rpms/bind
7
0
Fork 1
Code Issues Pull Requests Releases Activity

Remove erroneous OpenSSL API version check

Browse Source 
It was preventing bind from fetching the OpenSSL engine for
RSA algorithms. Fixes Sanity/utils/pkcs11-tools test.

Resolves: RHEL-213788
This commit is contained in:
Fedor Vorobev 2026-07-23 11:30:05 +02:00
parent cfa78fe2a3
commit 7e7c98adeb
2 changed files with 42 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

35
bind-9.16-remove-openssl-api-level-check-for-engine.patch Normal file
View File

@ -0,0 +1,35 @@
From 68c631cf8dc67cb315d738a55a97fff26c0818e7 Mon Sep 17 00:00:00 2001
From: Fedor Vorobev <fvorobev@redhat.com>
Date: Thu, 23 Jul 2026 10:55:42 +0200
Subject: [PATCH] Remove OPENSSL_API_LEVEL < 30000 check from an engine check.
It was added in 5f8ac682c9912aaf564595f73f777672743f56aa upstream
commit, which was a cherry pick from a newer version of bind. As this is
the only instance of OPENSSL_API_LEVEL < 30000 within bind 9.16.50, I
believe it was done in error.
This check was preventing bind from finding the OpenSSL engine for RSA
algorithms. `dnssec-keyfromlabel` would error out with 'no engine'
whenever an RSA algorithm was used.
Resolves: RHEL-213788
---
lib/dns/opensslrsa_link.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/lib/dns/opensslrsa_link.c b/lib/dns/opensslrsa_link.c
index 09412c58b5..81ce6cc7cb 100644
--- a/lib/dns/opensslrsa_link.c
+++ b/lib/dns/opensslrsa_link.c
@@ -931,7 +931,7 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) {
for (i = 0; i < priv.nelements; i++) {
switch (priv.elements[i].tag) {
-#if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000
+#if !defined(OPENSSL_NO_ENGINE)
case TAG_RSA_ENGINE:
engine = (char *)priv.elements[i].data;
break;
--
2.55.0

8
bind.spec
View File

@ -54,7 +54,7 @@ Summary: The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
Name: bind
License: MPLv2.0
Version: 9.16.50
Release: 4%{?dist}
Release: 5%{?dist}
Epoch: 32
Url: https://www.isc.org/downloads/bind/
#
@ -165,6 +165,8 @@ Patch233: bind-9.20-stale-cname.patch
Patch234: bind-9.20-stale-cname-tests.patch
# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/9236
Patch235: bind-9.18-fix-qmin-test.patch
# Downstream only. RHEL-213998.
Patch236: bind-9.16-remove-openssl-api-level-check-for-engine.patch
%{?systemd_ordering}
# https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers
@ -1222,6 +1224,10 @@ fi;
%endif
%changelog
* Thu Jul 23 2026 Fedor Vorobev <fvorobev@redhat.com> - 32:9.16.50-5
- Remove compile-time OpenSSL API version check that was preventing
bind from fetching the engine for RSA algorithms. (RHEL-213788)
* Mon Jul 20 2026 Fedor Vorobev <fvorobev@redhat.com> - 32:9.16.50-4
- Fix uninitialized boolean in dig/host downstream patch that was
leading to incorrectly canceled queries in certain scenarios. (RHEL-212648)