From 7e7c98adeb87565fa29b06d1c404ba315f3d13e6 Mon Sep 17 00:00:00 2001 From: Fedor Vorobev Date: Thu, 23 Jul 2026 11:30:05 +0200 Subject: [PATCH] Remove erroneous OpenSSL API version check It was preventing bind from fetching the OpenSSL engine for RSA algorithms. Fixes Sanity/utils/pkcs11-tools test. Resolves: RHEL-213788 --- ...e-openssl-api-level-check-for-engine.patch | 35 +++++++++++++++++++ bind.spec | 8 ++++- 2 files changed, 42 insertions(+), 1 deletion(-) create mode 100644 bind-9.16-remove-openssl-api-level-check-for-engine.patch diff --git a/bind-9.16-remove-openssl-api-level-check-for-engine.patch b/bind-9.16-remove-openssl-api-level-check-for-engine.patch new file mode 100644 index 0000000..cde6963 --- /dev/null +++ b/bind-9.16-remove-openssl-api-level-check-for-engine.patch @@ -0,0 +1,35 @@ +From 68c631cf8dc67cb315d738a55a97fff26c0818e7 Mon Sep 17 00:00:00 2001 +From: Fedor Vorobev +Date: Thu, 23 Jul 2026 10:55:42 +0200 +Subject: [PATCH] Remove OPENSSL_API_LEVEL < 30000 check from an engine check. + +It was added in 5f8ac682c9912aaf564595f73f777672743f56aa upstream +commit, which was a cherry pick from a newer version of bind. As this is +the only instance of OPENSSL_API_LEVEL < 30000 within bind 9.16.50, I +believe it was done in error. + +This check was preventing bind from finding the OpenSSL engine for RSA +algorithms. `dnssec-keyfromlabel` would error out with 'no engine' +whenever an RSA algorithm was used. + +Resolves: RHEL-213788 +--- + lib/dns/opensslrsa_link.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/lib/dns/opensslrsa_link.c b/lib/dns/opensslrsa_link.c +index 09412c58b5..81ce6cc7cb 100644 +--- a/lib/dns/opensslrsa_link.c ++++ b/lib/dns/opensslrsa_link.c +@@ -931,7 +931,7 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) { + + for (i = 0; i < priv.nelements; i++) { + switch (priv.elements[i].tag) { +-#if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 ++#if !defined(OPENSSL_NO_ENGINE) + case TAG_RSA_ENGINE: + engine = (char *)priv.elements[i].data; + break; +-- +2.55.0 + diff --git a/bind.spec b/bind.spec index 9c35ca7..f5a8c8c 100644 --- a/bind.spec +++ b/bind.spec @@ -54,7 +54,7 @@ Summary: The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv Name: bind License: MPLv2.0 Version: 9.16.50 -Release: 4%{?dist} +Release: 5%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ # @@ -165,6 +165,8 @@ Patch233: bind-9.20-stale-cname.patch Patch234: bind-9.20-stale-cname-tests.patch # https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/9236 Patch235: bind-9.18-fix-qmin-test.patch +# Downstream only. RHEL-213998. +Patch236: bind-9.16-remove-openssl-api-level-check-for-engine.patch %{?systemd_ordering} # https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers @@ -1222,6 +1224,10 @@ fi; %endif %changelog +* Thu Jul 23 2026 Fedor Vorobev - 32:9.16.50-5 +- Remove compile-time OpenSSL API version check that was preventing + bind from fetching the engine for RSA algorithms. (RHEL-213788) + * Mon Jul 20 2026 Fedor Vorobev - 32:9.16.50-4 - Fix uninitialized boolean in dig/host downstream patch that was leading to incorrectly canceled queries in certain scenarios. (RHEL-212648)