Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
home:jengelh:branches:security:tls
openssl-3
openssl-Allow-disabling-of-SHA1-signatures.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File openssl-Allow-disabling-of-SHA1-signatures.patch of Package openssl-3
From 2e8388e06eafb703aeb315498915bf079561bdb5 Mon Sep 17 00:00:00 2001 From: Dmitry Belyavskiy <dbelyavs@redhat.com> Date: Mon, 21 Aug 2023 13:07:07 +0200 Subject: 0049-Allow-disabling-of-SHA1-signatures.patch Patch-name: 0049-Allow-disabling-of-SHA1-signatures.patch Patch-id: 49 Patch-status: | # Selectively disallow SHA1 signatures rhbz#2070977 From-dist-git-commit: 9409bc7044cf4b5773639cce20f51399888c45fd --- crypto/context.c | 14 ++++ crypto/evp/evp_cnf.c | 13 +++ crypto/evp/m_sigver.c | 79 +++++++++++++++++++ crypto/evp/pmeth_lib.c | 15 ++++ doc/man5/config.pod | 13 +++ include/crypto/context.h | 3 + include/internal/cryptlib.h | 3 +- include/internal/sslconf.h | 4 + providers/common/securitycheck.c | 20 +++++ providers/common/securitycheck_default.c | 9 ++- providers/implementations/signature/dsa_sig.c | 11 ++- .../implementations/signature/ecdsa_sig.c | 4 + providers/implementations/signature/rsa_sig.c | 20 ++++- ssl/t1_lib.c | 8 ++ util/libcrypto.num | 2 + 15 files changed, 209 insertions(+), 9 deletions(-) Index: openssl-3.2.3/crypto/context.c =================================================================== --- openssl-3.2.3.orig/crypto/context.c +++ openssl-3.2.3/crypto/context.c @@ -82,6 +82,8 @@ struct ossl_lib_ctx_st { void *fips_prov; #endif + void *legacy_digest_signatures; + unsigned int ischild:1; }; @@ -222,6 +224,10 @@ static int context_init(OSSL_LIB_CTX *ct goto err; #endif + ctx->legacy_digest_signatures = ossl_ctx_legacy_digest_signatures_new(ctx); + if (ctx->legacy_digest_signatures == NULL) + goto err; + /* Low priority. */ #ifndef FIPS_MODULE ctx->child_provider = ossl_child_prov_ctx_new(ctx); @@ -365,6 +371,11 @@ static void context_deinit_objs(OSSL_LIB } #endif + if (ctx->legacy_digest_signatures != NULL) { + ossl_ctx_legacy_digest_signatures_free(ctx->legacy_digest_signatures); + ctx->legacy_digest_signatures = NULL; + } + /* Low priority. */ #ifndef FIPS_MODULE if (ctx->child_provider != NULL) { @@ -662,6 +673,9 @@ void *ossl_lib_ctx_get_data(OSSL_LIB_CTX return ctx->fips_prov; #endif + case OSSL_LIB_CTX_LEGACY_DIGEST_SIGNATURES_INDEX: + return ctx->legacy_digest_signatures; + default: return NULL; } Index: openssl-3.2.3/crypto/evp/evp_cnf.c =================================================================== --- openssl-3.2.3.orig/crypto/evp/evp_cnf.c +++ openssl-3.2.3/crypto/evp/evp_cnf.c @@ -10,6 +10,7 @@ #include <stdio.h> #include <openssl/crypto.h> #include "internal/cryptlib.h" +#include "internal/sslconf.h" #include <openssl/conf.h> #include <openssl/x509.h> #include <openssl/x509v3.h> @@ -57,6 +58,18 @@ static int alg_module_init(CONF_IMODULE ERR_raise(ERR_LIB_EVP, EVP_R_SET_DEFAULT_PROPERTY_FAILURE); return 0; } + } else if (strcmp(oval->name, "rh-allow-sha1-signatures") == 0) { + int m; + + /* Detailed error already reported. */ + if (!X509V3_get_value_bool(oval, &m)) + return 0; + + if (!ossl_ctx_legacy_digest_signatures_allowed_set( + NCONF_get0_libctx((CONF *)cnf), m > 0, 0)) { + ERR_raise(ERR_LIB_EVP, EVP_R_SET_DEFAULT_PROPERTY_FAILURE); + return 0; + } } else { ERR_raise_data(ERR_LIB_EVP, EVP_R_UNKNOWN_OPTION, "name=%s, value=%s", oval->name, oval->value); Index: openssl-3.2.3/crypto/evp/m_sigver.c =================================================================== --- openssl-3.2.3.orig/crypto/evp/m_sigver.c +++ openssl-3.2.3/crypto/evp/m_sigver.c @@ -15,6 +15,69 @@ #include "internal/provider.h" #include "internal/numbers.h" /* includes SIZE_MAX */ #include "evp_local.h" +#include "crypto/context.h" + +typedef struct ossl_legacy_digest_signatures_st { + int allowed; +} OSSL_LEGACY_DIGEST_SIGNATURES; + +void ossl_ctx_legacy_digest_signatures_free(void *vldsigs) +{ + OSSL_LEGACY_DIGEST_SIGNATURES *ldsigs = vldsigs; + + if (ldsigs != NULL) { + OPENSSL_free(ldsigs); + } +} + +void *ossl_ctx_legacy_digest_signatures_new(OSSL_LIB_CTX *ctx) +{ + OSSL_LEGACY_DIGEST_SIGNATURES* ldsigs = OPENSSL_zalloc(sizeof(OSSL_LEGACY_DIGEST_SIGNATURES)); + /* Default to allow SHA-1 and support disabling it via config. */ + ldsigs->allowed = 1; + return ldsigs; +} + +static OSSL_LEGACY_DIGEST_SIGNATURES *ossl_ctx_legacy_digest_signatures( + OSSL_LIB_CTX *libctx, int loadconfig) +{ +#ifndef FIPS_MODULE + if (loadconfig && !OPENSSL_init_crypto(OPENSSL_INIT_LOAD_CONFIG, NULL)) + return NULL; +#endif + + return ossl_lib_ctx_get_data(libctx, OSSL_LIB_CTX_LEGACY_DIGEST_SIGNATURES_INDEX); +} + +int ossl_ctx_legacy_digest_signatures_allowed(OSSL_LIB_CTX *libctx, int loadconfig) +{ + OSSL_LEGACY_DIGEST_SIGNATURES *ldsigs + = ossl_ctx_legacy_digest_signatures(libctx, loadconfig); + +#ifndef FIPS_MODULE + if (ossl_safe_getenv("OPENSSL_ENABLE_SHA1_SIGNATURES") != NULL) + /* This is to be used in tests if SHA-1 is disabled. */ + return 1; +#endif + + /* Default to allow SHA-1 and support disabling it via config. */ + return ldsigs != NULL ? ldsigs->allowed : 1; +} + +int ossl_ctx_legacy_digest_signatures_allowed_set(OSSL_LIB_CTX *libctx, int allow, + int loadconfig) +{ + OSSL_LEGACY_DIGEST_SIGNATURES *ldsigs + = ossl_ctx_legacy_digest_signatures(libctx, loadconfig); + + if (ldsigs == NULL) { + ERR_raise(ERR_LIB_EVP, ERR_R_INTERNAL_ERROR); + return 0; + } + + ldsigs->allowed = allow; + return 1; +} #ifndef FIPS_MODULE @@ -253,6 +316,18 @@ static int do_sigver_init(EVP_MD_CTX *ct } } + if (ctx->reqdigest != NULL + && !EVP_PKEY_is_a(locpctx->pkey, SN_hmac) + && !EVP_PKEY_is_a(locpctx->pkey, SN_tls1_prf) + && !EVP_PKEY_is_a(locpctx->pkey, SN_hkdf)) { + int mdnid = EVP_MD_nid(ctx->reqdigest); + if (!ossl_ctx_legacy_digest_signatures_allowed(locpctx->libctx, 0) + && (mdnid == NID_sha1 || mdnid == NID_md5_sha1)) { + ERR_raise(ERR_LIB_EVP, EVP_R_INVALID_DIGEST); + goto err; + } + } + if (ver) { if (signature->digest_verify_init == NULL) { ERR_raise(ERR_LIB_EVP, EVP_R_INITIALIZATION_ERROR); Index: openssl-3.2.3/crypto/evp/pmeth_lib.c =================================================================== --- openssl-3.2.3.orig/crypto/evp/pmeth_lib.c +++ openssl-3.2.3/crypto/evp/pmeth_lib.c @@ -33,6 +33,7 @@ #include "internal/ffc.h" #include "internal/numbers.h" #include "internal/provider.h" +#include "internal/sslconf.h" #include "evp_local.h" #ifndef FIPS_MODULE @@ -951,6 +952,20 @@ static int evp_pkey_ctx_set_md(EVP_PKEY_ return -2; } + if (EVP_PKEY_CTX_IS_SIGNATURE_OP(ctx) + && md != NULL + && ctx->pkey != NULL + && !EVP_PKEY_is_a(ctx->pkey, SN_hmac) + && !EVP_PKEY_is_a(ctx->pkey, SN_tls1_prf) + && !EVP_PKEY_is_a(ctx->pkey, SN_hkdf)) { + int mdnid = EVP_MD_nid(md); + if ((mdnid == NID_sha1 || mdnid == NID_md5_sha1) + && !ossl_ctx_legacy_digest_signatures_allowed(ctx->libctx, 0)) { + ERR_raise(ERR_LIB_EVP, EVP_R_INVALID_DIGEST); + return -1; + } + } + if (fallback) return EVP_PKEY_CTX_ctrl(ctx, -1, op, ctrl, 0, (void *)(md)); Index: openssl-3.2.3/doc/man5/config.pod =================================================================== --- openssl-3.2.3.orig/doc/man5/config.pod +++ openssl-3.2.3/doc/man5/config.pod @@ -304,6 +304,21 @@ Within the algorithm properties section, The value may be anything that is acceptable as a property query string for EVP_set_default_properties(). +=item B<rh-allow-sha1-signatures> + +The value is a boolean that can be B<yes> or B<no>. If the value is not set, +it behaves as if it was set to B<yes>. + +When set to B<no>, any attempt to create or verify a signature with a SHA1 +digest will fail. To test whether your software will work with future versions +of OpenSSL, set this option to B<no>. This setting also affects TLS, where +signature algorithms that use SHA1 as digest will no longer be supported if +this option is set to B<no>. Because TLS 1.1 or lower use MD5-SHA1 as +pseudorandom function (PRF) to derive key material, disabling +B<rh-allow-sha1-signatures> requires the use of TLS 1.2 or newer. + +This is a downstream specific option, and normally it should be set up via crypto-policies. + =item B<fips_mode> (deprecated) The value is a boolean that can be B<yes> or B<no>. If the value is Index: openssl-3.2.3/include/crypto/context.h =================================================================== --- openssl-3.2.3.orig/include/crypto/context.h +++ openssl-3.2.3/include/crypto/context.h @@ -46,3 +46,6 @@ void ossl_release_default_drbg_ctx(void) #if defined(OPENSSL_THREADS) void ossl_threads_ctx_free(void *); #endif + +void *ossl_ctx_legacy_digest_signatures_new(OSSL_LIB_CTX *); +void ossl_ctx_legacy_digest_signatures_free(void *); Index: openssl-3.2.3/include/internal/cryptlib.h =================================================================== --- openssl-3.2.3.orig/include/internal/cryptlib.h +++ openssl-3.2.3/include/internal/cryptlib.h @@ -117,7 +117,8 @@ typedef struct ossl_ex_data_global_st { # define OSSL_LIB_CTX_CHILD_PROVIDER_INDEX 18 # define OSSL_LIB_CTX_THREAD_INDEX 19 # define OSSL_LIB_CTX_DECODER_CACHE_INDEX 20 -# define OSSL_LIB_CTX_MAX_INDEXES 20 +# define OSSL_LIB_CTX_LEGACY_DIGEST_SIGNATURES_INDEX 21 +# define OSSL_LIB_CTX_MAX_INDEXES 21 OSSL_LIB_CTX *ossl_lib_ctx_get_concrete(OSSL_LIB_CTX *ctx); int ossl_lib_ctx_is_default(OSSL_LIB_CTX *ctx); Index: openssl-3.2.3/include/internal/sslconf.h =================================================================== --- openssl-3.2.3.orig/include/internal/sslconf.h +++ openssl-3.2.3/include/internal/sslconf.h @@ -18,4 +18,8 @@ int conf_ssl_name_find(const char *name, void conf_ssl_get_cmd(const SSL_CONF_CMD *cmd, size_t idx, char **cmdstr, char **arg); +/* Methods to support disabling all signatures with legacy digests */ +int ossl_ctx_legacy_digest_signatures_allowed(OSSL_LIB_CTX *libctx, int loadconfig); +int ossl_ctx_legacy_digest_signatures_allowed_set(OSSL_LIB_CTX *libctx, int allow, + int loadconfig); #endif Index: openssl-3.2.3/providers/common/securitycheck.c =================================================================== --- openssl-3.2.3.orig/providers/common/securitycheck.c +++ openssl-3.2.3/providers/common/securitycheck.c @@ -19,6 +19,7 @@ #include <openssl/core_names.h> #include <openssl/obj_mac.h> #include "prov/securitycheck.h" +#include "internal/sslconf.h" /* * FIPS requires a minimum security strength of 112 bits (for encryption or @@ -243,6 +244,14 @@ int ossl_digest_get_approved_nid_with_sh mdnid = -1; /* disallowed by security checks */ } # endif /* OPENSSL_NO_FIPS_SECURITYCHECKS */ + +#ifndef FIPS_MODULE + if (!ossl_ctx_legacy_digest_signatures_allowed(ctx, 0)) + /* SHA1 is globally enabled by default, check whether we want to locally disable it. */ + if (mdnid == NID_sha1 && !sha1_allowed) + mdnid = -1; +#endif + return mdnid; } @@ -252,5 +261,15 @@ int ossl_digest_is_allowed(OSSL_LIB_CTX if (ossl_securitycheck_enabled(ctx)) return ossl_digest_get_approved_nid(md) != NID_undef; # endif /* OPENSSL_NO_FIPS_SECURITYCHECKS */ + +#ifndef FIPS_MODULE + { + int mdnid = EVP_MD_nid(md); + if ((mdnid == NID_sha1 || mdnid == NID_md5_sha1) + && !ossl_ctx_legacy_digest_signatures_allowed(ctx, 0)) + return 0; + } +#endif + return 1; } Index: openssl-3.2.3/providers/common/securitycheck_default.c =================================================================== --- openssl-3.2.3.orig/providers/common/securitycheck_default.c +++ openssl-3.2.3/providers/common/securitycheck_default.c @@ -15,6 +15,7 @@ #include <openssl/obj_mac.h> #include "prov/securitycheck.h" #include "internal/nelem.h" +#include "internal/sslconf.h" /* Disable the security checks in the default provider */ int ossl_securitycheck_enabled(OSSL_LIB_CTX *libctx) @@ -29,9 +30,10 @@ int ossl_tls1_prf_ems_check_enabled(OSSL } int ossl_digest_rsa_sign_get_md_nid(OSSL_LIB_CTX *ctx, const EVP_MD *md, - ossl_unused int sha1_allowed) + int sha1_allowed) { int mdnid; + int ldsigs_allowed; static const OSSL_ITEM name_to_nid[] = { { NID_md5, OSSL_DIGEST_NAME_MD5 }, @@ -42,8 +44,11 @@ int ossl_digest_rsa_sign_get_md_nid(OSSL { NID_ripemd160, OSSL_DIGEST_NAME_RIPEMD160 }, }; - mdnid = ossl_digest_get_approved_nid_with_sha1(ctx, md, 1); + ldsigs_allowed = ossl_ctx_legacy_digest_signatures_allowed(ctx, 0); + mdnid = ossl_digest_get_approved_nid_with_sha1(ctx, md, sha1_allowed || ldsigs_allowed); if (mdnid == NID_undef) mdnid = ossl_digest_md_to_nid(md, name_to_nid, OSSL_NELEM(name_to_nid)); + if (mdnid == NID_md5_sha1 && !ldsigs_allowed) + mdnid = -1; return mdnid; } Index: openssl-3.2.3/providers/implementations/signature/dsa_sig.c =================================================================== --- openssl-3.2.3.orig/providers/implementations/signature/dsa_sig.c +++ openssl-3.2.3/providers/implementations/signature/dsa_sig.c @@ -125,12 +125,17 @@ static int dsa_setup_md(PROV_DSA_CTX *ct mdprops = ctx->propq; if (mdname != NULL) { - int sha1_allowed = (ctx->operation != EVP_PKEY_OP_SIGN); WPACKET pkt; EVP_MD *md = EVP_MD_fetch(ctx->libctx, mdname, mdprops); - int md_nid = ossl_digest_get_approved_nid_with_sha1(ctx->libctx, md, - sha1_allowed); + int md_nid; size_t mdname_len = strlen(mdname); +#ifdef FIPS_MODULE + int sha1_allowed = (ctx->operation != EVP_PKEY_OP_SIGN); +#else + int sha1_allowed = 0; +#endif + md_nid = ossl_digest_get_approved_nid_with_sha1(ctx->libctx, md, + sha1_allowed); if (md == NULL || md_nid < 0) { if (md == NULL) Index: openssl-3.2.3/providers/implementations/signature/ecdsa_sig.c =================================================================== --- openssl-3.2.3.orig/providers/implementations/signature/ecdsa_sig.c +++ openssl-3.2.3/providers/implementations/signature/ecdsa_sig.c @@ -247,7 +247,11 @@ static int ecdsa_setup_md(PROV_ECDSA_CTX "%s could not be fetched", mdname); return 0; } +#ifdef FIPS_MODULE sha1_allowed = (ctx->operation != EVP_PKEY_OP_SIGN); +#else + sha1_allowed = 0; +#endif md_nid = ossl_digest_get_approved_nid_with_sha1(ctx->libctx, md, sha1_allowed); if (md_nid < 0) { Index: openssl-3.2.3/providers/implementations/signature/rsa_sig.c =================================================================== --- openssl-3.2.3.orig/providers/implementations/signature/rsa_sig.c +++ openssl-3.2.3/providers/implementations/signature/rsa_sig.c @@ -25,6 +25,7 @@ #include "internal/cryptlib.h" #include "internal/nelem.h" #include "internal/sizes.h" +#include "internal/sslconf.h" #include "crypto/rsa.h" #include "prov/providercommon.h" #include "prov/implementations.h" @@ -33,6 +34,7 @@ #include "prov/securitycheck.h" #define RSA_DEFAULT_DIGEST_NAME OSSL_DIGEST_NAME_SHA1 +#define RSA_DEFAULT_DIGEST_NAME_NONLEGACY OSSL_DIGEST_NAME_SHA2_256 OSSL_FUNC_signature_newctx_fn rsa_newctx; static OSSL_FUNC_signature_sign_init_fn rsa_sign_init; @@ -317,10 +319,15 @@ static int rsa_setup_md(PROV_RSA_CTX *ct if (mdname != NULL) { EVP_MD *md = EVP_MD_fetch(ctx->libctx, mdname, mdprops); + int md_nid; + size_t mdname_len = strlen(mdname); +#ifdef FIPS_MODULE int sha1_allowed = (ctx->operation != EVP_PKEY_OP_SIGN); - int md_nid = ossl_digest_rsa_sign_get_md_nid(ctx->libctx, md, +#else + int sha1_allowed = 0; +#endif + md_nid = ossl_digest_rsa_sign_get_md_nid(ctx->libctx, md, sha1_allowed); - size_t mdname_len = strlen(mdname); if (md == NULL || md_nid <= 0 @@ -1408,8 +1415,15 @@ static int rsa_set_ctx_params(void *vprs prsactx->pad_mode = pad_mode; if (prsactx->md == NULL && pmdname == NULL - && pad_mode == RSA_PKCS1_PSS_PADDING) + && pad_mode == RSA_PKCS1_PSS_PADDING) { pmdname = RSA_DEFAULT_DIGEST_NAME; +#ifndef FIPS_MODULE + if (!ossl_ctx_legacy_digest_signatures_allowed(prsactx->libctx, 0)) { + pmdname = RSA_DEFAULT_DIGEST_NAME_NONLEGACY; + } +#endif + } + if (pmgf1mdname != NULL && !rsa_setup_mgf1_md(prsactx, pmgf1mdname, pmgf1mdprops)) Index: openssl-3.2.3/ssl/t1_lib.c =================================================================== --- openssl-3.2.3.orig/ssl/t1_lib.c +++ openssl-3.2.3/ssl/t1_lib.c @@ -20,6 +20,7 @@ #include <openssl/bn.h> #include <openssl/provider.h> #include <openssl/param_build.h> +#include "internal/sslconf.h" #include "internal/nelem.h" #include "internal/sizes.h" #include "internal/tlsgroups.h" @@ -1508,6 +1509,7 @@ int ssl_setup_sigalgs(SSL_CTX *ctx) uint16_t *tls12_sigalgs_list = NULL; EVP_PKEY *tmpkey = EVP_PKEY_new(); int ret = 0; + int ldsigs_allowed; if (ctx == NULL) goto err; @@ -1523,6 +1525,7 @@ int ssl_setup_sigalgs(SSL_CTX *ctx) goto err; ERR_set_mark(); + ldsigs_allowed = ossl_ctx_legacy_digest_signatures_allowed(ctx->libctx, 0); /* First fill cache and tls12_sigalgs list from legacy algorithm list */ for (i = 0, lu = sigalg_lookup_tbl; i < OSSL_NELEM(sigalg_lookup_tbl); lu++, i++) { @@ -1544,6 +1547,11 @@ int ssl_setup_sigalgs(SSL_CTX *ctx) cache[i].enabled = 0; continue; } + if ((lu->hash == NID_sha1 || lu->hash == NID_md5_sha1) + && !ldsigs_allowed) { + cache[i].enabled = 0; + continue; + } if (!EVP_PKEY_set_type(tmpkey, lu->sig)) { cache[i].enabled = 0; Index: openssl-3.2.3/util/libcrypto.num =================================================================== --- openssl-3.2.3.orig/util/libcrypto.num +++ openssl-3.2.3/util/libcrypto.num @@ -5537,3 +5537,5 @@ X509_STORE_CTX_set_current_reasons OSSL_STORE_delete 5665 3_2_0 EXIST::FUNCTION: BIO_ADDR_copy 5666 3_2_0 EXIST::FUNCTION:SOCK ossl_safe_getenv ? 3_2_0 EXIST::FUNCTION: +ossl_ctx_legacy_digest_signatures_allowed ? 3_0_1 EXIST::FUNCTION: +ossl_ctx_legacy_digest_signatures_allowed_set ? 3_0_1 EXIST::FUNCTION:
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor
