Import rpm: 3a9a4cff04ebcf62cba2891ec2b656989a9773d6

2022-08-08 14:10:39 -04:00 · 2022-08-08 14:10:39 -04:00 · 75f7d31b6a
commit 75f7d31b6a
8 changed files with 410 additions and 0 deletions
--- a/.gitignore
+++ b/.gitignore
@ -0,0 +1 @@
+SOURCES/libtpms-20211126.tar.xz
--- a/0001-tpm2-Do-not-call-EVP_PKEY_CTX_set0_rsa_oaep_label-fo.patch
+++ b/0001-tpm2-Do-not-call-EVP_PKEY_CTX_set0_rsa_oaep_label-fo.patch
@ -0,0 +1,37 @@
+From e4261984374556da65c9d46097d5a1200b335c0c Mon Sep 17 00:00:00 2001
+From: Juergen Repp <juergen.repp@sit.fraunhofer.de>
+Date: Sat, 19 Feb 2022 12:59:32 +0100
+Subject: [PATCH] tpm2: Do not call EVP_PKEY_CTX_set0_rsa_oaep_label() for
+ label of size 0 (OSSL 3)
+
+Openssl 3.0 did return an error if EVP_PKEY_CTX_set0_rsa_oaep_label was called
+with label size 0. The function should only be called if the size of the label
+is greater 0.
+With this fix TPM2_RSA_Encrypt/Decrypt did work with OpenSSL 1.1 and 3.0
+for encryption without label.
+
+Signed-off-by: Juergen Repp <juergen.repp@sit.fraunhofer.de>
+---
+ src/tpm2/crypto/openssl/CryptRsa.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/src/tpm2/crypto/openssl/CryptRsa.c b/src/tpm2/crypto/openssl/CryptRsa.c
+index 4ed04384feb0..b5d6b6c3be82 100644
+--- a/src/tpm2/crypto/openssl/CryptRsa.c
+++ b/src/tpm2/crypto/openssl/CryptRsa.c
+@@ -1356,10 +1356,9 @@ CryptRsaEncrypt(
+                 if (tmp == NULL)
+                     ERROR_RETURN(TPM_RC_FAILURE);
+                 memcpy(tmp, label->buffer, label->size);
+                if (EVP_PKEY_CTX_set0_rsa_oaep_label(ctx, tmp, label->size) <= 0)
+                    ERROR_RETURN(TPM_RC_FAILURE);
+             }
+-            // label->size == 0 is supported
+-            if (EVP_PKEY_CTX_set0_rsa_oaep_label(ctx, tmp, label->size) <= 0)
+-                ERROR_RETURN(TPM_RC_FAILURE);
+             tmp = NULL;
+             break;
+           default:
+-- 
+2.36.0.44.g0f828332d5ac
+
--- a/0001-tpm2-Fix-size-check-in-CryptSecretDecrypt.patch
+++ b/0001-tpm2-Fix-size-check-in-CryptSecretDecrypt.patch
@ -0,0 +1,31 @@
+From 3d2bbe2f1947784506ba0a7f9e8ab81eefb69929 Mon Sep 17 00:00:00 2001
+From: Ross Lagerwall <ross.lagerwall@citrix.com>
+Date: Mon, 23 May 2022 14:16:57 +0100
+Subject: [PATCH] tpm2: Fix size check in CryptSecretDecrypt
+
+Check the secret size against the size of the buffer, not the size
+member that has not been set yet.
+
+Reported by Coverity.
+
+Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com>
+---
+ src/tpm2/CryptUtil.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/tpm2/CryptUtil.c b/src/tpm2/CryptUtil.c
+index 9879f918acb6..002fde0987a9 100644
+--- a/src/tpm2/CryptUtil.c
+++ b/src/tpm2/CryptUtil.c
+@@ -732,7 +732,7 @@ CryptSecretDecrypt(
+ 					     nonceCaller->t.size);
+ 			      }
+ 			  // make sure secret will fit
+-			  if(secret->t.size > data->t.size)
+			  if(secret->t.size > sizeof(data->t.buffer))
+ 			      return TPM_RC_FAILURE;
+ 			  data->t.size = secret->t.size;
+ 			  // CFB decrypt, using nonceCaller as iv
+-- 
+2.36.0.44.g0f828332d5ac
+
--- a/0001-tpm2-When-writing-state-initialize-s_ContextSlotMask.patch
+++ b/0001-tpm2-When-writing-state-initialize-s_ContextSlotMask.patch
@ -0,0 +1,51 @@
+From b662e6fd7169f31ef664ecd0b0b45547462e1e31 Mon Sep 17 00:00:00 2001
+From: Stefan Berger <stefanb@linux.ibm.com>
+Date: Tue, 4 Jan 2022 14:45:31 -0500
+Subject: [PATCH] tpm2: When writing state initialize s_ContextSlotMask if not
+ set
+
+If s_ContextSlotMask was not set since the TPM 2 was not initialized
+by a call to TPM_Manufacture() or the state was not resumed, then
+initialize the s_ContextSlotMask to 0xffff.
+
+This situation can occur if a VM with an attached swtpm was started
+and the VM's firmware either doesn't support TPM or didn't get to
+initialize the vTPM.
+
+The following commands recreated the issue with a SeaBIOS-only VM that
+had no attached hard disk but an attached TPM 2:
+
+virsh start BIOS-only-VM ; virsh save BIOS-only-VM save.bin ; \
+ virsh restore save.bin
+
+Error: Failed to restore domain from save.bin
+error: internal error: qemu unexpectedly closed the monitor: \
+2022-01-04T19:26:18.835851Z qemu-system-x86_64: tpm-emulator: Setting the stateblob (type 2) failed with a TPM error 0x3 a parameter is bad
+2022-01-04T19:26:18.835899Z qemu-system-x86_64: error while loading state for instance 0x0 of device 'tpm-emulator'
+2022-01-04T19:26:18.835929Z qemu-system-x86_64: load of migration failed: Input/output error
+
+Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2035731
+Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
+---
+ src/tpm2/NVMarshal.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/src/tpm2/NVMarshal.c b/src/tpm2/NVMarshal.c
+index 996c73c..c7cd1e0 100644
+--- a/src/tpm2/NVMarshal.c
+++ b/src/tpm2/NVMarshal.c
+@@ -1422,6 +1422,11 @@ STATE_RESET_DATA_Marshal(STATE_RESET_DATA *data, BYTE **buffer, INT32 *size)
+     written += UINT16_Marshal(&array_size, buffer, size);
+     for (i = 0; i < array_size; i++)
+         written += UINT16_Marshal(&data->contextArray[i], buffer, size);
+
+    if (s_ContextSlotMask != 0x00ff && s_ContextSlotMask != 0xffff) {
+        /* TPM wasn't initialized, so s_ContextSlotMask wasn't set */
+        s_ContextSlotMask = 0xffff;
+    }
+     written += UINT16_Marshal(&s_ContextSlotMask, buffer, size);
+ 
+     written += UINT64_Marshal(&data->contextCounter, buffer, size);
+-- 
+2.36.1
+
--- a/gating.yaml
+++ b/gating.yaml
@ -0,0 +1,8 @@
+# recipients: kvmqe-ci, yfu, qcheng
+--- !Policy
+product_versions:
+  - rhel-9
+decision_context: osci_compose_gate
+subject_type: brew-build
+rules:
+  - !PassingTestCaseRule {test_case_name: kvm-ci.libtpms.x86_64.brew-build.gating.tier1.functional}
--- a/libtpms.spec
+++ b/libtpms.spec
@ -0,0 +1,258 @@
+%global gitdate   20211126
+%global gitversion 1ff6fe1f43
+
+Name:           libtpms
+Version:        0.9.1
+Release:        0.%{gitdate}git%{gitversion}%{?dist}
+
+Summary: Library providing Trusted Platform Module (TPM) functionality
+License:        BSD
+Url:            http://github.com/stefanberger/libtpms
+Source0:        libtpms-%{gitdate}.tar.xz
+ExcludeArch:    i686
+
+BuildRequires:  openssl-devel
+BuildRequires:  pkgconfig gawk sed
+BuildRequires:  automake autoconf libtool bash coreutils gcc-c++
+BuildRequires:  git
+BuildRequires:  make
+
+%description
+A library providing TPM functionality for VMs. Targeted for integration
+into Qemu.
+
+%package        devel
+Summary:        Include files for libtpms
+Requires:       %{name}%{?_isa} = %{version}-%{release}
+
+%description   devel
+Libtpms header files and documentation.
+
+%prep
+%autosetup -S git -n %{name}-%{gitdate}
+%build
+NOCONFIGURE=1 sh autogen.sh
+%configure --disable-static --with-tpm2 --without-tpm1 --with-openssl
+%make_build
+
+%check
+make check
+
+%install
+%make_install
+find %{buildroot} -type f -name '*.la' | xargs rm -f -- || :
+
+%ldconfig_scriptlets
+
+%files
+%license LICENSE
+%doc README CHANGES
+%{_libdir}/lib*.so.*
+
+%files devel
+%dir %{_includedir}/%{name}
+%{_includedir}/%{name}/*.h
+%{_libdir}/lib*.so
+%{_libdir}/pkgconfig/*.pc
+%{_mandir}/man3/*
+
+%changelog
+* Thu Dec 09 2021 Marc-André Lureau <marcandre.lureau@redhat.com> - 0.9.1-0.20211126git1ff6fe1f43
+- Rebase to 0.9.1 (sync with RHEL9)
+  Resolves: rhbz#2029355
+
+* Tue Aug 31 2021 Marc-André Lureau <marcandre.lureau@redhat.com> - 0.7.4-6.20201106git2452a24dab
+- Fix CVE-2021-3746 libtpms: out-of-bounds access via specially crafted TPM 2 command packets
+  Resolves: rhbz#1999307
+
+* Mon Jun 28 2021 Marc-André Lureau <marcandre.lureau@redhat.com> - 0.7.4-5.20201106git2452a24dab
+- Fix CVE-2021-3623: out-of-bounds access when trying to resume the state of the vTPM
+  Fixes: rhbz#1976816
+
+* Wed Mar 17 2021 Marc-André Lureau <marcandre.lureau@redhat.com> - 0.7.4-4.20201106git2452a24dab
+- tpm2: CryptSym: fix AES output IV
+  Fixes: rhbz#1942904
+
+* Fri Feb 19 2021 Eduardo Lima (Etrunko) <etrunko@redhat.com> - 0.7.4-3.20201106git2452a24dab
+- Add git as build dependency
+  Related: rhbz#1858821
+
+* Wed Feb 17 2021 Marc-André Lureau <marcandre.lureau@redhat.com> - 0.7.4-2.20201106git2452a24dab
+- tpm2: Return properly sized array for b parameter for NIST P521 (HLK) #180 
+  Fixes: rhbz#1858821
+
+* Fri Nov  6 18:46:36 +04 2020 Marc-André Lureau <marcandre.lureau@redhat.com> - 0.7.4-1.20201106git2452a24dab
+- Follow stable-0.7.0 branch to v0.7.4 with security-related fixes.
+  Fixes: rhbz#1893444
+
+* Tue Aug 18 2020 Marc-André Lureau <marcandre.lureau@redhat.com> - 0.7.3-1.20200818git1d392d466a
+- Update to v0.7.3 stable, fixes rhbz#1868447
+- (includes "tpm2: fix PCRBelongsTCBGroup for PCClient")
+
+* Thu May 28 2020 Marc-André Lureau <marcandre.lureau@redhat.com> - 0.7.2-1.20200527git7325acb477
+- Update to v0.7.2 stable snapshot, fixes rhbz#1809676
+- exclude i686 build
+- Following stable-0.7.0 branch for TPM 2 related fixes: RSA decryption,
+  PSS salt length, symmetric decryption (padding)
+- Under certain circumstances an RSA decryption could cause a buffer overflow causing
+  termination of the program (swtpm)
+- Following stable-0.7.0 branch for TPM 2 related fixes; v0.7.1 + gcc related patch
+- elliptic curve fixes
+- MANUFACTURER changed from "IBM " to "IBM"
+- gcc 10 related fix
+- Following stable-0.7.0 branch for TPM 1.2 related bugfix
+
+* Fri Oct 18 2019 Marc-André Lureau <marcandre.lureau@redhat.com> - 0.7.0-1.20191018gitdc116933b7
+- RHEL8.1.1 update
+- Update to v0.7.0 stable snapshot
+
+* Tue Apr 16 2019 Marc-André Lureau <marcandre.lureau@redhat.com> - 0.6.1-0.20190121git9dc915572b.2
+- RHEL8.1 build
+
+* Fri Feb 01 2019 Fedora Release Engineering <releng@fedoraproject.org> - 0.6.1-0.20190121git9dc915572b.1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
+
+* Mon Jan 21 2019 Stefan Berger <stefanb@linux.ibm.com> - 0.6.1-0.20190121git9dc915572b
+- Libtpms was updated to rev. 150 of TPM 2.0 code
+- following branch stable-0.6.0
+
+* Tue Dec 11 2018 Stefan Berger <stefanb@linux.ibm.com> - 0.6.0-0.20181211gitba56737b93
+- Following bugfixes in libtpms
+
+* Wed Oct 31 2018 Stefan Berger <stefanb@linux.ibm.com> - 0.6.0-0.20181031git0466fcf6a4
+- Following improvements in libtpms
+
+* Tue Sep 18 2018 Stefan Berger <stefanb@linux.vnet.ibm.com - 0.6.0-0.20180918gite8e8633089
+- Fixed changelog
+
+* Mon Sep 17 2018 Stefan Berger <stefanb@linux.vnet.ibm.com - 0.6.0-0.20180917gite8e8633089
+- Build snapshot from git after libtpms fix.
+
+* Fri Sep 14 2018 Marc-André Lureau <marcandre.lureau@redhat.com> - 0.6.0-0.20180914git4111bd1bcf
+- Build snapshot from git, simplify spec
+
+* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 0.5.2-12
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
+
+* Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org> - 0.5.2-11
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
+
+* Thu Aug 03 2017 Fedora Release Engineering <releng@fedoraproject.org> - 0.5.2-10
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
+
+* Wed Jul 26 2017 Fedora Release Engineering <releng@fedoraproject.org> - 0.5.2-9
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
+
+* Fri Feb 10 2017 Fedora Release Engineering <releng@fedoraproject.org> - 0.5.2-8
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
+
+* Thu Feb 04 2016 Fedora Release Engineering <releng@fedoraproject.org> - 0.5.2-7
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
+
+* Wed Jun 17 2015 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.5.2-6
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
+
+* Sun Aug 17 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.5.2-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
+
+* Sat Aug 16 2014 Stefan Berger - 0.5.2-3
+- do not include libtpms.la in rpm
+
+* Mon Jul 14 2014 Stefan Berger - 0.5.2-2
+- Added patches
+
+* Mon Jun 30 2014 Stefan Berger - 0.5.2-1
+- Updated to version 0.5.2
+- coverity fixes
+- fixes for ARM64 using __aarch64__
+
+* Sat Jun 07 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.5.1-20.1
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
+
+* Sat Aug 03 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.5.1-19
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
+
+* Mon Mar 25 2013 Stefan Berger - 0.5.1-18
+- Ran autoreconf for support of aarch64
+- Checking for __arm64__ in code
+
+* Thu Feb 14 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.5.1-17
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
+
+* Thu Jul 19 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.5.1-16
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
+
+* Fri Feb 17 2012 Peter Robinson <pbrobinson@fedoraproject.org> - 0.5.1-15
+- Add dist tag as required by package guidelines
+
+* Fri Jan 27 2012 Stefan Berger - 0.5.1-14
+- fix gcc-4.7 compilation problem
+
+* Fri Jan 13 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.5.1-13
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
+
+* Tue Dec 20 2011 Dan Horák <dan[at]danny.cz> - 0.5.1-12
+- fix build on secondary arches
+
+* Wed Nov 2 2011 Stefan Berger - 0.5.1-11
+- added (lib)gmp as runtime dependency
+
+* Sat Oct 8 2011 Stefan Berger - 0.5.1-10
+- internal fixes; callback fixes
+
+* Tue Aug 30 2011 Stefan Berger - 0.5.1-9
+- new directory structure and build process
+
+* Tue Jul 12 2011 Stefan Berger - 0.5.1-8
+- added pkgconfig as build dependency
+- enabling __powerpc__ build following Bz 728220
+
+* Wed May 25 2011 Stefan Berger - 0.5.1-7
+- increasing NVRAM area space to have enough room for certificates
+
+* Wed May 25 2011 Stefan Berger - 0.5.1-6
+- adding libtpms.pc pkg-config file
+
+* Wed Apr 13 2011 Stefan Berger - 0.5.1-5
+- adding BuildRequires for nss-softokn-freebl-static
+- several libtpms-internal changes around state serialization and 
+  deserialization
+- fixes to libtpms makefile (makefile-libtpms)
+- adding build_type to generate a debug or production build
+- need nss-devel to have nss-config
+
+* Tue Mar 08 2011 Stefan Berger - 0.5.1-4
+- small fixes to libtpms makefile
+
+* Fri Feb 25 2011 Stefan Berger - 0.5.1-3
+- removing release from tar ball name
+- Use {?_smp_mflags} for make rather than hardcoding it
+- Fixing post and postun scripts; removing the scripts for devel package
+- Fixing usage of defattr
+- Adding version information into the changelog headers and spaces between the changelog entries
+- Adding LICENSE, README and CHANGELOG file into tar ball and main rpm
+- Removing clean section
+- removed command to clean the build root
+- adding library version to the libries required for building and during
+  runtime
+- Extended Requires in devel package with {?_isa}
+
+* Fri Feb 18 2011 Stefan Berger - 0.5.1-2
+- make rpmlint happy by replacing tabs with spaces
+- providing a valid URL for the tgz file
+- release is now 2 -> 0.5.1-2
+
+* Mon Jan 17 2011 Stefan Berger - 0.5.1-1
+- Update version to 0.5.1
+
+* Fri Jan 14 2011 Stefan Berger - 0.5.0-1
+- Changes following Fedora review comments
+
+* Thu Dec 2 2010 Stefan Berger
+- Small tweaks after reading the FedoreCore packaging requirements
+
+* Tue Nov 16 2010 Stefan Berger
+- Created initial version of rpm spec files
+- Version of library is now 0.5.0
+- Debuginfo rpm is built but empty -- seems to be a known problem
+  Check https://bugzilla.redhat.com/show_bug.cgi?id=209316
--- a/make-git-snapshot.sh
+++ b/make-git-snapshot.sh
@ -0,0 +1,23 @@
+#!/bin/sh
+
+# Usage: ./make-git-snapshot.sh [COMMIT]
+#
+# to make a snapshot of the given tag/branch.  Defaults to HEAD.
+# Point env var REF to a local mesa repo to reduce clone time.
+
+DIRNAME=libtpms-$( date +%Y%m%d )
+
+echo REF ${REF:+--reference $REF}
+echo DIRNAME $DIRNAME
+echo HEAD ${1:-HEAD}
+
+rm -rf $DIRNAME
+
+git clone ${REF:+--reference $REF} \
+	https://github.com/stefanberger/libtpms $DIRNAME
+
+set -x
+GIT_DIR=$DIRNAME/.git git archive --format=tar --prefix=$DIRNAME/ ${1:-HEAD} \
+	| xz > $DIRNAME.tar.xz
+
+# rm -rf $DIRNAME
--- a/1
+++ b/1
@ -0,0 +1 @@
+SHA1 (libtpms-20211126.tar.xz) = ae609402e34992590961b0d025e9ef1202d8dede
				`@ -0,0 +1 @@`
				`SHA1 (libtpms-20211126.tar.xz) = ae609402e34992590961b0d025e9ef1202d8dede`