import UBI gnutls-3.7.6-23.el9_3.3
This commit is contained in:
eabdullin
parent
80cc707582
commit
ebc33bd8f3
183
SOURCES/gnutls-3.7.6-ca-xsigned.patch
Normal file
183
SOURCES/gnutls-3.7.6-ca-xsigned.patch
Normal file
@ -0,0 +1,183 @@
|
|||||||
|
From 2e5f198d9440e508be13cdbad6e3f3ab47898037 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Daiki Ueno <ueno@gnu.org>
|
||||||
|
Date: Thu, 11 Jan 2024 15:45:11 +0900
|
||||||
|
Subject: [PATCH] x509: detect loop in certificate chain
|
||||||
|
MIME-Version: 1.0
|
||||||
|
Content-Type: text/plain; charset=UTF-8
|
||||||
|
Content-Transfer-Encoding: 8bit
|
||||||
|
|
||||||
|
There can be a loop in a certificate chain, when multiple CA
|
||||||
|
certificates are cross-signed with each other, such as A → B, B → C,
|
||||||
|
and C → A. Previously, the verification logic was not capable of
|
||||||
|
handling this scenario while sorting the certificates in the chain in
|
||||||
|
_gnutls_sort_clist, resulting in an assertion failure. This patch
|
||||||
|
properly detects such loop and aborts further processing in a graceful
|
||||||
|
manner.
|
||||||
|
|
||||||
|
Signed-off-by: Daiki Ueno <ueno@gnu.org>
|
||||||
|
---
|
||||||
|
lib/x509/common.c | 4 ++
|
||||||
|
tests/test-chains.h | 125 ++++++++++++++++++++++++++++++++++++++++++++
|
||||||
|
2 files changed, 129 insertions(+)
|
||||||
|
|
||||||
|
diff --git a/lib/x509/common.c b/lib/x509/common.c
|
||||||
|
index ca0b71cb69..1a022f91af 100644
|
||||||
|
--- a/lib/x509/common.c
|
||||||
|
+++ b/lib/x509/common.c
|
||||||
|
@@ -1796,6 +1796,10 @@ unsigned int _gnutls_sort_clist(gnutls_x509_crt_t *clist,
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
|
||||||
|
+ if (insorted[prev]) { /* loop detected */
|
||||||
|
+ break;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
sorted[i] = clist[prev];
|
||||||
|
insorted[prev] = 1;
|
||||||
|
}
|
||||||
|
diff --git a/tests/test-chains.h b/tests/test-chains.h
|
||||||
|
index dd7ccf0e40..09a5461ebf 100644
|
||||||
|
--- a/tests/test-chains.h
|
||||||
|
+++ b/tests/test-chains.h
|
||||||
|
@@ -4263,6 +4263,129 @@ static const char *rsa_sha1_not_in_trusted_ca[] = {
|
||||||
|
NULL
|
||||||
|
};
|
||||||
|
|
||||||
|
+static const char *cross_signed[] = {
|
||||||
|
+ /* server (signed by A1) */
|
||||||
|
+ "-----BEGIN CERTIFICATE-----\n"
|
||||||
|
+ "MIIBqDCCAVqgAwIBAgIUejlil+8DBffazcnMNwyOOP6yCCowBQYDK2VwMBoxGDAW\n"
|
||||||
|
+ "BgNVBAMTD0ludGVybWVkaWF0ZSBBMTAgFw0yNDAxMTEwNjI3MjJaGA85OTk5MTIz\n"
|
||||||
|
+ "MTIzNTk1OVowNzEbMBkGA1UEChMSR251VExTIHRlc3Qgc2VydmVyMRgwFgYDVQQD\n"
|
||||||
|
+ "Ew90ZXN0LmdudXRscy5vcmcwKjAFBgMrZXADIQA1ZVS0PcNeTPQMZ+FuVz82AHrj\n"
|
||||||
|
+ "qL5hWEpCDgpG4M4fxaOBkjCBjzAMBgNVHRMBAf8EAjAAMBoGA1UdEQQTMBGCD3Rl\n"
|
||||||
|
+ "c3QuZ251dGxzLm9yZzATBgNVHSUEDDAKBggrBgEFBQcDATAOBgNVHQ8BAf8EBAMC\n"
|
||||||
|
+ "B4AwHQYDVR0OBBYEFGtEUv+JSt+zPoO3lu0IiObZVoiNMB8GA1UdIwQYMBaAFPnY\n"
|
||||||
|
+ "v6Pw0IvKSqIlb6ewHyEAmTA3MAUGAytlcANBAAS2lyc87kH/aOvNKzPjqDwUYxPA\n"
|
||||||
|
+ "CfYjyaKea2d0DZLBM5+Bjnj/4aWwTKgVTJzWhLJcLtaSdVHrXqjr9NhEhQ0=\n"
|
||||||
|
+ "-----END CERTIFICATE-----\n",
|
||||||
|
+ /* A1 (signed by A) */
|
||||||
|
+ "-----BEGIN CERTIFICATE-----\n"
|
||||||
|
+ "MIIBUjCCAQSgAwIBAgIUe/R+NVp04e74ySw2qgI6KZgFR20wBQYDK2VwMBExDzAN\n"
|
||||||
|
+ "BgNVBAMTBlJvb3QgQTAgFw0yNDAxMTEwNjI1MDFaGA85OTk5MTIzMTIzNTk1OVow\n"
|
||||||
|
+ "GjEYMBYGA1UEAxMPSW50ZXJtZWRpYXRlIEExMCowBQYDK2VwAyEAlkTNqwz973sy\n"
|
||||||
|
+ "u3whMjSiUMs77CZu5YA7Gi5KcakExrKjYzBhMA8GA1UdEwEB/wQFMAMBAf8wDgYD\n"
|
||||||
|
+ "VR0PAQH/BAQDAgIEMB0GA1UdDgQWBBT52L+j8NCLykqiJW+nsB8hAJkwNzAfBgNV\n"
|
||||||
|
+ "HSMEGDAWgBRbYgOkRGsd3Z74+CauX4htzLg0lzAFBgMrZXADQQBM0NBaFVPd3cTJ\n"
|
||||||
|
+ "DSaZNT34fsHuJk4eagpn8mBxKQpghq4s8Ap+nYtp2KiXjcizss53PeLXVnkfyLi0\n"
|
||||||
|
+ "TLVBHvUJ\n"
|
||||||
|
+ "-----END CERTIFICATE-----\n",
|
||||||
|
+ /* A (signed by B) */
|
||||||
|
+ "-----BEGIN CERTIFICATE-----\n"
|
||||||
|
+ "MIIBSDCB+6ADAgECAhQtdJpg+qlPcLoRW8iiztJUD4xNvDAFBgMrZXAwETEPMA0G\n"
|
||||||
|
+ "A1UEAxMGUm9vdCBCMCAXDTI0MDExMTA2MTk1OVoYDzk5OTkxMjMxMjM1OTU5WjAR\n"
|
||||||
|
+ "MQ8wDQYDVQQDEwZSb290IEEwKjAFBgMrZXADIQA0vDYyg3tgotSETL1Wq2hBs32p\n"
|
||||||
|
+ "WbnINkmOSNmOiZlGHKNjMGEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMC\n"
|
||||||
|
+ "AgQwHQYDVR0OBBYEFFtiA6REax3dnvj4Jq5fiG3MuDSXMB8GA1UdIwQYMBaAFJFA\n"
|
||||||
|
+ "s2rg6j8w9AKItRnOOOjG2FG6MAUGAytlcANBAPv674p9ek5GjRcRfVQhgN+kQlHU\n"
|
||||||
|
+ "u774wL3Vx3fWA1E7+WchdMzcHrPoa5OKtKmxjIKUTO4SeDZL/AVpvulrWwk=\n"
|
||||||
|
+ "-----END CERTIFICATE-----\n",
|
||||||
|
+ /* A (signed by C) */
|
||||||
|
+ "-----BEGIN CERTIFICATE-----\n"
|
||||||
|
+ "MIIBSDCB+6ADAgECAhReNpCiVn7eFDUox3mvM5qE942AVzAFBgMrZXAwETEPMA0G\n"
|
||||||
|
+ "A1UEAxMGUm9vdCBDMCAXDTI0MDExMTA2MjEyMVoYDzk5OTkxMjMxMjM1OTU5WjAR\n"
|
||||||
|
+ "MQ8wDQYDVQQDEwZSb290IEIwKjAFBgMrZXADIQAYX92hS97OGKbMzwrD7ReVifwM\n"
|
||||||
|
+ "3iz5tnfQHWQSkvvYMKNjMGEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMC\n"
|
||||||
|
+ "AgQwHQYDVR0OBBYEFJFAs2rg6j8w9AKItRnOOOjG2FG6MB8GA1UdIwQYMBaAFEh/\n"
|
||||||
|
+ "XKjIuMeEavX5QVoy39Q+GhnwMAUGAytlcANBAIwghH3gelXty8qtoTGIEJb0+EBv\n"
|
||||||
|
+ "BH4YOUh7TamxjxkjvvIhDA7ZdheofFb7NrklJco7KBcTATUSOvxakYRP9Q8=\n"
|
||||||
|
+ "-----END CERTIFICATE-----\n",
|
||||||
|
+ /* B1 (signed by B) */
|
||||||
|
+ "-----BEGIN CERTIFICATE-----\n"
|
||||||
|
+ "MIIBUjCCAQSgAwIBAgIUfpmrVDc1XBA5/7QYMyGBuB9mTtUwBQYDK2VwMBExDzAN\n"
|
||||||
|
+ "BgNVBAMTBlJvb3QgQjAgFw0yNDAxMTEwNjI1MjdaGA85OTk5MTIzMTIzNTk1OVow\n"
|
||||||
|
+ "GjEYMBYGA1UEAxMPSW50ZXJtZWRpYXRlIEIxMCowBQYDK2VwAyEAh6ZTuJWsweVB\n"
|
||||||
|
+ "a5fsye5iq89kWDC2Y/Hlc0htLmjzMP+jYzBhMA8GA1UdEwEB/wQFMAMBAf8wDgYD\n"
|
||||||
|
+ "VR0PAQH/BAQDAgIEMB0GA1UdDgQWBBTMQu37PKyLjKfPODZgxYCaayff+jAfBgNV\n"
|
||||||
|
+ "HSMEGDAWgBSRQLNq4Oo/MPQCiLUZzjjoxthRujAFBgMrZXADQQBblmguY+lnYvOK\n"
|
||||||
|
+ "rAZJnqpEUGfm1tIFyu3rnlE7WOVcXRXMIoNApLH2iHIipQjlvNWuSBFBTC1qdewh\n"
|
||||||
|
+ "/e+0cgQB\n"
|
||||||
|
+ "-----END CERTIFICATE-----\n",
|
||||||
|
+ /* B (signed by A) */
|
||||||
|
+ "-----BEGIN CERTIFICATE-----\n"
|
||||||
|
+ "MIIBSDCB+6ADAgECAhRpEm+dWNX6DMZh/nottkFfFFrXXDAFBgMrZXAwETEPMA0G\n"
|
||||||
|
+ "A1UEAxMGUm9vdCBBMCAXDTI0MDExMTA2MTcyNloYDzk5OTkxMjMxMjM1OTU5WjAR\n"
|
||||||
|
+ "MQ8wDQYDVQQDEwZSb290IEIwKjAFBgMrZXADIQAYX92hS97OGKbMzwrD7ReVifwM\n"
|
||||||
|
+ "3iz5tnfQHWQSkvvYMKNjMGEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMC\n"
|
||||||
|
+ "AgQwHQYDVR0OBBYEFJFAs2rg6j8w9AKItRnOOOjG2FG6MB8GA1UdIwQYMBaAFFti\n"
|
||||||
|
+ "A6REax3dnvj4Jq5fiG3MuDSXMAUGAytlcANBAFvmcK3Ida5ViVYDzxKVLPcPsCHe\n"
|
||||||
|
+ "3hxz99lBrerJC9iJSvRYTJoPBvjTxDYnBn5EFrQYMrUED+6i71lmGXNU9gs=\n"
|
||||||
|
+ "-----END CERTIFICATE-----\n",
|
||||||
|
+ /* B (signed by C) */
|
||||||
|
+ "-----BEGIN CERTIFICATE-----\n"
|
||||||
|
+ "MIIBSDCB+6ADAgECAhReNpCiVn7eFDUox3mvM5qE942AVzAFBgMrZXAwETEPMA0G\n"
|
||||||
|
+ "A1UEAxMGUm9vdCBDMCAXDTI0MDExMTA2MjEyMVoYDzk5OTkxMjMxMjM1OTU5WjAR\n"
|
||||||
|
+ "MQ8wDQYDVQQDEwZSb290IEIwKjAFBgMrZXADIQAYX92hS97OGKbMzwrD7ReVifwM\n"
|
||||||
|
+ "3iz5tnfQHWQSkvvYMKNjMGEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMC\n"
|
||||||
|
+ "AgQwHQYDVR0OBBYEFJFAs2rg6j8w9AKItRnOOOjG2FG6MB8GA1UdIwQYMBaAFEh/\n"
|
||||||
|
+ "XKjIuMeEavX5QVoy39Q+GhnwMAUGAytlcANBAIwghH3gelXty8qtoTGIEJb0+EBv\n"
|
||||||
|
+ "BH4YOUh7TamxjxkjvvIhDA7ZdheofFb7NrklJco7KBcTATUSOvxakYRP9Q8=\n"
|
||||||
|
+ "-----END CERTIFICATE-----\n",
|
||||||
|
+ /* C1 (signed by C) */
|
||||||
|
+ "-----BEGIN CERTIFICATE-----\n"
|
||||||
|
+ "MIIBUjCCAQSgAwIBAgIUSKsfY1wD3eD2VmaaK1wt5naPckMwBQYDK2VwMBExDzAN\n"
|
||||||
|
+ "BgNVBAMTBlJvb3QgQzAgFw0yNDAxMTEwNjI1NDdaGA85OTk5MTIzMTIzNTk1OVow\n"
|
||||||
|
+ "GjEYMBYGA1UEAxMPSW50ZXJtZWRpYXRlIEMxMCowBQYDK2VwAyEA/t7i1chZlKkV\n"
|
||||||
|
+ "qxJOrmmyATn8XnpK+nV/iT4OMHSHfAyjYzBhMA8GA1UdEwEB/wQFMAMBAf8wDgYD\n"
|
||||||
|
+ "VR0PAQH/BAQDAgIEMB0GA1UdDgQWBBRmpF3JjoP3NiBzE5J5ANT0bvfRmjAfBgNV\n"
|
||||||
|
+ "HSMEGDAWgBRIf1yoyLjHhGr1+UFaMt/UPhoZ8DAFBgMrZXADQQAeRBXv6WCTOp0G\n"
|
||||||
|
+ "3wgd8bbEGrrILfpi+qH7aj/MywgkPIlppDYRQ3jL6ASd+So/408dlE0DV9DXKBi0\n"
|
||||||
|
+ "725XUUYO\n"
|
||||||
|
+ "-----END CERTIFICATE-----\n",
|
||||||
|
+ /* C (signed by A) */
|
||||||
|
+ "-----BEGIN CERTIFICATE-----\n"
|
||||||
|
+ "MIIBSDCB+6ADAgECAhRvbZv3SRTjDOiAbyFWHH4y0yMZkjAFBgMrZXAwETEPMA0G\n"
|
||||||
|
+ "A1UEAxMGUm9vdCBBMCAXDTI0MDExMTA2MTg1MVoYDzk5OTkxMjMxMjM1OTU5WjAR\n"
|
||||||
|
+ "MQ8wDQYDVQQDEwZSb290IEMwKjAFBgMrZXADIQDxm6Ubhsa0gSa1vBCIO5e+qZEH\n"
|
||||||
|
+ "8Oocz+buNHfIJbh5NaNjMGEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMC\n"
|
||||||
|
+ "AgQwHQYDVR0OBBYEFEh/XKjIuMeEavX5QVoy39Q+GhnwMB8GA1UdIwQYMBaAFFti\n"
|
||||||
|
+ "A6REax3dnvj4Jq5fiG3MuDSXMAUGAytlcANBAPl+SyiOfXJnjSWx8hFMhJ7w92mn\n"
|
||||||
|
+ "tkGifCFHBpUhYcBIMeMtLw0RBLXqaaN0EKlTFimiEkLClsU7DKYrpEEJegs=\n"
|
||||||
|
+ "-----END CERTIFICATE-----\n",
|
||||||
|
+ /* C (signed by B) */
|
||||||
|
+ "-----BEGIN CERTIFICATE-----\n"
|
||||||
|
+ "MIIBSDCB+6ADAgECAhQU1OJWRVOLrGrgJiLwexd1/MwKkTAFBgMrZXAwETEPMA0G\n"
|
||||||
|
+ "A1UEAxMGUm9vdCBCMCAXDTI0MDExMTA2MjAzMFoYDzk5OTkxMjMxMjM1OTU5WjAR\n"
|
||||||
|
+ "MQ8wDQYDVQQDEwZSb290IEMwKjAFBgMrZXADIQDxm6Ubhsa0gSa1vBCIO5e+qZEH\n"
|
||||||
|
+ "8Oocz+buNHfIJbh5NaNjMGEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMC\n"
|
||||||
|
+ "AgQwHQYDVR0OBBYEFEh/XKjIuMeEavX5QVoy39Q+GhnwMB8GA1UdIwQYMBaAFJFA\n"
|
||||||
|
+ "s2rg6j8w9AKItRnOOOjG2FG6MAUGAytlcANBALXeyuj8vj6Q8j4l17VzZwmJl0gN\n"
|
||||||
|
+ "bCGoKMl0J/0NiN/fQRIsdbwQDh0RUN/RN3I6DTtB20ER6f3VdnzAh8nXkQ4=\n"
|
||||||
|
+ "-----END CERTIFICATE-----\n",
|
||||||
|
+ NULL
|
||||||
|
+};
|
||||||
|
+
|
||||||
|
+static const char *cross_signed_ca[] = {
|
||||||
|
+ /* A (self-signed) */
|
||||||
|
+ "-----BEGIN CERTIFICATE-----\n"
|
||||||
|
+ "MIIBJzCB2qADAgECAhQs1Ur+gzPs1ISxs3Tbs700q0CZcjAFBgMrZXAwETEPMA0G\n"
|
||||||
|
+ "A1UEAxMGUm9vdCBBMCAXDTI0MDExMTA2MTYwMFoYDzk5OTkxMjMxMjM1OTU5WjAR\n"
|
||||||
|
+ "MQ8wDQYDVQQDEwZSb290IEEwKjAFBgMrZXADIQA0vDYyg3tgotSETL1Wq2hBs32p\n"
|
||||||
|
+ "WbnINkmOSNmOiZlGHKNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMC\n"
|
||||||
|
+ "AgQwHQYDVR0OBBYEFFtiA6REax3dnvj4Jq5fiG3MuDSXMAUGAytlcANBAHrVv7E9\n"
|
||||||
|
+ "5scuOVCH9gNRRm8Z9SUoLakRHAPnySdg6z/kI3vOgA/OM7reArpnW8l1H2FapgpL\n"
|
||||||
|
+ "bDeZ2XJH+BdVFwg=\n"
|
||||||
|
+ "-----END CERTIFICATE-----\n",
|
||||||
|
+ NULL
|
||||||
|
+};
|
||||||
|
+
|
||||||
|
#if defined __clang__ || __GNUC__ > 4 || (__GNUC__ == 4 && __GNUC_MINOR__ >= 5)
|
||||||
|
# pragma GCC diagnostic push
|
||||||
|
# pragma GCC diagnostic ignored "-Wunused-variable"
|
||||||
|
@@ -4442,6 +4565,8 @@ static struct
|
||||||
|
rsa_sha1_not_in_trusted, rsa_sha1_not_in_trusted_ca,
|
||||||
|
GNUTLS_PROFILE_TO_VFLAGS(GNUTLS_PROFILE_MEDIUM),
|
||||||
|
GNUTLS_CERT_INSECURE_ALGORITHM | GNUTLS_CERT_INVALID, NULL, 1620118136, 1},
|
||||||
|
+ { "cross signed - ok", cross_signed, cross_signed_ca, 0, 0, 0,
|
||||||
|
+ 1704955300 },
|
||||||
|
{ NULL, NULL, NULL, 0, 0}
|
||||||
|
};
|
||||||
|
|
||||||
|
--
|
||||||
|
2.43.0
|
||||||
|
|
||||||
40
SOURCES/gnutls-3.7.6-fips-integrity-zeroize.patch
Normal file
40
SOURCES/gnutls-3.7.6-fips-integrity-zeroize.patch
Normal file
@ -0,0 +1,40 @@
|
|||||||
|
From 65911d48d49116a6ba49402824864e5f2f3ac1e1 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Clemens Lang <cllang@redhat.com>
|
||||||
|
Date: Fri, 12 Jan 2024 11:12:14 +0100
|
||||||
|
Subject: [PATCH] fips: Zeroize temporary values
|
||||||
|
MIME-Version: 1.0
|
||||||
|
Content-Type: text/plain; charset=UTF-8
|
||||||
|
Content-Transfer-Encoding: 8bit
|
||||||
|
|
||||||
|
The standard says "temporary value(s) generated during the integrity
|
||||||
|
test of the module's software […] shall be zeroised from the module upon
|
||||||
|
completion of the integrity test".
|
||||||
|
|
||||||
|
That includes the computed HMAC value, which is currently not zeroized
|
||||||
|
after the test. Add explicit calls to gnutls_memset() to fix that.
|
||||||
|
|
||||||
|
Signed-off-by: Clemens Lang <cllang@redhat.com>
|
||||||
|
---
|
||||||
|
lib/fips.c | 2 ++
|
||||||
|
1 file changed, 2 insertions(+)
|
||||||
|
|
||||||
|
diff --git a/lib/fips.c b/lib/fips.c
|
||||||
|
index e9c27f6df6..8f4ff22fb9 100644
|
||||||
|
--- a/lib/fips.c
|
||||||
|
+++ b/lib/fips.c
|
||||||
|
@@ -380,10 +380,12 @@ static int check_lib_hmac(struct hmac_entry *entry,
|
||||||
|
|
||||||
|
if (gnutls_memcmp(entry->hmac, hmac, HMAC_SIZE)) {
|
||||||
|
_gnutls_debug_log("Calculated MAC for %s does not match\n", path);
|
||||||
|
+ gnutls_memset(hmac, 0, HMAC_SIZE);
|
||||||
|
return gnutls_assert_val(GNUTLS_E_PARSING_ERROR);
|
||||||
|
}
|
||||||
|
_gnutls_debug_log("Successfully verified MAC for %s\n", path);
|
||||||
|
|
||||||
|
+ gnutls_memset(hmac, 0, HMAC_SIZE);
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
--
|
||||||
|
2.43.0
|
||||||
|
|
||||||
121
SOURCES/gnutls-3.7.6-rsa-psk-timing-followup.patch
Normal file
121
SOURCES/gnutls-3.7.6-rsa-psk-timing-followup.patch
Normal file
@ -0,0 +1,121 @@
|
|||||||
|
From a27c2e9574d2f29dbf674bd8863f29f7a0a9b9a0 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Daiki Ueno <ueno@gnu.org>
|
||||||
|
Date: Wed, 10 Jan 2024 19:13:17 +0900
|
||||||
|
Subject: [PATCH] rsa-psk: minimize branching after decryption
|
||||||
|
|
||||||
|
This moves any non-trivial code between gnutls_privkey_decrypt_data2
|
||||||
|
and the function return in _gnutls_proc_rsa_psk_client_kx up until the
|
||||||
|
decryption. This also avoids an extra memcpy to session->key.key.
|
||||||
|
|
||||||
|
Signed-off-by: Daiki Ueno <ueno@gnu.org>
|
||||||
|
---
|
||||||
|
lib/auth/rsa_psk.c | 68 ++++++++++++++++++++++++----------------------
|
||||||
|
1 file changed, 35 insertions(+), 33 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/lib/auth/rsa_psk.c b/lib/auth/rsa_psk.c
|
||||||
|
index 93c2dc9998..8f3fe5a4bd 100644
|
||||||
|
--- a/lib/auth/rsa_psk.c
|
||||||
|
+++ b/lib/auth/rsa_psk.c
|
||||||
|
@@ -269,7 +269,6 @@ _gnutls_proc_rsa_psk_client_kx(gnutls_session_t session, uint8_t * data,
|
||||||
|
int ret, dsize;
|
||||||
|
ssize_t data_size = _data_size;
|
||||||
|
gnutls_psk_server_credentials_t cred;
|
||||||
|
- gnutls_datum_t premaster_secret = { NULL, 0 };
|
||||||
|
volatile uint8_t ver_maj, ver_min;
|
||||||
|
|
||||||
|
cred = (gnutls_psk_server_credentials_t)
|
||||||
|
@@ -329,24 +328,48 @@ _gnutls_proc_rsa_psk_client_kx(gnutls_session_t session, uint8_t * data,
|
||||||
|
ver_maj = _gnutls_get_adv_version_major(session);
|
||||||
|
ver_min = _gnutls_get_adv_version_minor(session);
|
||||||
|
|
||||||
|
- premaster_secret.data = gnutls_malloc(GNUTLS_MASTER_SIZE);
|
||||||
|
- if (premaster_secret.data == NULL) {
|
||||||
|
+ /* Find the key of this username. A random value will be
|
||||||
|
+ * filled in if the key is not found.
|
||||||
|
+ */
|
||||||
|
+ ret =
|
||||||
|
+ _gnutls_psk_pwd_find_entry(session, info->username, strlen(info->username), &pwd_psk);
|
||||||
|
+ if (ret < 0)
|
||||||
|
+ return gnutls_assert_val(ret);
|
||||||
|
+
|
||||||
|
+ /* Allocate memory for premaster secret, and fill in the
|
||||||
|
+ * fields except the decryption result.
|
||||||
|
+ */
|
||||||
|
+ session->key.key.size = 2 + GNUTLS_MASTER_SIZE + 2 + pwd_psk.size;
|
||||||
|
+ session->key.key.data = gnutls_malloc(session->key.key.size);
|
||||||
|
+ if (session->key.key.data == NULL) {
|
||||||
|
gnutls_assert();
|
||||||
|
+ _gnutls_free_key_datum(&pwd_psk);
|
||||||
|
+ /* No need to zeroize, as the secret is not copied in yet */
|
||||||
|
+ _gnutls_free_datum(&session->key.key);
|
||||||
|
return GNUTLS_E_MEMORY_ERROR;
|
||||||
|
}
|
||||||
|
- premaster_secret.size = GNUTLS_MASTER_SIZE;
|
||||||
|
|
||||||
|
/* Fallback value when decryption fails. Needs to be unpredictable. */
|
||||||
|
- ret = gnutls_rnd(GNUTLS_RND_NONCE, premaster_secret.data,
|
||||||
|
- premaster_secret.size);
|
||||||
|
+ ret = gnutls_rnd(GNUTLS_RND_NONCE, session->key.key.data + 2,
|
||||||
|
+ GNUTLS_MASTER_SIZE);
|
||||||
|
if (ret < 0) {
|
||||||
|
gnutls_assert();
|
||||||
|
- goto cleanup;
|
||||||
|
+ _gnutls_free_key_datum(&pwd_psk);
|
||||||
|
+ /* No need to zeroize, as the secret is not copied in yet */
|
||||||
|
+ _gnutls_free_datum(&session->key.key);
|
||||||
|
+ return ret;
|
||||||
|
}
|
||||||
|
|
||||||
|
+ _gnutls_write_uint16(GNUTLS_MASTER_SIZE, session->key.key.data);
|
||||||
|
+ _gnutls_write_uint16(pwd_psk.size,
|
||||||
|
+ &session->key.key.data[2 + GNUTLS_MASTER_SIZE]);
|
||||||
|
+ memcpy(&session->key.key.data[2 + GNUTLS_MASTER_SIZE + 2],
|
||||||
|
+ pwd_psk.data, pwd_psk.size);
|
||||||
|
+ _gnutls_free_key_datum(&pwd_psk);
|
||||||
|
+
|
||||||
|
gnutls_privkey_decrypt_data2(session->internals.selected_key, 0,
|
||||||
|
- &ciphertext, premaster_secret.data,
|
||||||
|
- premaster_secret.size);
|
||||||
|
+ &ciphertext, session->key.key.data + 2,
|
||||||
|
+ GNUTLS_MASTER_SIZE);
|
||||||
|
/* After this point, any conditional on failure that cause differences
|
||||||
|
* in execution may create a timing or cache access pattern side
|
||||||
|
* channel that can be used as an oracle, so tread carefully */
|
||||||
|
@@ -365,31 +388,10 @@ _gnutls_proc_rsa_psk_client_kx(gnutls_session_t session, uint8_t * data,
|
||||||
|
/* This is here to avoid the version check attack
|
||||||
|
* discussed above.
|
||||||
|
*/
|
||||||
|
- premaster_secret.data[0] = ver_maj;
|
||||||
|
- premaster_secret.data[1] = ver_min;
|
||||||
|
-
|
||||||
|
- /* find the key of this username
|
||||||
|
- */
|
||||||
|
- ret =
|
||||||
|
- _gnutls_psk_pwd_find_entry(session, info->username, strlen(info->username), &pwd_psk);
|
||||||
|
- if (ret < 0) {
|
||||||
|
- gnutls_assert();
|
||||||
|
- goto cleanup;
|
||||||
|
- }
|
||||||
|
-
|
||||||
|
- ret =
|
||||||
|
- set_rsa_psk_session_key(session, &pwd_psk, &premaster_secret);
|
||||||
|
- if (ret < 0) {
|
||||||
|
- gnutls_assert();
|
||||||
|
- goto cleanup;
|
||||||
|
- }
|
||||||
|
+ session->key.key.data[2] = ver_maj;
|
||||||
|
+ session->key.key.data[3] = ver_min;
|
||||||
|
|
||||||
|
- ret = 0;
|
||||||
|
- cleanup:
|
||||||
|
- _gnutls_free_key_datum(&pwd_psk);
|
||||||
|
- _gnutls_free_temp_key_datum(&premaster_secret);
|
||||||
|
-
|
||||||
|
- return ret;
|
||||||
|
+ return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
static int
|
||||||
|
--
|
||||||
|
2.43.0
|
||||||
|
|
||||||
202
SOURCES/gnutls-3.7.6-rsa-psk-timing.patch
Normal file
202
SOURCES/gnutls-3.7.6-rsa-psk-timing.patch
Normal file
@ -0,0 +1,202 @@
|
|||||||
|
From 36b576644e4b90256bb485200ac6feca211f2b22 Mon Sep 17 00:00:00 2001
|
||||||
|
From: rpm-build <rpm-build>
|
||||||
|
Date: Mon, 11 Dec 2023 10:47:04 +0900
|
||||||
|
Subject: [PATCH] gnutls-3.7.6-rsa-psk-timing.patch
|
||||||
|
|
||||||
|
Signed-off-by: rpm-build <rpm-build>
|
||||||
|
---
|
||||||
|
lib/auth/rsa.c | 2 +-
|
||||||
|
lib/auth/rsa_psk.c | 93 +++++++++++++++++-----------------------------
|
||||||
|
lib/gnutls_int.h | 4 --
|
||||||
|
lib/priority.c | 1 -
|
||||||
|
4 files changed, 35 insertions(+), 65 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/lib/auth/rsa.c b/lib/auth/rsa.c
|
||||||
|
index 858701f..02b6a34 100644
|
||||||
|
--- a/lib/auth/rsa.c
|
||||||
|
+++ b/lib/auth/rsa.c
|
||||||
|
@@ -207,7 +207,7 @@ proc_rsa_client_kx(gnutls_session_t session, uint8_t * data,
|
||||||
|
session->key.key.size);
|
||||||
|
/* After this point, any conditional on failure that cause differences
|
||||||
|
* in execution may create a timing or cache access pattern side
|
||||||
|
- * channel that can be used as an oracle, so treat very carefully */
|
||||||
|
+ * channel that can be used as an oracle, so tread carefully */
|
||||||
|
|
||||||
|
/* Error handling logic:
|
||||||
|
* In case decryption fails then don't inform the peer. Just use the
|
||||||
|
diff --git a/lib/auth/rsa_psk.c b/lib/auth/rsa_psk.c
|
||||||
|
index 1a9dab5..93c2dc9 100644
|
||||||
|
--- a/lib/auth/rsa_psk.c
|
||||||
|
+++ b/lib/auth/rsa_psk.c
|
||||||
|
@@ -264,14 +264,13 @@ _gnutls_proc_rsa_psk_client_kx(gnutls_session_t session, uint8_t * data,
|
||||||
|
{
|
||||||
|
gnutls_datum_t username;
|
||||||
|
psk_auth_info_t info;
|
||||||
|
- gnutls_datum_t plaintext;
|
||||||
|
gnutls_datum_t ciphertext;
|
||||||
|
gnutls_datum_t pwd_psk = { NULL, 0 };
|
||||||
|
int ret, dsize;
|
||||||
|
- int randomize_key = 0;
|
||||||
|
ssize_t data_size = _data_size;
|
||||||
|
gnutls_psk_server_credentials_t cred;
|
||||||
|
gnutls_datum_t premaster_secret = { NULL, 0 };
|
||||||
|
+ volatile uint8_t ver_maj, ver_min;
|
||||||
|
|
||||||
|
cred = (gnutls_psk_server_credentials_t)
|
||||||
|
_gnutls_get_cred(session, GNUTLS_CRD_PSK);
|
||||||
|
@@ -327,71 +326,47 @@ _gnutls_proc_rsa_psk_client_kx(gnutls_session_t session, uint8_t * data,
|
||||||
|
}
|
||||||
|
ciphertext.size = dsize;
|
||||||
|
|
||||||
|
- ret =
|
||||||
|
- gnutls_privkey_decrypt_data(session->internals.selected_key, 0,
|
||||||
|
- &ciphertext, &plaintext);
|
||||||
|
- if (ret < 0 || plaintext.size != GNUTLS_MASTER_SIZE) {
|
||||||
|
- /* In case decryption fails then don't inform
|
||||||
|
- * the peer. Just use a random key. (in order to avoid
|
||||||
|
- * attack against pkcs-1 formatting).
|
||||||
|
- */
|
||||||
|
+ ver_maj = _gnutls_get_adv_version_major(session);
|
||||||
|
+ ver_min = _gnutls_get_adv_version_minor(session);
|
||||||
|
+
|
||||||
|
+ premaster_secret.data = gnutls_malloc(GNUTLS_MASTER_SIZE);
|
||||||
|
+ if (premaster_secret.data == NULL) {
|
||||||
|
gnutls_assert();
|
||||||
|
- _gnutls_debug_log
|
||||||
|
- ("auth_rsa_psk: Possible PKCS #1 format attack\n");
|
||||||
|
- if (ret >= 0) {
|
||||||
|
- gnutls_free(plaintext.data);
|
||||||
|
- }
|
||||||
|
- randomize_key = 1;
|
||||||
|
- } else {
|
||||||
|
- /* If the secret was properly formatted, then
|
||||||
|
- * check the version number.
|
||||||
|
- */
|
||||||
|
- if (_gnutls_get_adv_version_major(session) !=
|
||||||
|
- plaintext.data[0]
|
||||||
|
- || (session->internals.allow_wrong_pms == 0
|
||||||
|
- && _gnutls_get_adv_version_minor(session) !=
|
||||||
|
- plaintext.data[1])) {
|
||||||
|
- /* No error is returned here, if the version number check
|
||||||
|
- * fails. We proceed normally.
|
||||||
|
- * That is to defend against the attack described in the paper
|
||||||
|
- * "Attacking RSA-based sessions in SSL/TLS" by Vlastimil Klima,
|
||||||
|
- * Ondej Pokorny and Tomas Rosa.
|
||||||
|
- */
|
||||||
|
- gnutls_assert();
|
||||||
|
- _gnutls_debug_log
|
||||||
|
- ("auth_rsa: Possible PKCS #1 version check format attack\n");
|
||||||
|
- }
|
||||||
|
+ return GNUTLS_E_MEMORY_ERROR;
|
||||||
|
}
|
||||||
|
+ premaster_secret.size = GNUTLS_MASTER_SIZE;
|
||||||
|
|
||||||
|
-
|
||||||
|
- if (randomize_key != 0) {
|
||||||
|
- premaster_secret.size = GNUTLS_MASTER_SIZE;
|
||||||
|
- premaster_secret.data =
|
||||||
|
- gnutls_malloc(premaster_secret.size);
|
||||||
|
- if (premaster_secret.data == NULL) {
|
||||||
|
- gnutls_assert();
|
||||||
|
- return GNUTLS_E_MEMORY_ERROR;
|
||||||
|
- }
|
||||||
|
-
|
||||||
|
- /* we do not need strong random numbers here.
|
||||||
|
- */
|
||||||
|
- ret = gnutls_rnd(GNUTLS_RND_NONCE, premaster_secret.data,
|
||||||
|
- premaster_secret.size);
|
||||||
|
- if (ret < 0) {
|
||||||
|
- gnutls_assert();
|
||||||
|
- goto cleanup;
|
||||||
|
- }
|
||||||
|
- } else {
|
||||||
|
- premaster_secret.data = plaintext.data;
|
||||||
|
- premaster_secret.size = plaintext.size;
|
||||||
|
+ /* Fallback value when decryption fails. Needs to be unpredictable. */
|
||||||
|
+ ret = gnutls_rnd(GNUTLS_RND_NONCE, premaster_secret.data,
|
||||||
|
+ premaster_secret.size);
|
||||||
|
+ if (ret < 0) {
|
||||||
|
+ gnutls_assert();
|
||||||
|
+ goto cleanup;
|
||||||
|
}
|
||||||
|
|
||||||
|
+ gnutls_privkey_decrypt_data2(session->internals.selected_key, 0,
|
||||||
|
+ &ciphertext, premaster_secret.data,
|
||||||
|
+ premaster_secret.size);
|
||||||
|
+ /* After this point, any conditional on failure that cause differences
|
||||||
|
+ * in execution may create a timing or cache access pattern side
|
||||||
|
+ * channel that can be used as an oracle, so tread carefully */
|
||||||
|
+
|
||||||
|
+ /* Error handling logic:
|
||||||
|
+ * In case decryption fails then don't inform the peer. Just use the
|
||||||
|
+ * random key previously generated. (in order to avoid attack against
|
||||||
|
+ * pkcs-1 formatting).
|
||||||
|
+ *
|
||||||
|
+ * If we get version mismatches no error is returned either. We
|
||||||
|
+ * proceed normally. This is to defend against the attack described
|
||||||
|
+ * in the paper "Attacking RSA-based sessions in SSL/TLS" by
|
||||||
|
+ * Vlastimil Klima, Ondej Pokorny and Tomas Rosa.
|
||||||
|
+ */
|
||||||
|
+
|
||||||
|
/* This is here to avoid the version check attack
|
||||||
|
* discussed above.
|
||||||
|
*/
|
||||||
|
-
|
||||||
|
- premaster_secret.data[0] = _gnutls_get_adv_version_major(session);
|
||||||
|
- premaster_secret.data[1] = _gnutls_get_adv_version_minor(session);
|
||||||
|
+ premaster_secret.data[0] = ver_maj;
|
||||||
|
+ premaster_secret.data[1] = ver_min;
|
||||||
|
|
||||||
|
/* find the key of this username
|
||||||
|
*/
|
||||||
|
diff --git a/lib/gnutls_int.h b/lib/gnutls_int.h
|
||||||
|
index c6bf154..b59fb7c 100644
|
||||||
|
--- a/lib/gnutls_int.h
|
||||||
|
+++ b/lib/gnutls_int.h
|
||||||
|
@@ -988,7 +988,6 @@ struct gnutls_priority_st {
|
||||||
|
bool _no_etm;
|
||||||
|
bool _no_ext_master_secret;
|
||||||
|
bool _allow_key_usage_violation;
|
||||||
|
- bool _allow_wrong_pms;
|
||||||
|
bool _dumbfw;
|
||||||
|
unsigned int _dh_prime_bits; /* old (deprecated) variable */
|
||||||
|
|
||||||
|
@@ -1006,7 +1005,6 @@ struct gnutls_priority_st {
|
||||||
|
(x)->no_etm = 1; \
|
||||||
|
(x)->no_ext_master_secret = 1; \
|
||||||
|
(x)->allow_key_usage_violation = 1; \
|
||||||
|
- (x)->allow_wrong_pms = 1; \
|
||||||
|
(x)->dumbfw = 1
|
||||||
|
|
||||||
|
#define ENABLE_PRIO_COMPAT(x) \
|
||||||
|
@@ -1015,7 +1013,6 @@ struct gnutls_priority_st {
|
||||||
|
(x)->_no_etm = 1; \
|
||||||
|
(x)->_no_ext_master_secret = 1; \
|
||||||
|
(x)->_allow_key_usage_violation = 1; \
|
||||||
|
- (x)->_allow_wrong_pms = 1; \
|
||||||
|
(x)->_dumbfw = 1
|
||||||
|
|
||||||
|
/* DH and RSA parameters types.
|
||||||
|
@@ -1140,7 +1137,6 @@ typedef struct {
|
||||||
|
bool no_etm;
|
||||||
|
bool no_ext_master_secret;
|
||||||
|
bool allow_key_usage_violation;
|
||||||
|
- bool allow_wrong_pms;
|
||||||
|
bool dumbfw;
|
||||||
|
|
||||||
|
/* old (deprecated) variable. This is used for both srp_prime_bits
|
||||||
|
diff --git a/lib/priority.c b/lib/priority.c
|
||||||
|
index 4adf4c7..423cbd3 100644
|
||||||
|
--- a/lib/priority.c
|
||||||
|
+++ b/lib/priority.c
|
||||||
|
@@ -701,7 +701,6 @@ gnutls_priority_set(gnutls_session_t session, gnutls_priority_t priority)
|
||||||
|
COPY_TO_INTERNALS(no_etm);
|
||||||
|
COPY_TO_INTERNALS(no_ext_master_secret);
|
||||||
|
COPY_TO_INTERNALS(allow_key_usage_violation);
|
||||||
|
- COPY_TO_INTERNALS(allow_wrong_pms);
|
||||||
|
COPY_TO_INTERNALS(dumbfw);
|
||||||
|
COPY_TO_INTERNALS(dh_prime_bits);
|
||||||
|
|
||||||
|
--
|
||||||
|
2.43.0
|
||||||
|
|
||||||
@ -13,7 +13,7 @@ print(string.sub(hash, 0, 16))
|
|||||||
}
|
}
|
||||||
|
|
||||||
Version: 3.7.6
|
Version: 3.7.6
|
||||||
Release: 23%{?dist}
|
Release: 23%{?dist}.3
|
||||||
# not upstreamed
|
# not upstreamed
|
||||||
Patch: gnutls-3.6.7-no-now-guile.patch
|
Patch: gnutls-3.6.7-no-now-guile.patch
|
||||||
Patch: gnutls-3.2.7-rpath.patch
|
Patch: gnutls-3.2.7-rpath.patch
|
||||||
@ -42,6 +42,10 @@ Patch: gnutls-3.7.8-rsa-kx-timing.patch
|
|||||||
Patch: gnutls-3.7.8-fips-pct-dh.patch
|
Patch: gnutls-3.7.8-fips-pct-dh.patch
|
||||||
Patch: gnutls-3.7.6-fips-ems.patch
|
Patch: gnutls-3.7.6-fips-ems.patch
|
||||||
Patch: gnutls-3.7.6-fips-sha1-sigver.patch
|
Patch: gnutls-3.7.6-fips-sha1-sigver.patch
|
||||||
|
Patch: gnutls-3.7.6-rsa-psk-timing.patch
|
||||||
|
Patch: gnutls-3.7.6-rsa-psk-timing-followup.patch
|
||||||
|
Patch: gnutls-3.7.6-ca-xsigned.patch
|
||||||
|
Patch: gnutls-3.7.6-fips-integrity-zeroize.patch
|
||||||
|
|
||||||
# not upstreamed
|
# not upstreamed
|
||||||
Patch: gnutls-3.7.3-disable-config-reload.patch
|
Patch: gnutls-3.7.3-disable-config-reload.patch
|
||||||
@ -421,6 +425,16 @@ make check %{?_smp_mflags} GNUTLS_SYSTEM_PRIORITY_FILE=/dev/null XFAIL_TESTS="$x
|
|||||||
%endif
|
%endif
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Wed Jan 17 2024 Daiki Ueno <dueno@redhat.com> - 3.7.6-23.3
|
||||||
|
- x509: detect loop in certificate chain (RHEL-21759)
|
||||||
|
- fips: Zeroize temporary values in integrity check (RHEL-21870)
|
||||||
|
|
||||||
|
* Wed Jan 10 2024 Daiki Ueno <dueno@redhat.com> - 3.7.6-23.2
|
||||||
|
- auth/rsa_psk: minimize branching after decryption
|
||||||
|
|
||||||
|
* Mon Dec 11 2023 Daiki Ueno <dueno@redhat.com> - 3.7.6-23.1
|
||||||
|
- auth/rsa_psk: side-step potential side-channel (RHEL-16755)
|
||||||
|
|
||||||
* Sat Jul 29 2023 Daiki Ueno <dueno@redhat.com> - 3.7.6-23
|
* Sat Jul 29 2023 Daiki Ueno <dueno@redhat.com> - 3.7.6-23
|
||||||
- Mark SHA-1 signature verification non-approved in FIPS (#2102751)
|
- Mark SHA-1 signature verification non-approved in FIPS (#2102751)
|
||||||
|
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user