Bug 2133809

Do you plan to rebase to OpenSSL 3.0.3, so that you get the full symbol set at this version? RPM dependency management only works at the symbol set level, so things go wrong if you backport only part of the set. (Perhaps you are lucky and it's just the pair, them there's no problem.)

I assume it's just an internal hack, so whatever works with our toolchain is acceptable. This appears to work

cat > t.c <<EOF
int __attribute__ ((symver ("OPENSSL_strcasecmp.1"),
                    symver ("OPENSSL_strcasecmp@@OPENSSL_3.0.3")))
OPENSSL_strcasecmp (const char *a, const char *b)
{
  return 0;
}
EOF
cat > t.lds <<EOF
OPENSSL_3.0.1 {
  global: OPENSSL_strcasecmp;
  local: *;
};
OPENSSL_3.0.3 {
  global: OPENSSL_strcasecmp;
  local: *;
} OPENSSL_3.0.1;
EOF
gcc -Wall -O2 -shared -fpic t.c -Wl,--version-script t.lds

@@ is the default version, @ is for compatibility with old binaries. It appears to work with gcc-11.3.1-2.1.el9.x86_64 and
binutils-2.35.2-24.el9.x86_64. It should be LTO-compatible, too. If there are issues, we can and should fix them on the toolchain side (symver had bugs before). Note that this is not suitable for upstream use because symver support in GCC and multi-.symver support in binutils are fairly recent.

If I remember the challenges from the OpenSSL 3 transitions correctly, your main issue will be integrating this approach into the OpenSSL build process and its idiosyncratic approach to symbol management. (The glibc build system has the same problem, although the details are of course very different.)

We plan to rebase to 3.0.7

Thank you very much!

To avoid the problems I met, I added -Wl,--allow-multiple-definition to compiler options. And, as FIPS module builds these functions itself, I wrapped the extra attributes with #ifndef FIPS_MODULE

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Low: openssl security and bug fix update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2023:2523