import sscg-3.0.0-7.el9

SOURCES/0004-dhparams-don-t-fail-if-default-file-can-t-be-created.patch

@@ -0,0 +1,139 @@
+From 282f819bc39c9557ee34f73c6f6623182f680792 Mon Sep 17 00:00:00 2001
+From: Stephen Gallagher <sgallagh@redhat.com>
+Date: Wed, 16 Nov 2022 15:27:58 -0500
+Subject: [PATCH] dhparams: don't fail if default file can't be created
+
+Resolves: rhbz#2143206
+
+Signed-off-by: Stephen Gallagher <sgallagh@redhat.com>
+---
+ src/arguments.c |  1 -
+ src/io_utils.c  | 12 +++++++++++
+ src/sscg.c      | 55 +++++++++++++++++++++++++++++++++----------------
+ 3 files changed, 49 insertions(+), 19 deletions(-)
+
+diff --git a/src/arguments.c b/src/arguments.c
+index 7b9da14a732875b0f33a12e22a97d51a78216839..770d834aacc05d6d92cc0c855852eadb88f8c9bc 100644
+--- a/src/arguments.c
++++ b/src/arguments.c
+@@ -69,7 +69,6 @@ set_default_options (struct sscg_options *opts)
+ 
+   opts->lifetime = 398;
+ 
+-  opts->dhparams_file = talloc_strdup (opts, "dhparams.pem");
+   opts->dhparams_group = talloc_strdup (opts, "ffdhe4096");
+   opts->dhparams_generator = 2;
+ 
+diff --git a/src/io_utils.c b/src/io_utils.c
+index 1b8bc41c3849acbe4657ae14dfe55e3010957129..5d34327bdbe450add5326ac20c337c9399b471dc 100644
+--- a/src/io_utils.c
++++ b/src/io_utils.c
+@@ -544,6 +544,18 @@ sscg_io_utils_open_output_files (struct sscg_stream **streams, bool overwrite)
+     {
+       SSCG_LOG (SSCG_DEBUG, "Opening %s\n", stream->path);
+       stream->bio = BIO_new_file (stream->path, create_mode);
++      if (!stream->bio)
++        {
++          fprintf (stderr,
++                   "Could not write to %s. Check directory permissions.\n",
++                   stream->path);
++
++          /* The dhparams file is special, it will be handled later */
++          if (i != SSCG_FILE_TYPE_DHPARAMS)
++            {
++              continue;
++            }
++        }
+       CHECK_BIO (stream->bio, stream->path);
+     }
+ 
+diff --git a/src/sscg.c b/src/sscg.c
+index 1bf8019c2dda136abe56acd101dfe8ad0b3d725d..dcff4cd2b8dfd2e11c8612d36ecc94b175e9dc26 100644
+--- a/src/sscg.c
++++ b/src/sscg.c
+@@ -93,6 +93,7 @@ main (int argc, const char **argv)
+   int ret, sret;
+   struct sscg_options *options;
+   bool build_client_cert = false;
++  char *dhparams_file = NULL;
+ 
+   struct sscg_x509_cert *cacert;
+   struct sscg_evp_pkey *cakey;
+@@ -182,9 +183,19 @@ main (int argc, const char **argv)
+                                        options->crl_mode);
+   CHECK_OK (ret);
+ 
++  if (options->dhparams_file)
++    {
++      dhparams_file = talloc_strdup (main_ctx, options->dhparams_file);
++    }
++  else
++    {
++      dhparams_file = talloc_strdup (main_ctx, "./dhparams.pem");
++    }
++  CHECK_MEM (dhparams_file);
++
+   ret = sscg_io_utils_add_output_file (options->streams,
+                                        SSCG_FILE_TYPE_DHPARAMS,
+-                                       options->dhparams_file,
++                                       dhparams_file,
+                                        options->dhparams_mode);
+   CHECK_OK (ret);
+ 
+@@ -281,28 +292,36 @@ main (int argc, const char **argv)
+ 
+ 
+   /* Create DH parameters file */
+-  bp = GET_BIO (SSCG_FILE_TYPE_DHPARAMS);
+-  if (options->dhparams_prime_len > 0)
++  if ((bp = GET_BIO (SSCG_FILE_TYPE_DHPARAMS)))
+     {
+-      ret = create_dhparams (options->verbosity,
+-                             options->dhparams_prime_len,
+-                             options->dhparams_generator,
+-                             &dhparams);
+-      CHECK_OK (ret);
++      if (options->dhparams_prime_len > 0)
++        {
++          ret = create_dhparams (options->verbosity,
++                                 options->dhparams_prime_len,
++                                 options->dhparams_generator,
++                                 &dhparams);
++          CHECK_OK (ret);
++        }
++      else
++        {
++          ret = get_params_by_named_group (options->dhparams_group, &dhparams);
++          CHECK_OK (ret);
++        }
++
++      /* Export the DH parameters to the file */
++      sret = PEM_write_bio_Parameters (bp, dhparams);
++      CHECK_SSL (sret, PEM_write_bio_Parameters ());
++      ANNOUNCE_WRITE (SSCG_FILE_TYPE_DHPARAMS);
++      EVP_PKEY_free (dhparams);
+     }
+-  else
++  else if (options->dhparams_file)
+     {
+-      ret = get_params_by_named_group (options->dhparams_group, &dhparams);
+-      CHECK_OK (ret);
++      /* A filename was explicitly passed, but it couldn't be created */
++      ret = EPERM;
++      fprintf (stderr, "Could not write to %s: ", options->dhparams_file);
++      goto done;
+     }
+ 
+-  /* Export the DH parameters to the file */
+-  sret = PEM_write_bio_Parameters (bp, dhparams);
+-  CHECK_SSL (sret, PEM_write_bio_Parameters ());
+-  ANNOUNCE_WRITE (SSCG_FILE_TYPE_DHPARAMS);
+-  EVP_PKEY_free (dhparams);
+-
+-
+   /* Set the final file permissions */
+   sscg_io_utils_finalize_output_files (options->streams);
+ 
+-- 
+2.38.1
+

SOURCES/0005-dhparams-Fix-the-FIPS_mode-call-for-OpenSSL-3.0.patch

@@ -0,0 +1,32 @@
+From e65a507c487a37dd5a8c90b7dbd1ff3274146239 Mon Sep 17 00:00:00 2001
+From: Simon Chopin <simon.chopin@canonical.com>
+Date: Mon, 13 Dec 2021 15:20:55 +0100
+Subject: [PATCH 5/5] dhparams: Fix the FIPS_mode() call for OpenSSL 3.0
+
+This function has been removed from OpenSSL 3.0, replaced by
+EVP_default_properties_is_fips_enabled().
+
+Closes #50
+---
+ src/dhparams.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/src/dhparams.c b/src/dhparams.c
+index 5c50128970d48790df910b9f9531e61e1d4c5758..61fd57aeedca47fba49f75d356cd5f42b9586696 100644
+--- a/src/dhparams.c
++++ b/src/dhparams.c
+@@ -231,7 +231,11 @@ is_valid_named_group (const char *group_name)
+     }
+ 
+   /* Check non-FIPS groups */
++#if OPENSSL_VERSION_NUMBER < 0x30000000L
+   if (!FIPS_mode ())
++#else
++  if (!EVP_default_properties_is_fips_enabled(NULL))
++#endif
+     {
+       i = 0;
+       while (dh_nonfips_groups[i])
+-- 
+2.31.1
+

SPECS/sscg.spec

@@ -9,7 +9,7 @@
 
 Name:           sscg
 Version:        3.0.0
-Release:        5%{?dist}
+Release:        7%{?dist}
 Summary:        Simple SSL certificate generator
 
 License:        GPLv3+ with exceptions
@@ -26,10 +26,11 @@ BuildRequires:  ninja-build
 BuildRequires:  help2man
 
 
-Patch0001: 0001-Drop-usage-of-ERR_GET_FUNC.patch
+Patch: 0001-Drop-usage-of-ERR_GET_FUNC.patch
-Patch0002: 0002-Correct-certificate-lifetime-calculation.patch
+Patch: 0002-Correct-certificate-lifetime-calculation.patch
-Patch0003: 0003-Truncate-IP-address-in-SAN.patch
+Patch: 0003-Truncate-IP-address-in-SAN.patch
-
+Patch: 0004-dhparams-don-t-fail-if-default-file-can-t-be-created.patch
+Patch: 0005-dhparams-Fix-the-FIPS_mode-call-for-OpenSSL-3.0.patch
 
 %description
 A utility to aid in the creation of more secure "self-signed"
@@ -60,6 +61,14 @@ false signatures from the service certificate.
 %{_mandir}/man8/%{name}.8*
 
 %changelog
+* Fri Dec 02 2022 Stephen Gallagher <sgallagh@redhat.com> - 3.0.0-6
+- Use EVP_default_properties_is_fips_enabled() on OpenSSL 3.0
+- Related: rhbz#2083879
+
+* Mon Nov 28 2022 Stephen Gallagher <sgallagh@redhat.com> - 3.0.0-6
+- Don't fail if default dhparams file can't be created
+- Resolves: rhbz#2149064
+
 * Wed Mar 09 2022 Stephen Gallagher <sgallagh@redhat.com> - 3.0.0-5
 - Handle IP addresses in subjectAlternativeName correctly
 - Resolves: rhbz#2061923