From 992c7a0311bc1131fd8d7df00c8f78b8792a98f9 Mon Sep 17 00:00:00 2001 From: Vitezslav Crhonek Date: Fri, 30 Jan 2026 11:23:30 +0100 Subject: [PATCH] Add support for post-quantum cryptography Resolves: RHEL-127515 --- sblim-sfcb-1.4.9-post-quantum.patch | 104 ++++++++++++++++++++++++++++ sblim-sfcb.spec | 10 ++- 2 files changed, 113 insertions(+), 1 deletion(-) create mode 100644 sblim-sfcb-1.4.9-post-quantum.patch diff --git a/sblim-sfcb-1.4.9-post-quantum.patch b/sblim-sfcb-1.4.9-post-quantum.patch new file mode 100644 index 0000000..ae509d8 --- /dev/null +++ b/sblim-sfcb-1.4.9-post-quantum.patch @@ -0,0 +1,104 @@ +diff -up sblim-sfcb-1.4.9/control.c.orig sblim-sfcb-1.4.9/control.c +--- sblim-sfcb-1.4.9/control.c.orig 2025-05-28 10:39:14.751599855 +0200 ++++ sblim-sfcb-1.4.9/control.c 2025-06-12 10:20:43.025624410 +0200 +@@ -171,10 +171,12 @@ static Control init[] = { + + {"sslKeyFilePath", CTL_STRING, SFCB_CONFDIR "/file.pem", {0}}, + {"sslCertificateFilePath", CTL_STRING, SFCB_CONFDIR "/server.pem", {0}}, ++ {"sslKeyFallbackFilePath", CTL_STRING, NULL, {0}}, ++ {"sslCertificateFallbackFilePath", CTL_STRING, NULL, {0}}, + {"sslCertList", CTL_STRING, SFCB_CONFDIR "/clist.pem", {0}}, + {"sslCiphers", CTL_STRING, "ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH", {0}}, + {"sslDhParamsFilePath", CTL_STRING, NULL, {0}}, +- {"sslEcDhCurveName", CTL_STRING, "secp384r1", {0}}, ++ {"sslEcDhCurveName", CTL_STRING, NULL, {0}}, + {"enableSslCipherServerPref", CTL_BOOL, NULL, {.b=0}}, + + {"registrationDir", CTL_STRING, SFCB_STATEDIR "/registration", {0}}, +diff -up sblim-sfcb-1.4.9/httpAdapter.c.orig sblim-sfcb-1.4.9/httpAdapter.c +--- sblim-sfcb-1.4.9/httpAdapter.c.orig 2025-05-21 10:41:30.727123823 +0200 ++++ sblim-sfcb-1.4.9/httpAdapter.c 2025-06-12 11:14:32.906455875 +0200 +@@ -2053,6 +2053,24 @@ initSSL() + _SFCB_TRACE(1, ("--- sslKeyFilePath = %s", fnk)); + if (SSL_CTX_use_PrivateKey_file(ctx, fnk, SSL_FILETYPE_PEM) != 1) + intSSLerror("Error loading private key from file"); ++ ++ /* ++ * Add fall back certificate/key pair ++ */ ++ getControlChars("sslCertificateFallbackFilePath", &fnc); ++ if (fnc) { ++ _SFCB_TRACE(1, ("--- sslCertificateFallbackFilePath = %s", fnc)); ++ if (SSL_CTX_use_certificate_chain_file(ctx, fnc) != 1) ++ intSSLerror("Error loading certificate fall back from file"); ++ } ++ ++ getControlChars("sslKeyFallbackFilePath", &fnk); ++ if (fnk) { ++ _SFCB_TRACE(1, ("--- sslKeyFallbackFilePath = %s", fnk)); ++ if (SSL_CTX_use_PrivateKey_file(ctx, fnk, SSL_FILETYPE_PEM) != 1) ++ intSSLerror("Error loading private key fall back from file"); ++ } ++ + getControlChars("sslClientCertificate", &fnl); + _SFCB_TRACE(1, ("--- sslClientCertificate = %s", fnl)); + getControlChars("sslCertList", &fcert); +@@ -2103,6 +2121,26 @@ initSSL() + _SFCB_TRACE(1, ("--- sslCiphers = %s", sslCiphers)); + if (SSL_CTX_set_cipher_list(ctx, sslCiphers) != 1) + intSSLerror("Error setting cipher list (no valid ciphers)"); ++ ++ /* ++ * Configure TLS key exchange groups with PQC support ++ */ ++ if (SSL_CTX_set1_groups_list(ctx, "X25519MLKEM768:P-256:P-384:X25519") != 1) { ++ mlogf(M_INFO, M_SHOW, "--- SSL: Failed to set PQC groups, trying traditional groups\n"); ++ /* Fallback to traditional groups for systems without PQC support */ ++ if (SSL_CTX_set1_groups_list(ctx, "P-256:P-384:X25519") != 1) ++ mlogf(M_ERROR, M_SHOW, "--- SSL: Failed to set traditional groups\n"); ++ } ++ ++ /* ++ * Configure TLS signature algorithms with PQC support (ML-DSA) ++ */ ++ if (SSL_CTX_set1_sigalgs_list(ctx, "mldsa65:rsa_pss_rsae_sha256:rsa_pss_rsae_sha384:rsa_pss_rsae_sha512:ecdsa_secp256r1_sha256:ecdsa_secp384r1_sha384") != 1) { ++ mlogf(M_INFO, M_SHOW, "--- SSL: Failed to set PQC signature algorithms, trying traditional algorithms\n"); ++ /* Fallback to traditional signature algorithms */ ++ if (SSL_CTX_set1_sigalgs_list(ctx, "rsa_pss_rsae_sha256:rsa_pss_rsae_sha384:rsa_pss_rsae_sha512:ecdsa_secp256r1_sha256:ecdsa_secp384r1_sha384") != 1) ++ mlogf(M_ERROR, M_SHOW, "--- SSL: Failed to set traditional signature algorithms\n"); ++ } + + #if (defined HEADER_DH_H && !defined OPENSSL_NO_DH) + /* +diff -up sblim-sfcb-1.4.9/sfcb.cfg.pre.in.orig sblim-sfcb-1.4.9/sfcb.cfg.pre.in +--- sblim-sfcb-1.4.9/sfcb.cfg.pre.in.orig 2025-05-28 10:05:42.359932525 +0200 ++++ sblim-sfcb-1.4.9/sfcb.cfg.pre.in 2025-06-12 11:23:37.424277273 +0200 +@@ -244,6 +244,15 @@ sslKeyFilePath: @sysconfdir@/sfcb/file.p + ## Default is @sysconfdir@/sfcb/server.pem + sslCertificateFilePath: @sysconfdir@/sfcb/server.pem + ++## Filename containing the fall back private key for the server's fall back certificate. ++## The file must be in PEM format and may not be passphrase-protected. The file is ++## relevant for both client connect and indications sent via https. ++#sslKeyFallbackFilePath: @sysconfdir@/sfcb/file-fallback.pem ++ ++## Filename containing the server's fall back certificate. Must be in PEM format. ++## The file is relevant for both client connect and indications sent via https. ++#sslCertificateFallbackFilePath: @sysconfdir@/sfcb/server-fallback.pem ++ + ## Filename containing list of certificates server accepts. + ## The file is relevant client connect only. + ## Default is @sysconfdir@/sfcb/clist.pem +@@ -302,10 +311,10 @@ sslCiphers: ALL:!ADH:!LOW:!EXP:!MD5:@STR + ## Configure a curve name for ECDH ephemeral key generation. See man + ## SSL_CTX_set_tmp_ecdh(3) for details. The value should be a curve name + ## listed by the "openssl ecparam -list_curves" command in the SFCB runtime +-## environment. If this value is not set, the indicated default is in effect. ++## environment. If this value is not set, ECDH ephemeral key generation is not used. + ## If the value is set but the curve name is not recognized by the underlying + ## openssl implementation, SFCB will abort. +-## Default is secp384r1 ++## Default is: not set + #sslEcDhCurveName: secp384r1 + + ## When set to true, sets the SSL_OP_CIPHER_SERVER_PREFERENCE flag for the ssl diff --git a/sblim-sfcb.spec b/sblim-sfcb.spec index b79a92f..dfe1099 100644 --- a/sblim-sfcb.spec +++ b/sblim-sfcb.spec @@ -8,7 +8,7 @@ Name: sblim-sfcb Summary: Small Footprint CIM Broker URL: http://sblim.wiki.sourceforge.net/ Version: 1.4.9 -Release: 26%{?dist} +Release: 27%{?dist} License: EPL-1.0 Source0: http://downloads.sourceforge.net/sblim/%{name}-%{version}.tar.bz2 Source1: sfcb.service @@ -46,6 +46,9 @@ Patch10: sblim-sfcb-1.4.9-docdir-license.patch # Patch11: use sscg to generate cert, openssl as fallback, obtain correct # key length based upon crypto policy level Patch11: sblim-sfcb-1.4.9-ssl-certs-gen-changes.patch +# Patch12: adds configuration options to specify fallback SSL cert/key pair +# and disables default ECDH ephemeral key generation +Patch12: sblim-sfcb-1.4.9-post-quantum.patch Provides: cim-server = 0 Requires: cim-schema Requires: sblim-sfcCommon @@ -88,6 +91,7 @@ Programming Interface (CMPI). %patch -P9 -p1 -b .fix-ppc-optimization-level %patch -P10 -p1 -b .docdir-license %patch -P11 -p1 -b .ssl-certs-gen-changes +%patch -P12 -p1 -b .post-quantum # Create a sysusers.d config file cat >sblim-sfcb.sysusers.conf < - 1.4.9-27 +- Add support for post-quantum cryptography + Resolves: RHEL-127515 + * Tue Sep 30 2025 Vitezslav Crhonek - 1.4.9-26 - Update OpenSSL certificates set up Resolves: RHEL-118293