From 4d5f472d67d6d9e94625c5796768ccc7a500b8e1 Mon Sep 17 00:00:00 2001
From: Basil Hess <bhe@zurich.ibm.com>
Date: Thu, 19 Oct 2023 20:19:35 +0200
Subject: [PATCH] Updates docker file to create test server package (#238)

* Updates docker file to create test server package:
- Using liboqs 0.9.0
- Using latest oqs-provider
- Using latest nginx 1.25.2

Updates nginx docker demo to 1.25.2

* revert -j and update docs about OPENSSL_CONF
---
 nginx/Dockerfile                        |  7 ++++---
 nginx/fulltest-provider/Dockerfile      | 12 ++++++------
 nginx/fulltest-provider/README.md       |  8 +++++++-
 nginx/fulltest-provider/build_ubuntu.sh |  2 +-
 4 files changed, 18 insertions(+), 11 deletions(-)

diff --git a/nginx/Dockerfile b/nginx/Dockerfile
index 3907b1cc..c5f1aacc 100644
--- a/nginx/Dockerfile
+++ b/nginx/Dockerfile
@@ -18,7 +18,7 @@ ARG SIG_ALG="dilithium3"
 ARG DEFAULT_GROUPS=x25519:x448:kyber512:p256_kyber512:kyber768:p384_kyber768:kyber1024:p521_kyber1024
 
 # define the nginx version to include
-ARG NGINX_VERSION=1.23.3
+ARG NGINX_VERSION=1.25.2
 
 # Define the degree of parallelism when building the image; leave the number away only if you know what you are doing
 ARG MAKE_DEFINES="-j 18"
@@ -126,6 +126,7 @@ STOPSIGNAL SIGTERM
 # Enable a normal user to create new server keys off set CA
 RUN addgroup -g 1000 -S oqs && adduser --uid 1000 -S oqs -G oqs && chown -R oqs.oqs ${INSTALLDIR}
 USER oqs
-
+# From nginx 1.25.2: "nginx does not try to load OpenSSL configuration if the --with-openssl option was used to built OpenSSL and the OPENSSL_CONF environment variable is not set".
+# We therefore have to set the OPENSSL_CONF environment variable.
+ENV OPENSSL_CONF ${OSSLDIR}/ssl/openssl.cnf
 CMD ["nginx", "-c", "nginx-conf/nginx.conf", "-g", "daemon off;"]
-
diff --git a/nginx/fulltest-provider/Dockerfile b/nginx/fulltest-provider/Dockerfile
index 3bc04ce6..96108a73 100644
--- a/nginx/fulltest-provider/Dockerfile
+++ b/nginx/fulltest-provider/Dockerfile
@@ -3,11 +3,11 @@
 # First: global build arguments:
 
 # liboqs build type variant; maximum portability of image:
-ARG LIBOQS_VERSION=0.8.0
+ARG LIBOQS_VERSION=0.9.0
 
 ARG OPENSSL_VERSION=master
 
-ARG OQS_PROVIDER_VERSION=0.5.1
+ARG OQS_PROVIDER_VERSION=main
 
 ARG LIBOQS_BUILD_DEFINES="-DOQS_DIST_BUILD=ON"
 
@@ -26,7 +26,7 @@ ARG SIG_ALG="dilithium3"
 ARG DEFAULT_GROUPS=x25519:x448:prime256v1:secp384r1:secp521r1:kyber512:p256_kyber512:kyber768:p384_kyber768:kyber1024:p521_kyber1024
 
 # define the nginx version to include
-ARG NGINX_VERSION=1.25.1
+ARG NGINX_VERSION=1.25.2
 
 # Define the degree of parallelism when building the image; leave the number away only if you know what you are doing
 ARG MAKE_DEFINES="-j"
@@ -97,7 +97,7 @@ COPY genconfig.py ${CONFIGDIR}
 COPY common.py ${CONFIGDIR}
 COPY ext-csr.conf ${CONFIGDIR}
 COPY index-template ${CONFIGDIR}
-COPY chromium-template ${CONFIGDIR}
+#COPY chromium-template ${CONFIGDIR}
 COPY success.htm ${CONFIGDIR}
 COPY OsslAlgParser.scala ${CONFIGDIR}
 
@@ -108,8 +108,8 @@ RUN python3 genconfig.py
 
 RUN sed -i "s/LIBOQS_RELEASE/${LIBOQS_VERSION}/g" index-base.html
 RUN sed -i "s/OQSPROVIDER_RELEASE/${OQS_PROVIDER_VERSION}/g" index-base.html
-RUN sed -i "s/LIBOQS_RELEASE/${LIBOQS_VERSION}/g" chromium-base.html
-RUN sed -i "s/OQSPROVIDER_RELEASE/${OQS_PROVIDER_VERSION}/g" chromium-base.html
+#RUN sed -i "s/LIBOQS_RELEASE/${LIBOQS_VERSION}/g" chromium-base.html
+#RUN sed -i "s/OQSPROVIDER_RELEASE/${OQS_PROVIDER_VERSION}/g" chromium-base.html
 
 RUN rm -rf ${INSTALLDIR}/pki
 RUN rm -rf ${INSTALLDIR}/logs/*
diff --git a/nginx/fulltest-provider/README.md b/nginx/fulltest-provider/README.md
index 2b7ed297..7f49b225 100644
--- a/nginx/fulltest-provider/README.md
+++ b/nginx/fulltest-provider/README.md
@@ -32,6 +32,12 @@ Note that, the oqs-nginx-{LIBOQS_VERSION}.tgz package contains all required conf
 
 #### Activation
 
-Execute `/opt/nginx/sbin/nginx -c /opt/nginx/interop.conf` to start the test server.
+Execute `OPENSSL_CONF=/opt/openssl/.openssl/ssl/openssl.cnf /opt/nginx/sbin/nginx -c /opt/nginx/interop.conf` to start the test server.
+
+*Note*: From nginx version 1.25.2, nginx does not try to load OpenSSL configuration if the --with-openssl option was used to built OpenSSL. We therefore have to set the `OPENSSL_CONF` environment variable when activating nginx.
 
 *Note*: As the server many of ports, the server may need to be configured to permit this, e.g., using `ulimit -S -n 4096`.
+
+#### Test run
+
+The `testrun.sh` script runs test connections against all ports configured by the server. To run the script, execute `testrun.sh openquantumsafe/curl`.
diff --git a/nginx/fulltest-provider/build_ubuntu.sh b/nginx/fulltest-provider/build_ubuntu.sh
index 84c37533..5a7585fb 100755
--- a/nginx/fulltest-provider/build_ubuntu.sh
+++ b/nginx/fulltest-provider/build_ubuntu.sh
@@ -9,4 +9,4 @@
 docker build --no-cache -t oqs-nginx-fulltest-provider .
 
 # Copy tar from image
-docker cp $(docker create oqs-nginx-fulltest-provider:latest):oqs-nginx-0.8.0.tgz .
+docker cp $(docker create oqs-nginx-fulltest-provider:latest):oqs-nginx-0.9.0.tgz .