Compare commits
No commits in common. "c8" and "a8-beta" have entirely different histories.
2
.gitignore
vendored
2
.gitignore
vendored
@ -1 +1 @@
|
||||
SOURCES/libica-4.2.3.tar.gz
|
||||
SOURCES/libica-4.2.2.tar.gz
|
||||
|
1
.libica.metadata
Normal file
1
.libica.metadata
Normal file
@ -0,0 +1 @@
|
||||
300e2aa5c7de375a161b2390b178134a46818bdd SOURCES/libica-4.2.2.tar.gz
|
228
SOURCES/4.2.2-icastats-summary.patch
Normal file
228
SOURCES/4.2.2-icastats-summary.patch
Normal file
@ -0,0 +1,228 @@
|
||||
From f09f1d0b48f3bf541f1300716fa5bdbbbe80a4a1 Mon Sep 17 00:00:00 2001
|
||||
From: Ingo Franzki <ifranzki@linux.ibm.com>
|
||||
Date: Tue, 18 Jul 2023 09:21:54 +0200
|
||||
Subject: [PATCH] icastats: Fix summary option to display correct summary
|
||||
information
|
||||
|
||||
The '--summary' option of icastats did not display correct statistics since
|
||||
the introduction of per key keysize counters with libica version 4.0.0.
|
||||
|
||||
To display the correct summary counters, the all-key-size-counter values of an
|
||||
algorithm that supports multiple key sizes must be calculated like it is done
|
||||
in get_stats_data(). Adjust get_stats_data() function and friends so that it
|
||||
now also can be called from get_stats_sum() and can optionally operate on a
|
||||
specified statistics segment (i.e. the one where the summary statistics have
|
||||
been calculated in), not just the global one.
|
||||
|
||||
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
|
||||
---
|
||||
src/icastats.c | 4 +-
|
||||
src/icastats_shared.c | 102 +++++++++++++++++++++++------------------
|
||||
src/include/icastats.h | 5 +-
|
||||
3 files changed, 62 insertions(+), 49 deletions(-)
|
||||
|
||||
diff --git a/src/icastats.c b/src/icastats.c
|
||||
index e98617f..07b0d50 100644
|
||||
--- a/src/icastats.c
|
||||
+++ b/src/icastats.c
|
||||
@@ -302,7 +302,7 @@ int main(int argc, char *argv[])
|
||||
perror("malloc: ");
|
||||
return EXIT_FAILURE;
|
||||
}
|
||||
- get_stats_data(entries);
|
||||
+ get_stats_data(NULL, entries);
|
||||
if (json) {
|
||||
print_stats_json(entries, usr);
|
||||
} else {
|
||||
@@ -358,7 +358,7 @@ int main(int argc, char *argv[])
|
||||
perror("malloc: ");
|
||||
return EXIT_FAILURE;
|
||||
}
|
||||
- get_stats_data(stats);
|
||||
+ get_stats_data(NULL, stats);
|
||||
if (json) {
|
||||
pswd = getpwuid(user == -1 ? geteuid() : (uid_t)user);
|
||||
if (pswd == NULL) {
|
||||
diff --git a/src/icastats_shared.c b/src/icastats_shared.c
|
||||
index 8290239..f8e8563 100644
|
||||
--- a/src/icastats_shared.c
|
||||
+++ b/src/icastats_shared.c
|
||||
@@ -124,39 +124,46 @@ void stats_munmap(int user, int unlink)
|
||||
* @direction - valid values are ENCRYPT and DECRYPT
|
||||
*/
|
||||
|
||||
-uint64_t stats_query(stats_fields_t field, int hardware, int direction)
|
||||
+uint64_t stats_query(stats_entry_t *source, stats_fields_t field,
|
||||
+ int hardware, int direction)
|
||||
{
|
||||
- if (stats == NULL)
|
||||
+ if (source == NULL)
|
||||
+ source = stats;
|
||||
+
|
||||
+ if (source == NULL)
|
||||
return 0;
|
||||
|
||||
if (direction == ENCRYPT)
|
||||
if (hardware == ALGO_HW)
|
||||
- return stats[field].enc.hw;
|
||||
+ return source[field].enc.hw;
|
||||
else
|
||||
- return stats[field].enc.sw;
|
||||
+ return source[field].enc.sw;
|
||||
else
|
||||
if (hardware == ALGO_HW)
|
||||
- return stats[field].dec.hw;
|
||||
+ return source[field].dec.hw;
|
||||
else
|
||||
- return stats[field].dec.sw;
|
||||
+ return source[field].dec.sw;
|
||||
}
|
||||
|
||||
-static uint64_t calc_summary(stats_fields_t start, unsigned int num,
|
||||
+static uint64_t calc_summary(stats_entry_t *source,
|
||||
+ stats_fields_t start, unsigned int num,
|
||||
int hardware, int direction)
|
||||
{
|
||||
unsigned int i;
|
||||
uint64_t sum = 0;
|
||||
|
||||
for (i = 0; i < num; i++)
|
||||
- sum += stats_query(start + i, hardware, direction);
|
||||
+ sum += stats_query(source, start + i, hardware, direction);
|
||||
|
||||
return sum;
|
||||
}
|
||||
|
||||
/* Returns the statistic data in a stats_entry_t array
|
||||
+ * @source - source of the statistics data. If NULL, then the global stats
|
||||
+ * are used, which must have been mapped via stats_mmap() before.
|
||||
* @entries - Needs to be a array of size ICA_NUM_STATS.
|
||||
*/
|
||||
-void get_stats_data(stats_entry_t *entries)
|
||||
+void get_stats_data(stats_entry_t *source, stats_entry_t *entries)
|
||||
{
|
||||
unsigned int i;
|
||||
for (i = 0; i < ICA_NUM_STATS; i++) {
|
||||
@@ -168,58 +175,62 @@ void get_stats_data(stats_entry_t *entries)
|
||||
case ICA_STATS_AES_CTR:
|
||||
case ICA_STATS_AES_CMAC:
|
||||
case ICA_STATS_AES_GCM:
|
||||
- entries[i].enc.hw = calc_summary(i + 1, 3,
|
||||
- ALGO_HW, ENCRYPT);
|
||||
- entries[i].enc.sw = calc_summary(i + 1, 3,
|
||||
- ALGO_SW, ENCRYPT);
|
||||
- entries[i].dec.hw = calc_summary(i + 1, 3,
|
||||
- ALGO_HW, DECRYPT);
|
||||
- entries[i].dec.sw = calc_summary(i + 1, 3,
|
||||
- ALGO_SW, DECRYPT);
|
||||
+ entries[i].enc.hw = calc_summary(source, i + 1, 3,
|
||||
+ ALGO_HW, ENCRYPT);
|
||||
+ entries[i].enc.sw = calc_summary(source, i + 1, 3,
|
||||
+ ALGO_SW, ENCRYPT);
|
||||
+ entries[i].dec.hw = calc_summary(source, i + 1, 3,
|
||||
+ ALGO_HW, DECRYPT);
|
||||
+ entries[i].dec.sw = calc_summary(source, i + 1, 3,
|
||||
+ ALGO_SW, DECRYPT);
|
||||
break;
|
||||
|
||||
case ICA_STATS_AES_XTS:
|
||||
- entries[i].enc.hw = calc_summary(i + 1, 2,
|
||||
- ALGO_HW, ENCRYPT);
|
||||
- entries[i].enc.sw = calc_summary(i + 1, 2,
|
||||
- ALGO_SW, ENCRYPT);
|
||||
- entries[i].dec.hw = calc_summary(i + 1, 2,
|
||||
- ALGO_HW, DECRYPT);
|
||||
- entries[i].dec.sw = calc_summary(i + 1, 2,
|
||||
- ALGO_SW, DECRYPT);
|
||||
+ entries[i].enc.hw = calc_summary(source, i + 1, 2,
|
||||
+ ALGO_HW, ENCRYPT);
|
||||
+ entries[i].enc.sw = calc_summary(source, i + 1, 2,
|
||||
+ ALGO_SW, ENCRYPT);
|
||||
+ entries[i].dec.hw = calc_summary(source, i + 1, 2,
|
||||
+ ALGO_HW, DECRYPT);
|
||||
+ entries[i].dec.sw = calc_summary(source, i + 1, 2,
|
||||
+ ALGO_SW, DECRYPT);
|
||||
break;
|
||||
|
||||
case ICA_STATS_RSA_ME:
|
||||
case ICA_STATS_RSA_CRT:
|
||||
- entries[i].enc.hw = calc_summary(i + 1, 4,
|
||||
- ALGO_HW, ENCRYPT);
|
||||
- entries[i].enc.sw = calc_summary(i + 1, 4,
|
||||
- ALGO_SW, ENCRYPT);
|
||||
- entries[i].dec.hw = calc_summary(i + 1, 4,
|
||||
- ALGO_HW, DECRYPT);
|
||||
- entries[i].dec.sw = calc_summary(i + 1, 4,
|
||||
- ALGO_SW, DECRYPT);
|
||||
+ entries[i].enc.hw = calc_summary(source, i + 1, 4,
|
||||
+ ALGO_HW, ENCRYPT);
|
||||
+ entries[i].enc.sw = calc_summary(source, i + 1, 4,
|
||||
+ ALGO_SW, ENCRYPT);
|
||||
+ entries[i].dec.hw = calc_summary(source, i + 1, 4,
|
||||
+ ALGO_HW, DECRYPT);
|
||||
+ entries[i].dec.sw = calc_summary(source, i + 1, 4,
|
||||
+ ALGO_SW, DECRYPT);
|
||||
break;
|
||||
|
||||
case ICA_STATS_ECDH:
|
||||
case ICA_STATS_ECDSA_SIGN:
|
||||
case ICA_STATS_ECDSA_VERIFY:
|
||||
case ICA_STATS_ECKGEN:
|
||||
- entries[i].enc.hw = calc_summary(i + 1, 8,
|
||||
- ALGO_HW, ENCRYPT);
|
||||
- entries[i].enc.sw = calc_summary(i + 1, 8,
|
||||
- ALGO_SW, ENCRYPT);
|
||||
- entries[i].dec.hw = calc_summary(i + 1, 8,
|
||||
- ALGO_HW, DECRYPT);
|
||||
- entries[i].dec.sw = calc_summary(i + 1, 8,
|
||||
- ALGO_SW, DECRYPT);
|
||||
+ entries[i].enc.hw = calc_summary(source, i + 1, 8,
|
||||
+ ALGO_HW, ENCRYPT);
|
||||
+ entries[i].enc.sw = calc_summary(source, i + 1, 8,
|
||||
+ ALGO_SW, ENCRYPT);
|
||||
+ entries[i].dec.hw = calc_summary(source, i + 1, 8,
|
||||
+ ALGO_HW, DECRYPT);
|
||||
+ entries[i].dec.sw = calc_summary(source, i + 1, 8,
|
||||
+ ALGO_SW, DECRYPT);
|
||||
break;
|
||||
|
||||
default:
|
||||
- entries[i].enc.hw = stats_query(i, ALGO_HW, ENCRYPT);
|
||||
- entries[i].enc.sw = stats_query(i, ALGO_SW, ENCRYPT);
|
||||
- entries[i].dec.hw = stats_query(i, ALGO_HW, DECRYPT);
|
||||
- entries[i].dec.sw = stats_query(i, ALGO_SW, DECRYPT);
|
||||
+ entries[i].enc.hw = stats_query(source, i,
|
||||
+ ALGO_HW, ENCRYPT);
|
||||
+ entries[i].enc.sw = stats_query(source, i,
|
||||
+ ALGO_SW, ENCRYPT);
|
||||
+ entries[i].dec.hw = stats_query(source, i,
|
||||
+ ALGO_HW, DECRYPT);
|
||||
+ entries[i].dec.sw = stats_query(source, i,
|
||||
+ ALGO_SW, DECRYPT);
|
||||
break;
|
||||
}
|
||||
}
|
||||
@@ -280,6 +291,7 @@ int get_stats_sum(stats_entry_t *sum)
|
||||
}
|
||||
}
|
||||
closedir(shmDir);
|
||||
+ get_stats_data(sum, sum);
|
||||
return 1;
|
||||
}
|
||||
|
||||
diff --git a/src/include/icastats.h b/src/include/icastats.h
|
||||
index f1d70ba..136ac0f 100644
|
||||
--- a/src/include/icastats.h
|
||||
+++ b/src/include/icastats.h
|
||||
@@ -286,8 +286,9 @@ typedef enum stats_fields {
|
||||
|
||||
int stats_mmap(int user);
|
||||
void stats_munmap(int user, int unlink);
|
||||
-uint64_t stats_query(stats_fields_t field, int hardware, int direction);
|
||||
-void get_stats_data(stats_entry_t *entries);
|
||||
+uint64_t stats_query(stats_entry_t *source, stats_fields_t field,
|
||||
+ int hardware, int direction);
|
||||
+void get_stats_data(stats_entry_t *source, stats_entry_t *entries);
|
||||
void stats_increment(stats_fields_t field, int hardware, int direction);
|
||||
int get_stats_sum(stats_entry_t *sum);
|
||||
char *get_next_usr();
|
@ -1,35 +0,0 @@
|
||||
From ee365a11a4acc667c7a726fbdc3447ba550309b6 Mon Sep 17 00:00:00 2001
|
||||
From: Joerg Schmidbauer <jschmidb@de.ibm.com>
|
||||
Date: Tue, 10 Oct 2023 14:10:22 +0200
|
||||
Subject: [PATCH] fips: use openssl lib context in compute_file_hmac
|
||||
|
||||
Before calling any openssl EVP function, libica's own openssl lib ctx
|
||||
must be made the current one. This was missing in compute_file_hmac.
|
||||
|
||||
Suggested-by: Ingo Franzki <ifranzki@linux.ibm.com>
|
||||
Signed-off-by: Joerg Schmidbauer <jschmidb@de.ibm.com>
|
||||
---
|
||||
src/fips.c | 3 +++
|
||||
1 file changed, 3 insertions(+)
|
||||
|
||||
diff --git a/src/fips.c b/src/fips.c
|
||||
index f09dc77..3bbc325 100644
|
||||
--- a/src/fips.c
|
||||
+++ b/src/fips.c
|
||||
@@ -400,6 +400,8 @@ static int compute_file_hmac(const char *path, void **buf, size_t *hmaclen)
|
||||
void *fdata = NULL;
|
||||
struct stat fdata_stat;
|
||||
|
||||
+ BEGIN_OPENSSL_LIBCTX(openssl_libctx, rc);
|
||||
+
|
||||
pkey = get_pkey();
|
||||
if (!pkey)
|
||||
goto end;
|
||||
@@ -438,6 +440,7 @@ static int compute_file_hmac(const char *path, void **buf, size_t *hmaclen)
|
||||
EVP_MD_CTX_destroy(mdctx);
|
||||
|
||||
OPENSSL_cleanse(tmp, sizeof(tmp));
|
||||
+ END_OPENSSL_LIBCTX(rc);
|
||||
|
||||
return rc;
|
||||
}
|
@ -4,8 +4,8 @@
|
||||
|
||||
Summary: Library for accessing ICA hardware crypto on IBM z Systems
|
||||
Name: libica
|
||||
Version: 4.2.3
|
||||
Release: 1%{?dist}
|
||||
Version: 4.2.2
|
||||
Release: 2%{?dist}.alma.1
|
||||
License: CPL
|
||||
Group: System Environment/Libraries
|
||||
URL: https://github.com/opencryptoki/
|
||||
@ -17,9 +17,11 @@ Patch0: %{name}-4.0.1-annotate.patch
|
||||
# - reverted commit 4a3a77232ee85cf9f4eb7ac2d366b613013b9048
|
||||
# - partial revert of commit 56b9ac0669e4d204ecb3f23e5404c2351cca96a2
|
||||
Patch1: %{name}-4.1.1-revert-abi.patch
|
||||
# https://issues.redhat.com/browse/RHEL-14892
|
||||
# https//github.com/opencryptoki/libica/commit/ee365a11a4acc667c7a726fbdc3447ba550309b6
|
||||
Patch2: %{name}-4.2.3-fips.patch
|
||||
|
||||
# Patches were taken from:
|
||||
# https://github.com/opencryptoki/libica/commit/f09f1d0b48f3bf541f1300716fa
|
||||
Patch2: 4.2.2-icastats-summary.patch
|
||||
|
||||
BuildRequires: gcc
|
||||
BuildRequires: openssl
|
||||
BuildRequires: openssl-devel
|
||||
@ -110,19 +112,8 @@ fi
|
||||
|
||||
|
||||
%changelog
|
||||
* Fri Oct 27 2023 Dan Horák <dhorak@redhat.com> - 4.2.3-1
|
||||
- updated to 4.2.3 (RHEL-11411)
|
||||
- fix selfcheck in FIPS mode (RHEL-14892)
|
||||
- Resolves: RHEL-11411 RHEL-14892
|
||||
|
||||
* Wed Jul 19 2023 Dan Horák <dhorak@redhat.com> - 4.2.2-2
|
||||
- icastats: Fix summary option (#2223697)
|
||||
- Resolves: #2223697
|
||||
|
||||
* Wed May 24 2023 Dan Horák <dhorak@redhat.com> - 4.2.2-1
|
||||
- updated to 4.2.2 (#2159718)
|
||||
- FIPS 140-3 compliance (#2159748)
|
||||
- Resolves: #2159718 #2159748
|
||||
* Wed Nov 01 2023 Eduard Abdullin <eabdullin@almalinux.org> - 4.2.2-1.alma.1
|
||||
- fix permissions for shared memory segments (#2167363)
|
||||
|
||||
* Tue Feb 07 2023 Dan Horák <dhorak@redhat.com> - 4.1.1-2
|
||||
- fix permissions for shared memory segments (#2167363)
|
||||
|
Loading…
Reference in New Issue
Block a user