diff --git a/.gitignore b/.gitignore index b0eec8c..1ab5bde 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1 @@ -SOURCES/libica-4.1.1.tar.gz +SOURCES/libica-4.2.2.tar.gz diff --git a/.libica.metadata b/.libica.metadata index 6020dad..dec8d0f 100644 --- a/.libica.metadata +++ b/.libica.metadata @@ -1 +1 @@ -a826ac86ded4ed96804fe19634b02838ab78ac86 SOURCES/libica-4.1.1.tar.gz +300e2aa5c7de375a161b2390b178134a46818bdd SOURCES/libica-4.2.2.tar.gz diff --git a/SOURCES/libica-4.1.1-shmem.patch b/SOURCES/libica-4.1.1-shmem.patch deleted file mode 100644 index 0343471..0000000 --- a/SOURCES/libica-4.1.1-shmem.patch +++ /dev/null @@ -1,35 +0,0 @@ -From cd5b2b75554875111bf375b555ebd3b185cff1a0 Mon Sep 17 00:00:00 2001 -From: Joerg Schmidbauer -Date: Wed, 1 Feb 2023 10:54:33 +0100 -Subject: [libica PATCH] bugfix: permission denied on shared memory segments - -A change to the Linux kernel in 4.19 for added security is -changing the behavior when opening shared memory segments. -The O_CREAT flag must not be used for existing segments. - -Signed-off-by: Joerg Schmidbauer ---- - src/icastats_shared.c | 7 ++++--- - 1 file changed, 4 insertions(+), 3 deletions(-) - -diff --git a/src/icastats_shared.c b/src/icastats_shared.c -index bbc8d0e..8290239 100644 ---- a/src/icastats_shared.c -+++ b/src/icastats_shared.c -@@ -54,9 +54,10 @@ int stats_mmap(int user) - sprintf(shm_id, "icastats_%d", - user == -1 ? geteuid() : (uid_t)user); - -- stats_shm_handle = shm_open(shm_id, -- O_CREAT | O_RDWR, -- S_IRUSR | S_IWUSR); -+ stats_shm_handle = shm_open(shm_id, O_RDWR, S_IRUSR | S_IWUSR); -+ -+ if (stats_shm_handle == -1) -+ stats_shm_handle = shm_open(shm_id, O_CREAT | O_RDWR, S_IRUSR | S_IWUSR); - - if (stats_shm_handle == -1) - return rc; --- -2.39.1 - diff --git a/SOURCES/libica-4.2.2-icastats-summary.patch b/SOURCES/libica-4.2.2-icastats-summary.patch new file mode 100644 index 0000000..2558bc0 --- /dev/null +++ b/SOURCES/libica-4.2.2-icastats-summary.patch @@ -0,0 +1,231 @@ +From f09f1d0b48f3bf541f1300716fa5bdbbbe80a4a1 Mon Sep 17 00:00:00 2001 +From: Ingo Franzki +Date: Tue, 18 Jul 2023 09:21:54 +0200 +Subject: [libica PATCH] icastats: Fix summary option to display correct + summary information + +The '--summary' option of icastats did not display correct statistics since +the introduction of per key keysize counters with libica version 4.0.0. + +To display the correct summary counters, the all-key-size-counter values of an +algorithm that supports multiple key sizes must be calculated like it is done +in get_stats_data(). Adjust get_stats_data() function and friends so that it +now also can be called from get_stats_sum() and can optionally operate on a +specified statistics segment (i.e. the one where the summary statistics have +been calculated in), not just the global one. + +Signed-off-by: Ingo Franzki +--- + src/icastats.c | 4 +- + src/icastats_shared.c | 102 +++++++++++++++++++++++------------------ + src/include/icastats.h | 5 +- + 3 files changed, 62 insertions(+), 49 deletions(-) + +diff --git a/src/icastats.c b/src/icastats.c +index e98617f..07b0d50 100644 +--- a/src/icastats.c ++++ b/src/icastats.c +@@ -302,7 +302,7 @@ int main(int argc, char *argv[]) + perror("malloc: "); + return EXIT_FAILURE; + } +- get_stats_data(entries); ++ get_stats_data(NULL, entries); + if (json) { + print_stats_json(entries, usr); + } else { +@@ -358,7 +358,7 @@ int main(int argc, char *argv[]) + perror("malloc: "); + return EXIT_FAILURE; + } +- get_stats_data(stats); ++ get_stats_data(NULL, stats); + if (json) { + pswd = getpwuid(user == -1 ? geteuid() : (uid_t)user); + if (pswd == NULL) { +diff --git a/src/icastats_shared.c b/src/icastats_shared.c +index 8290239..f8e8563 100644 +--- a/src/icastats_shared.c ++++ b/src/icastats_shared.c +@@ -124,39 +124,46 @@ void stats_munmap(int user, int unlink) + * @direction - valid values are ENCRYPT and DECRYPT + */ + +-uint64_t stats_query(stats_fields_t field, int hardware, int direction) ++uint64_t stats_query(stats_entry_t *source, stats_fields_t field, ++ int hardware, int direction) + { +- if (stats == NULL) ++ if (source == NULL) ++ source = stats; ++ ++ if (source == NULL) + return 0; + + if (direction == ENCRYPT) + if (hardware == ALGO_HW) +- return stats[field].enc.hw; ++ return source[field].enc.hw; + else +- return stats[field].enc.sw; ++ return source[field].enc.sw; + else + if (hardware == ALGO_HW) +- return stats[field].dec.hw; ++ return source[field].dec.hw; + else +- return stats[field].dec.sw; ++ return source[field].dec.sw; + } + +-static uint64_t calc_summary(stats_fields_t start, unsigned int num, ++static uint64_t calc_summary(stats_entry_t *source, ++ stats_fields_t start, unsigned int num, + int hardware, int direction) + { + unsigned int i; + uint64_t sum = 0; + + for (i = 0; i < num; i++) +- sum += stats_query(start + i, hardware, direction); ++ sum += stats_query(source, start + i, hardware, direction); + + return sum; + } + + /* Returns the statistic data in a stats_entry_t array ++ * @source - source of the statistics data. If NULL, then the global stats ++ * are used, which must have been mapped via stats_mmap() before. + * @entries - Needs to be a array of size ICA_NUM_STATS. + */ +-void get_stats_data(stats_entry_t *entries) ++void get_stats_data(stats_entry_t *source, stats_entry_t *entries) + { + unsigned int i; + for (i = 0; i < ICA_NUM_STATS; i++) { +@@ -168,58 +175,62 @@ void get_stats_data(stats_entry_t *entries) + case ICA_STATS_AES_CTR: + case ICA_STATS_AES_CMAC: + case ICA_STATS_AES_GCM: +- entries[i].enc.hw = calc_summary(i + 1, 3, +- ALGO_HW, ENCRYPT); +- entries[i].enc.sw = calc_summary(i + 1, 3, +- ALGO_SW, ENCRYPT); +- entries[i].dec.hw = calc_summary(i + 1, 3, +- ALGO_HW, DECRYPT); +- entries[i].dec.sw = calc_summary(i + 1, 3, +- ALGO_SW, DECRYPT); ++ entries[i].enc.hw = calc_summary(source, i + 1, 3, ++ ALGO_HW, ENCRYPT); ++ entries[i].enc.sw = calc_summary(source, i + 1, 3, ++ ALGO_SW, ENCRYPT); ++ entries[i].dec.hw = calc_summary(source, i + 1, 3, ++ ALGO_HW, DECRYPT); ++ entries[i].dec.sw = calc_summary(source, i + 1, 3, ++ ALGO_SW, DECRYPT); + break; + + case ICA_STATS_AES_XTS: +- entries[i].enc.hw = calc_summary(i + 1, 2, +- ALGO_HW, ENCRYPT); +- entries[i].enc.sw = calc_summary(i + 1, 2, +- ALGO_SW, ENCRYPT); +- entries[i].dec.hw = calc_summary(i + 1, 2, +- ALGO_HW, DECRYPT); +- entries[i].dec.sw = calc_summary(i + 1, 2, +- ALGO_SW, DECRYPT); ++ entries[i].enc.hw = calc_summary(source, i + 1, 2, ++ ALGO_HW, ENCRYPT); ++ entries[i].enc.sw = calc_summary(source, i + 1, 2, ++ ALGO_SW, ENCRYPT); ++ entries[i].dec.hw = calc_summary(source, i + 1, 2, ++ ALGO_HW, DECRYPT); ++ entries[i].dec.sw = calc_summary(source, i + 1, 2, ++ ALGO_SW, DECRYPT); + break; + + case ICA_STATS_RSA_ME: + case ICA_STATS_RSA_CRT: +- entries[i].enc.hw = calc_summary(i + 1, 4, +- ALGO_HW, ENCRYPT); +- entries[i].enc.sw = calc_summary(i + 1, 4, +- ALGO_SW, ENCRYPT); +- entries[i].dec.hw = calc_summary(i + 1, 4, +- ALGO_HW, DECRYPT); +- entries[i].dec.sw = calc_summary(i + 1, 4, +- ALGO_SW, DECRYPT); ++ entries[i].enc.hw = calc_summary(source, i + 1, 4, ++ ALGO_HW, ENCRYPT); ++ entries[i].enc.sw = calc_summary(source, i + 1, 4, ++ ALGO_SW, ENCRYPT); ++ entries[i].dec.hw = calc_summary(source, i + 1, 4, ++ ALGO_HW, DECRYPT); ++ entries[i].dec.sw = calc_summary(source, i + 1, 4, ++ ALGO_SW, DECRYPT); + break; + + case ICA_STATS_ECDH: + case ICA_STATS_ECDSA_SIGN: + case ICA_STATS_ECDSA_VERIFY: + case ICA_STATS_ECKGEN: +- entries[i].enc.hw = calc_summary(i + 1, 8, +- ALGO_HW, ENCRYPT); +- entries[i].enc.sw = calc_summary(i + 1, 8, +- ALGO_SW, ENCRYPT); +- entries[i].dec.hw = calc_summary(i + 1, 8, +- ALGO_HW, DECRYPT); +- entries[i].dec.sw = calc_summary(i + 1, 8, +- ALGO_SW, DECRYPT); ++ entries[i].enc.hw = calc_summary(source, i + 1, 8, ++ ALGO_HW, ENCRYPT); ++ entries[i].enc.sw = calc_summary(source, i + 1, 8, ++ ALGO_SW, ENCRYPT); ++ entries[i].dec.hw = calc_summary(source, i + 1, 8, ++ ALGO_HW, DECRYPT); ++ entries[i].dec.sw = calc_summary(source, i + 1, 8, ++ ALGO_SW, DECRYPT); + break; + + default: +- entries[i].enc.hw = stats_query(i, ALGO_HW, ENCRYPT); +- entries[i].enc.sw = stats_query(i, ALGO_SW, ENCRYPT); +- entries[i].dec.hw = stats_query(i, ALGO_HW, DECRYPT); +- entries[i].dec.sw = stats_query(i, ALGO_SW, DECRYPT); ++ entries[i].enc.hw = stats_query(source, i, ++ ALGO_HW, ENCRYPT); ++ entries[i].enc.sw = stats_query(source, i, ++ ALGO_SW, ENCRYPT); ++ entries[i].dec.hw = stats_query(source, i, ++ ALGO_HW, DECRYPT); ++ entries[i].dec.sw = stats_query(source, i, ++ ALGO_SW, DECRYPT); + break; + } + } +@@ -280,6 +291,7 @@ int get_stats_sum(stats_entry_t *sum) + } + } + closedir(shmDir); ++ get_stats_data(sum, sum); + return 1; + } + +diff --git a/src/include/icastats.h b/src/include/icastats.h +index f1d70ba..136ac0f 100644 +--- a/src/include/icastats.h ++++ b/src/include/icastats.h +@@ -286,8 +286,9 @@ typedef enum stats_fields { + + int stats_mmap(int user); + void stats_munmap(int user, int unlink); +-uint64_t stats_query(stats_fields_t field, int hardware, int direction); +-void get_stats_data(stats_entry_t *entries); ++uint64_t stats_query(stats_entry_t *source, stats_fields_t field, ++ int hardware, int direction); ++void get_stats_data(stats_entry_t *source, stats_entry_t *entries); + void stats_increment(stats_fields_t field, int hardware, int direction); + int get_stats_sum(stats_entry_t *sum); + char *get_next_usr(); +-- +2.40.1 + diff --git a/SPECS/libica.spec b/SPECS/libica.spec index 5aed378..a435b63 100644 --- a/SPECS/libica.spec +++ b/SPECS/libica.spec @@ -2,7 +2,7 @@ Summary: Library for accessing ICA hardware crypto on IBM z Systems Name: libica -Version: 4.1.1 +Version: 4.2.2 Release: 2%{?dist} License: CPL URL: https://github.com/opencryptoki/ @@ -11,9 +11,9 @@ Source0: https://github.com/opencryptoki/%{name}/archive/v%{version}/%{name}-%{v # https://bugzilla.redhat.com/show_bug.cgi?id=1630582 # https://github.com/opencryptoki/libica/pull/24 Patch0: %{name}-4.0.0-annotate.patch -# fix permissions for shared memory segments -# https://bugzilla.redhat.com/show_bug.cgi?id=2167364 -Patch1: %{name}-4.1.1-shmem.patch +# https://bugzilla.redhat.com/show_bug.cgi?id=2223698 +# https://github.com/opencryptoki/libica/commit/f09f1d0b48f3bf541f1300716fa5bdbbbe80a4a1 +Patch1: %{name}-4.2.2-icastats-summary.patch BuildRequires: gcc BuildRequires: openssl-devel BuildRequires: openssl @@ -110,6 +110,15 @@ fi %changelog +* Wed Jul 19 2023 Dan Horák - 4.2.2-2 +- icastats: Fix summary option (#2223698) +- Resolves: #2223698 + +* Fri May 19 2023 Dan Horák - 4.2.2-1 +- updated to 4.2.2 (#2160060) +- FIPS 140-3 compliance (#2160106) +- Resolves: #2160060 #2160106 + * Tue Feb 07 2023 Dan Horák - 4.1.1-2 - fix permissions for shared memory segments (#2167364) - Resolves: #2167364