Compare commits
1 commit
| Author | SHA1 | Date | |
|---|---|---|---|
|
993621e0d2 |
9 changed files with 95 additions and 279 deletions
|
|
@ -1 +0,0 @@
|
|||
1
|
||||
|
|
@ -1,9 +0,0 @@
|
|||
summary: Basic test plan
|
||||
prepare:
|
||||
how: install
|
||||
package:
|
||||
- sblim-sfcb
|
||||
discover:
|
||||
how: fmf
|
||||
execute:
|
||||
how: tmt
|
||||
|
|
@ -1,9 +0,0 @@
|
|||
---
|
||||
badfuncs:
|
||||
allowed:
|
||||
/usr/lib64/sfcb/libsfcHttpAdapter.so.*:
|
||||
- inet_aton
|
||||
|
||||
runpath:
|
||||
allowed_paths:
|
||||
- /usr/lib64/sfcb
|
||||
71
sblim-sfcb-1.4.9-fix-multiple-definition.patch
Normal file
71
sblim-sfcb-1.4.9-fix-multiple-definition.patch
Normal file
|
|
@ -0,0 +1,71 @@
|
|||
diff -up sblim-sfcb-1.4.9/control.h.orig sblim-sfcb-1.4.9/control.h
|
||||
--- sblim-sfcb-1.4.9/control.h.orig 2014-11-25 02:43:10.000000000 +0100
|
||||
+++ sblim-sfcb-1.4.9/control.h 2020-02-12 12:14:46.078102974 +0100
|
||||
@@ -28,7 +28,7 @@ int getControlUNum(char *id,
|
||||
int getControlULong(char *id, unsigned long *val);
|
||||
int getControlNum(char *id, long *val);
|
||||
int getControlBool(char *id, int *val);
|
||||
-const char * sfcBrokerStart;
|
||||
+extern const char * sfcBrokerStart;
|
||||
|
||||
#endif
|
||||
/* MODELINES */
|
||||
diff -up sblim-sfcb-1.4.9/providerMgr.c.orig sblim-sfcb-1.4.9/providerMgr.c
|
||||
--- sblim-sfcb-1.4.9/providerMgr.c.orig 2020-02-12 12:14:46.065102946 +0100
|
||||
+++ sblim-sfcb-1.4.9/providerMgr.c 2020-02-12 12:19:15.879677891 +0100
|
||||
@@ -53,6 +53,8 @@
|
||||
#define SFCB_ASM(x)
|
||||
#endif
|
||||
|
||||
+sigset_t mask, old_mask;
|
||||
+
|
||||
static pthread_mutex_t resultsocketMutex = PTHREAD_MUTEX_INITIALIZER;
|
||||
|
||||
extern CMPIBroker *Broker;
|
||||
diff -up sblim-sfcb-1.4.9/providerMgr.h.orig sblim-sfcb-1.4.9/providerMgr.h
|
||||
--- sblim-sfcb-1.4.9/providerMgr.h.orig 2014-11-25 02:43:12.000000000 +0100
|
||||
+++ sblim-sfcb-1.4.9/providerMgr.h 2020-02-12 12:14:46.078102974 +0100
|
||||
@@ -398,7 +398,7 @@ BinResponseHdr **invokeProviders(BinRequ
|
||||
BinResponseHdr *invokeProvider(BinRequestContext * ctx);
|
||||
void freeResponseHeaders(BinResponseHdr ** resp,
|
||||
BinRequestContext * ctx);
|
||||
-sigset_t mask, old_mask;
|
||||
+extern sigset_t mask, old_mask;
|
||||
|
||||
#endif
|
||||
/* MODELINES */
|
||||
diff -up sblim-sfcb-1.4.9/sfcBroker.c.orig sblim-sfcb-1.4.9/sfcBroker.c
|
||||
--- sblim-sfcb-1.4.9/sfcBroker.c.orig 2014-11-25 02:43:13.000000000 +0100
|
||||
+++ sblim-sfcb-1.4.9/sfcBroker.c 2020-02-12 12:22:21.768073986 +0100
|
||||
@@ -52,6 +52,8 @@
|
||||
#include "config.h"
|
||||
#endif
|
||||
|
||||
+const char *sfcBrokerStart;
|
||||
+
|
||||
int sfcBrokerPid = 0;
|
||||
|
||||
extern int sfcbUseSyslog;
|
||||
diff -up sblim-sfcb-1.4.9/trace.c.orig sblim-sfcb-1.4.9/trace.c
|
||||
--- sblim-sfcb-1.4.9/trace.c.orig 2014-11-25 02:43:17.000000000 +0100
|
||||
+++ sblim-sfcb-1.4.9/trace.c 2020-02-12 12:15:19.319173804 +0100
|
||||
@@ -48,6 +48,7 @@
|
||||
* ---------------------------------------------------------------------------
|
||||
*/
|
||||
|
||||
+int colorTrace;
|
||||
char *processName = NULL;
|
||||
int providerProcess = 0;
|
||||
int idleThreadId = 0;
|
||||
diff -up sblim-sfcb-1.4.9/trace.h.orig sblim-sfcb-1.4.9/trace.h
|
||||
--- sblim-sfcb-1.4.9/trace.h.orig 2014-11-25 02:43:17.000000000 +0100
|
||||
+++ sblim-sfcb-1.4.9/trace.h 2020-02-12 12:14:46.078102974 +0100
|
||||
@@ -130,7 +130,7 @@ typedef struct traceId {
|
||||
#define CYAN 6
|
||||
#define WHITE 7
|
||||
void changeTextColor(int reset);
|
||||
-int colorTrace;
|
||||
+extern int colorTrace;
|
||||
|
||||
#define MAX_MSG_SIZE 1024 /* max length of trace message */
|
||||
|
||||
|
|
@ -1,77 +0,0 @@
|
|||
diff -up sblim-sfcb-1.4.9/control.c.orig sblim-sfcb-1.4.9/control.c
|
||||
--- sblim-sfcb-1.4.9/control.c.orig 2025-05-28 10:39:14.751599855 +0200
|
||||
+++ sblim-sfcb-1.4.9/control.c 2025-06-12 10:20:43.025624410 +0200
|
||||
@@ -171,10 +171,12 @@ static Control init[] = {
|
||||
|
||||
{"sslKeyFilePath", CTL_STRING, SFCB_CONFDIR "/file.pem", {0}},
|
||||
{"sslCertificateFilePath", CTL_STRING, SFCB_CONFDIR "/server.pem", {0}},
|
||||
+ {"sslKeyFallbackFilePath", CTL_STRING, NULL, {0}},
|
||||
+ {"sslCertificateFallbackFilePath", CTL_STRING, NULL, {0}},
|
||||
{"sslCertList", CTL_STRING, SFCB_CONFDIR "/clist.pem", {0}},
|
||||
{"sslCiphers", CTL_STRING, "ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH", {0}},
|
||||
{"sslDhParamsFilePath", CTL_STRING, NULL, {0}},
|
||||
- {"sslEcDhCurveName", CTL_STRING, "secp384r1", {0}},
|
||||
+ {"sslEcDhCurveName", CTL_STRING, NULL, {0}},
|
||||
{"enableSslCipherServerPref", CTL_BOOL, NULL, {.b=0}},
|
||||
|
||||
{"registrationDir", CTL_STRING, SFCB_STATEDIR "/registration", {0}},
|
||||
diff -up sblim-sfcb-1.4.9/httpAdapter.c.orig sblim-sfcb-1.4.9/httpAdapter.c
|
||||
--- sblim-sfcb-1.4.9/httpAdapter.c.orig 2025-05-21 10:41:30.727123823 +0200
|
||||
+++ sblim-sfcb-1.4.9/httpAdapter.c 2025-06-12 11:14:32.906455875 +0200
|
||||
@@ -2053,6 +2053,24 @@ initSSL()
|
||||
_SFCB_TRACE(1, ("--- sslKeyFilePath = %s", fnk));
|
||||
if (SSL_CTX_use_PrivateKey_file(ctx, fnk, SSL_FILETYPE_PEM) != 1)
|
||||
intSSLerror("Error loading private key from file");
|
||||
+
|
||||
+ /*
|
||||
+ * Add fall back certificate/key pair
|
||||
+ */
|
||||
+ getControlChars("sslCertificateFallbackFilePath", &fnc);
|
||||
+ if (fnc) {
|
||||
+ _SFCB_TRACE(1, ("--- sslCertificateFallbackFilePath = %s", fnc));
|
||||
+ if (SSL_CTX_use_certificate_chain_file(ctx, fnc) != 1)
|
||||
+ intSSLerror("Error loading certificate fall back from file");
|
||||
+ }
|
||||
+
|
||||
+ getControlChars("sslKeyFallbackFilePath", &fnk);
|
||||
+ if (fnk) {
|
||||
+ _SFCB_TRACE(1, ("--- sslKeyFallbackFilePath = %s", fnk));
|
||||
+ if (SSL_CTX_use_PrivateKey_file(ctx, fnk, SSL_FILETYPE_PEM) != 1)
|
||||
+ intSSLerror("Error loading private key fall back from file");
|
||||
+ }
|
||||
+
|
||||
getControlChars("sslClientCertificate", &fnl);
|
||||
_SFCB_TRACE(1, ("--- sslClientCertificate = %s", fnl));
|
||||
getControlChars("sslCertList", &fcert);
|
||||
diff -up sblim-sfcb-1.4.9/sfcb.cfg.pre.in.orig sblim-sfcb-1.4.9/sfcb.cfg.pre.in
|
||||
--- sblim-sfcb-1.4.9/sfcb.cfg.pre.in.orig 2025-05-28 10:05:42.359932525 +0200
|
||||
+++ sblim-sfcb-1.4.9/sfcb.cfg.pre.in 2025-06-12 11:23:37.424277273 +0200
|
||||
@@ -244,6 +244,15 @@ sslKeyFilePath: @sysconfdir@/sfcb/file.p
|
||||
## Default is @sysconfdir@/sfcb/server.pem
|
||||
sslCertificateFilePath: @sysconfdir@/sfcb/server.pem
|
||||
|
||||
+## Filename containing the fall back private key for the server's fall back certificate.
|
||||
+## The file must be in PEM format and may not be passphrase-protected. The file is
|
||||
+## relevant for both client connect and indications sent via https.
|
||||
+#sslKeyFallbackFilePath: @sysconfdir@/sfcb/file-fallback.pem
|
||||
+
|
||||
+## Filename containing the server's fall back certificate. Must be in PEM format.
|
||||
+## The file is relevant for both client connect and indications sent via https.
|
||||
+#sslCertificateFallbackFilePath: @sysconfdir@/sfcb/server-fallback.pem
|
||||
+
|
||||
## Filename containing list of certificates server accepts.
|
||||
## The file is relevant client connect only.
|
||||
## Default is @sysconfdir@/sfcb/clist.pem
|
||||
@@ -302,10 +311,10 @@ sslCiphers: ALL:!ADH:!LOW:!EXP:!MD5:@STR
|
||||
## Configure a curve name for ECDH ephemeral key generation. See man
|
||||
## SSL_CTX_set_tmp_ecdh(3) for details. The value should be a curve name
|
||||
## listed by the "openssl ecparam -list_curves" command in the SFCB runtime
|
||||
-## environment. If this value is not set, the indicated default is in effect.
|
||||
+## environment. If this value is not set, ECDH ephemeral key generation is not used.
|
||||
## If the value is set but the curve name is not recognized by the underlying
|
||||
## openssl implementation, SFCB will abort.
|
||||
-## Default is secp384r1
|
||||
+## Default is: not set
|
||||
#sslEcDhCurveName: secp384r1
|
||||
|
||||
## When set to true, sets the SSL_OP_CIPHER_SERVER_PREFERENCE flag for the ssl
|
||||
123
sblim-sfcb.spec
123
sblim-sfcb.spec
|
|
@ -8,7 +8,7 @@ Name: sblim-sfcb
|
|||
Summary: Small Footprint CIM Broker
|
||||
URL: http://sblim.wiki.sourceforge.net/
|
||||
Version: 1.4.9
|
||||
Release: 38%{?dist}
|
||||
Release: 18%{?dist}
|
||||
License: EPL-1.0
|
||||
Source0: http://downloads.sourceforge.net/sblim/%{name}-%{version}.tar.bz2
|
||||
Source1: sfcb.service
|
||||
|
|
@ -16,8 +16,6 @@ Source1: sfcb.service
|
|||
Source2: sfcbdump.1.gz
|
||||
Source3: sfcbinst2mof.1.gz
|
||||
Source4: sfcbtrace.1.gz
|
||||
# /etc/tmpfiles.d configuration file
|
||||
Source5: sblim-sfcb.tmpfiles
|
||||
# Patch0: changes schema location to the path we use
|
||||
Patch0: sblim-sfcb-1.3.9-sfcbrepos-schema-location.patch
|
||||
# Patch1: Fix provider debugging - variable for stopping wait-for-debugger
|
||||
|
|
@ -43,13 +41,11 @@ Patch9: sblim-sfcb-1.4.9-fix-ppc-optimization-level.patch
|
|||
# Patch10: fixes docdir name and removes install of COPYING with license
|
||||
# which is included through %%license
|
||||
Patch10: sblim-sfcb-1.4.9-docdir-license.patch
|
||||
# Patch11: adds configuration options to specify fallback SSL cert/key pair
|
||||
# and disables default ECDH ephemeral key generation
|
||||
Patch11: sblim-sfcb-1.4.9-post-quantum.patch
|
||||
# Patch11: fixes multiple definiton of variables (FTBFS with GCC 10)
|
||||
Patch11: sblim-sfcb-1.4.9-fix-multiple-definition.patch
|
||||
Provides: cim-server = 0
|
||||
Requires: cim-schema
|
||||
Requires: sblim-sfcCommon
|
||||
BuildRequires: make
|
||||
BuildRequires: libcurl-devel
|
||||
BuildRequires: perl-generators
|
||||
BuildRequires: zlib-devel
|
||||
|
|
@ -76,29 +72,23 @@ Programming Interface (CMPI).
|
|||
|
||||
%prep
|
||||
%setup -q -T -b 0 -n %{name}-%{version}
|
||||
%patch -P0 -p1 -b .sfcbrepos-schema-location
|
||||
%patch -P1 -p1 -b .fix-provider-debugging
|
||||
%patch -P2 -p1 -b .maxMsgLen
|
||||
%patch -P3 -p1 -b .service
|
||||
%patch -P4 -p1 -b .multilib-man-cfg
|
||||
%patch -P5 -p1 -b .default-ecdh-curve-name
|
||||
%patch -P6 -p1 -b .fix-ftbfs
|
||||
%patch -P7 -p1 -b .fix-null-deref
|
||||
%patch -P8 -p1 -b .fix-null-content-type-crash
|
||||
%patch -P9 -p1 -b .fix-ppc-optimization-level
|
||||
%patch -P10 -p1 -b .docdir-license
|
||||
%patch -P11 -p1 -b .post-quantum
|
||||
|
||||
# Create a sysusers.d config file
|
||||
cat >sblim-sfcb.sysusers.conf <<EOF
|
||||
g sfcb -
|
||||
m root sfcb
|
||||
EOF
|
||||
%patch0 -p1 -b .sfcbrepos-schema-location
|
||||
%patch1 -p1 -b .fix-provider-debugging
|
||||
%patch2 -p1 -b .maxMsgLen
|
||||
%patch3 -p1 -b .service
|
||||
%patch4 -p1 -b .multilib-man-cfg
|
||||
%patch5 -p1 -b .default-ecdh-curve-name
|
||||
%patch6 -p1 -b .fix-ftbfs
|
||||
%patch7 -p1 -b .fix-null-deref
|
||||
%patch8 -p1 -b .fix-null-content-type-crash
|
||||
%patch9 -p1 -b .fix-ppc-optimization-level
|
||||
%patch10 -p1 -b .docdir-license
|
||||
%patch11 -p1 -b .fix-multiple-definition
|
||||
|
||||
%build
|
||||
%configure --enable-debug --enable-uds --enable-ssl --enable-pam --enable-ipv6 \
|
||||
--enable-slp --enable-large_volume_support --enable-optimized-enumeration --enable-relax-mofsyntax \
|
||||
CFLAGS="$CFLAGS -D_GNU_SOURCE -fPIE -DPIE -fcommon" LDFLAGS="$LDFLAGS -Wl,-z,now -pie"
|
||||
CFLAGS="$CFLAGS -D_GNU_SOURCE -fPIE -DPIE" LDFLAGS="$LDFLAGS -Wl,-z,now -pie"
|
||||
|
||||
make
|
||||
|
||||
|
|
@ -123,100 +113,35 @@ echo "%{_datadir}/man/man1/*" >> _pkg_list
|
|||
echo "%{_unitdir}/sblim-sfcb.service" >> _pkg_list
|
||||
echo "%{_localstatedir}/lib/sfcb" >> _pkg_list
|
||||
echo "%{_bindir}/*" >> _pkg_list
|
||||
echo "%{_sbindir}/*" >> _pkg_list
|
||||
echo "%{_libdir}/sfcb/*.so.*" >> _pkg_list
|
||||
echo "%{_libdir}/sfcb/*.so" >> _pkg_list
|
||||
|
||||
cat _pkg_list
|
||||
|
||||
install -m0644 -D sblim-sfcb.sysusers.conf %{buildroot}%{_sysusersdir}/sblim-sfcb.conf
|
||||
mkdir -p %{buildroot}/%{_tmpfilesdir}
|
||||
install -p -D -m 644 %{SOURCE5} %{buildroot}/%{_tmpfilesdir}/sblim-sfcb.conf
|
||||
%pre
|
||||
/usr/bin/getent group sfcb >/dev/null || /usr/sbin/groupadd -r sfcb
|
||||
/usr/sbin/usermod -a -G sfcb root > /dev/null 2>&1 || :
|
||||
|
||||
%post
|
||||
%{_datadir}/sfcb/genSslCert.sh %{_sysconfdir}/sfcb &>/dev/null || :
|
||||
/sbin/ldconfig
|
||||
%{_bindir}/sfcbrepos -f > /dev/null 2>&1
|
||||
%{_bindir}/sfcbrepos -f > /dev/null 2>1
|
||||
%systemd_post sblim-sfcb.service
|
||||
# copy content of /var/lib/sfcb to temporary place for Image Mode
|
||||
(mkdir -p /usr/share/factory/var/lib && cp -a /var/lib/sfcb /usr/share/factory/var/lib/sfcb) >/dev/null 2>&1 || :
|
||||
|
||||
%preun
|
||||
%systemd_preun sblim-sfcb.service
|
||||
if [ $1 -eq 0 ]; then
|
||||
# Package removal, not upgrade
|
||||
rm -rf /usr/share/factory/var/lib/sfcb
|
||||
fi
|
||||
|
||||
%postun
|
||||
/sbin/ldconfig
|
||||
%systemd_postun_with_restart sblim-sfcb.service
|
||||
if [ $1 -eq 0 ]; then
|
||||
/usr/sbin/groupdel sfcb > /dev/null 2>&1 || :;
|
||||
fi;
|
||||
|
||||
%files -f _pkg_list
|
||||
%{_sysusersdir}/sblim-sfcb.conf
|
||||
%{_tmpfilesdir}/sblim-sfcb.conf
|
||||
|
||||
%changelog
|
||||
* Fri Sep 12 2025 Vitezslav Crhonek <vcrhonek@redhat.com> - 1.4.9-38
|
||||
- Add support for Image Mode
|
||||
|
||||
* Fri Jul 25 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.9-37
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
|
||||
|
||||
* Tue Jun 17 2025 Vitezslav Crhonek <vcrhonek@redhat.com> - 1.4.9-36
|
||||
- Update to better support post-quantum cryptography
|
||||
|
||||
* Thu Mar 06 2025 Vitezslav Crhonek <vcrhonek@redhat.com> - 1.4.9-35
|
||||
- bin and sbin unification
|
||||
|
||||
* Thu Jan 23 2025 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.4.9-34
|
||||
- Add sysusers.d config file to allow rpm to create users/groups automatically
|
||||
|
||||
* Sun Jan 19 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.9-33
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
|
||||
|
||||
* Sat Jul 20 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.9-32
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
|
||||
|
||||
* Sat Jan 27 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.9-31
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
|
||||
|
||||
* Sat Jul 22 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.9-30
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
|
||||
|
||||
* Tue Feb 14 2023 Vitezslav Crhonek <vcrhonek@redhat.com> - 1.4.9-29
|
||||
- SPDX migration
|
||||
|
||||
* Sat Jan 21 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.9-28
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
|
||||
|
||||
* Sat Jul 23 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.9-27
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
|
||||
|
||||
* Thu Jan 27 2022 Vitezslav Crhonek <vcrhonek@redhat.com> - 1.4.9-26
|
||||
- Change build flags, fix errors during the start of the service
|
||||
|
||||
* Sat Jan 22 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.9-25
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
|
||||
|
||||
* Tue Sep 14 2021 Sahana Prasad <sahana@redhat.com> - 1.4.9-24
|
||||
- Rebuilt with OpenSSL 3.0.0
|
||||
|
||||
* Fri Jul 23 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.9-23
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
|
||||
|
||||
* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.4.9-22
|
||||
- Rebuilt for updated systemd-rpm-macros
|
||||
See https://pagure.io/fesco/issue/2583.
|
||||
|
||||
* Wed Jan 27 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.9-21
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
|
||||
|
||||
* Wed Jul 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.9-20
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
|
||||
|
||||
* Wed Jul 08 2020 Vitezslav Crhonek <vcrhonek@redhat.com> - 1.4.9-19
|
||||
- Fix sfcbrepos redirection
|
||||
|
||||
* Wed Feb 12 2020 Vitezslav Crhonek <vcrhonek@redhat.com> - 1.4.9-18
|
||||
- Fixes multiple definiton of variables (FTBFS with GCC 10)
|
||||
Resolves: #1800074
|
||||
|
|
|
|||
|
|
@ -1,2 +0,0 @@
|
|||
# populate /var/lib/sfcb with content from /usr/share/factory/var/lib/sfcb
|
||||
C /var/lib/sfcb - - - -
|
||||
|
|
@ -1,6 +0,0 @@
|
|||
summary: Post-quantum cryptography support test
|
||||
author: Vitezslav Crhonek <vcrhonek@redhat.com>
|
||||
contact: Vitezslav Crhonek <vcrhonek@redhat.com>
|
||||
require: patch
|
||||
duration: 10m
|
||||
test: ./runtest.sh
|
||||
|
|
@ -1,76 +0,0 @@
|
|||
#!/bin/sh -eux
|
||||
|
||||
function check_key_and_cert()
|
||||
{
|
||||
echo -e "\n===== key info"
|
||||
ssh-keygen -l -f /etc/sfcb/file.pem || :
|
||||
file /etc/sfcb/file.pem
|
||||
echo -e "\n\n\n"
|
||||
|
||||
echo -e "\n===== cert info"
|
||||
openssl x509 -in /etc/sfcb/server.pem --text --noout
|
||||
echo -e "\n\n\n"
|
||||
}
|
||||
|
||||
function test_key_exchange()
|
||||
{
|
||||
echo -e "\n===== check that it uses TLS 1.3 and the X25519MLKEM768 key exchange by default if the peer supports it"
|
||||
openssl s_client -connect localhost:5989 -CAfile /etc/sfcb/client.pem </dev/null | tee key-exchange.out
|
||||
echo -e "\n\n\n"
|
||||
grep "Negotiated TLS1.3 group: X25519MLKEM768" key-exchange.out
|
||||
echo -e "\n\n\n"
|
||||
}
|
||||
|
||||
function test_cert_support()
|
||||
{
|
||||
echo -e "\n===== check that TLS certificate using ML-DSA works"
|
||||
openssl s_client -connect localhost:5989 -CAfile /etc/sfcb/client.pem </dev/null | tee cert-mldsa.out
|
||||
echo -e "\n\n\n"
|
||||
grep "Peer signature type: mldsa65" cert-mldsa.out
|
||||
echo -e "\n\n\n"
|
||||
# simulate lack of ML-DSA support
|
||||
echo "\n===== check support for a classic certificate chain if peer doesn't support ML-DSA certificate"
|
||||
openssl s_client -connect localhost:5989 -CAfile /etc/sfcb/client-fallback.pem -sigalgs 'rsa_pss_pss_sha256:rsa_pss_rsae_sha256' </dev/null | \
|
||||
tee cert-classic.out
|
||||
echo -e "\n\n\n"
|
||||
grep "Peer signature type: rsa_pss_rsae_sha256" cert-classic.out
|
||||
echo -e "\n\n\n"
|
||||
}
|
||||
|
||||
systemctl start sblim-sfcb
|
||||
check_key_and_cert
|
||||
test_key_exchange
|
||||
systemctl stop sblim-sfcb
|
||||
|
||||
# keep RSA certificate and key
|
||||
cp /etc/sfcb/server.pem /etc/sfcb/server-fallback.pem
|
||||
cp /etc/sfcb/client.pem /etc/sfcb/client-fallback.pem
|
||||
cp /etc/sfcb/file.pem /etc/sfcb/file-fallback.pem
|
||||
# remove previously generated certificates/keys
|
||||
rm -rf /etc/sfcb/{client,clist,file,server}.pem
|
||||
|
||||
# update genOpenPegasusSSLCerts to generate a new key using ML-DSA-65
|
||||
# and issue a self-signed certificate for localhost using this key
|
||||
patch /usr/share/sfcb/genSslCert.sh << 'EOF'
|
||||
--- genSslCert.sh.orig 2025-05-21 09:29:57.615675163 +0200
|
||||
+++ genSslCert.sh 2025-05-21 09:31:02.967076796 +0200
|
||||
@@ -38,7 +38,7 @@
|
||||
emailAddress=root@$HOSTNAME
|
||||
EOF
|
||||
|
||||
-openssl req -x509 -days 365 -newkey rsa:2048 \
|
||||
+openssl req -x509 -days 365 -newkey mldsa65 \
|
||||
-nodes -config $DIR/ssl.cnf \
|
||||
-keyout $DIR/key.pem -out $DIR/cert.pem
|
||||
|
||||
EOF
|
||||
|
||||
/usr/share/sfcb/genSslCert.sh /etc/sfcb
|
||||
|
||||
# update config file
|
||||
echo "sslKeyFallbackFilePath: /etc/sfcb/file-fallback.pem" >> /etc/sfcb/sfcb.cfg
|
||||
echo "sslCertificateFallbackFilePath: /etc/sfcb/server-fallback.pem" >> /etc/sfcb/sfcb.cfg
|
||||
|
||||
systemctl start sblim-sfcb
|
||||
check_key_and_cert
|
||||
test_cert_support
|
||||
Loading…
Add table
Add a link
Reference in a new issue