From 7853f5caad3f6fd2685dd9f6b9c6622cec677891 Mon Sep 17 00:00:00 2001 From: CentOS Sources Date: Tue, 28 Mar 2023 12:13:03 +0000 Subject: [PATCH] import sscg-3.0.0-7.el9 --- ...ail-if-default-file-can-t-be-created.patch | 139 ++++++++++++++++++ ...x-the-FIPS_mode-call-for-OpenSSL-3.0.patch | 32 ++++ SPECS/sscg.spec | 19 ++- 3 files changed, 185 insertions(+), 5 deletions(-) create mode 100644 SOURCES/0004-dhparams-don-t-fail-if-default-file-can-t-be-created.patch create mode 100644 SOURCES/0005-dhparams-Fix-the-FIPS_mode-call-for-OpenSSL-3.0.patch diff --git a/SOURCES/0004-dhparams-don-t-fail-if-default-file-can-t-be-created.patch b/SOURCES/0004-dhparams-don-t-fail-if-default-file-can-t-be-created.patch new file mode 100644 index 0000000..27deba5 --- /dev/null +++ b/SOURCES/0004-dhparams-don-t-fail-if-default-file-can-t-be-created.patch @@ -0,0 +1,139 @@ +From 282f819bc39c9557ee34f73c6f6623182f680792 Mon Sep 17 00:00:00 2001 +From: Stephen Gallagher +Date: Wed, 16 Nov 2022 15:27:58 -0500 +Subject: [PATCH] dhparams: don't fail if default file can't be created + +Resolves: rhbz#2143206 + +Signed-off-by: Stephen Gallagher +--- + src/arguments.c | 1 - + src/io_utils.c | 12 +++++++++++ + src/sscg.c | 55 +++++++++++++++++++++++++++++++++---------------- + 3 files changed, 49 insertions(+), 19 deletions(-) + +diff --git a/src/arguments.c b/src/arguments.c +index 7b9da14a732875b0f33a12e22a97d51a78216839..770d834aacc05d6d92cc0c855852eadb88f8c9bc 100644 +--- a/src/arguments.c ++++ b/src/arguments.c +@@ -69,7 +69,6 @@ set_default_options (struct sscg_options *opts) + + opts->lifetime = 398; + +- opts->dhparams_file = talloc_strdup (opts, "dhparams.pem"); + opts->dhparams_group = talloc_strdup (opts, "ffdhe4096"); + opts->dhparams_generator = 2; + +diff --git a/src/io_utils.c b/src/io_utils.c +index 1b8bc41c3849acbe4657ae14dfe55e3010957129..5d34327bdbe450add5326ac20c337c9399b471dc 100644 +--- a/src/io_utils.c ++++ b/src/io_utils.c +@@ -544,6 +544,18 @@ sscg_io_utils_open_output_files (struct sscg_stream **streams, bool overwrite) + { + SSCG_LOG (SSCG_DEBUG, "Opening %s\n", stream->path); + stream->bio = BIO_new_file (stream->path, create_mode); ++ if (!stream->bio) ++ { ++ fprintf (stderr, ++ "Could not write to %s. Check directory permissions.\n", ++ stream->path); ++ ++ /* The dhparams file is special, it will be handled later */ ++ if (i != SSCG_FILE_TYPE_DHPARAMS) ++ { ++ continue; ++ } ++ } + CHECK_BIO (stream->bio, stream->path); + } + +diff --git a/src/sscg.c b/src/sscg.c +index 1bf8019c2dda136abe56acd101dfe8ad0b3d725d..dcff4cd2b8dfd2e11c8612d36ecc94b175e9dc26 100644 +--- a/src/sscg.c ++++ b/src/sscg.c +@@ -93,6 +93,7 @@ main (int argc, const char **argv) + int ret, sret; + struct sscg_options *options; + bool build_client_cert = false; ++ char *dhparams_file = NULL; + + struct sscg_x509_cert *cacert; + struct sscg_evp_pkey *cakey; +@@ -182,9 +183,19 @@ main (int argc, const char **argv) + options->crl_mode); + CHECK_OK (ret); + ++ if (options->dhparams_file) ++ { ++ dhparams_file = talloc_strdup (main_ctx, options->dhparams_file); ++ } ++ else ++ { ++ dhparams_file = talloc_strdup (main_ctx, "./dhparams.pem"); ++ } ++ CHECK_MEM (dhparams_file); ++ + ret = sscg_io_utils_add_output_file (options->streams, + SSCG_FILE_TYPE_DHPARAMS, +- options->dhparams_file, ++ dhparams_file, + options->dhparams_mode); + CHECK_OK (ret); + +@@ -281,28 +292,36 @@ main (int argc, const char **argv) + + + /* Create DH parameters file */ +- bp = GET_BIO (SSCG_FILE_TYPE_DHPARAMS); +- if (options->dhparams_prime_len > 0) ++ if ((bp = GET_BIO (SSCG_FILE_TYPE_DHPARAMS))) + { +- ret = create_dhparams (options->verbosity, +- options->dhparams_prime_len, +- options->dhparams_generator, +- &dhparams); +- CHECK_OK (ret); ++ if (options->dhparams_prime_len > 0) ++ { ++ ret = create_dhparams (options->verbosity, ++ options->dhparams_prime_len, ++ options->dhparams_generator, ++ &dhparams); ++ CHECK_OK (ret); ++ } ++ else ++ { ++ ret = get_params_by_named_group (options->dhparams_group, &dhparams); ++ CHECK_OK (ret); ++ } ++ ++ /* Export the DH parameters to the file */ ++ sret = PEM_write_bio_Parameters (bp, dhparams); ++ CHECK_SSL (sret, PEM_write_bio_Parameters ()); ++ ANNOUNCE_WRITE (SSCG_FILE_TYPE_DHPARAMS); ++ EVP_PKEY_free (dhparams); + } +- else ++ else if (options->dhparams_file) + { +- ret = get_params_by_named_group (options->dhparams_group, &dhparams); +- CHECK_OK (ret); ++ /* A filename was explicitly passed, but it couldn't be created */ ++ ret = EPERM; ++ fprintf (stderr, "Could not write to %s: ", options->dhparams_file); ++ goto done; + } + +- /* Export the DH parameters to the file */ +- sret = PEM_write_bio_Parameters (bp, dhparams); +- CHECK_SSL (sret, PEM_write_bio_Parameters ()); +- ANNOUNCE_WRITE (SSCG_FILE_TYPE_DHPARAMS); +- EVP_PKEY_free (dhparams); +- +- + /* Set the final file permissions */ + sscg_io_utils_finalize_output_files (options->streams); + +-- +2.38.1 + diff --git a/SOURCES/0005-dhparams-Fix-the-FIPS_mode-call-for-OpenSSL-3.0.patch b/SOURCES/0005-dhparams-Fix-the-FIPS_mode-call-for-OpenSSL-3.0.patch new file mode 100644 index 0000000..d35a8a2 --- /dev/null +++ b/SOURCES/0005-dhparams-Fix-the-FIPS_mode-call-for-OpenSSL-3.0.patch @@ -0,0 +1,32 @@ +From e65a507c487a37dd5a8c90b7dbd1ff3274146239 Mon Sep 17 00:00:00 2001 +From: Simon Chopin +Date: Mon, 13 Dec 2021 15:20:55 +0100 +Subject: [PATCH 5/5] dhparams: Fix the FIPS_mode() call for OpenSSL 3.0 + +This function has been removed from OpenSSL 3.0, replaced by +EVP_default_properties_is_fips_enabled(). + +Closes #50 +--- + src/dhparams.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/src/dhparams.c b/src/dhparams.c +index 5c50128970d48790df910b9f9531e61e1d4c5758..61fd57aeedca47fba49f75d356cd5f42b9586696 100644 +--- a/src/dhparams.c ++++ b/src/dhparams.c +@@ -231,7 +231,11 @@ is_valid_named_group (const char *group_name) + } + + /* Check non-FIPS groups */ ++#if OPENSSL_VERSION_NUMBER < 0x30000000L + if (!FIPS_mode ()) ++#else ++ if (!EVP_default_properties_is_fips_enabled(NULL)) ++#endif + { + i = 0; + while (dh_nonfips_groups[i]) +-- +2.31.1 + diff --git a/SPECS/sscg.spec b/SPECS/sscg.spec index d940fbe..eb650f9 100644 --- a/SPECS/sscg.spec +++ b/SPECS/sscg.spec @@ -9,7 +9,7 @@ Name: sscg Version: 3.0.0 -Release: 5%{?dist} +Release: 7%{?dist} Summary: Simple SSL certificate generator License: GPLv3+ with exceptions @@ -26,10 +26,11 @@ BuildRequires: ninja-build BuildRequires: help2man -Patch0001: 0001-Drop-usage-of-ERR_GET_FUNC.patch -Patch0002: 0002-Correct-certificate-lifetime-calculation.patch -Patch0003: 0003-Truncate-IP-address-in-SAN.patch - +Patch: 0001-Drop-usage-of-ERR_GET_FUNC.patch +Patch: 0002-Correct-certificate-lifetime-calculation.patch +Patch: 0003-Truncate-IP-address-in-SAN.patch +Patch: 0004-dhparams-don-t-fail-if-default-file-can-t-be-created.patch +Patch: 0005-dhparams-Fix-the-FIPS_mode-call-for-OpenSSL-3.0.patch %description A utility to aid in the creation of more secure "self-signed" @@ -60,6 +61,14 @@ false signatures from the service certificate. %{_mandir}/man8/%{name}.8* %changelog +* Fri Dec 02 2022 Stephen Gallagher - 3.0.0-6 +- Use EVP_default_properties_is_fips_enabled() on OpenSSL 3.0 +- Related: rhbz#2083879 + +* Mon Nov 28 2022 Stephen Gallagher - 3.0.0-6 +- Don't fail if default dhparams file can't be created +- Resolves: rhbz#2149064 + * Wed Mar 09 2022 Stephen Gallagher - 3.0.0-5 - Handle IP addresses in subjectAlternativeName correctly - Resolves: rhbz#2061923