Add support for post-quantum cryptography
Resolves: RHEL-127515
This commit is contained in:
Vitezslav Crhonek
parent
52d608c4cb
commit
992c7a0311
104
sblim-sfcb-1.4.9-post-quantum.patch
Normal file
104
sblim-sfcb-1.4.9-post-quantum.patch
Normal file
@ -0,0 +1,104 @@
|
||||
diff -up sblim-sfcb-1.4.9/control.c.orig sblim-sfcb-1.4.9/control.c
|
||||
--- sblim-sfcb-1.4.9/control.c.orig 2025-05-28 10:39:14.751599855 +0200
|
||||
+++ sblim-sfcb-1.4.9/control.c 2025-06-12 10:20:43.025624410 +0200
|
||||
@@ -171,10 +171,12 @@ static Control init[] = {
|
||||
|
||||
{"sslKeyFilePath", CTL_STRING, SFCB_CONFDIR "/file.pem", {0}},
|
||||
{"sslCertificateFilePath", CTL_STRING, SFCB_CONFDIR "/server.pem", {0}},
|
||||
+ {"sslKeyFallbackFilePath", CTL_STRING, NULL, {0}},
|
||||
+ {"sslCertificateFallbackFilePath", CTL_STRING, NULL, {0}},
|
||||
{"sslCertList", CTL_STRING, SFCB_CONFDIR "/clist.pem", {0}},
|
||||
{"sslCiphers", CTL_STRING, "ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH", {0}},
|
||||
{"sslDhParamsFilePath", CTL_STRING, NULL, {0}},
|
||||
- {"sslEcDhCurveName", CTL_STRING, "secp384r1", {0}},
|
||||
+ {"sslEcDhCurveName", CTL_STRING, NULL, {0}},
|
||||
{"enableSslCipherServerPref", CTL_BOOL, NULL, {.b=0}},
|
||||
|
||||
{"registrationDir", CTL_STRING, SFCB_STATEDIR "/registration", {0}},
|
||||
diff -up sblim-sfcb-1.4.9/httpAdapter.c.orig sblim-sfcb-1.4.9/httpAdapter.c
|
||||
--- sblim-sfcb-1.4.9/httpAdapter.c.orig 2025-05-21 10:41:30.727123823 +0200
|
||||
+++ sblim-sfcb-1.4.9/httpAdapter.c 2025-06-12 11:14:32.906455875 +0200
|
||||
@@ -2053,6 +2053,24 @@ initSSL()
|
||||
_SFCB_TRACE(1, ("--- sslKeyFilePath = %s", fnk));
|
||||
if (SSL_CTX_use_PrivateKey_file(ctx, fnk, SSL_FILETYPE_PEM) != 1)
|
||||
intSSLerror("Error loading private key from file");
|
||||
+
|
||||
+ /*
|
||||
+ * Add fall back certificate/key pair
|
||||
+ */
|
||||
+ getControlChars("sslCertificateFallbackFilePath", &fnc);
|
||||
+ if (fnc) {
|
||||
+ _SFCB_TRACE(1, ("--- sslCertificateFallbackFilePath = %s", fnc));
|
||||
+ if (SSL_CTX_use_certificate_chain_file(ctx, fnc) != 1)
|
||||
+ intSSLerror("Error loading certificate fall back from file");
|
||||
+ }
|
||||
+
|
||||
+ getControlChars("sslKeyFallbackFilePath", &fnk);
|
||||
+ if (fnk) {
|
||||
+ _SFCB_TRACE(1, ("--- sslKeyFallbackFilePath = %s", fnk));
|
||||
+ if (SSL_CTX_use_PrivateKey_file(ctx, fnk, SSL_FILETYPE_PEM) != 1)
|
||||
+ intSSLerror("Error loading private key fall back from file");
|
||||
+ }
|
||||
+
|
||||
getControlChars("sslClientCertificate", &fnl);
|
||||
_SFCB_TRACE(1, ("--- sslClientCertificate = %s", fnl));
|
||||
getControlChars("sslCertList", &fcert);
|
||||
@@ -2103,6 +2121,26 @@ initSSL()
|
||||
_SFCB_TRACE(1, ("--- sslCiphers = %s", sslCiphers));
|
||||
if (SSL_CTX_set_cipher_list(ctx, sslCiphers) != 1)
|
||||
intSSLerror("Error setting cipher list (no valid ciphers)");
|
||||
+
|
||||
+ /*
|
||||
+ * Configure TLS key exchange groups with PQC support
|
||||
+ */
|
||||
+ if (SSL_CTX_set1_groups_list(ctx, "X25519MLKEM768:P-256:P-384:X25519") != 1) {
|
||||
+ mlogf(M_INFO, M_SHOW, "--- SSL: Failed to set PQC groups, trying traditional groups\n");
|
||||
+ /* Fallback to traditional groups for systems without PQC support */
|
||||
+ if (SSL_CTX_set1_groups_list(ctx, "P-256:P-384:X25519") != 1)
|
||||
+ mlogf(M_ERROR, M_SHOW, "--- SSL: Failed to set traditional groups\n");
|
||||
+ }
|
||||
+
|
||||
+ /*
|
||||
+ * Configure TLS signature algorithms with PQC support (ML-DSA)
|
||||
+ */
|
||||
+ if (SSL_CTX_set1_sigalgs_list(ctx, "mldsa65:rsa_pss_rsae_sha256:rsa_pss_rsae_sha384:rsa_pss_rsae_sha512:ecdsa_secp256r1_sha256:ecdsa_secp384r1_sha384") != 1) {
|
||||
+ mlogf(M_INFO, M_SHOW, "--- SSL: Failed to set PQC signature algorithms, trying traditional algorithms\n");
|
||||
+ /* Fallback to traditional signature algorithms */
|
||||
+ if (SSL_CTX_set1_sigalgs_list(ctx, "rsa_pss_rsae_sha256:rsa_pss_rsae_sha384:rsa_pss_rsae_sha512:ecdsa_secp256r1_sha256:ecdsa_secp384r1_sha384") != 1)
|
||||
+ mlogf(M_ERROR, M_SHOW, "--- SSL: Failed to set traditional signature algorithms\n");
|
||||
+ }
|
||||
|
||||
#if (defined HEADER_DH_H && !defined OPENSSL_NO_DH)
|
||||
/*
|
||||
diff -up sblim-sfcb-1.4.9/sfcb.cfg.pre.in.orig sblim-sfcb-1.4.9/sfcb.cfg.pre.in
|
||||
--- sblim-sfcb-1.4.9/sfcb.cfg.pre.in.orig 2025-05-28 10:05:42.359932525 +0200
|
||||
+++ sblim-sfcb-1.4.9/sfcb.cfg.pre.in 2025-06-12 11:23:37.424277273 +0200
|
||||
@@ -244,6 +244,15 @@ sslKeyFilePath: @sysconfdir@/sfcb/file.p
|
||||
## Default is @sysconfdir@/sfcb/server.pem
|
||||
sslCertificateFilePath: @sysconfdir@/sfcb/server.pem
|
||||
|
||||
+## Filename containing the fall back private key for the server's fall back certificate.
|
||||
+## The file must be in PEM format and may not be passphrase-protected. The file is
|
||||
+## relevant for both client connect and indications sent via https.
|
||||
+#sslKeyFallbackFilePath: @sysconfdir@/sfcb/file-fallback.pem
|
||||
+
|
||||
+## Filename containing the server's fall back certificate. Must be in PEM format.
|
||||
+## The file is relevant for both client connect and indications sent via https.
|
||||
+#sslCertificateFallbackFilePath: @sysconfdir@/sfcb/server-fallback.pem
|
||||
+
|
||||
## Filename containing list of certificates server accepts.
|
||||
## The file is relevant client connect only.
|
||||
## Default is @sysconfdir@/sfcb/clist.pem
|
||||
@@ -302,10 +311,10 @@ sslCiphers: ALL:!ADH:!LOW:!EXP:!MD5:@STR
|
||||
## Configure a curve name for ECDH ephemeral key generation. See man
|
||||
## SSL_CTX_set_tmp_ecdh(3) for details. The value should be a curve name
|
||||
## listed by the "openssl ecparam -list_curves" command in the SFCB runtime
|
||||
-## environment. If this value is not set, the indicated default is in effect.
|
||||
+## environment. If this value is not set, ECDH ephemeral key generation is not used.
|
||||
## If the value is set but the curve name is not recognized by the underlying
|
||||
## openssl implementation, SFCB will abort.
|
||||
-## Default is secp384r1
|
||||
+## Default is: not set
|
||||
#sslEcDhCurveName: secp384r1
|
||||
|
||||
## When set to true, sets the SSL_OP_CIPHER_SERVER_PREFERENCE flag for the ssl
|
||||
@ -8,7 +8,7 @@ Name: sblim-sfcb
|
||||
Summary: Small Footprint CIM Broker
|
||||
URL: http://sblim.wiki.sourceforge.net/
|
||||
Version: 1.4.9
|
||||
Release: 26%{?dist}
|
||||
Release: 27%{?dist}
|
||||
License: EPL-1.0
|
||||
Source0: http://downloads.sourceforge.net/sblim/%{name}-%{version}.tar.bz2
|
||||
Source1: sfcb.service
|
||||
@ -46,6 +46,9 @@ Patch10: sblim-sfcb-1.4.9-docdir-license.patch
|
||||
# Patch11: use sscg to generate cert, openssl as fallback, obtain correct
|
||||
# key length based upon crypto policy level
|
||||
Patch11: sblim-sfcb-1.4.9-ssl-certs-gen-changes.patch
|
||||
# Patch12: adds configuration options to specify fallback SSL cert/key pair
|
||||
# and disables default ECDH ephemeral key generation
|
||||
Patch12: sblim-sfcb-1.4.9-post-quantum.patch
|
||||
Provides: cim-server = 0
|
||||
Requires: cim-schema
|
||||
Requires: sblim-sfcCommon
|
||||
@ -88,6 +91,7 @@ Programming Interface (CMPI).
|
||||
%patch -P9 -p1 -b .fix-ppc-optimization-level
|
||||
%patch -P10 -p1 -b .docdir-license
|
||||
%patch -P11 -p1 -b .ssl-certs-gen-changes
|
||||
%patch -P12 -p1 -b .post-quantum
|
||||
|
||||
# Create a sysusers.d config file
|
||||
cat >sblim-sfcb.sysusers.conf <<EOF
|
||||
@ -157,6 +161,10 @@ fi
|
||||
%{_tmpfilesdir}/sblim-sfcb.conf
|
||||
|
||||
%changelog
|
||||
* Fri Jan 30 2026 Vitezslav Crhonek <vcrhonek@redhat.com> - 1.4.9-27
|
||||
- Add support for post-quantum cryptography
|
||||
Resolves: RHEL-127515
|
||||
|
||||
* Tue Sep 30 2025 Vitezslav Crhonek <vcrhonek@redhat.com> - 1.4.9-26
|
||||
- Update OpenSSL certificates set up
|
||||
Resolves: RHEL-118293
|
||||
|
||||
Loading…
Reference in New Issue
Block a user