openssl3/contribs10/0049-Selectively-disallow-SHA1-signatures.patch

From 243201772cc6d583fae9eba81cb2c2c7425bc564 Mon Sep 17 00:00:00 2001
From: Clemens Lang <cllang@redhat.com>
Date: Mon, 21 Feb 2022 17:24:44 +0100
Subject: Selectively disallow SHA1 signatures

For RHEL 9.0, we want to phase out SHA1. One of the steps to do that is
disabling SHA1 signatures. Introduce a new configuration option in the
alg_section named 'rh-allow-sha1-signatures'. This option defaults to
false. If set to false (or unset), any signature creation or
verification operations that involve SHA1 as digest will fail.

This also affects TLS, where the signature_algorithms extension of any
ClientHello message sent by OpenSSL will no longer include signatures
with the SHA1 digest if rh-allow-sha1-signatures is false. For servers
that request a client certificate, the same also applies for
CertificateRequest messages sent by them.

For signatures created using the EVP_PKEY API, this is a best-effort
check that will deny signatures in cases where the digest algorithm is
known. This means, for example, that that following steps will still
work:

 $> openssl dgst -sha1 -binary -out sha1 infile
 $> openssl pkeyutl -inkey key.pem -sign -in sha1 -out sha1sig
 $> openssl pkeyutl -inkey key.pem -verify -sigfile sha1sig -in sha1

whereas these will not:

 $> openssl dgst -sha1 -binary -out sha1 infile
 $> openssl pkeyutl -inkey kem.pem -sign -in sha1 -out sha1sig -pkeyopt digest:sha1
 $> openssl pkeyutl -inkey kem.pem -verify -sigfile sha1sig -in sha1 -pkeyopt digest:sha1

This happens because in the first case, OpenSSL's signature
implementation does not know that it is signing a SHA1 hash (it could be
signing arbitrary data).

Resolves: rhbz#2031742
---
 crypto/evp/evp_cnf.c                          | 13 ++++
 crypto/evp/m_sigver.c                         | 77 +++++++++++++++++++
 crypto/evp/pmeth_lib.c                        | 15 ++++
 doc/man5/config.pod                           | 11 +++
 include/internal/cryptlib.h                   |  3 +-
 include/internal/sslconf.h                    |  4 +
 providers/common/securitycheck.c              | 20 +++++
 providers/common/securitycheck_default.c      |  9 ++-
 providers/implementations/signature/dsa_sig.c | 11 ++-
 .../implementations/signature/ecdsa_sig.c     |  4 +
 providers/implementations/signature/rsa_sig.c | 20 ++++-
 ssl/t1_lib.c                                  |  8 ++
 util/libcrypto.num                            |  2 +
 13 files changed, 188 insertions(+), 9 deletions(-)

diff --git a/crypto/evp/evp_cnf.c b/crypto/evp/evp_cnf.c
index 0e7fe64cf9..b9d3b6d226 100644
--- a/crypto/evp/evp_cnf.c
+++ b/crypto/evp/evp_cnf.c
@@ -10,6 +10,7 @@
 #include <stdio.h>
 #include <openssl/crypto.h>
 #include "internal/cryptlib.h"
+#include "internal/sslconf.h"
 #include <openssl/conf.h>
 #include <openssl/x509.h>
 #include <openssl/x509v3.h>
@@ -57,6 +58,18 @@ static int alg_module_init(CONF_IMODULE *md, const CONF *cnf)
                 ERR_raise(ERR_LIB_EVP, EVP_R_SET_DEFAULT_PROPERTY_FAILURE);
                 return 0;
             }
+        } else if (strcmp(oval->name, "rh-allow-sha1-signatures") == 0) {
+            int m;
+
+            /* Detailed error already reported. */
+            if (!X509V3_get_value_bool(oval, &m))
+                return 0;
+
+            if (!ossl_ctx_legacy_digest_signatures_allowed_set(
+                    NCONF_get0_libctx((CONF *)cnf), m > 0, 0)) {
+                ERR_raise(ERR_LIB_EVP, EVP_R_SET_DEFAULT_PROPERTY_FAILURE);
+                return 0;
+            }
         } else {
             ERR_raise_data(ERR_LIB_EVP, EVP_R_UNKNOWN_OPTION,
                            "name=%s, value=%s", oval->name, oval->value);
diff --git a/crypto/evp/m_sigver.c b/crypto/evp/m_sigver.c
index 9188edbc21..db1a1d7bc3 100644
--- a/crypto/evp/m_sigver.c
+++ b/crypto/evp/m_sigver.c
@@ -16,6 +16,71 @@
 #include "internal/numbers.h"   /* includes SIZE_MAX */
 #include "evp_local.h"
 
+typedef struct ossl_legacy_digest_signatures_st {
+    int allowed;
+} OSSL_LEGACY_DIGEST_SIGNATURES;
+
+static void ossl_ctx_legacy_digest_signatures_free(void *vldsigs)
+{
+    OSSL_LEGACY_DIGEST_SIGNATURES *ldsigs = vldsigs;
+
+    if (ldsigs != NULL) {
+        OPENSSL_free(ldsigs);
+    }
+}
+
+static void *ossl_ctx_legacy_digest_signatures_new(OSSL_LIB_CTX *ctx)
+{
+    return OPENSSL_zalloc(sizeof(OSSL_LEGACY_DIGEST_SIGNATURES));
+}
+
+static const OSSL_LIB_CTX_METHOD ossl_ctx_legacy_digest_signatures_method = {
+    OSSL_LIB_CTX_METHOD_DEFAULT_PRIORITY,
+    ossl_ctx_legacy_digest_signatures_new,
+    ossl_ctx_legacy_digest_signatures_free,
+};
+
+static OSSL_LEGACY_DIGEST_SIGNATURES *ossl_ctx_legacy_digest_signatures(
+        OSSL_LIB_CTX *libctx, int loadconfig)
+{
+#ifndef FIPS_MODULE
+    if (loadconfig && !OPENSSL_init_crypto(OPENSSL_INIT_LOAD_CONFIG, NULL))
+        return 0;
+#endif
+
+    return ossl_lib_ctx_get_data(libctx, OSSL_LIB_CTX_LEGACY_DIGEST_SIGNATURES,
+                                 &ossl_ctx_legacy_digest_signatures_method);
+}
+
+int ossl_ctx_legacy_digest_signatures_allowed(OSSL_LIB_CTX *libctx, int loadconfig)
+{
+    OSSL_LEGACY_DIGEST_SIGNATURES *ldsigs
+        = ossl_ctx_legacy_digest_signatures(libctx, loadconfig);
+
+#ifndef FIPS_MODULE
+    if (ossl_safe_getenv("OPENSSL_ENABLE_SHA1_SIGNATURES") != NULL)
+        /* used in tests */
+        return 1;
+#endif
+
+    return ldsigs != NULL ? ldsigs->allowed : 0;
+}
+
+int ossl_ctx_legacy_digest_signatures_allowed_set(OSSL_LIB_CTX *libctx, int allow,
+                                                  int loadconfig)
+{
+    OSSL_LEGACY_DIGEST_SIGNATURES *ldsigs
+        = ossl_ctx_legacy_digest_signatures(libctx, loadconfig);
+
+    if (ldsigs == NULL) {
+        ERR_raise(ERR_LIB_EVP, ERR_R_INTERNAL_ERROR);
+        return 0;
+    }
+
+    ldsigs->allowed = allow;
+    return 1;
+}
+
 #ifndef FIPS_MODULE
 
 static int update(EVP_MD_CTX *ctx, const void *data, size_t datalen)
@@ -258,6 +323,18 @@ static int do_sigver_init(EVP_MD_CTX *ctx, EVP_PKEY_CTX **pctx,
         }
     }
 
+    if (ctx->reqdigest != NULL
+            && !EVP_PKEY_is_a(locpctx->pkey, SN_hmac)
+            && !EVP_PKEY_is_a(locpctx->pkey, SN_tls1_prf)
+            && !EVP_PKEY_is_a(locpctx->pkey, SN_hkdf)) {
+        int mdnid = EVP_MD_nid(ctx->reqdigest);
+        if (!ossl_ctx_legacy_digest_signatures_allowed(locpctx->libctx, 0)
+                && (mdnid == NID_sha1 || mdnid == NID_md5_sha1)) {
+            ERR_raise(ERR_LIB_EVP, EVP_R_INVALID_DIGEST);
+            goto err;
+        }
+    }
+
     if (ver) {
         if (signature->digest_verify_init == NULL) {
             ERR_raise(ERR_LIB_EVP, EVP_R_INITIALIZATION_ERROR);
diff --git a/crypto/evp/pmeth_lib.c b/crypto/evp/pmeth_lib.c
index 2b9c6c2351..3c5a1e6f5d 100644
--- a/crypto/evp/pmeth_lib.c
+++ b/crypto/evp/pmeth_lib.c
@@ -33,6 +33,7 @@
 #include "internal/ffc.h"
 #include "internal/numbers.h"
 #include "internal/provider.h"
+#include "internal/sslconf.h"
 #include "evp_local.h"
 
 #ifndef FIPS_MODULE
@@ -946,6 +947,20 @@ static int evp_pkey_ctx_set_md(EVP_PKEY_CTX *ctx, const EVP_MD *md,
         return -2;
     }
 
+    if (EVP_PKEY_CTX_IS_SIGNATURE_OP(ctx)
+            && md != NULL
+            && ctx->pkey != NULL
+            && !EVP_PKEY_is_a(ctx->pkey, SN_hmac)
+            && !EVP_PKEY_is_a(ctx->pkey, SN_tls1_prf)
+            && !EVP_PKEY_is_a(ctx->pkey, SN_hkdf)) {
+        int mdnid = EVP_MD_nid(md);
+        if ((mdnid == NID_sha1 || mdnid == NID_md5_sha1)
+                && !ossl_ctx_legacy_digest_signatures_allowed(ctx->libctx, 0)) {
+            ERR_raise(ERR_LIB_EVP, EVP_R_INVALID_DIGEST);
+            return -1;
+        }
+    }
+
     if (fallback)
         return EVP_PKEY_CTX_ctrl(ctx, -1, op, ctrl, 0, (void *)(md));
 
diff --git a/doc/man5/config.pod b/doc/man5/config.pod
index 77a8055e81..aa1be5ca7f 100644
--- a/doc/man5/config.pod
+++ b/doc/man5/config.pod
@@ -304,6 +304,17 @@ Within the algorithm properties section, the following names have meaning:
 The value may be anything that is acceptable as a property query
 string for EVP_set_default_properties().
 
+=item B<rh-allow-sha1-signatures>
+
+The value is a boolean that can be B<yes> or B<no>.  If the value is not set,
+it behaves as if it was set to B<no>.
+
+When set to B<no>, any attempt to create or verify a signature with a SHA1
+digest will fail.  For compatibility with older versions of OpenSSL, set this
+option to B<yes>.  This setting also affects TLS, where signature algorithms
+that use SHA1 as digest will no longer be supported if this option is set to
+B<no>.
+
 =item B<fips_mode> (deprecated)
 
 The value is a boolean that can be B<yes> or B<no>.  If the value is
diff --git a/include/internal/cryptlib.h b/include/internal/cryptlib.h
index 1291299b6e..e234341e6a 100644
--- a/include/internal/cryptlib.h
+++ b/include/internal/cryptlib.h
@@ -168,7 +168,8 @@ typedef struct ossl_ex_data_global_st {
 # define OSSL_LIB_CTX_PROVIDER_CONF_INDEX           16
 # define OSSL_LIB_CTX_BIO_CORE_INDEX                17
 # define OSSL_LIB_CTX_CHILD_PROVIDER_INDEX          18
-# define OSSL_LIB_CTX_MAX_INDEXES                   19
+# define OSSL_LIB_CTX_LEGACY_DIGEST_SIGNATURES      19
+# define OSSL_LIB_CTX_MAX_INDEXES                   20
 
 # define OSSL_LIB_CTX_METHOD_LOW_PRIORITY          -1
 # define OSSL_LIB_CTX_METHOD_DEFAULT_PRIORITY       0
diff --git a/include/internal/sslconf.h b/include/internal/sslconf.h
index fd7f7e3331..05464b0655 100644
--- a/include/internal/sslconf.h
+++ b/include/internal/sslconf.h
@@ -18,4 +18,8 @@ int conf_ssl_name_find(const char *name, size_t *idx);
 void conf_ssl_get_cmd(const SSL_CONF_CMD *cmd, size_t idx, char **cmdstr,
                       char **arg);
 
+/* Methods to support disabling all signatures with legacy digests */
+int ossl_ctx_legacy_digest_signatures_allowed(OSSL_LIB_CTX *libctx, int loadconfig);
+int ossl_ctx_legacy_digest_signatures_allowed_set(OSSL_LIB_CTX *libctx, int allow,
+                                                  int loadconfig);
 #endif
diff --git a/providers/common/securitycheck.c b/providers/common/securitycheck.c
index 699ada7c52..e534ad0a5f 100644
--- a/providers/common/securitycheck.c
+++ b/providers/common/securitycheck.c
@@ -19,6 +19,7 @@
 #include <openssl/core_names.h>
 #include <openssl/obj_mac.h>
 #include "prov/securitycheck.h"
+#include "internal/sslconf.h"
 
 /*
  * FIPS requires a minimum security strength of 112 bits (for encryption or
@@ -235,6 +236,15 @@ int ossl_digest_get_approved_nid_with_sha1(OSSL_LIB_CTX *ctx, const EVP_MD *md,
             mdnid = -1; /* disallowed by security checks */
     }
 # endif /* OPENSSL_NO_FIPS_SECURITYCHECKS */
+
+#ifndef FIPS_MODULE
+    if (!ossl_ctx_legacy_digest_signatures_allowed(ctx, 0))
+        /* SHA1 is globally disabled, check whether we want to locally allow
+         * it. */
+        if (mdnid == NID_sha1 && !sha1_allowed)
+            mdnid = -1;
+#endif
+
     return mdnid;
 }
 
@@ -244,5 +254,15 @@ int ossl_digest_is_allowed(OSSL_LIB_CTX *ctx, const EVP_MD *md)
     if (ossl_securitycheck_enabled(ctx))
         return ossl_digest_get_approved_nid(md) != NID_undef;
 # endif /* OPENSSL_NO_FIPS_SECURITYCHECKS */
+
+#ifndef FIPS_MODULE
+    {
+        int mdnid = EVP_MD_nid(md);
+        if ((mdnid == NID_sha1 || mdnid == NID_md5_sha1)
+                && !ossl_ctx_legacy_digest_signatures_allowed(ctx, 0))
+            return 0;
+    }
+#endif
+
     return 1;
 }
diff --git a/providers/common/securitycheck_default.c b/providers/common/securitycheck_default.c
index de7f0d3a0a..ce54a94fbc 100644
--- a/providers/common/securitycheck_default.c
+++ b/providers/common/securitycheck_default.c
@@ -15,6 +15,7 @@
 #include <openssl/obj_mac.h>
 #include "prov/securitycheck.h"
 #include "internal/nelem.h"
+#include "internal/sslconf.h"
 
 /* Disable the security checks in the default provider */
 int ossl_securitycheck_enabled(OSSL_LIB_CTX *libctx)
@@ -23,9 +24,10 @@ int ossl_securitycheck_enabled(OSSL_LIB_CTX *libctx)
 }
 
 int ossl_digest_rsa_sign_get_md_nid(OSSL_LIB_CTX *ctx, const EVP_MD *md,
-                                    ossl_unused int sha1_allowed)
+                                    int sha1_allowed)
 {
     int mdnid;
+    int ldsigs_allowed;
 
     static const OSSL_ITEM name_to_nid[] = {
         { NID_md5,       OSSL_DIGEST_NAME_MD5       },
@@ -36,8 +38,11 @@ int ossl_digest_rsa_sign_get_md_nid(OSSL_LIB_CTX *ctx, const EVP_MD *md,
         { NID_ripemd160, OSSL_DIGEST_NAME_RIPEMD160 },
     };
 
-    mdnid = ossl_digest_get_approved_nid_with_sha1(ctx, md, 1);
+    ldsigs_allowed = ossl_ctx_legacy_digest_signatures_allowed(ctx, 0);
+    mdnid = ossl_digest_get_approved_nid_with_sha1(ctx, md, sha1_allowed || ldsigs_allowed);
     if (mdnid == NID_undef)
         mdnid = ossl_digest_md_to_nid(md, name_to_nid, OSSL_NELEM(name_to_nid));
+    if (mdnid == NID_md5_sha1 && !ldsigs_allowed)
+        mdnid = -1;
     return mdnid;
 }
diff --git a/providers/implementations/signature/dsa_sig.c b/providers/implementations/signature/dsa_sig.c
index 28fd7c498e..fa3822f39f 100644
--- a/providers/implementations/signature/dsa_sig.c
+++ b/providers/implementations/signature/dsa_sig.c
@@ -124,12 +124,17 @@ static int dsa_setup_md(PROV_DSA_CTX *ctx,
         mdprops = ctx->propq;
 
     if (mdname != NULL) {
-        int sha1_allowed = (ctx->operation != EVP_PKEY_OP_SIGN);
         WPACKET pkt;
         EVP_MD *md = EVP_MD_fetch(ctx->libctx, mdname, mdprops);
-        int md_nid = ossl_digest_get_approved_nid_with_sha1(ctx->libctx, md,
-                                                            sha1_allowed);
+        int md_nid;
         size_t mdname_len = strlen(mdname);
+#ifdef FIPS_MODULE
+        int sha1_allowed = (ctx->operation != EVP_PKEY_OP_SIGN);
+#else
+        int sha1_allowed = 0;
+#endif
+        md_nid = ossl_digest_get_approved_nid_with_sha1(ctx->libctx, md,
+                                                            sha1_allowed);
 
         if (md == NULL || md_nid < 0) {
             if (md == NULL)
diff --git a/providers/implementations/signature/ecdsa_sig.c b/providers/implementations/signature/ecdsa_sig.c
index 865d49d100..99b228e82c 100644
--- a/providers/implementations/signature/ecdsa_sig.c
+++ b/providers/implementations/signature/ecdsa_sig.c
@@ -237,7 +237,11 @@ static int ecdsa_setup_md(PROV_ECDSA_CTX *ctx, const char *mdname,
                        "%s could not be fetched", mdname);
         return 0;
     }
+#ifdef FIPS_MODULE
     sha1_allowed = (ctx->operation != EVP_PKEY_OP_SIGN);
+#else
+    sha1_allowed = 0;
+#endif
     md_nid = ossl_digest_get_approved_nid_with_sha1(ctx->libctx, md,
                                                     sha1_allowed);
     if (md_nid < 0) {
diff --git a/providers/implementations/signature/rsa_sig.c b/providers/implementations/signature/rsa_sig.c
index 325e855333..bea397f0c1 100644
--- a/providers/implementations/signature/rsa_sig.c
+++ b/providers/implementations/signature/rsa_sig.c
@@ -26,6 +26,7 @@
 #include "internal/cryptlib.h"
 #include "internal/nelem.h"
 #include "internal/sizes.h"
+#include "internal/sslconf.h"
 #include "crypto/rsa.h"
 #include "prov/providercommon.h"
 #include "prov/implementations.h"
@@ -34,6 +35,7 @@
 #include "prov/securitycheck.h"
 
 #define RSA_DEFAULT_DIGEST_NAME OSSL_DIGEST_NAME_SHA1
+#define RSA_DEFAULT_DIGEST_NAME_NONLEGACY OSSL_DIGEST_NAME_SHA2_256
 
 static OSSL_FUNC_signature_newctx_fn rsa_newctx;
 static OSSL_FUNC_signature_sign_init_fn rsa_sign_init;
@@ -289,10 +291,15 @@ static int rsa_setup_md(PROV_RSA_CTX *ctx, const char *mdname,
 
     if (mdname != NULL) {
         EVP_MD *md = EVP_MD_fetch(ctx->libctx, mdname, mdprops);
+        int md_nid;
+        size_t mdname_len = strlen(mdname);
+#ifdef FIPS_MODULE
         int sha1_allowed = (ctx->operation != EVP_PKEY_OP_SIGN);
-        int md_nid = ossl_digest_rsa_sign_get_md_nid(ctx->libctx, md,
+#else
+        int sha1_allowed = 0;
+#endif
+        md_nid = ossl_digest_rsa_sign_get_md_nid(ctx->libctx, md,
                                                      sha1_allowed);
-        size_t mdname_len = strlen(mdname);
 
         if (md == NULL
             || md_nid <= 0
@@ -1348,8 +1355,15 @@ static int rsa_set_ctx_params(void *vprsactx, const OSSL_PARAM params[])
     prsactx->pad_mode = pad_mode;
 
     if (prsactx->md == NULL && pmdname == NULL
-        && pad_mode == RSA_PKCS1_PSS_PADDING)
+        && pad_mode == RSA_PKCS1_PSS_PADDING) {
         pmdname = RSA_DEFAULT_DIGEST_NAME;
+#ifndef FIPS_MODULE
+        if (!ossl_ctx_legacy_digest_signatures_allowed(prsactx->libctx, 0)) {
+            pmdname = RSA_DEFAULT_DIGEST_NAME_NONLEGACY;
+        }
+#endif
+    }
+
 
     if (pmgf1mdname != NULL
         && !rsa_setup_mgf1_md(prsactx, pmgf1mdname, pmgf1mdprops))
diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c
index fc32bb3556..4b74ee1a34 100644
--- a/ssl/t1_lib.c
+++ b/ssl/t1_lib.c
@@ -20,6 +20,7 @@
 #include <openssl/bn.h>
 #include <openssl/provider.h>
 #include <openssl/param_build.h>
+#include "internal/sslconf.h"
 #include "internal/nelem.h"
 #include "internal/sizes.h"
 #include "internal/tlsgroups.h"
@@ -1145,11 +1146,13 @@ int ssl_setup_sig_algs(SSL_CTX *ctx)
         = OPENSSL_malloc(sizeof(*lu) * OSSL_NELEM(sigalg_lookup_tbl));
     EVP_PKEY *tmpkey = EVP_PKEY_new();
     int ret = 0;
+    int ldsigs_allowed;
 
     if (cache == NULL || tmpkey == NULL)
         goto err;
 
     ERR_set_mark();
+    ldsigs_allowed = ossl_ctx_legacy_digest_signatures_allowed(ctx->libctx, 0);
     for (i = 0, lu = sigalg_lookup_tbl;
          i < OSSL_NELEM(sigalg_lookup_tbl); lu++, i++) {
         EVP_PKEY_CTX *pctx;
@@ -1169,6 +1172,11 @@ int ssl_setup_sig_algs(SSL_CTX *ctx)
             cache[i].enabled = 0;
             continue;
         }
+        if ((lu->hash == NID_sha1 || lu->hash == NID_md5_sha1)
+                && !ldsigs_allowed) {
+            cache[i].enabled = 0;
+            continue;
+        }
 
         if (!EVP_PKEY_set_type(tmpkey, lu->sig)) {
             cache[i].enabled = 0;
diff --git a/util/libcrypto.num b/util/libcrypto.num
index 10b4e57d79..2d3c363bb0 100644
--- a/util/libcrypto.num
+++ b/util/libcrypto.num
@@ -5426,3 +5426,5 @@ ASN1_TIME_print_ex                      5553      3_0_0   EXIST::FUNCTION:
 OPENSSL_strcasecmp                      5556   3_0_3   EXIST::FUNCTION:
 OPENSSL_strncasecmp                     5557   3_0_3   EXIST::FUNCTION:
 ossl_safe_getenv                        ?      3_0_0   EXIST::FUNCTION:
+ossl_ctx_legacy_digest_signatures_allowed ?    3_0_1   EXIST::FUNCTION:
+ossl_ctx_legacy_digest_signatures_allowed_set ?        3_0_1   EXIST::FUNCTION:
-- 
2.35.1

1	jpp	1.1	From 243201772cc6d583fae9eba81cb2c2c7425bc564 Mon Sep 17 00:00:00 2001
2			From: Clemens Lang <cllang@redhat.com>
3			Date: Mon, 21 Feb 2022 17:24:44 +0100
4			Subject: Selectively disallow SHA1 signatures
5
6			For RHEL 9.0, we want to phase out SHA1. One of the steps to do that is
7			disabling SHA1 signatures. Introduce a new configuration option in the
8			alg_section named 'rh-allow-sha1-signatures'. This option defaults to
9			false. If set to false (or unset), any signature creation or
10			verification operations that involve SHA1 as digest will fail.
11
12			This also affects TLS, where the signature_algorithms extension of any
13			ClientHello message sent by OpenSSL will no longer include signatures
14			with the SHA1 digest if rh-allow-sha1-signatures is false. For servers
15			that request a client certificate, the same also applies for
16			CertificateRequest messages sent by them.
17
18			For signatures created using the EVP_PKEY API, this is a best-effort
19			check that will deny signatures in cases where the digest algorithm is
20			known. This means, for example, that that following steps will still
21			work:
22
23			$> openssl dgst -sha1 -binary -out sha1 infile
24			$> openssl pkeyutl -inkey key.pem -sign -in sha1 -out sha1sig
25			$> openssl pkeyutl -inkey key.pem -verify -sigfile sha1sig -in sha1
26
27			whereas these will not:
28
29			$> openssl dgst -sha1 -binary -out sha1 infile
30			$> openssl pkeyutl -inkey kem.pem -sign -in sha1 -out sha1sig -pkeyopt digest:sha1
31			$> openssl pkeyutl -inkey kem.pem -verify -sigfile sha1sig -in sha1 -pkeyopt digest:sha1
32
33			This happens because in the first case, OpenSSL's signature
34			implementation does not know that it is signing a SHA1 hash (it could be
35			signing arbitrary data).
36
37			Resolves: rhbz#2031742
38			---
39			crypto/evp/evp_cnf.c \| 13 ++++
40			crypto/evp/m_sigver.c \| 77 +++++++++++++++++++
41			crypto/evp/pmeth_lib.c \| 15 ++++
42			doc/man5/config.pod \| 11 +++
43			include/internal/cryptlib.h \| 3 +-
44			include/internal/sslconf.h \| 4 +
45			providers/common/securitycheck.c \| 20 +++++
46			providers/common/securitycheck_default.c \| 9 ++-
47			providers/implementations/signature/dsa_sig.c \| 11 ++-
48			.../implementations/signature/ecdsa_sig.c \| 4 +
49			providers/implementations/signature/rsa_sig.c \| 20 ++++-
50			ssl/t1_lib.c \| 8 ++
51			util/libcrypto.num \| 2 +
52			13 files changed, 188 insertions(+), 9 deletions(-)
53
54			diff --git a/crypto/evp/evp_cnf.c b/crypto/evp/evp_cnf.c
55			index 0e7fe64cf9..b9d3b6d226 100644
56			--- a/crypto/evp/evp_cnf.c
57			+++ b/crypto/evp/evp_cnf.c
58			@@ -10,6 +10,7 @@
59			#include <stdio.h>
60			#include <openssl/crypto.h>
61			#include "internal/cryptlib.h"
62			+#include "internal/sslconf.h"
63			#include <openssl/conf.h>
64			#include <openssl/x509.h>
65			#include <openssl/x509v3.h>
66			@@ -57,6 +58,18 @@ static int alg_module_init(CONF_IMODULE md, const CONF cnf)
67			ERR_raise(ERR_LIB_EVP, EVP_R_SET_DEFAULT_PROPERTY_FAILURE);
68			return 0;
69			}
70			+ } else if (strcmp(oval->name, "rh-allow-sha1-signatures") == 0) {
71			+ int m;
72			+
73			+ /* Detailed error already reported. */
74			+ if (!X509V3_get_value_bool(oval, &m))
75			+ return 0;
76			+
77			+ if (!ossl_ctx_legacy_digest_signatures_allowed_set(
78			+ NCONF_get0_libctx((CONF *)cnf), m > 0, 0)) {
79			+ ERR_raise(ERR_LIB_EVP, EVP_R_SET_DEFAULT_PROPERTY_FAILURE);
80			+ return 0;
81			+ }
82			} else {
83			ERR_raise_data(ERR_LIB_EVP, EVP_R_UNKNOWN_OPTION,
84			"name=%s, value=%s", oval->name, oval->value);
85			diff --git a/crypto/evp/m_sigver.c b/crypto/evp/m_sigver.c
86			index 9188edbc21..db1a1d7bc3 100644
87			--- a/crypto/evp/m_sigver.c
88			+++ b/crypto/evp/m_sigver.c
89			@@ -16,6 +16,71 @@
90			#include "internal/numbers.h" /* includes SIZE_MAX */
91			#include "evp_local.h"
92
93			+typedef struct ossl_legacy_digest_signatures_st {
94			+ int allowed;
95			+} OSSL_LEGACY_DIGEST_SIGNATURES;
96			+
97			+static void ossl_ctx_legacy_digest_signatures_free(void *vldsigs)
98			+{
99			+ OSSL_LEGACY_DIGEST_SIGNATURES *ldsigs = vldsigs;
100			+
101			+ if (ldsigs != NULL) {
102			+ OPENSSL_free(ldsigs);
103			+ }
104			+}
105			+
106			+static void ossl_ctx_legacy_digest_signatures_new(OSSL_LIB_CTX ctx)
107			+{
108			+ return OPENSSL_zalloc(sizeof(OSSL_LEGACY_DIGEST_SIGNATURES));
109			+}
110			+
111			+static const OSSL_LIB_CTX_METHOD ossl_ctx_legacy_digest_signatures_method = {
112			+ OSSL_LIB_CTX_METHOD_DEFAULT_PRIORITY,
113			+ ossl_ctx_legacy_digest_signatures_new,
114			+ ossl_ctx_legacy_digest_signatures_free,
115			+};
116			+
117			+static OSSL_LEGACY_DIGEST_SIGNATURES *ossl_ctx_legacy_digest_signatures(
118			+ OSSL_LIB_CTX *libctx, int loadconfig)
119			+{
120			+#ifndef FIPS_MODULE
121			+ if (loadconfig && !OPENSSL_init_crypto(OPENSSL_INIT_LOAD_CONFIG, NULL))
122			+ return 0;
123			+#endif
124			+
125			+ return ossl_lib_ctx_get_data(libctx, OSSL_LIB_CTX_LEGACY_DIGEST_SIGNATURES,
126			+ &ossl_ctx_legacy_digest_signatures_method);
127			+}
128			+
129			+int ossl_ctx_legacy_digest_signatures_allowed(OSSL_LIB_CTX *libctx, int loadconfig)
130			+{
131			+ OSSL_LEGACY_DIGEST_SIGNATURES *ldsigs
132			+ = ossl_ctx_legacy_digest_signatures(libctx, loadconfig);
133			+
134			+#ifndef FIPS_MODULE
135			+ if (ossl_safe_getenv("OPENSSL_ENABLE_SHA1_SIGNATURES") != NULL)
136			+ /* used in tests */
137			+ return 1;
138			+#endif
139			+
140			+ return ldsigs != NULL ? ldsigs->allowed : 0;
141			+}
142			+
143			+int ossl_ctx_legacy_digest_signatures_allowed_set(OSSL_LIB_CTX *libctx, int allow,
144			+ int loadconfig)
145			+{
146			+ OSSL_LEGACY_DIGEST_SIGNATURES *ldsigs
147			+ = ossl_ctx_legacy_digest_signatures(libctx, loadconfig);
148			+
149			+ if (ldsigs == NULL) {
150			+ ERR_raise(ERR_LIB_EVP, ERR_R_INTERNAL_ERROR);
151			+ return 0;
152			+ }
153			+
154			+ ldsigs->allowed = allow;
155			+ return 1;
156			+}
157			+
158			#ifndef FIPS_MODULE
159
160			static int update(EVP_MD_CTX ctx, const void data, size_t datalen)
161			@@ -258,6 +323,18 @@ static int do_sigver_init(EVP_MD_CTX ctx, EVP_PKEY_CTX *pctx,
162			}
163			}
164
165			+ if (ctx->reqdigest != NULL
166			+ && !EVP_PKEY_is_a(locpctx->pkey, SN_hmac)
167			+ && !EVP_PKEY_is_a(locpctx->pkey, SN_tls1_prf)
168			+ && !EVP_PKEY_is_a(locpctx->pkey, SN_hkdf)) {
169			+ int mdnid = EVP_MD_nid(ctx->reqdigest);
170			+ if (!ossl_ctx_legacy_digest_signatures_allowed(locpctx->libctx, 0)
171			+ && (mdnid == NID_sha1 \|\| mdnid == NID_md5_sha1)) {
172			+ ERR_raise(ERR_LIB_EVP, EVP_R_INVALID_DIGEST);
173			+ goto err;
174			+ }
175			+ }
176			+
177			if (ver) {
178			if (signature->digest_verify_init == NULL) {
179			ERR_raise(ERR_LIB_EVP, EVP_R_INITIALIZATION_ERROR);
180			diff --git a/crypto/evp/pmeth_lib.c b/crypto/evp/pmeth_lib.c
181			index 2b9c6c2351..3c5a1e6f5d 100644
182			--- a/crypto/evp/pmeth_lib.c
183			+++ b/crypto/evp/pmeth_lib.c
184			@@ -33,6 +33,7 @@
185			#include "internal/ffc.h"
186			#include "internal/numbers.h"
187			#include "internal/provider.h"
188			+#include "internal/sslconf.h"
189			#include "evp_local.h"
190
191			#ifndef FIPS_MODULE
192			@@ -946,6 +947,20 @@ static int evp_pkey_ctx_set_md(EVP_PKEY_CTX ctx, const EVP_MD md,
193			return -2;
194			}
195
196			+ if (EVP_PKEY_CTX_IS_SIGNATURE_OP(ctx)
197			+ && md != NULL
198			+ && ctx->pkey != NULL
199			+ && !EVP_PKEY_is_a(ctx->pkey, SN_hmac)
200			+ && !EVP_PKEY_is_a(ctx->pkey, SN_tls1_prf)
201			+ && !EVP_PKEY_is_a(ctx->pkey, SN_hkdf)) {
202			+ int mdnid = EVP_MD_nid(md);
203			+ if ((mdnid == NID_sha1 \|\| mdnid == NID_md5_sha1)
204			+ && !ossl_ctx_legacy_digest_signatures_allowed(ctx->libctx, 0)) {
205			+ ERR_raise(ERR_LIB_EVP, EVP_R_INVALID_DIGEST);
206			+ return -1;
207			+ }
208			+ }
209			+
210			if (fallback)
211			return EVP_PKEY_CTX_ctrl(ctx, -1, op, ctrl, 0, (void *)(md));
212
213			diff --git a/doc/man5/config.pod b/doc/man5/config.pod
214			index 77a8055e81..aa1be5ca7f 100644
215			--- a/doc/man5/config.pod
216			+++ b/doc/man5/config.pod
217			@@ -304,6 +304,17 @@ Within the algorithm properties section, the following names have meaning:
218			The value may be anything that is acceptable as a property query
219			string for EVP_set_default_properties().
220
221			+=item B<rh-allow-sha1-signatures>
222			+
223			+The value is a boolean that can be B<yes> or B<no>. If the value is not set,
224			+it behaves as if it was set to B<no>.
225			+
226			+When set to B<no>, any attempt to create or verify a signature with a SHA1
227			+digest will fail. For compatibility with older versions of OpenSSL, set this
228			+option to B<yes>. This setting also affects TLS, where signature algorithms
229			+that use SHA1 as digest will no longer be supported if this option is set to
230			+B<no>.
231			+
232			=item B<fips_mode> (deprecated)
233
234			The value is a boolean that can be B<yes> or B<no>. If the value is
235			diff --git a/include/internal/cryptlib.h b/include/internal/cryptlib.h
236			index 1291299b6e..e234341e6a 100644
237			--- a/include/internal/cryptlib.h
238			+++ b/include/internal/cryptlib.h
239			@@ -168,7 +168,8 @@ typedef struct ossl_ex_data_global_st {
240			# define OSSL_LIB_CTX_PROVIDER_CONF_INDEX 16
241			# define OSSL_LIB_CTX_BIO_CORE_INDEX 17
242			# define OSSL_LIB_CTX_CHILD_PROVIDER_INDEX 18
243			-# define OSSL_LIB_CTX_MAX_INDEXES 19
244			+# define OSSL_LIB_CTX_LEGACY_DIGEST_SIGNATURES 19
245			+# define OSSL_LIB_CTX_MAX_INDEXES 20
246
247			# define OSSL_LIB_CTX_METHOD_LOW_PRIORITY -1
248			# define OSSL_LIB_CTX_METHOD_DEFAULT_PRIORITY 0
249			diff --git a/include/internal/sslconf.h b/include/internal/sslconf.h
250			index fd7f7e3331..05464b0655 100644
251			--- a/include/internal/sslconf.h
252			+++ b/include/internal/sslconf.h
253			@@ -18,4 +18,8 @@ int conf_ssl_name_find(const char name, size_t idx);
254			void conf_ssl_get_cmd(const SSL_CONF_CMD cmd, size_t idx, char *cmdstr,
255			char **arg);
256
257			+/* Methods to support disabling all signatures with legacy digests */
258			+int ossl_ctx_legacy_digest_signatures_allowed(OSSL_LIB_CTX *libctx, int loadconfig);
259			+int ossl_ctx_legacy_digest_signatures_allowed_set(OSSL_LIB_CTX *libctx, int allow,
260			+ int loadconfig);
261			#endif
262			diff --git a/providers/common/securitycheck.c b/providers/common/securitycheck.c
263			index 699ada7c52..e534ad0a5f 100644
264			--- a/providers/common/securitycheck.c
265			+++ b/providers/common/securitycheck.c
266			@@ -19,6 +19,7 @@
267			#include <openssl/core_names.h>
268			#include <openssl/obj_mac.h>
269			#include "prov/securitycheck.h"
270			+#include "internal/sslconf.h"
271
272			/*
273			* FIPS requires a minimum security strength of 112 bits (for encryption or
274			@@ -235,6 +236,15 @@ int ossl_digest_get_approved_nid_with_sha1(OSSL_LIB_CTX ctx, const EVP_MD md,
275			mdnid = -1; /* disallowed by security checks */
276			}
277			# endif /* OPENSSL_NO_FIPS_SECURITYCHECKS */
278			+
279			+#ifndef FIPS_MODULE
280			+ if (!ossl_ctx_legacy_digest_signatures_allowed(ctx, 0))
281			+ /* SHA1 is globally disabled, check whether we want to locally allow
282			+ * it. */
283			+ if (mdnid == NID_sha1 && !sha1_allowed)
284			+ mdnid = -1;
285			+#endif
286			+
287			return mdnid;
288			}
289
290			@@ -244,5 +254,15 @@ int ossl_digest_is_allowed(OSSL_LIB_CTX ctx, const EVP_MD md)
291			if (ossl_securitycheck_enabled(ctx))
292			return ossl_digest_get_approved_nid(md) != NID_undef;
293			# endif /* OPENSSL_NO_FIPS_SECURITYCHECKS */
294			+
295			+#ifndef FIPS_MODULE
296			+ {
297			+ int mdnid = EVP_MD_nid(md);
298			+ if ((mdnid == NID_sha1 \|\| mdnid == NID_md5_sha1)
299			+ && !ossl_ctx_legacy_digest_signatures_allowed(ctx, 0))
300			+ return 0;
301			+ }
302			+#endif
303			+
304			return 1;
305			}
306			diff --git a/providers/common/securitycheck_default.c b/providers/common/securitycheck_default.c
307			index de7f0d3a0a..ce54a94fbc 100644
308			--- a/providers/common/securitycheck_default.c
309			+++ b/providers/common/securitycheck_default.c
310			@@ -15,6 +15,7 @@
311			#include <openssl/obj_mac.h>
312			#include "prov/securitycheck.h"
313			#include "internal/nelem.h"
314			+#include "internal/sslconf.h"
315
316			/* Disable the security checks in the default provider */
317			int ossl_securitycheck_enabled(OSSL_LIB_CTX *libctx)
318			@@ -23,9 +24,10 @@ int ossl_securitycheck_enabled(OSSL_LIB_CTX *libctx)
319			}
320
321			int ossl_digest_rsa_sign_get_md_nid(OSSL_LIB_CTX ctx, const EVP_MD md,
322			- ossl_unused int sha1_allowed)
323			+ int sha1_allowed)
324			{
325			int mdnid;
326			+ int ldsigs_allowed;
327
328			static const OSSL_ITEM name_to_nid[] = {
329			{ NID_md5, OSSL_DIGEST_NAME_MD5 },
330			@@ -36,8 +38,11 @@ int ossl_digest_rsa_sign_get_md_nid(OSSL_LIB_CTX ctx, const EVP_MD md,
331			{ NID_ripemd160, OSSL_DIGEST_NAME_RIPEMD160 },
332			};
333
334			- mdnid = ossl_digest_get_approved_nid_with_sha1(ctx, md, 1);
335			+ ldsigs_allowed = ossl_ctx_legacy_digest_signatures_allowed(ctx, 0);
336			+ mdnid = ossl_digest_get_approved_nid_with_sha1(ctx, md, sha1_allowed \|\| ldsigs_allowed);
337			if (mdnid == NID_undef)
338			mdnid = ossl_digest_md_to_nid(md, name_to_nid, OSSL_NELEM(name_to_nid));
339			+ if (mdnid == NID_md5_sha1 && !ldsigs_allowed)
340			+ mdnid = -1;
341			return mdnid;
342			}
343			diff --git a/providers/implementations/signature/dsa_sig.c b/providers/implementations/signature/dsa_sig.c
344			index 28fd7c498e..fa3822f39f 100644
345			--- a/providers/implementations/signature/dsa_sig.c
346			+++ b/providers/implementations/signature/dsa_sig.c
347			@@ -124,12 +124,17 @@ static int dsa_setup_md(PROV_DSA_CTX *ctx,
348			mdprops = ctx->propq;
349
350			if (mdname != NULL) {
351			- int sha1_allowed = (ctx->operation != EVP_PKEY_OP_SIGN);
352			WPACKET pkt;
353			EVP_MD *md = EVP_MD_fetch(ctx->libctx, mdname, mdprops);
354			- int md_nid = ossl_digest_get_approved_nid_with_sha1(ctx->libctx, md,
355			- sha1_allowed);
356			+ int md_nid;
357			size_t mdname_len = strlen(mdname);
358			+#ifdef FIPS_MODULE
359			+ int sha1_allowed = (ctx->operation != EVP_PKEY_OP_SIGN);
360			+#else
361			+ int sha1_allowed = 0;
362			+#endif
363			+ md_nid = ossl_digest_get_approved_nid_with_sha1(ctx->libctx, md,
364			+ sha1_allowed);
365
366			if (md == NULL \|\| md_nid < 0) {
367			if (md == NULL)
368			diff --git a/providers/implementations/signature/ecdsa_sig.c b/providers/implementations/signature/ecdsa_sig.c
369			index 865d49d100..99b228e82c 100644
370			--- a/providers/implementations/signature/ecdsa_sig.c
371			+++ b/providers/implementations/signature/ecdsa_sig.c
372			@@ -237,7 +237,11 @@ static int ecdsa_setup_md(PROV_ECDSA_CTX ctx, const char mdname,
373			"%s could not be fetched", mdname);
374			return 0;
375			}
376			+#ifdef FIPS_MODULE
377			sha1_allowed = (ctx->operation != EVP_PKEY_OP_SIGN);
378			+#else
379			+ sha1_allowed = 0;
380			+#endif
381			md_nid = ossl_digest_get_approved_nid_with_sha1(ctx->libctx, md,
382			sha1_allowed);
383			if (md_nid < 0) {
384			diff --git a/providers/implementations/signature/rsa_sig.c b/providers/implementations/signature/rsa_sig.c
385			index 325e855333..bea397f0c1 100644
386			--- a/providers/implementations/signature/rsa_sig.c
387			+++ b/providers/implementations/signature/rsa_sig.c
388			@@ -26,6 +26,7 @@
389			#include "internal/cryptlib.h"
390			#include "internal/nelem.h"
391			#include "internal/sizes.h"
392			+#include "internal/sslconf.h"
393			#include "crypto/rsa.h"
394			#include "prov/providercommon.h"
395			#include "prov/implementations.h"
396			@@ -34,6 +35,7 @@
397			#include "prov/securitycheck.h"
398
399			#define RSA_DEFAULT_DIGEST_NAME OSSL_DIGEST_NAME_SHA1
400			+#define RSA_DEFAULT_DIGEST_NAME_NONLEGACY OSSL_DIGEST_NAME_SHA2_256
401
402			static OSSL_FUNC_signature_newctx_fn rsa_newctx;
403			static OSSL_FUNC_signature_sign_init_fn rsa_sign_init;
404			@@ -289,10 +291,15 @@ static int rsa_setup_md(PROV_RSA_CTX ctx, const char mdname,
405
406			if (mdname != NULL) {
407			EVP_MD *md = EVP_MD_fetch(ctx->libctx, mdname, mdprops);
408			+ int md_nid;
409			+ size_t mdname_len = strlen(mdname);
410			+#ifdef FIPS_MODULE
411			int sha1_allowed = (ctx->operation != EVP_PKEY_OP_SIGN);
412			- int md_nid = ossl_digest_rsa_sign_get_md_nid(ctx->libctx, md,
413			+#else
414			+ int sha1_allowed = 0;
415			+#endif
416			+ md_nid = ossl_digest_rsa_sign_get_md_nid(ctx->libctx, md,
417			sha1_allowed);
418			- size_t mdname_len = strlen(mdname);
419
420			if (md == NULL
421			\|\| md_nid <= 0
422			@@ -1348,8 +1355,15 @@ static int rsa_set_ctx_params(void *vprsactx, const OSSL_PARAM params[])
423			prsactx->pad_mode = pad_mode;
424
425			if (prsactx->md == NULL && pmdname == NULL
426			- && pad_mode == RSA_PKCS1_PSS_PADDING)
427			+ && pad_mode == RSA_PKCS1_PSS_PADDING) {
428			pmdname = RSA_DEFAULT_DIGEST_NAME;
429			+#ifndef FIPS_MODULE
430			+ if (!ossl_ctx_legacy_digest_signatures_allowed(prsactx->libctx, 0)) {
431			+ pmdname = RSA_DEFAULT_DIGEST_NAME_NONLEGACY;
432			+ }
433			+#endif
434			+ }
435			+
436
437			if (pmgf1mdname != NULL
438			&& !rsa_setup_mgf1_md(prsactx, pmgf1mdname, pmgf1mdprops))
439			diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c
440			index fc32bb3556..4b74ee1a34 100644
441			--- a/ssl/t1_lib.c
442			+++ b/ssl/t1_lib.c
443			@@ -20,6 +20,7 @@
444			#include <openssl/bn.h>
445			#include <openssl/provider.h>
446			#include <openssl/param_build.h>
447			+#include "internal/sslconf.h"
448			#include "internal/nelem.h"
449			#include "internal/sizes.h"
450			#include "internal/tlsgroups.h"
451			@@ -1145,11 +1146,13 @@ int ssl_setup_sig_algs(SSL_CTX *ctx)
452			= OPENSSL_malloc(sizeof(lu) OSSL_NELEM(sigalg_lookup_tbl));
453			EVP_PKEY *tmpkey = EVP_PKEY_new();
454			int ret = 0;
455			+ int ldsigs_allowed;
456
457			if (cache == NULL \|\| tmpkey == NULL)
458			goto err;
459
460			ERR_set_mark();
461			+ ldsigs_allowed = ossl_ctx_legacy_digest_signatures_allowed(ctx->libctx, 0);
462			for (i = 0, lu = sigalg_lookup_tbl;
463			i < OSSL_NELEM(sigalg_lookup_tbl); lu++, i++) {
464			EVP_PKEY_CTX *pctx;
465			@@ -1169,6 +1172,11 @@ int ssl_setup_sig_algs(SSL_CTX *ctx)
466			cache[i].enabled = 0;
467			continue;
468			}
469			+ if ((lu->hash == NID_sha1 \|\| lu->hash == NID_md5_sha1)
470			+ && !ldsigs_allowed) {
471			+ cache[i].enabled = 0;
472			+ continue;
473			+ }
474
475			if (!EVP_PKEY_set_type(tmpkey, lu->sig)) {
476			cache[i].enabled = 0;
477			diff --git a/util/libcrypto.num b/util/libcrypto.num
478			index 10b4e57d79..2d3c363bb0 100644
479			--- a/util/libcrypto.num
480			+++ b/util/libcrypto.num
481			@@ -5426,3 +5426,5 @@ ASN1_TIME_print_ex 5553 3_0_0 EXIST::FUNCTION:
482			OPENSSL_strcasecmp 5556 3_0_3 EXIST::FUNCTION:
483			OPENSSL_strncasecmp 5557 3_0_3 EXIST::FUNCTION:
484			ossl_safe_getenv ? 3_0_0 EXIST::FUNCTION:
485			+ossl_ctx_legacy_digest_signatures_allowed ? 3_0_1 EXIST::FUNCTION:
486			+ossl_ctx_legacy_digest_signatures_allowed_set ? 3_0_1 EXIST::FUNCTION:
487			--
488			2.35.1
489