import CS libica-4.2.2-2.el9
This commit is contained in:
eabdullin
parent
6f9c7d27ec
commit
d6e6851a6b
2
.gitignore
vendored
2
.gitignore
vendored
@ -1 +1 @@
|
|||||||
SOURCES/libica-4.1.1.tar.gz
|
SOURCES/libica-4.2.2.tar.gz
|
||||||
|
|||||||
@ -1 +1 @@
|
|||||||
a826ac86ded4ed96804fe19634b02838ab78ac86 SOURCES/libica-4.1.1.tar.gz
|
300e2aa5c7de375a161b2390b178134a46818bdd SOURCES/libica-4.2.2.tar.gz
|
||||||
|
|||||||
@ -1,35 +0,0 @@
|
|||||||
From cd5b2b75554875111bf375b555ebd3b185cff1a0 Mon Sep 17 00:00:00 2001
|
|
||||||
From: Joerg Schmidbauer <jschmidb@de.ibm.com>
|
|
||||||
Date: Wed, 1 Feb 2023 10:54:33 +0100
|
|
||||||
Subject: [libica PATCH] bugfix: permission denied on shared memory segments
|
|
||||||
|
|
||||||
A change to the Linux kernel in 4.19 for added security is
|
|
||||||
changing the behavior when opening shared memory segments.
|
|
||||||
The O_CREAT flag must not be used for existing segments.
|
|
||||||
|
|
||||||
Signed-off-by: Joerg Schmidbauer <jschmidb@de.ibm.com>
|
|
||||||
---
|
|
||||||
src/icastats_shared.c | 7 ++++---
|
|
||||||
1 file changed, 4 insertions(+), 3 deletions(-)
|
|
||||||
|
|
||||||
diff --git a/src/icastats_shared.c b/src/icastats_shared.c
|
|
||||||
index bbc8d0e..8290239 100644
|
|
||||||
--- a/src/icastats_shared.c
|
|
||||||
+++ b/src/icastats_shared.c
|
|
||||||
@@ -54,9 +54,10 @@ int stats_mmap(int user)
|
|
||||||
sprintf(shm_id, "icastats_%d",
|
|
||||||
user == -1 ? geteuid() : (uid_t)user);
|
|
||||||
|
|
||||||
- stats_shm_handle = shm_open(shm_id,
|
|
||||||
- O_CREAT | O_RDWR,
|
|
||||||
- S_IRUSR | S_IWUSR);
|
|
||||||
+ stats_shm_handle = shm_open(shm_id, O_RDWR, S_IRUSR | S_IWUSR);
|
|
||||||
+
|
|
||||||
+ if (stats_shm_handle == -1)
|
|
||||||
+ stats_shm_handle = shm_open(shm_id, O_CREAT | O_RDWR, S_IRUSR | S_IWUSR);
|
|
||||||
|
|
||||||
if (stats_shm_handle == -1)
|
|
||||||
return rc;
|
|
||||||
--
|
|
||||||
2.39.1
|
|
||||||
|
|
||||||
231
SOURCES/libica-4.2.2-icastats-summary.patch
Normal file
231
SOURCES/libica-4.2.2-icastats-summary.patch
Normal file
@ -0,0 +1,231 @@
|
|||||||
|
From f09f1d0b48f3bf541f1300716fa5bdbbbe80a4a1 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Ingo Franzki <ifranzki@linux.ibm.com>
|
||||||
|
Date: Tue, 18 Jul 2023 09:21:54 +0200
|
||||||
|
Subject: [libica PATCH] icastats: Fix summary option to display correct
|
||||||
|
summary information
|
||||||
|
|
||||||
|
The '--summary' option of icastats did not display correct statistics since
|
||||||
|
the introduction of per key keysize counters with libica version 4.0.0.
|
||||||
|
|
||||||
|
To display the correct summary counters, the all-key-size-counter values of an
|
||||||
|
algorithm that supports multiple key sizes must be calculated like it is done
|
||||||
|
in get_stats_data(). Adjust get_stats_data() function and friends so that it
|
||||||
|
now also can be called from get_stats_sum() and can optionally operate on a
|
||||||
|
specified statistics segment (i.e. the one where the summary statistics have
|
||||||
|
been calculated in), not just the global one.
|
||||||
|
|
||||||
|
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
|
||||||
|
---
|
||||||
|
src/icastats.c | 4 +-
|
||||||
|
src/icastats_shared.c | 102 +++++++++++++++++++++++------------------
|
||||||
|
src/include/icastats.h | 5 +-
|
||||||
|
3 files changed, 62 insertions(+), 49 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/src/icastats.c b/src/icastats.c
|
||||||
|
index e98617f..07b0d50 100644
|
||||||
|
--- a/src/icastats.c
|
||||||
|
+++ b/src/icastats.c
|
||||||
|
@@ -302,7 +302,7 @@ int main(int argc, char *argv[])
|
||||||
|
perror("malloc: ");
|
||||||
|
return EXIT_FAILURE;
|
||||||
|
}
|
||||||
|
- get_stats_data(entries);
|
||||||
|
+ get_stats_data(NULL, entries);
|
||||||
|
if (json) {
|
||||||
|
print_stats_json(entries, usr);
|
||||||
|
} else {
|
||||||
|
@@ -358,7 +358,7 @@ int main(int argc, char *argv[])
|
||||||
|
perror("malloc: ");
|
||||||
|
return EXIT_FAILURE;
|
||||||
|
}
|
||||||
|
- get_stats_data(stats);
|
||||||
|
+ get_stats_data(NULL, stats);
|
||||||
|
if (json) {
|
||||||
|
pswd = getpwuid(user == -1 ? geteuid() : (uid_t)user);
|
||||||
|
if (pswd == NULL) {
|
||||||
|
diff --git a/src/icastats_shared.c b/src/icastats_shared.c
|
||||||
|
index 8290239..f8e8563 100644
|
||||||
|
--- a/src/icastats_shared.c
|
||||||
|
+++ b/src/icastats_shared.c
|
||||||
|
@@ -124,39 +124,46 @@ void stats_munmap(int user, int unlink)
|
||||||
|
* @direction - valid values are ENCRYPT and DECRYPT
|
||||||
|
*/
|
||||||
|
|
||||||
|
-uint64_t stats_query(stats_fields_t field, int hardware, int direction)
|
||||||
|
+uint64_t stats_query(stats_entry_t *source, stats_fields_t field,
|
||||||
|
+ int hardware, int direction)
|
||||||
|
{
|
||||||
|
- if (stats == NULL)
|
||||||
|
+ if (source == NULL)
|
||||||
|
+ source = stats;
|
||||||
|
+
|
||||||
|
+ if (source == NULL)
|
||||||
|
return 0;
|
||||||
|
|
||||||
|
if (direction == ENCRYPT)
|
||||||
|
if (hardware == ALGO_HW)
|
||||||
|
- return stats[field].enc.hw;
|
||||||
|
+ return source[field].enc.hw;
|
||||||
|
else
|
||||||
|
- return stats[field].enc.sw;
|
||||||
|
+ return source[field].enc.sw;
|
||||||
|
else
|
||||||
|
if (hardware == ALGO_HW)
|
||||||
|
- return stats[field].dec.hw;
|
||||||
|
+ return source[field].dec.hw;
|
||||||
|
else
|
||||||
|
- return stats[field].dec.sw;
|
||||||
|
+ return source[field].dec.sw;
|
||||||
|
}
|
||||||
|
|
||||||
|
-static uint64_t calc_summary(stats_fields_t start, unsigned int num,
|
||||||
|
+static uint64_t calc_summary(stats_entry_t *source,
|
||||||
|
+ stats_fields_t start, unsigned int num,
|
||||||
|
int hardware, int direction)
|
||||||
|
{
|
||||||
|
unsigned int i;
|
||||||
|
uint64_t sum = 0;
|
||||||
|
|
||||||
|
for (i = 0; i < num; i++)
|
||||||
|
- sum += stats_query(start + i, hardware, direction);
|
||||||
|
+ sum += stats_query(source, start + i, hardware, direction);
|
||||||
|
|
||||||
|
return sum;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* Returns the statistic data in a stats_entry_t array
|
||||||
|
+ * @source - source of the statistics data. If NULL, then the global stats
|
||||||
|
+ * are used, which must have been mapped via stats_mmap() before.
|
||||||
|
* @entries - Needs to be a array of size ICA_NUM_STATS.
|
||||||
|
*/
|
||||||
|
-void get_stats_data(stats_entry_t *entries)
|
||||||
|
+void get_stats_data(stats_entry_t *source, stats_entry_t *entries)
|
||||||
|
{
|
||||||
|
unsigned int i;
|
||||||
|
for (i = 0; i < ICA_NUM_STATS; i++) {
|
||||||
|
@@ -168,58 +175,62 @@ void get_stats_data(stats_entry_t *entries)
|
||||||
|
case ICA_STATS_AES_CTR:
|
||||||
|
case ICA_STATS_AES_CMAC:
|
||||||
|
case ICA_STATS_AES_GCM:
|
||||||
|
- entries[i].enc.hw = calc_summary(i + 1, 3,
|
||||||
|
- ALGO_HW, ENCRYPT);
|
||||||
|
- entries[i].enc.sw = calc_summary(i + 1, 3,
|
||||||
|
- ALGO_SW, ENCRYPT);
|
||||||
|
- entries[i].dec.hw = calc_summary(i + 1, 3,
|
||||||
|
- ALGO_HW, DECRYPT);
|
||||||
|
- entries[i].dec.sw = calc_summary(i + 1, 3,
|
||||||
|
- ALGO_SW, DECRYPT);
|
||||||
|
+ entries[i].enc.hw = calc_summary(source, i + 1, 3,
|
||||||
|
+ ALGO_HW, ENCRYPT);
|
||||||
|
+ entries[i].enc.sw = calc_summary(source, i + 1, 3,
|
||||||
|
+ ALGO_SW, ENCRYPT);
|
||||||
|
+ entries[i].dec.hw = calc_summary(source, i + 1, 3,
|
||||||
|
+ ALGO_HW, DECRYPT);
|
||||||
|
+ entries[i].dec.sw = calc_summary(source, i + 1, 3,
|
||||||
|
+ ALGO_SW, DECRYPT);
|
||||||
|
break;
|
||||||
|
|
||||||
|
case ICA_STATS_AES_XTS:
|
||||||
|
- entries[i].enc.hw = calc_summary(i + 1, 2,
|
||||||
|
- ALGO_HW, ENCRYPT);
|
||||||
|
- entries[i].enc.sw = calc_summary(i + 1, 2,
|
||||||
|
- ALGO_SW, ENCRYPT);
|
||||||
|
- entries[i].dec.hw = calc_summary(i + 1, 2,
|
||||||
|
- ALGO_HW, DECRYPT);
|
||||||
|
- entries[i].dec.sw = calc_summary(i + 1, 2,
|
||||||
|
- ALGO_SW, DECRYPT);
|
||||||
|
+ entries[i].enc.hw = calc_summary(source, i + 1, 2,
|
||||||
|
+ ALGO_HW, ENCRYPT);
|
||||||
|
+ entries[i].enc.sw = calc_summary(source, i + 1, 2,
|
||||||
|
+ ALGO_SW, ENCRYPT);
|
||||||
|
+ entries[i].dec.hw = calc_summary(source, i + 1, 2,
|
||||||
|
+ ALGO_HW, DECRYPT);
|
||||||
|
+ entries[i].dec.sw = calc_summary(source, i + 1, 2,
|
||||||
|
+ ALGO_SW, DECRYPT);
|
||||||
|
break;
|
||||||
|
|
||||||
|
case ICA_STATS_RSA_ME:
|
||||||
|
case ICA_STATS_RSA_CRT:
|
||||||
|
- entries[i].enc.hw = calc_summary(i + 1, 4,
|
||||||
|
- ALGO_HW, ENCRYPT);
|
||||||
|
- entries[i].enc.sw = calc_summary(i + 1, 4,
|
||||||
|
- ALGO_SW, ENCRYPT);
|
||||||
|
- entries[i].dec.hw = calc_summary(i + 1, 4,
|
||||||
|
- ALGO_HW, DECRYPT);
|
||||||
|
- entries[i].dec.sw = calc_summary(i + 1, 4,
|
||||||
|
- ALGO_SW, DECRYPT);
|
||||||
|
+ entries[i].enc.hw = calc_summary(source, i + 1, 4,
|
||||||
|
+ ALGO_HW, ENCRYPT);
|
||||||
|
+ entries[i].enc.sw = calc_summary(source, i + 1, 4,
|
||||||
|
+ ALGO_SW, ENCRYPT);
|
||||||
|
+ entries[i].dec.hw = calc_summary(source, i + 1, 4,
|
||||||
|
+ ALGO_HW, DECRYPT);
|
||||||
|
+ entries[i].dec.sw = calc_summary(source, i + 1, 4,
|
||||||
|
+ ALGO_SW, DECRYPT);
|
||||||
|
break;
|
||||||
|
|
||||||
|
case ICA_STATS_ECDH:
|
||||||
|
case ICA_STATS_ECDSA_SIGN:
|
||||||
|
case ICA_STATS_ECDSA_VERIFY:
|
||||||
|
case ICA_STATS_ECKGEN:
|
||||||
|
- entries[i].enc.hw = calc_summary(i + 1, 8,
|
||||||
|
- ALGO_HW, ENCRYPT);
|
||||||
|
- entries[i].enc.sw = calc_summary(i + 1, 8,
|
||||||
|
- ALGO_SW, ENCRYPT);
|
||||||
|
- entries[i].dec.hw = calc_summary(i + 1, 8,
|
||||||
|
- ALGO_HW, DECRYPT);
|
||||||
|
- entries[i].dec.sw = calc_summary(i + 1, 8,
|
||||||
|
- ALGO_SW, DECRYPT);
|
||||||
|
+ entries[i].enc.hw = calc_summary(source, i + 1, 8,
|
||||||
|
+ ALGO_HW, ENCRYPT);
|
||||||
|
+ entries[i].enc.sw = calc_summary(source, i + 1, 8,
|
||||||
|
+ ALGO_SW, ENCRYPT);
|
||||||
|
+ entries[i].dec.hw = calc_summary(source, i + 1, 8,
|
||||||
|
+ ALGO_HW, DECRYPT);
|
||||||
|
+ entries[i].dec.sw = calc_summary(source, i + 1, 8,
|
||||||
|
+ ALGO_SW, DECRYPT);
|
||||||
|
break;
|
||||||
|
|
||||||
|
default:
|
||||||
|
- entries[i].enc.hw = stats_query(i, ALGO_HW, ENCRYPT);
|
||||||
|
- entries[i].enc.sw = stats_query(i, ALGO_SW, ENCRYPT);
|
||||||
|
- entries[i].dec.hw = stats_query(i, ALGO_HW, DECRYPT);
|
||||||
|
- entries[i].dec.sw = stats_query(i, ALGO_SW, DECRYPT);
|
||||||
|
+ entries[i].enc.hw = stats_query(source, i,
|
||||||
|
+ ALGO_HW, ENCRYPT);
|
||||||
|
+ entries[i].enc.sw = stats_query(source, i,
|
||||||
|
+ ALGO_SW, ENCRYPT);
|
||||||
|
+ entries[i].dec.hw = stats_query(source, i,
|
||||||
|
+ ALGO_HW, DECRYPT);
|
||||||
|
+ entries[i].dec.sw = stats_query(source, i,
|
||||||
|
+ ALGO_SW, DECRYPT);
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
@@ -280,6 +291,7 @@ int get_stats_sum(stats_entry_t *sum)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
closedir(shmDir);
|
||||||
|
+ get_stats_data(sum, sum);
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
diff --git a/src/include/icastats.h b/src/include/icastats.h
|
||||||
|
index f1d70ba..136ac0f 100644
|
||||||
|
--- a/src/include/icastats.h
|
||||||
|
+++ b/src/include/icastats.h
|
||||||
|
@@ -286,8 +286,9 @@ typedef enum stats_fields {
|
||||||
|
|
||||||
|
int stats_mmap(int user);
|
||||||
|
void stats_munmap(int user, int unlink);
|
||||||
|
-uint64_t stats_query(stats_fields_t field, int hardware, int direction);
|
||||||
|
-void get_stats_data(stats_entry_t *entries);
|
||||||
|
+uint64_t stats_query(stats_entry_t *source, stats_fields_t field,
|
||||||
|
+ int hardware, int direction);
|
||||||
|
+void get_stats_data(stats_entry_t *source, stats_entry_t *entries);
|
||||||
|
void stats_increment(stats_fields_t field, int hardware, int direction);
|
||||||
|
int get_stats_sum(stats_entry_t *sum);
|
||||||
|
char *get_next_usr();
|
||||||
|
--
|
||||||
|
2.40.1
|
||||||
|
|
||||||
@ -2,7 +2,7 @@
|
|||||||
|
|
||||||
Summary: Library for accessing ICA hardware crypto on IBM z Systems
|
Summary: Library for accessing ICA hardware crypto on IBM z Systems
|
||||||
Name: libica
|
Name: libica
|
||||||
Version: 4.1.1
|
Version: 4.2.2
|
||||||
Release: 2%{?dist}
|
Release: 2%{?dist}
|
||||||
License: CPL
|
License: CPL
|
||||||
URL: https://github.com/opencryptoki/
|
URL: https://github.com/opencryptoki/
|
||||||
@ -11,9 +11,9 @@ Source0: https://github.com/opencryptoki/%{name}/archive/v%{version}/%{name}-%{v
|
|||||||
# https://bugzilla.redhat.com/show_bug.cgi?id=1630582
|
# https://bugzilla.redhat.com/show_bug.cgi?id=1630582
|
||||||
# https://github.com/opencryptoki/libica/pull/24
|
# https://github.com/opencryptoki/libica/pull/24
|
||||||
Patch0: %{name}-4.0.0-annotate.patch
|
Patch0: %{name}-4.0.0-annotate.patch
|
||||||
# fix permissions for shared memory segments
|
# https://bugzilla.redhat.com/show_bug.cgi?id=2223698
|
||||||
# https://bugzilla.redhat.com/show_bug.cgi?id=2167364
|
# https://github.com/opencryptoki/libica/commit/f09f1d0b48f3bf541f1300716fa5bdbbbe80a4a1
|
||||||
Patch1: %{name}-4.1.1-shmem.patch
|
Patch1: %{name}-4.2.2-icastats-summary.patch
|
||||||
BuildRequires: gcc
|
BuildRequires: gcc
|
||||||
BuildRequires: openssl-devel
|
BuildRequires: openssl-devel
|
||||||
BuildRequires: openssl
|
BuildRequires: openssl
|
||||||
@ -110,6 +110,15 @@ fi
|
|||||||
|
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Wed Jul 19 2023 Dan Horák <dhorak@redhat.com> - 4.2.2-2
|
||||||
|
- icastats: Fix summary option (#2223698)
|
||||||
|
- Resolves: #2223698
|
||||||
|
|
||||||
|
* Fri May 19 2023 Dan Horák <dhorak@redhat.com> - 4.2.2-1
|
||||||
|
- updated to 4.2.2 (#2160060)
|
||||||
|
- FIPS 140-3 compliance (#2160106)
|
||||||
|
- Resolves: #2160060 #2160106
|
||||||
|
|
||||||
* Tue Feb 07 2023 Dan Horák <dhorak@redhat.com> - 4.1.1-2
|
* Tue Feb 07 2023 Dan Horák <dhorak@redhat.com> - 4.1.1-2
|
||||||
- fix permissions for shared memory segments (#2167364)
|
- fix permissions for shared memory segments (#2167364)
|
||||||
- Resolves: #2167364
|
- Resolves: #2167364
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user