Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package gnutls for openSUSE:Factory checked in at 2026-11-01 22:22:46 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/gnutls (Old) and /work/SRC/openSUSE:Factory/.gnutls.new.1255 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "gnutls" Sun Nov 1 22:22:46 2026 rev:172 rq:1393860 version:3.8.13 Changes: -------- --- /work/SRC/openSUSE:Factory/gnutls/gnutls.changes 2026-08-15 22:40:45.774875250 +0200 +++ /work/SRC/openSUSE:Factory/.gnutls.new.1255/gnutls.changes 2026-11-01 22:23:27.783107775 +0100 @@ -1,0 +2,39 @@ +Tue Oct 20 15:40:00 UTC 2026 - Pedro Monreal <[email protected]> + +- FIPS: Perform RSA-PSS self-tests. (bsc#1286296) + * fips: perform RSA self-tests using RSA-PSS instead of PKCS#1 + v1.5 (ed0c45d) + * pk: use deterministic RNG for RSA-PSS in self-tests (35c56812) + +------------------------------------------------------------------- +Wed Oct 7 14:26:26 UTC 2026 - Pedro Monreal <[email protected]> + +- FIPS: Mark internal HMAC-SHA-1 when session tickets are enabled + as non approved (bsc#1284342) + * Add gnutls-FIPS-SLI-session-ticket.patch + +------------------------------------------------------------------- +Wed Oct 7 14:20:07 UTC 2026 - Pedro Monreal <[email protected]> + +- FIPS: Mark TLS 1.2 cipher suites using HMAC-SHA-1 for record + authentication as non approved (bsc#1284341) + * Add an additional GNUTLS_MAC_AEAD check to independently + evaluate the MAC algorithm + * Add gnutls-FIPS-SLI-record-MAC.patch + +------------------------------------------------------------------- +Wed Oct 7 13:48:09 UTC 2026 - Pedro Monreal <[email protected]> + +- FIPS: Mark SHA-1 in TLS v1.0 PRF as non approved (bsc#1284343) + * Add gnutls-FIPS-SLI-tls10-PRF.patch + +------------------------------------------------------------------- +Wed Oct 7 12:58:43 UTC 2026 - Pedro Monreal <[email protected]> + +- FIPS: TLS 1.3 initialized using empty input (bsc#1284344) + * TLS 1.3 key schedule was initialized using an empty input + instead of the zero-filled value specified by RFC 8446. + * secrets: pass actual zeroes in _tls13_init_secret2 (7fad16dc) + * Add gnutls-FIPS-zeros-in_tls13_init_secret2.patch + +------------------------------------------------------------------- New: ---- gnutls-FIPS-SLI-record-MAC.patch gnutls-FIPS-SLI-session-ticket.patch gnutls-FIPS-SLI-tls10-PRF.patch gnutls-FIPS-zeros-in_tls13_init_secret2.patch ----------(New B)---------- New: evaluate the MAC algorithm * Add gnutls-FIPS-SLI-record-MAC.patch New: as non approved (bsc#1284342) * Add gnutls-FIPS-SLI-session-ticket.patch New:- FIPS: Mark SHA-1 in TLS v1.0 PRF as non approved (bsc#1284343) * Add gnutls-FIPS-SLI-tls10-PRF.patch New: * secrets: pass actual zeroes in _tls13_init_secret2 (7fad16dc) * Add gnutls-FIPS-zeros-in_tls13_init_secret2.patch ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ gnutls.spec ++++++ --- /var/tmp/diff_new_pack.AiaBuG/_old 2026-11-01 22:23:29.155164621 +0100 +++ /var/tmp/diff_new_pack.AiaBuG/_new 2026-11-01 22:23:29.157164703 +0100 @@ -84,6 +84,14 @@ Patch12: gnutls-FIPS-SHA224-SHA3224-Legacy-Status.patch # PATCH-FIX-SUSE bsc#1265613 FIPS: Deprecate ECDSA siggen with less than 128-bit Patch13: gnutls-FIPS-Deprecate-ECDSA-with-less-that-128-bit.patch +# PATCH-FIX-UPSTREAM bsc#1284344 FIPS: TLS 1.3 initialized using empty input +Patch14: gnutls-FIPS-zeros-in_tls13_init_secret2.patch +# PATCH-FIX-SUSE bsc#1284343 FIPS: Mark SHA-1 in TLS v1.0 PRF as non approved +Patch15: gnutls-FIPS-SLI-tls10-PRF.patch +# PATCH-FIX-SUSE bsc#1284341 FIPS: Add an additional GNUTLS_MAC_AEAD check to independently evaluate the MAC algorithm +Patch16: gnutls-FIPS-SLI-record-MAC.patch +# PATCH-FIX-SUSE bsc#1284342 FIPS: Mark internal HMAC-SHA-1 when session tickets are enabled as non approved +Patch17: gnutls-FIPS-SLI-session-ticket.patch BuildRequires: autogen BuildRequires: automake ++++++ gnutls-FIPS-SLI-record-MAC.patch ++++++ Index: gnutls-3.8.10/lib/constate.c =================================================================== --- gnutls-3.8.10.orig/lib/constate.c +++ gnutls-3.8.10/lib/constate.c @@ -572,7 +572,14 @@ static int _gnutls_init_record_state(rec return gnutls_assert_val(ret); } - if (is_cipher_algo_allowed(params->cipher->id)) + /* The service indicator must take into account both the cipher and + * the MAC used for record authentication. AEAD cipher suites carry + * the GNUTLS_MAC_AEAD placeholder, as authentication is provided by + * the cipher itself, so the MAC check only applies to non-AEAD suites. + */ + if (is_cipher_algo_allowed(params->cipher->id) && + (params->mac->id == GNUTLS_MAC_AEAD || + is_mac_algo_approved_in_fips(params->mac->id))) _gnutls_switch_fips_state(GNUTLS_FIPS140_OP_APPROVED); else _gnutls_switch_fips_state(GNUTLS_FIPS140_OP_NOT_APPROVED); ++++++ gnutls-FIPS-SLI-session-ticket.patch ++++++ Index: gnutls-3.8.10/lib/ext/session_ticket.c =================================================================== --- gnutls-3.8.10.orig/lib/ext/session_ticket.c +++ gnutls-3.8.10/lib/ext/session_ticket.c @@ -178,6 +178,15 @@ static int digest_ticket(const gnutls_da ticket->encrypted_state_len); _gnutls_mac_deinit(&digest_hd, digest); + /* The ticket is authenticated with HMAC-SHA1 through the internal + * MAC functions, which do not update the FIPS service indicator. + * Mark the operation as not approved explicitly. Once in this state, + * the indicator cannot be switched back to approved by the + * subsequent cipher operations on the ticket. + */ + if (!is_mac_algo_approved_in_fips(TICKET_MAC_ALGO)) + _gnutls_switch_fips_state(GNUTLS_FIPS140_OP_NOT_APPROVED); + return 0; } ++++++ gnutls-FIPS-SLI-tls10-PRF.patch ++++++ Index: gnutls-3.8.10/lib/nettle/int/tls1-prf.c =================================================================== --- gnutls-3.8.10.orig/lib/nettle/int/tls1-prf.c +++ gnutls-3.8.10/lib/nettle/int/tls1-prf.c @@ -116,6 +116,12 @@ int tls10_prf(size_t secret_size, const memxor(dst, o1, length); + /* The TLS 1.0/1.1 PRF relies on HMAC-MD5 and HMAC-SHA1, and + * SHA-1 is no longer approved in FIPS 140-3. Mark this usage + * as non-approved. + */ + _gnutls_switch_fips_state(GNUTLS_FIPS140_OP_NOT_APPROVED); + return 1; } ++++++ gnutls-FIPS-zeros-in_tls13_init_secret2.patch ++++++ >From 7fad16dcd3c9e9b843527c54a86c2955dc20a802 Mon Sep 17 00:00:00 2001 From: Alexander Sosedkin <[email protected]> Date: Fri, 11 Sep 2026 16:14:22 +0200 Subject: [PATCH] secrets: pass actual zeroes in _tls13_init_secret2 https://datatracker.ietf.org/doc/html/rfc8446#section-7.1 states that key schedule should start with "0", defined as > a string of Hash.length bytes set to zero. Passing "" to gnutls_hmac_fast() is computationally equivalent, but trips a FIPS indicator because this API has a length check. A third option would've been to call _gnutls_hkdf_extract() and handle the indicator state like the other functions do, but this feels a different kind of quirky and starts hitting a different set of approved algorithm checks, so I went for a minimal change instead. Signed-off-by: Alexander Sosedkin <[email protected]> --- lib/secrets.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/lib/secrets.c b/lib/secrets.c index e6f82c2028..4555e6c173 100644 --- a/lib/secrets.c +++ b/lib/secrets.c @@ -44,7 +44,8 @@ int _tls13_init_secret(gnutls_session_t session, const uint8_t *psk, int _tls13_init_secret2(const mac_entry_st *prf, const uint8_t *psk, size_t psk_size, void *out) { - char buf[128]; + uint8_t buf[128] = { 0 }; + uint8_t salt[MAX_HASH_SIZE] = { 0 }; if (unlikely(prf == NULL)) return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR); @@ -54,12 +55,13 @@ int _tls13_init_secret2(const mac_entry_st *prf, const uint8_t *psk, psk_size = prf->output_size; if (unlikely(psk_size >= sizeof(buf))) return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR); - - memset(buf, 0, psk_size); psk = (uint8_t *)buf; } - return gnutls_hmac_fast(prf->id, "", 0, psk, psk_size, out); + /* passing an empty salt trips FIPS indicator, so pass real zeroes */ + memset(salt, 0, prf->output_size); + return gnutls_hmac_fast(prf->id, salt, prf->output_size, psk, psk_size, + out); } /* HKDF-Extract(Prev-Secret, key) */ -- GitLab
