diff --git a/.gitignore b/.gitignore index 088a728..e06708c 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1 @@ -SOURCES/opencryptoki-3.17.0.tar.gz +SOURCES/opencryptoki-3.18.0.tar.gz diff --git a/.opencryptoki.metadata b/.opencryptoki.metadata index 1ece19c..7ff8bfe 100644 --- a/.opencryptoki.metadata +++ b/.opencryptoki.metadata @@ -1 +1 @@ -598f43d2a04a878a4577f143251f4631625ac49b SOURCES/opencryptoki-3.17.0.tar.gz +257eb4d5458c52bf7c1634fea155bf217d561bd4 SOURCES/opencryptoki-3.18.0.tar.gz diff --git a/SOURCES/0001-EP11-Dilithium-Specify-OID-of-key-strength-at-key-ge.patch b/SOURCES/0001-EP11-Dilithium-Specify-OID-of-key-strength-at-key-ge.patch deleted file mode 100644 index c335d06..0000000 --- a/SOURCES/0001-EP11-Dilithium-Specify-OID-of-key-strength-at-key-ge.patch +++ /dev/null @@ -1,56 +0,0 @@ -From a431e3742a1bdac515d0b491e77caeeb44720354 Mon Sep 17 00:00:00 2001 -From: Ingo Franzki -Date: Tue, 1 Feb 2022 13:50:18 +0100 -Subject: [PATCH 1/2] EP11: Dilithium: Specify OID of key strength at key - generation - -Newer EP11 firmware versions require that the OID of the desired -Dilithium key strength is specified with attribute CKA_IBM_PQC_PARAMS -at key generation. Older firmware versions ignore this attribute. - -Signed-off-by: Ingo Franzki ---- - usr/lib/ep11_stdll/ep11_specific.c | 20 ++++++++++++++++++++ - 1 file changed, 20 insertions(+) - -diff --git a/usr/lib/ep11_stdll/ep11_specific.c b/usr/lib/ep11_stdll/ep11_specific.c -index 75fd46a5..4ca9678a 100644 ---- a/usr/lib/ep11_stdll/ep11_specific.c -+++ b/usr/lib/ep11_stdll/ep11_specific.c -@@ -6347,6 +6347,8 @@ static CK_RV ibm_dilithium_generate_keypair(STDLL_TokData_t * tokdata, - CK_ULONG new_publ_attrs_len = 0, new_priv_attrs_len = 0; - CK_ATTRIBUTE *new_publ_attrs2 = NULL, *new_priv_attrs2 = NULL; - CK_ULONG new_publ_attrs2_len = 0, new_priv_attrs2_len = 0; -+ const CK_BYTE dilithium_oid[] = { 0x06, 0x0b, 0x2b, 0x06, 0x01, 0x04, 0x01, -+ 0x02, 0x82, 0x0b, 0x01, 0x06, 0x05 }; - - UNUSED(h); - -@@ -6371,6 +6373,24 @@ static CK_RV ibm_dilithium_generate_keypair(STDLL_TokData_t * tokdata, - goto error; - } - -+ rc = add_to_attribute_array(&new_publ_attrs, &new_publ_attrs_len, -+ CKA_IBM_PQC_PARAMS, (CK_BYTE *)dilithium_oid, -+ sizeof(dilithium_oid)); -+ if (rc != CKR_OK) { -+ TRACE_ERROR("%s add_to_attribute_array failed with rc=0x%lx\n", -+ __func__, rc); -+ goto error; -+ } -+ -+ rc = add_to_attribute_array(&new_priv_attrs, &new_priv_attrs_len, -+ CKA_IBM_PQC_PARAMS,(CK_BYTE *)dilithium_oid, -+ sizeof(dilithium_oid)); -+ if (rc != CKR_OK) { -+ TRACE_ERROR("%s add_to_attribute_array failed with rc=0x%lx\n", -+ __func__, rc); -+ goto error; -+ } -+ - rc = check_key_attributes(tokdata, ktype, CKO_PUBLIC_KEY, - new_publ_attrs, new_publ_attrs_len, - &new_publ_attrs2, &new_publ_attrs2_len, -1); --- -2.16.2.windows.1 - diff --git a/SOURCES/0002-EP11-Fix-host-library-version-query.patch b/SOURCES/0002-EP11-Fix-host-library-version-query.patch deleted file mode 100644 index 519f499..0000000 --- a/SOURCES/0002-EP11-Fix-host-library-version-query.patch +++ /dev/null @@ -1,66 +0,0 @@ -From 20f401a98d5c06648f5dd6ea62aa82f86662d90c Mon Sep 17 00:00:00 2001 -From: Ingo Franzki -Date: Tue, 8 Mar 2022 15:01:24 +0100 -Subject: [PATCH 2/2] EP11: Fix host library version query - -Look at release and modification level, not just the modification level. -Release and modification level are encoded into the one byte minor -field of a CK_VERSION. The high order 4 bits are the release number, the -low order 4 bits the modification level. - -This allows host library version checks for release and modification levels. - -Signed-off-by: Ingo Franzki ---- - usr/lib/ep11_stdll/ep11_specific.c | 19 ++++++++++++++++--- - 1 file changed, 16 insertions(+), 3 deletions(-) - -diff --git a/usr/lib/ep11_stdll/ep11_specific.c b/usr/lib/ep11_stdll/ep11_specific.c -index 4ca9678a..2d7581fa 100644 ---- a/usr/lib/ep11_stdll/ep11_specific.c -+++ b/usr/lib/ep11_stdll/ep11_specific.c -@@ -2588,9 +2588,10 @@ CK_RV ep11tok_init(STDLL_TokData_t * tokdata, CK_SLOT_ID SlotNumber, - goto error; - } - -- TRACE_INFO("%s Host library version: %d.%d\n", __func__, -+ TRACE_INFO("%s Host library version: %d.%d.%d\n", __func__, - ep11_data->ep11_lib_version.major, -- ep11_data->ep11_lib_version.minor); -+ (ep11_data->ep11_lib_version.minor & 0xF0) >> 4, -+ (ep11_data->ep11_lib_version.minor & 0x0F)); - - rc = refresh_target_info(tokdata); - if (rc != CKR_OK) { -@@ -11289,8 +11290,19 @@ static CK_RV ep11tok_get_ep11_library_version(CK_VERSION *lib_version) - rc); - return rc; - } -+ TRACE_DEVEL("%s host_version=0x08%x\n", __func__, host_version); - lib_version->major = (host_version & 0x00FF0000) >> 16; -- lib_version->minor = host_version & 0x000000FF; -+ /* Minor is 4 bits release number and 4 bits modification level */ -+ lib_version->minor = (host_version & 0x00000F00) >> 4 | -+ (host_version & 0x0000000F); -+ if ((host_version & 0x0000F000) != 0) { -+ lib_version->minor |= 0xF0; -+ TRACE_DEVEL("%s relelase > 15, treating as 15\n", __func__); -+ } -+ if ((host_version & 0x000000F0) != 0) { -+ lib_version->minor |= 0x0F; -+ TRACE_DEVEL("%s modification level > 15, treating as 15\n", __func__); -+ } - /* - * EP11 host library < v2.0 returns an invalid version (i.e. 0x100). This - * can safely be treated as version 1.0 -@@ -11399,6 +11411,7 @@ CK_RV ep11tok_copy_firmware_info(STDLL_TokData_t *tokdata, - if (target_info->card_versions != NULL) - pInfo->hardwareVersion = target_info->card_versions->firmware_version; - pInfo->firmwareVersion = ep11_data->ep11_lib_version; -+ pInfo->firmwareVersion.minor >>= 4; /* report release, skip mod-level */ - memcpy(pInfo->serialNumber, target_info->serialNumber, - sizeof(pInfo->serialNumber)); - --- -2.16.2.windows.1 - diff --git a/SOURCES/opencryptoki-1.17.0-p11sak.patch b/SOURCES/opencryptoki-1.17.0-p11sak.patch deleted file mode 100644 index 62ccf2a..0000000 --- a/SOURCES/opencryptoki-1.17.0-p11sak.patch +++ /dev/null @@ -1,12 +0,0 @@ -diff -up opencryptoki-3.17.0/Makefile.am.me opencryptoki-3.17.0/Makefile.am ---- opencryptoki-3.17.0/Makefile.am.me 2021-11-09 09:45:49.032661898 +0100 -+++ opencryptoki-3.17.0/Makefile.am 2021-11-09 09:46:41.353400986 +0100 -@@ -76,7 +76,7 @@ if ENABLE_EP11TOK - endif - if ENABLE_P11SAK - test -f $(DESTDIR)$(sysconfdir)/opencryptoki || $(MKDIR_P) $(DESTDIR)$(sysconfdir)/opencryptoki || true -- test -f $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || $(INSTALL) -g pkcs11 -m 0640 $(srcdir)/usr/sbin/p11sak/p11sak_defined_attrs.conf $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || true -+ test -f $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || $(INSTALL) -m 0644 $(srcdir)/usr/sbin/p11sak/p11sak_defined_attrs.conf $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || true - endif - if ENABLE_ICATOK - cd $(DESTDIR)$(libdir)/opencryptoki/stdll && \ diff --git a/SOURCES/opencryptoki-3.17.0-unlock-globmutex-if-user-and-group-check-fail.patch b/SOURCES/opencryptoki-3.17.0-unlock-globmutex-if-user-and-group-check-fail.patch deleted file mode 100644 index dc8c70c..0000000 --- a/SOURCES/opencryptoki-3.17.0-unlock-globmutex-if-user-and-group-check-fail.patch +++ /dev/null @@ -1,12 +0,0 @@ -diff -up opencryptoki-3.17.0/usr/lib/api/api_interface.c.me opencryptoki-3.17.0/usr/lib/api/api_interface.c ---- opencryptoki-3.17.0/usr/lib/api/api_interface.c.me 2022-01-17 12:04:18.937010924 +0100 -+++ opencryptoki-3.17.0/usr/lib/api/api_interface.c 2022-01-17 12:04:54.020182038 +0100 -@@ -2869,7 +2869,7 @@ CK_RV C_Initialize(CK_VOID_PTR pVoid) - - rc = check_user_and_group(); - if (rc != CKR_OK) -- return rc; -+ goto done; - - if (!Anchor) { - Anchor = (API_Proc_Struct_t *) malloc(sizeof(API_Proc_Struct_t)); diff --git a/SOURCES/opencryptoki-3.18.0-fix-json-output.patch b/SOURCES/opencryptoki-3.18.0-fix-json-output.patch new file mode 100644 index 0000000..baa6ff7 --- /dev/null +++ b/SOURCES/opencryptoki-3.18.0-fix-json-output.patch @@ -0,0 +1,47 @@ +commit 1600eebb422ae2a733de3a0bd47464620e39ab0d +Author: Ingo Franzki +Date: Tue Jun 7 08:58:16 2022 +0200 + + pkcsstats: Fix JSON output in case of errors + + Produce correct JSON output, even if an error occurs during obtaining + of the statistics for a user. + + Signed-off-by: Ingo Franzki + +diff --git a/usr/sbin/pkcsstats/pkcsstats.c b/usr/sbin/pkcsstats/pkcsstats.c +index 8eb049dd..65d4833f 100644 +--- a/usr/sbin/pkcsstats/pkcsstats.c ++++ b/usr/sbin/pkcsstats/pkcsstats.c +@@ -789,7 +789,7 @@ int main(int argc, char **argv) + bool reset = false, reset_all = false; + bool delete = false, delete_all = false; + bool slot_id_specified = false; +- bool json = false; ++ bool json = false, json_started = false; + CK_SLOT_ID slot_id = 0; + void *dll = NULL; + CK_FUNCTION_LIST *func_list = NULL; +@@ -949,8 +949,11 @@ int main(int argc, char **argv) + goto done; + } + +- if (json && print_json_start() != 0) +- goto done; ++ if (json) { ++ if (print_json_start() != 0) ++ goto done; ++ json_started = true; ++ } + + dd.func_list = func_list; + dd.num_slots = num_slots; +@@ -972,7 +975,7 @@ int main(int argc, char **argv) + } + + done: +- if (rc == 0 && json) ++ if (json && json_started) + printf("\n\t]\n}\n"); + + if (slots != NULL) diff --git a/SOURCES/opencryptoki-3.18.0-p11sak.patch b/SOURCES/opencryptoki-3.18.0-p11sak.patch new file mode 100644 index 0000000..f8f9f1c --- /dev/null +++ b/SOURCES/opencryptoki-3.18.0-p11sak.patch @@ -0,0 +1,21 @@ +diff -up opencryptoki-3.18.0/Makefile.am.me opencryptoki-3.18.0/Makefile.am +--- opencryptoki-3.18.0/Makefile.am.me 2022-05-09 22:25:07.980238715 +0200 ++++ opencryptoki-3.18.0/Makefile.am 2022-05-09 22:25:29.292722755 +0200 +@@ -78,7 +78,7 @@ if ENABLE_EP11TOK + endif + if ENABLE_P11SAK + test -f $(DESTDIR)$(sysconfdir)/opencryptoki || $(MKDIR_P) $(DESTDIR)$(sysconfdir)/opencryptoki || true +- test -f $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || $(INSTALL) -g pkcs11 -m 0640 $(srcdir)/usr/sbin/p11sak/p11sak_defined_attrs.conf $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || true ++ test -f $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || $(INSTALL) -m 0640 $(srcdir)/usr/sbin/p11sak/p11sak_defined_attrs.conf $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || true + endif + if ENABLE_ICATOK + cd $(DESTDIR)$(libdir)/opencryptoki/stdll && \ +@@ -129,7 +129,7 @@ endif + if ENABLE_DAEMON + test -f $(DESTDIR)$(sysconfdir)/opencryptoki || $(MKDIR_P) $(DESTDIR)$(sysconfdir)/opencryptoki || true + test -f $(DESTDIR)$(sysconfdir)/opencryptoki/opencryptoki.conf || $(INSTALL) -m 644 $(srcdir)/usr/sbin/pkcsslotd/opencryptoki.conf $(DESTDIR)$(sysconfdir)/opencryptoki/opencryptoki.conf || true +- test -f $(DESTDIR)$(sysconfdir)/opencryptoki/strength.conf || $(INSTALL) -m 640 -o root -g pkcs11 -T $(srcdir)/doc/strength-example.conf $(DESTDIR)$(sysconfdir)/opencryptoki/strength.conf || true ++ test -f $(DESTDIR)$(sysconfdir)/opencryptoki/strength.conf || $(INSTALL) -m 640 -o root -T $(srcdir)/doc/strength-example.conf $(DESTDIR)$(sysconfdir)/opencryptoki/strength.conf || true + if ENABLE_SYSTEMD + mkdir -p $(DESTDIR)/usr/lib/tmpfiles.d + cp $(srcdir)/misc/tmpfiles.conf $(DESTDIR)/usr/lib/tmpfiles.d/opencryptoki.conf diff --git a/SPECS/opencryptoki.spec b/SPECS/opencryptoki.spec index 9fee399..42d72c7 100644 --- a/SPECS/opencryptoki.spec +++ b/SPECS/opencryptoki.spec @@ -1,7 +1,7 @@ Name: opencryptoki Summary: Implementation of the PKCS#11 (Cryptoki) specification v3.0 -Version: 3.17.0 -Release: 5%{?dist} +Version: 3.18.0 +Release: 3%{?dist} License: CPL Group: System Environment/Base URL: https://github.com/opencryptoki/opencryptoki @@ -11,14 +11,12 @@ Patch0: opencryptoki-3.11.0-group.patch # bz#1373833, change tmpfiles snippets from /var/lock/* to /run/lock/* Patch1: opencryptoki-3.11.0-lockdir.patch # add missing p11sak_defined_attrs.conf -Patch2: opencryptoki-1.17.0-p11sak.patch +Patch2: opencryptoki-3.18.0-p11sak.patch # upstream patches -Patch100: opencryptoki-3.17.0-unlock-globmutex-if-user-and-group-check-fail.patch -Patch101: 0001-EP11-Dilithium-Specify-OID-of-key-strength-at-key-ge.patch -Patch102: 0002-EP11-Fix-host-library-version-query.patch -Patch103: opencryptoki-3.18.0-returning_CKR_BUFFER_TOO_SMALL.patch +Patch100: opencryptoki-3.18.0-fix-json-output.patch +Patch102: opencryptoki-3.18.0-returning_CKR_BUFFER_TOO_SMALL.patch -Requires(pre): coreutils +Requires(pre): coreutils diffutils Requires: (selinux-policy >= 3.14.3-70 if selinux-policy-targeted) BuildRequires: gcc BuildRequires: gcc-c++ @@ -230,11 +228,28 @@ rm -f $RPM_BUILD_ROOT/%{_libdir}/%{name}/stdll/*.la %postun ep11tok -p /sbin/ldconfig %endif +%pre +# don't touch opencryptoki.conf even if it is unchanged due to new tokversion +# backup config file +%global cfile /etc/opencryptoki/opencryptoki.conf +%global csuffix .rpmsave.XyoP +if test $1 -gt 1 && test -f %{cfile} ; then + cp -p %{cfile} %{cfile}%{csuffix} +fi + %pre libs getent group pkcs11 >/dev/null || groupadd -r pkcs11 exit 0 %post +# restore the config file from %pre +if test $1 -gt 1 && test -f %{cfile} ; then + if ( ! cmp -s %{cfile} %{cfile}%{csuffix} ) ; then + cp -p %{cfile} %{cfile}.rpmnew + fi + cp -p %{cfile}%{csuffix} %{cfile} && rm -f %{cfile}%{csuffix} +fi + %systemd_post pkcsslotd.service if test $1 -eq 1; then %tmpfiles_create @@ -251,18 +266,24 @@ fi %doc ChangeLog FAQ README.md %doc doc/opencryptoki-howto.md %doc doc/README.token_data +%doc %{_docdir}/%{name}/*.conf %dir %{_sysconfdir}/%{name} %config(noreplace) %{_sysconfdir}/%{name}/%{name}.conf %attr(0640, root, pkcs11) %config(noreplace) %{_sysconfdir}/%{name}/p11sak_defined_attrs.conf +%attr(0640, root, pkcs11) %config(noreplace) %{_sysconfdir}/%{name}/strength.conf %{_tmpfilesdir}/%{name}.conf %{_unitdir}/pkcsslotd.service %{_sbindir}/p11sak %{_sbindir}/pkcstok_migrate %{_sbindir}/pkcsconf %{_sbindir}/pkcsslotd +%{_sbindir}/pkcsstats %{_mandir}/man1/p11sak.1* %{_mandir}/man1/pkcstok_migrate.1* %{_mandir}/man1/pkcsconf.1* +%{_mandir}/man1/pkcsstats.1* +%{_mandir}/man5/policy.conf.5* +%{_mandir}/man5/strength.conf.5* %{_mandir}/man5/%{name}.conf.5* %{_mandir}/man5/p11sak_defined_attrs.conf.5* %{_mandir}/man7/%{name}.7* @@ -344,11 +365,20 @@ fi %changelog -* Wed Aug 03 2022 Than Ngo - 3.17.0-5 -- Resolves: #2114806, EP11: Fix C_GetMechanismList returning CKR_BUFFER_TOO_SMALL +* Mon Aug 01 2022 Than Ngo - 3.18.0-3 +- Related: #2043854, do not touch opencryptoki.conf if it is in place already and even if it is unchanged +- Resolves: #2112785, EP11: Fix C_GetMechanismList returning CKR_BUFFER_TOO_SMALL + +* Tue Jun 07 2022 Than Ngo - 3.18.0-2 +- Related: #2043854, fix json output + +* Tue May 24 2022 Than Ngo - 3.18.0-1 +- Resolves: #2043845, rebase to 3.18.0 +- Resolves: #2043854, add crypto counters +- Resolves: #2043855, support crypto profiles * Fri Apr 15 2022 Than Ngo - 3.17.0-4 -- Resolves: #2069592, Dilithium support not available +- Resolves: #2066762, Dilithium support not available * Mon Jan 17 2022 Than Ngo - 3.17.0-3 - Resolves: #2040677, API: Unlock GlobMutex if user and group check fails