rpms
/
softhsm
7
0
Fork 0
Code Issues Pull Requests Releases Activity

import softhsm-2.6.0-3.module+el8.3.0+6909+fb33717d

This commit is contained in:
CentOS Sources 2020-11-03 06:54:29 -05:00 committed by Andrew Lukoshko
parent 08cf6c7206
commit 97ec75a434
8 changed files with 106 additions and 5265 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.gitignore vendored
View File

@ -1 +1 @@
SOURCES/softhsm-2.4.0.tar.gz
SOURCES/softhsm-2.6.0.tar.gz

2
.softhsm.metadata
View File

@ -1 +1 @@
398502be47a21deb7d10f259a7fc89a357d52ecd SOURCES/softhsm-2.4.0.tar.gz
da4220189c358741a42a63442561ec07996badaf SOURCES/softhsm-2.6.0.tar.gz

72
SOURCES/softhsm-2.3.0-reset-mutex-callbacks.patch
View File

@ -1,72 +0,0 @@
From 16f994e7944a917fa81c8db11c56c594f4e78b40 Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Tue, 31 Jul 2018 14:59:03 +0300
Subject: [PATCH] Reset mutex callbacks to the default version when finished
If a PKCS11 API caller provided own mutex handling callbacks,
we need to ensure they aren't used after C_Finalize is called
and SoftHSM instance is recycled.
Inability to do so may lead to a situation where callbacks might
be provided by a different dynamically loaded object which is removed
after C_Finalize() call. Thus, callback pointers become invalid and
calling them leads to crashes.
Fixes: https://github.com/opendnssec/SoftHSMv2/issues/408
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
---
src/lib/SoftHSM.cpp | 16 ++++++++++++----
1 file changed, 12 insertions(+), 4 deletions(-)
diff --git a/src/lib/SoftHSM.cpp b/src/lib/SoftHSM.cpp
index ee94d3f..e4cc044 100644
--- a/src/lib/SoftHSM.cpp
+++ b/src/lib/SoftHSM.cpp
@@ -314,6 +314,15 @@ static CK_ATTRIBUTE bsAttribute(CK_ATTRIBUTE_TYPE type, const ByteString &value)
/*****************************************************************************
Implementation of SoftHSM class specific functions
*****************************************************************************/
+static void resetMutexFactoryCallbacks()
+{
+ // Reset MutexFactory callbacks to our versions
+ MutexFactory::i()->setCreateMutex(OSCreateMutex);
+ MutexFactory::i()->setDestroyMutex(OSDestroyMutex);
+ MutexFactory::i()->setLockMutex(OSLockMutex);
+ MutexFactory::i()->setUnlockMutex(OSUnlockMutex);
+}
+
// Return the one-and-only instance
SoftHSM* SoftHSM::i()
@@ -342,6 +351,7 @@ SoftHSM::SoftHSM()
slotManager = NULL;
sessionManager = NULL;
handleManager = NULL;
+ resetMutexFactoryCallbacks();
}
// Destructor
@@ -352,6 +362,7 @@ SoftHSM::~SoftHSM()
if (slotManager != NULL) delete slotManager;
if (objectStore != NULL) delete objectStore;
if (sessionObjectStore != NULL) delete sessionObjectStore;
+ resetMutexFactoryCallbacks();
}
/*****************************************************************************
@@ -402,10 +413,7 @@ CK_RV SoftHSM::C_Initialize(CK_VOID_PTR pInitArgs)
if (args->flags & CKF_OS_LOCKING_OK)
{
// Use our own mutex functions.
- MutexFactory::i()->setCreateMutex(OSCreateMutex);
- MutexFactory::i()->setDestroyMutex(OSDestroyMutex);
- MutexFactory::i()->setLockMutex(OSLockMutex);
- MutexFactory::i()->setUnlockMutex(OSUnlockMutex);
+ resetMutexFactoryCallbacks();
MutexFactory::i()->enable();
}
else
--
2.17.1

5181
SOURCES/softhsm-2.4.0-use-p11-kit-headers.patch
View File

File diff suppressed because it is too large Load Diff

BIN
SOURCES/softhsm-2.4.0.tar.gz.sig
View File

Binary file not shown.

BIN
SOURCES/softhsm-2.6.0.tar.gz.sig Normal file
View File

Binary file not shown.

72
SOURCES/softhsm-2.6.1-rh1834909-exit.patch Normal file
View File

@ -0,0 +1,72 @@
diff --git a/src/lib/crypto/OSSLCryptoFactory.cpp b/src/lib/crypto/OSSLCryptoFactory.cpp
index 32daca2..ace4bcb 100644
--- a/src/lib/crypto/OSSLCryptoFactory.cpp
+++ b/src/lib/crypto/OSSLCryptoFactory.cpp
@@ -226,31 +226,49 @@ err:
// Destructor
OSSLCryptoFactory::~OSSLCryptoFactory()
{
-#ifdef WITH_GOST
- // Finish the GOST engine
- if (eg != NULL)
+ bool ossl_shutdown = false;
+
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
+ // OpenSSL 1.1.0+ will register an atexit() handler to run
+ // OPENSSL_cleanup(). If that has already happened we must
+ // not attempt to free any ENGINEs because they'll already
+ // have been destroyed and the use-after-free would cause
+ // a deadlock or crash.
+ //
+ // Detect that situation because reinitialisation will fail
+ // after OPENSSL_cleanup() has run.
+ (void)ERR_set_mark();
+ ossl_shutdown = !OPENSSL_init_crypto(OPENSSL_INIT_ENGINE_RDRAND, NULL);
+ (void)ERR_pop_to_mark();
+#endif
+ if (!ossl_shutdown)
{
- ENGINE_finish(eg);
- ENGINE_free(eg);
- eg = NULL;
- }
+#ifdef WITH_GOST
+ // Finish the GOST engine
+ if (eg != NULL)
+ {
+ ENGINE_finish(eg);
+ ENGINE_free(eg);
+ eg = NULL;
+ }
#endif
- // Finish the rd_rand engine
- ENGINE_finish(rdrand_engine);
- ENGINE_free(rdrand_engine);
- rdrand_engine = NULL;
+ // Finish the rd_rand engine
+ ENGINE_finish(rdrand_engine);
+ ENGINE_free(rdrand_engine);
+ rdrand_engine = NULL;
+ // Recycle locks
+#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
+ if (setLockingCallback)
+ {
+ CRYPTO_set_locking_callback(NULL);
+ }
+#endif
+ }
// Destroy the one-and-only RNG
delete rng;
- // Recycle locks
-#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
- if (setLockingCallback)
- {
- CRYPTO_set_locking_callback(NULL);
- }
-#endif
for (unsigned i = 0; i < nlocks; i++)
{
MutexFactory::i()->recycleMutex(locks[i]);

42
SPECS/softhsm.spec
View File

@ -2,15 +2,14 @@
Summary: Software version of a PKCS#11 Hardware Security Module
Name: softhsm
Version: 2.4.0
Release: %{?prever:0.}2%{?prever:.%{prever}}%{?dist}
Version: 2.6.0
Release: %{?prever:0.}3%{?prever:.%{prever}}%{?dist}
License: BSD
Url: http://www.opendnssec.org/
Source: http://dist.opendnssec.org/source/%{?prever:testing/}%{name}-%{version}.tar.gz
Source1: http://dist.opendnssec.org/source/%{?prever:testing/}%{name}-%{version}.tar.gz.sig
Patch1: softhsm-2.3.0-reset-mutex-callbacks.patch
Patch2: softhsm-2.4.0-use-p11-kit-headers.patch
Patch1: softhsm-2.6.1-rh1834909-exit.patch
Group: Applications/System
BuildRequires: openssl-devel >= 1.0.1k-6, sqlite-devel >= 3.4.2, cppunit-devel
@ -43,13 +42,7 @@ The devel package contains the libsofthsm include files
%prep
%setup -q -n %{name}-%{version}%{?prever}
%patch1 -p1
%patch2 -p1
%if 0%{?prever:1}
autoreconf -fiv
%endif
# remove softhsm/ subdir auto-added to --libdir
sed -i "s:full_libdir/softhsm:full_libdir:g" configure
@ -58,6 +51,16 @@ sed -i 's:^full_libdir=":#full_libdir=":g' configure.ac
%endif
sed -i "s:libdir)/@PACKAGE@:libdir):" Makefile.in
sed -i 's:$full_libdir/libsofthsm2\.so:libsofthsm2\.so:g' configure
%if 0%{?prever:1}
sed -i 's:$full_libdir/libsofthsm2\.so:libsofthsm2\.so:g' configure.ac
%endif
%if 0%{?prever:1}
autoreconf -fiv
%endif
%build
%configure --libdir=%{_libdir}/pkcs11 --with-openssl=%{_prefix} --enable-ecc --disable-gost \
--with-migrate --enable-visibility --with-p11-kit=%{_datadir}/p11-kit/modules/
@ -118,6 +121,25 @@ if [ -f /var/softhsm/slot0.db ]; then
fi
%changelog
* Thu Jun 04 2020 Alexander Bokovoy <abokovoy@redhat.com> - 2.6.0-3
- Fixes: rhbz#1834909 - softhsm use-after-free on process exit
- Synchronize the final fix with Fedora
* Thu May 14 2020 Paul Wouters <pwouters@redhat.com> - 2.6.0-2
- Fixes: rhbz#1834909 - softhsm use-after-free on process exit
* Wed Apr 01 2020 Alexander Bokovoy <abokovoy@redhat.com> - 2.6.0-1
- Fixes: rhbz#1818877 - rebase to softhsm 2.6.0+
- Fixes: rhbz#1701233 - support setting supported signature methods on the token
* Mon Feb 17 2020 Alexander Bokovoy <abokovoy@redhat.com> - 2.4.0-4
- Provide specific version libsofthsm2.so for p11-kit
- Fixes: rhbz#1727065
* Tue Feb 11 2020 Alexander Bokovoy <abokovoy@redhat.com> - 2.4.0-3
- Remove architecture-specific path from softhsm2.module definition
- Fixes: rhbz#1727065
* Fri Aug 17 2018 Alexander Bokovoy <abokovoy@redhat.com> - 2.4.0-2
- Replace PKCS11 headers by a more liberal version from p11-kit
- Fixes: rhbz#1615766