import opencryptoki-3.18.0-3.el8

This commit is contained in:
CentOS Sources 2022-11-08 01:57:23 -05:00 committed by Stepan Oksanichenko
parent 094ff8f62a
commit 2e1694e46b
9 changed files with 111 additions and 159 deletions

2
.gitignore vendored
View File

@ -1 +1 @@
SOURCES/opencryptoki-3.17.0.tar.gz
SOURCES/opencryptoki-3.18.0.tar.gz

View File

@ -1 +1 @@
598f43d2a04a878a4577f143251f4631625ac49b SOURCES/opencryptoki-3.17.0.tar.gz
257eb4d5458c52bf7c1634fea155bf217d561bd4 SOURCES/opencryptoki-3.18.0.tar.gz

View File

@ -1,56 +0,0 @@
From a431e3742a1bdac515d0b491e77caeeb44720354 Mon Sep 17 00:00:00 2001
From: Ingo Franzki <ifranzki@linux.ibm.com>
Date: Tue, 1 Feb 2022 13:50:18 +0100
Subject: [PATCH 1/2] EP11: Dilithium: Specify OID of key strength at key
generation
Newer EP11 firmware versions require that the OID of the desired
Dilithium key strength is specified with attribute CKA_IBM_PQC_PARAMS
at key generation. Older firmware versions ignore this attribute.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
---
usr/lib/ep11_stdll/ep11_specific.c | 20 ++++++++++++++++++++
1 file changed, 20 insertions(+)
diff --git a/usr/lib/ep11_stdll/ep11_specific.c b/usr/lib/ep11_stdll/ep11_specific.c
index 75fd46a5..4ca9678a 100644
--- a/usr/lib/ep11_stdll/ep11_specific.c
+++ b/usr/lib/ep11_stdll/ep11_specific.c
@@ -6347,6 +6347,8 @@ static CK_RV ibm_dilithium_generate_keypair(STDLL_TokData_t * tokdata,
CK_ULONG new_publ_attrs_len = 0, new_priv_attrs_len = 0;
CK_ATTRIBUTE *new_publ_attrs2 = NULL, *new_priv_attrs2 = NULL;
CK_ULONG new_publ_attrs2_len = 0, new_priv_attrs2_len = 0;
+ const CK_BYTE dilithium_oid[] = { 0x06, 0x0b, 0x2b, 0x06, 0x01, 0x04, 0x01,
+ 0x02, 0x82, 0x0b, 0x01, 0x06, 0x05 };
UNUSED(h);
@@ -6371,6 +6373,24 @@ static CK_RV ibm_dilithium_generate_keypair(STDLL_TokData_t * tokdata,
goto error;
}
+ rc = add_to_attribute_array(&new_publ_attrs, &new_publ_attrs_len,
+ CKA_IBM_PQC_PARAMS, (CK_BYTE *)dilithium_oid,
+ sizeof(dilithium_oid));
+ if (rc != CKR_OK) {
+ TRACE_ERROR("%s add_to_attribute_array failed with rc=0x%lx\n",
+ __func__, rc);
+ goto error;
+ }
+
+ rc = add_to_attribute_array(&new_priv_attrs, &new_priv_attrs_len,
+ CKA_IBM_PQC_PARAMS,(CK_BYTE *)dilithium_oid,
+ sizeof(dilithium_oid));
+ if (rc != CKR_OK) {
+ TRACE_ERROR("%s add_to_attribute_array failed with rc=0x%lx\n",
+ __func__, rc);
+ goto error;
+ }
+
rc = check_key_attributes(tokdata, ktype, CKO_PUBLIC_KEY,
new_publ_attrs, new_publ_attrs_len,
&new_publ_attrs2, &new_publ_attrs2_len, -1);
--
2.16.2.windows.1

View File

@ -1,66 +0,0 @@
From 20f401a98d5c06648f5dd6ea62aa82f86662d90c Mon Sep 17 00:00:00 2001
From: Ingo Franzki <ifranzki@linux.ibm.com>
Date: Tue, 8 Mar 2022 15:01:24 +0100
Subject: [PATCH 2/2] EP11: Fix host library version query
Look at release and modification level, not just the modification level.
Release and modification level are encoded into the one byte minor
field of a CK_VERSION. The high order 4 bits are the release number, the
low order 4 bits the modification level.
This allows host library version checks for release and modification levels.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
---
usr/lib/ep11_stdll/ep11_specific.c | 19 ++++++++++++++++---
1 file changed, 16 insertions(+), 3 deletions(-)
diff --git a/usr/lib/ep11_stdll/ep11_specific.c b/usr/lib/ep11_stdll/ep11_specific.c
index 4ca9678a..2d7581fa 100644
--- a/usr/lib/ep11_stdll/ep11_specific.c
+++ b/usr/lib/ep11_stdll/ep11_specific.c
@@ -2588,9 +2588,10 @@ CK_RV ep11tok_init(STDLL_TokData_t * tokdata, CK_SLOT_ID SlotNumber,
goto error;
}
- TRACE_INFO("%s Host library version: %d.%d\n", __func__,
+ TRACE_INFO("%s Host library version: %d.%d.%d\n", __func__,
ep11_data->ep11_lib_version.major,
- ep11_data->ep11_lib_version.minor);
+ (ep11_data->ep11_lib_version.minor & 0xF0) >> 4,
+ (ep11_data->ep11_lib_version.minor & 0x0F));
rc = refresh_target_info(tokdata);
if (rc != CKR_OK) {
@@ -11289,8 +11290,19 @@ static CK_RV ep11tok_get_ep11_library_version(CK_VERSION *lib_version)
rc);
return rc;
}
+ TRACE_DEVEL("%s host_version=0x08%x\n", __func__, host_version);
lib_version->major = (host_version & 0x00FF0000) >> 16;
- lib_version->minor = host_version & 0x000000FF;
+ /* Minor is 4 bits release number and 4 bits modification level */
+ lib_version->minor = (host_version & 0x00000F00) >> 4 |
+ (host_version & 0x0000000F);
+ if ((host_version & 0x0000F000) != 0) {
+ lib_version->minor |= 0xF0;
+ TRACE_DEVEL("%s relelase > 15, treating as 15\n", __func__);
+ }
+ if ((host_version & 0x000000F0) != 0) {
+ lib_version->minor |= 0x0F;
+ TRACE_DEVEL("%s modification level > 15, treating as 15\n", __func__);
+ }
/*
* EP11 host library < v2.0 returns an invalid version (i.e. 0x100). This
* can safely be treated as version 1.0
@@ -11399,6 +11411,7 @@ CK_RV ep11tok_copy_firmware_info(STDLL_TokData_t *tokdata,
if (target_info->card_versions != NULL)
pInfo->hardwareVersion = target_info->card_versions->firmware_version;
pInfo->firmwareVersion = ep11_data->ep11_lib_version;
+ pInfo->firmwareVersion.minor >>= 4; /* report release, skip mod-level */
memcpy(pInfo->serialNumber, target_info->serialNumber,
sizeof(pInfo->serialNumber));
--
2.16.2.windows.1

View File

@ -1,12 +0,0 @@
diff -up opencryptoki-3.17.0/Makefile.am.me opencryptoki-3.17.0/Makefile.am
--- opencryptoki-3.17.0/Makefile.am.me 2021-11-09 09:45:49.032661898 +0100
+++ opencryptoki-3.17.0/Makefile.am 2021-11-09 09:46:41.353400986 +0100
@@ -76,7 +76,7 @@ if ENABLE_EP11TOK
endif
if ENABLE_P11SAK
test -f $(DESTDIR)$(sysconfdir)/opencryptoki || $(MKDIR_P) $(DESTDIR)$(sysconfdir)/opencryptoki || true
- test -f $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || $(INSTALL) -g pkcs11 -m 0640 $(srcdir)/usr/sbin/p11sak/p11sak_defined_attrs.conf $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || true
+ test -f $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || $(INSTALL) -m 0644 $(srcdir)/usr/sbin/p11sak/p11sak_defined_attrs.conf $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || true
endif
if ENABLE_ICATOK
cd $(DESTDIR)$(libdir)/opencryptoki/stdll && \

View File

@ -1,12 +0,0 @@
diff -up opencryptoki-3.17.0/usr/lib/api/api_interface.c.me opencryptoki-3.17.0/usr/lib/api/api_interface.c
--- opencryptoki-3.17.0/usr/lib/api/api_interface.c.me 2022-01-17 12:04:18.937010924 +0100
+++ opencryptoki-3.17.0/usr/lib/api/api_interface.c 2022-01-17 12:04:54.020182038 +0100
@@ -2869,7 +2869,7 @@ CK_RV C_Initialize(CK_VOID_PTR pVoid)
rc = check_user_and_group();
if (rc != CKR_OK)
- return rc;
+ goto done;
if (!Anchor) {
Anchor = (API_Proc_Struct_t *) malloc(sizeof(API_Proc_Struct_t));

View File

@ -0,0 +1,47 @@
commit 1600eebb422ae2a733de3a0bd47464620e39ab0d
Author: Ingo Franzki <ifranzki@linux.ibm.com>
Date: Tue Jun 7 08:58:16 2022 +0200
pkcsstats: Fix JSON output in case of errors
Produce correct JSON output, even if an error occurs during obtaining
of the statistics for a user.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
diff --git a/usr/sbin/pkcsstats/pkcsstats.c b/usr/sbin/pkcsstats/pkcsstats.c
index 8eb049dd..65d4833f 100644
--- a/usr/sbin/pkcsstats/pkcsstats.c
+++ b/usr/sbin/pkcsstats/pkcsstats.c
@@ -789,7 +789,7 @@ int main(int argc, char **argv)
bool reset = false, reset_all = false;
bool delete = false, delete_all = false;
bool slot_id_specified = false;
- bool json = false;
+ bool json = false, json_started = false;
CK_SLOT_ID slot_id = 0;
void *dll = NULL;
CK_FUNCTION_LIST *func_list = NULL;
@@ -949,8 +949,11 @@ int main(int argc, char **argv)
goto done;
}
- if (json && print_json_start() != 0)
- goto done;
+ if (json) {
+ if (print_json_start() != 0)
+ goto done;
+ json_started = true;
+ }
dd.func_list = func_list;
dd.num_slots = num_slots;
@@ -972,7 +975,7 @@ int main(int argc, char **argv)
}
done:
- if (rc == 0 && json)
+ if (json && json_started)
printf("\n\t]\n}\n");
if (slots != NULL)

View File

@ -0,0 +1,21 @@
diff -up opencryptoki-3.18.0/Makefile.am.me opencryptoki-3.18.0/Makefile.am
--- opencryptoki-3.18.0/Makefile.am.me 2022-05-09 22:25:07.980238715 +0200
+++ opencryptoki-3.18.0/Makefile.am 2022-05-09 22:25:29.292722755 +0200
@@ -78,7 +78,7 @@ if ENABLE_EP11TOK
endif
if ENABLE_P11SAK
test -f $(DESTDIR)$(sysconfdir)/opencryptoki || $(MKDIR_P) $(DESTDIR)$(sysconfdir)/opencryptoki || true
- test -f $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || $(INSTALL) -g pkcs11 -m 0640 $(srcdir)/usr/sbin/p11sak/p11sak_defined_attrs.conf $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || true
+ test -f $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || $(INSTALL) -m 0640 $(srcdir)/usr/sbin/p11sak/p11sak_defined_attrs.conf $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || true
endif
if ENABLE_ICATOK
cd $(DESTDIR)$(libdir)/opencryptoki/stdll && \
@@ -129,7 +129,7 @@ endif
if ENABLE_DAEMON
test -f $(DESTDIR)$(sysconfdir)/opencryptoki || $(MKDIR_P) $(DESTDIR)$(sysconfdir)/opencryptoki || true
test -f $(DESTDIR)$(sysconfdir)/opencryptoki/opencryptoki.conf || $(INSTALL) -m 644 $(srcdir)/usr/sbin/pkcsslotd/opencryptoki.conf $(DESTDIR)$(sysconfdir)/opencryptoki/opencryptoki.conf || true
- test -f $(DESTDIR)$(sysconfdir)/opencryptoki/strength.conf || $(INSTALL) -m 640 -o root -g pkcs11 -T $(srcdir)/doc/strength-example.conf $(DESTDIR)$(sysconfdir)/opencryptoki/strength.conf || true
+ test -f $(DESTDIR)$(sysconfdir)/opencryptoki/strength.conf || $(INSTALL) -m 640 -o root -T $(srcdir)/doc/strength-example.conf $(DESTDIR)$(sysconfdir)/opencryptoki/strength.conf || true
if ENABLE_SYSTEMD
mkdir -p $(DESTDIR)/usr/lib/tmpfiles.d
cp $(srcdir)/misc/tmpfiles.conf $(DESTDIR)/usr/lib/tmpfiles.d/opencryptoki.conf

View File

@ -1,7 +1,7 @@
Name: opencryptoki
Summary: Implementation of the PKCS#11 (Cryptoki) specification v3.0
Version: 3.17.0
Release: 5%{?dist}
Version: 3.18.0
Release: 3%{?dist}
License: CPL
Group: System Environment/Base
URL: https://github.com/opencryptoki/opencryptoki
@ -11,14 +11,12 @@ Patch0: opencryptoki-3.11.0-group.patch
# bz#1373833, change tmpfiles snippets from /var/lock/* to /run/lock/*
Patch1: opencryptoki-3.11.0-lockdir.patch
# add missing p11sak_defined_attrs.conf
Patch2: opencryptoki-1.17.0-p11sak.patch
Patch2: opencryptoki-3.18.0-p11sak.patch
# upstream patches
Patch100: opencryptoki-3.17.0-unlock-globmutex-if-user-and-group-check-fail.patch
Patch101: 0001-EP11-Dilithium-Specify-OID-of-key-strength-at-key-ge.patch
Patch102: 0002-EP11-Fix-host-library-version-query.patch
Patch103: opencryptoki-3.18.0-returning_CKR_BUFFER_TOO_SMALL.patch
Patch100: opencryptoki-3.18.0-fix-json-output.patch
Patch102: opencryptoki-3.18.0-returning_CKR_BUFFER_TOO_SMALL.patch
Requires(pre): coreutils
Requires(pre): coreutils diffutils
Requires: (selinux-policy >= 3.14.3-70 if selinux-policy-targeted)
BuildRequires: gcc
BuildRequires: gcc-c++
@ -230,11 +228,28 @@ rm -f $RPM_BUILD_ROOT/%{_libdir}/%{name}/stdll/*.la
%postun ep11tok -p /sbin/ldconfig
%endif
%pre
# don't touch opencryptoki.conf even if it is unchanged due to new tokversion
# backup config file
%global cfile /etc/opencryptoki/opencryptoki.conf
%global csuffix .rpmsave.XyoP
if test $1 -gt 1 && test -f %{cfile} ; then
cp -p %{cfile} %{cfile}%{csuffix}
fi
%pre libs
getent group pkcs11 >/dev/null || groupadd -r pkcs11
exit 0
%post
# restore the config file from %pre
if test $1 -gt 1 && test -f %{cfile} ; then
if ( ! cmp -s %{cfile} %{cfile}%{csuffix} ) ; then
cp -p %{cfile} %{cfile}.rpmnew
fi
cp -p %{cfile}%{csuffix} %{cfile} && rm -f %{cfile}%{csuffix}
fi
%systemd_post pkcsslotd.service
if test $1 -eq 1; then
%tmpfiles_create
@ -251,18 +266,24 @@ fi
%doc ChangeLog FAQ README.md
%doc doc/opencryptoki-howto.md
%doc doc/README.token_data
%doc %{_docdir}/%{name}/*.conf
%dir %{_sysconfdir}/%{name}
%config(noreplace) %{_sysconfdir}/%{name}/%{name}.conf
%attr(0640, root, pkcs11) %config(noreplace) %{_sysconfdir}/%{name}/p11sak_defined_attrs.conf
%attr(0640, root, pkcs11) %config(noreplace) %{_sysconfdir}/%{name}/strength.conf
%{_tmpfilesdir}/%{name}.conf
%{_unitdir}/pkcsslotd.service
%{_sbindir}/p11sak
%{_sbindir}/pkcstok_migrate
%{_sbindir}/pkcsconf
%{_sbindir}/pkcsslotd
%{_sbindir}/pkcsstats
%{_mandir}/man1/p11sak.1*
%{_mandir}/man1/pkcstok_migrate.1*
%{_mandir}/man1/pkcsconf.1*
%{_mandir}/man1/pkcsstats.1*
%{_mandir}/man5/policy.conf.5*
%{_mandir}/man5/strength.conf.5*
%{_mandir}/man5/%{name}.conf.5*
%{_mandir}/man5/p11sak_defined_attrs.conf.5*
%{_mandir}/man7/%{name}.7*
@ -344,11 +365,20 @@ fi
%changelog
* Wed Aug 03 2022 Than Ngo <than@redhat.com> - 3.17.0-5
- Resolves: #2114806, EP11: Fix C_GetMechanismList returning CKR_BUFFER_TOO_SMALL
* Mon Aug 01 2022 Than Ngo <than@redhat.com> - 3.18.0-3
- Related: #2043854, do not touch opencryptoki.conf if it is in place already and even if it is unchanged
- Resolves: #2112785, EP11: Fix C_GetMechanismList returning CKR_BUFFER_TOO_SMALL
* Tue Jun 07 2022 Than Ngo <than@redhat.com> - 3.18.0-2
- Related: #2043854, fix json output
* Tue May 24 2022 Than Ngo <than@redhat.com> - 3.18.0-1
- Resolves: #2043845, rebase to 3.18.0
- Resolves: #2043854, add crypto counters
- Resolves: #2043855, support crypto profiles
* Fri Apr 15 2022 Than Ngo <than@redhat.com> - 3.17.0-4
- Resolves: #2069592, Dilithium support not available
- Resolves: #2066762, Dilithium support not available
* Mon Jan 17 2022 Than Ngo <than@redhat.com> - 3.17.0-3
- Resolves: #2040677, API: Unlock GlobMutex if user and group check fails