From 364b054ff18d51f47d7b5e95f3127d249a1feffa Mon Sep 17 00:00:00 2001 From: CentOS Sources Date: Sep 27 2022 14:54:41 +0000 Subject: import opencryptoki-3.18.0-4.el9 --- diff --git a/.gitignore b/.gitignore index 088a728..e06708c 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1 @@ -SOURCES/opencryptoki-3.17.0.tar.gz +SOURCES/opencryptoki-3.18.0.tar.gz diff --git a/.opencryptoki.metadata b/.opencryptoki.metadata index 1ece19c..7ff8bfe 100644 --- a/.opencryptoki.metadata +++ b/.opencryptoki.metadata @@ -1 +1 @@ -598f43d2a04a878a4577f143251f4631625ac49b SOURCES/opencryptoki-3.17.0.tar.gz +257eb4d5458c52bf7c1634fea155bf217d561bd4 SOURCES/opencryptoki-3.18.0.tar.gz diff --git a/SOURCES/opencryptoki-3.17-libica4-8e9800b492f7a40ed5dfcd85e042701b6a5c5a26.patch b/SOURCES/opencryptoki-3.17-libica4-8e9800b492f7a40ed5dfcd85e042701b6a5c5a26.patch deleted file mode 100644 index 540ac76..0000000 --- a/SOURCES/opencryptoki-3.17-libica4-8e9800b492f7a40ed5dfcd85e042701b6a5c5a26.patch +++ /dev/null @@ -1,88 +0,0 @@ -commit 8e9800b492f7a40ed5dfcd85e042701b6a5c5a26 -Author: Ingo Franzki -Date: Tue Dec 7 16:39:28 2021 +0100 - - ICA/EP11: Support libica version 4 - - Try to load libica version 4 (libica.so.4), but fall back to version 3 - (libica.so.3) if version 4 is not available. - - Signed-off-by: Ingo Franzki - -diff --git a/usr/lib/ep11_stdll/ep11_specific.c b/usr/lib/ep11_stdll/ep11_specific.c -index 4029e5a5..f223017d 100644 ---- a/usr/lib/ep11_stdll/ep11_specific.c -+++ b/usr/lib/ep11_stdll/ep11_specific.c -@@ -68,7 +68,8 @@ - #define EP11SHAREDLIB_V2 "libep11.so.2" - #define EP11SHAREDLIB_V1 "libep11.so.1" - #define EP11SHAREDLIB "libep11.so" --#define ICASHAREDLIB "libica.so.3" -+#define ICASHAREDLIB_V4 "libica.so.4" -+#define ICASHAREDLIB_V3 "libica.so.3" - - CK_RV ep11tok_get_mechanism_list(STDLL_TokData_t * tokdata, - CK_MECHANISM_TYPE_PTR mlist, -@@ -2044,9 +2045,9 @@ static CK_RV make_wrapblob(STDLL_TokData_t * tokdata, CK_ATTRIBUTE * tmpl_in, - } - - #ifdef EP11_HSMSIM --#define DLOPEN_FLAGS RTLD_GLOBAL | RTLD_NOW | RTLD_DEEPBIND -+#define DLOPEN_FLAGS RTLD_NOW | RTLD_DEEPBIND - #else --#define DLOPEN_FLAGS RTLD_GLOBAL | RTLD_NOW -+#define DLOPEN_FLAGS RTLD_NOW - #endif - - static void *ep11_load_host_lib() -@@ -2209,12 +2210,16 @@ static CK_RV ep11tok_load_libica(STDLL_TokData_t *tokdata) - return CKR_OK; - - if (strcmp(ep11_data->digest_libica_path, "") == 0) { -- strcpy(ep11_data->digest_libica_path, ICASHAREDLIB); -+ strcpy(ep11_data->digest_libica_path, ICASHAREDLIB_V4); - default_libica = 1; -+ libica->library = dlopen(ep11_data->digest_libica_path, RTLD_NOW); -+ if (libica->library == NULL) { -+ strcpy(ep11_data->digest_libica_path, ICASHAREDLIB_V3); -+ libica->library = dlopen(ep11_data->digest_libica_path, RTLD_NOW); -+ } -+ } else { -+ libica->library = dlopen(ep11_data->digest_libica_path, RTLD_NOW); - } -- -- libica->library = dlopen(ep11_data->digest_libica_path, -- RTLD_GLOBAL | RTLD_NOW); - if (libica->library == NULL) { - errstr = dlerror(); - OCK_SYSLOG(default_libica ? LOG_WARNING : LOG_ERR, -diff --git a/usr/lib/ica_s390_stdll/ica_specific.c b/usr/lib/ica_s390_stdll/ica_specific.c -index fd18de42..c4fa9654 100644 ---- a/usr/lib/ica_s390_stdll/ica_specific.c -+++ b/usr/lib/ica_s390_stdll/ica_specific.c -@@ -83,7 +83,8 @@ const char label[] = "icatok"; - - static pthread_mutex_t rngmtx = PTHREAD_MUTEX_INITIALIZER; - --#define LIBICA_SHARED_LIB "libica.so.3" -+#define LIBICA_SHARED_LIB_V3 "libica.so.3" -+#define LIBICA_SHARED_LIB_V4 "libica.so.4" - #define BIND(dso, sym) do { \ - if (p_##sym == NULL) \ - *(void **)(&p_##sym) = dlsym(dso, #sym); \ -@@ -221,9 +222,13 @@ static CK_RV load_libica(void) - void *ibmca_dso = NULL; - - /* Load libica */ -- ibmca_dso = dlopen(LIBICA_SHARED_LIB, RTLD_NOW); -+ ibmca_dso = dlopen(LIBICA_SHARED_LIB_V4, RTLD_NOW); -+ if (ibmca_dso == NULL) -+ ibmca_dso = dlopen(LIBICA_SHARED_LIB_V3, RTLD_NOW); -+ - if (ibmca_dso == NULL) { -- TRACE_ERROR("%s: dlopen(%s) failed\n", __func__, LIBICA_SHARED_LIB); -+ TRACE_ERROR("%s: dlopen(%s or %s) failed: %s\n", __func__, -+ LIBICA_SHARED_LIB_V4, LIBICA_SHARED_LIB_V3, dlerror()); - return CKR_FUNCTION_FAILED; - } - diff --git a/SOURCES/opencryptoki-3.17.0-p11sak.patch b/SOURCES/opencryptoki-3.17.0-p11sak.patch deleted file mode 100644 index 62ccf2a..0000000 --- a/SOURCES/opencryptoki-3.17.0-p11sak.patch +++ /dev/null @@ -1,12 +0,0 @@ -diff -up opencryptoki-3.17.0/Makefile.am.me opencryptoki-3.17.0/Makefile.am ---- opencryptoki-3.17.0/Makefile.am.me 2021-11-09 09:45:49.032661898 +0100 -+++ opencryptoki-3.17.0/Makefile.am 2021-11-09 09:46:41.353400986 +0100 -@@ -76,7 +76,7 @@ if ENABLE_EP11TOK - endif - if ENABLE_P11SAK - test -f $(DESTDIR)$(sysconfdir)/opencryptoki || $(MKDIR_P) $(DESTDIR)$(sysconfdir)/opencryptoki || true -- test -f $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || $(INSTALL) -g pkcs11 -m 0640 $(srcdir)/usr/sbin/p11sak/p11sak_defined_attrs.conf $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || true -+ test -f $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || $(INSTALL) -m 0644 $(srcdir)/usr/sbin/p11sak/p11sak_defined_attrs.conf $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || true - endif - if ENABLE_ICATOK - cd $(DESTDIR)$(libdir)/opencryptoki/stdll && \ diff --git a/SOURCES/opencryptoki-3.17.0-unlock-globmutex-if-user-and-group-check-fail.patch b/SOURCES/opencryptoki-3.17.0-unlock-globmutex-if-user-and-group-check-fail.patch deleted file mode 100644 index dc8c70c..0000000 --- a/SOURCES/opencryptoki-3.17.0-unlock-globmutex-if-user-and-group-check-fail.patch +++ /dev/null @@ -1,12 +0,0 @@ -diff -up opencryptoki-3.17.0/usr/lib/api/api_interface.c.me opencryptoki-3.17.0/usr/lib/api/api_interface.c ---- opencryptoki-3.17.0/usr/lib/api/api_interface.c.me 2022-01-17 12:04:18.937010924 +0100 -+++ opencryptoki-3.17.0/usr/lib/api/api_interface.c 2022-01-17 12:04:54.020182038 +0100 -@@ -2869,7 +2869,7 @@ CK_RV C_Initialize(CK_VOID_PTR pVoid) - - rc = check_user_and_group(); - if (rc != CKR_OK) -- return rc; -+ goto done; - - if (!Anchor) { - Anchor = (API_Proc_Struct_t *) malloc(sizeof(API_Proc_Struct_t)); diff --git a/SOURCES/opencryptoki-3.18.0-fix-json-output.patch b/SOURCES/opencryptoki-3.18.0-fix-json-output.patch new file mode 100644 index 0000000..baa6ff7 --- /dev/null +++ b/SOURCES/opencryptoki-3.18.0-fix-json-output.patch @@ -0,0 +1,47 @@ +commit 1600eebb422ae2a733de3a0bd47464620e39ab0d +Author: Ingo Franzki +Date: Tue Jun 7 08:58:16 2022 +0200 + + pkcsstats: Fix JSON output in case of errors + + Produce correct JSON output, even if an error occurs during obtaining + of the statistics for a user. + + Signed-off-by: Ingo Franzki + +diff --git a/usr/sbin/pkcsstats/pkcsstats.c b/usr/sbin/pkcsstats/pkcsstats.c +index 8eb049dd..65d4833f 100644 +--- a/usr/sbin/pkcsstats/pkcsstats.c ++++ b/usr/sbin/pkcsstats/pkcsstats.c +@@ -789,7 +789,7 @@ int main(int argc, char **argv) + bool reset = false, reset_all = false; + bool delete = false, delete_all = false; + bool slot_id_specified = false; +- bool json = false; ++ bool json = false, json_started = false; + CK_SLOT_ID slot_id = 0; + void *dll = NULL; + CK_FUNCTION_LIST *func_list = NULL; +@@ -949,8 +949,11 @@ int main(int argc, char **argv) + goto done; + } + +- if (json && print_json_start() != 0) +- goto done; ++ if (json) { ++ if (print_json_start() != 0) ++ goto done; ++ json_started = true; ++ } + + dd.func_list = func_list; + dd.num_slots = num_slots; +@@ -972,7 +975,7 @@ int main(int argc, char **argv) + } + + done: +- if (rc == 0 && json) ++ if (json && json_started) + printf("\n\t]\n}\n"); + + if (slots != NULL) diff --git a/SOURCES/opencryptoki-3.18.0-p11sak.patch b/SOURCES/opencryptoki-3.18.0-p11sak.patch new file mode 100644 index 0000000..f8f9f1c --- /dev/null +++ b/SOURCES/opencryptoki-3.18.0-p11sak.patch @@ -0,0 +1,21 @@ +diff -up opencryptoki-3.18.0/Makefile.am.me opencryptoki-3.18.0/Makefile.am +--- opencryptoki-3.18.0/Makefile.am.me 2022-05-09 22:25:07.980238715 +0200 ++++ opencryptoki-3.18.0/Makefile.am 2022-05-09 22:25:29.292722755 +0200 +@@ -78,7 +78,7 @@ if ENABLE_EP11TOK + endif + if ENABLE_P11SAK + test -f $(DESTDIR)$(sysconfdir)/opencryptoki || $(MKDIR_P) $(DESTDIR)$(sysconfdir)/opencryptoki || true +- test -f $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || $(INSTALL) -g pkcs11 -m 0640 $(srcdir)/usr/sbin/p11sak/p11sak_defined_attrs.conf $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || true ++ test -f $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || $(INSTALL) -m 0640 $(srcdir)/usr/sbin/p11sak/p11sak_defined_attrs.conf $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || true + endif + if ENABLE_ICATOK + cd $(DESTDIR)$(libdir)/opencryptoki/stdll && \ +@@ -129,7 +129,7 @@ endif + if ENABLE_DAEMON + test -f $(DESTDIR)$(sysconfdir)/opencryptoki || $(MKDIR_P) $(DESTDIR)$(sysconfdir)/opencryptoki || true + test -f $(DESTDIR)$(sysconfdir)/opencryptoki/opencryptoki.conf || $(INSTALL) -m 644 $(srcdir)/usr/sbin/pkcsslotd/opencryptoki.conf $(DESTDIR)$(sysconfdir)/opencryptoki/opencryptoki.conf || true +- test -f $(DESTDIR)$(sysconfdir)/opencryptoki/strength.conf || $(INSTALL) -m 640 -o root -g pkcs11 -T $(srcdir)/doc/strength-example.conf $(DESTDIR)$(sysconfdir)/opencryptoki/strength.conf || true ++ test -f $(DESTDIR)$(sysconfdir)/opencryptoki/strength.conf || $(INSTALL) -m 640 -o root -T $(srcdir)/doc/strength-example.conf $(DESTDIR)$(sysconfdir)/opencryptoki/strength.conf || true + if ENABLE_SYSTEMD + mkdir -p $(DESTDIR)/usr/lib/tmpfiles.d + cp $(srcdir)/misc/tmpfiles.conf $(DESTDIR)/usr/lib/tmpfiles.d/opencryptoki.conf diff --git a/SOURCES/opencryptoki-3.18.0-returning_CKR_BUFFER_TOO_SMALL.patch b/SOURCES/opencryptoki-3.18.0-returning_CKR_BUFFER_TOO_SMALL.patch new file mode 100644 index 0000000..9dbbb74 --- /dev/null +++ b/SOURCES/opencryptoki-3.18.0-returning_CKR_BUFFER_TOO_SMALL.patch @@ -0,0 +1,32 @@ +commit b545050b338e46c29936a2748aab7200e69a5c91 +Author: Ingo Franzki +Date: Tue Jul 26 15:11:06 2022 +0200 + + EP11: Fix C_GetMechanismList returning CKR_BUFFER_TOO_SMALL + + For mixed card levels, the size query call and the call to obtain the + list may run on different cards. When the size query call runs on a + card with less mechanisms than the second call, will fail, but it + returns the larger larger number of mechanisms. + + The code already re-allocates the buffer for retrieving the mechanism + list, but does not return the larger number in pulCount. This will + lead to a CKR_BUFFER_TOO_SMALL when the application calls C_GetMechanismList + again to obtain the list of mechanisms, because the applications buffer + is too small. + + Signed-off-by: Ingo Franzki + +diff --git a/usr/lib/ep11_stdll/ep11_specific.c b/usr/lib/ep11_stdll/ep11_specific.c +index 8d796452..1629e664 100644 +--- a/usr/lib/ep11_stdll/ep11_specific.c ++++ b/usr/lib/ep11_stdll/ep11_specific.c +@@ -8977,6 +8977,8 @@ CK_RV ep11tok_get_mechanism_list(STDLL_TokData_t * tokdata, + if (rc != CKR_BUFFER_TOO_SMALL) + goto out; + } ++ /* counter was updated in case of CKR_BUFFER_TOO_SMALL */ ++ *pulCount = counter; + } while (rc == CKR_BUFFER_TOO_SMALL); + + for (i = 0; i < counter; i++) { diff --git a/SOURCES/opencryptoki-pkcsslotd-pidfile.patch b/SOURCES/opencryptoki-pkcsslotd-pidfile.patch deleted file mode 100644 index 92f7e3c..0000000 --- a/SOURCES/opencryptoki-pkcsslotd-pidfile.patch +++ /dev/null @@ -1,29 +0,0 @@ -diff -up opencryptoki-3.16.0/misc/pkcsslotd.service.in.me opencryptoki-3.16.0/misc/pkcsslotd.service.in ---- opencryptoki-3.16.0/misc/pkcsslotd.service.in.me 2021-06-25 09:25:11.464487847 +0200 -+++ opencryptoki-3.16.0/misc/pkcsslotd.service.in 2021-06-25 09:25:38.701225760 +0200 -@@ -4,7 +4,7 @@ After=local-fs.target - - [Service] - Type=forking --PIDFile=/var/run/pkcsslotd.pid -+PIDFile=/run/pkcsslotd.pid - ExecStart=@sbindir@/pkcsslotd - - [Install] -diff -up opencryptoki-3.16.0/usr/include/slotmgr.h.me opencryptoki-3.16.0/usr/include/slotmgr.h ---- opencryptoki-3.16.0/usr/include/slotmgr.h.me 2021-06-30 17:28:18.000594834 +0200 -+++ opencryptoki-3.16.0/usr/include/slotmgr.h 2021-06-30 17:28:38.920890278 +0200 -@@ -30,10 +30,10 @@ - #define TOK_PATH SBIN_PATH "/pkcsslotd" - #define OCK_API_LOCK_FILE LOCKDIR_PATH "/LCK..APIlock" - --#define PROC_SOCKET_FILE_PATH "/var/run/pkcsslotd.socket" --#define ADMIN_SOCKET_FILE_PATH "/var/run/pkcsslotd.admin.socket" -+#define PROC_SOCKET_FILE_PATH "/run/pkcsslotd.socket" -+#define ADMIN_SOCKET_FILE_PATH "/run/pkcsslotd.admin.socket" - --#define PID_FILE_PATH "/var/run/pkcsslotd.pid" -+#define PID_FILE_PATH "/run/pkcsslotd.pid" - #define OCK_CONFIG OCK_CONFDIR "/opencryptoki.conf" - - #ifndef CK_BOOL diff --git a/SPECS/opencryptoki.spec b/SPECS/opencryptoki.spec index b38b4c9..01846e7 100644 --- a/SPECS/opencryptoki.spec +++ b/SPECS/opencryptoki.spec @@ -1,7 +1,7 @@ Name: opencryptoki Summary: Implementation of the PKCS#11 (Cryptoki) specification v3.0 -Version: 3.17.0 -Release: 5%{?dist} +Version: 3.18.0 +Release: 4%{?dist} License: CPL URL: https://github.com/opencryptoki/opencryptoki Source0: https://github.com/opencryptoki/%{name}/archive/v%{version}/%{name}-%{version}.tar.gz @@ -9,15 +9,13 @@ Source0: https://github.com/opencryptoki/%{name}/archive/v%{version}/%{name}-%{ Patch0: opencryptoki-3.11.0-group.patch # bz#1373833, change tmpfiles snippets from /var/lock/* to /run/lock/* Patch1: opencryptoki-3.11.0-lockdir.patch -# add missing p11sak_defined_attrs.conf -Patch2: opencryptoki-3.17.0-p11sak.patch +# add missing p11sak_defined_attrs.conf, strength.conf +Patch2: opencryptoki-3.18.0-p11sak.patch # upstream patches -# PIDfile below legacy directory /var/run/ -Patch300: opencryptoki-pkcsslotd-pidfile.patch -Patch301: opencryptoki-3.17.0-unlock-globmutex-if-user-and-group-check-fail.patch -Patch302: opencryptoki-3.17-libica4-8e9800b492f7a40ed5dfcd85e042701b6a5c5a26.patch +Patch100: opencryptoki-3.18.0-fix-json-output.patch +Patch101: opencryptoki-3.18.0-returning_CKR_BUFFER_TOO_SMALL.patch -Requires(pre): coreutils +Requires(pre): coreutils diffutils Requires: (selinux-policy >= 34.1.8-1 if selinux-policy-targeted) BuildRequires: gcc BuildRequires: gcc-c++ @@ -203,12 +201,28 @@ configured with Enterprise PKCS#11 (EP11) firmware. %install %make_install CHGRP=/bin/true +%pre +# don't touch opencryptoki.conf even if it is unchanged due to new tokversion +# backup config file +%global cfile /etc/opencryptoki/opencryptoki.conf +%global csuffix .rpmsave.XyoP +if test $1 -gt 1 && test -f %{cfile} ; then + cp -p %{cfile} %{cfile}%{csuffix} +fi %pre libs getent group pkcs11 >/dev/null || groupadd -r pkcs11 exit 0 %post +# restore the config file from %pre +if test $1 -gt 1 && test -f %{cfile} ; then + if ( ! cmp -s %{cfile} %{cfile}%{csuffix} ) ; then + cp -p %{cfile} %{cfile}.rpmnew + fi + cp -p %{cfile}%{csuffix} %{cfile} && rm -f %{cfile}%{csuffix} +fi + %systemd_post pkcsslotd.service if test $1 -eq 1; then %tmpfiles_create %{name}.conf @@ -225,18 +239,24 @@ fi %doc ChangeLog FAQ README.md %doc doc/opencryptoki-howto.md %doc doc/README.token_data +%doc %{_docdir}/%{name}/*.conf %dir %{_sysconfdir}/%{name} %config(noreplace) %{_sysconfdir}/%{name}/%{name}.conf %attr(0640, root, pkcs11) %config(noreplace) %{_sysconfdir}/%{name}/p11sak_defined_attrs.conf +%attr(0640, root, pkcs11) %config(noreplace) %{_sysconfdir}/%{name}/strength.conf %{_tmpfilesdir}/%{name}.conf %{_unitdir}/pkcsslotd.service %{_sbindir}/p11sak %{_sbindir}/pkcstok_migrate %{_sbindir}/pkcsconf %{_sbindir}/pkcsslotd +%{_sbindir}/pkcsstats %{_mandir}/man1/p11sak.1* %{_mandir}/man1/pkcstok_migrate.1* %{_mandir}/man1/pkcsconf.1* +%{_mandir}/man1/pkcsstats.1* +%{_mandir}/man5/policy.conf.5* +%{_mandir}/man5/strength.conf.5* %{_mandir}/man5/%{name}.conf.5* %{_mandir}/man5/p11sak_defined_attrs.conf.5* %{_mandir}/man7/%{name}.7* @@ -320,8 +340,28 @@ fi %changelog +* Fri Jul 29 2022 Than Ngo - 3.18.0-4 +- Related: #2044179, do not touch opencryptoki.conf if it is in place already and even if it is unchanged + +* Tue Jun 07 2022 Than Ngo - 3.18.0-3 +- Related: #2044179, fix json output + +* Mon May 09 2022 Than Ngo - 3.18.0-2 +- Related: #2044179, add missing strength.conf + +* Mon May 09 2022 Than Ngo - 3.18.0-1 +- Resolves: #2044179, rebase to 3.18.0 +- Resolves: #2068091, pkcsconf -t failed with Segmentation fault in FIPS mode +- Resolves: #2066763, Dilithium support not available +- Resolves: #2064697, OpenSSL 3.0 Compatibility for IBM Security Libraries and Tools +- Resolves: #2044181, support crypto profiles +- Resolves: #2044180, add crypto counters + +* Tue May 03 2022 Than Ngo - 3.17.0-6 +- Resolves: #2066763, Dilithium support not available + * Mon Mar 14 2022 Than Ngo - 3.17.0-5 -- Related: #2015888, ICA/EP11: Support libica version 4 +- Resolves: #2064697, ICA/EP11: Support libica version 4 * Mon Jan 17 2022 Than Ngo - 3.17.0-4 - Resolves: #2040678, API: Unlock GlobMutex if user and group check fails