base/SOURCES/m2crypto-0.20.2-fips.patch

diff -up M2Crypto-0.20.2/SWIG/_evp.i.fips M2Crypto-0.20.2/SWIG/_evp.i
--- M2Crypto-0.20.2/SWIG/_evp.i.fips	2010-05-19 07:06:44.029090567 +0200
+++ M2Crypto-0.20.2/SWIG/_evp.i	2010-05-19 07:06:44.049115516 +0200
@@ -250,7 +250,10 @@ PyObject *hmac_init(HMAC_CTX *ctx, PyObj
     if (m2_PyObject_AsReadBufferInt(key, &kbuf, &klen) == -1)
         return NULL;
 
-    HMAC_Init(ctx, kbuf, klen, md);
+    if (!HMAC_Init(ctx, kbuf, klen, md)) {
+        PyErr_SetString(_evp_err, "HMAC_Init failed");
+        return NULL;
+    }
     Py_INCREF(Py_None);
     return Py_None;
 }
@@ -262,7 +265,10 @@ PyObject *hmac_update(HMAC_CTX *ctx, PyO
     if (PyObject_AsReadBuffer(blob, &buf, &len) == -1)
         return NULL;
 
-    HMAC_Update(ctx, buf, len);
+    if (!HMAC_Update(ctx, buf, len)) {
+        PyErr_SetString(_evp_err, "HMAC_Update failed");
+        return NULL;
+    }
     Py_INCREF(Py_None);
     return Py_None;
 }
@@ -276,7 +282,10 @@ PyObject *hmac_final(HMAC_CTX *ctx) {
         PyErr_SetString(PyExc_MemoryError, "hmac_final");
         return NULL;
     }
-    HMAC_Final(ctx, blob, (unsigned int *)&blen);
+    if (!HMAC_Final(ctx, blob, (unsigned int *)&blen)) {
+        PyErr_SetString(_evp_err, "HMAC_Final failed");
+        return NULL;
+    }
     ret = PyString_FromStringAndSize(blob, blen);
     PyMem_Free(blob);
     return ret;
diff -up M2Crypto-0.20.2/SWIG/_rsa.i.fips M2Crypto-0.20.2/SWIG/_rsa.i
--- M2Crypto-0.20.2/SWIG/_rsa.i.fips	2010-05-19 07:06:44.030090773 +0200
+++ M2Crypto-0.20.2/SWIG/_rsa.i	2010-05-19 07:06:44.038095292 +0200
@@ -423,15 +423,17 @@ void genrsa_callback(int p, int n, void 
     Py_XDECREF(ret);
 }
 
-RSA *rsa_generate_key(int bits, unsigned long e, PyObject *pyfunc) {
+PyObject *rsa_generate_key(int bits, unsigned long e, PyObject *pyfunc) {
     RSA *rsa;
 
     Py_INCREF(pyfunc);
     rsa = RSA_generate_key(bits, e, genrsa_callback, (void *)pyfunc);
     Py_DECREF(pyfunc);
-    if (!rsa) 
+    if (!rsa) {
         PyErr_SetString(_rsa_err, ERR_reason_error_string(ERR_get_error()));
-    return rsa;
+	return NULL;
+    }
+    return SWIG_NewPointerObj((void *)rsa, SWIGTYPE_p_RSA, 0);
 }
 
 int rsa_type_check(RSA *rsa) {
diff -up M2Crypto-0.20.2/tests/test_evp.py.fips M2Crypto-0.20.2/tests/test_evp.py
--- M2Crypto-0.20.2/tests/test_evp.py.fips	2009-10-07 06:24:44.000000000 +0200
+++ M2Crypto-0.20.2/tests/test_evp.py	2010-05-19 07:06:44.039121270 +0200
@@ -97,7 +97,7 @@ class EVPTestCase(unittest.TestCase):
         """
         Testing retrieving the RSA key from the PKey instance.
         """
-        rsa = RSA.gen_key(512, 3, callback=self._gen_callback)
+        rsa = RSA.gen_key(1024, 3, callback=self._gen_callback)
         assert isinstance(rsa, RSA.RSA)
         pkey = EVP.PKey()
         pkey.assign_rsa(rsa) 
@@ -130,7 +130,7 @@ class EVPTestCase(unittest.TestCase):
         pkey = EVP.PKey()
         self.assertRaises(ValueError, pkey.get_modulus)
 
-        rsa = RSA.gen_key(512, 3, callback=self._gen_callback)
+        rsa = RSA.gen_key(1024, 3, callback=self._gen_callback)
         pkey.assign_rsa(rsa)
         mod = pkey.get_modulus()
         assert len(mod) > 0, mod
@@ -373,21 +373,21 @@ class PBKDF2TestCase(unittest.TestCase):
 
 class HMACTestCase(unittest.TestCase):
     data1=['', 'More text test vectors to stuff up EBCDIC machines :-)', \
-           h2b("e9139d1e6ee064ef8cf514fc7dc83e86")]
+           h2b("b760e92d6662d351eb3801057695ac0346295356")]
 
     data2=[h2b('0b'*16), "Hi There", \
-           h2b("9294727a3638bb1c13f48ef8158bfc9d")]
+           h2b("675b0b3a1b4ddf4e124872da6c2f632bfed957e9")]
 
     data3=['Jefe', "what do ya want for nothing?", \
-           h2b("750c783e6ab0b503eaa86e310a5db738")]
+           h2b("effcdf6ae5eb2fa2d27416d5f184df9c259a7c79")]
 
     data4=[h2b('aa'*16), h2b('dd'*50), \
-           h2b("0x56be34521d144c88dbb8c733f0e8b3f6")]
+           h2b("d730594d167e35d5956fd8003d0db3d3f46dc7bb")]
 
     data=[data1, data2, data3, data4]
 
     def test_simple(self):
-        algo = 'md5'
+        algo = 'sha1'
         for d in self.data:
             h = EVP.HMAC(d[0], algo)
             h.update(d[1])
diff -up M2Crypto-0.20.2/tests/test_rc4.py.fips M2Crypto-0.20.2/tests/test_rc4.py
--- M2Crypto-0.20.2/tests/test_rc4.py.fips	2009-10-07 06:24:39.000000000 +0200
+++ M2Crypto-0.20.2/tests/test_rc4.py	2010-05-19 07:08:10.754839354 +0200
@@ -8,12 +8,16 @@ import unittest
 from binascii import hexlify
 from M2Crypto import RC4
 
+from fips import fips_mode
+
 class RC4TestCase(unittest.TestCase):
 
     def test_vectors(self):
         """
         Test with test vectors from Wikipedia: http://en.wikipedia.org/wiki/Rc4
         """
+        if fips_mode:
+            return
         vectors = (('Key', 'Plaintext', 'BBF316E8D940AF0AD3'),
                    ('Wiki', 'pedia', '1021BF0420'),
                    ('Secret', 'Attack at dawn', '45A01F645FC35B383552544B9BF5'))
@@ -26,6 +30,8 @@ class RC4TestCase(unittest.TestCase):
         self.assertEqual(rc4.final(), '')
     
     def test_bad(self):
+        if fips_mode:
+            return
         rc4 = RC4.RC4('foo')
         self.assertNotEqual(hexlify(rc4.update('bar')).upper(), '45678')
         
diff -up M2Crypto-0.20.2/tests/test_rsa.py.fips M2Crypto-0.20.2/tests/test_rsa.py
--- M2Crypto-0.20.2/tests/test_rsa.py.fips	2009-10-07 06:26:42.000000000 +0200
+++ M2Crypto-0.20.2/tests/test_rsa.py	2010-05-19 07:06:44.039121270 +0200
@@ -8,6 +8,8 @@ import unittest
 import sha, md5, os, sys
 from M2Crypto import RSA, BIO, Rand, m2, EVP, X509
 
+from fips import fips_mode
+
 class RSATestCase(unittest.TestCase):
 
     errkey = 'tests/dsa.priv.pem'
@@ -187,9 +189,10 @@ class RSATestCase(unittest.TestCase):
         
             else:
                 import hashlib
-                algos = {'sha1': 43, 
-                         'ripemd160': 43,
-                         'md5': 47}
+                algos = {'sha1': 43}
+                if not fips_mode:
+                    algos['md5'] = 47
+                    algos['ripemd160'] = 43
         
                 if m2.OPENSSL_VERSION_NUMBER >= 0x90800F:
                     algos['sha224'] = 35
@@ -217,7 +220,7 @@ class RSATestCase(unittest.TestCase):
         """
         rsa = RSA.load_key(self.privkey)
         message = "This is the message string"
-        digest = md5.md5(message).digest() 
+        digest = 'a' * 16
         self.assertRaises(ValueError, rsa.sign, 
                           digest, 'bad_digest_method') 
     
@@ -227,7 +230,7 @@ class RSATestCase(unittest.TestCase):
         """
         rsa = RSA.load_key(self.privkey)
         message = "This is the message string"
-        digest = md5.md5(message).digest() 
+        digest = 'a' * 16
         signature = rsa.sign(digest, 'sha1')
         self.assertRaises(ValueError, rsa.verify,
                           digest, signature, 'bad_digest_method') 
diff -up M2Crypto-0.20.2/tests/test_smime.py.fips M2Crypto-0.20.2/tests/test_smime.py
--- M2Crypto-0.20.2/tests/test_smime.py.fips	2010-05-19 07:06:44.035105357 +0200
+++ M2Crypto-0.20.2/tests/test_smime.py	2010-05-19 07:06:44.040120779 +0200
@@ -219,7 +219,7 @@ class WriteLoadTestCase(unittest.TestCas
         buf = BIO.MemoryBuffer()
         assert SMIME.load_pkcs7(self.filename).write_der(buf) == 1
         s = buf.read()
-        assert len(s) in (1204, 1243), len(s)
+        assert len(s) in (1188, 1204, 1243), len(s)
         
     def test_load_pkcs7(self):
         assert SMIME.load_pkcs7(self.filename).type() == SMIME.PKCS7_SIGNED
diff -up M2Crypto-0.20.2/tests/test_ssl.py.fips M2Crypto-0.20.2/tests/test_ssl.py
--- M2Crypto-0.20.2/tests/test_ssl.py.fips	2010-05-19 07:06:44.019113781 +0200
+++ M2Crypto-0.20.2/tests/test_ssl.py	2010-05-19 07:06:44.040120779 +0200
@@ -51,7 +51,7 @@ class VerifyCB:
     def __call__(self, ok, store):
         return verify_cb_new_function(ok, store)
 
-sleepTime = float(os.getenv('M2CRYPTO_TEST_SSL_SLEEP', 0.5))
+sleepTime = float(os.getenv('M2CRYPTO_TEST_SSL_SLEEP', 1.5))
 
 def find_openssl():
     if os.name == 'nt' or sys.platform == 'cygwin':
diff -up M2Crypto-0.20.2/tests/test_x509.py.fips M2Crypto-0.20.2/tests/test_x509.py
--- M2Crypto-0.20.2/tests/test_x509.py.fips	2010-05-19 07:06:44.019113781 +0200
+++ M2Crypto-0.20.2/tests/test_x509.py	2010-05-19 07:06:44.040120779 +0200
@@ -394,7 +394,7 @@ class X509TestCase(unittest.TestCase):
         return
     
     def test_load_request_bio(self):
-        (req, _) = self.mkreq(512)
+        (req, _) = self.mkreq(1024)
 
         r1 = X509.load_request_der_string(req.as_der())
         r2 = X509.load_request_string(req.as_der(), X509.FORMAT_DER)