|
 |
57f72f |
From 10366b4ee8c01ea20d908102e92d52fdeda168c3 Mon Sep 17 00:00:00 2001
|
|
|
57f72f |
From: Alexey Tikhonov <atikhono@redhat.com>
|
|
|
57f72f |
Date: Tue, 18 Aug 2020 14:37:04 +0200
|
|
|
57f72f |
Subject: [PATCH] p11_child: switch default ocsp_dgst to sha1
|
|
|
57f72f |
|
|
|
57f72f |
For details please see discussion at
|
|
|
57f72f |
https://github.com/SSSD/sssd/pull/837#issuecomment-672831519
|
|
|
57f72f |
|
|
|
57f72f |
:newdefault: sssd:certificate_verification:ocsp_dgst, sha256, sha1
|
|
|
57f72f |
|
|
|
57f72f |
Resolves:
|
|
|
57f72f |
https://github.com/SSSD/sssd/issues/5002
|
|
|
57f72f |
|
|
|
57f72f |
Reviewed-by: Iker Pedrosa <ipedrosa@redhat.com>
|
|
|
57f72f |
Reviewed-by: Sumit Bose <sbose@redhat.com>
|
|
|
57f72f |
---
|
|
|
57f72f |
src/man/sssd.conf.5.xml | 3 ++-
|
|
|
57f72f |
src/p11_child/p11_child_common_utils.c | 6 +++---
|
|
|
57f72f |
src/p11_child/p11_child_openssl.c | 4 ++--
|
|
|
57f72f |
3 files changed, 7 insertions(+), 6 deletions(-)
|
|
|
57f72f |
|
|
|
57f72f |
diff --git a/src/man/sssd.conf.5.xml b/src/man/sssd.conf.5.xml
|
|
|
57f72f |
index 874a09c49..50692dfdd 100644
|
|
|
57f72f |
--- a/src/man/sssd.conf.5.xml
|
|
|
57f72f |
+++ b/src/man/sssd.conf.5.xml
|
|
|
57f72f |
@@ -507,7 +507,8 @@
|
|
|
57f72f |
<listitem><para>sha512</para></listitem>
|
|
|
57f72f |
</itemizedlist></para>
|
|
|
57f72f |
<para>
|
|
|
57f72f |
- Default: sha256
|
|
|
57f72f |
+ Default: sha1 (to allow compatibility with
|
|
|
57f72f |
+ RFC5019-compliant responder)
|
|
|
57f72f |
</para>
|
|
|
57f72f |
<para>(NSS Version) This option is
|
|
|
57f72f |
ignored, because NSS uses sha1
|
|
|
57f72f |
diff --git a/src/p11_child/p11_child_common_utils.c b/src/p11_child/p11_child_common_utils.c
|
|
|
57f72f |
index 6798752c7..95791b1f0 100644
|
|
|
57f72f |
--- a/src/p11_child/p11_child_common_utils.c
|
|
|
57f72f |
+++ b/src/p11_child/p11_child_common_utils.c
|
|
|
57f72f |
@@ -43,7 +43,7 @@ static struct cert_verify_opts *init_cert_verify_opts(TALLOC_CTX *mem_ctx)
|
|
|
57f72f |
cert_verify_opts->ocsp_default_responder = NULL;
|
|
|
57f72f |
cert_verify_opts->ocsp_default_responder_signing_cert = NULL;
|
|
|
57f72f |
cert_verify_opts->crl_file = NULL;
|
|
|
57f72f |
- cert_verify_opts->ocsp_dgst = CKM_SHA256;
|
|
|
57f72f |
+ cert_verify_opts->ocsp_dgst = CKM_SHA_1;
|
|
|
57f72f |
cert_verify_opts->soft_ocsp = false;
|
|
|
57f72f |
cert_verify_opts->soft_crl = false;
|
|
|
57f72f |
|
|
|
57f72f |
@@ -174,8 +174,8 @@ errno_t parse_cert_verify_opts(TALLOC_CTX *mem_ctx, const char *verify_opts,
|
|
|
57f72f |
} else {
|
|
|
57f72f |
DEBUG(SSSDBG_CRIT_FAILURE,
|
|
|
57f72f |
"Unsupported digest for OCSP [%s], "
|
|
|
57f72f |
- "using default sha256.\n", &opts[c][OCSP_DGST_LEN]);
|
|
|
57f72f |
- cert_verify_opts->ocsp_dgst = CKM_SHA256;
|
|
|
57f72f |
+ "using default sha1.\n", &opts[c][OCSP_DGST_LEN]);
|
|
|
57f72f |
+ cert_verify_opts->ocsp_dgst = CKM_SHA_1;
|
|
|
57f72f |
}
|
|
|
57f72f |
#endif
|
|
|
57f72f |
} else if (strcasecmp(opts[c], "soft_ocsp") == 0) {
|
|
|
57f72f |
diff --git a/src/p11_child/p11_child_openssl.c b/src/p11_child/p11_child_openssl.c
|
|
|
57f72f |
index 321cf162e..04b3e1467 100644
|
|
|
57f72f |
--- a/src/p11_child/p11_child_openssl.c
|
|
|
57f72f |
+++ b/src/p11_child/p11_child_openssl.c
|
|
|
57f72f |
@@ -372,8 +372,8 @@ static errno_t do_ocsp(struct p11_ctx *p11_ctx, X509 *cert)
|
|
|
57f72f |
ocsp_dgst = get_dgst(p11_ctx->cert_verify_opts->ocsp_dgst);
|
|
|
57f72f |
if (ocsp_dgst == NULL) {
|
|
|
57f72f |
DEBUG(SSSDBG_OP_FAILURE, "Cannot determine configured digest function "
|
|
|
57f72f |
- "for OCSP, using default sha256.\n");
|
|
|
57f72f |
- ocsp_dgst = EVP_sha256();
|
|
|
57f72f |
+ "for OCSP, using default sha1.\n");
|
|
|
57f72f |
+ ocsp_dgst = EVP_sha1();
|
|
|
57f72f |
}
|
|
|
57f72f |
cid = OCSP_cert_to_id(ocsp_dgst, cert, issuer);
|
|
|
57f72f |
if (cid == NULL) {
|
|
|
57f72f |
--
|
|
|
57f72f |
2.21.3
|
|
|
57f72f |
|