rpms/tog-pegasus
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Support added for post-quantum cryptography

Browse Source 
Resolves: RHEL-93093
This commit is contained in:
Vitezslav Crhonek 2025-07-21 09:05:34 +02:00
parent ec860f844b
commit 01e5ee7e5b
2 changed files with 70 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

62
pegasus-2.14.1-post-quantum.patch Normal file
View File

@ -0,0 +1,62 @@
diff -up pegasus/src/Pegasus/Common/SSLContext.cpp.orig pegasus/src/Pegasus/Common/SSLContext.cpp
--- pegasus/src/Pegasus/Common/SSLContext.cpp.orig 2025-05-30 09:11:14.935204675 +0200
+++ pegasus/src/Pegasus/Common/SSLContext.cpp 2025-06-18 09:29:02.485778858 +0200
@@ -1095,6 +1095,58 @@ SSL_CTX* SSLContextRep::_makeSSLContext(
keyLoaded = true;
}
+ //
+ // Load fall back certificate/key pair if both exist
+ //
+
+ const String& certFallbackPath = "/etc/pki/Pegasus/server-fallback.pem";
+ const String& keyFallbackPath = "/etc/pki/Pegasus/file-fallback.pem";
+
+ FILE* certIs = Executor::openFile(certFallbackPath.getCString(), 'r');
+ FILE* keyIs = Executor::openFile(keyFallbackPath.getCString(), 'r');
+
+ if (certIs && keyIs)
+ {
+ fclose(certIs);
+ fclose(keyIs);
+
+ PEG_TRACE((TRC_SSL, Tracer::LEVEL4,
+ "---> SSL: Loading server certificate fall back from: %s",
+ (const char*)certFallbackPath.getCString()));
+
+ if (SSL_CTX_use_certificate_file(sslContext,
+ (const char*)certFallbackPath.getCString(), SSL_FILETYPE_PEM) != 1)
+ {
+ PEG_TRACE((TRC_SSL, Tracer::LEVEL1,
+ "---> SSL: No server certificate fall back found in %s",
+ (const char*)certFallbackPath.getCString()));
+ MessageLoaderParms parms(
+ "Common.SSLContext.COULD_NOT_ACCESS_SERVER_CERTIFICATE",
+ "Could not access server certificate fall back in $0.",
+ (const char*)certFallbackPath.getCString());
+
+ SSL_CTX_free(sslContext);
+ sslContext = NULL;
+ PEG_METHOD_EXIT();
+ throw SSLException(parms);
+ }
+
+ PEG_TRACE((TRC_SSL, Tracer::LEVEL4,
+ "---> SSL: loading private key fall back from: %s",
+ (const char*)keyFallbackPath.getCString()));
+
+ if (SSL_CTX_use_PrivateKey_file(sslContext, (const char*)keyFallbackPath.getCString(), SSL_FILETYPE_PEM) != 1)
+ {
+ MessageLoaderParms parms(
+ "Common.SSLContext.COULD_NOT_GET_PRIVATE_KEY",
+ "Could not get private key fall back.");
+ SSL_CTX_free(sslContext);
+ sslContext = NULL;
+ PEG_METHOD_EXIT();
+ throw SSLException(parms);
+ }
+ }
+
PEG_METHOD_EXIT();
return sslContext;
}

9
tog-pegasus.spec
View File

@ -6,7 +6,7 @@
Name: tog-pegasus
Version: %{major_ver}.1
Release: 77%{?dist}
Release: 78%{?dist}
Epoch: 2
Summary: OpenPegasus WBEM Services for Linux
@ -113,6 +113,8 @@ Patch48: add-riscv64-support.patch
# 49: use sscg to generate cert, openssl as fallback, obtain correct key length
# based upon crypto policy level
Patch49: pegasus-2.14.1-ssl-certs-gen-changes.patch
# 50: add mechanism to load fall back certificate/key pair
Patch50: pegasus-2.14.1-post-quantum.patch
BuildRequires: procps, libstdc++, pam-devel
BuildRequires: openssl, openssl-devel
@ -272,6 +274,7 @@ yes | mak/CreateDmtfSchema 238 %{SOURCE9} cim_schema_2.38.0
%patch -P47 -p1 -b .snmp-disable-des
%patch -P48 -p1 -b .add-riscv64-support
%patch -P49 -p1 -b .ssl-certs-gen-changes
%patch -P50 -p1 -b .post-quantum
%build
@ -578,6 +581,10 @@ fi
%changelog
* Mon Jul 21 2025 Vitezslav Crhonek <vcrhonek@redhat.com> - 2:2.14.1-78
- Support added for post-quantum cryptography
Resolves: RHEL-93093
* Fri Apr 11 2025 Vitezslav Crhonek <vcrhonek@redhat.com> - 2:2.14.1-77
- Update OpenSSL certificates set up
Resolves: RHEL-86503