# For the curious:

# 0.9.5a soversion = 0

# 0.9.6  soversion = 1

# 0.9.6a soversion = 2

# 0.9.6c soversion = 3

# 0.9.7a soversion = 4

# 0.9.7ef soversion = 5

# 0.9.8ab soversion = 6

# 0.9.8g soversion = 7

# 0.9.8jk + EAP-FAST soversion = 8

# 1.0.0 soversion = 10

%define soversion 10

# Number of threads to spawn when testing some threading fixes.

%define thread_test_threads %{?threads:%{threads}}%{!?threads:1}

# Arches on which we need to prevent arch conflicts on opensslconf.h, must

# also be handled in opensslconf-new.h.

%define multilib_arches %{ix86} ia64 ppc %{power64} s390 s390x sparcv9 sparc64 x86_64

%global _performance_build 1

Summary: Utilities from the general purpose cryptography library with TLS implementation

Name: openssl

Version: 1.0.1e

Release: 51%{?dist}.1

Epoch: 1

# We have to remove certain patented algorithms from the openssl source

# tarball with the hobble-openssl script which is included below.

# The original openssl upstream tarball cannot be shipped in the .src.rpm.

Source: openssl-%{version}-hobbled.tar.xz

Source1: hobble-openssl

Source2: Makefile.certificate

Source6: make-dummy-cert

Source7: renew-dummy-cert

Source8: openssl-thread-test.c

Source9: opensslconf-new.h

Source10: opensslconf-new-warning.h

Source11: README.FIPS

Source12: ec_curve.c

Source13: ectest.c

# Build changes

Patch1: openssl-1.0.1e-rpmbuild.patch

Patch2: openssl-1.0.1e-defaults.patch

Patch4: openssl-1.0.0-beta5-enginesdir.patch

Patch5: openssl-0.9.8a-no-rpath.patch

Patch6: openssl-0.9.8b-test-use-localhost.patch

Patch7: openssl-1.0.0-timezone.patch

Patch8: openssl-1.0.1c-perlfind.patch

Patch9: openssl-1.0.1c-aliasing.patch

# This patch must be applied first

Patch10: openssl-1.0.1e-ppc-asm-update.patch

# Bug fixes

Patch23: openssl-1.0.1c-default-paths.patch

Patch24: openssl-1.0.1e-issuer-hash.patch

# Functionality changes

Patch33: openssl-1.0.0-beta4-ca-dir.patch

Patch34: openssl-0.9.6-x509.patch

Patch35: openssl-0.9.8j-version-add-engines.patch

Patch36: openssl-1.0.0e-doc-noeof.patch

Patch38: openssl-1.0.1-beta2-ssl-op-all.patch

Patch39: openssl-1.0.1c-ipv6-apps.patch

Patch40: openssl-1.0.1e-fips.patch

Patch45: openssl-1.0.1e-env-zlib.patch

Patch47: openssl-1.0.0-beta5-readme-warning.patch

Patch49: openssl-1.0.1a-algo-doc.patch

Patch50: openssl-1.0.1-beta2-dtls1-abi.patch

Patch51: openssl-1.0.1e-version.patch

Patch56: openssl-1.0.0c-rsa-x931.patch

Patch58: openssl-1.0.1-beta2-fips-md5-allow.patch

Patch60: openssl-1.0.0d-apps-dgst.patch

Patch63: openssl-1.0.0d-xmpp-starttls.patch

Patch65: openssl-1.0.0e-chil-fixes.patch

Patch66: openssl-1.0.1-pkgconfig-krb5.patch

Patch68: openssl-1.0.1e-secure-getenv.patch

Patch69: openssl-1.0.1c-dh-1024.patch

Patch70: openssl-1.0.1e-fips-ec.patch

Patch71: openssl-1.0.1e-manfix.patch

Patch72: openssl-1.0.1e-fips-ctor.patch

Patch73: openssl-1.0.1e-ecc-suiteb.patch

Patch74: openssl-1.0.1e-no-md5-verify.patch

Patch75: openssl-1.0.1e-compat-symbols.patch

Patch76: openssl-1.0.1e-new-fips-reqs.patch

Patch77: openssl-1.0.1e-weak-ciphers.patch

Patch78: openssl-1.0.1e-3des-strength.patch

Patch79: openssl-1.0.1e-req-keylen.patch

Patch41: openssl-1.0.1e-ssl2-no-ec.patch

Patch42: openssl-1.0.1e-enc-fail.patch

# Backported fixes including security fixes

Patch80: openssl-1.0.1e-evp-wrap.patch

Patch81: openssl-1.0.1-beta2-padlock64.patch

Patch82: openssl-1.0.1e-backports.patch

Patch83: openssl-1.0.1e-bad-mac.patch

Patch84: openssl-1.0.1e-trusted-first.patch

Patch85: openssl-1.0.1e-arm-use-elf-auxv-caps.patch

Patch86: openssl-1.0.1e-cve-2013-6449.patch

Patch87: openssl-1.0.1e-cve-2013-6450.patch

Patch88: openssl-1.0.1e-cve-2013-4353.patch

Patch89: openssl-1.0.1e-ephemeral-key-size.patch

Patch90: openssl-1.0.1e-cve-2014-0160.patch

Patch91: openssl-1.0.1e-cve-2010-5298.patch

Patch92: openssl-1.0.1e-cve-2014-0195.patch

Patch93: openssl-1.0.1e-cve-2014-0198.patch

Patch94: openssl-1.0.1e-cve-2014-0221.patch

Patch95: openssl-1.0.1e-cve-2014-0224.patch

Patch96: openssl-1.0.1e-cve-2014-3470.patch

Patch97: openssl-1.0.1e-dtls-ecc-ext.patch

Patch100: openssl-1.0.1e-cve-2014-3505.patch

Patch101: openssl-1.0.1e-cve-2014-3506.patch

Patch102: openssl-1.0.1e-cve-2014-3507.patch

Patch103: openssl-1.0.1e-cve-2014-3508.patch

Patch104: openssl-1.0.1e-cve-2014-3509.patch

Patch105: openssl-1.0.1e-cve-2014-3510.patch

Patch106: openssl-1.0.1e-cve-2014-3511.patch

Patch107: openssl-1.0.1e-doc-ciphersuites.patch

Patch108: openssl-1.0.1e-sn-case.patch

Patch109: openssl-1.0.1e-ecdh-auto.patch

Patch110: openssl-1.0.1e-cve-2014-3567.patch

Patch111: openssl-1.0.1e-cve-2014-3513.patch

Patch112: openssl-1.0.1e-fallback-scsv.patch

Patch113: openssl-1.0.1e-copy-algo.patch

Patch114: openssl-1.0.1e-cve-2014-3570.patch

Patch115: openssl-1.0.1e-cve-2014-3571.patch

Patch116: openssl-1.0.1e-cve-2014-3572.patch

Patch117: openssl-1.0.1e-cve-2014-8275.patch

Patch118: openssl-1.0.1e-cve-2015-0204.patch

Patch119: openssl-1.0.1e-cve-2015-0205.patch

Patch120: openssl-1.0.1e-cve-2015-0206.patch

Patch121: openssl-1.0.1e-cc-reqs.patch

Patch122: openssl-1.0.1e-cve-2015-0209.patch

Patch123: openssl-1.0.1e-cve-2015-0286.patch

Patch124: openssl-1.0.1e-cve-2015-0287.patch

Patch125: openssl-1.0.1e-cve-2015-0288.patch

Patch126: openssl-1.0.1e-cve-2015-0289.patch

Patch127: openssl-1.0.1e-cve-2015-0292.patch

Patch128: openssl-1.0.1e-cve-2015-0293.patch

Patch129: openssl-1.0.1e-cve-2015-4000.patch

Patch130: openssl-1.0.1e-cve-2014-8176.patch

Patch131: openssl-1.0.1e-cve-2015-1789.patch

Patch132: openssl-1.0.1e-cve-2015-1790.patch

Patch133: openssl-1.0.1e-cve-2015-1791.patch

Patch134: openssl-1.0.1e-cve-2015-1792.patch

Patch135: openssl-1.0.1e-cve-2015-3194.patch

Patch136: openssl-1.0.1e-cve-2015-3195.patch

Patch137: openssl-1.0.1e-cve-2015-3196.patch

License: OpenSSL

Group: System Environment/Libraries

URL: http://www.openssl.org/

BuildRoot: %{_tmppath}/%{name}-%{version}-root

BuildRequires: coreutils, krb5-devel, perl, sed, zlib-devel, /usr/bin/cmp

BuildRequires: /usr/bin/rename

Requires: coreutils, make

Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}

%description

The OpenSSL toolkit provides support for secure communications between

machines. OpenSSL includes a certificate management tool and shared

libraries which provide various cryptographic algorithms and

protocols.

%package libs

Summary: A general purpose cryptography library with TLS implementation

Group: System Environment/Libraries

Requires: ca-certificates >= 2008-5

# Needed obsoletes due to the base/lib subpackage split

Obsoletes: openssl < 1:1.0.1-0.3.beta3

%description libs

OpenSSL is a toolkit for supporting cryptography. The openssl-libs

package contains the libraries that are used by various applications which

support cryptographic algorithms and protocols.

%package devel

Summary: Files for development of applications which will use OpenSSL

Group: Development/Libraries

Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}

Requires: krb5-devel%{?_isa}, zlib-devel%{?_isa}

Requires: pkgconfig

%description devel

OpenSSL is a toolkit for supporting cryptography. The openssl-devel

package contains include files needed to develop applications which

support various cryptographic algorithms and protocols.

%package static

Summary:  Libraries for static linking of applications which will use OpenSSL

Group: Development/Libraries

Requires: %{name}-devel%{?_isa} = %{epoch}:%{version}-%{release}

%description static

OpenSSL is a toolkit for supporting cryptography. The openssl-static

package contains static libraries needed for static linking of

applications which support various cryptographic algorithms and

protocols.

%package perl

Summary: Perl scripts provided with OpenSSL

Group: Applications/Internet

Requires: perl

Requires: %{name}%{?_isa} = %{epoch}:%{version}-%{release}

%description perl

OpenSSL is a toolkit for supporting cryptography. The openssl-perl

package provides Perl scripts for converting certificates and keys

from other formats to the formats used by the OpenSSL toolkit.

%prep

%setup -q -n %{name}-%{version}

# The hobble_openssl is called here redundantly, just to be sure.

# The tarball has already the sources removed.

%{SOURCE1} > /dev/null

cp %{SOURCE12} %{SOURCE13} crypto/ec/

%patch10 -p1 -b .ppc-asm

%patch1 -p1 -b .rpmbuild

%patch2 -p1 -b .defaults

%patch4 -p1 -b .enginesdir %{?_rawbuild}

%patch5 -p1 -b .no-rpath

%patch6 -p1 -b .use-localhost

%patch7 -p1 -b .timezone

%patch8 -p1 -b .perlfind %{?_rawbuild}

%patch9 -p1 -b .aliasing

%patch23 -p1 -b .default-paths

%patch24 -p1 -b .issuer-hash

%patch33 -p1 -b .ca-dir

%patch34 -p1 -b .x509

%patch35 -p1 -b .version-add-engines

%patch36 -p1 -b .doc-noeof

%patch38 -p1 -b .op-all

%patch39 -p1 -b .ipv6-apps

%patch40 -p1 -b .fips

%patch45 -p1 -b .env-zlib

%patch47 -p1 -b .warning

%patch49 -p1 -b .algo-doc

%patch50 -p1 -b .dtls1-abi

%patch51 -p1 -b .version

%patch56 -p1 -b .x931

%patch58 -p1 -b .md5-allow

%patch60 -p1 -b .dgst

%patch63 -p1 -b .starttls

%patch65 -p1 -b .chil

%patch66 -p1 -b .krb5

%patch68 -p1 -b .secure-getenv

%patch69 -p1 -b .dh1024

%patch70 -p1 -b .fips-ec

%patch72 -p1 -b .fips-ctor

%patch73 -p1 -b .suiteb

%patch74 -p1 -b .no-md5-verify

%patch75 -p1 -b .compat

%patch76 -p1 -b .fips-reqs

%patch77 -p1 -b .weak-ciphers

%patch78 -p1 -b .3des-strength

%patch79 -p1 -b .keylen

%patch41 -p1 -b .ssl2-noec

%patch42 -p1 -b .enc-fail

%patch80 -p1 -b .wrap

%patch81 -p1 -b .padlock64

%patch82 -p1 -b .backports

%patch71 -p1 -b .manfix

%patch83 -p1 -b .bad-mac

%patch84 -p1 -b .trusted-first

%patch85 -p1 -b .armcap

%patch86 -p1 -b .hash-crash

%patch87 -p1 -b .dtls1-mitm

%patch88 -p1 -b .handshake-crash

%patch89 -p1 -b .ephemeral

%patch90 -p1 -b .heartbeat

%patch91 -p1 -b .freelist

%patch92 -p1 -b .dtls1-overflow

%patch93 -p1 -b .null-deref

%patch94 -p1 -b .dtls1-dos

%patch95 -p1 -b .keying-mitm

%patch96 -p1 -b .anon-ecdh-dos

%patch97 -p1 -b .dtls-ecc-ext

%patch100 -p1 -b .dtls-doublefree

%patch101 -p1 -b .dtls-sizechecks

%patch102 -p1 -b .dtls-memleak

%patch103 -p1 -b .oid-handling

%patch104 -p1 -b .tlsext-race

%patch105 -p1 -b .adh-dos

%patch106 -p1 -b .frag-downgrade

%patch107 -p1 -b .doc-ciphersuites

%patch108 -p1 -b .sn-case

%patch109 -p1 -b .ecdh-auto

%patch110 -p1 -b .ticket-leak

%patch111 -p1 -b .srtp-leak

%patch112 -p1 -b .fallback-scsv

%patch113 -p1 -b .copy-algo

%patch114 -p1 -b .bn-sqr

%patch115 -p1 -b .dtls1-reads

%patch116 -p1 -b .ecdh-downgrade

%patch117 -p1 -b .cert-fingerprint

%patch118 -p1 -b .rsa-ephemeral

%patch119 -p1 -b .dh-unauthenticated

%patch120 -p1 -b .dtls-rec-leak

%patch121 -p1 -b .cc-reqs

%patch122 -p1 -b .use-after-free

%patch123 -p1 -b .bool-cmp

%patch124 -p1 -b .item-reuse

%patch125 -p1 -b .req-null-deref

%patch126 -p1 -b .pkcs7-null-deref

%patch127 -p1 -b .b64-underflow

%patch128 -p1 -b .ssl2-assert

%patch129 -p1 -b .logjam

%patch130 -p1 -b .appdata-free

%patch131 -p1 -b .oob-read

%patch132 -p1 -b .missing-content

%patch133 -p1 -b .ticket-race

%patch134 -p1 -b .unknown-hash

%patch135 -p1 -b .pss-check

%patch136 -p1 -b .combine-leak

%patch137 -p1 -b .psk-identity

sed -i 's/SHLIB_VERSION_NUMBER "1.0.0"/SHLIB_VERSION_NUMBER "%{version}"/' crypto/opensslv.h

# Modify the various perl scripts to reference perl in the right location.

perl util/perlpath.pl `dirname %{__perl}`

# Generate a table with the compile settings for my perusal.

touch Makefile

make TABLE PERL=%{__perl}

%build

# Figure out which flags we want to use.

# default

sslarch=%{_os}-%{_target_cpu}

%ifarch %ix86

sslarch=linux-elf

if ! echo %{_target} | grep -q i686 ; then

	sslflags="no-asm 386"

fi

%endif

%ifarch sparcv9

sslarch=linux-sparcv9

sslflags=no-asm

%endif

%ifarch sparc64

sslarch=linux64-sparcv9

sslflags=no-asm

%endif

%ifarch alpha alphaev56 alphaev6 alphaev67

sslarch=linux-alpha-gcc

%endif

%ifarch s390 sh3eb sh4eb

sslarch="linux-generic32 -DB_ENDIAN"

%endif

%ifarch s390x

sslarch="linux64-s390x"

%endif

%ifarch %{arm}

sslarch=linux-armv4

%endif

%ifarch sh3 sh4

sslarch=linux-generic32

%endif

%ifarch ppc64 ppc64p7

sslarch=linux-ppc64

%endif

%ifarch ppc64le

sslarch="linux-ppc64le"

%endif

# ia64, x86_64, ppc are OK by default

# Configure the build tree.  Override OpenSSL defaults with known-good defaults

# usable on all platforms.  The Configure script already knows to use -fPIC and

# RPM_OPT_FLAGS, so we can skip specifiying them here.

./Configure \

	--prefix=%{_prefix} --openssldir=%{_sysconfdir}/pki/tls ${sslflags} \

	zlib enable-camellia enable-seed enable-tlsext enable-rfc3779 \

	enable-cms enable-md2 no-mdc2 no-rc5 no-ec2m no-gost no-srp \

	--with-krb5-flavor=MIT --enginesdir=%{_libdir}/openssl/engines \

	--with-krb5-dir=/usr shared  ${sslarch} %{?!nofips:fips}

# Add -Wa,--noexecstack here so that libcrypto's assembler modules will be

# marked as not requiring an executable stack.

# Also add -DPURIFY to make using valgrind with openssl easier as we do not

# want to depend on the uninitialized memory as a source of entropy anyway.

RPM_OPT_FLAGS="$RPM_OPT_FLAGS -Wa,--noexecstack -DPURIFY"

make depend

make all

# Generate hashes for the included certs.

make rehash

# Overwrite FIPS README

cp -f %{SOURCE11} .

%check

# Verify that what was compiled actually works.

# We must revert patch33 before tests otherwise they will fail

patch -p1 -R < %{PATCH33}

LD_LIBRARY_PATH=`pwd`${LD_LIBRARY_PATH:+:${LD_LIBRARY_PATH}}

export LD_LIBRARY_PATH

OPENSSL_ENABLE_MD5_VERIFY=

export OPENSSL_ENABLE_MD5_VERIFY

make -C test apps tests

%{__cc} -o openssl-thread-test \

	`krb5-config --cflags` \

	-I./include \

	$RPM_OPT_FLAGS \

	%{SOURCE8} \

	-L. \

	-lssl -lcrypto \

	`krb5-config --libs` \

	-lpthread -lz -ldl

./openssl-thread-test --threads %{thread_test_threads}

# Add generation of HMAC checksum of the final stripped library

%define __spec_install_post \

    %{?__debug_package:%{__debug_install_post}} \

    %{__arch_install_post} \

    %{__os_install_post} \

    crypto/fips/fips_standalone_hmac $RPM_BUILD_ROOT%{_libdir}/libcrypto.so.%{version} >$RPM_BUILD_ROOT%{_libdir}/.libcrypto.so.%{version}.hmac \

    ln -sf .libcrypto.so.%{version}.hmac $RPM_BUILD_ROOT%{_libdir}/.libcrypto.so.%{soversion}.hmac \

    crypto/fips/fips_standalone_hmac $RPM_BUILD_ROOT%{_libdir}/libssl.so.%{version} >$RPM_BUILD_ROOT%{_libdir}/.libssl.so.%{version}.hmac \

    ln -sf .libssl.so.%{version}.hmac $RPM_BUILD_ROOT%{_libdir}/.libssl.so.%{soversion}.hmac \

%{nil}

%define __provides_exclude_from %{_libdir}/openssl

%install

[ "$RPM_BUILD_ROOT" != "/" ] && rm -rf $RPM_BUILD_ROOT

# Install OpenSSL.

install -d $RPM_BUILD_ROOT{%{_bindir},%{_includedir},%{_libdir},%{_mandir},%{_libdir}/openssl}

make INSTALL_PREFIX=$RPM_BUILD_ROOT install

make INSTALL_PREFIX=$RPM_BUILD_ROOT install_docs

mv $RPM_BUILD_ROOT%{_libdir}/engines $RPM_BUILD_ROOT%{_libdir}/openssl

mv $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/man/* $RPM_BUILD_ROOT%{_mandir}/

rmdir $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/man

rename so.%{soversion} so.%{version} $RPM_BUILD_ROOT%{_libdir}/*.so.%{soversion}

mkdir $RPM_BUILD_ROOT/%{_lib}

for lib in $RPM_BUILD_ROOT%{_libdir}/*.so.%{version} ; do

	chmod 755 ${lib}

	ln -s -f `basename ${lib}` $RPM_BUILD_ROOT%{_libdir}/`basename ${lib} .%{version}`

	ln -s -f `basename ${lib}` $RPM_BUILD_ROOT%{_libdir}/`basename ${lib} .%{version}`.%{soversion}

done

# Install a makefile for generating keys and self-signed certs, and a script

# for generating them on the fly.

mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/certs

install -m644 %{SOURCE2} $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/certs/Makefile

install -m755 %{SOURCE6} $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/certs/make-dummy-cert

install -m755 %{SOURCE7} $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/certs/renew-dummy-cert

# Make sure we actually include the headers we built against.

for header in $RPM_BUILD_ROOT%{_includedir}/openssl/* ; do

	if [ -f ${header} -a -f include/openssl/$(basename ${header}) ] ; then

		install -m644 include/openssl/`basename ${header}` ${header}

	fi

done

# Rename man pages so that they don't conflict with other system man pages.

pushd $RPM_BUILD_ROOT%{_mandir}

ln -s -f config.5 man5/openssl.cnf.5

for manpage in man*/* ; do

	if [ -L ${manpage} ]; then

		TARGET=`ls -l ${manpage} | awk '{ print $NF }'`

		ln -snf ${TARGET}ssl ${manpage}ssl

		rm -f ${manpage}

	else

		mv ${manpage} ${manpage}ssl

	fi

done

for conflict in passwd rand ; do

	rename ${conflict} ssl${conflict} man*/${conflict}*

done

popd

# Pick a CA script.

pushd  $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/misc

mv CA.sh CA

popd

mkdir -m755 $RPM_BUILD_ROOT%{_sysconfdir}/pki/CA

mkdir -m700 $RPM_BUILD_ROOT%{_sysconfdir}/pki/CA/private

mkdir -m755 $RPM_BUILD_ROOT%{_sysconfdir}/pki/CA/certs

mkdir -m755 $RPM_BUILD_ROOT%{_sysconfdir}/pki/CA/crl

mkdir -m755 $RPM_BUILD_ROOT%{_sysconfdir}/pki/CA/newcerts

# Ensure the openssl.cnf timestamp is identical across builds to avoid

# mulitlib conflicts and unnecessary renames on upgrade

touch -r %{SOURCE2} $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/openssl.cnf

# Determine which arch opensslconf.h is going to try to #include.

basearch=%{_arch}

%ifarch %{ix86}

basearch=i386

%endif

%ifarch sparcv9

basearch=sparc

%endif

%ifarch sparc64

basearch=sparc64

%endif

%ifarch %{multilib_arches}

# Do an opensslconf.h switcheroo to avoid file conflicts on systems where you

# can have both a 32- and 64-bit version of the library, and they each need

# their own correct-but-different versions of opensslconf.h to be usable.

install -m644 %{SOURCE10} \

	$RPM_BUILD_ROOT/%{_prefix}/include/openssl/opensslconf-${basearch}.h

cat $RPM_BUILD_ROOT/%{_prefix}/include/openssl/opensslconf.h >> \

	$RPM_BUILD_ROOT/%{_prefix}/include/openssl/opensslconf-${basearch}.h

install -m644 %{SOURCE9} \

	$RPM_BUILD_ROOT/%{_prefix}/include/openssl/opensslconf.h

%endif

# Remove unused files from upstream fips support

rm -rf $RPM_BUILD_ROOT/%{_bindir}/openssl_fips_fingerprint

rm -rf $RPM_BUILD_ROOT/%{_libdir}/fips_premain.*

rm -rf $RPM_BUILD_ROOT/%{_libdir}/fipscanister.*

%clean

[ "$RPM_BUILD_ROOT" != "/" ] && rm -rf $RPM_BUILD_ROOT

%files

%defattr(-,root,root)

%doc FAQ LICENSE CHANGES NEWS INSTALL README

%doc doc/c-indentation.el doc/openssl.txt

%doc doc/openssl_button.html doc/openssl_button.gif

%doc doc/ssleay.txt

%doc README.FIPS

%{_sysconfdir}/pki/tls/certs/make-dummy-cert

%{_sysconfdir}/pki/tls/certs/renew-dummy-cert

%{_sysconfdir}/pki/tls/certs/Makefile

%{_sysconfdir}/pki/tls/misc/CA

%dir %{_sysconfdir}/pki/CA

%dir %{_sysconfdir}/pki/CA/private

%dir %{_sysconfdir}/pki/CA/certs

%dir %{_sysconfdir}/pki/CA/crl

%dir %{_sysconfdir}/pki/CA/newcerts

%{_sysconfdir}/pki/tls/misc/c_*

%attr(0755,root,root) %{_bindir}/openssl

%attr(0644,root,root) %{_mandir}/man1*/[ABD-Zabcd-z]*

%attr(0644,root,root) %{_mandir}/man5*/*

%attr(0644,root,root) %{_mandir}/man7*/*

%files libs

%defattr(-,root,root)

%doc LICENSE

%dir %{_sysconfdir}/pki/tls

%dir %{_sysconfdir}/pki/tls/certs

%dir %{_sysconfdir}/pki/tls/misc

%dir %{_sysconfdir}/pki/tls/private

%config(noreplace) %{_sysconfdir}/pki/tls/openssl.cnf

%attr(0755,root,root) %{_libdir}/libcrypto.so.%{version}

%attr(0755,root,root) %{_libdir}/libcrypto.so.%{soversion}

%attr(0755,root,root) %{_libdir}/libssl.so.%{version}

%attr(0755,root,root) %{_libdir}/libssl.so.%{soversion}

%attr(0644,root,root) %{_libdir}/.libcrypto.so.*.hmac

%attr(0644,root,root) %{_libdir}/.libssl.so.*.hmac

%attr(0755,root,root) %{_libdir}/openssl

%files devel

%defattr(-,root,root)

%{_prefix}/include/openssl

%attr(0755,root,root) %{_libdir}/*.so

%attr(0644,root,root) %{_mandir}/man3*/*

%attr(0644,root,root) %{_libdir}/pkgconfig/*.pc

%files static

%defattr(-,root,root)

%attr(0644,root,root) %{_libdir}/*.a

%files perl

%defattr(-,root,root)

%attr(0755,root,root) %{_bindir}/c_rehash

%attr(0644,root,root) %{_mandir}/man1*/*.pl*

%{_sysconfdir}/pki/tls/misc/*.pl

%{_sysconfdir}/pki/tls/misc/tsget

%post libs -p /sbin/ldconfig

%postun libs -p /sbin/ldconfig

%changelog

* Fri Dec  4 2015 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-51.1

- fix CVE-2015-3194 - certificate verify crash with missing PSS parameter

- fix CVE-2015-3195 - X509_ATTRIBUTE memory leak

- fix CVE-2015-3196 - race condition when handling PSK identity hint

* Tue Jun 23 2015 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-51

- fix the CVE-2015-1791 fix (broken server side renegotiation)

* Thu Jun 11 2015 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-50

- improved fix for CVE-2015-1791

- add missing parts of CVE-2015-0209 fix for corectness although unexploitable

* Tue Jun  9 2015 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-49

- fix CVE-2014-8176 - invalid free in DTLS buffering code

- fix CVE-2015-1789 - out-of-bounds read in X509_cmp_time

- fix CVE-2015-1790 - PKCS7 crash with missing EncryptedContent

- fix CVE-2015-1791 - race condition handling NewSessionTicket

- fix CVE-2015-1792 - CMS verify infinite loop with unknown hash function

* Wed Jun  3 2015 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-48

- fix CVE-2015-3216 - regression in RAND locking that can cause segfaults on

  read in multithreaded applications

* Mon May 25 2015 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-47

- fix CVE-2015-4000 - prevent the logjam attack on client - restrict

  the DH key size to at least 768 bits (limit will be increased in future)

* Wed Mar 25 2015 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-46

- drop the AES-GCM restriction of 2^32 operations because the IV is

  always 96 bits (32 bit fixed field + 64 bit invocation field)

* Thu Mar 19 2015 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-45

- update fix for CVE-2015-0287 to what was released upstream

* Wed Mar 18 2015 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-44

- fix CVE-2015-0209 - potential use after free in d2i_ECPrivateKey()

- fix CVE-2015-0286 - improper handling of ASN.1 boolean comparison

- fix CVE-2015-0287 - ASN.1 structure reuse decoding memory corruption

- fix CVE-2015-0288 - X509_to_X509_REQ NULL pointer dereference

- fix CVE-2015-0289 - NULL dereference decoding invalid PKCS#7 data

- fix CVE-2015-0292 - integer underflow in base64 decoder

- fix CVE-2015-0293 - triggerable assert in SSLv2 server

* Mon Mar 16 2015 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-43

- fix broken error detection when unwrapping unpadded key

* Mon Mar  2 2015 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-42.1

- fix the RFC 5649 for key material that does not need padding

* Thu Jan 15 2015 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-42

- test in the non-FIPS RSA keygen for minimal distance of p and q

  similarly to the FIPS RSA keygen

* Tue Jan 13 2015 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-41

- fix CVE-2014-3570 - incorrect computation in BN_sqr()

- fix CVE-2014-3571 - possible crash in dtls1_get_record()

- fix CVE-2014-3572 - possible downgrade of ECDH ciphersuite to non-PFS state

- fix CVE-2014-8275 - various certificate fingerprint issues

- fix CVE-2015-0204 - remove support for RSA ephemeral keys for non-export

  ciphersuites and on server

- fix CVE-2015-0205 - do not allow unauthenticated client DH certificate

- fix CVE-2015-0206 - possible memory leak when buffering DTLS records

* Tue Oct 21 2014 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-40

- use FIPS approved method for computation of d in RSA

- copy digest algorithm when handling SNI context switch

* Wed Oct 15 2014 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-39

- fix CVE-2014-3567 - memory leak when handling session tickets

- fix CVE-2014-3513 - memory leak in srtp support

- add support for fallback SCSV to partially mitigate CVE-2014-3566

  (padding attack on SSL3)

* Wed Sep 24 2014 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-38

- do FIPS algorithm selftest before the integrity check

* Thu Sep 18 2014 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-37

- add support for RFC 5649 (#1119738)

- do not pass the FIPS integrity check if the .hmac files are empty (#1128849)

- add ECC TLS extensions to DTLS (#1119803)

- do not send ECC ciphersuites in SSLv2 client hello (#1090955)

- properly propagate encryption failure in BIO_f_cipher (#1072439)

- fix CVE-2014-0224 fix that broke EAP-FAST session resumption support

- improve documentation of ciphersuites - patch by Hubert Kario (#1108026)

- use case insensitive comparison for servername in s_server (#1081163)

- add support for automatic ECDH curve selection on server (#1080128)

- FIPS mode: make the limitations on DSA, DH, and RSA keygen

  length enforced only if OPENSSL_ENFORCE_MODULUS_BITS environment

  variable is set

* Wed Aug 13 2014 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-36

- add support for ppc64le architecture

- add Power 8 optimalizations

* Fri Aug  8 2014 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-35

- fix CVE-2014-3505 - doublefree in DTLS packet processing

- fix CVE-2014-3506 - avoid memory exhaustion in DTLS

- fix CVE-2014-3507 - avoid memory leak in DTLS

- fix CVE-2014-3508 - fix OID handling to avoid information leak

- fix CVE-2014-3509 - fix race condition when parsing server hello

- fix CVE-2014-3510 - fix DoS in anonymous (EC)DH handling in DTLS

- fix CVE-2014-3511 - disallow protocol downgrade via fragmentation

* Tue Jun  3 2014 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-34.3

- fix CVE-2010-5298 - possible use of memory after free

- fix CVE-2014-0195 - buffer overflow via invalid DTLS fragment

- fix CVE-2014-0198 - possible NULL pointer dereference

- fix CVE-2014-0221 - DoS from invalid DTLS handshake packet

- fix CVE-2014-0224 - SSL/TLS MITM vulnerability

- fix CVE-2014-3470 - client-side DoS when using anonymous ECDH

* Tue Apr  8 2014 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-34

- fix CVE-2014-0160 - information disclosure in TLS heartbeat extension

* Fri Feb 14 2014 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-33

- use the key length from configuration file if req -newkey rsa is invoked

* Thu Feb 13 2014 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-32

- avoid unnecessary reseeding in BN_rand in the FIPS mode

* Wed Feb 12 2014 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-31

- print ephemeral key size negotiated in TLS handshake (#1057715)

- add DH_compute_key_padded needed for FIPS CAVS testing

- make expiration and key length changeable by DAYS and KEYLEN

  variables in the certificate Makefile (#1058108)

- change default hash to sha256 (#1062325)

- lower the actual 3des strength so it is sorted behind aes128 (#1056616)

* Fri Jan 24 2014 Daniel Mach <dmach@redhat.com> - 1:1.0.1e-30

- Mass rebuild 2014-01-24

* Wed Jan 15 2014 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-29

- rebuild with -O3 on ppc64 architecture

* Tue Jan  7 2014 Tomáš Mráz <tmraz@redhat.com> 1.0.1e-28