From ca5c3e6d3d95df78f4bba445f983ae55885180a8 Mon Sep 17 00:00:00 2001 From: Basil Hess Date: Wed, 26 Jun 2024 08:43:50 +0100 Subject: [PATCH] Update test server build script: liboqs-0.10.1 & oqs-provider-0.6.1-rc1 (#272) * update to nginx 1.25.4 & reference composite sigs in html update test server build script to use liboqs 0.10.0 Signed-off-by: Basil Hess * Update to final 0.6.0 release Signed-off-by: Basil Hess * Update to liboqs 0.10.1 and oqs-provider 0.6.1-rc1, update nginx version Signed-off-by: Basil Hess --------- Signed-off-by: Basil Hess --- nginx/fulltest/Dockerfile | 12 ++++++------ nginx/fulltest/build_ubuntu.sh | 4 ++-- nginx/fulltest/index-template | 3 ++- 3 files changed, 10 insertions(+), 9 deletions(-) diff --git a/nginx/fulltest/Dockerfile b/nginx/fulltest/Dockerfile index 3258ebce..be0bfb63 100644 --- a/nginx/fulltest/Dockerfile +++ b/nginx/fulltest/Dockerfile @@ -3,11 +3,11 @@ # First: global build arguments: # liboqs build type variant; maximum portability of image: -ARG LIBOQS_VERSION=0.9.2 +ARG LIBOQS_VERSION=0.10.1 ARG OPENSSL_VERSION=master -ARG OQS_PROVIDER_VERSION=0.5.2 +ARG OQS_PROVIDER_VERSION=0.6.1-rc1 ARG LIBOQS_BUILD_DEFINES="-DOQS_DIST_BUILD=ON" @@ -23,10 +23,10 @@ ARG CONFIGDIR="/" ARG SIG_ALG="dilithium3" # defines the list of default groups to be activated in nginx-openssl config: -ARG DEFAULT_GROUPS=x25519:x448:prime256v1:secp384r1:secp521r1:kyber512:p256_kyber512:kyber768:p384_kyber768:kyber1024:p521_kyber1024 +ARG DEFAULT_GROUPS=x25519:x448:prime256v1:secp384r1:secp521r1:kyber512:x25519_kyber768:p256_kyber512:kyber768:p384_kyber768:kyber1024:p521_kyber1024 # define the nginx version to include -ARG NGINX_VERSION=1.25.3 +ARG NGINX_VERSION=1.26.1 # Define the degree of parallelism when building the image; leave the number away only if you know what you are doing ARG MAKE_DEFINES="-j" @@ -81,7 +81,7 @@ RUN mkdir -p ${OSSLDIR}/ssl && cp /opt/openssl/apps/openssl.cnf ${OSSLDIR}/ssl/ # build oqsprovider WORKDIR /opt/oqs-provider -RUN ln -s /opt/nginx/include/oqs ${OSSLDIR}/include && rm -rf build && cmake -DCMAKE_C_STANDARD_LIBRARIES="-ldl" -DOPENSSL_ROOT_DIR=${OSSLDIR} -DCMAKE_PREFIX_PATH=${INSTALLDIR} -S . -B build && cmake --build build && mkdir -p ${OSSLDIR}/lib64/ossl-modules && cp build/lib/oqsprovider.so ${OSSLDIR}/lib64/ossl-modules && rm -rf ${INSTALLDIR}/lib64 +RUN ln -s /opt/nginx/include/oqs ${OSSLDIR}/include && rm -rf build && cmake -DCMAKE_C_STANDARD_LIBRARIES="-ldl -pthread" -DOPENSSL_ROOT_DIR=${OSSLDIR} -DCMAKE_PREFIX_PATH=${INSTALLDIR} -S . -B build && cmake --build build && mkdir -p ${OSSLDIR}/lib64/ossl-modules && cp build/lib/oqsprovider.so ${OSSLDIR}/lib64/ossl-modules && rm -rf ${INSTALLDIR}/lib64 WORKDIR ${INSTALLDIR} @@ -156,4 +156,4 @@ COPY --from=intermediate ${CAROOTDIR} ${CAROOTDIR} RUN tar czvf oqs-nginx-${LIBOQS_VERSION}.tgz ${BASEDIR} # Package for root CA cert and key -RUN tar czvf oqs-testserver-rootca-${LIBOQS_VERSION}.tgz ${CAROOTDIR} \ No newline at end of file +RUN tar czvf oqs-testserver-rootca-${LIBOQS_VERSION}.tgz ${CAROOTDIR} diff --git a/nginx/fulltest/build_ubuntu.sh b/nginx/fulltest/build_ubuntu.sh index 07b106ce..c2797823 100755 --- a/nginx/fulltest/build_ubuntu.sh +++ b/nginx/fulltest/build_ubuntu.sh @@ -9,7 +9,7 @@ docker build --no-cache -t oqs-nginx-fulltest-provider . # Copy deployment tar from image -docker cp $(docker create oqs-nginx-fulltest-provider:latest):oqs-nginx-0.9.2.tgz . +docker cp $(docker create oqs-nginx-fulltest-provider:latest):oqs-nginx-0.10.1.tgz . # Copy root ca tar from image -docker cp $(docker create oqs-nginx-fulltest-provider:latest):oqs-testserver-rootca-0.9.2.tgz . \ No newline at end of file +docker cp $(docker create oqs-nginx-fulltest-provider:latest):oqs-testserver-rootca-0.10.1.tgz . diff --git a/nginx/fulltest/index-template b/nginx/fulltest/index-template index 215c392d..3b7087e0 100644 --- a/nginx/fulltest/index-template +++ b/nginx/fulltest/index-template @@ -33,6 +33,7 @@ tr:nth-child(even) {

This nginx server supports

@@ -82,7 +83,7 @@ tr:nth-child(even) {

For automated testing, a JSON file encoding all available SIG/KEM combinations and the respective ports where they can be found is available for download here. We explicitly want to warn that algorithm/port combinations are subject to change. Be sure to download the most current JSON file before testing.

-

Note: The designator "*" below for key exchange algorithms should not be understood that the port referenced supports any possible KEM, but only all those KEMs configured into the underlying nginx server as default groups. This can be set when building the server via the DEFAULT_GROUPS configuration option. The default algorithm list is: 

x25519:x448:prime256v1:secp384r1:secp521r1:kyber512:p256_kyber512:kyber768:p384_kyber768:kyber1024:p521_kyber1024.

+

Note: The designator "*" below for key exchange algorithms should not be understood that the port referenced supports any possible KEM, but only all those KEMs configured into the underlying nginx server as default groups. This can be set when building the server via the DEFAULT_GROUPS configuration option. The default algorithm list is: 

x25519:x448:prime256v1:secp384r1:secp521r1:kyber512:x25519_kyber768:p256_kyber512:kyber768:p384_kyber768:kyber1024:p521_kyber1024.