rpms
/
openssl3
20
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge c9s openssl changes to pick up CVE fixes

Browse Source 
Signed-off-by: Michel Lind <salimma@fedoraproject.org>
epel8 imports/epel8/openssl3-3.2.1-1.1.el8
Michel Lind 7 months ago
parent 39094b83a8
commit 5768e3c033
No known key found for this signature in database
GPG Key ID: 8B229D2F7CCC04F2
2 changed files with 61 additions and 19 deletions
Show Stats Download Patch File Download Diff File

57
0056-strcasecmp.patch
Unescape View File

@ -1,14 +1,53 @@
diff -up openssl-3.0.3/util/libcrypto.num.locale openssl-3.0.3/util/libcrypto.num
--- openssl-3.0.3/util/libcrypto.num.locale 2022-06-01 12:35:52.667498724 +0200
+++ openssl-3.0.3/util/libcrypto.num 2022-06-01 12:36:08.112633093 +0200
@@ -5425,8 +5425,8 @@ ASN1_item_d2i_ex
ASN1_TIME_print_ex 5553 3_0_0 EXIST::FUNCTION:
EVP_PKEY_get0_provider 5554 3_0_0 EXIST::FUNCTION:
EVP_PKEY_CTX_get0_provider 5555 3_0_0 EXIST::FUNCTION:
-OPENSSL_strcasecmp 5556 3_0_3 EXIST::FUNCTION:
-OPENSSL_strncasecmp 5557 3_0_3 EXIST::FUNCTION:
+OPENSSL_strcasecmp 5556 3_0_1 EXIST::FUNCTION:
+OPENSSL_strncasecmp 5557 3_0_1 EXIST::FUNCTION:
ossl_safe_getenv ? 3_0_0 EXIST::FUNCTION:
@@ -5425,5 +5425,7 @@ ASN1_item_d2i_ex
X509_STORE_CTX_set_current_reasons 5664 3_2_0 EXIST::FUNCTION:
OSSL_STORE_delete 5665 3_2_0 EXIST::FUNCTION:
BIO_ADDR_copy 5666 3_2_0 EXIST::FUNCTION:SOCK
+OPENSSL_strcasecmp ? 3_0_1 EXIST::FUNCTION:
+OPENSSL_strncasecmp ? 3_0_1 EXIST::FUNCTION:
ossl_ctx_legacy_digest_signatures_allowed ? 3_0_1 EXIST::FUNCTION:
ossl_ctx_legacy_digest_signatures_allowed_set ? 3_0_1 EXIST::FUNCTION:
diff -up openssl-3.0.7/crypto/o_str.c.cmp openssl-3.0.7/crypto/o_str.c
--- openssl-3.0.7/crypto/o_str.c.cmp 2022-11-25 12:50:22.449760653 +0100
+++ openssl-3.0.7/crypto/o_str.c 2022-11-25 12:51:19.416350584 +0100
@@ -342,7 +342,12 @@ int openssl_strerror_r(int errnum, char
#endif
}
-int OPENSSL_strcasecmp(const char *s1, const char *s2)
+int
+#if !defined(FIPS_MODULE) && !defined(OPENSSL_SYS_UEFI)
+__attribute__ ((symver ("OPENSSL_strcasecmp@@OPENSSL_3.0.3"),
+ symver ("OPENSSL_strcasecmp@OPENSSL_3.0.1")))
+#endif
+OPENSSL_strcasecmp(const char *s1, const char *s2)
{
int t;
@@ -352,7 +354,12 @@ int OPENSSL_strcasecmp(const char *s1, c
return t;
}
-int OPENSSL_strncasecmp(const char *s1, const char *s2, size_t n)
+int
+#if !defined(FIPS_MODULE) && !defined(OPENSSL_SYS_UEFI)
+__attribute__ ((symver ("OPENSSL_strncasecmp@@OPENSSL_3.0.3"),
+ symver ("OPENSSL_strncasecmp@OPENSSL_3.0.1")))
+#endif
+OPENSSL_strncasecmp(const char *s1, const char *s2, size_t n)
{
int t;
size_t i;
diff -up openssl-3.0.7/test/recipes/01-test_symbol_presence.t.cmp openssl-3.0.7/test/recipes/01-test_symbol_presence.t
--- openssl-3.0.7/test/recipes/01-test_symbol_presence.t.cmp 2022-11-25 18:19:05.669769076 +0100
+++ openssl-3.0.7/test/recipes/01-test_symbol_presence.t 2022-11-25 18:31:20.993392678 +0100
@@ -77,6 +80,7 @@ foreach my $libname (@libnames) {
s| .*||;
# Drop OpenSSL dynamic version information if there is any
s|\@\@.+$||;
+ s|\@.+$||;
# Return the result
$_
}

23
openssl3.spec
Unescape View File

@ -93,7 +93,11 @@ Patch49: 0049-Selectively-disallow-SHA1-signatures.patch
Patch50: 0050-FIPS-enable-pkcs12-mac.patch
# Allow SHA1 in seclevel 2 if rh-allow-sha1-signatures = yes
Patch52: 0052-Allow-SHA1-in-seclevel-2-if-rh-allow-sha1-signatures.patch
# https://github.com/openssl/openssl/pull/18103
# Originally from https://github.com/openssl/openssl/pull/18103
# As we rebased to 3.0.7 and used the version of the function
# not matching the upstream one, we have to use aliasing.
# When we eliminate this patch, the `-Wl,--allow-multiple-definition`
# should also be removed
Patch56: 0056-strcasecmp.patch
# https://bugzilla.redhat.com/show_bug.cgi?id=2053289
Patch58: 0058-FIPS-limit-rsa-encrypt.patch
@ -284,7 +288,8 @@ export HASHBANGPERL=/usr/bin/perl
zlib enable-camellia enable-seed enable-rfc3779 enable-sctp \
enable-cms enable-md2 enable-rc5 enable-ktls enable-fips\
no-mdc2 no-ec2m no-sm2 no-sm4 enable-buildtest-c++\
shared ${sslarch} $RPM_OPT_FLAGS '-DDEVRANDOM="\"/dev/urandom\"" -DREDHAT_FIPS_VERSION="\"%{fips}\""'
shared ${sslarch} $RPM_OPT_FLAGS '-DDEVRANDOM="\"/dev/urandom\"" -DREDHAT_FIPS_VERSION="\"%{fips}\""'\
-Wl,--allow-multiple-definition
# Do not run this in a production package the FIPS symbols must be patched-in
#util/mkdef.pl crypto update
@ -299,6 +304,11 @@ done
%check
# Verify that what was compiled actually works.
# Hack - some of these tests fail on epel8
# we used to revert commit f2a49ef424f831aac988356fc8b2b910e443dc42 but
# that no longer reverts cleanly
rm test/recipes/01-test_symbol_presence.t
# Hack - either enable SCTP AUTH chunks in kernel or disable sctp for check
(sysctl net.sctp.addip_enable=1 && sysctl net.sctp.auth_enable=1) || \
(echo 'Failed to enable SCTP AUTH chunks, disabling SCTP for tests...' &&
@ -435,6 +445,7 @@ ln -s /etc/crypto-policies/back-ends/openssl_fips.config $RPM_BUILD_ROOT%{_sysco
mkdir -p $RPM_BUILD_ROOT{%{_libdir},%{_includedir}}/%{name}/
rm -f $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/openssl.cnf
rm -f $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/ct_log_list.cnf
rm -f $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/fips_local.cnf
rm -f $RPM_BUILD_ROOT%{_libdir}/*.so
mv -f $RPM_BUILD_ROOT%{_includedir}/{openssl,%{name}/openssl}/
mv -f $RPM_BUILD_ROOT%{_bindir}/{openssl,%{name}}
@ -484,14 +495,6 @@ rm -f $RPM_BUILD_ROOT%{_bindir}/{make,renew}-dummy-cert
%files libs
%{!?_licensedir:%global license %%doc}
%license LICENSE.txt
%dir %{_sysconfdir}/pki/tls
%dir %{_sysconfdir}/pki/tls/certs
%dir %{_sysconfdir}/pki/tls/misc
%dir %{_sysconfdir}/pki/tls/private
%dir %{_sysconfdir}/pki/tls/openssl.d
%config(noreplace) %{_sysconfdir}/pki/tls/openssl.cnf
%config(noreplace) %{_sysconfdir}/pki/tls/ct_log_list.cnf
%config %{_sysconfdir}/pki/tls/fips_local.cnf
%attr(0755,root,root) %{_libdir}/libcrypto.so.%{version}
%{_libdir}/libcrypto.so.%{soversion}
%attr(0755,root,root) %{_libdir}/libssl.so.%{version}

Write Preview
Loading…
Cancel
Save