<pre style='margin:0'>
Clemens Lang (neverpanic) pushed a commit to branch master
in repository macports-ports.
</pre>
<p><a href="https://github.com/macports/macports-ports/commit/3bf0dcad85e5c035336584ad65860f688375afb3">https://github.com/macports/macports-ports/commit/3bf0dcad85e5c035336584ad65860f688375afb3</a></p>
<pre style="white-space: pre; background: #F8F8F8"><span style='display:block; white-space:pre;color:#808000;'>commit 3bf0dcad85e5c035336584ad65860f688375afb3
</span>Author: Clemens Lang <cal@macports.org>
AuthorDate: Tue Jan 30 21:45:54 2024 +0100
<span style='display:block; white-space:pre;color:#404040;'> openssl3: Update to 3.2.1/3.1.5
</span><span style='display:block; white-space:pre;color:#404040;'>
</span><span style='display:block; white-space:pre;color:#404040;'> Not a security update, since I backported all CVEs already, so this is
</span><span style='display:block; white-space:pre;color:#404040;'> a bugfix release only.
</span>---
devel/openssl3/Portfile | 26 ++-
.../0b0f7abfb37350794a4b8960fafc292cd5d1b84d.patch | 122 ---------------
.../a830f551557d3d66a84bbb18a5b889c640c36294.patch | 122 ---------------
.../ddeb4b6c6d527e54ce9a99cba785c0f7776e54b6.patch | 174 ---------------------
4 files changed, 10 insertions(+), 434 deletions(-)
<span style='display:block; white-space:pre;color:#808080;'>diff --git a/devel/openssl3/Portfile b/devel/openssl3/Portfile
</span><span style='display:block; white-space:pre;color:#808080;'>index 360b5120557..0d06cec14b8 100644
</span><span style='display:block; white-space:pre;background:#e0e0ff;'>--- a/devel/openssl3/Portfile
</span><span style='display:block; white-space:pre;background:#e0e0ff;'>+++ b/devel/openssl3/Portfile
</span><span style='display:block; white-space:pre;background:#e0e0e0;'>@@ -12,8 +12,8 @@ set major_v 3
</span> name openssl$major_v
# For rolling back to 3.1.4 release where needed. Must now stay.
epoch 1
<span style='display:block; white-space:pre;background:#ffe0e0;'>-version ${major_v}.2.0
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-revision 1
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+version ${major_v}.2.1
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+revision 0
</span>
# Please revbump these ports when updating the openssl3 version/revision
# - freeradius (#43461)
<span style='display:block; white-space:pre;background:#e0e0e0;'>@@ -50,11 +50,9 @@ master_sites ${homepage}/source \
</span> ftp://ftp.linux.hr/pub/openssl/source/ \
ftp://guest.kuria.katowice.pl/pub/openssl/source/
<span style='display:block; white-space:pre;background:#ffe0e0;'>-checksums rmd160 88d268dca2256ce7d6db7cd20e54bd936d134dbb \
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- sha256 14c826f07c7e433706fb5c69fa9e25dab95684844b4c962a2cf1bf183eb4690e \
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- size 17698352
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-patchfiles 0b0f7abfb37350794a4b8960fafc292cd5d1b84d.patch
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+checksums rmd160 0182f83617754e1a2b0f6864679a7cd9c088e172 \
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ sha256 83c7329fe52c850677d75e5d0b0ca245309b97e8ecbcfdc1dfdc4ab9fac35b39 \
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ size 17733249
</span>
# 3.2.0 is currently broken for OS < 10.14
if {${os.platform} eq "darwin" && ${os.major} < 18} {
<span style='display:block; white-space:pre;background:#e0e0e0;'>@@ -65,18 +63,14 @@ if {${os.platform} eq "darwin" && ${os.major} < 18} {
</span>
if {$subport eq $name} {
conflicts ${name}-devel
<span style='display:block; white-space:pre;background:#ffe0e0;'>- version ${major_v}.1.4
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- revision 1
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ version ${major_v}.1.5
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ revision 0
</span>
distname openssl-${version}
<span style='display:block; white-space:pre;background:#ffe0e0;'>- checksums rmd160 44e8f5368a6f62508b8b83124239bf1ebbba8d18 \
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- sha256 840af5366ab9b522bde525826be3ef0fb0af81c6a9ebd84caa600fea1731eee3 \
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- size 15569450
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- patchfiles-delete 0b0f7abfb37350794a4b8960fafc292cd5d1b84d.patch
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- patchfiles ddeb4b6c6d527e54ce9a99cba785c0f7776e54b6.patch \
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- a830f551557d3d66a84bbb18a5b889c640c36294.patch
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ checksums rmd160 9c3e80f27e0b15b6b46774a944d75cf034358474 \
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ sha256 6ae015467dabf0469b139ada93319327be24b98251ffaeceda0221848dc09262 \
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ size 15663524
</span> }
}
<span style='display:block; white-space:pre;color:#808080;'>diff --git a/devel/openssl3/files/0b0f7abfb37350794a4b8960fafc292cd5d1b84d.patch b/devel/openssl3/files/0b0f7abfb37350794a4b8960fafc292cd5d1b84d.patch
</span>deleted file mode 100644
<span style='display:block; white-space:pre;color:#808080;'>index 8b0aa9c6155..00000000000
</span><span style='display:block; white-space:pre;background:#e0e0ff;'>--- a/devel/openssl3/files/0b0f7abfb37350794a4b8960fafc292cd5d1b84d.patch
</span><span style='display:block; white-space:pre;background:#e0e0ff;'>+++ /dev/null
</span><span style='display:block; white-space:pre;background:#e0e0e0;'>@@ -1,122 +0,0 @@
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-From 0b0f7abfb37350794a4b8960fafc292cd5d1b84d Mon Sep 17 00:00:00 2001
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-From: Tomas Mraz <tomas@openssl.org>
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-Date: Fri, 22 Dec 2023 16:25:56 +0100
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-Subject: [PATCH] Limit the execution time of RSA public key check
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-Fixes CVE-2023-6237
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-If a large and incorrect RSA public key is checked with
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-EVP_PKEY_public_check() the computation could take very long time
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-due to no limit being applied to the RSA public key size and
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-unnecessarily high number of Miller-Rabin algorithm rounds
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-used for non-primality check of the modulus.
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-Now the keys larger than 16384 bits (OPENSSL_RSA_MAX_MODULUS_BITS)
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-will fail the check with RSA_R_MODULUS_TOO_LARGE error reason.
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-Also the number of Miller-Rabin rounds was set to 5.
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-Reviewed-by: Neil Horman <nhorman@openssl.org>
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-Reviewed-by: Matt Caswell <matt@openssl.org>
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-(Merged from https://github.com/openssl/openssl/pull/23243)
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-(cherry picked from commit e09fc1d746a4fd15bb5c3d7bbbab950aadd005db)
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>----
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- crypto/rsa/rsa_sp800_56b_check.c | 8 +++-
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- test/recipes/91-test_pkey_check.t | 2 +-
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- .../91-test_pkey_check_data/rsapub_17k.pem | 48 +++++++++++++++++++
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- 3 files changed, 56 insertions(+), 2 deletions(-)
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- create mode 100644 test/recipes/91-test_pkey_check_data/rsapub_17k.pem
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-diff --git a/crypto/rsa/rsa_sp800_56b_check.c b/crypto/rsa/rsa_sp800_56b_check.c
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-index c585465b32752..3f0a1e0d6b1ee 100644
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>---- ./crypto/rsa/rsa_sp800_56b_check.c
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+++ ./crypto/rsa/rsa_sp800_56b_check.c
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-@@ -289,6 +289,11 @@ int ossl_rsa_sp800_56b_check_public(const RSA *rsa)
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- return 0;
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- nbits = BN_num_bits(rsa->n);
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+ if (nbits > OPENSSL_RSA_MAX_MODULUS_BITS) {
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+ ERR_raise(ERR_LIB_RSA, RSA_R_MODULUS_TOO_LARGE);
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+ return 0;
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+ }
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- #ifdef FIPS_MODULE
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- /*
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- * (Step a): modulus must be 2048 or 3072 (caveat from SP800-56Br1)
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-@@ -324,7 +329,8 @@ int ossl_rsa_sp800_56b_check_public(const RSA *rsa)
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- goto err;
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- }
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-- ret = ossl_bn_miller_rabin_is_prime(rsa->n, 0, ctx, NULL, 1, &status);
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+ /* Highest number of MR rounds from FIPS 186-5 Section B.3 Table B.1 */
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+ ret = ossl_bn_miller_rabin_is_prime(rsa->n, 5, ctx, NULL, 1, &status);
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- #ifdef FIPS_MODULE
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- if (ret != 1 || status != BN_PRIMETEST_COMPOSITE_NOT_POWER_OF_PRIME) {
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- #else
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-diff --git a/test/recipes/91-test_pkey_check.t b/test/recipes/91-test_pkey_check.t
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-index dc7cc64533af2..f8088df14d36c 100644
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>---- ./test/recipes/91-test_pkey_check.t
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+++ ./test/recipes/91-test_pkey_check.t
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-@@ -70,7 +70,7 @@ push(@positive_tests, (
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- "dhpkey.pem"
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- )) unless disabled("dh");
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>--my @negative_pubtests = ();
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+my @negative_pubtests = ("rsapub_17k.pem"); # Too big RSA public key
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- push(@negative_pubtests, (
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- "dsapub_noparam.der"
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-diff --git a/test/recipes/91-test_pkey_check_data/rsapub_17k.pem b/test/recipes/91-test_pkey_check_data/rsapub_17k.pem
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-new file mode 100644
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-index 0000000000000..9a2eaedaf1b22
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>---- /dev/null
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+++ ./test/recipes/91-test_pkey_check_data/rsapub_17k.pem
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-@@ -0,0 +1,48 @@
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+-----BEGIN PUBLIC KEY-----
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+MIIIbzANBgkqhkiG9w0BAQEFAAOCCFwAMIIIVwKCCE4Ang+cE5H+hg3RbapDAHqR
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+B9lUnp2MlAwsZxQ/FhYepaR60bFQeumbu7817Eo5YLMObVI99hF1C4u/qcpD4Jph
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+gZt87/JAYDbP+DIh/5gUXCL9m5Fp4u7mvZaZdnlcftBvR1uKUTCAwc9pZ/Cfr8W2
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+GzrRODzsNYnk2DcZMfe2vRDuDZRopE+Y+I72rom2SZLxoN547N1daM/M/CL9KVQ/
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+XMI/YOpJrBI0jI3brMRhLkvLckwies9joufydlGbJkeil9H7/grj3fQZtFkZ2Pkj
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+b87XDzRVX7wsEpAgPJxskL3jApokCp1kQYKG+Uc3dKM9Ade6IAPK7VKcmbAQTYw2
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+gZxsc28dtstazmfGz0ACCTSMrmbgWAM3oPL7RRzhrXDWgmYQ0jHefGh8SNTIgtPq
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+TuHxPYkDMQNaf0LmDGCxqlnf4b5ld3YaU8zZ/RqIRx5v/+w0rJUvU53qY1bYSnL1
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+vbqKSnN2mip0GYyQ4AUgkS1NBV4rGYU/VTvzEjLfkg02KOtHKandvEoUjmZPzCT0
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+V2ZhGc8K1UJNGYlIiHqCdwCBoghvly/pYajTkDXyd6BsukzA5H3IkZB1xDgl035j
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+/0Cr7QeZLEOdi9fPdSSaBT6OmD0WFuZfJF0wMr7ucRhWzPXvSensD9v7MBE7tNfH
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+SLeTSx8tLt8UeWriiM+0CnkPR1IOqMOxubOyf1eV8NQqEWm5wEQG/0IskbOKnaHa
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+PqLFJZn/bvyL3XK5OxVIJG3z6bnRDOMS9SzkjqgPdIO8tkySEHVSi/6iuGUltx3Y
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+Fmq6ye/r34ekyHPbfn6UuTON7joM6SIXb5bHM64x4iMVWx4hMvDjfy0UqfywAUyu
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+C1o7BExSMxxFG8GJcqR0K8akpPp7EM588PC+YuItoxzXgfUJnP3BQ1Beev2Ve7/J
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+xeGZH0N4ntfr+cuaLAakAER9zDglwChWflw3NNFgIdAgSxXv3XXx5xDXpdP4lxUo
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+F5zAN4Mero3yV90FaJl7Vhq/UFVidbwFc15jUDwaE0mKRcsBeVd3GOhoECAgE0id
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+aIPT20z8oVY0FyTJlRk7QSjo8WjJSrHY/Fn14gctX07ZdfkufyL6w+NijBdYluvB
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+nIrgHEvpkDEWoIa8qcx0EppoIcmqgMV2mTShfFYSybsO33Pm8WXec2FXjwhzs1Pi
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+R/BuIW8rHPI67xqWm0h8dEw11vtfi9a/BBBikFHe59KBjMTG+lW/gADNvRoTzGh7
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+kN4+UVDS3jlSisRZZOn1XoeQtpubNYWgUsecjKy45IwIj8h1SHgn3wkmUesY0woN
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+mOdoNtq+NezN4RFtbCOHhxFVpKKDi/HQP2ro0ykkXMDjwEIVf2Lii1Mg9UP8m+Ux
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+AOqkTrIkdogkRx+70h7/wUOfDIFUq2JbKzqxJYamyEphcdAko7/B8efQKc61Z93O
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+f2SHa4++4WI7wIIx18v5KV4M/cRmrfc8w9WRkQN3gBT5AJMuqwcSHVXBWvNQeGmi
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+ScMh7X6cCZ0daEujqb8svq4WgsJ8UT4GaGBRIYtt7QUKEh+JQwNJzneRYZ3pzpaH
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+UJeeoYobMlkp3rM9cYzdq90nBQiI9Jsbim9m9ggb2dMOS5CsI9S/IuG2O5uTjfxx
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+wkwsd5nLDFtNXHYZ7W6XlVJ1Rc6zShnEmdCn3mmibb6OaMUmun2yl9ryEjVSoXLP
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+fSA8W9K9yNhKTRkzdXJfqlC+s/ovX2xBGxsuOoUDaXhRVz0qmpKIHeSFjIP4iXq4
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+y8gDiwvM3HbZfvVonbg6siPwpn4uvw3hesojk1DKAENS52i6U3uK2fs1ALVxsFNS
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+Yh914rDu0Q3e4RXVhURaYzoEbLCot6WGYeCCfQOK0rkETMv+sTYYscC8/THuW7SL
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+HG5zy9Ed95N1Xmf8J+My7gM7ZFodGdHsWvdzEmqsdOFh6IVx/VfHFX0MDBq0t6lZ
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+eRvVgVCfu3gkYLwPScn/04E02vOom51ISKHsF/I11erC66jjNYV9BSpH8O7sAHxZ
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+EmPT2ZVVRSgivOHdQW/FZ3UZQQhVaVSympo2Eb4yWEMFn84Q8T+9Honj6gnB5PXz
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+chmeCsOMlcg1mwWwhn0k+OAWEZy7VRUk5Ahp0fBAGJgwBdqrZ3kM356DjUkVBiYq
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+4eHyvafNKmjf2mnFsI3g2NKRNyl1Lh63wyCFx60yYvBUfXF/W9PFJbD9CiP83kEW
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+gV36gxTsbOSfhpO1OXR90ODy0kx06XzWmJCUugK8u9bx4F/CjV+LIHExuNJiethC
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+A8sIup/MT0fWp4RO/SsVblGqfoqJTaPnhptQzeH2N07pbWkxeMuL6ppPuwFmfVjK
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+FJndqCVrAukcPEOQ16iVURuloJMudqYRc9QKkJFsnv0W/iMNbqQGmXe8Q/5qFiys
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+26NIQBiE2ad9hNLnoccEnmYSRgnW3ZPSKuq5TDdYyDqTZH2r8cam65pr3beKw2XC
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+xw4cc7VaxiwGC2Mg2wRmwwPaTjrcEt6sMa3RjwFEVBxBFyM26wnTEZsTBquCxV0J
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+pgERaeplkixP2Q0m7XAdlDaob973SM2vOoUgypzDchWmpx7u775bnOfU5CihwXl+
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+k0i09WZuT8bPmhEAiGCw5sNzMkz1BC2cCZFfJIkE2vc/wXYOrGxBTJo0EKaUFswa
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+2dnP/u0bn+VksBUM7ywW9LJSXh4mN+tpzdeJtxEObKwX1I0dQxSPWmjd2++wMr9q
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+Unre5fCrDToy2H7C2VKSpuOCT2/Kv4JDQRWwI4KxQOpn0UknAGNmfBoTtpIZ3LEb
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+77oBUJdMQD7tQBBLL0a6f1TdK0dHVprWWawJ+gGFMiMQXqAqblHcxFKWuHv9bQID
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+AQAB
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+-----END PUBLIC KEY-----
</span><span style='display:block; white-space:pre;color:#808080;'>diff --git a/devel/openssl3/files/a830f551557d3d66a84bbb18a5b889c640c36294.patch b/devel/openssl3/files/a830f551557d3d66a84bbb18a5b889c640c36294.patch
</span>deleted file mode 100644
<span style='display:block; white-space:pre;color:#808080;'>index 19f5499f32b..00000000000
</span><span style='display:block; white-space:pre;background:#e0e0ff;'>--- a/devel/openssl3/files/a830f551557d3d66a84bbb18a5b889c640c36294.patch
</span><span style='display:block; white-space:pre;background:#e0e0ff;'>+++ /dev/null
</span><span style='display:block; white-space:pre;background:#e0e0e0;'>@@ -1,122 +0,0 @@
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-From a830f551557d3d66a84bbb18a5b889c640c36294 Mon Sep 17 00:00:00 2001
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-From: Tomas Mraz <tomas@openssl.org>
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-Date: Fri, 22 Dec 2023 16:25:56 +0100
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-Subject: [PATCH] Limit the execution time of RSA public key check
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-Fixes CVE-2023-6237
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-If a large and incorrect RSA public key is checked with
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-EVP_PKEY_public_check() the computation could take very long time
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-due to no limit being applied to the RSA public key size and
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-unnecessarily high number of Miller-Rabin algorithm rounds
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-used for non-primality check of the modulus.
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-Now the keys larger than 16384 bits (OPENSSL_RSA_MAX_MODULUS_BITS)
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-will fail the check with RSA_R_MODULUS_TOO_LARGE error reason.
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-Also the number of Miller-Rabin rounds was set to 5.
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-Reviewed-by: Neil Horman <nhorman@openssl.org>
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-Reviewed-by: Matt Caswell <matt@openssl.org>
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-(Merged from https://github.com/openssl/openssl/pull/23243)
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-(cherry picked from commit e09fc1d746a4fd15bb5c3d7bbbab950aadd005db)
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>----
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- crypto/rsa/rsa_sp800_56b_check.c | 8 +++-
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- test/recipes/91-test_pkey_check.t | 2 +-
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- .../91-test_pkey_check_data/rsapub_17k.pem | 48 +++++++++++++++++++
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- 3 files changed, 56 insertions(+), 2 deletions(-)
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- create mode 100644 test/recipes/91-test_pkey_check_data/rsapub_17k.pem
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-diff --git a/crypto/rsa/rsa_sp800_56b_check.c b/crypto/rsa/rsa_sp800_56b_check.c
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-index fc8f19b48770b..bcbdd24fb8199 100644
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>---- ./crypto/rsa/rsa_sp800_56b_check.c
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+++ ./crypto/rsa/rsa_sp800_56b_check.c
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-@@ -289,6 +289,11 @@ int ossl_rsa_sp800_56b_check_public(const RSA *rsa)
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- return 0;
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- nbits = BN_num_bits(rsa->n);
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+ if (nbits > OPENSSL_RSA_MAX_MODULUS_BITS) {
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+ ERR_raise(ERR_LIB_RSA, RSA_R_MODULUS_TOO_LARGE);
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+ return 0;
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+ }
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- #ifdef FIPS_MODULE
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- /*
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- * (Step a): modulus must be 2048 or 3072 (caveat from SP800-56Br1)
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-@@ -324,7 +329,8 @@ int ossl_rsa_sp800_56b_check_public(const RSA *rsa)
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- goto err;
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- }
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-- ret = ossl_bn_miller_rabin_is_prime(rsa->n, 0, ctx, NULL, 1, &status);
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+ /* Highest number of MR rounds from FIPS 186-5 Section B.3 Table B.1 */
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+ ret = ossl_bn_miller_rabin_is_prime(rsa->n, 5, ctx, NULL, 1, &status);
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- #ifdef FIPS_MODULE
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- if (ret != 1 || status != BN_PRIMETEST_COMPOSITE_NOT_POWER_OF_PRIME) {
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- #else
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-diff --git a/test/recipes/91-test_pkey_check.t b/test/recipes/91-test_pkey_check.t
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-index dc7cc64533af2..f8088df14d36c 100644
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>---- ./test/recipes/91-test_pkey_check.t
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+++ ./test/recipes/91-test_pkey_check.t
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-@@ -70,7 +70,7 @@ push(@positive_tests, (
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- "dhpkey.pem"
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- )) unless disabled("dh");
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>--my @negative_pubtests = ();
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+my @negative_pubtests = ("rsapub_17k.pem"); # Too big RSA public key
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- push(@negative_pubtests, (
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- "dsapub_noparam.der"
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-diff --git a/test/recipes/91-test_pkey_check_data/rsapub_17k.pem b/test/recipes/91-test_pkey_check_data/rsapub_17k.pem
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-new file mode 100644
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-index 0000000000000..9a2eaedaf1b22
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>---- /dev/null
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+++ ./test/recipes/91-test_pkey_check_data/rsapub_17k.pem
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-@@ -0,0 +1,48 @@
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+-----BEGIN PUBLIC KEY-----
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+MIIIbzANBgkqhkiG9w0BAQEFAAOCCFwAMIIIVwKCCE4Ang+cE5H+hg3RbapDAHqR
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+B9lUnp2MlAwsZxQ/FhYepaR60bFQeumbu7817Eo5YLMObVI99hF1C4u/qcpD4Jph
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+gZt87/JAYDbP+DIh/5gUXCL9m5Fp4u7mvZaZdnlcftBvR1uKUTCAwc9pZ/Cfr8W2
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+GzrRODzsNYnk2DcZMfe2vRDuDZRopE+Y+I72rom2SZLxoN547N1daM/M/CL9KVQ/
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+XMI/YOpJrBI0jI3brMRhLkvLckwies9joufydlGbJkeil9H7/grj3fQZtFkZ2Pkj
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+b87XDzRVX7wsEpAgPJxskL3jApokCp1kQYKG+Uc3dKM9Ade6IAPK7VKcmbAQTYw2
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+gZxsc28dtstazmfGz0ACCTSMrmbgWAM3oPL7RRzhrXDWgmYQ0jHefGh8SNTIgtPq
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+TuHxPYkDMQNaf0LmDGCxqlnf4b5ld3YaU8zZ/RqIRx5v/+w0rJUvU53qY1bYSnL1
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+vbqKSnN2mip0GYyQ4AUgkS1NBV4rGYU/VTvzEjLfkg02KOtHKandvEoUjmZPzCT0
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+V2ZhGc8K1UJNGYlIiHqCdwCBoghvly/pYajTkDXyd6BsukzA5H3IkZB1xDgl035j
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+/0Cr7QeZLEOdi9fPdSSaBT6OmD0WFuZfJF0wMr7ucRhWzPXvSensD9v7MBE7tNfH
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+SLeTSx8tLt8UeWriiM+0CnkPR1IOqMOxubOyf1eV8NQqEWm5wEQG/0IskbOKnaHa
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+PqLFJZn/bvyL3XK5OxVIJG3z6bnRDOMS9SzkjqgPdIO8tkySEHVSi/6iuGUltx3Y
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+Fmq6ye/r34ekyHPbfn6UuTON7joM6SIXb5bHM64x4iMVWx4hMvDjfy0UqfywAUyu
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+C1o7BExSMxxFG8GJcqR0K8akpPp7EM588PC+YuItoxzXgfUJnP3BQ1Beev2Ve7/J
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+xeGZH0N4ntfr+cuaLAakAER9zDglwChWflw3NNFgIdAgSxXv3XXx5xDXpdP4lxUo
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+F5zAN4Mero3yV90FaJl7Vhq/UFVidbwFc15jUDwaE0mKRcsBeVd3GOhoECAgE0id
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+aIPT20z8oVY0FyTJlRk7QSjo8WjJSrHY/Fn14gctX07ZdfkufyL6w+NijBdYluvB
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+nIrgHEvpkDEWoIa8qcx0EppoIcmqgMV2mTShfFYSybsO33Pm8WXec2FXjwhzs1Pi
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+R/BuIW8rHPI67xqWm0h8dEw11vtfi9a/BBBikFHe59KBjMTG+lW/gADNvRoTzGh7
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+kN4+UVDS3jlSisRZZOn1XoeQtpubNYWgUsecjKy45IwIj8h1SHgn3wkmUesY0woN
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+mOdoNtq+NezN4RFtbCOHhxFVpKKDi/HQP2ro0ykkXMDjwEIVf2Lii1Mg9UP8m+Ux
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+AOqkTrIkdogkRx+70h7/wUOfDIFUq2JbKzqxJYamyEphcdAko7/B8efQKc61Z93O
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+f2SHa4++4WI7wIIx18v5KV4M/cRmrfc8w9WRkQN3gBT5AJMuqwcSHVXBWvNQeGmi
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+ScMh7X6cCZ0daEujqb8svq4WgsJ8UT4GaGBRIYtt7QUKEh+JQwNJzneRYZ3pzpaH
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+UJeeoYobMlkp3rM9cYzdq90nBQiI9Jsbim9m9ggb2dMOS5CsI9S/IuG2O5uTjfxx
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+wkwsd5nLDFtNXHYZ7W6XlVJ1Rc6zShnEmdCn3mmibb6OaMUmun2yl9ryEjVSoXLP
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+fSA8W9K9yNhKTRkzdXJfqlC+s/ovX2xBGxsuOoUDaXhRVz0qmpKIHeSFjIP4iXq4
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+y8gDiwvM3HbZfvVonbg6siPwpn4uvw3hesojk1DKAENS52i6U3uK2fs1ALVxsFNS
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+Yh914rDu0Q3e4RXVhURaYzoEbLCot6WGYeCCfQOK0rkETMv+sTYYscC8/THuW7SL
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+HG5zy9Ed95N1Xmf8J+My7gM7ZFodGdHsWvdzEmqsdOFh6IVx/VfHFX0MDBq0t6lZ
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+eRvVgVCfu3gkYLwPScn/04E02vOom51ISKHsF/I11erC66jjNYV9BSpH8O7sAHxZ
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+EmPT2ZVVRSgivOHdQW/FZ3UZQQhVaVSympo2Eb4yWEMFn84Q8T+9Honj6gnB5PXz
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+chmeCsOMlcg1mwWwhn0k+OAWEZy7VRUk5Ahp0fBAGJgwBdqrZ3kM356DjUkVBiYq
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+4eHyvafNKmjf2mnFsI3g2NKRNyl1Lh63wyCFx60yYvBUfXF/W9PFJbD9CiP83kEW
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+gV36gxTsbOSfhpO1OXR90ODy0kx06XzWmJCUugK8u9bx4F/CjV+LIHExuNJiethC
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+A8sIup/MT0fWp4RO/SsVblGqfoqJTaPnhptQzeH2N07pbWkxeMuL6ppPuwFmfVjK
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+FJndqCVrAukcPEOQ16iVURuloJMudqYRc9QKkJFsnv0W/iMNbqQGmXe8Q/5qFiys
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+26NIQBiE2ad9hNLnoccEnmYSRgnW3ZPSKuq5TDdYyDqTZH2r8cam65pr3beKw2XC
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+xw4cc7VaxiwGC2Mg2wRmwwPaTjrcEt6sMa3RjwFEVBxBFyM26wnTEZsTBquCxV0J
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+pgERaeplkixP2Q0m7XAdlDaob973SM2vOoUgypzDchWmpx7u775bnOfU5CihwXl+
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+k0i09WZuT8bPmhEAiGCw5sNzMkz1BC2cCZFfJIkE2vc/wXYOrGxBTJo0EKaUFswa
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+2dnP/u0bn+VksBUM7ywW9LJSXh4mN+tpzdeJtxEObKwX1I0dQxSPWmjd2++wMr9q
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+Unre5fCrDToy2H7C2VKSpuOCT2/Kv4JDQRWwI4KxQOpn0UknAGNmfBoTtpIZ3LEb
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+77oBUJdMQD7tQBBLL0a6f1TdK0dHVprWWawJ+gGFMiMQXqAqblHcxFKWuHv9bQID
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+AQAB
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+-----END PUBLIC KEY-----
</span><span style='display:block; white-space:pre;color:#808080;'>diff --git a/devel/openssl3/files/ddeb4b6c6d527e54ce9a99cba785c0f7776e54b6.patch b/devel/openssl3/files/ddeb4b6c6d527e54ce9a99cba785c0f7776e54b6.patch
</span>deleted file mode 100644
<span style='display:block; white-space:pre;color:#808080;'>index 667bdbe8229..00000000000
</span><span style='display:block; white-space:pre;background:#e0e0ff;'>--- a/devel/openssl3/files/ddeb4b6c6d527e54ce9a99cba785c0f7776e54b6.patch
</span><span style='display:block; white-space:pre;background:#e0e0ff;'>+++ /dev/null
</span><span style='display:block; white-space:pre;background:#e0e0e0;'>@@ -1,174 +0,0 @@
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-From ddeb4b6c6d527e54ce9a99cba785c0f7776e54b6 Mon Sep 17 00:00:00 2001
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-From: Richard Levitte <levitte@openssl.org>
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-Date: Fri, 20 Oct 2023 09:18:19 +0200
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-Subject: [PATCH] Make DH_check_pub_key() and DH_generate_key() safer yet
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-We already check for an excessively large P in DH_generate_key(), but not in
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-DH_check_pub_key(), and none of them check for an excessively large Q.
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-This change adds all the missing excessive size checks of P and Q.
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-It's to be noted that behaviours surrounding excessively sized P and Q
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-differ. DH_check() raises an error on the excessively sized P, but only
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-sets a flag for the excessively sized Q. This behaviour is mimicked in
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-DH_check_pub_key().
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-Reviewed-by: Tomas Mraz <tomas@openssl.org>
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-Reviewed-by: Matt Caswell <matt@openssl.org>
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-Reviewed-by: Hugo Landau <hlandau@openssl.org>
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-(Merged from https://github.com/openssl/openssl/pull/22518)
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-Upstream-Stauts: Backport [github.com/openssl/openssl/commit/ddeb4b6c6d527e54ce9a99cba785c0f7776e54b6]
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>----
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- crypto/dh/dh_check.c | 12 ++++++++++++
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- crypto/dh/dh_err.c | 3 ++-
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- crypto/dh/dh_key.c | 12 ++++++++++++
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- crypto/err/openssl.txt | 1 +
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- include/crypto/dherr.h | 2 +-
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- include/openssl/dh.h | 6 +++---
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- include/openssl/dherr.h | 3 ++-
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- 7 files changed, 33 insertions(+), 6 deletions(-)
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-diff --git a/crypto/dh/dh_check.c b/crypto/dh/dh_check.c
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-index 7ba2beae7fd6b..e20eb62081c5e 100644
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>---- ./crypto/dh/dh_check.c
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+++ ./crypto/dh/dh_check.c
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-@@ -249,6 +249,18 @@ int DH_check_pub_key_ex(const DH *dh, const BIGNUM *pub_key)
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- */
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- int DH_check_pub_key(const DH *dh, const BIGNUM *pub_key, int *ret)
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- {
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+ /* Don't do any checks at all with an excessively large modulus */
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+ if (BN_num_bits(dh->params.p) > OPENSSL_DH_CHECK_MAX_MODULUS_BITS) {
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+ ERR_raise(ERR_LIB_DH, DH_R_MODULUS_TOO_LARGE);
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+ *ret = DH_MODULUS_TOO_LARGE | DH_CHECK_PUBKEY_INVALID;
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+ return 0;
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+ }
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+ if (dh->params.q != NULL && BN_ucmp(dh->params.p, dh->params.q) < 0) {
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+ *ret |= DH_CHECK_INVALID_Q_VALUE | DH_CHECK_PUBKEY_INVALID;
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+ return 1;
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+ }
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- return ossl_ffc_validate_public_key(&dh->params, pub_key, ret);
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- }
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-diff --git a/crypto/dh/dh_err.c b/crypto/dh/dh_err.c
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-index 4152397426cc9..f76ac0dd1463f 100644
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>---- ./crypto/dh/dh_err.c
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+++ ./crypto/dh/dh_err.c
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-@@ -1,6 +1,6 @@
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- /*
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- * Generated by util/mkerr.pl DO NOT EDIT
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-- * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+ * Copyright 1995-2023 The OpenSSL Project Authors. All Rights Reserved.
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- *
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- * Licensed under the Apache License 2.0 (the "License"). You may not use
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- * this file except in compliance with the License. You can obtain a copy
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-@@ -54,6 +54,7 @@ static const ERR_STRING_DATA DH_str_reasons[] = {
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- {ERR_PACK(ERR_LIB_DH, 0, DH_R_PARAMETER_ENCODING_ERROR),
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- "parameter encoding error"},
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- {ERR_PACK(ERR_LIB_DH, 0, DH_R_PEER_KEY_ERROR), "peer key error"},
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+ {ERR_PACK(ERR_LIB_DH, 0, DH_R_Q_TOO_LARGE), "q too large"},
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- {ERR_PACK(ERR_LIB_DH, 0, DH_R_SHARED_INFO_ERROR), "shared info error"},
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- {ERR_PACK(ERR_LIB_DH, 0, DH_R_UNABLE_TO_CHECK_GENERATOR),
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- "unable to check generator"},
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-diff --git a/crypto/dh/dh_key.c b/crypto/dh/dh_key.c
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-index d84ea99241b9e..afc49f5cdc87d 100644
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>---- ./crypto/dh/dh_key.c
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+++ ./crypto/dh/dh_key.c
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-@@ -49,6 +49,12 @@ int ossl_dh_compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh)
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- goto err;
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- }
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+ if (dh->params.q != NULL
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+ && BN_num_bits(dh->params.q) > OPENSSL_DH_MAX_MODULUS_BITS) {
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+ ERR_raise(ERR_LIB_DH, DH_R_Q_TOO_LARGE);
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+ goto err;
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+ }
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- if (BN_num_bits(dh->params.p) < DH_MIN_MODULUS_BITS) {
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- ERR_raise(ERR_LIB_DH, DH_R_MODULUS_TOO_SMALL);
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- return 0;
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-@@ -267,6 +273,12 @@ static int generate_key(DH *dh)
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- return 0;
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- }
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+ if (dh->params.q != NULL
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+ && BN_num_bits(dh->params.q) > OPENSSL_DH_MAX_MODULUS_BITS) {
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+ ERR_raise(ERR_LIB_DH, DH_R_Q_TOO_LARGE);
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+ return 0;
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+ }
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- if (BN_num_bits(dh->params.p) < DH_MIN_MODULUS_BITS) {
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- ERR_raise(ERR_LIB_DH, DH_R_MODULUS_TOO_SMALL);
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- return 0;
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-diff --git a/crypto/err/openssl.txt b/crypto/err/openssl.txt
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-index a1e6bbb617fcb..69e4f61aa1801 100644
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>---- ./crypto/err/openssl.txt
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+++ ./crypto/err/openssl.txt
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-@@ -513,6 +513,7 @@ DH_R_NO_PARAMETERS_SET:107:no parameters set
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- DH_R_NO_PRIVATE_VALUE:100:no private value
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- DH_R_PARAMETER_ENCODING_ERROR:105:parameter encoding error
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- DH_R_PEER_KEY_ERROR:111:peer key error
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+DH_R_Q_TOO_LARGE:130:q too large
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- DH_R_SHARED_INFO_ERROR:113:shared info error
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- DH_R_UNABLE_TO_CHECK_GENERATOR:121:unable to check generator
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- DSA_R_BAD_FFC_PARAMETERS:114:bad ffc parameters
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-diff --git a/include/crypto/dherr.h b/include/crypto/dherr.h
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-index bb24d131eb887..519327f795742 100644
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>---- ./include/crypto/dherr.h
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+++ ./include/crypto/dherr.h
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-@@ -1,6 +1,6 @@
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- /*
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- * Generated by util/mkerr.pl DO NOT EDIT
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-- * Copyright 2020-2021 The OpenSSL Project Authors. All Rights Reserved.
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+ * Copyright 2020-2023 The OpenSSL Project Authors. All Rights Reserved.
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- *
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- * Licensed under the Apache License 2.0 (the "License"). You may not use
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- * this file except in compliance with the License. You can obtain a copy
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-diff --git a/include/openssl/dh.h b/include/openssl/dh.h
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-index 8bc17448a0817..f1c0ed06b375a 100644
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>---- ./include/openssl/dh.h
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+++ ./include/openssl/dh.h
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-@@ -144,7 +144,7 @@ DECLARE_ASN1_ITEM(DHparams)
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- # define DH_GENERATOR_3 3
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- # define DH_GENERATOR_5 5
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>--/* DH_check error codes */
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+/* DH_check error codes, some of them shared with DH_check_pub_key */
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- /*
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- * NB: These values must align with the equivalently named macros in
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- * internal/ffc.h.
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-@@ -154,10 +154,10 @@ DECLARE_ASN1_ITEM(DHparams)
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- # define DH_UNABLE_TO_CHECK_GENERATOR 0x04
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- # define DH_NOT_SUITABLE_GENERATOR 0x08
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- # define DH_CHECK_Q_NOT_PRIME 0x10
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>--# define DH_CHECK_INVALID_Q_VALUE 0x20
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+# define DH_CHECK_INVALID_Q_VALUE 0x20 /* +DH_check_pub_key */
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- # define DH_CHECK_INVALID_J_VALUE 0x40
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- # define DH_MODULUS_TOO_SMALL 0x80
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>--# define DH_MODULUS_TOO_LARGE 0x100
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+# define DH_MODULUS_TOO_LARGE 0x100 /* +DH_check_pub_key */
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- /* DH_check_pub_key error codes */
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- # define DH_CHECK_PUBKEY_TOO_SMALL 0x01
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-diff --git a/include/openssl/dherr.h b/include/openssl/dherr.h
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-index 5d2a762a96f8c..074a70145f9f5 100644
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>---- ./include/openssl/dherr.h
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+++ ./include/openssl/dherr.h
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-@@ -1,6 +1,6 @@
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- /*
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- * Generated by util/mkerr.pl DO NOT EDIT
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-- * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+ * Copyright 1995-2023 The OpenSSL Project Authors. All Rights Reserved.
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- *
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- * Licensed under the Apache License 2.0 (the "License"). You may not use
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- * this file except in compliance with the License. You can obtain a copy
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-@@ -50,6 +50,7 @@
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- # define DH_R_NO_PRIVATE_VALUE 100
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- # define DH_R_PARAMETER_ENCODING_ERROR 105
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- # define DH_R_PEER_KEY_ERROR 111
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-+# define DH_R_Q_TOO_LARGE 130
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- # define DH_R_SHARED_INFO_ERROR 113
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- # define DH_R_UNABLE_TO_CHECK_GENERATOR 121
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>-
</span></pre><pre style='margin:0'>
</pre>