.gitignore

@@ -1,2 +1 @@
-SOURCES/librelp-1.9.0.tar.gz
-/librelp-1.9.0.tar.gz
+SOURCES/librelp-1.10.0.tar.gz

.librelp.metadata

@@ -0,0 +1 @@
+595a718aabe368762d2c14512956bf94364da489 SOURCES/librelp-1.10.0.tar.gz

SOURCES/RHEL-192631-fix-ossl-ssl-new-ordering.patch

@@ -0,0 +1,58 @@
+From 9bf89ca142bc89d5bf29fc9a437187dd0bffaaa9 Mon Sep 17 00:00:00 2001
+From: Cropi <alakatos@redhat.com>
+Date: Wed, 24 Jun 2026 13:07:05 +0200
+Subject: [PATCH] tcp: fix SSL_CONF_cmd/SSL_new ordering in OpenSSL client
+ connect path
+
+relpTcpConnectTLSInit_ossl() called SSL_new(ctx) before
+relpTcpSetSslConfCmd_ossl(), so SSL_CONF_cmd("Groups", ...) applied via
+tls.tlscfgcmd was updating the SSL_CTX after the SSL object had already
+captured its group list.  On OpenSSL 3.x this caused the client to
+advertise the full default group set (including X25519MLKEM768 on 3.5+)
+regardless of any Groups restriction in tlsConfigCmd.
+
+Move pThis->sslState = osslClient and relpTcpSetSslConfCmd_ossl() to
+before SSL_new() so the SSL object inherits the correctly configured
+SSL_CTX.  relpTcpTLSSetPrio() stays after SSL_new() because it operates
+on pThis->ssl via SSL_set_cipher_list().
+
+Adapted from upstream commit 9bf89ca for librelp-1.10.0 line numbers
+(post-downstream-patch context differs from 1.12.0).
+
+Signed-off-by: Cropi <alakatos@redhat.com>
+--- a/src/tcp.c
++++ b/src/tcp.c
+@@ -1790,6 +1790,15 @@
+ 	/*if we reach this point we are in tls mode */
+ 	pThis->pEngine->dbgprint((char*)"relpTcpConnectTLSInit: TLS Mode\n");
+ 
++	/* set before relpTcpSetSslConfCmd_ossl: tlsConfigCmd may contain
++	 * flag-restricted commands that require SSL_CONF_FLAG_CLIENT */
++	pThis->sslState = osslClient;
++
++	/* SSL_CONF_cmd targets the SSL_CTX; SSL_new() snapshots the SSL_CTX's
++	 * group list at construction time, so this must run before SSL_new()
++	 * or the SSL object keeps the default groups set by SSL_CTX_new() */
++	CHKRet(relpTcpSetSslConfCmd_ossl(pThis, pThis->tlsConfigCmd));
++
+ 	if(!(pThis->ssl = SSL_new(ctx))) {
+ 		relpTcpLastSSLErrorMsg(0, pThis, "relpTcpConnectTLSInit");
+ 		ABORT_FINALIZE(RELP_RET_IO_ERR);
+@@ -1805,17 +1814,11 @@
+ 	} else
+ 		pThis->authmode = eRelpAuthMode_None;
+ 
+-	/* Set TLS Options if configured */
+-	CHKRet(relpTcpSetSslConfCmd_ossl(pThis, pThis->tlsConfigCmd));
+-
+ 	/* Set TLS Priority Options */
+ 	CHKRet(relpTcpTLSSetPrio(pThis));
+ 
+ 	SSL_set_ex_data(pThis->ssl, 0, (void*)pThis);
+ 
+-	/*set client state */
+-	pThis->sslState = osslClient;
+-
+ 	/* Create BIO from ptcp socket! */
+ 	conn = BIO_new_socket(pThis->sock, BIO_NOCLOSE);
+ 	pThis->pEngine->dbgprint((char*)"relpTcpConnectTLSInit: Init conn BIO[%p] done\n", (void *)conn);

SOURCES/fix-openssl-fd-double-close.patch

@@ -0,0 +1,73 @@
+From 940cd1835206ae124e8d213a26723464a949d8c1 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Renaud=20M=C3=A9trich?= <rmetrich@redhat.com>
+Date: Wed, 1 Jul 2026 13:31:09 +0200
+Subject: [PATCH] openssl: fix fd double-close in relpTcpDestruct
+
+relpTcpDestruct() closed the socket fd before calling
+relpTcpDestructTLS(), causing SSL_shutdown() to operate on an
+already-closed fd. Additionally, BIO_new_socket() was called with
+BIO_CLOSE, making SSL_free() close the fd a second time via the BIO
+destructor. Strace on every TLS teardown:
+
+  shutdown(12, SHUT_RDWR) = 0
+  close(12)               = 0           # relpTcpDestruct
+  write(12, ...)          = -1 EBADF    # SSL_shutdown on closed fd
+  close(12)               = -1 EBADF    # SSL_free BIO_CLOSE
+
+Fix:
+- Move relpTcpDestructTLS() before the socket close so SSL_shutdown()
+  can send the close_notify on a valid fd.
+- Change BIO_new_socket() from BIO_CLOSE to BIO_NOCLOSE so SSL_free()
+  does not close the fd.
+- Add conn = NULL after SSL_set_bio() to prevent double-free in the
+  error path.
+---
+ src/tcp.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/src/tcp.c b/src/tcp.c
+--- a/src/tcp.c
++++ b/src/tcp.c
+@@ -781,6 +781,8 @@
+ 	pThis = *ppThis;
+ 	RELPOBJ_assert(pThis, Tcp);
+ 
++	relpTcpDestructTLS(pThis);
++
+ 	if(pThis->sock != -1) {
+ 		shutdown(pThis->sock, SHUT_RDWR);
+ 		close(pThis->sock);
+@@ -795,7 +797,6 @@
+ 		}
+ 		free(pThis->socks);
+ 	}
+-	relpTcpDestructTLS(pThis);
+ 
+ 	free(pThis->pRemHostIP);
+ 	free(pThis->pRemHostName);
+@@ -1770,7 +1771,7 @@
+ 	pThis->sslState = osslServer;
+ 
+ 	/* Create BIO from ptcp socket! */
+-	client = BIO_new_socket(pThis->sock, BIO_CLOSE /*BIO_NOCLOSE*/);
++	client = BIO_new_socket(pThis->sock, BIO_NOCLOSE);
+ 	pThis->pEngine->dbgprint((char*)"relpTcpAcceptConnReqInitTLS_ossl: Init client BIO[%p] done\n", (void *)client);
+ 
+ 	/* Set debug Callback for client BIO as well! */
+@@ -1863,7 +1864,7 @@
+ 	pThis->sslState = osslClient;
+ 
+ 	/* Create BIO from ptcp socket! */
+-	conn = BIO_new_socket(pThis->sock, BIO_CLOSE /*BIO_NOCLOSE*/);
++	conn = BIO_new_socket(pThis->sock, BIO_NOCLOSE);
+ 	pThis->pEngine->dbgprint((char*)"relpTcpConnectTLSInit: Init conn BIO[%p] done\n", (void *)conn);
+ 
+ 	/* Set debug Callback for client BIO as well! */
+@@ -1874,6 +1875,7 @@
+ BIO_set_nbio( conn, 1 );
+ 
+ 	SSL_set_bio(pThis->ssl, conn, conn);
++	conn = NULL;
+ 	SSL_set_connect_state(pThis->ssl); /*sets ssl to work in client mode.*/
+ 
+ 	/* Perform the TLS handshake */

SOURCES/librelp-1.10.0-crypto-compliance.patch

@@ -1,6 +1,6 @@
-diff -up librelp-1.9.0/src/tcp.c.orig librelp-1.9.0/src/tcp.c
---- librelp-1.9.0/src/tcp.c.orig	2021-04-26 12:50:02.988053548 +0200
-+++ librelp-1.9.0/src/tcp.c	2021-04-26 15:12:58.292600192 +0200
+diff -up librelp-1.10.0/src/tcp.c.crypto-compliance librelp-1.10.0/src/tcp.c
+--- librelp-1.10.0/src/tcp.c.crypto-compliance	2021-02-16 09:07:24.000000000 +0100
++++ librelp-1.10.0/src/tcp.c	2021-08-17 10:13:53.368936612 +0200
 @@ -1155,32 +1155,8 @@ static relpRetVal LIBRELP_ATTR_NONNULL()
  relpTcpTLSSetPrio_gtls(relpTcp_t *const pThis)
  {
@@ -44,7 +44,7 @@ diff -up librelp-1.9.0/src/tcp.c.orig librelp-1.9.0/src/tcp.c
  
  	if(iRet != RELP_RET_OK) {
  		chkGnutlsCode(pThis, "Failed to set GnuTLS priority", iRet, r);
-@@ -1207,37 +1183,15 @@ relpTcpTLSSetPrio_gtls(LIBRELP_ATTR_UNUS
+@@ -1207,38 +1183,15 @@ relpTcpTLSSetPrio_gtls(LIBRELP_ATTR_UNUS
  static relpRetVal LIBRELP_ATTR_NONNULL()
  relpTcpTLSSetPrio_ossl(relpTcp_t *const pThis)
  {
@@ -69,12 +69,13 @@ diff -up librelp-1.9.0/src/tcp.c.orig librelp-1.9.0/src/tcp.c
 -		pristringBuf[sizeof(pristringBuf)-1] = '\0';
 -		pristring = pristringBuf;
 -	} else {
+-		/* We use custom CipherString if used sets it by SslConfCmd */
 -		pristring = pThis->pristring;
 -	}
  
 -	if ( SSL_set_cipher_list(pThis->ssl, pristring) == 0 ){
 -		pThis->pEngine->dbgprint((char*)"relpTcpTLSSetPrio_ossl: Error setting ciphers '%s'\n", pristring);
-+	if ( SSL_set_cipher_list(pThis->ssl, "PROFILE=SYSTEM") == 0 ){
++	if (SSL_set_cipher_list(pThis->ssl, "PROFILE=SYSTEM") == 0){
 +		pThis->pEngine->dbgprint((char*)"relpTcpTLSSetPrio_ossl: Error setting ciphers to system default\n");
  		ABORT_FINALIZE(RELP_RET_ERR_TLS_SETUP);
  	}

SOURCES/librelp-1.10.0-rhbz1972067-relpEngineSetTLSLibByName.patch

@@ -0,0 +1,15 @@
+diff -up librelp-1.10.0/src/relp.c.orig librelp-1.10.0/src/relp.c
+--- librelp-1.10.0/src/relp.c.orig	2021-08-17 08:33:12.416786299 +0200
++++ librelp-1.10.0/src/relp.c	2021-08-17 08:33:45.070119507 +0200
+@@ -385,9 +385,9 @@ relpEngineSetTLSLibByName(relpEngine_t *
+ 	}
+ 
+ 	if(!strcasecmp(name, "gnutls")) {
+-		relpEngineSetTLSLib(pThis, RELP_USE_GNUTLS);
++		CHKRet(relpEngineSetTLSLib(pThis, RELP_USE_GNUTLS));
+ 	}else if(!strcasecmp(name, "openssl")) {
+-		relpEngineSetTLSLib(pThis, RELP_USE_OPENSSL);
++		CHKRet(relpEngineSetTLSLib(pThis, RELP_USE_OPENSSL));
+ 	} else {
+ 		relpEngineCallOnGenericErr(pThis, "librelp", RELP_RET_PARAM_ERROR,
+ 				"invalid tls lib '%s' requested; this version of "

SPECS/librelp.spec

@@ -1,18 +1,19 @@
 Summary: The Reliable Event Logging Protocol library
 Name: librelp
-Version: 1.9.0
-Release: 1%{?dist}
+Version: 1.10.0
+Release: 7%{?dist}
 License: GPLv3+
-Group: System Environment/Libraries
 URL: http://www.rsyslog.com/
-Source0: http://download.rsyslog.com/librelp/%{name}-%{version}.tar.gz
-Requires(post): /sbin/ldconfig
-Requires(postun): /sbin/ldconfig
-Requires: openssl-libs
+Source0: http://download.rsyslog.com/%{name}/%{name}-%{version}.tar.gz
 BuildRequires: gnutls-devel >= 1.4.0
-BuildRequires: openssl-devel
 
-Patch0: librelp-1.9.0-crypto-compliance.patch
+Patch0: librelp-1.10.0-rhbz1972067-relpEngineSetTLSLibByName.patch
+Patch1: librelp-1.10.0-crypto-compliance.patch
+Patch2: fix-openssl-fd-double-close.patch
+
+# https://github.com/rsyslog/librelp/commit/9bf89ca142bc89d5bf29fc9a437187dd0bffaaa9
+# Resolves: RHEL-192631
+Patch3: RHEL-192631-fix-ossl-ssl-new-ordering.patch
 
 %description
 Librelp is an easy to use library for the RELP protocol. RELP (stands
@@ -21,12 +22,14 @@ logging protocol.
 
 %package devel
 Summary: Development files for the %{name} package
-Group: Development/Libraries
 Requires: %{name} = %{version}-%{release}
 Requires: pkgconfig
+Requires: openssl-libs
 BuildRequires: autoconf
 BuildRequires: automake
 BuildRequires: libtool
+BuildRequires: make
+BuildRequires: openssl-devel
 
 %description devel
 Librelp is an easy to use library for the RELP protocol. The
@@ -35,7 +38,10 @@ to develop applications using librelp.
 
 %prep
 %setup -q
-%patch0 -p1 -b .crypto-compliance
+%patch -P 0 -p1 -b .tls-by-name
+%patch -P 1 -p1 -b .crypto-compliance
+%patch -P 2 -p1
+%patch -P 3 -p1
 
 %build
 autoreconf -ivf
@@ -48,36 +54,85 @@ make install DESTDIR=$RPM_BUILD_ROOT
 
 rm $RPM_BUILD_ROOT/%{_libdir}/*.la
 
-%post -p /sbin/ldconfig
-
-%postun
-if [ "$1" = "0" ] ; then
-    /sbin/ldconfig
-fi
+%ldconfig_scriptlets
 
 %files
-%defattr(-,root,root,-)
 %doc AUTHORS COPYING NEWS README doc/*html
 %{_libdir}/librelp.so.*
 
 %files devel
-%defattr(-,root,root)
 %{_includedir}/*
 %{_libdir}/librelp.so
 %{_libdir}/pkgconfig/relp.pc
 
 %changelog
-* Mon Apr 26 2021 Attila Lakatos <alakatos@redhat.com> - 1.9.0-1
-- rebase to 1.9.0
-- add patch to comply with crypto policies
-- add support for openssl
-  resolves: rhbz#1932783
-- Properly end TLS connections
-  resolves: rhbz#1886400
+* Thu Jul 09 2026 Attila Lakatos <alakatos@redhat.com> - 1.10.0-7
+- Backport: fix SSL_CONF_cmd/SSL_new ordering in OpenSSL client connect path
+  Resolves: RHEL-192631
 
-* Wed Aug 08 2018 Jiri Vymazal <jvymazal@redhat.com> - 1.2.16-1
+* Thu Jul 09 2026 Attila Lakatos <alakatos@redhat.com> - 1.10.0-6
+- Backport: fix OpenSSL fd double-close in TLS teardown
+  Resolves: RHEL-192630
+
+* Wed Aug 02 2023 Attila Lakatos <alakatos@redhat.com> - 1.10.0-5
+- Rebuild
+  resolves: rhbz#2227723
+
+* Fri Aug 06 2021 Attila Lakatos <alakatos@redhat.com> - 1.10.0-4
+- Replace GNUTLS_SHUT_RDWR by GNUTLS_SHUT_WR when ending TLS connections
+  resolves: rhbz#1990735
+- Add patch to comply with crypto policies
+- Forward return code from relpEngineSetTLSLib to relpEngineSetTLSLibByName
+- Enable openssl
+  resolves: rhbz#1972067
+
+* Mon Aug 09 2021 Mohan Boddu <mboddu@redhat.com> - 1.10.0-3
+- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
+  Related: rhbz#1991688
+
+* Fri Apr 16 2021 Mohan Boddu <mboddu@redhat.com> - 1.10.0-2
+- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
+
+* Mon Mar 08 2021 Attila Lakatos <alakatos@redhat.com> - 1.10.0-1
+- rebase to 1.10.0
+  resolves: rhbz#1929153
+
+* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.9.0-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
+
+* Fri Sep 18 2020 Attila Lakatos <alakatos@redhat.com> - 1.9.0-1
+- rebase to 1.9.0
+  resolves: rhbz#1883471
+
+* Tue Sep 08 2020 Attila Lakatos <alakatos@redhat.com> - 1.7.0-1
+- rebase to 1.7.0
+  resolves: rhbz#1826269
+
+* Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.5.0-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
+* Mon Feb 03 2020 Jiri Vymazal <jvymazal@redhat.com> - 1.5.0-1
+- rebase to 1.5.0
+  resolves: rhbz#1790820
+
+* Wed Jan 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.0-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
+
+* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.0-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
+
+* Wed Jul 10 2019 Jiri Vymazal <jvymazal@redhat.com> - 1.4.0-1
+- rebase to 1.4.0
+  resolves: rhbz#1425638
+
+* Fri Feb 01 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.2.16-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
+
+* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.2.16-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
+
+* Mon Jul 02 2018 Radovan Sroka <rsroka@redhat.com> - 1.2.16-1
 - rebase to 1.2.16
-  resolves: rhbz#1613876
 
 * Mon Mar 26 2018 Radovan Sroka <rsroka@redhat.com> - 1.2.15-1
 - rebase to 1.2.15

gating.yaml

@@ -1,6 +0,0 @@
---- !Policy
-product_versions:
-  - rhel-8
-decision_context: osci_compose_gate
-rules:
-  - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tier1.functional}

sources

@@ -1 +0,0 @@
-SHA512 (librelp-1.9.0.tar.gz) = 3cb8cf2707cff662bd0b9100c737458b6b96820db7e362094c77cdb50455fcb944d7760921e0b758a3a6cd15d685f488a976fe909de034c289635c660caae723