From f360f484d23c217a3d161dbf19ca54cbbfeb5b1d Mon Sep 17 00:00:00 2001 From: Julien Rische Date: Aug 19 2022 13:16:09 +0000 Subject: Update error checking for OpenSSL CMS_verify Resolves: rhbz#2119704 Signed-off-by: Julien Rische --- diff --git a/Update-error-checking-for-OpenSSL-CMS_verify.patch b/Update-error-checking-for-OpenSSL-CMS_verify.patch new file mode 100644 index 0000000..43b3883 --- /dev/null +++ b/Update-error-checking-for-OpenSSL-CMS_verify.patch @@ -0,0 +1,48 @@ +From d18875818789051c08a56464066ca40f65898286 Mon Sep 17 00:00:00 2001 +From: Julien Rische +Date: Thu, 28 Jul 2022 15:20:12 +0200 +Subject: [PATCH] Update error checking for OpenSSL CMS_verify + +The code for CMS data verification was initially written for OpenSSL's +PKCS7_verify() function. It now uses CMS_verify(), but error handling +is still done using PKCS7_verify() error identifiers. Update the +recognized error codes so that the KDC generates +KDC_ERR_DIGEST_IN_SIGNED_DATA_NOT_ACCEPTED errors when appropriate. +Use ERR_peek_last_error() to observe the error generated closest to +the API surface. + +[ghudson@mit.edu: edited commit message] + +ticket: 9069 (new) +tags: pullup +target_version: 1.20-next +--- + src/plugins/preauth/pkinit/pkinit_crypto_openssl.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c +index 2a6ef4aaa..cef4e897a 100644 +--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c ++++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c +@@ -1691,12 +1691,15 @@ cms_signeddata_verify(krb5_context context, + goto cleanup; + out = BIO_new(BIO_s_mem()); + if (CMS_verify(cms, NULL, store, NULL, out, flags) == 0) { +- unsigned long err = ERR_peek_error(); ++ unsigned long err = ERR_peek_last_error(); + switch(ERR_GET_REASON(err)) { +- case PKCS7_R_DIGEST_FAILURE: ++ case RSA_R_DIGEST_NOT_ALLOWED: ++ case CMS_R_UNKNOWN_DIGEST_ALGORITHM: ++ case CMS_R_NO_MATCHING_DIGEST: ++ case CMS_R_NO_MATCHING_SIGNATURE: + retval = KRB5KDC_ERR_DIGEST_IN_SIGNED_DATA_NOT_ACCEPTED; + break; +- case PKCS7_R_SIGNATURE_FAILURE: ++ case CMS_R_VERIFICATION_FAILURE: + default: + retval = KRB5KDC_ERR_INVALID_SIG; + } +-- +2.37.1 + diff --git a/downstream-Catch-SHA-1-digest-disallowed-error-for-P.patch b/downstream-Catch-SHA-1-digest-disallowed-error-for-P.patch new file mode 100644 index 0000000..ae4d03d --- /dev/null +++ b/downstream-Catch-SHA-1-digest-disallowed-error-for-P.patch @@ -0,0 +1,27 @@ +From d365c6231387d8a5fd9eba9f10f99dc0e440e4ac Mon Sep 17 00:00:00 2001 +From: Julien Rische +Date: Fri, 19 Aug 2022 10:34:52 +0200 +Subject: [PATCH] [downstream] Catch SHA-1 digest disallowed error for PKINIT + +An OpenSSL patch causes EVP_R_INVALID_DIGEST error to be raised if +CMS_verify is called to verify a SHA-1 signature. If this error is +caught, it will now return KDC_ERR_DIGEST_IN_SIGNED_DATA_NOT_ACCEPTED. +--- + src/plugins/preauth/pkinit/pkinit_crypto_openssl.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c +index cef4e897a..c8e4a73a2 100644 +--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c ++++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c +@@ -1693,6 +1693,7 @@ cms_signeddata_verify(krb5_context context, + if (CMS_verify(cms, NULL, store, NULL, out, flags) == 0) { + unsigned long err = ERR_peek_last_error(); + switch(ERR_GET_REASON(err)) { ++ case EVP_R_INVALID_DIGEST: + case RSA_R_DIGEST_NOT_ALLOWED: + case CMS_R_UNKNOWN_DIGEST_ALGORITHM: + case CMS_R_NO_MATCHING_DIGEST: +-- +2.37.1 + diff --git a/krb5.spec b/krb5.spec index ab154f4..70e1ed6 100644 --- a/krb5.spec +++ b/krb5.spec @@ -42,7 +42,7 @@ Summary: The Kerberos network authentication system Name: krb5 Version: 1.19.2 -Release: %{?zdpd}11%{?dist} +Release: %{?zdpd}12%{?dist} # rharwood has trust path to signing key and verifies on check-in Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz @@ -101,6 +101,8 @@ Patch40: Try-harder-to-avoid-password-change-replay-errors.patch Patch41: Add-configure-variable-for-default-PKCS-11-module.patch Patch42: downstream-Allow-krad-UDP-TCP-localhost-connection-with-FIPS.patch Patch43: Read-GSS-configuration-files-with-mtime-0.patch +Patch44: Update-error-checking-for-OpenSSL-CMS_verify.patch +Patch45: downstream-Catch-SHA-1-digest-disallowed-error-for-P.patch License: MIT URL: https://web.mit.edu/kerberos/www/ @@ -651,6 +653,10 @@ exit 0 %{_libdir}/libkadm5srv_mit.so.* %changelog +* Fri Aug 19 2022 Julien Rische - 1.19.2-12 +- Update error checking for OpenSSL CMS_verify +- Resolves: rhbz#2119704 + * Wed Jun 15 2022 Julien Rische - 1.19.2-11 - Allow libkrad UDP/TCP connection to localhost in FIPS mode - Resolves: rhbz#2082189