Fix null pointer (DoS) vulnerability via POST request to /cimom (CVE-2018-6644)

2018-02-14 10:54:26 +01:00
10 changed files with 24 additions and 354 deletions
--- a/.fmf/version
+++ b/.fmf/version
@ -1 +0,0 @@
-1
--- a/plans/basic.fmf
+++ b/plans/basic.fmf
@ -1,9 +0,0 @@
-summary: Basic test plan
-prepare:
-    how: install
-    package:
-        - sblim-sfcb
-discover:
-    how: fmf
-execute:
-    how: tmt
--- a/rpminspect.yaml
+++ b/rpminspect.yaml
@ -1,9 +0,0 @@
---
-badfuncs:
-    allowed:
-        /usr/lib64/sfcb/libsfcHttpAdapter.so.*:
-            - inet_aton
-
-runpath:
-    allowed_paths:
-        - /usr/lib64/sfcb
--- a/sblim-sfcb-1.4.9-docdir-license.patch
+++ b/sblim-sfcb-1.4.9-docdir-license.patch
@ -1,21 +0,0 @@
-diff -up sblim-sfcb-1.4.9/Makefile.in.orig sblim-sfcb-1.4.9/Makefile.in
--- sblim-sfcb-1.4.9/Makefile.in.orig	2018-10-11 10:03:54.533549400 +0200
-+++ sblim-sfcb-1.4.9/Makefile.in	2018-10-11 10:04:12.199570473 +0200
-@@ -619,7 +619,7 @@ top_srcdir = @top_srcdir@
- # 
- # 
- AUTOMAKE_OPTIONS = no-dist-gzip dist-bzip2
-sfcbdocdir = $(datadir)/doc/sfcb-$(VERSION)
-+sfcbdocdir = $(datadir)/doc/sblim-sfcb
- sfcbdatadir = $(datadir)/sfcb
- sfcbconfdir = $(sysconfdir)/sfcb
- sfcbstatedir = $(localstatedir)/lib/sfcb
-@@ -908,7 +908,7 @@ dist_sfcbdata_DATA = default.reg 10_inte
- nodist_bin_SCRIPTS = sfcbrepos sfcbstage sfcbunstage sfcbuuid
- dist_bin_SCRIPTS = wbemcat xmltest
- init_SCRIPTS = sfcb
-sfcbdoc_DATA = README AUTHORS COPYING
-+sfcbdoc_DATA = README AUTHORS
- sfcbconf_DATA = sfcb.cfg
- @PAM_TRUE@dist_pam_DATA = pam/sfcb
- @DOCS_TRUE@noinst_DATA = doc/html/index.html
--- a/sblim-sfcb-1.4.9-fix-ppc-optimization-level.patch
+++ b/sblim-sfcb-1.4.9-fix-ppc-optimization-level.patch
@ -1,12 +0,0 @@
-diff -up sblim-sfcb-1.4.9/configure.orig sblim-sfcb-1.4.9/configure
--- sblim-sfcb-1.4.9/configure.orig	2018-09-26 09:43:18.678547933 +0200
-+++ sblim-sfcb-1.4.9/configure	2018-09-26 09:43:31.603560105 +0200
-@@ -5426,8 +5426,6 @@ case $host_cpu in
- $as_echo "#define SFCB_IX86 1" >>confdefs.h
- 
- 	       ;;
-     powerpc*)  CFLAGS="$CFLAGS -O0"
-	       ;;
- esac
- 
- 
--- a/sblim-sfcb-1.4.9-post-quantum.patch
+++ b/sblim-sfcb-1.4.9-post-quantum.patch
@ -1,77 +0,0 @@
-diff -up sblim-sfcb-1.4.9/control.c.orig sblim-sfcb-1.4.9/control.c
--- sblim-sfcb-1.4.9/control.c.orig	2025-05-28 10:39:14.751599855 +0200
-+++ sblim-sfcb-1.4.9/control.c	2025-06-12 10:20:43.025624410 +0200
-@@ -171,10 +171,12 @@ static Control init[] = {
- 
-   {"sslKeyFilePath", CTL_STRING, SFCB_CONFDIR "/file.pem", {0}},
-   {"sslCertificateFilePath", CTL_STRING, SFCB_CONFDIR "/server.pem", {0}},
-+  {"sslKeyFallbackFilePath", CTL_STRING, NULL, {0}},
-+  {"sslCertificateFallbackFilePath", CTL_STRING, NULL, {0}},
-   {"sslCertList", CTL_STRING, SFCB_CONFDIR "/clist.pem", {0}},
-   {"sslCiphers", CTL_STRING, "ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH", {0}},
-   {"sslDhParamsFilePath", CTL_STRING, NULL, {0}},
-  {"sslEcDhCurveName", CTL_STRING, "secp384r1", {0}},
-+  {"sslEcDhCurveName", CTL_STRING, NULL, {0}},
-   {"enableSslCipherServerPref", CTL_BOOL, NULL, {.b=0}},
- 
-   {"registrationDir", CTL_STRING, SFCB_STATEDIR "/registration", {0}},
-diff -up sblim-sfcb-1.4.9/httpAdapter.c.orig sblim-sfcb-1.4.9/httpAdapter.c
--- sblim-sfcb-1.4.9/httpAdapter.c.orig	2025-05-21 10:41:30.727123823 +0200
-+++ sblim-sfcb-1.4.9/httpAdapter.c	2025-06-12 11:14:32.906455875 +0200
-@@ -2053,6 +2053,24 @@ initSSL()
-   _SFCB_TRACE(1, ("---  sslKeyFilePath = %s", fnk));
-   if (SSL_CTX_use_PrivateKey_file(ctx, fnk, SSL_FILETYPE_PEM) != 1)
-     intSSLerror("Error loading private key from file");
-+
-+  /*
-+   *  Add fall back certificate/key pair
-+   */
-+  getControlChars("sslCertificateFallbackFilePath", &fnc);
-+  if (fnc) {
-+    _SFCB_TRACE(1, ("---  sslCertificateFallbackFilePath = %s", fnc));
-+    if (SSL_CTX_use_certificate_chain_file(ctx, fnc) != 1)
-+      intSSLerror("Error loading certificate fall back from file");
-+  }
-+
-+  getControlChars("sslKeyFallbackFilePath", &fnk);
-+  if (fnk) {
-+    _SFCB_TRACE(1, ("---  sslKeyFallbackFilePath = %s", fnk));
-+    if (SSL_CTX_use_PrivateKey_file(ctx, fnk, SSL_FILETYPE_PEM) != 1)
-+      intSSLerror("Error loading private key fall back from file");
-+  }
-+
-   getControlChars("sslClientCertificate", &fnl);
-   _SFCB_TRACE(1, ("---  sslClientCertificate = %s", fnl));
-   getControlChars("sslCertList", &fcert);
-diff -up sblim-sfcb-1.4.9/sfcb.cfg.pre.in.orig sblim-sfcb-1.4.9/sfcb.cfg.pre.in
--- sblim-sfcb-1.4.9/sfcb.cfg.pre.in.orig	2025-05-28 10:05:42.359932525 +0200
-+++ sblim-sfcb-1.4.9/sfcb.cfg.pre.in	2025-06-12 11:23:37.424277273 +0200
-@@ -244,6 +244,15 @@ sslKeyFilePath: @sysconfdir@/sfcb/file.p
- ## Default is @sysconfdir@/sfcb/server.pem
- sslCertificateFilePath: @sysconfdir@/sfcb/server.pem
- 
-+## Filename containing the fall back private key for the server's fall back certificate.
-+## The file  must be in PEM format and may not be passphrase-protected. The file is
-+## relevant for both client connect and indications sent via https.
-+#sslKeyFallbackFilePath: @sysconfdir@/sfcb/file-fallback.pem
-+
-+## Filename containing the server's fall back certificate. Must be in PEM format.
-+## The file is relevant for both client connect and indications sent via https.
-+#sslCertificateFallbackFilePath: @sysconfdir@/sfcb/server-fallback.pem
-+
- ## Filename containing list of certificates server accepts.
- ## The file is relevant client connect only.
- ## Default is @sysconfdir@/sfcb/clist.pem
-@@ -302,10 +311,10 @@ sslCiphers: ALL:!ADH:!LOW:!EXP:!MD5:@STR
- ## Configure a curve name for ECDH ephemeral key generation. See man
- ## SSL_CTX_set_tmp_ecdh(3) for details. The value should be a curve name
- ## listed by the "openssl ecparam -list_curves" command in the SFCB runtime
-## environment. If this value is not set, the indicated default is in effect.
-+## environment. If this value is not set, ECDH ephemeral key generation is not used.
- ## If the value is set but the curve name is not recognized by the underlying
- ## openssl implementation, SFCB will abort.
-## Default is secp384r1
-+## Default is: not set
- #sslEcDhCurveName: secp384r1
- 
- ## When set to true, sets the SSL_OP_CIPHER_SERVER_PREFERENCE flag for the ssl
--- a/sblim-sfcb.spec
+++ b/sblim-sfcb.spec
@ -8,16 +8,14 @@ Name: sblim-sfcb
 Summary: Small Footprint CIM Broker
 URL: http://sblim.wiki.sourceforge.net/
 Version: 1.4.9
-Release: 38%{?dist}
-License: EPL-1.0
+Release: 9%{?dist}
+License: EPL
 Source0: http://downloads.sourceforge.net/sblim/%{name}-%{version}.tar.bz2
 Source1: sfcb.service
 # Missing man pages
 Source2: sfcbdump.1.gz
 Source3: sfcbinst2mof.1.gz
 Source4: sfcbtrace.1.gz
-# /etc/tmpfiles.d configuration file
-Source5: sblim-sfcb.tmpfiles
 # Patch0: changes schema location to the path we use
 Patch0: sblim-sfcb-1.3.9-sfcbrepos-schema-location.patch
 # Patch1: Fix provider debugging - variable for stopping wait-for-debugger
@ -38,18 +36,9 @@ Patch7: sblim-sfcb-1.4.9-fix-null-deref.patch
 # Patch8: fix null pointer (DoS) vulnerability via POST request to /cimom
 #   (CVE-2018-6644), patch by Adam Majer, rhbz#1543826
 Patch8: sblim-sfcb-1.4.9-fix-null-content-type-crash.patch
-# Patch9: removes decrease of optimization level to -O0 on ppc64le
-Patch9: sblim-sfcb-1.4.9-fix-ppc-optimization-level.patch
-# Patch10: fixes docdir name and removes install of COPYING with license
-#   which is included through %%license
-Patch10: sblim-sfcb-1.4.9-docdir-license.patch
-# Patch11: adds configuration options to specify fallback SSL cert/key pair
-#   and disables default ECDH ephemeral key generation
-Patch11: sblim-sfcb-1.4.9-post-quantum.patch
 Provides: cim-server = 0
 Requires: cim-schema
 Requires: sblim-sfcCommon
-BuildRequires: make
 BuildRequires: libcurl-devel
 BuildRequires: perl-generators
 BuildRequires: zlib-devel
@ -61,7 +50,6 @@ BuildRequires: sblim-cmpi-devel
 BuildRequires: systemd
 BuildRequires: sblim-sfcCommon-devel
 BuildRequires: openslp-devel
-BuildRequires: gcc
 Requires(post): systemd-units
 Requires(preun): systemd-units
 Requires(postun): systemd-units
@ -76,29 +64,20 @@ Programming Interface (CMPI).

 %prep
 %setup -q -T -b 0 -n %{name}-%{version}
-%patch -P0 -p1 -b .sfcbrepos-schema-location
-%patch -P1 -p1 -b .fix-provider-debugging
-%patch -P2 -p1 -b .maxMsgLen
-%patch -P3 -p1 -b .service
-%patch -P4 -p1 -b .multilib-man-cfg
-%patch -P5 -p1 -b .default-ecdh-curve-name
-%patch -P6 -p1 -b .fix-ftbfs
-%patch -P7 -p1 -b .fix-null-deref
-%patch -P8 -p1 -b .fix-null-content-type-crash
-%patch -P9 -p1 -b .fix-ppc-optimization-level
-%patch -P10 -p1 -b .docdir-license
-%patch -P11 -p1 -b .post-quantum
-
-# Create a sysusers.d config file
-cat >sblim-sfcb.sysusers.conf <<EOF
-g sfcb -
-m root sfcb
-EOF
+%patch0 -p1 -b .sfcbrepos-schema-location
+%patch1 -p1 -b .fix-provider-debugging
+%patch2 -p1 -b .maxMsgLen
+%patch3 -p1 -b .service
+%patch4 -p1 -b .multilib-man-cfg
+%patch5 -p1 -b .default-ecdh-curve-name
+%patch6 -p1 -b .fix-ftbfs
+%patch7 -p1 -b .fix-null-deref
+%patch8 -p1 -b .fix-null-content-type-crash

 %build
 %configure --enable-debug --enable-uds --enable-ssl --enable-pam --enable-ipv6 \
    --enable-slp --enable-large_volume_support --enable-optimized-enumeration --enable-relax-mofsyntax \
-    CFLAGS="$CFLAGS -D_GNU_SOURCE -fPIE -DPIE -fcommon" LDFLAGS="$LDFLAGS -Wl,-z,now -pie"
+    CFLAGS="$CFLAGS -D_GNU_SOURCE -fPIE -DPIE" LDFLAGS="$LDFLAGS -Wl,-z,now -pie"
 
 make 

@ -113,147 +92,51 @@ cp %{SOURCE2} %{SOURCE3} %{SOURCE4} $RPM_BUILD_ROOT/%{_mandir}/man1/
 # remove unused static libraries and so files
 rm -f $RPM_BUILD_ROOT/%{_libdir}/sfcb/*.la

-echo "%%license COPYING" > _pkg_list
+echo "%defattr(-,root,root,-)" > _pkg_list
+
 find $RPM_BUILD_ROOT/%{_datadir}/sfcb -type f | grep -v $RPM_BUILD_ROOT/%{_datadir}/sfcb/CIM >> _pkg_list
 sed -i s?$RPM_BUILD_ROOT??g _pkg_list > _pkg_list_2
 echo "%config(noreplace) %{_sysconfdir}/sfcb/*" >> _pkg_list
 echo "%config(noreplace) %{_sysconfdir}/pam.d/*" >> _pkg_list
-echo "%doc %{_datadir}/doc/sblim-sfcb/[!COPYING]*" >> _pkg_list
+echo "%doc %{_datadir}/doc/*" >> _pkg_list
 echo "%{_datadir}/man/man1/*" >> _pkg_list
 echo "%{_unitdir}/sblim-sfcb.service" >> _pkg_list
 echo "%{_localstatedir}/lib/sfcb" >> _pkg_list
 echo "%{_bindir}/*" >> _pkg_list
+echo "%{_sbindir}/*" >> _pkg_list
 echo "%{_libdir}/sfcb/*.so.*" >> _pkg_list
 echo "%{_libdir}/sfcb/*.so" >> _pkg_list

 cat _pkg_list

-install -m0644 -D sblim-sfcb.sysusers.conf %{buildroot}%{_sysusersdir}/sblim-sfcb.conf
-mkdir -p %{buildroot}/%{_tmpfilesdir}
-install -p -D -m 644 %{SOURCE5} %{buildroot}/%{_tmpfilesdir}/sblim-sfcb.conf
+%pre
+/usr/bin/getent group sfcb >/dev/null || /usr/sbin/groupadd -r sfcb
+/usr/sbin/usermod -a -G sfcb root > /dev/null 2>&1 || :

 %post 
 %{_datadir}/sfcb/genSslCert.sh %{_sysconfdir}/sfcb &>/dev/null || :
 /sbin/ldconfig
-%{_bindir}/sfcbrepos -f > /dev/null 2>&1
+%{_bindir}/sfcbrepos -f > /dev/null 2>1
 %systemd_post sblim-sfcb.service
-# copy content of /var/lib/sfcb to temporary place for Image Mode
-(mkdir -p /usr/share/factory/var/lib && cp -a /var/lib/sfcb /usr/share/factory/var/lib/sfcb) >/dev/null 2>&1 || :

 %preun
 %systemd_preun sblim-sfcb.service
-if [ $1 -eq 0 ]; then
-   # Package removal, not upgrade
-   rm -rf /usr/share/factory/var/lib/sfcb
-fi

 %postun
 /sbin/ldconfig
 %systemd_postun_with_restart sblim-sfcb.service
+if [ $1 -eq 0 ]; then
+        /usr/sbin/groupdel sfcb > /dev/null 2>&1 || :;
+fi;

 %files -f _pkg_list
-%{_sysusersdir}/sblim-sfcb.conf
-%{_tmpfilesdir}/sblim-sfcb.conf

 %changelog
-* Fri Sep 12 2025 Vitezslav Crhonek <vcrhonek@redhat.com> - 1.4.9-38
- Add support for Image Mode
-
-* Fri Jul 25 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.9-37
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
-
-* Tue Jun 17 2025 Vitezslav Crhonek <vcrhonek@redhat.com> - 1.4.9-36
- Update to better support post-quantum cryptography
-
-* Thu Mar 06 2025 Vitezslav Crhonek <vcrhonek@redhat.com> - 1.4.9-35
- bin and sbin unification
-
-* Thu Jan 23 2025 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.4.9-34
- Add sysusers.d config file to allow rpm to create users/groups automatically
-
-* Sun Jan 19 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.9-33
- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
-
-* Sat Jul 20 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.9-32
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
-
-* Sat Jan 27 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.9-31
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-
-* Sat Jul 22 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.9-30
- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
-
-* Tue Feb 14 2023 Vitezslav Crhonek <vcrhonek@redhat.com> - 1.4.9-29
- SPDX migration
-
-* Sat Jan 21 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.9-28
- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
-
-* Sat Jul 23 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.9-27
- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
-
-* Thu Jan 27 2022 Vitezslav Crhonek <vcrhonek@redhat.com> - 1.4.9-26
- Change build flags, fix errors during the start of the service
-
-* Sat Jan 22 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.9-25
- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
-
-* Tue Sep 14 2021 Sahana Prasad <sahana@redhat.com> - 1.4.9-24
- Rebuilt with OpenSSL 3.0.0
-
-* Fri Jul 23 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.9-23
- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
-
-* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.4.9-22
- Rebuilt for updated systemd-rpm-macros
-  See https://pagure.io/fesco/issue/2583.
-
-* Wed Jan 27 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.9-21
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
-
-* Wed Jul 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.9-20
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
-
-* Wed Jul 08 2020 Vitezslav Crhonek <vcrhonek@redhat.com> - 1.4.9-19
- Fix sfcbrepos redirection
-
-* Wed Feb 12 2020 Vitezslav Crhonek <vcrhonek@redhat.com> - 1.4.9-18
- Fixes multiple definiton of variables (FTBFS with GCC 10)
-  Resolves: #1800074
-
-* Thu Jan 30 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.9-17
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
-
-* Fri Jul 26 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.9-16
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
-
-* Sat Feb 02 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.9-15
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
-
-* Thu Oct 11 2018 Vitezslav Crhonek <vcrhonek@redhat.com> - 1.4.9-14
- Don't decrease optimization level to -O0 on ppc64le
- Use %%license for file which contains the text of the license
- Change versioned docdir to unversioned and rename the docdir to match
-  the package name
- Remove %%defattr
-
-* Mon Oct 08 2018 Vitezslav Crhonek <vcrhonek@redhat.com> - 1.4.9-13
- Fix license tag
-
-* Sat Jul 14 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.9-12
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
-
-* Tue Feb 27 2018 Vitezslav Crhonek <vcrhonek@redhat.com> - 1.4.9-11
- Add BuildRequires gcc
-
-* Wed Feb 14 2018 Vitezslav Crhonek <vcrhonek@redhat.com> - 1.4.9-10
+* Wed Feb 14 2018 Vitezslav Crhonek <vcrhonek@redhat.com> - 1.4.9-9
 - Fix null pointer (DoS) vulnerability via POST request to /cimom (CVE-2018-6644)
  (patch by Adam Majer)
  Resolves: #1543825

-* Fri Feb 09 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.9-9
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
-
 * Thu Aug 03 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.9-8
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild

--- a/sblim-sfcb.tmpfiles
+++ b/sblim-sfcb.tmpfiles
@ -1,2 +0,0 @@
-# populate /var/lib/sfcb with content from /usr/share/factory/var/lib/sfcb
-C /var/lib/sfcb - - - -
--- a/tests/post-quantum-cryptography/main.fmf
+++ b/tests/post-quantum-cryptography/main.fmf
@ -1,6 +0,0 @@
-summary: Post-quantum cryptography support test
-author: Vitezslav Crhonek <vcrhonek@redhat.com>
-contact: Vitezslav Crhonek <vcrhonek@redhat.com>
-require: patch
-duration: 10m
-test: ./runtest.sh
--- a/tests/post-quantum-cryptography/runtest.sh
+++ b/tests/post-quantum-cryptography/runtest.sh
@ -1,76 +0,0 @@
-#!/bin/sh -eux
-
-function check_key_and_cert()
-{
-  echo -e "\n===== key info"
-  ssh-keygen -l -f /etc/sfcb/file.pem || :
-  file /etc/sfcb/file.pem
-  echo -e "\n\n\n"
-
-  echo -e "\n===== cert info"
-  openssl x509 -in /etc/sfcb/server.pem --text --noout
-  echo -e "\n\n\n"
-}
-
-function test_key_exchange()
-{
-  echo -e "\n===== check that it uses TLS 1.3 and the X25519MLKEM768 key exchange by default if the peer supports it"
-  openssl s_client -connect localhost:5989 -CAfile /etc/sfcb/client.pem </dev/null | tee key-exchange.out
-  echo -e "\n\n\n"
-  grep "Negotiated TLS1.3 group: X25519MLKEM768" key-exchange.out
-  echo -e "\n\n\n"
-}
-
-function test_cert_support()
-{
-  echo -e "\n===== check that TLS certificate using ML-DSA works"
-  openssl s_client -connect localhost:5989 -CAfile /etc/sfcb/client.pem </dev/null | tee cert-mldsa.out
-  echo -e "\n\n\n"
-  grep "Peer signature type: mldsa65" cert-mldsa.out
-  echo -e "\n\n\n"
-  # simulate lack of ML-DSA support
-  echo "\n===== check support for a classic certificate chain if peer doesn't support ML-DSA certificate"
-  openssl s_client -connect localhost:5989 -CAfile /etc/sfcb/client-fallback.pem -sigalgs 'rsa_pss_pss_sha256:rsa_pss_rsae_sha256' </dev/null | \
-    tee cert-classic.out
-  echo -e "\n\n\n"
-  grep "Peer signature type: rsa_pss_rsae_sha256" cert-classic.out
-  echo -e "\n\n\n"
-}
-
-systemctl start sblim-sfcb
-check_key_and_cert
-test_key_exchange
-systemctl stop sblim-sfcb
-
-# keep RSA certificate and key
-cp /etc/sfcb/server.pem /etc/sfcb/server-fallback.pem
-cp /etc/sfcb/client.pem /etc/sfcb/client-fallback.pem
-cp /etc/sfcb/file.pem /etc/sfcb/file-fallback.pem
-# remove previously generated certificates/keys
-rm -rf /etc/sfcb/{client,clist,file,server}.pem
-
-# update genOpenPegasusSSLCerts to generate a new key using ML-DSA-65
-# and issue a self-signed certificate for localhost using this key
-patch /usr/share/sfcb/genSslCert.sh << 'EOF'
--- genSslCert.sh.orig	2025-05-21 09:29:57.615675163 +0200
-+++ genSslCert.sh	2025-05-21 09:31:02.967076796 +0200
-@@ -38,7 +38,7 @@
- emailAddress=root@$HOSTNAME
- EOF
- 
-openssl req -x509 -days 365 -newkey rsa:2048 \
-+openssl req -x509 -days 365 -newkey mldsa65 \
-    -nodes -config $DIR/ssl.cnf   \
-    -keyout $DIR/key.pem -out $DIR/cert.pem
- 
-EOF
-
-/usr/share/sfcb/genSslCert.sh /etc/sfcb
-
-# update config file
-echo "sslKeyFallbackFilePath: /etc/sfcb/file-fallback.pem" >> /etc/sfcb/sfcb.cfg
-echo "sslCertificateFallbackFilePath: /etc/sfcb/server-fallback.pem" >> /etc/sfcb/sfcb.cfg
-
-systemctl start sblim-sfcb
-check_key_and_cert
-test_cert_support