diff --git a/SOURCES/openwsman-2.4.0-pamsetup.patch b/SOURCES/openwsman-2.4.0-pamsetup.patch new file mode 100644 index 00000000..928c239b --- /dev/null +++ b/SOURCES/openwsman-2.4.0-pamsetup.patch @@ -0,0 +1,15 @@ +diff -up openwsman-2.4.0/etc/pam/openwsman.pamsetup openwsman-2.4.0/etc/pam/openwsman +--- openwsman-2.4.0/etc/pam/openwsman.pamsetup 2013-09-27 17:14:39.147565052 +0200 ++++ openwsman-2.4.0/etc/pam/openwsman 2013-09-27 17:15:12.744578165 +0200 +@@ -1,7 +1,7 @@ + #%PAM-1.0 +-auth required pam_unix2.so nullok ++auth required pam_unix.so nullok + auth required pam_nologin.so +-account required pam_unix2.so ++account required pam_unix.so + password required pam_pwcheck.so nullok +-password required pam_unix2.so nullok use_first_pass use_authtok +-session required pam_unix2.so none ++password required pam_unix.so nullok use_first_pass use_authtok ++session required pam_unix.so none diff --git a/SOURCES/openwsman-2.6.2-openssl-1.1-fix.patch b/SOURCES/openwsman-2.6.2-openssl-1.1-fix.patch new file mode 100644 index 00000000..82c333c4 --- /dev/null +++ b/SOURCES/openwsman-2.6.2-openssl-1.1-fix.patch @@ -0,0 +1,192 @@ +diff -up openwsman-4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b/src/lib/wsman-curl-client-transport.c.orig openwsman-4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b/src/lib/wsman-curl-client-transport.c +--- openwsman-4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b/src/lib/wsman-curl-client-transport.c.orig 2016-07-27 16:03:55.000000000 +0200 ++++ openwsman-4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b/src/lib/wsman-curl-client-transport.c 2017-09-12 12:56:51.720463095 +0200 +@@ -241,12 +241,20 @@ write_handler( void *ptr, size_t size, s + static int ssl_certificate_thumbprint_verify_callback(X509_STORE_CTX *ctx, void *arg) + { + unsigned char *thumbprint = (unsigned char *)arg; +- X509 *cert = ctx->cert; + EVP_MD *tempDigest; + + unsigned char tempFingerprint[EVP_MAX_MD_SIZE]; + unsigned int tempFingerprintLen; + tempDigest = (EVP_MD*)EVP_sha1( ); ++ ++#if OPENSSL_VERSION_NUMBER >= 0x10100000L ++ X509 *cert = X509_STORE_CTX_get_current_cert(ctx); ++#else ++ X509 *cert = ctx->cert; ++#endif ++ if(!cert) ++ return 0; ++ + if ( X509_digest(cert, tempDigest, tempFingerprint, &tempFingerprintLen ) <= 0) + return 0; + if(!memcmp(tempFingerprint, thumbprint, tempFingerprintLen)) +diff -up openwsman-4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b/src/server/shttpd/compat_unix.h.orig openwsman-4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b/src/server/shttpd/compat_unix.h +--- openwsman-4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b/src/server/shttpd/compat_unix.h.orig 2016-07-27 16:03:55.000000000 +0200 ++++ openwsman-4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b/src/server/shttpd/compat_unix.h 2017-09-12 12:56:51.720463095 +0200 +@@ -27,7 +27,6 @@ + pthread_create(&tid, NULL, (void *(*)(void *))a, c); } while (0) + #endif /* !NO_THREADS */ + +-#define SSL_LIB "libssl.so" + #define DIRSEP '/' + #define IS_DIRSEP_CHAR(c) ((c) == '/') + #define O_BINARY 0 +diff -up openwsman-4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b/src/server/shttpd/config.h.orig openwsman-4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b/src/server/shttpd/config.h +--- openwsman-4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b/src/server/shttpd/config.h.orig 2017-09-12 12:56:51.720463095 +0200 ++++ openwsman-4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b/src/server/shttpd/config.h 2017-09-12 12:56:51.720463095 +0200 +@@ -0,0 +1,29 @@ ++/* ++ * Copyright (c) 2004-2005 Sergey Lyubka ++ * All rights reserved ++ * ++ * "THE BEER-WARE LICENSE" (Revision 42): ++ * Sergey Lyubka wrote this file. As long as you retain this notice you ++ * can do whatever you want with this stuff. If we meet some day, and you think ++ * this stuff is worth it, you can buy me a beer in return. ++ */ ++ ++#ifndef CONFIG_HEADER_DEFINED ++#define CONFIG_HEADER_DEFINED ++ ++#define SHTTPD_VERSION "1.42" /* Version */ ++#define CONFIG_FILE "shttpd.conf" /* Configuration file */ ++#define HTPASSWD ".htpasswd" /* Passwords file name */ ++#define URI_MAX 16384 /* Default max request size */ ++#define LISTENING_PORTS "80" /* Default listening ports */ ++#define INDEX_FILES "index.html,index.htm,index.php,index.cgi" ++#define CGI_EXT "cgi,pl,php" /* Default CGI extensions */ ++#define SSI_EXT "shtml,shtm" /* Default SSI extensions */ ++#define REALM "mydomain.com" /* Default authentication realm */ ++#define DELIM_CHARS "," /* Separators for lists */ ++#define EXPIRE_TIME 3600 /* Expiration time, seconds */ ++#define ENV_MAX 4096 /* Size of environment block */ ++#define CGI_ENV_VARS 64 /* Maximum vars passed to CGI */ ++#define SERVICE_NAME "SHTTPD " VERSION /* NT service name */ ++ ++#endif /* CONFIG_HEADER_DEFINED */ +diff -up openwsman-4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b/src/server/shttpd/io_ssl.c.orig openwsman-4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b/src/server/shttpd/io_ssl.c +--- openwsman-4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b/src/server/shttpd/io_ssl.c.orig 2016-07-27 16:03:55.000000000 +0200 ++++ openwsman-4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b/src/server/shttpd/io_ssl.c 2017-09-12 12:56:51.720463095 +0200 +@@ -11,23 +11,6 @@ + #include "defs.h" + + #if !defined(NO_SSL) +-struct ssl_func ssl_sw[] = { +- {"SSL_free", {0}}, +- {"SSL_accept", {0}}, +- {"SSL_connect", {0}}, +- {"SSL_read", {0}}, +- {"SSL_write", {0}}, +- {"SSL_get_error", {0}}, +- {"SSL_set_fd", {0}}, +- {"SSL_new", {0}}, +- {"SSL_CTX_new", {0}}, +- {"SSLv23_server_method", {0}}, +- {"SSL_library_init", {0}}, +- {"SSL_CTX_use_PrivateKey_file", {0}}, +- {"SSL_CTX_use_certificate_file",{0}}, +- {NULL, {0}} +-}; +- + void + _shttpd_ssl_handshake(struct stream *stream) + { +diff -up openwsman-4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b/src/server/shttpd/shttpd.c.orig openwsman-4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b/src/server/shttpd/shttpd.c +--- openwsman-4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b/src/server/shttpd/shttpd.c.orig 2016-07-27 16:03:55.000000000 +0200 ++++ openwsman-4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b/src/server/shttpd/shttpd.c 2017-09-12 12:58:20.132254340 +0200 +@@ -1474,20 +1474,14 @@ set_ssl(struct shttpd_ctx *ctx, const ch + char *ssl_disabled_protocols = wsmand_options_get_ssl_disabled_protocols(); + int retval = FALSE; + +- /* Load SSL library dynamically */ +- if ((lib = dlopen(SSL_LIB, RTLD_LAZY)) == NULL) { +- _shttpd_elog(E_LOG, NULL, "set_ssl: cannot load %s", SSL_LIB); +- return (FALSE); +- } +- +- for (fp = ssl_sw; fp->name != NULL; fp++) +- if ((fp->ptr.v_void = dlsym(lib, fp->name)) == NULL) { +- _shttpd_elog(E_LOG, NULL,"set_ssl: cannot find %s", fp->name); +- return (FALSE); +- } +- + /* Initialize SSL crap */ ++ debug("Initialize SSL"); ++ SSL_load_error_strings(); ++#if OPENSSL_VERSION_NUMBER >= 0x10100000L ++ OPENSSL_init_ssl(0, NULL); ++#else + SSL_library_init(); ++#endif + + if ((CTX = SSL_CTX_new(SSLv23_server_method())) == NULL) + _shttpd_elog(E_LOG, NULL, "SSL_CTX_new error"); +@@ -1523,7 +1517,11 @@ set_ssl(struct shttpd_ctx *ctx, const ch + if (strncasecmp(protocols[idx].name, ssl_disabled_protocols, blank_ptr-ssl_disabled_protocols) == 0) { + //_shttpd_elog(E_LOG, NULL, "SSL: disable %s protocol", protocols[idx].name); + debug("SSL: disable %s protocol", protocols[idx].name); ++#if OPENSSL_VERSION_NUMBER >= 0x10100000L ++ SSL_CTX_set_options(CTX, protocols[idx].opt); ++#else + SSL_CTX_ctrl(CTX, SSL_CTRL_OPTIONS, protocols[idx].opt, NULL); ++#endif + break; + } + } +diff -up openwsman-4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b/src/server/shttpd/ssl.h.orig openwsman-4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b/src/server/shttpd/ssl.h +--- openwsman-4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b/src/server/shttpd/ssl.h.orig 2016-07-27 16:03:55.000000000 +0200 ++++ openwsman-4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b/src/server/shttpd/ssl.h 2017-09-12 12:56:51.721463093 +0200 +@@ -12,50 +12,4 @@ + + #include + +-#else +- +-/* +- * Snatched from OpenSSL includes. I put the prototypes here to be independent +- * from the OpenSSL source installation. Having this, shttpd + SSL can be +- * built on any system with binary SSL libraries installed. +- */ +- +-typedef struct ssl_st SSL; +-typedef struct ssl_method_st SSL_METHOD; +-typedef struct ssl_ctx_st SSL_CTX; +- +-#define SSL_ERROR_WANT_READ 2 +-#define SSL_ERROR_WANT_WRITE 3 +-#define SSL_ERROR_SYSCALL 5 +-#define SSL_FILETYPE_PEM 1 +- + #endif +- +-/* +- * Dynamically loaded SSL functionality +- */ +-struct ssl_func { +- const char *name; /* SSL function name */ +- union variant ptr; /* Function pointer */ +-}; +- +-extern struct ssl_func ssl_sw[]; +- +-#define FUNC(x) ssl_sw[x].ptr.v_func +- +-#define SSL_free(x) (* (void (*)(SSL *)) FUNC(0))(x) +-#define SSL_accept(x) (* (int (*)(SSL *)) FUNC(1))(x) +-#define SSL_connect(x) (* (int (*)(SSL *)) FUNC(2))(x) +-#define SSL_read(x,y,z) (* (int (*)(SSL *, void *, int)) FUNC(3))((x),(y),(z)) +-#define SSL_write(x,y,z) \ +- (* (int (*)(SSL *, const void *,int)) FUNC(4))((x), (y), (z)) +-#define SSL_get_error(x,y)(* (int (*)(SSL *, int)) FUNC(5))((x), (y)) +-#define SSL_set_fd(x,y) (* (int (*)(SSL *, int)) FUNC(6))((x), (y)) +-#define SSL_new(x) (* (SSL * (*)(SSL_CTX *)) FUNC(7))(x) +-#define SSL_CTX_new(x) (* (SSL_CTX * (*)(SSL_METHOD *)) FUNC(8))(x) +-#define SSLv23_server_method() (* (SSL_METHOD * (*)(void)) FUNC(9))() +-#define SSL_library_init() (* (int (*)(void)) FUNC(10))() +-#define SSL_CTX_use_PrivateKey_file(x,y,z) (* (int (*)(SSL_CTX *, \ +- const char *, int)) FUNC(11))((x), (y), (z)) +-#define SSL_CTX_use_certificate_file(x,y,z) (* (int (*)(SSL_CTX *, \ +- const char *, int)) FUNC(12))((x), (y), (z)) diff --git a/SOURCES/openwsman-2.6.3-cipher-list-config.patch b/SOURCES/openwsman-2.6.3-cipher-list-config.patch new file mode 100644 index 00000000..7652be16 --- /dev/null +++ b/SOURCES/openwsman-2.6.3-cipher-list-config.patch @@ -0,0 +1,81 @@ +diff -up openwsman-4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b/etc/openwsman.conf.orig openwsman-4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b/etc/openwsman.conf +--- openwsman-4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b/etc/openwsman.conf.orig 2016-07-27 16:03:55.000000000 +0200 ++++ openwsman-4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b/etc/openwsman.conf 2017-10-02 12:22:14.132019954 +0200 +@@ -45,6 +45,10 @@ ssl_disabled_protocols = SSLv2 SSLv3 + # set these to enable basic authentication against a local datbase + #basic_password_file = /etc/openwsman/simple_auth.passwd + ++# SSL cipher list ++# see 'ciphers' in the OpenSSL documentation ++#ssl_cipher_list = ++ + max_threads = 0 + max_connections_per_thread = 20 + #thread_stack_size=262144 +diff -up openwsman-4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b/src/server/shttpd/shttpd.c.orig openwsman-4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b/src/server/shttpd/shttpd.c +--- openwsman-4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b/src/server/shttpd/shttpd.c.orig 2017-10-02 12:26:03.160273923 +0200 ++++ openwsman-4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b/src/server/shttpd/shttpd.c 2017-10-02 12:28:01.700405369 +0200 +@@ -1472,6 +1472,7 @@ set_ssl(struct shttpd_ctx *ctx, const ch + void *lib; + struct ssl_func *fp; + char *ssl_disabled_protocols = wsmand_options_get_ssl_disabled_protocols(); ++ char *ssl_cipher_list = wsmand_options_get_ssl_cipher_list(); + int retval = FALSE; + + /* Initialize SSL crap */ +@@ -1530,6 +1531,13 @@ set_ssl(struct shttpd_ctx *ctx, const ch + ssl_disabled_protocols = blank_ptr + 1; + } + ++ if (ssl_cipher_list) { ++ int rc = SSL_CTX_set_cipher_list(CTX, ssl_cipher_list); ++ if (rc != 0) { ++ _shttpd_elog(E_LOG, NULL, "Failed to set SSL cipher list \"%s\"", ssl_cipher_list); ++ } ++ } ++ + ctx->ssl_ctx = CTX; + + return (retval); +diff -up openwsman-4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b/src/server/wsmand-daemon.c.orig openwsman-4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b/src/server/wsmand-daemon.c +--- openwsman-4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b/src/server/wsmand-daemon.c.orig 2017-10-02 12:23:24.487097973 +0200 ++++ openwsman-4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b/src/server/wsmand-daemon.c 2017-10-02 12:24:57.701201336 +0200 +@@ -79,6 +79,7 @@ static char *ssl_key_file = NULL; + static char *service_path = DEFAULT_SERVICE_PATH; + static char *ssl_cert_file = NULL; + static char *ssl_disabled_protocols = NULL; ++static char *ssl_cipher_list = NULL; + static char *pid_file = DEFAULT_PID_PATH; + static char *uri_subscription_repository = DEFAULT_SUBSCRIPTION_REPOSITORY; + static int daemon_flag = 0; +@@ -178,6 +179,7 @@ int wsmand_read_config(dictionary * ini) + ssl_key_file = iniparser_getstr(ini, "server:ssl_key_file"); + ssl_cert_file = iniparser_getstr(ini, "server:ssl_cert_file"); + ssl_disabled_protocols = iniparser_getstr(ini, "server:ssl_disabled_protocols"); ++ ssl_cipher_list = iniparser_getstr(ini, "server:ssl_cipher_list"); + use_ipv4 = iniparser_getboolean(ini, "server:ipv4", 1); + #ifdef ENABLE_IPV6 + use_ipv6 = iniparser_getboolean(ini, "server:ipv6", 1); +@@ -348,6 +350,11 @@ char *wsmand_options_get_ssl_disabled_pr + return ssl_disabled_protocols; + } + ++char *wsmand_options_get_ssl_cipher_list(void) ++{ ++ return ssl_cipher_list; ++} ++ + int wsmand_options_get_digest(void) + { + return use_digest; +diff -up openwsman-4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b/src/server/wsmand-daemon.h.orig openwsman-4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b/src/server/wsmand-daemon.h +--- openwsman-4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b/src/server/wsmand-daemon.h.orig 2017-10-02 12:25:06.792211418 +0200 ++++ openwsman-4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b/src/server/wsmand-daemon.h 2017-10-02 12:25:30.629237848 +0200 +@@ -77,6 +77,7 @@ int wsmand_options_get_server_ssl_port(v + char *wsmand_options_get_ssl_key_file(void); + char *wsmand_options_get_ssl_cert_file(void); + char *wsmand_options_get_ssl_disabled_protocols(void); ++char *wsmand_options_get_ssl_cipher_list(void); + int wsmand_options_get_digest(void); + char *wsmand_options_get_digest_password_file(void); + char *wsmand_options_get_basic_password_file(void); diff --git a/SOURCES/openwsman-2.6.3-ecdh-support.patch b/SOURCES/openwsman-2.6.3-ecdh-support.patch new file mode 100644 index 00000000..128be72a --- /dev/null +++ b/SOURCES/openwsman-2.6.3-ecdh-support.patch @@ -0,0 +1,25 @@ +diff -up openwsman-4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b/src/server/shttpd/shttpd.c.orig openwsman-4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b/src/server/shttpd/shttpd.c +--- openwsman-4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b/src/server/shttpd/shttpd.c.orig 2018-06-15 13:18:46.274786925 +0200 ++++ openwsman-4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b/src/server/shttpd/shttpd.c 2018-06-15 13:18:46.281786924 +0200 +@@ -1474,6 +1474,7 @@ set_ssl(struct shttpd_ctx *ctx, const ch + char *ssl_disabled_protocols = wsmand_options_get_ssl_disabled_protocols(); + char *ssl_cipher_list = wsmand_options_get_ssl_cipher_list(); + int retval = FALSE; ++ EC_KEY* key; + + /* Initialize SSL crap */ + debug("Initialize SSL"); +@@ -1493,6 +1494,13 @@ set_ssl(struct shttpd_ctx *ctx, const ch + else + retval = TRUE; + ++ /* This enables ECDH Perfect Forward secrecy. Currently with just the most generic p256 prime curve */ ++ key = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1); ++ if (key != NULL) { ++ SSL_CTX_set_tmp_ecdh(CTX, key); ++ EC_KEY_free(key); ++ } ++ + while (ssl_disabled_protocols) { + struct ctx_opts_t { + char *name; diff --git a/SOURCES/openwsman-2.6.3-http-status-line.patch b/SOURCES/openwsman-2.6.3-http-status-line.patch new file mode 100644 index 00000000..f5715088 --- /dev/null +++ b/SOURCES/openwsman-2.6.3-http-status-line.patch @@ -0,0 +1,39 @@ +diff -up openwsman-4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b/src/server/wsmand-listener.c.orig openwsman-4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b/src/server/wsmand-listener.c +--- openwsman-4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b/src/server/wsmand-listener.c.orig 2016-07-27 16:03:55.000000000 +0200 ++++ openwsman-4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b/src/server/wsmand-listener.c 2018-01-22 13:05:04.478923300 +0100 +@@ -344,6 +344,35 @@ DONE: + if (fault_reason == NULL) { + // this is a way to segfault, investigate + //fault_reason = shttpd_reason_phrase(status); ++ // ugly workaround follows... ++ switch (status) { ++ case 200: ++ fault_reason = "OK"; ++ break; ++ case 400: ++ fault_reason = "Bad request"; ++ break; ++ case 401: ++ fault_reason = "Unauthorized"; ++ break; ++ case 403: ++ fault_reason = "Forbidden"; ++ break; ++ case 404: ++ fault_reason = "Not found"; ++ break; ++ case 500: ++ fault_reason = "Internal Error"; ++ break; ++ case 501: ++ fault_reason = "Not implemented"; ++ break; ++ case 415: ++ fault_reason = "Unsupported Media Type"; ++ break; ++ default: ++ fault_reason = ""; ++ } + } + debug("Response status=%d (%s)", status, fault_reason); + diff --git a/SOURCES/openwsmand.service b/SOURCES/openwsmand.service new file mode 100644 index 00000000..e10c75df --- /dev/null +++ b/SOURCES/openwsmand.service @@ -0,0 +1,12 @@ +[Unit] +Description=Openwsman WS-Management Service +After=syslog.target + +[Service] +Type=forking +ExecStart=/usr/sbin/openwsmand -S +ExecStartPre=/etc/openwsman/owsmantestcert.sh +PIDFile=/var/run/wsmand.pid + +[Install] +WantedBy=multi-user.target diff --git a/SOURCES/owsmantestcert.sh b/SOURCES/owsmantestcert.sh new file mode 100644 index 00000000..8918f413 --- /dev/null +++ b/SOURCES/owsmantestcert.sh @@ -0,0 +1,21 @@ +#!/bin/bash + +if [ ! -f "/etc/openwsman/serverkey.pem" ]; then + if [ -f "/etc/ssl/servercerts/servercert.pem" \ + -a -f "/etc/ssl/servercerts/serverkey.pem" ]; then + echo "Using common server certificate /etc/ssl/servercerts/servercert.pem" + ln -s /etc/ssl/servercerts/server{cert,key}.pem /etc/openwsman + exit 0 + else + echo "FAILED: Starting openwsman server" + echo "There is no ssl server key available for openwsman server to use." + echo -e "Please generate one with the following script and start the openwsman service again:\n" + echo "##################################" + echo "/etc/openwsman/owsmangencert.sh" + echo "=================================" + + echo "NOTE: The script uses /dev/random device for generating some random bits while generating the server key." + echo " If this takes too long, you can replace the value of \"RANDFILE\" in /etc/openwsman/ssleay.cnf with /dev/urandom. Please understand the implications of replacing the RNADFILE." + exit 1 + fi +fi diff --git a/SPECS/openwsman.spec b/SPECS/openwsman.spec new file mode 100644 index 00000000..808f2025 --- /dev/null +++ b/SPECS/openwsman.spec @@ -0,0 +1,554 @@ + +%if ! (0%{?fedora} > 12 || 0%{?rhel} > 5) +%{!?python_sitelib: %global python_sitelib %(%{__python} -c "from distutils.sysconfig import get_python_lib; print(get_python_lib())")} +%{!?python_sitearch: %global python_sitearch %(%{__python} -c "from distutils.sysconfig import get_python_lib; print(get_python_lib(1))")} +%endif + +%global commit 4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b +%global shortcommit %(c=%{commit}; echo ${c:0:7}) +%global compatver 2.3.6 + +Name: openwsman +BuildRequires: swig +BuildRequires: libcurl-devel libxml2-devel pam-devel sblim-sfcc-devel +BuildRequires: python python-devel ruby ruby-devel rubygem(rdoc) perl +BuildRequires: python python-devel perl +BuildRequires: perl-devel pkgconfig openssl-devel +#BuildRequires: java-1.8.0-openjdk-devel +BuildRequires: cmake +BuildRequires: systemd-units +Version: 2.6.3 +Release: 4.git%{shortcommit}%{?dist} +Url: http://www.openwsman.org/ +License: BSD +Group: Applications/System +Summary: Open source Implementation of WS-Management +# The source for this package was pulled from upstream's vcs. Use the +# following commands to generate the tarball: +# git clone https://github.com/Openwsman/openwsman.git; cd openwsman +# git archive --format tar --prefix openwsman-4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b/ \ +# 4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b | gzip > openwsman-4391e5c68d99c6239e1672d1c8a5a16d7d8c4c2b.tar.gz +Source0: %{name}-%{commit}.tar.gz +# help2man generated manpage for openwsmand binary +Source1: openwsmand.8.gz +# service file for systemd +Source2: openwsmand.service +# script for testing presence of the certificates in ExecStartPre +Source3: owsmantestcert.sh +# source for libwsman_client lib compatibility +Source4: %{name}-%{compatver}.tar.bz2 +Patch0: openwsman-2.4.0-pamsetup.patch +# Patch1: partially upstream +Patch1: openwsman-2.6.2-openssl-1.1-fix.patch +# Patch2: already upstream +Patch2: openwsman-2.6.3-cipher-list-config.patch +# Patch3: fixes rhbz#1532722 +Patch3: openwsman-2.6.3-http-status-line.patch +# Patch4: fixes rhbz#1547144, , already upstream +Patch4: openwsman-2.6.3-ecdh-support.patch + +%description +Openwsman is a project intended to provide an open-source +implementation of the Web Services Management specipication +(WS-Management) and to expose system management information on the +Linux operating system using the WS-Management protocol. WS-Management +is based on a suite of web services specifications and usage +requirements that exposes a set of operations focused on and covers +all system management aspects. + + + + +%package -n libwsman1 +License: BSD +Group: System Environment/Libraries +Summary: Open source Implementation of WS-Management +Provides: %{name} = %{version}-%{release} +Obsoletes: %{name} < %{version}-%{release} + +%description -n libwsman1 +Openwsman library for packages dependent on openwsman + + + + +%package -n libwsman-devel +License: BSD +Group: Development/Libraries +Summary: Open source Implementation of WS-Management +Provides: %{name}-devel = %{version}-%{release} +Obsoletes: %{name}-devel < %{version}-%{release} +Requires: libwsman1 = %{version}-%{release} +Requires: %{name}-server = %{version}-%{release} +Requires: %{name}-client = %{version}-%{release} +Requires: sblim-sfcc-devel libxml2-devel pam-devel +Requires: libcurl-devel + +%description -n libwsman-devel +Development files for openwsman + + + +%package client +License: BSD +Group: System Environment/Libraries +Summary: Openwsman Client libraries + +%description client +Openwsman Client libraries + + + + +%package server +License: BSD +Group: System Environment/Daemons +Requires: net-tools +Requires(post): chkconfig +Requires(preun): chkconfig +Requires(postun): initscripts +Summary: Openwsman Server and service libraries +Requires: libwsman1 = %{version}-%{release} + +%description server +Openwsman Server and service libraries + + + + +%package python +License: BSD +Group: Development/Libraries +Summary: Python bindings for openwsman client API +Requires: python +Requires: libwsman1 = %{version}-%{release} + +%description python +This package provides Python bindings to access the openwsman client +API. + + + + +%package ruby +License: BSD +Group: Development/Libraries +Requires: ruby +Requires: ruby(release) +Summary: Ruby bindings for openwsman client API +Requires: libwsman1 = %{version}-%{release} + +%description ruby +This package provides Ruby bindings to access the openwsman client API. + +#%package java +#Requires: java +#Requires: libwsman1 = %{version} +#Summary: Java bindings for openwsman client API +#Group: Development/Libraries + +#%description java +#This package provides Java bindings to access the openwsman client API. + + +%package perl +License: BSD +Group: Development/Libraries +Requires: perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $version)) +Summary: Perl bindings for openwsman client API +Requires: libwsman1 = %{version}-%{release} + +%description perl +This package provides Perl bindings to access the openwsman client API. + + + + +%prep +%setup -q -c -n %{name} -a 4 +# apply patches for regular source +cd %{name}-%{commit} +%patch0 -p1 -b .pamsetup +%patch1 -p1 -b .openssl-1.1-fix +%patch2 -p1 -b .cipher-list-config +%patch3 -p1 -b .http-status-line +%patch4 -p1 -b .ecdh-support + +%build +# build regular source +cd %{name}-%{commit} +# Removing executable permissions on .c and .h files to fix rpmlint warnings. +chmod -x src/cpp/WsmanClient.h + +rm -rf build +mkdir build + +export RPM_OPT_FLAGS="$RPM_OPT_FLAGS -DFEDORA -DNO_SSL_CALLBACK" +export SSL_LIB=`readlink %{_libdir}/libssl.so` +export CFLAGS="-D_GNU_SOURCE -fPIE -DPIE" +export LDFLAGS="$LDFLAGS -Wl,-z,now -pie" +cd build +cmake \ + -DCMAKE_INSTALL_PREFIX=/usr \ + -DCMAKE_VERBOSE_MAKEFILE=TRUE \ + -DCMAKE_BUILD_TYPE=Release \ + -DCMAKE_C_FLAGS_RELEASE:STRING="$RPM_OPT_FLAGS -fno-strict-aliasing" \ + -DCMAKE_CXX_FLAGS_RELEASE:STRING="$RPM_OPT_FLAGS" \ + -DCMAKE_SKIP_RPATH=1 \ + -DPACKAGE_ARCHITECTURE=`uname -m` \ + -DLIB=%{_lib} \ + -DBUILD_RUBY_GEM=no \ + -DBUILD_JAVA=no \ + .. + +make CFLAGS="-DSSL_LIB='\"$SSL_LIB\"'" + + +# build compat source +cd ../../%{name}-%{compatver} +# Removing executable permissions on .c and .h files to fix rpmlint warnings. +chmod -x src/cpp/WsmanClient.h + +rm -rf build +mkdir build + +export RPM_OPT_FLAGS="$RPM_OPT_FLAGS -DFEDORA -DNO_SSL_CALLBACK" +export SSL_LIB=`readlink %{_libdir}/libssl.so` +export CFLAGS="-D_GNU_SOURCE -fPIE -DPIE" +export LDFLAGS="$LDFLAGS -Wl,-z,now -pie" +cd build +cmake \ + -DCMAKE_INSTALL_PREFIX=/usr \ + -DCMAKE_VERBOSE_MAKEFILE=TRUE \ + -DCMAKE_BUILD_TYPE=Release \ + -DCMAKE_C_FLAGS_RELEASE:STRING="$RPM_OPT_FLAGS -fno-strict-aliasing" \ + -DCMAKE_CXX_FLAGS_RELEASE:STRING="$RPM_OPT_FLAGS" \ + -DCMAKE_SKIP_RPATH=1 \ + -DPACKAGE_ARCHITECTURE=`uname -m` \ + -DLIB=%{_lib} \ + -DBUILD_RUBY_GEM=no \ + -DBUILD_JAVA=no \ + .. + +make CFLAGS="-DSSL_LIB='\"$SSL_LIB\"'" + +%install +# install regular source +cd %{name}-%{commit} +cd build +make DESTDIR=%{buildroot} install +cd .. +rm -f %{buildroot}/%{_libdir}/*.la +rm -f %{buildroot}/%{_libdir}/openwsman/plugins/*.la +rm -f %{buildroot}/%{_libdir}/openwsman/authenticators/*.la +[ -d %{buildroot}/%{ruby_vendorlibdir} ] && rm -f %{buildroot}/%{ruby_vendorlibdir}/openwsmanplugin.rb +[ -d %{buildroot}/%{ruby_vendorlibdir} ] && rm -f %{buildroot}/%{ruby_vendorlibdir}/openwsman.rb +mkdir -p %{buildroot}%{_sysconfdir}/init.d +install -m 644 etc/openwsman.conf %{buildroot}/%{_sysconfdir}/openwsman +install -m 644 etc/openwsman_client.conf %{buildroot}/%{_sysconfdir}/openwsman +mkdir -p %{buildroot}/%{_unitdir} +install -p -m 644 %{SOURCE2} %{buildroot}/%{_unitdir}/openwsmand.service +install -m 644 etc/ssleay.cnf %{buildroot}/%{_sysconfdir}/openwsman +install -p -m 755 %{SOURCE3} %{buildroot}/%{_sysconfdir}/openwsman +# install manpage +mkdir -p %{buildroot}/%{_mandir}/man8/ +cp %SOURCE1 %{buildroot}/%{_mandir}/man8/ +# install missing headers +install -m 644 include/wsman-xml.h %{buildroot}/%{_includedir}/openwsman +install -m 644 include/wsman-xml-binding.h %{buildroot}/%{_includedir}/openwsman +install -m 644 include/wsman-dispatcher.h %{buildroot}/%{_includedir}/openwsman +# remove winrs +rm -f %{buildroot}/%{_bindir}/winrs + +# install compat library +cd ../%{name}-%{compatver} +install build/src/lib/libwsman_client.so.1.0.0 %{buildroot}/%{_libdir} +# create symlink +pushd %{buildroot}/%{_libdir} +ln -s libwsman_client.so.1.0.0 libwsman_client.so.1 +popd + +%post -n libwsman1 -p /sbin/ldconfig + +%postun -n libwsman1 -p /sbin/ldconfig + +%post server +/sbin/ldconfig +%systemd_post openwsmand.service + +%preun server +%systemd_preun openwsmand.service + +%postun server +rm -f /var/log/wsmand.log +%systemd_postun_with_restart openwsmand.service +/sbin/ldconfig + +%post client -p /sbin/ldconfig + +%postun client -p /sbin/ldconfig + +%files -n libwsman1 +%doc %{name}-%{commit}/AUTHORS %{name}-%{commit}/COPYING %{name}-%{commit}/ChangeLog %{name}-%{commit}/README.md %{name}-%{commit}/TODO +%{_libdir}/libwsman.so.* +%{_libdir}/libwsman_client.so.* +%{_libdir}/libwsman_curl_client_transport.so.* + +%files -n libwsman-devel +%{_includedir}/* +%{_libdir}/pkgconfig/* +%{_libdir}/*.so +%doc %{name}-%{commit}/AUTHORS %{name}-%{commit}/COPYING %{name}-%{commit}/ChangeLog %{name}-%{commit}/README.md + +%files python +%{python_sitearch}/*.so +%{python_sitearch}/*.py +%{python_sitearch}/*.pyc +%{python_sitearch}/*.pyo +%doc %{name}-%{commit}/AUTHORS %{name}-%{commit}/COPYING %{name}-%{commit}/ChangeLog %{name}-%{commit}/README.md + +%files ruby +%{ruby_vendorarchdir}/_openwsman.so +%dir %{ruby_vendorlibdir}/openwsman +%{ruby_vendorlibdir}/openwsman/*.rb +%doc %{name}-%{commit}/AUTHORS %{name}-%{commit}/COPYING %{name}-%{commit}/ChangeLog %{name}-%{commit}/README.md + + +#%files java +#%defattr(-,root,root) +#%{_javadir}/*jar + +%files perl +%{perl_vendorarch}/openwsman.so +%{perl_vendorlib}/openwsman.pm +%doc %{name}-%{commit}/AUTHORS %{name}-%{commit}/COPYING %{name}-%{commit}/ChangeLog %{name}-%{commit}/README.md + +%files server +# Don't remove *.so files from the server package. +# the server fails to start without these files. +%dir %{_sysconfdir}/openwsman +%config(noreplace) %{_sysconfdir}/openwsman/openwsman.conf +%config(noreplace) %{_sysconfdir}/openwsman/ssleay.cnf +%attr(0755,root,root) %{_sysconfdir}/openwsman/owsmangencert.sh +%attr(0755,root,root) %{_sysconfdir}/openwsman/owsmantestcert.sh +%config(noreplace) %{_sysconfdir}/pam.d/openwsman +%{_unitdir}/openwsmand.service +%dir %{_libdir}/openwsman +%dir %{_libdir}/openwsman/authenticators +%{_libdir}/openwsman/authenticators/*.so +%{_libdir}/openwsman/authenticators/*.so.* +%dir %{_libdir}/openwsman/plugins +%{_libdir}/openwsman/plugins/*.so +%{_libdir}/openwsman/plugins/*.so.* +%{_sbindir}/openwsmand +%{_libdir}/libwsman_server.so.* +%{_mandir}/man8/* +%doc %{name}-%{commit}/AUTHORS %{name}-%{commit}/COPYING %{name}-%{commit}/ChangeLog %{name}-%{commit}/README.md + +%files client +%{_libdir}/libwsman_clientpp.so.* +%config(noreplace) %{_sysconfdir}/openwsman/openwsman_client.conf +%doc %{name}-%{commit}/AUTHORS %{name}-%{commit}/COPYING %{name}-%{commit}/ChangeLog %{name}-%{commit}/README.md + + +%changelog +* Fri Jun 15 2018 Vitezslav Crhonek - 2.6.3-4.git4391e5c +- Explicitly disable build of java bindings + Resolves: #1540723 +- Add support for ECDH key exchange algorithm + Resolves: #1547144 + +* Wed Jan 31 2018 Vitezslav Crhonek - 2.6.3-3.git4391e5c +- Add libwsman-client.so.1 for backward compatibility + Resolves: #1537528 + +* Mon Jan 22 2018 Vitezslav Crhonek - 2.6.3-2.git4391e5c +- Fix malformed HTTP 200 status line + Resolves: #1532722 + +* Tue Oct 03 2017 Vitezslav Crhonek - 2.6.3-1.git4391e5c +- Update to openwsman-2.6.3 from upstream VCS + Resolves: #1208364 #1296198 +- Backport support for configuring used cipher suite + Resolves: #1454607 + +* Wed Mar 15 2017 Vitezslav Crhonek - 2.3.6-14 +- Backport option for disabling various SSL protocols + Resolves: #1190689 +- Fix curl_easy_setopt call for CURLOPT_SSL_VERIFYPEER/HOST + Resolves: #1319949 + +* Mon Feb 10 2014 Vitezslav Crhonek - 2.3.6-13 +- Fix libredirect.so doesn't load + Resolves: #1061676 + +* Wed Feb 05 2014 Vitezslav Crhonek - 2.3.6-12 +- Update openwsmand man page + Resolves: #949018 + +* Fri Jan 24 2014 Daniel Mach - 2.3.6-11 +- Mass rebuild 2014-01-24 + +* Thu Jan 09 2014 Vitezslav Crhonek - 2.3.6-10 +- Fix pam.d config +- Start the service using SSL by default + Resolves: #1047800 + +* Fri Dec 27 2013 Daniel Mach - 2.3.6-9 +- Mass rebuild 2013-12-27 + +* Mon Oct 07 2013 Vitezslav Crhonek - 2.3.6-8 +- Add requires for ruby subpackage + Related: #881316 + +* Wed Oct 02 2013 Vitezslav Crhonek - 2.3.6-7 +- Fix bogus date in the %%changelog +- Build with full relro +- Fix requires/provides + Resolves: #881316 + +* Tue Mar 19 2013 Vít Ondruch - 2.3.6-6 +- Rebuild for https://fedoraproject.org/wiki/Features/Ruby_2.0.0 + +* Mon Mar 18 2013 Praveen K Paladugu -2.3.6-5 +- Disabling the java binding for now. + +* Fri Mar 15 2013 Praveen K Paladugu -2.3.6-4 +- Enabled java bindings in the build +- Removed versioned dep on ruby + +* Wed Mar 13 2013 Peter Robinson 2.3.6-3 +- rebuild for ruby 2 + +* Thu Feb 14 2013 Fedora Release Engineering - 2.3.6-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild + +* Thu Nov 08 2012 Vitezslav Crhonek - 2.3.6-1 +- Update to openwsman-2.3.6 + +* Mon Sep 17 2012 Vitezslav Crhonek - 2.3.5-1 +- Update to openwsman-2.3.5 +- Enable ruby subpackage again + +* Tue Aug 28 2012 Vitezslav Crhonek - 2.3.0-7 +- Fix issues found by fedora-review utility in the spec file + +* Thu Aug 23 2012 Vitezslav Crhonek - 2.3.0-6 +- Use new systemd-rpm macros + Resolves: #850405 + +* Fri Jul 20 2012 Fedora Release Engineering - 2.3.0-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild + +* Sun Jun 10 2012 Petr Pisar - 2.3.0-4 +- Perl 5.16 rebuild + +* Mon May 28 2012 Vitezslav Crhonek - 2.3.0-3 +- Rename service file + +* Wed May 23 2012 Vitezslav Crhonek - 2.3.0-2 +- Add systemd support + +* Tue Mar 27 2012 Vitezslav Crhonek - 2.3.0-1 +- Update to openwsman-2.3.0 + +* Thu Feb 09 2012 Vitezslav Crhonek - 2.2.7-4 +- Fix libssl loading + +* Thu Feb 09 2012 Vitezslav Crhonek - 2.2.7-3 +- Temporarily disable ruby subpackage + +* Thu Jan 26 2012 Vitezslav Crhonek - 2.2.7-2 +- Remove unnecessary net-tools requirement + Resolves: #784787 + +* Wed Jan 11 2012 Vitezslav Crhonek - 2.2.7-1 +- Update to openwsman-2.2.7 + +* Mon Jun 20 2011 Marcela Mašláňová - 2.2.5-3 +- Perl mass rebuild + +* Fri Jun 10 2011 Marcela Mašláňová - 2.2.5-2 +- Perl 5.14 mass rebuild + +* Wed Mar 23 2011 Vitezslav Crhonek - 2.2.5-1 +- Update to openwsman-2.2.5 + +* Tue Feb 08 2011 Fedora Release Engineering - 2.2.4-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild + +* Thu Dec 9 2010 Vitezslav Crhonek - 2.2.4-2 +- Recompile with -DNO_SSL_CALLBACK + +* Tue Nov 16 2010 Vitezslav Crhonek - 2.2.4-1 +- Update to openwsman-2.2.4 +- Add help2man generated manpage for openwsmand binary +- Add missing openwsman headers to libwsman-devel +- Add configuration file to openwsman-client + +* Wed Sep 29 2010 jkeating - 2.2.3-9 +- Rebuilt for gcc bug 634757 + +* Mon Sep 13 2010 Vitezslav Crhonek - 2.2.3-8 +- Move initscript to the right place +- Fix return values from initscript according to guidelines + +* Tue Aug 10 2010 Praveen K Paladugu - 2.2.3-7 +- Moved the certificate generation from init script. The user will have to +- generate the certificate manually. + +* Mon Aug 2 2010 Praveen K Paladugu - 2.2.3-6 +- Fixed the version checking of swig and forced all the ruby files to be +- installed into site{lib,arch} dirs + +* Wed Jul 21 2010 David Malcolm - 2.2.3-5 +- Rebuilt for https://fedoraproject.org/wiki/Features/Python_2.7/MassRebuild + +* Tue Jun 01 2010 Marcela Maslanova - 2.2.3-4 +- Mass rebuild with perl-5.12.0 + +* Thu Apr 22 2010 Praveen K Paladugu - 2.2.3-3 +- authors.patch: Moved all the AUTHORS info to AUTHORS file. +- Corrected the Source tag. +- Corrected the package dependencies to break cyclic dependencies. +- Fixed the default attributes. +- Fixed the preun & postun scripts, to make sure the openwsmand service +- is stopped before the package is removed. +- Added 'condrestart' function to the init script. +- Had to let the *.so files be part of the openwsman-server becuase +- some of the source files explicitly call out for *.so files. + + +* Thu Apr 15 2010 Praveen K Paladugu - 2.2.3-2 +- Updated the spec file to adhere to the upstream standard of breaking +- the package in server, client, lib modules +- randfile.patch: when openwsmand daemon creates a certificate the +- first time it needs a file which have random content it. This +- is pointed to $HOME/.rnd in /etc/openwsman/ssleay.cnf. Changed this +- random file to /dev/urandom. +- initscript.patch: patch to edit the init script so that the services +- are not started by default. + + +* Wed Mar 3 2010 Vitezslav Crhonek - 2.2.3-1 +- Update to openwsman-2.2.3 + + +* Wed Sep 23 2009 Praveen K Paladugu - 2.2.0-1 +- Added the new 2.2.0 sources. +- Changed the release and version numbers. + +* Fri Aug 21 2009 Tomas Mraz - 2.1.0-4 +- rebuilt with new openssl + +* Sat Jul 25 2009 Fedora Release Engineering - 2.1.0-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild + +* Thu Feb 26 2009 Fedora Release Engineering - 2.1.0-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild + +* Mon Sep 22 2008 Matt Domsch - 2.1.0-1 +- update to 2.1.0, resolves security issues + +* Tue Aug 19 2008 - 2.0.0-1%{?dist} +- Modified the spec file to adhere to fedora packaging guidelines.