diff --git a/SOURCES/gnutls-3.8.10-fips-pct-hash-sign.patch b/SOURCES/gnutls-3.8.10-fips-pct-hash-sign.patch new file mode 100644 index 0000000..900f591 --- /dev/null +++ b/SOURCES/gnutls-3.8.10-fips-pct-hash-sign.patch @@ -0,0 +1,172 @@ +From 3272be27967c42c96b9f9eeab5b0fe886269fb5b Mon Sep 17 00:00:00 2001 +From: Angel Yankov +Date: Fri, 8 Nov 2024 17:07:27 +0200 +Subject: [PATCH] Use full hash+sign operations in pct_test + +pct_test inside fips uses low-level, separate primitves +for some hasing and signing. Replace them with high-level, +more specific APIs. + +Signed-off-by: Angel Yankov +Modified-by: Daiki Ueno +--- + lib/nettle/pk.c | 136 +++++++++++++++++++++++++++++++++++++++++++++++- + 1 file changed, 135 insertions(+), 1 deletion(-) + +diff --git a/lib/nettle/pk.c b/lib/nettle/pk.c +index 5986a410c2..c665ded6e6 100644 +--- a/lib/nettle/pk.c ++++ b/lib/nettle/pk.c +@@ -3195,6 +3195,128 @@ cleanup: + return ret; + } + ++static gnutls_sign_algorithm_t pct_pk_to_sign(gnutls_pk_algorithm_t algo, ++ const gnutls_x509_spki_st *spki) ++{ ++ switch (algo) { ++ case GNUTLS_PK_RSA: ++ return gnutls_pk_to_sign(algo, GNUTLS_DIG_SHA256); ++ case GNUTLS_PK_RSA_PSS: ++ return gnutls_pk_to_sign(algo, spki->rsa_pss_dig); ++#ifdef ENABLE_DSA ++ case GNUTLS_PK_DSA: ++#endif ++ case GNUTLS_PK_ECDSA: ++ return gnutls_pk_to_sign(algo, spki->dsa_dig); ++ case GNUTLS_PK_EDDSA_ED25519: ++ return GNUTLS_SIGN_EDDSA_ED25519; ++ case GNUTLS_PK_EDDSA_ED448: ++ return GNUTLS_SIGN_EDDSA_ED448; ++#if ENABLE_GOST ++ case GNUTLS_PK_GOST_01: ++ return GNUTLS_SIGN_GOST_94; ++ case GNUTLS_PK_GOST_12_256: ++ return GNUTLS_SIGN_GOST_256; ++ case GNUTLS_PK_GOST_12_512: ++ return GNUTLS_SIGN_GOST_512; ++#endif ++ case GNUTLS_PK_MLDSA44: ++ return GNUTLS_SIGN_MLDSA44; ++ case GNUTLS_PK_MLDSA65: ++ return GNUTLS_SIGN_MLDSA65; ++ case GNUTLS_PK_MLDSA87: ++ return GNUTLS_SIGN_MLDSA87; ++ default: ++ return GNUTLS_SIGN_UNKNOWN; ++ } ++} ++ ++static int pct_hash_sign_test(gnutls_pk_algorithm_t algo, ++ const gnutls_pk_params_st *params, ++ const gnutls_x509_spki_st *spki, ++ const gnutls_datum_t *data) ++{ ++ gnutls_privkey_t privkey = NULL; ++ gnutls_pubkey_t pubkey = NULL; ++ gnutls_x509_privkey_t xprivkey = NULL; ++ gnutls_datum_t sig = { NULL, 0 }; ++ gnutls_sign_algorithm_t sign_algo; ++ int ret; ++ ++ sign_algo = pct_pk_to_sign(algo, spki); ++ if (sign_algo == GNUTLS_SIGN_UNKNOWN) ++ return gnutls_assert_val(GNUTLS_E_PK_GENERATION_ERROR); ++ ++ ret = gnutls_x509_privkey_init(&xprivkey); ++ if (ret < 0) { ++ gnutls_assert(); ++ goto cleanup; ++ } ++ ++ ret = _gnutls_pk_params_copy(&xprivkey->params, params); ++ if (ret < 0) { ++ gnutls_assert(); ++ goto cleanup; ++ } ++ ++ ret = gnutls_privkey_init(&privkey); ++ if (ret < 0) { ++ gnutls_assert(); ++ goto cleanup; ++ } ++ ++ ret = gnutls_privkey_import_x509(privkey, xprivkey, ++ GNUTLS_PRIVKEY_IMPORT_AUTO_RELEASE); ++ if (ret < 0) { ++ gnutls_assert(); ++ goto cleanup; ++ } ++ xprivkey = NULL; ++ ++ ret = gnutls_pubkey_init(&pubkey); ++ if (ret < 0) { ++ gnutls_assert(); ++ goto cleanup; ++ } ++ ++ ret = gnutls_pubkey_import_privkey(pubkey, privkey, 0, 0); ++ if (ret < 0) { ++ gnutls_assert(); ++ goto cleanup; ++ } ++ ++ ret = gnutls_privkey_sign_data2(privkey, sign_algo, 0, data, &sig); ++ if (ret < 0) { ++ gnutls_assert(); ++ goto cleanup; ++ } ++ ++ /* Ignore algorithm disablement through configuration during PCT. */ ++ ret = gnutls_pubkey_verify_data2( ++ pubkey, sign_algo, GNUTLS_VERIFY_ALLOW_BROKEN, data, &sig); ++ if (ret < 0) { ++ gnutls_assert(); ++ goto cleanup; ++ } ++ ++cleanup: ++ if (ret < 0) { ++ _gnutls_debug_log("PCT: %s hash+sign self-test failed: %s\n", ++ gnutls_sign_get_name(sign_algo), ++ gnutls_strerror(ret)); ++ } else { ++ _gnutls_debug_log("PCT: %s hash+sign self-test succeeded\n", ++ gnutls_sign_get_name(sign_algo)); ++ } ++ ++ gnutls_x509_privkey_deinit(xprivkey); ++ gnutls_privkey_deinit(privkey); ++ gnutls_pubkey_deinit(pubkey); ++ _gnutls_free_datum(&sig); ++ ++ return ret; ++} ++ + static int pct_test(gnutls_pk_algorithm_t algo, + const gnutls_pk_params_st *params) + { +@@ -3341,7 +3463,19 @@ static int pct_test(gnutls_pk_algorithm_t algo, + ret = _gnutls_pk_verify(algo, &ddata, &sig, params, &spki); + if (ret < 0) { + ret = gnutls_assert_val(GNUTLS_E_PK_GENERATION_ERROR); +- gnutls_assert(); ++ goto cleanup; ++ } ++ ++ /* Exercise the combined hash+sign operation, using ++ * the abstract key interface. ++ * ++ * FIXME: rework this once the crypto-backend ++ * interface natively supports hash+sign operation, see: ++ * https://gitlab.com/gnutls/gnutls/-/merge_requests/2066 ++ */ ++ ret = pct_hash_sign_test(algo, params, &spki, &ddata); ++ if (ret < 0) { ++ ret = gnutls_assert_val(GNUTLS_E_PK_GENERATION_ERROR); + goto cleanup; + } + break; +-- +2.54.0 + diff --git a/SOURCES/gnutls-3.8.10-rhel9-revert-rsa-less-than-2048.patch b/SOURCES/gnutls-3.8.10-rhel9-revert-rsa-less-than-2048.patch deleted file mode 100644 index 1b53dc6..0000000 --- a/SOURCES/gnutls-3.8.10-rhel9-revert-rsa-less-than-2048.patch +++ /dev/null @@ -1,75 +0,0 @@ -commit bf374b4151c7f6cf4b94e9eb911ceb730904a44c -Author: Alexander Sosedkin -Date: Wed Nov 19 10:48:51 2025 +0100 - - Revert "fips: Allow SigVer only with RSA keys with modulus >= 2048 bits" - - This reverts commit da1df0a3167ec96605fed267d97f9081cf498eec. - -diff --git a/lib/nettle/pk.c b/lib/nettle/pk.c -index 5986a410c2..d14efbaaf0 100644 ---- a/lib/nettle/pk.c -+++ b/lib/nettle/pk.c -@@ -2474,12 +2474,16 @@ static int _wrap_nettle_pk_verify(gnutls_pk_algorithm_t algo, - - bits = mpz_sizeinbase(pub.n, 2); - -- /* In FIPS 140-3, RSA key size should be larger than 2048-bit. -+ /* In FIPS 140-3, RSA key size should be larger than -+ * 2048-bit or one of the known lengths (1024, 1280, -+ * 1536, 1792; i.e., multiple of 256-bits). -+ * - * In addition to this, only SHA-2 is allowed - * for SigVer; it is checked in _pkcs1_rsa_verify_sig in - * lib/pubkey.c. - */ -- if (unlikely(bits < 2048)) { -+ if (unlikely(bits < 2048 && bits != 1024 && bits != 1280 && -+ bits != 1536 && bits != 1792)) { - not_approved = true; - } - -diff --git a/tests/fips-rsa-sizes.c b/tests/fips-rsa-sizes.c -index 61a76d3c09..d134a35f8c 100644 ---- a/tests/fips-rsa-sizes.c -+++ b/tests/fips-rsa-sizes.c -@@ -250,24 +250,35 @@ void doit(void) - - assert(gnutls_fips140_context_init(&fips_context) == 0); - -+ /* 512-bit RSA: no generate, no sign, no verify */ - generate_unsuccessfully(&privkey, &pubkey, 512); - sign_verify_unsuccessfully(privkey, pubkey); -+ /* 512-bit RSA again (to be safer about going in and out of FIPS) */ - generate_unsuccessfully(&privkey, &pubkey, 512); - sign_verify_unsuccessfully(privkey, pubkey); -+ /* 600-bit RSA: no generate, no sign, no verify */ - generate_unsuccessfully(&privkey, &pubkey, 600); - sign_verify_unsuccessfully(privkey, pubkey); -+ -+ /* 768-bit RSA not-an-exception: nogenerate, nosign, verify */ - generate_unsuccessfully(&privkey, &pubkey, 768); - sign_verify_unsuccessfully(privkey, pubkey); -+ /* 1024-bit RSA exception: nogenerate, nosign, verify */ - generate_unsuccessfully(&privkey, &pubkey, 1024); -- sign_verify_unsuccessfully(privkey, pubkey); -+ nosign_verify(privkey, pubkey); -+ /* 1280-bit RSA exception: nogenerate, nosign, verify */ - generate_unsuccessfully(&privkey, &pubkey, 1280); -- sign_verify_unsuccessfully(privkey, pubkey); -+ nosign_verify(privkey, pubkey); -+ /* 1500-bit RSA not-an-exception: nogenerate, nosign, noverify */ - generate_unsuccessfully(&privkey, &pubkey, 1500); - sign_verify_unsuccessfully(privkey, pubkey); -+ /* 1536-bit RSA exception: nogenerate, nosign, verify */ - generate_unsuccessfully(&privkey, &pubkey, 1536); -- sign_verify_unsuccessfully(privkey, pubkey); -+ nosign_verify(privkey, pubkey); -+ /* 1792-bit RSA exception: nogenerate, nosign, verify */ - generate_unsuccessfully(&privkey, &pubkey, 1792); -- sign_verify_unsuccessfully(privkey, pubkey); -+ nosign_verify(privkey, pubkey); -+ /* 2000-bit RSA not-an-exception: nogenerate, nosign, noverify */ - generate_unsuccessfully(&privkey, &pubkey, 2000); - sign_verify_unsuccessfully(privkey, pubkey); - diff --git a/SPECS/gnutls.spec b/SPECS/gnutls.spec index 6e20745..a6a16cf 100644 --- a/SPECS/gnutls.spec +++ b/SPECS/gnutls.spec @@ -13,7 +13,7 @@ print(string.sub(hash, 0, 16)) } Version: 3.8.10 -Release: 4%{?dist} +Release: 8%{?dist} # not upstreamed Patch: gnutls-3.2.7-rpath.patch Patch: gnutls-3.7.2-enable-intel-cet.patch @@ -32,8 +32,6 @@ Patch: gnutls-3.8.10-tests-ktls.patch # reverts # * e52c7ca885 pkcs12: enable PBMAC1 by default in FIPS mode Patch: gnutls-3.8.10-rhel9-revert-pbmac1-fips-default.patch -# * da1df0a31 fips: Allow SigVer only with RSA keys with modulus >= 2048 bits -Patch: gnutls-3.8.10-rhel9-revert-rsa-less-than-2048.patch # CVE fixes backported from 3.8.12 release # upstreamed: https://gitlab.com/gnutls/gnutls/-/merge_requests/2041 @@ -69,6 +67,8 @@ Patch: gnutls-3.8.10-1841-hybrid-kx-zeroize.patch Patch: gnutls-3.8.10-1823-cfg-clear-options.patch Patch: gnutls-3.8.10-1817-security-parameters.patch Patch: gnutls-3.8.10-1820-p11p-kdf.patch +# https://gitlab.com/gnutls/gnutls/-/merge_requests/2100 +Patch: gnutls-3.8.10-fips-pct-hash-sign.patch %bcond_without bootstrap %bcond_without dane @@ -514,6 +514,18 @@ make check %{?_smp_mflags} GNUTLS_SYSTEM_PRIORITY_FILE=/dev/null XFAIL_TESTS="$x %endif %changelog +* Wed Jul 08 2026 Alexander Sosedkin - 3.8.10-8 +- Rebuild to target RHEL-9.8 + +* Thu Jul 02 2026 Alexander Sosedkin - 3.8.10-7 +- fips: Allow SigVer only with RSA keys with modulus >= 2048 bits + +* Fri Jun 12 2026 Daiki Ueno - 3.8.10-6 +- Fix order of previous changelog entries (RHEL-172270) + +* Tue Jun 9 2026 Daiki Ueno - 3.8.10-5 +- Use full hash+sign operations in pct_test (RHEL-172270) + * Thu Apr 30 2026 Alexander Sosedkin - 3.8.10-4 - Fix CVE-2026-33846 (DTLS fragment reassembly, High, heap overwrite) - Fix CVE-2026-42009 (DTLS fragment reassembly, High, undefined behaviour)