[Backport][ipa-4-6] Vault: Migrate to RSA-OAEP

[f-trivino]

This PR was opened manually because PR #6959 was pushed to master and backport to ipa-4-6 is required.

[f-trivino]

WIP as I need to test well.

[f-trivino]

Hi @rcritten, @flo-renaud

I spawned RHEL7.9 server and client:

RHEL7.9 server/client with the patches in normal mode (KRA uses PKCS1v15), keyWrap.useOAEP is not in the CS.cfg file:

• vault-add works from the server
• vault-archive works from the server
• vault-retrieve works from the server
• vault-del works from the server
• vault-add works from the client
• vault-archive works from the client
• vault-retrieve works from the client
• vault-del works from the client

I manually added UseOAEP in the KRA, and restarted pki-tomcatd@pki-tomcat.service, then:

• vault-add works from the server
• vault-archive works from the server
• vault-retrieve works from the server
• vault-del works from the server
• vault-add works from the client
• vault-archive works from the client
• vault-retrieve works from the client
• vault-del works from the client

running with pki-kra-10.5.18-27.el7_9.noarch.

[flo-renaud]

Hi @f-trivino
I applied the patch on a RHEL 7.9 server in FIPS mode and tried to call ipa vault-add from a fedora38 FIPS client using source code from the master branch (with dnf copr enable @freeipa/freeipa-master-nightly). ipa vault-add is failing because the following patches were not backported to RHEL 7.9:
Support AES for KRA archival wrapping
Set AES as default for KRA archival wrapping

The 7.9 server answers to vaultconfig-show with a result containing only the transport cert. With recent versions the result also contains wrapping_supported_algorithms and wrapping_default_algorithm.
If this info is not present in the result of vaultconfig-show, the client assumes that the wrapping algo is 3DES and fails:

# python3  /usr/bin/ipa vault-add clientvault --password Secret123
ipa: ERROR: non-public: ValueError: non-generic 'ValidationError' needs format=None; got format="'des-ede3-cbc' is not a supported vault wrapping algorithm"
Traceback (most recent call last):
  File "/usr/lib/python3.11/site-packages/ipalib/backend.py", line 141, in execute
    return self.Command[_name](*args, **options)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/ipalib/frontend.py", line 471, in __call__
    return self.__do_call(*args, **options)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/ipalib/frontend.py", line 499, in __do_call
    ret = self.run(*args, **options)
          ^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/ipalib/frontend.py", line 1224, in run
    return self.forward(*args, **options)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/ipaclient/plugins/vault.py", line 356, in forward
    self.api.Command.vault_archive(*args, **opts)
  File "/usr/lib/python3.11/site-packages/ipalib/frontend.py", line 471, in __call__
    return self.__do_call(*args, **options)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/ipalib/frontend.py", line 499, in __do_call
    ret = self.run(*args, **options)
          ^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/ipalib/frontend.py", line 1224, in run
    return self.forward(*args, **options)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/ipaclient/plugins/vault.py", line 963, in forward
    self.api.Command.vault_retrieve(*args, **opts)
  File "/usr/lib/python3.11/site-packages/ipalib/frontend.py", line 471, in __call__
    return self.__do_call(*args, **options)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/ipalib/frontend.py", line 499, in __do_call
    ret = self.run(*args, **options)
          ^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/ipalib/frontend.py", line 1224, in run
    return self.forward(*args, **options)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/ipaclient/plugins/vault.py", line 1156, in forward
    algo = self._generate_session_key(wrapping_algo)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/ipaclient/plugins/vault.py", line 659, in _generate_session_key
    raise errors.ValidationError(msg.format(algo=repr(name)))
          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/ipalib/errors.py", line 269, in __init__
    messages.process_message_arguments(self, format, message, **kw)
  File "/usr/lib/python3.11/site-packages/ipalib/messages.py", line 61, in process_message_arguments
    raise ValueError(
ValueError: non-generic 'ValidationError' needs format=None; got format="'des-ede3-cbc' is not a supported vault wrapping algorithm"
ipa: ERROR: an internal error has occurred

[f-trivino]

@flo-renaud I believe this is ready now. I'm removing temp_commit (passing tests are here: http://freeipa-org-pr-ci.s3-website.eu-central-1.amazonaws.com/jobs/3974dc32-ca6f-11ee-9f92-fa163eeea21a/)

I also did some manual testing with rhel7.9 server and rhel9.4 client with all patches:

Without FIPS:

• vaultconfig-show (from client and server)
• vault-(add, archive, retrieve, del) type standard (from client and server)
• vault-(add, archive, retrieve, del) type symmetric (from client and server)
• vault-(add, archive, retrieve, del) type asymmetric (from client and server)

With FIPS:

• vaultconfig-show (server)
• vault-(add, archive, retrieve, del) type standard (server)
• vault-(add, archive, retrieve, del) type symmetric (server)
• vault-(add, archive, retrieve, del) type asymmetric (server)