diff --git a/opencryptoki-3.18.0-fix-json-output.patch b/opencryptoki-3.18.0-fix-json-output.patch new file mode 100644 index 0000000..baa6ff7 --- /dev/null +++ b/opencryptoki-3.18.0-fix-json-output.patch @@ -0,0 +1,47 @@ +commit 1600eebb422ae2a733de3a0bd47464620e39ab0d +Author: Ingo Franzki +Date: Tue Jun 7 08:58:16 2022 +0200 + + pkcsstats: Fix JSON output in case of errors + + Produce correct JSON output, even if an error occurs during obtaining + of the statistics for a user. + + Signed-off-by: Ingo Franzki + +diff --git a/usr/sbin/pkcsstats/pkcsstats.c b/usr/sbin/pkcsstats/pkcsstats.c +index 8eb049dd..65d4833f 100644 +--- a/usr/sbin/pkcsstats/pkcsstats.c ++++ b/usr/sbin/pkcsstats/pkcsstats.c +@@ -789,7 +789,7 @@ int main(int argc, char **argv) + bool reset = false, reset_all = false; + bool delete = false, delete_all = false; + bool slot_id_specified = false; +- bool json = false; ++ bool json = false, json_started = false; + CK_SLOT_ID slot_id = 0; + void *dll = NULL; + CK_FUNCTION_LIST *func_list = NULL; +@@ -949,8 +949,11 @@ int main(int argc, char **argv) + goto done; + } + +- if (json && print_json_start() != 0) +- goto done; ++ if (json) { ++ if (print_json_start() != 0) ++ goto done; ++ json_started = true; ++ } + + dd.func_list = func_list; + dd.num_slots = num_slots; +@@ -972,7 +975,7 @@ int main(int argc, char **argv) + } + + done: +- if (rc == 0 && json) ++ if (json && json_started) + printf("\n\t]\n}\n"); + + if (slots != NULL) diff --git a/opencryptoki-3.18.0-returning_CKR_BUFFER_TOO_SMALL.patch b/opencryptoki-3.18.0-returning_CKR_BUFFER_TOO_SMALL.patch new file mode 100644 index 0000000..9dbbb74 --- /dev/null +++ b/opencryptoki-3.18.0-returning_CKR_BUFFER_TOO_SMALL.patch @@ -0,0 +1,32 @@ +commit b545050b338e46c29936a2748aab7200e69a5c91 +Author: Ingo Franzki +Date: Tue Jul 26 15:11:06 2022 +0200 + + EP11: Fix C_GetMechanismList returning CKR_BUFFER_TOO_SMALL + + For mixed card levels, the size query call and the call to obtain the + list may run on different cards. When the size query call runs on a + card with less mechanisms than the second call, will fail, but it + returns the larger larger number of mechanisms. + + The code already re-allocates the buffer for retrieving the mechanism + list, but does not return the larger number in pulCount. This will + lead to a CKR_BUFFER_TOO_SMALL when the application calls C_GetMechanismList + again to obtain the list of mechanisms, because the applications buffer + is too small. + + Signed-off-by: Ingo Franzki + +diff --git a/usr/lib/ep11_stdll/ep11_specific.c b/usr/lib/ep11_stdll/ep11_specific.c +index 8d796452..1629e664 100644 +--- a/usr/lib/ep11_stdll/ep11_specific.c ++++ b/usr/lib/ep11_stdll/ep11_specific.c +@@ -8977,6 +8977,8 @@ CK_RV ep11tok_get_mechanism_list(STDLL_TokData_t * tokdata, + if (rc != CKR_BUFFER_TOO_SMALL) + goto out; + } ++ /* counter was updated in case of CKR_BUFFER_TOO_SMALL */ ++ *pulCount = counter; + } while (rc == CKR_BUFFER_TOO_SMALL); + + for (i = 0; i < counter; i++) { diff --git a/opencryptoki.spec b/opencryptoki.spec index c451a65..7b9f2c5 100644 --- a/opencryptoki.spec +++ b/opencryptoki.spec @@ -6,17 +6,20 @@ Name: opencryptoki Summary: Implementation of the PKCS#11 (Cryptoki) specification v3.0 Version: 3.18.0 -Release: 3%{?dist} +Release: 4%{?dist} License: CPL URL: https://github.com/opencryptoki/opencryptoki Source0: https://github.com/opencryptoki/%{name}/archive/v%{version}/%{name}-%{version}.tar.gz Source1: opencryptoki.module # https://bugzilla.redhat.com/show_bug.cgi?id=732756 -Patch0: opencryptoki-3.11.0-group.patch +Patch0: opencryptoki-3.11.0-group.patch # bz#1373833, change tmpfiles snippets from /var/lock/* to /run/lock/* -Patch1: opencryptoki-3.11.0-lockdir.patch +Patch1: opencryptoki-3.11.0-lockdir.patch # add missing config file -Patch2: opencryptoki-3.18.0-p11sak.patch +Patch2: opencryptoki-3.18.0-p11sak.patch +# upstream patches +Patch100: opencryptoki-3.18.0-fix-json-output.patch +Patch101: opencryptoki-3.18.0-returning_CKR_BUFFER_TOO_SMALL.patch Requires(pre): coreutils Requires: (selinux-policy >= 34.9-1 if selinux-policy-targeted) @@ -39,7 +42,7 @@ BuildRequires: libica-devel >= 2.3 Requires(pre): %{name}-libs%{?_isa} = %{version}-%{release} Requires: %{name}-libs%{?_isa} = %{version}-%{release} Requires: %{name}(token) -Requires(post): systemd +Requires(post): systemd diffutils Requires(preun): systemd Requires(postun): systemd @@ -208,11 +211,28 @@ configured with Enterprise PKCS#11 (EP11) firmware. install -Dpm 644 %{SOURCE1} $RPM_BUILD_ROOT%{_datadir}/p11-kit/modules/opencryptoki.module %endif +%pre +# don't touch opencryptoki.conf even if it is unchanged due to new tokversion +# backup config file. bz#2044179 +%global cfile /etc/opencryptoki/opencryptoki.conf +%global csuffix .rpmsave.XyoP +if test $1 -gt 1 && test -f %{cfile} ; then + cp -p %{cfile} %{cfile}%{csuffix} +fi + %pre libs getent group pkcs11 >/dev/null || groupadd -r pkcs11 exit 0 %post +# restore the config file from %pre +if test $1 -gt 1 && test -f %{cfile} ; then + if ( ! cmp -s %{cfile} %{cfile}%{csuffix} ) ; then + cp -p %{cfile} %{cfile}.rpmnew + fi + cp -p %{cfile}%{csuffix} %{cfile} && rm -f %{cfile}%{csuffix} +fi + %systemd_post pkcsslotd.service if test $1 -eq 1; then %tmpfiles_create %{name}.conf @@ -336,6 +356,10 @@ fi %changelog +* Mon Aug 01 2022 Than Ngo - 3.18.0-4 +- fix json output +- do not touch opencryptoki.conf if it is in place already and even if it is unchanged + * Fri Jul 22 2022 Fedora Release Engineering - 3.18.0-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild