import libtpms-0.9.1-2.20211126git1ff6fe1f43.el9
This commit is contained in:
CentOS Sources
Stepan Oksanichenko
parent
d13e92b963
commit
0580917f64
@ -0,0 +1,37 @@
|
||||
From e4261984374556da65c9d46097d5a1200b335c0c Mon Sep 17 00:00:00 2001
|
||||
From: Juergen Repp <juergen.repp@sit.fraunhofer.de>
|
||||
Date: Sat, 19 Feb 2022 12:59:32 +0100
|
||||
Subject: [PATCH] tpm2: Do not call EVP_PKEY_CTX_set0_rsa_oaep_label() for
|
||||
label of size 0 (OSSL 3)
|
||||
|
||||
Openssl 3.0 did return an error if EVP_PKEY_CTX_set0_rsa_oaep_label was called
|
||||
with label size 0. The function should only be called if the size of the label
|
||||
is greater 0.
|
||||
With this fix TPM2_RSA_Encrypt/Decrypt did work with OpenSSL 1.1 and 3.0
|
||||
for encryption without label.
|
||||
|
||||
Signed-off-by: Juergen Repp <juergen.repp@sit.fraunhofer.de>
|
||||
---
|
||||
src/tpm2/crypto/openssl/CryptRsa.c | 5 ++---
|
||||
1 file changed, 2 insertions(+), 3 deletions(-)
|
||||
|
||||
diff --git a/src/tpm2/crypto/openssl/CryptRsa.c b/src/tpm2/crypto/openssl/CryptRsa.c
|
||||
index 4ed04384feb0..b5d6b6c3be82 100644
|
||||
--- a/src/tpm2/crypto/openssl/CryptRsa.c
|
||||
+++ b/src/tpm2/crypto/openssl/CryptRsa.c
|
||||
@@ -1356,10 +1356,9 @@ CryptRsaEncrypt(
|
||||
if (tmp == NULL)
|
||||
ERROR_RETURN(TPM_RC_FAILURE);
|
||||
memcpy(tmp, label->buffer, label->size);
|
||||
+ if (EVP_PKEY_CTX_set0_rsa_oaep_label(ctx, tmp, label->size) <= 0)
|
||||
+ ERROR_RETURN(TPM_RC_FAILURE);
|
||||
}
|
||||
- // label->size == 0 is supported
|
||||
- if (EVP_PKEY_CTX_set0_rsa_oaep_label(ctx, tmp, label->size) <= 0)
|
||||
- ERROR_RETURN(TPM_RC_FAILURE);
|
||||
tmp = NULL;
|
||||
break;
|
||||
default:
|
||||
--
|
||||
2.36.0.44.g0f828332d5ac
|
||||
|
||||
31
SOURCES/0001-tpm2-Fix-size-check-in-CryptSecretDecrypt.patch
Normal file
31
SOURCES/0001-tpm2-Fix-size-check-in-CryptSecretDecrypt.patch
Normal file
@ -0,0 +1,31 @@
|
||||
From 3d2bbe2f1947784506ba0a7f9e8ab81eefb69929 Mon Sep 17 00:00:00 2001
|
||||
From: Ross Lagerwall <ross.lagerwall@citrix.com>
|
||||
Date: Mon, 23 May 2022 14:16:57 +0100
|
||||
Subject: [PATCH] tpm2: Fix size check in CryptSecretDecrypt
|
||||
|
||||
Check the secret size against the size of the buffer, not the size
|
||||
member that has not been set yet.
|
||||
|
||||
Reported by Coverity.
|
||||
|
||||
Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com>
|
||||
---
|
||||
src/tpm2/CryptUtil.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/src/tpm2/CryptUtil.c b/src/tpm2/CryptUtil.c
|
||||
index 9879f918acb6..002fde0987a9 100644
|
||||
--- a/src/tpm2/CryptUtil.c
|
||||
+++ b/src/tpm2/CryptUtil.c
|
||||
@@ -732,7 +732,7 @@ CryptSecretDecrypt(
|
||||
nonceCaller->t.size);
|
||||
}
|
||||
// make sure secret will fit
|
||||
- if(secret->t.size > data->t.size)
|
||||
+ if(secret->t.size > sizeof(data->t.buffer))
|
||||
return TPM_RC_FAILURE;
|
||||
data->t.size = secret->t.size;
|
||||
// CFB decrypt, using nonceCaller as iv
|
||||
--
|
||||
2.36.0.44.g0f828332d5ac
|
||||
|
||||
@ -0,0 +1,51 @@
|
||||
From b662e6fd7169f31ef664ecd0b0b45547462e1e31 Mon Sep 17 00:00:00 2001
|
||||
From: Stefan Berger <stefanb@linux.ibm.com>
|
||||
Date: Tue, 4 Jan 2022 14:45:31 -0500
|
||||
Subject: [PATCH] tpm2: When writing state initialize s_ContextSlotMask if not
|
||||
set
|
||||
|
||||
If s_ContextSlotMask was not set since the TPM 2 was not initialized
|
||||
by a call to TPM_Manufacture() or the state was not resumed, then
|
||||
initialize the s_ContextSlotMask to 0xffff.
|
||||
|
||||
This situation can occur if a VM with an attached swtpm was started
|
||||
and the VM's firmware either doesn't support TPM or didn't get to
|
||||
initialize the vTPM.
|
||||
|
||||
The following commands recreated the issue with a SeaBIOS-only VM that
|
||||
had no attached hard disk but an attached TPM 2:
|
||||
|
||||
virsh start BIOS-only-VM ; virsh save BIOS-only-VM save.bin ; \
|
||||
virsh restore save.bin
|
||||
|
||||
Error: Failed to restore domain from save.bin
|
||||
error: internal error: qemu unexpectedly closed the monitor: \
|
||||
2022-01-04T19:26:18.835851Z qemu-system-x86_64: tpm-emulator: Setting the stateblob (type 2) failed with a TPM error 0x3 a parameter is bad
|
||||
2022-01-04T19:26:18.835899Z qemu-system-x86_64: error while loading state for instance 0x0 of device 'tpm-emulator'
|
||||
2022-01-04T19:26:18.835929Z qemu-system-x86_64: load of migration failed: Input/output error
|
||||
|
||||
Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2035731
|
||||
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
|
||||
---
|
||||
src/tpm2/NVMarshal.c | 5 +++++
|
||||
1 file changed, 5 insertions(+)
|
||||
|
||||
diff --git a/src/tpm2/NVMarshal.c b/src/tpm2/NVMarshal.c
|
||||
index 996c73c..c7cd1e0 100644
|
||||
--- a/src/tpm2/NVMarshal.c
|
||||
+++ b/src/tpm2/NVMarshal.c
|
||||
@@ -1422,6 +1422,11 @@ STATE_RESET_DATA_Marshal(STATE_RESET_DATA *data, BYTE **buffer, INT32 *size)
|
||||
written += UINT16_Marshal(&array_size, buffer, size);
|
||||
for (i = 0; i < array_size; i++)
|
||||
written += UINT16_Marshal(&data->contextArray[i], buffer, size);
|
||||
+
|
||||
+ if (s_ContextSlotMask != 0x00ff && s_ContextSlotMask != 0xffff) {
|
||||
+ /* TPM wasn't initialized, so s_ContextSlotMask wasn't set */
|
||||
+ s_ContextSlotMask = 0xffff;
|
||||
+ }
|
||||
written += UINT16_Marshal(&s_ContextSlotMask, buffer, size);
|
||||
|
||||
written += UINT64_Marshal(&data->contextCounter, buffer, size);
|
||||
--
|
||||
2.36.1
|
||||
|
||||
@ -3,12 +3,15 @@
|
||||
|
||||
Name: libtpms
|
||||
Version: 0.9.1
|
||||
Release: 0.%{gitdate}git%{gitversion}%{?dist}
|
||||
Release: 2.%{gitdate}git%{gitversion}%{?dist}
|
||||
|
||||
Summary: Library providing Trusted Platform Module (TPM) functionality
|
||||
License: BSD
|
||||
Url: http://github.com/stefanberger/libtpms
|
||||
Source0: libtpms-%{gitdate}.tar.xz
|
||||
Patch0001: 0001-tpm2-Do-not-call-EVP_PKEY_CTX_set0_rsa_oaep_label-fo.patch
|
||||
Patch0002: 0001-tpm2-Fix-size-check-in-CryptSecretDecrypt.patch
|
||||
Patch0003: 0001-tpm2-When-writing-state-initialize-s_ContextSlotMask.patch
|
||||
|
||||
BuildRequires: openssl-devel
|
||||
BuildRequires: pkgconfig gawk sed
|
||||
@ -55,6 +58,14 @@ find %{buildroot} -type f -name '*.la' | xargs rm -f -- || :
|
||||
%{_mandir}/man3/*
|
||||
|
||||
%changelog
|
||||
* Mon Jun 20 2022 Marc-André Lureau <marcandre.lureau@redhat.com> - 0.9.1-2.20211126git1ff6fe1f43
|
||||
- Backport s_ContextSlotMask initialization fix
|
||||
Resolves: rhbz#2035731
|
||||
|
||||
* Mon Jun 13 2022 Marc-André Lureau <marcandre.lureau@redhat.com> - 0.9.1-1.20211126git1ff6fe1f43
|
||||
- Backport RSA/OAEP fixes.
|
||||
Resolves: rhbz#2093651
|
||||
|
||||
* Wed Dec 01 2021 Marc-André Lureau <marcandre.lureau@redhat.com> - 0.9.1-0.20211126git1ff6fe1f43
|
||||
- Rebase to 0.9.1
|
||||
Resolves: rhbz#2027951
|
||||
|
||||
Loading…
Reference in New Issue
Block a user