From 0982e58ece6916479b49a1c23c711d65be9d6d49 Mon Sep 17 00:00:00 2001
From: Cropi <alakatos@redhat.com>
Date: Thu, 9 Jul 2026 08:49:04 +0200
Subject: [PATCH] librelp: backport fix for OpenSSL fd double-close in TLS
 teardown

relpTcpDestruct() was calling close(sock) before relpTcpDestructTLS(),
causing SSL_shutdown() to write close_notify to an already-closed fd
(EBADF). Both BIO_new_socket() calls used BIO_CLOSE, causing SSL_free()
to close the fd a second time -- silently destroying any socket the OS
had reassigned to a new incoming connection in the interim.

Backport https://github.com/rsyslog/librelp/pull/292

Resolves: RHEL-191751
Signed-off-by: Cropi <alakatos@redhat.com>
---
 fix-openssl-fd-double-close.patch | 47 +++++++++++++++++++++++++++++++
 librelp.spec                      |  7 ++++-
 2 files changed, 53 insertions(+), 1 deletion(-)
 create mode 100644 fix-openssl-fd-double-close.patch

diff --git a/fix-openssl-fd-double-close.patch b/fix-openssl-fd-double-close.patch
new file mode 100644
index 0000000..6a94f79
--- /dev/null
+++ b/fix-openssl-fd-double-close.patch
@@ -0,0 +1,47 @@
+diff --git a/src/tcp.c b/src/tcp.c
+index 47e62a1..1b91c78 100644
+--- a/src/tcp.c
++++ b/src/tcp.c
+@@ -801,6 +801,8 @@ relpTcpDestruct(relpTcp_t **ppThis)
+ 		// Only DEBUG if pThis  is available
+ 		pThis->pEngine->dbgprint((char*)"relpTcpDestruct for %p\n", (void *) pThis);
+ 
++		relpTcpDestructTLS(pThis);
++
+ 		if(pThis->sock != -1) {
+ 			shutdown(pThis->sock, SHUT_RDWR);
+ 			close(pThis->sock);
+@@ -815,7 +817,6 @@ relpTcpDestruct(relpTcp_t **ppThis)
+ 			}
+ 			free(pThis->socks);
+ 		}
+-		relpTcpDestructTLS(pThis);
+ 
+ 		free(pThis->pRemHostIP);
+ 		free(pThis->pRemHostName);
+@@ -1812,7 +1813,7 @@ relpTcpAcceptConnReqInitTLS_ossl(relpTcp_t *const pThis, relpSrv_t *const pSrv)
+ 	pThis->sslState = osslServer;
+ 
+ 	/* Create BIO from ptcp socket! */
+-	client = BIO_new_socket(pThis->sock, BIO_CLOSE /*BIO_NOCLOSE*/);
++	client = BIO_new_socket(pThis->sock, BIO_NOCLOSE);
+ 	pThis->pEngine->dbgprint((char*)"relpTcpAcceptConnReqInitTLS_ossl: Init client BIO[%p] done\n", (void *)client);
+ 
+ 	/* Set debug Callback for client BIO as well! */
+@@ -1918,7 +1919,7 @@ relpTcpConnectTLSInit_ossl(relpTcp_t *const pThis)
+ 	pThis->sslState = osslClient;
+ 
+ 	/* Create BIO from ptcp socket! */
+-	conn = BIO_new_socket(pThis->sock, BIO_CLOSE /*BIO_NOCLOSE*/);
++	conn = BIO_new_socket(pThis->sock, BIO_NOCLOSE);
+ 	pThis->pEngine->dbgprint((char*)"relpTcpConnectTLSInit: Init conn BIO[%p] done\n", (void *)conn);
+ 
+ 	/* Set debug Callback for client BIO as well! */
+@@ -1933,6 +1934,7 @@ relpTcpConnectTLSInit_ossl(relpTcp_t *const pThis)
+ BIO_set_nbio( conn, 1 );
+ 
+ 	SSL_set_bio(pThis->ssl, conn, conn);
++	conn = NULL;
+ 	SSL_set_connect_state(pThis->ssl); /*sets ssl to work in client mode.*/
+ 
+ 	/* Perform the TLS handshake */
diff --git a/librelp.spec b/librelp.spec
index fbf6bcd..6b5f0f6 100644
--- a/librelp.spec
+++ b/librelp.spec
@@ -1,12 +1,13 @@
 Summary: The Reliable Event Logging Protocol library
 Name: librelp
 Version: 1.11.0
-Release: 7%{?dist}
+Release: 8%{?dist}
 License: GPL-3.0-or-later
 URL: http://www.rsyslog.com/
 Source0: http://download.rsyslog.com/%{name}/%{name}-%{version}.tar.gz
 
 Patch0: disable-openssl-engine.patch
+Patch1: fix-openssl-fd-double-close.patch
 
 %description
 Librelp is an easy to use library for the RELP protocol. RELP (stands
@@ -33,6 +34,7 @@ to develop applications using librelp.
 %setup -q
 
 %patch -P 0 -p1
+%patch -P 1 -p1
 
 %build
 autoreconf -ivf
@@ -57,6 +59,9 @@ rm $RPM_BUILD_ROOT/%{_libdir}/*.la
 %{_libdir}/pkgconfig/relp.pc
 
 %changelog
+* Thu Jul 09 2026 Attila Lakatos <alakatos@redhat.com> - 1.11.0-8
+- Backport: fix OpenSSL fd double-close in TLS teardown
+  Resolves: RHEL-191751
 * Tue Oct 29 2024 Troy Dawson <tdawson@redhat.com> - 1.11.0-7
 - Bump release for October 2024 mass rebuild:
   Resolves: RHEL-64018