Fix building and running against OpenSSL 3 beta 2

Resolves: RHBZ#1991050

corefx-openssl-0001-Use-EVP_PKEY-for-RSA-key-generation.patch

@@ -1,7 +1,7 @@
 From 2b6b45878b1be4d77eec34ab5bc80b626995a8c5 Mon Sep 17 00:00:00 2001
 From: Jeremy Barton <jbarton@microsoft.com>
 Date: Fri, 19 Mar 2021 15:05:41 -0700
-Subject: [PATCH 1/9] Use EVP_PKEY for RSA key generation
+Subject: [PATCH 01/11] Use EVP_PKEY for RSA key generation
 
 ---
  .../Interop.EvpPkey.Rsa.cs                    | 16 ++++++++

corefx-openssl-0002-Use-EVP_PKEY-for-RSA-Decrypt.patch

@@ -1,7 +1,7 @@
 From 16f162f76cdbdd150487eb9824f9d8f8e39df5ca Mon Sep 17 00:00:00 2001
 From: Jeremy Barton <jbarton@microsoft.com>
 Date: Wed, 24 Mar 2021 10:27:42 -0700
-Subject: [PATCH 2/9] Use EVP_PKEY for RSA Decrypt
+Subject: [PATCH 02/11] Use EVP_PKEY for RSA Decrypt
 
 ---
  .../Interop.EVP.DigestAlgs.cs                 |  58 +++++

corefx-openssl-0003-Use-EVP_PKEY-for-RSA-signing-operations.patch

@@ -1,7 +1,7 @@
 From 7111a92546253d6fc857f7cad8b0bff425df0798 Mon Sep 17 00:00:00 2001
 From: Jeremy Barton <jbarton@microsoft.com>
 Date: Fri, 2 Apr 2021 09:10:08 -0700
-Subject: [PATCH 3/9] Use EVP_PKEY for RSA signing operations
+Subject: [PATCH 03/11] Use EVP_PKEY for RSA signing operations
 
 With this change all RSA private key operations (excluding import/export) use the EVP_PKEY APIs.
 

corefx-openssl-0004-Support-compiling-against-OpenSSL-3-headers.patch

@@ -1,7 +1,7 @@
 From 49dc6e515d9ec0db1841e5d2d86f52916d35f667 Mon Sep 17 00:00:00 2001
 From: Jeremy Barton <jbarton@microsoft.com>
 Date: Mon, 5 Apr 2021 11:07:29 -0700
-Subject: [PATCH 4/9] Support compiling against OpenSSL 3 headers
+Subject: [PATCH 04/11] Support compiling against OpenSSL 3 headers
 
 Building against OpenSSL 3's headers fails to compile, as X509_V_ERR_INVALID_CA has changed from 24 to 79, tripping a static assert.
 

corefx-openssl-0005-Make-portable-builds-work-across-OpenSSL-1.0.2-1.1.1.patch

@@ -1,7 +1,8 @@
 From 07c2b5773e994e8922a24757605a5eff05073167 Mon Sep 17 00:00:00 2001
 From: Jeremy Barton <jbarton@microsoft.com>
 Date: Wed, 14 Apr 2021 16:38:19 -0700
-Subject: [PATCH 5/9] Make portable builds work across OpenSSL 1.0.2/1.1.1/3.0
+Subject: [PATCH 05/11] Make portable builds work across OpenSSL
+ 1.0.2/1.1.1/3.0
 
 Overall structure of changes
 

corefx-openssl-0006-Fix-merge-issues-and-make-the-build-work.patch

@@ -1,7 +1,7 @@
 From 5848349f1e0df84949a01b41d41904036cc070f7 Mon Sep 17 00:00:00 2001
 From: Omair Majid <omajid@redhat.com>
 Date: Fri, 4 Jun 2021 17:21:28 -0400
-Subject: [PATCH 6/9] Fix merge issues and make the build work
+Subject: [PATCH 06/11] Fix merge issues and make the build work
 
 ---
  .../Cryptography/Pal.Unix/OpenSslX509ChainProcessor.cs      | 6 +++---

corefx-openssl-0007-OpenSSL3-Register-legacy-algorithms-when-needed.patch

@@ -1,7 +1,7 @@
 From 7f171bb20e0816cd2d5af57437553f1a31a886af Mon Sep 17 00:00:00 2001
 From: Jeremy Barton <jbarton@microsoft.com>
 Date: Thu, 15 Apr 2021 08:06:27 -0700
-Subject: [PATCH 7/9] OpenSSL3: Register legacy algorithms when needed
+Subject: [PATCH 07/11] OpenSSL3: Register legacy algorithms when needed
 
 ---
  .../Interop.LegacyAlgorithms.cs               | 31 +++++++++++++++++++

corefx-openssl-0008-Work-around-OpenSSL-3.0-ciphers-not-restoring-origin.patch

@@ -1,8 +1,8 @@
 From 30e2e4cbb11a4fbdb7102133b19bfc990a2ba939 Mon Sep 17 00:00:00 2001
 From: Jeremy Barton <jbarton@microsoft.com>
 Date: Fri, 16 Apr 2021 09:38:47 -0700
-Subject: [PATCH 8/9] Work around OpenSSL 3.0 ciphers not restoring original IV
+Subject: [PATCH 08/11] Work around OpenSSL 3.0 ciphers not restoring original
- on reset.
+ IV on reset.
 
 ---
  .../opensslshim.h                             |  2 ++

corefx-openssl-0009-Use-1-instead-of-true-for-more-portable-code.patch

@@ -1,7 +1,7 @@
 From b7700862a9a85e5bab302c158d5aa6ac1af7c5c1 Mon Sep 17 00:00:00 2001
 From: Omair Majid <omajid@redhat.com>
 Date: Mon, 7 Jun 2021 11:37:48 -0400
-Subject: [PATCH 9/9] Use `1` instead of `true` for more portable code
+Subject: [PATCH 09/11] Use `1` instead of `true` for more portable code
 
 ---
  .../opensslshim.h                                  | 14 +++++++-------

corefx-openssl-0010-Stop-using-ERR_GET_FUNC-since-it-has-been-removed-in.patch

@@ -0,0 +1,80 @@
+From c746b2a3bd8ae3b76740e2b4f2cf12646eedbb51 Mon Sep 17 00:00:00 2001
+From: Jeremy Barton <jbarton@microsoft.com>
+Date: Sat, 21 Aug 2021 05:05:19 -0700
+Subject: [PATCH 10/11] Stop using ERR_GET_FUNC, since it has been removed in
+ OSSL3 Beta2. (#57869)
+
+---
+ .../openssl.c                                 | 25 +++++++++++--------
+ .../opensslshim.h                             |  2 ++
+ 2 files changed, 16 insertions(+), 11 deletions(-)
+
+diff --git a/src/Native/Unix/System.Security.Cryptography.Native/openssl.c b/src/Native/Unix/System.Security.Cryptography.Native/openssl.c
+index 6792bdb1a1..e55486dc80 100644
+--- a/src/Native/Unix/System.Security.Cryptography.Native/openssl.c
++++ b/src/Native/Unix/System.Security.Cryptography.Native/openssl.c
+@@ -1064,27 +1064,30 @@ int32_t CryptoNative_LookupFriendlyNameByOid(const char* oidValue, const char**
+         return -2;
+     }
+ 
++    // First, check if oidValue parses as a dotted decimal OID. If not, we'll
++    // return not-found and let the system cache that.
++    int asnRet = a2d_ASN1_OBJECT(NULL, 0, oidValue, -1);
++
++    if (asnRet <= 0)
++    {
++        return 0;
++    }
++
+     // Do a lookup with no_name set. The purpose of this function is to map only the
+     // dotted decimal to the friendly name. "sha1" in should not result in "sha1" out.
+     oid = OBJ_txt2obj(oidValue, 1);
+ 
+-    if (!oid)
++    if (oid == NULL)
+     {
+-        unsigned long err = ERR_peek_last_error();
+-
+-        // If the most recent error pushed onto the error queue is NOT from OID parsing
+-        // then signal for an exception to be thrown.
+-        if (err != 0 && ERR_GET_FUNC(err) != ASN1_F_A2D_ASN1_OBJECT)
+-        {
+-            return -1;
+-        }
+-
+-        return 0;
++        // We know that the OID parsed (unless it underwent concurrent modification,
++        // which is unsupported), so any error in this stage should be an exception.
++        return -1;
+     }
+ 
+     // Look in the predefined, and late-registered, OIDs list to get the lookup table
+     // identifier for this OID.  The OBJ_txt2obj object will not have ln set.
+     nid = OBJ_obj2nid(oid);
++    ASN1_OBJECT_free(oid);
+ 
+     if (nid == NID_undef)
+     {
+diff --git a/src/Native/Unix/System.Security.Cryptography.Native/opensslshim.h b/src/Native/Unix/System.Security.Cryptography.Native/opensslshim.h
+index b0d1a71671..c11285e7dd 100644
+--- a/src/Native/Unix/System.Security.Cryptography.Native/opensslshim.h
++++ b/src/Native/Unix/System.Security.Cryptography.Native/opensslshim.h
+@@ -148,6 +148,7 @@ void SSL_get0_alpn_selected(const SSL* ssl, const unsigned char** protocol, unsi
+ // that needs to be added.
+ 
+ #define FOR_ALL_OPENSSL_FUNCTIONS \
++    REQUIRED_FUNCTION(a2d_ASN1_OBJECT) \
+     REQUIRED_FUNCTION(ASN1_BIT_STRING_free) \
+     REQUIRED_FUNCTION(ASN1_d2i_bio) \
+     REQUIRED_FUNCTION(ASN1_i2d_bio) \
+@@ -554,6 +555,7 @@ FOR_ALL_OPENSSL_FUNCTIONS
+ 
+ // Redefine all calls to OpenSSL functions as calls through pointers that are set
+ // to the functions from the libssl.so selected by the shim.
++#define a2d_ASN1_OBJECT a2d_ASN1_OBJECT_ptr
+ #define ASN1_BIT_STRING_free ASN1_BIT_STRING_free_ptr
+ #define ASN1_GENERALIZEDTIME_free ASN1_GENERALIZEDTIME_free_ptr
+ #define ASN1_d2i_bio ASN1_d2i_bio_ptr
+-- 
+2.31.1
+

corefx-openssl-0011-Adjust-crypto-shim-for-functions-renamed-for-OSSL3-b.patch

@@ -0,0 +1,140 @@
+From 05fb8ceb229d76ae32bd18e707b3682c8302490c Mon Sep 17 00:00:00 2001
+From: Jeremy Barton <jbarton@microsoft.com>
+Date: Tue, 13 Jul 2021 01:38:33 -0700
+Subject: [PATCH 11/11] Adjust crypto shim for functions renamed for OSSL3
+ beta1
+
+---
+ .../opensslshim.h                                 | 15 +++++++++------
+ .../osslcompat_30.h                               |  3 +++
+ .../System.Security.Cryptography.Native/pal_evp.c |  2 +-
+ .../pal_evp_pkey.c                                |  2 +-
+ 4 files changed, 14 insertions(+), 8 deletions(-)
+
+diff --git a/src/Native/Unix/System.Security.Cryptography.Native/opensslshim.h b/src/Native/Unix/System.Security.Cryptography.Native/opensslshim.h
+index c11285e7dd..b3386d381f 100644
+--- a/src/Native/Unix/System.Security.Cryptography.Native/opensslshim.h
++++ b/src/Native/Unix/System.Security.Cryptography.Native/opensslshim.h
+@@ -292,7 +292,7 @@ void SSL_get0_alpn_selected(const SSL* ssl, const unsigned char** protocol, unsi
+     REQUIRED_FUNCTION(EVP_md5) \
+     RENAMED_FUNCTION(EVP_MD_CTX_free, EVP_MD_CTX_destroy) \
+     RENAMED_FUNCTION(EVP_MD_CTX_new, EVP_MD_CTX_create) \
+-    REQUIRED_FUNCTION(EVP_MD_size) \
++    RENAMED_FUNCTION(EVP_MD_get_size, EVP_MD_size) \
+     REQUIRED_FUNCTION(EVP_PKEY_CTX_ctrl) \
+     REQUIRED_FUNCTION(EVP_PKEY_CTX_free) \
+     REQUIRED_FUNCTION(EVP_PKEY_CTX_get0_pkey) \
+@@ -303,13 +303,14 @@ void SSL_get0_alpn_selected(const SSL* ssl, const unsigned char** protocol, unsi
+     FALLBACK_FUNCTION(EVP_PKEY_CTX_set_rsa_padding) \
+     FALLBACK_FUNCTION(EVP_PKEY_CTX_set_rsa_pss_saltlen) \
+     FALLBACK_FUNCTION(EVP_PKEY_CTX_set_signature_md) \
+-    REQUIRED_FUNCTION(EVP_PKEY_base_id) \
+     REQUIRED_FUNCTION(EVP_PKEY_decrypt) \
+     REQUIRED_FUNCTION(EVP_PKEY_decrypt_init) \
+     REQUIRED_FUNCTION(EVP_PKEY_derive_set_peer) \
+     REQUIRED_FUNCTION(EVP_PKEY_derive_init) \
+     REQUIRED_FUNCTION(EVP_PKEY_derive) \
+     REQUIRED_FUNCTION(EVP_PKEY_free) \
++    RENAMED_FUNCTION(EVP_PKEY_get_base_id, EVP_PKEY_base_id) \
++    RENAMED_FUNCTION(EVP_PKEY_get_size, EVP_PKEY_size) \
+     FALLBACK_FUNCTION(EVP_PKEY_get0_RSA) \
+     REQUIRED_FUNCTION(EVP_PKEY_get1_DSA) \
+     REQUIRED_FUNCTION(EVP_PKEY_get1_EC_KEY) \
+@@ -322,7 +323,6 @@ void SSL_get0_alpn_selected(const SSL* ssl, const unsigned char** protocol, unsi
+     REQUIRED_FUNCTION(EVP_PKEY_set1_RSA) \
+     REQUIRED_FUNCTION(EVP_PKEY_sign) \
+     REQUIRED_FUNCTION(EVP_PKEY_sign_init) \
+-    REQUIRED_FUNCTION(EVP_PKEY_size) \
+     FALLBACK_FUNCTION(EVP_PKEY_up_ref) \
+     REQUIRED_FUNCTION(EVP_rc2_cbc) \
+     REQUIRED_FUNCTION(EVP_rc2_ecb) \
+@@ -699,7 +699,7 @@ FOR_ALL_OPENSSL_FUNCTIONS
+ #define EVP_md5 EVP_md5_ptr
+ #define EVP_MD_CTX_free EVP_MD_CTX_free_ptr
+ #define EVP_MD_CTX_new EVP_MD_CTX_new_ptr
+-#define EVP_MD_size EVP_MD_size_ptr
++#define EVP_MD_get_size EVP_MD_get_size_ptr
+ #define EVP_PKEY_CTX_ctrl EVP_PKEY_CTX_ctrl_ptr
+ #define EVP_PKEY_CTX_free EVP_PKEY_CTX_free_ptr
+ #define EVP_PKEY_CTX_get0_pkey EVP_PKEY_CTX_get0_pkey_ptr
+@@ -710,13 +710,14 @@ FOR_ALL_OPENSSL_FUNCTIONS
+ #define EVP_PKEY_CTX_set_rsa_padding EVP_PKEY_CTX_set_rsa_padding_ptr
+ #define EVP_PKEY_CTX_set_rsa_pss_saltlen EVP_PKEY_CTX_set_rsa_pss_saltlen_ptr
+ #define EVP_PKEY_CTX_set_signature_md EVP_PKEY_CTX_set_signature_md_ptr
+-#define EVP_PKEY_base_id EVP_PKEY_base_id_ptr
+ #define EVP_PKEY_decrypt_init EVP_PKEY_decrypt_init_ptr
+ #define EVP_PKEY_decrypt EVP_PKEY_decrypt_ptr
+ #define EVP_PKEY_derive_set_peer EVP_PKEY_derive_set_peer_ptr
+ #define EVP_PKEY_derive_init EVP_PKEY_derive_init_ptr
+ #define EVP_PKEY_derive EVP_PKEY_derive_ptr
+ #define EVP_PKEY_free EVP_PKEY_free_ptr
++#define EVP_PKEY_get_base_id EVP_PKEY_get_base_id_ptr
++#define EVP_PKEY_get_size EVP_PKEY_get_size_ptr
+ #define EVP_PKEY_get0_RSA EVP_PKEY_get0_RSA_ptr
+ #define EVP_PKEY_get1_DSA EVP_PKEY_get1_DSA_ptr
+ #define EVP_PKEY_get1_EC_KEY EVP_PKEY_get1_EC_KEY_ptr
+@@ -729,7 +730,6 @@ FOR_ALL_OPENSSL_FUNCTIONS
+ #define EVP_PKEY_set1_RSA EVP_PKEY_set1_RSA_ptr
+ #define EVP_PKEY_sign_init EVP_PKEY_sign_init_ptr
+ #define EVP_PKEY_sign EVP_PKEY_sign_ptr
+-#define EVP_PKEY_size EVP_PKEY_size_ptr
+ #define EVP_PKEY_up_ref EVP_PKEY_up_ref_ptr
+ #define EVP_rc2_cbc EVP_rc2_cbc_ptr
+ #define EVP_rc2_ecb EVP_rc2_ecb_ptr
+@@ -1006,6 +1006,9 @@ FOR_ALL_OPENSSL_FUNCTIONS
+ #if OPENSSL_VERSION_NUMBER < OPENSSL_VERSION_3_0_RTM
+ 
+ // Undo renames for renamed-in-3.0
++#define EVP_MD_get_size EVP_MD_size
++#define EVP_PKEY_get_base_id EVP_PKEY_base_id
++#define EVP_PKEY_get_size EVP_PKEY_size
+ #define SSL_get1_peer_certificate SSL_get_peer_certificate
+ 
+ #endif
+diff --git a/src/Native/Unix/System.Security.Cryptography.Native/osslcompat_30.h b/src/Native/Unix/System.Security.Cryptography.Native/osslcompat_30.h
+index bb529df51e..dba69f1382 100644
+--- a/src/Native/Unix/System.Security.Cryptography.Native/osslcompat_30.h
++++ b/src/Native/Unix/System.Security.Cryptography.Native/osslcompat_30.h
+@@ -19,10 +19,13 @@ void ERR_new(void);
+ void ERR_set_debug(const char *file, int line, const char *func);
+ void ERR_set_error(int lib, int reason, const char *fmt, ...);
+ int EVP_CIPHER_CTX_get_original_iv(EVP_CIPHER_CTX *ctx, void *buf, size_t len);
++int EVP_MD_get_size(const EVP_MD* md);
+ int EVP_PKEY_CTX_set_rsa_keygen_bits(EVP_PKEY_CTX* ctx, int bits);
+ int EVP_PKEY_CTX_set_rsa_oaep_md(EVP_PKEY_CTX* ctx, const EVP_MD* md);
+ int EVP_PKEY_CTX_set_rsa_padding(EVP_PKEY_CTX* ctx, int pad_mode);
+ int EVP_PKEY_CTX_set_rsa_pss_saltlen(EVP_PKEY_CTX* ctx, int saltlen);
+ int EVP_PKEY_CTX_set_signature_md(EVP_PKEY_CTX* ctx, const EVP_MD* md);
++int EVP_PKEY_get_base_id(const EVP_PKEY* pkey);
++int EVP_PKEY_get_size(const EVP_PKEY* pkey);
+ OSSL_PROVIDER* OSSL_PROVIDER_try_load(OSSL_LIB_CTX* , const char* name, int retain_fallbacks);
+ X509* SSL_get1_peer_certificate(const SSL* ssl);
+diff --git a/src/Native/Unix/System.Security.Cryptography.Native/pal_evp.c b/src/Native/Unix/System.Security.Cryptography.Native/pal_evp.c
+index 9665ffe3fa..5ec3c63122 100644
+--- a/src/Native/Unix/System.Security.Cryptography.Native/pal_evp.c
++++ b/src/Native/Unix/System.Security.Cryptography.Native/pal_evp.c
+@@ -59,7 +59,7 @@ int32_t CryptoNative_EvpDigestFinalEx(EVP_MD_CTX* ctx, uint8_t* md, uint32_t* s)
+ 
+ int32_t CryptoNative_EvpMdSize(const EVP_MD* md)
+ {
+-    return EVP_MD_size(md);
++    return EVP_MD_get_size(md);
+ }
+ 
+ const EVP_MD* CryptoNative_EvpMd5()
+diff --git a/src/Native/Unix/System.Security.Cryptography.Native/pal_evp_pkey.c b/src/Native/Unix/System.Security.Cryptography.Native/pal_evp_pkey.c
+index f232b382ea..67410bc4e8 100644
+--- a/src/Native/Unix/System.Security.Cryptography.Native/pal_evp_pkey.c
++++ b/src/Native/Unix/System.Security.Cryptography.Native/pal_evp_pkey.c
+@@ -21,7 +21,7 @@ void CryptoNative_EvpPkeyDestroy(EVP_PKEY* pkey)
+ int32_t CryptoNative_EvpPKeySize(EVP_PKEY* pkey)
+ {
+     assert(pkey != NULL);
+-    return EVP_PKEY_size(pkey);
++    return EVP_PKEY_get_size(pkey);
+ }
+ 
+ int32_t CryptoNative_UpRefEvpPkey(EVP_PKEY* pkey)
+-- 
+2.31.1
+

dotnet3.1.spec

@@ -55,7 +55,7 @@
 
 Name:           dotnet3.1
 Version:        %{sdk_rpm_version}
-Release:        1%{?dist}
+Release:        2%{?dist}
 Summary:        .NET Core Runtime and SDK
 License:        MIT and ASL 2.0 and BSD and LGPLv2+ and CC-BY and CC0 and MS-PL and EPL-1.0 and GPL+ and GPLv2 and ISC and OFL and zlib
 URL:            https://github.com/dotnet/
@@ -88,6 +88,8 @@ Patch111:       corefx-openssl-0006-Fix-merge-issues-and-make-the-build-work.pat
 Patch112:       corefx-openssl-0007-OpenSSL3-Register-legacy-algorithms-when-needed.patch
 Patch113:       corefx-openssl-0008-Work-around-OpenSSL-3.0-ciphers-not-restoring-origin.patch
 Patch114:       corefx-openssl-0009-Use-1-instead-of-true-for-more-portable-code.patch
+Patch115:       corefx-openssl-0010-Stop-using-ERR_GET_FUNC-since-it-has-been-removed-in.patch
+Patch116:       corefx-openssl-0011-Adjust-crypto-shim-for-functions-renamed-for-OSSL3-b.patch
 
 # Fix build with clang 10; Already applied at tarball-build time
 # Patch200:       coreclr-clang10.patch
@@ -375,6 +377,8 @@ pushd src/corefx.*
 %patch112 -p1
 %patch113 -p1
 %patch114 -p1
+%patch115 -p1
+%patch116 -p1
 popd
 
 pushd src/coreclr.*
@@ -568,6 +572,10 @@ echo "Testing build results for debug symbols..."
 
 
 %changelog
+* Tue Aug 24 2021 Omair Majid <omajid@redhat.com> - 3.1.117-2
+- Fix building and running against OpenSSL 3.0
+- Resolves: RHBZ#1991050
+
 * Thu Aug 12 2021 Omair Majid <omajid@redhat.com> - 3.1.117-1
 - Update to .NET SDK 3.1.117 and Runtime 3.1.17
 - Resolves: RHBZ#1961848