rpms/opencryptoki
6
0
Fork 0
Code Issues Pull Requests Releases Activity

import opencryptoki-3.18.0-4.el9

Browse Source
This commit is contained in:
CentOS Sources 2022-09-27 10:54:41 -04:00 committed by root
parent 749a27997c
commit 9087810c0e
10 changed files with 152 additions and 153 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.gitignore vendored
View File

@ -1 +1 @@
SOURCES/opencryptoki-3.17.0.tar.gz SOURCES/opencryptoki-3.18.0.tar.gz

2
.opencryptoki.metadata
View File

@ -1 +1 @@
598f43d2a04a878a4577f143251f4631625ac49b SOURCES/opencryptoki-3.17.0.tar.gz 257eb4d5458c52bf7c1634fea155bf217d561bd4 SOURCES/opencryptoki-3.18.0.tar.gz

88
SOURCES/opencryptoki-3.17-libica4-8e9800b492f7a40ed5dfcd85e042701b6a5c5a26.patch
View File

@ -1,88 +0,0 @@
commit 8e9800b492f7a40ed5dfcd85e042701b6a5c5a26
Author: Ingo Franzki <ifranzki@linux.ibm.com>
Date: Tue Dec 7 16:39:28 2021 +0100
ICA/EP11: Support libica version 4
Try to load libica version 4 (libica.so.4), but fall back to version 3
(libica.so.3) if version 4 is not available.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
diff --git a/usr/lib/ep11_stdll/ep11_specific.c b/usr/lib/ep11_stdll/ep11_specific.c
index 4029e5a5..f223017d 100644
--- a/usr/lib/ep11_stdll/ep11_specific.c
+++ b/usr/lib/ep11_stdll/ep11_specific.c
@@ -68,7 +68,8 @@
#define EP11SHAREDLIB_V2 "libep11.so.2"
#define EP11SHAREDLIB_V1 "libep11.so.1"
#define EP11SHAREDLIB "libep11.so"
-#define ICASHAREDLIB "libica.so.3"
+#define ICASHAREDLIB_V4 "libica.so.4"
+#define ICASHAREDLIB_V3 "libica.so.3"
CK_RV ep11tok_get_mechanism_list(STDLL_TokData_t * tokdata,
CK_MECHANISM_TYPE_PTR mlist,
@@ -2044,9 +2045,9 @@ static CK_RV make_wrapblob(STDLL_TokData_t * tokdata, CK_ATTRIBUTE * tmpl_in,
}
#ifdef EP11_HSMSIM
-#define DLOPEN_FLAGS RTLD_GLOBAL | RTLD_NOW | RTLD_DEEPBIND
+#define DLOPEN_FLAGS RTLD_NOW | RTLD_DEEPBIND
#else
-#define DLOPEN_FLAGS RTLD_GLOBAL | RTLD_NOW
+#define DLOPEN_FLAGS RTLD_NOW
#endif
static void *ep11_load_host_lib()
@@ -2209,12 +2210,16 @@ static CK_RV ep11tok_load_libica(STDLL_TokData_t *tokdata)
return CKR_OK;
if (strcmp(ep11_data->digest_libica_path, "") == 0) {
- strcpy(ep11_data->digest_libica_path, ICASHAREDLIB);
+ strcpy(ep11_data->digest_libica_path, ICASHAREDLIB_V4);
default_libica = 1;
+ libica->library = dlopen(ep11_data->digest_libica_path, RTLD_NOW);
+ if (libica->library == NULL) {
+ strcpy(ep11_data->digest_libica_path, ICASHAREDLIB_V3);
+ libica->library = dlopen(ep11_data->digest_libica_path, RTLD_NOW);
+ }
+ } else {
+ libica->library = dlopen(ep11_data->digest_libica_path, RTLD_NOW);
}
-
- libica->library = dlopen(ep11_data->digest_libica_path,
- RTLD_GLOBAL | RTLD_NOW);
if (libica->library == NULL) {
errstr = dlerror();
OCK_SYSLOG(default_libica ? LOG_WARNING : LOG_ERR,
diff --git a/usr/lib/ica_s390_stdll/ica_specific.c b/usr/lib/ica_s390_stdll/ica_specific.c
index fd18de42..c4fa9654 100644
--- a/usr/lib/ica_s390_stdll/ica_specific.c
+++ b/usr/lib/ica_s390_stdll/ica_specific.c
@@ -83,7 +83,8 @@ const char label[] = "icatok";
static pthread_mutex_t rngmtx = PTHREAD_MUTEX_INITIALIZER;
-#define LIBICA_SHARED_LIB "libica.so.3"
+#define LIBICA_SHARED_LIB_V3 "libica.so.3"
+#define LIBICA_SHARED_LIB_V4 "libica.so.4"
#define BIND(dso, sym) do { \
if (p_##sym == NULL) \
*(void **)(&p_##sym) = dlsym(dso, #sym); \
@@ -221,9 +222,13 @@ static CK_RV load_libica(void)
void *ibmca_dso = NULL;
/* Load libica */
- ibmca_dso = dlopen(LIBICA_SHARED_LIB, RTLD_NOW);
+ ibmca_dso = dlopen(LIBICA_SHARED_LIB_V4, RTLD_NOW);
+ if (ibmca_dso == NULL)
+ ibmca_dso = dlopen(LIBICA_SHARED_LIB_V3, RTLD_NOW);
+
if (ibmca_dso == NULL) {
- TRACE_ERROR("%s: dlopen(%s) failed\n", __func__, LIBICA_SHARED_LIB);
+ TRACE_ERROR("%s: dlopen(%s or %s) failed: %s\n", __func__,
+ LIBICA_SHARED_LIB_V4, LIBICA_SHARED_LIB_V3, dlerror());
return CKR_FUNCTION_FAILED;
}

12
SOURCES/opencryptoki-3.17.0-p11sak.patch
View File

@ -1,12 +0,0 @@
diff -up opencryptoki-3.17.0/Makefile.am.me opencryptoki-3.17.0/Makefile.am
--- opencryptoki-3.17.0/Makefile.am.me 2021-11-09 09:45:49.032661898 +0100
+++ opencryptoki-3.17.0/Makefile.am 2021-11-09 09:46:41.353400986 +0100
@@ -76,7 +76,7 @@ if ENABLE_EP11TOK
endif
if ENABLE_P11SAK
test -f $(DESTDIR)$(sysconfdir)/opencryptoki || $(MKDIR_P) $(DESTDIR)$(sysconfdir)/opencryptoki || true
- test -f $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || $(INSTALL) -g pkcs11 -m 0640 $(srcdir)/usr/sbin/p11sak/p11sak_defined_attrs.conf $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || true
+ test -f $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || $(INSTALL) -m 0644 $(srcdir)/usr/sbin/p11sak/p11sak_defined_attrs.conf $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || true
endif
if ENABLE_ICATOK
cd $(DESTDIR)$(libdir)/opencryptoki/stdll && \

12
SOURCES/opencryptoki-3.17.0-unlock-globmutex-if-user-and-group-check-fail.patch
View File

@ -1,12 +0,0 @@
diff -up opencryptoki-3.17.0/usr/lib/api/api_interface.c.me opencryptoki-3.17.0/usr/lib/api/api_interface.c
--- opencryptoki-3.17.0/usr/lib/api/api_interface.c.me 2022-01-17 12:04:18.937010924 +0100
+++ opencryptoki-3.17.0/usr/lib/api/api_interface.c 2022-01-17 12:04:54.020182038 +0100
@@ -2869,7 +2869,7 @@ CK_RV C_Initialize(CK_VOID_PTR pVoid)
rc = check_user_and_group();
if (rc != CKR_OK)
- return rc;
+ goto done;
if (!Anchor) {
Anchor = (API_Proc_Struct_t *) malloc(sizeof(API_Proc_Struct_t));

47
SOURCES/opencryptoki-3.18.0-fix-json-output.patch Normal file
View File

@ -0,0 +1,47 @@
commit 1600eebb422ae2a733de3a0bd47464620e39ab0d
Author: Ingo Franzki <ifranzki@linux.ibm.com>
Date: Tue Jun 7 08:58:16 2022 +0200
pkcsstats: Fix JSON output in case of errors
Produce correct JSON output, even if an error occurs during obtaining
of the statistics for a user.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
diff --git a/usr/sbin/pkcsstats/pkcsstats.c b/usr/sbin/pkcsstats/pkcsstats.c
index 8eb049dd..65d4833f 100644
--- a/usr/sbin/pkcsstats/pkcsstats.c
+++ b/usr/sbin/pkcsstats/pkcsstats.c
@@ -789,7 +789,7 @@ int main(int argc, char **argv)
bool reset = false, reset_all = false;
bool delete = false, delete_all = false;
bool slot_id_specified = false;
- bool json = false;
+ bool json = false, json_started = false;
CK_SLOT_ID slot_id = 0;
void *dll = NULL;
CK_FUNCTION_LIST *func_list = NULL;
@@ -949,8 +949,11 @@ int main(int argc, char **argv)
goto done;
}
- if (json && print_json_start() != 0)
- goto done;
+ if (json) {
+ if (print_json_start() != 0)
+ goto done;
+ json_started = true;
+ }
dd.func_list = func_list;
dd.num_slots = num_slots;
@@ -972,7 +975,7 @@ int main(int argc, char **argv)
}
done:
- if (rc == 0 && json)
+ if (json && json_started)
printf("\n\t]\n}\n");
if (slots != NULL)

21
SOURCES/opencryptoki-3.18.0-p11sak.patch Normal file
View File

@ -0,0 +1,21 @@
diff -up opencryptoki-3.18.0/Makefile.am.me opencryptoki-3.18.0/Makefile.am
--- opencryptoki-3.18.0/Makefile.am.me 2022-05-09 22:25:07.980238715 +0200
+++ opencryptoki-3.18.0/Makefile.am 2022-05-09 22:25:29.292722755 +0200
@@ -78,7 +78,7 @@ if ENABLE_EP11TOK
endif
if ENABLE_P11SAK
test -f $(DESTDIR)$(sysconfdir)/opencryptoki || $(MKDIR_P) $(DESTDIR)$(sysconfdir)/opencryptoki || true
- test -f $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || $(INSTALL) -g pkcs11 -m 0640 $(srcdir)/usr/sbin/p11sak/p11sak_defined_attrs.conf $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || true
+ test -f $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || $(INSTALL) -m 0640 $(srcdir)/usr/sbin/p11sak/p11sak_defined_attrs.conf $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || true
endif
if ENABLE_ICATOK
cd $(DESTDIR)$(libdir)/opencryptoki/stdll && \
@@ -129,7 +129,7 @@ endif
if ENABLE_DAEMON
test -f $(DESTDIR)$(sysconfdir)/opencryptoki || $(MKDIR_P) $(DESTDIR)$(sysconfdir)/opencryptoki || true
test -f $(DESTDIR)$(sysconfdir)/opencryptoki/opencryptoki.conf || $(INSTALL) -m 644 $(srcdir)/usr/sbin/pkcsslotd/opencryptoki.conf $(DESTDIR)$(sysconfdir)/opencryptoki/opencryptoki.conf || true
- test -f $(DESTDIR)$(sysconfdir)/opencryptoki/strength.conf || $(INSTALL) -m 640 -o root -g pkcs11 -T $(srcdir)/doc/strength-example.conf $(DESTDIR)$(sysconfdir)/opencryptoki/strength.conf || true
+ test -f $(DESTDIR)$(sysconfdir)/opencryptoki/strength.conf || $(INSTALL) -m 640 -o root -T $(srcdir)/doc/strength-example.conf $(DESTDIR)$(sysconfdir)/opencryptoki/strength.conf || true
if ENABLE_SYSTEMD
mkdir -p $(DESTDIR)/usr/lib/tmpfiles.d
cp $(srcdir)/misc/tmpfiles.conf $(DESTDIR)/usr/lib/tmpfiles.d/opencryptoki.conf

32
SOURCES/opencryptoki-3.18.0-returning_CKR_BUFFER_TOO_SMALL.patch Normal file
View File

@ -0,0 +1,32 @@
commit b545050b338e46c29936a2748aab7200e69a5c91
Author: Ingo Franzki <ifranzki@linux.ibm.com>
Date: Tue Jul 26 15:11:06 2022 +0200
EP11: Fix C_GetMechanismList returning CKR_BUFFER_TOO_SMALL
For mixed card levels, the size query call and the call to obtain the
list may run on different cards. When the size query call runs on a
card with less mechanisms than the second call, will fail, but it
returns the larger larger number of mechanisms.
The code already re-allocates the buffer for retrieving the mechanism
list, but does not return the larger number in pulCount. This will
lead to a CKR_BUFFER_TOO_SMALL when the application calls C_GetMechanismList
again to obtain the list of mechanisms, because the applications buffer
is too small.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
diff --git a/usr/lib/ep11_stdll/ep11_specific.c b/usr/lib/ep11_stdll/ep11_specific.c
index 8d796452..1629e664 100644
--- a/usr/lib/ep11_stdll/ep11_specific.c
+++ b/usr/lib/ep11_stdll/ep11_specific.c
@@ -8977,6 +8977,8 @@ CK_RV ep11tok_get_mechanism_list(STDLL_TokData_t * tokdata,
if (rc != CKR_BUFFER_TOO_SMALL)
goto out;
}
+ /* counter was updated in case of CKR_BUFFER_TOO_SMALL */
+ *pulCount = counter;
} while (rc == CKR_BUFFER_TOO_SMALL);
for (i = 0; i < counter; i++) {

29
SOURCES/opencryptoki-pkcsslotd-pidfile.patch
View File

@ -1,29 +0,0 @@
diff -up opencryptoki-3.16.0/misc/pkcsslotd.service.in.me opencryptoki-3.16.0/misc/pkcsslotd.service.in
--- opencryptoki-3.16.0/misc/pkcsslotd.service.in.me 2021-06-25 09:25:11.464487847 +0200
+++ opencryptoki-3.16.0/misc/pkcsslotd.service.in 2021-06-25 09:25:38.701225760 +0200
@@ -4,7 +4,7 @@ After=local-fs.target
[Service]
Type=forking
-PIDFile=/var/run/pkcsslotd.pid
+PIDFile=/run/pkcsslotd.pid
ExecStart=@sbindir@/pkcsslotd
[Install]
diff -up opencryptoki-3.16.0/usr/include/slotmgr.h.me opencryptoki-3.16.0/usr/include/slotmgr.h
--- opencryptoki-3.16.0/usr/include/slotmgr.h.me 2021-06-30 17:28:18.000594834 +0200
+++ opencryptoki-3.16.0/usr/include/slotmgr.h 2021-06-30 17:28:38.920890278 +0200
@@ -30,10 +30,10 @@
#define TOK_PATH SBIN_PATH "/pkcsslotd"
#define OCK_API_LOCK_FILE LOCKDIR_PATH "/LCK..APIlock"
-#define PROC_SOCKET_FILE_PATH "/var/run/pkcsslotd.socket"
-#define ADMIN_SOCKET_FILE_PATH "/var/run/pkcsslotd.admin.socket"
+#define PROC_SOCKET_FILE_PATH "/run/pkcsslotd.socket"
+#define ADMIN_SOCKET_FILE_PATH "/run/pkcsslotd.admin.socket"
-#define PID_FILE_PATH "/var/run/pkcsslotd.pid"
+#define PID_FILE_PATH "/run/pkcsslotd.pid"
#define OCK_CONFIG OCK_CONFDIR "/opencryptoki.conf"
#ifndef CK_BOOL

60
SPECS/opencryptoki.spec
View File

@ -1,7 +1,7 @@
Name: opencryptoki Name: opencryptoki
Summary: Implementation of the PKCS#11 (Cryptoki) specification v3.0 Summary: Implementation of the PKCS#11 (Cryptoki) specification v3.0
Version: 3.17.0 Version: 3.18.0
Release: 5%{?dist} Release: 4%{?dist}
License: CPL License: CPL
URL: https://github.com/opencryptoki/opencryptoki URL: https://github.com/opencryptoki/opencryptoki
Source0: https://github.com/opencryptoki/%{name}/archive/v%{version}/%{name}-%{version}.tar.gz Source0: https://github.com/opencryptoki/%{name}/archive/v%{version}/%{name}-%{version}.tar.gz
@ -9,15 +9,13 @@ Source0: https://github.com/opencryptoki/%{name}/archive/v%{version}/%{name}-%{
Patch0: opencryptoki-3.11.0-group.patch Patch0: opencryptoki-3.11.0-group.patch
# bz#1373833, change tmpfiles snippets from /var/lock/* to /run/lock/* # bz#1373833, change tmpfiles snippets from /var/lock/* to /run/lock/*
Patch1: opencryptoki-3.11.0-lockdir.patch Patch1: opencryptoki-3.11.0-lockdir.patch
# add missing p11sak_defined_attrs.conf # add missing p11sak_defined_attrs.conf, strength.conf
Patch2: opencryptoki-3.17.0-p11sak.patch Patch2: opencryptoki-3.18.0-p11sak.patch
# upstream patches # upstream patches
# PIDfile below legacy directory /var/run/ Patch100: opencryptoki-3.18.0-fix-json-output.patch
Patch300: opencryptoki-pkcsslotd-pidfile.patch Patch101: opencryptoki-3.18.0-returning_CKR_BUFFER_TOO_SMALL.patch
Patch301: opencryptoki-3.17.0-unlock-globmutex-if-user-and-group-check-fail.patch
Patch302: opencryptoki-3.17-libica4-8e9800b492f7a40ed5dfcd85e042701b6a5c5a26.patch
Requires(pre): coreutils Requires(pre): coreutils diffutils
Requires: (selinux-policy >= 34.1.8-1 if selinux-policy-targeted) Requires: (selinux-policy >= 34.1.8-1 if selinux-policy-targeted)
BuildRequires: gcc BuildRequires: gcc
BuildRequires: gcc-c++ BuildRequires: gcc-c++
@ -203,12 +201,28 @@ configured with Enterprise PKCS#11 (EP11) firmware.
%install %install
%make_install CHGRP=/bin/true %make_install CHGRP=/bin/true
%pre
# don't touch opencryptoki.conf even if it is unchanged due to new tokversion
# backup config file
%global cfile /etc/opencryptoki/opencryptoki.conf
%global csuffix .rpmsave.XyoP
if test $1 -gt 1 && test -f %{cfile} ; then
cp -p %{cfile} %{cfile}%{csuffix}
fi
%pre libs %pre libs
getent group pkcs11 >/dev/null || groupadd -r pkcs11 getent group pkcs11 >/dev/null || groupadd -r pkcs11
exit 0 exit 0
%post %post
# restore the config file from %pre
if test $1 -gt 1 && test -f %{cfile} ; then
if ( ! cmp -s %{cfile} %{cfile}%{csuffix} ) ; then
cp -p %{cfile} %{cfile}.rpmnew
fi
cp -p %{cfile}%{csuffix} %{cfile} && rm -f %{cfile}%{csuffix}
fi
%systemd_post pkcsslotd.service %systemd_post pkcsslotd.service
if test $1 -eq 1; then if test $1 -eq 1; then
%tmpfiles_create %{name}.conf %tmpfiles_create %{name}.conf
@ -225,18 +239,24 @@ fi
%doc ChangeLog FAQ README.md %doc ChangeLog FAQ README.md
%doc doc/opencryptoki-howto.md %doc doc/opencryptoki-howto.md
%doc doc/README.token_data %doc doc/README.token_data
%doc %{_docdir}/%{name}/*.conf
%dir %{_sysconfdir}/%{name} %dir %{_sysconfdir}/%{name}
%config(noreplace) %{_sysconfdir}/%{name}/%{name}.conf %config(noreplace) %{_sysconfdir}/%{name}/%{name}.conf
%attr(0640, root, pkcs11) %config(noreplace) %{_sysconfdir}/%{name}/p11sak_defined_attrs.conf %attr(0640, root, pkcs11) %config(noreplace) %{_sysconfdir}/%{name}/p11sak_defined_attrs.conf
%attr(0640, root, pkcs11) %config(noreplace) %{_sysconfdir}/%{name}/strength.conf
%{_tmpfilesdir}/%{name}.conf %{_tmpfilesdir}/%{name}.conf
%{_unitdir}/pkcsslotd.service %{_unitdir}/pkcsslotd.service
%{_sbindir}/p11sak %{_sbindir}/p11sak
%{_sbindir}/pkcstok_migrate %{_sbindir}/pkcstok_migrate
%{_sbindir}/pkcsconf %{_sbindir}/pkcsconf
%{_sbindir}/pkcsslotd %{_sbindir}/pkcsslotd
%{_sbindir}/pkcsstats
%{_mandir}/man1/p11sak.1* %{_mandir}/man1/p11sak.1*
%{_mandir}/man1/pkcstok_migrate.1* %{_mandir}/man1/pkcstok_migrate.1*
%{_mandir}/man1/pkcsconf.1* %{_mandir}/man1/pkcsconf.1*
%{_mandir}/man1/pkcsstats.1*
%{_mandir}/man5/policy.conf.5*
%{_mandir}/man5/strength.conf.5*
%{_mandir}/man5/%{name}.conf.5* %{_mandir}/man5/%{name}.conf.5*
%{_mandir}/man5/p11sak_defined_attrs.conf.5* %{_mandir}/man5/p11sak_defined_attrs.conf.5*
%{_mandir}/man7/%{name}.7* %{_mandir}/man7/%{name}.7*
@ -320,8 +340,28 @@ fi
%changelog %changelog
* Fri Jul 29 2022 Than Ngo <than@redhat.com> - 3.18.0-4
- Related: #2044179, do not touch opencryptoki.conf if it is in place already and even if it is unchanged
* Tue Jun 07 2022 Than Ngo <than@redhat.com> - 3.18.0-3
- Related: #2044179, fix json output
* Mon May 09 2022 Than Ngo <than@redhat.com> - 3.18.0-2
- Related: #2044179, add missing strength.conf
* Mon May 09 2022 Than Ngo <than@redhat.com> - 3.18.0-1
- Resolves: #2044179, rebase to 3.18.0
- Resolves: #2068091, pkcsconf -t failed with Segmentation fault in FIPS mode
- Resolves: #2066763, Dilithium support not available
- Resolves: #2064697, OpenSSL 3.0 Compatibility for IBM Security Libraries and Tools
- Resolves: #2044181, support crypto profiles
- Resolves: #2044180, add crypto counters
* Tue May 03 2022 Than Ngo <than@redhat.com> - 3.17.0-6
- Resolves: #2066763, Dilithium support not available
* Mon Mar 14 2022 Than Ngo <than@redhat.com> - 3.17.0-5 * Mon Mar 14 2022 Than Ngo <than@redhat.com> - 3.17.0-5
- Related: #2015888, ICA/EP11: Support libica version 4 - Resolves: #2064697, ICA/EP11: Support libica version 4
* Mon Jan 17 2022 Than Ngo <than@redhat.com> - 3.17.0-4 * Mon Jan 17 2022 Than Ngo <than@redhat.com> - 3.17.0-4
- Resolves: #2040678, API: Unlock GlobMutex if user and group check fails - Resolves: #2040678, API: Unlock GlobMutex if user and group check fails