From: Clemens Lang <cllang@redhat.com>

  Date: Tue, 1 Mar 2022 15:44:18 +0100

  Subject: [PATCH 2/2] Allow SHA1 in seclevel 1 if rh-allow-sha1-signatures =

  Related: rhbz#2055796

  Related: rhbz#2070977

  ---

   doc/man5/config.pod           |  7 ++++

   test/recipes/25-test_verify.t |  4 +--

  diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c

  --- a/crypto/x509/x509_vfy.c

  +++ b/crypto/x509/x509_vfy.c

  @@ -25,6 +25,7 @@

   #include "crypto/x509.h"

   #include "x509_local.h"

   {

       int secbits = -1;

       int level = ctx->param->auth_level;

  +    if (!X509_get_signature_info(cert, &nid, NULL, &secbits, NULL))

           return 0;

  +            && ossl_ctx_legacy_digest_signatures_allowed(libctx, 0)

  +            && ctx->param->auth_level < 2)

  +        /* When rh-allow-sha1-signatures = yes and security level <= 1,

  +        return 1;

  +

       return secbits >= minbits_table[level - 1];

   }

  diff --git a/doc/man5/config.pod b/doc/man5/config.pod

  --- a/doc/man5/config.pod

  +++ b/doc/man5/config.pod

  @@ -309,6 +309,13 @@ this option is set to B<no>.  Because TLS 1.1 or lower use MD5-SHA1 as

  +Note that enabling B<rh-allow-sha1-signatures> will allow TLS signature

  +algorithms that use SHA1 in security level 1, despite the definition of

  +

   =item B<fips_mode> (deprecated)

   The value is a boolean that can be B<yes> or B<no>.  If the value is

  diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c

  --- a/ssl/t1_lib.c

  +++ b/ssl/t1_lib.c

  @@ -20,6 +20,7 @@

   #include "internal/sslconf.h"

   #include "internal/nelem.h"

   #include "internal/sizes.h"

           SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_UNKNOWN_DIGEST);

           return 0;

       }

  -        SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_WRONG_SIGNATURE_TYPE);

  -        return 0;

  +

  +            && ossl_ctx_legacy_digest_signatures_allowed(s->ctx->libctx, 0)

  +            && SSL_get_security_level(s) < 2) {

  +    } else {

  +        /*

  +         * Make sure security callback allows algorithm. For historical

       }

       /* Store the sigalg the peer uses */

       s->s3.tmp.peer_sigalg = lu;

           }

       }

  +            && ossl_ctx_legacy_digest_signatures_allowed(s->ctx->libctx, 0)

  +            && SSL_get_security_level(s) < 2) {

  +        return 1;

  +    }

  +

       /* Finally see if security callback allows it */

       secbits = sigalg_security_bits(s->ctx, lu);

       sigalgstr[0] = (lu->sigalg >> 8) & 0xff;

   {

       /* Lookup signature algorithm digest */

       int secbits, nid, pknid;

       /* Don't check signature if self signed */

       if ((X509_get_extension_flags(x) & EXFLAG_SS) != 0)

           return 1;

       /* If digest NID not defined use signature NID */

       if (nid == NID_undef)

           nid = pknid;

  +    else

  +        libctx = OSSL_LIB_CTX_get0_global_default();

  +

  +            && ossl_ctx_legacy_digest_signatures_allowed(libctx, 0)

  +            && ((s != NULL && SSL_get_security_level(s) < 2)

  +                || (ctx != NULL && SSL_CTX_get_security_level(ctx) < 2)

  +            ))

  +        /* When rh-allow-sha1-signatures = yes and security level <= 1,

  +        return 1;

  +

       if (s)

  From: Clemens Lang <cllang@redhat.com>

  Date: Mon, 25 Apr 2022 15:21:46 +0200

  Subject: [PATCH] Instrument SHA-1 signatures with USDT probes

  in production so that they can be transitioned to more modern hash

  algorithms.

  ---

  diff --git a/crypto/evp/m_sigver.c b/crypto/evp/m_sigver.c

  index 8da2183ce0..c17cdfa5d5 100644

  @@ -16,6 +16,8 @@

   #include "internal/numbers.h"   /* includes SIZE_MAX */

   #include "evp_local.h"

  +#include <sys/sdt.h>

  +

   typedef struct ossl_legacy_digest_signatures_st {

  +            }

           }

       }

  diff --git a/crypto/evp/pmeth_lib.c b/crypto/evp/pmeth_lib.c

  --- a/crypto/evp/pmeth_lib.c

  +++ b/crypto/evp/pmeth_lib.c

   #include "internal/sslconf.h"

   #include "evp_local.h"

  +#include <sys/sdt.h>

  +

   #ifndef FIPS_MODULE

   static int evp_pkey_ctx_store_cached_data(EVP_PKEY_CTX *ctx,

               && !EVP_PKEY_is_a(ctx->pkey, SN_tls1_prf)

               && !EVP_PKEY_is_a(ctx->pkey, SN_hkdf)) {

           int mdnid = EVP_MD_nid(md);

  +            }

           }

       }

  diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c

  --- a/crypto/x509/x509_vfy.c

  +++ b/crypto/x509/x509_vfy.c

  @@ -29,6 +29,8 @@

   #include "crypto/x509.h"

   #include "x509_local.h"

  +#include <sys/sdt.h>

  +

   /* CRL score values */

   #define CRL_SCORE_NOCRITICAL    0x100 /* No unhandled critical extensions */

               && ossl_ctx_legacy_digest_signatures_allowed(libctx, 0)

  -            && ctx->param->auth_level < 2)

  +            && ctx->param->auth_level < 2) {

  +        DTRACE_PROBE1(libcrypto, fedora_check_sig_level_1, nid);

           /* When rh-allow-sha1-signatures = yes and security level <= 1,

           return 1;

  +    }

       return secbits >= minbits_table[level - 1];

   }

  diff --git a/providers/common/securitycheck.c b/providers/common/securitycheck.c

  @@ -21,6 +21,8 @@

   #include "prov/securitycheck.h"

   #include "internal/sslconf.h"

  +#include <sys/sdt.h>

  +

   /*

    * signing), and for legacy purposes 80 bits (for decryption or verifying).

  @@ -238,11 +240,14 @@ int ossl_digest_get_approved_nid_with_sha1(OSSL_LIB_CTX *ctx, const EVP_MD *md,

   # endif /* OPENSSL_NO_FIPS_SECURITYCHECKS */

   #ifndef FIPS_MODULE

  -    if (!ossl_ctx_legacy_digest_signatures_allowed(ctx, 0))

  -        /* SHA1 is globally disabled, check whether we want to locally allow

  +            DTRACE_PROBE1(libcrypto, fedora_ossl_digest_get_approved_nid_with_sha1_1, mdnid);

  +    }

   #endif

       return mdnid;

  @@ -258,9 +263,12 @@ int ossl_digest_is_allowed(OSSL_LIB_CTX *ctx, const EVP_MD *md)

   #ifndef FIPS_MODULE

  +        }

       }

   #endif

  diff --git a/providers/common/securitycheck_default.c b/providers/common/securitycheck_default.c

  --- a/providers/common/securitycheck_default.c

  +++ b/providers/common/securitycheck_default.c

  @@ -17,6 +17,8 @@

   #include "internal/nelem.h"

   #include "internal/sslconf.h"

  +#include <sys/sdt.h>

  +

   /* Disable the security checks in the default provider */

   int ossl_securitycheck_enabled(OSSL_LIB_CTX *libctx)

   {

  @@ -40,9 +42,16 @@ int ossl_digest_rsa_sign_get_md_nid(OSSL_LIB_CTX *ctx, const EVP_MD *md,

       ldsigs_allowed = ossl_ctx_legacy_digest_signatures_allowed(ctx, 0);

       mdnid = ossl_digest_get_approved_nid_with_sha1(ctx, md, sha1_allowed || ldsigs_allowed);

  +    if (mdnid == NID_sha1)

       return mdnid;

   }

  diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c

  --- a/ssl/t1_lib.c

  +++ b/ssl/t1_lib.c

  @@ -28,6 +28,8 @@

   #include "ssl_local.h"

   #include <openssl/ct.h>

  +#include <sys/sdt.h>

  +

   static const SIGALG_LOOKUP *find_sig_alg(SSL *s, X509 *x, EVP_PKEY *pkey);

   static int tls12_sigalg_allowed(const SSL *s, int op, const SIGALG_LOOKUP *lu);

  +        DTRACE_PROBE1(libssl, fedora_tls12_check_peer_sigalg_1, lu->hash);

       } else {

           /*

            * Make sure security callback allows algorithm. For historical

  +        DTRACE_PROBE1(libssl, fedora_tls12_sigalg_allowed_1, lu->hash);

           return 1;

       }

               && ossl_ctx_legacy_digest_signatures_allowed(libctx, 0)

               && ((s != NULL && SSL_get_security_level(s) < 2)

                   || (ctx != NULL && SSL_CTX_get_security_level(ctx) < 2)

  -            ))

  +            )) {

           /* When rh-allow-sha1-signatures = yes and security level <= 1,

  +        DTRACE_PROBE1(libssl, fedora_ssl_security_cert_sig_1, nid);

           return 1;

  +    }

       if (s)

           return ssl_security(s, op, secbits, nid, x);

  2.35.1

  %ldconfig_scriptlets libs

  %changelog

  * Tue Apr 26 2022 Alexander Sosedkin <asosedkin@redhat.com> - 1:3.0.2-4

  - Instrument with USDT probes related to SHA-1 deprecation