diff --git a/.gitignore b/.gitignore index 3ce6307..0ecc220 100644 --- a/.gitignore +++ b/.gitignore @@ -29,3 +29,4 @@ opencryptoki-2.3.1.tar.gz /opencryptoki-3.15.1.tar.gz /opencryptoki-3.16.0.tar.gz /opencryptoki-3.17.0.tar.gz +/opencryptoki-3.18.0.tar.gz diff --git a/0001-EP11-Dilithium-Specify-OID-of-key-strength-at-key-ge.patch b/0001-EP11-Dilithium-Specify-OID-of-key-strength-at-key-ge.patch deleted file mode 100644 index c335d06..0000000 --- a/0001-EP11-Dilithium-Specify-OID-of-key-strength-at-key-ge.patch +++ /dev/null @@ -1,56 +0,0 @@ -From a431e3742a1bdac515d0b491e77caeeb44720354 Mon Sep 17 00:00:00 2001 -From: Ingo Franzki -Date: Tue, 1 Feb 2022 13:50:18 +0100 -Subject: [PATCH 1/2] EP11: Dilithium: Specify OID of key strength at key - generation - -Newer EP11 firmware versions require that the OID of the desired -Dilithium key strength is specified with attribute CKA_IBM_PQC_PARAMS -at key generation. Older firmware versions ignore this attribute. - -Signed-off-by: Ingo Franzki ---- - usr/lib/ep11_stdll/ep11_specific.c | 20 ++++++++++++++++++++ - 1 file changed, 20 insertions(+) - -diff --git a/usr/lib/ep11_stdll/ep11_specific.c b/usr/lib/ep11_stdll/ep11_specific.c -index 75fd46a5..4ca9678a 100644 ---- a/usr/lib/ep11_stdll/ep11_specific.c -+++ b/usr/lib/ep11_stdll/ep11_specific.c -@@ -6347,6 +6347,8 @@ static CK_RV ibm_dilithium_generate_keypair(STDLL_TokData_t * tokdata, - CK_ULONG new_publ_attrs_len = 0, new_priv_attrs_len = 0; - CK_ATTRIBUTE *new_publ_attrs2 = NULL, *new_priv_attrs2 = NULL; - CK_ULONG new_publ_attrs2_len = 0, new_priv_attrs2_len = 0; -+ const CK_BYTE dilithium_oid[] = { 0x06, 0x0b, 0x2b, 0x06, 0x01, 0x04, 0x01, -+ 0x02, 0x82, 0x0b, 0x01, 0x06, 0x05 }; - - UNUSED(h); - -@@ -6371,6 +6373,24 @@ static CK_RV ibm_dilithium_generate_keypair(STDLL_TokData_t * tokdata, - goto error; - } - -+ rc = add_to_attribute_array(&new_publ_attrs, &new_publ_attrs_len, -+ CKA_IBM_PQC_PARAMS, (CK_BYTE *)dilithium_oid, -+ sizeof(dilithium_oid)); -+ if (rc != CKR_OK) { -+ TRACE_ERROR("%s add_to_attribute_array failed with rc=0x%lx\n", -+ __func__, rc); -+ goto error; -+ } -+ -+ rc = add_to_attribute_array(&new_priv_attrs, &new_priv_attrs_len, -+ CKA_IBM_PQC_PARAMS,(CK_BYTE *)dilithium_oid, -+ sizeof(dilithium_oid)); -+ if (rc != CKR_OK) { -+ TRACE_ERROR("%s add_to_attribute_array failed with rc=0x%lx\n", -+ __func__, rc); -+ goto error; -+ } -+ - rc = check_key_attributes(tokdata, ktype, CKO_PUBLIC_KEY, - new_publ_attrs, new_publ_attrs_len, - &new_publ_attrs2, &new_publ_attrs2_len, -1); --- -2.16.2.windows.1 - diff --git a/0002-EP11-Fix-host-library-version-query.patch b/0002-EP11-Fix-host-library-version-query.patch deleted file mode 100644 index 519f499..0000000 --- a/0002-EP11-Fix-host-library-version-query.patch +++ /dev/null @@ -1,66 +0,0 @@ -From 20f401a98d5c06648f5dd6ea62aa82f86662d90c Mon Sep 17 00:00:00 2001 -From: Ingo Franzki -Date: Tue, 8 Mar 2022 15:01:24 +0100 -Subject: [PATCH 2/2] EP11: Fix host library version query - -Look at release and modification level, not just the modification level. -Release and modification level are encoded into the one byte minor -field of a CK_VERSION. The high order 4 bits are the release number, the -low order 4 bits the modification level. - -This allows host library version checks for release and modification levels. - -Signed-off-by: Ingo Franzki ---- - usr/lib/ep11_stdll/ep11_specific.c | 19 ++++++++++++++++--- - 1 file changed, 16 insertions(+), 3 deletions(-) - -diff --git a/usr/lib/ep11_stdll/ep11_specific.c b/usr/lib/ep11_stdll/ep11_specific.c -index 4ca9678a..2d7581fa 100644 ---- a/usr/lib/ep11_stdll/ep11_specific.c -+++ b/usr/lib/ep11_stdll/ep11_specific.c -@@ -2588,9 +2588,10 @@ CK_RV ep11tok_init(STDLL_TokData_t * tokdata, CK_SLOT_ID SlotNumber, - goto error; - } - -- TRACE_INFO("%s Host library version: %d.%d\n", __func__, -+ TRACE_INFO("%s Host library version: %d.%d.%d\n", __func__, - ep11_data->ep11_lib_version.major, -- ep11_data->ep11_lib_version.minor); -+ (ep11_data->ep11_lib_version.minor & 0xF0) >> 4, -+ (ep11_data->ep11_lib_version.minor & 0x0F)); - - rc = refresh_target_info(tokdata); - if (rc != CKR_OK) { -@@ -11289,8 +11290,19 @@ static CK_RV ep11tok_get_ep11_library_version(CK_VERSION *lib_version) - rc); - return rc; - } -+ TRACE_DEVEL("%s host_version=0x08%x\n", __func__, host_version); - lib_version->major = (host_version & 0x00FF0000) >> 16; -- lib_version->minor = host_version & 0x000000FF; -+ /* Minor is 4 bits release number and 4 bits modification level */ -+ lib_version->minor = (host_version & 0x00000F00) >> 4 | -+ (host_version & 0x0000000F); -+ if ((host_version & 0x0000F000) != 0) { -+ lib_version->minor |= 0xF0; -+ TRACE_DEVEL("%s relelase > 15, treating as 15\n", __func__); -+ } -+ if ((host_version & 0x000000F0) != 0) { -+ lib_version->minor |= 0x0F; -+ TRACE_DEVEL("%s modification level > 15, treating as 15\n", __func__); -+ } - /* - * EP11 host library < v2.0 returns an invalid version (i.e. 0x100). This - * can safely be treated as version 1.0 -@@ -11399,6 +11411,7 @@ CK_RV ep11tok_copy_firmware_info(STDLL_TokData_t *tokdata, - if (target_info->card_versions != NULL) - pInfo->hardwareVersion = target_info->card_versions->firmware_version; - pInfo->firmwareVersion = ep11_data->ep11_lib_version; -+ pInfo->firmwareVersion.minor >>= 4; /* report release, skip mod-level */ - memcpy(pInfo->serialNumber, target_info->serialNumber, - sizeof(pInfo->serialNumber)); - --- -2.16.2.windows.1 - diff --git a/opencryptoki-3.17-libica4-8e9800b492f7a40ed5dfcd85e042701b6a5c5a26.patch b/opencryptoki-3.17-libica4-8e9800b492f7a40ed5dfcd85e042701b6a5c5a26.patch deleted file mode 100644 index 540ac76..0000000 --- a/opencryptoki-3.17-libica4-8e9800b492f7a40ed5dfcd85e042701b6a5c5a26.patch +++ /dev/null @@ -1,88 +0,0 @@ -commit 8e9800b492f7a40ed5dfcd85e042701b6a5c5a26 -Author: Ingo Franzki -Date: Tue Dec 7 16:39:28 2021 +0100 - - ICA/EP11: Support libica version 4 - - Try to load libica version 4 (libica.so.4), but fall back to version 3 - (libica.so.3) if version 4 is not available. - - Signed-off-by: Ingo Franzki - -diff --git a/usr/lib/ep11_stdll/ep11_specific.c b/usr/lib/ep11_stdll/ep11_specific.c -index 4029e5a5..f223017d 100644 ---- a/usr/lib/ep11_stdll/ep11_specific.c -+++ b/usr/lib/ep11_stdll/ep11_specific.c -@@ -68,7 +68,8 @@ - #define EP11SHAREDLIB_V2 "libep11.so.2" - #define EP11SHAREDLIB_V1 "libep11.so.1" - #define EP11SHAREDLIB "libep11.so" --#define ICASHAREDLIB "libica.so.3" -+#define ICASHAREDLIB_V4 "libica.so.4" -+#define ICASHAREDLIB_V3 "libica.so.3" - - CK_RV ep11tok_get_mechanism_list(STDLL_TokData_t * tokdata, - CK_MECHANISM_TYPE_PTR mlist, -@@ -2044,9 +2045,9 @@ static CK_RV make_wrapblob(STDLL_TokData_t * tokdata, CK_ATTRIBUTE * tmpl_in, - } - - #ifdef EP11_HSMSIM --#define DLOPEN_FLAGS RTLD_GLOBAL | RTLD_NOW | RTLD_DEEPBIND -+#define DLOPEN_FLAGS RTLD_NOW | RTLD_DEEPBIND - #else --#define DLOPEN_FLAGS RTLD_GLOBAL | RTLD_NOW -+#define DLOPEN_FLAGS RTLD_NOW - #endif - - static void *ep11_load_host_lib() -@@ -2209,12 +2210,16 @@ static CK_RV ep11tok_load_libica(STDLL_TokData_t *tokdata) - return CKR_OK; - - if (strcmp(ep11_data->digest_libica_path, "") == 0) { -- strcpy(ep11_data->digest_libica_path, ICASHAREDLIB); -+ strcpy(ep11_data->digest_libica_path, ICASHAREDLIB_V4); - default_libica = 1; -+ libica->library = dlopen(ep11_data->digest_libica_path, RTLD_NOW); -+ if (libica->library == NULL) { -+ strcpy(ep11_data->digest_libica_path, ICASHAREDLIB_V3); -+ libica->library = dlopen(ep11_data->digest_libica_path, RTLD_NOW); -+ } -+ } else { -+ libica->library = dlopen(ep11_data->digest_libica_path, RTLD_NOW); - } -- -- libica->library = dlopen(ep11_data->digest_libica_path, -- RTLD_GLOBAL | RTLD_NOW); - if (libica->library == NULL) { - errstr = dlerror(); - OCK_SYSLOG(default_libica ? LOG_WARNING : LOG_ERR, -diff --git a/usr/lib/ica_s390_stdll/ica_specific.c b/usr/lib/ica_s390_stdll/ica_specific.c -index fd18de42..c4fa9654 100644 ---- a/usr/lib/ica_s390_stdll/ica_specific.c -+++ b/usr/lib/ica_s390_stdll/ica_specific.c -@@ -83,7 +83,8 @@ const char label[] = "icatok"; - - static pthread_mutex_t rngmtx = PTHREAD_MUTEX_INITIALIZER; - --#define LIBICA_SHARED_LIB "libica.so.3" -+#define LIBICA_SHARED_LIB_V3 "libica.so.3" -+#define LIBICA_SHARED_LIB_V4 "libica.so.4" - #define BIND(dso, sym) do { \ - if (p_##sym == NULL) \ - *(void **)(&p_##sym) = dlsym(dso, #sym); \ -@@ -221,9 +222,13 @@ static CK_RV load_libica(void) - void *ibmca_dso = NULL; - - /* Load libica */ -- ibmca_dso = dlopen(LIBICA_SHARED_LIB, RTLD_NOW); -+ ibmca_dso = dlopen(LIBICA_SHARED_LIB_V4, RTLD_NOW); -+ if (ibmca_dso == NULL) -+ ibmca_dso = dlopen(LIBICA_SHARED_LIB_V3, RTLD_NOW); -+ - if (ibmca_dso == NULL) { -- TRACE_ERROR("%s: dlopen(%s) failed\n", __func__, LIBICA_SHARED_LIB); -+ TRACE_ERROR("%s: dlopen(%s or %s) failed: %s\n", __func__, -+ LIBICA_SHARED_LIB_V4, LIBICA_SHARED_LIB_V3, dlerror()); - return CKR_FUNCTION_FAILED; - } - diff --git a/opencryptoki-3.17.0-unlock-globmutex-if-user-and-group-check-fail.patch b/opencryptoki-3.17.0-unlock-globmutex-if-user-and-group-check-fail.patch deleted file mode 100644 index dc8c70c..0000000 --- a/opencryptoki-3.17.0-unlock-globmutex-if-user-and-group-check-fail.patch +++ /dev/null @@ -1,12 +0,0 @@ -diff -up opencryptoki-3.17.0/usr/lib/api/api_interface.c.me opencryptoki-3.17.0/usr/lib/api/api_interface.c ---- opencryptoki-3.17.0/usr/lib/api/api_interface.c.me 2022-01-17 12:04:18.937010924 +0100 -+++ opencryptoki-3.17.0/usr/lib/api/api_interface.c 2022-01-17 12:04:54.020182038 +0100 -@@ -2869,7 +2869,7 @@ CK_RV C_Initialize(CK_VOID_PTR pVoid) - - rc = check_user_and_group(); - if (rc != CKR_OK) -- return rc; -+ goto done; - - if (!Anchor) { - Anchor = (API_Proc_Struct_t *) malloc(sizeof(API_Proc_Struct_t)); diff --git a/opencryptoki-pkcsslotd-pidfile.patch b/opencryptoki-pkcsslotd-pidfile.patch deleted file mode 100644 index 92f7e3c..0000000 --- a/opencryptoki-pkcsslotd-pidfile.patch +++ /dev/null @@ -1,29 +0,0 @@ -diff -up opencryptoki-3.16.0/misc/pkcsslotd.service.in.me opencryptoki-3.16.0/misc/pkcsslotd.service.in ---- opencryptoki-3.16.0/misc/pkcsslotd.service.in.me 2021-06-25 09:25:11.464487847 +0200 -+++ opencryptoki-3.16.0/misc/pkcsslotd.service.in 2021-06-25 09:25:38.701225760 +0200 -@@ -4,7 +4,7 @@ After=local-fs.target - - [Service] - Type=forking --PIDFile=/var/run/pkcsslotd.pid -+PIDFile=/run/pkcsslotd.pid - ExecStart=@sbindir@/pkcsslotd - - [Install] -diff -up opencryptoki-3.16.0/usr/include/slotmgr.h.me opencryptoki-3.16.0/usr/include/slotmgr.h ---- opencryptoki-3.16.0/usr/include/slotmgr.h.me 2021-06-30 17:28:18.000594834 +0200 -+++ opencryptoki-3.16.0/usr/include/slotmgr.h 2021-06-30 17:28:38.920890278 +0200 -@@ -30,10 +30,10 @@ - #define TOK_PATH SBIN_PATH "/pkcsslotd" - #define OCK_API_LOCK_FILE LOCKDIR_PATH "/LCK..APIlock" - --#define PROC_SOCKET_FILE_PATH "/var/run/pkcsslotd.socket" --#define ADMIN_SOCKET_FILE_PATH "/var/run/pkcsslotd.admin.socket" -+#define PROC_SOCKET_FILE_PATH "/run/pkcsslotd.socket" -+#define ADMIN_SOCKET_FILE_PATH "/run/pkcsslotd.admin.socket" - --#define PID_FILE_PATH "/var/run/pkcsslotd.pid" -+#define PID_FILE_PATH "/run/pkcsslotd.pid" - #define OCK_CONFIG OCK_CONFDIR "/opencryptoki.conf" - - #ifndef CK_BOOL diff --git a/opencryptoki.spec b/opencryptoki.spec index d0fbb4e..541d71e 100644 --- a/opencryptoki.spec +++ b/opencryptoki.spec @@ -1,7 +1,7 @@ Name: opencryptoki Summary: Implementation of the PKCS#11 (Cryptoki) specification v3.0 -Version: 3.17.0 -Release: 6%{?dist} +Version: 3.18.0 +Release: 1%{?dist} License: CPL URL: https://github.com/opencryptoki/opencryptoki Source0: https://github.com/opencryptoki/%{name}/archive/v%{version}/%{name}-%{version}.tar.gz @@ -12,10 +12,6 @@ Patch1: opencryptoki-3.11.0-lockdir.patch # add missing p11sak_defined_attrs.conf Patch2: opencryptoki-3.17.0-p11sak.patch # upstream patches -# PIDfile below legacy directory /var/run/ -Patch300: opencryptoki-pkcsslotd-pidfile.patch -Patch301: opencryptoki-3.17.0-unlock-globmutex-if-user-and-group-check-fail.patch -Patch302: opencryptoki-3.17-libica4-8e9800b492f7a40ed5dfcd85e042701b6a5c5a26.patch Requires(pre): coreutils Requires: (selinux-policy >= 34.1.8-1 if selinux-policy-targeted) @@ -225,6 +221,7 @@ fi %doc ChangeLog FAQ README.md %doc doc/opencryptoki-howto.md %doc doc/README.token_data +%doc %{_docdir}/%{name}/*.conf %dir %{_sysconfdir}/%{name} %config(noreplace) %{_sysconfdir}/%{name}/%{name}.conf %attr(0640, root, pkcs11) %config(noreplace) %{_sysconfdir}/%{name}/p11sak_defined_attrs.conf @@ -234,9 +231,13 @@ fi %{_sbindir}/pkcstok_migrate %{_sbindir}/pkcsconf %{_sbindir}/pkcsslotd +%{_sbindir}/pkcsstats %{_mandir}/man1/p11sak.1* %{_mandir}/man1/pkcstok_migrate.1* %{_mandir}/man1/pkcsconf.1* +%{_mandir}/man1/pkcsstats.1* +%{_mandir}/man5/policy.conf.5* +%{_mandir}/man5/strength.conf.5* %{_mandir}/man5/%{name}.conf.5* %{_mandir}/man5/p11sak_defined_attrs.conf.5* %{_mandir}/man7/%{name}.7* @@ -320,6 +321,14 @@ fi %changelog +* Mon May 09 2022 Than Ngo - 3.18.0-1 +- Resolves: #2044179, rebase to 3.18.0 +- Resolves: #2068091, pkcsconf -t failed with Segmentation fault in FIPS mode +- Resolves: #2066763, Dilithium support not available +- Resolves: #2064697, OpenSSL 3.0 Compatibility for IBM Security Libraries and Tools +- Resolves: #2044181, support crypto profiles +- Resolves: #2044180, add crypto counters + * Tue May 03 2022 Than Ngo - 3.17.0-6 - Resolves: #2066763, Dilithium support not available diff --git a/sources b/sources index 7bfc995..5c6e201 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (opencryptoki-3.17.0.tar.gz) = 1e80f4cebfffef1b50f3a29577c003e3a3ac68f9c93c3fd49537dad5ab82d02ab54f62fa73e93cd20f2ea1517eb4aa3a0ac167df3597bb801e8781a4162f9d01 +SHA512 (opencryptoki-3.18.0.tar.gz) = ec975ad15766d1565bb8134160c1a6373a1106486acc924f34d63d8a02c2f2b4d88caa443d17a5f7f92c8d99d3e5c1604073d879403e4f531019ced736422ea3