Bug 1962035

Summary: dovecot: Port to OpenSSL 3.0
Product: Red Hat Enterprise Linux 9 Reporter: Sahana Prasad <sahana>
Component: dovecotAssignee: Michal Hlavinka <mhlavink>
Status: CLOSED CURRENTRELEASE QA Contact: Evgeny Fedin <efedin>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: CentOS StreamCC: bstinson, efedin, fweimer, jwboyer, sahana
Target Milestone: betaKeywords: Triaged
Target Release: ---Flags: pm-rhel: mirror+
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: dovecot-2.3.14-3.el9 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2022-01-12 11:26:32 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1958021    
Attachments:
Description Flags
simple fix to make dovecot work with openssl 3.0 none

Comment 1 Michal Hlavinka 2021-05-25 10:46:38 UTC 
I've spent quite some time looking into this, but progress is slow as code compiles without problem, but runtime test fail and openssl is not really friendly for debugging (private internal structures). I don't expect it to be ready for ITM 13 as was asked in the email. Nine days is not nearly enough.

What is "plan B"? Should I change build requirement to compat-openssl11 or... ?
Comment 4 Michal Hlavinka 2021-06-03 18:48:43 UTC 
Created attachment 1788877 [details]
simple fix to make dovecot work with openssl 3.0

This is simple fix that makes dovecot work with openssl 3.0

dovecot uses access to EVP_PKEY->EC_KEY to set asn1 flag OPENSSL_EC_NAMED_CURVE and conversion format POINT_CONVERSION_COMPRESSED and also ECDSA_do_sign/ECDSA_do_verify

This used EVP_PKEY_get0_EC_KEY that was changed in 3.0 to return const read only data. This can be somewhat circumvent by using EVP_PKEY_get1_EC_KEY + EC_KEY_free, but in some cases this returns copy of EC_KEY which means that setting parameters on it has no effect on the EVP_PKEY key itself.

This patch creates #define replacement, that it gets the copy (get1) and writes it back immediately, keeping the EC_KEY pointer.
Comment 8 Evgeny Fedin 2021-06-28 08:50:54 UTC 
No regression has been found, verified