Complete explicit disabling of RSAMD5 in FIPS mode (#1709553)
Previous fix included just part inside named. However, checking part would check algorithm support also in check library. The code is almost the same. Permit already disabled algoritms also in libbind9. Use the same change as RHEL.
This commit is contained in:
Petr Menšík
parent
adcfd20cb2
commit
6f27f8e4a7
|
|
@ -1,4 +1,4 @@
|
|||
From df23c869f8973bc9494dcdc86ef46070d8194897 Mon Sep 17 00:00:00 2001
|
||||
From 83b889c238282b210f874a3ad81bb56299767495 Mon Sep 17 00:00:00 2001
|
||||
From: Petr Mensik <pemensik@redhat.com>
|
||||
Date: Mon, 5 Aug 2019 11:54:03 +0200
|
||||
Subject: [PATCH] Allow explicit disabling of autodisabled MD5
|
||||
|
|
@ -9,15 +9,22 @@ RSAMD5 is included in security policy, it fails to start, because that
|
|||
algorithm is not recognized. Allow it disabled, but fail on any
|
||||
other usage.
|
||||
---
|
||||
bin/named/server.c | 2 +-
|
||||
lib/dns/rcode.c | 31 +++++++++++++------------------
|
||||
2 files changed, 14 insertions(+), 19 deletions(-)
|
||||
bin/named/server.c | 4 ++--
|
||||
lib/bind9/check.c | 4 ++++
|
||||
lib/dns/rcode.c | 33 +++++++++++++++------------------
|
||||
3 files changed, 21 insertions(+), 20 deletions(-)
|
||||
|
||||
diff --git a/bin/named/server.c b/bin/named/server.c
|
||||
index 3cd49a9..ef82d89 100644
|
||||
index 5b57371..51702ab 100644
|
||||
--- a/bin/named/server.c
|
||||
+++ b/bin/named/server.c
|
||||
@@ -1551,7 +1551,7 @@ disable_algorithms(const cfg_obj_t *disabled, dns_resolver_t *resolver) {
|
||||
@@ -1547,12 +1547,12 @@ disable_algorithms(const cfg_obj_t *disabled, dns_resolver_t *resolver) {
|
||||
r.length = strlen(r.base);
|
||||
|
||||
result = dns_secalg_fromtext(&alg, &r);
|
||||
- if (result != ISC_R_SUCCESS) {
|
||||
+ if (result != ISC_R_SUCCESS && result != ISC_R_DISABLED) {
|
||||
uint8_t ui;
|
||||
result = isc_parse_uint8(&ui, r.base, 10);
|
||||
alg = ui;
|
||||
}
|
||||
|
|
@ -26,8 +33,23 @@ index 3cd49a9..ef82d89 100644
|
|||
cfg_obj_log(cfg_listelt_value(element),
|
||||
ns_g_lctx, ISC_LOG_ERROR,
|
||||
"invalid algorithm");
|
||||
diff --git a/lib/bind9/check.c b/lib/bind9/check.c
|
||||
index e0803d4..8023784 100644
|
||||
--- a/lib/bind9/check.c
|
||||
+++ b/lib/bind9/check.c
|
||||
@@ -302,6 +302,10 @@ disabled_algorithms(const cfg_obj_t *disabled, isc_log_t *logctx) {
|
||||
r.length = strlen(r.base);
|
||||
|
||||
tresult = dns_secalg_fromtext(&alg, &r);
|
||||
+ if (tresult == ISC_R_DISABLED) {
|
||||
+ // Recognize disabled algorithms, disable it explicitly
|
||||
+ tresult = ISC_R_SUCCESS;
|
||||
+ }
|
||||
if (tresult != ISC_R_SUCCESS) {
|
||||
cfg_obj_log(cfg_listelt_value(element), logctx,
|
||||
ISC_LOG_ERROR, "invalid algorithm '%s'",
|
||||
diff --git a/lib/dns/rcode.c b/lib/dns/rcode.c
|
||||
index f51d548..8dbb12d 100644
|
||||
index f51d548..c49b8d1 100644
|
||||
--- a/lib/dns/rcode.c
|
||||
+++ b/lib/dns/rcode.c
|
||||
@@ -126,7 +126,6 @@
|
||||
|
|
@ -46,7 +68,7 @@ index f51d548..8dbb12d 100644
|
|||
static struct tbl secprotos[] = { SECPROTONAMES };
|
||||
static struct tbl hashalgs[] = { HASHALGNAMES };
|
||||
static struct tbl dsdigests[] = { DSDIGESTNAMES };
|
||||
@@ -358,33 +358,28 @@ dns_cert_totext(dns_cert_t cert, isc_buffer_t *target) {
|
||||
@@ -358,33 +358,30 @@ dns_cert_totext(dns_cert_t cert, isc_buffer_t *target) {
|
||||
return (dns_mnemonic_totext(cert, target, certs));
|
||||
}
|
||||
|
||||
|
|
@ -72,14 +94,16 @@ index f51d548..8dbb12d 100644
|
|||
- RETERR(dns_mnemonic_fromtext(&value, source,
|
||||
- secalgs_tbl_start(), 0xff));
|
||||
+ result = dns_mnemonic_fromtext(&value, source,
|
||||
+ secalgs, 0xff);
|
||||
+ secalgs, 0xff);
|
||||
+ if (result != ISC_R_SUCCESS) {
|
||||
+ result = dns_mnemonic_fromtext(&value, source,
|
||||
+ md5_secalgs, 0xff);
|
||||
+ md5_secalgs, 0xff);
|
||||
+ if (result != ISC_R_SUCCESS) {
|
||||
+ return (result);
|
||||
+ } else if (!isc_md5_available())
|
||||
+ } else if (!isc_md5_available()) {
|
||||
+ *secalgp = value;
|
||||
+ return (ISC_R_DISABLED);
|
||||
+ }
|
||||
+ }
|
||||
*secalgp = value;
|
||||
return (ISC_R_SUCCESS);
|
||||
|
|
|
|||
|
|
@ -62,7 +62,7 @@ Summary: The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
|
|||
Name: bind
|
||||
License: MPLv2.0
|
||||
Version: 9.11.13
|
||||
Release: 1%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
|
||||
Release: 2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
|
||||
Epoch: 32
|
||||
Url: https://www.isc.org/downloads/bind/
|
||||
#
|
||||
|
|
@ -1571,6 +1571,9 @@ fi;
|
|||
|
||||
|
||||
%changelog
|
||||
* Tue Nov 26 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.13-2
|
||||
- Complete explicit disabling of RSAMD5 in FIPS mode (#1709553)
|
||||
|
||||
* Tue Nov 19 2019 Petr Menšík <pemensik@redhat.com> - 32:9.11.13-1
|
||||
- Update to 9.11.13
|
||||
|
||||
|
|
|
|||
Loading…
Reference in New Issue