登录
当前位置： 首页 > 工具软件 > OpenSSL > 使用案例 >

centos8编译openssl-1.0.2u、openssl-1.1.1k

唐高朗
2023-12-01

目录

一、给openssl-1.0.2u打包rpm

二、编译安装openssl-1.1.1k

三、给openssl-1.1.1k打包rpm（不推荐！）

近日openssl爆出拒绝服务、证书绕过漏洞，CVE编号CVE-2021-3449、CVE-2021-3450。

解决方法：
CentOS7默认openssl版本1.0.2，不受影响。
CentOS8默认openssl版本1.1.1，受影响，需要到OpenSSL1.1.1k及以上版本。

记录centos8编译打包openssl-1.0.2u、openssl-1.1.1k的过程。

一、给openssl-1.0.2u打包rpm

从官网https://www.openssl.org/source/old/1.0.2/下载openssl-1.0.2u.tar.gz，并做sha256校验。

cd rpmbuild/SOURCES/
wget https://www.openssl.org/source/old/1.0.2/openssl-1.0.2u.tar.gz
sha256sum ./openssl-1.0.2u.tar.gz
ecd0c6ffb493dd06707d38b14bb4d8c2288bb7033735606569d8f90f89669d16  ./openssl-1.0.2u.tar.gz

解压缩，把spec文件copy到SPEC目录下。 

tar xvzf openssl-1.0.2u.tar.gz
cp openssl-1.0.2u/openssl.spec ../SPECS/openssl-1.0.2u.spec

编译打包openssl-1.0.2u并排错。报错Can't locate find.pl in @INC (@INC contains: /usr/local/lib64/perl5 /usr/local/share/perl5 /usr/lib64/perl5/vendor_perl /usr/share/perl5/vendor_perl /usr/lib64/perl5，解决方案是安装依赖perl-Perl4-CoreLibs.noarch

rpmbuild -ba openssl-1.0.2u.spec

Can't locate find.pl in @INC (@INC contains: /usr/local/lib64/perl5 /usr/local/share/perl5 /usr/lib64/perl5/vendor_perl /usr/share/perl5/vendor_perl /usr/lib64/perl5 /usr/share/perl5) at util/perlpath.pl line 7.
error: Bad exit status from /var/tmp/rpm-tmp.IaQ3r6 (%build)

RPM build errors:
    bogus date in %changelog: Sun Jun  6 2005 Richard Levitte <richard@levitte.org>
    bogus date in %changelog: Tue Sep 10 1999 Damien Miller <damien@ibs.com.au>
    Bad exit status from /var/tmp/rpm-tmp.IaQ3r6 (%build)

yum install perl-Perl4-CoreLibs.noarch

 编译打包openssl-1.0.2u成功。

rpmbuild -ba --clean openssl-1.0.2u.spec
……
Wrote: /home/cnpe/rpmbuild/SRPMS/openssl-1.0.2u-1.src.rpm
Wrote: /home/cnpe/rpmbuild/RPMS/x86_64/openssl-1.0.2u-1.x86_64.rpm
Wrote: /home/cnpe/rpmbuild/RPMS/x86_64/openssl-devel-1.0.2u-1.x86_64.rpm
Wrote: /home/cnpe/rpmbuild/RPMS/x86_64/openssl-doc-1.0.2u-1.x86_64.rpm

二、编译安装openssl-1.1.1k

从官网https://www.openssl.org/source/下载openssl-1.1.1k.tar.gz，并做sha256校验，再解压缩。

wget https://www.openssl.org/source/openssl-1.1.1k.tar.gz

sha256sum ./openssl-1.1.1k.tar.gz
892a0875b9872acd04a9fde79b1f943075d5ea162415de3047c327df33fbaee5  ./openssl-1.1.1k.tar.gz

tar xvzf openssl-1.1.1k.tar.gz

编译安装
config生成Makefile
make编译，make test的结果一定要PASS
make install安装，或者其他选项只安装你需要的内容
如果在这些过程中提示有依赖项就安装，不OK就解决，再make clean后重新来过。

cd openssl-1.1.1k
./config
make
make test
make install

 这样编译安装以后，openssl的版本升级到了1.1.1k，但是库文件仍使用原来1.1.1g版本的，不会影响使用。

openssl version
OpenSSL 1.1.1k  25 Mar 2021 (Library: OpenSSL 1.1.1g FIPS  21 Apr 2020)

三、给openssl-1.1.1k打包rpm（不推荐！动态库不兼容！）

这个包安装上以后，会导致严重的故障。

[root@test18 x86_64]# rpm --version
rpm: symbol lookup error: /lib64/librpmio.so.8: undefined symbol: EVP_md2, version OPENSSL_1_1_0

[root@test18 x86_64]# yum remove openssl
Traceback (most recent call last):
......
ImportError: /lib64/libk5crypto.so.3: undefined symbol: EVP_KDF_ctrl, version OPENSSL_1_1_1b
......


[root@test18 ~]# ldd /lib64/librpmio.so.8 | grep crypto
	libcrypto.so.1.1 => /lib64/libcrypto.so.1.1 (0x00007f299ed70000)
[root@test18 ~]# ldd /lib64/libk5crypto.so.3 | grep crypto
	libcrypto.so.1.1 => /lib64/libcrypto.so.1.1 (0x00007fea0bf97000)

原因是这种方式会替换库文件，不能替换这个库文件详细的原因在这个地方有https://github.com/openssl/openssl/issues/11471，请自行查看。

[root@test18 ~]# ll /lib64/libcrypto.so.1.1
lrwxrwxrwx. 1 root root 19 Dec 18 06:45 /lib64/libcrypto.so.1.1 -> libcrypto.so.1.1.1g
[root@test18 ~]# nm -gD /lib64/libcrypto.so.1.1 | grep EVP_KDF
0000000000170530 T EVP_KDF_ctrl
0000000000170620 T EVP_KDF_ctrl_str
0000000000170370 T EVP_KDF_CTX_free
00000000001703b0 T EVP_KDF_CTX_new_id
00000000001706e0 T EVP_KDF_derive
00000000001704d0 T EVP_KDF_reset
00000000001706b0 T EVP_KDF_size
0000000000170500 T EVP_KDF_vctrl

[root@test18 x86_64]# ll /lib64/libcrypto.so.1.1
lrwxrwxrwx. 1 root root 19 Apr  5 12:58 /lib64/libcrypto.so.1.1 -> libcrypto.so.1.1.1k
[root@test18 x86_64]# nm -gD /lib64/libcrypto.so.1.1 | grep EVP_KDF
Nothing！！！

这里只是记录编译打包的过程，不推荐使用！

从官网https://www.openssl.org/source/下载openssl-1.1.1k.tar.gz，并做sha256校验。解压缩，发现这个版本没有现成的spec文件。经查证在http://rpmfind.net/可以找到openssl-1.1.1g-12.el8.src.rpm这个包，这个包里面有1.1.1g版本的spec文件，可以找来使用。
该rpm文件cpio提取归档文件不会生成目录，因此建立一个目录存放，再下载。

mkdir openssl-1.1.1g-src
cd openssl-1.1.1g-src/
wget http://vault.centos.org/8.3.2011/BaseOS/Source/SPackages/openssl-1.1.1g-12.el8_3.src.rpm
rpm2cpio openssl-1.1.1g-12.el8_3.src.rpm | cpio -duim

提取的文件很多，把其中的openssl.spec拷贝到rpmbuild/SPECS目录下，并编辑openssl-1.1.1k.spec，修改源代码文件、版本、删除不需要的内容，最终形成openssl-1.1.1k.spec文件，内容如下。

# For the curious:
# 0.9.5a soversion = 0
# 0.9.6  soversion = 1
# 0.9.6a soversion = 2
# 0.9.6c soversion = 3
# 0.9.7a soversion = 4
# 0.9.7ef soversion = 5
# 0.9.8ab soversion = 6
# 0.9.8g soversion = 7
# 0.9.8jk + EAP-FAST soversion = 8
# 1.0.0 soversion = 10
# 1.1.0 soversion = 1.1 (same as upstream although presence of some symbols
#                        depends on build configuration options)
%define soversion 1.1
%define debug_package %{nil}

Summary: Utilities from the general purpose cryptography library with TLS implementation
Name: openssl
Version: 1.1.1k
Release: 1%{?dist}
Epoch: 1
License: OpenSSL and ASL 2.0
URL: http://www.openssl.org/
BuildRequires: gcc
BuildRequires: coreutils, perl-interpreter, sed, zlib-devel, /usr/bin/cmp
BuildRequires: lksctp-tools-devel
BuildRequires: /usr/bin/rename
BuildRequires: /usr/bin/pod2man
BuildRequires: /usr/sbin/sysctl
BuildRequires: perl(Test::Harness), perl(Test::More), perl(Math::BigInt)
BuildRequires: perl(Module::Load::Conditional), perl(File::Temp)
BuildRequires: perl(Time::HiRes)
BuildRequires: perl(FindBin), perl(lib), perl(File::Compare), perl(File::Copy)
Requires: coreutils
Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
Source0:openssl-%{version}.tar.gz

%description
The OpenSSL toolkit provides support for secure communications between
machines. OpenSSL includes a certificate management tool and shared
libraries which provide various cryptographic algorithms and
protocols.

%package libs
Summary: A general purpose cryptography library with TLS implementation
Requires: ca-certificates >= 2008-5
Requires: crypto-policies >= 20180730
Recommends: openssl-pkcs11%{?_isa}
# Needed obsoletes due to the base/lib subpackage split
Obsoletes: openssl < 1:1.0.1-0.3.beta3
Obsoletes: openssl-fips < 1:1.0.1e-28
Provides: openssl-fips = %{epoch}:%{version}-%{release}

%description libs
OpenSSL is a toolkit for supporting cryptography. The openssl-libs
package contains the libraries that are used by various applications which
support cryptographic algorithms and protocols.

%package devel
Summary: Files for development of applications which will use OpenSSL
Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
Requires: krb5-devel%{?_isa}, zlib-devel%{?_isa}
Requires: pkgconfig

%description devel
OpenSSL is a toolkit for supporting cryptography. The openssl-devel
package contains include files needed to develop applications which
support various cryptographic algorithms and protocols.

%package static
Summary:  Libraries for static linking of applications which will use OpenSSL
Requires: %{name}-devel%{?_isa} = %{epoch}:%{version}-%{release}

%description static
OpenSSL is a toolkit for supporting cryptography. The openssl-static
package contains static libraries needed for static linking of
applications which support various cryptographic algorithms and
protocols.

%package perl
Summary: Perl scripts provided with OpenSSL
Requires: perl-interpreter
Requires: %{name}%{?_isa} = %{epoch}:%{version}-%{release}

%description perl
OpenSSL is a toolkit for supporting cryptography. The openssl-perl
package provides Perl scripts for converting certificates and keys
from other formats to the formats used by the OpenSSL toolkit.

%prep
%setup -q -n %{name}-%{version}

%build
#./config \
#	--prefix=/usr/bin \
#	--openssldir=/etc/pki/tls \
#	--libdir=/usr/lib64 \

#./config \
#	--prefix=%{_bindir} \
#	--openssldir=%{_sysconfdir}/pki/tls \
#	--libdir=%{_prefix}/lib64 \

./config \
        --prefix=%{_prefix} \
        --openssldir=%{_sysconfdir}/pki/tls \

make all

# Clean up the .pc files
#for i in libcrypto.pc libssl.pc openssl.pc ; do
#  sed -i '/^Libs.private:/{s/-L[^ ]* //;s/-Wl[^ ]* //}' $i
#done

%check
# Verify that what was compiled actually works.
make test

%install
[ "$RPM_BUILD_ROOT" != "/" ] && rm -rf $RPM_BUILD_ROOT
# Install OpenSSL.
install -d $RPM_BUILD_ROOT{%{_bindir},%{_includedir},%{_libdir},%{_mandir},%{_libdir}/openssl,%{_pkgdocdir}}
make DESTDIR=$RPM_BUILD_ROOT install
make DESTDIR=$RPM_BUILD_ROOT uninstall_html_docs
rename so.%{soversion} so.%{version} $RPM_BUILD_ROOT%{_libdir}/*.so.%{soversion}
for lib in $RPM_BUILD_ROOT%{_libdir}/*.so.%{version} ; do
	chmod 755 ${lib}
	ln -s -f `basename ${lib}` $RPM_BUILD_ROOT%{_libdir}/`basename ${lib} .%{version}`
	ln -s -f `basename ${lib}` $RPM_BUILD_ROOT%{_libdir}/`basename ${lib} .%{version}`.%{soversion}
done

# Install a makefile for generating keys and self-signed certs, and a script
# for generating them on the fly.
#mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/certs
#install -m644 %{SOURCE2} $RPM_BUILD_ROOT%{_pkgdocdir}/Makefile.certificate
#install -m755 %{SOURCE6} $RPM_BUILD_ROOT%{_bindir}/make-dummy-cert
#install -m755 %{SOURCE7} $RPM_BUILD_ROOT%{_bindir}/renew-dummy-cert

# Move runable perl scripts to bindir
mv $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/misc/*.pl $RPM_BUILD_ROOT%{_bindir}
mv $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/misc/tsget $RPM_BUILD_ROOT%{_bindir}


# Rename man pages so that they don't conflict with other system man pages.
pushd $RPM_BUILD_ROOT%{_mandir}
ln -s -f config.5 man5/openssl.cnf.5
for manpage in man*/* ; do
	if [ -L ${manpage} ]; then
		TARGET=`ls -l ${manpage} | awk '{ print $NF }'`
		ln -snf ${TARGET}ssl ${manpage}ssl
		rm -f ${manpage}
	else
		mv ${manpage} ${manpage}ssl
	fi
done
for conflict in passwd rand ; do
	rename ${conflict} ssl${conflict} man*/${conflict}*
# Fix dangling symlinks
	manpage=man1/openssl-${conflict}.*
	if [ -L ${manpage} ] ; then
		ln -snf ssl${conflict}.1ssl ${manpage}
	fi
done
popd

mkdir -m755 $RPM_BUILD_ROOT%{_sysconfdir}/pki/CA
mkdir -m700 $RPM_BUILD_ROOT%{_sysconfdir}/pki/CA/private
mkdir -m755 $RPM_BUILD_ROOT%{_sysconfdir}/pki/CA/certs
mkdir -m755 $RPM_BUILD_ROOT%{_sysconfdir}/pki/CA/crl
mkdir -m755 $RPM_BUILD_ROOT%{_sysconfdir}/pki/CA/newcerts

# Ensure the config file timestamps are identical across builds to avoid
# mulitlib conflicts and unnecessary renames on upgrade
#touch -r %{SOURCE2} $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/openssl.cnf
#touch -r %{SOURCE2} $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/ct_log_list.cnf

rm -f $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/openssl.cnf.dist
rm -f $RPM_BUILD_ROOT%{_sysconfdir}/pki/tls/ct_log_list.cnf.dist

# Determine which arch opensslconf.h is going to try to #include.
basearch=%{_arch}
%ifarch %{ix86}
basearch=i386
%endif
%ifarch sparcv9
basearch=sparc
%endif
%ifarch sparc64
basearch=sparc64
%endif

%ifarch %{multilib_arches}
# Do an opensslconf.h switcheroo to avoid file conflicts on systems where you
# can have both a 32- and 64-bit version of the library, and they each need
# their own correct-but-different versions of opensslconf.h to be usable.
install -m644 %{SOURCE10} \
	$RPM_BUILD_ROOT/%{_prefix}/include/openssl/opensslconf-${basearch}.h
cat $RPM_BUILD_ROOT/%{_prefix}/include/openssl/opensslconf.h >> \
	$RPM_BUILD_ROOT/%{_prefix}/include/openssl/opensslconf-${basearch}.h
install -m644 %{SOURCE9} \
	$RPM_BUILD_ROOT/%{_prefix}/include/openssl/opensslconf.h
%endif
LD_LIBRARY_PATH=`pwd`${LD_LIBRARY_PATH:+:${LD_LIBRARY_PATH}}
export LD_LIBRARY_PATH

%files
%{!?_licensedir:%global license %%doc}
%license LICENSE
%doc FAQ NEWS README README.FIPS
%{_bindir}/openssl
%{_mandir}/man1*/*
%{_mandir}/man5*/*
%{_mandir}/man7*/*
%exclude %{_mandir}/man1*/*.pl*
%exclude %{_mandir}/man1*/c_rehash*
%exclude %{_mandir}/man1*/tsget*
%exclude %{_mandir}/man1*/openssl-tsget*

%files libs
%{!?_licensedir:%global license %%doc}
%license LICENSE
%dir %{_sysconfdir}/pki/tls
%dir %{_sysconfdir}/pki/tls/certs
%dir %{_sysconfdir}/pki/tls/misc
%dir %{_sysconfdir}/pki/tls/private
%config(noreplace) %{_sysconfdir}/pki/tls/openssl.cnf
%config(noreplace) %{_sysconfdir}/pki/tls/ct_log_list.cnf
%attr(0755,root,root) %{_libdir}/libcrypto.so.%{version}
%attr(0755,root,root) %{_libdir}/libcrypto.so.%{soversion}
%attr(0755,root,root) %{_libdir}/libssl.so.%{version}
%attr(0755,root,root) %{_libdir}/libssl.so.%{soversion}
%attr(0755,root,root) %{_libdir}/engines-%{soversion}

%files devel
%doc CHANGES doc/dir-locals.example.el doc/openssl-c-indent.el
%{_prefix}/include/openssl
%{_libdir}/*.so
%{_mandir}/man3*/*
%{_libdir}/pkgconfig/*.pc

%files static
%{_libdir}/*.a

%files perl
%{_bindir}/c_rehash
%{_bindir}/*.pl
%{_bindir}/tsget
%{_mandir}/man1*/*.pl*
%{_mandir}/man1*/c_rehash*
%{_mandir}/man1*/tsget*
%{_mandir}/man1*/openssl-tsget*
%dir %{_sysconfdir}/pki/CA
%dir %{_sysconfdir}/pki/CA/private
%dir %{_sysconfdir}/pki/CA/certs
%dir %{_sysconfdir}/pki/CA/crl
%dir %{_sysconfdir}/pki/CA/newcerts

%post libs -p /sbin/ldconfig

%postun libs -p /sbin/ldconfig

%changelog

然后rpmbuild -ba --clean openssl-1.1.1k.spec，得到openssl-1.1.1k的rpm包。

rpmbuild -ba --clean openssl-1.1.1k.spec
......
Wrote: /home/cnpe/rpmbuild/SRPMS/openssl-1.1.1k-1.el8.src.rpm
Wrote: /home/cnpe/rpmbuild/RPMS/x86_64/openssl-1.1.1k-1.el8.x86_64.rpm
Wrote: /home/cnpe/rpmbuild/RPMS/x86_64/openssl-libs-1.1.1k-1.el8.x86_64.rpm
Wrote: /home/cnpe/rpmbuild/RPMS/x86_64/openssl-devel-1.1.1k-1.el8.x86_64.rpm
Wrote: /home/cnpe/rpmbuild/RPMS/x86_64/openssl-static-1.1.1k-1.el8.x86_64.rpm
Wrote: /home/cnpe/rpmbuild/RPMS/x86_64/openssl-perl-1.1.1k-1.el8.x86_64.rpm
......

 

 类似资料：

相关阅读

无法链接OpenSSL代码使用Java解密OpenSSL PEM编码的RSA私钥？将OpenSSL库链接到程序如何在python中导入OpenSSL如何在Mac上更新OpenSSL？

相关文章

Java11 免编译启动动态编译之JavassistC语言条件编译GCC -S选项：编译非汇编文件Kotlin 使用命令行编译

相关问答

“openssl genrsa”和“openssl genpkey-算法rsa”之间的区别？Ruby OpenSSL AES-128-CTR用openssl解密mcryptopenssl - OpenSSL: error:0A000126:SSL routines::unexpected eof while reading ,如何解决?Openssl ECDSA ： 私钥密码

相关文档

Android 开机 和 编译系统 和 binder翻译漫谈 怎样翻译更地道StackExchange.Redis 文档翻译RxJava Essentials 中文翻译版Effective Modern C++ 中文翻译
快捷导航： 新手教程 算法原理 架构设计 Java进阶 数据库进阶 大厂专栏 面试经验 编程笔记 编程问答 所有专题 文档资料 工具软件 电子书籍 小牛导航
在线工具： 房贷计算器 个税计算器 Linux命令查询 Json格式化 正则表达式 颜色转换 AES加解密 SHA1加密 MD5加密 毒鸡汤 字数统计 随机密码生成 进制转换 Base64编解码 励志句子
Copyright © 2019-2024 小牛知识库@xnip.cn. All Rights Reserved.