rpms/cups
7
0
Fork 0
Code Issues Pull Requests Releases Activity

RHEL-68415 Inability to disable weak ciphers in CUPS configuration

Browse Source 
Resolves: RHEL-68415
This commit is contained in:
Zdenek Dohnal 2024-12-06 08:10:56 +01:00
parent 14a4ae58dc
commit 8cc4676c65
2 changed files with 39 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
0001-tls-gnutls.c-Use-system-crypto-policy-if-available.patch Normal file
View File

@ -0,0 +1,31 @@
From 331a202a87db30b5d1d5386ccc99de6843eef03e Mon Sep 17 00:00:00 2001
From: Zdenek Dohnal <zdohnal@redhat.com>
Date: Fri, 6 Dec 2024 07:59:16 +0100
Subject: [PATCH] tls-gnutls.c: Use system crypto policy if available
Some Linux systems provide a way how to control cryptography on system or service level via cryptographic policies. OpenSSL implementation reflects system changes to some degree, however GnuTLS implementation does not take system policy into account.
GnuTLS supports fallback mechanism, so we can fallback to NORMAL if @System is not defined on the system.
Fortunately, the current GnuTLS implementation allows overrides via priority strings (so no "this cipher/hash is disabled" if we enabled them in our application by priority string), so allowing to honor system policy can save us work if someone wants to disable a specific cipher, so we don't have to implement it in libcups.
---
CHANGES.md | 2 ++
cups/tls-gnutls.c | 2 +-
2 files changed, 3 insertions(+), 1 deletion(-)
diff --git a/cups/tls-gnutls.c b/cups/tls-gnutls.c
index f3f71a055..719161da7 100644
--- a/cups/tls-gnutls.c
+++ b/cups/tls-gnutls.c
@@ -1504,7 +1504,7 @@ _httpTLSStart(http_t *http) /* I - Connection to server */
return (-1);
}
- strlcpy(priority_string, "NORMAL", sizeof(priority_string));
+ strlcpy(priority_string, "@SYSTEM,NORMAL", sizeof(priority_string));
if (tls_max_version < _HTTP_TLS_MAX)
{
--
2.47.1

9
cups.spec
View File

@ -22,7 +22,7 @@ Summary: CUPS printing system
Name: cups
Epoch: 1
Version: 2.4.10
Release: 9%{?dist}
Release: 10%{?dist}
# backend/failover.c - BSD-3-Clause
# cups/md5* - Zlib
# scheduler/colorman.c - Apache-2.0 WITH LLVM-exception AND BSD-2-Clause
@ -100,6 +100,8 @@ Patch1009: 0001-fix-warnings-for-unused-vars.patch
Patch1010: 0001-Fix-make-and-model-whitespace-trimming-Issue-1096.patch
# RHEL-69638 IPP Everywhere permanent queue is not removed if PPD generation fails
Patch1011: 0001-scheduler-Clean-up-failed-IPP-Everywhere-permanent-q.patch
# RHEL-68415 Inability to disable weak ciphers in CUPS configuration
Patch1012: 0001-tls-gnutls.c-Use-system-crypto-policy-if-available.patch
##### Patches removed because IMHO they aren't no longer needed
@ -353,6 +355,8 @@ to CUPS daemon. This solution will substitute printer drivers and raw queues in
%patch -P 1010 -p1 -b .trim-make-model
# RHEL-69638 IPP Everywhere permanent queue is not removed if PPD generation fails
%patch -P 1011 -p1 -b .clean-failed-eve
# RHEL-68415 Inability to disable weak ciphers in CUPS configuration
%patch -P 1012 -p1 -b .tls-system-policy
# Log to the system journal by default (bug #1078781, bug #1519331).
@ -822,6 +826,9 @@ rm -f %{cups_serverbin}/backend/smb
%{_mandir}/man7/ippeveps.7.gz
%changelog
* Fri Dec 06 2024 Zdenek Dohnal <zdohnal@redhat.com> - 1:2.4.10-10
- RHEL-68415 Inability to disable weak ciphers in CUPS configuration
* Mon Dec 02 2024 Zdenek Dohnal <zdohnal@redhat.com> - 1:2.4.10-9
- RHEL-69638 IPP Everywhere permanent queue is not removed if PPD generation fails