Compare commits
4 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Fedora Release Engineering
|
32c91f31be | ||
|
Bill Nottingham
|
e8def3b647 | ||
|
srinivas ramanatha
|
1132fc64a5 | ||
|
Huzaifa Sidhpurwala
|
4600ef9ebd |
@@ -1 +0,0 @@
|
||||
1
|
||||
+1
-2
@@ -1,2 +1 @@
|
||||
/openwsmand.8.gz
|
||||
/v2.8.1.tar.gz
|
||||
openwsman-2.1.0.tar.bz2
|
||||
|
||||
@@ -1,13 +0,0 @@
|
||||
diff -up openwsman-2.6.8/etc/pam/openwsman.orig openwsman-2.6.8/etc/pam/openwsman
|
||||
--- openwsman-2.6.8/etc/pam/openwsman.orig 2018-11-21 13:51:52.776325243 +0100
|
||||
+++ openwsman-2.6.8/etc/pam/openwsman 2018-11-21 13:54:17.066351134 +0100
|
||||
@@ -2,6 +2,6 @@
|
||||
auth required pam_unix.so nullok
|
||||
auth required pam_nologin.so
|
||||
account required pam_unix.so
|
||||
-password required pam_cracklib.so nullok
|
||||
-password required pam_unix.so nullok use_first_pass use_authtok nis shadow
|
||||
-session required pam_unix.so none
|
||||
+password required pam_pwquality.so
|
||||
+password required pam_unix.so nullok use_first_pass use_authtok
|
||||
+session required pam_unix.so
|
||||
@@ -1,12 +0,0 @@
|
||||
diff -up openwsman-2.7.2/bindings/ruby/extconf.rb.orig openwsman-2.7.2/bindings/ruby/extconf.rb
|
||||
--- openwsman-2.7.2/bindings/ruby/extconf.rb.orig 2022-12-28 16:43:03.000000000 +0100
|
||||
+++ openwsman-2.7.2/bindings/ruby/extconf.rb 2023-08-09 12:50:21.361216733 +0200
|
||||
@@ -32,7 +32,7 @@ swig = find_executable("swig")
|
||||
raise "SWIG not found" unless swig
|
||||
|
||||
major, minor, path = RUBY_VERSION.split(".")
|
||||
-raise "SWIG failed to run" unless system("#{swig} -ruby -autorename -DRUBY_VERSION=#{major}#{minor} -I. -I/usr/include/openwsman -o openwsman_wrap.c openwsman.i")
|
||||
+raise "SWIG failed to run" unless system("#{swig} -ruby -autorename -DRUBY_VERSION=#{major}#{minor} -I. -I/usr/include/openwsman -I/builddir/build/BUILD/openwsman-2.8.1-build/openwsman-2.8.1/include -o openwsman_wrap.c openwsman.i")
|
||||
|
||||
$CPPFLAGS = "-I/usr/include/openwsman -I.."
|
||||
|
||||
@@ -1,135 +0,0 @@
|
||||
diff -up openwsman-2.8.1/src/server/shttpd/compat_unix.h.orig openwsman-2.8.1/src/server/shttpd/compat_unix.h
|
||||
--- openwsman-2.8.1/src/server/shttpd/compat_unix.h.orig 2025-01-23 10:23:52.000000000 +0100
|
||||
+++ openwsman-2.8.1/src/server/shttpd/compat_unix.h 2025-02-03 09:11:35.072818890 +0100
|
||||
@@ -27,10 +27,6 @@
|
||||
pthread_create(&tid, NULL, (void *(*)(void *))a, c); } while (0)
|
||||
#endif /* !NO_THREADS */
|
||||
|
||||
-#ifndef SSL_LIB
|
||||
-#define SSL_LIB "libssl.so"
|
||||
-#endif
|
||||
-
|
||||
#define DIRSEP '/'
|
||||
#define IS_DIRSEP_CHAR(c) ((c) == '/')
|
||||
#define O_BINARY 0
|
||||
diff -up openwsman-2.8.1/src/server/shttpd/io_ssl.c.orig openwsman-2.8.1/src/server/shttpd/io_ssl.c
|
||||
--- openwsman-2.8.1/src/server/shttpd/io_ssl.c.orig 2025-01-23 10:23:52.000000000 +0100
|
||||
+++ openwsman-2.8.1/src/server/shttpd/io_ssl.c 2025-02-03 09:12:22.387355905 +0100
|
||||
@@ -11,28 +11,6 @@
|
||||
#include "defs.h"
|
||||
|
||||
#if !defined(NO_SSL)
|
||||
-struct ssl_func ssl_sw[] = {
|
||||
- {"SSL_free", {0}},
|
||||
- {"SSL_accept", {0}},
|
||||
- {"SSL_connect", {0}},
|
||||
- {"SSL_read", {0}},
|
||||
- {"SSL_write", {0}},
|
||||
- {"SSL_get_error", {0}},
|
||||
- {"SSL_set_fd", {0}},
|
||||
- {"SSL_new", {0}},
|
||||
- {"SSL_CTX_new", {0}},
|
||||
-#if OPENSSL_VERSION_NUMBER < 0x10100000L
|
||||
- {"SSLv23_server_method", {0}},
|
||||
- {"SSL_library_init", {0}},
|
||||
-#else
|
||||
- {"TLS_server_method", {0}},
|
||||
- {"OPENSSL_init_ssl", {0}},
|
||||
-#endif
|
||||
- {"SSL_CTX_use_PrivateKey_file", {0}},
|
||||
- {"SSL_CTX_use_certificate_file",{0}},
|
||||
- {NULL, {0}}
|
||||
-};
|
||||
-
|
||||
void
|
||||
_shttpd_ssl_handshake(struct stream *stream)
|
||||
{
|
||||
diff -up openwsman-2.8.1/src/server/shttpd/shttpd.c.orig openwsman-2.8.1/src/server/shttpd/shttpd.c
|
||||
--- openwsman-2.8.1/src/server/shttpd/shttpd.c.orig 2025-01-23 10:23:52.000000000 +0100
|
||||
+++ openwsman-2.8.1/src/server/shttpd/shttpd.c 2025-02-03 09:13:43.415562784 +0100
|
||||
@@ -1510,25 +1510,13 @@ set_ssl(struct shttpd_ctx *ctx, const ch
|
||||
int retval = FALSE;
|
||||
EC_KEY* key;
|
||||
|
||||
- /* Load SSL library dynamically */
|
||||
- if ((lib = dlopen(SSL_LIB, RTLD_LAZY)) == NULL) {
|
||||
- _shttpd_elog(E_LOG, NULL, "set_ssl: cannot load %s", SSL_LIB);
|
||||
- return (FALSE);
|
||||
- }
|
||||
-
|
||||
- for (fp = ssl_sw; fp->name != NULL; fp++)
|
||||
- if ((fp->ptr.v_void = dlsym(lib, fp->name)) == NULL) {
|
||||
- _shttpd_elog(E_LOG, NULL,"set_ssl: cannot find %s", fp->name);
|
||||
- return (FALSE);
|
||||
- }
|
||||
-
|
||||
/* Initialize SSL crap */
|
||||
|
||||
#if OPENSSL_VERSION_NUMBER < 0x10100000L
|
||||
SSL_library_init();
|
||||
if ((CTX = SSL_CTX_new(SSLv23_server_method())) == NULL)
|
||||
#else
|
||||
- OPENSSL_init_ssl();
|
||||
+ OPENSSL_init_ssl(0, NULL);
|
||||
if ((CTX = SSL_CTX_new(TLS_server_method())) == NULL)
|
||||
#endif
|
||||
_shttpd_report_ssl_error("SSL_CTX_new failed", NULL);
|
||||
diff -up openwsman-2.8.1/src/server/shttpd/ssl.h.orig openwsman-2.8.1/src/server/shttpd/ssl.h
|
||||
--- openwsman-2.8.1/src/server/shttpd/ssl.h.orig 2025-01-23 10:23:52.000000000 +0100
|
||||
+++ openwsman-2.8.1/src/server/shttpd/ssl.h 2025-02-03 09:14:43.142975166 +0100
|
||||
@@ -12,55 +12,4 @@
|
||||
|
||||
#include <openssl/ssl.h>
|
||||
|
||||
-#else
|
||||
-
|
||||
-/*
|
||||
- * Snatched from OpenSSL includes. I put the prototypes here to be independent
|
||||
- * from the OpenSSL source installation. Having this, shttpd + SSL can be
|
||||
- * built on any system with binary SSL libraries installed.
|
||||
- */
|
||||
-
|
||||
-typedef struct ssl_st SSL;
|
||||
-typedef struct ssl_method_st SSL_METHOD;
|
||||
-typedef struct ssl_ctx_st SSL_CTX;
|
||||
-
|
||||
-#define SSL_ERROR_WANT_READ 2
|
||||
-#define SSL_ERROR_WANT_WRITE 3
|
||||
-#define SSL_ERROR_SYSCALL 5
|
||||
-#define SSL_FILETYPE_PEM 1
|
||||
-
|
||||
-#endif
|
||||
-
|
||||
-/*
|
||||
- * Dynamically loaded SSL functionality
|
||||
- */
|
||||
-struct ssl_func {
|
||||
- const char *name; /* SSL function name */
|
||||
- union variant ptr; /* Function pointer */
|
||||
-};
|
||||
-
|
||||
-extern struct ssl_func ssl_sw[];
|
||||
-
|
||||
-#define FUNC(x) ssl_sw[x].ptr.v_func
|
||||
-
|
||||
-#define SSL_free(x) (* (void (*)(SSL *)) FUNC(0))(x)
|
||||
-#define SSL_accept(x) (* (int (*)(SSL *)) FUNC(1))(x)
|
||||
-#define SSL_connect(x) (* (int (*)(SSL *)) FUNC(2))(x)
|
||||
-#define SSL_read(x,y,z) (* (int (*)(SSL *, void *, int)) FUNC(3))((x),(y),(z))
|
||||
-#define SSL_write(x,y,z) \
|
||||
- (* (int (*)(SSL *, const void *,int)) FUNC(4))((x), (y), (z))
|
||||
-#define SSL_get_error(x,y)(* (int (*)(SSL *, int)) FUNC(5))((x), (y))
|
||||
-#define SSL_set_fd(x,y) (* (int (*)(SSL *, int)) FUNC(6))((x), (y))
|
||||
-#define SSL_new(x) (* (SSL * (*)(SSL_CTX *)) FUNC(7))(x)
|
||||
-#define SSL_CTX_new(x) (* (SSL_CTX * (*)(const SSL_METHOD *)) FUNC(8))(x)
|
||||
-#if OPENSSL_VERSION_NUMBER < 0x10100000L
|
||||
-#define SSLv23_server_method() (* (SSL_METHOD * (*)(void)) FUNC(9))()
|
||||
-#define SSL_library_init() (* (int (*)(void)) FUNC(10))()
|
||||
-#else
|
||||
-#define TLS_server_method() (* (SSL_METHOD * (*)(void)) FUNC(9))()
|
||||
-#define OPENSSL_init_ssl() (* (int (*)(void)) FUNC(10))()
|
||||
#endif
|
||||
-#define SSL_CTX_use_PrivateKey_file(x,y,z) (* (int (*)(SSL_CTX *, \
|
||||
- const char *, int)) FUNC(11))((x), (y), (z))
|
||||
-#define SSL_CTX_use_certificate_file(x,y,z) (* (int (*)(SSL_CTX *, \
|
||||
- const char *, int)) FUNC(12))((x), (y), (z))
|
||||
@@ -1,39 +0,0 @@
|
||||
diff -up openwsman-4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b/src/server/wsmand-listener.c.orig openwsman-4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b/src/server/wsmand-listener.c
|
||||
--- openwsman-4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b/src/server/wsmand-listener.c.orig 2016-07-27 16:03:55.000000000 +0200
|
||||
+++ openwsman-4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b/src/server/wsmand-listener.c 2018-01-22 13:05:04.478923300 +0100
|
||||
@@ -344,6 +344,35 @@ DONE:
|
||||
if (fault_reason == NULL) {
|
||||
// this is a way to segfault, investigate
|
||||
//fault_reason = shttpd_reason_phrase(status);
|
||||
+ // ugly workaround follows...
|
||||
+ switch (status) {
|
||||
+ case 200:
|
||||
+ fault_reason = "OK";
|
||||
+ break;
|
||||
+ case 400:
|
||||
+ fault_reason = "Bad request";
|
||||
+ break;
|
||||
+ case 401:
|
||||
+ fault_reason = "Unauthorized";
|
||||
+ break;
|
||||
+ case 403:
|
||||
+ fault_reason = "Forbidden";
|
||||
+ break;
|
||||
+ case 404:
|
||||
+ fault_reason = "Not found";
|
||||
+ break;
|
||||
+ case 500:
|
||||
+ fault_reason = "Internal Error";
|
||||
+ break;
|
||||
+ case 501:
|
||||
+ fault_reason = "Not implemented";
|
||||
+ break;
|
||||
+ case 415:
|
||||
+ fault_reason = "Unsupported Media Type";
|
||||
+ break;
|
||||
+ default:
|
||||
+ fault_reason = "";
|
||||
+ }
|
||||
}
|
||||
debug("Response status=%d (%s)", status, fault_reason);
|
||||
|
||||
@@ -1,12 +0,0 @@
|
||||
diff -up openwsman-2.7.1/etc/ssleay.cnf.orig openwsman-2.7.1/etc/ssleay.cnf
|
||||
--- openwsman-2.7.1/etc/ssleay.cnf.orig 2021-11-09 08:27:48.577749509 +0100
|
||||
+++ openwsman-2.7.1/etc/ssleay.cnf 2021-11-09 08:28:10.499967010 +0100
|
||||
@@ -3,7 +3,7 @@
|
||||
#
|
||||
|
||||
[ req ]
|
||||
-default_bits = 1024
|
||||
+default_bits = 2048
|
||||
default_keyfile = privkey.pem
|
||||
distinguished_name = req_distinguished_name
|
||||
|
||||
@@ -1,24 +0,0 @@
|
||||
diff -up openwsman-2.8.1/src/plugins/swig/src/target_ruby.c.orig openwsman-2.8.1/src/plugins/swig/src/target_ruby.c
|
||||
--- openwsman-2.8.1/src/plugins/swig/src/target_ruby.c.orig 2025-01-23 10:23:52.000000000 +0100
|
||||
+++ openwsman-2.8.1/src/plugins/swig/src/target_ruby.c 2025-02-03 09:30:36.905616375 +0100
|
||||
@@ -49,7 +49,7 @@
|
||||
*/
|
||||
|
||||
static VALUE
|
||||
-load_module()
|
||||
+load_module(VALUE)
|
||||
{
|
||||
ruby_script(PLUGIN_FILE);
|
||||
return rb_require(PLUGIN_FILE);
|
||||
diff -up openwsman-2.8.1/src/server/CMakeLists.txt.orig openwsman-2.8.1/src/server/CMakeLists.txt
|
||||
--- openwsman-2.8.1/src/server/CMakeLists.txt.orig 2025-01-23 10:23:52.000000000 +0100
|
||||
+++ openwsman-2.8.1/src/server/CMakeLists.txt 2025-02-03 09:31:15.258241237 +0100
|
||||
@@ -48,7 +48,7 @@ IF( HAVE_LIBDL )
|
||||
TARGET_LINK_LIBRARIES(openwsmand ${DL_LIBRARIES})
|
||||
ENDIF( HAVE_LIBDL )
|
||||
|
||||
-INSTALL(TARGETS openwsmand DESTINATION ${CMAKE_INSTALL_PREFIX}/sbin)
|
||||
+INSTALL(TARGETS openwsmand DESTINATION ${CMAKE_INSTALL_PREFIX}/bin)
|
||||
|
||||
#
|
||||
#
|
||||
@@ -1,101 +0,0 @@
|
||||
diff -up openwsman-2.7.2/etc/openwsman.conf.orig openwsman-2.7.2/etc/openwsman.conf
|
||||
--- openwsman-2.7.2/etc/openwsman.conf.orig 2022-12-28 16:43:03.000000000 +0100
|
||||
+++ openwsman-2.7.2/etc/openwsman.conf 2025-05-27 08:03:57.890057721 +0200
|
||||
@@ -32,8 +32,12 @@ ipv6 = yes
|
||||
|
||||
# the openwsman server certificate file, in .pem format
|
||||
ssl_cert_file = /etc/openwsman/servercert.pem
|
||||
+# the openwsman server certificate fallback file, in .pem format
|
||||
+#ssl_cert_fallback_file = /etc/openwsman/servercert-fallback.pem
|
||||
# the openwsman server private key, in .pem format
|
||||
ssl_key_file = /etc/openwsman/serverkey.pem
|
||||
+# the openwsman server private key fallback, in .pem format
|
||||
+#ssl_key_fallback_file = /etc/openwsman/serverkey-fallback.pem
|
||||
|
||||
# space-separated list of SSL protocols to *dis*able
|
||||
# possible values: SSLv2 SSLv3 TLSv1 TLSv1_1 TLSv1_2
|
||||
diff -up openwsman-2.7.2/src/server/shttpd/shttpd.c.orig openwsman-2.7.2/src/server/shttpd/shttpd.c
|
||||
--- openwsman-2.7.2/src/server/shttpd/shttpd.c.orig 2025-05-21 10:07:40.404532496 +0200
|
||||
+++ openwsman-2.7.2/src/server/shttpd/shttpd.c 2025-06-12 12:27:44.785904555 +0200
|
||||
@@ -1491,7 +1491,6 @@ set_ssl(struct shttpd_ctx *ctx, const ch
|
||||
char *ssl_disabled_protocols = wsmand_options_get_ssl_disabled_protocols();
|
||||
char *ssl_cipher_list = wsmand_options_get_ssl_cipher_list();
|
||||
int retval = FALSE;
|
||||
- EC_KEY* key;
|
||||
|
||||
/* Initialize SSL crap */
|
||||
|
||||
@@ -1510,11 +1509,15 @@ set_ssl(struct shttpd_ctx *ctx, const ch
|
||||
else
|
||||
retval = TRUE;
|
||||
|
||||
- /* This enables ECDH Perfect Forward secrecy. Currently with just the most generic p256 prime curve */
|
||||
- key = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
|
||||
- if (key != NULL) {
|
||||
- SSL_CTX_set_tmp_ecdh(CTX, key);
|
||||
- EC_KEY_free(key);
|
||||
+ /* Add fall back certificate/key pair */
|
||||
+ if (wsmand_options_get_ssl_cert_fallback_file() &&
|
||||
+ wsmand_options_get_ssl_key_fallback_file()) {
|
||||
+ if (SSL_CTX_use_certificate_file(CTX, wsmand_options_get_ssl_cert_fallback_file(), SSL_FILETYPE_PEM) != 1)
|
||||
+ _shttpd_elog(E_LOG, NULL, "cannot open certificate fallback file %s", pem);
|
||||
+ else if (SSL_CTX_use_PrivateKey_file(CTX, wsmand_options_get_ssl_key_fallback_file(), SSL_FILETYPE_PEM) != 1)
|
||||
+ _shttpd_elog(E_LOG, NULL, "cannot open fallback PrivateKey %s", pem);
|
||||
+ else
|
||||
+ retval = TRUE;
|
||||
}
|
||||
|
||||
while (ssl_disabled_protocols) {
|
||||
diff -up openwsman-2.7.2/src/server/wsmand-daemon.c.orig openwsman-2.7.2/src/server/wsmand-daemon.c
|
||||
--- openwsman-2.7.2/src/server/wsmand-daemon.c.orig 2025-05-27 07:18:16.878974761 +0200
|
||||
+++ openwsman-2.7.2/src/server/wsmand-daemon.c 2025-05-27 07:22:06.832235764 +0200
|
||||
@@ -76,8 +76,10 @@ static int use_ipv6 = 0;
|
||||
#endif
|
||||
static int use_digest = 0;
|
||||
static char *ssl_key_file = NULL;
|
||||
+static char *ssl_key_fallback_file = NULL;
|
||||
static char *service_path = DEFAULT_SERVICE_PATH;
|
||||
static char *ssl_cert_file = NULL;
|
||||
+static char *ssl_cert_fallback_file = NULL;
|
||||
static char *ssl_disabled_protocols = NULL;
|
||||
static char *ssl_cipher_list = NULL;
|
||||
static char *pid_file = DEFAULT_PID_PATH;
|
||||
@@ -186,7 +188,9 @@ int wsmand_read_config(dictionary * ini)
|
||||
service_path =
|
||||
iniparser_getstring(ini, "server:service_path", "/wsman");
|
||||
ssl_key_file = iniparser_getstr(ini, "server:ssl_key_file");
|
||||
+ ssl_key_fallback_file = iniparser_getstr(ini, "server:ssl_key_fallback_file");
|
||||
ssl_cert_file = iniparser_getstr(ini, "server:ssl_cert_file");
|
||||
+ ssl_cert_fallback_file = iniparser_getstr(ini, "server:ssl_cert_fallback_file");
|
||||
ssl_disabled_protocols = iniparser_getstr(ini, "server:ssl_disabled_protocols");
|
||||
ssl_cipher_list = iniparser_getstr(ini, "server:ssl_cipher_list");
|
||||
use_ipv4 = iniparser_getboolean(ini, "server:ipv4", 1);
|
||||
@@ -364,6 +368,16 @@ char *wsmand_options_get_ssl_cert_file(v
|
||||
return ssl_cert_file;
|
||||
}
|
||||
|
||||
+char *wsmand_options_get_ssl_key_fallback_file(void)
|
||||
+{
|
||||
+ return ssl_key_fallback_file;
|
||||
+}
|
||||
+
|
||||
+char *wsmand_options_get_ssl_cert_fallback_file(void)
|
||||
+{
|
||||
+ return ssl_cert_fallback_file;
|
||||
+}
|
||||
+
|
||||
char *wsmand_options_get_ssl_disabled_protocols(void)
|
||||
{
|
||||
return ssl_disabled_protocols;
|
||||
diff -up openwsman-2.7.2/src/server/wsmand-daemon.h.orig openwsman-2.7.2/src/server/wsmand-daemon.h
|
||||
--- openwsman-2.7.2/src/server/wsmand-daemon.h.orig 2025-05-27 07:15:56.869002037 +0200
|
||||
+++ openwsman-2.7.2/src/server/wsmand-daemon.h 2025-05-27 07:18:06.429846617 +0200
|
||||
@@ -76,6 +76,8 @@ int wsmand_options_get_server_port(void)
|
||||
int wsmand_options_get_server_ssl_port(void);
|
||||
char *wsmand_options_get_ssl_key_file(void);
|
||||
char *wsmand_options_get_ssl_cert_file(void);
|
||||
+char *wsmand_options_get_ssl_key_fallback_file(void);
|
||||
+char *wsmand_options_get_ssl_cert_fallback_file(void);
|
||||
char *wsmand_options_get_ssl_disabled_protocols(void);
|
||||
char *wsmand_options_get_ssl_cipher_list(void);
|
||||
int wsmand_options_get_digest(void);
|
||||
@@ -0,0 +1,28 @@
|
||||
--- openwsman-2.0.0/etc/init/openwsmand.sh.in.orig 2008-09-07 00:01:29.000000000 -0500
|
||||
+++ openwsman-2.0.0/etc/init/openwsmand.sh.in 2008-09-07 00:34:57.000000000 -0500
|
||||
@@ -4,15 +4,13 @@
|
||||
# Provides: openwsmand
|
||||
# Required-Start: $remote_fs
|
||||
# Required-Stop: $network
|
||||
-# Default-Start: 2 3 4 5
|
||||
-# Default-Stop: 0 1 6
|
||||
# Short-Description: Openwsman Daemon
|
||||
# Description: openwsmand
|
||||
# Start/Stop the Openwsman Daemon
|
||||
### END INIT INFO
|
||||
#
|
||||
#
|
||||
-# chkconfig: 2345 36 64
|
||||
+# chkconfig: - 36 64
|
||||
# description: Openwsman Daemon
|
||||
# processname: openwsmand
|
||||
|
||||
@@ -57,7 +55,7 @@ case "$1" in
|
||||
if [ "x${FQDN}" = "x" ]; then
|
||||
FQDN=localhost.localdomain
|
||||
fi
|
||||
-cat << EOF | sh @SYSCONFDIR@/owsmangencert.sh > /dev/null 2>&1
|
||||
+cat << EOF | sh @libexecdir@/openwsman/owsmangencert.sh > /dev/null 2>&1
|
||||
--
|
||||
SomeState
|
||||
SomeCity
|
||||
@@ -1,7 +0,0 @@
|
||||
/usr/lib/systemd/system/openwsmand.* -- gen_context(system_u:object_r:openwsman_unit_file_t,s0)
|
||||
|
||||
/usr/sbin/openwsmand -- gen_context(system_u:object_r:openwsman_exec_t,s0)
|
||||
|
||||
/var/log/wsmand.* -- gen_context(system_u:object_r:openwsman_log_t,s0)
|
||||
|
||||
/var/run/wsmand.* -- gen_context(system_u:object_r:openwsman_run_t,s0)
|
||||
@@ -1,79 +0,0 @@
|
||||
## <summary>WS-Management Server</summary>
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Execute openwsman in the openwsman domin.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed to transition.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`openwsman_domtrans',`
|
||||
gen_require(`
|
||||
type openwsman_t, openwsman_exec_t;
|
||||
')
|
||||
|
||||
corecmd_search_bin($1)
|
||||
domtrans_pattern($1, openwsman_exec_t, openwsman_t)
|
||||
')
|
||||
########################################
|
||||
## <summary>
|
||||
## Execute openwsman server in the openwsman domain.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed to transition.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`openwsman_systemctl',`
|
||||
gen_require(`
|
||||
type openwsman_t;
|
||||
type openwsman_unit_file_t;
|
||||
')
|
||||
|
||||
systemd_exec_systemctl($1)
|
||||
init_reload_services($1)
|
||||
systemd_read_fifo_file_passwd_run($1)
|
||||
allow $1 openwsman_unit_file_t:file read_file_perms;
|
||||
allow $1 openwsman_unit_file_t:service manage_service_perms;
|
||||
|
||||
ps_process_pattern($1, openwsman_t)
|
||||
')
|
||||
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## All of the rules required to administrate
|
||||
## an openwsman environment
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
## <rolecap/>
|
||||
#
|
||||
interface(`openwsman_admin',`
|
||||
gen_require(`
|
||||
type openwsman_t;
|
||||
type openwsman_unit_file_t;
|
||||
')
|
||||
|
||||
allow $1 openwsman_t:process { signal_perms };
|
||||
ps_process_pattern($1, openwsman_t)
|
||||
|
||||
tunable_policy(`deny_ptrace',`',`
|
||||
allow $1 openwsman_t:process ptrace;
|
||||
')
|
||||
|
||||
openwsman_systemctl($1)
|
||||
admin_pattern($1, openwsman_unit_file_t)
|
||||
allow $1 openwsman_unit_file_t:service all_service_perms;
|
||||
optional_policy(`
|
||||
systemd_passwd_agent_exec($1)
|
||||
systemd_read_fifo_file_passwd_run($1)
|
||||
')
|
||||
')
|
||||
+103
-911
File diff suppressed because it is too large
Load Diff
@@ -1,74 +0,0 @@
|
||||
policy_module(openwsman, 1.0.0)
|
||||
|
||||
########################################
|
||||
#
|
||||
# Declarations
|
||||
#
|
||||
|
||||
type openwsman_t;
|
||||
type openwsman_exec_t;
|
||||
init_daemon_domain(openwsman_t, openwsman_exec_t)
|
||||
|
||||
type openwsman_tmp_t;
|
||||
files_tmp_file(openwsman_tmp_t)
|
||||
|
||||
type openwsman_tmpfs_t;
|
||||
files_tmpfs_file(openwsman_tmpfs_t)
|
||||
|
||||
type openwsman_log_t;
|
||||
logging_log_file(openwsman_log_t)
|
||||
|
||||
type openwsman_run_t;
|
||||
files_pid_file(openwsman_run_t)
|
||||
|
||||
type openwsman_unit_file_t;
|
||||
systemd_unit_file(openwsman_unit_file_t)
|
||||
|
||||
########################################
|
||||
#
|
||||
# openwsman local policy
|
||||
#
|
||||
|
||||
allow openwsman_t self:capability setuid;
|
||||
|
||||
allow openwsman_t self:process { fork };
|
||||
allow openwsman_t self:fifo_file rw_fifo_file_perms;
|
||||
allow openwsman_t self:unix_stream_socket create_stream_socket_perms;
|
||||
allow openwsman_t self:tcp_socket { accept create_socket_perms listen };
|
||||
|
||||
manage_files_pattern(openwsman_t, openwsman_tmp_t, openwsman_tmp_t)
|
||||
manage_dirs_pattern(openwsman_t, openwsman_tmp_t, openwsman_tmp_t)
|
||||
files_tmp_filetrans(openwsman_t, openwsman_tmp_t, { dir file })
|
||||
|
||||
manage_files_pattern(openwsman_t, openwsman_tmpfs_t, openwsman_tmpfs_t)
|
||||
manage_dirs_pattern(openwsman_t, openwsman_tmpfs_t, openwsman_tmpfs_t)
|
||||
fs_tmpfs_filetrans(openwsman_t, openwsman_tmpfs_t, { dir file })
|
||||
|
||||
manage_files_pattern(openwsman_t, openwsman_log_t, openwsman_log_t)
|
||||
logging_log_filetrans(openwsman_t, openwsman_log_t, { file })
|
||||
|
||||
manage_files_pattern(openwsman_t, openwsman_run_t, openwsman_run_t)
|
||||
files_pid_filetrans(openwsman_t, openwsman_run_t, { file })
|
||||
|
||||
auth_use_nsswitch(openwsman_t)
|
||||
auth_domtrans_chkpwd(openwsman_t)
|
||||
|
||||
corenet_tcp_connect_pegasus_https_port(openwsman_t)
|
||||
corenet_tcp_bind_vnc_port(openwsman_t)
|
||||
corenet_tcp_bind_http_port(openwsman_t)
|
||||
|
||||
dev_read_urand(openwsman_t)
|
||||
|
||||
logging_send_syslog_msg(openwsman_t)
|
||||
logging_send_audit_msgs(openwsman_t)
|
||||
|
||||
optional_policy(`
|
||||
sblim_stream_connect_sfcbd(openwsman_t)
|
||||
sblim_rw_semaphores_sfcbd(openwsman_t)
|
||||
sblim_getattr_exec_sfcbd(openwsman_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
unconfined_domain(openwsman_t)
|
||||
')
|
||||
|
||||
@@ -1,12 +0,0 @@
|
||||
[Unit]
|
||||
Description=Openwsman WS-Management Service
|
||||
After=syslog.target
|
||||
|
||||
[Service]
|
||||
Type=forking
|
||||
ExecStart=/usr/sbin/openwsmand -S
|
||||
ExecStartPre=/etc/openwsman/owsmantestcert.sh
|
||||
PIDFile=/run/wsmand.pid
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@@ -1,21 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
if [ ! -f "/etc/openwsman/serverkey.pem" ]; then
|
||||
if [ -f "/etc/ssl/servercerts/servercert.pem" \
|
||||
-a -f "/etc/ssl/servercerts/serverkey.pem" ]; then
|
||||
echo "Using common server certificate /etc/ssl/servercerts/servercert.pem"
|
||||
ln -s /etc/ssl/servercerts/server{cert,key}.pem /etc/openwsman
|
||||
exit 0
|
||||
else
|
||||
echo "FAILED: Starting openwsman server"
|
||||
echo "There is no ssl server key available for openwsman server to use."
|
||||
echo -e "Please generate one with the following script and start the openwsman service again:\n"
|
||||
echo "##################################"
|
||||
echo "/etc/openwsman/owsmangencert.sh"
|
||||
echo "================================="
|
||||
|
||||
echo "NOTE: The script uses /dev/random device for generating some random bits while generating the server key."
|
||||
echo " If this takes too long, you can replace the value of \"RANDFILE\" in /etc/openwsman/ssleay.cnf with /dev/urandom. Please understand the implications of replacing the RNADFILE."
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
@@ -1,9 +0,0 @@
|
||||
summary: Basic test plan
|
||||
prepare:
|
||||
how: install
|
||||
package:
|
||||
- openwsman-server
|
||||
discover:
|
||||
how: fmf
|
||||
execute:
|
||||
how: tmt
|
||||
@@ -1,5 +0,0 @@
|
||||
---
|
||||
badfuncs:
|
||||
allowed:
|
||||
/usr/sbin/openwsmand:
|
||||
- inet_ntoa
|
||||
@@ -1,2 +1 @@
|
||||
SHA512 (openwsmand.8.gz) = 751c40060781e8b5a847e09aee94833ed1e4fbe966f052e5023cb209361acc312078d0d75c0806bd9990da061d3048566418135d3670dd620c6b809e5d0e594c
|
||||
SHA512 (v2.8.1.tar.gz) = 3c72b6778269186108e48203a9c37f1e4ea8ff532013a80be6af3c6e8d2bf89343233287bc4eb2e955b8db4b7cf6d20818f77423781f6fdb52a6317a7e8bc972
|
||||
25a135bea7c1653f66b2428c4b252d3a openwsman-2.1.0.tar.bz2
|
||||
|
||||
@@ -1,6 +0,0 @@
|
||||
summary: Post-quantum cryptography support test
|
||||
author: Vitezslav Crhonek <vcrhonek@redhat.com>
|
||||
contact: Vitezslav Crhonek <vcrhonek@redhat.com>
|
||||
require: patch
|
||||
duration: 10m
|
||||
test: ./runtest.sh
|
||||
@@ -1,92 +0,0 @@
|
||||
#!/bin/sh -eux
|
||||
|
||||
function check_key_and_cert()
|
||||
{
|
||||
echo -e "\n===== key info"
|
||||
ssh-keygen -l -f /etc/openwsman/serverkey.pem || :
|
||||
file /etc/openwsman/serverkey.pem
|
||||
echo -e "\n\n\n"
|
||||
|
||||
echo -e "\n===== cert info"
|
||||
openssl x509 -in /etc/openwsman/servercert.pem --text --noout
|
||||
echo -e "\n\n\n"
|
||||
}
|
||||
|
||||
function test_key_exchange()
|
||||
{
|
||||
echo -e "\n===== check that it uses TLS 1.3 and the X25519MLKEM768 key exchange by default if the peer supports it"
|
||||
openssl s_client -connect localhost:5986 -CAfile /etc/openwsman/servercert.pem </dev/null | tee key-exchange.out
|
||||
echo -e "\n\n\n"
|
||||
grep "Negotiated TLS1.3 group: X25519MLKEM768" key-exchange.out
|
||||
echo -e "\n\n\n"
|
||||
}
|
||||
|
||||
function test_cert_support()
|
||||
{
|
||||
echo -e "\n===== check that TLS certificate using ML-DSA works"
|
||||
openssl s_client -connect localhost:5986 -CAfile /etc/openwsman/servercert.pem </dev/null | tee cert-mldsa.out
|
||||
echo -e "\n\n\n"
|
||||
grep "Peer signature type: mldsa65" cert-mldsa.out
|
||||
echo -e "\n\n\n"
|
||||
# simulate lack of ML-DSA support
|
||||
echo "\n===== check support for a classic certificate chain if peer doesn't support ML-DSA certificate"
|
||||
openssl s_client -connect localhost:5986 -CAfile /etc/openwsman/servercert-fallback.pem </dev/null -sigalgs 'rsa_pss_pss_sha256:rsa_pss_rsae_sha256' </dev/null | \
|
||||
tee cert-classic.out
|
||||
echo -e "\n\n\n"
|
||||
grep "Peer signature type: rsa_pss_rsae_sha256" cert-classic.out
|
||||
echo -e "\n\n\n"
|
||||
}
|
||||
|
||||
(echo CZ; echo "Czech Republic"; echo Brno; echo "Red Hat"; echo "Core Services"; echo localhost; echo joe@example.com; ) | /etc/openwsman/owsmangencert.sh
|
||||
systemctl start openwsmand
|
||||
check_key_and_cert
|
||||
test_key_exchange
|
||||
systemctl stop openwsmand
|
||||
|
||||
# keep RSA certificate and key
|
||||
cp /etc/openwsman/servercert.pem /etc/openwsman/servercert-fallback.pem
|
||||
cp /etc/openwsman/serverkey.pem /etc/openwsman/serverkey-fallback.pem
|
||||
# remove previously generated certificates/keys
|
||||
rm -rf /etc/openwsman/{servercert,serverkey}.pem
|
||||
|
||||
# update genOpenPegasusSSLCerts to generate a new key using ML-DSA-65
|
||||
# and issue a self-signed certificate for localhost using this key
|
||||
patch /etc/openwsman/owsmangencert.sh << 'EOF'
|
||||
--- /etc/openwsman/owsmangencert.sh.orig 2025-06-25 04:03:22.295778704 -0400
|
||||
+++ /etc/openwsman/owsmangencert.sh 2025-06-25 04:05:12.181435542 -0400
|
||||
@@ -26,7 +26,7 @@
|
||||
# certificate is created
|
||||
|
||||
openssl req -days 365 $@ -config $CNFFILE \
|
||||
- -newkey rsa:2048 -x509 -nodes -out $CERTFILE \
|
||||
+ -newkey mldsa65 -x509 -nodes -out $CERTFILE \
|
||||
-keyout $KEYFILE
|
||||
chmod 600 $KEYFILE
|
||||
|
||||
EOF
|
||||
|
||||
(echo CZ; echo "Czech Republic"; echo Brno; echo "Red Hat"; echo "Core Services"; echo localhost; echo joe@example.com; ) | /etc/openwsman/owsmangencert.sh
|
||||
|
||||
# update config file
|
||||
patch /etc/openwsman/openwsman.conf << 'EOF'
|
||||
--- openwsman.conf.orig 2025-06-05 07:50:30.285822838 -0400
|
||||
+++ openwsman.conf 2025-06-05 07:50:38.609822838 -0400
|
||||
@@ -33,11 +33,11 @@
|
||||
# the openwsman server certificate file, in .pem format
|
||||
ssl_cert_file = /etc/openwsman/servercert.pem
|
||||
# the openwsman server certificate fallback file, in .pem format
|
||||
-#ssl_cert_fallback_file = /etc/openwsman/servercert-fallback.pem
|
||||
+ssl_cert_fallback_file = /etc/openwsman/servercert-fallback.pem
|
||||
# the openwsman server private key, in .pem format
|
||||
ssl_key_file = /etc/openwsman/serverkey.pem
|
||||
# the openwsman server private key fallback, in .pem format
|
||||
-#ssl_key_fallback_file = /etc/openwsman/serverkey-fallback.pem
|
||||
+ssl_key_fallback_file = /etc/openwsman/serverkey-fallback.pem
|
||||
|
||||
# space-separated list of SSL protocols to *dis*able
|
||||
# possible values: SSLv2 SSLv3 TLSv1 TLSv1_1 TLSv1_2
|
||||
EOF
|
||||
|
||||
systemctl start openwsmand
|
||||
check_key_and_cert
|
||||
test_cert_support
|
||||
Reference in New Issue
Block a user