- Upgraded to version 3.3.3 (Fate#325690) * v3.3.3 [PATCH] Various bug fixes * v3.3.2 [PATCH] Skip ECC tests if required HW is not available [PATCH] Update spec file * v3.3.1 [PATCH] Fix configure.ac to honour CFLAGS * v3.3.0 [FEATURE] Add CEX supported elliptic-curve crypto interfaces [FEATURE] Add SIMD supported multiple-precision arithmetic interfaces [FEATURE] Add interface to enable/disable SW fallbacks [FEATURE] Add 'make check' target, test-suite rework * v3.2.1 [FEATURE] Use z14 PRNO-TRNG to seed SHA512-DRBG. [PATCH] Various bug fixes. - Dropped obsolete patch increment-icastats-counter-for-aes-gcm.patch - Added "Obsoletes: libica-2_3_0" to the libica-tools package to fix a problem with upgrading from SLES12 SP2 to either SLES12 SP3/SP4, or SLES15. (bsc#1112655) - Added "Obsoletes: libica2" to the libica-tools package to fix a problem with upgrading from SLES12 SP2 to either SLES12 SP3/SP4, or SLES15. (bsc#1046435, bsc#1104638) - Removed COPYING from %files, since it is no longer in the tarball. - Added Add-non-executable-gnu-stack-markings-in-the-assembl.patch (bsc#1103493). - Replaced multiple instances of $RPM_BUILD_ROOT with %buildroot in the spec file. - Added increment-icastats-counter-for-aes-gcm.patch (bsc#1086756) - Updated boot.z90crypt script to fix a problem with the modprobe command not being found. (bsc#1040229). - Added "Recommends: libica-tools" (bsc#1046435). - Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468) - Added "--enable-fips" to the %configure parms (Fate#324115) - Upgraded to version 3.2 (Fate#321517) * v3.2.0 [FEATURE] New AES-GCM interface. [UPDATE] Add symbol versioning. * v3.1.1 [PATCH] Various bug fixes related to old and new AES-GCM implementations. [UPDATE] Add SHA3 test cases. Improved and extended test suite. * v3.1.0 [FEATURE] Add KMA support for AES-GCM. [FEATURE] Add SHA-3 support. [PATCH] Reject RSA keys with invalid key-length. [PATCH] Allow zero output length for ica_random_number_generate. [PATCH] icastats: Correct owner of shared segment when root creates it. * Removed the following obsolete patches: libica-3.0.2-01-fix-old-aes-gcm-decrypt-code-path.patch libica-3.0.2-02-fix-aes-ccm-encrypt-code-path.patch libica-3.0.2-03-fix-aes-ctr.patch libica-3.0.2-04-fix-aes-gcm-to-allow-zero-pt-ct-length.patch - libica: AES-GCM/CCM sometimes compute wrong tag values (bsc#1058567) - Added the following patches (bsc#1058567) - libica-3.0.2-01-fix-old-aes-gcm-decrypt-code-path.patch - libica-3.0.2-02-fix-aes-ccm-encrypt-code-path.patch - libica-3.0.2-03-fix-aes-ctr.patch - libica-3.0.2-04-fix-aes-gcm-to-allow-zero-pt-ct-length.patch - baselibs.conf doesn't need any additional provides/conflicts for libica3. - Update baselibs.conf with proper name for library package name, stop providing/obsoleting libica-2_1_0/libica-2_3-0. - Upgraded to version 3.0.2 (Fate#322025). - v3.0.2 - Fix locking callbacks for openSSL APIs. - v3.0.1 - Fixed msa level detection on zEC/BC12 GA1 and predecessors. - v3.0.0 - Added FIPS mode. - Sanitized exported symbols. - Removed deprecated APIs. Marked some APIs as deprecated. - Adapted to OpenSSL v1.1.0. - RSA key generation is thread-safe now. - Removed the following obsolete patches: - fix-initialization-of-s390-hardware-switches-1.patch - fix-initialization-of-s390-hardware-switches-2.patch - fix-msa-level-detection.patch - fix-segfault-during-multithread-keygen.patch - rng-performance.patch - Made the following packaging changes: - Implemented the shared library packaging guidelines. - Consolidated double invocation of %setup into just one. - Dropped redundant %ifarch, the package is already ExclusiveArch. - Updated descriptions. - Added an libica-rpmlintrc file. - Added the following two patches: - fix-segfault-during-multithread-keygen.patch (bsc#991485) - fix-msa-level-detection.patch (bsc#1010927) - Added rng-performance.patch (bsc#990850). - Updated baselibs.conf to obsolete prior versions of the 32bit package. (bsc#983897): provides "libica-<targettype> = <version>" obsoletes "libica-<targettype> < <version>" provides "libica-2_1_0-<targettype> = <version>" obsoletes "libica-2_1_0-<targettype> < <version>" provides "libica-2_3_0-<targettype> = <version>" obsoletes "libica-2_3_0-<targettype> < <version>" - Added fix-initialization-of-s390-hardware-switches-1.patch and fix-initialization-of-s390-hardware-switches-2.patch (bsc#980548) - Upgraded to version 2.6.2 (FATE#319610). - Renamed /etc/init.d/z90crypt to boot.z90crypt to conform to naming standards. - Found the original location of the icaioctl.h file and downloaded it to replace what we had previously. - Removed the unnecessary libica2.la file - Removed unnecessary Requires for glibc-devel - Added Requires libica2 to the -devel package - Converted call to configure to %configure macro - Removed obsolete and unnecessary INSROOT and bindir parameters from the make install command - Add Provides/Obsoletes for libica-2_3_0 so that the package from SLE12 GA is replaced (bsc#953096). - move the .so file to the mainpackage, the openssl-ibmca engine will only load "libica.so" (bsc#952871) - Update to libica v2.4.2 (FATE#318035) - Removed outdated libica-aes_ccm-31-bit-compatibility.patch - Moved init script into libica-SuSE.tar.bz2 archive - sanitize release line in specfile - Moved z90crypt out of useless libica-SuSE.tar.bz2 tarball to root - Removed libica-SuSE.tar.bz2 - z90crypt now starts and stops ap kernel module (bnc#888943) - libica-aes_ccm-31-bit-compatibility.patch: AES_CCM: fixed 64/31 bit compatibility - add obsoletes and provides for older libica versions - update to 2.3.0 (fate#315342) - obsolete/upstreamed patches: libica-2_1_0-fix_temporary_buffer_allocation_in_ica_get_version.patch libica-2_1_0-msa4-extension.patch libica-2_1_0-synchronize_shared_memory_ref_counting.patch - Added COPYING to %files - Fixed build dependency errors by requiring autoconf, automake and libtool - Changed license to CPL-1.0 - Created devel package - Support for MSA4 extension (bnc#794518, fate#314078) - synchronize shared memory reference counting for library statistics (bnc#719659) - fix temporary buffer allocation in ica_get_version() (bnc#719660) - update -> 2.1.0 (fate#311914) - Moved icainfo into /usr/bin (bnc#448643) - obsolete old -XXbit packages (bnc#437293) - fix build on all platforms - Added CPL license to include/z90crypt.h, removed GPL reference (This patch is upstream) - Changed package name to libica-1_3_9 to conform to rpmlint requirements. (bnc#433432) - Removed soname filter for rpmlint - Several RPM fixes to help satisfy rpmlint - Updated to libica 1.3.9 - added baselibs.conf file to build xxbit packages for multilib support - remove inclusion of linux/config.h - z90crypt: handle errors (bug #247799) - Add gcc-c++ to BuildRequires. - fix build for the rest of platforms - Update to libica 1.3.7 (#160036 - LTC22571) - Increasing # of open handles with symmetric crypto support (#165323 - LTC23095) - converted neededforbuild to BuildRequires - include string.h and unistd.h in icalinux.c - Port package from SLES9 SP3 - Update to libica 1.3.6-rc3. - Close all filehandles (#130060 - LTC19221). - downgrade to libica 1.3.6-rc2 (contains AES software fallback, bug #117336) - Update to libica 1.3.6 (#117336) - fix implicit declaration - Changing the default value from 0 to -1 in rcz90crypt (#114371) - Finally fix 'reload' messages (#81824 - LTC15733). - Fix sigill patch. - Remove printf output from sigill patch (#81829 - LTC15731). - Use correct default value for z90crypt (#81825 - LTC15732). - Fix messages for 'reload' (#81824 - LTC15733). - Fixed SIGILL on z900 (#46422). - Fixed range for 'domain' parameter in sysconfig.z90crypt (#42005). - Fix module loading error (#42006). - Add sysconfig variable to set the 'domain' parameter (#42005). - update -> 1.3.5-3 (bug #42122) - Update README.SuSE and correct name as well - Use modprobe instead of insmod and fix module load error(#40526) - Fix error checking for no hardware found case and hw error on load - Update Readme again for the correct name (SUSE LINUX Server). - Moved README.SuSE to README.SUSE. - Update Readme to refer to the correct name (SUSE Linux Server). - Update to 1.3.5-2 (#38511, #39693). - Update Readme to refer to SUSE Linux Server instead of SuSE Linux Enterprise Server. - Update to 1.3.5 - export CFLAGS & CPPFLAGS for configure - Exclude S/390-specific files for other archs (#37183) - add "-I./include" to CFLAGS and use RPM_OPT_FLAGS - fix build - build as user - update to 1.3.4 - update to 1.3.2 - update to 1.3.1: now supports DES, TDES and SHA, as well as RSA. - throw libica.patch away, since autoversion and Makefile.am have similar changes now, and the renaming from _LINUX_S390_ to __s390__ is not really necessary - use %defattr - checked that icaioctl.h is still current - dump the bin-only z90crypt-2.4.7-s390-2.tar.gz which has gone open source meanwhile and comes with the kernel sources - added documentation how to set up crypto hardware support, esp. S/390 and zSeries. (#16011, #22056) - upgraded to version 1.2 as requested by IBM to make openCryptoki 1.5 actually work. (#20737) - Correct PreReq - fixed src/Makefile.am and ugly ./autoversion to honor %_lib and to build on non-s390 - updated to current libica - hacked in icaioctl.h for build, 'til we have the module in the kernel. - add %run_ldconfig - fix for current automake/autoconf - removed old fillup-template and START_ variable - modified etc/init.d/z90crypt-script to report result at start. - Added openssl to #neededforbuild, which is needed in addition to openssl-devel - initial version OBS-URL: https://build.opensuse.org/request/show/649054 OBS-URL: https://build.opensuse.org/package/show/devel:openSUSE:Factory/libica?expand=0&rev=28 |
||
---|---|---|
.gitattributes | ||
.gitignore | ||
Add-non-executable-gnu-stack-markings-in-the-assembl.patch | ||
baselibs.conf | ||
icaioctl.h | ||
libica-3.3.3.tar.gz | ||
libica-rpmlintrc | ||
libica-SuSE.tar.bz2 | ||
libica.changes | ||
libica.spec | ||
README.SUSE | ||
sysconfig.z90crypt |
The following information was provided to us courtesy of the IBM testing team, who tested the functionality of apache with mod_ssl on SUSE LINUX Enterprise Server 9 for S/390 and zSeries. It thus refers to testing only from a certain point, and the z90crypt part is of course specific to S/390 and zSeries. ------------------------------------------------------------------- Installation and Configuration of S/390 HW Crypto on SUSE Linux Enterprise Server 9 for S/390 and zSeries: 1) Installation of the driver packages openCryptoki and libica The driver packages are installed during base install in the default selection. If you installed only minimal system or deinstalled the packages, install them now. If the installation source is accessible, you can do it with a single command: 31bit: yast sw_single openCryptoki openCryptoki-32bit 64bit: yast sw_single openCryptoki openCryptoki-32bit openCryptoki-64bit This will automatically install the necessary libica packages as well if they are not installed yet. 2) Loading the z90crypt driver: rcz90crypt start to load z90crypt rcz90crypt stop to unload z90crypt this command will be available only after installation of the crypto driver packages. To load the driver automatically at every system boot, integrate it with the other boot scripts issuing insserv z90crypt 3) Checking if the z90crypt hardware driver can be accessed Run this command: openssl speed rsa1024 -engine ibmca -elapsed If you get 'can't use that engine', as the first line of output of the command look for the successive line and check: - if running "rcz90crypt restart" gives no error message - the output of command "dmesg" for error messages from the driver - the hardware is indeed available to this instance 4) Installation and Setup of mod_ssl and apache a) ensure that mod_ssl and apache are installed during base install. If the installation source is accessible, the command yast sw_single mod_ssl will install apache and mod_ssl if they are not installed yet. b) to activate the apache ssl support do the following: if you did not use yast to install the packages, you have to run manually: SuSEconfig --module apache edit /etc/sysconfig/apache: change HTTPD_START_TIMEOUT=2 to 20 change HTTPD_SEC_MOD_SSL=no to yes edit httpd.conf in /etc/httpd: in section 2: check that the ServerName and ServerMail in the ServerAdmin section is ok. in section 3: set inside <VirtualHost_default_: 443> the ServerName to host name add on section <IfModule mod_ssl.c>: SSLCryptoDevice ibmca run: SuSEconfig --module apache 5) Crypto configuration of apache/mod_ssl: a) create a certificate (Snake Oil) for the TEST --- THIS CERTIFICATE IS NOT SECURE FOR PRODUCTION USE! IT IS FOR TESTING PURPOSES ONLY! GET A PROPER CERTIFICATE FROM A CERTIFICATION AUTHORITY FOR PRODUCTION USE. go to: cd /usr/share/doc/packages/mod_ssl run: ./certificate.sh see following questions will come up. Give shown answers and use the pass phrase: der3gbe:/usr/share/doc/packages/mod_ssl # ./certificate.sh SSL Certificate Generation Utility (mkcert.sh) Copyright (c) 1998 Ralf S. Engelschall, All Rights Reserved. Generating test certificate signed by Snake Oil CA [TEST] WARNING: Do not use this for real-life/production systems STEP 0: Decide the signature algorithm used for certificate The generated X.509 CA certificate can contain either RSA or DSA based ingredients. Select the one you want to use. Signature Algorithm ((R)SA or (D)SA) [R]:R STEP 1: Generating RSA private key (1024 bit) [server.key] 123006 semi-random bytes loaded Generating RSA private key, 1024 bit long modulus ..++++++ .................++++++ e is 65537 (0x10001) STEP 2: Generating X.509 certificate signing request [server.csr] Using configuration from .mkcert.cfg You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- 1. Country Name (2 letter code) [XY]:DE 2. State or Province Name (full name) [Snake Desert]: <enter> 3. Locality Name (eg, city) [Snake Town]: <enter> 4. Organization Name (eg, company) [Snake Oil, Ltd]: <enter> 5. Organizational Unit Name (eg, section) [Webserver Team]: <enter> 6. Common Name (eg, FQDN) [www.snakeoil.dom]: <enter> 7. Email Address (eg, name@FQDN) [www@snakeoil.dom]: <enter> STEP 3: Generating X.509 certificate signed by Snake Oil CA [server.crt] Certificate Version (1 or 3) [3]:3 Signature ok subject=/C=DE/ST=Snake Desert/L=Snake Town/O=Snake Oil, Ltd/OU=Webserver Team/CN=www.snakeoil.dom/Email=www@snakeoil.dom Getting CA Private Key Verify: matching certificate & key modulus read RSA key Verify: matching certificate signature /etc/httpd/ssl.crt/server.crt: /C=XY/ST=Snake Desert/L=Snake Town/O=Snake Oil, Ltd/OU=Certificate Authority/CN=Snake Oil CA/Email=ca@snakeoil.dom error 10 at 1 depth lookup:certificate has expired OK STEP 4: Enrypting RSA private key with a pass phrase for security [server.key] The contents of the server.key file (the generated private key) has to be kept secret. So we strongly recommend you to encrypt the server.key file with a Triple-DES cipher and a Pass Phrase. Encrypt the private key now? [Y/n]: Y read RSA key writing RSA key Enter PEM pass phrase: <=== crypto Verifying password - Enter PEM pass phrase: <=== crypto Fine, you're using an encrypted RSA private key. RESULT: Server Certification Files o conf/ssl.key/server.key The PEM-encoded RSA private key file which you configure with the 'SSLCertificateKeyFile' directive (automatically done when you install via APACI). KEEP THIS FILE PRIVATE! o conf/ssl.crt/server.crt The PEM-encoded X.509 certificate file which you configure with the 'SSLCertificateFile' directive (automatically done when you install via APACI). o conf/ssl.csr/server.csr The PEM-encoded X.509 certificate signing request file which you can send to an official Certificate Authority (CA) in order to request a real server certificate (signed by this CA instead of our demonstration-only Snake Oil CA) which later can replace the conf/ssl.crt/server.crt file. WARNING: Do not use this for real-life/production systems der3gbe:/usr/share/doc/packages/mod_ssl # 6) Start Apache with SSL a) start with pass phrase (Changes done to apache modul described in item c)). run: rcapache start dev3fe01:~ # rcapache start Starting httpd [ PERL PHP4 Python SSL ]Apache/1.3.26 mod_ssl/2.8.10 (Pass Phrase Dialog) Some of your private key files are encrypted for security reasons. In order to read them you have to provide us with the pass phrases. Server dev3fe01.boeblingen.de.ibm.com:443 (RSA) Enter pass phrase: crypto Ok: Pass Phrase Dialog successful. done b) start without pass phrase when using apache without ssl-support remark: You need to change the apache modul (see item c)). Set the HTTPD_SEC_MOD_SSL=no. run: rcapache start 7) Check that ibmca is used and apache is working with http and https: a) On a browser enter http://<server-host> or https://<server-host> b) with netstat or netstat -a on the apache server machine you can see if https is used. c) in the log /var/log/httpd/ssl_engine_log you can see if the ibmca engine is started or not. d) during siege test you can see with cat /proc/driver/z90crypt if and what crypto HW is used e) you can check a http connection with telnet <server-host> http. Then enter get / http/1.0 and you should get back some stuff after pressing enter twice. f) You can check if openssl works with the ibmca engine a) Therefore you must create certificates: cd /usr/share/ssl/misc run: ./CA.sh -newcert dev3fe01:/usr/share/ssl/misc # ./CA.sh -newcert Using configuration from /etc/ssl/openssl.cnf Generating a 1024 bit RSA private key ......................++++++ .++++++ writing new private key to 'newreq.pem' Enter PEM pass phrase: <== geheim Verifying password - Enter PEM pass phrase: <== geheim Verify failure Enter PEM pass phrase: Verifying password - Enter PEM pass phrase: phrase is too short, needs to be at least 4 chars Enter PEM pass phrase: Verifying password - Enter PEM pass phrase: ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]: <== press enter State or Province Name (full name) [Some-State]: <== press enter Locality Name (eg, city) []: <== press enter Organization Name (eg, company) [Internet Widgits Pty Ltd]: <== press enter Organizational Unit Name (eg, section) []: <== press enter Common Name (eg, YOUR name) []: <== press enter Email Address []: <== press enter Certificate (and private key) is in newreq.pem run: ./CA.sh -newca dev3fe02:/usr/share/ssl/misc # ./CA.sh -newca CA certificate filename (or enter to create) newreq.pem dev3fe02: b) Use openssl as a Web-browser and use https connection: openssl s_client \ -connect <ip-addr of webserver>:443 -state -debug The machine were you start the client is working as your 'browser' connecting to the webserver. You can start commands from the client like get / http/1.0 . c) Use openssl as a Web-server and use https connection: openssl s_server \ -accept 443 -www -engine ibmca -cert newreq.pem The machine is working like a small webserver with full openssl functionality. You can start your browser to this machine and a lot of info will be sent. dev3fe01:/usr/share/ssl/misc # openssl s_server -accept 443 -www -cert newreq.pem -engine ibmca engine "ibmca" set. Using default temp DH parameters Enter PEM pass phrase: <== geheim ACCEPT -------------------------------------------------------------------