import opencryptoki-3.18.0-3.el8

.gitignore

@@ -1 +1 @@
-SOURCES/opencryptoki-3.17.0.tar.gz
+SOURCES/opencryptoki-3.18.0.tar.gz

.opencryptoki.metadata

@@ -1 +1 @@
-598f43d2a04a878a4577f143251f4631625ac49b SOURCES/opencryptoki-3.17.0.tar.gz
+257eb4d5458c52bf7c1634fea155bf217d561bd4 SOURCES/opencryptoki-3.18.0.tar.gz

SOURCES/opencryptoki-1.17.0-p11sak.patch

@@ -1,12 +0,0 @@
-diff -up opencryptoki-3.17.0/Makefile.am.me opencryptoki-3.17.0/Makefile.am
---- opencryptoki-3.17.0/Makefile.am.me	2021-11-09 09:45:49.032661898 +0100
-+++ opencryptoki-3.17.0/Makefile.am	2021-11-09 09:46:41.353400986 +0100
-@@ -76,7 +76,7 @@ if ENABLE_EP11TOK
- endif
- if ENABLE_P11SAK
- 	test -f $(DESTDIR)$(sysconfdir)/opencryptoki || $(MKDIR_P) $(DESTDIR)$(sysconfdir)/opencryptoki || true
--	test -f $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || $(INSTALL) -g pkcs11 -m 0640 $(srcdir)/usr/sbin/p11sak/p11sak_defined_attrs.conf $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || true
-+	test -f $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || $(INSTALL) -m 0644 $(srcdir)/usr/sbin/p11sak/p11sak_defined_attrs.conf $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || true
- endif
- if ENABLE_ICATOK
- 	cd $(DESTDIR)$(libdir)/opencryptoki/stdll && \

SOURCES/opencryptoki-3.17.0-unlock-globmutex-if-user-and-group-check-fail.patch

@@ -1,12 +0,0 @@
-diff -up opencryptoki-3.17.0/usr/lib/api/api_interface.c.me opencryptoki-3.17.0/usr/lib/api/api_interface.c
---- opencryptoki-3.17.0/usr/lib/api/api_interface.c.me	2022-01-17 12:04:18.937010924 +0100
-+++ opencryptoki-3.17.0/usr/lib/api/api_interface.c	2022-01-17 12:04:54.020182038 +0100
-@@ -2869,7 +2869,7 @@ CK_RV C_Initialize(CK_VOID_PTR pVoid)
- 
-     rc = check_user_and_group();
-     if (rc != CKR_OK)
--        return rc;
-+        goto done;
- 
-     if (!Anchor) {
-         Anchor = (API_Proc_Struct_t *) malloc(sizeof(API_Proc_Struct_t));

SOURCES/opencryptoki-3.18.0-fix-json-output.patch

@@ -0,0 +1,47 @@
+commit 1600eebb422ae2a733de3a0bd47464620e39ab0d
+Author: Ingo Franzki <ifranzki@linux.ibm.com>
+Date:   Tue Jun 7 08:58:16 2022 +0200
+
+    pkcsstats: Fix JSON output in case of errors
+    
+    Produce correct JSON output, even if an error occurs during obtaining
+    of the statistics for a user.
+    
+    Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
+
+diff --git a/usr/sbin/pkcsstats/pkcsstats.c b/usr/sbin/pkcsstats/pkcsstats.c
+index 8eb049dd..65d4833f 100644
+--- a/usr/sbin/pkcsstats/pkcsstats.c
++++ b/usr/sbin/pkcsstats/pkcsstats.c
+@@ -789,7 +789,7 @@ int main(int argc, char **argv)
+     bool reset = false, reset_all = false;
+     bool delete = false, delete_all = false;
+     bool slot_id_specified = false;
+-    bool json = false;
++    bool json = false, json_started = false;
+     CK_SLOT_ID slot_id = 0;
+     void *dll = NULL;
+     CK_FUNCTION_LIST *func_list = NULL;
+@@ -949,8 +949,11 @@ int main(int argc, char **argv)
+         goto done;
+     }
+ 
+-    if (json && print_json_start() != 0)
+-        goto done;
++    if (json) {
++        if (print_json_start() != 0)
++            goto done;
++        json_started = true;
++    }
+ 
+     dd.func_list = func_list;
+     dd.num_slots = num_slots;
+@@ -972,7 +975,7 @@ int main(int argc, char **argv)
+     }
+ 
+ done:
+-    if (rc == 0 && json)
++    if (json && json_started)
+         printf("\n\t]\n}\n");
+ 
+     if (slots != NULL)

SOURCES/opencryptoki-3.18.0-p11sak.patch

@@ -0,0 +1,21 @@
+diff -up opencryptoki-3.18.0/Makefile.am.me opencryptoki-3.18.0/Makefile.am
+--- opencryptoki-3.18.0/Makefile.am.me	2022-05-09 22:25:07.980238715 +0200
++++ opencryptoki-3.18.0/Makefile.am	2022-05-09 22:25:29.292722755 +0200
+@@ -78,7 +78,7 @@ if ENABLE_EP11TOK
+ endif
+ if ENABLE_P11SAK
+ 	test -f $(DESTDIR)$(sysconfdir)/opencryptoki || $(MKDIR_P) $(DESTDIR)$(sysconfdir)/opencryptoki || true
+-	test -f $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || $(INSTALL) -g pkcs11 -m 0640 $(srcdir)/usr/sbin/p11sak/p11sak_defined_attrs.conf $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || true
++	test -f $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || $(INSTALL) -m 0640 $(srcdir)/usr/sbin/p11sak/p11sak_defined_attrs.conf $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || true
+ endif
+ if ENABLE_ICATOK
+ 	cd $(DESTDIR)$(libdir)/opencryptoki/stdll && \
+@@ -129,7 +129,7 @@ endif
+ if ENABLE_DAEMON
+ 	test -f $(DESTDIR)$(sysconfdir)/opencryptoki || $(MKDIR_P) $(DESTDIR)$(sysconfdir)/opencryptoki || true
+ 	test -f $(DESTDIR)$(sysconfdir)/opencryptoki/opencryptoki.conf || $(INSTALL) -m 644 $(srcdir)/usr/sbin/pkcsslotd/opencryptoki.conf $(DESTDIR)$(sysconfdir)/opencryptoki/opencryptoki.conf || true
+-	test -f $(DESTDIR)$(sysconfdir)/opencryptoki/strength.conf || $(INSTALL) -m 640 -o root -g pkcs11 -T $(srcdir)/doc/strength-example.conf $(DESTDIR)$(sysconfdir)/opencryptoki/strength.conf || true
++	test -f $(DESTDIR)$(sysconfdir)/opencryptoki/strength.conf || $(INSTALL) -m 640 -o root -T $(srcdir)/doc/strength-example.conf $(DESTDIR)$(sysconfdir)/opencryptoki/strength.conf || true
+ if ENABLE_SYSTEMD
+ 	mkdir -p $(DESTDIR)/usr/lib/tmpfiles.d
+ 	cp $(srcdir)/misc/tmpfiles.conf $(DESTDIR)/usr/lib/tmpfiles.d/opencryptoki.conf

SOURCES/opencryptoki-3.18.0-returning_CKR_BUFFER_TOO_SMALL.patch

@@ -0,0 +1,32 @@
+commit b545050b338e46c29936a2748aab7200e69a5c91
+Author: Ingo Franzki <ifranzki@linux.ibm.com>
+Date:   Tue Jul 26 15:11:06 2022 +0200
+
+    EP11: Fix C_GetMechanismList returning CKR_BUFFER_TOO_SMALL
+    
+    For mixed card levels, the size query call and the call to obtain the
+    list may run on different cards. When the size query call runs on a
+    card with less mechanisms than the second call, will fail, but it
+    returns the larger larger number of mechanisms.
+    
+    The code already re-allocates the buffer for retrieving the mechanism
+    list, but does not return the larger number in pulCount. This will
+    lead to a CKR_BUFFER_TOO_SMALL when the application calls C_GetMechanismList
+    again to obtain the list of mechanisms, because the applications buffer
+    is too small.
+    
+    Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
+
+diff --git a/usr/lib/ep11_stdll/ep11_specific.c b/usr/lib/ep11_stdll/ep11_specific.c
+index 8d796452..1629e664 100644
+--- a/usr/lib/ep11_stdll/ep11_specific.c
++++ b/usr/lib/ep11_stdll/ep11_specific.c
+@@ -8977,6 +8977,8 @@ CK_RV ep11tok_get_mechanism_list(STDLL_TokData_t * tokdata,
+                 if (rc != CKR_BUFFER_TOO_SMALL)
+                     goto out;
+             }
++            /* counter was updated in case of CKR_BUFFER_TOO_SMALL */
++            *pulCount = counter;
+         } while (rc == CKR_BUFFER_TOO_SMALL);
+ 
+         for (i = 0; i < counter; i++) {

SPECS/opencryptoki.spec

@@ -1,6 +1,6 @@
 Name: opencryptoki
 Summary: Implementation of the PKCS#11 (Cryptoki) specification v3.0
-Version: 3.17.0
+Version: 3.18.0
 Release: 3%{?dist}
 License: CPL
 Group: System Environment/Base
@@ -11,11 +11,12 @@ Patch0: opencryptoki-3.11.0-group.patch
 # bz#1373833, change tmpfiles snippets from /var/lock/* to /run/lock/*
 Patch1: opencryptoki-3.11.0-lockdir.patch
 # add missing p11sak_defined_attrs.conf
-Patch2: opencryptoki-1.17.0-p11sak.patch
+Patch2: opencryptoki-3.18.0-p11sak.patch
 # upstream patches
-Patch100: opencryptoki-3.17.0-unlock-globmutex-if-user-and-group-check-fail.patch
+Patch100: opencryptoki-3.18.0-fix-json-output.patch
+Patch102: opencryptoki-3.18.0-returning_CKR_BUFFER_TOO_SMALL.patch
 
-Requires(pre): coreutils
+Requires(pre): coreutils diffutils
 Requires: (selinux-policy >= 3.14.3-70 if selinux-policy-targeted)
 BuildRequires: gcc
 BuildRequires: gcc-c++
@@ -227,11 +228,28 @@ rm -f $RPM_BUILD_ROOT/%{_libdir}/%{name}/stdll/*.la
 %postun ep11tok -p /sbin/ldconfig
 %endif
 
+%pre
+# don't touch opencryptoki.conf even if it is unchanged due to new tokversion
+# backup config file
+%global cfile /etc/opencryptoki/opencryptoki.conf
+%global csuffix .rpmsave.XyoP
+if test $1 -gt 1 && test -f %{cfile} ; then
+    cp -p %{cfile} %{cfile}%{csuffix}
+fi
+
 %pre libs
 getent group pkcs11 >/dev/null || groupadd -r pkcs11
 exit 0
 
 %post
+# restore the config file from %pre
+if test $1 -gt 1 && test -f %{cfile} ; then
+    if ( ! cmp -s %{cfile} %{cfile}%{csuffix} ) ; then
+        cp -p %{cfile} %{cfile}.rpmnew
+    fi
+    cp -p %{cfile}%{csuffix} %{cfile} && rm -f %{cfile}%{csuffix}
+fi
+
 %systemd_post pkcsslotd.service
 if test $1 -eq 1; then
     %tmpfiles_create
@@ -248,18 +266,24 @@ fi
 %doc ChangeLog FAQ README.md
 %doc doc/opencryptoki-howto.md
 %doc doc/README.token_data
+%doc %{_docdir}/%{name}/*.conf
 %dir %{_sysconfdir}/%{name}
 %config(noreplace) %{_sysconfdir}/%{name}/%{name}.conf
 %attr(0640, root, pkcs11) %config(noreplace) %{_sysconfdir}/%{name}/p11sak_defined_attrs.conf
+%attr(0640, root, pkcs11) %config(noreplace) %{_sysconfdir}/%{name}/strength.conf
 %{_tmpfilesdir}/%{name}.conf
 %{_unitdir}/pkcsslotd.service
 %{_sbindir}/p11sak
 %{_sbindir}/pkcstok_migrate
 %{_sbindir}/pkcsconf
 %{_sbindir}/pkcsslotd
+%{_sbindir}/pkcsstats
 %{_mandir}/man1/p11sak.1*
 %{_mandir}/man1/pkcstok_migrate.1*
 %{_mandir}/man1/pkcsconf.1*
+%{_mandir}/man1/pkcsstats.1*
+%{_mandir}/man5/policy.conf.5*
+%{_mandir}/man5/strength.conf.5*
 %{_mandir}/man5/%{name}.conf.5*
 %{_mandir}/man5/p11sak_defined_attrs.conf.5*
 %{_mandir}/man7/%{name}.7*
@@ -341,6 +365,21 @@ fi
 
 
 %changelog
+* Mon Aug 01 2022 Than Ngo <than@redhat.com> - 3.18.0-3
+- Related: #2043854, do not touch opencryptoki.conf if it is in place already and even if it is unchanged
+- Resolves: #2112785, EP11: Fix C_GetMechanismList returning CKR_BUFFER_TOO_SMALL
+
+* Tue Jun 07 2022 Than Ngo <than@redhat.com> - 3.18.0-2
+- Related: #2043854, fix json output
+
+* Tue May 24 2022 Than Ngo <than@redhat.com> - 3.18.0-1
+- Resolves: #2043845, rebase to 3.18.0
+- Resolves: #2043854, add crypto counters
+- Resolves: #2043855, support crypto profiles
+
+* Fri Apr 15 2022 Than Ngo <than@redhat.com> - 3.17.0-4
+- Resolves: #2066762, Dilithium support not available 
+
 * Mon Jan 17 2022 Than Ngo <than@redhat.com> - 3.17.0-3
 - Resolves: #2040677, API: Unlock GlobMutex if user and group check fails