import CS librelp-1.10.0-7.el9
This commit is contained in:
AlmaLinux RelEng Bot
parent
e6d842b253
commit
e4f0d9263b
58
SOURCES/RHEL-192631-fix-ossl-ssl-new-ordering.patch
Normal file
58
SOURCES/RHEL-192631-fix-ossl-ssl-new-ordering.patch
Normal file
@ -0,0 +1,58 @@
|
||||
From 9bf89ca142bc89d5bf29fc9a437187dd0bffaaa9 Mon Sep 17 00:00:00 2001
|
||||
From: Cropi <alakatos@redhat.com>
|
||||
Date: Wed, 24 Jun 2026 13:07:05 +0200
|
||||
Subject: [PATCH] tcp: fix SSL_CONF_cmd/SSL_new ordering in OpenSSL client
|
||||
connect path
|
||||
|
||||
relpTcpConnectTLSInit_ossl() called SSL_new(ctx) before
|
||||
relpTcpSetSslConfCmd_ossl(), so SSL_CONF_cmd("Groups", ...) applied via
|
||||
tls.tlscfgcmd was updating the SSL_CTX after the SSL object had already
|
||||
captured its group list. On OpenSSL 3.x this caused the client to
|
||||
advertise the full default group set (including X25519MLKEM768 on 3.5+)
|
||||
regardless of any Groups restriction in tlsConfigCmd.
|
||||
|
||||
Move pThis->sslState = osslClient and relpTcpSetSslConfCmd_ossl() to
|
||||
before SSL_new() so the SSL object inherits the correctly configured
|
||||
SSL_CTX. relpTcpTLSSetPrio() stays after SSL_new() because it operates
|
||||
on pThis->ssl via SSL_set_cipher_list().
|
||||
|
||||
Adapted from upstream commit 9bf89ca for librelp-1.10.0 line numbers
|
||||
(post-downstream-patch context differs from 1.12.0).
|
||||
|
||||
Signed-off-by: Cropi <alakatos@redhat.com>
|
||||
--- a/src/tcp.c
|
||||
+++ b/src/tcp.c
|
||||
@@ -1790,6 +1790,15 @@
|
||||
/*if we reach this point we are in tls mode */
|
||||
pThis->pEngine->dbgprint((char*)"relpTcpConnectTLSInit: TLS Mode\n");
|
||||
|
||||
+ /* set before relpTcpSetSslConfCmd_ossl: tlsConfigCmd may contain
|
||||
+ * flag-restricted commands that require SSL_CONF_FLAG_CLIENT */
|
||||
+ pThis->sslState = osslClient;
|
||||
+
|
||||
+ /* SSL_CONF_cmd targets the SSL_CTX; SSL_new() snapshots the SSL_CTX's
|
||||
+ * group list at construction time, so this must run before SSL_new()
|
||||
+ * or the SSL object keeps the default groups set by SSL_CTX_new() */
|
||||
+ CHKRet(relpTcpSetSslConfCmd_ossl(pThis, pThis->tlsConfigCmd));
|
||||
+
|
||||
if(!(pThis->ssl = SSL_new(ctx))) {
|
||||
relpTcpLastSSLErrorMsg(0, pThis, "relpTcpConnectTLSInit");
|
||||
ABORT_FINALIZE(RELP_RET_IO_ERR);
|
||||
@@ -1805,17 +1814,11 @@
|
||||
} else
|
||||
pThis->authmode = eRelpAuthMode_None;
|
||||
|
||||
- /* Set TLS Options if configured */
|
||||
- CHKRet(relpTcpSetSslConfCmd_ossl(pThis, pThis->tlsConfigCmd));
|
||||
-
|
||||
/* Set TLS Priority Options */
|
||||
CHKRet(relpTcpTLSSetPrio(pThis));
|
||||
|
||||
SSL_set_ex_data(pThis->ssl, 0, (void*)pThis);
|
||||
|
||||
- /*set client state */
|
||||
- pThis->sslState = osslClient;
|
||||
-
|
||||
/* Create BIO from ptcp socket! */
|
||||
conn = BIO_new_socket(pThis->sock, BIO_NOCLOSE);
|
||||
pThis->pEngine->dbgprint((char*)"relpTcpConnectTLSInit: Init conn BIO[%p] done\n", (void *)conn);
|
||||
73
SOURCES/fix-openssl-fd-double-close.patch
Normal file
73
SOURCES/fix-openssl-fd-double-close.patch
Normal file
@ -0,0 +1,73 @@
|
||||
From 940cd1835206ae124e8d213a26723464a949d8c1 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Renaud=20M=C3=A9trich?= <rmetrich@redhat.com>
|
||||
Date: Wed, 1 Jul 2026 13:31:09 +0200
|
||||
Subject: [PATCH] openssl: fix fd double-close in relpTcpDestruct
|
||||
|
||||
relpTcpDestruct() closed the socket fd before calling
|
||||
relpTcpDestructTLS(), causing SSL_shutdown() to operate on an
|
||||
already-closed fd. Additionally, BIO_new_socket() was called with
|
||||
BIO_CLOSE, making SSL_free() close the fd a second time via the BIO
|
||||
destructor. Strace on every TLS teardown:
|
||||
|
||||
shutdown(12, SHUT_RDWR) = 0
|
||||
close(12) = 0 # relpTcpDestruct
|
||||
write(12, ...) = -1 EBADF # SSL_shutdown on closed fd
|
||||
close(12) = -1 EBADF # SSL_free BIO_CLOSE
|
||||
|
||||
Fix:
|
||||
- Move relpTcpDestructTLS() before the socket close so SSL_shutdown()
|
||||
can send the close_notify on a valid fd.
|
||||
- Change BIO_new_socket() from BIO_CLOSE to BIO_NOCLOSE so SSL_free()
|
||||
does not close the fd.
|
||||
- Add conn = NULL after SSL_set_bio() to prevent double-free in the
|
||||
error path.
|
||||
---
|
||||
src/tcp.c | 9 +++++++--
|
||||
1 file changed, 7 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/src/tcp.c b/src/tcp.c
|
||||
--- a/src/tcp.c
|
||||
+++ b/src/tcp.c
|
||||
@@ -781,6 +781,8 @@
|
||||
pThis = *ppThis;
|
||||
RELPOBJ_assert(pThis, Tcp);
|
||||
|
||||
+ relpTcpDestructTLS(pThis);
|
||||
+
|
||||
if(pThis->sock != -1) {
|
||||
shutdown(pThis->sock, SHUT_RDWR);
|
||||
close(pThis->sock);
|
||||
@@ -795,7 +797,6 @@
|
||||
}
|
||||
free(pThis->socks);
|
||||
}
|
||||
- relpTcpDestructTLS(pThis);
|
||||
|
||||
free(pThis->pRemHostIP);
|
||||
free(pThis->pRemHostName);
|
||||
@@ -1770,7 +1771,7 @@
|
||||
pThis->sslState = osslServer;
|
||||
|
||||
/* Create BIO from ptcp socket! */
|
||||
- client = BIO_new_socket(pThis->sock, BIO_CLOSE /*BIO_NOCLOSE*/);
|
||||
+ client = BIO_new_socket(pThis->sock, BIO_NOCLOSE);
|
||||
pThis->pEngine->dbgprint((char*)"relpTcpAcceptConnReqInitTLS_ossl: Init client BIO[%p] done\n", (void *)client);
|
||||
|
||||
/* Set debug Callback for client BIO as well! */
|
||||
@@ -1863,7 +1864,7 @@
|
||||
pThis->sslState = osslClient;
|
||||
|
||||
/* Create BIO from ptcp socket! */
|
||||
- conn = BIO_new_socket(pThis->sock, BIO_CLOSE /*BIO_NOCLOSE*/);
|
||||
+ conn = BIO_new_socket(pThis->sock, BIO_NOCLOSE);
|
||||
pThis->pEngine->dbgprint((char*)"relpTcpConnectTLSInit: Init conn BIO[%p] done\n", (void *)conn);
|
||||
|
||||
/* Set debug Callback for client BIO as well! */
|
||||
@@ -1874,6 +1875,7 @@
|
||||
BIO_set_nbio( conn, 1 );
|
||||
|
||||
SSL_set_bio(pThis->ssl, conn, conn);
|
||||
+ conn = NULL;
|
||||
SSL_set_connect_state(pThis->ssl); /*sets ssl to work in client mode.*/
|
||||
|
||||
/* Perform the TLS handshake */
|
||||
@ -1,7 +1,7 @@
|
||||
Summary: The Reliable Event Logging Protocol library
|
||||
Name: librelp
|
||||
Version: 1.10.0
|
||||
Release: 5%{?dist}
|
||||
Release: 7%{?dist}
|
||||
License: GPLv3+
|
||||
URL: http://www.rsyslog.com/
|
||||
Source0: http://download.rsyslog.com/%{name}/%{name}-%{version}.tar.gz
|
||||
@ -9,6 +9,11 @@ BuildRequires: gnutls-devel >= 1.4.0
|
||||
|
||||
Patch0: librelp-1.10.0-rhbz1972067-relpEngineSetTLSLibByName.patch
|
||||
Patch1: librelp-1.10.0-crypto-compliance.patch
|
||||
Patch2: fix-openssl-fd-double-close.patch
|
||||
|
||||
# https://github.com/rsyslog/librelp/commit/9bf89ca142bc89d5bf29fc9a437187dd0bffaaa9
|
||||
# Resolves: RHEL-192631
|
||||
Patch3: RHEL-192631-fix-ossl-ssl-new-ordering.patch
|
||||
|
||||
%description
|
||||
Librelp is an easy to use library for the RELP protocol. RELP (stands
|
||||
@ -33,8 +38,10 @@ to develop applications using librelp.
|
||||
|
||||
%prep
|
||||
%setup -q
|
||||
%patch0 -p1 -b .tls-by-name
|
||||
%patch1 -p1 -b .crypto-compliance
|
||||
%patch -P 0 -p1 -b .tls-by-name
|
||||
%patch -P 1 -p1 -b .crypto-compliance
|
||||
%patch -P 2 -p1
|
||||
%patch -P 3 -p1
|
||||
|
||||
%build
|
||||
autoreconf -ivf
|
||||
@ -59,6 +66,14 @@ rm $RPM_BUILD_ROOT/%{_libdir}/*.la
|
||||
%{_libdir}/pkgconfig/relp.pc
|
||||
|
||||
%changelog
|
||||
* Thu Jul 09 2026 Attila Lakatos <alakatos@redhat.com> - 1.10.0-7
|
||||
- Backport: fix SSL_CONF_cmd/SSL_new ordering in OpenSSL client connect path
|
||||
Resolves: RHEL-192631
|
||||
|
||||
* Thu Jul 09 2026 Attila Lakatos <alakatos@redhat.com> - 1.10.0-6
|
||||
- Backport: fix OpenSSL fd double-close in TLS teardown
|
||||
Resolves: RHEL-192630
|
||||
|
||||
* Wed Aug 02 2023 Attila Lakatos <alakatos@redhat.com> - 1.10.0-5
|
||||
- Rebuild
|
||||
resolves: rhbz#2227723
|
||||
|
||||
Loading…
Reference in New Issue
Block a user