rpms/libica
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Update to 4.2.2

Browse Source
This commit is contained in:
eabdullin 2023-11-01 10:23:27 +03:00
parent 2895cffc24
commit d74195e26b
6 changed files with 250 additions and 52 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.gitignore vendored
View File

@ -1 +1 @@
SOURCES/libica-4.1.1.tar.gz
SOURCES/libica-4.2.2.tar.gz

2
.libica.metadata
View File

@ -1 +1 @@
a826ac86ded4ed96804fe19634b02838ab78ac86 SOURCES/libica-4.1.1.tar.gz
300e2aa5c7de375a161b2390b178134a46818bdd SOURCES/libica-4.2.2.tar.gz

228
SOURCES/4.2.2-icastats-summary.patch Normal file
View File

@ -0,0 +1,228 @@
From f09f1d0b48f3bf541f1300716fa5bdbbbe80a4a1 Mon Sep 17 00:00:00 2001
From: Ingo Franzki <ifranzki@linux.ibm.com>
Date: Tue, 18 Jul 2023 09:21:54 +0200
Subject: [PATCH] icastats: Fix summary option to display correct summary
information
The '--summary' option of icastats did not display correct statistics since
the introduction of per key keysize counters with libica version 4.0.0.
To display the correct summary counters, the all-key-size-counter values of an
algorithm that supports multiple key sizes must be calculated like it is done
in get_stats_data(). Adjust get_stats_data() function and friends so that it
now also can be called from get_stats_sum() and can optionally operate on a
specified statistics segment (i.e. the one where the summary statistics have
been calculated in), not just the global one.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
---
src/icastats.c | 4 +-
src/icastats_shared.c | 102 +++++++++++++++++++++++------------------
src/include/icastats.h | 5 +-
3 files changed, 62 insertions(+), 49 deletions(-)
diff --git a/src/icastats.c b/src/icastats.c
index e98617f..07b0d50 100644
--- a/src/icastats.c
+++ b/src/icastats.c
@@ -302,7 +302,7 @@ int main(int argc, char *argv[])
perror("malloc: ");
return EXIT_FAILURE;
}
- get_stats_data(entries);
+ get_stats_data(NULL, entries);
if (json) {
print_stats_json(entries, usr);
} else {
@@ -358,7 +358,7 @@ int main(int argc, char *argv[])
perror("malloc: ");
return EXIT_FAILURE;
}
- get_stats_data(stats);
+ get_stats_data(NULL, stats);
if (json) {
pswd = getpwuid(user == -1 ? geteuid() : (uid_t)user);
if (pswd == NULL) {
diff --git a/src/icastats_shared.c b/src/icastats_shared.c
index 8290239..f8e8563 100644
--- a/src/icastats_shared.c
+++ b/src/icastats_shared.c
@@ -124,39 +124,46 @@ void stats_munmap(int user, int unlink)
* @direction - valid values are ENCRYPT and DECRYPT
*/
-uint64_t stats_query(stats_fields_t field, int hardware, int direction)
+uint64_t stats_query(stats_entry_t *source, stats_fields_t field,
+ int hardware, int direction)
{
- if (stats == NULL)
+ if (source == NULL)
+ source = stats;
+
+ if (source == NULL)
return 0;
if (direction == ENCRYPT)
if (hardware == ALGO_HW)
- return stats[field].enc.hw;
+ return source[field].enc.hw;
else
- return stats[field].enc.sw;
+ return source[field].enc.sw;
else
if (hardware == ALGO_HW)
- return stats[field].dec.hw;
+ return source[field].dec.hw;
else
- return stats[field].dec.sw;
+ return source[field].dec.sw;
}
-static uint64_t calc_summary(stats_fields_t start, unsigned int num,
+static uint64_t calc_summary(stats_entry_t *source,
+ stats_fields_t start, unsigned int num,
int hardware, int direction)
{
unsigned int i;
uint64_t sum = 0;
for (i = 0; i < num; i++)
- sum += stats_query(start + i, hardware, direction);
+ sum += stats_query(source, start + i, hardware, direction);
return sum;
}
/* Returns the statistic data in a stats_entry_t array
+ * @source - source of the statistics data. If NULL, then the global stats
+ * are used, which must have been mapped via stats_mmap() before.
* @entries - Needs to be a array of size ICA_NUM_STATS.
*/
-void get_stats_data(stats_entry_t *entries)
+void get_stats_data(stats_entry_t *source, stats_entry_t *entries)
{
unsigned int i;
for (i = 0; i < ICA_NUM_STATS; i++) {
@@ -168,58 +175,62 @@ void get_stats_data(stats_entry_t *entries)
case ICA_STATS_AES_CTR:
case ICA_STATS_AES_CMAC:
case ICA_STATS_AES_GCM:
- entries[i].enc.hw = calc_summary(i + 1, 3,
- ALGO_HW, ENCRYPT);
- entries[i].enc.sw = calc_summary(i + 1, 3,
- ALGO_SW, ENCRYPT);
- entries[i].dec.hw = calc_summary(i + 1, 3,
- ALGO_HW, DECRYPT);
- entries[i].dec.sw = calc_summary(i + 1, 3,
- ALGO_SW, DECRYPT);
+ entries[i].enc.hw = calc_summary(source, i + 1, 3,
+ ALGO_HW, ENCRYPT);
+ entries[i].enc.sw = calc_summary(source, i + 1, 3,
+ ALGO_SW, ENCRYPT);
+ entries[i].dec.hw = calc_summary(source, i + 1, 3,
+ ALGO_HW, DECRYPT);
+ entries[i].dec.sw = calc_summary(source, i + 1, 3,
+ ALGO_SW, DECRYPT);
break;
case ICA_STATS_AES_XTS:
- entries[i].enc.hw = calc_summary(i + 1, 2,
- ALGO_HW, ENCRYPT);
- entries[i].enc.sw = calc_summary(i + 1, 2,
- ALGO_SW, ENCRYPT);
- entries[i].dec.hw = calc_summary(i + 1, 2,
- ALGO_HW, DECRYPT);
- entries[i].dec.sw = calc_summary(i + 1, 2,
- ALGO_SW, DECRYPT);
+ entries[i].enc.hw = calc_summary(source, i + 1, 2,
+ ALGO_HW, ENCRYPT);
+ entries[i].enc.sw = calc_summary(source, i + 1, 2,
+ ALGO_SW, ENCRYPT);
+ entries[i].dec.hw = calc_summary(source, i + 1, 2,
+ ALGO_HW, DECRYPT);
+ entries[i].dec.sw = calc_summary(source, i + 1, 2,
+ ALGO_SW, DECRYPT);
break;
case ICA_STATS_RSA_ME:
case ICA_STATS_RSA_CRT:
- entries[i].enc.hw = calc_summary(i + 1, 4,
- ALGO_HW, ENCRYPT);
- entries[i].enc.sw = calc_summary(i + 1, 4,
- ALGO_SW, ENCRYPT);
- entries[i].dec.hw = calc_summary(i + 1, 4,
- ALGO_HW, DECRYPT);
- entries[i].dec.sw = calc_summary(i + 1, 4,
- ALGO_SW, DECRYPT);
+ entries[i].enc.hw = calc_summary(source, i + 1, 4,
+ ALGO_HW, ENCRYPT);
+ entries[i].enc.sw = calc_summary(source, i + 1, 4,
+ ALGO_SW, ENCRYPT);
+ entries[i].dec.hw = calc_summary(source, i + 1, 4,
+ ALGO_HW, DECRYPT);
+ entries[i].dec.sw = calc_summary(source, i + 1, 4,
+ ALGO_SW, DECRYPT);
break;
case ICA_STATS_ECDH:
case ICA_STATS_ECDSA_SIGN:
case ICA_STATS_ECDSA_VERIFY:
case ICA_STATS_ECKGEN:
- entries[i].enc.hw = calc_summary(i + 1, 8,
- ALGO_HW, ENCRYPT);
- entries[i].enc.sw = calc_summary(i + 1, 8,
- ALGO_SW, ENCRYPT);
- entries[i].dec.hw = calc_summary(i + 1, 8,
- ALGO_HW, DECRYPT);
- entries[i].dec.sw = calc_summary(i + 1, 8,
- ALGO_SW, DECRYPT);
+ entries[i].enc.hw = calc_summary(source, i + 1, 8,
+ ALGO_HW, ENCRYPT);
+ entries[i].enc.sw = calc_summary(source, i + 1, 8,
+ ALGO_SW, ENCRYPT);
+ entries[i].dec.hw = calc_summary(source, i + 1, 8,
+ ALGO_HW, DECRYPT);
+ entries[i].dec.sw = calc_summary(source, i + 1, 8,
+ ALGO_SW, DECRYPT);
break;
default:
- entries[i].enc.hw = stats_query(i, ALGO_HW, ENCRYPT);
- entries[i].enc.sw = stats_query(i, ALGO_SW, ENCRYPT);
- entries[i].dec.hw = stats_query(i, ALGO_HW, DECRYPT);
- entries[i].dec.sw = stats_query(i, ALGO_SW, DECRYPT);
+ entries[i].enc.hw = stats_query(source, i,
+ ALGO_HW, ENCRYPT);
+ entries[i].enc.sw = stats_query(source, i,
+ ALGO_SW, ENCRYPT);
+ entries[i].dec.hw = stats_query(source, i,
+ ALGO_HW, DECRYPT);
+ entries[i].dec.sw = stats_query(source, i,
+ ALGO_SW, DECRYPT);
break;
}
}
@@ -280,6 +291,7 @@ int get_stats_sum(stats_entry_t *sum)
}
}
closedir(shmDir);
+ get_stats_data(sum, sum);
return 1;
}
diff --git a/src/include/icastats.h b/src/include/icastats.h
index f1d70ba..136ac0f 100644
--- a/src/include/icastats.h
+++ b/src/include/icastats.h
@@ -286,8 +286,9 @@ typedef enum stats_fields {
int stats_mmap(int user);
void stats_munmap(int user, int unlink);
-uint64_t stats_query(stats_fields_t field, int hardware, int direction);
-void get_stats_data(stats_entry_t *entries);
+uint64_t stats_query(stats_entry_t *source, stats_fields_t field,
+ int hardware, int direction);
+void get_stats_data(stats_entry_t *source, stats_entry_t *entries);
void stats_increment(stats_fields_t field, int hardware, int direction);
int get_stats_sum(stats_entry_t *sum);
char *get_next_usr();

20
SOURCES/libica-4.1.1-revert-abi.patch
View File

@ -26,7 +26,7 @@ diff --git a/include/ica_api.h b/include/ica_api.h
index 0263d2f..8f7bbdb 100644
--- a/include/ica_api.h
+++ b/include/ica_api.h
@@ -1447,6 +1447,227 @@ unsigned int ica_rsa_crt(ica_adapter_handle_t adapter_handle,
@@ -1480,6 +1480,227 @@ unsigned int ica_rsa_crt(ica_adapter_handle_t adapter_handle,
ICA_EXPORT
unsigned int ica_rsa_crt_key_check(ica_rsa_key_crt_t *rsa_key);
@ -254,7 +254,7 @@ index 0263d2f..8f7bbdb 100644
/**
* Encrypt or decrypt data with an DES key using Electronic Cook Book (ECB)
* mode as described in NIST Special Publication 800-38A Chapter 6.1.
@@ -3485,6 +3706,15 @@ void ica_aes_gcm_kma_ctx_free(kma_ctx* ctx);
@@ -3599,6 +3820,15 @@ int ica_get_hw_info(libica_hw_info *hw_info);
ICA_EXPORT
unsigned int ica_get_version(libica_version_info *version_info);
@ -268,8 +268,8 @@ index 0263d2f..8f7bbdb 100644
+ unsigned int *pmech_list_len);
+
/**
* Function that returns a list of crypto mechanisms supported by libica.
* @param pmech_list
* Return libica build information.
*
diff --git a/libica.map b/libica.map
index 0a64d4c..0a71832 100644
--- a/libica.map
@ -312,7 +312,7 @@ diff --git a/src/ica_api.c b/src/ica_api.c
index 42d9baf..3e13a29 100644
--- a/src/ica_api.c
+++ b/src/ica_api.c
@@ -2436,6 +2436,264 @@ int ica_ed448_key_gen(ICA_ED448_CTX *ctx)
@@ -2452,6 +2452,264 @@ int ica_ed448_key_gen(ICA_ED448_CTX *ctx)
*
******************************************************************************/
@ -581,9 +581,9 @@ diff --git a/src/include/s390_crypto.h b/src/include/s390_crypto.h
index 49cbb09..76f530f 100644
--- a/src/include/s390_crypto.h
+++ b/src/include/s390_crypto.h
@@ -25,11 +25,6 @@
#include <openssl/opensslv.h>
@@ -30,11 +30,6 @@ int s390_get_fips_indicator(libica_fips_indicator_element *fips_list,
unsigned int *fips_list_len);
#endif
-/* major 4.0: no more exported, now internal */
-int s390_initialize_functionlist(void);
@ -619,7 +619,7 @@ index f220205..f756597 100644
aes_ecb_test \
aes_cbc_test \
aes_ctr_test \
@@ -71,10 +76,10 @@ get_functionlist_cex_test_SOURCES = get_functionlist_cex_test.c
@@ -72,10 +77,10 @@ get_functionlist_cex_test_SOURCES = get_functionlist_cex_test.c
get_functionlist_cex_test_LDADD = @LIBS@ ${top_builddir}/src/.libs/libica-cex.so -lcrypto -lpthread
check_PROGRAMS = fips_test icastats_test get_functionlist_test \
@ -1596,7 +1596,7 @@ diff --git a/src/ica_api.c b/src/ica_api.c
index 3e13a29..1bd81bb 100644
--- a/src/ica_api.c
+++ b/src/ica_api.c
@@ -91,6 +91,16 @@ void ica_set_stats_mode(int stats_mode)
@@ -93,6 +93,16 @@ void ica_set_stats_mode(int stats_mode)
}
#ifndef NO_CPACF

35
SOURCES/libica-4.1.1-shmem.patch
View File

@ -1,35 +0,0 @@
From cd5b2b75554875111bf375b555ebd3b185cff1a0 Mon Sep 17 00:00:00 2001
From: Joerg Schmidbauer <jschmidb@de.ibm.com>
Date: Wed, 1 Feb 2023 10:54:33 +0100
Subject: [libica PATCH] bugfix: permission denied on shared memory segments
A change to the Linux kernel in 4.19 for added security is
changing the behavior when opening shared memory segments.
The O_CREAT flag must not be used for existing segments.
Signed-off-by: Joerg Schmidbauer <jschmidb@de.ibm.com>
---
src/icastats_shared.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/src/icastats_shared.c b/src/icastats_shared.c
index bbc8d0e..8290239 100644
--- a/src/icastats_shared.c
+++ b/src/icastats_shared.c
@@ -54,9 +54,10 @@ int stats_mmap(int user)
sprintf(shm_id, "icastats_%d",
user == -1 ? geteuid() : (uid_t)user);
- stats_shm_handle = shm_open(shm_id,
- O_CREAT | O_RDWR,
- S_IRUSR | S_IWUSR);
+ stats_shm_handle = shm_open(shm_id, O_RDWR, S_IRUSR | S_IWUSR);
+
+ if (stats_shm_handle == -1)
+ stats_shm_handle = shm_open(shm_id, O_CREAT | O_RDWR, S_IRUSR | S_IWUSR);
if (stats_shm_handle == -1)
return rc;
--
2.39.1

15
SPECS/libica.spec
View File

@ -4,8 +4,8 @@
Summary: Library for accessing ICA hardware crypto on IBM z Systems
Name: libica
Version: 4.1.1
Release: 2%{?dist}
Version: 4.2.2
Release: 2%{?dist}.alma.1
License: CPL
Group: System Environment/Libraries
URL: https://github.com/opencryptoki/
@ -17,9 +17,11 @@ Patch0: %{name}-4.0.1-annotate.patch
# - reverted commit 4a3a77232ee85cf9f4eb7ac2d366b613013b9048
# - partial revert of commit 56b9ac0669e4d204ecb3f23e5404c2351cca96a2
Patch1: %{name}-4.1.1-revert-abi.patch
# fix permissions for shared memory segments
# https://bugzilla.redhat.com/show_bug.cgi?id=2167363
Patch2: %{name}-4.1.1-shmem.patch
# Patches were taken from:
# https://github.com/opencryptoki/libica/commit/f09f1d0b48f3bf541f1300716fa
Patch2: 4.2.2-icastats-summary.patch
BuildRequires: gcc
BuildRequires: openssl
BuildRequires: openssl-devel
@ -110,6 +112,9 @@ fi
%changelog
* Wed Nov 01 2023 Eduard Abdullin <eabdullin@almalinux.org> - 4.2.2-1.alma.1
- fix permissions for shared memory segments (#2167363)
* Tue Feb 07 2023 Dan Horák <dhorak@redhat.com> - 4.1.1-2
- fix permissions for shared memory segments (#2167363)
- Resolves: #2167363