Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
This bug was initially created as a copy of Bug #1397547
I am copying this bug because:
There seems to be a regression of this bug in RHEL-9.3 in FIPS. Scenario described below is implemented in TC#0544984 - /CoreOS/openssh/Regression/bz1397547-SSH-does-not-use-the-ibmca-crypto-hardware. The test fails on RHEL-9.3 with openssh-8.7p1-34.el9.s390x the same way that is described in the original bug report (counters are not incremented). When I downgrade to openssh-8.7p1-28.el9.s390x the test again works flawlessly. The most suspicious change in 9.3.9 openssh is in BZ#2091694 - isn't it possible that it brought this regression?
Description of problem:
Configured OpenSSL to use ibmca and verified the configuration for Apache but SSHD will not use the modular exponentiation (RSA/DH/DSA) from the crypto adapter.
Version-Release number of selected component (if applicable):
openssh-8.7p1-34.el9.s390x (the other packages make no difference)
How reproducible:
100% in FIPS mode on s390x
Steps to Reproduce:
1. Run TC#0544984 - /CoreOS/openssh/Regression/bz1397547-SSH-does-not-use-the-ibmca-crypto-hardware
or
0. configure the openssl.cnf as described in openssl.cnf.sample-s390x reboot
1.configure openssl as above
2.reboot
3.run lszcrypt -VVV to check request_count
4.run icastats -r to clear stats
5.open multiple ssh sessions and the counter will not increment
6.run lszcrypt -VVV to check request_count
7.run icastats to verify the software count is incrementing and the hardware count is not
Actual results:
the request_count will not increment and icastats for hardware will not increment which means that ssh is using the builtin openssl engine instead of offloading to the crypto card
Expected results:
request_count should increment and icastats should increment for hardware
Additional info:
Works fine with openssh-8.7p1-28.el9.s390x.
Works fine with openssh-8.7p1-34.el9.s390x when FIPS is disabled.
Comment 2Dmitry Belyavskiy
2023-08-14 07:25:49 UTC
No, this is something different. The issue in bug 2224568 has been fixed with openssl-ibmca-2.4.0-4.el9 which has been installed in test jobs above.
However, I had been discussing this issue previously with Hubert Kario who spotted it. The ibmca engine is not used when openssl is configured to use the ibmca engine. It works when openssl is using ibmca provider. The engine is deprecated and it has never been FIPS compliant, we believe this is not worth fixing. Users should be using ibmca provider instead.
Comment 4Dmitry Belyavskiy
2023-08-14 08:20:38 UTC
Ondra, could you please check whether switching to the provider fixes the issue? If yes, I'd close it as WONTFIX.
(In reply to Dmitry Belyavskiy from comment #4)
> Ondra, could you please check whether switching to the provider fixes the
> issue? If yes, I'd close it as WONTFIX.
Yes, it works fine when imbca provider is enabled. Thank you both!