[Bug]: How does wolfssl deal with system-wide crypto policies?

[topazus]

Contact Details

No response

Version

5.7.0

Description

When packaging wolfssl on Fedora Linux, the rpmlint tool will report wolfssl.x86_64: W: crypto-policy-non-compliance-openssl /usr/lib64/libwolfssl.so.42.1.0 SSL_CTX_set_cipher_list, as the issue was raised on package review of wolfssl [1, 2]. Any ideas on the issue that how wolfssl deals with system-wide crypto policies?

[1] https://bugzilla.redhat.com/show_bug.cgi?id=2302646#c11
[2] https://docs.fedoraproject.org/en-US/packaging-guidelines/CryptoPolicies/#_new_crypto_libraries
[3] https://pagure.io/packaging-committee/issue/1390

Reproduction steps

No response

Relevant log output

No response

[topazus]

@douzzer @dgarske

[anhu]

Hi @topazus

Let me look into this for you. I'll check the links you referenced first. Please stay tuned.

Warm regards, Anthony

[anhu]

@topazus

I'm not sure I understand their objection. Is there an action that needs to be taken? The interaction is very confusing as there is back and forth about a security team that no longer exists in the same capacity.

Warm regards, Anthony

[topazus]

@decathorpe Fabio is proficient with Fedora crypto policies, would you mind sheding light on this?

cc @knight-of-ni

[decathorpe]

Short summary (I'm not at my PC right now):

There is a system-wide security policy for cryptography in Fedora. It defines which ciphers / algorithms are allowed to be used, and which are not. There are policies for OpenSSL, GnuTLS, OpenJDK, etc. They're loaded at runtime by these libraries, and applications are not allowed to override this policy without approval.

The policies are developed here:
https://gitlab.com/redhat-crypto/fedora-crypto-policies

It sounds like WolfSSL doesn't have a mechanism to load such a policy at runtime, which is a problem for Fedora - new libraries that implement cryptography MUST follow the system-wide policy, unless granted an explicit exception.

[anhu]

Interesting. Thanks for the summary of the situation. Is there a procedure for getting the exception?

Warm regards, Anthony

[topazus]

Wolfssl package is disapproved and retired for now.
https://pagure.io/fesco/issue/3267#comment-929888

[anhu]

@decathorpe ,

Are you saying we need to be able to parse files like this: https://gitlab.com/redhat-crypto/fedora-crypto-policies/-/blob/master/policies/DEFAULT.pol?ref_type=heads

....and then only allow usage of the algorithms specified in there?

Warm regards, Anthony

[decathorpe]

Actual installed policy files are parsed from these .pol files and look a bit different, they're available in /usr/share/crypto-policies/ (etc.) on an installed Fedora Linux system.

There are policies in different formats for different applications, I assume that one in a specific format for wolfSSL could be added here, too.

[anhu]

@decathorpe , Thank you so much for these explanations. They make a lot of sense now.

In my mind this seems like a feature request.

@topazus , Can you please send a message to support@wolfssl.com referencing this github issue asking for a feature request?

I will now close this as the conversation will continue in our technical support system.

Warm regards, Anthony