From: Clemens Lang <cllang@redhat.com>

  For RHEL 9.0, we want to phase out SHA1. One of the steps to do that is

  disabling SHA1 signatures. Introduce a new configuration option in the

  signing arbitrary data).

  Resolves: rhbz#2031742

  ---

   crypto/evp/evp_cnf.c                          | 13 ++++

   crypto/evp/m_sigver.c                         | 77 +++++++++++++++++++

   13 files changed, 188 insertions(+), 9 deletions(-)

  diff --git a/crypto/evp/evp_cnf.c b/crypto/evp/evp_cnf.c

  --- a/crypto/evp/evp_cnf.c

  +++ b/crypto/evp/evp_cnf.c

  @@ -10,6 +10,7 @@

               ERR_raise_data(ERR_LIB_EVP, EVP_R_UNKNOWN_OPTION,

                              "name=%s, value=%s", oval->name, oval->value);

  diff --git a/crypto/evp/m_sigver.c b/crypto/evp/m_sigver.c

  --- a/crypto/evp/m_sigver.c

  +++ b/crypto/evp/m_sigver.c

  @@ -16,6 +16,71 @@

           if (signature->digest_verify_init == NULL) {

               ERR_raise(ERR_LIB_EVP, EVP_R_INITIALIZATION_ERROR);

  diff --git a/crypto/evp/pmeth_lib.c b/crypto/evp/pmeth_lib.c

  --- a/crypto/evp/pmeth_lib.c

  +++ b/crypto/evp/pmeth_lib.c

  @@ -33,6 +33,7 @@

           return EVP_PKEY_CTX_ctrl(ctx, -1, op, ctrl, 0, (void *)(md));

  diff --git a/doc/man5/config.pod b/doc/man5/config.pod

  --- a/doc/man5/config.pod

  +++ b/doc/man5/config.pod

  @@ -304,6 +304,17 @@ Within the algorithm properties section, the following names have meaning:

   The value is a boolean that can be B<yes> or B<no>.  If the value is

  diff --git a/include/internal/cryptlib.h b/include/internal/cryptlib.h

  --- a/include/internal/cryptlib.h

  +++ b/include/internal/cryptlib.h

  @@ -168,7 +168,8 @@ typedef struct ossl_ex_data_global_st {

   # define OSSL_LIB_CTX_METHOD_LOW_PRIORITY          -1

   # define OSSL_LIB_CTX_METHOD_DEFAULT_PRIORITY       0

  diff --git a/include/internal/sslconf.h b/include/internal/sslconf.h

  --- a/include/internal/sslconf.h

  +++ b/include/internal/sslconf.h

  @@ -18,4 +18,8 @@ int conf_ssl_name_find(const char *name, size_t *idx);

  +                                                  int loadconfig);

   #endif

  diff --git a/providers/common/securitycheck.c b/providers/common/securitycheck.c

  --- a/providers/common/securitycheck.c

  +++ b/providers/common/securitycheck.c

  @@ -19,6 +19,7 @@

       return 1;

   }

  diff --git a/providers/common/securitycheck_default.c b/providers/common/securitycheck_default.c

  --- a/providers/common/securitycheck_default.c

  +++ b/providers/common/securitycheck_default.c

  @@ -15,6 +15,7 @@

       return mdnid;

   }

  diff --git a/providers/implementations/signature/dsa_sig.c b/providers/implementations/signature/dsa_sig.c

  --- a/providers/implementations/signature/dsa_sig.c

  +++ b/providers/implementations/signature/dsa_sig.c

  @@ -124,12 +124,17 @@ static int dsa_setup_md(PROV_DSA_CTX *ctx,

           if (md == NULL || md_nid < 0) {

               if (md == NULL)

  diff --git a/providers/implementations/signature/ecdsa_sig.c b/providers/implementations/signature/ecdsa_sig.c

  --- a/providers/implementations/signature/ecdsa_sig.c

  +++ b/providers/implementations/signature/ecdsa_sig.c

  @@ -237,7 +237,11 @@ static int ecdsa_setup_md(PROV_ECDSA_CTX *ctx, const char *mdname,

                                                       sha1_allowed);

       if (md_nid < 0) {

  diff --git a/providers/implementations/signature/rsa_sig.c b/providers/implementations/signature/rsa_sig.c

  --- a/providers/implementations/signature/rsa_sig.c

  +++ b/providers/implementations/signature/rsa_sig.c

   #include "internal/cryptlib.h"

   #include "internal/nelem.h"

   #include "internal/sizes.h"

   #include "crypto/rsa.h"

   #include "prov/providercommon.h"

   #include "prov/implementations.h"

   #include "prov/securitycheck.h"

   #define RSA_DEFAULT_DIGEST_NAME OSSL_DIGEST_NAME_SHA1

   static OSSL_FUNC_signature_newctx_fn rsa_newctx;

   static OSSL_FUNC_signature_sign_init_fn rsa_sign_init;

       if (mdname != NULL) {

           EVP_MD *md = EVP_MD_fetch(ctx->libctx, mdname, mdprops);

           if (md == NULL

               || md_nid <= 0

       prsactx->pad_mode = pad_mode;

       if (prsactx->md == NULL && pmdname == NULL

       if (pmgf1mdname != NULL

           && !rsa_setup_mgf1_md(prsactx, pmgf1mdname, pmgf1mdprops))

  diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c

  --- a/ssl/t1_lib.c

  +++ b/ssl/t1_lib.c

  @@ -20,6 +20,7 @@

   #include "internal/nelem.h"

   #include "internal/sizes.h"

   #include "internal/tlsgroups.h"

           = OPENSSL_malloc(sizeof(*lu) * OSSL_NELEM(sigalg_lookup_tbl));

       EVP_PKEY *tmpkey = EVP_PKEY_new();

       int ret = 0;

       for (i = 0, lu = sigalg_lookup_tbl;

            i < OSSL_NELEM(sigalg_lookup_tbl); lu++, i++) {

           EVP_PKEY_CTX *pctx;

               cache[i].enabled = 0;

               continue;

           }

           if (!EVP_PKEY_set_type(tmpkey, lu->sig)) {

               cache[i].enabled = 0;

  diff --git a/util/libcrypto.num b/util/libcrypto.num

  --- a/util/libcrypto.num

  +++ b/util/libcrypto.num

   ossl_safe_getenv                        ?	3_0_0	EXIST::FUNCTION:

  +ossl_ctx_legacy_digest_signatures_allowed ?	3_0_1	EXIST::FUNCTION:

  +ossl_ctx_legacy_digest_signatures_allowed_set ?	3_0_1	EXIST::FUNCTION:

  -- 

  From: Clemens Lang <cllang@redhat.com>

  Date: Tue, 1 Mar 2022 15:44:18 +0100

  Subject: [PATCH] Allow SHA1 in seclevel 2 if rh-allow-sha1-signatures = yes

   4 files changed, 79 insertions(+), 18 deletions(-)

  diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c

  --- a/crypto/x509/x509_vfy.c

  +++ b/crypto/x509/x509_vfy.c

  @@ -25,6 +25,7 @@

   #include "crypto/x509.h"

   #include "x509_local.h"

   {

       int secbits = -1;

       int level = ctx->param->auth_level;

       return secbits >= minbits_table[level - 1];

   }

  diff --git a/doc/man5/config.pod b/doc/man5/config.pod

  --- a/doc/man5/config.pod

  +++ b/doc/man5/config.pod

   digest will fail.  For compatibility with older versions of OpenSSL, set this

   option to B<yes>.  This setting also affects TLS, where signature algorithms

   that use SHA1 as digest will no longer be supported if this option is set to

   =item B<fips_mode> (deprecated)

  diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c

  --- a/ssl/t1_lib.c

  +++ b/ssl/t1_lib.c

  @@ -20,6 +20,7 @@

   #include "internal/sslconf.h"

   #include "internal/nelem.h"

   #include "internal/sizes.h"

           SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_R_UNKNOWN_DIGEST);

           return 0;

       }

       }

       /* Store the sigalg the peer uses */

       s->s3.tmp.peer_sigalg = lu;

           }

       }

       /* Finally see if security callback allows it */

       secbits = sigalg_security_bits(s->ctx, lu);

       sigalgstr[0] = (lu->sigalg >> 8) & 0xff;

   {

       /* Lookup signature algorithm digest */

       int secbits, nid, pknid;

       /* Don't check signature if self signed */

       if ((X509_get_extension_flags(x) & EXFLAG_SS) != 0)

           return 1;

       /* If digest NID not defined use signature NID */

       if (nid == NID_undef)

           nid = pknid;

           return ssl_security(s, op, secbits, nid, x);

       else

  diff --git a/test/recipes/25-test_verify.t b/test/recipes/25-test_verify.t

  --- a/test/recipes/25-test_verify.t

  +++ b/test/recipes/25-test_verify.t

  @@ -29,7 +29,7 @@ sub verify {

       run(app([@args]));

   }

   # Canonical success

   ok(verify("ee-cert", "sslserver", ["root-cert"], ["ca-cert"]),

   ok(verify("ee-pss-sha256-cert", "", ["root-cert"], ["ca-cert"], ),

       "CA with PSS signature using SHA256");

   ok(verify("ee-pss-sha256-cert", "", ["root-cert"], ["ca-cert"], "-auth_level", "2"),

       "PSS signature using SHA256 and auth level 2");

  --