From e4f0d9263bcb5afd99b8643235d6df7058370401 Mon Sep 17 00:00:00 2001 From: AlmaLinux RelEng Bot Date: Mon, 24 Aug 2026 09:18:48 -0400 Subject: [PATCH] import CS librelp-1.10.0-7.el9 --- ...HEL-192631-fix-ossl-ssl-new-ordering.patch | 58 +++++++++++++++ SOURCES/fix-openssl-fd-double-close.patch | 73 +++++++++++++++++++ SPECS/librelp.spec | 21 +++++- 3 files changed, 149 insertions(+), 3 deletions(-) create mode 100644 SOURCES/RHEL-192631-fix-ossl-ssl-new-ordering.patch create mode 100644 SOURCES/fix-openssl-fd-double-close.patch diff --git a/SOURCES/RHEL-192631-fix-ossl-ssl-new-ordering.patch b/SOURCES/RHEL-192631-fix-ossl-ssl-new-ordering.patch new file mode 100644 index 0000000..e9c90d8 --- /dev/null +++ b/SOURCES/RHEL-192631-fix-ossl-ssl-new-ordering.patch @@ -0,0 +1,58 @@ +From 9bf89ca142bc89d5bf29fc9a437187dd0bffaaa9 Mon Sep 17 00:00:00 2001 +From: Cropi +Date: Wed, 24 Jun 2026 13:07:05 +0200 +Subject: [PATCH] tcp: fix SSL_CONF_cmd/SSL_new ordering in OpenSSL client + connect path + +relpTcpConnectTLSInit_ossl() called SSL_new(ctx) before +relpTcpSetSslConfCmd_ossl(), so SSL_CONF_cmd("Groups", ...) applied via +tls.tlscfgcmd was updating the SSL_CTX after the SSL object had already +captured its group list. On OpenSSL 3.x this caused the client to +advertise the full default group set (including X25519MLKEM768 on 3.5+) +regardless of any Groups restriction in tlsConfigCmd. + +Move pThis->sslState = osslClient and relpTcpSetSslConfCmd_ossl() to +before SSL_new() so the SSL object inherits the correctly configured +SSL_CTX. relpTcpTLSSetPrio() stays after SSL_new() because it operates +on pThis->ssl via SSL_set_cipher_list(). + +Adapted from upstream commit 9bf89ca for librelp-1.10.0 line numbers +(post-downstream-patch context differs from 1.12.0). + +Signed-off-by: Cropi +--- a/src/tcp.c ++++ b/src/tcp.c +@@ -1790,6 +1790,15 @@ + /*if we reach this point we are in tls mode */ + pThis->pEngine->dbgprint((char*)"relpTcpConnectTLSInit: TLS Mode\n"); + ++ /* set before relpTcpSetSslConfCmd_ossl: tlsConfigCmd may contain ++ * flag-restricted commands that require SSL_CONF_FLAG_CLIENT */ ++ pThis->sslState = osslClient; ++ ++ /* SSL_CONF_cmd targets the SSL_CTX; SSL_new() snapshots the SSL_CTX's ++ * group list at construction time, so this must run before SSL_new() ++ * or the SSL object keeps the default groups set by SSL_CTX_new() */ ++ CHKRet(relpTcpSetSslConfCmd_ossl(pThis, pThis->tlsConfigCmd)); ++ + if(!(pThis->ssl = SSL_new(ctx))) { + relpTcpLastSSLErrorMsg(0, pThis, "relpTcpConnectTLSInit"); + ABORT_FINALIZE(RELP_RET_IO_ERR); +@@ -1805,17 +1814,11 @@ + } else + pThis->authmode = eRelpAuthMode_None; + +- /* Set TLS Options if configured */ +- CHKRet(relpTcpSetSslConfCmd_ossl(pThis, pThis->tlsConfigCmd)); +- + /* Set TLS Priority Options */ + CHKRet(relpTcpTLSSetPrio(pThis)); + + SSL_set_ex_data(pThis->ssl, 0, (void*)pThis); + +- /*set client state */ +- pThis->sslState = osslClient; +- + /* Create BIO from ptcp socket! */ + conn = BIO_new_socket(pThis->sock, BIO_NOCLOSE); + pThis->pEngine->dbgprint((char*)"relpTcpConnectTLSInit: Init conn BIO[%p] done\n", (void *)conn); diff --git a/SOURCES/fix-openssl-fd-double-close.patch b/SOURCES/fix-openssl-fd-double-close.patch new file mode 100644 index 0000000..0e29d8e --- /dev/null +++ b/SOURCES/fix-openssl-fd-double-close.patch @@ -0,0 +1,73 @@ +From 940cd1835206ae124e8d213a26723464a949d8c1 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Renaud=20M=C3=A9trich?= +Date: Wed, 1 Jul 2026 13:31:09 +0200 +Subject: [PATCH] openssl: fix fd double-close in relpTcpDestruct + +relpTcpDestruct() closed the socket fd before calling +relpTcpDestructTLS(), causing SSL_shutdown() to operate on an +already-closed fd. Additionally, BIO_new_socket() was called with +BIO_CLOSE, making SSL_free() close the fd a second time via the BIO +destructor. Strace on every TLS teardown: + + shutdown(12, SHUT_RDWR) = 0 + close(12) = 0 # relpTcpDestruct + write(12, ...) = -1 EBADF # SSL_shutdown on closed fd + close(12) = -1 EBADF # SSL_free BIO_CLOSE + +Fix: +- Move relpTcpDestructTLS() before the socket close so SSL_shutdown() + can send the close_notify on a valid fd. +- Change BIO_new_socket() from BIO_CLOSE to BIO_NOCLOSE so SSL_free() + does not close the fd. +- Add conn = NULL after SSL_set_bio() to prevent double-free in the + error path. +--- + src/tcp.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/src/tcp.c b/src/tcp.c +--- a/src/tcp.c ++++ b/src/tcp.c +@@ -781,6 +781,8 @@ + pThis = *ppThis; + RELPOBJ_assert(pThis, Tcp); + ++ relpTcpDestructTLS(pThis); ++ + if(pThis->sock != -1) { + shutdown(pThis->sock, SHUT_RDWR); + close(pThis->sock); +@@ -795,7 +797,6 @@ + } + free(pThis->socks); + } +- relpTcpDestructTLS(pThis); + + free(pThis->pRemHostIP); + free(pThis->pRemHostName); +@@ -1770,7 +1771,7 @@ + pThis->sslState = osslServer; + + /* Create BIO from ptcp socket! */ +- client = BIO_new_socket(pThis->sock, BIO_CLOSE /*BIO_NOCLOSE*/); ++ client = BIO_new_socket(pThis->sock, BIO_NOCLOSE); + pThis->pEngine->dbgprint((char*)"relpTcpAcceptConnReqInitTLS_ossl: Init client BIO[%p] done\n", (void *)client); + + /* Set debug Callback for client BIO as well! */ +@@ -1863,7 +1864,7 @@ + pThis->sslState = osslClient; + + /* Create BIO from ptcp socket! */ +- conn = BIO_new_socket(pThis->sock, BIO_CLOSE /*BIO_NOCLOSE*/); ++ conn = BIO_new_socket(pThis->sock, BIO_NOCLOSE); + pThis->pEngine->dbgprint((char*)"relpTcpConnectTLSInit: Init conn BIO[%p] done\n", (void *)conn); + + /* Set debug Callback for client BIO as well! */ +@@ -1874,6 +1875,7 @@ + BIO_set_nbio( conn, 1 ); + + SSL_set_bio(pThis->ssl, conn, conn); ++ conn = NULL; + SSL_set_connect_state(pThis->ssl); /*sets ssl to work in client mode.*/ + + /* Perform the TLS handshake */ diff --git a/SPECS/librelp.spec b/SPECS/librelp.spec index 038a06f..32a13a3 100644 --- a/SPECS/librelp.spec +++ b/SPECS/librelp.spec @@ -1,7 +1,7 @@ Summary: The Reliable Event Logging Protocol library Name: librelp Version: 1.10.0 -Release: 5%{?dist} +Release: 7%{?dist} License: GPLv3+ URL: http://www.rsyslog.com/ Source0: http://download.rsyslog.com/%{name}/%{name}-%{version}.tar.gz @@ -9,6 +9,11 @@ BuildRequires: gnutls-devel >= 1.4.0 Patch0: librelp-1.10.0-rhbz1972067-relpEngineSetTLSLibByName.patch Patch1: librelp-1.10.0-crypto-compliance.patch +Patch2: fix-openssl-fd-double-close.patch + +# https://github.com/rsyslog/librelp/commit/9bf89ca142bc89d5bf29fc9a437187dd0bffaaa9 +# Resolves: RHEL-192631 +Patch3: RHEL-192631-fix-ossl-ssl-new-ordering.patch %description Librelp is an easy to use library for the RELP protocol. RELP (stands @@ -33,8 +38,10 @@ to develop applications using librelp. %prep %setup -q -%patch0 -p1 -b .tls-by-name -%patch1 -p1 -b .crypto-compliance +%patch -P 0 -p1 -b .tls-by-name +%patch -P 1 -p1 -b .crypto-compliance +%patch -P 2 -p1 +%patch -P 3 -p1 %build autoreconf -ivf @@ -59,6 +66,14 @@ rm $RPM_BUILD_ROOT/%{_libdir}/*.la %{_libdir}/pkgconfig/relp.pc %changelog +* Thu Jul 09 2026 Attila Lakatos - 1.10.0-7 +- Backport: fix SSL_CONF_cmd/SSL_new ordering in OpenSSL client connect path + Resolves: RHEL-192631 + +* Thu Jul 09 2026 Attila Lakatos - 1.10.0-6 +- Backport: fix OpenSSL fd double-close in TLS teardown + Resolves: RHEL-192630 + * Wed Aug 02 2023 Attila Lakatos - 1.10.0-5 - Rebuild resolves: rhbz#2227723