- rebased to 2.17.0 (#1869554)

- Resolves: #1869554
This commit is contained in:
Dan Horák 2021-07-15 12:08:59 +02:00
parent bfa589ac16
commit 8c9a2c0e67
8 changed files with 43 additions and 1290 deletions

27
.gitignore vendored
View File

@ -1,26 +1 @@
s390-tools-1.8.2.tar.bz2
cmsfs-1.1.8c.tar.gz
lib-zfcp-hbaapi-2.0.tar.gz
src_vipa-2.0.4.tar.gz
/lib-zfcp-hbaapi-2.1.tar.gz
/src_vipa-2.1.0.tar.gz
/s390-tools-*.tar.bz2
/s390-tools-2.0.0.tar.gz
/s390-tools-2.1.0.tar.gz
/s390-tools-2.2.0.tar.gz
/s390-tools-2.3.0.tar.gz
/s390-tools-2.4.0.tar.gz
/s390-tools-2.5.0.tar.gz
/s390-tools-2.6.0.tar.gz
/s390-tools-2.7.0.tar.gz
/s390-tools-2.7.1.tar.gz
/s390-tools-2.8.0.tar.gz
/s390-tools-2.9.0.tar.gz
/s390-tools-2.10.0.tar.gz
/s390-tools-2.11.0.tar.gz
/s390-tools-2.12.0.tar.gz
/s390-tools-2.13.0.tar.gz
/s390-tools-2.14.0.tar.gz
/s390-tools-2.15.0.tar.gz
/s390-tools-2.15.1.tar.gz
/s390-tools-2.16.0.tar.gz
/s390-tools-*.tar.gz

View File

@ -1,13 +1,4 @@
ACTION!="add|change", GOTO="ccw_end"
ACTION!="bind", GOTO="ccw_end"
SUBSYSTEM!="ccw", GOTO="ccw_end"
ATTRS{cutype}=="1731/01", RUN+="ccw_init"
ATTRS{cutype}=="1731/02", RUN+="ccw_init"
ATTRS{cutype}=="1731/05", RUN+="ccw_init"
ATTRS{cutype}=="1731/06", RUN+="ccw_init"
ATTRS{cutype}=="3088/01", RUN+="ccw_init"
ATTRS{cutype}=="3088/08", RUN+="ccw_init"
ATTRS{cutype}=="3088/60", RUN+="ccw_init"
ATTRS{cutype}=="3088/61", RUN+="ccw_init"
ATTRS{cutype}=="3088/1e", RUN+="ccw_init"
ATTRS{cutype}=="3088/1f", RUN+="ccw_init"
DRIVER=="ctcm|lcs|qeth", RUN+="ccw_init"
LABEL="ccw_end"

View File

@ -1,149 +0,0 @@
From 8723dbce048add87ce10fe8c72eea75c4f828ef8 Mon Sep 17 00:00:00 2001
From: Marc Hartmayer <mhartmay@linux.ibm.com>
Date: Wed, 23 Jun 2021 13:16:25 +0000
Subject: [PATCH] genprotimg: add OpenSSL 3.0 support
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Add OpenSSL 3.0 support while still supporting OpenSSL 1.1.0 and newer. For this
set the OPENSSL_API_COMPAT user defined macro to OpenSSL 1.1.0 (see
https://www.openssl.org/docs/manmaster/man7/OPENSSL_API_COMPAT.html) so we don't
see any deprecation warnings when using OpenSSL 3.0. In addition, add an
compatibility layer for OpenSSL since some OpenSSL API functions were constified
with OpenSSL 3.0.
Fixes: https://github.com/ibm-s390-linux/s390-tools/issues/112
Reviewed-by: Patrick Steuer <patrick.steuer@de.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
---
CHANGELOG.md | 1 +
genprotimg/src/Makefile | 1 +
genprotimg/src/utils/crypto.c | 15 ++++++------
genprotimg/src/utils/openssl_compat.h | 33 +++++++++++++++++++++++++++
4 files changed, 43 insertions(+), 7 deletions(-)
create mode 100644 genprotimg/src/utils/openssl_compat.h
diff --git a/genprotimg/src/Makefile b/genprotimg/src/Makefile
index a71bb1e3..0e811d66 100644
--- a/genprotimg/src/Makefile
+++ b/genprotimg/src/Makefile
@@ -29,6 +29,7 @@ $(bin_PROGRAM)_OBJS := $($(bin_PROGRAM)_SRCS:.c=.o)
ALL_CFLAGS += -std=gnu11 -DPKGDATADIR=$(PKGDATADIR) \
$(GLIB2_CFLAGS) $(LIBCRYPTO_CFLAGS) $(LIBCURL_CFLAGS) \
+ -DOPENSSL_API_COMPAT=0x10100000L \
$(WARNINGS) \
$(NULL)
ALL_CPPFLAGS += $(INCLUDE_PARMS)
diff --git a/genprotimg/src/utils/crypto.c b/genprotimg/src/utils/crypto.c
index 2e4750b8..087de375 100644
--- a/genprotimg/src/utils/crypto.c
+++ b/genprotimg/src/utils/crypto.c
@@ -31,6 +31,7 @@
#include "buffer.h"
#include "curl.h"
+#include "openssl_compat.h"
#include "crypto.h"
#define DEFINE_GSLIST_MAP(t2, t1) \
@@ -1438,7 +1439,7 @@ static const char *get_first_dp_url(DIST_POINT *dp)
return NULL;
}
-static gboolean insert_crl(X509_NAME *name, X509_CRL *crl)
+static gboolean insert_crl(const X509_NAME *name, X509_CRL *crl)
{
g_autofree gchar *key = NULL;
@@ -1453,7 +1454,7 @@ static gboolean insert_crl(X509_NAME *name, X509_CRL *crl)
}
/* Caller is responsible for free'ing */
-static X509_CRL *lookup_crl(X509_NAME *name)
+static X509_CRL *lookup_crl(const X509_NAME *name)
{
g_autoptr(X509_CRL) crl = NULL;
g_autofree gchar *key = NULL;
@@ -1473,7 +1474,7 @@ static X509_CRL *lookup_crl(X509_NAME *name)
}
/* Returns empty stack if no CRL downloaded. */
-static STACK_OF_X509_CRL *crls_download_cb(X509_STORE_CTX *ctx, X509_NAME *nm)
+static STACK_OF_X509_CRL *crls_download_cb(const X509_STORE_CTX *ctx, const X509_NAME *nm)
{
g_autoptr(STACK_OF_X509_CRL) crls = NULL;
g_autoptr(X509_CRL) crl = NULL;
@@ -1483,7 +1484,7 @@ static STACK_OF_X509_CRL *crls_download_cb(X509_STORE_CTX *ctx, X509_NAME *nm)
crls = sk_X509_CRL_new_null();
if (!crls)
g_abort();
- cert = X509_STORE_CTX_get_current_cert(ctx);
+ cert = Pv_X509_STORE_CTX_get_current_cert(ctx);
if (!cert)
return g_steal_pointer(&crls);
g_assert(X509_NAME_cmp(X509_get_issuer_name(cert), nm) == 0);
@@ -1527,19 +1528,19 @@ void STACK_OF_X509_CRL_free(STACK_OF_X509_CRL *stack)
/* Downloaded CRLs have a higher precedence than the CRLs specified on the
* command line.
*/
-static STACK_OF_X509_CRL *crls_cb(X509_STORE_CTX *ctx, X509_NAME *nm)
+static STACK_OF_X509_CRL *crls_cb(const X509_STORE_CTX *ctx, const X509_NAME *nm)
{
g_autoptr(STACK_OF_X509_CRL) crls = crls_download_cb(ctx, nm);
if (sk_X509_CRL_num(crls) > 0)
return g_steal_pointer(&crls);
- return X509_STORE_CTX_get1_crls(ctx, nm);
+ return Pv_X509_STORE_CTX_get1_crls(ctx, nm);
}
/* Set up CRL lookup with download support */
void store_setup_crl_download(X509_STORE *st)
{
- X509_STORE_set_lookup_crls(st, crls_cb);
+ Pv_X509_STORE_set_lookup_crls(st, crls_cb);
}
/* Download a CRL using the URI specified in the distribution @crldp */
diff --git a/genprotimg/src/utils/openssl_compat.h b/genprotimg/src/utils/openssl_compat.h
new file mode 100644
index 00000000..791c31fc
--- /dev/null
+++ b/genprotimg/src/utils/openssl_compat.h
@@ -0,0 +1,33 @@
+/*
+ * OpenSSL compatibility utils
+ *
+ * Copyright IBM Corp. 2021
+ *
+ * s390-tools is free software; you can redistribute it and/or modify
+ * it under the terms of the MIT license. See LICENSE for details.
+ */
+
+#ifndef PV_UTILS_OPENSSL_COMPAT_H
+#define PV_UTILS_OPENSSL_COMPAT_H
+
+#include <openssl/opensslv.h>
+#include <openssl/x509.h>
+#include <openssl/x509_vfy.h>
+
+#if OPENSSL_VERSION_NUMBER < 0x30000000L
+#define Pv_X509_STORE_CTX_get_current_cert(ctx) \
+ X509_STORE_CTX_get_current_cert((X509_STORE_CTX *)(ctx))
+#define Pv_X509_STORE_CTX_get1_crls(ctx, nm) \
+ X509_STORE_CTX_get1_crls((X509_STORE_CTX *)(ctx), (X509_NAME *)(nm))
+#define Pv_X509_STORE_set_lookup_crls(st, cb) \
+ X509_STORE_set_lookup_crls(st, (X509_STORE_CTX_lookup_crls_fn)(cb))
+#else
+#define Pv_X509_STORE_CTX_get_current_cert(ctx) \
+ X509_STORE_CTX_get_current_cert(ctx)
+#define Pv_X509_STORE_CTX_get1_crls(ctx, nm) \
+ X509_STORE_CTX_get1_crls(ctx, nm)
+#define Pv_X509_STORE_set_lookup_crls(st, cb) \
+ X509_STORE_set_lookup_crls(st, cb)
+#endif
+
+#endif

File diff suppressed because it is too large Load Diff

View File

@ -1,50 +0,0 @@
From 3f3f063c98278f53ad3b34e68b70fca62eaea8fb Mon Sep 17 00:00:00 2001
From: Ingo Franzki <ifranzki@linux.ibm.com>
Date: Tue, 23 Feb 2021 08:52:26 +0100
Subject: [PATCH] zkey: Fix build error when the compiler flags are overridden
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
When the compiler flags are overridden, the build of zkey may fail with:
kms.c:44:2: error: #error KMS_PLUGIN_LOCATION must be defined
44 | #error KMS_PLUGIN_LOCATION must be defined
| ^~~~~
The Makefile uses CFLAGS variable for defining the KMS_PLUGIN_LOCATION,
but it should rather use ALL_CFLAGS.
Also use ALL_CPPFLAGS for defining HAVE_LUKS2_SUPPORT.
Fixes: https://github.com/ibm-s390-linux/s390-tools/issues/108
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Jan Hoeppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
---
zkey/Makefile | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/zkey/Makefile b/zkey/Makefile
index 41129bcf..f74e2091 100644
--- a/zkey/Makefile
+++ b/zkey/Makefile
@@ -18,7 +18,7 @@ ifneq (${HAVE_CRYPTSETUP2},0)
ifneq (${HAVE_OPENSSL},0)
BUILD_TARGETS += zkey-cryptsetup
INSTALL_TARGETS += install-zkey-cryptsetup
- CPPFLAGS += -DHAVE_LUKS2_SUPPORT
+ ALL_CPPFLAGS += -DHAVE_LUKS2_SUPPORT
else
BUILD_TARGETS += zkey-cryptsetup-skip-openssl
INSTALL_TARGETS += zkey-cryptsetup-skip-openssl
@@ -34,7 +34,7 @@ endif
libs = $(rootdir)/libutil/libutil.a
-CFLAGS += -DKMS_PLUGIN_LOCATION=\"$(ZKEYKMSPLUGINDIR)\"
+ALL_CFLAGS += -DKMS_PLUGIN_LOCATION=\"$(ZKEYKMSPLUGINDIR)\"
detect-libcryptsetup.dep:
echo "#include <libcryptsetup.h>" > detect-libcryptsetup.dep

View File

@ -5,24 +5,22 @@
Name: s390utils
Summary: Utilities and daemons for IBM z Systems
Version: 2.16.0
Release: 6%{?dist}
Version: 2.17.0
Release: 1%{?dist}
Epoch: 2
License: MIT
ExclusiveArch: s390 s390x
#URL: http://www.ibm.com/developerworks/linux/linux390/s390-tools.html
URL: https://github.com/ibm-s390-tools/s390-tools
Source0: https://github.com/ibm-s390-tools/s390-tools/archive/v%{version}.tar.gz#/s390-tools-%{version}.tar.gz
Source5: zfcpconf.sh
Source7: zfcp.udev
# files for DASD initialization
Source12: dasd.udev
Source13: dasdconf.sh
Source14: device_cio_free
Source15: device_cio_free.service
Source16: ccw_init
Source17: ccw.udev
Source21: normalize_dasd_arg
URL: https://github.com/ibm-s390-linux/s390-tools
Source0: https://github.com/ibm-s390-linux/s390-tools/archive/v%{version}.tar.gz#/s390-tools-%{version}.tar.gz
Source5: https://fedorapeople.org/cgit/sharkcz/public_git/utils.git/tree/zfcpconf.sh
Source7: https://fedorapeople.org/cgit/sharkcz/public_git/utils.git/tree/zfcp.udev
Source12: https://fedorapeople.org/cgit/sharkcz/public_git/utils.git/tree/dasd.udev
Source13: https://fedorapeople.org/cgit/sharkcz/public_git/utils.git/tree/dasdconf.sh
Source14: https://fedorapeople.org/cgit/sharkcz/public_git/utils.git/tree/device_cio_free
Source15: https://fedorapeople.org/cgit/sharkcz/public_git/utils.git/tree/device_cio_free.service
Source16: https://fedorapeople.org/cgit/sharkcz/public_git/utils.git/tree/ccw_init
Source17: https://fedorapeople.org/cgit/sharkcz/public_git/utils.git/tree/ccw.udev
Source21: https://fedorapeople.org/cgit/sharkcz/public_git/utils.git/tree/normalize_dasd_arg
Source23: 20-zipl-kernel.install
Source24: 52-zipl-rescue.install
Source25: 91-zipl.install
@ -35,14 +33,6 @@ Source25: 91-zipl.install
Patch0: s390-tools-zipl-invert-script-options.patch
Patch1: s390-tools-zipl-blscfg-rpm-nvr-sort.patch
# upstream fixes
# https://github.com/ibm-s390-linux/s390-tools/commit/3f3f063c98278f53ad3b34e68b70fca62eaea8fb
Patch100: s390-tools-2.16.0-zkey.patch
# https://github.com/ibm-s390-linux/s390-tools/commit/b6bdd7744aba06d82f30b0c84012f0b06ccb01de
Patch101: s390-tools-2.16.0-genprotimg.patch
# https://github.com/ibm-s390-linux/s390-tools/commit/8723dbce048add87ce10fe8c72eea75c4f828ef8
Patch102: s390-tools-2.16.0-genprotimg-openssl3.patch
Requires: s390utils-core = %{epoch}:%{version}-%{release}
Requires: s390utils-base = %{epoch}:%{version}-%{release}
Requires: s390utils-osasnmpd = %{epoch}:%{version}-%{release}
@ -51,7 +41,7 @@ Requires: s390utils-mon_statd = %{epoch}:%{version}-%{release}
Requires: s390utils-iucvterm = %{epoch}:%{version}-%{release}
Requires: s390utils-ziomon = %{epoch}:%{version}-%{release}
BuildRequires: make
BuildRequires: make
BuildRequires: gcc-c++
%description
@ -69,11 +59,6 @@ be used together with the zSeries (s390) Linux kernel and device drivers.
%patch0 -p1 -b .zipl-invert-script-options
%patch1 -p1 -b .blscfg-rpm-nvr-sort
# upstream fixes
%patch100 -p1
%patch101 -p1
%patch102 -p1
# remove --strip from install
find . -name Makefile | xargs sed -i 's/$(INSTALL) -s/$(INSTALL)/g'
@ -81,6 +66,7 @@ find . -name Makefile | xargs sed -i 's/$(INSTALL) -s/$(INSTALL)/g'
%build
make \
CFLAGS="%{build_cflags}" CXXFLAGS="%{build_cflags}" LDFLAGS="%{build_ldflags}" \
NO_PIE_LDFLAGS="" \
BINDIR=/usr/sbin \
DISTRELEASE=%{release} \
V=1
@ -195,7 +181,7 @@ This package provides minimal set of tools needed to system to boot.
%{_sbindir}/fdasd
%{_sbindir}/lszdev
%{_sbindir}/zipl
%dir /lib/s390-tools/
%dir /lib/s390-tools
/lib/s390-tools/{zipl,chreipl}_helper.*
/lib/s390-tools/cpictl
/lib/s390-tools/stage3.bin
@ -252,6 +238,7 @@ Requires: gawk sed coreutils
Requires: sg3_utils
Requires: ethtool
Requires: tar
Requires: file
Requires: s390utils-core = %{epoch}:%{version}-%{release}
%{?systemd_requires}
BuildRequires: perl-generators
@ -261,6 +248,7 @@ BuildRequires: cryptsetup-devel >= 2.0.3
BuildRequires: json-c-devel
BuildRequires: rpm-devel
BuildRequires: glib2-devel
BuildRequires: libxml2-devel
%description base
@ -420,6 +408,7 @@ getent group zkeyadm > /dev/null || groupadd -r zkeyadm
%{_sbindir}/dasdstat
%{_sbindir}/dasdview
%{_sbindir}/dbginfo.sh
%{_sbindir}/hsavmcore
%{_sbindir}/hsci
%{_sbindir}/hyptop
%{_sbindir}/ip_watcher.pl
@ -427,6 +416,7 @@ getent group zkeyadm > /dev/null || groupadd -r zkeyadm
%{_sbindir}/lscpumf
%{_sbindir}/lscss
%{_sbindir}/lsdasd
%{_sbindir}/lshwc
%{_sbindir}/lsqeth
%{_sbindir}/lsluns
%{_sbindir}/lsreipl
@ -470,17 +460,23 @@ getent group zkeyadm > /dev/null || groupadd -r zkeyadm
/lib/s390-tools/zfcpdump/zfcpdump-initrd
/lib/s390-tools/znetcontrolunits
%{_libdir}/libekmfweb.so.*
%{_libdir}/libkmipclient.so.*
%dir %{_libdir}/zkey
%{_libdir}/zkey/zkey-ekmfweb.so
%{_libdir}/zkey/zkey-kmip.so
%{_mandir}/man1/dbginfo.sh.1*
%{_mandir}/man1/dump2tar.1*
%{_mandir}/man1/lscpumf.1*
%{_mandir}/man1/lshwc.1*
%{_mandir}/man1/vmconvert.1*
%{_mandir}/man1/zfcpdbf.1*
%{_mandir}/man1/zipl-switch-to-blscfg.1*
%{_mandir}/man1/zkey.1*
%{_mandir}/man1/zkey-cryptsetup.1*
%{_mandir}/man1/zkey-ekmfweb.1*
%{_mandir}/man1/zkey-kmip.1*
%{_mandir}/man4/prandom.4*
%{_mandir}/man5/hsavmcore.conf.5*
%{_mandir}/man8/chccwdev.8*
%{_mandir}/man8/chchp.8*
%{_mandir}/man8/chcpumf.8*
@ -490,6 +486,7 @@ getent group zkeyadm > /dev/null || groupadd -r zkeyadm
%{_mandir}/man8/dasdview.8*
%{_mandir}/man8/dumpconf.8*
%{_mandir}/man8/genprotimg.8.*
%{_mandir}/man8/hsavmcore.8*
%{_mandir}/man8/hsci.8*
%{_mandir}/man8/hyptop.8*
%{_mandir}/man8/lschp.8*
@ -518,10 +515,13 @@ getent group zkeyadm > /dev/null || groupadd -r zkeyadm
%{_mandir}/man8/zgetdump.8*
%{_mandir}/man8/znetconf.8*
%{_mandir}/man8/zpcictl.8*
%dir %{_datadir}/s390-tools/
%dir %{_datadir}/s390-tools
%{_datadir}/s390-tools/genprotimg/
%{_datadir}/s390-tools/netboot/
%dir %attr(0770,root,zkeyadm) %{_sysconfdir}/zkey
%dir %attr(0770,root,zkeyadm) %{_sysconfdir}/zkey/kmip
%dir %attr(0770,root,zkeyadm) %{_sysconfdir}/zkey/kmip/profiles
%config(noreplace) %attr(0660,root,zkeyadm)%{_sysconfdir}/zkey/kmip/profiles/*.profile
%dir %attr(0770,root,zkeyadm) %{_sysconfdir}/zkey/repository
%config(noreplace) %attr(0660,root,zkeyadm)%{_sysconfdir}/zkey/kms-plugins.conf
@ -815,10 +815,16 @@ User-space development files for the s390/s390x architecture.
%files devel
%{_includedir}/%{name}/
%{_includedir}/ekmfweb/
%{_includedir}/kmipclient/
%{_libdir}/libekmfweb.so
%{_libdir}/libkmipclient.so
%changelog
* Thu Jul 15 2021 Dan Horák <dan[at]danny.cz> - 2:2.17.0-1
- rebased to 2.17.0 (#1869554)
- Resolves: #1869554
* Wed Jul 07 2021 Dan Horák <dan[at]danny.cz> - 2:2.16.0-6
- update genprotimg for OpenSSL3 (#1964818)
- Related: #1964818

View File

@ -1 +1 @@
SHA512 (s390-tools-2.16.0.tar.gz) = d0866e2f372ba2938ccab264846d6cfe3db1b760cff6645fbefcd33a8ce8e7d971e442ccefda7e8e4d59818293147caa57fa593a3e66cd77e1e661928336793c
SHA512 (s390-tools-2.17.0.tar.gz) = 57d1c90e2a270c380fd7b4ac8efdd301299d9e8671a7ff10747557135b27a06e8124a49f50b8729b450550ced61599f392606bcbe5e499c5bd488b9e207945da

View File

@ -36,7 +36,7 @@ if [ -f "$CONFIG" ]; then
modprobe zfcp
fi
if [ ! -d /sys/bus/ccw/drivers/zfcp ]; then
return
exit 1
fi
sed 'y/ABCDEF/abcdef/' < $CONFIG | while read line; do
case $line in
@ -74,3 +74,4 @@ if [ -f "$CONFIG" ]; then
esac
done
fi
exit 0