Openssl-4 fixes

[pierre]

In ​LFS ticket #5912, a list of packages affected by the move to Openssl-4 has been given. Since then, a few of those packages have been fixed, but not all. I propose to maintain this list here, striking over already treated packages:

• openssh
• git (new version)
• sudo (commit 67cf4c4e12)
• systemd (commit db7234d5ffcc)
• rustc (commit 8314b3388)
• cargo-c (new version)
• lynx
• libarchive
• cryptsetup
• neon
• python (commit 618a288aaa3)
• libnvme
• pipewire
• pulseaudio
• libevent
• cups
• gst-plugins-bad (tests marked as known to fail at 8aca372)
• qca (commit 073fa0ea96)
• urllib3 (tests disabled at 60f66bb5dd241)
• mariadb (see #23282)
• nmap (see #23297)
• wget (commit f8042eccd5)
• Qt6 (commit 64869dc7 and commit 6306e3fc - needed patch and removal of qtopcua submodule)
• openldap (commit 4e4ff408c5)
• krb5 (commit e2aa8bdc2b5)
• ruby (commit b2119fac7b9)
• Net::SSLeay (commit 2deda56c8)
• apache (commit 8aec0a06ae to patches and 23383f0c67 to blfs)
• serf (commit 58eaa1b756)
• wpa_supplicant (commit fc9446d769d6)
• IO::Socket::SSL (commit 34eba49aab)
• libssh2 (seems to work (PL))
• python-3.11 (commit 0f4ffb963389c)
• ntp (commit 425d82c4ea)
• mutt (commit 6fab265f21)
• bind (updated at commit aba6910d61)

[Xi Ruoyao]

cargo-c updated.

[Douglas R. Reno]

Marked OpenSSH, lynx, libarchive, cryptsetup, neon, libnvme, pipewire, pulseaudio, libevent, and CUPS as good. I've done a pretty complete Plasma build with some additional packages over on my new workstation during the past week and can confirm these are good.

[Douglas R. Reno]

I haven't had time to put these in yet with all of the security issues going on, but I do have fixes locally for:

• krb5
• bind/bind-utils
• wpa_supplicant
• OpenLDAP
• Net-SSLeay (update to new version)
• serf
• Ruby

[Douglas R. Reno]

Note that I marked the affected test as known to fail in gst-plugins-bad.

[Douglas R. Reno]

Documented fixes required for Qt6 and commits fixed at.

[Bruce Dubbs]

Just reorganized the description to make it easier to track progress.

[pierre]

I do have a local fix for openldap too. And I've made a patch for krb5 (using information from the LFS ticket). May I commit?

[Douglas R. Reno]

Yes please, go for it!

[pierre]

apache is affected too. Patch at ​https://github.com/apache/httpd/commit/e340b81301e32c9beaddf3c5da068e31a4bdb2b7

[pierre]

apache needs also ​https://github.com/apache/httpd/commit/bdea725e483c16e1a6db99d5a4207220018beb1c

[Bruce Dubbs]

Replying to pierre:

apache needs also ​https://github.com/apache/httpd/commit/bdea725e483c16e1a6db99d5a4207220018beb1c

We already have httpd-2.4.67-openssl4_fixes-1.patch but it hasn't made it into the book yet. I'll do it.

[pierre]

Thanks for the patch. I think the patch is not enough, there are also errors in modules/md/md_ocsp.c

I've made a pull request: ​https://github.com/apache/httpd/pull/652

[Bruce Dubbs]

I don't see any reference to 'ocsp' in my apache build log.

[pierre]

Replying to Bruce Dubbs:

I don't see any reference to 'ocsp' in my apache build log.

I got an error in the file modules/md/md_ocsp.c

[pierre]

Replying to Bruce Dubbs:

I don't see any reference to 'ocsp' in my apache build log.

There is also modules/ssl/ssl_engine_ocsp.c, that we modify in the patch!

[pierre]

The mod_md module in apache is only built if jansson and curl are installed.

[pierre]

Net::SSLeay needs ​https://github.com/radiator-software/p5-net-ssleay/pull/553 in addition to upgrading to 1.96

[Bruce Dubbs]

Replying to pierre:

Net::SSLeay needs ​https://github.com/radiator-software/p5-net-ssleay/pull/553 in addition to upgrading to 1.96

Interesting that the patch is not yet incorporated into cpan.

[pierre]

IO::Socket::SSL has one test failure due to the removal of the TLSv1{,_1,_2}_method functions, that are expected to be present.

Actually Net:SSLeay patch should provide replacements, but it does not seem to work...

[pierre]

Subversion test "crypto" fails, due to the removal of "ENGINE_xxx" functions in OpenSSL. This is the only test failure (in addition to the already known ones), and it is not due to serf. So I think the serf patch in the SSL ticket is sufficient for serf. (I implemented it with a sed:

sed -e 's/nm->d.ia5->length/ASN1_STRING_length(nm->d.ia5)/' \
    -e 's/nm->d.ia5->data/(const char *)ASN1_STRING_get0_data(nm->d.ia5)/' \
    -i buckets/ssl_buckets.c

)

[pierre]

Back to Net::SSLeay: one change in the patch requires a version of ExtUtils::ParseXS posterior to the one bundled with perl-5.42.2!

[pierre]

For bind, 9.20.23 has the fix for OpenSSL-4. It has also a load of security fixes.

[pierre]

Changed slightly the patch for Net::SSLeay, so that now the IO::Socket::SSL tests pass.

[pierre]

curl tests with libssh2 and gssapi enabled worked for me. I think we can remove libssh2 from the list.

[pierre]

ntp added to the list:

ntp_crypto.c:2035:23: error: invalid use of incomplete typedef ‘ASN1_TIME’ {aka 
‘const struct asn1_string_st’}
 2035 |         len = asn1time->length;
      |                       ^~
ntp_crypto.c:2037:43: error: invalid use of incomplete typedef ‘ASN1_TIME’ {aka 
‘const struct asn1_string_st’}
 2037 |         (void)strncpy(v, (char *)(asn1time->data), len);

etc

[pierre]

ntp can be made to build with:

sed -e 's/\([[:alnum:]]*\)->length/ASN1_STRING_length(\1)/'  \
    -e 's/\([[:alnum:]]*\)->data/ASN1_STRING_get0_data(\1)/' \
    -i ntpd/ntp_crypto.c

But there is a more complicated patch upstream: ​https://bugs.ntp.org/show_bug.cgi?id=4023

[pierre]

Python-3.11 builds ok, but seamonkey fails with a missing _ssl module.

[pierre]

The patch for python-3.14 does not apply cleanly...

[pierre]

mutt also:

mutt_ssl.c: In function ‘check_host’:
mutt_ssl.c:985:33: error: invalid use of incomplete typedef ‘ASN1_IA5STRING’ {aka ‘struct asn1_string_st’}
  985 |         if (subj_alt_name->d.ia5->length >= 0 &&
      |                                 ^~
mutt_ssl.c:986:53: error: invalid use of incomplete typedef ‘ASN1_IA5STRING’ {aka ‘struct asn1_string_st’}
  986 |             mutt_strlen((char *)subj_alt_name->d.ia5->data) == (size_t)subj_alt_name->d.ia5->length &&
      |                                                     ^~
mutt_ssl.c:986:92: error: invalid use of incomplete typedef ‘ASN1_IA5STRING’ {aka ‘struct asn1_string_st’}
  986 |             mutt_strlen((char *)subj_alt_name->d.ia5->data) == (size_t)subj_alt_name->d.ia5->length &&
      |                                                                                            ^~
mutt_ssl.c:988:72: error: invalid use of incomplete typedef ‘ASN1_IA5STRING’ {aka ‘struct asn1_string_st’}
  988 |                                           (char *)(subj_alt_name->d.ia5->data))))
      |                                                                        ^~

[pierre]

Made a patch for Python-3.11.1, that allows building the _ssl module and building seamonkey.

[pierre]

ntp patched.

[Joe Locash]

mutt patched.

[pierre]

Looks like we are done.