rpms/opencryptoki
7
0
Fork 0
Code Issues Pull Requests Releases Activity

import opencryptoki-3.18.0-3.el8

Browse Source
This commit is contained in:
CentOS Sources 2022-09-27 15:56:21 -04:00 committed by root
parent 9a1e158369
commit e3b379290b
8 changed files with 145 additions and 30 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.gitignore vendored
View File

@ -1 +1 @@
SOURCES/opencryptoki-3.17.0.tar.gz
SOURCES/opencryptoki-3.18.0.tar.gz

2
.opencryptoki.metadata
View File

@ -1 +1 @@
598f43d2a04a878a4577f143251f4631625ac49b SOURCES/opencryptoki-3.17.0.tar.gz
257eb4d5458c52bf7c1634fea155bf217d561bd4 SOURCES/opencryptoki-3.18.0.tar.gz

12
SOURCES/opencryptoki-1.17.0-p11sak.patch
View File

@ -1,12 +0,0 @@
diff -up opencryptoki-3.17.0/Makefile.am.me opencryptoki-3.17.0/Makefile.am
--- opencryptoki-3.17.0/Makefile.am.me 2021-11-09 09:45:49.032661898 +0100
+++ opencryptoki-3.17.0/Makefile.am 2021-11-09 09:46:41.353400986 +0100
@@ -76,7 +76,7 @@ if ENABLE_EP11TOK
endif
if ENABLE_P11SAK
test -f $(DESTDIR)$(sysconfdir)/opencryptoki || $(MKDIR_P) $(DESTDIR)$(sysconfdir)/opencryptoki || true
- test -f $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || $(INSTALL) -g pkcs11 -m 0640 $(srcdir)/usr/sbin/p11sak/p11sak_defined_attrs.conf $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || true
+ test -f $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || $(INSTALL) -m 0644 $(srcdir)/usr/sbin/p11sak/p11sak_defined_attrs.conf $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || true
endif
if ENABLE_ICATOK
cd $(DESTDIR)$(libdir)/opencryptoki/stdll && \

12
SOURCES/opencryptoki-3.17.0-unlock-globmutex-if-user-and-group-check-fail.patch
View File

@ -1,12 +0,0 @@
diff -up opencryptoki-3.17.0/usr/lib/api/api_interface.c.me opencryptoki-3.17.0/usr/lib/api/api_interface.c
--- opencryptoki-3.17.0/usr/lib/api/api_interface.c.me 2022-01-17 12:04:18.937010924 +0100
+++ opencryptoki-3.17.0/usr/lib/api/api_interface.c 2022-01-17 12:04:54.020182038 +0100
@@ -2869,7 +2869,7 @@ CK_RV C_Initialize(CK_VOID_PTR pVoid)
rc = check_user_and_group();
if (rc != CKR_OK)
- return rc;
+ goto done;
if (!Anchor) {
Anchor = (API_Proc_Struct_t *) malloc(sizeof(API_Proc_Struct_t));

47
SOURCES/opencryptoki-3.18.0-fix-json-output.patch Normal file
View File

@ -0,0 +1,47 @@
commit 1600eebb422ae2a733de3a0bd47464620e39ab0d
Author: Ingo Franzki <ifranzki@linux.ibm.com>
Date: Tue Jun 7 08:58:16 2022 +0200
pkcsstats: Fix JSON output in case of errors
Produce correct JSON output, even if an error occurs during obtaining
of the statistics for a user.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
diff --git a/usr/sbin/pkcsstats/pkcsstats.c b/usr/sbin/pkcsstats/pkcsstats.c
index 8eb049dd..65d4833f 100644
--- a/usr/sbin/pkcsstats/pkcsstats.c
+++ b/usr/sbin/pkcsstats/pkcsstats.c
@@ -789,7 +789,7 @@ int main(int argc, char **argv)
bool reset = false, reset_all = false;
bool delete = false, delete_all = false;
bool slot_id_specified = false;
- bool json = false;
+ bool json = false, json_started = false;
CK_SLOT_ID slot_id = 0;
void *dll = NULL;
CK_FUNCTION_LIST *func_list = NULL;
@@ -949,8 +949,11 @@ int main(int argc, char **argv)
goto done;
}
- if (json && print_json_start() != 0)
- goto done;
+ if (json) {
+ if (print_json_start() != 0)
+ goto done;
+ json_started = true;
+ }
dd.func_list = func_list;
dd.num_slots = num_slots;
@@ -972,7 +975,7 @@ int main(int argc, char **argv)
}
done:
- if (rc == 0 && json)
+ if (json && json_started)
printf("\n\t]\n}\n");
if (slots != NULL)

21
SOURCES/opencryptoki-3.18.0-p11sak.patch Normal file
View File

@ -0,0 +1,21 @@
diff -up opencryptoki-3.18.0/Makefile.am.me opencryptoki-3.18.0/Makefile.am
--- opencryptoki-3.18.0/Makefile.am.me 2022-05-09 22:25:07.980238715 +0200
+++ opencryptoki-3.18.0/Makefile.am 2022-05-09 22:25:29.292722755 +0200
@@ -78,7 +78,7 @@ if ENABLE_EP11TOK
endif
if ENABLE_P11SAK
test -f $(DESTDIR)$(sysconfdir)/opencryptoki || $(MKDIR_P) $(DESTDIR)$(sysconfdir)/opencryptoki || true
- test -f $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || $(INSTALL) -g pkcs11 -m 0640 $(srcdir)/usr/sbin/p11sak/p11sak_defined_attrs.conf $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || true
+ test -f $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || $(INSTALL) -m 0640 $(srcdir)/usr/sbin/p11sak/p11sak_defined_attrs.conf $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || true
endif
if ENABLE_ICATOK
cd $(DESTDIR)$(libdir)/opencryptoki/stdll && \
@@ -129,7 +129,7 @@ endif
if ENABLE_DAEMON
test -f $(DESTDIR)$(sysconfdir)/opencryptoki || $(MKDIR_P) $(DESTDIR)$(sysconfdir)/opencryptoki || true
test -f $(DESTDIR)$(sysconfdir)/opencryptoki/opencryptoki.conf || $(INSTALL) -m 644 $(srcdir)/usr/sbin/pkcsslotd/opencryptoki.conf $(DESTDIR)$(sysconfdir)/opencryptoki/opencryptoki.conf || true
- test -f $(DESTDIR)$(sysconfdir)/opencryptoki/strength.conf || $(INSTALL) -m 640 -o root -g pkcs11 -T $(srcdir)/doc/strength-example.conf $(DESTDIR)$(sysconfdir)/opencryptoki/strength.conf || true
+ test -f $(DESTDIR)$(sysconfdir)/opencryptoki/strength.conf || $(INSTALL) -m 640 -o root -T $(srcdir)/doc/strength-example.conf $(DESTDIR)$(sysconfdir)/opencryptoki/strength.conf || true
if ENABLE_SYSTEMD
mkdir -p $(DESTDIR)/usr/lib/tmpfiles.d
cp $(srcdir)/misc/tmpfiles.conf $(DESTDIR)/usr/lib/tmpfiles.d/opencryptoki.conf

32
SOURCES/opencryptoki-3.18.0-returning_CKR_BUFFER_TOO_SMALL.patch Normal file
View File

@ -0,0 +1,32 @@
commit b545050b338e46c29936a2748aab7200e69a5c91
Author: Ingo Franzki <ifranzki@linux.ibm.com>
Date: Tue Jul 26 15:11:06 2022 +0200
EP11: Fix C_GetMechanismList returning CKR_BUFFER_TOO_SMALL
For mixed card levels, the size query call and the call to obtain the
list may run on different cards. When the size query call runs on a
card with less mechanisms than the second call, will fail, but it
returns the larger larger number of mechanisms.
The code already re-allocates the buffer for retrieving the mechanism
list, but does not return the larger number in pulCount. This will
lead to a CKR_BUFFER_TOO_SMALL when the application calls C_GetMechanismList
again to obtain the list of mechanisms, because the applications buffer
is too small.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
diff --git a/usr/lib/ep11_stdll/ep11_specific.c b/usr/lib/ep11_stdll/ep11_specific.c
index 8d796452..1629e664 100644
--- a/usr/lib/ep11_stdll/ep11_specific.c
+++ b/usr/lib/ep11_stdll/ep11_specific.c
@@ -8977,6 +8977,8 @@ CK_RV ep11tok_get_mechanism_list(STDLL_TokData_t * tokdata,
if (rc != CKR_BUFFER_TOO_SMALL)
goto out;
}
+ /* counter was updated in case of CKR_BUFFER_TOO_SMALL */
+ *pulCount = counter;
} while (rc == CKR_BUFFER_TOO_SMALL);
for (i = 0; i < counter; i++) {

47
SPECS/opencryptoki.spec
View File

@ -1,6 +1,6 @@
Name: opencryptoki
Summary: Implementation of the PKCS#11 (Cryptoki) specification v3.0
Version: 3.17.0
Version: 3.18.0
Release: 3%{?dist}
License: CPL
Group: System Environment/Base
@ -11,11 +11,12 @@ Patch0: opencryptoki-3.11.0-group.patch
# bz#1373833, change tmpfiles snippets from /var/lock/* to /run/lock/*
Patch1: opencryptoki-3.11.0-lockdir.patch
# add missing p11sak_defined_attrs.conf
Patch2: opencryptoki-1.17.0-p11sak.patch
Patch2: opencryptoki-3.18.0-p11sak.patch
# upstream patches
Patch100: opencryptoki-3.17.0-unlock-globmutex-if-user-and-group-check-fail.patch
Patch100: opencryptoki-3.18.0-fix-json-output.patch
Patch102: opencryptoki-3.18.0-returning_CKR_BUFFER_TOO_SMALL.patch
Requires(pre): coreutils
Requires(pre): coreutils diffutils
Requires: (selinux-policy >= 3.14.3-70 if selinux-policy-targeted)
BuildRequires: gcc
BuildRequires: gcc-c++
@ -227,11 +228,28 @@ rm -f $RPM_BUILD_ROOT/%{_libdir}/%{name}/stdll/*.la
%postun ep11tok -p /sbin/ldconfig
%endif
%pre
# don't touch opencryptoki.conf even if it is unchanged due to new tokversion
# backup config file
%global cfile /etc/opencryptoki/opencryptoki.conf
%global csuffix .rpmsave.XyoP
if test $1 -gt 1 && test -f %{cfile} ; then
cp -p %{cfile} %{cfile}%{csuffix}
fi
%pre libs
getent group pkcs11 >/dev/null || groupadd -r pkcs11
exit 0
%post
# restore the config file from %pre
if test $1 -gt 1 && test -f %{cfile} ; then
if ( ! cmp -s %{cfile} %{cfile}%{csuffix} ) ; then
cp -p %{cfile} %{cfile}.rpmnew
fi
cp -p %{cfile}%{csuffix} %{cfile} && rm -f %{cfile}%{csuffix}
fi
%systemd_post pkcsslotd.service
if test $1 -eq 1; then
%tmpfiles_create
@ -248,18 +266,24 @@ fi
%doc ChangeLog FAQ README.md
%doc doc/opencryptoki-howto.md
%doc doc/README.token_data
%doc %{_docdir}/%{name}/*.conf
%dir %{_sysconfdir}/%{name}
%config(noreplace) %{_sysconfdir}/%{name}/%{name}.conf
%attr(0640, root, pkcs11) %config(noreplace) %{_sysconfdir}/%{name}/p11sak_defined_attrs.conf
%attr(0640, root, pkcs11) %config(noreplace) %{_sysconfdir}/%{name}/strength.conf
%{_tmpfilesdir}/%{name}.conf
%{_unitdir}/pkcsslotd.service
%{_sbindir}/p11sak
%{_sbindir}/pkcstok_migrate
%{_sbindir}/pkcsconf
%{_sbindir}/pkcsslotd
%{_sbindir}/pkcsstats
%{_mandir}/man1/p11sak.1*
%{_mandir}/man1/pkcstok_migrate.1*
%{_mandir}/man1/pkcsconf.1*
%{_mandir}/man1/pkcsstats.1*
%{_mandir}/man5/policy.conf.5*
%{_mandir}/man5/strength.conf.5*
%{_mandir}/man5/%{name}.conf.5*
%{_mandir}/man5/p11sak_defined_attrs.conf.5*
%{_mandir}/man7/%{name}.7*
@ -341,6 +365,21 @@ fi
%changelog
* Mon Aug 01 2022 Than Ngo <than@redhat.com> - 3.18.0-3
- Related: #2043854, do not touch opencryptoki.conf if it is in place already and even if it is unchanged
- Resolves: #2112785, EP11: Fix C_GetMechanismList returning CKR_BUFFER_TOO_SMALL
* Tue Jun 07 2022 Than Ngo <than@redhat.com> - 3.18.0-2
- Related: #2043854, fix json output
* Tue May 24 2022 Than Ngo <than@redhat.com> - 3.18.0-1
- Resolves: #2043845, rebase to 3.18.0
- Resolves: #2043854, add crypto counters
- Resolves: #2043855, support crypto profiles
* Fri Apr 15 2022 Than Ngo <than@redhat.com> - 3.17.0-4
- Resolves: #2066762, Dilithium support not available
* Mon Jan 17 2022 Than Ngo <than@redhat.com> - 3.17.0-3
- Resolves: #2040677, API: Unlock GlobMutex if user and group check fails