Bug 1960266

Summary:	rebase crypto-policies to a version with scoped policies support
Product:	Red Hat Enterprise Linux 8	Reporter:	Alexander Sosedkin <asosedki>
Component:	crypto-policies	Assignee:	Alexander Sosedkin <asosedki>
Status:	CLOSED ERRATA	QA Contact:	Ondrej Moriš <omoris>
Severity:	unspecified	Docs Contact:	Mirek Jahoda <mjahoda>
Priority:	medium
Version:	8.5	CC:	jafiala, jtougne, mjahoda, omoris, pvrabec
Target Milestone:	beta	Keywords:	Rebase, Triaged
Target Release:	---	Flags:	pm-rhel: mirror+
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	crypto-policies-20210617-1.gitc776d3e.el8	Doc Type:	Enhancement
Doc Text:	.`crypto-policies` rebased to 20210617 The `crypto-policies` packages have been upgraded to upstream version 20210617, which provides a number of enhancements and bug fixes over the previous version, most notably: * You can now use scoped policies to enable different sets of algorithms for different back ends. Each configuration directive can now be limited to specific protocols, libraries, or services. For a complete list of available scopes and details on the new syntax, see the `crypto-policies(7)` man page. For example, the following directive allows using AES-256-CBC cipher with the SSH protocol, impacting both the `libssh` library and the OpenSSH suite: + ---- cipher@SSH = AES-256-CBC+ ---- * Directives can now use asterisks for specifying multiple values using wildcards. For example, the following directive disables all CBC mode ciphers for applications using `libssh`: + ---- cipher@libssh = -*-CBC ---- + Note that future updates can introduce new algorithms matched by the current wildcards.	Story Points:	---
Clone Of:
Clones:	2011208 (view as bug list)		Environment:
Last Closed:	2021-11-09 19:51:36 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2011208

Description Alexander Sosedkin 2021-05-13 13:36:52 UTC

Derived properties like `tls_cipher` are not affected by follow-up modifications of `cipher`,
confusing users (example: bz1933036).
Best way forward is to move away from them to a more coherently inheritable `cipher@TLS`
that is affected by `cipher` modifications. The support is now landed upstream.

Known QE concerns:
1) The parser is heavily rewritten. quite some upstream tests were added,
   but it wouldn't hurt to improve downstream coverage of malformed configs as well
2) This is new functionality anyway, we better at least smoke-test it downstream
3) Error/warning reporting was heavily redone.
   I've tried to keep it as close as possible to what was there,
   but somebody should have a look at it anyway.
   (see) -/Sanity/bad-policies
4) We should test that bz1933036 is now achievable by a mere `cipher = -*-CBC` =)

Known docs/backwards-compat concerns:
1) Old properties are still accepted and applied separately at the end of the policy,
   and print warnings suggesting to use new options,
   but rectifying the broken diamond inheritance can't happen without breaking backwards compat.
   We'll definitely need to have the need to review and migrate custom (sub)policies
   documented in release notes
   (draft: https://gitlab.com/redhat-crypto/fedora-crypto-policies/-/merge_requests/92#note_571831205).

Comment 3 Alexander Sosedkin 2021-06-18 14:38:11 UTC

*** Bug 1933036 has been marked as a duplicate of this bug. ***

Comment 18 errata-xmlrpc 2021-11-09 19:51:36 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (crypto-policies bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2021:4460