[PATCH common 0/2] ticket: sign RSA tickets with SHA-256

[Mark Atwood <mark@wolfssl.com>]

RSA tickets are currently signed with SHA-1, because that is the
Crypt::OpenSSL::RSA default. NIST SP 800-131A Rev. 2 disallows SHA-1 for
creating signatures. With a FIPS provider that enforces this, such as
wolfProvider or the OpenSSL FIPS provider with its signature digest
check enabled, the signing call fails and nobody can log in.

The change is split in two so that it can be staged for clusters with
mixed versions, where an updated node forwards its tickets to nodes
that are not updated yet:

1/2 makes verification accept SHA-256 as well as SHA-1. It changes no
    issued ticket and can be applied right away.
2/2 switches signing to SHA-256. Nodes without 1/2 reject the new
    tickets, so this should go in once 1/2 has been in a released
    version for a while, for example with the next major release.

The SHA-1 verification fallback can be dropped in a later major release,
once no supported version signs with SHA-1 anymore. Tickets are only
valid for two hours, so it does not need to cover old tickets, only
nodes running old versions.

Tested with "make check" on Debian trixie with the build dependencies
from pve-no-subscription. The new test fails on master for the SHA-256
cases and, with only 1/2 applied, for the signing checks of 2/2. I also
checked a ticket issued with the series applied with
"openssl dgst -sha256 -verify", which accepts it, and with -sha1, which
rejects it.

A separate patch for pve-access-control removes the leftover SHA-1 CSRF
token fallback there.

Mark Atwood (2):
  ticket: accept RSA tickets signed with SHA-256
  ticket: sign RSA tickets with SHA-256

 src/PVE/Ticket.pm   |  19 ++++++++-
 test/Makefile       |   1 +
 test/ticket_test.pl | 102 ++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 121 insertions(+), 1 deletion(-)
 create mode 100755 test/ticket_test.pl


base-commit: d3e8405874f43e4a128a11d7ce829102fda2eefd
-- 
2.55.0