rpms/openssl
8
1
Fork 1
Code Issues Pull Requests Releases Activity

In FIPS mode when neither FIPS provider nor FIPS provider configuration is

Browse Source 
present, OpenSSL silently falls back to the default provider.

Resolves: RHEL-213740
This commit is contained in:
Dmitry Belyavskiy 2026-08-13 11:36:03 +02:00
parent d8bc2379c7
commit 251f6280bc
2 changed files with 8 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
0019-FIPS-Force-fips-provider-on.patch
View File

@ -51,6 +51,8 @@ index f2e76ac402..a2a8a9942c 100644
+ OSSL_LIB_CTX *libctx = NCONF_get0_libctx((CONF *)cnf);
+# define FIPS_LOCAL_CONF OPENSSLDIR "/fips_local.cnf"
+
+ if (EVP_default_properties_enable_fips(libctx, 1) != 1)
+ return 0;
+ if (access(FIPS_LOCAL_CONF, R_OK) == 0) {
+ CONF *fips_conf = NCONF_new_ex(libctx, NCONF_default());
+ if (NCONF_load(fips_conf, FIPS_LOCAL_CONF, NULL) <= 0)
@ -67,8 +69,6 @@ index f2e76ac402..a2a8a9942c 100644
+ }
+ if (provider_conf_activate(libctx, "base", NULL, NULL, 0, NULL) != 1)
+ return 0;
+ if (EVP_default_properties_enable_fips(libctx, 1) != 1)
+ return 0;
+ }
+
return 1;

7
openssl.spec
View File

@ -29,7 +29,7 @@ print(string.sub(hash, 0, 16))
Summary: Utilities from the general purpose cryptography library with TLS implementation
Name: openssl
Version: 3.5.7
Release: 2%{?dist}
Release: 3%{?dist}
Epoch: 1
Source0: openssl-%{version}.tar.gz
Source1: fips-hmacify.sh
@ -460,6 +460,11 @@ touch $RPM_BUILD_ROOT/%{_prefix}/include/openssl/engine.h
%ldconfig_scriptlets libs
%changelog
* Thu Aug 13 2026 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.5.7-3
- In FIPS mode when neither FIPS provider nor FIPS provider configuration is
present, OpenSSL silently falls back to the default provider.
Resolves: RHEL-213740
* Tue Jul 07 2026 Pavol Žáčik <pzacik@redhat.com> - 1:3.5.7-2
- Backport https://github.com/openssl/openssl/pull/31818
Resolves: RHEL-192992