Update error checking for OpenSSL CMS_verify

Resolves: rhbz#2063838
Signed-off-by: Julien Rische <jrische@redhat.com>

0010-Update-error-checking-for-OpenSSL-CMS_verify.patch

@@ -0,0 +1,48 @@
+From 75f71ace74449a6e5154314229bfa61960cd326c Mon Sep 17 00:00:00 2001
+From: Julien Rische <jrische@redhat.com>
+Date: Thu, 28 Jul 2022 15:20:12 +0200
+Subject: [PATCH] Update error checking for OpenSSL CMS_verify
+
+The code for CMS data verification was initially written for OpenSSL's
+PKCS7_verify() function.  It now uses CMS_verify(), but error handling
+is still done using PKCS7_verify() error identifiers.  Update the
+recognized error codes so that the KDC generates
+KDC_ERR_DIGEST_IN_SIGNED_DATA_NOT_ACCEPTED errors when appropriate.
+Use ERR_peek_last_error() to observe the error generated closest to
+the API surface.
+
+[ghudson@mit.edu: edited commit message]
+
+ticket: 9069 (new)
+tags: pullup
+target_version: 1.20-next
+---
+ src/plugins/preauth/pkinit/pkinit_crypto_openssl.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+index 1c2aa02827..16edf15cb2 100644
+--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
++++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+@@ -2102,12 +2102,15 @@ cms_signeddata_verify(krb5_context context,
+             goto cleanup;
+         out = BIO_new(BIO_s_mem());
+         if (CMS_verify(cms, NULL, store, NULL, out, flags) == 0) {
+-            unsigned long err = ERR_peek_error();
++            unsigned long err = ERR_peek_last_error();
+             switch(ERR_GET_REASON(err)) {
+-            case PKCS7_R_DIGEST_FAILURE:
++            case RSA_R_DIGEST_NOT_ALLOWED:
++            case CMS_R_UNKNOWN_DIGEST_ALGORITHM:
++            case CMS_R_NO_MATCHING_DIGEST:
++            case CMS_R_NO_MATCHING_SIGNATURE:
+                 retval = KRB5KDC_ERR_DIGEST_IN_SIGNED_DATA_NOT_ACCEPTED;
+                 break;
+-            case PKCS7_R_SIGNATURE_FAILURE:
++            case CMS_R_VERIFICATION_FAILURE:
+             default:
+                 retval = KRB5KDC_ERR_INVALID_SIG;
+             }
+-- 
+2.38.1
+

0011-downstream-Catch-SHA-1-digest-disallowed-error-for-P.patch

@@ -0,0 +1,28 @@
+From 3f8a3b57cf0e057635e570d5038fb52c19ca5744 Mon Sep 17 00:00:00 2001
+From: Julien Rische <jrische@redhat.com>
+Date: Fri, 19 Aug 2022 10:34:52 +0200
+Subject: [PATCH] [downstream] Catch SHA-1 digest disallowed error for
+ PKINIT
+
+An OpenSSL patch causes EVP_R_INVALID_DIGEST error to be raised if
+CMS_verify is called to verify a SHA-1 signature. If this error is
+caught, it will now return KDC_ERR_DIGEST_IN_SIGNED_DATA_NOT_ACCEPTED.
+---
+ src/plugins/preauth/pkinit/pkinit_crypto_openssl.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+index 16edf15cb2..bfa3fe8e91 100644
+--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
++++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+@@ -2104,6 +2104,7 @@ cms_signeddata_verify(krb5_context context,
+         if (CMS_verify(cms, NULL, store, NULL, out, flags) == 0) {
+             unsigned long err = ERR_peek_last_error();
+             switch(ERR_GET_REASON(err)) {
++            case EVP_R_INVALID_DIGEST:
+             case RSA_R_DIGEST_NOT_ALLOWED:
+             case CMS_R_UNKNOWN_DIGEST_ALGORITHM:
+             case CMS_R_NO_MATCHING_DIGEST:
+-- 
+2.38.1
+

krb5.spec

@@ -37,7 +37,7 @@
 %global baserelease 0
 
 # This should be e.g. beta1 or %%nil
-%global pre_release 1
+%global pre_release 2
 
 %global krb5_release %{baserelease}
 %if "x%{?pre_release}" != "x"
@@ -92,6 +92,8 @@ Patch06: 0006-downstream-Allow-krad-UDP-TCP-localhost-connection-w.patch
 Patch07: 0007-Add-configure-variable-for-default-PKCS-11-module.patch
 Patch08: 0008-Set-reasonable-supportedCMSTypes-in-PKINIT.patch
 Patch09: 0009-Simplify-plugin-loading-code.patch
+Patch10: 0010-Update-error-checking-for-OpenSSL-CMS_verify.patch
+Patch11: 0011-downstream-Catch-SHA-1-digest-disallowed-error-for-P.patch
 
 License: MIT
 URL: https://web.mit.edu/kerberos/www/
@@ -656,7 +658,9 @@ exit 0
 %{_libdir}/libkadm5srv_mit.so.*
 
 %changelog
-* Tue Nov 22 2022 Julien Rische <jrische@redhat.com> - 1.20.1-0.1
+* Tue Nov 22 2022 Julien Rische <jrische@redhat.com> - 1.20.1-0.2
+- Update error checking for OpenSSL CMS_verify
+- Resolves: rhbz#2063838
 - New upstream version (1.20.1)
 - Resolves: rhbz#2016312
 - Fix integer overflows in PAC parsing (CVE-2022-42898)