From c2463c330b62f81868cad375cdecfff0c89daf45 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E9=80=86=E4=B8=96=E7=95=8C?= <13035954+reverse-world@user.noreply.gitee.com> Date: Thu, 7 Sep 2023 12:54:50 +0000 Subject: [PATCH 1/5] update openssl.spec. --- openssl.spec | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/openssl.spec b/openssl.spec index ebfffe0..91bce0d 100644 --- a/openssl.spec +++ b/openssl.spec @@ -133,6 +133,7 @@ Patch122: backport-CVE-2023-3446-Fix-DH_check-excessive-time-with-over-sized- Patch123: backport-update-expired-certificates-for-sm2.patch Patch124: backport-CVE-2023-3817.patch Patch125: backport-CVE-2023-3817-testcase.patch +Patch126: Fix-FIPS-getenv-problem.patch BuildRequires: gcc perl make lksctp-tools-devel coreutils util-linux zlib-devel Requires: coreutils %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release} @@ -335,6 +336,9 @@ make test || : %ldconfig_scriptlets libs %changelog +* Thu Sep 7 2023 reverse-world - 1:1.1.1m-26 +* fix FIPS getenv compatibility problem + * Wed Aug 2 2023 liningjie - 1:1.1.1m-25 * fix CVE-2023-3817 -- Gitee From 5ede237791d94042550fcf3b96ea3658a91162f2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E9=80=86=E4=B8=96=E7=95=8C?= <13035954+reverse-world@user.noreply.gitee.com> Date: Thu, 7 Sep 2023 12:57:25 +0000 Subject: [PATCH 2/5] update openssl.spec. --- openssl.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/openssl.spec b/openssl.spec index 91bce0d..359f975 100644 --- a/openssl.spec +++ b/openssl.spec @@ -2,7 +2,7 @@ Name: openssl Epoch: 1 Version: 1.1.1m -Release: 25 +Release: 26 Summary: Cryptography and SSL/TLS Toolkit License: OpenSSL and SSLeay URL: https://www.openssl.org/ @@ -133,7 +133,7 @@ Patch122: backport-CVE-2023-3446-Fix-DH_check-excessive-time-with-over-sized- Patch123: backport-update-expired-certificates-for-sm2.patch Patch124: backport-CVE-2023-3817.patch Patch125: backport-CVE-2023-3817-testcase.patch -Patch126: Fix-FIPS-getenv-problem.patch +Patch126: Fix-FIPS-getenv-build-failure.patch BuildRequires: gcc perl make lksctp-tools-devel coreutils util-linux zlib-devel Requires: coreutils %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release} -- Gitee From e20f571145b4e0aba9645b0c26bf6428ea43c0aa Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E9=80=86=E4=B8=96=E7=95=8C?= <13035954+reverse-world@user.noreply.gitee.com> Date: Thu, 7 Sep 2023 12:58:43 +0000 Subject: [PATCH 3/5] add Fix-FIPS-getenv-build-failure.patch. --- Fix-FIPS-getenv-build-failure.patch | 30 +++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) create mode 100644 Fix-FIPS-getenv-build-failure.patch diff --git a/Fix-FIPS-getenv-build-failure.patch b/Fix-FIPS-getenv-build-failure.patch new file mode 100644 index 0000000..df05aef --- /dev/null +++ b/Fix-FIPS-getenv-build-failure.patch @@ -0,0 +1,30 @@ +diff --git a/crypto/o_init.c b/crypto/o_init.c +index b1eef43..4fbb0e5 100644 +--- a/crypto/o_init.c ++++ b/crypto/o_init.c +@@ -7,7 +7,7 @@ + * https://www.openssl.org/source/license.html + */ + +-/* for secure_getenv */ ++/* for ossl_safe_getenv */ + #define _GNU_SOURCE + #include "e_os.h" + #include +@@ -21,6 +21,7 @@ + # include + # include + # include "crypto/fips.h" ++# include "internal/cryptlib.h" + + # define FIPS_MODE_SWITCH_FILE "/proc/sys/crypto/fips_enabled" + +@@ -29,7 +30,7 @@ static void init_fips_mode(void) + char buf[2] = "0"; + int fd; + +- if (secure_getenv("OPENSSL_FORCE_FIPS_MODE") != NULL) { ++ if (ossl_safe_getenv("OPENSSL_FORCE_FIPS_MODE") != NULL) { + buf[0] = '1'; + } else if ((fd = open(FIPS_MODE_SWITCH_FILE, O_RDONLY)) >= 0) { + while (read(fd, buf, sizeof(buf)) < 0 && errno == EINTR) ; -- Gitee From a7f8de0d58ef375daf0dd6bf3cb34284b3ffd2da Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E9=80=86=E4=B8=96=E7=95=8C?= <13035954+reverse-world@user.noreply.gitee.com> Date: Thu, 7 Sep 2023 13:41:34 +0000 Subject: [PATCH 4/5] =?UTF-8?q?=E5=88=A0=E9=99=A4=E6=96=87=E4=BB=B6=20Fix-?= =?UTF-8?q?FIPS-getenv-build-failure.patch?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- Fix-FIPS-getenv-build-failure.patch | 30 ----------------------------- 1 file changed, 30 deletions(-) delete mode 100644 Fix-FIPS-getenv-build-failure.patch diff --git a/Fix-FIPS-getenv-build-failure.patch b/Fix-FIPS-getenv-build-failure.patch deleted file mode 100644 index df05aef..0000000 --- a/Fix-FIPS-getenv-build-failure.patch +++ /dev/null @@ -1,30 +0,0 @@ -diff --git a/crypto/o_init.c b/crypto/o_init.c -index b1eef43..4fbb0e5 100644 ---- a/crypto/o_init.c -+++ b/crypto/o_init.c -@@ -7,7 +7,7 @@ - * https://www.openssl.org/source/license.html - */ - --/* for secure_getenv */ -+/* for ossl_safe_getenv */ - #define _GNU_SOURCE - #include "e_os.h" - #include -@@ -21,6 +21,7 @@ - # include - # include - # include "crypto/fips.h" -+# include "internal/cryptlib.h" - - # define FIPS_MODE_SWITCH_FILE "/proc/sys/crypto/fips_enabled" - -@@ -29,7 +30,7 @@ static void init_fips_mode(void) - char buf[2] = "0"; - int fd; - -- if (secure_getenv("OPENSSL_FORCE_FIPS_MODE") != NULL) { -+ if (ossl_safe_getenv("OPENSSL_FORCE_FIPS_MODE") != NULL) { - buf[0] = '1'; - } else if ((fd = open(FIPS_MODE_SWITCH_FILE, O_RDONLY)) >= 0) { - while (read(fd, buf, sizeof(buf)) < 0 && errno == EINTR) ; -- Gitee From 7908368bf3bcd4c22cdc85a9608ae12ed36f74f4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E9=80=86=E4=B8=96=E7=95=8C?= <13035954+reverse-world@user.noreply.gitee.com> Date: Thu, 7 Sep 2023 13:41:55 +0000 Subject: [PATCH 5/5] update patch file format --- Fix-FIPS-getenv-build-failure.patch | 30 +++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) create mode 100644 Fix-FIPS-getenv-build-failure.patch diff --git a/Fix-FIPS-getenv-build-failure.patch b/Fix-FIPS-getenv-build-failure.patch new file mode 100644 index 0000000..fc57d2d --- /dev/null +++ b/Fix-FIPS-getenv-build-failure.patch @@ -0,0 +1,30 @@ +diff --git a/crypto/o_init.c b/crypto/o_init.c +index b1eef43..4fbb0e5 100644 +--- a/crypto/o_init.c ++++ b/crypto/o_init.c +@@ -7,7 +7,7 @@ + * https://www.openssl.org/source/license.html + */ + +-/* for secure_getenv */ ++/* for ossl_safe_getenv */ + #define _GNU_SOURCE + #include "e_os.h" + #include +@@ -21,6 +21,7 @@ + # include + # include + # include "crypto/fips.h" ++# include "internal/cryptlib.h" + + # define FIPS_MODE_SWITCH_FILE "/proc/sys/crypto/fips_enabled" + +@@ -29,7 +30,7 @@ static void init_fips_mode(void) + char buf[2] = "0"; + int fd; + +- if (secure_getenv("OPENSSL_FORCE_FIPS_MODE") != NULL) { ++ if (ossl_safe_getenv("OPENSSL_FORCE_FIPS_MODE") != NULL) { + buf[0] = '1'; + } else if ((fd = open(FIPS_MODE_SWITCH_FILE, O_RDONLY)) >= 0) { + while (read(fd, buf, sizeof(buf)) < 0 && errno == EINTR) ; -- Gitee