scm-commits November 2022

scm-commits@lists.fedoraproject.org

2 participants
44898 discussions

mstevens pushed to rpms/cacti (epel8). "Update to 1.2.22"
by notifications＠fedoraproject.org 31 Oct '22

31 Oct '22

Notification time stamped 2022-10-22 22:29:23 UTC From 7fce402e46d42b5442d15c7d4c08d7c72062e686 Mon Sep 17 00:00:00 2001 From: Morten Stevens <mstevens(a)fedoraproject.org> Date: Oct 22 2022 22:18:52 +0000 Subject: Update to 1.2.22 --- diff --git a/.gitignore b/.gitignore index e7abb2d..c43553e 100644 --- a/.gitignore +++ b/.gitignore @@ -55,3 +55,4 @@ /cacti-1.2.19.tar.gz /cacti-1.2.20.tar.gz /cacti-1.2.21.tar.gz +/cacti-1.2.22.tar.gz diff --git a/cacti.spec b/cacti.spec index a09517b..e4df6cf 100644 --- a/cacti.spec +++ b/cacti.spec @@ -1,8 +1,8 @@ %{!?_pkgdocdir: %global _pkgdocdir %{_docdir}/%{name}-%{version}} Name: cacti -Version: 1.2.21 -Release: 2%{?dist} +Version: 1.2.22 +Release: 1%{?dist} Summary: An rrd based graphing tool License: GPLv2+ URL: https://www.cacti.net/ @@ -219,6 +219,9 @@ fi %ghost %{_datadir}/%{name}/resource.rpmmoved %changelog +* Sat Oct 22 2022 Morten Stevens <mstevens(a)fedoraproject.org> - 1.2.22-1 +- Update to 1.2.22 + * Wed Jul 20 2022 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.2.21-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild diff --git a/sources b/sources index 813a3b7..ee3ce10 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (cacti-1.2.21.tar.gz) = 084ff9135dd0a92596a4d65f2fd461c8e84907ff87e467f6d144ee3b52ef7aeb44ffa5a8c25e74e5ff25588bc6c5b13b44ab2f24ef5e1c6652513b5c2a39f78d +SHA512 (cacti-1.2.22.tar.gz) = 95e96f8b05b07a1620bc4eae37250ea7e9e49383fe5e2c2993d06b735cb24b95229fb0788b588bc033ab0304ca82119a0cf9d24becb11f2a234c2a612c6dd965 https://src.fedoraproject.org/rpms/cacti/c/7fce402e46d42b5442d15c7d4c08d7c7…

1 0

pemensik pushed to rpms/bind (rawhide). "Start using DEFAULT_HMAC configured variable (..more)"
by notifications＠fedoraproject.org 31 Oct '22

31 Oct '22

Notification time stamped 2022-10-22 22:27:15 UTC From 21fe71bc4651ed668ae90d3de0f7db80ad262a14 Mon Sep 17 00:00:00 2001 From: Petr Menšík <pemensik(a)redhat.com> Date: Oct 22 2022 22:13:43 +0000 Subject: Start using DEFAULT_HMAC configured variable Do not replace hmac-md5 with fixed algorithm. But use default variable used by more recent versions. --- diff --git a/bind-9.11-fips-tests.patch b/bind-9.11-fips-tests.patch index 072419f..25f0e76 100644 --- a/bind-9.11-fips-tests.patch +++ b/bind-9.11-fips-tests.patch @@ -1,4 +1,4 @@ -From 2ad42c7c23858f12d977526d6ebc3465907d7b1b Mon Sep 17 00:00:00 2001 +From f7d0320466815001b0fdf85f85a436f39463287e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik(a)redhat.com> Date: Thu, 2 Aug 2018 23:46:45 +0200 Subject: [PATCH] FIPS tests changes @@ -57,6 +57,8 @@ Date: Wed Mar 7 10:44:23 2018 +0100 Change tests to not use hmac-md5 algorithms if not required Use hmac-sha256 instead of default hmac-md5 for allow-query + +Use DEFAULT_HMAC configured variable --- bin/tests/system/acl/ns2/named1.conf.in | 4 +- bin/tests/system/acl/ns2/named2.conf.in | 4 +- @@ -73,26 +75,35 @@ Date: Wed Mar 7 10:44:23 2018 +0100 .../system/allow-query/ns2/named40.conf.in | 4 +- bin/tests/system/allow-query/tests.sh | 18 ++--- bin/tests/system/catz/ns1/named.conf.in | 2 +- + bin/tests/system/catz/ns2/named1.conf.in | 2 +- + bin/tests/system/catz/ns2/named2.conf.in | 2 +- bin/tests/system/checkconf/bad-tsig.conf | 2 +- bin/tests/system/checkconf/good.conf | 2 +- + bin/tests/system/cookie/ns1/named.conf.in | 2 +- + bin/tests/system/dnssec/ns4/named5.conf.in | 2 +- bin/tests/system/feature-test.c | 14 ++++ bin/tests/system/notify/ns5/named.conf.in | 6 +- bin/tests/system/notify/tests.sh | 6 +- bin/tests/system/nsupdate/ns1/named.conf.in | 2 +- bin/tests/system/nsupdate/ns2/named.conf.in | 2 +- + bin/tests/system/nsupdate/ns9/named.conf.in | 2 +- bin/tests/system/nsupdate/setup.sh | 6 +- bin/tests/system/nsupdate/tests.sh | 9 ++- + bin/tests/system/rndc/ns2/named.conf.in | 2 +- + bin/tests/system/rndc/ns3/named.conf.in | 2 +- bin/tests/system/rndc/setup.sh | 2 +- bin/tests/system/rndc/tests.sh | 22 +++--- bin/tests/system/tsig/ns1/named.conf.in | 10 +-- + bin/tests/system/tsig/ns1/rndc5.conf.in | 10 +++ bin/tests/system/tsig/setup.sh | 5 ++ bin/tests/system/tsig/tests.sh | 67 ++++++++++++------- bin/tests/system/upforwd/ns1/named.conf.in | 2 +- bin/tests/system/upforwd/tests.sh | 2 +- - 31 files changed, 147 insertions(+), 106 deletions(-) + 39 files changed, 164 insertions(+), 113 deletions(-) + create mode 100644 bin/tests/system/tsig/ns1/rndc5.conf.in diff --git a/bin/tests/system/acl/ns2/named1.conf.in b/bin/tests/system/acl/ns2/named1.conf.in -index 8787c6a..b781d0b 100644 +index 8787c6a..682ba97 100644 --- a/bin/tests/system/acl/ns2/named1.conf.in +++ b/bin/tests/system/acl/ns2/named1.conf.in @@ -35,12 +35,12 @@ options { @@ -100,18 +111,18 @@ index 8787c6a..b781d0b 100644 key one { - algorithm hmac-md5; -+ algorithm hmac-sha256; ++ algorithm @DEFAULT_HMAC@; secret "1234abcd8765"; }; key two { - algorithm hmac-md5; -+ algorithm hmac-sha256; ++ algorithm @DEFAULT_HMAC@; secret "1234abcd8765"; }; diff --git a/bin/tests/system/acl/ns2/named2.conf.in b/bin/tests/system/acl/ns2/named2.conf.in -index a95b4c1..3f3f471 100644 +index a95b4c1..7b1cea6 100644 --- a/bin/tests/system/acl/ns2/named2.conf.in +++ b/bin/tests/system/acl/ns2/named2.conf.in @@ -35,12 +35,12 @@ options { @@ -119,18 +130,18 @@ index a95b4c1..3f3f471 100644 key one { - algorithm hmac-md5; -+ algorithm hmac-sha256; ++ algorithm @DEFAULT_HMAC@; secret "1234abcd8765"; }; key two { - algorithm hmac-md5; -+ algorithm hmac-sha256; ++ algorithm @DEFAULT_HMAC@; secret "1234abcd8765"; }; diff --git a/bin/tests/system/acl/ns2/named3.conf.in b/bin/tests/system/acl/ns2/named3.conf.in -index 14cc3fe..9507706 100644 +index 14cc3fe..6b35ba5 100644 --- a/bin/tests/system/acl/ns2/named3.conf.in +++ b/bin/tests/system/acl/ns2/named3.conf.in @@ -35,17 +35,17 @@ options { @@ -138,24 +149,24 @@ index 14cc3fe..9507706 100644 key one { - algorithm hmac-md5; -+ algorithm hmac-sha256; ++ algorithm @DEFAULT_HMAC@; secret "1234abcd8765"; }; key two { - algorithm hmac-md5; -+ algorithm hmac-sha256; ++ algorithm @DEFAULT_HMAC@; secret "1234abcd8765"; }; key three { - algorithm hmac-md5; -+ algorithm hmac-sha256; ++ algorithm @DEFAULT_HMAC@; secret "1234abcd8765"; }; diff --git a/bin/tests/system/acl/ns2/named4.conf.in b/bin/tests/system/acl/ns2/named4.conf.in -index 77cf110..029c91b 100644 +index 77cf110..b23a1ca 100644 --- a/bin/tests/system/acl/ns2/named4.conf.in +++ b/bin/tests/system/acl/ns2/named4.conf.in @@ -35,12 +35,12 @@ options { @@ -163,18 +174,18 @@ index 77cf110..029c91b 100644 key one { - algorithm hmac-md5; -+ algorithm hmac-sha256; ++ algorithm @DEFAULT_HMAC@; secret "1234abcd8765"; }; key two { - algorithm hmac-md5; -+ algorithm hmac-sha256; ++ algorithm @DEFAULT_HMAC@; secret "1234abcd8765"; }; diff --git a/bin/tests/system/acl/ns2/named5.conf.in b/bin/tests/system/acl/ns2/named5.conf.in -index 5ccabf9..6154797 100644 +index 5ccabf9..52791aa 100644 --- a/bin/tests/system/acl/ns2/named5.conf.in +++ b/bin/tests/system/acl/ns2/named5.conf.in @@ -37,12 +37,12 @@ options { @@ -182,13 +193,13 @@ index 5ccabf9..6154797 100644 key one { - algorithm hmac-md5; -+ algorithm hmac-sha256; ++ algorithm @DEFAULT_HMAC@; secret "1234abcd8765"; }; key two { - algorithm hmac-md5; -+ algorithm hmac-sha256; ++ algorithm @DEFAULT_HMAC@; secret "1234abcd8765"; }; @@ -319,7 +330,7 @@ index ad98fa1..7a7ff4a 100644 echo_i "testing allow-query-on ACL processing" diff --git a/bin/tests/system/allow-query/ns2/named10.conf.in b/bin/tests/system/allow-query/ns2/named10.conf.in -index b91d19a..7d777c2 100644 +index b91d19a..ae485e8 100644 --- a/bin/tests/system/allow-query/ns2/named10.conf.in +++ b/bin/tests/system/allow-query/ns2/named10.conf.in @@ -12,7 +12,7 @@ @@ -327,12 +338,12 @@ index b91d19a..7d777c2 100644 key one { - algorithm hmac-md5; -+ algorithm hmac-sha256; ++ algorithm @DEFAULT_HMAC@; secret "1234abcd8765"; }; diff --git a/bin/tests/system/allow-query/ns2/named11.conf.in b/bin/tests/system/allow-query/ns2/named11.conf.in -index 308c4ca..00f6f40 100644 +index 308c4ca..8a5e806 100644 --- a/bin/tests/system/allow-query/ns2/named11.conf.in +++ b/bin/tests/system/allow-query/ns2/named11.conf.in @@ -12,12 +12,12 @@ @@ -340,18 +351,18 @@ index 308c4ca..00f6f40 100644 key one { - algorithm hmac-md5; -+ algorithm hmac-sha256; ++ algorithm @DEFAULT_HMAC@; secret "1234abcd8765"; }; key two { - algorithm hmac-md5; -+ algorithm hmac-sha256; ++ algorithm @DEFAULT_HMAC@; secret "1234efgh8765"; }; diff --git a/bin/tests/system/allow-query/ns2/named12.conf.in b/bin/tests/system/allow-query/ns2/named12.conf.in -index 6b0fe55..491e514 100644 +index 6b0fe55..a10c6d0 100644 --- a/bin/tests/system/allow-query/ns2/named12.conf.in +++ b/bin/tests/system/allow-query/ns2/named12.conf.in @@ -12,7 +12,7 @@ @@ -359,12 +370,12 @@ index 6b0fe55..491e514 100644 key one { - algorithm hmac-md5; -+ algorithm hmac-sha256; ++ algorithm @DEFAULT_HMAC@; secret "1234abcd8765"; }; diff --git a/bin/tests/system/allow-query/ns2/named30.conf.in b/bin/tests/system/allow-query/ns2/named30.conf.in -index aefc474..7c06596 100644 +index aefc474..52981a7 100644 --- a/bin/tests/system/allow-query/ns2/named30.conf.in +++ b/bin/tests/system/allow-query/ns2/named30.conf.in @@ -12,7 +12,7 @@ @@ -372,12 +383,12 @@ index aefc474..7c06596 100644 key one { - algorithm hmac-md5; -+ algorithm hmac-sha256; ++ algorithm @DEFAULT_HMAC@; secret "1234abcd8765"; }; diff --git a/bin/tests/system/allow-query/ns2/named31.conf.in b/bin/tests/system/allow-query/ns2/named31.conf.in -index 27eccc2..eecb990 100644 +index 27eccc2..f627870 100644 --- a/bin/tests/system/allow-query/ns2/named31.conf.in +++ b/bin/tests/system/allow-query/ns2/named31.conf.in @@ -12,12 +12,12 @@ @@ -385,18 +396,18 @@ index 27eccc2..eecb990 100644 key one { - algorithm hmac-md5; -+ algorithm hmac-sha256; ++ algorithm @DEFAULT_HMAC@; secret "1234abcd8765"; }; key two { - algorithm hmac-md5; -+ algorithm hmac-sha256; ++ algorithm @DEFAULT_HMAC@; secret "1234efgh8765"; }; diff --git a/bin/tests/system/allow-query/ns2/named32.conf.in b/bin/tests/system/allow-query/ns2/named32.conf.in -index adbb203..744d122 100644 +index adbb203..6fd516b 100644 --- a/bin/tests/system/allow-query/ns2/named32.conf.in +++ b/bin/tests/system/allow-query/ns2/named32.conf.in @@ -12,7 +12,7 @@ @@ -404,12 +415,12 @@ index adbb203..744d122 100644 key one { - algorithm hmac-md5; -+ algorithm hmac-sha256; ++ algorithm @DEFAULT_HMAC@; secret "1234abcd8765"; }; diff --git a/bin/tests/system/allow-query/ns2/named40.conf.in b/bin/tests/system/allow-query/ns2/named40.conf.in -index 364f94b..9518f82 100644 +index 364f94b..de37915 100644 --- a/bin/tests/system/allow-query/ns2/named40.conf.in +++ b/bin/tests/system/allow-query/ns2/named40.conf.in @@ -16,12 +16,12 @@ acl accept { 10.53.0.2; }; @@ -417,13 +428,13 @@ index 364f94b..9518f82 100644 key one { - algorithm hmac-md5; -+ algorithm hmac-sha256; ++ algorithm @DEFAULT_HMAC@; secret "1234abcd8765"; }; key two { - algorithm hmac-md5; -+ algorithm hmac-sha256; ++ algorithm @DEFAULT_HMAC@; secret "1234efgh8765"; }; @@ -513,7 +524,7 @@ index 01a13cf..3711c63 100644 grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1 grep '^a.keydisallow.example' dig.out.ns2.$n > /dev/null && ret=1 diff --git a/bin/tests/system/catz/ns1/named.conf.in b/bin/tests/system/catz/ns1/named.conf.in -index 3a8e401..82e720d 100644 +index 3a8e401..052ae3f 100644 --- a/bin/tests/system/catz/ns1/named.conf.in +++ b/bin/tests/system/catz/ns1/named.conf.in @@ -122,7 +122,7 @@ view "ch" ch { @@ -521,10 +532,34 @@ index 3a8e401..82e720d 100644 key tsig_key. { secret "LSAnCU+Z"; - algorithm hmac-md5; -+ algorithm hmac-sha256; ++ algorithm @DEFAULT_HMAC@; }; key next_key. { +diff --git a/bin/tests/system/catz/ns2/named1.conf.in b/bin/tests/system/catz/ns2/named1.conf.in +index 23383ed..5a7babd 100644 +--- a/bin/tests/system/catz/ns2/named1.conf.in ++++ b/bin/tests/system/catz/ns2/named1.conf.in +@@ -165,7 +165,7 @@ view "ch" ch { + + key tsig_key. { + secret "LSAnCU+Z"; +- algorithm hmac-md5; ++ algorithm @DEFAULT_HMAC@; + }; + + key next_key. { +diff --git a/bin/tests/system/catz/ns2/named2.conf.in b/bin/tests/system/catz/ns2/named2.conf.in +index 62b76a6..cd5f2b9 100644 +--- a/bin/tests/system/catz/ns2/named2.conf.in ++++ b/bin/tests/system/catz/ns2/named2.conf.in +@@ -122,5 +122,5 @@ view "ch" ch { + + key tsig_key. { + secret "LSAnCU+Z"; +- algorithm hmac-md5; ++ algorithm @DEFAULT_HMAC@; + }; diff --git a/bin/tests/system/checkconf/bad-tsig.conf b/bin/tests/system/checkconf/bad-tsig.conf index 4af25b0..9f202d5 100644 --- a/bin/tests/system/checkconf/bad-tsig.conf @@ -550,6 +585,30 @@ index 154bf75..e7a05cd 100644 + algorithm "hmac-sha256"; secret "qwertyuiopasdfgh"; }; +diff --git a/bin/tests/system/cookie/ns1/named.conf.in b/bin/tests/system/cookie/ns1/named.conf.in +index 1304303..e9c28c6 100644 +--- a/bin/tests/system/cookie/ns1/named.conf.in ++++ b/bin/tests/system/cookie/ns1/named.conf.in +@@ -18,7 +18,7 @@ key rndc_key { + + key foo { + secret "aaaaaaaaaaaa"; +- algorithm hmac-sha256; ++ algorithm @DEFAULT_HMAC@; + }; + + server 10.53.0.10 { +diff --git a/bin/tests/system/dnssec/ns4/named5.conf.in b/bin/tests/system/dnssec/ns4/named5.conf.in +index f1b817a..e457062 100644 +--- a/bin/tests/system/dnssec/ns4/named5.conf.in ++++ b/bin/tests/system/dnssec/ns4/named5.conf.in +@@ -35,5 +35,5 @@ controls { + + key auth { + secret "1234abcd8765"; +- algorithm hmac-sha256; ++ algorithm @DEFAULT_HMAC@; + }; diff --git a/bin/tests/system/feature-test.c b/bin/tests/system/feature-test.c index 3435c91..aaaa264 100644 --- a/bin/tests/system/feature-test.c @@ -583,7 +642,7 @@ index 3435c91..aaaa264 100644 #if defined(IPPROTO_IPV6) && defined(IPV6_V6ONLY) int s; diff --git a/bin/tests/system/notify/ns5/named.conf.in b/bin/tests/system/notify/ns5/named.conf.in -index 5cab276..d4a7bf3 100644 +index 5cab276..c0492e1 100644 --- a/bin/tests/system/notify/ns5/named.conf.in +++ b/bin/tests/system/notify/ns5/named.conf.in @@ -12,17 +12,17 @@ @@ -591,19 +650,19 @@ index 5cab276..d4a7bf3 100644 key "a" { - algorithm "hmac-md5"; -+ algorithm "hmac-sha256"; ++ algorithm "@DEFAULT_HMAC@"; secret "aaaaaaaaaaaaaaaaaaaa"; }; key "b" { - algorithm "hmac-md5"; -+ algorithm "hmac-sha256"; ++ algorithm "@DEFAULT_HMAC@"; secret "bbbbbbbbbbbbbbbbbbbb"; }; key "c" { - algorithm "hmac-md5"; -+ algorithm "hmac-sha256"; ++ algorithm "@DEFAULT_HMAC@"; secret "cccccccccccccccccccc"; }; @@ -658,6 +717,19 @@ index c85eef5..428b6b1 100644 secret "1234abcd8765"; }; +diff --git a/bin/tests/system/nsupdate/ns9/named.conf.in b/bin/tests/system/nsupdate/ns9/named.conf.in +index 6a7ff88..0b70745 100644 +--- a/bin/tests/system/nsupdate/ns9/named.conf.in ++++ b/bin/tests/system/nsupdate/ns9/named.conf.in +@@ -32,7 +32,7 @@ key rndc_key { + + key subkey { + secret "1234abcd8765"; +- algorithm hmac-sha256; ++ algorithm @DEFAULT_HMAC@; + }; + + controls { diff --git a/bin/tests/system/nsupdate/setup.sh b/bin/tests/system/nsupdate/setup.sh index 50056dc..a4a1a3f 100644 --- a/bin/tests/system/nsupdate/setup.sh @@ -702,6 +774,32 @@ index 0bb9d00..ecbc0df 100755 $DIG $DIGOPTS +short @10.53.0.1 ${alg}.keytests.nil | grep 10.10.10.3 > /dev/null 2>&1 || ret=1 done if [ $ret -ne 0 ]; then +diff --git a/bin/tests/system/rndc/ns2/named.conf.in b/bin/tests/system/rndc/ns2/named.conf.in +index 117a5f4..be1af25 100644 +--- a/bin/tests/system/rndc/ns2/named.conf.in ++++ b/bin/tests/system/rndc/ns2/named.conf.in +@@ -27,7 +27,7 @@ key rndc_key { + + key secondkey { + secret "abcd1234abcd8765"; +- algorithm hmac-sha256; ++ algorithm @DEFAULT_HMAC@; + }; + + controls { +diff --git a/bin/tests/system/rndc/ns3/named.conf.in b/bin/tests/system/rndc/ns3/named.conf.in +index 3078e90..fd97ca2 100644 +--- a/bin/tests/system/rndc/ns3/named.conf.in ++++ b/bin/tests/system/rndc/ns3/named.conf.in +@@ -25,7 +25,7 @@ key rndc_key { + + key secondkey { + secret "abcd1234abcd8765"; +- algorithm hmac-sha256; ++ algorithm @DEFAULT_HMAC@; + }; + + controls { diff --git a/bin/tests/system/rndc/setup.sh b/bin/tests/system/rndc/setup.sh index 4dd6fa7..1b79263 100644 --- a/bin/tests/system/rndc/setup.sh @@ -776,6 +874,22 @@ index 76cf970..22637af 100644 key "sha1-trunc" { secret "FrSt77yPTFx6hTs4i2tKLB9LmE0="; +diff --git a/bin/tests/system/tsig/ns1/rndc5.conf.in b/bin/tests/system/tsig/ns1/rndc5.conf.in +new file mode 100644 +index 0000000..0682194 +--- /dev/null ++++ b/bin/tests/system/tsig/ns1/rndc5.conf.in +@@ -0,0 +1,10 @@ ++# Conditionally included when support for MD5 is available ++key "md5" { ++ secret "97rnFx24Tfna4mHPfgnerA=="; ++ algorithm hmac-md5; ++}; ++ ++key "md5-trunc" { ++ secret "97rnFx24Tfna4mHPfgnerA=="; ++ algorithm hmac-md5-80; ++}; diff --git a/bin/tests/system/tsig/setup.sh b/bin/tests/system/tsig/setup.sh index 34cc73b..d51ff21 100644 --- a/bin/tests/system/tsig/setup.sh @@ -882,7 +996,7 @@ index 1067227..ee05e83 100644 echo_i "fetching using hmac-sha1-80 (BADTRUNC)" diff --git a/bin/tests/system/upforwd/ns1/named.conf.in b/bin/tests/system/upforwd/ns1/named.conf.in -index c2b57dd..cb13aa1 100644 +index c2b57dd..ea744f8 100644 --- a/bin/tests/system/upforwd/ns1/named.conf.in +++ b/bin/tests/system/upforwd/ns1/named.conf.in @@ -12,7 +12,7 @@ @@ -890,7 +1004,7 @@ index c2b57dd..cb13aa1 100644 key "update.example." { - algorithm "hmac-md5"; -+ algorithm "hmac-sha256"; ++ algorithm "@DEFAULT_HMAC@"; secret "c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K"; }; https://src.fedoraproject.org/rpms/bind/c/21fe71bc4651ed668ae90d3de0f7db80a…

1 0

pemensik pushed to rpms/bind-dyndb-ldap (rawhide). "Rebuilt for BIND 9.18.8 (#2136100)"
by notifications＠fedoraproject.org 31 Oct '22

31 Oct '22

Notification time stamped 2022-10-22 22:27:28 UTC From f11c23361fe5cad1bc2f789251a2cc7ec5654d45 Mon Sep 17 00:00:00 2001 From: Petr Menšík <pemensik(a)redhat.com> Date: Oct 22 2022 20:28:58 +0000 Subject: Rebuilt for BIND 9.18.8 (#2136100) --- diff --git a/bind-dyndb-ldap.spec b/bind-dyndb-ldap.spec index 0e1910a..f2f563e 100644 --- a/bind-dyndb-ldap.spec +++ b/bind-dyndb-ldap.spec @@ -12,7 +12,7 @@ Name: bind-dyndb-ldap Version: 11.10 -Release: 6%{?dist} +Release: 7%{?dist} Summary: LDAP back-end plug-in for BIND License: GPLv2+ @@ -114,6 +114,9 @@ sed -i.bak -e "$SEDSCRIPT" /etc/named.conf %changelog +* Sat Oct 22 2022 Petr Menšík <pemensik(a)redhat.com> - 11.10-7 +- Rebuilt for BIND 9.18.8 (#2136100) + * Wed Sep 21 2022 Petr Menšík <pemensik(a)redhat.com> - 11.10-6 - Rebuild for BIND 9.18.7 (#2128609) https://src.fedoraproject.org/rpms/bind-dyndb-ldap/c/f11c23361fe5cad1bc2f78…

1 0

pemensik pushed to rpms/bind (rawhide). "Update to 9.18.8 (#2136100) (..more)"
by notifications＠fedoraproject.org 31 Oct '22

31 Oct '22

Notification time stamped 2022-10-22 22:27:15 UTC From 99fd53a10661f8de99fb9d335c37f8e891d4455a Mon Sep 17 00:00:00 2001 From: Petr Menšík <pemensik(a)redhat.com> Date: Oct 22 2022 20:07:38 +0000 Subject: Update to 9.18.8 (#2136100) https://downloads.isc.org/isc/bind9/9.18.8/doc/arm/html/notes.html#notes-fo… --- diff --git a/.gitignore b/.gitignore index c6e3afe..d9ce40c 100644 --- a/.gitignore +++ b/.gitignore @@ -192,3 +192,5 @@ bind-9.7.2b1.tar.gz /bind-9.18.6.tar.xz.asc /bind-9.18.7.tar.xz /bind-9.18.7.tar.xz.asc +/bind-9.18.8.tar.xz +/bind-9.18.8.tar.xz.asc diff --git a/bind-9.11-fips-tests.patch b/bind-9.11-fips-tests.patch index 415a87a..072419f 100644 --- a/bind-9.11-fips-tests.patch +++ b/bind-9.11-fips-tests.patch @@ -1,4 +1,4 @@ -From b1e27453fadcf8ce453beed5b896ad995dfb5534 Mon Sep 17 00:00:00 2001 +From 2ad42c7c23858f12d977526d6ebc3465907d7b1b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik(a)redhat.com> Date: Thu, 2 Aug 2018 23:46:45 +0200 Subject: [PATCH] FIPS tests changes @@ -428,10 +428,10 @@ index 364f94b..9518f82 100644 }; diff --git a/bin/tests/system/allow-query/tests.sh b/bin/tests/system/allow-query/tests.sh -index bbffe07..80da0fe 100644 +index 01a13cf..3711c63 100644 --- a/bin/tests/system/allow-query/tests.sh +++ b/bin/tests/system/allow-query/tests.sh -@@ -200,7 +200,7 @@ rndc_reload ns2 10.53.0.2 +@@ -201,7 +201,7 @@ rndc_reload ns2 10.53.0.2 echo_i "test $n: key allowed - query allowed" ret=0 @@ -440,7 +440,7 @@ index bbffe07..80da0fe 100644 grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1 grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1 if [ $ret != 0 ]; then echo_i "failed"; fi -@@ -213,7 +213,7 @@ rndc_reload ns2 10.53.0.2 +@@ -214,7 +214,7 @@ rndc_reload ns2 10.53.0.2 echo_i "test $n: key not allowed - query refused" ret=0 @@ -449,7 +449,7 @@ index bbffe07..80da0fe 100644 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1 grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1 grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1 -@@ -227,7 +227,7 @@ rndc_reload ns2 10.53.0.2 +@@ -228,7 +228,7 @@ rndc_reload ns2 10.53.0.2 echo_i "test $n: key disallowed - query refused" ret=0 @@ -458,7 +458,7 @@ index bbffe07..80da0fe 100644 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1 grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1 grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1 -@@ -366,7 +366,7 @@ rndc_reload ns2 10.53.0.2 +@@ -367,7 +367,7 @@ rndc_reload ns2 10.53.0.2 echo_i "test $n: views key allowed - query allowed" ret=0 @@ -467,7 +467,7 @@ index bbffe07..80da0fe 100644 grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1 grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1 if [ $ret != 0 ]; then echo_i "failed"; fi -@@ -379,7 +379,7 @@ rndc_reload ns2 10.53.0.2 +@@ -380,7 +380,7 @@ rndc_reload ns2 10.53.0.2 echo_i "test $n: views key not allowed - query refused" ret=0 @@ -476,7 +476,7 @@ index bbffe07..80da0fe 100644 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1 grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1 grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1 -@@ -393,7 +393,7 @@ rndc_reload ns2 10.53.0.2 +@@ -394,7 +394,7 @@ rndc_reload ns2 10.53.0.2 echo_i "test $n: views key disallowed - query refused" ret=0 @@ -485,7 +485,7 @@ index bbffe07..80da0fe 100644 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1 grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1 grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1 -@@ -533,7 +533,7 @@ status=`expr $status + $ret` +@@ -534,7 +534,7 @@ status=`expr $status + $ret` n=`expr $n + 1` echo_i "test $n: zone key allowed - query allowed" ret=0 @@ -494,7 +494,7 @@ index bbffe07..80da0fe 100644 grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1 grep '^a.keyallow.example' dig.out.ns2.$n > /dev/null || ret=1 if [ $ret != 0 ]; then echo_i "failed"; fi -@@ -543,7 +543,7 @@ status=`expr $status + $ret` +@@ -544,7 +544,7 @@ status=`expr $status + $ret` n=`expr $n + 1` echo_i "test $n: zone key not allowed - query refused" ret=0 @@ -503,7 +503,7 @@ index bbffe07..80da0fe 100644 grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1 grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1 grep '^a.keyallow.example' dig.out.ns2.$n > /dev/null && ret=1 -@@ -554,7 +554,7 @@ status=`expr $status + $ret` +@@ -555,7 +555,7 @@ status=`expr $status + $ret` n=`expr $n + 1` echo_i "test $n: zone key disallowed - query refused" ret=0 @@ -513,16 +513,18 @@ index bbffe07..80da0fe 100644 grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1 grep '^a.keydisallow.example' dig.out.ns2.$n > /dev/null && ret=1 diff --git a/bin/tests/system/catz/ns1/named.conf.in b/bin/tests/system/catz/ns1/named.conf.in -index 1421281..424afb8 100644 +index 3a8e401..82e720d 100644 --- a/bin/tests/system/catz/ns1/named.conf.in +++ b/bin/tests/system/catz/ns1/named.conf.in -@@ -122,5 +122,5 @@ view "ch" ch { +@@ -122,7 +122,7 @@ view "ch" ch { key tsig_key. { secret "LSAnCU+Z"; - algorithm hmac-md5; + algorithm hmac-sha256; }; + + key next_key. { diff --git a/bin/tests/system/checkconf/bad-tsig.conf b/bin/tests/system/checkconf/bad-tsig.conf index 4af25b0..9f202d5 100644 --- a/bin/tests/system/checkconf/bad-tsig.conf diff --git a/bind-9.18-doc-arm-rhel9.patch b/bind-9.18-doc-arm-rhel9.patch deleted file mode 100644 index 2778e1e..0000000 --- a/bind-9.18-doc-arm-rhel9.patch +++ /dev/null @@ -1,46 +0,0 @@ -diff --git a/doc/arm/dnssec.inc.rst b/doc/arm/dnssec.inc.rst -index 0d72000..f4810ae 100644 ---- a/doc/arm/dnssec.inc.rst -+++ b/doc/arm/dnssec.inc.rst -@@ -282,7 +282,7 @@ NSEC3 - - To sign using :ref:`NSEC3 <advanced_discussions_nsec3>` instead of :ref:`NSEC - <advanced_discussions_nsec>`, add an NSEC3PARAM record to the initial update --request. The :term:`OPTOUT <opt-out>` bit in the NSEC3 -+request. The :term:`OPTOUT <Opt-out>` bit in the NSEC3 - chain can be set in the flags field of the - NSEC3PARAM record. - -diff --git a/doc/arm/reference.rst b/doc/arm/reference.rst -index ef6c1c7..b59b0ac 100644 ---- a/doc/arm/reference.rst -+++ b/doc/arm/reference.rst -@@ -35,7 +35,7 @@ The file :file:`named.conf` may contain three types of entities: - - Block - :ref:`Blocks <configuration_blocks>` are containers for :term:`statements -- <statement>` which either have common functionality - for example, -+ <Statement>` which either have common functionality - for example, - the definition of a cryptographic key in a :namedconf:ref:`key` block - or which - define the scope of the statement - for example, a statement which appears - in a :namedconf:ref:`zone` block has scope only for that zone. -@@ -68,7 +68,7 @@ The file :file:`named.conf` may contain three types of entities: - more argument/value pairs. The :any:`also-notify` statement may take a number - of such argument/value pairs, such as ``also-notify port 5353;``, - where ``port`` is the argument and ``5353`` is the corresponding value. -- - Statements can appear in a single :term:`block` - for -+ - Statements can appear in a single :term:`block <Block>` - for - example, an :namedconf:ref:`algorithm` statement can appear only in a - :namedconf:ref:`key` block - or in multiple blocks - for example, an - :any:`also-notify` statement can appear in an :namedconf:ref:`options` -@@ -6550,8 +6550,8 @@ The following options can be specified in a :any:`dnssec-policy` statement: - of the indicated length. - - .. warning:: -- Do not use extra :term:`iterations`, :term:`salt`, and -- :term:`opt-out` unless their implications are fully understood. -+ Do not use extra :term:`iterations <Iterations>`, :term:`salt <Salt>`, and -+ :term:`opt-out <Opt-out>` unless their implications are fully understood. - A higher number of iterations causes interoperability problems and opens - servers to CPU-exhausting DoS attacks. - diff --git a/bind-9.18-pkcs11-engine-compat-api.patch b/bind-9.18-pkcs11-engine-compat-api.patch deleted file mode 100644 index 678d199..0000000 --- a/bind-9.18-pkcs11-engine-compat-api.patch +++ /dev/null @@ -1,1556 +0,0 @@ -From 1ecf072a6a556aa386003d1d5b83fe172320e7ed Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik(a)redhat.com> -Date: Thu, 8 Sep 2022 17:19:20 +0200 -Subject: [PATCH] Do not use OSSL_PARAM when engine API is compiled - -OpenSSL has deprecated many things in version 3.0. If pkcs11 engine -should work then no builder from OpenSSL 3.0 API can be used. - -Allow switching to OpenSSL 1.1 like calls even on OpenSSL 3.0 when -OPENSSL_API_COMPAT=10100 is defined. It would still compile and allow -working keys loading from the engine passed on command line. ---- - lib/dns/openssldh_link.c | 136 +++++++++++++++++++----------------- - lib/dns/opensslecdsa_link.c | 119 +++++++++++++++---------------- - lib/dns/opensslrsa_link.c | 118 +++++++++++++++---------------- - 3 files changed, 189 insertions(+), 184 deletions(-) - -diff --git a/lib/dns/openssldh_link.c b/lib/dns/openssldh_link.c -index 1a01c2b..7df483f 100644 ---- a/lib/dns/openssldh_link.c -+++ b/lib/dns/openssldh_link.c -@@ -91,7 +91,7 @@ static BIGNUM *bn2 = NULL, *bn768 = NULL, *bn1024 = NULL, *bn1536 = NULL; - static isc_result_t - openssldh_computesecret(const dst_key_t *pub, const dst_key_t *priv, - isc_buffer_t *secret) { --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - DH *dhpub, *dhpriv; - const BIGNUM *pub_key = NULL; - int secret_len = 0; -@@ -99,11 +99,11 @@ openssldh_computesecret(const dst_key_t *pub, const dst_key_t *priv, - EVP_PKEY_CTX *ctx = NULL; - EVP_PKEY *dhpub, *dhpriv; - size_t secret_len = 0; --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - isc_region_t r; - unsigned int len; - --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - REQUIRE(pub->keydata.dh != NULL); - REQUIRE(priv->keydata.dh != NULL); - -@@ -119,14 +119,14 @@ openssldh_computesecret(const dst_key_t *pub, const dst_key_t *priv, - dhpriv = priv->keydata.pkey; - - len = EVP_PKEY_get_size(dhpriv); --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - - isc_buffer_availableregion(secret, &r); - if (r.length < len) { - return (ISC_R_NOSPACE); - } - --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - DH_get0_key(dhpub, &pub_key, NULL); - secret_len = DH_compute_key(r.base, pub_key, dhpriv); - if (secret_len <= 0) { -@@ -156,7 +156,7 @@ openssldh_computesecret(const dst_key_t *pub, const dst_key_t *priv, - DST_R_COMPUTESECRETFAILURE)); - } - EVP_PKEY_CTX_free(ctx); --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - - isc_buffer_add(secret, (unsigned int)secret_len); - -@@ -166,7 +166,7 @@ openssldh_computesecret(const dst_key_t *pub, const dst_key_t *priv, - static bool - openssldh_compare(const dst_key_t *key1, const dst_key_t *key2) { - bool ret = true; --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - DH *dh1, *dh2; - const BIGNUM *pub_key1 = NULL, *pub_key2 = NULL; - const BIGNUM *priv_key1 = NULL, *priv_key2 = NULL; -@@ -176,9 +176,9 @@ openssldh_compare(const dst_key_t *key1, const dst_key_t *key2) { - BIGNUM *pub_key1 = NULL, *pub_key2 = NULL; - BIGNUM *priv_key1 = NULL, *priv_key2 = NULL; - BIGNUM *p1 = NULL, *g1 = NULL, *p2 = NULL, *g2 = NULL; --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - dh1 = key1->keydata.dh; - dh2 = key2->keydata.dh; - -@@ -210,7 +210,7 @@ openssldh_compare(const dst_key_t *key1, const dst_key_t *key2) { - EVP_PKEY_get_bn_param(pkey2, OSSL_PKEY_PARAM_PUB_KEY, &pub_key2); - EVP_PKEY_get_bn_param(pkey1, OSSL_PKEY_PARAM_PRIV_KEY, &priv_key1); - EVP_PKEY_get_bn_param(pkey2, OSSL_PKEY_PARAM_PRIV_KEY, &priv_key2); --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L*/ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000*/ - - if (BN_cmp(p1, p2) != 0 || BN_cmp(g1, g2) != 0 || - BN_cmp(pub_key1, pub_key2) != 0) -@@ -226,7 +226,7 @@ openssldh_compare(const dst_key_t *key1, const dst_key_t *key2) { - } - - err: --#if OPENSSL_VERSION_NUMBER >= 0x30000000L -+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000 - if (p1 != NULL) { - BN_free(p1); - } -@@ -251,7 +251,8 @@ err: - if (priv_key2 != NULL) { - BN_clear_free(priv_key2); - } --#endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000 \ -+ */ - - return (ret); - } -@@ -259,15 +260,15 @@ err: - static bool - openssldh_paramcompare(const dst_key_t *key1, const dst_key_t *key2) { - bool ret = true; --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - DH *dh1, *dh2; - const BIGNUM *p1 = NULL, *g1 = NULL, *p2 = NULL, *g2 = NULL; - #else - EVP_PKEY *pkey1, *pkey2; - BIGNUM *p1 = NULL, *g1 = NULL, *p2 = NULL, *g2 = NULL; --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - dh1 = key1->keydata.dh; - dh2 = key2->keydata.dh; - -@@ -293,14 +294,14 @@ openssldh_paramcompare(const dst_key_t *key1, const dst_key_t *key2) { - EVP_PKEY_get_bn_param(pkey2, OSSL_PKEY_PARAM_FFC_P, &p2); - EVP_PKEY_get_bn_param(pkey1, OSSL_PKEY_PARAM_FFC_G, &g1); - EVP_PKEY_get_bn_param(pkey2, OSSL_PKEY_PARAM_FFC_G, &g2); --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - - if (BN_cmp(p1, p2) != 0 || BN_cmp(g1, g2) != 0) { - DST_RET(false); - } - - err: --#if OPENSSL_VERSION_NUMBER >= 0x30000000L -+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000 - if (p1 != NULL) { - BN_free(p1); - } -@@ -313,12 +314,13 @@ err: - if (g2 != NULL) { - BN_free(g2); - } --#endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000 \ -+ */ - - return (ret); - } - --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - static int - progress_cb(int p, int n, BN_GENCB *cb) { - union { -@@ -349,7 +351,7 @@ progress_cb(EVP_PKEY_CTX *ctx) { - } - return (1); - } --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - - static isc_result_t - openssldh_generate(dst_key_t *key, int generator, void (*callback)(int)) { -@@ -359,7 +361,7 @@ openssldh_generate(dst_key_t *key, int generator, void (*callback)(int)) { - void (*fptr)(int); - } u; - BIGNUM *p = NULL, *g = NULL; --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - DH *dh = NULL; - BN_GENCB *cb = NULL; - #if !HAVE_BN_GENCB_NEW -@@ -372,9 +374,9 @@ openssldh_generate(dst_key_t *key, int generator, void (*callback)(int)) { - EVP_PKEY_CTX *ctx = NULL; - EVP_PKEY *param_pkey = NULL; - EVP_PKEY *pkey = NULL; --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - dh = DH_new(); - if (dh == NULL) { - DST_RET(dst__openssl_toresult(ISC_R_NOMEMORY)); -@@ -388,7 +390,7 @@ openssldh_generate(dst_key_t *key, int generator, void (*callback)(int)) { - if (param_ctx == NULL) { - DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE)); - } --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - - if (generator == 0) { - /* -@@ -408,7 +410,7 @@ openssldh_generate(dst_key_t *key, int generator, void (*callback)(int)) { - if (p == NULL || g == NULL) { - DST_RET(dst__openssl_toresult(ISC_R_NOMEMORY)); - } --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - if (DH_set0_pqg(dh, p, NULL, g) != 1) { - DST_RET(dst__openssl_toresult2( - "DH_set0_pqg", DST_R_OPENSSLFAILURE)); -@@ -432,7 +434,7 @@ openssldh_generate(dst_key_t *key, int generator, void (*callback)(int)) { - DST_R_OPENSSLFAILURE)); - } - params = OSSL_PARAM_BLD_to_param(bld); --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - - } else { - /* -@@ -445,7 +447,7 @@ openssldh_generate(dst_key_t *key, int generator, void (*callback)(int)) { - } - - if (generator != 0) { --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - cb = BN_GENCB_new(); - #if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER) - if (cb == NULL) { -@@ -488,10 +490,10 @@ openssldh_generate(dst_key_t *key, int generator, void (*callback)(int)) { - DST_R_OPENSSLFAILURE)); - } - params = OSSL_PARAM_BLD_to_param(bld); --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - } - --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - if (DH_generate_key(dh) == 0) { - DST_RET(dst__openssl_toresult2("DH_generate_key", - DST_R_OPENSSLFAILURE)); -@@ -559,12 +561,12 @@ openssldh_generate(dst_key_t *key, int generator, void (*callback)(int)) { - - key->keydata.pkey = pkey; - pkey = NULL; --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - - ret = ISC_R_SUCCESS; - - err: --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - if (dh != NULL) { - DH_free(dh); - } -@@ -596,14 +598,14 @@ err: - if (g != NULL) { - BN_free(g); - } --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - - return (ret); - } - - static bool - openssldh_isprivate(const dst_key_t *key) { --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - DH *dh = key->keydata.dh; - const BIGNUM *priv_key = NULL; - -@@ -628,12 +630,12 @@ openssldh_isprivate(const dst_key_t *key) { - } - - return (ret); --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - } - - static void - openssldh_destroy(dst_key_t *key) { --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - DH *dh = key->keydata.dh; - - if (dh == NULL) { -@@ -651,7 +653,7 @@ openssldh_destroy(dst_key_t *key) { - - EVP_PKEY_free(pkey); - key->keydata.pkey = NULL; --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - } - - static void -@@ -678,17 +680,17 @@ uint16_fromregion(isc_region_t *region) { - static isc_result_t - openssldh_todns(const dst_key_t *key, isc_buffer_t *data) { - isc_result_t ret = ISC_R_SUCCESS; --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - DH *dh; - const BIGNUM *pub_key = NULL, *p = NULL, *g = NULL; - #else - EVP_PKEY *pkey; - BIGNUM *pub_key = NULL, *p = NULL, *g = NULL; --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - isc_region_t r; - uint16_t dnslen, plen, glen, publen; - --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - REQUIRE(key->keydata.dh != NULL); - - dh = key->keydata.dh; -@@ -701,7 +703,7 @@ openssldh_todns(const dst_key_t *key, isc_buffer_t *data) { - EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_FFC_P, &p); - EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_FFC_G, &g); - EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_PUB_KEY, &pub_key); --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - - isc_buffer_availableregion(data, &r); - -@@ -749,7 +751,7 @@ openssldh_todns(const dst_key_t *key, isc_buffer_t *data) { - isc_buffer_add(data, dnslen); - - err: --#if OPENSSL_VERSION_NUMBER >= 0x30000000L -+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000 - if (p != NULL) { - BN_free(p); - } -@@ -759,7 +761,8 @@ err: - if (pub_key != NULL) { - BN_free(pub_key); - } --#endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000 \ -+ */ - - return (ret); - } -@@ -767,14 +770,14 @@ err: - static isc_result_t - openssldh_fromdns(dst_key_t *key, isc_buffer_t *data) { - isc_result_t ret; --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - DH *dh; - #else - OSSL_PARAM_BLD *bld = NULL; - OSSL_PARAM *params = NULL; - EVP_PKEY_CTX *ctx = NULL; - EVP_PKEY *pkey = NULL; --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - BIGNUM *pub_key = NULL, *p = NULL, *g = NULL; - int key_size; - isc_region_t r; -@@ -786,7 +789,7 @@ openssldh_fromdns(dst_key_t *key, isc_buffer_t *data) { - return (ISC_R_SUCCESS); - } - --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - dh = DH_new(); - if (dh == NULL) { - DST_RET(dst__openssl_toresult(ISC_R_NOMEMORY)); -@@ -801,7 +804,7 @@ openssldh_fromdns(dst_key_t *key, isc_buffer_t *data) { - if (ctx == NULL) { - DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE)); - } --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - - /* - * Read the prime length. 1 & 2 are table entries, > 16 means a -@@ -877,7 +880,7 @@ openssldh_fromdns(dst_key_t *key, isc_buffer_t *data) { - - key_size = BN_num_bits(p); - --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - if (DH_set0_pqg(dh, p, NULL, g) != 1) { - DST_RET(dst__openssl_toresult2("DH_set0_pqg", - DST_R_OPENSSLFAILURE)); -@@ -893,7 +896,7 @@ openssldh_fromdns(dst_key_t *key, isc_buffer_t *data) { - DST_RET(dst__openssl_toresult2("OSSL_PARAM_BLD_push_BN", - DST_R_OPENSSLFAILURE)); - } --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - - if (r.length < 2) { - DST_RET(DST_R_INVALIDPUBLICKEY); -@@ -911,7 +914,7 @@ openssldh_fromdns(dst_key_t *key, isc_buffer_t *data) { - - isc_buffer_forward(data, plen + glen + publen + 6); - --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - #if (LIBRESSL_VERSION_NUMBER >= 0x2070000fL) && \ - (LIBRESSL_VERSION_NUMBER <= 0x2070200fL) - /* -@@ -955,14 +958,14 @@ openssldh_fromdns(dst_key_t *key, isc_buffer_t *data) { - - key->keydata.pkey = pkey; - pkey = NULL; --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - - key->key_size = (unsigned int)key_size; - - ret = ISC_R_SUCCESS; - - err: --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - if (dh != NULL) { - DH_free(dh); - } -@@ -979,7 +982,7 @@ err: - if (bld != NULL) { - OSSL_PARAM_BLD_free(bld); - } --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - if (p != NULL) { - BN_free(p); - } -@@ -995,13 +998,13 @@ err: - - static isc_result_t - openssldh_tofile(const dst_key_t *key, const char *directory) { --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - DH *dh; - const BIGNUM *pub_key = NULL, *priv_key = NULL, *p = NULL, *g = NULL; - #else - EVP_PKEY *pkey; - BIGNUM *pub_key = NULL, *priv_key = NULL, *p = NULL, *g = NULL; --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - dst_private_t priv; - unsigned char *bufs[4] = { NULL }; - unsigned short i = 0; -@@ -1011,7 +1014,7 @@ openssldh_tofile(const dst_key_t *key, const char *directory) { - return (DST_R_EXTERNALKEY); - } - --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - if (key->keydata.dh == NULL) { - return (DST_R_NULLKEY); - } -@@ -1029,7 +1032,7 @@ openssldh_tofile(const dst_key_t *key, const char *directory) { - EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_FFC_G, &g); - EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_PUB_KEY, &pub_key); - EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_PRIV_KEY, &priv_key); --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - - priv.elements[i].tag = TAG_DH_PRIME; - priv.elements[i].length = BN_num_bytes(p); -@@ -1069,7 +1072,7 @@ openssldh_tofile(const dst_key_t *key, const char *directory) { - } - } - --#if OPENSSL_VERSION_NUMBER >= 0x30000000L -+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000 - if (p != NULL) { - BN_free(p); - } -@@ -1082,7 +1085,8 @@ openssldh_tofile(const dst_key_t *key, const char *directory) { - if (priv_key != NULL) { - BN_clear_free(priv_key); - } --#endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000 \ -+ */ - - return (result); - } -@@ -1092,14 +1096,14 @@ openssldh_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) { - dst_private_t priv; - isc_result_t ret; - int i; --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - DH *dh = NULL; - #else - OSSL_PARAM_BLD *bld = NULL; - OSSL_PARAM *params = NULL; - EVP_PKEY_CTX *ctx = NULL; - EVP_PKEY *pkey = NULL; --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - BIGNUM *pub_key = NULL, *priv_key = NULL, *p = NULL, *g = NULL; - int key_size = 0; - isc_mem_t *mctx; -@@ -1117,7 +1121,7 @@ openssldh_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) { - DST_RET(DST_R_EXTERNALKEY); - } - --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - dh = DH_new(); - if (dh == NULL) { - DST_RET(ISC_R_NOMEMORY); -@@ -1132,7 +1136,7 @@ openssldh_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) { - if (ctx == NULL) { - DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE)); - } --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - - for (i = 0; i < priv.nelements; i++) { - BIGNUM *bn; -@@ -1159,7 +1163,7 @@ openssldh_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) { - } - } - --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - if (DH_set0_key(dh, pub_key, priv_key) != 1) { - DST_RET(dst__openssl_toresult2("DH_set0_key", - DST_R_OPENSSLFAILURE)); -@@ -1206,13 +1210,13 @@ openssldh_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) { - - key->keydata.pkey = pkey; - pkey = NULL; --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - - key->key_size = (unsigned int)key_size; - ret = ISC_R_SUCCESS; - - err: --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - if (dh != NULL) { - DH_free(dh); - } -@@ -1229,7 +1233,7 @@ err: - if (bld != NULL) { - OSSL_PARAM_BLD_free(bld); - } --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - if (p != NULL) { - BN_free(p); - } -diff --git a/lib/dns/opensslecdsa_link.c b/lib/dns/opensslecdsa_link.c -index 519e88b..04f0d80 100644 ---- a/lib/dns/opensslecdsa_link.c -+++ b/lib/dns/opensslecdsa_link.c -@@ -17,14 +17,14 @@ - - #include <openssl/bn.h> - #include <openssl/opensslv.h> --#if OPENSSL_VERSION_NUMBER >= 0x30000000L -+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000 - #include <openssl/core_names.h> - #endif - #include <openssl/ecdsa.h> - #include <openssl/err.h> - #include <openssl/evp.h> - #include <openssl/objects.h> --#if OPENSSL_VERSION_NUMBER >= 0x30000000L -+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000 - #include <openssl/param_build.h> - #endif - #if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 -@@ -57,7 +57,7 @@ - goto err; \ - } - --#if OPENSSL_VERSION_NUMBER >= 0x30000000L -+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000 - static isc_result_t - raw_key_to_ossl(unsigned int key_alg, int private, const unsigned char *key, - size_t key_len, EVP_PKEY **pkey) { -@@ -159,7 +159,8 @@ err: - - return (ret); - } --#endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000 \ -+ */ - - static isc_result_t - opensslecdsa_createctx(dst_key_t *key, dst_context_t *dctx) { -@@ -411,7 +412,7 @@ opensslecdsa_compare(const dst_key_t *key1, const dst_key_t *key2) { - bool ret; - EVP_PKEY *pkey1 = key1->keydata.pkey; - EVP_PKEY *pkey2 = key2->keydata.pkey; --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - EC_KEY *eckey1 = NULL; - EC_KEY *eckey2 = NULL; - const BIGNUM *priv1; -@@ -419,7 +420,7 @@ opensslecdsa_compare(const dst_key_t *key1, const dst_key_t *key2) { - #else - BIGNUM *priv1 = NULL; - BIGNUM *priv2 = NULL; --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - - if (pkey1 == NULL && pkey2 == NULL) { - return (true); -@@ -432,7 +433,7 @@ opensslecdsa_compare(const dst_key_t *key1, const dst_key_t *key2) { - DST_RET(false); - } - --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - eckey1 = EVP_PKEY_get1_EC_KEY(pkey1); - eckey2 = EVP_PKEY_get1_EC_KEY(pkey2); - if (eckey1 == NULL && eckey2 == NULL) { -@@ -445,7 +446,7 @@ opensslecdsa_compare(const dst_key_t *key1, const dst_key_t *key2) { - #else - EVP_PKEY_get_bn_param(pkey1, OSSL_PKEY_PARAM_PRIV_KEY, &priv1); - EVP_PKEY_get_bn_param(pkey2, OSSL_PKEY_PARAM_PRIV_KEY, &priv2); --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - - if (priv1 != NULL || priv2 != NULL) { - if (priv1 == NULL || priv2 == NULL || BN_cmp(priv1, priv2) != 0) -@@ -457,7 +458,7 @@ opensslecdsa_compare(const dst_key_t *key1, const dst_key_t *key2) { - ret = true; - - err: --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - if (eckey1 != NULL) { - EC_KEY_free(eckey1); - } -@@ -471,7 +472,7 @@ err: - if (priv2 != NULL) { - BN_clear_free(priv2); - } --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - - return (ret); - } -@@ -481,12 +482,12 @@ opensslecdsa_generate(dst_key_t *key, int unused, void (*callback)(int)) { - isc_result_t ret; - int status; - EVP_PKEY *pkey = NULL; --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - EC_KEY *eckey = NULL; - #else - EVP_PKEY_CTX *ctx = NULL; - EVP_PKEY *params_pkey = NULL; --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - int group_nid; - - REQUIRE(key->key_alg == DST_ALG_ECDSA256 || -@@ -502,7 +503,7 @@ opensslecdsa_generate(dst_key_t *key, int unused, void (*callback)(int)) { - key->key_size = DNS_KEY_ECDSA384SIZE * 4; - } - --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - eckey = EC_KEY_new_by_curve_name(group_nid); - if (eckey == NULL) { - DST_RET(dst__openssl_toresult2("EC_KEY_new_by_curve_name", -@@ -563,7 +564,7 @@ opensslecdsa_generate(dst_key_t *key, int unused, void (*callback)(int)) { - DST_RET(dst__openssl_toresult2("EVP_PKEY_keygen", - DST_R_OPENSSLFAILURE)); - } --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - - key->keydata.pkey = pkey; - pkey = NULL; -@@ -573,7 +574,7 @@ err: - if (pkey != NULL) { - EVP_PKEY_free(pkey); - } --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - if (eckey != NULL) { - EC_KEY_free(eckey); - } -@@ -584,7 +585,7 @@ err: - if (ctx != NULL) { - EVP_PKEY_CTX_free(ctx); - } --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - - return (ret); - } -@@ -593,11 +594,11 @@ static bool - opensslecdsa_isprivate(const dst_key_t *key) { - bool ret; - EVP_PKEY *pkey; --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - EC_KEY *eckey; - #else - BIGNUM *priv = NULL; --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - - REQUIRE(key->key_alg == DST_ALG_ECDSA256 || - key->key_alg == DST_ALG_ECDSA384); -@@ -607,7 +608,7 @@ opensslecdsa_isprivate(const dst_key_t *key) { - return (false); - } - --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - eckey = EVP_PKEY_get1_EC_KEY(pkey); - - ret = (eckey != NULL && EC_KEY_get0_private_key(eckey) != NULL); -@@ -621,7 +622,7 @@ opensslecdsa_isprivate(const dst_key_t *key) { - if (priv != NULL) { - BN_clear_free(priv); - } --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - - return (ret); - } -@@ -640,7 +641,7 @@ static isc_result_t - opensslecdsa_todns(const dst_key_t *key, isc_buffer_t *data) { - isc_result_t ret; - EVP_PKEY *pkey; --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - EC_KEY *eckey = NULL; - int len; - unsigned char *cp; -@@ -650,7 +651,7 @@ opensslecdsa_todns(const dst_key_t *key, isc_buffer_t *data) { - BIGNUM *y = NULL; - size_t keysize = 0; - size_t len = 0; --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - isc_region_t r; - unsigned char buf[DNS_KEY_ECDSA384SIZE + 1]; - -@@ -658,7 +659,7 @@ opensslecdsa_todns(const dst_key_t *key, isc_buffer_t *data) { - - pkey = key->keydata.pkey; - --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - eckey = EVP_PKEY_get1_EC_KEY(pkey); - if (eckey == NULL) { - DST_RET(dst__openssl_toresult(ISC_R_FAILURE)); -@@ -677,14 +678,14 @@ opensslecdsa_todns(const dst_key_t *key, isc_buffer_t *data) { - } - - len = keysize; --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - - isc_buffer_availableregion(data, &r); - if (r.length < (unsigned int)len) { - DST_RET(ISC_R_NOSPACE); - } - --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - cp = buf; - if (!i2o_ECPublicKey(eckey, &cp)) { - DST_RET(dst__openssl_toresult(ISC_R_FAILURE)); -@@ -704,13 +705,13 @@ opensslecdsa_todns(const dst_key_t *key, isc_buffer_t *data) { - BN_bn2bin_fixed(x, &buf[0], keysize / 2); - BN_bn2bin_fixed(y, &buf[keysize / 2], keysize / 2); - memmove(r.base, buf, len); --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - - isc_buffer_add(data, len); - ret = ISC_R_SUCCESS; - - err: --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - if (eckey != NULL) { - EC_KEY_free(eckey); - } -@@ -721,7 +722,7 @@ err: - if (y != NULL) { - BN_clear_free(y); - } --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - - return (ret); - } -@@ -731,7 +732,7 @@ opensslecdsa_fromdns(dst_key_t *key, isc_buffer_t *data) { - isc_result_t ret; - EVP_PKEY *pkey = NULL; - isc_region_t r; --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - EC_KEY *eckey = NULL; - const unsigned char *cp; - unsigned int len; -@@ -739,7 +740,7 @@ opensslecdsa_fromdns(dst_key_t *key, isc_buffer_t *data) { - int group_nid; - #else - size_t len; --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - - REQUIRE(key->key_alg == DST_ALG_ECDSA256 || - key->key_alg == DST_ALG_ECDSA384); -@@ -758,7 +759,7 @@ opensslecdsa_fromdns(dst_key_t *key, isc_buffer_t *data) { - DST_RET(DST_R_INVALIDPUBLICKEY); - } - --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - if (key->key_alg == DST_ALG_ECDSA256) { - group_nid = NID_X9_62_prime256v1; - } else { -@@ -794,7 +795,7 @@ opensslecdsa_fromdns(dst_key_t *key, isc_buffer_t *data) { - if (ret != ISC_R_SUCCESS) { - DST_RET(ret); - } --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - - isc_buffer_forward(data, len); - key->keydata.pkey = pkey; -@@ -802,11 +803,11 @@ opensslecdsa_fromdns(dst_key_t *key, isc_buffer_t *data) { - ret = ISC_R_SUCCESS; - - err: --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - if (eckey != NULL) { - EC_KEY_free(eckey); - } --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - return (ret); - } - -@@ -814,13 +815,13 @@ static isc_result_t - opensslecdsa_tofile(const dst_key_t *key, const char *directory) { - isc_result_t ret; - EVP_PKEY *pkey; --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - EC_KEY *eckey = NULL; - const BIGNUM *privkey = NULL; - #else - int status; - BIGNUM *privkey = NULL; --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - dst_private_t priv; - unsigned char *buf = NULL; - unsigned short i; -@@ -835,7 +836,7 @@ opensslecdsa_tofile(const dst_key_t *key, const char *directory) { - } - - pkey = key->keydata.pkey; --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - eckey = EVP_PKEY_get1_EC_KEY(pkey); - if (eckey == NULL) { - DST_RET(dst__openssl_toresult2("EVP_PKEY_get1_EC_KEY", -@@ -853,7 +854,7 @@ opensslecdsa_tofile(const dst_key_t *key, const char *directory) { - DST_RET(dst__openssl_toresult2("EVP_PKEY_get_bn_param", - DST_R_OPENSSLFAILURE)); - } --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - - buf = isc_mem_get(key->mctx, BN_num_bytes(privkey)); - -@@ -888,7 +889,7 @@ err: - if (buf != NULL && privkey != NULL) { - isc_mem_put(key->mctx, buf, BN_num_bytes(privkey)); - } --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - if (eckey != NULL) { - EC_KEY_free(eckey); - } -@@ -896,12 +897,12 @@ err: - if (privkey != NULL) { - BN_clear_free(privkey); - } --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - - return (ret); - } - --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - static isc_result_t - ecdsa_check(EC_KEY *eckey, EC_KEY *pubeckey) { - const EC_POINT *pubkey; -@@ -1065,9 +1066,9 @@ err: - - return (ret); - } --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - static isc_result_t - load_privkey_from_privstruct(EC_KEY *eckey, dst_private_t *priv, - int privkey_index) { -@@ -1102,16 +1103,16 @@ eckey_to_pkey(EC_KEY *eckey, EVP_PKEY **pkey) { - } - return (ISC_R_SUCCESS); - } --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - - static isc_result_t - finalize_eckey(dst_key_t *key, --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - EC_KEY *eckey, - #endif - const char *engine, const char *label) { - isc_result_t result = ISC_R_SUCCESS; --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - EVP_PKEY *pkey = NULL; - - REQUIRE(eckey != NULL); -@@ -1122,7 +1123,7 @@ finalize_eckey(dst_key_t *key, - } - - key->keydata.pkey = pkey; --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - - if (label != NULL) { - key->label = isc_mem_strdup(key->mctx, label); -@@ -1138,7 +1139,7 @@ finalize_eckey(dst_key_t *key, - return (result); - } - --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - static isc_result_t - dst__key_to_eckey(dst_key_t *key, EC_KEY **eckey) { - int group_nid; -@@ -1163,7 +1164,7 @@ dst__key_to_eckey(dst_key_t *key, EC_KEY **eckey) { - - return (ISC_R_SUCCESS); - } --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - - static isc_result_t - opensslecdsa_fromlabel(dst_key_t *key, const char *engine, const char *label, -@@ -1173,10 +1174,10 @@ static isc_result_t - opensslecdsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) { - dst_private_t priv; - isc_result_t ret; --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - EC_KEY *eckey = NULL; - EC_KEY *pubeckey = NULL; --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - const char *engine = NULL; - const char *label = NULL; - int i, privkey_index = -1; -@@ -1227,14 +1228,14 @@ opensslecdsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) { - goto err; - } - --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - eckey = EVP_PKEY_get1_EC_KEY(key->keydata.pkey); - if (eckey == NULL) { - DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE)); - } --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - } else { --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - ret = dst__key_to_eckey(key, &eckey); - if (ret != ISC_R_SUCCESS) { - goto err; -@@ -1251,7 +1252,7 @@ opensslecdsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) { - priv.elements[privkey_index].data, - priv.elements[privkey_index].length, - &key->keydata.pkey); --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - - if (ret != ISC_R_SUCCESS) { - goto err; -@@ -1260,7 +1261,7 @@ opensslecdsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) { - finalize_key = true; - } - --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - if (pub != NULL && pub->keydata.pkey != NULL) { - pubeckey = EVP_PKEY_get1_EC_KEY(pub->keydata.pkey); - } -@@ -1283,17 +1284,17 @@ opensslecdsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) { - if (finalize_key) { - ret = finalize_eckey(key, engine, label); - } --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - - err: --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - if (pubeckey != NULL) { - EC_KEY_free(pubeckey); - } - if (eckey != NULL) { - EC_KEY_free(eckey); - } --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - if (ret != ISC_R_SUCCESS) { - key->keydata.generic = NULL; - } -diff --git a/lib/dns/opensslrsa_link.c b/lib/dns/opensslrsa_link.c -index fc905b7..867b486 100644 ---- a/lib/dns/opensslrsa_link.c -+++ b/lib/dns/opensslrsa_link.c -@@ -18,7 +18,7 @@ - - #include <openssl/bn.h> - #include <openssl/opensslv.h> --#if OPENSSL_VERSION_NUMBER >= 0x30000000L -+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000 - #include <openssl/core_names.h> - #endif - #if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 -@@ -26,7 +26,7 @@ - #endif /* if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 */ - #include <openssl/err.h> - #include <openssl/objects.h> --#if OPENSSL_VERSION_NUMBER >= 0x30000000L -+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000 - #include <openssl/param_build.h> - #endif - #include <openssl/rsa.h> -@@ -180,12 +180,12 @@ static isc_result_t - opensslrsa_verify2(dst_context_t *dctx, int maxbits, const isc_region_t *sig) { - dst_key_t *key = dctx->key; - int status = 0; --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - RSA *rsa; - const BIGNUM *e = NULL; - #else - BIGNUM *e = NULL; --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - EVP_MD_CTX *evp_md_ctx = dctx->ctxdata.evp_md_ctx; - EVP_PKEY *pkey = key->keydata.pkey; - int bits; -@@ -195,7 +195,7 @@ opensslrsa_verify2(dst_context_t *dctx, int maxbits, const isc_region_t *sig) { - dctx->key->key_alg == DST_ALG_RSASHA256 || - dctx->key->key_alg == DST_ALG_RSASHA512); - --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - rsa = EVP_PKEY_get1_RSA(pkey); - if (rsa == NULL) { - return (dst__openssl_toresult(DST_R_OPENSSLFAILURE)); -@@ -213,7 +213,7 @@ opensslrsa_verify2(dst_context_t *dctx, int maxbits, const isc_region_t *sig) { - } - bits = BN_num_bits(e); - BN_free(e); --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - - if (bits > maxbits && maxbits != 0) { - return (DST_R_VERIFYFAILURE); -@@ -243,7 +243,7 @@ opensslrsa_compare(const dst_key_t *key1, const dst_key_t *key2) { - int status; - EVP_PKEY *pkey1 = key1->keydata.pkey; - EVP_PKEY *pkey2 = key2->keydata.pkey; --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - RSA *rsa1 = NULL; - RSA *rsa2 = NULL; - const BIGNUM *d1 = NULL, *d2 = NULL; -@@ -253,7 +253,7 @@ opensslrsa_compare(const dst_key_t *key1, const dst_key_t *key2) { - BIGNUM *d1 = NULL, *d2 = NULL; - BIGNUM *p1 = NULL, *p2 = NULL; - BIGNUM *q1 = NULL, *q2 = NULL; --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - - if (pkey1 == NULL && pkey2 == NULL) { - return (true); -@@ -267,7 +267,7 @@ opensslrsa_compare(const dst_key_t *key1, const dst_key_t *key2) { - DST_RET(false); - } - --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - rsa1 = EVP_PKEY_get1_RSA(pkey1); - rsa2 = EVP_PKEY_get1_RSA(pkey2); - if (rsa1 == NULL && rsa2 == NULL) { -@@ -280,14 +280,14 @@ opensslrsa_compare(const dst_key_t *key1, const dst_key_t *key2) { - #else - EVP_PKEY_get_bn_param(pkey1, OSSL_PKEY_PARAM_RSA_D, &d1); - EVP_PKEY_get_bn_param(pkey2, OSSL_PKEY_PARAM_RSA_D, &d2); --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - - if (d1 != NULL || d2 != NULL) { - if (d1 == NULL || d2 == NULL) { - DST_RET(false); - } - --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - RSA_get0_factors(rsa1, &p1, &q1); - RSA_get0_factors(rsa2, &p2, &q2); - #else -@@ -295,7 +295,7 @@ opensslrsa_compare(const dst_key_t *key1, const dst_key_t *key2) { - EVP_PKEY_get_bn_param(pkey1, OSSL_PKEY_PARAM_RSA_FACTOR2, &q1); - EVP_PKEY_get_bn_param(pkey2, OSSL_PKEY_PARAM_RSA_FACTOR1, &p2); - EVP_PKEY_get_bn_param(pkey2, OSSL_PKEY_PARAM_RSA_FACTOR2, &q2); --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - - if (BN_cmp(d1, d2) != 0 || BN_cmp(p1, p2) != 0 || - BN_cmp(q1, q2) != 0) { -@@ -306,7 +306,7 @@ opensslrsa_compare(const dst_key_t *key1, const dst_key_t *key2) { - ret = true; - - err: --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - if (rsa1 != NULL) { - RSA_free(rsa1); - } -@@ -332,12 +332,12 @@ err: - if (q2 != NULL) { - BN_clear_free(q2); - } --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - - return (ret); - } - --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - static int - progress_cb(int p, int n, BN_GENCB *cb) { - union { -@@ -368,7 +368,7 @@ progress_cb(EVP_PKEY_CTX *ctx) { - } - return (1); - } --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - - static isc_result_t - opensslrsa_generate(dst_key_t *key, int exp, void (*callback)(int)) { -@@ -378,7 +378,7 @@ opensslrsa_generate(dst_key_t *key, int exp, void (*callback)(int)) { - void (*fptr)(int); - } u; - BIGNUM *e = BN_new(); --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - RSA *rsa = RSA_new(); - EVP_PKEY *pkey = EVP_PKEY_new(); - #if !HAVE_BN_GENCB_NEW -@@ -388,9 +388,9 @@ opensslrsa_generate(dst_key_t *key, int exp, void (*callback)(int)) { - #else - EVP_PKEY_CTX *ctx = EVP_PKEY_CTX_new_from_name(NULL, "RSA", NULL); - EVP_PKEY *pkey = NULL; --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - if (e == NULL || rsa == NULL || pkey == NULL || cb == NULL) { - DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE)); - } -@@ -398,7 +398,7 @@ opensslrsa_generate(dst_key_t *key, int exp, void (*callback)(int)) { - if (e == NULL || ctx == NULL) { - DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE)); - } --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - - /* - * Reject incorrect RSA key lengths. -@@ -437,7 +437,7 @@ opensslrsa_generate(dst_key_t *key, int exp, void (*callback)(int)) { - BN_set_bit(e, 32); - } - --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - if (EVP_PKEY_set1_RSA(pkey, rsa) != 1) { - DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE)); - } -@@ -476,7 +476,7 @@ opensslrsa_generate(dst_key_t *key, int exp, void (*callback)(int)) { - DST_RET(dst__openssl_toresult2("EVP_PKEY_keygen", - DST_R_OPENSSLFAILURE)); - } --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - - key->keydata.pkey = pkey; - pkey = NULL; -@@ -486,7 +486,7 @@ err: - if (pkey != NULL) { - EVP_PKEY_free(pkey); - } --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - if (rsa != NULL) { - RSA_free(rsa); - } -@@ -497,7 +497,7 @@ err: - if (ctx != NULL) { - EVP_PKEY_CTX_free(ctx); - } --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - if (e != NULL) { - BN_free(e); - } -@@ -508,12 +508,12 @@ static bool - opensslrsa_isprivate(const dst_key_t *key) { - bool ret; - EVP_PKEY *pkey; --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - RSA *rsa; - const BIGNUM *d = NULL; - #else - BIGNUM *d = NULL; --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - - REQUIRE(key->key_alg == DST_ALG_RSASHA1 || - key->key_alg == DST_ALG_NSEC3RSASHA1 || -@@ -525,7 +525,7 @@ opensslrsa_isprivate(const dst_key_t *key) { - return (false); - } - --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - rsa = EVP_PKEY_get1_RSA(pkey); - INSIST(rsa != NULL); - -@@ -542,7 +542,7 @@ opensslrsa_isprivate(const dst_key_t *key) { - if (d != NULL) { - BN_clear_free(d); - } --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - - return (ret); - } -@@ -564,19 +564,19 @@ opensslrsa_todns(const dst_key_t *key, isc_buffer_t *data) { - unsigned int mod_bytes; - isc_result_t ret; - EVP_PKEY *pkey; --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - RSA *rsa; - const BIGNUM *e = NULL, *n = NULL; - #else - BIGNUM *e = NULL, *n = NULL; --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - - REQUIRE(key->keydata.pkey != NULL); - - pkey = key->keydata.pkey; - isc_buffer_availableregion(data, &r); - --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - rsa = EVP_PKEY_get1_RSA(pkey); - if (rsa == NULL) { - DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE)); -@@ -588,7 +588,7 @@ opensslrsa_todns(const dst_key_t *key, isc_buffer_t *data) { - if (e == NULL || n == NULL) { - DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE)); - } --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - - mod_bytes = BN_num_bytes(n); - e_bytes = BN_num_bytes(e); -@@ -621,7 +621,7 @@ opensslrsa_todns(const dst_key_t *key, isc_buffer_t *data) { - - ret = ISC_R_SUCCESS; - err: --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - if (rsa != NULL) { - RSA_free(rsa); - } -@@ -632,7 +632,7 @@ err: - if (n != NULL) { - BN_free(n); - } --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - return (ret); - } - -@@ -643,13 +643,13 @@ opensslrsa_fromdns(dst_key_t *key, isc_buffer_t *data) { - isc_region_t r; - unsigned int e_bytes; - unsigned int length; --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - RSA *rsa = NULL; - #else - OSSL_PARAM_BLD *bld = NULL; - OSSL_PARAM *params = NULL; - EVP_PKEY_CTX *ctx = NULL; --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - EVP_PKEY *pkey = NULL; - BIGNUM *e = NULL, *n = NULL; - -@@ -691,7 +691,7 @@ opensslrsa_fromdns(dst_key_t *key, isc_buffer_t *data) { - - isc_buffer_forward(data, length); - --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - rsa = RSA_new(); - if (rsa == NULL) { - DST_RET(dst__openssl_toresult2("RSA_new", -@@ -749,7 +749,7 @@ opensslrsa_fromdns(dst_key_t *key, isc_buffer_t *data) { - DST_RET(dst__openssl_toresult2("EVP_PKEY_fromdata", - DST_R_OPENSSLFAILURE)); - } --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - - key->keydata.pkey = pkey; - pkey = NULL; -@@ -757,7 +757,7 @@ opensslrsa_fromdns(dst_key_t *key, isc_buffer_t *data) { - - err: - --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - if (rsa != NULL) { - RSA_free(rsa); - } -@@ -771,7 +771,7 @@ err: - if (bld != NULL) { - OSSL_PARAM_BLD_free(bld); - } --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - if (n != NULL) { - BN_free(n); - } -@@ -792,7 +792,7 @@ opensslrsa_tofile(const dst_key_t *key, const char *directory) { - unsigned char *bufs[8] = { NULL }; - unsigned short i = 0; - EVP_PKEY *pkey; --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - RSA *rsa = NULL; - const BIGNUM *n = NULL, *e = NULL, *d = NULL; - const BIGNUM *p = NULL, *q = NULL; -@@ -801,7 +801,7 @@ opensslrsa_tofile(const dst_key_t *key, const char *directory) { - BIGNUM *n = NULL, *e = NULL, *d = NULL; - BIGNUM *p = NULL, *q = NULL; - BIGNUM *dmp1 = NULL, *dmq1 = NULL, *iqmp = NULL; --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - - if (key->keydata.pkey == NULL) { - DST_RET(DST_R_NULLKEY); -@@ -812,7 +812,7 @@ opensslrsa_tofile(const dst_key_t *key, const char *directory) { - } - - pkey = key->keydata.pkey; --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - rsa = EVP_PKEY_get1_RSA(pkey); - if (rsa == NULL) { - DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE)); -@@ -829,7 +829,7 @@ opensslrsa_tofile(const dst_key_t *key, const char *directory) { - EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_RSA_EXPONENT1, &dmp1); - EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_RSA_EXPONENT2, &dmq1); - EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_RSA_COEFFICIENT1, &iqmp); --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - - if (n == NULL || e == NULL) { - DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE)); -@@ -935,7 +935,7 @@ err: - priv.elements[i].length); - } - } --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - RSA_free(rsa); - #else - if (n != NULL) { -@@ -962,12 +962,12 @@ err: - if (iqmp != NULL) { - BN_clear_free(iqmp); - } --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - - return (ret); - } - --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - static isc_result_t - rsa_check(RSA *rsa, RSA *pub) { - const BIGNUM *n1 = NULL, *n2 = NULL; -@@ -1079,14 +1079,14 @@ err: - - return (ret); - } --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - - static isc_result_t - opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) { - dst_private_t priv; - isc_result_t ret; - int i; --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - RSA *rsa = NULL, *pubrsa = NULL; - const BIGNUM *ex = NULL; - #else -@@ -1094,7 +1094,7 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) { - OSSL_PARAM *params = NULL; - EVP_PKEY_CTX *ctx = NULL; - BIGNUM *ex = NULL; --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - #if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 - ENGINE *ep = NULL; - #endif /* if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 */ -@@ -1126,11 +1126,11 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) { - DST_RET(ISC_R_SUCCESS); - } - --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - if (pub != NULL && pub->keydata.pkey != NULL) { - pubrsa = EVP_PKEY_get1_RSA(pub->keydata.pkey); - } --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - - for (i = 0; i < priv.nelements; i++) { - switch (priv.elements[i].tag) { -@@ -1249,7 +1249,7 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) { - } - } - --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - rsa = RSA_new(); - if (rsa == NULL) { - DST_RET(ISC_R_NOMEMORY); -@@ -1361,7 +1361,7 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) { - ISC_R_SUCCESS) { - DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY)); - } --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - - if (BN_num_bits(e) > RSA_MAX_PUBEXP_BITS) { - DST_RET(ISC_R_RANGE); -@@ -1375,7 +1375,7 @@ err: - if (pkey != NULL) { - EVP_PKEY_free(pkey); - } --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - if (rsa != NULL) { - RSA_free(rsa); - } -@@ -1419,7 +1419,7 @@ err: - if (iqmp != NULL) { - BN_clear_free(iqmp); - } --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ -+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - if (ret != ISC_R_SUCCESS) { - key->keydata.generic = NULL; - } -@@ -1643,7 +1643,7 @@ check_algorithm(unsigned char algorithm) { - int status; - isc_result_t ret = ISC_R_SUCCESS; - size_t len; --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - RSA *rsa = NULL; - #else - OSSL_PARAM *params = NULL; -@@ -1689,7 +1689,7 @@ check_algorithm(unsigned char algorithm) { - DST_RET(ISC_R_NOMEMORY); - } - --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - rsa = RSA_new(); - if (rsa == NULL) { - DST_RET(dst__openssl_toresult2("RSA_new", -@@ -1762,7 +1762,7 @@ check_algorithm(unsigned char algorithm) { - err: - BN_free(e); - BN_free(n); --#if OPENSSL_VERSION_NUMBER < 0x30000000L -+#if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 - if (rsa != NULL) { - RSA_free(rsa); - } --- -2.37.3 - diff --git a/bind-9.18-pkcs11-engine-init.patch b/bind-9.18-pkcs11-engine-init.patch deleted file mode 100644 index 5c0c6c4..0000000 --- a/bind-9.18-pkcs11-engine-init.patch +++ /dev/null @@ -1,48 +0,0 @@ -From 87a2eac7a8264a0e8d64a8db85d44ec22454e256 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik(a)redhat.com> -Date: Wed, 7 Sep 2022 13:46:31 +0200 -Subject: [PATCH 1/3] Add ENGINE_init and ENGINE_finish calls - -According to manual page of ENGINE_init, it should be called explicitly -before any key operations happens. Make it active whole lifetime. ---- - lib/dns/openssl_link.c | 9 ++++++++- - 1 file changed, 8 insertions(+), 1 deletion(-) - -diff --git a/lib/dns/openssl_link.c b/lib/dns/openssl_link.c -index 333f34cb37..a3f63885fa 100644 ---- a/lib/dns/openssl_link.c -+++ b/lib/dns/openssl_link.c -@@ -85,14 +85,20 @@ dst__openssl_init(const char *engine) { - result = DST_R_NOENGINE; - goto cleanup_rm; - } -+ if (!ENGINE_init(e)) { -+ result = DST_R_NOENGINE; -+ goto cleanup_rm; -+ } - /* This will init the engine. */ - if (!ENGINE_set_default(e, ENGINE_METHOD_ALL)) { - result = DST_R_NOENGINE; -- goto cleanup_rm; -+ goto cleanup_init; - } - } - - return (ISC_R_SUCCESS); -+cleanup_init: -+ ENGINE_finish(e); - cleanup_rm: - if (e != NULL) { - ENGINE_free(e); -@@ -108,6 +114,7 @@ void - dst__openssl_destroy(void) { - #if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 - if (e != NULL) { -+ ENGINE_finish(e); - ENGINE_free(e); - } - e = NULL; --- -2.37.2 - diff --git a/bind-9.18-pkcs11-engine-remove-deadcode.patch b/bind-9.18-pkcs11-engine-remove-deadcode.patch deleted file mode 100644 index 7586395..0000000 --- a/bind-9.18-pkcs11-engine-remove-deadcode.patch +++ /dev/null @@ -1,245 +0,0 @@ -From cc8edfc6670ba97434bc5acb595539fd9c7d9123 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik(a)redhat.com> -Date: Thu, 8 Sep 2022 16:33:38 +0200 -Subject: [PATCH 3/3] Remove engine related parts for OpenSSL 3.0 - -OpenSSL just cannot work with mixing ENGINE_* api mixed with OSSL_PARAM -builders. But it can be built in legacy mode, where deprecated but still -working API would be used. - -It can work under OpenSSL 3.0, but only if using legacy code paths -matching OpenSSL 1.1 calls and functions. - -Remove fromlabel processing by OpenSSL 3.0 only functions. They can -return later with a proper provider support for pkcs11. ---- - lib/dns/opensslecdsa_link.c | 55 ------------------------------------- - lib/dns/opensslrsa_link.c | 32 --------------------- - 2 files changed, 87 deletions(-) - -diff --git a/lib/dns/opensslecdsa_link.c b/lib/dns/opensslecdsa_link.c -index 04f0d80b5e..f04f076e42 100644 ---- a/lib/dns/opensslecdsa_link.c -+++ b/lib/dns/opensslecdsa_link.c -@@ -1311,15 +1311,9 @@ opensslecdsa_fromlabel(dst_key_t *key, const char *engine, const char *label, - #if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 - isc_result_t ret = ISC_R_SUCCESS; - ENGINE *e; --#if OPENSSL_VERSION_NUMBER < 0x30000000L - EC_KEY *eckey = NULL; - EC_KEY *pubeckey = NULL; - int group_nid; --#else -- size_t len; -- const char *curve_name, *nist_curve_name; -- char buf[128]; /* Sufficient for all of the supported curves' names. */ --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ - EVP_PKEY *pkey = NULL; - EVP_PKEY *pubpkey = NULL; - -@@ -1336,22 +1330,11 @@ opensslecdsa_fromlabel(dst_key_t *key, const char *engine, const char *label, - DST_RET(DST_R_NOENGINE); - } - --#if OPENSSL_VERSION_NUMBER < 0x30000000L - if (key->key_alg == DST_ALG_ECDSA256) { - group_nid = NID_X9_62_prime256v1; - } else { - group_nid = NID_secp384r1; - } --#else -- /* Get the expected curve names */ -- if (key->key_alg == DST_ALG_ECDSA256) { -- curve_name = "prime256v1"; -- nist_curve_name = "P-256"; -- } else { -- curve_name = "secp384r1"; -- nist_curve_name = "P-384"; -- } --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ - - /* Load private key. */ - pkey = ENGINE_load_private_key(e, label, NULL, NULL); -@@ -1363,7 +1346,6 @@ opensslecdsa_fromlabel(dst_key_t *key, const char *engine, const char *label, - if (EVP_PKEY_base_id(pkey) != EVP_PKEY_EC) { - DST_RET(DST_R_INVALIDPRIVATEKEY); - } --#if OPENSSL_VERSION_NUMBER < 0x30000000L - eckey = EVP_PKEY_get1_EC_KEY(pkey); - if (eckey == NULL) { - DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE)); -@@ -1371,20 +1353,6 @@ opensslecdsa_fromlabel(dst_key_t *key, const char *engine, const char *label, - if (EC_GROUP_get_curve_name(EC_KEY_get0_group(eckey)) != group_nid) { - DST_RET(DST_R_INVALIDPRIVATEKEY); - } --#else -- len = 0; -- if (EVP_PKEY_get_utf8_string_param(pkey, OSSL_PKEY_PARAM_GROUP_NAME, -- buf, sizeof buf, &len) != 1 || -- len == 0 || len >= sizeof buf) -- { -- DST_RET(DST_R_INVALIDPRIVATEKEY); -- } -- if (strncasecmp(buf, curve_name, strlen(curve_name)) != 0 && -- strncasecmp(buf, nist_curve_name, strlen(nist_curve_name)) != 0) -- { -- DST_RET(DST_R_INVALIDPRIVATEKEY); -- } --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ - - /* Load public key. */ - pubpkey = ENGINE_load_public_key(e, label, NULL, NULL); -@@ -1396,7 +1364,6 @@ opensslecdsa_fromlabel(dst_key_t *key, const char *engine, const char *label, - if (EVP_PKEY_base_id(pubpkey) != EVP_PKEY_EC) { - DST_RET(DST_R_INVALIDPUBLICKEY); - } --#if OPENSSL_VERSION_NUMBER < 0x30000000L - pubeckey = EVP_PKEY_get1_EC_KEY(pubpkey); - if (pubeckey == NULL) { - DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE)); -@@ -1404,30 +1371,10 @@ opensslecdsa_fromlabel(dst_key_t *key, const char *engine, const char *label, - if (EC_GROUP_get_curve_name(EC_KEY_get0_group(pubeckey)) != group_nid) { - DST_RET(DST_R_INVALIDPUBLICKEY); - } --#else -- len = 0; -- if (EVP_PKEY_get_utf8_string_param(pubpkey, OSSL_PKEY_PARAM_GROUP_NAME, -- buf, sizeof buf, &len) != 1 || -- len == 0 || len >= sizeof buf) -- { -- DST_RET(DST_R_INVALIDPUBLICKEY); -- } -- if (strncasecmp(buf, curve_name, strlen(curve_name)) != 0 && -- strncasecmp(buf, nist_curve_name, strlen(nist_curve_name)) != 0) -- { -- DST_RET(DST_R_INVALIDPUBLICKEY); -- } --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ - --#if OPENSSL_VERSION_NUMBER < 0x30000000L - if (ecdsa_check(eckey, pubeckey) != ISC_R_SUCCESS) { - DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY)); - } --#else -- if (ecdsa_check(&pkey, pubpkey) != ISC_R_SUCCESS) { -- DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY)); -- } --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ - - key->label = isc_mem_strdup(key->mctx, label); - key->engine = isc_mem_strdup(key->mctx, engine); -@@ -1442,14 +1389,12 @@ err: - if (pkey != NULL) { - EVP_PKEY_free(pkey); - } --#if OPENSSL_VERSION_NUMBER < 0x30000000L - if (pubeckey != NULL) { - EC_KEY_free(pubeckey); - } - if (eckey != NULL) { - EC_KEY_free(eckey); - } --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ - - return (ret); - #else -diff --git a/lib/dns/opensslrsa_link.c b/lib/dns/opensslrsa_link.c -index 867b486a2f..cf350610ba 100644 ---- a/lib/dns/opensslrsa_link.c -+++ b/lib/dns/opensslrsa_link.c -@@ -1167,7 +1167,6 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) { - key->engine = isc_mem_strdup(key->mctx, engine); - key->label = isc_mem_strdup(key->mctx, label); - --#if OPENSSL_VERSION_NUMBER < 0x30000000L - rsa = EVP_PKEY_get1_RSA(pkey); - if (rsa == NULL) { - DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE)); -@@ -1176,16 +1175,6 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) { - DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY)); - } - RSA_get0_key(rsa, NULL, &ex, NULL); --#else -- if (rsa_check(pkey, pub != NULL ? pub->keydata.pkey : NULL) != -- ISC_R_SUCCESS) { -- DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY)); -- } -- if (EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_RSA_E, &ex) != -- 1) { -- DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY)); -- } --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ - - if (ex == NULL) { - DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY)); -@@ -1437,12 +1426,8 @@ opensslrsa_fromlabel(dst_key_t *key, const char *engine, const char *label, - ENGINE *e = NULL; - isc_result_t ret = ISC_R_SUCCESS; - EVP_PKEY *pkey = NULL, *pubpkey = NULL; --#if OPENSSL_VERSION_NUMBER < 0x30000000L - RSA *rsa = NULL, *pubrsa = NULL; - const BIGNUM *ex = NULL; --#else -- BIGNUM *ex = NULL; --#endif - - UNUSED(pin); - -@@ -1459,12 +1444,10 @@ opensslrsa_fromlabel(dst_key_t *key, const char *engine, const char *label, - DST_RET(dst__openssl_toresult2("ENGINE_load_public_key", - DST_R_OPENSSLFAILURE)); - } --#if OPENSSL_VERSION_NUMBER < 0x30000000L - pubrsa = EVP_PKEY_get1_RSA(pubpkey); - if (pubrsa == NULL) { - DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE)); - } --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ - - pkey = ENGINE_load_private_key(e, label, NULL, NULL); - if (pkey == NULL) { -@@ -1475,7 +1458,6 @@ opensslrsa_fromlabel(dst_key_t *key, const char *engine, const char *label, - key->engine = isc_mem_strdup(key->mctx, engine); - key->label = isc_mem_strdup(key->mctx, label); - --#if OPENSSL_VERSION_NUMBER < 0x30000000L - rsa = EVP_PKEY_get1_RSA(pkey); - if (rsa == NULL) { - DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE)); -@@ -1484,14 +1466,6 @@ opensslrsa_fromlabel(dst_key_t *key, const char *engine, const char *label, - DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY)); - } - RSA_get0_key(rsa, NULL, &ex, NULL); --#else -- if (rsa_check(pkey, pubpkey) != ISC_R_SUCCESS) { -- DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY)); -- } -- if (EVP_PKEY_get_bn_param(pkey, OSSL_PKEY_PARAM_RSA_E, &ex) != 1) { -- DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY)); -- } --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ - - if (ex == NULL) { - DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY)); -@@ -1505,18 +1479,12 @@ opensslrsa_fromlabel(dst_key_t *key, const char *engine, const char *label, - pkey = NULL; - - err: --#if OPENSSL_VERSION_NUMBER < 0x30000000L - if (rsa != NULL) { - RSA_free(rsa); - } - if (pubrsa != NULL) { - RSA_free(pubrsa); - } --#else -- if (ex != NULL) { -- BN_free(ex); -- } --#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */ - if (pkey != NULL) { - EVP_PKEY_free(pkey); - } --- -2.37.2 - diff --git a/bind.spec b/bind.spec index 20bb29e..ef86ef1 100644 --- a/bind.spec +++ b/bind.spec @@ -62,8 +62,8 @@ Conflicts: %1 \ Summary: The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server Name: bind License: MPL-2.0 -Version: 9.18.7 -Release: 3%{?dist} +Version: 9.18.8 +Release: 1%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ # @@ -99,16 +99,8 @@ Source49: named-chroot.files Patch10: bind-9.5-PIE.patch Patch16: bind-9.16-redhat_doc.patch Patch22: bind-9.11-fips-tests.patch -# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/5385 -# https://bugzilla.redhat.com/show_bug.cgi?id=2122841 -Patch23: bind-9.18-pkcs11-engine-init.patch -Patch24: bind-9.18-pkcs11-engine-compat-api.patch -Patch25: bind-9.18-pkcs11-engine-remove-deadcode.patch # https://bugzilla.redhat.com/show_bug.cgi?id=2122010 Patch26: bind-9.18-unittest-netmgr-unstable.patch -# Fix building ARM docs in EPEL9 -# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/6815 -Patch27: bind-9.18-doc-arm-rhel9.patch %{?systemd_ordering} Requires: coreutils @@ -957,6 +949,9 @@ fi; %endif %changelog +* Sat Oct 22 2022 Petr Menšík <pemensik(a)redhat.com> - 32:9.18.8-1 +- Update to 9.18.8 (#2136100) + * Fri Sep 30 2022 Petr Menšík <pemensik(a)redhat.com> - 32:9.18.7-3 - Update License to SPDX identifier - Enable automatic restart on crashes diff --git a/sources b/sources index 25459e0..10c60a2 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.18.7.tar.xz) = 2cdceb4125b8759f5225296c6ffecdbb895b0a27dfcfcd98b04b9ad78552d16c16b0452fb823dc47d11cec21d2c6ecb05a107dd3094f8e7419bb9717d68820c5 -SHA512 (bind-9.18.7.tar.xz.asc) = 40030c2259858f1ba7ce4fbcd523025631ed78687ca87863d0f0bcd0fd530d96052e0601808ffa37e59d574a9a9c84bb2ededc66f730b9eaf560a00a6ef29c48 +SHA512 (bind-9.18.8.tar.xz) = ea6cad5276269a320fa1e666544888ed88b9d058ecab56c82aebff24e841a4ad221ce9c1209b1258884d71f7c03eed4d1c6a7e1922780073644344bc939a0e89 +SHA512 (bind-9.18.8.tar.xz.asc) = 06a880eb3af14e760f52ab5bd666b6512487d724a16a0fdf646ad9a07f17249e68a9a59ddf902f9111aee6450d96ed8dfe36d6fb433808f993d9bbc6dd4e665c https://src.fedoraproject.org/rpms/bind/c/99fd53a10661f8de99fb9d335c37f8e89…

1 0

mstevens pushed to rpms/cacti-spine (f37). "Update to 1.2.22"
by notifications＠fedoraproject.org 31 Oct '22

31 Oct '22

Notification time stamped 2022-10-22 22:20:31 UTC From ff46d800dc4949a54a458a43e5850e4464a6ddde Mon Sep 17 00:00:00 2001 From: Morten Stevens <mstevens(a)fedoraproject.org> Date: Oct 22 2022 22:14:05 +0000 Subject: Update to 1.2.22 --- diff --git a/.gitignore b/.gitignore index f4d5ff1..97437fe 100644 --- a/.gitignore +++ b/.gitignore @@ -20,3 +20,4 @@ /cacti-spine-1.2.19.tar.gz /cacti-spine-1.2.20.tar.gz /cacti-spine-1.2.21.tar.gz +/cacti-spine-1.2.22.tar.gz diff --git a/cacti-spine-disable-des.patch b/cacti-spine-disable-des.patch deleted file mode 100644 index 0a86683..0000000 --- a/cacti-spine-disable-des.patch +++ /dev/null @@ -1,22 +0,0 @@ -From 0e90e50867956f27213fc76b4567beca82b98728 Mon Sep 17 00:00:00 2001 -From: Morten Stevens <mstevens(a)fedoraproject.org> -Date: Sat, 9 Apr 2022 17:37:29 +0200 -Subject: [PATCH] Disable DES if Net-SNMP doesn't have it (#220) - ---- - snmp.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/snmp.c b/snmp.c -index ea4e296..8fca547 100644 ---- a/snmp.c -+++ b/snmp.c -@@ -283,7 +283,7 @@ void *snmp_host_init(int host_id, char *hostname, int snmp_version, char *snmp_c - } - } else { - if (strcmp(snmp_priv_protocol, "DES") == 0) { -- #if defined(USM_PRIV_PROTO_DES_LEN) -+ #if defined(USM_PRIV_PROTO_DES_LEN) && !defined(NETSNMP_DISABLE_DES) - session.securityPrivProto = snmp_duplicate_objid(usmDESPrivProtocol, USM_PRIV_PROTO_DES_LEN); - session.securityPrivProtoLen = USM_PRIV_PROTO_DES_LEN; - session.securityPrivKeyLen = USM_PRIV_KU_LEN; diff --git a/cacti-spine.spec b/cacti-spine.spec index 5a880a1..dc97694 100644 --- a/cacti-spine.spec +++ b/cacti-spine.spec @@ -1,6 +1,6 @@ Name: cacti-spine -Version: 1.2.21 -Release: 2%{?dist} +Version: 1.2.22 +Release: 1%{?dist} Summary: Threaded poller for Cacti written in C License: LGPLv2+ URL: https://cacti.net @@ -48,6 +48,9 @@ autoreconf -fiv %{_mandir}/man1/spine.1.* %changelog +* Sat Oct 22 2022 Morten Stevens <mstevens(a)fedoraproject.org> - 1.2.22-1 +- Update to 1.2.22 + * Wed Jul 20 2022 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.2.21-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild diff --git a/sources b/sources index 18a9ec0..b54b1b4 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (cacti-spine-1.2.21.tar.gz) = 8cd15b3a25e956db3c9e26961afef6bee1cdde5ada4a818a7c2b19ab1a4b3498d34ab01ff67c67e2a36fe1c9d557cb6cc38c864f844dd6ab672166ce132d3dfb +SHA512 (cacti-spine-1.2.22.tar.gz) = fee4c0eba4a649ed48d0f1fd617f32e696c82377b01c4e4c99b36759bc35d045741f75a4977530a10e457b8c923d23ec72f79034897bba2fb998da4e19432fd3 https://src.fedoraproject.org/rpms/cacti-spine/c/ff46d800dc4949a54a458a43e5…

1 0

mstevens pushed to rpms/cacti (f37). "Update to 1.2.22"
by notifications＠fedoraproject.org 31 Oct '22

31 Oct '22

Notification time stamped 2022-10-22 22:19:18 UTC From 7fce402e46d42b5442d15c7d4c08d7c72062e686 Mon Sep 17 00:00:00 2001 From: Morten Stevens <mstevens(a)fedoraproject.org> Date: Oct 22 2022 22:18:52 +0000 Subject: Update to 1.2.22 --- diff --git a/.gitignore b/.gitignore index e7abb2d..c43553e 100644 --- a/.gitignore +++ b/.gitignore @@ -55,3 +55,4 @@ /cacti-1.2.19.tar.gz /cacti-1.2.20.tar.gz /cacti-1.2.21.tar.gz +/cacti-1.2.22.tar.gz diff --git a/cacti.spec b/cacti.spec index a09517b..e4df6cf 100644 --- a/cacti.spec +++ b/cacti.spec @@ -1,8 +1,8 @@ %{!?_pkgdocdir: %global _pkgdocdir %{_docdir}/%{name}-%{version}} Name: cacti -Version: 1.2.21 -Release: 2%{?dist} +Version: 1.2.22 +Release: 1%{?dist} Summary: An rrd based graphing tool License: GPLv2+ URL: https://www.cacti.net/ @@ -219,6 +219,9 @@ fi %ghost %{_datadir}/%{name}/resource.rpmmoved %changelog +* Sat Oct 22 2022 Morten Stevens <mstevens(a)fedoraproject.org> - 1.2.22-1 +- Update to 1.2.22 + * Wed Jul 20 2022 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.2.21-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild diff --git a/sources b/sources index 813a3b7..ee3ce10 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (cacti-1.2.21.tar.gz) = 084ff9135dd0a92596a4d65f2fd461c8e84907ff87e467f6d144ee3b52ef7aeb44ffa5a8c25e74e5ff25588bc6c5b13b44ab2f24ef5e1c6652513b5c2a39f78d +SHA512 (cacti-1.2.22.tar.gz) = 95e96f8b05b07a1620bc4eae37250ea7e9e49383fe5e2c2993d06b735cb24b95229fb0788b588bc033ab0304ca82119a0cf9d24becb11f2a234c2a612c6dd965 https://src.fedoraproject.org/rpms/cacti/c/7fce402e46d42b5442d15c7d4c08d7c7…

1 0

mstevens pushed to rpms/cacti (rawhide). "Update to 1.2.22"
by notifications＠fedoraproject.org 31 Oct '22

31 Oct '22

Notification time stamped 2022-10-22 22:19:02 UTC From 7fce402e46d42b5442d15c7d4c08d7c72062e686 Mon Sep 17 00:00:00 2001 From: Morten Stevens <mstevens(a)fedoraproject.org> Date: Oct 22 2022 22:18:52 +0000 Subject: Update to 1.2.22 --- diff --git a/.gitignore b/.gitignore index e7abb2d..c43553e 100644 --- a/.gitignore +++ b/.gitignore @@ -55,3 +55,4 @@ /cacti-1.2.19.tar.gz /cacti-1.2.20.tar.gz /cacti-1.2.21.tar.gz +/cacti-1.2.22.tar.gz diff --git a/cacti.spec b/cacti.spec index a09517b..e4df6cf 100644 --- a/cacti.spec +++ b/cacti.spec @@ -1,8 +1,8 @@ %{!?_pkgdocdir: %global _pkgdocdir %{_docdir}/%{name}-%{version}} Name: cacti -Version: 1.2.21 -Release: 2%{?dist} +Version: 1.2.22 +Release: 1%{?dist} Summary: An rrd based graphing tool License: GPLv2+ URL: https://www.cacti.net/ @@ -219,6 +219,9 @@ fi %ghost %{_datadir}/%{name}/resource.rpmmoved %changelog +* Sat Oct 22 2022 Morten Stevens <mstevens(a)fedoraproject.org> - 1.2.22-1 +- Update to 1.2.22 + * Wed Jul 20 2022 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.2.21-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild diff --git a/sources b/sources index 813a3b7..ee3ce10 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (cacti-1.2.21.tar.gz) = 084ff9135dd0a92596a4d65f2fd461c8e84907ff87e467f6d144ee3b52ef7aeb44ffa5a8c25e74e5ff25588bc6c5b13b44ab2f24ef5e1c6652513b5c2a39f78d +SHA512 (cacti-1.2.22.tar.gz) = 95e96f8b05b07a1620bc4eae37250ea7e9e49383fe5e2c2993d06b735cb24b95229fb0788b588bc033ab0304ca82119a0cf9d24becb11f2a234c2a612c6dd965 https://src.fedoraproject.org/rpms/cacti/c/7fce402e46d42b5442d15c7d4c08d7c7…

1 0

mstevens pushed to rpms/cacti-spine (rawhide). "Update to 1.2.22"
by notifications＠fedoraproject.org 31 Oct '22

31 Oct '22

Notification time stamped 2022-10-22 22:14:13 UTC From ff46d800dc4949a54a458a43e5850e4464a6ddde Mon Sep 17 00:00:00 2001 From: Morten Stevens <mstevens(a)fedoraproject.org> Date: Oct 22 2022 22:14:05 +0000 Subject: Update to 1.2.22 --- diff --git a/.gitignore b/.gitignore index f4d5ff1..97437fe 100644 --- a/.gitignore +++ b/.gitignore @@ -20,3 +20,4 @@ /cacti-spine-1.2.19.tar.gz /cacti-spine-1.2.20.tar.gz /cacti-spine-1.2.21.tar.gz +/cacti-spine-1.2.22.tar.gz diff --git a/cacti-spine-disable-des.patch b/cacti-spine-disable-des.patch deleted file mode 100644 index 0a86683..0000000 --- a/cacti-spine-disable-des.patch +++ /dev/null @@ -1,22 +0,0 @@ -From 0e90e50867956f27213fc76b4567beca82b98728 Mon Sep 17 00:00:00 2001 -From: Morten Stevens <mstevens(a)fedoraproject.org> -Date: Sat, 9 Apr 2022 17:37:29 +0200 -Subject: [PATCH] Disable DES if Net-SNMP doesn't have it (#220) - ---- - snmp.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/snmp.c b/snmp.c -index ea4e296..8fca547 100644 ---- a/snmp.c -+++ b/snmp.c -@@ -283,7 +283,7 @@ void *snmp_host_init(int host_id, char *hostname, int snmp_version, char *snmp_c - } - } else { - if (strcmp(snmp_priv_protocol, "DES") == 0) { -- #if defined(USM_PRIV_PROTO_DES_LEN) -+ #if defined(USM_PRIV_PROTO_DES_LEN) && !defined(NETSNMP_DISABLE_DES) - session.securityPrivProto = snmp_duplicate_objid(usmDESPrivProtocol, USM_PRIV_PROTO_DES_LEN); - session.securityPrivProtoLen = USM_PRIV_PROTO_DES_LEN; - session.securityPrivKeyLen = USM_PRIV_KU_LEN; diff --git a/cacti-spine.spec b/cacti-spine.spec index 5a880a1..dc97694 100644 --- a/cacti-spine.spec +++ b/cacti-spine.spec @@ -1,6 +1,6 @@ Name: cacti-spine -Version: 1.2.21 -Release: 2%{?dist} +Version: 1.2.22 +Release: 1%{?dist} Summary: Threaded poller for Cacti written in C License: LGPLv2+ URL: https://cacti.net @@ -48,6 +48,9 @@ autoreconf -fiv %{_mandir}/man1/spine.1.* %changelog +* Sat Oct 22 2022 Morten Stevens <mstevens(a)fedoraproject.org> - 1.2.22-1 +- Update to 1.2.22 + * Wed Jul 20 2022 Fedora Release Engineering <releng(a)fedoraproject.org> - 1.2.21-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild diff --git a/sources b/sources index 18a9ec0..b54b1b4 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (cacti-spine-1.2.21.tar.gz) = 8cd15b3a25e956db3c9e26961afef6bee1cdde5ada4a818a7c2b19ab1a4b3498d34ab01ff67c67e2a36fe1c9d557cb6cc38c864f844dd6ab672166ce132d3dfb +SHA512 (cacti-spine-1.2.22.tar.gz) = fee4c0eba4a649ed48d0f1fd617f32e696c82377b01c4e4c99b36759bc35d045741f75a4977530a10e457b8c923d23ec72f79034897bba2fb998da4e19432fd3 https://src.fedoraproject.org/rpms/cacti-spine/c/ff46d800dc4949a54a458a43e5…

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

scm-commits November 2022