Mailing-List: contact dev-help@tomcat.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Tomcat Developers List" <dev@tomcat.apache.org>
Received-SPF: pass (athena.apache.org: local policy includes SPF record at
 spf.trusted-forwarder.org)
Message-ID: <534ED0D9.9020007@christopherschultz.net>
Date: Wed, 16 Apr 2014 14:50:01 -0400
From: Christopher Schultz <chris@christopherschultz.net>
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9;
 rv:24.0) Gecko/20100101 Thunderbird/24.4.0
MIME-Version: 1.0
To: Tomcat Developers List <dev@tomcat.apache.org>
Subject: Re: svn commit: r1587896 - in /tomcat/native/branches/1.1.x:
 native/src/ssl.c
 xdocs/miscellaneous/changelog.xml
References: <20140416125217.13037238889B@eris.apache.org>
In-Reply-To: <20140416125217.13037238889B@eris.apache.org>
Content-Type: multipart/signed; micalg=pgp-sha256;
 protocol="application/pgp-signature";
 boundary="tXm3C3368NGpgF09LwidbdNgPPcIRJoWr"

--tXm3C3368NGpgF09LwidbdNgPPcIRJoWr
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Mladen,

On 4/16/14, 8:52 AM, mturk@apache.org wrote:
> Author: mturk
> Date: Wed Apr 16 12:52:16 2014
> New Revision: 1587896
>=20
> URL: http://svn.apache.org/r1587896
> Log:
> Fix Bz56396. Be tolerant on RSA keys < 1024 bits
>=20
> Modified:
>     tomcat/native/branches/1.1.x/native/src/ssl.c
>     tomcat/native/branches/1.1.x/xdocs/miscellaneous/changelog.xml
>=20
> Modified: tomcat/native/branches/1.1.x/native/src/ssl.c
> URL: http://svn.apache.org/viewvc/tomcat/native/branches/1.1.x/native/s=
rc/ssl.c?rev=3D1587896&r1=3D1587895&r2=3D1587896&view=3Ddiff
> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D
> --- tomcat/native/branches/1.1.x/native/src/ssl.c (original)
> +++ tomcat/native/branches/1.1.x/native/src/ssl.c Wed Apr 16 12:52:16 2=
014
> @@ -221,6 +221,14 @@ static const jint supported_ssl_opts =3D 0
> =20
>  static int ssl_tmp_key_init_rsa(int bits, int idx)
>  {
> +#ifdef OPENSSL_FIPS
> +    /**
> +     * With FIPS mode short RSA keys cannot be
> +     * generated.
> +     */
> +    if (bits < 1024)
> +        return 0;
> +#endif

Why not fix this by removing the actual call to
ssl_tmp_key_init_rsa(512) instead of modifying the behavior of the functi=
on?

-chris


--tXm3C3368NGpgF09LwidbdNgPPcIRJoWr
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQIcBAEBCAAGBQJTTtDZAAoJEBzwKT+lPKRYLdUP+weMOkyilSCNSRFd21Eir25F
GhuwG1Fu9WV8j3IlockzOKQaF3Hi8jGAZyndUWN7Z+LoHbEnjYyW4zk9/uXY6Sbx
tOLVSHbNoAunsV7KtIWBCQLkC2//A8LbySbp0x6AQ3Gl3iyMXwkK/woOopnxszxf
RXZjpI+l5gtnMNjl9TCb6ixMNAYQaSCqGmgdyt8cdvDaASCKrKuJH6t4MSTqYSib
bqqXY2nRjnob6WtWRj3J+chFixTVxou/Tsd1p8xINywBASkZDk0YK18XaRCE2oVf
EcIuSx5TG61iUuMgyKcYOAO1ZDpG3saVfEeN2bKb51XGZ4oajU3D+XCiGDv807sV
nxZaQhASooDj+5+wFzplNxneda5vxdf61WO9+2htCZvf8I5+mIC8wbyPD4Q0q/+a
zE1YDBZ6hS2DPhIZZrCpg8p0gDTv48/80TwIt3CeFI5l0XX4Ohjz68FNu6SnauHP
knT/+j58Yuvtae+j1G9bk+pT58DaCFcj/t53eHSJ6FXbtmVQUBA2MZogtdWaxbn5
Ss4tra/78COPFAYSrfPApqflC9Fpslbt5fpxjrOhBWZ2LKJzQWDkACKZjgVuGmRg
7Q0Cpr6A7tcdebr4hQHaLrZX081etljCb/QEX2hxVfePOdQWFJ2HYhVbO4wx7xRp
WSe4O4yeuFwYvkUCFApR
=5Kc7
-----END PGP SIGNATURE-----

--tXm3C3368NGpgF09LwidbdNgPPcIRJoWr--