Merge ~fheimes/ubuntu/+source/s390-tools:s390-tools-sru-lp1968259+lp1968260-jammy into ubuntu/+source/s390-tools:ubuntu/jammy-devel

[Frank Heimes]

s390-tools-sru-lp1968259+lp1968260-jammy
  * d/p/78b0533-genprotimg-remove-DigiCert-root-CA-pinning.patch
    Fix for genprotimg failing to process z15 host key documents
    after April 2022. (LP: #1968260)
  * d/p/673ff37-genprotimg-check_hostkeydoc-relax-default-issuer-che.patch
    Fixing check_hostkeydoc since it's checking the certificate issuer
    too strictly. (LP: #1968259)

Test build is available here:
https://launchpad.net/~fheimes/+archive/ubuntu/lp1968259+lp1968260

Unmerged commits

18fb177... by Frank Heimes on 2022-04-08

  * debian/changelog for
    d/p/78b0533-genprotimg-remove-DigiCert-root-CA-pinning.patch
    d/p/673ff37-genprotimg-check_hostkeydoc-relax-default-issuer-che.patch

646836b... by Frank Heimes on 2022-04-08

  * d/p/673ff37-genprotimg-check_hostkeydoc-relax-default-issuer-che.patch
    Fixing check_hostkeydoc since it's checking the certificate issuer
    too strictly.
    (LP: #1968259)

e53f460... by Frank Heimes on 2022-04-08

  * d/p/78b0533-genprotimg-remove-DigiCert-root-CA-pinning.patch
    Fix for genprotimg failing to process z15 host key documents
    after April 2022.
    (LP: #1968260)

diff --git a/debian/changelog b/debian/changelog
index 5bda178..9c7b5ea 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,14 @@
+s390-tools (2.20.0-0ubuntu2) jammy; urgency=medium
+
+  * d/p/78b0533-genprotimg-remove-DigiCert-root-CA-pinning.patch
+    Fix for genprotimg failing to process z15 host key documents
+    after April 2022. (LP: #1968260)
+  * d/p/673ff37-genprotimg-check_hostkeydoc-relax-default-issuer-che.patch
+    Fixing check_hostkeydoc since it's checking the certificate issuer
+    too strictly. (LP: #1968259)
+
+ -- Frank Heimes <[e-mail]>  Fri, 08 Apr 2022 16:01:38 +0200
+
 s390-tools (2.20.0-0ubuntu1) jammy; urgency=medium
 
   * New upstream release. LP: #1959420
diff --git a/debian/patches/673ff37-genprotimg-check_hostkeydoc-relax-default-issuer-che.patch b/debian/patches/673ff37-genprotimg-check_hostkeydoc-relax-default-issuer-che.patch
new file mode 100644
index 0000000..7d69069
--- /dev/null
+++ b/debian/patches/673ff37-genprotimg-check_hostkeydoc-relax-default-issuer-che.patch
@@ -0,0 +1,84 @@
+genprotimg/check_hostkeydoc: relax default issuer check
+
+While the original default issuer's organizationalUnitName (OU)
+was defined as "IBM Z Host Key Signing Service", any OU ending
+with "Key Signing Service" is considered legal.
+
+Let's relax the default issuer check by stripping off characters
+preceding "Key Signing Service".
+
+Signed-off-by: Viktor Mihajlovski <[e-mail]>
+Reviewed-by: Marc Hartmayer <[e-mail]>
+Signed-off-by: Jan Höppner <[e-mail]>
+
+Author: Viktor Mihajlovski <[e-mail]>
+Origin: upstream, https://github.com/ibm-s390-tools/s390-tools673ff37
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1968259
+Bug-IBM: BZ#197551
+Applied-Upstream: > 2.20.0
+Reviewed-by: Frank Heimes <[e-mail]>
+Last-Update: 2022-04-08
+
+---
+ genprotimg/samples/check_hostkeydoc | 20 ++++++++++++++++----
+ 1 file changed, 16 insertions(+), 4 deletions(-)
+
+diff --git a/genprotimg/samples/check_hostkeydoc b/genprotimg/samples/check_hostkeydoc
+index a96576fa..6a837390 100755
+--- a/genprotimg/samples/check_hostkeydoc
++++ b/genprotimg/samples/check_hostkeydoc
+@@ -23,6 +23,7 @@ BODY_FILE=$(mktemp)
+ ISSUER_DN_FILE=$(mktemp)
+ SUBJECT_DN_FILE=$(mktemp)
+ DEF_ISSUER_DN_FILE=$(mktemp)
++CANONICAL_ISSUER_DN_FILE=$(mktemp)
+ CRL_SERIAL_FILE=$(mktemp)
+ 
+ # Cleanup on exit
+@@ -30,7 +31,7 @@ cleanup()
+ {
+     rm -f $ISSUER_PUBKEY_FILE $SIGNATURE_FILE $BODY_FILE \
+         $ISSUER_DN_FILE $SUBJECT_DN_FILE $DEF_ISSUER_DN_FILE \
+-        $CRL_SERIAL_FILE
++        $CANONICAL_ISSUER_DN_FILE $CRL_SERIAL_FILE
+ }
+ trap cleanup EXIT
+ 
+@@ -121,20 +122,31 @@ default_issuer()
+     commonName                = International Business Machines Corporation
+     countryName               = US
+     localityName              = Poughkeepsie
+-    organizationalUnitName    = IBM Z Host Key Signing Service
++    organizationalUnitName    = Key Signing Service
+     organizationName          = International Business Machines Corporation
+     stateOrProvinceName       = New York
+ EOF
+ }
+ 
+-verify_issuer_files()
++# As organizationalUnitName can have an arbitrary prefix but must
++# end with "Key Signing Service" let's normalize the OU name by
++# stripping off the prefix
++verify_default_issuer()
+ {
+     default_issuer > $DEF_ISSUER_DN_FILE
+ 
+-    if ! diff $ISSUER_DN_FILE $DEF_ISSUER_DN_FILE
++    sed "s/\(^[ ]*organizationalUnitName[ ]*=[ ]*\).*\(Key Signing Service$\)/\1\2/" \
++	$ISSUER_DN_FILE > $CANONICAL_ISSUER_DN_FILE
++
++    if ! diff $CANONICAL_ISSUER_DN_FILE $DEF_ISSUER_DN_FILE
+     then
+         echo Incorrect default issuer >&2 && exit 1
+     fi
++}
++
++verify_issuer_files()
++{
++    verify_default_issuer
+ 
+     if diff $ISSUER_DN_FILE $SUBJECT_DN_FILE
+     then
+-- 
+2.25.1
+
diff --git a/debian/patches/78b0533-genprotimg-remove-DigiCert-root-CA-pinning.patch b/debian/patches/78b0533-genprotimg-remove-DigiCert-root-CA-pinning.patch
new file mode 100644
index 0000000..1defa2d
--- /dev/null
+++ b/debian/patches/78b0533-genprotimg-remove-DigiCert-root-CA-pinning.patch
@@ -0,0 +1,258 @@
+genprotimg: remove DigiCert root CA pinning
+
+Remove the DigiCert root CA pinning. The root CA used for the chain of trust can
+change in the future therefore let's remove this check. If someone wants to
+enforce the usage of a specific root CA it can be selected by the genprotimg
+command line option `--root-ca $CA`. Make it transparent to the user which root
+CA is actually being used by printing the subject name of the root CA to stdout
+in verbose mode.
+
+Signed-off-by: Marc Hartmayer <[e-mail]>
+Acked-by: Viktor Mihajlovski <[e-mail]>
+Reviewed-and-tested-by: Nico Boehr <[e-mail]>
+Signed-off-by: Jan Höppner <[e-mail]>
+
+Author: Marc Hartmayer <[e-mail]>
+Origin: upstream, https://github.com/ibm-s390-tools/s390-tools78b0533
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1968260
+Bug-IBM: BZ#197550
+Applied-Upstream: > 2.20.0
+Reviewed-by: Frank Heimes <[e-mail]>
+Last-Update: 2022-04-08
+
+---
+ genprotimg/man/genprotimg.8            |  2 +-
+ genprotimg/src/include/pv_crypto_def.h |  3 --
+ genprotimg/src/pv/pv_args.c            |  2 +-
+ genprotimg/src/pv/pv_image.c           | 27 ++++++---------
+ genprotimg/src/utils/crypto.c          | 48 +++++++++++---------------
+ genprotimg/src/utils/crypto.h          |  4 +--
+ 6 files changed, 35 insertions(+), 51 deletions(-)
+
+diff --git a/genprotimg/man/genprotimg.8 b/genprotimg/man/genprotimg.8
+index 81929926..460c1d79 100644
+--- a/genprotimg/man/genprotimg.8
++++ b/genprotimg/man/genprotimg.8
+@@ -87,7 +87,7 @@ CRLs. Optional.
+ .TP
+ \fB\-\-root\-ca\fR=\fI\,FILE\/\fR
+ Specifies the root CA certificate for the verification. If omitted,
+-the DigiCert root CA certificate installed on the system is used. Use
++the system wide root CAs installed on the system is used. Use
+ this only if you trust the specified certificate. Optional.
+ .TP
+ \fB\-\-no-verify\fR
+diff --git a/genprotimg/src/include/pv_crypto_def.h b/genprotimg/src/include/pv_crypto_def.h
+index 53984a3d..3635433c 100644
+--- a/genprotimg/src/include/pv_crypto_def.h
++++ b/genprotimg/src/include/pv_crypto_def.h
+@@ -29,9 +29,6 @@
+  */
+ #define PV_CERTS_SECURITY_LEVEL 2
+ 
+-/* SKID for DigiCert Assured ID Root CA */
+-#define DIGICERT_ASSURED_ID_ROOT_CA_SKID "45EBA2AFF492CB82312D518BA7A7219DF36DC80F"
+-
+ union ecdh_pub_key {
+ 	struct {
+ 		uint8_t x[80];
+diff --git a/genprotimg/src/pv/pv_args.c b/genprotimg/src/pv/pv_args.c
+index 000eb9a0..c67ae99f 100644
+--- a/genprotimg/src/pv/pv_args.c
++++ b/genprotimg/src/pv/pv_args.c
+@@ -123,7 +123,7 @@ static gint pv_args_validate_options(PvArgs *args, GError **err)
+ 	     g_strv_length(args->untrusted_cert_paths) == 0)) {
+ 		g_set_error(
+ 			err, PV_PARSE_ERROR, PR_PARSE_ERROR_MISSING_ARGUMENT,
+-			_("Either specify the IBM Z signing key and (DigiCert) intermediate CA certificate\n"
++			_("Either specify the IBM Z signing key and intermediate CA certificate\n"
+ 			  "by using the '--cert' option, or use the '--no-verify' flag to disable the\n"
+ 			  "host-key document verification completely (at your own risk)."));
+ 		return -1;
+diff --git a/genprotimg/src/pv/pv_image.c b/genprotimg/src/pv/pv_image.c
+index 1ccb0fce..8399901d 100644
+--- a/genprotimg/src/pv/pv_image.c
++++ b/genprotimg/src/pv/pv_image.c
+@@ -311,9 +311,10 @@ static gint pv_img_hostkey_verify(GSList *host_key_certs,
+ 	}
+ 
+ 	/* Load all untrusted certificates (e.g. IBM Z signing key and
+-	 * DigiCert intermediate CA) that are required to establish a chain of
+-	 * trust starting from the host-key document up to the root CA (if not
+-	 * otherwise specified that's the DigiCert Assured ID Root CA).
++	 * intermediate CA) that are required to establish a chain of trust
++	 * starting from the host-key document up to the root CA (if not
++	 * otherwise specified that can be one of the system wide installed
++	 * root CAs, e.g. DigiCert).
+ 	 */
+ 	untrusted_certs_with_path = load_certificates(untrusted_cert_paths, err);
+ 	if (!untrusted_certs_with_path)
+@@ -348,9 +349,8 @@ static gint pv_img_hostkey_verify(GSList *host_key_certs,
+ 	 * For this we must check:
+ 	 *
+ 	 * 1. Can a chain of trust be established ending in a root CA
+-	 * 2. Is the correct root CA ued? It has either to be the
+-	 *    'DigiCert Assured ID Root CA' or the root CA specified via
+-	 *    command line.
++	 * 2. Is the correct root CA used? It has either to be a system CA
++	 *    or the root CA specified via command line.
+ 	 */
+ 	for (gint i = 0; i < sk_X509_num(ibm_signing_certs); ++i) {
+ 		X509 *ibm_signing_cert = sk_X509_value(ibm_signing_certs, i);
+@@ -371,17 +371,12 @@ static gint pv_img_hostkey_verify(GSList *host_key_certs,
+ 		if (verify_cert(ibm_signing_cert, ctx, err) < 0)
+ 			goto error;
+ 
+-		/* Verify the build chain of trust chain. If the user passes a
+-		 * trusted root CA on the command line then the check for the
+-		 * Subject Key Identifier (SKID) is skipped, otherwise let's
+-		 * check if the SKID meets our expectation.
++		/* If there is a chain of trust using either the provided root
++		 * CA on the command line or a system wide trusted root CA.
+ 		 */
+-		if (!root_ca_path &&
+-		    check_chain_parameters(X509_STORE_CTX_get0_chain(ctx),
+-					   get_digicert_assured_id_root_ca_skid(),
+-					   err) < 0) {
++		if (check_chain_parameters(X509_STORE_CTX_get0_chain(ctx),
++					   err) < 0)
+ 			goto error;
+-		}
+ 
+ 		ibm_signing_crls = store_ctx_find_valid_crls(ctx, ibm_signing_cert, err);
+ 		if (!ibm_signing_crls) {
+@@ -595,7 +590,7 @@ PvImage *pv_img_new(PvArgs *args, const gchar *stage3a_path, GError **err)
+ 		g_warning(_("host-key document verification is disabled. Your workload is not secured."));
+ 
+ 	if (args->root_ca_path)
+-		g_warning(_("A different root CA than the default DigiCert root CA is selected. Ensure that this root CA is trusted."));
++		g_warning(_("The root CA is selected through the command line. Ensure that this root CA is trusted."));
+ 
+ 	ret->comps = pv_img_comps_new(EVP_sha512(), EVP_sha512(), EVP_sha512(), err);
+ 	if (!ret->comps)
+diff --git a/genprotimg/src/utils/crypto.c b/genprotimg/src/utils/crypto.c
+index 96726095..7745b392 100644
+--- a/genprotimg/src/utils/crypto.c
++++ b/genprotimg/src/utils/crypto.c
+@@ -1079,8 +1079,8 @@ int store_set_verify_param(X509_STORE *store, GError **err)
+ 		g_abort();
+ 
+ 	/* The maximum depth level of the chain of trust for the verification of
+-	 * the IBM Z signing key is 2, i.e. IBM Z signing key -> (DigiCert)
+-	 * intermediate CA -> (DigiCert) root CA
++	 * the IBM Z signing key is 2, i.e. IBM Z signing key -> intermediate CA
++	 * -> root CA
+ 	 */
+ 	X509_VERIFY_PARAM_set_depth(param, 2);
+ 
+@@ -1267,46 +1267,38 @@ static int security_level_to_bits(int level)
+ 	return security_bits[level];
+ }
+ 
+-static ASN1_OCTET_STRING *digicert_assured_id_root_ca;
+-
+-const ASN1_OCTET_STRING *get_digicert_assured_id_root_ca_skid(void)
+-{
+-	pv_crypto_init();
+-	return digicert_assured_id_root_ca;
+-}
+-
+ /* Used for the caching of the downloaded CRLs */
+ static GHashTable *cached_crls;
+ 
+ void pv_crypto_init(void)
+ {
+-	if (digicert_assured_id_root_ca)
++	if (cached_crls)
+ 		return;
+-
+ 	cached_crls = g_hash_table_new_full(g_str_hash, g_str_equal, g_free,
+ 					    (GDestroyNotify)X509_CRL_free);
+-	digicert_assured_id_root_ca = s2i_ASN1_OCTET_STRING(
+-		NULL, NULL, DIGICERT_ASSURED_ID_ROOT_CA_SKID);
+ }
+ 
+ void pv_crypto_cleanup(void)
+ {
+-	if (!digicert_assured_id_root_ca)
++	if (!cached_crls)
+ 		return;
+ 	g_clear_pointer(&cached_crls, g_hash_table_destroy);
+-	g_clear_pointer(&digicert_assured_id_root_ca, ASN1_OCTET_STRING_free);
+ }
+ 
+ gint check_chain_parameters(const STACK_OF_X509 *chain,
+-			    const ASN1_OCTET_STRING *skid, GError **err)
++			    GError **err)
+ {
+-	const ASN1_OCTET_STRING *ca_skid = NULL;
++	const X509_NAME *ca_x509_subject = NULL;
++	g_autofree gchar *ca_subject = NULL;
+ 	gint len = sk_X509_num(chain);
+ 	X509 *ca = NULL;
+ 
+-	g_assert(skid);
+ 	/* at least one root and one leaf certificate must be defined */
+-	g_assert(len >= 2);
++	if (len < 2) {
++		g_set_error(err, PV_CRYPTO_ERROR, PV_CRYPTO_ERROR_INTERNAL,
++			    _("there must be at least on root and one leaf certificate in the chain of trust"));
++		return -1;
++	}
+ 
+ 	/* get the root certificate of the chain of trust */
+ 	ca = sk_X509_value(chain, len - 1);
+@@ -1316,19 +1308,21 @@ gint check_chain_parameters(const STACK_OF_X509 *chain,
+ 		return -1;
+ 	}
+ 
+-	ca_skid = X509_get0_subject_key_id(ca);
+-	if (!ca_skid) {
+-		g_set_error(err, PV_CRYPTO_ERROR, PV_CRYPTO_ERROR_MALFORMED_ROOT_CA,
+-			    _("malformed root certificate"));
++	ca_x509_subject = X509_get_subject_name(ca);
++	if (!ca_x509_subject) {
++		g_set_error(err, PV_CRYPTO_ERROR, PV_CRYPTO_ERROR_INTERNAL,
++			    _("subject of the root CA cannot be retrieved"));
+ 		return -1;
+ 	}
+ 
+-	if (ASN1_STRING_cmp(ca_skid, skid) != 0) {
+-		g_set_error(err, PV_CRYPTO_ERROR, PV_CRYPTO_ERROR_WRONG_CA_USED,
+-			    _("expecting DigiCert root CA to be used"));
++	ca_subject = X509_NAME_oneline(ca_x509_subject, NULL, 0);
++	if (!ca_subject) {
++		g_set_error(err, PV_CRYPTO_ERROR, PV_CRYPTO_ERROR_INTERNAL,
++			    _("subject name of the root CA cannot be retrieved"));
+ 		return -1;
+ 	}
+ 
++	g_info("Root CA used: '%s'", ca_subject);
+ 	return 0;
+ }
+ 
+diff --git a/genprotimg/src/utils/crypto.h b/genprotimg/src/utils/crypto.h
+index 3cda4507..fdf66de2 100644
+--- a/genprotimg/src/utils/crypto.h
++++ b/genprotimg/src/utils/crypto.h
+@@ -125,7 +125,6 @@ int check_crl_valid_for_cert(X509_CRL *crl, X509 *cert,
+ 			     gint verify_flags, GError **err);
+ void pv_crypto_init(void);
+ void pv_crypto_cleanup(void);
+-const ASN1_OCTET_STRING *get_digicert_assured_id_root_ca_skid(void);
+ gint verify_host_key(X509 *host_key, GSList *issuer_pairs,
+ 		     gint verify_flags, int level, GError **err);
+ X509 *load_cert_from_file(const char *path, GError **err);
+@@ -138,8 +137,7 @@ X509_STORE *store_setup(const gchar *root_ca_path,
+ int store_set_verify_param(X509_STORE *store, GError **err);
+ X509_CRL *load_crl_by_cert(X509 *cert, GError **err);
+ STACK_OF_X509_CRL *try_load_crls_by_certs(GSList *certs_with_path);
+-gint check_chain_parameters(const STACK_OF_X509 *chain,
+-			    const ASN1_OCTET_STRING *skid, GError **err);
++gint check_chain_parameters(const STACK_OF_X509 *chain, GError **err);
+ X509_NAME *c2b_name(const X509_NAME *name);
+ 
+ STACK_OF_X509 *delete_ibm_signing_certs(STACK_OF_X509 *certs);
+-- 
+2.25.1
+
diff --git a/debian/patches/series b/debian/patches/series
index bf63586..704198b 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -13,3 +13,5 @@ ee2c6d4-zipl-Allow-optional-entries-that-are-left-out-when-f.patch
 a9e13a2d-genprotimg-introduce-macro-for-the-control-flags-and.patch
 0906293c-genprotimg-enable-pckmo-and-disable-pckmo-are-mutual.patch
 5394cd36-genprotimg-add-PV-guest-dump-support.patch
+78b0533-genprotimg-remove-DigiCert-root-CA-pinning.patch
+673ff37-genprotimg-check_hostkeydoc-relax-default-issuer-che.patch