crypto: Handle EVP changes in OpenSSL 3

crypto-Handle-EVP-changes-in-OpenSSL-3.patch

@@ -0,0 +1,35 @@
+From 915a3d7fca3beefadd751562abe2d481354a2a9c Mon Sep 17 00:00:00 2001
+From: Robbie Harwood <rharwood@redhat.com>
+Date: Tue, 24 Aug 2021 15:04:13 -0400
+Subject: [PATCH] crypto: Handle EVP changes in OpenSSL 3
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+OpenSSL 3 changes the padding behavior of EVP_DecryptFinal_ex(), which
+causes our decryption to fail.  It is the opnion of the OpenSSL
+developers that mod_auth_gssapi's use of this function was incorrect.
+
+Patch suggested by Tomáš Mráz.
+
+Related: https://github.com/openssl/openssl/issues/16351
+
+Signed-off-by: Robbie Harwood <rharwood@redhat.com>
+(cherry picked from commit 06d1f7d36d2455747e6e8231d28e6524ea1181f1)
+---
+ src/crypto.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/crypto.c b/src/crypto.c
+index 3f372a0..b3f7fd9 100644
+--- a/src/crypto.c
++++ b/src/crypto.c
+@@ -262,7 +262,7 @@ apr_status_t UNSEAL_BUFFER(apr_pool_t *p, struct seal_key *skey,
+ 
+     totlen += outlen;
+     outlen = plain->length - totlen;
+-    ret = EVP_DecryptFinal_ex(ctx, plain->value, &outlen);
++    ret = EVP_DecryptFinal_ex(ctx, plain->value + totlen, &outlen);
+     if (ret == 0) goto done;
+ 
+     totlen += outlen;

mod_auth_gssapi.spec

@@ -1,12 +1,14 @@
 Name:           mod_auth_gssapi
 Version:        1.6.3
-Release:        4%{?dist}
+Release:        5%{?dist}
 Summary:        A GSSAPI Authentication module for Apache
 
 License:        MIT
 URL:            https://github.com/gssapi/mod_auth_gssapi
 Source0:        https://github.com/gssapi/%{name}/releases/download/v%{version}/%name-%{version}.tar.gz
 
+Patch0: crypto-Handle-EVP-changes-in-OpenSSL-3.patch
+
 BuildRequires:  httpd-devel, krb5-devel, openssl-devel
 BuildRequires:  autoconf, automake, libtool, bison, flex, make
 BuildRequires:  git
@@ -24,7 +26,7 @@ The mod_auth_gssapi module is an authentication service that implements the
 SPNEGO based HTTP Authentication protocol defined in RFC4559.
 
 %prep
-%autosetup -S git
+%autosetup -S git_am
 
 %build
 export APXS=%{_httpd_apxs}
@@ -49,6 +51,9 @@ install -m 644 10-auth_gssapi.conf %{buildroot}%{_httpd_modconfdir}
 %{_httpd_moddir}/mod_auth_gssapi.so
 
 %changelog
+* Tue Aug 24 2021 Robbie Harwood <rharwood@redhat.com> - 1.6.3-5
+- crypto: Handle EVP changes in OpenSSL 3
+
 * Thu Jul 22 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.6.3-4
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild