pool/crypto-policies
SHA256
2
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Accepting request 1089054 from home:pmonrealgonzalez:branches:security:tls

Browse Source 
- FIPS: Enable to set the kernel FIPS mode with fips-mode-setup
  and fips-finish-install commands, add also the man pages. The
  required FIPS modules are left to be installed by the user.
  * Rebase crypto-policies-FIPS.patch

- Revert a breaking change that introduces the config option
  rh-allow-sha1-signatures that is unkown to OpenSSL and fails
  on startup. We will consider adding this option to openssl.
  * https://gitlab.com/redhat-crypto/fedora-crypto-policies/-/commit/97fe4494
  * Add crypto-policies-revert-rh-allow-sha1-signatures.patch

  * Skip not needed LibreswanGenerator and SequoiaGenerator:

OBS-URL: https://build.opensuse.org/request/show/1089054
OBS-URL: https://build.opensuse.org/package/show/security:tls/crypto-policies?expand=0&rev=16
This commit is contained in:
Pedro Monreal Gonzalez 2023-05-25 16:40:03 +00:00 committed by Git OBS Bridge
parent 4ac1e9ad7b
commit 743dc266bd
8 changed files with 518 additions and 78 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

258
crypto-policies-FIPS.patch
View File

@ -1,72 +1,206 @@
Index: fedora-crypto-policies-20221214.a4c31a3/Makefile
Index: fedora-crypto-policies-20230420.3d08ae7/fips-mode-setup
===================================================================
--- fedora-crypto-policies-20221214.a4c31a3.orig/Makefile
+++ fedora-crypto-policies-20221214.a4c31a3/Makefile
@@ -5,8 +5,8 @@ MANDIR?=/usr/share/man
CONFDIR?=/etc/crypto-policies
DESTDIR?=
MAN7PAGES=crypto-policies.7
-MAN8PAGES=update-crypto-policies.8 fips-finish-install.8 fips-mode-setup.8
-SCRIPTS=update-crypto-policies fips-finish-install fips-mode-setup
+MAN8PAGES=update-crypto-policies.8 fips-finish-install.8
+SCRIPTS=update-crypto-policies fips-finish-install
NUM_PROCS = $$(getconf _NPROCESSORS_ONLN)
PYVERSION = -3
DIFFTOOL?=meld
Index: fedora-crypto-policies-20221214.a4c31a3/crypto-policies.7.txt
===================================================================
--- fedora-crypto-policies-20221214.a4c31a3.orig/crypto-policies.7.txt
+++ fedora-crypto-policies-20221214.a4c31a3/crypto-policies.7.txt
@@ -153,9 +153,6 @@ PROVIDED POLICIES
--- fedora-crypto-policies-20230420.3d08ae7.orig/fips-mode-setup
+++ fedora-crypto-policies-20230420.3d08ae7/fips-mode-setup
@@ -7,6 +7,7 @@ enable_fips=
check=0
boot_config=1
err_if_disabled=0
+fips_install_complete=0
output_text=1
*FIPS*::
A policy to aid conformance to the *FIPS 140-2* requirements.
- This policy is used internally by the *fips-mode-setup(8)* tool
- which can switch the system into the *FIPS 140-2* mode.
- This policy provides at least 112-bit security.
is_ostree_system=0
@@ -75,109 +76,74 @@ if test "$is_ostree_system" = 1 && test
exit 1
fi
* MACs: all *HMAC* with *SHA1* or better
* Curves: all prime >= 256 bits
@@ -264,12 +261,6 @@ COMMANDS
back ends and allows the system administrator to change the active
cryptographic policy.
-*fips-mode-setup(8)*::
- This command allows the system administrator to enable, or disable the
- system FIPS mode and also apply the *FIPS* cryptographic policy
- which limits the allowed algorithms and protocols to these allowed by
- the FIPS 140-2 requirements.
-
-if [ "$(id -u)" != 0 ]; then
- echo "You must be root to run $(basename $0)"
- exit 1
-fi
-
-
-# Detect 1: kernel FIPS flag
-fips_kernel_enabled=$(cat /proc/sys/crypto/fips_enabled)
-
-# Detect 2: initramfs fips module presence; not always can be done
-initramfs_fips_module=0
-initramfs_inspectable=0
-if test -d /boot -a -x /usr/bin/lsinitrd; then
- initramfs_inspectable=1
- if lsinitrd -m 2>/dev/null | grep -Fxq fips; then
- initramfs_fips_module=1
+if test "$enable_fips" = 1 ; then
+ # Check the required FIPS modules are installed
+ if test ! -x "$(command -v grubby)" -o ! -f /usr/share/doc/packages/patterns/fips.txt -o ! -f /etc/dracut.conf.d/40-fips.conf; then
+ cond_echo "Installation of FIPS modules is not complete."
+ cond_echo "Please, install grubby and the fips pattern."
+ exit 1
fi
fi
NOTES
-----
@@ -447,7 +438,7 @@ FILES
-# Detect 3: crypto-policy base policy
-current_policy="$(cat /etc/crypto-policies/state/current)"
-base_policy="$(echo $current_policy| cut -f 1 -d :)"
-if test "$base_policy" == "FIPS" ; then
- base_policy_is_fips=1
-else
- base_policy_is_fips=0
+if test "$enable_fips" = 1 ; then
+ if test ! -d /boot -o ! -x /usr/bin/lsinitrd -o x"$(/usr/bin/lsinitrd -f etc/system-fips 2>/dev/null || test $? = 2 && echo y)" != x ; then
+ fips_install_complete=1
+ fi
fi
SEE ALSO
--------
-update-crypto-policies(8), fips-mode-setup(8)
+update-crypto-policies(8)
-
if test $check = 1 ; then
- # Look for signs for both enabling and disabling FIPS mode
- fips_positive=0
- fips_negative=0
-
- # Display 1: kernel FIPS flag
- cond_echo "FIPS mode is $(enable2txt $fips_kernel_enabled)."
-
- # Display 2: initramfs fips module
- if test "$initramfs_inspectable" = 1 ; then
- cond_echo -n "Initramfs fips module is "
- cond_echo "$(enable2txt $initramfs_fips_module)."
- fi
-
- # Display 3: active crypto-policy
- cond_echo -n "The current crypto policy ($current_policy) "
- if test "$base_policy_is_fips" == 1 ; then
- cond_echo 'is based on the FIPS policy.'
- else
- cond_echo -n 'neither is the FIPS policy '
- cond_echo 'nor is based on the FIPS policy.'
- fi
-
- # Decide 1: kernel FIPS flag
- if test "$fips_kernel_enabled" = 1 ; then
- fips_positive=1
- else
- fips_negative=1
- fi
-
- # Decide 2: initramfs module presence
- if test "$initramfs_inspectable" = 1 ; then
- if test "$initramfs_fips_module" = 1 ; then
- fips_positive=1
- else
- fips_negative=1
+ test $fips_install_complete = 0 && cond_echo "Installation of FIPS modules is not complete."
+ fips_enabled=$(cat /proc/sys/crypto/fips_enabled)
+ cond_echo "FIPS mode is $(enable2txt $fips_enabled)."
+ if test "$fips_enabled" = 1 ; then
+ if test $fips_install_complete = 0 ; then
+ cond_echo "Inconsistent state detected."
+ exit 1
+ fi
+ current="$(cat /etc/crypto-policies/state/current)"
+ if test "$(echo $current | cut -f 1 -d :)" != "FIPS" ; then
+ cond_echo -n "The current crypto policy ($current) "
+ cond_echo -n 'neither is the FIPS policy '
+ cond_echo 'nor is based on the FIPS policy.'
+ cond_echo 'Inconsistent state detected.'
+ exit 1
fi
- fi
-
- # Decide 3: active crypto-policy
- if test "$base_policy_is_fips" = 1 ; then
- fips_positive=1
else
- fips_negative=1
- fi
-
- # Make the FIPS mode consistency decision
- if test "$fips_positive" = 1 -a "$fips_negative" = 1 ; then
- cond_echo 'Inconsistent state detected.'
- exit 1
+ if test $fips_install_complete = 1 ; then
+ cond_echo "Inconsistent state detected."
+ exit 1
+ fi
+ current="$(cat /etc/crypto-policies/state/current)"
+ if test "$(echo $current | cut -f 1 -d :)" == "FIPS" ; then
+ cond_echo -n "The current crypto policy ($current) "
+ cond_echo -n 'is based on the FIPS policy, '
+ cond_echo 'but FIPS mode is not enabled.'
+ cond_echo 'Inconsistent state detected.'
+ exit 1
+ fi
fi
-
- # Error out if `--is-enabled` was passed and FIPS mode is not enabled
- if test "$fips_positive" = 0 -a "$err_if_disabled" = 1 ; then
- cond_echo 'FIPS mode is not enabled.'
+ if test "$fips_enabled" != 1 && test "$err_if_disabled" = 1; then
exit 2
fi
-
exit 0
fi
+if [ "$(id -u)" != 0 ]; then
+ echo "You must be root to run $(basename $0)"
+ exit 1
+fi
AUTHOR
Index: fedora-crypto-policies-20221214.a4c31a3/python/update-crypto-policies.py
if test $enable_fips = 1 ; then
- if test "$initramfs_fips_module" = 0 ; then
+ if test $fips_install_complete = 1 ; then
fips-finish-install --complete
if test $? != 0 ; then
- echo "Installation of FIPS modules could not be completed."
+ echo "Installation of FIPS modules could not be completed."
exit 1
fi
fi
- if test "$base_policy_is_fips" == 1 ; then
- cond_echo -n 'Preserving current FIPS-based policy '
- cond_echo "${current_policy}."
+ target="$(cat /etc/crypto-policies/state/current)"
+ if test "$(echo $target | cut -f 1 -d :)" == "FIPS" ; then
+ cond_echo "Preserving current FIPS-based policy ${target}."
cond_echo -n 'Please review the subpolicies to ensure they '
cond_echo 'only restrict, not relax the FIPS policy.'
else
@@ -196,11 +162,11 @@ if test x"$boot_device" = x ; then
boot_device_opt=" boot=UUID=<your-boot-device-uuid>"
boot_config=0
else
- if test "$boot_device" = / ; then
- boot_device_opt=""
- else
- boot_device_opt=" boot=UUID=$(blkid -s UUID -o value $boot_device)"
- fi
+ if test "$boot_device" = / ; then
+ boot_device_opt=""
+ else
+ boot_device_opt=" boot=UUID=$(blkid -s UUID -o value $boot_device)"
+ fi
fi
if test "$boot_config" = 1 && test ! -x "$(command -v grubby)" ; then
Index: fedora-crypto-policies-20230420.3d08ae7/fips-mode-setup.8.txt
===================================================================
--- fedora-crypto-policies-20221214.a4c31a3.orig/python/update-crypto-policies.py
+++ fedora-crypto-policies-20221214.a4c31a3/python/update-crypto-policies.py
@@ -344,16 +344,12 @@ def apply_policy(pconfig, profile=None,
eprint("Warning: Using 'update-crypto-policies --set FIPS' "
"is not sufficient for")
eprint(" FIPS compliance.")
- eprint(" Use 'fips-mode-setup --enable' "
- "command instead.")
elif fips_mode():
eprint("Warning: Using 'update-crypto-policies --set' "
"in FIPS mode will make the system")
eprint(" non-compliant with FIPS.")
eprint(" It can also break "
"the ssh access to the system.")
- eprint(" Use 'fips-mode-setup --disable' "
- "to disable the system FIPS mode.")
--- fedora-crypto-policies-20230420.3d08ae7.orig/fips-mode-setup.8.txt
+++ fedora-crypto-policies-20230420.3d08ae7/fips-mode-setup.8.txt
@@ -39,8 +39,15 @@ system crypto policy to FIPS
(unless the policy has already been set to FIPS plus subpolicies on top,
in which case the currently active subpolicies is retained).
if base_dir == DEFAULT_BASE_DIR:
if not os.geteuid() == 0:
+Some required FIPS modules (grubby, fips pattern) might not be
+installed by default. These can be installed in SUSE/openSUSE with
+the following command:
+
+ zypper in -y grubby && zypper in -y -t pattern fips
+
Then the command modifies the boot loader configuration to add
'fips=1' and 'boot=<boot-device>' options to the kernel command line.
+Note that, grubby could show a harmless warning about leaked file descriptors.
When disabling the system FIPS mode the system crypto policy is switched
to DEFAULT and the kernel command line option 'fips=0' is set.

272
crypto-policies-revert-rh-allow-sha1-signatures.patch Normal file
View File

@ -0,0 +1,272 @@
From 97fe4494571fd90a05f9bc42af152762eca2fac5 Mon Sep 17 00:00:00 2001
From: Alexander Sosedkin <asosedkin@redhat.com>
Date: Fri, 8 Apr 2022 13:47:29 +0200
Subject: openssl: disable SHA-1 signatures in FUTURE/NO-SHA1
Index: fedora-crypto-policies-20230420.3d08ae7/policies/FUTURE.pol
===================================================================
--- fedora-crypto-policies-20230420.3d08ae7.orig/policies/FUTURE.pol
+++ fedora-crypto-policies-20230420.3d08ae7/policies/FUTURE.pol
@@ -65,7 +65,3 @@ sha1_in_certs = 0
arbitrary_dh_groups = 1
ssh_certs = 1
ssh_etm = 1
-
-# https://fedoraproject.org/wiki/Changes/StrongCryptoSettings3Forewarning1
-# SHA-1 signatures are blocked in OpenSSL in FUTURE only
-__openssl_block_sha1_signatures = 1
Index: fedora-crypto-policies-20230420.3d08ae7/policies/modules/NO-SHA1.pmod
===================================================================
--- fedora-crypto-policies-20230420.3d08ae7.orig/policies/modules/NO-SHA1.pmod
+++ fedora-crypto-policies-20230420.3d08ae7/policies/modules/NO-SHA1.pmod
@@ -3,7 +3,3 @@
hash = -SHA1
sign = -*-SHA1
sha1_in_certs = 0
-
-# https://fedoraproject.org/wiki/Changes/StrongCryptoSettings3Preview1
-# SHA-1 signatures are blocked in OpenSSL in FUTURE only
-__openssl_block_sha1_signatures = 1
Index: fedora-crypto-policies-20230420.3d08ae7/python/cryptopolicies/cryptopolicies.py
===================================================================
--- fedora-crypto-policies-20230420.3d08ae7.orig/python/cryptopolicies/cryptopolicies.py
+++ fedora-crypto-policies-20230420.3d08ae7/python/cryptopolicies/cryptopolicies.py
@@ -19,7 +19,6 @@ from . import validation # moved out of
INT_DEFAULTS = {k: 0 for k in (
'arbitrary_dh_groups',
'min_dh_size', 'min_dsa_size', 'min_rsa_size',
- '__openssl_block_sha1_signatures',
'sha1_in_certs',
'ssh_certs', 'ssh_etm',
)}
Index: fedora-crypto-policies-20230420.3d08ae7/python/policygenerators/openssl.py
===================================================================
--- fedora-crypto-policies-20230420.3d08ae7.orig/python/policygenerators/openssl.py
+++ fedora-crypto-policies-20230420.3d08ae7/python/policygenerators/openssl.py
@@ -7,14 +7,6 @@ from subprocess import check_output, Cal
from .configgenerator import ConfigGenerator
-RH_SHA1_SECTION = '''
-[openssl_init]
-alg_section = evp_properties
-
-[evp_properties]
-rh-allow-sha1-signatures = {}
-'''
-
class OpenSSLGenerator(ConfigGenerator):
CONFIG_NAME = 'openssl'
@@ -254,12 +246,6 @@ class OpenSSLConfigGenerator(OpenSSLGene
groups = [cls.group_map[i] for i in p['group'] if i in cls.group_map]
s += 'Groups = ' + ':'.join(groups) + '\n'
- # In the future it'll be just
- # s += RH_SHA1_SECTION.format('yes' if 'SHA1' in p['hash'] else 'no')
- # but for now we slow down the roll-out and we have
- sha1_sig = not policy.integers['__openssl_block_sha1_signatures']
- s += RH_SHA1_SECTION.format('yes' if sha1_sig else 'no')
-
return s
@classmethod
Index: fedora-crypto-policies-20230420.3d08ae7/tests/alternative-policies/FUTURE.pol
===================================================================
--- fedora-crypto-policies-20230420.3d08ae7.orig/tests/alternative-policies/FUTURE.pol
+++ fedora-crypto-policies-20230420.3d08ae7/tests/alternative-policies/FUTURE.pol
@@ -71,7 +71,3 @@ sha1_in_dnssec = 0
arbitrary_dh_groups = 1
ssh_certs = 1
ssh_etm = 1
-
-# https://fedoraproject.org/wiki/Changes/StrongCryptoSettings3Preview1
-# SHA-1 signatures are blocked in OpenSSL in FUTURE only
-__openssl_block_sha1_signatures = 1
Index: fedora-crypto-policies-20230420.3d08ae7/tests/outputs/DEFAULT-opensslcnf.txt
===================================================================
--- fedora-crypto-policies-20230420.3d08ae7.orig/tests/outputs/DEFAULT-opensslcnf.txt
+++ fedora-crypto-policies-20230420.3d08ae7/tests/outputs/DEFAULT-opensslcnf.txt
@@ -6,9 +6,3 @@ DTLS.MinProtocol = DTLSv1.2
DTLS.MaxProtocol = DTLSv1.2
SignatureAlgorithms = ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA512:ed25519:ed448:rsa_pss_pss_sha256:rsa_pss_pss_sha384:rsa_pss_pss_sha512:rsa_pss_rsae_sha256:rsa_pss_rsae_sha384:rsa_pss_rsae_sha512:RSA+SHA256:RSA+SHA384:RSA+SHA512:ECDSA+SHA224:RSA+SHA224
Groups = X25519:X448:secp256r1:secp384r1:secp521r1:ffdhe2048:ffdhe3072:ffdhe4096:ffdhe6144:ffdhe8192
-
-[openssl_init]
-alg_section = evp_properties
-
-[evp_properties]
-rh-allow-sha1-signatures = yes
Index: fedora-crypto-policies-20230420.3d08ae7/tests/outputs/DEFAULT:FEDORA32-opensslcnf.txt
===================================================================
--- fedora-crypto-policies-20230420.3d08ae7.orig/tests/outputs/DEFAULT:FEDORA32-opensslcnf.txt
+++ fedora-crypto-policies-20230420.3d08ae7/tests/outputs/DEFAULT:FEDORA32-opensslcnf.txt
@@ -6,9 +6,3 @@ DTLS.MinProtocol = DTLSv1
DTLS.MaxProtocol = DTLSv1.2
SignatureAlgorithms = ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA512:ed25519:ed448:rsa_pss_pss_sha256:rsa_pss_pss_sha384:rsa_pss_pss_sha512:rsa_pss_rsae_sha256:rsa_pss_rsae_sha384:rsa_pss_rsae_sha512:RSA+SHA256:RSA+SHA384:RSA+SHA512:ECDSA+SHA224:RSA+SHA224:ECDSA+SHA1:RSA+SHA1
Groups = X25519:X448:secp256r1:secp384r1:secp521r1:ffdhe2048:ffdhe3072:ffdhe4096:ffdhe6144:ffdhe8192
-
-[openssl_init]
-alg_section = evp_properties
-
-[evp_properties]
-rh-allow-sha1-signatures = yes
Index: fedora-crypto-policies-20230420.3d08ae7/tests/outputs/DEFAULT:GOST-opensslcnf.txt
===================================================================
--- fedora-crypto-policies-20230420.3d08ae7.orig/tests/outputs/DEFAULT:GOST-opensslcnf.txt
+++ fedora-crypto-policies-20230420.3d08ae7/tests/outputs/DEFAULT:GOST-opensslcnf.txt
@@ -6,9 +6,3 @@ DTLS.MinProtocol = DTLSv1.2
DTLS.MaxProtocol = DTLSv1.2
SignatureAlgorithms = ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA512:ed25519:ed448:rsa_pss_pss_sha256:rsa_pss_pss_sha384:rsa_pss_pss_sha512:rsa_pss_rsae_sha256:rsa_pss_rsae_sha384:rsa_pss_rsae_sha512:RSA+SHA256:RSA+SHA384:RSA+SHA512:ECDSA+SHA224:RSA+SHA224
Groups = X25519:X448:secp256r1:secp384r1:secp521r1:ffdhe2048:ffdhe3072:ffdhe4096:ffdhe6144:ffdhe8192
-
-[openssl_init]
-alg_section = evp_properties
-
-[evp_properties]
-rh-allow-sha1-signatures = yes
Index: fedora-crypto-policies-20230420.3d08ae7/tests/outputs/EMPTY-opensslcnf.txt
===================================================================
--- fedora-crypto-policies-20230420.3d08ae7.orig/tests/outputs/EMPTY-opensslcnf.txt
+++ fedora-crypto-policies-20230420.3d08ae7/tests/outputs/EMPTY-opensslcnf.txt
@@ -2,9 +2,3 @@ CipherString = @SECLEVEL=0:-kPSK:-kDHEPS
Ciphersuites =
SignatureAlgorithms =
Groups =
-
-[openssl_init]
-alg_section = evp_properties
-
-[evp_properties]
-rh-allow-sha1-signatures = yes
Index: fedora-crypto-policies-20230420.3d08ae7/tests/outputs/FIPS-opensslcnf.txt
===================================================================
--- fedora-crypto-policies-20230420.3d08ae7.orig/tests/outputs/FIPS-opensslcnf.txt
+++ fedora-crypto-policies-20230420.3d08ae7/tests/outputs/FIPS-opensslcnf.txt
@@ -6,9 +6,3 @@ DTLS.MinProtocol = DTLSv1.2
DTLS.MaxProtocol = DTLSv1.2
SignatureAlgorithms = ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA512:rsa_pss_pss_sha256:rsa_pss_pss_sha384:rsa_pss_pss_sha512:rsa_pss_rsae_sha256:rsa_pss_rsae_sha384:rsa_pss_rsae_sha512:RSA+SHA256:RSA+SHA384:RSA+SHA512:ECDSA+SHA224:RSA+SHA224
Groups = secp256r1:secp384r1:secp521r1:ffdhe2048:ffdhe3072:ffdhe4096:ffdhe6144:ffdhe8192
-
-[openssl_init]
-alg_section = evp_properties
-
-[evp_properties]
-rh-allow-sha1-signatures = yes
Index: fedora-crypto-policies-20230420.3d08ae7/tests/outputs/FIPS:ECDHE-ONLY-opensslcnf.txt
===================================================================
--- fedora-crypto-policies-20230420.3d08ae7.orig/tests/outputs/FIPS:ECDHE-ONLY-opensslcnf.txt
+++ fedora-crypto-policies-20230420.3d08ae7/tests/outputs/FIPS:ECDHE-ONLY-opensslcnf.txt
@@ -6,9 +6,3 @@ DTLS.MinProtocol = DTLSv1.2
DTLS.MaxProtocol = DTLSv1.2
SignatureAlgorithms = ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA512:rsa_pss_pss_sha256:rsa_pss_pss_sha384:rsa_pss_pss_sha512:rsa_pss_rsae_sha256:rsa_pss_rsae_sha384:rsa_pss_rsae_sha512:RSA+SHA256:RSA+SHA384:RSA+SHA512:ECDSA+SHA224:RSA+SHA224
Groups = secp256r1:secp384r1:secp521r1
-
-[openssl_init]
-alg_section = evp_properties
-
-[evp_properties]
-rh-allow-sha1-signatures = yes
Index: fedora-crypto-policies-20230420.3d08ae7/tests/outputs/FIPS:OSPP-opensslcnf.txt
===================================================================
--- fedora-crypto-policies-20230420.3d08ae7.orig/tests/outputs/FIPS:OSPP-opensslcnf.txt
+++ fedora-crypto-policies-20230420.3d08ae7/tests/outputs/FIPS:OSPP-opensslcnf.txt
@@ -6,9 +6,3 @@ DTLS.MinProtocol = DTLSv1.2
DTLS.MaxProtocol = DTLSv1.2
SignatureAlgorithms = ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA512:rsa_pss_pss_sha256:rsa_pss_pss_sha384:rsa_pss_pss_sha512:rsa_pss_rsae_sha256:rsa_pss_rsae_sha384:rsa_pss_rsae_sha512:RSA+SHA256:RSA+SHA384:RSA+SHA512
Groups = secp256r1:secp384r1:secp521r1:ffdhe2048:ffdhe3072:ffdhe4096:ffdhe6144:ffdhe8192
-
-[openssl_init]
-alg_section = evp_properties
-
-[evp_properties]
-rh-allow-sha1-signatures = yes
Index: fedora-crypto-policies-20230420.3d08ae7/tests/outputs/FUTURE-opensslcnf.txt
===================================================================
--- fedora-crypto-policies-20230420.3d08ae7.orig/tests/outputs/FUTURE-opensslcnf.txt
+++ fedora-crypto-policies-20230420.3d08ae7/tests/outputs/FUTURE-opensslcnf.txt
@@ -6,9 +6,3 @@ DTLS.MinProtocol = DTLSv1.2
DTLS.MaxProtocol = DTLSv1.2
SignatureAlgorithms = ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA512:ed25519:ed448:rsa_pss_pss_sha256:rsa_pss_pss_sha384:rsa_pss_pss_sha512:rsa_pss_rsae_sha256:rsa_pss_rsae_sha384:rsa_pss_rsae_sha512:RSA+SHA256:RSA+SHA384:RSA+SHA512
Groups = X25519:X448:secp256r1:secp384r1:secp521r1:ffdhe3072:ffdhe4096:ffdhe6144:ffdhe8192
-
-[openssl_init]
-alg_section = evp_properties
-
-[evp_properties]
-rh-allow-sha1-signatures = no
Index: fedora-crypto-policies-20230420.3d08ae7/tests/outputs/GOST-ONLY-opensslcnf.txt
===================================================================
--- fedora-crypto-policies-20230420.3d08ae7.orig/tests/outputs/GOST-ONLY-opensslcnf.txt
+++ fedora-crypto-policies-20230420.3d08ae7/tests/outputs/GOST-ONLY-opensslcnf.txt
@@ -4,9 +4,3 @@ TLS.MinProtocol = TLSv1
TLS.MaxProtocol = TLSv1.3
SignatureAlgorithms =
Groups =
-
-[openssl_init]
-alg_section = evp_properties
-
-[evp_properties]
-rh-allow-sha1-signatures = yes
Index: fedora-crypto-policies-20230420.3d08ae7/tests/outputs/LEGACY-opensslcnf.txt
===================================================================
--- fedora-crypto-policies-20230420.3d08ae7.orig/tests/outputs/LEGACY-opensslcnf.txt
+++ fedora-crypto-policies-20230420.3d08ae7/tests/outputs/LEGACY-opensslcnf.txt
@@ -6,9 +6,3 @@ DTLS.MinProtocol = DTLSv1
DTLS.MaxProtocol = DTLSv1.2
SignatureAlgorithms = ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA512:ed25519:ed448:rsa_pss_pss_sha256:rsa_pss_pss_sha384:rsa_pss_pss_sha512:rsa_pss_rsae_sha256:rsa_pss_rsae_sha384:rsa_pss_rsae_sha512:RSA+SHA256:RSA+SHA384:RSA+SHA512:ECDSA+SHA224:RSA+SHA224:DSA+SHA256:DSA+SHA384:DSA+SHA512:DSA+SHA224:ECDSA+SHA1:RSA+SHA1:DSA+SHA1
Groups = X25519:X448:secp256r1:secp384r1:secp521r1:ffdhe2048:ffdhe3072:ffdhe4096:ffdhe6144:ffdhe8192
-
-[openssl_init]
-alg_section = evp_properties
-
-[evp_properties]
-rh-allow-sha1-signatures = yes
Index: fedora-crypto-policies-20230420.3d08ae7/tests/outputs/LEGACY:AD-SUPPORT-opensslcnf.txt
===================================================================
--- fedora-crypto-policies-20230420.3d08ae7.orig/tests/outputs/LEGACY:AD-SUPPORT-opensslcnf.txt
+++ fedora-crypto-policies-20230420.3d08ae7/tests/outputs/LEGACY:AD-SUPPORT-opensslcnf.txt
@@ -6,9 +6,3 @@ DTLS.MinProtocol = DTLSv1
DTLS.MaxProtocol = DTLSv1.2
SignatureAlgorithms = ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA512:ed25519:ed448:rsa_pss_pss_sha256:rsa_pss_pss_sha384:rsa_pss_pss_sha512:rsa_pss_rsae_sha256:rsa_pss_rsae_sha384:rsa_pss_rsae_sha512:RSA+SHA256:RSA+SHA384:RSA+SHA512:ECDSA+SHA224:RSA+SHA224:DSA+SHA256:DSA+SHA384:DSA+SHA512:DSA+SHA224:ECDSA+SHA1:RSA+SHA1:DSA+SHA1
Groups = X25519:X448:secp256r1:secp384r1:secp521r1:ffdhe2048:ffdhe3072:ffdhe4096:ffdhe6144:ffdhe8192
-
-[openssl_init]
-alg_section = evp_properties
-
-[evp_properties]
-rh-allow-sha1-signatures = yes
Index: fedora-crypto-policies-20230420.3d08ae7/tests/unit/test_cryptopolicy.py
===================================================================
--- fedora-crypto-policies-20230420.3d08ae7.orig/tests/unit/test_cryptopolicy.py
+++ fedora-crypto-policies-20230420.3d08ae7/tests/unit/test_cryptopolicy.py
@@ -260,7 +260,6 @@ def test_cryptopolicy_to_string_empty(tm
min_dh_size = 0
min_dsa_size = 0
min_rsa_size = 0
- __openssl_block_sha1_signatures = 0
sha1_in_certs = 0
ssh_certs = 0
ssh_etm = 0
@@ -291,7 +290,6 @@ def test_cryptopolicy_to_string_twisted(
min_dh_size = 0
min_dsa_size = 0
min_rsa_size = 0
- __openssl_block_sha1_signatures = 0
sha1_in_certs = 0
ssh_certs = 0
ssh_etm = 0
Index: fedora-crypto-policies-20230420.3d08ae7/policies/TEST-FEDORA39.pol
===================================================================
--- fedora-crypto-policies-20230420.3d08ae7.orig/policies/TEST-FEDORA39.pol
+++ fedora-crypto-policies-20230420.3d08ae7/policies/TEST-FEDORA39.pol
@@ -67,7 +67,3 @@ sha1_in_certs = 0
arbitrary_dh_groups = 1
ssh_certs = 1
ssh_etm = 1
-
-# https://fedoraproject.org/wiki/Changes/StrongCryptoSettings3Forewarning1
-# SHA-1 signatures will blocked in OpenSSL
-__openssl_block_sha1_signatures = 1

4
crypto-policies.7.gz
View File

@ -1,3 +1,3 @@
version https://git-lfs.github.com/spec/v1
oid sha256:e0f927cbf526fbd0bec4eaf6b2456a6d148d42abdfb25978c71ede20b3a5e2ce
size 6770
oid sha256:08e4778d0c659ec3d5f408ba889634255f462b5fe6ee0d22194347103da69a7e
size 6896

19
crypto-policies.changes
View File

@ -1,3 +1,20 @@
-------------------------------------------------------------------
Thu May 25 11:28:12 UTC 2023 - Pedro Monreal <pmonreal@suse.com>
- FIPS: Enable to set the kernel FIPS mode with fips-mode-setup
and fips-finish-install commands, add also the man pages. The
required FIPS modules are left to be installed by the user.
* Rebase crypto-policies-FIPS.patch
-------------------------------------------------------------------
Wed May 24 20:04:20 UTC 2023 - Pedro Monreal <pmonreal@suse.com>
- Revert a breaking change that introduces the config option
rh-allow-sha1-signatures that is unkown to OpenSSL and fails
on startup. We will consider adding this option to openssl.
* https://gitlab.com/redhat-crypto/fedora-crypto-policies/-/commit/97fe4494
* Add crypto-policies-revert-rh-allow-sha1-signatures.patch
-------------------------------------------------------------------
Mon May 8 09:45:45 UTC 2023 - Pedro Monreal <pmonreal@suse.com>
@ -16,7 +33,7 @@ Mon May 08 06:32:49 UTC 2023 - Pedro Monreal <pmonreal@suse.com>
* sequoia: add separate rpm-sequoia backend
* crypto-policies.7: state upfront that FUTURE is not so interoperable
* Makefile: update for asciidoc 10
* Skip the LibreswanGenerator and SequoiaGenerator:
* Skip not needed LibreswanGenerator and SequoiaGenerator:
- Add crypto-policies-policygenerators.patch
* Remove crypto-policies-test_supported_modules_only.patch
* Rebase crypto-policies-no-build-manpages.patch

33
crypto-policies.spec
View File

@ -32,16 +32,25 @@ Source0: fedora-%{name}-%{version}.tar.gz
Source1: README.SUSE
Source2: crypto-policies.7.gz
Source3: update-crypto-policies.8.gz
Source4: crypto-policies-rpmlintrc
Source4: fips-mode-setup.8.gz
Source5: fips-finish-install.8.gz
Source6: crypto-policies-rpmlintrc
%if %{without manbuild}
#PATCH-FIX-OPENSUSE Manpages build cycles and dependencies
# To reduce the build dependencies in Ring0, we have to compile the
# man pages locally (use --with testsuite) and add crypto-policies.7.gz
# and update-crypto-policies.8.gz as sources.
# man pages locally (use --with testsuite) and add the built files
# crypto-policies.7.gz, update-crypto-policies.8.gz, fips-mode-setup.8.gz
# and fips-finish-install.8.gz as sources.
Patch1: crypto-policies-no-build-manpages.patch
%endif
Patch2: crypto-policies-FIPS.patch
Patch3: crypto-policies-policygenerators.patch
Patch4: crypto-policies-supported.patch
#PATCH-FIX-OPENSUSE Skip not needed LibreswanGenerator and SequoiaGenerator
Patch2: crypto-policies-policygenerators.patch
#PATCH-FIX-OPENSUSE bsc#1209998 Mention the supported back-end policies
Patch3: crypto-policies-supported.patch
#PATCH-FIX-OPENSUSE Revert a breaking change that introduces rh-allow-sha1-signatures
Patch4: crypto-policies-revert-rh-allow-sha1-signatures.patch
#PATCH-FIX-OPENSUSE Adpat the fips-mode-setup script for TW
Patch5: crypto-policies-FIPS.patch
BuildRequires: python3-base >= 3.6
# The sequoia stuff needs python3-toml, removed until needed
# BuildRequires: python3-toml
@ -125,15 +134,13 @@ mkdir -p -m 755 %{buildroot}%{_mandir}/
mkdir -p -m 755 %{buildroot}%{_mandir}/man7/
mkdir -p -m 755 %{buildroot}%{_mandir}/man8/
cp %{SOURCE2} %{buildroot}%{_mandir}/man7/
cp %{SOURCE3} %{buildroot}%{_mandir}/man8/
cp %{SOURCE3} %{SOURCE4} %{SOURCE5} %{buildroot}%{_mandir}/man8/
%endif
# Install the executable scripts
install -p -m 755 update-crypto-policies %{buildroot}%{_bindir}/
# Remove the fips-related scripts and man pages
find -type f -name "*fips*" -delete
find %{buildroot} -type f -name "*fips*" -delete
install -p -m 755 fips-mode-setup %{buildroot}%{_bindir}/
install -p -m 755 fips-finish-install %{buildroot}%{_bindir}/
# Drop pre-generated GOST-ONLY policy, we do not need to ship them
rm -rf %{buildroot}%{_datarootdir}/crypto-policies/GOST-ONLY
@ -245,7 +252,11 @@ end
%files scripts
%{_bindir}/update-crypto-policies
%{_bindir}/fips-mode-setup
%{_bindir}/fips-finish-install
%{_mandir}/man8/update-crypto-policies.8%{?ext_man}
%{_mandir}/man8/fips-mode-setup.8%{?ext_man}
%{_mandir}/man8/fips-finish-install.8%{?ext_man}
%{_datarootdir}/crypto-policies/python
%changelog

3
fips-finish-install.8.gz Normal file
View File

@ -0,0 +1,3 @@
version https://git-lfs.github.com/spec/v1
oid sha256:c127272faa0580e5969d1a1b33ea4a8811a60da45d23fe50a782eaaf8c0c9075
size 824

3
fips-mode-setup.8.gz Normal file
View File

@ -0,0 +1,3 @@
version https://git-lfs.github.com/spec/v1
oid sha256:7a427092b98f11bf8bb0606afd71dbe1d153362f9c3a15ed53e479436f45e43b
size 1541

4
update-crypto-policies.8.gz
View File

@ -1,3 +1,3 @@
version https://git-lfs.github.com/spec/v1
oid sha256:ce03018475d3b1e4cb06951fa1c13017f13fa6600b3b10e04912af5e3e426692
size 4179
oid sha256:3530ed7a871a3b9c72ea761ff45f9a80ab2720f76bb223e58debad848b8aa7a1
size 4178