Skip to content

Commit 96c76ab

Browse files
dbenoit17dbenoit17
authored
Go1.20.6 (#95)
* Update to Go 1.20.6 * fix memory leak in ecdh * fix patch whitespace
1 parent 9a86525 commit 96c76ab

File tree

3 files changed

+43
-35
lines changed

3 files changed

+43
-35
lines changed

‎config/versions.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
22
"github.com/golang-fips/go": "go1.20-fips-release",
3-
"github.com/golang-fips/openssl-fips": "e1541889d8a8ad4eaf02630a8cae303206ef68c1",
4-
"github.com/golang/go": "go1.20.5"
3+
"github.com/golang-fips/openssl-fips": "9051f24728fe7141015889776bc44949c2b4cf1e",
4+
"github.com/golang/go": "go1.20.6"
55
}

‎patches/000-initial-setup.patch‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -151,7 +151,7 @@ index 0000000000..d12ba2f441
151151
+ testHashSignAndHashVerify(t, elliptic.P521(), "p521")
152152
+}
153153
diff --git a/src/crypto/ecdsa/ecdsa_test.go b/src/crypto/ecdsa/ecdsa_test.go
154-
index 95c78c8e32..51f58b305e 100644
154+
index 08a0903eb1..61a4662036 100644
155155
--- a/src/crypto/ecdsa/ecdsa_test.go
156156
+++ b/src/crypto/ecdsa/ecdsa_test.go
157157
@@ -9,6 +9,8 @@ import (
@@ -160,10 +160,10 @@ index 95c78c8e32..51f58b305e 100644
160160
"crypto/elliptic"
161161
+ "crypto/internal/backend/boringtest"
162162
+ "crypto/internal/boring"
163+
"crypto/internal/bigmod"
163164
"crypto/rand"
164165
"crypto/sha1"
165-
"crypto/sha256"
166-
@@ -35,8 +37,17 @@ func testAllCurves(t *testing.T, f func(*testing.T, elliptic.Curve)) {
166+
@@ -36,8 +38,17 @@ func testAllCurves(t *testing.T, f func(*testing.T, elliptic.Curve)) {
167167
}
168168
if testing.Short() {
169169
tests = tests[:1]
@@ -181,7 +181,7 @@ index 95c78c8e32..51f58b305e 100644
181181
curve := test.curve
182182
t.Run(test.name, func(t *testing.T) {
183183
t.Parallel()
184-
@@ -234,7 +245,11 @@ func TestVectors(t *testing.T) {
184+
@@ -235,7 +246,11 @@ func TestVectors(t *testing.T) {
185185

186186
switch curve {
187187
case "P-224":
@@ -854,10 +854,10 @@ index cf03e3cb7e..1226149321 100644
854854
}
855855

856856
diff --git a/src/crypto/rsa/rsa.go b/src/crypto/rsa/rsa.go
857-
index 11f87e8e49..bdd6d85c69 100644
857+
index 63bc8dad1a..ab56ccd1ed 100644
858858
--- a/src/crypto/rsa/rsa.go
859859
+++ b/src/crypto/rsa/rsa.go
860-
@@ -508,7 +508,7 @@ func EncryptOAEP(hash hash.Hash, random io.Reader, pub *PublicKey, msg []byte, l
860+
@@ -509,7 +509,7 @@ func EncryptOAEP(hash hash.Hash, random io.Reader, pub *PublicKey, msg []byte, l
861861
if err != nil {
862862
return nil, err
863863
}
@@ -866,7 +866,7 @@ index 11f87e8e49..bdd6d85c69 100644
866866
}
867867
boring.UnreachableExceptTests()
868868

869-
@@ -679,7 +679,7 @@ func decryptOAEP(hash, mgfHash hash.Hash, random io.Reader, priv *PrivateKey, ci
869+
@@ -680,7 +680,7 @@ func decryptOAEP(hash, mgfHash hash.Hash, random io.Reader, priv *PrivateKey, ci
870870
if err != nil {
871871
return nil, err
872872
}
@@ -876,7 +876,7 @@ index 11f87e8e49..bdd6d85c69 100644
876876
return nil, ErrDecryption
877877
}
878878
diff --git a/src/crypto/rsa/rsa_test.go b/src/crypto/rsa/rsa_test.go
879-
index 3278a7ff30..e4484540c1 100644
879+
index 3278a7ff30..b994daec19 100644
880880
--- a/src/crypto/rsa/rsa_test.go
881881
+++ b/src/crypto/rsa/rsa_test.go
882882
@@ -23,6 +23,8 @@ import (
@@ -1300,10 +1300,10 @@ index 63d86b9f3a..a8ee915041 100644
13001300
} else {
13011301
hello.cipherSuites = append(hello.cipherSuites, defaultCipherSuitesTLS13NoAES...)
13021302
diff --git a/src/crypto/tls/handshake_client_test.go b/src/crypto/tls/handshake_client_test.go
1303-
index 749c9fc954..2e37a1867c 100644
1303+
index 22be38faff..d460eeb880 100644
13041304
--- a/src/crypto/tls/handshake_client_test.go
13051305
+++ b/src/crypto/tls/handshake_client_test.go
1306-
@@ -2135,6 +2135,7 @@ func testBuffering(t *testing.T, version uint16) {
1306+
@@ -2156,6 +2156,7 @@ func testBuffering(t *testing.T, version uint16) {
13071307
}
13081308

13091309
func TestAlertFlushing(t *testing.T) {
@@ -1312,7 +1312,7 @@ index 749c9fc954..2e37a1867c 100644
13121312
done := make(chan bool)
13131313

13141314
diff --git a/src/crypto/tls/handshake_client_tls13.go b/src/crypto/tls/handshake_client_tls13.go
1315-
index fefba01a06..fa6989e619 100644
1315+
index 4a8661085e..87fe11de5c 100644
13161316
--- a/src/crypto/tls/handshake_client_tls13.go
13171317
+++ b/src/crypto/tls/handshake_client_tls13.go
13181318
@@ -41,10 +41,6 @@ type clientHandshakeStateTLS13 struct {

‎patches/001-initial-openssl-for-fips.patch‎

Lines changed: 30 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -255,7 +255,7 @@ index 275c60b4de..58f0034b18 100644
255255
"math/big"
256256
)
257257
diff --git a/src/crypto/ecdsa/ecdsa.go b/src/crypto/ecdsa/ecdsa.go
258-
index 68272af41f..b1eea00bef 100644
258+
index 03a9a72ddd..4bf497f9cc 100644
259259
--- a/src/crypto/ecdsa/ecdsa.go
260260
+++ b/src/crypto/ecdsa/ecdsa.go
261261
@@ -27,8 +27,8 @@ import (
@@ -350,7 +350,7 @@ index d12ba2f441..6334a56496 100644
350350
}
351351
testHashSignAndHashVerify(t, elliptic.P384(), "p384")
352352
diff --git a/src/crypto/ecdsa/ecdsa_test.go b/src/crypto/ecdsa/ecdsa_test.go
353-
index 51f58b305e..967e8ff7fb 100644
353+
index 61a4662036..80e484842b 100644
354354
--- a/src/crypto/ecdsa/ecdsa_test.go
355355
+++ b/src/crypto/ecdsa/ecdsa_test.go
356356
@@ -10,7 +10,7 @@ import (
@@ -359,10 +359,10 @@ index 51f58b305e..967e8ff7fb 100644
359359
"crypto/internal/backend/boringtest"
360360
- "crypto/internal/boring"
361361
+ boring "crypto/internal/backend"
362+
"crypto/internal/bigmod"
362363
"crypto/rand"
363364
"crypto/sha1"
364-
"crypto/sha256"
365-
@@ -37,7 +37,7 @@ func testAllCurves(t *testing.T, f func(*testing.T, elliptic.Curve)) {
365+
@@ -38,7 +38,7 @@ func testAllCurves(t *testing.T, f func(*testing.T, elliptic.Curve)) {
366366
}
367367
if testing.Short() {
368368
tests = tests[:1]
@@ -371,7 +371,7 @@ index 51f58b305e..967e8ff7fb 100644
371371
p224 := struct {
372372
name string
373373
curve elliptic.Curve
374-
@@ -45,7 +45,7 @@ func testAllCurves(t *testing.T, f func(*testing.T, elliptic.Curve)) {
374+
@@ -46,7 +46,7 @@ func testAllCurves(t *testing.T, f func(*testing.T, elliptic.Curve)) {
375375
tests = append(tests, p224)
376376
}
377377
for _, test := range tests {
@@ -380,7 +380,7 @@ index 51f58b305e..967e8ff7fb 100644
380380
t.Skip("unsupported test in FIPS mode")
381381
}
382382
curve := test.curve
383-
@@ -245,7 +245,7 @@ func TestVectors(t *testing.T) {
383+
@@ -246,7 +246,7 @@ func TestVectors(t *testing.T) {
384384

385385
switch curve {
386386
case "P-224":
@@ -2348,24 +2348,24 @@ index 8734dd03c1..22a104f338 100644
23482348
} else {
23492349
testCurve = elliptic.P384()
23502350
diff --git a/src/go.mod b/src/go.mod
2351-
index 4697da201c..0a5e32e27a 100644
2351+
index 4697da201c..a3891edd78 100644
23522352
--- a/src/go.mod
23532353
+++ b/src/go.mod
23542354
@@ -3,6 +3,7 @@ module std
23552355
go 1.20
23562356

23572357
require (
2358-
+ github.com/golang-fips/openssl-fips v0.0.0-20230323210700-e1541889d8a8
2358+
+ github.com/golang-fips/openssl-fips v0.0.0-20230714114059-9051f24728fe
23592359
golang.org/x/crypto v0.3.1-0.20221117191849-2c476679df9a
23602360
golang.org/x/net v0.4.1-0.20230214201333-88ed8ca3307d
23612361
)
23622362
diff --git a/src/go.sum b/src/go.sum
2363-
index 625f2070b3..fb6828ce41 100644
2363+
index 625f2070b3..2e984ad481 100644
23642364
--- a/src/go.sum
23652365
+++ b/src/go.sum
23662366
@@ -1,3 +1,5 @@
2367-
+github.com/golang-fips/openssl-fips v0.0.0-20230323210700-e1541889d8a8 h1:nY4kLp8xhBuVWF5mqsluydyZnJzW2FELBC+A4EEtu1o=
2368-
+github.com/golang-fips/openssl-fips v0.0.0-20230323210700-e1541889d8a8/go.mod h1:V2IU8imz/VkScnIbTOrdYsZ5R88ZFypCE0LzhRJ3HsI=
2367+
+github.com/golang-fips/openssl-fips v0.0.0-20230714114059-9051f24728fe h1:Zr44HT3VYwYIkT72fyvaqWZN+sO2Saw++e+6PaXapN0=
2368+
+github.com/golang-fips/openssl-fips v0.0.0-20230714114059-9051f24728fe/go.mod h1:V2IU8imz/VkScnIbTOrdYsZ5R88ZFypCE0LzhRJ3HsI=
23692369
golang.org/x/crypto v0.3.1-0.20221117191849-2c476679df9a h1:diz9pEYuTIuLMJLs3rGDkeaTsNyRs6duYdFyPAxzE/U=
23702370
golang.org/x/crypto v0.3.1-0.20221117191849-2c476679df9a/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
23712371
golang.org/x/net v0.4.1-0.20230214201333-88ed8ca3307d h1:KHU/KRz6+/yWyRHEC24m7T5gou5VSh62duch955ktBY=
@@ -5631,10 +5631,10 @@ index 0000000000..df4ebe3297
56315631
+}
56325632
diff --git a/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_ecdh.c b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_ecdh.c
56335633
new file mode 100644
5634-
index 0000000000..abdee81a91
5634+
index 0000000000..8205b040c5
56355635
--- /dev/null
56365636
+++ b/src/vendor/github.com/golang-fips/openssl-fips/openssl/openssl_port_ecdh.c
5637-
@@ -0,0 +1,334 @@
5637+
@@ -0,0 +1,342 @@
56385638
+// +build linux
56395639
+// +build !android
56405640
+// +build !no_openssl
@@ -5676,6 +5676,8 @@ index 0000000000..abdee81a91
56765676
+ return 0;
56775677
+
56785678
+ *result = malloc(len);
5679+
+ if (!*result)
5680+
+ return 0;
56795681
+
56805682
+ len = _goboringcrypto_EC_POINT_point2oct(group, point,
56815683
+ GO_POINT_CONVERSION_UNCOMPRESSED,
@@ -5760,14 +5762,18 @@ index 0000000000..abdee81a91
57605762
+ if (!priv)
57615763
+ goto err;
57625764
+
5763-
+ if (!_goboringcrypto_internal_OSSL_PARAM_BLD_push_BN(bld, "priv", priv))
5765+
+ if (!_goboringcrypto_internal_OSSL_PARAM_BLD_push_BN(bld, "priv", priv)) {
5766+
+ _goboringcrypto_BN_clear_free(priv);
57645767
+ goto err;
5768+
+ }
57655769
+
57665770
+ params = _goboringcrypto_internal_OSSL_PARAM_BLD_to_param(bld);
5767-
+ _goboringcrypto_BN_free(priv);
5768-
+ if (!params)
5771+
+ if (!params) {
5772+
+ _goboringcrypto_BN_clear_free(priv);
57695773
+ goto err;
5774+
+ }
57705775
+
5776+
+ _goboringcrypto_BN_clear_free(priv);
57715777
+ selection = GO_EVP_PKEY_KEYPAIR;
57725778
+ } else {
57735779
+ if (!_goboringcrypto_internal_OSSL_PARAM_BLD_push_octet_string(bld, "pub", bytes, len))
@@ -5797,7 +5803,7 @@ index 0000000000..abdee81a91
57975803
+ return result;
57985804
+}
57995805
+
5800-
+DEFINEFUNCINTERNAL(void, OPENSSL_free, (void *addr), (addr))
5806+
+DEFINEFUNCINTERNAL(void, CRYPTO_free, (void *addr, const char *file, int line), (addr, file, line))
58015807
+
58025808
+size_t
58035809
+_goboringcrypto_EVP_PKEY_get1_encoded_ecdh_public_key(GO_EVP_PKEY *pkey,
@@ -5812,10 +5818,11 @@ index 0000000000..abdee81a91
58125818
+
58135819
+ *result = malloc(len);
58145820
+ if (!*result) {
5815-
+ _goboringcrypto_internal_OPENSSL_free(res);
5821+
+ _goboringcrypto_internal_CRYPTO_free(res, __FILE__, __LINE__);
58165822
+ return 0;
58175823
+ }
58185824
+ memcpy(*result, res, len);
5825+
+ _goboringcrypto_internal_CRYPTO_free(res, __FILE__, __LINE__);
58195826
+ return len;
58205827
+}
58215828
+
@@ -5852,6 +5859,7 @@ index 0000000000..abdee81a91
58525859
+err:
58535860
+ _goboringcrypto_EC_GROUP_free(group);
58545861
+ _goboringcrypto_EC_POINT_free(point);
5862+
+ _goboringcrypto_BN_free(priv);
58555863
+ free(pub);
58565864
+ return result;
58575865
+}
@@ -5875,10 +5883,10 @@ index 0000000000..abdee81a91
58755883
+ if (!priv)
58765884
+ goto err;
58775885
+ if (_goboringcrypto_EC_KEY_set_private_key(key, priv) != 1) {
5878-
+ _goboringcrypto_BN_free(priv);
5886+
+ _goboringcrypto_BN_clear_free(priv);
58795887
+ goto err;
58805888
+ }
5881-
+ _goboringcrypto_BN_free(priv);
5889+
+ _goboringcrypto_BN_clear_free(priv);
58825890
+ } else {
58835891
+ const EC_GROUP *group = _goboringcrypto_EC_KEY_get0_group(key);
58845892
+ EC_POINT *pub;
@@ -7144,11 +7152,11 @@ index cf82f3f64f..0b55cedc91 100644
71447152

71457153
type sha512Ctx struct {
71467154
diff --git a/src/vendor/modules.txt b/src/vendor/modules.txt
7147-
index 89a7c86c41..d3e88755be 100644
7155+
index 89a7c86c41..f4f12ecee2 100644
71487156
--- a/src/vendor/modules.txt
71497157
+++ b/src/vendor/modules.txt
71507158
@@ -1,3 +1,6 @@
7151-
+# github.com/golang-fips/openssl-fips v0.0.0-20230323210700-e1541889d8a8
7159+
+# github.com/golang-fips/openssl-fips v0.0.0-20230714114059-9051f24728fe
71527160
+## explicit; go 1.18
71537161
+github.com/golang-fips/openssl-fips/openssl
71547162
# golang.org/x/crypto v0.3.1-0.20221117191849-2c476679df9a

0 commit comments

Comments
 (0)