From 4f30952208339dd097381e3cea5fae300e6319e1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
Date: Mon, 13 Aug 2018 15:24:37 +0200
Subject: [PATCH] Adapt tests to system-wide crypto policy

openssl-1:1.1.1-0.pre8.2.fc29 started to obey to a system-wide crypto
policy. This affected Net-SSLeay tests. Please note that
openssl-1.1.1-0.pre8.3.fc29 fixed some regressions affecting
Net-SSLeay tests.
---
 ...n_proto_version-tests-to-system-wide.patch | 63 +++++++++++++++++++
 perl-Net-SSLeay.spec                          |  4 ++
 2 files changed, 67 insertions(+)
 create mode 100644 Net-SSLeay-1.85-Adapt-CTX_get_min_proto_version-tests-to-system-wide.patch

diff --git a/Net-SSLeay-1.85-Adapt-CTX_get_min_proto_version-tests-to-system-wide.patch b/Net-SSLeay-1.85-Adapt-CTX_get_min_proto_version-tests-to-system-wide.patch
new file mode 100644
index 0000000..0f26c6c
--- /dev/null
+++ b/Net-SSLeay-1.85-Adapt-CTX_get_min_proto_version-tests-to-system-wide.patch
@@ -0,0 +1,63 @@
+From a00a70b7195438c543191b69382ff20e452548bf Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
+Date: Mon, 13 Aug 2018 12:33:58 +0200
+Subject: [PATCH] Adapt CTX_get_min_proto_version tests to system-wide policy
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+In our distribution, /etc/crypto-policies/back-ends/opensslcnf.config
+can override default minimal SSL/TLS protocol version. If it does,
+t/local/09_ctx_new.t test will fail because OpenSSL will return
+different then 0 value.
+
+This patch parses the configuration file and adjusts expect values in
+the test.
+
+Signed-off-by: Petr Písař <ppisar@redhat.com>
+---
+ t/local/09_ctx_new.t | 22 ++++++++++++++++++++--
+ 1 file changed, 20 insertions(+), 2 deletions(-)
+
+diff --git a/t/local/09_ctx_new.t b/t/local/09_ctx_new.t
+index 6d06f21..c584856 100644
+--- a/t/local/09_ctx_new.t
++++ b/t/local/09_ctx_new.t
+@@ -109,14 +109,32 @@ else
+ # Having TLS_method() does not necessarily that proto getters are available
+ if ($ctx_tls && exists &Net::SSLeay::CTX_get_min_proto_version)
+ {
++    my $min_ver = 0;
++    # Adjust minimal version to system-wide crypto policy
++    if (open(my $f, '<', '/etc/crypto-policies/back-ends/opensslcnf.config')) {
++        while(<$f>) {
++            if (/^MinProtocol = ([\w.]+)\b/) {
++                if ($1 eq 'TLSv1') {
++                    $min_ver = 0x0301;
++                } elsif ($1 eq 'TLSv1.1') {
++                    $min_ver = 0x0302;
++                } elsif ($1 eq 'TLSv1.2') {
++                    $min_ver = 0x0303;
++                } elsif ($1 eq 'TLSv1.3') {
++                    $min_ver = 0x0304;
++                }
++            }
++        }
++        close($f);
++    }
+     my $ver;
+     $ver = Net::SSLeay::CTX_get_min_proto_version($ctx_tls);
+-    is($ver, 0, 'TLS_method CTX has automatic minimum version');
++    is($ver, $min_ver, 'TLS_method CTX has automatic minimum version');
+     $ver = Net::SSLeay::CTX_get_max_proto_version($ctx_tls);
+     is($ver, 0, 'TLS_method CTX has automatic maximum version');
+ 
+     $ver = Net::SSLeay::get_min_proto_version($ssl_tls);
+-    is($ver, 0, 'SSL from TLS_method CTX has automatic minimum version');
++    is($ver, $min_ver, 'SSL from TLS_method CTX has automatic minimum version');
+     $ver = Net::SSLeay::get_max_proto_version($ssl_tls);
+     is($ver, 0, 'SSL from TLS_method CTX has automatic maximum version');
+ 
+-- 
+2.14.4
+
diff --git a/perl-Net-SSLeay.spec b/perl-Net-SSLeay.spec
index 078a63b..411f095 100644
--- a/perl-Net-SSLeay.spec
+++ b/perl-Net-SSLeay.spec
@@ -16,6 +16,8 @@ URL:		https://metacpan.org/release/Net-SSLeay
 Source0:	https://cpan.metacpan.org/authors/id/M/MI/MIKEM/Net-SSLeay-%{version}.tar.gz
 # Adapt to OpenSSL 1.1.1, bug #1614884, CPAN RT#125218
 Patch0:		Net-SSLeay-1.85-Adapt-to-OpenSSL-1.1.1.patch
+# Adapt tests to system-wide crypto policy, bug #1614884
+Patch1:		Net-SSLeay-1.85-Adapt-CTX_get_min_proto_version-tests-to-system-wide.patch
 # =========== Module Build ===========================
 BuildRequires:	coreutils
 BuildRequires:	findutils
@@ -72,6 +74,7 @@ so you can write servers or clients for more complicated applications.
 %prep
 %setup -q -n Net-SSLeay-%{version}
 %patch0 -p1
+%patch1 -p1
 
 # Fix permissions in examples to avoid bogus doc-file dependencies
 chmod -c 644 examples/*
@@ -121,6 +124,7 @@ perl -Iblib/{arch,lib} -MNet::SSLeay -e 'Net::SSLeay::CTX_v3_new()'
 %changelog
 * Mon Aug 13 2018 Petr Pisar <ppisar@redhat.com> - 1.85-4
 - Adapt to OpenSSL 1.1.1 (bug #1614884)
+- Adapt tests to system-wide crypto policy (bug #1614884)
 
 * Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.85-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild