Errata Tool added a comment - 2024/04/30 10:16 AM Since the problem described in this issue should be resolved in a recent advisory, it has been closed. For information on the advisory (crypto-policies bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHEA-2024:2400

Clemens Lang added a comment - 2024/03/22 3:38 PM jafiala@redhat.com Looks good to me.

Alexander Sosedkin added a comment - 2024/03/22 3:35 PM Reviewed, doc text is OK.

Jan Fiala added a comment - 2024/03/19 3:34 PM Hi asosedki@redhat.com , I adjusted the doctext for the release note. Please review if it's accurate. Check specifically the last sentence, I changed the word order to make it easier to read, but there might be an unintended change in meaning.

Gabriela Fialova added a comment - 2024/01/19 3:03 PM This enhancement has been added into the tickets.yaml file for RHEL 9.4 Beta release notes.

Ondrej Moris added a comment - 2023/11/24 8:49 AM Successfully verified with crypto-policies-20231113-1.gite9247c2.el9. 1. DEFAULT policy has the same MACs as before, ETM and non-ETM :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: 1. DEFAULT policy has all MACs (same as in 9.3) :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ 14:45:37 ] :: [ PASS ] :: Command 'update-crypto-policies --set DEFAULT' (Expected 0, got 0) :: [ 14:45:37 ] :: [ PASS ] :: libssh (Expected 0, got 0) :: [ 14:45:37 ] :: [ PASS ] :: openssl client (Expected 0, got 0) :: [ 14:45:38 ] :: [ PASS ] :: openssh server (Expected 0, got 0) :: [ 14:45:38 ] :: [ PASS ] :: Command 'update-crypto-policies --set DEFAULT:ETM_ANY' (Expected 0, got 0) :: [ 14:45:38 ] :: [ PASS ] :: libssh (Expected 0, got 0) :: [ 14:45:38 ] :: [ PASS ] :: openssl client (Expected 0, got 0) :: [ 14:45:38 ] :: [ PASS ] :: openssh server (Expected 0, got 0) :: [ 14:45:39 ] :: [ PASS ] :: Command 'update-crypto-policies --set DEFAULT' (Expected 0, got 0) :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: Duration: 2s :: Assertions: 9 good, 0 bad :: RESULT: PASS (1. DEFAULT policy has all MACs (same as in 9.3)) 2. FIPS:OSPP uses etm@ssh = DISABLE_ETM has only non-ETM macs as before :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: 2. FIPS:OSPP uses etm@ssh = DISABLE_ETM, only non-ETM MACs (same as in 9.3) :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ 14:45:41 ] :: [ PASS ] :: Command 'update-crypto-policies --set FIPS:OSPP' (Expected 0, got 0) :: [ 14:45:41 ] :: [ PASS ] :: Command 'grep 'etm@libssh = DISABLE_ETM' /etc/crypto-policies/state/CURRENT.pol' (Expected 0, got 0) :: [ 14:45:41 ] :: [ PASS ] :: Command 'grep 'etm@openssh-client = DISABLE_ETM' /etc/crypto-policies/state/CURRENT.pol' (Expected 0, got 0) :: [ 14:45:42 ] :: [ PASS ] :: Command 'grep 'etm@openssh-server = DISABLE_ETM' /etc/crypto-policies/state/CURRENT.pol' (Expected 0, got 0) :: [ 14:45:42 ] :: [ PASS ] :: libssh (Expected 0, got 0) :: [ 14:45:42 ] :: [ PASS ] :: openssl client (Expected 0, got 0) :: [ 14:45:42 ] :: [ PASS ] :: openssh server (Expected 0, got 0) :: [ 14:45:42 ] :: [ PASS ] :: Command 'update-crypto-policies --set DEFAULT:DISABLE_ETM' (Expected 0, got 0) :: [ 14:45:42 ] :: [ PASS ] :: libssh (Expected 0, got 0) :: [ 14:45:42 ] :: [ PASS ] :: openssl client (Expected 0, got 0) :: [ 14:45:42 ] :: [ PASS ] :: openssh server (Expected 0, got 0) :: [ 14:45:43 ] :: [ PASS ] :: Command 'update-crypto-policies --set DEFAULT' (Expected 0, got 0) :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: Duration: 2s :: Assertions: 12 good, 0 bad :: RESULT: PASS (2. FIPS:OSPP uses etm@ssh = DISABLE_ETM, only non-ETM MACs (same as in 9.3)) 3. specifying etm@ssh = DISABLE_NON_ETM has ETM macs :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: 3. specifying etm@ssh = DISABLE_NON_ETM and no non-ETM MACs :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ 14:45:45 ] :: [ PASS ] :: Command 'update-crypto-policies --set DEFAULT:DISABLE_NON_ETM' (Expected 0, got 0) :: [ 14:45:45 ] :: [ PASS ] :: libssh (Expected 0, got 0) :: [ 14:45:45 ] :: [ PASS ] :: openssl client (Expected 0, got 0) :: [ 14:45:45 ] :: [ PASS ] :: openssh server (Expected 0, got 0) :: [ 14:45:46 ] :: [ PASS ] :: Command 'update-crypto-policies --set DEFAULT' (Expected 0, got 0) :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: Duration: 1s :: Assertions: 5 good, 0 bad :: RESULT: PASS (3. specifying etm@ssh = DISABLE_NON_ETM and has no non-ETM MACs) 4. ssh_etm = 1 works as before and outputs a deprecation warning :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: 4. ssh_etm = 1 works as before and outputs a deprecation warning :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ 14:45:50 ] :: [ PASS ] :: Command 'update-crypto-policies --set DEFAULT:SSH_ETM_1' (Expected 0, got 0) :: [ 14:45:50 ] :: [ PASS ] :: File '/var/tmp/rlRun_LOG.5FpHmtJM' should contain 'PolicySyntaxDeprecationWarning: Option ssh_etm = 1 is deprecated' :: [ 14:45:50 ] :: [ PASS ] :: File '/var/tmp/rlRun_LOG.5FpHmtJM' should contain 'please rewrite your rules using etm@ssh = any;' :: [ 14:45:50 ] :: [ PASS ] :: File '/var/tmp/rlRun_LOG.5FpHmtJM' should contain 'be advised that it is not always a 1-1 replacement' :: [ 14:45:50 ] :: [ PASS ] :: libssh (Expected 0, got 0) :: [ 14:45:50 ] :: [ PASS ] :: openssl client (Expected 0, got 0) :: [ 14:45:50 ] :: [ PASS ] :: openssh server (Expected 0, got 0) :: [ 14:45:50 ] :: [ PASS ] :: Command 'update-crypto-policies --set DEFAULT' (Expected 0, got 0) :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: Duration: 2s :: Assertions: 8 good, 0 bad :: RESULT: PASS (4. ssh_etm = 1 works as before and outputs a deprecation warning) 5. ssh_etm = 0 works as before and outputs a deprecation warning :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: 5. ssh_etm = 0 works as before and outputs a deprecation warning :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ 14:45:53 ] :: [ PASS ] :: Command 'update-crypto-policies --set DEFAULT:SSH_ETM_0' (Expected 0, got 0) :: [ 14:45:53 ] :: [ PASS ] :: File '/var/tmp/rlRun_LOG.gCgnMXl8' should contain 'PolicySyntaxDeprecationWarning: Option ssh_etm = 0 is deprecated' :: [ 14:45:53 ] :: [ PASS ] :: File '/var/tmp/rlRun_LOG.gCgnMXl8' should contain 'please rewrite your rules using etm@ssh = DISABLE_ETM;' :: [ 14:45:53 ] :: [ PASS ] :: File '/var/tmp/rlRun_LOG.gCgnMXl8' should contain 'be advised that it is not always a 1-1 replacement' :: [ 14:45:53 ] :: [ PASS ] :: libssh (Expected 0, got 0) :: [ 14:45:53 ] :: [ PASS ] :: openssl client (Expected 0, got 0) :: [ 14:45:53 ] :: [ PASS ] :: openssh server (Expected 0, got 0) :: [ 14:45:53 ] :: [ PASS ] :: Command 'update-crypto-policies --set DEFAULT' (Expected 0, got 0) :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: Duration: 1s :: Assertions: 8 good, 0 bad :: RESULT: PASS (5. ssh_etm = 0 works as before and outputs a deprecation warning) 6. it's documented in the manpages that the option is only meant to be used with the SSH scope # man crypto-policies ... etm: ANY/DISABLE_ETM/DISABLE_NON_ETM allows both EtM (Encrypt-then-Mac) and E&M (Encrypt-and-Mac), disables EtM, and disables E&M respectively.                         (Currently only implemented for SSH, do not use without @SSH scope.) For more details see results of   TC#615980 in   TR#435554 .

gitlab-bot added a comment - 2023/11/09 11:52 AM Clemens Lang mentioned this issue in a merge request of Red Hat / centos-stream / rpms / crypto-policies on branch c9s-rhel-15925-fixes : Update from upstream (scoped ssh_etm, deprecation warnings)

gitlab-bot added a comment - 2023/11/08 1:55 PM Clemens Lang mentioned this issue in a commit of Red Hat / centos-stream / rpms / crypto-policies on branch c10s : Update from upstream (chroot fips-mode-setup, etm@SSH)