1 --priority "NORMAL:-VERS-ALL:+VERS-TLS1.2:%FORCE_SESSION_HASH" --verify-hostname=localhost --x509cafile ${CA} --logfile="$testdir/client.log" </dev/null >/dev/null ||
-+	fail "expected connection to succeed (2)"
-+
-+echo kill ${PID}
-+kill ${PID}
-+wait
-+
-+unset GNUTLS_SYSTEM_PRIORITY_FILE
-+unset GNUTLS_DEBUG_LEVEL
-+
-+export GNUTLS_SYSTEM_PRIORITY_FILE="$testdir/request.cfg"
-+
-+# "tls-session-hash" has precedence over %FORCE_SESSION_HASH
-+launch_server --echo --priority "NORMAL:-VERS-ALL:+VERS-TLS1.2:%FORCE_SESSION_HASH" --x509keyfile ${KEY} --x509certfile ${CERT}
-+PID=$!
-+wait_server ${PID}
-+
-+export GNUTLS_DEBUG_LEVEL=3
-+
-+"${CLI}" -p "${PORT}" 127.0.0.1 --priority "NORMAL:-VERS-ALL:+VERS-TLS1.2" --verify-hostname=localhost --x509cafile ${CA} --logfile="$testdir/client.log" </dev/null >/dev/null ||
-+	fail ${PID} "expected connection to succeed (3)"
-+
-+"${CLI}" -p "${PORT}" 127.0.0.1 --priority "NORMAL:-VERS-ALL:+VERS-TLS1.2:%NO_SESSION_HASH" --verify-hostname=localhost --x509cafile ${CA} --logfile="$testdir/client.log" </dev/null >/dev/null ||
-+	fail ${PID} "expected connection to succeed (4)"
-+
-+kill ${PID}
-+wait
-+
-+unset GNUTLS_SYSTEM_PRIORITY_FILE
-+unset GNUTLS_DEBUG_LEVEL
-+
-+launch_server --echo --priority "NORMAL:-VERS-ALL:+VERS-TLS1.2" --x509keyfile ${KEY} --x509certfile ${CERT}
-+PID=$!
-+wait_server ${PID}
-+
-+export GNUTLS_SYSTEM_PRIORITY_FILE="$testdir/require.cfg"
-+export GNUTLS_DEBUG_LEVEL=3
-+
-+"${CLI}" -p "${PORT}" 127.0.0.1 --priority "NORMAL:-VERS-ALL:+VERS-TLS1.2" --verify-hostname=localhost --x509cafile ${CA} --logfile="$testdir/client.log" </dev/null >/dev/null ||
-+	fail ${PID} "expected connection to succeed (5)"
-+
-+# "tls-session-hash" has precedence over %NO_SESSION_HASH
-+"${CLI}" -p "${PORT}" 127.0.0.1 --priority "NORMAL:-VERS-ALL:+VERS-TLS1.2:%NO_SESSION_HASH" --verify-hostname=localhost --x509cafile ${CA} --logfile="$testdir/client.log" </dev/null >/dev/null ||
-+	fail ${PID} "expected connection to succeed (6)"
-+
-+kill ${PID}
-+wait
-+
-+unset GNUTLS_SYSTEM_PRIORITY_FILE
-+unset GNUTLS_DEBUG_LEVEL
-+
-+export GNUTLS_SYSTEM_PRIORITY_FILE="$testdir/require.cfg"
-+
-+# "tls-session-hash" has precedence over %NO_SESSION_HASH
-+launch_server --echo --priority "NORMAL:-VERS-ALL:+VERS-TLS1.2:%NO_SESSION_HASH" --x509keyfile ${KEY} --x509certfile ${CERT}
-+PID=$!
-+wait_server ${PID}
-+
-+"${CLI}" -p "${PORT}" 127.0.0.1 --priority "NORMAL:-VERS-ALL:+VERS-TLS1.2" --verify-hostname=localhost --x509cafile ${CA} --logfile="$testdir/client.log" </dev/null >/dev/null ||
-+	fail ${PID} "expected connection to succeed (7)"
-+
-+# "tls-session-hash" has precedence over %NO_SESSION_HASH
-+"${CLI}" -p "${PORT}" 127.0.0.1 --priority "NORMAL:-VERS-ALL:+VERS-TLS1.2:%NO_SESSION_HASH" --verify-hostname=localhost --x509cafile ${CA} --logfile="$testdir/client.log" </dev/null >/dev/null ||
-+	fail ${PID} "expected connection to succeed (8)"
-+
-+kill ${PID}
-+wait
-+
-+rm -rf "$testdir"
-diff --git a/tests/tls-force-ems.c b/tests/tls-force-ems.c
-new file mode 100644
-index 0000000..35e7010
--- /dev/null
-+++ b/tests/tls-force-ems.c
-@@ -0,0 +1,148 @@
-+/*
-+ * Copyright (C) 2023 Red Hat, Inc.
-+ *
-+ * Author: Daiki Ueno
-+ *
-+ * This file is part of GnuTLS.
-+ *
-+ * GnuTLS is free software; you can redistribute it and/or modify it
-+ * under the terms of the GNU General Public License as published by
-+ * the Free Software Foundation; either version 3 of the License, or
-+ * (at your option) any later version.
-+ *
-+ * GnuTLS is distributed in the hope that it will be useful, but
-+ * WITHOUT ANY WARRANTY; without even the implied warranty of
-+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-+ * General Public License for more details.
-+ *
-+ * You should have received a copy of the GNU Lesser General Public License
-+ * along with this program.  If not, see <https://www.gnu.org/licenses/>
-+ */
-+
-+#ifdef HAVE_CONFIG_H
-+# include <config.h>
-+#endif
-+
-+#include <stdio.h>
-+#include <stdlib.h>
-+
-+#include "utils.h"
-+#include "cert-common.h"
-+#include "eagain-common.h"
-+
-+/* This program tests whether forced extended master secret is
-+ * negotiated as expected.
-+ */
-+
-+const char *side;
-+
-+static void tls_log_func(int level, const char *str)
-+{
-+	fprintf(stderr, "%s|<%d>| %s", side, level, str);
-+}
-+
-+static void
-+try(const char *name, const char *sprio, const char *cprio, int serr, int cerr)
-+{
-+	int sret, cret;
-+	gnutls_certificate_credentials_t scred, ccred;
-+	gnutls_session_t server, client;
-+
-+	success("Running %s\n", name);
-+
-+	assert(gnutls_certificate_allocate_credentials(&scred) >= 0);
-+
-+	assert(gnutls_certificate_set_x509_key_mem
-+	       (scred, &server_ca3_localhost_cert,
-+		&server_ca3_key, GNUTLS_X509_FMT_PEM) >= 0);
-+
-+	assert(gnutls_certificate_allocate_credentials(&ccred) >= 0);
-+
-+	assert(gnutls_certificate_set_x509_trust_mem
-+	       (ccred, &ca3_cert, GNUTLS_X509_FMT_PEM) >= 0);
-+
-+	assert(gnutls_init(&server, GNUTLS_SERVER) >= 0);
-+	assert(gnutls_init(&client, GNUTLS_CLIENT) >= 0);
-+
-+	gnutls_credentials_set(server, GNUTLS_CRD_CERTIFICATE, scred);
-+	gnutls_credentials_set(client, GNUTLS_CRD_CERTIFICATE, ccred);
-+
-+	gnutls_transport_set_push_function(server, server_push);
-+	gnutls_transport_set_pull_function(server, server_pull);
-+	gnutls_transport_set_ptr(server, server);
-+	assert(gnutls_priority_set_direct(server, sprio, 0) >= 0);
-+
-+	gnutls_transport_set_push_function(client, client_push);
-+	gnutls_transport_set_pull_function(client, client_pull);
-+	gnutls_transport_set_ptr(client, client);
-+	assert(gnutls_priority_set_direct(client, cprio, 0) >= 0);
-+
-+	HANDSHAKE_EXPECT(client, server, cerr, serr);
-+
-+	gnutls_deinit(server);
-+	gnutls_deinit(client);
-+	gnutls_certificate_free_credentials(scred);
-+	gnutls_certificate_free_credentials(ccred);
-+
-+	reset_buffers();
-+}
-+
-+#define AES_GCM "NORMAL:-VERS-ALL:+VERS-TLS1.2"
-+
-+void doit(void)
-+{
-+	gnutls_fips140_context_t fips_context;
-+
-+	global_init();
-+
-+	/* General init. */
-+	gnutls_global_set_log_function(tls_log_func);
-+	if (debug)
-+		gnutls_global_set_log_level(2);
-+
-+	assert(gnutls_fips140_context_init(&fips_context) >= 0);
-+
-+	/* Default: EMS is requested in non-FIPS mode, while it is
-+	 * required in FIPS mode.
-+	 */
-+	FIPS_PUSH_CONTEXT();
-+	try("default", AES_GCM, AES_GCM, 0, 0);
-+	FIPS_POP_CONTEXT(APPROVED);
-+
-+	FIPS_PUSH_CONTEXT();
-+	try("both force EMS", AES_GCM ":%FORCE_SESSION_HASH",
-+	    AES_GCM ":%FORCE_SESSION_HASH", 0, 0);
-+	FIPS_POP_CONTEXT(APPROVED);
-+
-+	if (gnutls_fips140_mode_enabled()) {
-+		try("neither negotiates EMS", AES_GCM ":%NO_SESSION_HASH",
-+		    AES_GCM ":%NO_SESSION_HASH", GNUTLS_E_INSUFFICIENT_SECURITY,
-+		    GNUTLS_E_AGAIN);
-+	} else {
-+		try("neither negotiates EMS", AES_GCM ":%NO_SESSION_HASH",
-+		    AES_GCM ":%NO_SESSION_HASH", 0, 0);
-+	}
-+	/* Note that the error codes are swapped based on FIPS mode:
-+	 * in FIPS mode, the server doesn't send the extension which
-+	 * causes the client to not send the one either, and then the
-+	 * server doesn't like the situation.  On the other hand, in
-+	 * non-FIPS mode, it's the client to decide to abort the
-+	 * connection.
-+	 */
-+	if (gnutls_fips140_mode_enabled()) {
-+		try("server doesn't negotiate EMS, client forces EMS",
-+		    AES_GCM ":%NO_SESSION_HASH", AES_GCM ":%FORCE_SESSION_HASH",
-+		    GNUTLS_E_INSUFFICIENT_SECURITY, GNUTLS_E_AGAIN);
-+	} else {
-+		try("server doesn't negotiate EMS, client forces EMS",
-+		    AES_GCM ":%NO_SESSION_HASH", AES_GCM ":%FORCE_SESSION_HASH",
-+		    GNUTLS_E_AGAIN, GNUTLS_E_INSUFFICIENT_SECURITY);
-+	}
-+	try("server forces EMS, client doesn't negotiate EMS",
-+	    AES_GCM ":%FORCE_SESSION_HASH", AES_GCM ":%NO_SESSION_HASH",
-+	    GNUTLS_E_INSUFFICIENT_SECURITY, GNUTLS_E_AGAIN);
-+
-+	gnutls_fips140_context_deinit(fips_context);
-+
-+	gnutls_global_deinit();
-+}
-- 
-2.41.0
-
--- a/SOURCES/gnutls-3.7.6-fips-integrity-zeroize.patch
+++ b/SOURCES/gnutls-3.7.6-fips-integrity-zeroize.patch
@ -1,40 +0,0 @@
-From 65911d48d49116a6ba49402824864e5f2f3ac1e1 Mon Sep 17 00:00:00 2001
-From: Clemens Lang <cllang@redhat.com>
-Date: Fri, 12 Jan 2024 11:12:14 +0100
-Subject: [PATCH] fips: Zeroize temporary values
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-The standard says "temporary value(s) generated during the integrity
-test of the module's software […] shall be zeroised from the module upon
-completion of the integrity test".
-
-That includes the computed HMAC value, which is currently not zeroized
-after the test. Add explicit calls to gnutls_memset() to fix that.
-
-Signed-off-by: Clemens Lang <cllang@redhat.com>
---
- lib/fips.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/lib/fips.c b/lib/fips.c
-index e9c27f6df6..8f4ff22fb9 100644
--- a/lib/fips.c
-+++ b/lib/fips.c
-@@ -380,10 +380,12 @@ static int check_lib_hmac(struct hmac_entry *entry,
- 
- 	if (gnutls_memcmp(entry->hmac, hmac, HMAC_SIZE)) {
- 		_gnutls_debug_log("Calculated MAC for %s does not match\n", path);
-+		gnutls_memset(hmac, 0, HMAC_SIZE);
- 		return gnutls_assert_val(GNUTLS_E_PARSING_ERROR);
- 	}
- 	_gnutls_debug_log("Successfully verified MAC for %s\n", path);
- 
-+	gnutls_memset(hmac, 0, HMAC_SIZE);
- 	return 0;
- }
- 
-- 
-2.43.0
-
--- a/SOURCES/gnutls-3.7.6-fips-pkcs12-des-cbc.patch
+++ b/SOURCES/gnutls-3.7.6-fips-pkcs12-des-cbc.patch
@ -1,58 +0,0 @@
-From de09280b2a8314eb98ec9a2b84eebe3eec2f49bd Mon Sep 17 00:00:00 2001
-From: Daiki Ueno <ueno@gnu.org>
-Date: Thu, 4 Aug 2022 16:37:51 +0900
-Subject: [PATCH] _gnutls_decrypt_pbes1_des_md5_data: use public crypto API
-
-This is a follow-up of e7f9267342bc2231149a640163c82b63c86f1dfd.  In
-the decryption code path with PBES1, algorithm checks for FIPS was not
-applied, because it used internal functions that bypass those checks.
-
-Signed-off-by: Daiki Ueno <ueno@gnu.org>
---
- lib/x509/privkey_pkcs8_pbes1.c | 10 ++++------
- 1 file changed, 4 insertions(+), 6 deletions(-)
-
-diff --git a/lib/x509/privkey_pkcs8_pbes1.c b/lib/x509/privkey_pkcs8_pbes1.c
-index c296807974..983530e46a 100644
--- a/lib/x509/privkey_pkcs8_pbes1.c
-+++ b/lib/x509/privkey_pkcs8_pbes1.c
-@@ -140,7 +140,7 @@ _gnutls_decrypt_pbes1_des_md5_data(const char *password,
- {
- 	int result;
- 	gnutls_datum_t dkey, d_iv;
-	cipher_hd_st ch;
-+	gnutls_cipher_hd_t ch;
- 	uint8_t key[16];
- 	const unsigned block_size = 8;
- 
-@@ -158,16 +158,14 @@ _gnutls_decrypt_pbes1_des_md5_data(const char *password,
- 	dkey.size = 8;
- 	d_iv.data = &key[8];
- 	d_iv.size = 8;
-	result =
-	    _gnutls_cipher_init(&ch, cipher_to_entry(GNUTLS_CIPHER_DES_CBC),
-				&dkey, &d_iv, 0);
-+	result = gnutls_cipher_init(&ch, GNUTLS_CIPHER_DES_CBC, &dkey, &d_iv);
- 	if (result < 0) {
- 		_gnutls_switch_fips_state(GNUTLS_FIPS140_OP_ERROR);
- 		return gnutls_assert_val(result);
- 	}
- 	_gnutls_switch_fips_state(GNUTLS_FIPS140_OP_NOT_APPROVED);
- 
-	result = _gnutls_cipher_decrypt(&ch, encrypted_data->data, encrypted_data->size);
-+	result = gnutls_cipher_decrypt(ch, encrypted_data->data, encrypted_data->size);
- 	if (result < 0) {
- 		gnutls_assert();
- 		goto error;
-@@ -184,7 +182,7 @@ _gnutls_decrypt_pbes1_des_md5_data(const char *password,
- 
- 	result = 0;
-  error:
-	_gnutls_cipher_deinit(&ch);
-+	gnutls_cipher_deinit(ch);
- 
- 	return result;
- }
-- 
-2.37.1
-
--- a/SOURCES/gnutls-3.7.6-fips-rsa-key-sizes.patch
+++ b/SOURCES/gnutls-3.7.6-fips-rsa-key-sizes.patch
@ -1,476 +0,0 @@
-From 237695d30c9f716333cfa077554a6e1ae0d2c589 Mon Sep 17 00:00:00 2001
-From: rpm-build <rpm-build>
-Date: Sat, 20 Aug 2022 09:52:08 +0900
-Subject: [PATCH] gnutls-3.7.6-fips-rsa-key-sizes.patch
-
---
- lib/nettle/pk.c        |  54 ++++---
- tests/Makefile.am      |   3 +-
- tests/fips-rsa-sizes.c | 328 +++++++++++++++++++++++++++++++++++++++++
- 3 files changed, 361 insertions(+), 24 deletions(-)
- create mode 100644 tests/fips-rsa-sizes.c
-
-diff --git a/lib/nettle/pk.c b/lib/nettle/pk.c
-index eba246f..f38016b 100644
--- a/lib/nettle/pk.c
-+++ b/lib/nettle/pk.c
-@@ -1247,20 +1247,20 @@ _wrap_nettle_pk_sign(gnutls_pk_algorithm_t algo,
- 
- 			_rsa_params_to_privkey(pk_params, &priv);
- 
-			/* RSA key size should be 2048-bit or larger in FIPS
-			 * 140-3.  In addition to this, only SHA-2 is allowed
-			 * for SigGen; it is checked in pk_prepare_hash lib/pk.c
-			 */
-			if (unlikely(priv.size < 256)) {
-				not_approved = true;
-			}
-
- 			ret = _rsa_params_to_pubkey(pk_params, &pub);
- 			if (ret < 0) {
- 				gnutls_assert();
- 				goto cleanup;
- 			}
- 
-+			/* RSA modulus size should be 2048-bit or larger in FIPS
-+			 * 140-3.  In addition to this, only SHA-2 is allowed
-+			 * for SigGen; it is checked in pk_prepare_hash lib/pk.c
-+			 */
-+			if (unlikely(mpz_sizeinbase(pub.n, 2) < 2048)) {
-+				not_approved = true;
-+			}
-+
- 			mpz_init(s);
- 
- 			if (_gnutls_get_lib_state() == LIB_STATE_SELFTEST)
-@@ -1298,22 +1298,22 @@ _wrap_nettle_pk_sign(gnutls_pk_algorithm_t algo,
- 
- 			_rsa_params_to_privkey(pk_params, &priv);
- 
-			/* RSA key size should be 2048-bit or larger in FIPS
-+			ret = _rsa_params_to_pubkey(pk_params, &pub);
-+			if (ret < 0) {
-+				gnutls_assert();
-+				goto cleanup;
-+			}
-+
-+			/* RSA modulus size should be 2048-bit or larger in FIPS
- 			 * 140-3.  In addition to this, only SHA-2 is allowed
- 			 * for SigGen; however, Nettle only support SHA256,
- 			 * SHA384, and SHA512 for RSA-PSS (see
- 			 * _rsa_pss_sign_digest_tr in this file for details).
- 			 */
-			if (unlikely(priv.size < 256)) {
-+			if (unlikely(mpz_sizeinbase(pub.n, 2) < 2048)) {
- 				not_approved = true;
- 			}
- 
-			ret = _rsa_params_to_pubkey(pk_params, &pub);
-			if (ret < 0) {
-				gnutls_assert();
-				goto cleanup;
-			}
-
- 			mpz_init(s);
- 
- 			ret =
-@@ -1643,6 +1643,7 @@ _wrap_nettle_pk_verify(gnutls_pk_algorithm_t algo,
- 	case GNUTLS_PK_RSA:
- 		{
- 			struct rsa_public_key pub;
-+			size_t bits;
- 
- 			ret = _rsa_params_to_pubkey(pk_params, &pub);
- 			if (ret < 0) {
-@@ -1650,12 +1651,19 @@ _wrap_nettle_pk_verify(gnutls_pk_algorithm_t algo,
- 				goto cleanup;
- 			}
- 
-			/* RSA key size should be 2048-bit or larger in FIPS
-			 * 140-3.  In addition to this, only SHA-1 and SHA-2 are
-			 * allowed for SigVer; it is checked in
-			 * _pkcs1_rsa_verify_sig in lib/pubkey.c
-+			bits = mpz_sizeinbase(pub.n, 2);
-+
-+			/* In FIPS 140-3, RSA key size should be larger than
-+			 * 2048-bit or one of the known lengths (1024, 1280,
-+			 * 1536, 1792; i.e., multiple of 256-bits).
-+			 *
-+			 * In addition to this, only SHA-1 and SHA-2 are allowed
-+			 * for SigVer; it is checked in _pkcs1_rsa_verify_sig in
-+			 * lib/pubkey.c.
- 			 */
-			if (unlikely(pub.size < 256)) {
-+			if (unlikely(bits < 2048 &&
-+				     bits != 1024 && bits != 1280 &&
-+				     bits != 1536 && bits != 1792)) {
- 				not_approved = true;
- 			}
- 
-@@ -1701,13 +1709,13 @@ _wrap_nettle_pk_verify(gnutls_pk_algorithm_t algo,
- 				goto cleanup;
- 			}
- 
-			/* RSA key size should be 2048-bit or larger in FIPS
-+			/* RSA modulus size should be 2048-bit or larger in FIPS
- 			 * 140-3.  In addition to this, only SHA-1 and SHA-2 are
- 			 * allowed for SigVer, while Nettle only supports
- 			 * SHA256, SHA384, and SHA512 for RSA-PSS (see
- 			 * _rsa_pss_verify_digest in this file for the details).
- 			 */
-			if (unlikely(pub.size < 256)) {
-+			if (unlikely(mpz_sizeinbase(pub.n, 2) < 2048)) {
- 				not_approved = true;
- 			}
- 
-diff --git a/tests/Makefile.am b/tests/Makefile.am
-index 7a7a4af..dd21e45 100644
--- a/tests/Makefile.am
-+++ b/tests/Makefile.am
-@@ -233,7 +233,8 @@ ctests += mini-record-2 simple gnutls_hmac_fast set_pkcs12_cred cert certuniquei
- 	 tls13-without-timeout-func buffer status-request-revoked \
- 	 set_x509_ocsp_multi_cli kdf-api keylog-func handshake-write \
- 	 x509cert-dntypes id-on-xmppAddr tls13-compat-mode ciphersuite-name \
-	 x509-upnconstraint pkcs7-verify-double-free
-+	 x509-upnconstraint pkcs7-verify-double-free \
-+	 fips-rsa-sizes
- 
- ctests += tls-channel-binding
- 
-diff --git a/tests/fips-rsa-sizes.c b/tests/fips-rsa-sizes.c
-new file mode 100644
-index 0000000..84b9aff
--- /dev/null
-+++ b/tests/fips-rsa-sizes.c
-@@ -0,0 +1,328 @@
-+/*
-+ * Copyright (C) 2022 Red Hat, Inc.
-+ *
-+ * Author: Alexander Sosedkin
-+ *
-+ * This file is part of GnuTLS.
-+ *
-+ * GnuTLS is free software; you can redistribute it and/or modify it
-+ * under the terms of the GNU General Public License as published by
-+ * the Free Software Foundation; either version 3 of the License, or
-+ * (at your option) any later version.
-+ *
-+ * GnuTLS is distributed in the hope that it will be useful, but
-+ * WITHOUT ANY WARRANTY; without even the implied warranty of
-+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-+ * General Public License for more details.
-+ *
-+ * You should have received a copy of the GNU General Public License
-+ * along with GnuTLS; if not, write to the Free Software Foundation,
-+ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
-+ */
-+
-+#include <assert.h>
-+#include <stdio.h>
-+#include <utils.h>
-+#include <gnutls/gnutls.h>
-+#include <gnutls/abstract.h>
-+#include <gnutls/x509.h>
-+
-+#define FIPS_PUSH_CONTEXT() do {				\
-+	ret = gnutls_fips140_push_context(fips_context);	\
-+	if (ret < 0) {						\
-+		fail("gnutls_fips140_push_context failed\n");	\
-+	}							\
-+} while (0)
-+
-+#define FIPS_POP_CONTEXT(state) do {					\
-+	ret = gnutls_fips140_pop_context();				\
-+	if (ret < 0) {							\
-+		fail("gnutls_fips140_context_pop failed\n");		\
-+	}								\
-+	fips_state = gnutls_fips140_get_operation_state(fips_context);	\
-+	if (fips_state != GNUTLS_FIPS140_OP_ ## state) {		\
-+		fail("operation state is not " # state " (%d)\n",	\
-+		     fips_state);					\
-+	}								\
-+} while (0)
-+
-+
-+void generate_successfully(gnutls_privkey_t* privkey, gnutls_pubkey_t* pubkey,
-+                           unsigned int size);
-+void generate_unsuccessfully(gnutls_privkey_t* privkey, gnutls_pubkey_t* pubkey,
-+                             unsigned int size);
-+void sign_verify_successfully(gnutls_privkey_t privkey, gnutls_pubkey_t pubkey);
-+void sign_verify_unsuccessfully(gnutls_privkey_t privkey,
-+                                gnutls_pubkey_t pubkey);
-+void nosign_verify(gnutls_privkey_t privkey, gnutls_pubkey_t pubkey);
-+
-+
-+void generate_successfully(gnutls_privkey_t* privkey, gnutls_pubkey_t* pubkey,
-+                           unsigned int size)
-+{
-+	int ret;
-+	gnutls_x509_privkey_t xprivkey;
-+	gnutls_fips140_context_t fips_context;
-+	gnutls_fips140_operation_state_t fips_state;
-+	assert(gnutls_fips140_context_init(&fips_context) == 0);
-+
-+	fprintf(stderr, "%d-bit\n", size);
-+
-+	/* x509 generation as well just because why not */
-+	FIPS_PUSH_CONTEXT();
-+	assert(gnutls_x509_privkey_init(&xprivkey) == 0);
-+	ret = gnutls_x509_privkey_generate(xprivkey, GNUTLS_PK_RSA, size, 0);
-+	if (ret != GNUTLS_E_SUCCESS)
-+		fail("%d-bit x509_privkey_init (%d)\n", size, ret);
-+	FIPS_POP_CONTEXT(APPROVED);
-+	gnutls_x509_privkey_deinit(xprivkey);
-+
-+	FIPS_PUSH_CONTEXT();
-+	assert(gnutls_privkey_init(privkey) == 0);
-+	ret = gnutls_privkey_generate(*privkey, GNUTLS_PK_RSA, size, 0);
-+	if (ret != GNUTLS_E_SUCCESS)
-+		fail("%d-bit privkey_init (%d)\n", size, ret);
-+	FIPS_POP_CONTEXT(APPROVED);
-+
-+	assert(gnutls_pubkey_init(pubkey) == 0);
-+	FIPS_PUSH_CONTEXT();
-+	ret = gnutls_pubkey_import_privkey(*pubkey, *privkey,
-+					   GNUTLS_KEY_DIGITAL_SIGNATURE, 0);
-+	if (ret != GNUTLS_E_SUCCESS)
-+		fail("%d-bit pubkey_import_privkey (%d)\n", size, ret);
-+	FIPS_POP_CONTEXT(INITIAL);
-+
-+	gnutls_fips140_context_deinit(fips_context);
-+}
-+
-+
-+void generate_unsuccessfully(gnutls_privkey_t* privkey, gnutls_pubkey_t* pubkey,
-+                             unsigned int size)
-+{
-+	int ret;
-+	gnutls_x509_privkey_t xprivkey;
-+	gnutls_fips140_context_t fips_context;
-+	gnutls_fips140_operation_state_t fips_state;
-+	assert(gnutls_fips140_context_init(&fips_context) == 0);
-+
-+	fprintf(stderr, "%d-bit\n", size);
-+
-+	/* short x509 generation: ERROR, blocked */
-+	FIPS_PUSH_CONTEXT();
-+	assert(gnutls_x509_privkey_init(&xprivkey) == 0);
-+	ret = gnutls_x509_privkey_generate(xprivkey, GNUTLS_PK_RSA, size, 0);
-+	if (ret != GNUTLS_E_PK_GENERATION_ERROR)
-+		fail("%d-bit x509_privkey_init (%d)\n", size, ret);
-+	FIPS_POP_CONTEXT(ERROR);
-+	gnutls_x509_privkey_deinit(xprivkey);
-+
-+	/* short key generation: ERROR, blocked */
-+	FIPS_PUSH_CONTEXT();
-+	assert(gnutls_privkey_init(privkey) == 0);
-+	ret = gnutls_privkey_generate(*privkey, GNUTLS_PK_RSA, size, 0);
-+	if (ret != GNUTLS_E_PK_GENERATION_ERROR)
-+		fail("%d-bit privkey_init (%d)\n", size, ret);
-+	FIPS_POP_CONTEXT(ERROR);
-+	gnutls_privkey_deinit(*privkey);
-+
-+	/* Disable FIPS to generate them anyway */
-+	gnutls_fips140_set_mode(GNUTLS_FIPS140_LAX, 0);
-+	assert(gnutls_fips140_mode_enabled() == GNUTLS_FIPS140_LAX);
-+
-+	assert(gnutls_x509_privkey_init(&xprivkey) == 0);
-+	ret = gnutls_x509_privkey_generate(xprivkey, GNUTLS_PK_RSA, size, 0);
-+	if (ret != GNUTLS_E_SUCCESS)
-+		fail("%d-bit x509_privkey_init (%d)\n", size, ret);
-+	gnutls_x509_privkey_deinit(xprivkey);
-+
-+	assert(gnutls_privkey_init(privkey) == 0);
-+	ret = gnutls_privkey_generate(*privkey, GNUTLS_PK_RSA, size, 0);
-+	if (ret != GNUTLS_E_SUCCESS)
-+		fail("%d-bit privkey_init (%d)\n", size, ret);
-+
-+	assert(gnutls_pubkey_init(pubkey) == 0);
-+	ret = gnutls_pubkey_import_privkey(*pubkey, *privkey,
-+					   GNUTLS_KEY_DIGITAL_SIGNATURE, 0);
-+	if (ret != GNUTLS_E_SUCCESS)
-+		fail("%d-bit pubkey_import_privkey (%d)\n", size, ret);
-+
-+	gnutls_fips140_set_mode(GNUTLS_FIPS140_STRICT, 0);
-+	assert(gnutls_fips140_mode_enabled());
-+
-+	gnutls_fips140_context_deinit(fips_context);
-+}
-+
-+
-+void sign_verify_successfully(gnutls_privkey_t privkey, gnutls_pubkey_t pubkey) {
-+	int ret;
-+	gnutls_fips140_context_t fips_context;
-+	gnutls_fips140_operation_state_t fips_state;
-+
-+	gnutls_datum_t signature;
-+	gnutls_datum_t plaintext = {
-+		.data = (unsigned char* const) "Hello world!",
-+		.size = 12
-+	};
-+	assert(gnutls_fips140_context_init(&fips_context) == 0);
-+
-+	/* RSA sign: approved */
-+	FIPS_PUSH_CONTEXT();
-+	ret = gnutls_privkey_sign_data(privkey, GNUTLS_DIG_SHA256, 0,
-+	                               &plaintext, &signature);
-+	if (ret < 0)
-+		fail("gnutls_privkey_sign_data failed\n");
-+	FIPS_POP_CONTEXT(APPROVED);
-+
-+	/* RSA verify: approved */
-+	FIPS_PUSH_CONTEXT();
-+	ret = gnutls_pubkey_verify_data2(pubkey, GNUTLS_SIGN_RSA_SHA256, 0,
-+	                                 &plaintext, &signature);
-+	if (ret < 0)
-+		fail("gnutls_pubkey_verify_data2 failed\n");
-+	FIPS_POP_CONTEXT(APPROVED);
-+
-+	gnutls_free(signature.data);
-+	gnutls_fips140_context_deinit(fips_context);
-+}
-+
-+
-+void sign_verify_unsuccessfully(gnutls_privkey_t privkey,
-+                                gnutls_pubkey_t pubkey) {
-+	int ret;
-+	gnutls_fips140_context_t fips_context;
-+	gnutls_fips140_operation_state_t fips_state;
-+
-+	gnutls_datum_t signature;
-+	gnutls_datum_t plaintext = {
-+		.data = (unsigned char* const) "Hello world!",
-+		.size = 12
-+	};
-+	assert(gnutls_fips140_context_init(&fips_context) == 0);
-+
-+	/* small key RSA sign: not approved */
-+	FIPS_PUSH_CONTEXT();
-+	ret = gnutls_privkey_sign_data(privkey, GNUTLS_DIG_SHA256, 0,
-+	                               &plaintext, &signature);
-+	if (ret < 0)
-+		fail("gnutls_privkey_sign_data failed\n");
-+	FIPS_POP_CONTEXT(NOT_APPROVED);
-+
-+	/* small key RSA verify: not approved */
-+	FIPS_PUSH_CONTEXT();
-+	ret = gnutls_pubkey_verify_data2(pubkey, GNUTLS_SIGN_RSA_SHA256, 0,
-+	                                 &plaintext, &signature);
-+	if (ret < 0)
-+		fail("gnutls_pubkey_verify_data2 failed\n");
-+	FIPS_POP_CONTEXT(NOT_APPROVED);
-+
-+	gnutls_free(signature.data);
-+	gnutls_pubkey_deinit(pubkey);
-+	gnutls_privkey_deinit(privkey);
-+	gnutls_fips140_context_deinit(fips_context);
-+}
-+
-+
-+void nosign_verify(gnutls_privkey_t privkey, gnutls_pubkey_t pubkey) {
-+	int ret;
-+	gnutls_fips140_context_t fips_context;
-+	gnutls_fips140_operation_state_t fips_state;
-+
-+	gnutls_datum_t signature;
-+	gnutls_datum_t plaintext = {
-+		.data = (unsigned char* const) "Hello world!",
-+		.size = 12
-+	};
-+	assert(gnutls_fips140_context_init(&fips_context) == 0);
-+
-+	/* 1024, 1280, 1536, 1792 key RSA sign: not approved */
-+	FIPS_PUSH_CONTEXT();
-+	ret = gnutls_privkey_sign_data(privkey, GNUTLS_DIG_SHA256, 0,
-+	                               &plaintext, &signature);
-+	if (ret < 0)
-+		fail("gnutls_privkey_sign_data failed\n");
-+	FIPS_POP_CONTEXT(NOT_APPROVED);
-+
-+	/* Disable FIPS to sign them anyway */
-+	gnutls_fips140_set_mode(GNUTLS_FIPS140_LAX, 0);
-+	assert(gnutls_fips140_mode_enabled() == GNUTLS_FIPS140_LAX);
-+
-+	ret = gnutls_privkey_sign_data(privkey, GNUTLS_DIG_SHA256, 0,
-+	                               &plaintext, &signature);
-+	if (ret < 0)
-+		fail("gnutls_privkey_sign_data failed\n");
-+
-+	gnutls_fips140_set_mode(GNUTLS_FIPS140_STRICT, 0);
-+	assert(gnutls_fips140_mode_enabled());
-+
-+	/* 1024, 1280, 1536, 1792 key RSA verify: approved (exception) */
-+	FIPS_PUSH_CONTEXT();
-+	ret = gnutls_pubkey_verify_data2(pubkey, GNUTLS_SIGN_RSA_SHA256, 0,
-+	                                 &plaintext, &signature);
-+	if (ret < 0)
-+		fail("gnutls_pubkey_verify_data2 failed\n");
-+	FIPS_POP_CONTEXT(APPROVED);
-+
-+	gnutls_free(signature.data);
-+	gnutls_pubkey_deinit(pubkey);
-+	gnutls_privkey_deinit(privkey);
-+	gnutls_fips140_context_deinit(fips_context);
-+}
-+
-+
-+void doit(void)
-+{
-+	gnutls_fips140_context_t fips_context;
-+	gnutls_privkey_t privkey;
-+	gnutls_pubkey_t pubkey;
-+
-+	if (gnutls_fips140_mode_enabled() == 0) {
-+		success("We are not in FIPS140 mode\n");
-+		exit(77);  /* SKIP */
-+	}
-+
-+	assert(gnutls_fips140_context_init(&fips_context) == 0);
-+
-+	/* 512-bit RSA: no generate, no sign, no verify */
-+	generate_unsuccessfully(&privkey, &pubkey, 512);
-+	sign_verify_unsuccessfully(privkey, pubkey);
-+	/* 512-bit RSA again (to be safer about going in and out of FIPS) */
-+	generate_unsuccessfully(&privkey, &pubkey, 512);
-+	sign_verify_unsuccessfully(privkey, pubkey);
-+	/* 600-bit RSA: no generate, no sign, no verify */
-+	generate_unsuccessfully(&privkey, &pubkey, 600);
-+	sign_verify_unsuccessfully(privkey, pubkey);
-+
-+	/* 768-bit RSA not-an-exception: nogenerate, nosign, verify */
-+	generate_unsuccessfully(&privkey, &pubkey, 768);
-+	sign_verify_unsuccessfully(privkey, pubkey);
-+	/* 1024-bit RSA exception: nogenerate, nosign, verify */
-+	generate_unsuccessfully(&privkey, &pubkey, 1024);
-+	nosign_verify(privkey, pubkey);
-+	/* 1280-bit RSA exception: nogenerate, nosign, verify */
-+	generate_unsuccessfully(&privkey, &pubkey, 1280);
-+	nosign_verify(privkey, pubkey);
-+	/* 1500-bit RSA not-an-exception: nogenerate, nosign, noverify */
-+	generate_unsuccessfully(&privkey, &pubkey, 1500);
-+	sign_verify_unsuccessfully(privkey, pubkey);
-+	/* 1536-bit RSA exception: nogenerate, nosign, verify */
-+	generate_unsuccessfully(&privkey, &pubkey, 1536);
-+	nosign_verify(privkey, pubkey);
-+	/* 1792-bit RSA exception: nogenerate, nosign, verify */
-+	generate_unsuccessfully(&privkey, &pubkey, 1792);
-+	nosign_verify(privkey, pubkey);
-+	/* 2000-bit RSA not-an-exception: nogenerate, nosign, noverify */
-+	generate_unsuccessfully(&privkey, &pubkey, 2000);
-+	sign_verify_unsuccessfully(privkey, pubkey);
-+
-+	/* 2048-bit RSA: generate, sign, verify */
-+	generate_successfully(&privkey, &pubkey, 2048);
-+	sign_verify_successfully(privkey, pubkey);
-+	/* 2432-bit RSA: nogenerate, sign, verify */
-+	generate_unsuccessfully(&privkey, &pubkey, 2432);
-+	sign_verify_successfully(privkey, pubkey);
-+	/* 3072-bit RSA: generate, sign, verify */
-+	generate_successfully(&privkey, &pubkey, 3072);
-+	sign_verify_successfully(privkey, pubkey);
-+
-+	gnutls_fips140_context_deinit(fips_context);
-+}
-- 
-2.37.2
-
--- a/SOURCES/gnutls-3.7.6-fips-rsa-pss-saltlen.patch
+++ b/SOURCES/gnutls-3.7.6-fips-rsa-pss-saltlen.patch
@ -1,163 +0,0 @@
-From 3bd42dc88ff062bf9ede2b593e1ad1afa6f68f62 Mon Sep 17 00:00:00 2001
-From: Daiki Ueno <ueno@gnu.org>
-Date: Wed, 16 Nov 2022 23:02:13 +0900
-Subject: [PATCH] nettle: mark non-compliant RSA-PSS salt length to be
- not-approved
-
-According to FIPS 186-5 5.4, the salt length must be in the range
-between 0 and the hash length inclusive.  While the use of those salt
-lengths is still allowed for compatibility, it is reported as
-non-approved operation through FIPS service indicator.
-
-Signed-off-by: Daiki Ueno <ueno@gnu.org>
---
- lib/nettle/pk.c     |  9 ++++++++
- tests/rsa-rsa-pss.c | 54 ++++++++++++++++++++++++++++++++++++---------
- 2 files changed, 53 insertions(+), 10 deletions(-)
-
-diff --git a/lib/nettle/pk.c b/lib/nettle/pk.c
-index c098e2aa45..7732e90542 100644
--- a/lib/nettle/pk.c
-+++ b/lib/nettle/pk.c
-@@ -1316,6 +1316,15 @@ _wrap_nettle_pk_sign(gnutls_pk_algorithm_t algo,
- 
- 			mpz_init(s);
- 
-+			me = hash_to_entry(sign_params->rsa_pss_dig);
-+
-+			/* According to FIPS 186-5 5.4, the salt length must be
-+			 * in the range between 0 and the hash length inclusive.
-+			 */
-+			if (sign_params->salt_size > _gnutls_mac_get_algo_len(me)) {
-+				not_approved = true;
-+			}
-+
- 			ret =
- 			    _rsa_pss_sign_digest_tr(sign_params->rsa_pss_dig,
- 						    &pub, &priv,
-diff --git a/tests/rsa-rsa-pss.c b/tests/rsa-rsa-pss.c
-index 19a175b722..d7799c1961 100644
--- a/tests/rsa-rsa-pss.c
-+++ b/tests/rsa-rsa-pss.c
-@@ -46,6 +46,8 @@ const gnutls_datum_t raw_data = {
- 	11
- };
- 
-+static gnutls_fips140_context_t fips_context;
-+
- static void inv_sign_check(unsigned sigalgo,
- 			   gnutls_privkey_t privkey, int exp_error)
- {
-@@ -86,13 +88,16 @@ static void inv_encryption_check(gnutls_pk_algorithm_t algorithm,
- 
- static void sign_verify_data(unsigned sigalgo, gnutls_privkey_t privkey,
- 			     unsigned int sign_flags, unsigned int verify_flags,
-			     int sign_exp_error, int verify_exp_error)
-+			     int sign_exp_error, int verify_exp_error,
-+			     gnutls_fips140_operation_state_t sign_exp_state)
- {
- 	int ret;
- 	gnutls_datum_t signature = { NULL, 0 };
- 
-+	fips_push_context(fips_context);
- 	ret = gnutls_privkey_sign_data2(privkey, sigalgo, sign_flags,
- 					&raw_data, &signature);
-+	fips_pop_context(fips_context, sign_exp_state);
- 	if (ret != sign_exp_error)
- 		fail("gnutls_x509_privkey_sign_data returned unexpected error: %s\n",
- 		     gnutls_strerror(ret));
-@@ -180,11 +185,16 @@ void doit(void)
- 	if (debug)
- 		gnutls_global_set_log_level(4711);
- 
-+	assert(gnutls_fips140_context_init(&fips_context) >= 0);
-+
- 	prepare_keys(&pkey_rsa_pss, &pkey_rsa, GNUTLS_DIG_SHA256, 32);
- 
-	sign_verify_data(GNUTLS_SIGN_RSA_PSS_SHA256, pkey_rsa_pss, 0, 0, 0, 0);
-	sign_verify_data(GNUTLS_SIGN_RSA_PSS_RSAE_SHA256, pkey_rsa, 0, 0, 0, 0);
-	sign_verify_data(GNUTLS_SIGN_RSA_PSS_SHA256, pkey_rsa, 0, 0, 0, 0);
-+	sign_verify_data(GNUTLS_SIGN_RSA_PSS_SHA256, pkey_rsa_pss, 0, 0, 0, 0,
-+			 GNUTLS_FIPS140_OP_APPROVED);
-+	sign_verify_data(GNUTLS_SIGN_RSA_PSS_RSAE_SHA256, pkey_rsa, 0, 0, 0, 0,
-+			 GNUTLS_FIPS140_OP_APPROVED);
-+	sign_verify_data(GNUTLS_SIGN_RSA_PSS_SHA256, pkey_rsa, 0, 0, 0, 0,
-+			 GNUTLS_FIPS140_OP_APPROVED);
- 
- 	if (debug)
- 		success("success signing with RSA-PSS-SHA256\n");
-@@ -213,41 +223,65 @@ void doit(void)
- 	gnutls_privkey_deinit(pkey_rsa_pss);
- 	gnutls_privkey_deinit(pkey_rsa);
- 
-+	/* Restrict key to use salt length larger than hash output
-+	 * length (not approved in FIPS).
-+	 */
-+	prepare_keys(&pkey_rsa_pss, &pkey_rsa, GNUTLS_DIG_SHA256, 33);
-+
-+	sign_verify_data(GNUTLS_SIGN_RSA_PSS_SHA256, pkey_rsa_pss, 0, 0, 0, 0,
-+			 GNUTLS_FIPS140_OP_NOT_APPROVED);
-+
-+	gnutls_privkey_deinit(pkey_rsa_pss);
-+	gnutls_privkey_deinit(pkey_rsa);
-+
- 	/* Use the mismatched salt length with the digest length */
- 	prepare_keys(&pkey_rsa_pss, &pkey_rsa, GNUTLS_DIG_SHA256, 48);
- 
- 	sign_verify_data(GNUTLS_SIGN_RSA_PSS_RSAE_SHA256, pkey_rsa_pss,
-			 0, 0, 0, 0);
-+			 0, 0, 0, 0, GNUTLS_FIPS140_OP_NOT_APPROVED);
- 	sign_verify_data(GNUTLS_SIGN_RSA_PSS_SHA256, pkey_rsa_pss,
- 			 GNUTLS_PRIVKEY_FLAG_RSA_PSS_FIXED_SALT_LENGTH,
- 			 0,
- 			 GNUTLS_E_CONSTRAINT_ERROR,
-			 0);
-+			 0,
-+			 /* The error is caught before calling the actual
-+			  * signing operation.
-+			  */
-+			 GNUTLS_FIPS140_OP_INITIAL);
- 	sign_verify_data(GNUTLS_SIGN_RSA_PSS_SHA256, pkey_rsa_pss,
- 			 0,
- 			 GNUTLS_VERIFY_RSA_PSS_FIXED_SALT_LENGTH,
- 			 0,
-			 GNUTLS_E_PK_SIG_VERIFY_FAILED);
-+			 GNUTLS_E_PK_SIG_VERIFY_FAILED,
-+			 GNUTLS_FIPS140_OP_NOT_APPROVED);
- 
- 	assert(gnutls_x509_spki_init(&spki)>=0);
- 	gnutls_x509_spki_set_rsa_pss_params(spki, GNUTLS_DIG_SHA256, 48);
- 	assert(gnutls_privkey_set_spki(pkey_rsa, spki, 0)>=0);
- 
-	sign_verify_data(GNUTLS_SIGN_RSA_PSS_RSAE_SHA256, pkey_rsa, 0, 0, 0, 0);
-+	sign_verify_data(GNUTLS_SIGN_RSA_PSS_RSAE_SHA256, pkey_rsa, 0, 0, 0, 0,
-+			 GNUTLS_FIPS140_OP_NOT_APPROVED);
- 	sign_verify_data(GNUTLS_SIGN_RSA_PSS_RSAE_SHA256, pkey_rsa,
- 			 GNUTLS_PRIVKEY_FLAG_RSA_PSS_FIXED_SALT_LENGTH,
- 			 0,
- 			 GNUTLS_E_CONSTRAINT_ERROR,
-			 0);
-+			 0,
-+			 /* The error is caught before calling the actual
-+			  * signing operation.
-+			  */
-+			 GNUTLS_FIPS140_OP_INITIAL);
- 	sign_verify_data(GNUTLS_SIGN_RSA_PSS_RSAE_SHA256, pkey_rsa,
- 			 0,
- 			 GNUTLS_VERIFY_RSA_PSS_FIXED_SALT_LENGTH,
- 			 0,
-			 GNUTLS_E_PK_SIG_VERIFY_FAILED);
-+			 GNUTLS_E_PK_SIG_VERIFY_FAILED,
-+			 GNUTLS_FIPS140_OP_NOT_APPROVED);
- 
- 	gnutls_privkey_deinit(pkey_rsa_pss);
- 	gnutls_privkey_deinit(pkey_rsa);
- 	gnutls_x509_spki_deinit(spki);
- 
-+	gnutls_fips140_context_deinit(fips_context);
-+
- 	gnutls_global_deinit();
- }
-- 
-2.38.1
-
--- a/SOURCES/gnutls-3.7.6-fips-run-selftests.patch
+++ b/SOURCES/gnutls-3.7.6-fips-run-selftests.patch
@ -1,640 +0,0 @@
-From 036fb360e5775f01ef25f5e712024a29930c462e Mon Sep 17 00:00:00 2001
-From: Daiki Ueno <ueno@gnu.org>
-Date: Fri, 3 Jun 2022 15:43:00 +0900
-Subject: [PATCH] fips: provide function to manually run FIPS self-tests
-
-FIPS140-3 IG 10.3.E Periodic Self-Testing says:
-
-  At security levels 1 and 2, acceptable means for initiating the
-  periodic self-tests include a provided service, resetting, rebooting
-  or power cycling.
-
-Neither resetting, rebooting, nor power-cycling is suitable because
-those involve operations outside of the module.  Therefore this patch
-adds a new API to manually run the substance of FIPS140 self-tests.
-
-Suggeested by Richard Costa and Stephan Mueller in:
-https://gitlab.com/gnutls/gnutls/-/issues/1364
-
-Signed-off-by: Daiki Ueno <ueno@gnu.org>
---
- NEWS                            |   5 ++
- devel/libgnutls.abignore        |   2 +
- devel/symbols.last              |   2 +
- doc/Makefile.am                 |   2 +
- doc/manpages/Makefile.am        |   1 +
- lib/fips.c                      | 139 ++++++++++++++++----------------
- lib/global.c                    |  14 +++-
- lib/includes/gnutls/gnutls.h.in |   2 +
- lib/libgnutls.map               |   8 ++
- tests/fips-test.c               |   7 ++
- 10 files changed, 110 insertions(+), 72 deletions(-)
-
-diff --git a/NEWS b/NEWS
-index 70dd8a12b5..389be8acaa 100644
--- a/NEWS
-+++ b/NEWS
-@@ -5,6 +5,11 @@ Copyright (C) 2000-2016 Free Software Foundation, Inc.
- Copyright (C) 2013-2019 Nikos Mavrogiannopoulos
- See the end for copying conditions.
- 
-+* Version 3.7.7 (unreleased)
-+
-+** API and ABI modifications:
-+gnutls_fips140_run_self_tests: New function
-+
- * Version 3.7.6 (released 2022-05-27)
- 
- ** libgnutls: Fixed invalid write when gnutls_realloc_zero()
-diff --git a/doc/Makefile.am b/doc/Makefile.am
-index d20a021d97..34ef43866c 100644
--- a/doc/Makefile.am
-+++ b/doc/Makefile.am
-@@ -1096,6 +1096,8 @@ FUNCS += functions/gnutls_fips140_pop_context
- FUNCS += functions/gnutls_fips140_pop_context.short
- FUNCS += functions/gnutls_fips140_push_context
- FUNCS += functions/gnutls_fips140_push_context.short
-+FUNCS += functions/gnutls_fips140_run_self_tests
-+FUNCS += functions/gnutls_fips140_run_self_tests.short
- FUNCS += functions/gnutls_fips140_set_mode
- FUNCS += functions/gnutls_fips140_set_mode.short
- FUNCS += functions/gnutls_get_library_config
-diff --git a/doc/manpages/Makefile.am b/doc/manpages/Makefile.am
-index d8c5f2854d..90906b0574 100644
--- a/doc/manpages/Makefile.am
-+++ b/doc/manpages/Makefile.am
-@@ -380,6 +380,7 @@ APIMANS += gnutls_fips140_get_operation_state.3
- APIMANS += gnutls_fips140_mode_enabled.3
- APIMANS += gnutls_fips140_pop_context.3
- APIMANS += gnutls_fips140_push_context.3
-+APIMANS += gnutls_fips140_run_self_tests.3
- APIMANS += gnutls_fips140_set_mode.3
- APIMANS += gnutls_get_library_config.3
- APIMANS += gnutls_get_system_config_file.3
-diff --git a/lib/fips.c b/lib/fips.c
-index e9c27f6df6..656d43e74a 100644
--- a/lib/fips.c
-+++ b/lib/fips.c
-@@ -419,8 +419,6 @@ int _gnutls_fips_perform_self_checks1(void)
- {
- 	int ret;
- 
-	_gnutls_switch_lib_state(LIB_STATE_SELFTEST);
-
- 	/* Tests the FIPS algorithms used by nettle internally.
- 	 * In our case we test AES-CBC since nettle's AES is used by
- 	 * the DRBG-AES.
-@@ -429,193 +427,153 @@ int _gnutls_fips_perform_self_checks1(void)
- 	/* ciphers - one test per cipher */
- 	ret = gnutls_cipher_self_test(0, GNUTLS_CIPHER_AES_128_CBC);
- 	if (ret < 0) {
-		gnutls_assert();
-		goto error;
-+		return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
- 	}
- 
- 	return 0;
-
-error:
-	_gnutls_switch_lib_state(LIB_STATE_ERROR);
-	_gnutls_audit_log(NULL, "FIPS140-2 self testing part1 failed\n");
-
-	return GNUTLS_E_SELF_TEST_ERROR;
- }
- 
- int _gnutls_fips_perform_self_checks2(void)
- {
- 	int ret;
- 
-	_gnutls_switch_lib_state(LIB_STATE_SELFTEST);
-
- 	/* Tests the FIPS algorithms */
- 
- 	/* ciphers - one test per cipher */
- 	ret = gnutls_cipher_self_test(0, GNUTLS_CIPHER_3DES_CBC);
- 	if (ret < 0) {
-		gnutls_assert();
-		goto error;
-+		return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
- 	}
- 
- 	ret = gnutls_cipher_self_test(0, GNUTLS_CIPHER_AES_256_CBC);
- 	if (ret < 0) {
-		gnutls_assert();
-		goto error;
-+		return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
- 	}
- 
- 	ret = gnutls_cipher_self_test(0, GNUTLS_CIPHER_AES_256_GCM);
- 	if (ret < 0) {
-		gnutls_assert();
-		goto error;
-+		return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
- 	}
- 
- 	ret = gnutls_cipher_self_test(0, GNUTLS_CIPHER_AES_256_XTS);
- 	if (ret < 0) {
-		gnutls_assert();
-		goto error;
-+		return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
- 	}
- 
- 	ret = gnutls_cipher_self_test(0, GNUTLS_CIPHER_AES_256_CFB8);
- 	if (ret < 0) {
-		gnutls_assert();
-		goto error;
-+		return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
- 	}
- 
- 	/* Digest tests */
- 	ret = gnutls_digest_self_test(0, GNUTLS_DIG_SHA3_224);
- 	if (ret < 0) {
-		gnutls_assert();
-		goto error;
-+		return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
- 	}
- 
- 	ret = gnutls_digest_self_test(0, GNUTLS_DIG_SHA3_256);
- 	if (ret < 0) {
-		gnutls_assert();
-		goto error;
-+		return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
- 	}
- 
- 	ret = gnutls_digest_self_test(0, GNUTLS_DIG_SHA3_384);
- 	if (ret < 0) {
-		gnutls_assert();
-		goto error;
-+		return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
- 	}
- 
- 	ret = gnutls_digest_self_test(0, GNUTLS_DIG_SHA3_512);
- 	if (ret < 0) {
-		gnutls_assert();
-		goto error;
-+		return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
- 	}
- 
- 	/* MAC (includes message digest test) */
- 	ret = gnutls_mac_self_test(0, GNUTLS_MAC_SHA1);
- 	if (ret < 0) {
-		gnutls_assert();
-		goto error;
-+		return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
- 	}
- 
- 	ret = gnutls_mac_self_test(0, GNUTLS_MAC_SHA224);
- 	if (ret < 0) {
-		gnutls_assert();
-		goto error;
-+		return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
- 	}
- 
- 	ret = gnutls_mac_self_test(0, GNUTLS_MAC_SHA256);
- 	if (ret < 0) {
-		gnutls_assert();
-		goto error;
-+		return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
- 	}
- 
- 	ret = gnutls_mac_self_test(0, GNUTLS_MAC_SHA384);
- 	if (ret < 0) {
-		gnutls_assert();
-		goto error;
-+		return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
- 	}
- 
- 	ret = gnutls_mac_self_test(0, GNUTLS_MAC_SHA512);
- 	if (ret < 0) {
-		gnutls_assert();
-		goto error;
-+		return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
- 	}
- 
- 	ret = gnutls_mac_self_test(0, GNUTLS_MAC_AES_CMAC_256);
- 	if (ret < 0) {
-		gnutls_assert();
-		goto error;
-+		return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
- 	}
- 
- 	/* PK */
- 	ret = gnutls_pk_self_test(0, GNUTLS_PK_RSA);
- 	if (ret < 0) {
-		gnutls_assert();
-		goto error;
-+		return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
- 	}
- 
- 	ret = gnutls_pk_self_test(0, GNUTLS_PK_DSA);
- 	if (ret < 0) {
-		gnutls_assert();
-		goto error;
-+		return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
- 	}
- 
- 	ret = gnutls_pk_self_test(0, GNUTLS_PK_EC);
- 	if (ret < 0) {
-		gnutls_assert();
-		goto error;
-+		return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
- 	}
- 
- 	ret = gnutls_pk_self_test(0, GNUTLS_PK_DH);
- 	if (ret < 0) {
-		gnutls_assert();
-		goto error;
-+		return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
- 	}
- 
- 	/* HKDF */
- 	ret = gnutls_hkdf_self_test(0, GNUTLS_MAC_SHA256);
- 	if (ret < 0) {
-		gnutls_assert();
-		goto error;
-+		return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
- 	}
- 
- 	/* PBKDF2 */
- 	ret = gnutls_pbkdf2_self_test(0, GNUTLS_MAC_SHA256);
- 	if (ret < 0) {
-		gnutls_assert();
-		goto error;
-+		return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
- 	}
- 
- 	/* TLS-PRF */
- 	ret = gnutls_tlsprf_self_test(0, GNUTLS_MAC_SHA256);
- 	if (ret < 0) {
-		gnutls_assert();
-		goto error;
-+		return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
- 	}
- 
- 	if (_gnutls_rnd_ops.self_test == NULL) {
-		gnutls_assert();
-		goto error;
-+		return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
- 	}
- 
- 	/* this does not require rng initialization */
- 	ret = _gnutls_rnd_ops.self_test();
- 	if (ret < 0) {
-		gnutls_assert();
-		goto error;
-+		return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
- 	}
- 
- 	if (_skip_integrity_checks == 0) {
- 		ret = check_binary_integrity();
- 		if (ret < 0) {
-			gnutls_assert();
-			goto error;
-+			return gnutls_assert_val(GNUTLS_E_SELF_TEST_ERROR);
- 		}
- 	}
- 
- 	return 0;
-
-error:
-	_gnutls_switch_lib_state(LIB_STATE_ERROR);
-	_gnutls_audit_log(NULL, "FIPS140-2 self testing part 2 failed\n");
-
-	return GNUTLS_E_SELF_TEST_ERROR;
- }
- #endif
- 
-@@ -894,3 +852,48 @@ _gnutls_switch_fips_state(gnutls_fips140_operation_state_t state)
- 	(void)state;
- #endif
- }
-+
-+/**
-+ * gnutls_fips140_run_self_tests:
-+ *
-+ * Manually perform the second round of the FIPS140 self-tests,
-+ * including:
-+ *
-+ * - Known answer tests (KAT) for the selected set of symmetric
-+ *   cipher, MAC, public key, KDF, and DRBG
-+ * - Library integrity checks
-+ *
-+ * Upon failure with FIPS140 mode enabled, it makes the library
-+ * unusable.  This function is not thread-safe.
-+ *
-+ * Returns: 0 upon success, a negative error code otherwise
-+ *
-+ * Since: 3.7.7
-+ */
-+int
-+gnutls_fips140_run_self_tests(void)
-+{
-+#ifdef ENABLE_FIPS140
-+	int ret;
-+	unsigned prev_lib_state;
-+
-+	/* Temporarily switch to LIB_STATE_SELFTEST as some of the
-+	 * algorithms are implemented using special constructs in
-+	 * self-tests (such as deterministic variants) */
-+	prev_lib_state = _gnutls_get_lib_state();
-+	_gnutls_switch_lib_state(LIB_STATE_SELFTEST);
-+
-+	ret = _gnutls_fips_perform_self_checks2();
-+	if (gnutls_fips140_mode_enabled() != GNUTLS_FIPS140_DISABLED &&
-+	    ret < 0) {
-+		_gnutls_switch_lib_state(LIB_STATE_ERROR);
-+		_gnutls_audit_log(NULL, "FIPS140-2 self testing part 2 failed\n");
-+	} else {
-+		/* Restore the previous library state */
-+		_gnutls_switch_lib_state(prev_lib_state);
-+	}
-+	return ret;
-+#else
-+	return 0;
-+#endif
-+}
-diff --git a/lib/global.c b/lib/global.c
-index faa7f0afb2..1b372c15bd 100644
--- a/lib/global.c
-+++ b/lib/global.c
-@@ -336,9 +336,12 @@ static int _gnutls_global_init(unsigned constructor)
- 
- 		/* first round of self checks, these are done on the
- 		 * nettle algorithms which are used internally */
-+		_gnutls_switch_lib_state(LIB_STATE_SELFTEST);
- 		ret = _gnutls_fips_perform_self_checks1();
-		if (res != 2) {
-			if (ret < 0) {
-+		if (ret < 0) {
-+			_gnutls_switch_lib_state(LIB_STATE_ERROR);
-+			_gnutls_audit_log(NULL, "FIPS140-2 self testing part1 failed\n");
-+			if (res != 2) {
- 				gnutls_assert();
- 				goto out;
- 			}
-@@ -355,9 +358,12 @@ static int _gnutls_global_init(unsigned constructor)
- 	 * (e.g., AESNI overridden AES). They are after _gnutls_register_accel_crypto()
- 	 * intentionally */
- 	if (res != 0) {
-+		_gnutls_switch_lib_state(LIB_STATE_SELFTEST);
- 		ret = _gnutls_fips_perform_self_checks2();
-		if (res != 2) {
-			if (ret < 0) {
-+		if (ret < 0) {
-+			_gnutls_switch_lib_state(LIB_STATE_ERROR);
-+			_gnutls_audit_log(NULL, "FIPS140-2 self testing part 2 failed\n");
-+			if (res != 2) {
- 				gnutls_assert();
- 				goto out;
- 			}
-diff --git a/lib/includes/gnutls/gnutls.h.in b/lib/includes/gnutls/gnutls.h.in
-index f7fc5d114a..5840f331e9 100644
--- a/lib/includes/gnutls/gnutls.h.in
-+++ b/lib/includes/gnutls/gnutls.h.in
-@@ -3416,6 +3416,8 @@ gnutls_fips140_get_operation_state(gnutls_fips140_context_t context);
- int gnutls_fips140_push_context(gnutls_fips140_context_t context);
- int gnutls_fips140_pop_context(void);
- 
-+int gnutls_fips140_run_self_tests(void);
-+
-   /* Gnutls error codes. The mapping to a TLS alert is also shown in
-    * comments.
-    */
-diff --git a/lib/libgnutls.map b/lib/libgnutls.map
-index 0241946c8a..f42d5f9fae 100644
--- a/lib/libgnutls.map
-+++ b/lib/libgnutls.map
-@@ -1399,6 +1399,14 @@ GNUTLS_3_7_5
- 	*;
- } GNUTLS_3_7_4;
- 
-+GNUTLS_3_7_7
-+{
-+ global:
-+	gnutls_fips140_run_self_tests;
-+ local:
-+	*;
-+} GNUTLS_3_7_5;
-+
- GNUTLS_FIPS140_3_4 {
-   global:
- 	gnutls_cipher_self_test;
-diff --git a/tests/fips-test.c b/tests/fips-test.c
-index a6a283fa67..31a5e26111 100644
--- a/tests/fips-test.c
-+++ b/tests/fips-test.c
-@@ -525,6 +525,13 @@ void doit(void)
- 	}
- 
- 	gnutls_fips140_context_deinit(fips_context);
-+
-+	/* run self-tests manually */
-+	ret = gnutls_fips140_run_self_tests();
-+	if (ret < 0) {
-+		fail("gnutls_fips140_run_self_tests failed\n");
-+	}
-+
- 	gnutls_global_deinit();
- 	return;
- }
-- 
-2.36.1
-
-From 354027c0c09db60d3083fa48ae791046d336957b Mon Sep 17 00:00:00 2001
-From: Alexander Sosedkin <asosedkin@redhat.com>
-Date: Tue, 28 Jun 2022 17:22:36 +0200
-Subject: [PATCH] tests/fips-test: minor extension
-
-Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>
---
- tests/fips-test.c | 36 +++++++++++++++++++++++++++---------
- 1 file changed, 27 insertions(+), 9 deletions(-)
-
-diff --git a/tests/fips-test.c b/tests/fips-test.c
-index 31a5e26111..f9bd34586a 100644
--- a/tests/fips-test.c
-+++ b/tests/fips-test.c
-@@ -427,34 +427,43 @@ void doit(void)
- 	rsa_import_keypair(&privkey, &pubkey, "rsa-2432.pem");
- 	FIPS_POP_CONTEXT(INITIAL);
- 
-	/* Create a signature with SHA256; approved */
-+	/* Create a signature with 2432-bit RSA and SHA256; approved */
- 	FIPS_PUSH_CONTEXT();
- 	ret = gnutls_privkey_sign_data(privkey, GNUTLS_DIG_SHA256, 0,
- 				       &data, &signature);
- 	if (ret < 0) {
- 		fail("gnutls_privkey_sign_data failed\n");
- 	}
-	gnutls_free(signature.data);
- 	FIPS_POP_CONTEXT(APPROVED);
- 
-	/* Create a signature with SHA-1; not approved */
-+	/* Verify a signature with 2432-bit RSA and SHA256; approved */
-+	FIPS_PUSH_CONTEXT();
-+	ret = gnutls_pubkey_verify_data2(pubkey, GNUTLS_SIGN_RSA_SHA256, 0,
-+	                                 &data, &signature);
-+	if (ret < 0) {
-+		fail("gnutls_pubkey_verify_data2 failed\n");
-+	}
-+	FIPS_POP_CONTEXT(APPROVED);
-+	gnutls_free(signature.data);
-+
-+	/* Create a signature with 2432-bit RSA and SHA-1; not approved */
- 	FIPS_PUSH_CONTEXT();
- 	ret = gnutls_privkey_sign_data(privkey, GNUTLS_DIG_SHA1, 0,
- 				       &data, &signature);
- 	if (ret < 0) {
- 		fail("gnutls_privkey_sign_data failed\n");
- 	}
-	gnutls_free(signature.data);
- 	FIPS_POP_CONTEXT(NOT_APPROVED);
- 
-	/* Verify a signature created with SHA-1; approved */
-+	/* Verify a signature created with 2432-bit RSA and SHA-1; approved */
- 	FIPS_PUSH_CONTEXT();
-	ret = gnutls_pubkey_verify_data2(pubkey, GNUTLS_SIGN_RSA_SHA1, 0, &data,
-					 &rsa2342_sha1_sig);
-+	ret = gnutls_pubkey_verify_data2(pubkey, GNUTLS_SIGN_RSA_SHA1, 0,
-+	                                 &data, &rsa2342_sha1_sig);
- 	if (ret < 0) {
- 		fail("gnutls_pubkey_verify_data2 failed\n");
- 	}
- 	FIPS_POP_CONTEXT(APPROVED);
-+	gnutls_free(signature.data);
- 	gnutls_pubkey_deinit(pubkey);
- 	gnutls_privkey_deinit(privkey);
- 
-@@ -463,15 +472,24 @@ void doit(void)
- 	rsa_import_keypair(&privkey, &pubkey, "rsa-512.pem");
- 	FIPS_POP_CONTEXT(INITIAL);
- 
-	/* Create a signature; not approved */
-+	/* Create a signature with 512-bit RSA and SHA256; not approved */
- 	FIPS_PUSH_CONTEXT();
- 	ret = gnutls_privkey_sign_data(privkey, GNUTLS_DIG_SHA256, 0,
- 				       &data, &signature);
- 	if (ret < 0) {
- 		fail("gnutls_privkey_sign_data failed\n");
- 	}
-	gnutls_free(signature.data);
- 	FIPS_POP_CONTEXT(NOT_APPROVED);
-+
-+	/* Verify a signature with 512-bit RSA and SHA256; not approved */
-+	FIPS_PUSH_CONTEXT();
-+	ret = gnutls_pubkey_verify_data2(pubkey, GNUTLS_SIGN_RSA_SHA256, 0,
-+	                                 &data, &signature);
-+	if (ret < 0) {
-+		fail("gnutls_pubkey_verify_data2 failed\n");
-+	}
-+	FIPS_POP_CONTEXT(NOT_APPROVED);
-+	gnutls_free(signature.data);
- 	gnutls_pubkey_deinit(pubkey);
- 	gnutls_privkey_deinit(privkey);
- 
-- 
-2.37.3
-
-From 5a745120148861d873f47c1428c8c6dcadcf109b Mon Sep 17 00:00:00 2001
-From: Richard Costa <richard.costa@suse.com>
-Date: Sat, 9 Jul 2022 00:50:21 +0000
-Subject: [PATCH] Add self-test code inside a FIPS context
-
-Self-test code exercise lots of different FIPS-related code with
-side-effects. So, in order to prevent it from losing information when
-executing inside another context, we create an appropriated one.
-
-If the self-test fails, then the library is placed in error state, so it
-doesn't matter for other contexts.
-
-Signed-off-by: Richard Maciel Costa <richard.costa@suse.com>
---
- lib/fips.c        | 19 +++++++++++++++++++
- tests/fips-test.c | 20 ++++++++++++--------
- 2 files changed, 31 insertions(+), 8 deletions(-)
-
-diff --git a/lib/fips.c b/lib/fips.c
-index 31a52a990f..7d143e608e 100644
--- a/lib/fips.c
-+++ b/lib/fips.c
-@@ -902,6 +902,16 @@ gnutls_fips140_run_self_tests(void)
- #ifdef ENABLE_FIPS140
- 	int ret;
- 	unsigned prev_lib_state;
-+	gnutls_fips140_context_t fips_context = NULL;
-+
-+	/* Save the FIPS context, because self tests change it */
-+	if (gnutls_fips140_mode_enabled() != GNUTLS_FIPS140_DISABLED) {
-+		if (gnutls_fips140_context_init(&fips_context) < 0 ||
-+		    gnutls_fips140_push_context(fips_context) < 0) {
-+			gnutls_fips140_context_deinit(fips_context);
-+			fips_context = NULL;
-+		}
-+	}
- 
- 	/* Temporarily switch to LIB_STATE_SELFTEST as some of the
- 	 * algorithms are implemented using special constructs in
-@@ -918,6 +928,15 @@ gnutls_fips140_run_self_tests(void)
- 		/* Restore the previous library state */
- 		_gnutls_switch_lib_state(prev_lib_state);
- 	}
-+
-+	/* Restore the previous FIPS context */
-+	if (gnutls_fips140_mode_enabled() != GNUTLS_FIPS140_DISABLED && fips_context) {
-+		if (gnutls_fips140_pop_context() < 0) {
-+			_gnutls_switch_lib_state(LIB_STATE_ERROR);
-+			_gnutls_audit_log(NULL, "FIPS140-2 context restoration failed\n");
-+		}
-+		gnutls_fips140_context_deinit(fips_context);
-+	}
- 	return ret;
- #else
- 	return 0;
-diff --git a/tests/fips-test.c b/tests/fips-test.c
-index f9bd34586a..475b739197 100644
--- a/tests/fips-test.c
-+++ b/tests/fips-test.c
-@@ -457,8 +457,9 @@ void doit(void)
- 
- 	/* Verify a signature created with 2432-bit RSA and SHA-1; approved */
- 	FIPS_PUSH_CONTEXT();
-	ret = gnutls_pubkey_verify_data2(pubkey, GNUTLS_SIGN_RSA_SHA1, 0,
-	                                 &data, &rsa2342_sha1_sig);
-+	ret = gnutls_pubkey_verify_data2(pubkey, GNUTLS_SIGN_RSA_SHA1,
-+					 GNUTLS_VERIFY_ALLOW_SIGN_WITH_SHA1, &data,
-+					 &rsa2342_sha1_sig);
- 	if (ret < 0) {
- 		fail("gnutls_pubkey_verify_data2 failed\n");
- 	}
-@@ -501,6 +502,15 @@ void doit(void)
- 	}
- 	FIPS_POP_CONTEXT(APPROVED);
- 
-+        /* run self-tests manually */
-+	FIPS_PUSH_CONTEXT();
-+	ret = gnutls_rnd(GNUTLS_RND_RANDOM, key16, sizeof(key16));
-+	ret = gnutls_fips140_run_self_tests();
-+	if (ret < 0) {
-+		fail("gnutls_fips140_run_self_tests failed\n");
-+	}
-+	FIPS_POP_CONTEXT(APPROVED);
-+
- 	/* Test when FIPS140 is set to error state */
- 	_gnutls_lib_simulate_error();
- 
-@@ -544,12 +554,6 @@ void doit(void)
- 
- 	gnutls_fips140_context_deinit(fips_context);
- 
-	/* run self-tests manually */
-	ret = gnutls_fips140_run_self_tests();
-	if (ret < 0) {
-		fail("gnutls_fips140_run_self_tests failed\n");
-	}
-
- 	gnutls_global_deinit();
- 	return;
- }
-- 
-2.37.3
-
--- a/SOURCES/gnutls-3.7.6-fips-service-indicator-test-functions.patch
+++ b/SOURCES/gnutls-3.7.6-fips-service-indicator-test-functions.patch
@ -1,407 +0,0 @@
-From e8b35d31817d207d8b4b87ccf104d3b93aa446e0 Mon Sep 17 00:00:00 2001
-From: Daiki Ueno <ueno@gnu.org>
-Date: Mon, 17 Oct 2022 11:11:43 +0900
-Subject: [PATCH] tests: move FIPS service indicator functions to common file
-
-Signed-off-by: Daiki Ueno <ueno@gnu.org>
---
- tests/dh-compute.c     | 36 +++++---------------------
- tests/fips-rsa-sizes.c | 24 -----------------
- tests/fips-test.c      | 27 +++-----------------
- tests/kdf-api.c        | 27 +-------------------
- tests/pkcs12_encode.c  | 24 -----------------
- tests/privkey-keygen.c | 24 -----------------
- tests/utils.h          | 58 ++++++++++++++++++++++++++++++++++++++++++
- 7 files changed, 69 insertions(+), 151 deletions(-)
-
-diff --git a/tests/dh-compute.c b/tests/dh-compute.c
-index 828fb05e9c..6c1d5328f6 100644
--- a/tests/dh-compute.c
-+++ b/tests/dh-compute.c
-@@ -156,34 +156,10 @@ void doit(void)
- 		{ NULL }
- 	};
- 
-#define FIPS_PUSH_CONTEXT() do {					\
-	if (gnutls_fips140_mode_enabled()) {				\
-		ret = gnutls_fips140_push_context(fips_context);	\
-		if (ret < 0) {						\
-			fail("gnutls_fips140_push_context failed\n");	\
-		}							\
-	}								\
-} while (0)
-
-#define FIPS_POP_CONTEXT(state) do {					\
-	if (gnutls_fips140_mode_enabled()) {				\
-		ret = gnutls_fips140_pop_context();			\
-		if (ret < 0) {						\
-			fail("gnutls_fips140_context_pop failed\n");	\
-		}							\
-		fips_state = gnutls_fips140_get_operation_state(fips_context); \
-		if (fips_state != state) {				\
-			fail("operation state is not %d (%d)\n",	\
-			     state, fips_state);			\
-		}							\
-	}								\
-} while (0)
-
- 	for (int i = 0; test_data[i].name != NULL; i++) {
- 		gnutls_datum_t priv_key, pub_key;
- 		gnutls_dh_params_t dh_params;
- 		gnutls_fips140_context_t fips_context;
-		gnutls_fips140_operation_state_t fips_state;
- 		int ret;
- 
- 		if (gnutls_fips140_mode_enabled()) {
-@@ -193,24 +169,24 @@ void doit(void)
- 			}
- 		}
- 
-		FIPS_PUSH_CONTEXT();
-+		fips_push_context(fips_context);
- 		params(&dh_params, &test_data[i].prime, &test_data[i].q,
- 		       &test_data[i].generator);
-		FIPS_POP_CONTEXT(GNUTLS_FIPS140_OP_INITIAL);
-+		fips_pop_context(fips_context, GNUTLS_FIPS140_OP_INITIAL);
- 
- 		success("%s genkey\n", test_data[i].name);
- 
-		FIPS_PUSH_CONTEXT();
-+		fips_push_context(fips_context);
- 		genkey(dh_params, &priv_key, &pub_key);
-		FIPS_POP_CONTEXT(test_data[i].fips_state_genkey);
-+		fips_pop_context(fips_context, test_data[i].fips_state_genkey);
- 
- 		success("%s compute_key\n", test_data[i].name);
- 		
-		FIPS_PUSH_CONTEXT();
-+		fips_push_context(fips_context);
- 		compute_key(test_data[i].name, dh_params, &priv_key,
- 			    &pub_key, &test_data[i].peer_key,
- 			    test_data[i].expected_error, NULL, 0);
-		FIPS_POP_CONTEXT(test_data[i].fips_state_compute_key);
-+		fips_pop_context(fips_context, test_data[i].fips_state_compute_key);
- 
- 		gnutls_dh_params_deinit(dh_params);
- 		gnutls_free(priv_key.data);
-diff --git a/tests/fips-rsa-sizes.c b/tests/fips-rsa-sizes.c
-index 84b9affabb..5feb284503 100644
--- a/tests/fips-rsa-sizes.c
-+++ b/tests/fips-rsa-sizes.c
-@@ -27,25 +27,6 @@
- #include <gnutls/abstract.h>
- #include <gnutls/x509.h>
- 
-#define FIPS_PUSH_CONTEXT() do {				\
-	ret = gnutls_fips140_push_context(fips_context);	\
-	if (ret < 0) {						\
-		fail("gnutls_fips140_push_context failed\n");	\
-	}							\
-} while (0)
-
-#define FIPS_POP_CONTEXT(state) do {					\
-	ret = gnutls_fips140_pop_context();				\
-	if (ret < 0) {							\
-		fail("gnutls_fips140_context_pop failed\n");		\
-	}								\
-	fips_state = gnutls_fips140_get_operation_state(fips_context);	\
-	if (fips_state != GNUTLS_FIPS140_OP_ ## state) {		\
-		fail("operation state is not " # state " (%d)\n",	\
-		     fips_state);					\
-	}								\
-} while (0)
-
- 
- void generate_successfully(gnutls_privkey_t* privkey, gnutls_pubkey_t* pubkey,
-                            unsigned int size);
-@@ -63,7 +44,6 @@ void generate_successfully(gnutls_privkey_t* privkey, gnutls_pubkey_t* pubkey,
- 	int ret;
- 	gnutls_x509_privkey_t xprivkey;
- 	gnutls_fips140_context_t fips_context;
-	gnutls_fips140_operation_state_t fips_state;
- 	assert(gnutls_fips140_context_init(&fips_context) == 0);
- 
- 	fprintf(stderr, "%d-bit\n", size);
-@@ -102,7 +82,6 @@ void generate_unsuccessfully(gnutls_privkey_t* privkey, gnutls_pubkey_t* pubkey,
- 	int ret;
- 	gnutls_x509_privkey_t xprivkey;
- 	gnutls_fips140_context_t fips_context;
-	gnutls_fips140_operation_state_t fips_state;
- 	assert(gnutls_fips140_context_init(&fips_context) == 0);
- 
- 	fprintf(stderr, "%d-bit\n", size);
-@@ -156,7 +135,6 @@ void generate_unsuccessfully(gnutls_privkey_t* privkey, gnutls_pubkey_t* pubkey,
- void sign_verify_successfully(gnutls_privkey_t privkey, gnutls_pubkey_t pubkey) {
- 	int ret;
- 	gnutls_fips140_context_t fips_context;
-	gnutls_fips140_operation_state_t fips_state;
- 
- 	gnutls_datum_t signature;
- 	gnutls_datum_t plaintext = {
-@@ -190,7 +168,6 @@ void sign_verify_unsuccessfully(gnutls_privkey_t privkey,
-                                 gnutls_pubkey_t pubkey) {
- 	int ret;
- 	gnutls_fips140_context_t fips_context;
-	gnutls_fips140_operation_state_t fips_state;
- 
- 	gnutls_datum_t signature;
- 	gnutls_datum_t plaintext = {
-@@ -225,7 +202,6 @@ void sign_verify_unsuccessfully(gnutls_privkey_t privkey,
- void nosign_verify(gnutls_privkey_t privkey, gnutls_pubkey_t pubkey) {
- 	int ret;
- 	gnutls_fips140_context_t fips_context;
-	gnutls_fips140_operation_state_t fips_state;
- 
- 	gnutls_datum_t signature;
- 	gnutls_datum_t plaintext = {
-diff --git a/tests/fips-test.c b/tests/fips-test.c
-index f789afb107..b0bae4ef9f 100644
--- a/tests/fips-test.c
-+++ b/tests/fips-test.c
-@@ -12,25 +12,6 @@
- /* This does check the FIPS140 support.
-  */
- 
-#define FIPS_PUSH_CONTEXT() do {				\
-	ret = gnutls_fips140_push_context(fips_context);	\
-	if (ret < 0) {						\
-		fail("gnutls_fips140_push_context failed\n");	\
-	}							\
-} while (0)
-
-#define FIPS_POP_CONTEXT(state) do {					\
-	ret = gnutls_fips140_pop_context();				\
-	if (ret < 0) {							\
-		fail("gnutls_fips140_context_pop failed\n");		\
-	}								\
-	fips_state = gnutls_fips140_get_operation_state(fips_context);	\
-	if (fips_state != GNUTLS_FIPS140_OP_ ## state) {		\
-		fail("operation state is not " # state " (%d)\n",	\
-		     fips_state);					\
-	}								\
-} while (0)
-
- void _gnutls_lib_simulate_error(void);
- 
- static void tls_log_func(int level, const char *str)
-@@ -40,10 +21,9 @@ static void tls_log_func(int level, const char *str)
- 
- static uint8_t key16[16];
- static uint8_t iv16[16];
-uint8_t key_data[64];
-uint8_t iv_data[16];
-gnutls_fips140_context_t fips_context;
-gnutls_fips140_operation_state_t fips_state;
-+static uint8_t key_data[64];
-+static uint8_t iv_data[16];
-+static gnutls_fips140_context_t fips_context;
- 
- static const gnutls_datum_t data = { .data = (unsigned char *)"foo", 3 };
- static const uint8_t rsa2342_sha1_sig_data[] = {
-@@ -276,6 +256,7 @@ test_ciphers(void)
- void doit(void)
- {
- 	int ret;
-+	gnutls_fips140_operation_state_t fips_state;
- 	unsigned int mode;
- 	gnutls_cipher_hd_t ch;
- 	gnutls_hmac_hd_t mh;
-diff --git a/tests/kdf-api.c b/tests/kdf-api.c
-index 9724502005..a28ce82a62 100644
--- a/tests/kdf-api.c
-+++ b/tests/kdf-api.c
-@@ -33,30 +33,7 @@
- #define MAX_BUF 1024
- 
- static gnutls_fips140_context_t fips_context;
-static gnutls_fips140_operation_state_t fips_state;
-
-#define FIPS_PUSH_CONTEXT() do {					\
-	if (gnutls_fips140_mode_enabled()) {				\
-		ret = gnutls_fips140_push_context(fips_context);	\
-		if (ret < 0) {						\
-			fail("gnutls_fips140_push_context failed\n");	\
-		}							\
-	}								\
-} while (0)
-
-#define FIPS_POP_CONTEXT(state) do {					\
-	if (gnutls_fips140_mode_enabled()) {				\
-		ret = gnutls_fips140_pop_context();			\
-		if (ret < 0) {						\
-			fail("gnutls_fips140_context_pop failed\n");	\
-		}							\
-		fips_state = gnutls_fips140_get_operation_state(fips_context); \
-		if (fips_state != GNUTLS_FIPS140_OP_ ## state) {	\
-			fail("operation state is not " # state " (%d)\n", \
-			     fips_state);				\
-		}							\
-	}								\
-} while (0)
-+
- 
- static void
- test_hkdf(gnutls_mac_algorithm_t mac,
-@@ -74,7 +51,6 @@ test_hkdf(gnutls_mac_algorithm_t mac,
- 	gnutls_datum_t prk;
- 	gnutls_datum_t okm;
- 	uint8_t buf[MAX_BUF];
-	int ret;
- 
- 	success("HKDF test with %s\n", gnutls_mac_get_name(mac));
- 
-@@ -144,7 +120,6 @@ test_pbkdf2(gnutls_mac_algorithm_t mac,
- 	gnutls_datum_t salt;
- 	gnutls_datum_t okm;
- 	uint8_t buf[MAX_BUF];
-	int ret;
- 
- 	success("PBKDF2 test with %s\n", gnutls_mac_get_name(mac));
- 
-diff --git a/tests/pkcs12_encode.c b/tests/pkcs12_encode.c
-index ea39f3d69e..dc55daccde 100644
--- a/tests/pkcs12_encode.c
-+++ b/tests/pkcs12_encode.c
-@@ -70,29 +70,6 @@ static void tls_log_func(int level, const char *str)
- 	fprintf(stderr, "|<%d>| %s", level, str);
- }
- 
-#define FIPS_PUSH_CONTEXT() do {					\
-	if (gnutls_fips140_mode_enabled()) {				\
-		ret = gnutls_fips140_push_context(fips_context);	\
-		if (ret < 0) {						\
-			fail("gnutls_fips140_push_context failed\n");	\
-		}							\
-	}								\
-} while (0)
-
-#define FIPS_POP_CONTEXT(state) do {					\
-	if (gnutls_fips140_mode_enabled()) {				\
-		ret = gnutls_fips140_pop_context();			\
-		if (ret < 0) {						\
-			fail("gnutls_fips140_context_pop failed\n");	\
-		}							\
-		fips_state = gnutls_fips140_get_operation_state(fips_context); \
-		if (fips_state != GNUTLS_FIPS140_OP_ ## state) {	\
-			fail("operation state is not " # state " (%d)\n", \
-			     fips_state);				\
-		}							\
-	}								\
-} while (0)
-
- void doit(void)
- {
- 	gnutls_pkcs12_t pkcs12;
-@@ -106,7 +83,6 @@ void doit(void)
- 	size_t size;
- 	unsigned i;
- 	gnutls_fips140_context_t fips_context;
-	gnutls_fips140_operation_state_t fips_state;
- 	size_t n_tests = 0;
- 	struct tests {
- 		const char *name;
-diff --git a/tests/privkey-keygen.c b/tests/privkey-keygen.c
-index 2766afee08..2531906d71 100644
--- a/tests/privkey-keygen.c
-+++ b/tests/privkey-keygen.c
-@@ -119,30 +119,6 @@ void doit(void)
- 	gnutls_x509_privkey_t pkey, dst;
- 	int ret, algorithm, i;
- 	gnutls_fips140_context_t fips_context;
-	gnutls_fips140_operation_state_t fips_state;
-
-#define FIPS_PUSH_CONTEXT() do {					\
-	if (gnutls_fips140_mode_enabled()) {				\
-		ret = gnutls_fips140_push_context(fips_context);	\
-		if (ret < 0) {						\
-			fail("gnutls_fips140_push_context failed\n");	\
-		}							\
-	}								\
-} while (0)
-
-#define FIPS_POP_CONTEXT(state) do {					\
-	if (gnutls_fips140_mode_enabled()) {				\
-		ret = gnutls_fips140_pop_context();			\
-		if (ret < 0) {						\
-			fail("gnutls_fips140_context_pop failed\n");	\
-		}							\
-		fips_state = gnutls_fips140_get_operation_state(fips_context); \
-		if (fips_state != GNUTLS_FIPS140_OP_ ## state) {	\
-			fail("operation state is not " # state " (%d)\n", \
-			     fips_state);				\
-		}							\
-	}								\
-} while (0)
- 
- 	ret = global_init();
- 	if (ret < 0)
-diff --git a/tests/utils.h b/tests/utils.h
-index d3a2ba8d16..4433a07057 100644
--- a/tests/utils.h
-+++ b/tests/utils.h
-@@ -210,4 +210,62 @@ inline static unsigned int get_dtls_retransmit_timeout(void) {
- 	return (unsigned int) ul;
- }
- 
-+static inline const char *
-+fips_operation_state_to_string(gnutls_fips140_operation_state_t state)
-+{
-+	switch (state) {
-+	case GNUTLS_FIPS140_OP_INITIAL:
-+		return "INITIAL";
-+	case GNUTLS_FIPS140_OP_APPROVED:
-+		return "APPROVED";
-+	case GNUTLS_FIPS140_OP_NOT_APPROVED:
-+		return "NOT_APPROVED";
-+	case GNUTLS_FIPS140_OP_ERROR:
-+		return "ERROR";
-+	default:
-+		/*NOTREACHED*/
-+		assert(0);
-+		return NULL;
-+	}
-+}
-+
-+static inline void
-+fips_push_context(gnutls_fips140_context_t context)
-+{
-+	if (gnutls_fips140_mode_enabled()) {
-+		int ret;
-+
-+		ret = gnutls_fips140_push_context(context);
-+		if (ret < 0) {
-+			fail("gnutls_fips140_push_context failed\n");
-+		}
-+	}
-+}
-+
-+static inline void
-+fips_pop_context(gnutls_fips140_context_t context,
-+		 gnutls_fips140_operation_state_t expected_state)
-+{
-+	gnutls_fips140_operation_state_t state;
-+
-+	if (gnutls_fips140_mode_enabled()) {
-+		int ret;
-+
-+		ret = gnutls_fips140_pop_context();
-+		if (ret < 0) {
-+			fail("gnutls_fips140_context_pop failed\n");
-+		}
-+		state = gnutls_fips140_get_operation_state(context);
-+		if (state != expected_state) {
-+			fail("operation state is not %s (%s)\n",
-+			     fips_operation_state_to_string(expected_state),
-+			     fips_operation_state_to_string(state));
-+		}
-+	}
-+}
-+
-+/* To use those convenient macros, define fips_context variable. */
-+#define FIPS_PUSH_CONTEXT() fips_push_context(fips_context)
-+#define FIPS_POP_CONTEXT(state) fips_pop_context(fips_context, GNUTLS_FIPS140_OP_ ## state)
-+
- #endif /* GNUTLS_TESTS_UTILS_H */
-- 
-2.38.1
-
--- a/SOURCES/gnutls-3.7.6-fips-sha1-sigver.patch
+++ b/SOURCES/gnutls-3.7.6-fips-sha1-sigver.patch
@ -1,109 +0,0 @@
-From 00f62aac690ba55650c58fa125a3806a8a684214 Mon Sep 17 00:00:00 2001
-From: Daiki Ueno <ueno@gnu.org>
-Date: Sat, 29 Jul 2023 13:21:37 +0900
-Subject: [PATCH] nettle: mark SHA-1 signature verification non-approved
-
-Signed-off-by: Daiki Ueno <ueno@gnu.org>
---
- lib/nettle/pk.c   | 13 +++++--------
- lib/pubkey.c      |  3 ---
- tests/fips-test.c |  8 ++++----
- 3 files changed, 9 insertions(+), 15 deletions(-)
-
-diff --git a/lib/nettle/pk.c b/lib/nettle/pk.c
-index c098e2aa45..f0b8b6d707 100644
--- a/lib/nettle/pk.c
-+++ b/lib/nettle/pk.c
-@@ -1575,10 +1575,7 @@ _wrap_nettle_pk_verify(gnutls_pk_algorithm_t algo,
- 			if (hash_len > vdata->size)
- 				hash_len = vdata->size;
- 
-			/* SHA-1 is allowed for SigVer in FIPS 140-3 in legacy
-			 * mode */
- 			switch (DIG_TO_MAC(sign_params->dsa_dig)) {
-			case GNUTLS_MAC_SHA1:
- 			case GNUTLS_MAC_SHA256:
- 			case GNUTLS_MAC_SHA384:
- 			case GNUTLS_MAC_SHA512:
-@@ -1656,8 +1653,8 @@ _wrap_nettle_pk_verify(gnutls_pk_algorithm_t algo,
- 			 * 2048-bit or one of the known lengths (1024, 1280,
- 			 * 1536, 1792; i.e., multiple of 256-bits).
- 			 *
-			 * In addition to this, only SHA-1 and SHA-2 are allowed
-			 * for SigVer; it is checked in _pkcs1_rsa_verify_sig in
-+			 * In addition to this, only SHA-2 is allowed for
-+			 * SigVer; it is checked in _pkcs1_rsa_verify_sig in
- 			 * lib/pubkey.c.
- 			 */
- 			if (unlikely(bits < 2048 &&
-@@ -1709,9 +1706,9 @@ _wrap_nettle_pk_verify(gnutls_pk_algorithm_t algo,
- 			}
- 
- 			/* RSA modulus size should be 2048-bit or larger in FIPS
-			 * 140-3.  In addition to this, only SHA-1 and SHA-2 are
-			 * allowed for SigVer, while Nettle only supports
-			 * SHA256, SHA384, and SHA512 for RSA-PSS (see
-+			 * 140-3.  In addition to this, only SHA-2 is allowed
-+			 * for SigVer, while Nettle only supports SHA256,
-+			 * SHA384, and SHA512 for RSA-PSS (see
- 			 * _rsa_pss_verify_digest in this file for the details).
- 			 */
- 			if (unlikely(mpz_sizeinbase(pub.n, 2) < 2048)) {
-diff --git a/lib/pubkey.c b/lib/pubkey.c
-index be1b045fa7..052707d5da 100644
--- a/lib/pubkey.c
-+++ b/lib/pubkey.c
-@@ -2370,10 +2370,7 @@ _pkcs1_rsa_verify_sig(gnutls_pk_algorithm_t pk,
- 	d.size = digest_size;
- 
- 	if (pk == GNUTLS_PK_RSA) {
-		/* SHA-1 is allowed for SigVer in FIPS 140-3 in legacy
-		 * mode */
- 		switch (me->id) {
-		case GNUTLS_MAC_SHA1:
- 		case GNUTLS_MAC_SHA256:
- 		case GNUTLS_MAC_SHA384:
- 		case GNUTLS_MAC_SHA512:
-diff --git a/tests/fips-test.c b/tests/fips-test.c
-index f789afb107..3549b727b9 100644
--- a/tests/fips-test.c
-+++ b/tests/fips-test.c
-@@ -471,7 +471,7 @@ void doit(void)
- 	}
- 	FIPS_POP_CONTEXT(NOT_APPROVED);
- 
-	/* Verify a signature created with 2432-bit RSA and SHA-1; approved */
-+	/* Verify a signature created with 2432-bit RSA and SHA-1; not approved */
- 	FIPS_PUSH_CONTEXT();
- 	ret = gnutls_pubkey_verify_data2(pubkey, GNUTLS_SIGN_RSA_SHA1,
- 					 GNUTLS_VERIFY_ALLOW_SIGN_WITH_SHA1, &data,
-@@ -479,7 +479,7 @@ void doit(void)
- 	if (ret < 0) {
- 		fail("gnutls_pubkey_verify_data2 failed\n");
- 	}
-	FIPS_POP_CONTEXT(APPROVED);
-+	FIPS_POP_CONTEXT(NOT_APPROVED);
- 	gnutls_free(signature.data);
- 	gnutls_pubkey_deinit(pubkey);
- 	gnutls_privkey_deinit(privkey);
-@@ -583,7 +583,7 @@ void doit(void)
- 	}
- 	FIPS_POP_CONTEXT(NOT_APPROVED);
- 
-	/* Verify a signature created with ECDSA and SHA-1; approved */
-+	/* Verify a signature created with ECDSA and SHA-1; not approved */
- 	FIPS_PUSH_CONTEXT();
- 	ret = gnutls_pubkey_verify_data2(pubkey, GNUTLS_SIGN_ECDSA_SHA1,
- 					 GNUTLS_VERIFY_ALLOW_SIGN_WITH_SHA1, &data,
-@@ -591,7 +591,7 @@ void doit(void)
- 	if (ret < 0) {
- 		fail("gnutls_pubkey_verify_data2 failed\n");
- 	}
-	FIPS_POP_CONTEXT(APPROVED);
-+	FIPS_POP_CONTEXT(NOT_APPROVED);
- 	gnutls_free(signature.data);
- 
- 	/* Create a signature with ECDSA and SHA-1 (old API); not approved */
-- 
-2.41.0
-
--- a/SOURCES/gnutls-3.7.6-fips-symkey-limit.patch
+++ b/SOURCES/gnutls-3.7.6-fips-symkey-limit.patch
@ -1,310 +0,0 @@
-From f8a8961cfa176fc74c153cb6e1e68aff5e2d42f2 Mon Sep 17 00:00:00 2001
-From: rpm-build <rpm-build>
-Date: Tue, 27 Sep 2022 10:52:19 +0900
-Subject: [PATCH] gnutls-3.7.6-fips-symkey-limit.patch
-
---
- lib/crypto-api.c  | 26 ++++++++++++++++++++++---
- tests/fips-test.c | 49 +++++++++++++++++++++++++++++++++++++++++++++++
- tests/kdf-api.c   |  9 ++++++++-
- 3 files changed, 80 insertions(+), 4 deletions(-)
-
-diff --git a/lib/crypto-api.c b/lib/crypto-api.c
-index b3e1eec..35200fb 100644
--- a/lib/crypto-api.c
-+++ b/lib/crypto-api.c
-@@ -896,6 +896,7 @@ gnutls_hash_hd_t gnutls_hash_copy(gnutls_hash_hd_t handle)
- int gnutls_key_generate(gnutls_datum_t * key, unsigned int key_size)
- {
- 	int ret;
-+	bool not_approved = false;
- 
- 	FAIL_IF_LIB_ERROR;
- 
-@@ -912,17 +913,31 @@ int gnutls_key_generate(gnutls_datum_t * key, unsigned int key_size)
- 	key->data = gnutls_malloc(key->size);
- 	if (!key->data) {
- 		gnutls_assert();
-		return GNUTLS_E_MEMORY_ERROR;
-+		ret = GNUTLS_E_MEMORY_ERROR;
-+		goto error;
-+	}
-+
-+	/* Key lengths of less than 112 bits are not approved */
-+	if (key_size < 14) {
-+		not_approved = true;
- 	}
- 
- 	ret = gnutls_rnd(GNUTLS_RND_RANDOM, key->data, key->size);
- 	if (ret < 0) {
- 		gnutls_assert();
- 		_gnutls_free_datum(key);
-		return ret;
-+		goto error;
- 	}
- 
-	return 0;
-+ error:
-+	if (ret < 0) {
-+		_gnutls_switch_fips_state(GNUTLS_FIPS140_OP_ERROR);
-+	} else if (not_approved) {
-+		_gnutls_switch_fips_state(GNUTLS_FIPS140_OP_NOT_APPROVED);
-+	} else {
-+		_gnutls_switch_fips_state(GNUTLS_FIPS140_OP_APPROVED);
-+	}
-+	return ret;
- }
- 
- /* AEAD API */
-@@ -2058,6 +2073,11 @@ gnutls_pbkdf2(gnutls_mac_algorithm_t mac,
- 		not_approved = true;
- 	}
- 
-+	/* Key lengths and output sizes of less than 112 bits are not approved */
-+	if (key->size < 14 || length < 14) {
-+		not_approved = true;
-+	}
-+
- 	ret = _gnutls_kdf_ops.pbkdf2(mac, key->data, key->size,
- 				     salt->data, salt->size, iter_count,
- 				     output, length);
-diff --git a/tests/fips-test.c b/tests/fips-test.c
-index 31a5e26..27da414 100644
--- a/tests/fips-test.c
-+++ b/tests/fips-test.c
-@@ -274,6 +274,8 @@ void doit(void)
- 	gnutls_datum_t signature;
- 	unsigned int bits;
- 	uint8_t hmac[64];
-+	uint8_t pbkdf2[64];
-+	gnutls_datum_t temp_key = { NULL, 0 };
- 
- 	fprintf(stderr,
- 		"Please note that if in FIPS140 mode, you need to assure the library's integrity prior to running this test\n");
-@@ -371,11 +373,58 @@ void doit(void)
- 	}
- 	FIPS_POP_CONTEXT(NOT_APPROVED);
- 
-+	/* PBKDF2 with key equal to or longer than 112 bits: approved */
-+	FIPS_PUSH_CONTEXT();
-+	ret = gnutls_pbkdf2(GNUTLS_MAC_SHA256, &key, &iv, 100,
-+			    &pbkdf2, sizeof(pbkdf2));
-+	if (ret < 0) {
-+		fail("gnutls_pbkdf2 failed\n");
-+	}
-+	FIPS_POP_CONTEXT(APPROVED);
-+
-+	/* PBKDF2 with key shorter than 112 bits: not approved */
-+	FIPS_PUSH_CONTEXT();
-+	key.size = 13;
-+	ret = gnutls_pbkdf2(GNUTLS_MAC_SHA256, &key, &iv, 100,
-+			    &pbkdf2, sizeof(pbkdf2));
-+	if (ret < 0) {
-+		fail("gnutls_pbkdf2 failed\n");
-+	}
-+	key.size = sizeof(key16);
-+	FIPS_POP_CONTEXT(NOT_APPROVED);
-+
-+	/* PBKDF2 with output shorter than 112 bits: not approved */
-+	FIPS_PUSH_CONTEXT();
-+	ret = gnutls_pbkdf2(GNUTLS_MAC_SHA256, &key, &iv, 100,
-+			    &pbkdf2, 13);
-+	if (ret < 0) {
-+		fail("gnutls_pbkdf2 failed\n");
-+	}
-+	FIPS_POP_CONTEXT(NOT_APPROVED);
-+
- 	ret = gnutls_rnd(GNUTLS_RND_NONCE, key16, sizeof(key16));
- 	if (ret < 0) {
- 		fail("gnutls_rnd failed\n");
- 	}
- 
-+	/* Symmetric key generation equal to or longer than 112 bits: approved */
-+	FIPS_PUSH_CONTEXT();
-+	ret = gnutls_key_generate(&temp_key, 14);
-+	if (ret < 0) {
-+		fail("gnutls_key_generate failed\n");
-+	}
-+	gnutls_free(temp_key.data);
-+	FIPS_POP_CONTEXT(APPROVED);
-+
-+	/* Symmetric key generation shorter than 112 bits: not approved */
-+	FIPS_PUSH_CONTEXT();
-+	ret = gnutls_key_generate(&temp_key, 13);
-+	if (ret < 0) {
-+		fail("gnutls_key_generate failed\n");
-+	}
-+	gnutls_free(temp_key.data);
-+	FIPS_POP_CONTEXT(NOT_APPROVED);
-+
- 	ret = gnutls_pubkey_init(&pubkey);
- 	if (ret < 0) {
- 		fail("gnutls_pubkey_init failed\n");
-diff --git a/tests/kdf-api.c b/tests/kdf-api.c
-index 25fbc6a..8a4677c 100644
--- a/tests/kdf-api.c
-+++ b/tests/kdf-api.c
-@@ -89,6 +89,7 @@ test_hkdf(gnutls_mac_algorithm_t mac,
- 
- 	FIPS_PUSH_CONTEXT();
- 	assert(gnutls_hkdf_extract(mac, &ikm, &salt, buf) >= 0);
-+	/* HKDF outside of TLS usage is not approved */
- 	FIPS_POP_CONTEXT(NOT_APPROVED);
- 	gnutls_free(ikm.data);
- 	gnutls_free(salt.data);
-@@ -110,6 +111,7 @@ test_hkdf(gnutls_mac_algorithm_t mac,
- 
- 	FIPS_PUSH_CONTEXT();
- 	assert(gnutls_hkdf_expand(mac, &prk, &info, buf, length) >= 0);
-+	/* HKDF outside of TLS usage is not approved */
- 	FIPS_POP_CONTEXT(NOT_APPROVED);
- 	gnutls_free(info.data);
- 
-@@ -151,7 +153,12 @@ test_pbkdf2(gnutls_mac_algorithm_t mac,
- 
- 	FIPS_PUSH_CONTEXT();
- 	assert(gnutls_pbkdf2(mac, &ikm, &salt, iter_count, buf, length) >= 0);
-	FIPS_POP_CONTEXT(APPROVED);
-+	/* Key sizes and output sizes less than 112-bit are not approved.  */
-+	if (ikm.size < 14 || length < 14) {
-+		FIPS_POP_CONTEXT(NOT_APPROVED);
-+	} else {
-+		FIPS_POP_CONTEXT(APPROVED);
-+	}
- 	gnutls_free(ikm.data);
- 	gnutls_free(salt.data);
- 
-- 
-2.37.3
-
-From 86eded166f77612c70201c0d85d3abe711edd77d Mon Sep 17 00:00:00 2001
-From: Daiki Ueno <ueno@gnu.org>
-Date: Thu, 29 Sep 2022 21:19:26 +0900
-Subject: [PATCH] fips: only mark HMAC as approved in PBKDF2
-
-As ACVP only allows HMAC used with PBKDF2[1], this change marks other
-hash algorithms not-approved.
-
-1. https://pages.nist.gov/ACVP/draft-celi-acvp-pbkdf.html
-
-Signed-off-by: Daiki Ueno <ueno@gnu.org>
---
- lib/crypto-api.c |  5 ++++-
- lib/fips.h       | 16 +++++++++++++++-
- tests/kdf-api.c  | 30 +++++++++++++++++++++++++++++-
- 3 files changed, 48 insertions(+), 3 deletions(-)
-
-diff --git a/lib/crypto-api.c b/lib/crypto-api.c
-index d3e601ab3a..9f7e18db11 100644
--- a/lib/crypto-api.c
-+++ b/lib/crypto-api.c
-@@ -2229,7 +2229,10 @@ gnutls_pbkdf2(gnutls_mac_algorithm_t mac,
- 	if (!is_mac_algo_allowed(mac)) {
- 		_gnutls_switch_fips_state(GNUTLS_FIPS140_OP_ERROR);
- 		return gnutls_assert_val(GNUTLS_E_UNWANTED_ALGORITHM);
-	} else if (!is_mac_algo_approved_in_fips(mac)) {
-+	} else if (!is_mac_algo_hmac_approved_in_fips(mac)) {
-+		/* ACVP only allows HMAC used with PBKDF2:
-+		 * https://pages.nist.gov/ACVP/draft-celi-acvp-pbkdf.html
-+		 */
- 		not_approved = true;
- 	}
- 
-diff --git a/lib/fips.h b/lib/fips.h
-index 3a74f254e7..bf61b36741 100644
--- a/lib/fips.h
-+++ b/lib/fips.h
-@@ -76,7 +76,7 @@ void _gnutls_lib_simulate_error(void);
- void _gnutls_lib_force_operational(void);
- 
- inline static bool
-is_mac_algo_approved_in_fips(gnutls_mac_algorithm_t algo)
-+is_mac_algo_hmac_approved_in_fips(gnutls_mac_algorithm_t algo)
- {
- 	switch (algo) {
- 	case GNUTLS_MAC_SHA1:
-@@ -88,6 +88,20 @@ is_mac_algo_approved_in_fips(gnutls_mac_algorithm_t algo)
- 	case GNUTLS_MAC_SHA3_256:
- 	case GNUTLS_MAC_SHA3_384:
- 	case GNUTLS_MAC_SHA3_512:
-+		return true;
-+	default:
-+		return false;
-+	}
-+}
-+
-+inline static bool
-+is_mac_algo_approved_in_fips(gnutls_mac_algorithm_t algo)
-+{
-+	if (is_mac_algo_hmac_approved_in_fips(algo)) {
-+		return true;
-+	}
-+
-+	switch (algo) {
- 	case GNUTLS_MAC_AES_CMAC_128:
- 	case GNUTLS_MAC_AES_CMAC_256:
- 	case GNUTLS_MAC_AES_GMAC_128:
-diff --git a/tests/kdf-api.c b/tests/kdf-api.c
-index 577cbf7a17..4feb22688b 100644
--- a/tests/kdf-api.c
-+++ b/tests/kdf-api.c
-@@ -26,6 +26,7 @@
- #include <gnutls/crypto.h>
- 
- #include <assert.h>
-+#include <stdbool.h>
- #include <stdint.h>
- 
- #include "utils.h"
-@@ -133,6 +134,25 @@ test_hkdf(gnutls_mac_algorithm_t mac,
- 	gnutls_free(hex.data);
- }
- 
-+inline static bool
-+is_mac_algo_hmac_approved_in_fips(gnutls_mac_algorithm_t algo)
-+{
-+	switch (algo) {
-+	case GNUTLS_MAC_SHA1:
-+	case GNUTLS_MAC_SHA256:
-+	case GNUTLS_MAC_SHA384:
-+	case GNUTLS_MAC_SHA512:
-+	case GNUTLS_MAC_SHA224:
-+	case GNUTLS_MAC_SHA3_224:
-+	case GNUTLS_MAC_SHA3_256:
-+	case GNUTLS_MAC_SHA3_384:
-+	case GNUTLS_MAC_SHA3_512:
-+		return true;
-+	default:
-+		return false;
-+	}
-+}
-+
- static void
- test_pbkdf2(gnutls_mac_algorithm_t mac,
- 	    const char *ikm_hex,
-@@ -161,7 +181,8 @@ test_pbkdf2(gnutls_mac_algorithm_t mac,
- 	FIPS_PUSH_CONTEXT();
- 	assert(gnutls_pbkdf2(mac, &ikm, &salt, iter_count, buf, length) >= 0);
- 	/* Key sizes and output sizes less than 112-bit are not approved.  */
-	if (ikm.size < 14 || length < 14) {
-+	if (ikm.size < 14 || length < 14 ||
-+	    !is_mac_algo_hmac_approved_in_fips(mac)) {
- 		FIPS_POP_CONTEXT(NOT_APPROVED);
- 	} else {
- 		FIPS_POP_CONTEXT(APPROVED);
-@@ -208,5 +229,12 @@ doit(void)
- 		    20,
- 		    "4b007901b765489abead49d926f721d065a429c1");
- 
-+	test_pbkdf2(GNUTLS_MAC_AES_CMAC_128,
-+		    "70617373776f726470617373776f7264", /* "passwordpassword" */
-+		    "73616c74",		/* "salt" */
-+		    4096,
-+		    20,
-+		    "c4c112c6e1e3b8757640603dec78825ff87605a7");
-+
- 	gnutls_fips140_context_deinit(fips_context);
- }
-- 
-2.37.3
-
--- a/SOURCES/gnutls-3.7.6-gmp-static.patch
+++ b/SOURCES/gnutls-3.7.6-gmp-static.patch
@ -1,175 +0,0 @@
-From: Daiki Ueno <ueno@gnu.org>
-Date: Fri, 19 Aug 2022 12:32:27 +0900
-Subject: [PATCH] build: allow GMP to be statically linked
-
-Even though we set the custom allocator[1] to zeroize sensitive data,
-it can be easily invalidated if the application sets its own custom
-allocator.  An approach to prevent that is to link against a static
-library of GMP, so the use of GMP is privatized and the custom
-allocator configuration is not shared with other applications.
-
-This patch allows libgnutls to be linked with the static library of
-GMP.  Note that, to this work libgmp.a needs to be compiled with -fPIC
-and libhogweed in Nettle is also linked to the static library of GMP.
-
-1. https://gitlab.com/gnutls/gnutls/-/merge_requests/1554
-
-Signed-off-by: Daiki Ueno <ueno@gnu.org>
---
-diff --color -ruNp a/configure.ac b/configure.ac
--- a/configure.ac	2022-12-15 11:06:16.782726043 +0100
-+++ b/configure.ac	2022-12-15 11:08:35.603451427 +0100
-@@ -744,6 +744,8 @@ AC_CHECK_FUNCS(nettle_cmac_kuznyechik_up
- LIBS=$save_LIBS
- 
- # Check sonames of the linked libraries needed for FIPS selftests.
-+save_CFLAGS=$CFLAGS
-+CFLAGS="$CFLAGS $GMP_CFLAGS"
- save_LIBS=$LIBS
- LIBS="$LIBS $GMP_LIBS"
- AC_MSG_CHECKING([gmp soname])
-@@ -757,9 +759,14 @@ if test -z "$gmp_so"; then
- 	gmp_so=none
- fi
- AC_MSG_RESULT($gmp_so)
-AC_DEFINE_UNQUOTED([GMP_LIBRARY_SONAME], ["$gmp_so"], [The soname of gmp library])
-+if test "$gmp_so" != none; then
-+	AC_DEFINE_UNQUOTED([GMP_LIBRARY_SONAME], ["$gmp_so"], [The soname of gmp library])
-+fi
- LIBS=$save_LIBS
-+CFLAGS=$save_CFLAGS
- 
-+save_CFLAGS=$CFLAGS
-+CFLAGS="$CFLAGS $NETTLE_CFLAGS"
- save_LIBS=$LIBS
- LIBS="$LIBS $NETTLE_LIBS"
- AC_MSG_CHECKING([nettle soname])
-@@ -775,7 +782,11 @@ fi
- AC_MSG_RESULT($nettle_so)
- AC_DEFINE_UNQUOTED([NETTLE_LIBRARY_SONAME], ["$nettle_so"], [The soname of nettle library])
- LIBS=$save_LIBS
-+CFLAGS=$save_CFLAGS
- 
-+save_CFLAGS=$CFLAGS
-+# <nettle/bignum.h> includes <gmp.h>
-+CFLAGS="$CFLAGS $HOGWEED_CFLAGS $GMP_CFLAGS"
- save_LIBS=$LIBS
- LIBS="$LIBS $HOGWEED_LIBS"
- AC_MSG_CHECKING([hogweed soname])
-@@ -791,6 +802,7 @@ fi
- AC_MSG_RESULT($hogweed_so)
- AC_DEFINE_UNQUOTED([HOGWEED_LIBRARY_SONAME], ["$hogweed_so"], [The soname of hogweed library])
- LIBS=$save_LIBS
-+CFLAGS=$save_CFLAGS
- 
- gnutls_so=libgnutls.so.`expr "$LT_CURRENT" - "$LT_AGE"`
- AC_DEFINE_UNQUOTED([GNUTLS_LIBRARY_SONAME], ["$gnutls_so"], [The soname of gnutls library])
-diff --color -ruNp a/lib/fips.c b/lib/fips.c
--- a/lib/fips.c	2022-12-15 11:06:16.868727731 +0100
-+++ b/lib/fips.c	2022-12-15 11:12:42.744303409 +0100
-@@ -155,7 +155,11 @@ void _gnutls_fips_mode_reset_zombie(void
- #define GNUTLS_LIBRARY_NAME GNUTLS_LIBRARY_SONAME
- #define NETTLE_LIBRARY_NAME NETTLE_LIBRARY_SONAME
- #define HOGWEED_LIBRARY_NAME HOGWEED_LIBRARY_SONAME
-+
-+/* GMP can be statically linked */
-+#ifdef GMP_LIBRARY_SONAME
- #define GMP_LIBRARY_NAME GMP_LIBRARY_SONAME
-+#endif
- 
- #define HMAC_SIZE 32
- #define HMAC_ALGO GNUTLS_MAC_SHA256
-@@ -173,7 +177,9 @@ struct hmac_file
- 	struct hmac_entry gnutls;
- 	struct hmac_entry nettle;
- 	struct hmac_entry hogweed;
-+#ifdef GMP_LIBRARY_SONAME
- 	struct hmac_entry gmp;
-+#endif
- };
- 
- struct lib_paths
-@@ -181,7 +187,9 @@ struct lib_paths
- 	char gnutls[GNUTLS_PATH_MAX];
- 	char nettle[GNUTLS_PATH_MAX];
- 	char hogweed[GNUTLS_PATH_MAX];
-+#ifdef GMP_LIBRARY_SONAME
- 	char gmp[GNUTLS_PATH_MAX];
-+#endif
- };
- 
- /*
-@@ -245,8 +253,10 @@ static int handler(void *user, const cha
- 		return lib_handler(&p->nettle, section, name, value);
- 	} else if (!strcmp(section, HOGWEED_LIBRARY_NAME)) {
- 		return lib_handler(&p->hogweed, section, name, value);
-+#ifdef GMP_LIBRARY_SONAME
- 	} else if (!strcmp(section, GMP_LIBRARY_NAME)) {
- 		return lib_handler(&p->gmp, section, name, value);
-+#endif
- 	} else {
- 		return 0;
- 	}
-@@ -389,8 +399,10 @@ static int callback(struct dl_phdr_info
- 		_gnutls_str_cpy(paths->nettle, GNUTLS_PATH_MAX, path);
- 	else if (!strcmp(soname, HOGWEED_LIBRARY_SONAME))
- 		_gnutls_str_cpy(paths->hogweed, GNUTLS_PATH_MAX, path);
-+#ifdef GMP_LIBRARY_SONAME
- 	else if (!strcmp(soname, GMP_LIBRARY_SONAME))
- 		_gnutls_str_cpy(paths->gmp, GNUTLS_PATH_MAX, path);
-+#endif
- 	return 0;
- }
- 
-@@ -411,10 +423,12 @@ static int load_lib_paths(struct lib_pat
- 		_gnutls_debug_log("Hogweed library path was not found\n");
- 		return gnutls_assert_val(GNUTLS_E_FILE_ERROR);
- 	}
-+#ifdef GMP_LIBRARY_SONAME
- 	if (paths->gmp[0] == '\0') {
- 		_gnutls_debug_log("Gmp library path was not found\n");
- 		return gnutls_assert_val(GNUTLS_E_FILE_ERROR);
- 	}
-+#endif
- 
- 	return GNUTLS_E_SUCCESS;
- }
-@@ -467,9 +481,11 @@ static int check_binary_integrity(void)
- 	ret = check_lib_hmac(&hmac.hogweed, paths.hogweed);
- 	if (ret < 0)
- 		return ret;
-+#ifdef GMP_LIBRARY_SONAME
- 	ret = check_lib_hmac(&hmac.gmp, paths.gmp);
- 	if (ret < 0)
- 		return ret;
-+#endif
- 
- 	return 0;
- }
-diff --color -ruNp a/lib/fipshmac.c b/lib/fipshmac.c
--- a/lib/fipshmac.c	2022-12-15 11:06:16.785726102 +0100
-+++ b/lib/fipshmac.c	2022-12-15 11:13:34.533320156 +0100
-@@ -107,8 +107,10 @@ static int callback(struct dl_phdr_info
- 		return print_lib(path, soname);
- 	if (!strcmp(soname, HOGWEED_LIBRARY_SONAME))
- 		return print_lib(path, soname);
-+#ifdef GMP_LIBRARY_SONAME
- 	if (!strcmp(soname, GMP_LIBRARY_SONAME))
- 		return print_lib(path, soname);
-+#endif
-         return 0;
- }
- 
-diff --color -ruNp a/lib/global.c b/lib/global.c
--- a/lib/global.c	2022-12-15 11:06:16.061711888 +0100
-+++ b/lib/global.c	2022-12-15 11:08:35.604451446 +0100
-@@ -540,7 +540,9 @@ static const struct gnutls_library_confi
- 	{ "libgnutls-soname", GNUTLS_LIBRARY_SONAME },
- 	{ "libnettle-soname", NETTLE_LIBRARY_SONAME },
- 	{ "libhogweed-soname", HOGWEED_LIBRARY_SONAME },
-+#ifdef GMP_LIBRARY_SONAME
- 	{ "libgmp-soname", GMP_LIBRARY_SONAME },
-+#endif
- 	{ "hardware-features", HW_FEATURES },
- 	{ "tls-features", TLS_FEATURES },
- 	{ NULL, NULL }
--- a/SOURCES/gnutls-3.7.6-ktls-disable-by-default.patch
+++ b/SOURCES/gnutls-3.7.6-ktls-disable-by-default.patch
@ -1,124 +0,0 @@
-From f41151c8a218f255af08362b74cd6ee0dfd45c00 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Franti=C5=A1ek=20Kren=C5=BEelok?=
- <krenzelok.frantisek@gmail.com>
-Date: Tue, 14 Jun 2022 16:16:11 +0200
-Subject: [PATCH] KTLS: disable by default enable by config
-
-KTLS will be disabled by default when build with `--enable-ktls` to
-enable it, use config file option `ktls = true` in [global] section.
-
-Signed-off-by: Frantisek Krenzelok <krenzelok.frantisek@gmail.com>
---
- doc/cha-config.texi | 18 ++++++++----------
- lib/gnutls_int.h    |  2 +-
- lib/handshake.c     |  2 +-
- lib/priority.c      | 12 ++++++------
- 4 files changed, 16 insertions(+), 18 deletions(-)
-
-diff --git a/doc/cha-config.texi b/doc/cha-config.texi
-index e550f2e4b1..eaab7fd799 100644
--- a/doc/cha-config.texi
-+++ b/doc/cha-config.texi
-@@ -26,7 +26,7 @@ used can be queried using @funcref{gnutls_get_system_config_file}.
- * Querying for disabled algorithms and protocols::
- * Overriding the parameter verification profile::
- * Overriding the default priority string::
-* Disabling system/acceleration protocols::
-+* Enabling/Disabling system/acceleration protocols::
- @end menu
- 
- @node Application-specific priority strings
-@@ -253,16 +253,14 @@ default-priority-string = SECURE128:-VERS-TLS-ALL:+VERS-TLS1.3
- @end example
- 
- 
-@node Disabling system/acceleration protocols
-@section Disabling system/acceleration protocols
-When system/acceleration protocol is enabled during build, it is usually
-enabled by default. The following options can overwrite this behavior
-system-wide.
-+@node Enabling/Disabling system/acceleration protocols
-+@section Enabling/Disabling system/acceleration protocols
-+The following options can overwrite default behavior of protocols system-wide.
- @example
- [global]
-ktls = false
-+ktls = true
- 
- @end example
-@subsection Disabling KTLS
-When GnuTLS is build with -–enable-ktls configuration, it uses KTLS by default.
-This can be overwritten by setting @code{ktls = false} in @code{[global]} section.
-+@subsection Enabling KTLS
-+When GnuTLS is build with -–enable-ktls configuration, KTLS is disabled by default.
-+This can be enabled by setting @code{ktls = true} in @code{[global]} section.
-diff --git a/lib/gnutls_int.h b/lib/gnutls_int.h
-index 872188696b..8c7bdaa1db 100644
--- a/lib/gnutls_int.h
-+++ b/lib/gnutls_int.h
-@@ -1649,6 +1649,6 @@ get_certificate_type(gnutls_session_t session,
- 
- extern unsigned int _gnutls_global_version;
- 
-bool _gnutls_config_is_ktls_disabled(void);
-+bool _gnutls_config_is_ktls_enabled(void);
- 
- #endif /* GNUTLS_LIB_GNUTLS_INT_H */
-diff --git a/lib/handshake.c b/lib/handshake.c
-index f3edbbdacb..4dd457bf22 100644
--- a/lib/handshake.c
-+++ b/lib/handshake.c
-@@ -2815,7 +2815,7 @@ int gnutls_handshake(gnutls_session_t session)
- 
- 	session->internals.ktls_enabled = 0;
- #ifdef ENABLE_KTLS
-	if (_gnutls_config_is_ktls_disabled() == false)
-+	if (_gnutls_config_is_ktls_enabled() == true)
- 		_gnutls_ktls_enable(session);
- #endif
- 
-diff --git a/lib/priority.c b/lib/priority.c
-index 7279c03c88..d163d8169f 100644
--- a/lib/priority.c
-+++ b/lib/priority.c
-@@ -1027,7 +1027,7 @@ static void dummy_func(gnutls_priority_t c)
- 
- struct cfg {
- 	bool allowlisting;
-	bool ktls_disabled;
-+	bool ktls_enabled;
- 
- 	name_val_array_t priority_strings;
- 	char *priority_string;
-@@ -1140,7 +1140,7 @@ cfg_steal(struct cfg *dst, struct cfg *src)
- 	src->default_priority_string = NULL;
- 
- 	dst->allowlisting = src->allowlisting;
-	dst->ktls_disabled = src->ktls_disabled;
-+	dst->ktls_enabled = src->ktls_enabled;
- 	memcpy(dst->ciphers, src->ciphers, sizeof(src->ciphers));
- 	memcpy(dst->macs, src->macs, sizeof(src->macs));
- 	memcpy(dst->groups, src->groups, sizeof(src->groups));
-@@ -1268,8 +1268,8 @@ static int global_ini_handler(void *ctx, const char *section, const char *name,
- 			}
- 		} else if (c_strcasecmp(name, "ktls") == 0) {
- 			p = clear_spaces(value, str);
-			if (c_strcasecmp(p, "false") == 0) {
-				cfg->ktls_disabled = true;
-+			if (c_strcasecmp(p, "true") == 0) {
-+				cfg->ktls_enabled = true;
- 			} else {
- 				_gnutls_debug_log("cfg: unknown ktls mode %s\n",
- 					p);
-@@ -3490,6 +3490,6 @@ gnutls_priority_string_list(unsigned iter, unsigned int flags)
- 	return NULL;
- }
- 
-bool _gnutls_config_is_ktls_disabled(void){
-	return system_wide_config.ktls_disabled;
-+bool _gnutls_config_is_ktls_enabled(void){
-+	return system_wide_config.ktls_enabled;
- }
-- 
-2.36.1
-
--- a/SOURCES/gnutls-3.7.6-ktls-fixes.patch
+++ b/SOURCES/gnutls-3.7.6-ktls-fixes.patch
@ -1,348 +0,0 @@
-From 7b700dbcd5907944a7dd2f74cd26ad8586cd4bac Mon Sep 17 00:00:00 2001
-From: Daiki Ueno <ueno@gnu.org>
-Date: Tue, 28 Jun 2022 09:37:22 +0900
-Subject: [PATCH 1/3] tests: enable KTLS config while running gnutls_ktls test
-
-Signed-off-by: Daiki Ueno <ueno@gnu.org>
---
- tests/Makefile.am   |  9 +++++----
- tests/gnutls_ktls.c |  4 ++--
- tests/ktls.sh       | 46 +++++++++++++++++++++++++++++++++++++++++++++
- 3 files changed, 53 insertions(+), 6 deletions(-)
- create mode 100755 tests/ktls.sh
-
-diff --git a/tests/Makefile.am b/tests/Makefile.am
-index 4deeb6462b..cba67e8db8 100644
--- a/tests/Makefile.am
-+++ b/tests/Makefile.am
-@@ -441,10 +441,6 @@ ctests += x509self x509dn anonself pskself pskself2 dhepskself	\
- 	resume-with-record-size-limit
- endif
- 
-if ENABLE_KTLS
-ctests += gnutls_ktls
-endif
-
- ctests += record-sendfile
- 
- gc_CPPFLAGS = $(AM_CPPFLAGS) \
-@@ -500,6 +496,11 @@ if ENABLE_TPM2
- dist_check_SCRIPTS += tpm2.sh
- endif
- 
-+if ENABLE_KTLS
-+indirect_tests += gnutls_ktls
-+dist_check_SCRIPTS += ktls.sh
-+endif
-+
- if !WINDOWS
- 
- #
-diff --git a/tests/gnutls_ktls.c b/tests/gnutls_ktls.c
-index 3966e2b10a..8f9c5fa36e 100644
--- a/tests/gnutls_ktls.c
-+++ b/tests/gnutls_ktls.c
-@@ -84,7 +84,7 @@ static void client(int fd, const char *prio)
- 
- 	ret = gnutls_transport_is_ktls_enabled(session);
- 	if (!(ret & GNUTLS_KTLS_RECV)){
-		fail("client: KTLS was not properly inicialized\n");
-+		fail("client: KTLS was not properly initialized\n");
- 		goto end;
- 	}
- 
-@@ -208,7 +208,7 @@ static void server(int fd, const char *prio)
- 
- 	ret = gnutls_transport_is_ktls_enabled(session);
- 	if (!(ret & GNUTLS_KTLS_SEND)){
-		fail("server: KTLS was not properly inicialized\n");
-+		fail("server: KTLS was not properly initialized\n");
- 		goto end;
- 	}
- 	do {
-diff --git a/tests/ktls.sh b/tests/ktls.sh
-new file mode 100755
-index 0000000000..ba52bd5775
--- /dev/null
-+++ b/tests/ktls.sh
-@@ -0,0 +1,46 @@
-+#!/bin/sh
-+
-+# Copyright (C) 2022 Red Hat, Inc.
-+#
-+# Author: Daiki Ueno
-+#
-+# This file is part of GnuTLS.
-+#
-+# GnuTLS is free software; you can redistribute it and/or modify it
-+# under the terms of the GNU General Public License as published by the
-+# Free Software Foundation; either version 3 of the License, or (at
-+# your option) any later version.
-+#
-+# GnuTLS is distributed in the hope that it will be useful, but
-+# WITHOUT ANY WARRANTY; without even the implied warranty of
-+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-+# General Public License for more details.
-+#
-+# You should have received a copy of the GNU General Public License
-+# along with GnuTLS; if not, write to the Free Software Foundation,
-+# Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-+
-+: ${builddir=.}
-+
-+. "$srcdir/scripts/common.sh"
-+
-+if ! grep '^tls ' /proc/modules 2>1 >& /dev/null; then
-+    exit 77
-+fi
-+
-+testdir=`create_testdir ktls`
-+
-+cfg="$testdir/config"
-+
-+cat <<EOF > "$cfg"
-+[global]
-+ktls = true
-+EOF
-+
-+GNUTLS_SYSTEM_PRIORITY_FAIL_ON_INVALID=1 \
-+GNUTLS_SYSTEM_PRIORITY_FILE="$cfg" \
-+"$builddir/gnutls_ktls" "$@"
-+rc=$?
-+
-+rm -rf "$testdir"
-+exit $rc
-- 
-2.36.1
-
-
-From 4a492462535a7f3a831685d3cf420b50ef219511 Mon Sep 17 00:00:00 2001
-From: Daiki Ueno <ueno@gnu.org>
-Date: Tue, 28 Jun 2022 10:23:33 +0900
-Subject: [PATCH 2/3] handshake: do not reset KTLS enablement in
- gnutls_handshake
-
-As gnutls_handshake can be repeatedly called upon non-blocking setup,
-we shouldn't try to call setsockopt for KTLS upon every call.
-
-Signed-off-by: Daiki Ueno <ueno@gnu.org>
---
- lib/handshake.c | 12 ++++++------
- 1 file changed, 6 insertions(+), 6 deletions(-)
-
-diff --git a/lib/handshake.c b/lib/handshake.c
-index 4dd457bf22..3886306eb4 100644
--- a/lib/handshake.c
-+++ b/lib/handshake.c
-@@ -2813,12 +2813,6 @@ int gnutls_handshake(gnutls_session_t session)
- 	const version_entry_st *vers = get_version(session);
- 	int ret;
- 
-	session->internals.ktls_enabled = 0;
-#ifdef ENABLE_KTLS
-	if (_gnutls_config_is_ktls_enabled() == true)
-		_gnutls_ktls_enable(session);
-#endif
-
- 	if (unlikely(session->internals.initial_negotiation_completed)) {
- 		if (vers->tls13_sem) {
- 			if (session->security_parameters.entity == GNUTLS_CLIENT) {
-@@ -2864,6 +2858,12 @@ int gnutls_handshake(gnutls_session_t session)
- 			end->tv_nsec =
- 				(start->tv_nsec + tmo_ms * 1000000LL) % 1000000000LL;
- 		}
-+
-+#ifdef ENABLE_KTLS
-+		if (_gnutls_config_is_ktls_enabled()) {
-+			_gnutls_ktls_enable(session);
-+		}
-+#endif
- 	}
- 
- 	if (session->internals.recv_state == RECV_STATE_FALSE_START) {
-- 
-2.36.1
-
-
-From ce13208e13b5dec73993c583d4c64ab7714e4a7a Mon Sep 17 00:00:00 2001
-From: Daiki Ueno <ueno@gnu.org>
-Date: Tue, 28 Jun 2022 10:53:55 +0900
-Subject: [PATCH 3/3] ktls: _gnutls_ktls_enable: fix GNUTLS_KTLS_SEND
- calculation
-
-Previously, if the first setsockopt for GNUTLS_KTLS_RECV fails and the
-same socket is used for both sending and receiving, GNUTLS_KTLS_SEND
-was unconditionally set.  This fixes the conditions and also adds more
-logging.
-
-Signed-off-by: Daiki Ueno <ueno@gnu.org>
---
- lib/system/ktls.c | 21 ++++++++++++++++-----
- 1 file changed, 16 insertions(+), 5 deletions(-)
-
-diff --git a/lib/system/ktls.c b/lib/system/ktls.c
-index b9f7a73fb5..ddf27fac76 100644
--- a/lib/system/ktls.c
-+++ b/lib/system/ktls.c
-@@ -47,7 +47,7 @@
- gnutls_transport_ktls_enable_flags_t
- gnutls_transport_is_ktls_enabled(gnutls_session_t session){
- 	if (unlikely(!session->internals.initial_negotiation_completed)){
-		_gnutls_debug_log("Initial negotiation is not yet complete");
-+		_gnutls_debug_log("Initial negotiation is not yet complete\n");
- 		return 0;
- 	}
- 
-@@ -57,16 +57,27 @@ gnutls_transport_is_ktls_enabled(gnutls_session_t session){
- void _gnutls_ktls_enable(gnutls_session_t session)
- {
- 	int sockin, sockout;
-+
- 	gnutls_transport_get_int2(session, &sockin, &sockout);
- 
-	if (setsockopt(sockin, SOL_TCP, TCP_ULP, "tls", sizeof ("tls")) == 0)
-+	if (setsockopt(sockin, SOL_TCP, TCP_ULP, "tls", sizeof ("tls")) == 0) {
- 		session->internals.ktls_enabled |= GNUTLS_KTLS_RECV;
-+		if (sockin == sockout) {
-+			session->internals.ktls_enabled |= GNUTLS_KTLS_SEND;
-+		}
-+	} else {
-+		_gnutls_record_log("Unable to set TCP_ULP for read socket: %d\n",
-+				   errno);
-+	}
- 
- 	if (sockin != sockout) {
-		if (setsockopt(sockout, SOL_TCP, TCP_ULP, "tls", sizeof ("tls")) == 0)
-+		if (setsockopt(sockout, SOL_TCP, TCP_ULP, "tls", sizeof ("tls")) == 0) {
- 			session->internals.ktls_enabled |= GNUTLS_KTLS_SEND;
-	} else
-		session->internals.ktls_enabled |= GNUTLS_KTLS_SEND;
-+		} else {
-+			_gnutls_record_log("Unable to set TCP_ULP for write socket: %d\n",
-+					   errno);
-+		}
-+	}
- }
- 
- int _gnutls_ktls_set_keys(gnutls_session_t session)
-- 
-2.36.1
-
-From 2d3cba6bb21acb40141180298f3924c73c7de8f8 Mon Sep 17 00:00:00 2001
-From: Daiki Ueno <ueno@gnu.org>
-Date: Tue, 26 Jul 2022 11:38:41 +0900
-Subject: [PATCH 1/2] handshake: do not enable KTLS if custom pull/push
- functions are set
-
-If gnutls_transport_set_pull_function or
-gnutls_transport_set_push_function is used, we can't assume the
-underlying transport handle is an FD.
-
-Signed-off-by: Daiki Ueno <ueno@gnu.org>
---
- lib/handshake.c | 9 ++++++++-
- 1 file changed, 8 insertions(+), 1 deletion(-)
-
-diff --git a/lib/handshake.c b/lib/handshake.c
-index 3886306eb4..cf025a84f6 100644
--- a/lib/handshake.c
-+++ b/lib/handshake.c
-@@ -2861,7 +2861,14 @@ int gnutls_handshake(gnutls_session_t session)
- 
- #ifdef ENABLE_KTLS
- 		if (_gnutls_config_is_ktls_enabled()) {
-			_gnutls_ktls_enable(session);
-+			if (session->internals.pull_func ||
-+			    session->internals.push_func) {
-+				_gnutls_audit_log(session,
-+						  "Not enabling KTLS with "
-+						  "custom pull/push function\n");
-+			} else {
-+				_gnutls_ktls_enable(session);
-+			}
- 		}
- #endif
- 	}
-- 
-2.37.1
-
-
-From f7160e4fb970b4ba6f96e85e21f8395eae735d95 Mon Sep 17 00:00:00 2001
-From: Daiki Ueno <ueno@gnu.org>
-Date: Tue, 26 Jul 2022 11:39:57 +0900
-Subject: [PATCH 2/2] socket: only set pull/push functions when --save-*-trace
- is used
-
-This allows gnutls-cli to use KTLS for the transport, unless either
--save-client-trace or --save-server-trace is used.
-
-Signed-off-by: Daiki Ueno <ueno@gnu.org>
---
- src/socket.c | 16 ++++++++--------
- 1 file changed, 8 insertions(+), 8 deletions(-)
-
-diff --git a/src/socket.c b/src/socket.c
-index 39f18dbe18..36ac292700 100644
--- a/src/socket.c
-+++ b/src/socket.c
-@@ -586,16 +586,16 @@ socket_open2(socket_st * hd, const char *hostname, const char *service,
- 				gnutls_session_set_data(hd->session, hd->rdata.data, hd->rdata.size);
- 			}
- 
-			if (server_trace)
-+			if (client_trace || server_trace) {
- 				hd->server_trace = server_trace;
-
-			if (client_trace)
- 				hd->client_trace = client_trace;
-
-			gnutls_transport_set_push_function(hd->session, wrap_push);
-			gnutls_transport_set_pull_function(hd->session, wrap_pull);
-			gnutls_transport_set_pull_timeout_function(hd->session, wrap_pull_timeout_func);
-			gnutls_transport_set_ptr(hd->session, hd);
-+				gnutls_transport_set_push_function(hd->session, wrap_push);
-+				gnutls_transport_set_pull_function(hd->session, wrap_pull);
-+				gnutls_transport_set_pull_timeout_function(hd->session, wrap_pull_timeout_func);
-+				gnutls_transport_set_ptr(hd->session, hd);
-+			} else {
-+				gnutls_transport_set_int(hd->session, hd->fd);
-+			}
- 		}
- 
- 		if (!(flags & SOCKET_FLAG_RAW) && !(flags & SOCKET_FLAG_SKIP_INIT)) {
-- 
-2.37.1
-
-From a5b671fc9105cb5dbe6e6a1c0f39fa787d862076 Mon Sep 17 00:00:00 2001
-From: Frantisek Krenzelok <krenzelok.frantisek@gmail.com>
-Date: Fri, 29 Jul 2022 10:38:42 +0200
-Subject: [PATCH] KTLS: hotfix
-
-session->internals.pull_func is set to system_read during gnutls_init()
-so check for user set pull/push function added in commit mentioned
-bellow will never pass.
-
-source: 2d3cba6bb21acb40141180298f3924c73c7de8f8
-
-Signed-off-by: Frantisek Krenzelok <krenzelok.frantisek@gmail.com>
---
- lib/handshake.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/lib/handshake.c b/lib/handshake.c
-index cf025a84f6..21edc5ece9 100644
--- a/lib/handshake.c
-+++ b/lib/handshake.c
-@@ -2861,7 +2861,8 @@ int gnutls_handshake(gnutls_session_t session)
- 
- #ifdef ENABLE_KTLS
- 		if (_gnutls_config_is_ktls_enabled()) {
-			if (session->internals.pull_func ||
-+			if ((session->internals.pull_func &&
-+				session->internals.pull_func != system_read) ||
- 			    session->internals.push_func) {
- 				_gnutls_audit_log(session,
- 						  "Not enabling KTLS with "
-- 
-2.37.1
-
--- a/SOURCES/gnutls-3.7.7-aes-cbc-padding-support.patch
+++ b/SOURCES/gnutls-3.7.7-aes-cbc-padding-support.patch
@ -1,433 +0,0 @@
-diff --color -ruNp a/doc/Makefile.am b/doc/Makefile.am
--- a/doc/Makefile.am	2022-11-15 14:14:10.632725399 +0100
-+++ b/doc/Makefile.am	2022-11-15 14:14:40.252300863 +0100
-@@ -575,6 +575,7 @@ ENUMS += enums/gnutls_certificate_verifi
- ENUMS += enums/gnutls_certificate_verify_flags
- ENUMS += enums/gnutls_channel_binding_t
- ENUMS += enums/gnutls_cipher_algorithm_t
-+ENUMS += enums/gnutls_cipher_flags_t
- ENUMS += enums/gnutls_close_request_t
- ENUMS += enums/gnutls_compression_method_t
- ENUMS += enums/gnutls_credentials_type_t
-@@ -882,12 +883,16 @@ FUNCS += functions/gnutls_cipher_decrypt
- FUNCS += functions/gnutls_cipher_decrypt.short
- FUNCS += functions/gnutls_cipher_decrypt2
- FUNCS += functions/gnutls_cipher_decrypt2.short
-+FUNCS += functions/gnutls_cipher_decrypt3
-+FUNCS += functions/gnutls_cipher_decrypt3.short
- FUNCS += functions/gnutls_cipher_deinit
- FUNCS += functions/gnutls_cipher_deinit.short
- FUNCS += functions/gnutls_cipher_encrypt
- FUNCS += functions/gnutls_cipher_encrypt.short
- FUNCS += functions/gnutls_cipher_encrypt2
- FUNCS += functions/gnutls_cipher_encrypt2.short
-+FUNCS += functions/gnutls_cipher_encrypt3
-+FUNCS += functions/gnutls_cipher_encrypt3.short
- FUNCS += functions/gnutls_cipher_get
- FUNCS += functions/gnutls_cipher_get.short
- FUNCS += functions/gnutls_cipher_get_block_size
-diff --color -ruNp a/doc/manpages/Makefile.am b/doc/manpages/Makefile.am
--- a/doc/manpages/Makefile.am	2022-11-15 14:14:10.634725438 +0100
-+++ b/doc/manpages/Makefile.am	2022-11-15 14:14:40.254300902 +0100
-@@ -273,9 +273,11 @@ APIMANS += gnutls_check_version.3
- APIMANS += gnutls_cipher_add_auth.3
- APIMANS += gnutls_cipher_decrypt.3
- APIMANS += gnutls_cipher_decrypt2.3
-+APIMANS += gnutls_cipher_decrypt3.3
- APIMANS += gnutls_cipher_deinit.3
- APIMANS += gnutls_cipher_encrypt.3
- APIMANS += gnutls_cipher_encrypt2.3
-+APIMANS += gnutls_cipher_encrypt3.3
- APIMANS += gnutls_cipher_get.3
- APIMANS += gnutls_cipher_get_block_size.3
- APIMANS += gnutls_cipher_get_id.3
-diff --color -ruNp a/lib/crypto-api.c b/lib/crypto-api.c
--- a/lib/crypto-api.c	2022-11-15 14:14:11.036733248 +0100
-+++ b/lib/crypto-api.c	2022-11-15 14:14:40.255300921 +0100
-@@ -413,6 +413,166 @@ gnutls_cipher_decrypt2(gnutls_cipher_hd_
- }
- 
- /**
-+ * gnutls_cipher_encrypt3:
-+ * @handle: is a #gnutls_cipher_hd_t type
-+ * @ptext: the data to encrypt
-+ * @ptext_len: the length of data to encrypt
-+ * @ctext: the encrypted data
-+ * @ctext_len: the length of encrypted data (initially must hold the maximum available size)
-+ * @flags: flags for padding
-+ *
-+ * This function will encrypt the given data using the algorithm
-+ * specified by the context. For block ciphers, @ptext_len is
-+ * typically a multiple of the block size. If not, the caller can
-+ * instruct the function to pad the last block according to @flags.
-+ * Currently, the only available padding scheme is
-+ * %GNUTLS_CIPHER_PADDING_PKCS7.
-+ *
-+ * If @ctext is not %NULL, it must hold enough space to store
-+ * resulting cipher text. To check the required size, this function
-+ * can be called with @ctext set to %NULL. Then @ctext_len will be
-+ * updated without performing actual encryption.
-+ *
-+ * Returns: Zero or a negative error code on error.
-+ *
-+ * Since: 3.7.7
-+ **/
-+int
-+gnutls_cipher_encrypt3(gnutls_cipher_hd_t handle,
-+		       const void *ptext, size_t ptext_len,
-+		       void *ctext, size_t *ctext_len,
-+		       unsigned flags)
-+{
-+	api_cipher_hd_st *h = handle;
-+	const cipher_entry_st *e = h->ctx_enc.e;
-+	int block_size = _gnutls_cipher_get_block_size(e);
-+	int ret = 0;
-+
-+	if (unlikely(ctext_len == NULL)) {
-+		return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
-+	}
-+
-+	if (_gnutls_cipher_type(e) == CIPHER_BLOCK &&
-+	    (flags & GNUTLS_CIPHER_PADDING_PKCS7)) {
-+		size_t n, r;
-+		uint8_t last_block[MAX_CIPHER_BLOCK_SIZE];
-+		const uint8_t *p = ptext;
-+		uint8_t *c = ctext;
-+
-+		if (!INT_ADD_OK(ptext_len, block_size, &n)) {
-+			return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
-+		}
-+
-+		n = (n / block_size) * block_size;
-+
-+		if (!ctext) {
-+			*ctext_len = n;
-+			return 0;
-+		}
-+
-+		if (*ctext_len < n) {
-+			return gnutls_assert_val(GNUTLS_E_SHORT_MEMORY_BUFFER);
-+		}
-+
-+		/* Encrypt up to the last complete block */
-+		r = ptext_len % block_size;
-+
-+		ret = _gnutls_cipher_encrypt2(&h->ctx_enc,
-+					      ptext, ptext_len - r,
-+					      ctext, ptext_len - r);
-+		if (ret < 0) {
-+			goto error;
-+		}
-+
-+		/* Encrypt the last block with padding */
-+		gnutls_memset(last_block, block_size - r, sizeof(last_block));
-+		if (r > 0) {
-+			memcpy(last_block, &p[ptext_len - r], r);
-+		}
-+		ret = _gnutls_cipher_encrypt2(&h->ctx_enc,
-+					      last_block, block_size,
-+					      &c[ptext_len - r], block_size);
-+		if (ret < 0) {
-+			goto error;
-+		}
-+		*ctext_len = n;
-+	} else {
-+		if (!ctext) {
-+			*ctext_len = ptext_len;
-+			return 0;
-+		}
-+
-+		ret = _gnutls_cipher_encrypt2(&h->ctx_enc, ptext, ptext_len,
-+					      ctext, *ctext_len);
-+		if (ret < 0) {
-+			goto error;
-+		}
-+		*ctext_len = ptext_len;
-+	}
-+
-+ error:
-+	if (ret < 0) {
-+		_gnutls_switch_fips_state(GNUTLS_FIPS140_OP_ERROR);
-+	} else {
-+		_gnutls_switch_fips_state(GNUTLS_FIPS140_OP_APPROVED);
-+	}
-+	return ret;
-+}
-+
-+/**
-+ * gnutls_cipher_decrypt3:
-+ * @handle: is a #gnutls_cipher_hd_t type
-+ * @ctext: the data to decrypt
-+ * @ctext_len: the length of data to decrypt
-+ * @ptext: the decrypted data
-+ * @ptext_len: the available length for decrypted data
-+ * @flags: flags for padding
-+ *
-+ * This function will decrypt the given data using the algorithm
-+ * specified by the context. If @flags is specified, padding for the
-+ * decrypted data will be removed accordingly and @ptext_len will be
-+ * updated.
-+ *
-+ * Returns: Zero or a negative error code on error.
-+ *
-+ * Since: 3.7.7
-+ **/
-+int
-+gnutls_cipher_decrypt3(gnutls_cipher_hd_t handle,
-+		       const void *ctext, size_t ctext_len,
-+		       void *ptext, size_t *ptext_len,
-+		       unsigned flags)
-+{
-+	api_cipher_hd_st *h = handle;
-+	int ret;
-+
-+	ret = gnutls_cipher_decrypt2(handle,
-+				     ctext, ctext_len,
-+				     ptext, *ptext_len);
-+	if (ret < 0) {
-+		return ret;
-+	}
-+
-+	if (_gnutls_cipher_type(h->ctx_enc.e) == CIPHER_BLOCK &&
-+	    (flags & GNUTLS_CIPHER_PADDING_PKCS7)) {
-+		uint8_t *p = ptext;
-+		uint8_t padding = p[*ptext_len - 1];
-+		if (!padding || padding > _gnutls_cipher_get_block_size(h->ctx_enc.e)) {
-+			return gnutls_assert_val(GNUTLS_E_DECRYPTION_FAILED);
-+		}
-+		/* Check that the prior bytes are all PADDING */
-+		for (size_t i = *ptext_len - padding; i < *ptext_len; i++) {
-+			if (padding != p[*ptext_len - 1]) {
-+				return gnutls_assert_val(GNUTLS_E_DECRYPTION_FAILED);
-+			}
-+		}
-+		*ptext_len -= padding;
-+	}
-+
-+	return 0;
-+}
-+
-+/**
-  * gnutls_cipher_deinit:
-  * @handle: is a #gnutls_cipher_hd_t type
-  *
-diff --color -ruNp a/lib/includes/gnutls/crypto.h b/lib/includes/gnutls/crypto.h
--- a/lib/includes/gnutls/crypto.h	2022-05-10 13:57:43.000000000 +0200
-+++ b/lib/includes/gnutls/crypto.h	2022-11-15 14:14:40.256300941 +0100
-@@ -49,6 +49,28 @@ int gnutls_cipher_encrypt2(gnutls_cipher
- 			   const void *text, size_t textlen,
- 			   void *ciphertext, size_t ciphertextlen);
- 
-+/**
-+ * gnutls_cipher_flags_t:
-+ * @GNUTLS_CIPHER_PADDING_PKCS7: Flag to indicate PKCS#7 padding
-+ *
-+ * Enumeration of flags to control block cipher padding, used by
-+ * gnutls_cipher_encrypt3() and gnutls_cipher_decrypt3().
-+ *
-+ * Since: 3.7.7
-+ */
-+typedef enum gnutls_cipher_flags_t {
-+	GNUTLS_CIPHER_PADDING_PKCS7 = 1
-+} gnutls_cipher_flags_t;
-+
-+int gnutls_cipher_encrypt3(gnutls_cipher_hd_t handle,
-+			   const void *ptext, size_t ptext_len,
-+			   void *ctext, size_t *ctext_len,
-+			   unsigned flags);
-+int gnutls_cipher_decrypt3(gnutls_cipher_hd_t handle,
-+			   const void *ctext, size_t ctext_len,
-+			   void *ptext, size_t *ptext_len,
-+			   unsigned flags);
-+
- void gnutls_cipher_set_iv(gnutls_cipher_hd_t handle, void *iv,
- 			  size_t ivlen);
- 
-diff --color -ruNp a/lib/libgnutls.map b/lib/libgnutls.map
--- a/lib/libgnutls.map	2022-11-15 14:14:11.142735308 +0100
-+++ b/lib/libgnutls.map	2022-11-15 14:14:40.256300941 +0100
-@@ -1403,6 +1403,8 @@ GNUTLS_3_7_7
- {
-  global:
- 	gnutls_fips140_run_self_tests;
-+	gnutls_cipher_encrypt3;
-+	gnutls_cipher_decrypt3;
-  local:
- 	*;
- } GNUTLS_3_7_5;
-diff --color -ruNp a/tests/cipher-padding.c b/tests/cipher-padding.c
--- a/tests/cipher-padding.c	1970-01-01 01:00:00.000000000 +0100
-+++ b/tests/cipher-padding.c	2022-11-15 14:14:40.258300980 +0100
-@@ -0,0 +1,160 @@
-+/*
-+ * Copyright (C) 2022 Red Hat, Inc.
-+ *
-+ * Author: Daiki Ueno
-+ *
-+ * This file is part of GnuTLS.
-+ *
-+ * The GnuTLS is free software; you can redistribute it and/or
-+ * modify it under the terms of the GNU Lesser General Public License
-+ * as published by the Free Software Foundation; either version 2.1 of
-+ * the License, or (at your option) any later version.
-+ *
-+ * This library is distributed in the hope that it will be useful, but
-+ * WITHOUT ANY WARRANTY; without even the implied warranty of
-+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-+ * Lesser General Public License for more details.
-+ *
-+ * You should have received a copy of the GNU Lesser General Public License
-+ * along with this program.  If not, see <https://www.gnu.org/licenses/>
-+ *
-+ */
-+
-+#include <config.h>
-+
-+#include <gnutls/crypto.h>
-+#include <limits.h>
-+#include <stdint.h>
-+#include <stdio.h>
-+#include "utils.h"
-+
-+static void tls_log_func(int level, const char *str)
-+{
-+	fprintf(stderr, "<%d>| %s", level, str);
-+}
-+
-+#define CLAMP(x, b) (((x) + (b)) / (b)) * (b)
-+
-+static void
-+start(gnutls_cipher_algorithm_t algo, size_t plaintext_size, unsigned int flags)
-+{
-+	int ret;
-+	gnutls_cipher_hd_t ch;
-+	uint8_t key16[64];
-+	uint8_t iv16[32];
-+	uint8_t plaintext[128];
-+	uint8_t ciphertext[128];
-+	size_t block_size;
-+	size_t size;
-+	gnutls_datum_t key, iv;
-+
-+	success("%s %zu %u\n",
-+		gnutls_cipher_get_name(algo), plaintext_size, flags);
-+
-+	block_size = gnutls_cipher_get_block_size(algo);
-+
-+	key.data = key16;
-+	key.size = gnutls_cipher_get_key_size(algo);
-+	assert(key.size <= sizeof(key16));
-+
-+	iv.data = iv16;
-+	iv.size = gnutls_cipher_get_iv_size(algo);
-+	assert(iv.size <= sizeof(iv16));
-+
-+	memset(iv.data, 0xff, iv.size);
-+	memset(key.data, 0xfe, key.size);
-+	memset(plaintext, 0xfa, sizeof(plaintext));
-+
-+	ret = gnutls_cipher_init(&ch, algo, &key, &iv);
-+	if (ret < 0) {
-+		fail("gnutls_cipher_init failed\n");
-+	}
-+
-+	/* Check overflow if PKCS#7 is requested */
-+	if (flags & GNUTLS_CIPHER_PADDING_PKCS7) {
-+		ret = gnutls_cipher_encrypt3(ch,
-+					     plaintext, SIZE_MAX,
-+					     NULL, &size,
-+					     flags);
-+		if (ret != GNUTLS_E_INVALID_REQUEST) {
-+			fail("gnutls_cipher_encrypt3 succeeded\n");
-+		}
-+	}
-+
-+	/* Get the ciphertext size */
-+	ret = gnutls_cipher_encrypt3(ch,
-+				     plaintext, plaintext_size,
-+				     NULL, &size,
-+				     flags);
-+	if (ret < 0) {
-+		fail("gnutls_cipher_encrypt3 failed\n");
-+	}
-+
-+	if (flags & GNUTLS_CIPHER_PADDING_PKCS7) {
-+		if (size <= plaintext_size) {
-+			fail("no padding appended\n");
-+		}
-+		if (size != CLAMP(plaintext_size, block_size)) {
-+			fail("size does not match: %zu (expected %zu)\n",
-+			     size, CLAMP(plaintext_size, block_size));
-+		}
-+	} else {
-+		if (size != plaintext_size) {
-+			fail("size does not match: %zu (expected %zu)\n",
-+			     size, plaintext_size);
-+		}
-+	}
-+
-+	/* Encrypt with padding */
-+	ret = gnutls_cipher_encrypt3(ch,
-+				     plaintext, plaintext_size,
-+				     ciphertext, &size,
-+				     flags);
-+	if (ret < 0) {
-+		fail("gnutls_cipher_encrypt3 failed\n");
-+	}
-+
-+	/* Decrypt with padding */
-+	ret = gnutls_cipher_decrypt3(ch,
-+				     ciphertext, size,
-+				     ciphertext, &size,
-+				     flags);
-+	if (ret < 0) {
-+		fail("gnutls_cipher_encrypt3 failed\n");
-+	}
-+
-+	if (size != plaintext_size) {
-+		fail("size does not match: %zu (expected %zu)\n",
-+		     size, plaintext_size);
-+	}
-+
-+	if (memcmp(ciphertext, plaintext, size) != 0) {
-+		fail("plaintext does not match\n");
-+	}
-+
-+	gnutls_cipher_deinit(ch);
-+}
-+
-+void doit(void) {
-+	int ret;
-+
-+	gnutls_global_set_log_function(tls_log_func);
-+	if (debug) {
-+		gnutls_global_set_log_level(4711);
-+	}
-+
-+	ret = global_init();
-+	if (ret < 0) {
-+		fail("Cannot initialize library\n");
-+	}
-+
-+	start(GNUTLS_CIPHER_AES_128_CBC, 0, GNUTLS_CIPHER_PADDING_PKCS7);
-+	start(GNUTLS_CIPHER_AES_128_CBC, 11, GNUTLS_CIPHER_PADDING_PKCS7);
-+	start(GNUTLS_CIPHER_AES_128_CBC, 77, GNUTLS_CIPHER_PADDING_PKCS7);
-+	start(GNUTLS_CIPHER_AES_128_CBC, 80, GNUTLS_CIPHER_PADDING_PKCS7);
-+
-+	start(GNUTLS_CIPHER_AES_128_CBC, 0, 0);
-+	start(GNUTLS_CIPHER_AES_128_CBC, 80, 0);
-+
-+	gnutls_global_deinit();
-+}
-diff --color -ruNp a/tests/Makefile.am b/tests/Makefile.am
--- a/tests/Makefile.am	2022-11-15 14:14:11.144735347 +0100
-+++ b/tests/Makefile.am	2022-11-15 14:14:40.257300960 +0100
-@@ -233,7 +233,7 @@ ctests += mini-record-2 simple gnutls_hm
- 	 tls13-without-timeout-func buffer status-request-revoked \
- 	 set_x509_ocsp_multi_cli kdf-api keylog-func handshake-write \
- 	 x509cert-dntypes id-on-xmppAddr tls13-compat-mode ciphersuite-name \
-	 x509-upnconstraint xts-key-check pkcs7-verify-double-free \
-+	 x509-upnconstraint cipher-padding xts-key-check pkcs7-verify-double-free \
- 	 fips-rsa-sizes tls12-rehandshake-ticket
- 
- ctests += tls-channel-binding
--- a/SOURCES/gnutls-3.7.8-fips-pct-dh.patch
+++ b/SOURCES/gnutls-3.7.8-fips-pct-dh.patch
@ -1,58 +0,0 @@
-From 51b721b69fd08ef1c4c4989f5e12b643e170ff56 Mon Sep 17 00:00:00 2001
-From: Pedro Monreal <pmgdeb@gmail.com>
-Date: Thu, 16 Feb 2023 17:02:38 +0100
-Subject: [PATCH] pk: extend pair-wise consistency to cover DH key generation
-
-Perform SP800 56A (rev 3) 5.6.2.1.4 Owner Assurance of Pair-wise
-Consistency check, even if we only support ephemeral DH, as it is
-required by FIPS 140-3 IG 10.3.A.
-
-Signed-off-by: Pedro Monreal <pmgdeb@gmail.com>
-Co-authored-by: Daiki Ueno <ueno@gnu.org>
---
- lib/nettle/pk.c | 29 +++++++++++++++++++++++++++++
- 1 file changed, 29 insertions(+)
-
-diff --git a/lib/nettle/pk.c b/lib/nettle/pk.c
-index d30bca594f..bd9c1b4c74 100644
--- a/lib/nettle/pk.c
-+++ b/lib/nettle/pk.c
-@@ -2642,6 +2642,35 @@ static int pct_test(gnutls_pk_algorithm_t algo,
- 		}
- 		break;
- 	case GNUTLS_PK_DH:
-+		{
-+			mpz_t y;
-+
-+			/* Perform SP800 56A (rev 3) 5.6.2.1.4 Owner Assurance
-+			 * of Pair-wise Consistency check, even if we only
-+			 * support ephemeral DH, as it is required by FIPS
-+			 * 140-3 IG 10.3.A.
-+			 *
-+			 * Use the private key, x, along with the generator g
-+			 * and prime modulus p included in the domain
-+			 * parameters associated with the key pair to compute
-+			 * g^x mod p. Compare the result to the public key, y.
-+			 */
-+			mpz_init(y);
-+			mpz_powm(y,
-+				 TOMPZ(params->params[DSA_G]),
-+				 TOMPZ(params->params[DSA_X]),
-+				 TOMPZ(params->params[DSA_P]));
-+			if (unlikely
-+			    (mpz_cmp(y, TOMPZ(params->params[DSA_Y])) != 0)) {
-+				ret =
-+				    gnutls_assert_val
-+				    (GNUTLS_E_PK_GENERATION_ERROR);
-+				mpz_clear(y);
-+				goto cleanup;
-+			}
-+			mpz_clear(y);
-+			break;
-+		}
- 	case GNUTLS_PK_ECDH_X25519:
- 	case GNUTLS_PK_ECDH_X448:
- 		ret = 0;
-- 
-2.39.2
-
--- a/SOURCES/gnutls-3.7.8-integrity-check.patch
+++ b/SOURCES/gnutls-3.7.8-integrity-check.patch
@ -1,54 +0,0 @@
-diff --color -ruNp a/lib/fips.c b/lib/fips.c
--- a/lib/fips.c	2022-11-15 16:10:56.183185457 +0100
-+++ b/lib/fips.c	2022-11-15 16:10:23.488530716 +0100
-@@ -360,11 +360,6 @@ static int check_lib_hmac(struct hmac_en
- 		return gnutls_assert_val(ret);
- 	}
- 
-	if (strncmp(entry->path, path, GNUTLS_PATH_MAX)) {
-		_gnutls_debug_log("Library path for %s does not match with HMAC file\n", lib);
-		return gnutls_assert_val(GNUTLS_E_PARSING_ERROR);
-	}
-
- 	_gnutls_debug_log("Loading: %s\n", path);
- 	ret = gnutls_load_file(path, &data);
- 	if (ret < 0) {
-diff --color -ruNp a/lib/fipshmac.c b/lib/fipshmac.c
--- a/lib/fipshmac.c	2022-11-15 16:10:56.183185457 +0100
-+++ b/lib/fipshmac.c	2022-11-15 16:10:23.489530737 +0100
-@@ -102,20 +102,30 @@ static int get_hmac(const char *path, ch
- static int print_lib_path(const char *path)
- {
- 	int ret;
-+	char *real_path = NULL;
- 	char hmac[HMAC_STR_SIZE];
- 
-	ret = get_hmac(path, hmac, sizeof(hmac));
-+	real_path = canonicalize_file_name(path);
-+	if (real_path == NULL) {
-+		fprintf(stderr, "Could not get realpath from %s\n", path);
-+		ret = GNUTLS_E_FILE_ERROR;
-+		goto cleanup;
-+	}
-+
-+	ret = get_hmac(real_path, hmac, sizeof(hmac));
- 	if (ret < 0) {
- 		fprintf(stderr, "Could not calculate HMAC for %s: %s\n",
-                        last_component(path), gnutls_strerror(ret));
-		return ret;
-+                        last_component(real_path), gnutls_strerror(ret));
-+		goto cleanup;
- 	}
- 
- 	printf("[%s]\n", last_component(path));
-	printf("path = %s\n", path);
-+	printf("path = %s\n", real_path);
- 	printf("hmac = %s\n", hmac);
- 
-	return 0;
-+cleanup:
-+	free(real_path);
-+	return ret;
- }
- 
- static int print_lib_dl(const char *lib, const char *sym)
--- a/SOURCES/gnutls-3.7.8-revert-hmac-name.patch
+++ b/SOURCES/gnutls-3.7.8-revert-hmac-name.patch
@ -1,534 +0,0 @@
-diff --color -ruNp a/configure.ac b/configure.ac
--- a/configure.ac	2022-05-27 09:17:26.000000000 +0200
-+++ b/configure.ac	2022-12-15 11:00:18.830698584 +0100
-@@ -619,6 +619,8 @@ if [ test "$enable_fips" = "yes" ];then
-     if test "x$fips_module_version" != xnone; then
-        AC_DEFINE_UNQUOTED([FIPS_MODULE_VERSION], ["$fips_module_version"], [The FIPS140 module version])
-     fi
-+
-+    AC_CHECK_FUNCS(dl_iterate_phdr)
-   else
-     enable_fips=no
-     AC_MSG_WARN([[
-diff --color -ruNp a/lib/fips.c b/lib/fips.c
--- a/lib/fips.c	2022-12-15 10:59:57.460279029 +0100
-+++ b/lib/fips.c	2022-12-15 11:00:18.831698604 +0100
-@@ -23,9 +23,11 @@
- #include <gnutls/gnutls.h>
- #include <gnutls/crypto.h>
- #include <unistd.h>
-+#include "dirname.h"
- #include "errors.h"
- #include "file.h"
- #include "inih/ini.h"
-+#include "str.h"
- #include <fips.h>
- #include <gnutls/self-test.h>
- #include <stdio.h>
-@@ -34,6 +36,10 @@
- 
- #include "gthreads.h"
- 
-+#ifdef HAVE_DL_ITERATE_PHDR
-+#include <link.h>
-+#endif
-+
- unsigned int _gnutls_lib_state = LIB_STATE_POWERON;
- 
- struct gnutls_fips140_context_st {
-@@ -153,7 +159,6 @@ void _gnutls_fips_mode_reset_zombie(void
- 
- #define HMAC_SIZE 32
- #define HMAC_ALGO GNUTLS_MAC_SHA256
-#define HMAC_FILE_NAME ".gnutls.hmac"
- #define HMAC_FORMAT_VERSION 1
- 
- struct hmac_entry
-@@ -162,51 +167,32 @@ struct hmac_entry
- 	uint8_t hmac[HMAC_SIZE];
- };
- 
-typedef struct
-+struct hmac_file
- {
- 	int version;
- 	struct hmac_entry gnutls;
- 	struct hmac_entry nettle;
- 	struct hmac_entry hogweed;
- 	struct hmac_entry gmp;
-} hmac_file;
-+};
- 
-static int get_library_path(const char* lib, const char* symbol, char* path, size_t path_size)
-+struct lib_paths
- {
-	int ret;
-	void *dl, *sym;
-	Dl_info info;
-
-	dl = dlopen(lib, RTLD_LAZY);
-	if (dl == NULL)
-		return gnutls_assert_val(GNUTLS_E_FILE_ERROR);
-
-	sym = dlsym(dl, symbol);
-	if (sym == NULL) {
-		ret = gnutls_assert_val(GNUTLS_E_FILE_ERROR);
-		goto cleanup;
-	}
-
-	ret = dladdr(sym, &info);
-	if (ret == 0) {
-		ret = gnutls_assert_val(GNUTLS_E_FILE_ERROR);
-		goto cleanup;
-	}
-
-	ret = snprintf(path, path_size, "%s", info.dli_fname);
-	if ((size_t)ret >= path_size) {
-		ret = gnutls_assert_val(GNUTLS_E_SHORT_MEMORY_BUFFER);
-		goto cleanup;
-	}
-
-	ret = 0;
-cleanup:
-	dlclose(dl);
-	return ret;
-}
-+	char gnutls[GNUTLS_PATH_MAX];
-+	char nettle[GNUTLS_PATH_MAX];
-+	char hogweed[GNUTLS_PATH_MAX];
-+	char gmp[GNUTLS_PATH_MAX];
-+};
- 
-/* Parses hmac data and copies hex value into dest.
-+/*
-+ * get_hmac:
-+ * @dest: buffer for the hex value
-+ * @value: hmac value
-+ *
-+ * Parses hmac data and copies hex value into dest.
-  * dest must point to at least HMAC_SIZE amount of memory
-+ *
-+ * Returns: 0 on success, a negative error code otherwise
-  */
- static int get_hmac(uint8_t *dest, const char *value)
- {
-@@ -245,7 +231,7 @@ lib_handler(struct hmac_entry *entry,
- 
- static int handler(void *user, const char *section, const char *name, const char *value)
- {
-	hmac_file *p = (hmac_file *)user;
-+	struct hmac_file *p = (struct hmac_file *)user;
- 
- 	if (!strcmp(section, "global")) {
- 		if (!strcmp(name, "format-version")) {
-@@ -267,24 +253,29 @@ static int handler(void *user, const cha
- 	return 1;
- }
- 
-static int get_hmac_path(char *mac_file, size_t mac_file_size)
-+/*
-+ * get_hmac_path:
-+ * @mac_file: buffer where the hmac file path will be written to
-+ * @mac_file_size: size of the mac_file buffer
-+ * @gnutls_path: path to the gnutls library, used to deduce hmac file path
-+ * 
-+ * Deduces hmac file path from the gnutls library path.
-+ *
-+ * Returns: 0 on success, a negative error code otherwise
-+ */
-+static int get_hmac_path(char *mac_file, size_t mac_file_size, const char *gnutls_path)
- {
- 	int ret;
- 	char *p;
-	char file[GNUTLS_PATH_MAX];
- 
-	ret = get_library_path(GNUTLS_LIBRARY_NAME, "gnutls_global_init",
-			       file, sizeof(file));
-	if (ret < 0)
-		return ret;
-
-	p = strrchr(file, '/');
-+	p = strrchr(gnutls_path, '/');
- 
- 	if (p == NULL)
-		ret = snprintf(mac_file, mac_file_size, HMAC_FILE_NAME);
-+		ret = snprintf(mac_file, mac_file_size, ".%s.hmac", gnutls_path);
- 	else
-		ret = snprintf(mac_file, mac_file_size,
-			       "%.*s/"HMAC_FILE_NAME, (int)(p - file), file);
-+		ret = snprintf(mac_file, mac_file_size, "%.*s/.%s.hmac",
-+			       (int)(p - gnutls_path), gnutls_path, p + 1);
-+
- 	if ((size_t)ret >= mac_file_size)
- 		return gnutls_assert_val(GNUTLS_E_SHORT_MEMORY_BUFFER);
- 
-@@ -293,10 +284,11 @@ static int get_hmac_path(char *mac_file,
- 		return GNUTLS_E_SUCCESS;
- 
- 	if (p == NULL)
-		ret = snprintf(mac_file, mac_file_size, "fipscheck/"HMAC_FILE_NAME);
-+		ret = snprintf(mac_file, mac_file_size, "fipscheck/.%s.hmac", gnutls_path);
- 	else
-		ret = snprintf(mac_file, mac_file_size,
-			       "%.*s/fipscheck/"HMAC_FILE_NAME, (int)(p - file), file);
-+		ret = snprintf(mac_file, mac_file_size, "%.*s/fipscheck/.%s.hmac",
-+			       (int)(p - gnutls_path), gnutls_path, p + 1);
-+
- 	if ((size_t)ret >= mac_file_size)
- 		return gnutls_assert_val(GNUTLS_E_SHORT_MEMORY_BUFFER);
- 
-@@ -307,51 +299,52 @@ static int get_hmac_path(char *mac_file,
- 	return GNUTLS_E_FILE_ERROR;
- }
- 
-static int load_hmac_file(hmac_file *p)
-+/*
-+ * load_hmac_file:
-+ * @hmac_file: hmac file structure
-+ * @hmac_path: path to the hmac file
-+ *
-+ * Loads the hmac file into the hmac file structure.
-+ *
-+ * Returns: 0 on success, a negative error code otherwise
-+ */
-+static int load_hmac_file(struct hmac_file *hmac_file, const char *hmac_path)
- {
- 	int ret;
- 	FILE *stream;
-	char hmac_path[GNUTLS_PATH_MAX];
-
-	ret = get_hmac_path(hmac_path, sizeof(hmac_path));
-	if (ret < 0)
-		return gnutls_assert_val(ret);
- 
- 	stream = fopen(hmac_path, "r");
- 	if (stream == NULL)
- 		return gnutls_assert_val(GNUTLS_E_FILE_ERROR);
- 
-	gnutls_memset(p, 0, sizeof(*p));
-	ret = ini_parse_file(stream, handler, p);
-+	gnutls_memset(hmac_file, 0, sizeof(*hmac_file));
-+	ret = ini_parse_file(stream, handler, hmac_file);
- 	fclose(stream);
- 	if (ret < 0)
- 		return gnutls_assert_val(GNUTLS_E_PARSING_ERROR);
- 
-	if (p->version != HMAC_FORMAT_VERSION)
-+	if (hmac_file->version != HMAC_FORMAT_VERSION)
- 		return gnutls_assert_val(GNUTLS_E_PARSING_ERROR);
- 
- 	return 0;
- }
- 
-/* Run an HMAC using the key above on the library binary data.
- * Returns 0 on success and negative value on error.
-+/*
-+ * check_lib_hmac:
-+ * @entry: hmac file entry
-+ * @path: path to the library which hmac should be compared
-+ *
-+ * Verify that HMAC from hmac file entry matches HMAC of given library.
-+ *
-+ * Returns: 0 on successful HMAC verification, a negative error code otherwise
-  */
-static int check_lib_hmac(struct hmac_entry *entry,
-			  const char *lib, const char *sym)
-+static int check_lib_hmac(struct hmac_entry *entry, const char *path)
- {
- 	int ret;
- 	unsigned prev;
-	char path[GNUTLS_PATH_MAX];
- 	uint8_t hmac[HMAC_SIZE];
- 	gnutls_datum_t data;
- 
-	ret = get_library_path(lib, sym, path, sizeof(path));
-	if (ret < 0) {
-		_gnutls_debug_log("Could not get lib path for %s: %s\n",
-				  lib, gnutls_strerror(ret));
-		return gnutls_assert_val(ret);
-	}
-
- 	_gnutls_debug_log("Loading: %s\n", path);
- 	ret = gnutls_load_file(path, &data);
- 	if (ret < 0) {
-@@ -382,28 +375,99 @@ static int check_lib_hmac(struct hmac_en
- 	return 0;
- }
- 
-+#ifdef HAVE_DL_ITERATE_PHDR
-+
-+static int callback(struct dl_phdr_info *info, size_t size, void *data)
-+{
-+	const char *path = info->dlpi_name;
-+	const char *soname = last_component(path);
-+	struct lib_paths *paths = (struct lib_paths *)data;
-+
-+	if (!strcmp(soname, GNUTLS_LIBRARY_SONAME))
-+		_gnutls_str_cpy(paths->gnutls, GNUTLS_PATH_MAX, path);
-+	else if (!strcmp(soname, NETTLE_LIBRARY_SONAME))
-+		_gnutls_str_cpy(paths->nettle, GNUTLS_PATH_MAX, path);
-+	else if (!strcmp(soname, HOGWEED_LIBRARY_SONAME))
-+		_gnutls_str_cpy(paths->hogweed, GNUTLS_PATH_MAX, path);
-+	else if (!strcmp(soname, GMP_LIBRARY_SONAME))
-+		_gnutls_str_cpy(paths->gmp, GNUTLS_PATH_MAX, path);
-+	return 0;
-+}
-+
-+static int load_lib_paths(struct lib_paths *paths)
-+{
-+	memset(paths, 0, sizeof(*paths));
-+	dl_iterate_phdr(callback, paths);
-+	
-+	if (paths->gnutls[0] == '\0') {
-+		_gnutls_debug_log("Gnutls library path was not found\n");
-+		return gnutls_assert_val(GNUTLS_E_FILE_ERROR);
-+	}
-+	if (paths->nettle[0] == '\0') {
-+		_gnutls_debug_log("Nettle library path was not found\n");
-+		return gnutls_assert_val(GNUTLS_E_FILE_ERROR);
-+	}
-+	if (paths->hogweed[0] == '\0') {
-+		_gnutls_debug_log("Hogweed library path was not found\n");
-+		return gnutls_assert_val(GNUTLS_E_FILE_ERROR);
-+	}
-+	if (paths->gmp[0] == '\0') {
-+		_gnutls_debug_log("Gmp library path was not found\n");
-+		return gnutls_assert_val(GNUTLS_E_FILE_ERROR);
-+	}
-+
-+	return GNUTLS_E_SUCCESS;
-+}
-+
-+#else
-+
-+static int load_lib_paths(struct lib_paths *paths)
-+{
-+	(void)paths;
-+	_gnutls_debug_log("Function dl_iterate_phdr is missing\n");
-+	return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);
-+}
-+
-+#endif /* HAVE_DL_ITERATE_PHDR */
-+
- static int check_binary_integrity(void)
- {
- 	int ret;
-	hmac_file file;
-+	struct lib_paths paths;
-+	struct hmac_file hmac;
-+	char hmac_path[GNUTLS_PATH_MAX];
-+
-+	ret = load_lib_paths(&paths);
-+	if (ret < 0) {
-+		_gnutls_debug_log("Could not load library paths: %s\n",
-+				  gnutls_strerror(ret));
-+		return ret;
-+	}
-+
-+	ret = get_hmac_path(hmac_path, sizeof(hmac_path), paths.gnutls);
-+	if (ret < 0) {
-+		_gnutls_debug_log("Could not get hmac file path: %s\n",
-+				  gnutls_strerror(ret));
-+		return ret;
-+	}
- 
-	ret = load_hmac_file(&file);
-+	ret = load_hmac_file(&hmac, hmac_path);
- 	if (ret < 0) {
- 		_gnutls_debug_log("Could not load hmac file: %s\n",
- 				  gnutls_strerror(ret));
- 		return ret;
- 	}
- 
-	ret = check_lib_hmac(&file.gnutls, GNUTLS_LIBRARY_NAME, "gnutls_global_init");
-+	ret = check_lib_hmac(&hmac.gnutls, paths.gnutls);
- 	if (ret < 0)
- 		return ret;
-	ret = check_lib_hmac(&file.nettle, NETTLE_LIBRARY_NAME, "nettle_aes_set_encrypt_key");
-+	ret = check_lib_hmac(&hmac.nettle, paths.nettle);
- 	if (ret < 0)
- 		return ret;
-	ret = check_lib_hmac(&file.hogweed, HOGWEED_LIBRARY_NAME, "nettle_mpz_sizeinbase_256_u");
-+	ret = check_lib_hmac(&hmac.hogweed, paths.hogweed);
- 	if (ret < 0)
- 		return ret;
-	ret = check_lib_hmac(&file.gmp, GMP_LIBRARY_NAME, "__gmpz_init");
-+	ret = check_lib_hmac(&hmac.gmp, paths.gmp);
- 	if (ret < 0)
- 		return ret;
- 
-diff --color -ruNp a/lib/fipshmac.c b/lib/fipshmac.c
--- a/lib/fipshmac.c	2022-12-15 10:59:57.461279049 +0100
-+++ b/lib/fipshmac.c	2022-12-15 11:00:18.832698623 +0100
-@@ -22,12 +22,14 @@
- 
- #include "config.h"
- 
-#include <gnutls/gnutls.h>
-#include <gnutls/crypto.h>
-#include <dlfcn.h>
-#include <stdint.h>
- #include <stdio.h>
- #include <stdlib.h>
-+
-+#ifdef HAVE_DL_ITERATE_PHDR
-+
-+#include <gnutls/gnutls.h>
-+#include <gnutls/crypto.h>
-+#include <link.h>
- #include "dirname.h"
- #include "errors.h"
- 
-@@ -36,40 +38,6 @@
- #define HMAC_ALGO GNUTLS_MAC_SHA256
- #define HMAC_STR_SIZE (2 * HMAC_SIZE + 1)
- 
-static int get_path(const char *lib, const char *symbol, char *path, size_t path_size)
-{
-	int ret;
-	void *dl, *sym;
-	Dl_info info;
-
-	dl = dlopen(lib, RTLD_LAZY);
-	if (dl == NULL)
-		return gnutls_assert_val(GNUTLS_E_FILE_ERROR);
-
-	sym = dlsym(dl, symbol);
-	if (sym == NULL) {
-		ret = gnutls_assert_val(GNUTLS_E_FILE_ERROR);
-		goto cleanup;
-	}
-
-	ret = dladdr(sym, &info);
-	if (ret == 0) {
-		ret = gnutls_assert_val(GNUTLS_E_FILE_ERROR);
-		goto cleanup;
-	}
-
-	ret = snprintf(path, path_size, "%s", info.dli_fname);
-	if ((size_t)ret >= path_size) {
-		ret = gnutls_assert_val(GNUTLS_E_SHORT_MEMORY_BUFFER);
-		goto cleanup;
-	}
-
-	ret = 0;
-cleanup:
-	dlclose(dl);
-	return ret;
-}
-
- static int get_hmac(const char *path, char *hmac, size_t hmac_size)
- {
- 	int ret;
-@@ -99,7 +67,7 @@ static int get_hmac(const char *path, ch
- 	return 0;
- }
- 
-static int print_lib_path(const char *path)
-+static int print_lib(const char *path, const char *soname)
- {
- 	int ret;
- 	char *real_path = NULL;
-@@ -119,7 +87,7 @@ static int print_lib_path(const char *pa
- 		goto cleanup;
- 	}
- 
-	printf("[%s]\n", last_component(path));
-+	printf("[%s]\n", soname);
- 	printf("path = %s\n", real_path);
- 	printf("hmac = %s\n", hmac);
- 
-@@ -128,25 +96,24 @@ cleanup:
- 	return ret;
- }
- 
-static int print_lib_dl(const char *lib, const char *sym)
-+static int callback(struct dl_phdr_info *info, size_t size, void *data)
- {
-	int ret;
-	char path[GNUTLS_PATH_MAX];
-
-	ret = get_path(lib, sym, path, sizeof(path));
-	if (ret < 0) {
-		fprintf(stderr, "Could not get lib path for %s: %s\n",
-                        lib, gnutls_strerror(ret));
-		return ret;
-	}
-+	const char *path = info->dlpi_name;
-+	const char *soname = last_component(path);
- 
-	return print_lib_path(path);
-+	if (!strcmp(soname, GNUTLS_LIBRARY_SONAME))
-+		return print_lib(data ? data : path, soname);
-+	if (!strcmp(soname, NETTLE_LIBRARY_SONAME))
-+		return print_lib(path, soname);
-+	if (!strcmp(soname, HOGWEED_LIBRARY_SONAME))
-+		return print_lib(path, soname);
-+	if (!strcmp(soname, GMP_LIBRARY_SONAME))
-+		return print_lib(path, soname);
-+        return 0;
- }
- 
- int main(int argc, char **argv)
- {
-	int ret;
-
- 	if (argc != 1 && argc != 2) {
- 		fprintf(stderr, "Usage: %s [gnutls_so_path]\n", last_component(argv[0]));
- 		return EXIT_FAILURE;
-@@ -155,24 +122,15 @@ int main(int argc, char **argv)
- 	printf("[global]\n");
- 	printf("format-version = %d\n", FORMAT_VERSION);
- 
-	if (argc == 2)
-		ret = print_lib_path(argv[1]);
-	else
-		ret = print_lib_dl(GNUTLS_LIBRARY_SONAME, "gnutls_global_init");
-	if (ret < 0)
-		return EXIT_FAILURE;
-+	return dl_iterate_phdr(callback, argc == 2 ? argv[1] : NULL);
-+}
- 
-	ret = print_lib_dl(NETTLE_LIBRARY_SONAME, "nettle_aes_set_encrypt_key");
-	if (ret < 0)
-		return EXIT_FAILURE;
-	
-	ret = print_lib_dl(HOGWEED_LIBRARY_SONAME, "nettle_mpz_sizeinbase_256_u");
-	if (ret < 0)
-		return EXIT_FAILURE;
-	
-	ret = print_lib_dl(GMP_LIBRARY_SONAME, "__gmpz_init");
-	if (ret < 0)
-		return EXIT_FAILURE;
-+#else
- 
-	return EXIT_SUCCESS;
-+int main(void)
-+{
-+	fprintf(stderr, "Function dl_iterate_phdr is missing\n");
-+	return EXIT_FAILURE;
- }
-+
-+#endif /* HAVE_DL_ITERATE_PHDR */
-diff --color -ruNp a/lib/Makefile.am b/lib/Makefile.am
--- a/lib/Makefile.am	2022-05-18 16:46:00.000000000 +0200
-+++ b/lib/Makefile.am	2022-12-15 11:00:18.789697779 +0100
-@@ -202,14 +202,14 @@ noinst_PROGRAMS = fipshmac
- fipshmac_SOURCES = fipshmac.c
- fipshmac_LDADD = libgnutls.la ../gl/libgnu.la
- 
-hmac_files = .libs/.gnutls.hmac
-+hmac_file = .libs/.$(gnutls_so).hmac
- 
-all-local: $(hmac_files)
-+all-local: $(hmac_file)
- 
-.libs/.gnutls.hmac: libgnutls.la fipshmac
-+$(hmac_file): libgnutls.la fipshmac
- 	$(AM_V_GEN) $(builddir)/fipshmac > $@-t && mv $@-t $@
- 
-CLEANFILES = $(hmac_files)
-+CLEANFILES = $(hmac_file)
- endif
- 
- if NEED_LTLIBDL
--- a/SOURCES/gnutls-3.7.8-xts-key-check.patch
+++ b/SOURCES/gnutls-3.7.8-xts-key-check.patch
@ -1,220 +0,0 @@
-diff --color -ruNp a/lib/accelerated/x86/aes-xts-x86-aesni.c b/lib/accelerated/x86/aes-xts-x86-aesni.c
--- a/lib/accelerated/x86/aes-xts-x86-aesni.c	2022-03-02 12:38:09.000000000 +0100
-+++ b/lib/accelerated/x86/aes-xts-x86-aesni.c	2022-11-07 14:12:38.476982750 +0100
-@@ -73,7 +73,6 @@ x86_aes_xts_cipher_setkey(void *_ctx, co
- 	/* Check key block according to FIPS-140-2 IG A.9 */
- 	if (_gnutls_fips_mode_enabled()){
- 		if (gnutls_memcmp(key, key + (keysize / 2), keysize / 2) == 0) {
-			_gnutls_switch_lib_state(LIB_STATE_ERROR);
- 			return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
- 		}
- 	}
-diff --color -ruNp a/lib/nettle/cipher.c b/lib/nettle/cipher.c
--- a/lib/nettle/cipher.c	2022-11-07 14:10:13.672085930 +0100
-+++ b/lib/nettle/cipher.c	2022-11-07 14:12:38.477982770 +0100
-@@ -448,12 +448,14 @@ _gcm_decrypt(struct nettle_cipher_ctx *c
- 		    length, dst, src);
- }
- 
-static void _des_set_key(struct des_ctx *ctx, const uint8_t *key)
-+static void
-+_des_set_key(struct des_ctx *ctx, const uint8_t *key)
- {
- 	des_set_key(ctx, key);
- }
- 
-static void _des3_set_key(struct des3_ctx *ctx, const uint8_t *key)
-+static void
-+_des3_set_key(struct des3_ctx *ctx, const uint8_t *key)
- {
- 	des3_set_key(ctx, key);
- }
-@@ -477,50 +479,6 @@ _cfb8_decrypt(struct nettle_cipher_ctx *
- }
- 
- static void
-_xts_aes128_set_encrypt_key(struct xts_aes128_key *xts_key,
-			    const uint8_t *key)
-{
-	if (_gnutls_fips_mode_enabled() &&
-	    gnutls_memcmp(key, key + AES128_KEY_SIZE, AES128_KEY_SIZE) == 0)
-		_gnutls_switch_lib_state(LIB_STATE_ERROR);
-
-	xts_aes128_set_encrypt_key(xts_key, key);
-}
-
-static void
-_xts_aes128_set_decrypt_key(struct xts_aes128_key *xts_key,
-			    const uint8_t *key)
-{
-	if (_gnutls_fips_mode_enabled() &&
-	    gnutls_memcmp(key, key + AES128_KEY_SIZE, AES128_KEY_SIZE) == 0)
-		_gnutls_switch_lib_state(LIB_STATE_ERROR);
-
-	xts_aes128_set_decrypt_key(xts_key, key);
-}
-
-static void
-_xts_aes256_set_encrypt_key(struct xts_aes256_key *xts_key,
-			    const uint8_t *key)
-{
-	if (_gnutls_fips_mode_enabled() &&
-	    gnutls_memcmp(key, key + AES256_KEY_SIZE, AES256_KEY_SIZE) == 0)
-		_gnutls_switch_lib_state(LIB_STATE_ERROR);
-
-	xts_aes256_set_encrypt_key(xts_key, key);
-}
-
-static void
-_xts_aes256_set_decrypt_key(struct xts_aes256_key *xts_key,
-			    const uint8_t *key)
-{
-	if (_gnutls_fips_mode_enabled() &&
-	    gnutls_memcmp(key, key + AES256_KEY_SIZE, AES256_KEY_SIZE) == 0)
-		_gnutls_switch_lib_state(LIB_STATE_ERROR);
-
-	xts_aes256_set_decrypt_key(xts_key, key);
-}
-
-static void
- _xts_aes128_encrypt(struct nettle_cipher_ctx *ctx, size_t length, uint8_t * dst,
- 		    const uint8_t * src)
- {
-@@ -1041,8 +999,8 @@ static const struct nettle_cipher_st bui
- 	   .ctx_size = sizeof(struct xts_aes128_key),
- 	   .encrypt = _xts_aes128_encrypt,
- 	   .decrypt = _xts_aes128_decrypt,
-	   .set_encrypt_key = (nettle_set_key_func*)_xts_aes128_set_encrypt_key,
-	   .set_decrypt_key = (nettle_set_key_func*)_xts_aes128_set_decrypt_key,
-+	   .set_encrypt_key = (nettle_set_key_func*)xts_aes128_set_encrypt_key,
-+	   .set_decrypt_key = (nettle_set_key_func*)xts_aes128_set_decrypt_key,
- 	   .max_iv_size = AES_BLOCK_SIZE,
- 	},
- 	{  .algo = GNUTLS_CIPHER_AES_256_XTS,
-@@ -1052,8 +1010,8 @@ static const struct nettle_cipher_st bui
- 	   .ctx_size = sizeof(struct xts_aes256_key),
- 	   .encrypt = _xts_aes256_encrypt,
- 	   .decrypt = _xts_aes256_decrypt,
-	   .set_encrypt_key = (nettle_set_key_func*)_xts_aes256_set_encrypt_key,
-	   .set_decrypt_key = (nettle_set_key_func*)_xts_aes256_set_decrypt_key,
-+	   .set_encrypt_key = (nettle_set_key_func*)xts_aes256_set_encrypt_key,
-+	   .set_decrypt_key = (nettle_set_key_func*)xts_aes256_set_decrypt_key,
- 	   .max_iv_size = AES_BLOCK_SIZE,
- 	},
- 	{  .algo = GNUTLS_CIPHER_AES_128_SIV,
-@@ -1144,6 +1102,21 @@ wrap_nettle_cipher_setkey(void *_ctx, co
- 		return 0;
- 	}
- 
-+	switch (ctx->cipher->algo) {
-+	case GNUTLS_CIPHER_AES_128_XTS:
-+		if (_gnutls_fips_mode_enabled() &&
-+		    gnutls_memcmp(key, (char *)key + AES128_KEY_SIZE, AES128_KEY_SIZE) == 0)
-+			return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
-+		break;
-+	case GNUTLS_CIPHER_AES_256_XTS:
-+		if (_gnutls_fips_mode_enabled() &&
-+		    gnutls_memcmp(key, (char *)key + AES256_KEY_SIZE, AES256_KEY_SIZE) == 0)
-+			return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
-+		break;
-+	default:
-+		break;
-+	}
-+
- 	if (ctx->enc)
- 		ctx->cipher->set_encrypt_key(ctx->ctx_ptr, key);
- 	else
-diff --color -ruNp a/tests/Makefile.am b/tests/Makefile.am
--- a/tests/Makefile.am	2022-11-07 14:10:13.836089211 +0100
-+++ b/tests/Makefile.am	2022-11-07 14:12:38.478982790 +0100
-@@ -233,7 +233,7 @@ ctests += mini-record-2 simple gnutls_hm
- 	 tls13-without-timeout-func buffer status-request-revoked \
- 	 set_x509_ocsp_multi_cli kdf-api keylog-func handshake-write \
- 	 x509cert-dntypes id-on-xmppAddr tls13-compat-mode ciphersuite-name \
-	 x509-upnconstraint pkcs7-verify-double-free \
-+	 x509-upnconstraint xts-key-check pkcs7-verify-double-free \
- 	 fips-rsa-sizes
- 
- ctests += tls-channel-binding
-diff --color -ruNp a/tests/xts-key-check.c b/tests/xts-key-check.c
--- a/tests/xts-key-check.c	1970-01-01 01:00:00.000000000 +0100
-+++ b/tests/xts-key-check.c	2022-11-07 14:12:38.478982790 +0100
-@@ -0,0 +1,78 @@
-+/*
-+ * Copyright (C) 2022 Red Hat, Inc.
-+ *
-+ * Author: Zoltan Fridrich
-+ *
-+ * This file is part of GnuTLS.
-+ *
-+ * GnuTLS is free software: you can redistribute it and/or modify it
-+ * under the terms of the GNU General Public License as published by
-+ * the Free Software Foundation, either version 3 of the License, or
-+ * (at your option) any later version.
-+ *
-+ * GnuTLS is distributed in the hope that it will be useful, but
-+ * WITHOUT ANY WARRANTY; without even the implied warranty of
-+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
-+ * General Public License for more details.
-+ *
-+ * You should have received a copy of the GNU General Public License
-+ * along with GnuTLS. If not, see <https://www.gnu.org/licenses/>.
-+ */
-+
-+#ifdef HAVE_CONFIG_H
-+#include <config.h>
-+#endif
-+
-+#include <gnutls/crypto.h>
-+
-+#include "utils.h"
-+
-+static void test_xts_check(gnutls_cipher_algorithm_t alg)
-+{
-+	int ret;
-+	gnutls_cipher_hd_t ctx;
-+	gnutls_datum_t key, iv;
-+
-+	iv.size = gnutls_cipher_get_iv_size(alg);
-+	iv.data = gnutls_malloc(iv.size);
-+	if (iv.data == NULL)
-+		fail("Error: %s\n", gnutls_strerror(GNUTLS_E_MEMORY_ERROR));
-+	gnutls_memset(iv.data, 0xf0, iv.size);
-+
-+	key.size = gnutls_cipher_get_key_size(alg);
-+	key.data = gnutls_malloc(key.size);
-+	if (key.data == NULL) {
-+		gnutls_free(iv.data);
-+		fail("Error: %s\n", gnutls_strerror(GNUTLS_E_MEMORY_ERROR));
-+	}
-+	gnutls_memset(key.data, 0xf0, key.size);
-+
-+	ret = gnutls_cipher_init(&ctx, alg, &key, &iv);
-+	if (ret == GNUTLS_E_SUCCESS) {
-+		gnutls_cipher_deinit(ctx);
-+		gnutls_free(iv.data);
-+		gnutls_free(key.data);
-+		fail("cipher initialization should fail for key1 == key2\n");
-+	}
-+
-+	key.data[0] = 0xff;
-+
-+	ret = gnutls_cipher_init(&ctx, alg, &key, &iv);
-+	gnutls_free(iv.data);
-+	gnutls_free(key.data);
-+
-+	if (ret == GNUTLS_E_SUCCESS)
-+		gnutls_cipher_deinit(ctx);
-+	else
-+		fail("cipher initialization should succeed with key1 != key2"
-+		     "\n%s\n", gnutls_strerror(ret));
-+}
-+
-+void doit(void)
-+{
-+	if (!gnutls_fips140_mode_enabled())
-+		exit(77);
-+
-+	test_xts_check(GNUTLS_CIPHER_AES_128_XTS);
-+	test_xts_check(GNUTLS_CIPHER_AES_256_XTS);
-+}
--- a/SPECS/gnutls.spec
+++ b/SPECS/gnutls.spec
@ -1,60 +1,20 @@
-%define srpmhash() %{lua:
-local files = rpm.expand("%_specdir/gnutls.spec")
-for i, p in ipairs(patches) do
-   files = files.." "..p
-end
-for i, p in ipairs(sources) do
-   files = files.." "..p
-end
-local sha256sum = assert(io.popen("cat "..files.."| sha256sum"))
-local hash = sha256sum:read("*a")
-sha256sum:close()
-print(string.sub(hash, 0, 16))
-}
-
-Version: 3.7.6
-Release: 23%{?dist}.3
-# not upstreamed
-Patch: gnutls-3.6.7-no-now-guile.patch
-Patch: gnutls-3.2.7-rpath.patch
-Patch: gnutls-3.7.2-enable-intel-cet.patch
-Patch: gnutls-3.7.2-no-explicit-init.patch
-
-# upstreamed
-Patch: gnutls-3.7.6-fips-run-selftests.patch
-Patch: gnutls-3.7.6-ktls-disable-by-default.patch
-Patch: gnutls-3.7.6-ktls-fixes.patch
-Patch: gnutls-3.7.6-aes-gcm-pt-limit.patch
-Patch: gnutls-3.7.6-pkcs7-verify.patch
-Patch: gnutls-3.7.6-fips-pkcs12-des-cbc.patch
-Patch: gnutls-3.7.6-fips-rsa-key-sizes.patch
-Patch: gnutls-3.7.6-fips-symkey-limit.patch
-Patch: gnutls-3.7.6-fips-ecdsa-hash-check.patch
-Patch: gnutls-3.7.8-xts-key-check.patch
-Patch: gnutls-3.7.8-clear-session-ticket.patch
-Patch: gnutls-3.7.7-aes-cbc-padding-support.patch
-Patch: gnutls-3.7.8-integrity-check.patch
-Patch: gnutls-3.7.6-fips-service-indicator-test-functions.patch
-Patch: gnutls-3.7.6-fips-ccm-taglen.patch
-Patch: gnutls-3.7.6-fips-rsa-pss-saltlen.patch
-Patch: gnutls-3.7.8-revert-hmac-name.patch
-Patch: gnutls-3.7.8-rsa-kx-timing.patch
-Patch: gnutls-3.7.8-fips-pct-dh.patch
-Patch: gnutls-3.7.6-fips-ems.patch
-Patch: gnutls-3.7.6-fips-sha1-sigver.patch
-Patch: gnutls-3.7.6-rsa-psk-timing.patch
-Patch: gnutls-3.7.6-rsa-psk-timing-followup.patch
-Patch: gnutls-3.7.6-ca-xsigned.patch
-Patch: gnutls-3.7.6-fips-integrity-zeroize.patch
-
-# not upstreamed
-Patch: gnutls-3.7.3-disable-config-reload.patch
-Patch: gnutls-3.7.3-fips-dsa-post.patch
-Patch: gnutls-3.7.6-drbg-reseed.patch
-Patch: gnutls-3.7.6-cpuid-fixes.patch
-Patch: gnutls-3.7.6-gmp-static.patch
-
-%bcond_without bootstrap
+Version:	3.6.16
+Release: 8%{?dist}.3
+Patch1:	gnutls-3.2.7-rpath.patch
+Patch2:	gnutls-3.6.4-no-now-guile.patch
+Patch3:	gnutls-3.6.13-enable-intel-cet.patch
+Patch10:	gnutls-3.6.14-fips-dh-selftests.patch
+Patch11:	gnutls-3.6.14-fips-kdf-selftests.patch
+Patch12:	gnutls-3.6.16-tls12-cert-type.patch
+Patch13:	gnutls-3.6.16-trust-ca-sha1.patch
+Patch14:	gnutls-3.6.16-doc-p11tool-ckaid.patch
+Patch15:	gnutls-3.6.16-pkcs7-verify.patch
+Patch16:	gnutls-3.6.16-cpuid.patch
+Patch17:	gnutls-3.7.8-rsa-kx-timing.patch
+Patch18:	gnutls-3.6.16-rehandshake-tickets.patch
+Patch19:	gnutls-3.6.16-rsa-psk-timing.patch
+Patch20:	gnutls-3.6.16-rsa-psk-timing-followup.patch
+Patch21:	gnutls-3.6.16-deterministic-ecdsa-fixes.patch
 %bcond_without dane
 %if 0%{?rhel}
 %bcond_with guile
@ -63,37 +23,25 @@ Patch: gnutls-3.7.6-gmp-static.patch
 %bcond_without guile
 %bcond_without fips
 %endif
-%bcond_with tpm12
-%bcond_without tpm2
-%bcond_with gost
-%bcond_with certificate_compression
-%bcond_without tests

 Summary: A TLS protocol implementation
 Name: gnutls
 # The libraries are LGPLv2.1+, utilities are GPLv3+
 License: GPLv3+ and LGPLv2+
+Group: System Environment/Libraries
 BuildRequires: p11-kit-devel >= 0.21.3, gettext-devel
-BuildRequires: readline-devel, libtasn1-devel >= 4.3
-%if %{with certificate_compression}
-BuildRequires: zlib-devel, brotli-devel, libzstd-devel
-%endif
-%if %{with bootstrap}
-BuildRequires: automake, autoconf, gperf, libtool
-%endif
-BuildRequires: texinfo
-BuildRequires: nettle-devel >= 3.5.1
-%if %{with tpm12}
+BuildRequires: zlib-devel, readline-devel, libtasn1-devel >= 4.3
+BuildRequires: libtool, automake, autoconf, texinfo
+BuildRequires: autogen-libopts-devel >= 5.18 autogen
+BuildRequires: nettle-devel >= 3.4.1
 BuildRequires: trousers-devel >= 0.3.11.2
-%endif
-%if %{with tpm2}
-BuildRequires: tpm2-tss-devel >= 3.0.3
-%endif
 BuildRequires: libidn2-devel
 BuildRequires: libunistring-devel
-BuildRequires: net-tools, datefudge, softhsm, gcc, gcc-c++
+BuildRequires: gperf, net-tools, datefudge, softhsm, gcc, gcc-c++
 BuildRequires: gnupg2
-BuildRequires: git-core
+%if %{with fips}
+BuildRequires: fipscheck
+%endif

 # for a sanity check on cert loading
 BuildRequires: p11-kit-trust, ca-certificates
@ -101,25 +49,18 @@ Requires: crypto-policies
 Requires: p11-kit-trust
 Requires: libtasn1 >= 4.3
 Requires: nettle >= 3.4.1
-%if %{with tpm12}
 Recommends: trousers >= 0.3.11.2
-%endif

 %if %{with dane}
 BuildRequires: unbound-devel unbound-libs
 %endif
 %if %{with guile}
-BuildRequires: guile22-devel
+BuildRequires: guile-devel
 %endif
-BuildRequires: make
 URL: http://www.gnutls.org/
-Source0: https://www.gnupg.org/ftp/gcrypt/gnutls/v3.7/%{name}-%{version}.tar.xz
-Source1: https://www.gnupg.org/ftp/gcrypt/gnutls/v3.7/%{name}-%{version}.tar.xz.sig
-Source2: gnutls-release-keyring.gpg
-
-Source100:	gmp-6.2.1.tar.xz
-# Taken from the main gmp package
-Source101:	gmp-6.2.1-intel-cet.patch
+Source0: ftp://ftp.gnutls.org/gcrypt/gnutls/v3.6/%{name}-%{version}.tar.xz
+Source1: ftp://ftp.gnutls.org/gcrypt/gnutls/v3.6/%{name}-%{version}.tar.xz.sig
+Source2: gpgkey-462225C3B46F34879FC8496CD605848ED7E69871.gpg

 # Wildcard bundling exception https://fedorahosted.org/fpc/ticket/174
 Provides: bundled(gnulib) = 20130424
@ -130,16 +71,20 @@ Requires: %{name}%{?_isa} = %{version}-%{release}

 %package devel
 Summary: Development files for the %{name} package
+Group: Development/Libraries
 Requires: %{name}%{?_isa} = %{version}-%{release}
 Requires: %{name}-c++%{?_isa} = %{version}-%{release}
 %if %{with dane}
 Requires: %{name}-dane%{?_isa} = %{version}-%{release}
 %endif
 Requires: pkgconfig
+Requires(post): /sbin/install-info
+Requires(preun): /sbin/install-info

 %package utils
 License: GPLv3+
 Summary: Command line tools for TLS protocol
+Group: Applications/System
 Requires: %{name}%{?_isa} = %{version}-%{release}
 %if %{with dane}
 Requires: %{name}-dane%{?_isa} = %{version}-%{release}
@ -154,8 +99,9 @@ Requires: %{name}%{?_isa} = %{version}-%{release}
 %if %{with guile}
 %package guile
 Summary: Guile bindings for the GNUTLS library
+Group: Development/Libraries
 Requires: %{name}%{?_isa} = %{version}-%{release}
-Requires: guile22
+Requires: guile
 %endif

 %description
@ -212,169 +158,91 @@ This package contains Guile bindings for the library.
 %endif

 %prep
-%{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}'
+gpgv2 --keyring %{SOURCE2} %{SOURCE1} %{SOURCE0}

 %autosetup -p1 -S git

-%if %{with fips}
-mkdir -p bundled_gmp
-pushd bundled_gmp
-tar --strip-components=1 -xf %{SOURCE100}
-patch -p1 < %{SOURCE101}
-popd
-%endif
-
-%build
-%ifarch aarch64 ppc64le
-%define _lto_cflags %{nil}
-%endif
-
-%if %{with fips}
-pushd bundled_gmp
-autoreconf -ifv
-%configure --disable-cxx --disable-shared --enable-fat --with-pic
-%make_build
-popd
-
-export GMP_CFLAGS="-I$PWD/bundled_gmp"
-export GMP_LIBS="$PWD/bundled_gmp/.libs/libgmp.a"
-%endif
-
-%if %{with bootstrap}
-autoreconf -fi
-%endif
-
 sed -i -e 's|sys_lib_dlsearch_path_spec="/lib /usr/lib|sys_lib_dlsearch_path_spec="/lib /usr/lib %{_libdir}|g' configure
 rm -f lib/minitasn1/*.c lib/minitasn1/*.h
+rm -f src/libopts/*.c src/libopts/*.h src/libopts/compat/*.c src/libopts/compat/*.h 

 echo "SYSTEM=NORMAL" >> tests/system.prio

-%if %{with guile}
-# These should be checked by m4/guile.m4 instead of configure.ac
-# taking into account of _guile_suffix
-guile_snarf=%{_bindir}/guile-snarf2.2
-export guile_snarf
-GUILD=%{_bindir}/guild2.2
-export GUILD
-%endif
+# Note that we explicitly enable SHA1, as SHA1 deprecation is handled
+# via the crypto policies

-%if %{with fips}
-eval $(sed -n 's/^\(\(NAME\|VERSION_ID\)=.*\)/OS_\1/p' /etc/os-release)
-export FIPS_MODULE_NAME="$OS_NAME ${OS_VERSION_ID%%.*} %name"
-%endif
-
-%configure \
+%build
+autoreconf -fi
+CCASFLAGS="$CCASFLAGS -Wa,--generate-missing-build-notes=yes"
+export CCASFLAGS
+%configure --with-libtasn1-prefix=%{_prefix} \
 %if %{with fips}
           --enable-fips140-mode \
-           --with-fips140-module-name="$FIPS_MODULE_NAME" \
-           --with-fips140-module-version=%{version}-%{srpmhash} \
-%endif
-%if %{with gost}
-    	   --enable-gost \
-%else
-	   --disable-gost \
 %endif
+	   --enable-tls13-support \
 	   --enable-sha1-support \
           --disable-static \
           --disable-openssl-compatibility \
           --disable-non-suiteb-curves \
           --with-system-priority-file=%{_sysconfdir}/crypto-policies/back-ends/gnutls.config \
           --with-default-trust-store-pkcs11="pkcs11:" \
-%if %{with tpm12}
           --with-trousers-lib=%{_libdir}/libtspi.so.1 \
-%else
-           --without-tpm \
-%endif
-%if %{with tpm2}
-           --with-tpm2 \
-%else
-           --without-tpm2 \
-%endif
-           --enable-ktls \
           --htmldir=%{_docdir}/manual \
 %if %{with guile}
           --enable-guile \
-           --with-guile-extension-dir=%{_libdir}/guile/2.2 \
 %else
           --disable-guile \
 %endif
 %if %{with dane}
           --with-unbound-root-key-file=/var/lib/unbound/root.key \
-           --enable-libdane \
+           --enable-dane \
 %else
-           --disable-libdane \
-%endif
-%if %{with certificate_compression}
-	   --with-zlib --with-brotli --with-zstd \
-%else
-	   --without-zlib --without-brotli --without-zstd \
+           --disable-dane \
 %endif
           --disable-rpath \
           --with-default-priority-string="@SYSTEM"

-# build libgnutlsxx.so with older SONAME
-make %{?_smp_mflags} V=1 CXX_LT_CURRENT=29 CXX_LT_REVISION=0 CXX_LT_AGE=1
-
-%install
-make install DESTDIR=$RPM_BUILD_ROOT
-
-# build libgnutlsxx.so with newer SONAME
-pushd lib
-rm -f libgnutlsxx.la
 make %{?_smp_mflags} V=1
-make install DESTDIR=$RPM_BUILD_ROOT
-popd
-touch doc/examples/ex-cxx
-
-make -C doc install-html DESTDIR=$RPM_BUILD_ROOT
-
-rm -f $RPM_BUILD_ROOT%{_infodir}/dir
-rm -f $RPM_BUILD_ROOT%{_libdir}/*.la
-rm -f $RPM_BUILD_ROOT%{_libdir}/guile/2.2/guile-gnutls*.a
-rm -f $RPM_BUILD_ROOT%{_libdir}/guile/2.2/guile-gnutls*.la
-%if %{without dane}
-rm -f $RPM_BUILD_ROOT%{_libdir}/pkgconfig/gnutls-dane.pc
-%endif
-
-%if %{with fips}
-# doing it twice should be a no-op the second time,
-# and this way we avoid redefining it and missing a future change
-%{__spec_install_post}
-fname=`basename $RPM_BUILD_ROOT%{_libdir}/libgnutls.so.30.*.*`
-./lib/fipshmac "$RPM_BUILD_ROOT%{_libdir}/libgnutls.so.30" > "$RPM_BUILD_ROOT%{_libdir}/.$fname.hmac"
-sed -i "s^$RPM_BUILD_ROOT/usr^^" "$RPM_BUILD_ROOT%{_libdir}/.$fname.hmac"
-ln -s ".$fname.hmac" "$RPM_BUILD_ROOT%{_libdir}/.libgnutls.so.30.hmac"
-%endif

 %if %{with fips}
 %define __spec_install_post \
 	%{?__debug_package:%{__debug_install_post}} \
 	%{__arch_install_post} \
 	%{__os_install_post} \
+	fipshmac -d $RPM_BUILD_ROOT%{_libdir} $RPM_BUILD_ROOT%{_libdir}/libgnutls.so.30.*.* \
+	file=`basename $RPM_BUILD_ROOT%{_libdir}/libgnutls.so.30.*.hmac` && mv $RPM_BUILD_ROOT%{_libdir}/$file $RPM_BUILD_ROOT%{_libdir}/.$file && ln -s .$file $RPM_BUILD_ROOT%{_libdir}/.libgnutls.so.30.hmac \
 %{nil}
 %endif

+%install
+make install DESTDIR=$RPM_BUILD_ROOT
+make -C doc install-html DESTDIR=$RPM_BUILD_ROOT
+rm -f $RPM_BUILD_ROOT%{_infodir}/dir
+rm -f $RPM_BUILD_ROOT%{_libdir}/*.la
+rm -f $RPM_BUILD_ROOT%{_libdir}/guile/2.0/guile-gnutls*.a
+rm -f $RPM_BUILD_ROOT%{_libdir}/guile/2.0/guile-gnutls*.la
+rm -f $RPM_BUILD_ROOT%{_libdir}/gnutls/libpkcs11mock1.*
+%if %{without dane}
+rm -f $RPM_BUILD_ROOT%{_libdir}/pkgconfig/gnutls-dane.pc
+%endif
+
 %find_lang gnutls

 %check
-%if %{with tests}
+make check %{?_smp_mflags}

-xfail_tests=
+%post devel
+if [ -f %{_infodir}/gnutls.info.gz ]; then
+    /sbin/install-info %{_infodir}/gnutls.info.gz %{_infodir}/dir || :
+fi

-# With older kernel, key installation fails if the host is x86_64 and
-# the package is built with -m32:
-%ifarch %{ix86}
-case "$(uname -r)" in
-  4.*.x86_64)
-    xfail_tests="$xfail_tests ktls.sh"
-    ;;
-esac
-%endif
-
-make check %{?_smp_mflags} GNUTLS_SYSTEM_PRIORITY_FILE=/dev/null XFAIL_TESTS="$xfail_tests"
-%endif
+%preun devel
+if [ $1 = 0 -a -f %{_infodir}/gnutls.info.gz ]; then
+   /sbin/install-info --delete %{_infodir}/gnutls.info.gz %{_infodir}/dir || :
+fi

 %files -f gnutls.lang
+%defattr(-,root,root,-)
 %{_libdir}/libgnutls.so.30*
 %if %{with fips}
 %{_libdir}/.libgnutls.so.30*.hmac
@ -386,8 +254,13 @@ make check %{?_smp_mflags} GNUTLS_SYSTEM_PRIORITY_FILE=/dev/null XFAIL_TESTS="$x
 %{_libdir}/libgnutlsxx.so.*

 %files devel
+%defattr(-,root,root,-)
 %{_includedir}/*
 %{_libdir}/libgnutls*.so
+%if %{with fips}
+%{_libdir}/.libgnutls.so.*.hmac
+%endif
+
 %{_libdir}/pkgconfig/*.pc
 %{_mandir}/man3/*
 %{_infodir}/gnutls*
@ -395,10 +268,9 @@ make check %{?_smp_mflags} GNUTLS_SYSTEM_PRIORITY_FILE=/dev/null XFAIL_TESTS="$x
 %{_docdir}/manual/*

 %files utils
+%defattr(-,root,root,-)
 %{_bindir}/certtool
-%if %{with tpm12}
 %{_bindir}/tpmtool
-%endif
 %{_bindir}/ocsptool
 %{_bindir}/psktool
 %{_bindir}/p11tool
@ -412,374 +284,184 @@ make check %{?_smp_mflags} GNUTLS_SYSTEM_PRIORITY_FILE=/dev/null XFAIL_TESTS="$x

 %if %{with dane}
 %files dane
+%defattr(-,root,root,-)
 %{_libdir}/libgnutls-dane.so.*
 %endif

 %if %{with guile}
 %files guile
-%{_libdir}/guile/2.2/guile-gnutls*.so*
-%{_libdir}/guile/2.2/site-ccache/gnutls.go
-%{_libdir}/guile/2.2/site-ccache/gnutls/extra.go
-%{_datadir}/guile/site/2.2/gnutls.scm
-%{_datadir}/guile/site/2.2/gnutls/extra.scm
+%defattr(-,root,root,-)
+%{_libdir}/guile/2.0/guile-gnutls*.so*
+%{_libdir}/guile/2.0/site-ccache/gnutls.go
+%{_libdir}/guile/2.0/site-ccache/gnutls/extra.go
+%{_datadir}/guile/site/2.0/gnutls.scm
+%{_datadir}/guile/site/2.0/gnutls/extra.scm
 %endif

 %changelog
-* Wed Jan 17 2024 Daiki Ueno <dueno@redhat.com> - 3.7.6-23.3
- x509: detect loop in certificate chain (RHEL-21759)
- fips: Zeroize temporary values in integrity check (RHEL-21870)
+* Tue Mar 26 2024 Daiki Ueno <dueno@redhat.com> - 3.6.16-8.3
+- Fix memleak with older GMP (RHEL-28957)

-* Wed Jan 10 2024 Daiki Ueno <dueno@redhat.com> - 3.7.6-23.2
- auth/rsa_psk: minimize branching after decryption
+* Mon Mar 25 2024 Daiki Ueno <dueno@redhat.com> - 3.6.16-8.2
+- Fix timing side-channel in deterministic ECDSA (RHEL-28957)

-* Mon Dec 11 2023 Daiki Ueno <dueno@redhat.com> - 3.7.6-23.1
- auth/rsa_psk: side-step potential side-channel (RHEL-16755)
+* Thu Jan 18 2024 Daiki Ueno <dueno@redhat.com> - 3.6.16-8.1
+- auth/rsa-psk: minimize branching after decryption (RHEL-21586)

-* Sat Jul 29 2023 Daiki Ueno <dueno@redhat.com> - 3.7.6-23
- Mark SHA-1 signature verification non-approved in FIPS (#2102751)
+* Wed Dec  6 2023 Daiki Ueno <dueno@redhat.com> - 3.6.16-8
+- auth/rsa_psk: side-step potential side-channel (RHEL-16753)

-* Tue Jul 18 2023 Daiki Ueno <dueno@redhat.com> - 3.7.6-22
- Skip KTLS test on old kernel if host and target arches are different
+* Mon Jun 26 2023 Daiki Ueno <dueno@redhat.com> - 3.6.16-7
+- Clear server's session ticket indication at rehandshake (#2089817)

-* Thu Jul 13 2023 Daiki Ueno <dueno@redhat.com> - 3.7.6-21
- Require use of extended master secret in FIPS mode by default (#2157953)
+* Thu Feb 23 2023 Zoltan Fridrich <zfridric@redhat.com> - 3.6.16-6
+- Fix x86_64 CPU feature detection when AVX is not available (#2131152)
+- Fix timing side-channel in TLS RSA key exchange (#2162598)

-* Tue Mar 14 2023 Daiki Ueno <dueno@redhat.com> - 3.7.6-20
- Fix the previous change (#2175214)
+* Mon Aug 29 2022 Daiki Ueno <dueno@redhat.com> - 3.6.16-5
+- Fix double-free in gnutls_pkcs7_verify (#2109788)

-* Fri Mar 10 2023 Daiki Ueno <dueno@redhat.com> - 3.7.6-19
- Bump release to ensure el9 package is greater than el9_* packages (#2175214)
+* Mon Jun 28 2021 Daiki Ueno <dueno@redhat.com> - 3.6.16-4
+- p11tool: Document ID reuse behavior when importing certs (#1776250)

-* Tue Feb 28 2023 Daiki Ueno <dueno@redhat.com> - 3.7.6-18
- Update gnutls-3.7.8-fips-pct-dh.patch to the upstream version (#2168143)
+* Mon Jun  7 2021 Daiki Ueno <dueno@redhat.com> - 3.6.16-3
+- Treat SHA-1 signed CA in the trusted set differently (#1965445)

-* Fri Feb 10 2023 Daiki Ueno <dueno@redhat.com> - 3.7.6-17
- Fix timing side-channel in TLS RSA key exchange (#2162601)
+* Wed May 26 2021 Daiki Ueno <dueno@redhat.com> - 3.6.16-2
+- Filter certificate_types in TLS 1.2 CR based on signature algorithms (#1942216)

-* Fri Feb 10 2023 Daiki Ueno <dueno@redhat.com> - 3.7.6-16
- fips: extend PCT to DH key generation (#2168143)
+* Mon May 24 2021 Daiki Ueno <dueno@redhat.com> - 3.6.16-1
+- Update to upstream 3.6.16 release (#1956783)
+- Fix potential use-after-free in key_share handling (#1927597)
+- Fix potential use-after-free in pre_shared_key handling (#1927593)
+- Stop gnutls-serv relying on AI_ADDRCONFIG to decide listening address (#1908334)
+- Fix cert expiration issue in tests (#1908110)

-* Thu Dec 15 2022 Zoltan Fridrich <zfridric@redhat.com> - 3.7.6-15
- fips: rename hmac file to its previous name (#2148269)
+* Thu Apr  1 2021 Daiki Ueno <dueno@redhat.com> - 3.6.14-10
+- Port fixes for potential miscalculation in ecdsa_verify (#1942931)

-* Tue Nov 22 2022 Daiki Ueno <dueno@redhat.com> - 3.7.6-14
- cipher: add restriction on CCM tag length under FIPS mode (#2137807)
- nettle: mark non-compliant RSA-PSS salt length to be not-approved (#2143266)
+* Tue Nov 24 2020 Daiki Ueno <dueno@redhat.com> - 3.6.14-9
+- Revert the previous change

-* Tue Nov 15 2022 Zoltan Fridrich <zfridric@redhat.com> - 3.7.6-13
- fips: make XTS key check failure not fatal (#2130971)
- enable source archive verification again (#2127094)
- clear server's session ticket indication at rehandshake (#2136072)
- crypto-api: add block cipher API with automatic padding (#2084161)
- fips: remove library path checking from FIPS integrity check (#2140908)
+* Wed Nov 11 2020 Daiki Ueno <dueno@redhat.com> - 3.6.14-8
+- Depend on specific NVR of gmp and nettle (#1812933)

-* Tue Sep 27 2022 Daiki Ueno <dueno@redhat.com> - 3.7.6-12
- fips: mark PBKDF2 with short key and output sizes non-approved
- fips: only mark HMAC as approved in PBKDF2
- fips: mark gnutls_key_generate with short key sizes non-approved
- fips: fix checking on hash algorithm used in ECDSA
- fips: preserve operation context around FIPS selftests API
+* Tue Nov  3 2020 Daiki Ueno <dueno@redhat.com> - 3.6.14-7
+- Increase DH key bits to >= 2048 in self-tests (#1879506)
+- Implement self-tests for KDF and CMAC (#1890870)
+- Fix CVE-2020-24659: heap buffer-overflow when "no_renegotiation" alert is received (#1873959)

-* Fri Aug 26 2022 Daiki Ueno <dueno@redhat.com> - 3.7.6-11
- Supply --with{,out}-{zlib,brotli,zstd} explicitly
+* Mon Aug 24 2020 Daiki Ueno <dueno@redhat.com> - 3.6.14-6
+- Fix memory leak when serializing iovec_t (#1844112)

-* Thu Aug 25 2022 Daiki Ueno <dueno@redhat.com> - 3.7.6-10
- Revert nettle version pinning as it doesn't work well in side-tag
+* Sat Jul 18 2020 Daiki Ueno <dueno@redhat.com> - 3.6.14-5
+- Perform validation checks on (EC)DH public keys and share secrets (#1855803)

-* Thu Aug 25 2022 Daiki Ueno <dueno@redhat.com> - 3.7.6-9
- Pin nettle version in Requires when compiled with FIPS
+* Mon Jun 29 2020 Daiki Ueno <dueno@redhat.com> - 3.6.14-4
+- Tighten FIPS DH primes check according to SP800-56A (rev 3) (#1849079)

-* Tue Aug 23 2022 Daiki Ueno <dueno@redhat.com> - 3.7.6-8
- Bundle GMP to privatize memory functions
- Disable certificate compression support by default
+* Fri Jun  5 2020 Daiki Ueno <dueno@redhat.com> - 3.6.14-3
+- Update gnutls-3.6.14-fips-mode-check.patch

-* Tue Aug 23 2022 Daiki Ueno <dueno@redhat.com> - 3.7.6-7
- Update gnutls-3.7.6-cpuid-fixes.patch
-
-* Sat Aug 20 2022 Daiki Ueno <dueno@redhat.com> - 3.7.6-6
- Mark RSA SigVer operation approved for known modulus sizes (#2091903)
- accelerated: clear AVX bits if it cannot be queried through XSAVE
-
-* Thu Aug  4 2022 Daiki Ueno <dueno@redhat.com> - 3.7.6-5
- Block DES-CBC usage in decrypting PKCS#12 bag under FIPS (#2115244)
- sysrng: reseed source DRBG for prediction resistance
-
-* Fri Jul 29 2022 Daiki Ueno <dueno@redhat.com> - 3.7.6-4
- Make gnutls-cli work with KTLS for testing
- Fix double-free in gnutls_pkcs7_verify (#2109790)
-
-* Mon Jul 25 2022 Daiki Ueno <dueno@redhat.com> - 3.7.6-3
- Limit input size for AES-GCM according to SP800-38D (#2095251)
- Do not treat GPG verification errors as fatal
- Remove gnutls-3.7.6-libgnutlsxx-const.patch
-
-* Tue Jul 19 2022 Daiki Ueno <dueno@redhat.com> - 3.7.6-2
- Allow enabling KTLS with config file (#2042009)
-
-* Fri Jul  1 2022 Daiki Ueno <dueno@redhat.com> - 3.7.6-1
- Update to gnutls 3.7.6 (#2097327)
-
-* Thu Mar 31 2022 Daiki Ueno <dueno@redhat.com> - 3.7.3-10
- Use only the first component of VERSION from /etc/os-release (#2070249)
- Don't run power-on self-tests on DSA (#2061325)
-
-* Fri Feb 25 2022 Daiki Ueno <dueno@redhat.com> - 3.7.3-9
- Stop using typeof keyword for tss2 function prototypes (#2057490)
- Ensure allowlist API is called before priority string construction (#1975421)
-
-* Thu Feb 24 2022 Daiki Ueno <dueno@redhat.com> - 3.7.3-8
- Fix previous change for loading libtss2* (#2057490)
-
-* Wed Feb 23 2022 Daiki Ueno <dueno@redhat.com> - 3.7.3-7
- Increase GNUTLS_MAX_ALGORITHM_NUM for allowlisting (#2033220)
- Ensure allowlisting API is called before priority string is constructed (#2042532)
- Use dlopen for loading libtss2* to avoid OpenSSL dependency (#2057490)
-
-* Tue Feb 22 2022 Daiki Ueno <dueno@redhat.com> - 3.7.3-6
- Compile out GOST algorithm IDs (#1945292)
-
-* Thu Feb 17 2022 Zoltan Fridrich <zfridric@redhat.com> - 3.7.3-5
- Fix upstream testsuite in fips mode (#2051637)
-
-* Wed Feb 16 2022 Daiki Ueno <dueno@redhat.com> - 3.7.3-4
- Specify FIPS140-3 module name and version
- fips: allow a few more primes in RSA key generation
- fips: tighten PKCS#12 algorithm checks
- Correct return value of KTLS stub API
-
-* Tue Feb 15 2022 Zoltan Fridrich <zfridric@redhat.com> - 3.7.3-3
- Disable config reload in order to not break allowlisting (#2042532)
-
-* Wed Feb  2 2022 Daiki Ueno <dueno@redhat.com> - 3.7.3-2
- Build with TPM2 support, patch from Alexander Sosedkin (#2033220)
-
-* Tue Jan 18 2022 Daiki Ueno <dueno@redhat.com> - 3.7.3-1
- Update to gnutls 3.7.3 (#2033220)
-
-* Wed Dec 22 2021 Daiki Ueno <dueno@redhat.com> - 3.7.2-10
- Update gnutls_{hash,hmac}_copy man-pages as well (#1999639)
-
-* Wed Dec 22 2021 Daiki Ueno <dueno@redhat.com> - 3.7.2-9
- Drop support for GNUTLS_NO_EXPLICIT_INIT envvar in favor of
-  GNUTLS_NO_IMPLICIT_INIT (#1999639)
- Expand documentation of gnutls_{hash,hmac}_copy, mentioning that
-  those do not always work (#1999639)
-
-* Tue Dec 21 2021 Daiki Ueno <dueno@redhat.com> - 3.7.2-9
- Fix race condition when resolving SYSTEM priority in allowlisting mode (#2012249)
-
-* Thu Oct 21 2021 Daiki Ueno <dueno@redhat.com> - 3.7.2-8
- Fix issues in bundled libopts, spotted by covscan (#1938730)
-
-* Tue Oct 12 2021 Daiki Ueno <dueno@redhat.com> - 3.7.2-7
- Enable Intel CET
- Remove unnecessary CCASFLAGS setting for annocheck
-
-* Thu Aug 19 2021 Daiki Ueno <dueno@redhat.com> - 3.7.2-6
- Reorder doc/invoke-*.texi generation (#1975482)
- Temporarily disable LTO for aarch64 and ppc64le
-
-* Mon Aug 09 2021 Mohan Boddu <mboddu@redhat.com> - 3.7.2-5
- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
-  Related: rhbz#1991688
-
-* Mon Aug  2 2021 Daiki Ueno <dueno@redhat.com> - 3.7.2-4
- Disable GOST cryptography by default (#1945292)
- Tighten timestamp adjustment when not bootstrapping (#1975482)
- Re-enable LTO (#1986143)
-
-* Mon Jun 28 2021 Daiki Ueno <dueno@redhat.com> - 3.7.2-3
- Enable allowlisting configuration mode (#1975421)
-
-* Sat Jun 26 2021 Daiki Ueno <dueno@redhat.com> - 3.7.2-2
- Remove %%defattr invocations which are no longer necessary
- libpkcs11mock1.* is not installed anymore
- hobble-gnutls: Remove SRP removal
- Use correct source URL
- Switch to using %%gpgverify macro
-
-* Fri Jun 25 2021 Daiki Ueno <dueno@redhat.com> - 3.7.2-1
- Update to upstream 3.7.2 release (#1966479)
-
-* Tue Jun 22 2021 Mohan Boddu <mboddu@redhat.com> - 3.7.1-6
- Rebuilt for RHEL 9 BETA for openssl 3.0
-  Related: rhbz#1971065
-
-* Thu Jun  3 2021 Daiki Ueno <dueno@redhat.com> - 3.7.1-5
- Fix typo in TPM 1.2 disablement (#1927370)
-
-* Thu May 27 2021 Daiki Ueno <dueno@redhat.com> - 3.7.1-4
- Disable TPM support by default (#1927370)
-
-* Thu Apr 15 2021 Mohan Boddu <mboddu@redhat.com> - 3.7.1-3
- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
-
-* Tue Mar 16 2021 Daiki Ueno <dueno@redhat.com> - 3.7.1-2
- Restore fipscheck dependency
-
-* Sat Mar 13 2021 Daiki Ueno <dueno@redhat.com> - 3.7.1-1
- Update to upstream 3.7.1 release
- Remove fipscheck dependency, as it is now calculated with an
-  internal tool
-
-* Fri Mar  5 2021 Daiki Ueno <dueno@redhat.com> - 3.7.0-4
- Tolerate duplicate certs in the chain also with PKCS #11 trust store
-
-* Tue Mar  2 2021 Daiki Ueno <dueno@redhat.com> - 3.7.0-3
- Reduce BRs for non-bootstrapping build
-
-* Wed Feb 10 2021 Daiki Ueno <dueno@redhat.com> - 3.7.0-2
- Tolerate duplicate certs in the chain
-
-* Mon Feb  8 2021 Daiki Ueno <dueno@redhat.com> - 3.7.0-1
- Update to upstream 3.7.0 release
- Temporarily disable LTO
-
-* Tue Jan 26 2021 Daiki Ueno <dueno@redhat.com> - 3.6.15-4
- Fix broken tests on rawhide (#1908110)
- Add BuildRequires: make (by Tom Stellard)
-
-* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 3.6.15-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
-
-* Mon Sep 28 2020 Jeff Law <law@redhat.com> - 3.6.15-2
- Re-enable LTO now that upstream GCC bugs have been fixed
-
-* Fri Sep  4 2020 Daiki Ueno <dueno@redhat.com> - 3.6.15-1
- Update to upstream 3.6.15 release
-
-* Mon Aug 17 2020 Jeff Law <law@redhat.com> - 3.6.14-7
- Disable LTO on ppc64le
-
-* Tue Aug  4 2020 Daiki Ueno <dueno@redhat.com> - 3.6.14-6
- Fix underlinking of libpthread
-
-* Sat Aug 01 2020 Fedora Release Engineering <releng@fedoraproject.org> - 3.6.14-5
- Second attempt - Rebuilt for
-  https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
-
-* Mon Jul 27 2020 Fedora Release Engineering <releng@fedoraproject.org> - 3.6.14-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
-
-* Thu Jul 02 2020 Anderson Sasaki <ansasaki@redhat.com> - 3.6.14-3
- Rebuild with autogen built with guile-2.2 (#1852706)
-
-* Tue Jun 09 2020 Anderson Sasaki <ansasaki@redhat.com> - 3.6.14-2
- Fix memory leak when serializing iovec_t (#1845083)
- Fix automatic libraries sonames detection (#1845806)
+* Thu Jun  4 2020 Daiki Ueno <dueno@redhat.com> - 3.6.14-2
+- Return false from gnutls_fips140_mode_enabled() if selftests failed (#1827687)

 * Thu Jun  4 2020 Daiki Ueno <dueno@redhat.com> - 3.6.14-1
 - Update to upstream 3.6.14 release

-* Sun May 31 2020 Daiki Ueno <dueno@redhat.com> - 3.6.13-6
- Update gnutls-3.6.13-superseding-chain.patch
+* Mon May 25 2020 Anderson Sasaki <ansasaki@redhat.com> - 3.6.13-3
+- Add an option to gnutls-cli to wait for resumption under TLS 1.3 (#1677754)

-* Sun May 31 2020 Daiki Ueno <dueno@redhat.com> - 3.6.13-5
- Fix cert chain validation behavior if the last cert has expired (#1842178)
+* Wed May 20 2020 Anderson Sasaki <ansasaki@redhat.com> - 3.6.13-2
+- Enable Intel CET (#1838476)

-* Mon May 25 2020 Anderson Sasaki <ansasaki@redhat.com> - 3.6.13-4
- Add option to gnutls-cli to wait for resumption under TLS 1.3
-
-* Tue May 19 2020 Anderson Sasaki <ansasaki@redhat.com> - 3.6.13-3
- Disable RSA blinding during FIPS self-tests
-
-* Thu May 14 2020 Anderson Sasaki <ansasaki@redhat.com> - 3.6.13-2
- Bump linked libraries soname to fix FIPS selftests (#1835265)
-
-* Tue Mar 31 2020 Daiki Ueno <dueno@redhat.com> - 3.6.13-1
+* Tue May  5 2020 Daiki Ueno <dueno@redhat.com> - 3.6.13-1
 - Update to upstream 3.6.13 release

-* Thu Mar 26 2020 Anderson Sasaki <ansasaki@redhat.com> - 3.6.12-2
- Fix FIPS POST (#1813384)
- Fix gnutls-serv --echo to not exit when a message is received (#1816583)
+* Tue Apr 21 2020 Daiki Ueno <dueno@redhat.com> - 3.6.8-10
+- Fix CVE-2020-11501 (#1822005)

-* Sun Feb 02 2020 Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com> - 3.6.12-1
- Update to upstream 3.6.12 release
+* Wed Nov  6 2019 Daiki Ueno <dueno@redhat.com> - 3.6.8-9
+- Fix CFB8 decryption when repeatedly called (#1757848)
+- Fix gnutls_aead_cipher_{en,de}cryptv2 with input not multiple of block size (#1757856)

-* Tue Jan 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 3.6.11-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
+* Fri Aug 16 2019 Daiki Ueno <dueno@redhat.com> - 3.6.8-8
+- Use fallback random function for RSA blinding in FIPS selftests

-* Mon Dec 02 2019 Nikos Mavrogiannopoulos <nmav@gnutls.org> - 3.6.11-1
- Update to upstream 3.6.11 release
+* Fri Aug 16 2019 Daiki Ueno <dueno@redhat.com> - 3.6.8-7
+- Fix deterministic signature creation in selftests

-* Sun Sep 29 2019 Nikos Mavrogiannopoulos <nmav@gnutls.org> - 3.6.10-1
- Update to upstream 3.6.10 release
+* Fri Aug 16 2019 Daiki Ueno <dueno@redhat.com> - 3.6.8-6
+- Treat login error more gracefully when enumerating PKCS#11 tokens (#1705478)
+- Use deterministic ECDSA/DSA in FIPS selftests (#1716560)
+- Add gnutls_aead_cipher_{encrypt,decrypt}v2 functions (#1684461)

-* Fri Jul 26 2019 Nikos Mavrogiannopoulos <nmav@gnutls.org> - 3.6.9-1
- Update to upstream 3.6.9 release
+* Fri Aug  9 2019 Daiki Ueno <dueno@redhat.com> - 3.6.8-5
+- Avoid UB when encrypting session tickets

-* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 3.6.8-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
+* Tue Jul  2 2019 Daiki Ueno <dueno@redhat.com> - 3.6.8-4
+- Add RNG continuous test under FIPS

-* Mon Jul 15 2019 Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.6.8-2
- Rebuilt with guile-2.2
+* Fri Jun 14 2019 Daiki Ueno <dueno@redhat.com> - 3.6.8-3
+- Follow-up fix on multiple key updates handling (#1673975)

-* Tue May 28 2019 Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.6.8-1
+* Thu Jun 13 2019 Daiki Ueno <dueno@redhat.com> - 3.6.8-2
+- Run FIPS AES self-tests over overridden algorithms
+
+* Wed May 29 2019 Daiki Ueno <dueno@redhat.com> - 3.6.8-1
 - Update to upstream 3.6.8 release

-* Wed Mar 27 2019 Anderson Toshiyuki Sasaki <ansasaki@redhat.com> - 3.6.7-1
- Update to upstream 3.6.7 release
- Fixed CVE-2019-3836 (#1693214)
- Fixed CVE-2019-3829 (#1693210)
+* Fri May 24 2019 Anderson Sasaki <ansasaki@redhat.com> - 3.6.5-4
+- Fixed FIPS signatures self tests (#1680509)

-* Fri Feb  1 2019 Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.6.6-1
- Update to upstream 3.6.6 release
+* Wed Mar 27 2019 Anderson Sasaki <ansasaki@redhat.com> - 3.6.5-3
+- Fixed CVE-2019-3829 (#1693285)
+- Fixed CVE-2019-3836 (#1693288)
+- Added explicit BuildRequires for nettle-devel >= 3.4.1

-* Thu Jan 31 2019 Fedora Release Engineering <releng@fedoraproject.org> - 3.6.5-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
+* Fri Jan 11 2019 Anderson Sasaki <ansasaki@redhat.com> - 3.6.5-2
+- Fixed FIPS integrity self tests (#1665061)

-* Fri Jan 11 2019 Anderson Toshiyuki Sasaki <ansasaki@redhat.com> - 3.6.5-2
+* Mon Dec 17 2018 Anderson Sasaki <ansasaki@redhat.com> - 3.6.5-1
+- Update to upstream 3.6.5 release
+- Fixes CVE-2018-16868 (#1655395)
+- Removed ldconfig scriptlet
 - Added explicit Requires for nettle >= 3.4.1

-* Tue Dec 11 2018 Anderson Toshiyuki Sasaki <ansasaki@redhat.com> - 3.6.5-1
- Update to upstream 3.6.5 release
+* Mon Nov 26 2018 Anderson Sasaki <ansasaki@redhat.com> - 3.6.4-7
+- Fix incorrect certificate type returned in TLS1.3 resumption (#1649786)

-* Mon Oct 29 2018 James Antill <james.antill@redhat.com> - 3.6.4-5
- Remove ldconfig scriptlet, now done via. transfiletrigger in glibc.
+* Mon Nov 12 2018 Anderson Sasaki <ansasaki@redhat.com> - 3.6.4-6
+- Add support for record_size_limit extension in TLS1.2 (#1644850)

-* Wed Oct 17 2018 Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.6.4-4
- Fix issue with rehandshake affecting glib-networking (#1634736)
+* Tue Oct 30 2018 Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.6.4-5
+- Fix issue with GOST ciphers (#1644193)
+- Made gnutls-serv use the default priorities if none is specified (#1644243)

-* Tue Oct 16 2018 Tomáš Mráz <tmraz@redhat.com> - 3.6.4-3
+* Wed Oct 24 2018 Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.6.4-3
+- Fix issue with rehandshake affecting glib-networking (#1641072)
+
+* Tue Oct 16 2018 Tomáš Mráz <tmraz@redhat.com> - 3.6.4-2
 - Add missing annobin notes for assembler sources

-* Tue Oct 09 2018 Petr Menšík <pemensik@redhat.com> - 3.6.4-2
- Rebuilt for unbound 1.8
-
 * Tue Sep 25 2018 Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.6.4-1
 - Updated to upstream 3.6.4 release
 - Added support for the latest version of the TLS1.3 protocol
- Enabled SHA1 support as SHA1 deprecation is handled via the
-  fedora crypto policies.

 * Thu Aug 16 2018 Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.6.3-4
- Fixed gnutls-cli input reading
+- Fixed support for ECDSA public keys (backported from Fedora)
 - Ensure that we do not cause issues with version rollback detection
  and TLS1.3.

-* Tue Aug 07 2018 Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.6.3-3
- Fixed ECDSA public key import (#1612803)
-
-* Thu Jul 26 2018 Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.6.3-2
- Backported regression fixes from 3.6.2
-
-* Mon Jul 16 2018 Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.6.3-1
- Update to upstream 3.6.3 release
-
-* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 3.6.2-5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
-
-* Wed Jun 13 2018 Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.6.2-4
- Enable FIPS140-2 mode in Fedora
+* Thu Jul 26 2018 Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.6.3-4
+- Updated to upstream 3.6.3 release

 * Wed Jun 06 2018 Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.6.2-3
- Update to upstream 3.6.2 release
-
-* Fri May 25 2018 David Abdurachmanov <david.abdurachmanov@gmail.com> - 3.6.2-2
+- Include FIPS mode
 - Add missing BuildRequires: gnupg2 for gpgv2 in %%prep

 * Fri Feb 16 2018 Nikos Mavrogiannopoulos <nmav@redhat.com> - 3.6.2-1
- Update to upstream 3.6.2 release
+- Updated to upstream 3.6.2 release

 * Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org> - 3.6.1-5
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild