From f3cd02e668f94c294d685edb24a051e2451589f1 Mon Sep 17 00:00:00 2001
From: Tomas Jelinek <tojeline@redhat.com>
Date: Fri, 23 Oct 2020 16:37:56 +0200
Subject: [PATCH 2/2] add support for loading a DH key from a file

---
 pcsd/pcsd.conf             |  6 +++++-
 pcsd/rfc7919-ffdhe2048.pem |  8 ++++++++
 pcsd/settings.rb           |  1 +
 pcsd/ssl.rb                | 20 ++++++++++++++++++--
 4 files changed, 32 insertions(+), 3 deletions(-)
 create mode 100644 pcsd/rfc7919-ffdhe2048.pem

diff --git a/pcsd/pcsd.conf b/pcsd/pcsd.conf
index 73d8b0ce..9f522353 100644
--- a/pcsd/pcsd.conf
+++ b/pcsd/pcsd.conf
@@ -31,7 +31,11 @@ PCSD_SESSION_LIFETIME=3600
 # set SSL ciphers
 #PCSD_SSL_CIPHERS='DEFAULT:!RC4:!3DES:@STRENGTH'
 
-# set length (in bits) of DH key for key exchange
+# set a DH key for key exchange, this overrides PCSD_SSL_DH_KEX_BITS
+# set to an empty string to disable this option and generate a random DH key
+#PCSD_SSL_DH_KEX_FILE=/usr/lib/pcsd/rfc7919-ffdhe2048.pem
+
+# set length (in bits) of a DH key for key exchange
 #PCSD_SSL_DH_KEX_BITS=1024
 
 # Reject client initiated SSL/TLS renegotiation. Set this to true to make pcsd
diff --git a/pcsd/rfc7919-ffdhe2048.pem b/pcsd/rfc7919-ffdhe2048.pem
new file mode 100644
index 00000000..9b182b72
--- /dev/null
+++ b/pcsd/rfc7919-ffdhe2048.pem
@@ -0,0 +1,8 @@
+-----BEGIN DH PARAMETERS-----
+MIIBCAKCAQEA//////////+t+FRYortKmq/cViAnPTzx2LnFg84tNpWp4TZBFGQz
++8yTnc4kmz75fS/jY2MMddj2gbICrsRhetPfHtXV/WVhJDP1H18GbtCFY2VVPe0a
+87VXE15/V8k1mE8McODmi3fipona8+/och3xWKE2rec1MKzKT0g6eXq8CrGCsyT7
+YdEIqUuyyOP7uWrat2DX9GgdT0Kj3jlN9K5W7edjcrsZCwenyO4KbXCeAvzhzffi
+7MA0BM0oNC9hkXL+nOmFg/+OTxIy7vKBg8P+OxtMb61zO7X8vC7CIAXFjvGDfRaD
+ssbzSibBsu/6iGtCOGEoXJf//////////wIBAg==
+-----END DH PARAMETERS-----
diff --git a/pcsd/settings.rb b/pcsd/settings.rb
index 3edc02b7..e7ff410d 100644
--- a/pcsd/settings.rb
+++ b/pcsd/settings.rb
@@ -6,6 +6,7 @@ PCSD_DEFAULT_PORT = 2224
 CRT_FILE = PCSD_VAR_LOCATION + 'pcsd.crt'
 KEY_FILE = PCSD_VAR_LOCATION + 'pcsd.key'
 COOKIE_FILE = PCSD_VAR_LOCATION + 'pcsd.cookiesecret'
+DH_KEY_FILE = PCSD_EXEC_LOCATION + 'rfc7919-ffdhe2048.pem'
 
 PENGINE = "/usr/libexec/pacemaker/pengine"
 CIB_BINARY = '/usr/libexec/pacemaker/cib'
diff --git a/pcsd/ssl.rb b/pcsd/ssl.rb
index de356e46..5acbac37 100644
--- a/pcsd/ssl.rb
+++ b/pcsd/ssl.rb
@@ -157,7 +157,23 @@ dh_key_bits = 0
 if ENV['PCSD_SSL_DH_KEX_BITS']
   dh_key_bits = Integer(ENV['PCSD_SSL_DH_KEX_BITS']) rescue 0
 end
-if dh_key_bits > 0
+dh_key_file = DH_KEY_FILE
+if ENV['PCSD_SSL_DH_KEX_FILE']
+  dh_key_file = ENV['PCSD_SSL_DH_KEX_FILE']
+end
+
+dh_key = nil
+if not dh_key_file.empty?()
+  $logger.info "Using '#{dh_key_file}' as a DH key..."
+  begin
+    dh_key = OpenSSL::PKey::DH.new(File.read(dh_key_file))
+    dh_key.generate_key!
+    $logger.info "DH key loaded"
+  rescue => e
+    $logger.error "Unable to read DH key file: #{e}"
+    exit 1
+  end
+elsif dh_key_bits > 0
   $logger.info "Generating #{dh_key_bits}bits long DH key..."
   dh_key = OpenSSL::PKey::DH.generate(dh_key_bits)
   $logger.info "DH key created"
@@ -187,7 +203,7 @@ webrick_options = {
   :SSLCertName        => [[ "CN", server_name ]],
   :SSLOptions         => get_ssl_options(),
 }
-if dh_key_bits > 0
+if not dh_key.nil?()
   webrick_options[:SSLTmpDhCallback] = lambda {|ctx, is_export, keylen| dh_key }
 end
 
-- 
2.21.0