From 11c186b4b2b4b4256641cc35709c3c9f8c4b1381 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E9=80=86=E4=B8=96=E7=95=8C?= <13035954+reverse-world@user.noreply.gitee.com> Date: Thu, 7 Sep 2023 13:00:08 +0000 Subject: [PATCH 1/4] add Fix-FIPS-getenv-build-failure.patch. --- Fix-FIPS-getenv-build-failure.patch | 30 +++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) create mode 100644 Fix-FIPS-getenv-build-failure.patch diff --git a/Fix-FIPS-getenv-build-failure.patch b/Fix-FIPS-getenv-build-failure.patch new file mode 100644 index 0000000..df05aef --- /dev/null +++ b/Fix-FIPS-getenv-build-failure.patch @@ -0,0 +1,30 @@ +diff --git a/crypto/o_init.c b/crypto/o_init.c +index b1eef43..4fbb0e5 100644 +--- a/crypto/o_init.c ++++ b/crypto/o_init.c +@@ -7,7 +7,7 @@ + * https://www.openssl.org/source/license.html + */ + +-/* for secure_getenv */ ++/* for ossl_safe_getenv */ + #define _GNU_SOURCE + #include "e_os.h" + #include +@@ -21,6 +21,7 @@ + # include + # include + # include "crypto/fips.h" ++# include "internal/cryptlib.h" + + # define FIPS_MODE_SWITCH_FILE "/proc/sys/crypto/fips_enabled" + +@@ -29,7 +30,7 @@ static void init_fips_mode(void) + char buf[2] = "0"; + int fd; + +- if (secure_getenv("OPENSSL_FORCE_FIPS_MODE") != NULL) { ++ if (ossl_safe_getenv("OPENSSL_FORCE_FIPS_MODE") != NULL) { + buf[0] = '1'; + } else if ((fd = open(FIPS_MODE_SWITCH_FILE, O_RDONLY)) >= 0) { + while (read(fd, buf, sizeof(buf)) < 0 && errno == EINTR) ; -- Gitee From bc1d11e733a8ac22d09d8abaad642e9b6ba1c2ed Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E9=80=86=E4=B8=96=E7=95=8C?= <13035954+reverse-world@user.noreply.gitee.com> Date: Thu, 7 Sep 2023 13:02:07 +0000 Subject: [PATCH 2/4] update openssl.spec. --- openssl.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/openssl.spec b/openssl.spec index a13037d..4013f57 100644 --- a/openssl.spec +++ b/openssl.spec @@ -2,7 +2,7 @@ Name: openssl Epoch: 1 Version: 1.1.1m -Release: 22 +Release: 23 Summary: Cryptography and SSL/TLS Toolkit License: OpenSSL and SSLeay URL: https://www.openssl.org/ @@ -65,6 +65,7 @@ Patch54: backport-CVE-2023-3446-Fix-DH_check-excessive-time-with-over-sized- Patch55: backport-update-expired-certificates-for-sm2.patch Patch56: backport-CVE-2023-3817.patch Patch57: backport-CVE-2023-3817-testcase.patch +Patch58: Fix-FIPS-getenv-build-failure.patch BuildRequires: gcc perl make lksctp-tools-devel coreutils util-linux zlib-devel Requires: coreutils %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release} @@ -267,6 +268,9 @@ make test || : %ldconfig_scriptlets libs %changelog +* Thu Sep 7 2023 reverse-world - 1:1.1.1m-23 +* fix FIPS getenv compatibility problem + * Wed Aug 2 2023 liningjie - 1:1.1.1m-22 - fix CVE-2023-3817 -- Gitee From 786e4c21895147f6069be428801aa14cb93cf2f4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E9=80=86=E4=B8=96=E7=95=8C?= <13035954+reverse-world@user.noreply.gitee.com> Date: Thu, 7 Sep 2023 13:42:24 +0000 Subject: [PATCH 3/4] =?UTF-8?q?=E5=88=A0=E9=99=A4=E6=96=87=E4=BB=B6=20Fix-?= =?UTF-8?q?FIPS-getenv-build-failure.patch?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- Fix-FIPS-getenv-build-failure.patch | 30 ----------------------------- 1 file changed, 30 deletions(-) delete mode 100644 Fix-FIPS-getenv-build-failure.patch diff --git a/Fix-FIPS-getenv-build-failure.patch b/Fix-FIPS-getenv-build-failure.patch deleted file mode 100644 index df05aef..0000000 --- a/Fix-FIPS-getenv-build-failure.patch +++ /dev/null @@ -1,30 +0,0 @@ -diff --git a/crypto/o_init.c b/crypto/o_init.c -index b1eef43..4fbb0e5 100644 ---- a/crypto/o_init.c -+++ b/crypto/o_init.c -@@ -7,7 +7,7 @@ - * https://www.openssl.org/source/license.html - */ - --/* for secure_getenv */ -+/* for ossl_safe_getenv */ - #define _GNU_SOURCE - #include "e_os.h" - #include -@@ -21,6 +21,7 @@ - # include - # include - # include "crypto/fips.h" -+# include "internal/cryptlib.h" - - # define FIPS_MODE_SWITCH_FILE "/proc/sys/crypto/fips_enabled" - -@@ -29,7 +30,7 @@ static void init_fips_mode(void) - char buf[2] = "0"; - int fd; - -- if (secure_getenv("OPENSSL_FORCE_FIPS_MODE") != NULL) { -+ if (ossl_safe_getenv("OPENSSL_FORCE_FIPS_MODE") != NULL) { - buf[0] = '1'; - } else if ((fd = open(FIPS_MODE_SWITCH_FILE, O_RDONLY)) >= 0) { - while (read(fd, buf, sizeof(buf)) < 0 && errno == EINTR) ; -- Gitee From 04ec8dc909cd6f3dbcb92ce4a69c27a4c5fb1991 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E9=80=86=E4=B8=96=E7=95=8C?= <13035954+reverse-world@user.noreply.gitee.com> Date: Thu, 7 Sep 2023 13:42:38 +0000 Subject: [PATCH 4/4] update patch file format --- Fix-FIPS-getenv-build-failure.patch | 30 +++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) create mode 100644 Fix-FIPS-getenv-build-failure.patch diff --git a/Fix-FIPS-getenv-build-failure.patch b/Fix-FIPS-getenv-build-failure.patch new file mode 100644 index 0000000..fc57d2d --- /dev/null +++ b/Fix-FIPS-getenv-build-failure.patch @@ -0,0 +1,30 @@ +diff --git a/crypto/o_init.c b/crypto/o_init.c +index b1eef43..4fbb0e5 100644 +--- a/crypto/o_init.c ++++ b/crypto/o_init.c +@@ -7,7 +7,7 @@ + * https://www.openssl.org/source/license.html + */ + +-/* for secure_getenv */ ++/* for ossl_safe_getenv */ + #define _GNU_SOURCE + #include "e_os.h" + #include +@@ -21,6 +21,7 @@ + # include + # include + # include "crypto/fips.h" ++# include "internal/cryptlib.h" + + # define FIPS_MODE_SWITCH_FILE "/proc/sys/crypto/fips_enabled" + +@@ -29,7 +30,7 @@ static void init_fips_mode(void) + char buf[2] = "0"; + int fd; + +- if (secure_getenv("OPENSSL_FORCE_FIPS_MODE") != NULL) { ++ if (ossl_safe_getenv("OPENSSL_FORCE_FIPS_MODE") != NULL) { + buf[0] = '1'; + } else if ((fd = open(FIPS_MODE_SWITCH_FILE, O_RDONLY)) >= 0) { + while (read(fd, buf, sizeof(buf)) < 0 && errno == EINTR) ; -- Gitee