MinGW port of the OpenSSL toolkit
Go to file
Erik van Pienbroek b629b66276 Synced patches with native openssl-1.0.1e-38.fc21
- Synced patches with native openssl-1.0.1e-38.fc21
- Enable ECC support (RHBZ #1037919)
- Fixes CVE-2013-6450 (RHBZ #1047844)
- Fixes CVE-2013-4353 (RHBZ #1049062)
- Fixes CVE-2013-6449 (RHBZ #1045444)
2014-01-25 23:18:30 +01:00
.gitignore Synced patches with native openssl-1.0.1e-38.fc21 2014-01-25 23:18:30 +01:00
ec_curve.c Synced patches with native openssl-1.0.1e-38.fc21 2014-01-25 23:18:30 +01:00
ectest.c Synced patches with native openssl-1.0.1e-38.fc21 2014-01-25 23:18:30 +01:00
fixpatch Synced patches with native openssl-1.0.1e-38.fc21 2014-01-25 23:18:30 +01:00
hobble-openssl Synced patches with native openssl-1.0.1e-38.fc21 2014-01-25 23:18:30 +01:00
make-dummy-cert - Updated to version 1.0.0 beta 4 2009-11-22 17:44:35 +00:00
Makefile.certificate - Updated to version 1.0.0 beta 4 2009-11-22 17:44:35 +00:00
mingw32-openssl-1.0.0-beta3-libversion.patch Simplified the lib renaming patch 2009-08-30 00:53:20 +00:00
mingw32-openssl-1.0.0d-sfx.patch Update to 1.0.0d 2011-04-23 13:30:28 +03:00
mingw-openssl-drop-unneeded-reference-to-dlfcn-h.patch Added win64 support 2012-03-10 19:39:59 +01:00
mingw-openssl-fix-fips-build-failure.patch Fix build failure when using mock 2012-11-10 21:52:58 +01:00
mingw-openssl.spec Synced patches with native openssl-1.0.1e-38.fc21 2014-01-25 23:18:30 +01:00
openssl_mingw64_install_fix.patch Added win64 support 2012-03-10 19:39:59 +01:00
openssl-0.9.6-x509.patch Initial import. 2009-02-09 09:33:37 +00:00
openssl-0.9.8a-no-rpath.patch Initial import. 2009-02-09 09:33:37 +00:00
openssl-0.9.8b-test-use-localhost.patch Initial import. 2009-02-09 09:33:37 +00:00
openssl-0.9.8j-version-add-engines.patch Initial import. 2009-02-09 09:33:37 +00:00
openssl-1.0.0-beta4-ca-dir.patch - Updated to version 1.0.0 beta 4 2009-11-22 17:44:35 +00:00
openssl-1.0.0-beta5-enginesdir.patch - Updated to openssl 1.0.0a 2010-06-19 19:33:41 +00:00
openssl-1.0.0-beta5-readme-warning.patch - Updated to openssl 1.0.0a 2010-06-19 19:33:41 +00:00
openssl-1.0.0-timezone.patch - Updated to openssl 1.0.0a 2010-06-19 19:33:41 +00:00
openssl-1.0.0c-rsa-x931.patch Update to 1.0.0d 2011-04-23 13:30:28 +03:00
openssl-1.0.0d-apps-dgst.patch Update to 1.0.0d 2011-04-23 13:30:28 +03:00
openssl-1.0.0d-xmpp-starttls.patch Added missing patches and removed unused ones 2012-11-09 16:29:44 +01:00
openssl-1.0.0e-chil-fixes.patch Added missing patches and removed unused ones 2012-11-09 16:29:44 +01:00
openssl-1.0.0e-doc-noeof.patch Added missing patches and removed unused ones 2012-11-09 16:29:44 +01:00
openssl-1.0.0f-defaults.patch Added missing patches and removed unused ones 2012-11-09 16:29:44 +01:00
openssl-1.0.1-beta2-dtls1-abi.patch Added missing patches and removed unused ones 2012-11-09 16:29:44 +01:00
openssl-1.0.1-beta2-fips-md5-allow.patch Added missing patches and removed unused ones 2012-11-09 16:29:44 +01:00
openssl-1.0.1-beta2-padlock64.patch Added missing patches and removed unused ones 2012-11-09 16:29:44 +01:00
openssl-1.0.1-beta2-rpmbuild.patch Synced patches with native openssl-1.0.1e-38.fc21 2014-01-25 23:18:30 +01:00
openssl-1.0.1-beta2-ssl-op-all.patch Added missing patches and removed unused ones 2012-11-09 16:29:44 +01:00
openssl-1.0.1-pkgconfig-krb5.patch Added missing patches and removed unused ones 2012-11-09 16:29:44 +01:00
openssl-1.0.1a-algo-doc.patch Added missing patches and removed unused ones 2012-11-09 16:29:44 +01:00
openssl-1.0.1c-aliasing.patch Added missing patches and removed unused ones 2012-11-09 16:29:44 +01:00
openssl-1.0.1c-default-paths.patch Update to 1.0.1e (RHBZ #920868) 2013-03-24 20:50:27 +01:00
openssl-1.0.1c-dh-1024.patch Update to 1.0.1e (RHBZ #920868) 2013-03-24 20:50:27 +01:00
openssl-1.0.1c-ipv6-apps.patch Added missing patches and removed unused ones 2012-11-09 16:29:44 +01:00
openssl-1.0.1c-perlfind.patch Added missing patches and removed unused ones 2012-11-09 16:29:44 +01:00
openssl-1.0.1e-3des-strength.patch Synced patches with native openssl-1.0.1e-38.fc21 2014-01-25 23:18:30 +01:00
openssl-1.0.1e-arm-use-elf-auxv-caps.patch Synced patches with native openssl-1.0.1e-38.fc21 2014-01-25 23:18:30 +01:00
openssl-1.0.1e-backports.patch Synced patches with native openssl-1.0.1e-38.fc21 2014-01-25 23:18:30 +01:00
openssl-1.0.1e-bad-mac.patch Update to 1.0.1e (RHBZ #920868) 2013-03-24 20:50:27 +01:00
openssl-1.0.1e-compat-symbols.patch Synced patches with native openssl-1.0.1e-38.fc21 2014-01-25 23:18:30 +01:00
openssl-1.0.1e-cve-2013-4353.patch Synced patches with native openssl-1.0.1e-38.fc21 2014-01-25 23:18:30 +01:00
openssl-1.0.1e-cve-2013-6449.patch Synced patches with native openssl-1.0.1e-38.fc21 2014-01-25 23:18:30 +01:00
openssl-1.0.1e-cve-2013-6450.patch Synced patches with native openssl-1.0.1e-38.fc21 2014-01-25 23:18:30 +01:00
openssl-1.0.1e-ecc-suiteb.patch Synced patches with native openssl-1.0.1e-38.fc21 2014-01-25 23:18:30 +01:00
openssl-1.0.1e-env-zlib.patch Update to 1.0.1e (RHBZ #920868) 2013-03-24 20:50:27 +01:00
openssl-1.0.1e-fips-ctor.patch Synced patches with native openssl-1.0.1e-38.fc21 2014-01-25 23:18:30 +01:00
openssl-1.0.1e-fips-ec.patch Synced patches with native openssl-1.0.1e-38.fc21 2014-01-25 23:18:30 +01:00
openssl-1.0.1e-fips.patch Synced patches with native openssl-1.0.1e-38.fc21 2014-01-25 23:18:30 +01:00
openssl-1.0.1e-issuer-hash.patch Update to 1.0.1e (RHBZ #920868) 2013-03-24 20:50:27 +01:00
openssl-1.0.1e-manfix.patch Synced patches with native openssl-1.0.1e-38.fc21 2014-01-25 23:18:30 +01:00
openssl-1.0.1e-new-fips-reqs.patch Synced patches with native openssl-1.0.1e-38.fc21 2014-01-25 23:18:30 +01:00
openssl-1.0.1e-no-md5-verify.patch Synced patches with native openssl-1.0.1e-38.fc21 2014-01-25 23:18:30 +01:00
openssl-1.0.1e-secure-getenv.patch Update to 1.0.1e (RHBZ #920868) 2013-03-24 20:50:27 +01:00
openssl-1.0.1e-trusted-first.patch Synced patches with native openssl-1.0.1e-38.fc21 2014-01-25 23:18:30 +01:00
openssl-1.0.1e-version.patch Synced patches with native openssl-1.0.1e-38.fc21 2014-01-25 23:18:30 +01:00
openssl-1.0.1e-weak-ciphers.patch Synced patches with native openssl-1.0.1e-38.fc21 2014-01-25 23:18:30 +01:00
openssl-fips.conf Synced patches with native openssl-1.0.1e-38.fc21 2014-01-25 23:18:30 +01:00
openssl-mingw64-dont-use-secure-getenv.patch Update to 1.0.1e (RHBZ #920868) 2013-03-24 20:50:27 +01:00
openssl-thread-test.c Initial import. 2009-02-09 09:33:37 +00:00
opensslconf-new-warning.h Initial import. 2009-02-09 09:33:37 +00:00
opensslconf-new.h Initial import. 2009-02-09 09:33:37 +00:00
README.FIPS Synced patches with native openssl-1.0.1e-38.fc21 2014-01-25 23:18:30 +01:00
renew-dummy-cert Update to 1.0.1e (RHBZ #920868) 2013-03-24 20:50:27 +01:00
sources Synced patches with native openssl-1.0.1e-38.fc21 2014-01-25 23:18:30 +01:00

User guide for the FIPS Red Hat Enterprise Linux - OpenSSL Module
=================================================================

This package contains libraries which comprise the FIPS 140-2
Red Hat Enterprise Linux - OPENSSL Module.
Note that the openssl-fips subpackage needs to be installed for the
OpenSSL FIPS module installation to be complete.

The module files
================
/usr/lib[64]/libcrypto.so.1.0.1e
/usr/lib[64]/libssl.so.1.0.1e
/usr/lib[64]/.libcrypto.so.1.0.1e.hmac
/usr/lib[64]/.libssl.so.1.0.1e.hmac

Dependencies
============

The approved mode of operation requires kernel with /dev/urandom RNG running
with properties as defined in the security policy of the module. This is
provided by kernel packages with validated Red Hat Enterprise Linux - IPSec
Crytographic Module.

Installation
============

The RPM package of the module can be installed by standard tools recommended
for installation of RPM packages on the Red Hat Enterprise Linux system (yum,
rpm, RHN remote management tool).

For proper operation of the in-module integrity verification the prelink has to
be disabled. This can be done with setting PRELINKING=no in the
/etc/sysconfig/prelink configuration file. If the libraries were already
prelinked the prelink should be undone on all the system files with the
'prelink -u -a' command.

Usage and API
=============

The module respects kernel command line FIPS setting. If the kernel command
line contains option fips=1 the module will initialize in the FIPS approved
mode of operation automatically. To allow for the automatic initialization the
application using the module has to call one of the following API calls:

- void OPENSSL_init_library(void) - this will do only a basic initialization
of the library and does initialization of the FIPS approved mode without setting
up EVP API with supported algorithms.

- void OPENSSL_add_all_algorithms(void) - this API function calls
OPENSSL_init() implicitly and also adds all approved algorithms to the EVP API
in the approved mode 

- void SSL_library_init(void) - it calls OPENSSL_init() implicitly and also
adds algorithms which are necessary for TLS protocol support and initializes
the SSL library.

To explicitely put the library to the approved mode the application can call
the following function:

- int FIPS_mode_set(int on) - if called with 1 as a parameter it will switch
the library from the non-approved to the approved mode. If any of the selftests
and integrity verification tests fail, the library is put into the error state
and 0 is returned. If they succeed the return value is 1.

To query the module whether it is in the approved mode or not:

- int FIPS_mode(void) - returns 1 if the module is in the approved mode,
0 otherwise.

To query whether the module is in the error state:

- int FIPS_selftest_failed(void) - returns 1 if the module is in the error
state, 0 otherwise.

To zeroize the FIPS RNG key and internal state the application calls:

- void RAND_cleanup(void)