import sscg-3.0.0-7.el9

This commit is contained in:
CentOS Sources 2023-03-28 12:13:03 +00:00 committed by Stepan Oksanichenko
parent e75e2d6647
commit 7853f5caad
3 changed files with 185 additions and 5 deletions

View File

@ -0,0 +1,139 @@
From 282f819bc39c9557ee34f73c6f6623182f680792 Mon Sep 17 00:00:00 2001
From: Stephen Gallagher <sgallagh@redhat.com>
Date: Wed, 16 Nov 2022 15:27:58 -0500
Subject: [PATCH] dhparams: don't fail if default file can't be created
Resolves: rhbz#2143206
Signed-off-by: Stephen Gallagher <sgallagh@redhat.com>
---
src/arguments.c | 1 -
src/io_utils.c | 12 +++++++++++
src/sscg.c | 55 +++++++++++++++++++++++++++++++++----------------
3 files changed, 49 insertions(+), 19 deletions(-)
diff --git a/src/arguments.c b/src/arguments.c
index 7b9da14a732875b0f33a12e22a97d51a78216839..770d834aacc05d6d92cc0c855852eadb88f8c9bc 100644
--- a/src/arguments.c
+++ b/src/arguments.c
@@ -69,7 +69,6 @@ set_default_options (struct sscg_options *opts)
opts->lifetime = 398;
- opts->dhparams_file = talloc_strdup (opts, "dhparams.pem");
opts->dhparams_group = talloc_strdup (opts, "ffdhe4096");
opts->dhparams_generator = 2;
diff --git a/src/io_utils.c b/src/io_utils.c
index 1b8bc41c3849acbe4657ae14dfe55e3010957129..5d34327bdbe450add5326ac20c337c9399b471dc 100644
--- a/src/io_utils.c
+++ b/src/io_utils.c
@@ -544,6 +544,18 @@ sscg_io_utils_open_output_files (struct sscg_stream **streams, bool overwrite)
{
SSCG_LOG (SSCG_DEBUG, "Opening %s\n", stream->path);
stream->bio = BIO_new_file (stream->path, create_mode);
+ if (!stream->bio)
+ {
+ fprintf (stderr,
+ "Could not write to %s. Check directory permissions.\n",
+ stream->path);
+
+ /* The dhparams file is special, it will be handled later */
+ if (i != SSCG_FILE_TYPE_DHPARAMS)
+ {
+ continue;
+ }
+ }
CHECK_BIO (stream->bio, stream->path);
}
diff --git a/src/sscg.c b/src/sscg.c
index 1bf8019c2dda136abe56acd101dfe8ad0b3d725d..dcff4cd2b8dfd2e11c8612d36ecc94b175e9dc26 100644
--- a/src/sscg.c
+++ b/src/sscg.c
@@ -93,6 +93,7 @@ main (int argc, const char **argv)
int ret, sret;
struct sscg_options *options;
bool build_client_cert = false;
+ char *dhparams_file = NULL;
struct sscg_x509_cert *cacert;
struct sscg_evp_pkey *cakey;
@@ -182,9 +183,19 @@ main (int argc, const char **argv)
options->crl_mode);
CHECK_OK (ret);
+ if (options->dhparams_file)
+ {
+ dhparams_file = talloc_strdup (main_ctx, options->dhparams_file);
+ }
+ else
+ {
+ dhparams_file = talloc_strdup (main_ctx, "./dhparams.pem");
+ }
+ CHECK_MEM (dhparams_file);
+
ret = sscg_io_utils_add_output_file (options->streams,
SSCG_FILE_TYPE_DHPARAMS,
- options->dhparams_file,
+ dhparams_file,
options->dhparams_mode);
CHECK_OK (ret);
@@ -281,28 +292,36 @@ main (int argc, const char **argv)
/* Create DH parameters file */
- bp = GET_BIO (SSCG_FILE_TYPE_DHPARAMS);
- if (options->dhparams_prime_len > 0)
+ if ((bp = GET_BIO (SSCG_FILE_TYPE_DHPARAMS)))
{
- ret = create_dhparams (options->verbosity,
- options->dhparams_prime_len,
- options->dhparams_generator,
- &dhparams);
- CHECK_OK (ret);
+ if (options->dhparams_prime_len > 0)
+ {
+ ret = create_dhparams (options->verbosity,
+ options->dhparams_prime_len,
+ options->dhparams_generator,
+ &dhparams);
+ CHECK_OK (ret);
+ }
+ else
+ {
+ ret = get_params_by_named_group (options->dhparams_group, &dhparams);
+ CHECK_OK (ret);
+ }
+
+ /* Export the DH parameters to the file */
+ sret = PEM_write_bio_Parameters (bp, dhparams);
+ CHECK_SSL (sret, PEM_write_bio_Parameters ());
+ ANNOUNCE_WRITE (SSCG_FILE_TYPE_DHPARAMS);
+ EVP_PKEY_free (dhparams);
}
- else
+ else if (options->dhparams_file)
{
- ret = get_params_by_named_group (options->dhparams_group, &dhparams);
- CHECK_OK (ret);
+ /* A filename was explicitly passed, but it couldn't be created */
+ ret = EPERM;
+ fprintf (stderr, "Could not write to %s: ", options->dhparams_file);
+ goto done;
}
- /* Export the DH parameters to the file */
- sret = PEM_write_bio_Parameters (bp, dhparams);
- CHECK_SSL (sret, PEM_write_bio_Parameters ());
- ANNOUNCE_WRITE (SSCG_FILE_TYPE_DHPARAMS);
- EVP_PKEY_free (dhparams);
-
-
/* Set the final file permissions */
sscg_io_utils_finalize_output_files (options->streams);
--
2.38.1

View File

@ -0,0 +1,32 @@
From e65a507c487a37dd5a8c90b7dbd1ff3274146239 Mon Sep 17 00:00:00 2001
From: Simon Chopin <simon.chopin@canonical.com>
Date: Mon, 13 Dec 2021 15:20:55 +0100
Subject: [PATCH 5/5] dhparams: Fix the FIPS_mode() call for OpenSSL 3.0
This function has been removed from OpenSSL 3.0, replaced by
EVP_default_properties_is_fips_enabled().
Closes #50
---
src/dhparams.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/src/dhparams.c b/src/dhparams.c
index 5c50128970d48790df910b9f9531e61e1d4c5758..61fd57aeedca47fba49f75d356cd5f42b9586696 100644
--- a/src/dhparams.c
+++ b/src/dhparams.c
@@ -231,7 +231,11 @@ is_valid_named_group (const char *group_name)
}
/* Check non-FIPS groups */
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
if (!FIPS_mode ())
+#else
+ if (!EVP_default_properties_is_fips_enabled(NULL))
+#endif
{
i = 0;
while (dh_nonfips_groups[i])
--
2.31.1

View File

@ -9,7 +9,7 @@
Name: sscg Name: sscg
Version: 3.0.0 Version: 3.0.0
Release: 5%{?dist} Release: 7%{?dist}
Summary: Simple SSL certificate generator Summary: Simple SSL certificate generator
License: GPLv3+ with exceptions License: GPLv3+ with exceptions
@ -26,10 +26,11 @@ BuildRequires: ninja-build
BuildRequires: help2man BuildRequires: help2man
Patch0001: 0001-Drop-usage-of-ERR_GET_FUNC.patch Patch: 0001-Drop-usage-of-ERR_GET_FUNC.patch
Patch0002: 0002-Correct-certificate-lifetime-calculation.patch Patch: 0002-Correct-certificate-lifetime-calculation.patch
Patch0003: 0003-Truncate-IP-address-in-SAN.patch Patch: 0003-Truncate-IP-address-in-SAN.patch
Patch: 0004-dhparams-don-t-fail-if-default-file-can-t-be-created.patch
Patch: 0005-dhparams-Fix-the-FIPS_mode-call-for-OpenSSL-3.0.patch
%description %description
A utility to aid in the creation of more secure "self-signed" A utility to aid in the creation of more secure "self-signed"
@ -60,6 +61,14 @@ false signatures from the service certificate.
%{_mandir}/man8/%{name}.8* %{_mandir}/man8/%{name}.8*
%changelog %changelog
* Fri Dec 02 2022 Stephen Gallagher <sgallagh@redhat.com> - 3.0.0-6
- Use EVP_default_properties_is_fips_enabled() on OpenSSL 3.0
- Related: rhbz#2083879
* Mon Nov 28 2022 Stephen Gallagher <sgallagh@redhat.com> - 3.0.0-6
- Don't fail if default dhparams file can't be created
- Resolves: rhbz#2149064
* Wed Mar 09 2022 Stephen Gallagher <sgallagh@redhat.com> - 3.0.0-5 * Wed Mar 09 2022 Stephen Gallagher <sgallagh@redhat.com> - 3.0.0-5
- Handle IP addresses in subjectAlternativeName correctly - Handle IP addresses in subjectAlternativeName correctly
- Resolves: rhbz#2061923 - Resolves: rhbz#2061923