Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Work around RHEL8 pooping the bed in OpenSSL's headers #12961

Merged
merged 1 commit into from Jun 28, 2023

Conversation

rgacogne
Copy link
Member

@rgacogne rgacogne commented Jun 28, 2023

Short description

The openssl/kdf.h header on RHEL8 is invalid because someone backported a work-in-progress feature to an older OpenSSL branch and did not bother to backport the fixes that were added later.

Red Hat declined to fix their mess and helpfully suggested we do the work instead in https://bugzilla.redhat.com/show_bug.cgi?id=2215856

This will need to be backported to all the branches we want to support on RHEL 8 and co.

Fixes #12926:

  • before checking whether EVP_PKEY_CTX_set1_scrypt_salt is declared... no
  • after checking whether EVP_PKEY_CTX_set1_scrypt_salt is declared... yes and it actually compiles
# pdns/pdnsutil hash-password
Warning: unable to read configuration file '/usr/local/etc/pdns.conf': No such file or directory
$scrypt$ln=10,p=1,r=8$Vtrf782VeuoQNY9VE7mvUA==$KFn4DGLV0SV4O7Pxunb38MBHr3uCf5SXtfzsf30aeBc=

Checklist

I have:

  • read the CONTRIBUTING.md document
  • compiled this code
  • tested this code
  • included documentation (including possible behaviour changes)
  • documented the code
  • added or modified regression test(s)
  • added or modified unit test(s)

The openssl/kdf.h header on EL8 is invalid because someone backported
a work-in-progress feature to an older OpenSSL branch and did not
bother to backport the fixes that were added later.

Red Hat declined to fix their mess and helpfully suggested we do the
work instead in https://bugzilla.redhat.com/show_bug.cgi?id=2215856
@Habbie
Copy link
Member

Habbie commented Jun 28, 2023

Fixes #12613

should be #12926

@rgacogne
Copy link
Member Author

Fixes #12613

should be #12926

Oops, correct! Sorry but I'm not going to fix it until there is a CVE assigned to it!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

pdnsutil hash-password doesn't work on RHEL8
3 participants