diff --git a/.fmf/version b/.fmf/version new file mode 100644 index 0000000..d00491f --- /dev/null +++ b/.fmf/version @@ -0,0 +1 @@ +1 diff --git a/plans/basic.fmf b/plans/basic.fmf new file mode 100644 index 0000000..a1bca5a --- /dev/null +++ b/plans/basic.fmf @@ -0,0 +1,9 @@ +summary: Basic test plan +prepare: + how: install + package: + - sblim-sfcb +discover: + how: fmf +execute: + how: tmt diff --git a/rpminspect.yaml b/rpminspect.yaml new file mode 100644 index 0000000..f82c3c2 --- /dev/null +++ b/rpminspect.yaml @@ -0,0 +1,9 @@ +--- +badfuncs: + allowed: + /usr/lib64/sfcb/libsfcHttpAdapter.so.*: + - inet_aton + +runpath: + allowed_paths: + - /usr/lib64/sfcb diff --git a/sblim-sfcb-1.4.9-docdir-license.patch b/sblim-sfcb-1.4.9-docdir-license.patch new file mode 100644 index 0000000..1262628 --- /dev/null +++ b/sblim-sfcb-1.4.9-docdir-license.patch @@ -0,0 +1,21 @@ +diff -up sblim-sfcb-1.4.9/Makefile.in.orig sblim-sfcb-1.4.9/Makefile.in +--- sblim-sfcb-1.4.9/Makefile.in.orig 2018-10-11 10:03:54.533549400 +0200 ++++ sblim-sfcb-1.4.9/Makefile.in 2018-10-11 10:04:12.199570473 +0200 +@@ -619,7 +619,7 @@ top_srcdir = @top_srcdir@ + # + # + AUTOMAKE_OPTIONS = no-dist-gzip dist-bzip2 +-sfcbdocdir = $(datadir)/doc/sfcb-$(VERSION) ++sfcbdocdir = $(datadir)/doc/sblim-sfcb + sfcbdatadir = $(datadir)/sfcb + sfcbconfdir = $(sysconfdir)/sfcb + sfcbstatedir = $(localstatedir)/lib/sfcb +@@ -908,7 +908,7 @@ dist_sfcbdata_DATA = default.reg 10_inte + nodist_bin_SCRIPTS = sfcbrepos sfcbstage sfcbunstage sfcbuuid + dist_bin_SCRIPTS = wbemcat xmltest + init_SCRIPTS = sfcb +-sfcbdoc_DATA = README AUTHORS COPYING ++sfcbdoc_DATA = README AUTHORS + sfcbconf_DATA = sfcb.cfg + @PAM_TRUE@dist_pam_DATA = pam/sfcb + @DOCS_TRUE@noinst_DATA = doc/html/index.html diff --git a/sblim-sfcb-1.4.9-fix-null-content-type-crash.patch b/sblim-sfcb-1.4.9-fix-null-content-type-crash.patch new file mode 100644 index 0000000..4009126 --- /dev/null +++ b/sblim-sfcb-1.4.9-fix-null-content-type-crash.patch @@ -0,0 +1,47 @@ +Author: Adam Majer +Summary: Fix crash caused by NULL content_type + +Also, allow requests with Content-Type set to text/xml + +==31976== Invalid read of size 1 +==31976== at 0x5883DEB: scanCimXmlRequest (cimXmlParserProcessed.c:1739) +==31976== by 0x588C88E: handleCimRequest (cimRequest.c:1850) +==31976== by 0x4E3D95A: doHttpRequest (httpAdapter.c:1399) +==31976== by 0x4E3EC96: handleHttpRequest (httpAdapter.c:1741) +==31976== by 0x4E3EC96: acceptRequest (httpAdapter.c:2022) +==31976== by 0x4E40B0C: httpDaemon (httpAdapter.c:2464) +==31976== by 0x404866: startHttpd (sfcBroker.c:540) +==31976== by 0x4038B3: main (sfcBroker.c:1062) +==31976== Address 0x0 is not stack'd, malloc'd or (recently) free'd +==31976== +==31976== +==31976== Process terminating with default action of signal 11 (SIGSEGV): dumping core +==31976== Access not within mapped region at address 0x0 +==31976== at 0x5883DEB: scanCimXmlRequest (cimXmlParserProcessed.c:1739) +==31976== by 0x588C88E: handleCimRequest (cimRequest.c:1850) +==31976== by 0x4E3D95A: doHttpRequest (httpAdapter.c:1399) +==31976== by 0x4E3EC96: handleHttpRequest (httpAdapter.c:1741) +==31976== by 0x4E3EC96: acceptRequest (httpAdapter.c:2022) +==31976== by 0x4E40B0C: httpDaemon (httpAdapter.c:2464) +==31976== by 0x404866: startHttpd (sfcBroker.c:540) +==31976== by 0x4038B3: main (sfcBroker.c:1062) + +(gdb) p *ctx +$3 = {cimDoc = 0x69058c0 "", principal = 0x0, host = 0x69054d9 "xxx.xx.xxx.xxx:5989", contentType = 0x0, teTrailers = 0, + sessionId = 1, role = 0x0, cimDocLength = 0, commHndl = 0xffefffab0, chunkFncs = 0x5044798 , + className = 0x0, operation = 0, verb = 0x6905480 "POST", path = 0x6905485 "/"} + +Index: sblim-sfcb-1.4.8/httpAdapter.c +=================================================================== +--- sblim-sfcb-1.4.8.orig/httpAdapter.c ++++ sblim-sfcb-1.4.8/httpAdapter.c +@@ -1047,7 +1047,7 @@ doHttpRequest(CommHndl conn_fd) + + inBuf.authorization = ""; + inBuf.protocol = "HTTP/1.1"; +- inBuf.content_type = NULL; ++ inBuf.content_type = "application/xml"; + inBuf.content_length = UINT_MAX; + inBuf.host = NULL; + inBuf.useragent = ""; + diff --git a/sblim-sfcb-1.4.9-fix-ppc-optimization-level.patch b/sblim-sfcb-1.4.9-fix-ppc-optimization-level.patch new file mode 100644 index 0000000..f1ebb45 --- /dev/null +++ b/sblim-sfcb-1.4.9-fix-ppc-optimization-level.patch @@ -0,0 +1,12 @@ +diff -up sblim-sfcb-1.4.9/configure.orig sblim-sfcb-1.4.9/configure +--- sblim-sfcb-1.4.9/configure.orig 2018-09-26 09:43:18.678547933 +0200 ++++ sblim-sfcb-1.4.9/configure 2018-09-26 09:43:31.603560105 +0200 +@@ -5426,8 +5426,6 @@ case $host_cpu in + $as_echo "#define SFCB_IX86 1" >>confdefs.h + + ;; +- powerpc*) CFLAGS="$CFLAGS -O0" +- ;; + esac + + diff --git a/sblim-sfcb-1.4.9-post-quantum.patch b/sblim-sfcb-1.4.9-post-quantum.patch new file mode 100644 index 0000000..16e64a4 --- /dev/null +++ b/sblim-sfcb-1.4.9-post-quantum.patch @@ -0,0 +1,77 @@ +diff -up sblim-sfcb-1.4.9/control.c.orig sblim-sfcb-1.4.9/control.c +--- sblim-sfcb-1.4.9/control.c.orig 2025-05-28 10:39:14.751599855 +0200 ++++ sblim-sfcb-1.4.9/control.c 2025-06-12 10:20:43.025624410 +0200 +@@ -171,10 +171,12 @@ static Control init[] = { + + {"sslKeyFilePath", CTL_STRING, SFCB_CONFDIR "/file.pem", {0}}, + {"sslCertificateFilePath", CTL_STRING, SFCB_CONFDIR "/server.pem", {0}}, ++ {"sslKeyFallbackFilePath", CTL_STRING, NULL, {0}}, ++ {"sslCertificateFallbackFilePath", CTL_STRING, NULL, {0}}, + {"sslCertList", CTL_STRING, SFCB_CONFDIR "/clist.pem", {0}}, + {"sslCiphers", CTL_STRING, "ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH", {0}}, + {"sslDhParamsFilePath", CTL_STRING, NULL, {0}}, +- {"sslEcDhCurveName", CTL_STRING, "secp384r1", {0}}, ++ {"sslEcDhCurveName", CTL_STRING, NULL, {0}}, + {"enableSslCipherServerPref", CTL_BOOL, NULL, {.b=0}}, + + {"registrationDir", CTL_STRING, SFCB_STATEDIR "/registration", {0}}, +diff -up sblim-sfcb-1.4.9/httpAdapter.c.orig sblim-sfcb-1.4.9/httpAdapter.c +--- sblim-sfcb-1.4.9/httpAdapter.c.orig 2025-05-21 10:41:30.727123823 +0200 ++++ sblim-sfcb-1.4.9/httpAdapter.c 2025-06-12 11:14:32.906455875 +0200 +@@ -2053,6 +2053,24 @@ initSSL() + _SFCB_TRACE(1, ("--- sslKeyFilePath = %s", fnk)); + if (SSL_CTX_use_PrivateKey_file(ctx, fnk, SSL_FILETYPE_PEM) != 1) + intSSLerror("Error loading private key from file"); ++ ++ /* ++ * Add fall back certificate/key pair ++ */ ++ getControlChars("sslCertificateFallbackFilePath", &fnc); ++ if (fnc) { ++ _SFCB_TRACE(1, ("--- sslCertificateFallbackFilePath = %s", fnc)); ++ if (SSL_CTX_use_certificate_chain_file(ctx, fnc) != 1) ++ intSSLerror("Error loading certificate fall back from file"); ++ } ++ ++ getControlChars("sslKeyFallbackFilePath", &fnk); ++ if (fnk) { ++ _SFCB_TRACE(1, ("--- sslKeyFallbackFilePath = %s", fnk)); ++ if (SSL_CTX_use_PrivateKey_file(ctx, fnk, SSL_FILETYPE_PEM) != 1) ++ intSSLerror("Error loading private key fall back from file"); ++ } ++ + getControlChars("sslClientCertificate", &fnl); + _SFCB_TRACE(1, ("--- sslClientCertificate = %s", fnl)); + getControlChars("sslCertList", &fcert); +diff -up sblim-sfcb-1.4.9/sfcb.cfg.pre.in.orig sblim-sfcb-1.4.9/sfcb.cfg.pre.in +--- sblim-sfcb-1.4.9/sfcb.cfg.pre.in.orig 2025-05-28 10:05:42.359932525 +0200 ++++ sblim-sfcb-1.4.9/sfcb.cfg.pre.in 2025-06-12 11:23:37.424277273 +0200 +@@ -244,6 +244,15 @@ sslKeyFilePath: @sysconfdir@/sfcb/file.p + ## Default is @sysconfdir@/sfcb/server.pem + sslCertificateFilePath: @sysconfdir@/sfcb/server.pem + ++## Filename containing the fall back private key for the server's fall back certificate. ++## The file must be in PEM format and may not be passphrase-protected. The file is ++## relevant for both client connect and indications sent via https. ++#sslKeyFallbackFilePath: @sysconfdir@/sfcb/file-fallback.pem ++ ++## Filename containing the server's fall back certificate. Must be in PEM format. ++## The file is relevant for both client connect and indications sent via https. ++#sslCertificateFallbackFilePath: @sysconfdir@/sfcb/server-fallback.pem ++ + ## Filename containing list of certificates server accepts. + ## The file is relevant client connect only. + ## Default is @sysconfdir@/sfcb/clist.pem +@@ -302,10 +311,10 @@ sslCiphers: ALL:!ADH:!LOW:!EXP:!MD5:@STR + ## Configure a curve name for ECDH ephemeral key generation. See man + ## SSL_CTX_set_tmp_ecdh(3) for details. The value should be a curve name + ## listed by the "openssl ecparam -list_curves" command in the SFCB runtime +-## environment. If this value is not set, the indicated default is in effect. ++## environment. If this value is not set, ECDH ephemeral key generation is not used. + ## If the value is set but the curve name is not recognized by the underlying + ## openssl implementation, SFCB will abort. +-## Default is secp384r1 ++## Default is: not set + #sslEcDhCurveName: secp384r1 + + ## When set to true, sets the SSL_OP_CIPHER_SERVER_PREFERENCE flag for the ssl diff --git a/sblim-sfcb.spec b/sblim-sfcb.spec index 43cc03c..c3e8c28 100644 --- a/sblim-sfcb.spec +++ b/sblim-sfcb.spec @@ -8,15 +8,16 @@ Name: sblim-sfcb Summary: Small Footprint CIM Broker URL: http://sblim.wiki.sourceforge.net/ Version: 1.4.9 -Release: 8%{?dist} -Group: Applications/System -License: EPL +Release: 38%{?dist} +License: EPL-1.0 Source0: http://downloads.sourceforge.net/sblim/%{name}-%{version}.tar.bz2 Source1: sfcb.service # Missing man pages Source2: sfcbdump.1.gz Source3: sfcbinst2mof.1.gz Source4: sfcbtrace.1.gz +# /etc/tmpfiles.d configuration file +Source5: sblim-sfcb.tmpfiles # Patch0: changes schema location to the path we use Patch0: sblim-sfcb-1.3.9-sfcbrepos-schema-location.patch # Patch1: Fix provider debugging - variable for stopping wait-for-debugger @@ -34,9 +35,21 @@ Patch5: sblim-sfcb-1.4.8-default-ecdh-curve-name.patch Patch6: sblim-sfcb-1.4.9-fix-ftbfs.patch # Patch7: fix possible null pointer dereference (CVE-2015-5185), rhbz#1255802 Patch7: sblim-sfcb-1.4.9-fix-null-deref.patch +# Patch8: fix null pointer (DoS) vulnerability via POST request to /cimom +# (CVE-2018-6644), patch by Adam Majer, rhbz#1543826 +Patch8: sblim-sfcb-1.4.9-fix-null-content-type-crash.patch +# Patch9: removes decrease of optimization level to -O0 on ppc64le +Patch9: sblim-sfcb-1.4.9-fix-ppc-optimization-level.patch +# Patch10: fixes docdir name and removes install of COPYING with license +# which is included through %%license +Patch10: sblim-sfcb-1.4.9-docdir-license.patch +# Patch11: adds configuration options to specify fallback SSL cert/key pair +# and disables default ECDH ephemeral key generation +Patch11: sblim-sfcb-1.4.9-post-quantum.patch Provides: cim-server = 0 Requires: cim-schema Requires: sblim-sfcCommon +BuildRequires: make BuildRequires: libcurl-devel BuildRequires: perl-generators BuildRequires: zlib-devel @@ -48,6 +61,7 @@ BuildRequires: sblim-cmpi-devel BuildRequires: systemd BuildRequires: sblim-sfcCommon-devel BuildRequires: openslp-devel +BuildRequires: gcc Requires(post): systemd-units Requires(preun): systemd-units Requires(postun): systemd-units @@ -62,19 +76,29 @@ Programming Interface (CMPI). %prep %setup -q -T -b 0 -n %{name}-%{version} -%patch0 -p1 -b .sfcbrepos-schema-location -%patch1 -p1 -b .fix-provider-debugging -%patch2 -p1 -b .maxMsgLen -%patch3 -p1 -b .service -%patch4 -p1 -b .multilib-man-cfg -%patch5 -p1 -b .default-ecdh-curve-name -%patch6 -p1 -b .fix-ftbfs -%patch7 -p1 -b .fix-null-deref +%patch -P0 -p1 -b .sfcbrepos-schema-location +%patch -P1 -p1 -b .fix-provider-debugging +%patch -P2 -p1 -b .maxMsgLen +%patch -P3 -p1 -b .service +%patch -P4 -p1 -b .multilib-man-cfg +%patch -P5 -p1 -b .default-ecdh-curve-name +%patch -P6 -p1 -b .fix-ftbfs +%patch -P7 -p1 -b .fix-null-deref +%patch -P8 -p1 -b .fix-null-content-type-crash +%patch -P9 -p1 -b .fix-ppc-optimization-level +%patch -P10 -p1 -b .docdir-license +%patch -P11 -p1 -b .post-quantum + +# Create a sysusers.d config file +cat >sblim-sfcb.sysusers.conf < _pkg_list - +echo "%%license COPYING" > _pkg_list find $RPM_BUILD_ROOT/%{_datadir}/sfcb -type f | grep -v $RPM_BUILD_ROOT/%{_datadir}/sfcb/CIM >> _pkg_list sed -i s?$RPM_BUILD_ROOT??g _pkg_list > _pkg_list_2 echo "%config(noreplace) %{_sysconfdir}/sfcb/*" >> _pkg_list echo "%config(noreplace) %{_sysconfdir}/pam.d/*" >> _pkg_list -echo "%doc %{_datadir}/doc/*" >> _pkg_list +echo "%doc %{_datadir}/doc/sblim-sfcb/[!COPYING]*" >> _pkg_list echo "%{_datadir}/man/man1/*" >> _pkg_list echo "%{_unitdir}/sblim-sfcb.service" >> _pkg_list echo "%{_localstatedir}/lib/sfcb" >> _pkg_list echo "%{_bindir}/*" >> _pkg_list -echo "%{_sbindir}/*" >> _pkg_list echo "%{_libdir}/sfcb/*.so.*" >> _pkg_list echo "%{_libdir}/sfcb/*.so" >> _pkg_list cat _pkg_list -%pre -/usr/bin/getent group sfcb >/dev/null || /usr/sbin/groupadd -r sfcb -/usr/sbin/usermod -a -G sfcb root > /dev/null 2>&1 || : +install -m0644 -D sblim-sfcb.sysusers.conf %{buildroot}%{_sysusersdir}/sblim-sfcb.conf +mkdir -p %{buildroot}/%{_tmpfilesdir} +install -p -D -m 644 %{SOURCE5} %{buildroot}/%{_tmpfilesdir}/sblim-sfcb.conf %post %{_datadir}/sfcb/genSslCert.sh %{_sysconfdir}/sfcb &>/dev/null || : /sbin/ldconfig -%{_bindir}/sfcbrepos -f > /dev/null 2>1 +%{_bindir}/sfcbrepos -f > /dev/null 2>&1 %systemd_post sblim-sfcb.service +# copy content of /var/lib/sfcb to temporary place for Image Mode +(mkdir -p /usr/share/factory/var/lib && cp -a /var/lib/sfcb /usr/share/factory/var/lib/sfcb) >/dev/null 2>&1 || : %preun %systemd_preun sblim-sfcb.service +if [ $1 -eq 0 ]; then + # Package removal, not upgrade + rm -rf /usr/share/factory/var/lib/sfcb +fi %postun /sbin/ldconfig %systemd_postun_with_restart sblim-sfcb.service -if [ $1 -eq 0 ]; then - /usr/sbin/groupdel sfcb > /dev/null 2>&1 || :; -fi; %files -f _pkg_list +%{_sysusersdir}/sblim-sfcb.conf +%{_tmpfilesdir}/sblim-sfcb.conf %changelog +* Fri Sep 12 2025 Vitezslav Crhonek - 1.4.9-38 +- Add support for Image Mode + +* Fri Jul 25 2025 Fedora Release Engineering - 1.4.9-37 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + +* Tue Jun 17 2025 Vitezslav Crhonek - 1.4.9-36 +- Update to better support post-quantum cryptography + +* Thu Mar 06 2025 Vitezslav Crhonek - 1.4.9-35 +- bin and sbin unification + +* Thu Jan 23 2025 Zbigniew Jędrzejewski-Szmek - 1.4.9-34 +- Add sysusers.d config file to allow rpm to create users/groups automatically + +* Sun Jan 19 2025 Fedora Release Engineering - 1.4.9-33 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + +* Sat Jul 20 2024 Fedora Release Engineering - 1.4.9-32 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + +* Sat Jan 27 2024 Fedora Release Engineering - 1.4.9-31 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Sat Jul 22 2023 Fedora Release Engineering - 1.4.9-30 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + +* Tue Feb 14 2023 Vitezslav Crhonek - 1.4.9-29 +- SPDX migration + +* Sat Jan 21 2023 Fedora Release Engineering - 1.4.9-28 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + +* Sat Jul 23 2022 Fedora Release Engineering - 1.4.9-27 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + +* Thu Jan 27 2022 Vitezslav Crhonek - 1.4.9-26 +- Change build flags, fix errors during the start of the service + +* Sat Jan 22 2022 Fedora Release Engineering - 1.4.9-25 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + +* Tue Sep 14 2021 Sahana Prasad - 1.4.9-24 +- Rebuilt with OpenSSL 3.0.0 + +* Fri Jul 23 2021 Fedora Release Engineering - 1.4.9-23 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + +* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek - 1.4.9-22 +- Rebuilt for updated systemd-rpm-macros + See https://pagure.io/fesco/issue/2583. + +* Wed Jan 27 2021 Fedora Release Engineering - 1.4.9-21 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + +* Wed Jul 29 2020 Fedora Release Engineering - 1.4.9-20 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + +* Wed Jul 08 2020 Vitezslav Crhonek - 1.4.9-19 +- Fix sfcbrepos redirection + +* Wed Feb 12 2020 Vitezslav Crhonek - 1.4.9-18 +- Fixes multiple definiton of variables (FTBFS with GCC 10) + Resolves: #1800074 + +* Thu Jan 30 2020 Fedora Release Engineering - 1.4.9-17 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + +* Fri Jul 26 2019 Fedora Release Engineering - 1.4.9-16 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + +* Sat Feb 02 2019 Fedora Release Engineering - 1.4.9-15 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + +* Thu Oct 11 2018 Vitezslav Crhonek - 1.4.9-14 +- Don't decrease optimization level to -O0 on ppc64le +- Use %%license for file which contains the text of the license +- Change versioned docdir to unversioned and rename the docdir to match + the package name +- Remove %%defattr + +* Mon Oct 08 2018 Vitezslav Crhonek - 1.4.9-13 +- Fix license tag + +* Sat Jul 14 2018 Fedora Release Engineering - 1.4.9-12 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild + +* Tue Feb 27 2018 Vitezslav Crhonek - 1.4.9-11 +- Add BuildRequires gcc + +* Wed Feb 14 2018 Vitezslav Crhonek - 1.4.9-10 +- Fix null pointer (DoS) vulnerability via POST request to /cimom (CVE-2018-6644) + (patch by Adam Majer) + Resolves: #1543825 + +* Fri Feb 09 2018 Fedora Release Engineering - 1.4.9-9 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild + * Thu Aug 03 2017 Fedora Release Engineering - 1.4.9-8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild diff --git a/sblim-sfcb.tmpfiles b/sblim-sfcb.tmpfiles new file mode 100644 index 0000000..897304c --- /dev/null +++ b/sblim-sfcb.tmpfiles @@ -0,0 +1,2 @@ +# populate /var/lib/sfcb with content from /usr/share/factory/var/lib/sfcb +C /var/lib/sfcb - - - - diff --git a/tests/post-quantum-cryptography/main.fmf b/tests/post-quantum-cryptography/main.fmf new file mode 100644 index 0000000..51ba4e2 --- /dev/null +++ b/tests/post-quantum-cryptography/main.fmf @@ -0,0 +1,6 @@ +summary: Post-quantum cryptography support test +author: Vitezslav Crhonek +contact: Vitezslav Crhonek +require: patch +duration: 10m +test: ./runtest.sh diff --git a/tests/post-quantum-cryptography/runtest.sh b/tests/post-quantum-cryptography/runtest.sh new file mode 100755 index 0000000..568b5b2 --- /dev/null +++ b/tests/post-quantum-cryptography/runtest.sh @@ -0,0 +1,76 @@ +#!/bin/sh -eux + +function check_key_and_cert() +{ + echo -e "\n===== key info" + ssh-keygen -l -f /etc/sfcb/file.pem || : + file /etc/sfcb/file.pem + echo -e "\n\n\n" + + echo -e "\n===== cert info" + openssl x509 -in /etc/sfcb/server.pem --text --noout + echo -e "\n\n\n" +} + +function test_key_exchange() +{ + echo -e "\n===== check that it uses TLS 1.3 and the X25519MLKEM768 key exchange by default if the peer supports it" + openssl s_client -connect localhost:5989 -CAfile /etc/sfcb/client.pem > /etc/sfcb/sfcb.cfg +echo "sslCertificateFallbackFilePath: /etc/sfcb/server-fallback.pem" >> /etc/sfcb/sfcb.cfg + +systemctl start sblim-sfcb +check_key_and_cert +test_cert_support