[rpms/inn] epel10.3: Support OpenSSL 1.1.0

A new commit has been pushed.

Repo   : rpms/inn
Branch : epel10.3
Commit : 5bab5750ef01a0c8f10695763dc1d70605430442
Author : Petr Písař <ppisar@redhat.com>
Date   : 2016-11-25T15:42:01+01:00
Stats  : +142/-1 in 3 file(s)
URL    : https://src.fedoraproject.org/rpms/inn/c/5bab5750ef01a0c8f10695763dc1d70605430442?branch=epel10.3

Log:
Support OpenSSL 1.1.0

---
diff --git a/inn-2.6.0-openssl-1.1-r10024.patch b/inn-2.6.0-openssl-1.1-r10024.patch
new file mode 100644
index 0000000..7014a75
--- /dev/null
+++ b/inn-2.6.0-openssl-1.1-r10024.patch
@@ -0,0 +1,45 @@
+------------------------------------------------------------------------
+r10024 | iulius | 2016-05-05 14:51:24 +0200 (Čt, 05 kvě 2016) | 7 lines
+
+Fix build with OpenSSL 1.1.0 - a few X509_xxx types are now opaque
+
+Check that the current certificate returned by
+X509_STORE_CTX_get_current_cert() is not NULL.  In the switch part,
+err_cert is not NULL though because otherwise the error would have been
+different than X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT.
+
+------------------------------------------------------------------------
+Index: nnrpd/tls.c
+===================================================================
+--- nnrpd/tls.c	(revision 10023)
++++ nnrpd/tls.c	(revision 10024)
+@@ -244,9 +244,13 @@
+     err = X509_STORE_CTX_get_error(ctx);
+     depth = X509_STORE_CTX_get_error_depth(ctx);
+ 
+-    X509_NAME_oneline(X509_get_subject_name(err_cert), buf, sizeof(buf));
+-    if ((tls_serveractive) && (tls_loglevel >= 1))
+-      Printf("Peer cert verify depth=%d %s", depth, buf);
++    if (err_cert != NULL) {
++        X509_NAME_oneline(X509_get_subject_name(err_cert), buf, sizeof(buf));
++        if ((tls_serveractive) && (tls_loglevel >= 1)) {
++            Printf("Peer cert verify depth=%d %s", depth, buf);
++        }
++    }
++    
+     if (ok==0)
+     {
+       syslog(L_NOTICE, "verify error:num=%d:%s", err,
+@@ -260,9 +264,10 @@
+ 	    verify_error = X509_V_ERR_CERT_CHAIN_TOO_LONG;
+ 	}
+     }
+-    switch (ctx->error) {
++
++    switch (err) {
+     case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT:
+-	X509_NAME_oneline(X509_get_issuer_name(ctx->current_cert), buf, sizeof(buf));
++	X509_NAME_oneline(X509_get_issuer_name(err_cert), buf, sizeof(buf));
+ 	syslog(L_NOTICE, "issuer= %s", buf);
+ 	break;
+     case X509_V_ERR_CERT_NOT_YET_VALID:

diff --git a/inn-2.6.0-openssl-1.1-r9998.patch b/inn-2.6.0-openssl-1.1-r9998.patch
new file mode 100644
index 0000000..e13b1c8
--- /dev/null
+++ b/inn-2.6.0-openssl-1.1-r9998.patch
@@ -0,0 +1,84 @@
+------------------------------------------------------------------------
+r9988 | iulius | 2016-03-28 19:47:40 +0200 (Po, 28 bře 2016) | 2 lines
+
+Add support for OpenSSL 1.1.0
+
+Petr Pisar: Ported to 2.6.0.
+------------------------------------------------------------------------
+Index: m4/openssl.m4
+===================================================================
+--- m4/openssl.m4	(revision 9987)
++++ m4/openssl.m4	(revision 9988)
+@@ -28,6 +28,7 @@
+ dnl package, available at <http://www.eyrie.org/~eagle/software/rra-c-util/>.
+ dnl
+ dnl Written by Russ Allbery <eagle@eyrie.org>
++dnl Copyright 2016 Russ Allbery <eagle@eyrie.org>
+ dnl Copyright 2010, 2013
+ dnl     The Board of Trustees of the Leland Stanford Junior University
+ dnl
+@@ -71,10 +72,10 @@
+         [AC_MSG_ERROR([cannot find usable OpenSSL crypto library])])],
+     [$inn_openssl_extra])
+  AS_IF([test x"$inn_reduced_depends" = xtrue],
+-    [AC_CHECK_LIB([ssl], [SSL_library_init], [OPENSSL_LIBS=-lssl],
++    [AC_CHECK_LIB([ssl], [SSL_accept], [OPENSSL_LIBS=-lssl],
+         [AS_IF([test x"$1" = xtrue],
+             [AC_MSG_ERROR([cannot find usable OpenSSL library])])])],
+-    [AC_CHECK_LIB([ssl], [SSL_library_init],
++    [AC_CHECK_LIB([ssl], [SSL_accept],
+         [OPENSSL_LIBS="-lssl $CRYPTO_LIBS"],
+         [AS_IF([test x"$1" = xtrue],
+             [AC_MSG_ERROR([cannot find usable OpenSSL library])])],
+Index: nnrpd/tls.c
+===================================================================
+--- nnrpd/tls.c	(revision 9987)
++++ nnrpd/tls.c	(revision 9988)
+@@ -216,7 +216,10 @@
+ 	default:
+ 		/* We should check current keylength vs. requested keylength
+ 		 * also, this is an extremely expensive operation! */
+-		dh = DH_generate_parameters(keylength, DH_GENERATOR_2, NULL, NULL);
++                dh = DH_new();
++                if (dh != NULL) {
++                    DH_generate_parameters_ex(dh, keylength, DH_GENERATOR_2, NULL);
++                }
+ 		r = dh;
+ 	}
+ 
+@@ -492,10 +495,17 @@
+     if (tls_loglevel >= 2)
+       Printf("starting TLS engine");
+ 
++/* New functions have been introduced in OpenSSL 1.1.0. */
++#if OPENSSL_VERSION_NUMBER < 0x10100000L
+     SSL_load_error_strings();
+     SSLeay_add_ssl_algorithms();
++    CTX = SSL_CTX_new(SSLv23_server_method());
++#else
++    OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS
++                     | OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
++    CTX = SSL_CTX_new(TLS_server_method());
++#endif
+ 
+-    CTX = SSL_CTX_new(SSLv23_server_method());
+     if (CTX == NULL) {
+       return (-1);
+     };
+Index: nnrpd/tls.h
+===================================================================
+--- nnrpd/tls.h	(revision 9987)
++++ nnrpd/tls.h	(revision 9988)
+@@ -22,8 +22,12 @@
+ #ifndef TLS_H
+ #define TLS_H
+ 
++/* Comment out to avoid the use of deprecated interfaces. */
++/* #define OPENSSL_API_COMPAT 0x10100000L */
++
+ #include <openssl/lhash.h>
+ #include <openssl/bn.h>
++#include <openssl/dh.h>
+ #include <openssl/err.h>
+ #include <openssl/pem.h>
+ #include <openssl/rand.h>

diff --git a/inn.spec b/inn.spec
index 325b8ef..15a30c0 100644
--- a/inn.spec
+++ b/inn.spec
@@ -3,7 +3,7 @@
 Summary: The InterNetNews system, an Usenet news server
 Name: inn
 Version: 2.6.0
-Release: 4%{?dist}
+Release: 5%{?dist}
 #see LICENSE file for details
 License: GPLv2+ and BSD and MIT and Public Domain
 Group: System Environment/Daemons
@@ -27,6 +27,11 @@ patch17: inn-2.5.2-pconf.patch
 Patch19: inn-2.5.4-docrun.patch
 # https://inn.eyrie.org/trac/changeset/9955
 Patch20: inn-2.6.0-nofork.patch
+# 1/2 Support OpenSSL 1.1.0, bug #1387660, in upstream 2.6 branch
+Patch21: inn-2.6.0-openssl-1.1-r9998.patch
+# 2/2 Support OpenSSL 1.1.0, bug #1387660, in upstream 2.6 branch
+Patch22: inn-2.6.0-openssl-1.1-r10024.patch
+BuildRequires: autoconf
 BuildRequires: python db4-devel byacc krb5-devel pam-devel e2fsprogs-devel perl
 BuildRequires: perl-devel
 BuildRequires: perl-generators
@@ -111,6 +116,10 @@ exit 0
 %patch17 -p1 -b .pfix
 # %patch19 -p1 -b .docrun
 %patch20 -p1 -b .nofork
+%patch21 -p0
+%patch22 -p0
+
+./autogen
 
 perl -pi -e 's/su news/su -m news/' ./INSTALL
 perl -pi -e 's/LOCK_READ/LLOCK_READ/' `find . -type f`
@@ -556,6 +565,9 @@ fi
 %{_mandir}/man1/inews*
 
 %changelog
+* Fri Nov 25 2016 Petr Pisar <ppisar@redhat.com> - 2.6.0-5
+- Support OpenSSL 1.1.0 (bug #1387660)
+
 * Sat Jul 02 2016 Dominik Mierzejewski <rpm@greysector.net> - 2.6.0-4
 - drop executable bits from systemd service and timer units (#1301180)