mirror of
https://github.com/rsyslog/rsyslog.git
synced 2026-06-19 22:12:56 +02:00
d128ef88a5
Why Native post-quantum TLS support should be usable and testable on newer distro baselines without adding provider-mode compatibility work for older platforms. Impact Rsyslog now has native-PQ smoke tests, clearer TLS diagnostics, updated CI baselines and helper images, and a new post-quantum tutorial for supported distros. Before/After Before: Fedora CI still targeted Fedora 41, PQ-capable TLS settings had no dedicated rsyslog tests or user-facing tutorial, and stricter clang builds could fail on warning-group handling. After: CI targets Fedora 43, native PQ usage is documented and smoke- tested, helper images include the required tools, and the branch builds and tests cleanly with the newer compiler/container combinations. Technical Overview The CI matrix now replaces the Fedora 41 lane with Fedora 43 and adds a matching Fedora 43 development image. The Debian 13 and Fedora 43 development containers now install the GnuTLS CLI utilities needed for native PQ capability checks. The OpenSSL TLS config path logs clearer messages when a command or value is unavailable on the native OpenSSL build. The GnuTLS TLS config path reports unsupported priority-string options more explicitly. Two new shell tests add native PQ smoke coverage for OpenSSL and GnuTLS using the existing gnutlsPriorityString control surface. Those tests self-skip unless the local native TLS libraries expose the required hybrid group support. The imtcp parameter docs and omfwd docs now explain the native-only PQ support policy and include example configurations. A new tutorial documents native PQ usage for OpenSSL and GnuTLS on supported newer distro versions. The shared runtime warning policy in rsyslog.h now tolerates clang handling of unknown warning groups so older and newer clang lanes remain warning-free under the existing finalize_it error-handling pattern. Testbench follow-ups harden omfwd-lb-susp with isolated retry attempts, skip rcvr_fail_restore on ARM where it is timing-flaky, and keep local SC2181 suppressions where if-exec rewrites would reduce shell-script usability. The Fedora 43 Dockerfile now cleans the dnf cache after install and locally suppresses the non-useful DL3041 package-version pinning warning. Older distro versions remain intentionally unsupported for PQ in this phase because we expect users to move to newer baselines first. If there is demand later, older-version support can be considered in a separate effort. With the help of AI-Agents: Codex
82 lines
2.0 KiB
Bash
Executable File
82 lines
2.0 KiB
Bash
Executable File
#!/bin/bash
|
|
# Native GnuTLS PQ smoke test. Requires a GnuTLS build with
|
|
# GROUP-X25519-MLKEM768 support.
|
|
. ${srcdir:=.}/diag.sh init
|
|
|
|
check_command_available gnutls-cli
|
|
|
|
export GNUTLS_PQ_PRIO='NORMAL:-GROUP-ALL:+GROUP-X25519-MLKEM768:+GROUP-X25519'
|
|
if ! gnutls-cli --priority "$GNUTLS_PQ_PRIO" --list >/dev/null 2>&1; then
|
|
echo "SKIP: native GnuTLS PQ group GROUP-X25519-MLKEM768 is unavailable"
|
|
skip_test
|
|
fi
|
|
|
|
export NUMMESSAGES=1000
|
|
export RSYSLOG_DEBUGLOG="log"
|
|
generate_conf
|
|
export PORT_RCVR="$(get_free_port)"
|
|
add_conf '
|
|
global(
|
|
defaultNetstreamDriverCAFile="'$srcdir/tls-certs/ca.pem'"
|
|
defaultNetstreamDriverCertFile="'$srcdir/tls-certs/cert.pem'"
|
|
defaultNetstreamDriverKeyFile="'$srcdir/tls-certs/key.pem'"
|
|
defaultNetstreamDriver="gtls"
|
|
)
|
|
|
|
module(load="../plugins/imtcp/.libs/imtcp"
|
|
StreamDriver.Name="gtls"
|
|
StreamDriver.Mode="1"
|
|
StreamDriver.AuthMode="anon"
|
|
gnutlsPriorityString="'$GNUTLS_PQ_PRIO'")
|
|
|
|
input(type="imtcp" port="'$PORT_RCVR'")
|
|
|
|
$template outfmt,"%msg:F,58:2%\n"
|
|
$template dynfile,"'$RSYSLOG_OUT_LOG'"
|
|
:msg, contains, "msgnum:" ?dynfile;outfmt
|
|
'
|
|
startup
|
|
|
|
export RSYSLOG_DEBUGLOG="log2"
|
|
generate_conf 2
|
|
add_conf '
|
|
global(
|
|
defaultNetstreamDriverCAFile="'$srcdir/tls-certs/ca.pem'"
|
|
defaultNetstreamDriverCertFile="'$srcdir/tls-certs/cert.pem'"
|
|
defaultNetstreamDriverKeyFile="'$srcdir/tls-certs/key.pem'"
|
|
defaultNetstreamDriver="gtls"
|
|
)
|
|
|
|
module(load="../plugins/imtcp/.libs/imtcp")
|
|
input(type="imtcp" port="0" listenPortFileName="'$RSYSLOG_DYNNAME'.tcpflood_port")
|
|
|
|
action(
|
|
type="omfwd"
|
|
protocol="tcp"
|
|
target="127.0.0.1"
|
|
port="'$PORT_RCVR'"
|
|
StreamDriver="gtls"
|
|
StreamDriverMode="1"
|
|
StreamDriverAuthMode="anon"
|
|
gnutlsPriorityString="'$GNUTLS_PQ_PRIO'"
|
|
)
|
|
' 2
|
|
startup 2
|
|
|
|
tcpflood -m$NUMMESSAGES -i1
|
|
wait_file_lines
|
|
shutdown_when_empty 2
|
|
wait_shutdown 2
|
|
shutdown_when_empty
|
|
wait_shutdown
|
|
|
|
content_check --check-only "Syntax error or unsupported option in Priority String"
|
|
# shellcheck disable=SC2181
|
|
if [ $? -eq 0 ]; then
|
|
echo "SKIP: native GnuTLS PQ group configuration was rejected"
|
|
skip_test
|
|
fi
|
|
|
|
seq_check 1 $NUMMESSAGES
|
|
exit_test
|