diff --git a/.fmf/version b/.fmf/version deleted file mode 100644 index d00491f..0000000 --- a/.fmf/version +++ /dev/null @@ -1 +0,0 @@ -1 diff --git a/changelog b/changelog deleted file mode 100644 index ce71afd..0000000 --- a/changelog +++ /dev/null @@ -1,247 +0,0 @@ -* Sat Aug 13 2022 Ondrej Mosnáček - 1.4.0-2 -- Switch to rpmautospec - -* Sat Aug 13 2022 Ondrej Mosnáček - 1.4.0-1 -- Update to upstream version 1.4.0 -- Re-enable cppcheck scanning on Fedora -- Resolves: rhbz#2056732 - -* Thu Jul 21 2022 Fedora Release Engineering - 1.3.1-5 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - -* Thu Jan 20 2022 Fedora Release Engineering - 1.3.1-4 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - -* Thu Jul 22 2021 Fedora Release Engineering - 1.3.1-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - -* Wed Jul 14 2021 Simo Sorce - 1.3.1-2 -- Remove LTO build suppression by using better symver machinery - -* Wed Jul 14 2021 Simo Sorce - 1.3.1-1 -- Update to upstream version 1.3.1 which fixes ABI issues - -* Mon Jul 12 2021 Simo Sorce - 1.3.0-1 -- Update to upstream version 1.3.0 - -* Mon Mar 15 2021 Sahana Prasad - 1.2.1-1 -- Update to upstream version 1.2.1 -- Remove patch fix MSG_MORE uasge as it is added upstream -- Remove cppcheck dependency for rhel bz#1931518 -- Add a patch to fix fuzz tests - -* Tue Jan 26 2021 Fedora Release Engineering - 1.2.0-4 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - -* Fri Aug 14 2020 Ondrej Mosnáček - 1.2.0-3 -- Require perl-interpreter instead of full perl -- Backport fix for 5.9 kernels - -* Tue Jul 28 2020 Fedora Release Engineering - 1.2.0-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - -* Mon May 25 2020 Sahana Prasad - 1.2.0-1 -- Update to upstream version 1.2.0 tracked by BZ 1839592. -- Enable kcapi-enc tests as libkcapi BZ 1826022 is fixed. -- Remove 110-fipshmac-compat.patch as the changes are merged upstream. -- Remove 100-workaround-cppcheck-bug.patch as the changes are merged upstream. - -* Tue May 05 2020 Ondrej Mosnáček - 1.1.5-5 -- Fix the CI test failures -- Enable building on old kernels -- Avoid conflicts between different versions of packages - -* Thu Apr 23 2020 Tomáš Mráz - 1.1.5-4 -- Add . prefix to files created by fipshmac if -d option is not specified - -* Wed Apr 22 2020 Sahana Prasad - 1.1.5-3 -- Disables kcapi-enc tests until the kernel bug bz 1826022 is fixed. -- Produce also the fipscheck replacement package - -* Wed Jan 29 2020 Fedora Release Engineering - 1.1.5-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - -* Tue Aug 13 2019 Ondrej Mosnáček - 1.1.5-1 -- Update to upstream version 1.1.5 - -* Sat Jul 27 2019 Ondrej Mosnáček - 1.1.4-6 -- Backport patch to fix test failure on aarch64 -- Remove no longer needed ppc64 workaround - -* Sat Jul 27 2019 Ondrej Mosnáček - 1.1.4-5 -- Backport patch to fix tests - -* Thu Jul 25 2019 Ondrej Mosnáček - 1.1.4-4 -- Work around cppcheck issue -- Enable gating - -* Thu Jul 25 2019 Fedora Release Engineering - 1.1.4-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild - -* Mon May 27 2019 Ondrej Mosnáček - 1.1.4-2 -- Fix FTBFS: hardlink is now in bindir - -* Sat Feb 02 2019 Ondrej Mosnáček - 1.1.4-1 -- Update to upstream version 1.1.4 - -* Fri Feb 01 2019 Ondrej Mosnáček - 1.1.3-3 -- Fix build with new GCC - -* Fri Feb 01 2019 Fedora Release Engineering - 1.1.3-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild - -* Thu Aug 23 2018 Ondrej Mosnáček - 1.1.3-1 -- Update to upstream version 1.1.3 - -* Thu Aug 09 2018 Ondrej Mosnáček - 1.1.1-16 -- Add missing dependencies to the tests package -- Update patch from upstream - -* Thu Aug 09 2018 Ondrej Mosnáček - 1.1.1-15 -- Build and tests require perl - -* Thu Aug 09 2018 Ondrej Mosnáček - 1.1.1-14 -- Add missing script to the 'tests' package - -* Wed Aug 08 2018 Ondrej Mosnáček - 1.1.1-13 -- Add missing requires to the 'tests' subpackage - -* Tue Aug 07 2018 Ondrej Mosnáček - 1.1.1-12 -- Produce a subpackage with test scripts -- Build the 'tests' subpackage conditionally - -* Wed Aug 01 2018 Ondrej Mosnáček - 1.1.1-11 -- Add patch to fix unwanted closing of FD 0 - -* Tue Jul 31 2018 Ondrej Mosnáček - 1.1.1-10 -- Remove the kernel headers workaround - -* Fri Jul 27 2018 Igor Gnatenko - 1.1.1-9 -- Rebuild for new binutils - -* Fri Jul 27 2018 Ondrej Mosnáček - 1.1.1-8 -- Add more Coverity fixes from upstream -- Add patch to fix AEAD fuzz test for BE arches -- Fixup specfile - -* Mon Jul 23 2018 Ondrej Mosnáček - 1.1.1-7 -- Add various fixes from upstream -- Drop the Requires on kernel package - -* Mon Jul 16 2018 Ondrej Mosnáček - 1.1.1-6 -- Put .hmac files into a separate directory - -* Fri Jul 13 2018 Fedora Release Engineering - 1.1.1-5 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild - -* Thu Jul 12 2018 Ondrej Mosnáček - 1.1.1-4 -- Add patch to work around FTBFS on rawhide - -* Wed Jul 11 2018 Ondrej Mosnáček - 1.1.1-3 -- Fix off-by-one error in checkfile parsing - -* Wed Jul 11 2018 Ondrej Mosnáček - 1.1.1-2 -- Fix command-line parsing in libkcapi-hmaccalc - -* Mon Jun 18 2018 Ondrej Mosnáček - 1.1.1-1 -- Update to upstream version 1.1.1 - -* Wed May 09 2018 Ondrej Mosnáček - 1.1.0-5 -- Skip CLang static analysis in RHEL -- Revert "Skip CLang static analysis in RHEL" -- Use own sha512hmac and fipscheck - -* Wed May 02 2018 Ondrej Mosnáček - 1.1.0-4 -- Fix description lines being too long - -* Fri Apr 27 2018 Björn Esser - 1.1.0-3 -- Fix conditional for hmaccalc replacement - -* Mon Apr 16 2018 Ondrej Mosnáček - 1.1.0-2 -- Enable hmaccalc replacements in Fedora 28+ - -* Thu Apr 12 2018 Ondrej Mosnáček - 1.1.0-1 -- Update to upstream version 1.1.0 - -* Sat Mar 31 2018 Björn Esser - 1.0.3-10 -- Replace single patches with a monolitic one from upstream -- Obsolete replacements subpackage -- Ignore failing tests on %%{power64} temporarily - -* Thu Mar 08 2018 Ondrej Mosnáček - 1.0.3-9 -- Split up the replacements subpackage - -* Mon Feb 26 2018 Björn Esser - 1.0.3-8 -- Increase optmem_max preset to 81920 - -* Mon Feb 26 2018 Björn Esser - 1.0.3-7 -- Obsoletes work by package name, not by provides (rhbz#1537225) - -* Sun Feb 25 2018 Björn Esser - 1.0.3-6 -- Add patch to fix a copy-paste typo - -* Sat Feb 17 2018 Björn Esser - 1.0.3-5 -- Add patch to fix build with -Werror - -* Wed Feb 07 2018 Fedora Release Engineering -- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild - -* Sun Feb 04 2018 Björn Esser - 1.0.3-3 -- Switch to %%ldconfig_scriptlets - -* Wed Jan 17 2018 Björn Esser - 1.0.3-2 -- Decrease optmem_max preset to 40960 -- Let the build fail, if the minimum kernel version cannot be met -- Conditionalize the sysctl.d tweak on version of the kernel -- Conditionalize the name of README.distro on the distro - -* Tue Jan 16 2018 Björn Esser - 1.0.3-1 -- Initial import (rhbz#1533929) - -* Tue Jan 16 2018 Björn Esser - 1.0.3-0.13 -- Increase optmem_max preset to 81920 - -* Tue Jan 16 2018 Björn Esser - 1.0.3-0.12 -- Add sysctl.d preset and README.fedora - -* Mon Jan 15 2018 Björn Esser - 1.0.3-0.11 -- Make the contents of the -replacements package configurable - -* Mon Jan 15 2018 Björn Esser - 1.0.3-0.10 -- Fix Obsoletes of the -replacements package - -* Sun Jan 14 2018 Björn Esser - 1.0.3-0.9 -- Disable the -replacements package until we have a plan for it - -* Sun Jan 14 2018 Björn Esser - 1.0.3-0.8 -- Move the kcapi-hasher binary to -replacements package, since it is - not of much use without the linked invocation names and saves the - extra Requires on the -tools package - -* Sun Jan 14 2018 Björn Esser - 1.0.3-0.7 -- Fix internal Requires of sub-packages -- Hardlink files in %%{_bindir} - -* Sun Jan 14 2018 Björn Esser - 1.0.3-0.6 -- Add patches from upstream - -* Sat Jan 13 2018 Björn Esser - 1.0.3-0.5 -- Add patches from upstream - -* Sat Jan 13 2018 Björn Esser - 1.0.3-0.4 -- Asume the testsuite cannot be run, if the value of optmem_max cannot - be obtained - -* Sat Jan 13 2018 Björn Esser - 1.0.3-0.3 -- Move libraries to /%%{_lib} instead of %%{_libdir}, which is useful - during boot when the library might be needed before a potentially - seperate /usr partition is mounted - -* Sat Jan 13 2018 Björn Esser - 1.0.3-0.2 -- Asume optmem_max is at least 20480, if the real value cannot be obtained - -* Fri Jan 12 2018 Björn Esser - 1.0.3-0.1 -- New upstream release - -* Wed Jan 10 2018 Björn Esser - 1.0.2-0.1 -- Initial rpm release (rhbz#1533929) diff --git a/fipshmac-openssl.sh b/fipshmac-openssl.sh deleted file mode 100644 index c554434..0000000 --- a/fipshmac-openssl.sh +++ /dev/null @@ -1,9 +0,0 @@ -#!/bin/bash - -# Mocks fipshmac using the openssl tool. -# Only for use during RPM build. - -[ "$1" = '-d' ] || exit 1 - -openssl sha256 -hmac orboDeJITITejsirpADONivirpUkvarP -hex "$3" | cut -f 2 -d ' ' \ - >"$2/$(basename "$3").hmac" diff --git a/gating.yaml b/gating.yaml deleted file mode 100644 index c2182c7..0000000 --- a/gating.yaml +++ /dev/null @@ -1,6 +0,0 @@ ---- !Policy -product_versions: - - fedora-* -decision_context: bodhi_update_push_stable -rules: - - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional} diff --git a/libkcapi-1.1.0-kcapi-hasher_Allow_picking_basename_via_cmdline.patch b/libkcapi-1.1.0-kcapi-hasher_Allow_picking_basename_via_cmdline.patch new file mode 100644 index 0000000..cc33cd6 --- /dev/null +++ b/libkcapi-1.1.0-kcapi-hasher_Allow_picking_basename_via_cmdline.patch @@ -0,0 +1,341 @@ +From 4986c2c95422f97ca0f8db94ce422a01f9a9fa5e Mon Sep 17 00:00:00 2001 +From: Ondrej Mosnacek +Date: Thu, 24 May 2018 08:28:02 +0200 +Subject: [PATCH] kcapi-hasher: Allow picking basename via cmdline + +This makes it possible to run the kcapi-hasher binary directly when +needed (even via the libtool wrapper) and to simplify the hasher tests. +--- + apps/kcapi-hasher.c | 22 ++++++++--- + test/hasher-test.sh | 108 +++++++++++++++++++--------------------------------- + 2 files changed, 57 insertions(+), 73 deletions(-) + +diff --git a/apps/kcapi-hasher.c b/apps/kcapi-hasher.c +index 9a5d2ee..ae88211 100644 +--- a/apps/kcapi-hasher.c ++++ b/apps/kcapi-hasher.c +@@ -117,14 +117,15 @@ static void usage(char *name, int fipscheck) + const char *base = basename(name); + fprintf(stderr, "\n%s - calculation of hash sum (Using Linux Kernel Crypto API)\n", basename(name)); + fprintf(stderr, "\nUsage:\n"); +- fprintf(stderr, "\t%s [OPTION]... -S|-L\n", base); ++ fprintf(stderr, "\t%s [-n BASENAME] [OPTION]... -S|-L\n", base); + if (fipscheck) +- fprintf(stderr, "\t%s [OPTION]... FILE\n", base); ++ fprintf(stderr, "\t%s [-n BASENAME] [OPTION]... FILE\n", base); + else { +- fprintf(stderr, "\t%s [OPTION]... -c FILE\n", base); +- fprintf(stderr, "\t%s [OPTION]... FILE...\n", base); ++ fprintf(stderr, "\t%s [-n BASENAME] [OPTION]... -c FILE\n", base); ++ fprintf(stderr, "\t%s [-n BASENAME] [OPTION]... FILE...\n", base); + } + fprintf(stderr, "\nOptions:\n"); ++ fprintf(stderr, "\t-n --name\t\tForce given application name (sha512hmac/...)\n"); + fprintf(stderr, "\t-S --self-sum\t\tPrint checksum of this binary and exit\n"); + fprintf(stderr, "\t-L --self-sum-lib\tPrint checksum of the libkcapi library and exit\n"); + if (!fipscheck) +@@ -781,12 +782,19 @@ int main(int argc, char *argv[]) + const char *targetfile = NULL; + uint8_t *hmackey_alloc = NULL; + uint8_t *hmackey_mmap = NULL; ++ int opt_index = 0; + int loglevel = 0; + int hmac = 0; + int fipscheck = 0; + int fipshmac = 0; + int selfcheck_mode = SELFCHECK_CHECK; + ++ static const char *opts_name_short = "n:"; ++ static const struct option opts_name[] = { ++ {"name", 1, 0, 'n'}, ++ {0, 0, 0, 0} ++ }; ++ + static const char *opts_short = "c:uh:t:SLqk:K:vbd:P"; + static const struct option opts[] = { + {"help", 0, 0, 0}, +@@ -833,6 +841,11 @@ int main(int argc, char *argv[]) + } + basen = basename(basec); + ++ if (getopt_long(argc, argv, opts_name_short, opts_name, &opt_index) == 'n') ++ basen = optarg; ++ else ++ opt_index = 0; ++ + params_self = &PARAMS_SELF_FIPSCHECK; + if (0 == strncmp(basen, "sha256sum", 9)) { + names = NAMES_SHA256; +@@ -888,7 +901,6 @@ int main(int argc, char *argv[]) + } + + while (1) { +- int opt_index = 0; + int c = getopt_long(argc, argv, opts_short, opts, &opt_index); + + if (-1 == c) +diff --git a/test/hasher-test.sh b/test/hasher-test.sh +index 28c6b5a..f36897b 100755 +--- a/test/hasher-test.sh ++++ b/test/hasher-test.sh +@@ -22,15 +22,18 @@ + + HASHERBIN="${APPDIR}/kcapi-hasher" + find_platform $HASHERBIN +-HASHERBIN=$(get_binlocation $HASHERBIN) + +-SUMHASHER="${TMPDIR}/md5sum ${TMPDIR}/sha1sum ${TMPDIR}/sha256sum ${TMPDIR}/sha384sum ${TMPDIR}/sha512sum" +-HMACHASHER="${TMPDIR}/sha1hmac ${TMPDIR}/sha256hmac ${TMPDIR}/sha384hmac ${TMPDIR}/sha512hmac" ++function run_hasher() { ++ "$HASHERBIN" -n "$@" ++} ++ ++SUMHASHER="md5sum sha1sum sha256sum sha384sum sha512sum" ++HMACHASHER="sha1hmac sha256hmac sha384hmac sha512hmac" + CHKFILE="${TMPDIR}/chk.$$" + ANOTHER="${TMPDIR}/test.$$" + + touch $ANOTHER +-trap "rm -f $ANOTHER $CHKFILE $SUMHASHER $HMACHASHER" 0 1 2 3 15 ++trap "rm -f $ANOTHER $CHKFILE" 0 1 2 3 15 + + if [ ! -e $HASHERBIN ] + then +@@ -38,20 +41,10 @@ then + exit 1 + fi + +-#although a hard link suffices, we need to copy it +-for i in $SUMHASHER $HMACHASHER +-do +- #ln $HASHERBIN $i +- cp -f $HASHERBIN $i +-done +- +-libdir=$(dirname $(realpath ../.libs/libkcapi.so)) +-libname=$(realpath ../.libs/libkcapi.so) +- + for hasher in $SUMHASHER $HMACHASHER + do + >$CHKFILE +- LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname $hasher -c $CHKFILE ++ run_hasher $hasher -c $CHKFILE + if [ $? -eq 0 ] + then + echo_fail "Verification of empty checker file with hasher $hasher did not fail" +@@ -60,7 +53,7 @@ do + fi + + echo >$CHKFILE +- LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname $hasher -c $CHKFILE ++ run_hasher $hasher -c $CHKFILE + if [ $? -eq 0 ] + then + echo_fail "Verification of empty line checker file with hasher $hasher did not fail" +@@ -68,9 +61,8 @@ do + echo_pass "Failure on empty line checker file for $hasher" + fi + +- LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname $hasher $0 $ANOTHER | \ +- sed -E 's/(\w+\s)\s/\1*/' >$CHKFILE +- LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname $hasher -q -c $CHKFILE ++ run_hasher $hasher $0 $ANOTHER | sed -E 's/(\w+\s)\s/\1*/' >$CHKFILE ++ run_hasher $hasher -q -c $CHKFILE + if [ $? -eq 0 ] + then + echo_pass "Parsing checker file with asterisk with $hasher" +@@ -78,8 +70,7 @@ do + echo_fail "Parsing checker file with asterisk (binary mode) with $hasher failed" + fi + +- LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname $hasher $0 $ANOTHER | \ +- LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname $hasher -q -c - ++ run_hasher $hasher $0 $ANOTHER | run_hasher $hasher -q -c - + if [ $? -eq 0 ] + then + echo_pass "Checker file '-' interpretation with $hasher" +@@ -87,7 +78,7 @@ do + echo_fail "Checker file '-' interpretation with $hasher failed" + fi + +- LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname $hasher $0 - <$ANOTHER >/dev/null ++ run_hasher $hasher $0 - <$ANOTHER >/dev/null + if [ $? -eq 0 ] + then + echo_pass "Input file '-' interpretation with $hasher" +@@ -100,16 +91,16 @@ done + + for i in $SUMHASHER + do +- hash=$(basename $i) +- hash=${hash%%sum} + hasher=$i +- i=$(basename $i) +- [ ! -e "$hasher" ] && { +- echo_deact "Hasher $hasher does not exist" ++ hash=${hasher%%sum} ++ i=$(command -v $i) ++ ++ [ -z "$i" ] && { ++ echo_deact "reference application $hasher missing" + continue + } + +- LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname $hasher $0 $ANOTHER > $CHKFILE ++ run_hasher $hasher $0 $ANOTHER > $CHKFILE + [ $? -ne 0 ] && { + echo_fail "Generation of hashes with hasher $hasher failed" + continue +@@ -131,14 +122,14 @@ do + continue + } + +- LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname $hasher --status -c $CHKFILE ++ run_hasher $hasher --status -c $CHKFILE + [ $? -ne 0 ] && echo_fail "Verification of checker file $CHKFILE with hasher $hasher failed" + + echo -n 123 >$CHKFILE + + a=$(openssl dgst -$hash -hmac 123 $0 | cut -f 2 -d" ") +- b=$(LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname $hasher -K 123 $0 | cut -f 1 -d" ") +- c=$(LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname $hasher -k $CHKFILE $0 | cut -f 1 -d" ") ++ b=$(run_hasher $hasher -K 123 $0 | cut -f 1 -d" ") ++ c=$(run_hasher $hasher -k $CHKFILE $0 | cut -f 1 -d" ") + [ x"$a" != x"$b" ] && { + echo_fail "HMAC calculation for $hasher failed (cmdline key)" + continue +@@ -153,23 +144,16 @@ done + + for i in $HMACHASHER + do +- hash=$(basename $i) +- hash=${hash%%hmac} + hasher=$i +- t=$(basename $i) +- i=$(command -v $t) ++ hash=${hasher%%hmac} ++ i=$(command -v $i) + + [ -z "$i" ] && { +- echo_deact "hmaccalc reference application $t missing" +- continue +- } +- +- [ ! -e "$hasher" ] && { +- echo_fail "Hasher $hasher does not exist" ++ echo_deact "hmaccalc reference application $hasher missing" + continue + } + +- LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname $hasher $0 $ANOTHER > $CHKFILE ++ run_hasher $hasher $0 $ANOTHER > $CHKFILE + [ $? -ne 0 ] && { + echo_fail "Generation of hashes with hasher $hasher failed" + continue +@@ -191,7 +175,7 @@ do + continue + } + +- LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname $hasher -q -c $CHKFILE ++ run_hasher $hasher -q -c $CHKFILE + if [ $? -ne 0 ] + then + echo_fail "Verification of checker file $CHKFILE with hasher $hasher failed" +@@ -210,13 +194,8 @@ do + ref=${i%%hmac}sum + hasher=$i + +- [ ! -e "$hasher" ] && { +- echo_fail "Hasher $hasher does not exist" +- continue +- } +- +- LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname $ref $0 $ANOTHER > $CHKFILE +- LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname $hasher -u -q -c $CHKFILE ++ run_hasher $ref $0 $ANOTHER > $CHKFILE ++ run_hasher $hasher -u -q -c $CHKFILE + if [ $? -ne 0 ] + then + echo_fail "Unkeyed verification with hasher $hasher failed" +@@ -224,8 +203,8 @@ do + echo_pass "Unkeyed verification with hasher $hasher" + fi + +- LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname $hasher -u $0 $ANOTHER > $CHKFILE +- LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname $ref --status -c $CHKFILE ++ run_hasher $hasher -u $0 $ANOTHER > $CHKFILE ++ run_hasher $ref --status -c $CHKFILE + if [ $? -ne 0 ] + then + echo_fail "Unkeyed generation of checker file with hasher $hasher failed" +@@ -239,12 +218,10 @@ done + # + # Test hmaccalc's ignored compatibility options: + # +-for i in $HMACHASHER ++for hasher in $HMACHASHER + do +- hasher=$i +- + compat="-d -P -b" +- LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname $hasher $compat $0 $ANOTHER > /dev/null ++ run_hasher $hasher $compat $0 $ANOTHER > /dev/null + if [ $? -ne 0 ] + then + echo_fail "Hasher $hasher does not accept compatiblity options: $compat" +@@ -256,11 +233,9 @@ done + # + # Test hmaccalc's -S option: + # +-for i in $HMACHASHER ++for hasher in $HMACHASHER + do +- hasher=$i +- +- LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname $hasher -S >$CHKFILE ++ run_hasher $hasher -S >$CHKFILE + if [ $? -ne 0 ] + then + echo_fail "Hasher $hasher does not accept the -S option" +@@ -277,11 +252,9 @@ done + # + # Test hmaccalc's -h option: + # +-for i in $HMACHASHER ++for hasher in $HMACHASHER + do +- hasher=$i +- +- LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname $hasher -h sha1 $0 $ANOTHER >$CHKFILE ++ run_hasher $hasher -h sha1 $0 $ANOTHER >$CHKFILE + if [ $? -ne 0 ] + then + echo_fail "Hasher $hasher does not accept the -h option" +@@ -289,8 +262,7 @@ do + continue + fi + +- LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname $TMPDIR/sha1hmac $0 $ANOTHER | \ +- diff $CHKFILE - ++ run_hasher sha1hmac $0 $ANOTHER | diff $CHKFILE - + if [ $? -ne 0 ] + then + echo_fail "Hasher $hasher does not work correctly with the -h option" +@@ -328,7 +300,7 @@ function run_kat() { + expand_string "$data" >"$ANOTHER" + echo "${result#0x} $ANOTHER" >"$CHKFILE" + +- LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname "${TMPDIR}/$hasher" -q \ ++ run_hasher $hasher -q \ + -k <(expand_string "$key") -c "$CHKFILE" $truncate_opt + if [ $? -ne 0 ] + then +@@ -337,7 +309,7 @@ function run_kat() { + echo_pass "Verification of hasher $hasher -c ... with KAT '$id'" + fi + +- LD_LIBRARY_PATH=$libdir LD_PRELOAD=$libname "${TMPDIR}/$hasher" -q \ ++ run_hasher $hasher -q \ + -k <(expand_string "$key") "$ANOTHER" $truncate_opt \ + | diff - "$CHKFILE" + if [ $? -ne 0 ] diff --git a/libkcapi-1.1.0-kcapi-hasher_Fix_FIPS_self-check_always_failing.patch b/libkcapi-1.1.0-kcapi-hasher_Fix_FIPS_self-check_always_failing.patch new file mode 100644 index 0000000..6c9b72f --- /dev/null +++ b/libkcapi-1.1.0-kcapi-hasher_Fix_FIPS_self-check_always_failing.patch @@ -0,0 +1,34 @@ +From 3a860a5d5231e4912d4611397752f2010467a578 Mon Sep 17 00:00:00 2001 +From: Ondrej Mosnacek +Date: Mon, 16 Apr 2018 19:35:57 +0200 +Subject: [PATCH] kcapi-hasher: Fix FIPS self-check always failing + +--- + apps/kcapi-hasher.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/apps/kcapi-hasher.c b/apps/kcapi-hasher.c +index 861db79..a5e9c71 100644 +--- a/apps/kcapi-hasher.c ++++ b/apps/kcapi-hasher.c +@@ -583,6 +583,7 @@ static int process_checkfile(const struct hash_params *params, + if (ret >= 0) + ret++; + } ++ checked_any = 1; + } else { + /* + * fipscheck does not have the filename in the check +@@ -591,11 +592,10 @@ static int process_checkfile(const struct hash_params *params, + if (targetfile) { + ret = hasher(handle, params, targetfile, + hexhash, hexhashlen + 1, stdout); ++ checked_any = 1; + goto out; + } + } +- +- checked_any = 1; + } + + out: diff --git a/libkcapi-1.1.0-kcapi-hasher_Fix_FIPS_self-check_of_the_libkcapi_library.patch b/libkcapi-1.1.0-kcapi-hasher_Fix_FIPS_self-check_of_the_libkcapi_library.patch new file mode 100644 index 0000000..de5bb83 --- /dev/null +++ b/libkcapi-1.1.0-kcapi-hasher_Fix_FIPS_self-check_of_the_libkcapi_library.patch @@ -0,0 +1,373 @@ +From 1ce0b18e588e226f4e9dcc3897236ae938b9d4dd Mon Sep 17 00:00:00 2001 +From: Ondrej Mosnacek +Date: Wed, 18 Apr 2018 10:03:49 +0200 +Subject: [PATCH 1/4] kcapi-hasher: Use consistent lib self-check params + +Since the various hasher tools use different HMAC parameters (hash, +key) and they all need to check the libkcapi library, it is necessary +to use a consistent set of parameters for the library itself. + +This patch changes the behavior to always check the library using the +fipscheck hash and key. +--- + apps/kcapi-hasher.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/apps/kcapi-hasher.c b/apps/kcapi-hasher.c +index 480a019..1d76e1d 100644 +--- a/apps/kcapi-hasher.c ++++ b/apps/kcapi-hasher.c +@@ -611,7 +611,8 @@ static int process_checkfile(const struct hash_params *params, + + } + +-static int fipscheck_self(const struct hash_params *params, int just_print) ++static int fipscheck_self(const struct hash_params *params_bin, ++ const struct hash_params *params_lib, int just_print) + { + char *checkfile = NULL; + uint32_t n = 0; +@@ -668,7 +669,7 @@ static int fipscheck_self(const struct hash_params *params, int just_print) + } + + if (just_print) { +- ret = hash_files(params, names, 1, 0, 1); ++ ret = hash_files(params_bin, names, 1, 0, 1); + goto out; + } + +@@ -678,7 +679,7 @@ static int fipscheck_self(const struct hash_params *params, int just_print) + goto out; + } + +- ret = process_checkfile(params, checkfile, selfname, CHK_STATUS); ++ ret = process_checkfile(params_bin, checkfile, selfname, CHK_STATUS); + if (ret) + goto out; + +@@ -710,7 +711,7 @@ static int fipscheck_self(const struct hash_params *params, int just_print) + goto out; + } + +- ret = process_checkfile(params, checkfile, selfname, CHK_STATUS); ++ ret = process_checkfile(params_lib, checkfile, selfname, CHK_STATUS); + + out: + if (checkfile) +@@ -1010,7 +1011,8 @@ int main(int argc, char *argv[]) + } + } + +- if (fipscheck_self(params_self, print_self_hash)) { ++ /* library self-check must be consistent across apps: */ ++ if (fipscheck_self(params_self, &PARAMS_SELF_FIPSCHECK, print_self_hash)) { + fprintf(stderr, "Integrity check of application %s failed\n", + basen); + ret = 1; + +From c69e77d4abd5b77a3f396abb816af1df8c9a7733 Mon Sep 17 00:00:00 2001 +From: Ondrej Mosnacek +Date: Wed, 18 Apr 2018 11:59:11 +0200 +Subject: [PATCH 2/4] Makefile.am: Properly install checksum files + +--- + Makefile.am | 19 ++++++++++++++----- + 1 file changed, 14 insertions(+), 5 deletions(-) + +diff --git a/Makefile.am b/Makefile.am +index ed724fe..07e2451 100644 +--- a/Makefile.am ++++ b/Makefile.am +@@ -139,16 +139,25 @@ EXTRA_bin_kcapi_hasher_DEPENDENCIES = libtool + + SCAN_FILES += $(bin_kcapi_hasher_SOURCES) + +-kcapi_hasher_links = sha1sum sha224sum sha256sum sha384sum sha512sum \ +- md5sum fipscheck fipshmac \ +- sha1hmac sha224hmac sha256hmac sha384hmac sha512hmac ++hasher_links_fc = sha1sum sha224sum sha256sum sha384sum sha512sum \ ++ md5sum fipscheck fipshmac ++hasher_links_hc = sha1hmac sha224hmac sha256hmac sha384hmac sha512hmac ++hasher_links = $(hasher_links_fc) $(hasher_links_hc) ++ ++CHECKSUM_CMD_FC = $(OPENSSL) sha256 -r -hmac orboDeJITITejsirpADONivirpUkvarP ++CHECKSUM_CMD_HC = $(OPENSSL) sha512 -r -hmac FIPS-FTW-RHT2009 + + install-exec-hook: + (cd $(DESTDIR)$(bindir) && \ +- ($(foreach link, $(kcapi_hasher_links), $(LN) -f kcapi-hasher $(link);))) ++ ($(foreach link, $(hasher_links), $(LN) -f kcapi-hasher $(link);))) + if HAVE_OPENSSL + (cd $(DESTDIR)$(bindir) && \ +- ($(foreach link, $(kcapi_hasher_links), $(OPENSSL) sha256 -hmac orboDeJITITejsirpADONivirpUkvarP $(link) > $(CHECK_PREFIX)$(link).$(CHECK_SUFFIX);))) ++ ($(foreach link, $(hasher_links_fc), \ ++ $(CHECKSUM_CMD_FC) $(link) > $(CHECK_PREFIX)$(link).$(CHECK_SUFFIX);) \ ++ $(foreach link, $(hasher_links_hc), \ ++ $(CHECKSUM_CMD_HC) $(link) > $(CHECK_PREFIX)$(link).$(CHECK_SUFFIX);):)) ++ ($(foreach lib, $(wildcard $(DESTDIR)$(libdir)/libkcapi.so*), \ ++ $(CHECKSUM_CMD_FC) $(lib) > $(CHECK_PREFIX)$(lib).$(CHECK_SUFFIX);):) + endif + endif + + +From a90c618490385d9d6214dd4918dd679b0be0df9f Mon Sep 17 00:00:00 2001 +From: Ondrej Mosnacek +Date: Wed, 18 Apr 2018 12:17:59 +0200 +Subject: [PATCH 3/4] kcapi-hasher: Add -L option for completeness + +Since kcapi-hasher also checks the checksum of the libkcapi library, add +-L option to print the checksum of the library. +--- + apps/kcapi-hasher.c | 130 ++++++++++++++++++++++++++++++---------------------- + 1 file changed, 75 insertions(+), 55 deletions(-) + +diff --git a/apps/kcapi-hasher.c b/apps/kcapi-hasher.c +index 1d76e1d..7890060 100644 +--- a/apps/kcapi-hasher.c ++++ b/apps/kcapi-hasher.c +@@ -114,7 +114,7 @@ static void usage(char *name, int fipscheck) + const char *base = basename(name); + fprintf(stderr, "\n%s - calculation of hash sum (Using Linux Kernel Crypto API)\n", basename(name)); + fprintf(stderr, "\nUsage:\n"); +- fprintf(stderr, "\t%s [OPTION]... -S\n", base); ++ fprintf(stderr, "\t%s [OPTION]... -S|-L\n", base); + if (fipscheck) + fprintf(stderr, "\t%s [OPTION]... FILE\n", base); + else { +@@ -123,6 +123,7 @@ static void usage(char *name, int fipscheck) + } + fprintf(stderr, "\nOptions:\n"); + fprintf(stderr, "\t-S --self-sum\t\tPrint checksum of this binary and exit\n"); ++ fprintf(stderr, "\t-L --self-sum-lib\tPrint checksum of the libkcapi library and exit\n"); + if (!fipscheck) + fprintf(stderr, "\t-c --check FILE\t\tVerify hash sums from file\n"); + fprintf(stderr, "\t-u --unkeyed\t\tForce unkeyed hash\n"); +@@ -611,8 +612,13 @@ static int process_checkfile(const struct hash_params *params, + + } + ++/* self-check modes: */ ++#define SELFCHECK_CHECK 0 ++#define SELFCHECK_PRINT_SELF 1 ++#define SELFCHECK_PRINT_LIB 2 ++ + static int fipscheck_self(const struct hash_params *params_bin, +- const struct hash_params *params_lib, int just_print) ++ const struct hash_params *params_lib, int mode) + { + char *checkfile = NULL; + uint32_t n = 0; +@@ -626,9 +632,9 @@ static int fipscheck_self(const struct hash_params *params_bin, + void *dl = NULL, *sym; + + #ifdef HAVE_SECURE_GETENV +- if (secure_getenv("KCAPI_HASHER_FORCE_FIPS") || just_print) { ++ if (secure_getenv("KCAPI_HASHER_FORCE_FIPS") || mode != SELFCHECK_CHECK) { + #else +- if (getenv("KCAPI_HASHER_FORCE_FIPS") || just_print) { ++ if (getenv("KCAPI_HASHER_FORCE_FIPS") || mode != SELFCHECK_CHECK) { + #endif + fipsflag[0] = 1; + } else { +@@ -660,58 +666,68 @@ static int fipscheck_self(const struct hash_params *params_bin, + } + + /* Integrity check of our application. */ +- memset(selfname, 0, sizeof(selfname)); +- selfnamesize = readlink("/proc/self/exe", selfname, BUFSIZE); +- if (selfnamesize >= BUFSIZE || selfnamesize < 0) { +- fprintf(stderr, "Cannot obtain my filename\n"); +- ret = -EFAULT; +- goto out; +- } ++ if (mode == SELFCHECK_CHECK || mode == SELFCHECK_PRINT_SELF) { ++ memset(selfname, 0, sizeof(selfname)); ++ selfnamesize = readlink("/proc/self/exe", selfname, BUFSIZE); ++ if (selfnamesize >= BUFSIZE || selfnamesize < 0) { ++ fprintf(stderr, "Cannot obtain my filename\n"); ++ ret = -EFAULT; ++ goto out; ++ } + +- if (just_print) { +- ret = hash_files(params_bin, names, 1, 0, 1); +- goto out; +- } ++ if (mode == SELFCHECK_PRINT_SELF) { ++ ret = hash_files(params_bin, names, 1, 0, 1); ++ goto out; ++ } + +- checkfile = get_hmac_file(selfname); +- if (!checkfile) { +- ret = -ENOMEM; +- goto out; +- } ++ checkfile = get_hmac_file(selfname); ++ if (!checkfile) { ++ ret = -ENOMEM; ++ goto out; ++ } + +- ret = process_checkfile(params_bin, checkfile, selfname, CHK_STATUS); +- if (ret) +- goto out; ++ ret = process_checkfile(params_bin, checkfile, selfname, CHK_STATUS); ++ if (ret) ++ goto out; ++ } + + /* Integrity check of shared libkcapi.so file. */ +- memset(selfname, 0, sizeof(selfname)); +- snprintf(selfname, (sizeof(selfname) - 1), "libkcapi.so.%u", +- KCAPI_MAJVERSION); +- dl = dlopen(selfname, RTLD_NODELETE|RTLD_NOLOAD|RTLD_LAZY); +- if (dl == NULL) { +- fprintf(stderr, "dlopen of file %s failed\n", selfname); +- ret = -EFAULT; +- goto out; +- } ++ if (mode == SELFCHECK_CHECK || mode == SELFCHECK_PRINT_LIB) { ++ memset(selfname, 0, sizeof(selfname)); ++ snprintf(selfname, (sizeof(selfname) - 1), "libkcapi.so.%u", ++ KCAPI_MAJVERSION); ++ dl = dlopen(selfname, RTLD_NODELETE|RTLD_NOLOAD|RTLD_LAZY); ++ if (dl == NULL) { ++ fprintf(stderr, "dlopen of file %s failed\n", selfname); ++ ret = -EFAULT; ++ goto out; ++ } + +- memset(selfname, 0, sizeof(selfname)); +- sym = dlsym(dl, "kcapi_md_init"); +- if (sym == NULL || !dladdr(sym, &info)) { +- fprintf(stderr, "finding symbol kcapi_md_init failed\n"); +- ret = -EFAULT; +- goto out; +- } ++ memset(selfname, 0, sizeof(selfname)); ++ sym = dlsym(dl, "kcapi_md_init"); ++ if (sym == NULL || !dladdr(sym, &info)) { ++ fprintf(stderr, "finding symbol kcapi_md_init failed\n"); ++ ret = -EFAULT; ++ goto out; ++ } + +- strncpy(selfname, info.dli_fname, (sizeof(selfname) - 1)); ++ strncpy(selfname, info.dli_fname, (sizeof(selfname) - 1)); + +- free(checkfile); +- checkfile = get_hmac_file(selfname); +- if (!checkfile) { +- ret = -ENOMEM; +- goto out; +- } ++ if (mode == SELFCHECK_PRINT_LIB) { ++ ret = hash_files(params_lib, names, 1, 0, 1); ++ goto out; ++ } ++ ++ if (checkfile) ++ free(checkfile); ++ checkfile = get_hmac_file(selfname); ++ if (!checkfile) { ++ ret = -ENOMEM; ++ goto out; ++ } + +- ret = process_checkfile(params_lib, checkfile, selfname, CHK_STATUS); ++ ret = process_checkfile(params_lib, checkfile, selfname, CHK_STATUS); ++ } + + out: + if (checkfile) +@@ -753,9 +769,9 @@ int main(int argc, char *argv[]) + int hmac = 0; + int fipscheck = 0; + int fipshmac = 0; +- int print_self_hash = 0; ++ int selfcheck_mode = SELFCHECK_CHECK; + +- static const char *opts_short = "c:uh:t:Sqk:K:vbd:P"; ++ static const char *opts_short = "c:uh:t:SLqk:K:vbd:P"; + static const struct option opts[] = { + {"help", 0, 0, 0}, + {"tag", 0, 0, 0}, +@@ -765,6 +781,7 @@ int main(int argc, char *argv[]) + {"hash", 1, 0, 'h'}, + {"truncate", 1, 0, 't'}, + {"self-sum", 0, 0, 'S'}, ++ {"self-sum-lib", 0, 0, 'L'}, + {"status", 0, 0, 'q'}, + {"key-file", 1, 0, 'k'}, + {"key", 1, 0, 'K'}, +@@ -932,7 +949,10 @@ int main(int argc, char *argv[]) + params.hashlen /= 8; + break; + case 'S': +- print_self_hash = 1; ++ selfcheck_mode = SELFCHECK_PRINT_SELF; ++ break; ++ case 'L': ++ selfcheck_mode = SELFCHECK_PRINT_LIB; + break; + case 'q': + loglevel = CHK_STATUS; +@@ -998,28 +1018,28 @@ int main(int argc, char *argv[]) + } + } + +- if (print_self_hash) { ++ if (selfcheck_mode != SELFCHECK_CHECK) { + if (checkfile) { +- fprintf(stderr, "-S and -c cannot be combined\n"); ++ fprintf(stderr, "-S/-L and -c cannot be combined\n"); + ret = 1; + goto out; + } + if (optind != argc) { +- fprintf(stderr, "-S cannot be used with input files\n"); ++ fprintf(stderr, "-S/-L cannot be used with input files\n"); + ret = 1; + goto out; + } + } + + /* library self-check must be consistent across apps: */ +- if (fipscheck_self(params_self, &PARAMS_SELF_FIPSCHECK, print_self_hash)) { ++ if (fipscheck_self(params_self, &PARAMS_SELF_FIPSCHECK, selfcheck_mode)) { + fprintf(stderr, "Integrity check of application %s failed\n", + basen); + ret = 1; + goto out; + } + +- if (print_self_hash) { ++ if (selfcheck_mode != SELFCHECK_CHECK) { + ret = 0; + goto out; + } + +From 7b176840ff60bc596a7c80685ef0a81adbc00e4b Mon Sep 17 00:00:00 2001 +From: Ondrej Mosnacek +Date: Thu, 19 Apr 2018 10:39:12 +0200 +Subject: [PATCH 4/4] Makefile.am: Do not install kcapi-hasher binary + +The kcapi-hasher binary is not usable on its own so it can be removed +after hard-linking the actual hasher tools. +--- + Makefile.am | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/Makefile.am b/Makefile.am +index 07e2451..383da75 100644 +--- a/Makefile.am ++++ b/Makefile.am +@@ -150,6 +150,7 @@ CHECKSUM_CMD_HC = $(OPENSSL) sha512 -r -hmac FIPS-FTW-RHT2009 + install-exec-hook: + (cd $(DESTDIR)$(bindir) && \ + ($(foreach link, $(hasher_links), $(LN) -f kcapi-hasher $(link);))) ++ -rm -f $(DESTDIR)$(bindir)/kcapi-hasher + if HAVE_OPENSSL + (cd $(DESTDIR)$(bindir) && \ + ($(foreach link, $(hasher_links_fc), \ diff --git a/libkcapi-1.1.0-kcapi-hasher_Fix_buffer_overrun_in_get_hmac_file.patch b/libkcapi-1.1.0-kcapi-hasher_Fix_buffer_overrun_in_get_hmac_file.patch new file mode 100644 index 0000000..eaea641 --- /dev/null +++ b/libkcapi-1.1.0-kcapi-hasher_Fix_buffer_overrun_in_get_hmac_file.patch @@ -0,0 +1,23 @@ +From f8e032f150522c17094e36dcf62ec3ebc77e69d8 Mon Sep 17 00:00:00 2001 +From: Ondrej Mosnacek +Date: Mon, 16 Apr 2018 15:39:03 +0200 +Subject: [PATCH] kcapi-hasher: Fix buffer overrun in get_hmac_file + +We need to allocate space also for the terminating null character... +--- + apps/kcapi-hasher.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/apps/kcapi-hasher.c b/apps/kcapi-hasher.c +index 861db79..2b87a45 100644 +--- a/apps/kcapi-hasher.c ++++ b/apps/kcapi-hasher.c +@@ -360,7 +360,7 @@ static char *get_hmac_file(const char *filename) + fprintf(stderr, "File too long\n"); + return NULL; + } +- checkfile = malloc(filelen + prefixlen + 1 + suffixlen); ++ checkfile = malloc(filelen + prefixlen + 1 + suffixlen + 1); + if (!checkfile) + return NULL; + diff --git a/libkcapi.spec b/libkcapi.spec index 9338486..75f9318 100644 --- a/libkcapi.spec +++ b/libkcapi.spec @@ -1,42 +1,17 @@ # Shared object version of libkcapi. %global vmajor 1 -%global vminor 5 +%global vminor 1 %global vpatch 0 # Do we build the replacements packages? %bcond_with replace_coreutils -# Replace fipscheck by default in Fedora 33+: -%if 0%{?fedora} >= 33 || 0%{?rhel} >= 9 -%bcond_without replace_fipscheck -%else %bcond_with replace_fipscheck -%endif # Replace hmaccalc by default in Fedora 28+: %if 0%{?fedora} >= 28 || 0%{?rhel} >= 8 %bcond_without replace_hmaccalc %else %bcond_with replace_hmaccalc %endif -%if 0%{?fedora} >= 29 || 0%{?rhel} >= 8 -%bcond_without test_package -%else -%bcond_with test_package -%endif -# disable cppcheck analysis in ELN/RHEL to avoid the dependency bz#1931518 -%if 0%{?rhel} -%bcond_with cppcheck -%else -%bcond_without cppcheck -%endif - -# Use `--without test` to build without running the tests -%bcond_without test -# Use `--without fuzz_test` to skip the fuzz test during build -%bcond_without fuzz_test -# Use `--without doc` to build without the -doc subpackage -%bcond_without doc -# Use `--without clang_sa` to skip clang static analysis during build -%bcond_without clang_sa # This package needs at least Linux Kernel v4.10.0. %global min_kernel_ver 4.10.0 @@ -76,7 +51,8 @@ # Do we replace fipscheck? %if %{with replace_fipscheck} -%global fipscheck_evr 1.5.0-9 +# TODO: Adapt this when replacing fipscheck initially. +%global fipscheck_evr 1.5.0-3%{?dist} %endif # Do we replace hmaccalc? @@ -84,69 +60,67 @@ %global hmaccalc_evr 0.9.14-10%{?dist} %endif -%global apps_coreutils sha1sum sha224sum sha256sum sha384sum sha512sum md5sum sm3sum -%global apps_hmaccalc sha1hmac sha224hmac sha256hmac sha384hmac sha512hmac sm3hmac -%global apps_fipscheck fipscheck fipshmac +%global apps_hmaccalc sha1hmac sha224hmac sha256hmac sha384hmac sha512hmac +%global apps_fipscheck sha1sum sha224sum sha256sum sha384sum sha512sum md5sum fipscheck fipshmac -# On old kernels use mock hashers implemented via openssl -%if %{lua:print(rpm.vercmp(posix.uname('%r'), '3.19'));} >= 0 -%global sha512hmac bin/kcapi-hasher -n sha512hmac -%global fipshmac bin/kcapi-hasher -n fipshmac -%else -%global sha512hmac bash %{SOURCE2} -%global fipshmac bash %{SOURCE3} -%endif - -# Add generation of HMAC checksum of the final stripped -# binary. %%define with lazy globbing is used here +# Add generation of HMAC checksums of the final stripped +# binaries. %%define with lazy globbing is used here # intentionally, because using %%global does not work. %define __spec_install_post \ %{?__debug_package:%{__debug_install_post}} \ %{__arch_install_post} \ %{__os_install_post} \ bin_path=%{buildroot}%{_bindir} \ -lib_path=%{buildroot}%{_libdir} \ -{ %sha512hmac "$bin_path"/kcapi-hasher || exit 1; } | \\\ - cut -f 1 -d ' ' >"$lib_path"/hmaccalc/kcapi-hasher.hmac \ -{ %sha512hmac "$lib_path"/libkcapi.so.%{version} || exit 1; } | \\\ - cut -f 1 -d ' ' >"$lib_path"/hmaccalc/libkcapi.so.%{version}.hmac \ -%{__ln_s} libkcapi.so.%{version}.hmac \\\ - "$lib_path"/hmaccalc/libkcapi.so.%{vmajor}.hmac \ +lib_path=%{buildroot}/%{_lib} \ +for app in %{apps_hmaccalc}; do \ + test -e "$bin_path"/$app || continue \ + { bin/kcapi-hasher -n sha512hmac "$bin_path"/$app || exit 1; } \\\ + | cut -f 1 -d ' ' >"$bin_path"/.$app.hmac \ +done \ +for app in %{apps_fipscheck}; do \ + test -e "$bin_path"/$app || continue \ + bin/kcapi-hasher -n fipshmac "$bin_path"/$app || exit 1 \ +done \ +%{_sbindir}/hardlink -cfv %{buildroot}%{_bindir} \ +bin/kcapi-hasher -n fipshmac "$lib_path"/libkcapi.so.%{version} \\\ + || exit 1 \ +%{__ln_s} .libkcapi.so.%{version}.hmac \\\ + "$lib_path"/.libkcapi.so.%{vmajor}.hmac \ %{nil} + Name: libkcapi Version: %{vmajor}.%{vminor}.%{vpatch} -Release: %autorelease +Release: 5%{?dist} Summary: User space interface to the Linux Kernel Crypto API -License: BSD-3-Clause OR GPL-2.0-only -URL: https://www.chronox.de/%{name}/ -Source0: https://www.chronox.de/%{name}/releases/%{version}/%{name}-%{version}.tar.xz -Source1: https://www.chronox.de/%{name}/releases/%{version}/%{name}-%{version}.tar.xz.asc -Source2: sha512hmac-openssl.sh -Source3: fipshmac-openssl.sh +License: BSD or GPLv2 +URL: http://www.chronox.de/%{name}.html +Source0: http://www.chronox.de/%{name}/%{name}-%{version}.tar.xz +Source1: http://www.chronox.de/%{name}/%{name}-%{version}.tar.xz.asc -BuildRequires: bash +Patch0: %{giturl}/pull/52.patch#/%{name}-1.1.0-kcapi-hasher_Fix_buffer_overrun_in_get_hmac_file.patch +Patch1: %{giturl}/pull/53.patch#/%{name}-1.1.0-kcapi-hasher_Fix_FIPS_self-check_always_failing.patch +Patch2: %{giturl}/pull/54.patch#/%{name}-1.1.0-kcapi-hasher_Fix_FIPS_self-check_of_the_libkcapi_library.patch +Patch3: %{giturl}/pull/57.patch#/%{name}-1.1.0-kcapi-hasher_Allow_picking_basename_via_cmdline.patch + +BuildRequires: clang BuildRequires: coreutils +BuildRequires: cppcheck +BuildRequires: docbook-utils-pdf BuildRequires: gcc -BuildRequires: git-core +BuildRequires: git BuildRequires: hardlink -BuildRequires: kernel-headers >= %{min_kernel_ver} BuildRequires: libtool -BuildRequires: make BuildRequires: openssl -BuildRequires: perl-interpreter BuildRequires: systemd BuildRequires: xmlto -%if %{with doc} -BuildRequires: docbook-utils-pdf -%endif -%if %{with clang_sa} -BuildRequires: clang -%endif -%if %{with cppcheck} -BuildRequires: cppcheck >= 2.4 -%endif + +# To make sure this is not buildable nor installable if the +# available Linux Kernel does not support the Linux Kernel +# Crypto API User Space Interface. +BuildRequires: kernel-headers >= %{min_kernel_ver} +Requires: kernel >= %{min_kernel_ver} # For ownership of %%{_sysctldir}. Requires: systemd @@ -176,32 +150,18 @@ Requires: %{name}%{?_isa} == %{version}-%{release} Header files for applications that use %{name}. -%if %{with doc} %package doc Summary: User documentation for the %{name} package BuildArch: noarch -# Depend on one of the base packages because they have the license files -# We cannot just bundle them into doc because they might conflict with an -# older or newer version of the base package. -Requires: %{name} == %{version}-%{release} %description doc User documentation for %{name}. -%endif - - -%package hasher -Summary: Common %{name} hashing application -Requires: %{name}%{?_isa} == %{version}-%{release} - -%description hasher -Provides The kcapi-hasher binary used by other %{name} subpackages. %if %{with replace_coreutils} %package checksum Summary: Drop-in replacement for *sum utils provided by the %{name} package -Requires: %{name}-hasher%{?_isa} == %{version}-%{release} +Requires: %{name}%{?_isa} == %{version}-%{release} Requires: coreutils%{?_isa} >= %{coreutils_evr} @@ -217,7 +177,7 @@ coreutils) using %{name}. %if %{with replace_fipscheck} %package fipscheck Summary: Drop-in replacements for fipscheck/fipshmac provided by the %{name} package -Requires: %{name}-hasher%{?_isa} == %{version}-%{release} +Requires: %{name}%{?_isa} == %{version}-%{release} Obsoletes: fipscheck <= %{fipscheck_evr} @@ -233,7 +193,7 @@ package fipscheck) using %{name}. %if %{with replace_hmaccalc} %package hmaccalc Summary: Drop-in replacements for hmaccalc provided by the %{name} package -Requires: %{name}-hasher%{?_isa} == %{version}-%{release} +Requires: %{name}%{?_isa} == %{version}-%{release} Obsoletes: hmaccalc <= %{hmaccalc_evr} @@ -258,8 +218,7 @@ is highly discouraged. %package tools Summary: Utility applications for the %{name} package -Requires: %{name}%{?_isa} == %{version}-%{release} -Requires: %{name}-hasher%{?_isa} == %{version}-%{release} +Requires: %{name}%{?_isa} == %{version}-%{release} %description tools Utility applications that are provided with %{name}. This includes @@ -267,33 +226,9 @@ tools to use message digests, symmetric ciphers and random number generators implemented in the Linux kernel from command line. -%if %{with test_package} -%package tests -Summary: Testing scripts for the %{name} package -Requires: %{name}%{?_isa} == %{version}-%{release} -Requires: %{name}-tools%{?_isa} == %{version}-%{release} -%if %{with replace_hmaccalc} -Requires: %{name}-hmaccalc%{?_isa} == %{version}-%{release} -%endif -%if %{with replace_coreutils} -Requires: %{name}-checksum%{?_isa} == %{version}-%{release} -%endif -Requires: coreutils -Requires: openssl -Requires: perl-interpreter - -%description tests -Auxiliary scripts for testing %{name}. -%endif - - %prep %autosetup -p 1 -S git -# Work around https://bugzilla.redhat.com/show_bug.cgi?id=2258240 -sed -i -e 's|XML V45|XML V4.1.2|' -e 's|/xml/4\.5/|/xml/4.1.2/|' \ - lib/doc/libkcapi.tmpl - %if %{with_sysctl_tweak} %{__cat} << EOF > README.%{distroname_ext} This package increases the default limit of the ancillary buffer size @@ -328,12 +263,16 @@ net.core.optmem_max = %{sysctl_optmem_max} EOF %endif +%ifarch %{power64} +%{__sed} -i -e 's!exit \$failures!#&!' test/kcapi-enc-test.sh +%endif + %{_bindir}/autoreconf -fiv %build %configure \ - --libdir=%{_libdir} \ + --libdir=/%{_lib} \ --disable-silent-rules \ --enable-kcapi-encapp \ --enable-kcapi-dgstapp \ @@ -343,14 +282,9 @@ EOF --enable-kcapi-test \ --enable-shared \ --enable-static \ - --enable-sum-prefix= \ - --enable-sum-dir=%{_libdir} \ + --enable-sum-prefix=. \ --with-pkgconfigdir=%{_libdir}/pkgconfig -%if %{with doc} %make_build all doc -%else -%make_build all man -%endif %install @@ -367,32 +301,22 @@ EOF %if %{with_sysctl_tweak} README.%{distroname_ext} \ %endif -%if %{with doc} - doc/%{name}.p{df,s} \ -%endif - README.md CHANGES.md TODO - -%if %{with doc} + README.md CHANGES TODO doc/%{name}.p{df,s} %{__cp} -pr lib/doc/html %{buildroot}%{_pkgdocdir} -%endif # Install replacement tools, if enabled. -%if %{with replace_coreutils} -for app in %apps_coreutils; do - %{__ln_s} ../libexec/libkcapi/$app %{buildroot}%{_bindir}/$app -done +%if !%{with replace_coreutils} +%{__rm} -f \ + %{buildroot}%{_bindir}/md5sum \ + %{buildroot}%{_bindir}/sha*sum %endif -%if %{with replace_fipscheck} -for app in %apps_fipscheck; do - %{__ln_s} ../libexec/libkcapi/$app %{buildroot}%{_bindir}/$app -done +%if !%{with replace_fipscheck} +%{__rm} -f %{buildroot}%{_bindir}/fips* %endif -%if %{with replace_hmaccalc} -for app in %apps_hmaccalc; do - %{__ln_s} ../libexec/libkcapi/$app %{buildroot}%{_bindir}/$app -done +%if !%{with replace_hmaccalc} +%{__rm} -f %{buildroot}%{_bindir}/sha*hmac %endif # We don't ship autocrap dumplings. @@ -404,51 +328,35 @@ done # Remove 0-size files. %{_bindir}/find %{buildroot} -type f -size 0 -print -delete -%if %{with doc} # Make sure all docs have non-exec permissions, except for the dirs. %{_bindir}/find %{buildroot}%{_pkgdocdir} -type f -print | \ %{_bindir}/xargs %{__chmod} -c 0644 %{_bindir}/find %{buildroot}%{_pkgdocdir} -type d -print | \ %{_bindir}/xargs %{__chmod} -c 0755 -%endif # Possibly save some space by hardlinking. for d in %{_mandir} %{_pkgdocdir}; do - %{_bindir}/hardlink -cfv %{buildroot}$d + %{_sbindir}/hardlink -cfv %{buildroot}$d done %check # Some basic sanity checks. -%if %{with clang_sa} -%make_build scan -%endif -%if %{with cppcheck} -# -UCHECK_DIR: string literal concatenation raises syntaxError -# with cppcheck-2.11 (https://trac.cppcheck.net/ticket/11830) -# --check-level=exhaustive: otherwise it emits warnings that get -# treated like errors -%make_build cppcheck CPPCHECK="cppcheck --check-level=exhaustive -UCHECK_DIR" -%endif +for t in cppcheck scan; do + %make_build $t +done -%if %{with test} # On some arches `/proc/sys/net/core/optmem_max` is lower than 20480, # which is the lowest limit needed to run the testsuite. If that limit # is not met, we do not run it. %if %{test_optmem_max} >= 20480 -# Skip the testsuite on old kernels. -%if %{lua:print(rpm.vercmp(posix.uname('%r'), '5.1'));} >= 0 # Real testsuite. pushd test -%if %{with fuzz_test} ENABLE_FUZZ_TEST=1 \ -%endif NO_32BIT_TEST=1 \ ./test-invocation.sh popd %endif -%endif -%endif %ldconfig_scriptlets @@ -458,10 +366,10 @@ popd %doc %dir %{_pkgdocdir} %doc %{_pkgdocdir}/README.md %license COPYING* -%{_libdir}/%{name}.so.%{vmajor} -%{_libdir}/%{name}.so.%{version} -%{_libdir}/hmaccalc/%{name}.so.%{vmajor}.hmac -%{_libdir}/hmaccalc/%{name}.so.%{version}.hmac +/%{_lib}/%{name}.so.%{vmajor} +/%{_lib}/%{name}.so.%{version} +/%{_lib}/.%{name}.so.%{vmajor}.hmac +/%{_lib}/.%{name}.so.%{version}.hmac %if %{with_sysctl_tweak} %doc %{_pkgdocdir}/README.%{distroname_ext} %{_sysctldir}/%{sysctl_prio}-%{name}-optmem_max.conf @@ -469,78 +377,146 @@ popd %files devel -%doc %{_pkgdocdir}/CHANGES.md +%doc %{_pkgdocdir}/CHANGES %doc %{_pkgdocdir}/TODO %{_includedir}/kcapi.h %{_mandir}/man3/kcapi_*.3.* -%{_libdir}/%{name}.so +/%{_lib}/%{name}.so %{_libdir}/pkgconfig/%{name}.pc -%if %{with doc} %files doc -%doc %{_pkgdocdir}/html -%doc %{_pkgdocdir}/%{name}.pdf -%doc %{_pkgdocdir}/%{name}.ps -%endif - - -%files hasher -%{_bindir}/kcapi-hasher -%{_libexecdir}/%{name}/md5sum -%{_libexecdir}/%{name}/sha*sum -%{_libexecdir}/%{name}/sm*sum -%{_libexecdir}/%{name}/fips* -%{_libexecdir}/%{name}/sha*hmac -%{_libexecdir}/%{name}/sm*hmac -%{_libdir}/hmaccalc/kcapi-hasher.hmac -%{_mandir}/man1/kcapi-hasher.1.* +%doc %{_pkgdocdir} +%license %{_datadir}/licenses/%{name}* %if %{with replace_coreutils} %files checksum %{_bindir}/md5sum +%{_bindir}/.md5sum.hmac %{_bindir}/sha*sum -%{_bindir}/sm*sum +%{_bindir}/.sha*sum.hmac %endif %if %{with replace_fipscheck} %files fipscheck %{_bindir}/fips* +%{_bindir}/.fips*.hmac %endif %if %{with replace_hmaccalc} %files hmaccalc %{_bindir}/sha*hmac -%{_bindir}/sm*hmac +%{_bindir}/.sha*hmac.hmac %endif %files static -%{_libdir}/%{name}.a +/%{_lib}/%{name}.a %files tools -%{_bindir}/kcapi -%{_bindir}/kcapi-convenience -%{_bindir}/kcapi-dgst -%{_bindir}/kcapi-enc -%{_bindir}/kcapi-enc-test-large -%{_bindir}/kcapi-rng -%{_bindir}/kcapi-speed -%{_mandir}/man1/kcapi-dgst.1.* -%{_mandir}/man1/kcapi-enc.1.* -%{_mandir}/man1/kcapi-rng.1.* - - -%if %{with test_package} -%files tests -%{_libexecdir}/%{name}/kcapi -%{_libexecdir}/%{name}/kcapi-convenience -%{_libexecdir}/%{name}/kcapi-enc-test-large -%{_libexecdir}/%{name}/*.sh -%endif +%{_bindir}/kcapi* +%{_mandir}/man1/kcapi*.1.* %changelog -%autochangelog +* Wed May 09 2018 Ondrej Mosnáček - 1.1.0-5 +- Skip CLang static analysis in RHEL +- Revert "Skip CLang static analysis in RHEL" +- Use own sha512hmac and fipscheck + +* Wed May 02 2018 Ondrej Mosnáček - 1.1.0-4 +- Fix description lines being too long + +* Fri Apr 27 2018 Björn Esser - 1.1.0-3 +- Fix conditional for hmaccalc replacement + +* Mon Apr 16 2018 Ondrej Mosnáček - 1.1.0-2 +- Enable hmaccalc replacements in Fedora 28+ + +* Thu Apr 12 2018 Ondrej Mosnáček - 1.1.0-1 +- Update to upstream version 1.1.0 + +* Sat Mar 31 2018 Björn Esser - 1.0.3-10 +- Replace single patches with a monolitic one from upstream +- Obsolete replacements subpackage +- Ignore failing tests on %%{power64} temporarily + +* Thu Mar 08 2018 Ondrej Mosnáček - 1.0.3-9 +- Split up the replacements subpackage + +* Mon Feb 26 2018 Björn Esser - 1.0.3-8 +- Increase optmem_max preset to 81920 + +* Mon Feb 26 2018 Björn Esser - 1.0.3-7 +- Obsoletes work by package name, not by provides (rhbz#1537225) + +* Sun Feb 25 2018 Björn Esser - 1.0.3-6 +- Add patch to fix a copy-paste typo + +* Sat Feb 17 2018 Björn Esser - 1.0.3-5 +- Add patch to fix build with -Werror + +* Wed Feb 07 2018 Fedora Release Engineering +- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild + +* Sun Feb 04 2018 Björn Esser - 1.0.3-3 +- Switch to %%ldconfig_scriptlets + +* Wed Jan 17 2018 Björn Esser - 1.0.3-2 +- Decrease optmem_max preset to 40960 +- Let the build fail, if the minimum kernel version cannot be met +- Conditionalize the sysctl.d tweak on version of the kernel +- Conditionalize the name of README.distro on the distro + +* Tue Jan 16 2018 Björn Esser - 1.0.3-1 +- Initial import (rhbz#1533929) + +* Tue Jan 16 2018 Björn Esser - 1.0.3-0.13 +- Increase optmem_max preset to 81920 + +* Tue Jan 16 2018 Björn Esser - 1.0.3-0.12 +- Add sysctl.d preset and README.fedora + +* Mon Jan 15 2018 Björn Esser - 1.0.3-0.11 +- Make the contents of the -replacements package configurable + +* Mon Jan 15 2018 Björn Esser - 1.0.3-0.10 +- Fix Obsoletes of the -replacements package + +* Sun Jan 14 2018 Björn Esser - 1.0.3-0.9 +- Disable the -replacements package until we have a plan for it + +* Sun Jan 14 2018 Björn Esser - 1.0.3-0.8 +- Move the kcapi-hasher binary to -replacements package, since it is + not of much use without the linked invocation names and saves the + extra Requires on the -tools package + +* Sun Jan 14 2018 Björn Esser - 1.0.3-0.7 +- Fix internal Requires of sub-packages +- Hardlink files in %%{_bindir} + +* Sun Jan 14 2018 Björn Esser - 1.0.3-0.6 +- Add patches from upstream + +* Sat Jan 13 2018 Björn Esser - 1.0.3-0.5 +- Add patches from upstream + +* Sat Jan 13 2018 Björn Esser - 1.0.3-0.4 +- Asume the testsuite cannot be run, if the value of optmem_max cannot + be obtained + +* Sat Jan 13 2018 Björn Esser - 1.0.3-0.3 +- Move libraries to /%%{_lib} instead of %%{_libdir}, which is useful + during boot when the library might be needed before a potentially + seperate /usr partition is mounted + +* Sat Jan 13 2018 Björn Esser - 1.0.3-0.2 +- Asume optmem_max is at least 20480, if the real value cannot be obtained + +* Fri Jan 12 2018 Björn Esser - 1.0.3-0.1 +- New upstream release + +* Wed Jan 10 2018 Björn Esser - 1.0.2-0.1 +- Initial rpm release (rhbz#1533929) diff --git a/plans/ci.fmf b/plans/ci.fmf deleted file mode 100644 index d3cd36f..0000000 --- a/plans/ci.fmf +++ /dev/null @@ -1,5 +0,0 @@ -summary: Run CI tests -discover: - how: fmf -execute: - how: tmt diff --git a/sha512hmac-openssl.sh b/sha512hmac-openssl.sh deleted file mode 100644 index 6496394..0000000 --- a/sha512hmac-openssl.sh +++ /dev/null @@ -1,6 +0,0 @@ -#!/bin/bash - -# Mocks sha512hmac using the openssl tool. -# Only for use during RPM build. - -openssl sha512 -hmac FIPS-FTW-RHT2009 -hex "$1" | cut -f 2 -d ' ' diff --git a/sources b/sources index 0f7842a..f1a22ba 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (libkcapi-1.5.0.tar.xz) = db156ee94fc63815a31876ab072aca72a806b26961c43f2caf8495c53b95484de71cd3be84dc9e5c9560e9ee704979be059ff6c102b4893d6bbdf9a8a69a667a -SHA512 (libkcapi-1.5.0.tar.xz.asc) = 69cfb6bf98f89c503e7fda07a54eddb9fcc2dafe418f1bc1216c051565c214a6caab83495c19b650a5c6e46e22080f8df4dd2152ab364993ed5badd256495159 +SHA512 (libkcapi-1.1.0.tar.xz) = 8d7a775a7ac3a16e006cc21a40e0dbc2c068879fb277ef7a96f706aa0a822ee6c29dba59e34a42cc2e3da926ee242fb47b6c1486d846d9028d662bc71e8f25fd +SHA512 (libkcapi-1.1.0.tar.xz.asc) = f2ecc4bc477231a5f2b91476f4d300be32d796cf5f49b0b89e3f5c5735690fe4b6baec3739aa8df99eaac6eac66a63b23ce25e9b16bec17f8748fcac19843968 diff --git a/tests/main.fmf b/tests/main.fmf deleted file mode 100644 index 4b6064e..0000000 --- a/tests/main.fmf +++ /dev/null @@ -1,29 +0,0 @@ -component: libkcapi -contact: Ondrej Mosnacek - -/upstream: - require: [libkcapi-tests] - tier: 1 - - /basic: - summary: Basic functionality - test: /usr/libexec/libkcapi/test.sh - /encrypt: - summary: Encryption/decryption - test: /usr/libexec/libkcapi/kcapi-enc-test.sh - /encrypt-large: - summary: Encryption/decryption of large data - test: /usr/libexec/libkcapi/kcapi-enc-test-large.sh - /digest: - summary: Message digest - test: /usr/libexec/libkcapi/kcapi-dgst-test.sh - /digest-convenience: - summary: Message digest convenience functions - test: /usr/libexec/libkcapi/kcapi-convenience.sh - /hasher: - summary: Checksum helpers - test: /usr/libexec/libkcapi/hasher-test.sh - /fuzz-test: - summary: Fuzz test - test: /usr/libexec/libkcapi/kcapi-fuzz-test.sh - duration: 2h