pool/ibmtss
SHA256
2
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Accepting request 1037119 from home:pmonrealgonzalez:branches:security

Browse Source 
- Build with OpenSSL 3.0 deprecated functions until fixed upstream
in the next version update [bsc#1205042]
  * ibmtss-openssl3-deprecation.patch
- Add upstream patches to fix build with OpenSSL 3.0
  * ibmtss-regtests-Update-openssl-key-generation-for-3.0.0.patch
  * ibmtss-utils-Update-certifyx509-for-Openssl-3.0.0.patch
  * ibmtss-utils-Remove-unused-variables-from-certifyx509.patch
  * ibmtss-tss-Port-HMAC-operations-to-openssl-3.0.patch
  * ibmtss-utils-Port-to-openssl-3.0.0-replaces-RSA-with-EVP_PK.patch

OBS-URL: https://build.opensuse.org/request/show/1037119
OBS-URL: https://build.opensuse.org/package/show/security/ibmtss?expand=0&rev=43
This commit is contained in:
Michal Suchanek 2022-11-24 10:28:59 +00:00 committed by Git OBS Bridge
parent 3acb9e4aba
commit 9198ea5057
8 changed files with 3633 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
ibmtss-openssl3-deprecation.patch Normal file
View File

@ -0,0 +1,26 @@
Index: ibmtss-1.6.0/build.sh
===================================================================
--- ibmtss-1.6.0.orig/build.sh
+++ ibmtss-1.6.0/build.sh
@@ -13,7 +13,7 @@ cleanup() {
}
CC="${CC:-gcc}"
-CFLAGS="${CFLAGS:--Wformat -Werror=format-security -Werror=implicit-function-declaration -Werror=return-type -fno-common}"
+CFLAGS="${CFLAGS:--Wformat -Werror=format-security -Werror=implicit-function-declaration -Werror=return-type -fno-common -Wno-error=deprecated-declarations}"
PREFIX="${PREFIX:-$HOME/tpm2}"
export LD_LIBRARY_PATH="$PREFIX/lib64:$PREFIX/lib:/usr/local/lib64:/usr/local/lib"
Index: ibmtss-1.6.0/configure.ac
===================================================================
--- ibmtss-1.6.0.orig/configure.ac
+++ ibmtss-1.6.0/configure.ac
@@ -71,7 +71,7 @@ AC_ARG_ENABLE(debug,
# Linux requires -DTPM_POSIX
case $host_os in
- linux-*) CFLAGS="-DTPM_POSIX $CFLAGS" ;;
+ linux-*) CFLAGS="-DTPM_POSIX $CFLAGS -Wno-error=deprecated-declarations" ;;
esac
AC_ARG_ENABLE(tpm-2.0,

453
ibmtss-regtests-Update-openssl-key-generation-for-3.0.0.patch Normal file
View File

@ -0,0 +1,453 @@
From f1c6b44f95392c156b235d42bccc8235ee24bb6f Mon Sep 17 00:00:00 2001
From: Ken Goldman <kgoldman@us.ibm.com>
Date: Wed, 11 Aug 2021 18:22:41 -0400
Subject: regtests: Update openssl key generation for 3.0.0
OpenSSL 3.0.0 used a different pem and der key format. Update the
command line calls. Bypass the tests that use these functions for
mbedtls, which does not support the new format.
Signed-off-by: Ken Goldman <kgoldman@us.ibm.com>
diff --git a/utils/regtests/testdup.sh b/utils/regtests/testdup.sh
index eeca02f..e849e44 100755
--- a/utils/regtests/testdup.sh
+++ b/utils/regtests/testdup.sh
@@ -7,7 +7,7 @@
# Written by Ken Goldman #
# IBM Thomas J. Watson Research Center #
# #
-# (c) Copyright IBM Corporation 2015 - 2020 #
+# (c) Copyright IBM Corporation 2015 - 2021 #
# #
# All rights reserved. #
# #
@@ -215,7 +215,12 @@ echo ""
if [ ${CRYPTOLIBRARY} == "openssl" ]; then
echo "generate the RSA signing key with openssl"
- openssl genrsa -out tmpprivkey.pem -aes256 -passout pass:rrrr 2048 > run.out 2>&1
+
+ openssl genpkey -out tmpprivkey.pem -outform pem -aes-256-cbc -algorithm rsa -pkeyopt rsa_keygen_bits:2048 -pass pass:rrrr > run.out 2>&1
+
+# The following worked up to Openssl 3.0.0. The key generation
+# remains here for when mbedtls is updated, but the tests are now
+# if'ed out
elif [ ${CRYPTOLIBRARY} == "mbedtls" ]; then
echo "Generate the RSA signing key with openssl"
@@ -232,22 +237,24 @@ else
exit 255
fi
-echo "load the ECC storage key 80000001"
-${PREFIX}load -hp 80000000 -pwdp sto -ipr storeeccnistp256priv.bin -ipu storeeccnistp256pub.bin > run.out
-checkSuccess $?
+if [ ${CRYPTOLIBRARY} == "openssl" ]; then
-echo "Start an HMAC auth session"
-${PREFIX}startauthsession -se h > run.out
-checkSuccess $?
+ echo "load the ECC storage key 80000001"
+ ${PREFIX}load -hp 80000000 -pwdp sto -ipr storeeccnistp256priv.bin -ipu storeeccnistp256pub.bin > run.out
+ checkSuccess $?
-for SESS in "" "-se0 02000000 1"
-do
- for HALG in ${ITERATE_ALGS}
- do
+ echo "Start an HMAC auth session"
+ ${PREFIX}startauthsession -se h > run.out
+ checkSuccess $?
- for PARENT in 80000000 80000001
+ for SESS in "" "-se0 02000000 1"
+ do
+ for HALG in ${ITERATE_ALGS}
do
+ for PARENT in 80000000 80000001
+ do
+
echo "Import the signing key under the parent key ${PARENT} ${HALG}"
${PREFIX}importpem -hp ${PARENT} -pwdp sto -ipem tmpprivkey.pem -pwdk rrrr -opu tmppub.bin -opr tmppriv.bin -halg ${HALG} > run.out
checkSuccess $?
@@ -268,9 +275,10 @@ do
${PREFIX}flushcontext -ha 80000002 > run.out
checkSuccess $?
+ done
done
done
-done
+fi
echo ""
echo "Import PEM EC signing key under RSA and ECC storage key"
@@ -300,49 +308,53 @@ else
exit 255
fi
-for CURVE in "nistp256" "nistp384"
-do
-
- for SESS in "" "-se0 02000000 1"
+if [ ${CRYPTOLIBRARY} == "openssl" ]; then
+
+ for CURVE in "nistp256" "nistp384"
do
- for HALG in ${ITERATE_ALGS}
- do
- for PARENT in 80000000 80000001
+ for SESS in "" "-se0 02000000 1"
+ do
+ for HALG in ${ITERATE_ALGS}
do
- echo "Import the ${CURVE} signing key under the parent key ${PARENT} ${HALG}"
- ${PREFIX}importpem -hp ${PARENT} -pwdp sto -ipem tmpec${CURVE}privkey.pem -ecc -pwdk rrrr -opu tmppub.bin -opr tmppriv.bin -halg ${HALG} > run.out
- checkSuccess $?
+ for PARENT in 80000000 80000001
+ do
- echo "Load the TPM signing key"
- ${PREFIX}load -hp ${PARENT} -pwdp sto -ipu tmppub.bin -ipr tmppriv.bin > run.out
- checkSuccess $?
+ echo "Import the ${CURVE} signing key under the parent key ${PARENT} ${HALG}"
+ ${PREFIX}importpem -hp ${PARENT} -pwdp sto -ipem tmpec${CURVE}privkey.pem -ecc -pwdk rrrr -opu tmppub.bin -opr tmppriv.bin -halg ${HALG} > run.out
+ checkSuccess $?
- echo "Sign the message ${HALG} ${SESS}"
- ${PREFIX}sign -hk 80000002 -salg ecc -pwdk rrrr -if policies/aaa -os tmpsig.bin -halg ${HALG} ${SESS} > run.out
- checkSuccess $?
+ echo "Load the TPM signing key"
+ ${PREFIX}load -hp ${PARENT} -pwdp sto -ipu tmppub.bin -ipr tmppriv.bin > run.out
+ checkSuccess $?
- echo "Verify the signature ${HALG}"
- ${PREFIX}verifysignature -hk 80000002 -ecc -if policies/aaa -is tmpsig.bin -halg ${HALG} > run.out
- checkSuccess $?
+ echo "Sign the message ${HALG} ${SESS}"
+ ${PREFIX}sign -hk 80000002 -salg ecc -pwdk rrrr -if policies/aaa -os tmpsig.bin -halg ${HALG} ${SESS} > run.out
+ checkSuccess $?
- echo "Flush the signing key"
- ${PREFIX}flushcontext -ha 80000002 > run.out
- checkSuccess $?
+ echo "Verify the signature ${HALG}"
+ ${PREFIX}verifysignature -hk 80000002 -ecc -if policies/aaa -is tmpsig.bin -halg ${HALG} > run.out
+ checkSuccess $?
+ echo "Flush the signing key"
+ ${PREFIX}flushcontext -ha 80000002 > run.out
+ checkSuccess $?
+
+ done
done
done
done
-done
-echo "Flush the ECC storage key"
-${PREFIX}flushcontext -ha 80000001 > run.out
-checkSuccess $?
+ echo "Flush the ECC storage key"
+ ${PREFIX}flushcontext -ha 80000001 > run.out
+ checkSuccess $?
-echo "Flush the auth session"
-${PREFIX}flushcontext -ha 02000000 > run.out
-checkSuccess $?
+ echo "Flush the auth session"
+ ${PREFIX}flushcontext -ha 02000000 > run.out
+ checkSuccess $?
+
+fi
echo ""
echo "Rewrap"
diff --git a/utils/regtests/testrsa.sh b/utils/regtests/testrsa.sh
index 4f76522..5ae0b29 100755
--- a/utils/regtests/testrsa.sh
+++ b/utils/regtests/testrsa.sh
@@ -7,7 +7,7 @@
# Written by Ken Goldman #
# IBM Thomas J. Watson Research Center #
# #
-# (c) Copyright IBM Corporation 2015 - 2020 #
+# (c) Copyright IBM Corporation 2015 - 2021 #
# #
# All rights reserved. #
# #
@@ -59,20 +59,25 @@ if [ ${CRYPTOLIBRARY} == "openssl" ]; then
do
echo "Generate the RSA $BITS encryption key with openssl"
- openssl genrsa -out tmpkeypairrsa${BITS}.pem -aes256 -passout pass:rrrr ${BITS} > run.out 2>&1
+ openssl genpkey -out tmpkeypairrsa${BITS}.pem -outform pem -aes-256-cbc -algorithm rsa -pkeyopt rsa_keygen_bits:${BITS} -pass pass:rrrr > run.out 2>&1
echo "Convert key pair to plaintext DER format"
- openssl rsa -inform pem -outform der -in tmpkeypairrsa${BITS}.pem -out tmpkeypairrsa${BITS}.der -passin pass:rrrr > run.out 2>&1
+ openssl pkey -inform pem -in tmpkeypairrsa${BITS}.pem -outform der -out tmpkeypairrsa${BITS}.der -passin pass:rrrr > run.out 2>&1
done
+
+# The following worked up to Openssl 3.0.0. The key generation
+# remains here for when mbedtls is updated, but the tests are now
+# if'ed out
+
elif [ ${CRYPTOLIBRARY} == "mbedtls" ]; then
for BITS in 2048 3072
do
echo "Generate the RSA $BITS encryption key with openssl"
- openssl genrsa -out tmpkeypairrsaenc${BITS}.pem -aes256 -passout pass:rrrr ${BITS} > run.out 2>&1
+ openssl genrsa -out tmpkeypairrsaenc${BITS}.pem -outform pem -aes-256-cbc -algorithm rsa -pkeyopt rsa_keygen_bits:${BITS} -pass:rrrr > run.out 2>&1
echo "Convert RSA $BITS key pair to plaintext DER format"
openssl rsa -in tmpkeypairrsaenc${BITS}.pem -passin pass:rrrr -outform der -out tmpkeypairrsa${BITS}.der > run.out 2>&1
@@ -158,20 +163,22 @@ do
done
-echo ""
-echo "Import PEM RSA encryption key"
-echo ""
+if [ ${CRYPTOLIBRARY} == "openssl" ]; then
-echo "Start an HMAC auth session"
-${PREFIX}startauthsession -se h > run.out
-checkSuccess $?
+ echo ""
+ echo "Import PEM RSA encryption key"
+ echo ""
-for BITS in 2048 3072
-do
+ echo "Start an HMAC auth session"
+ ${PREFIX}startauthsession -se h > run.out
+ checkSuccess $?
- for SESS in "" "-se0 02000000 1"
+ for BITS in 2048 3072
do
+ for SESS in "" "-se0 02000000 1"
+ do
+
echo "Import the $BITS encryption key under the primary key"
${PREFIX}importpem -hp 80000000 -den -pwdp sto -ipem tmpkeypairrsa${BITS}.pem -pwdk rrrr -opu tmppub.bin -opr tmppriv.bin > run.out
checkSuccess $?
@@ -201,97 +208,98 @@ do
${PREFIX}flushcontext -ha 80000001 > run.out
checkSuccess $?
+ done
+
done
-done
+ echo "Flush the session"
+ ${PREFIX}flushcontext -ha 02000000 > run.out
+ checkSuccess $?
-echo "Flush the session"
-${PREFIX}flushcontext -ha 02000000 > run.out
-checkSuccess $?
+ echo ""
+ echo "Import PEM RSA encryption key userWithAuth test"
+ echo ""
-echo ""
-echo "Import PEM RSA encryption key userWithAuth test"
-echo ""
+ echo "Import the RSA 2048 encryption key under the primary key 80000000"
+ ${PREFIX}importpem -hp 80000000 -den -pwdp sto -ipem tmpkeypairrsa2048.pem -pwdk rrrr -opu tmppub.bin -opr tmppriv.bin > run.out
+ checkSuccess $?
-echo "Import the RSA 2048 encryption key under the primary key 80000000"
-${PREFIX}importpem -hp 80000000 -den -pwdp sto -ipem tmpkeypairrsa2048.pem -pwdk rrrr -opu tmppub.bin -opr tmppriv.bin > run.out
-checkSuccess $?
+ echo "Load the RSA 2048 encryption key 80000001"
+ ${PREFIX}load -hp 80000000 -pwdp sto -ipu tmppub.bin -ipr tmppriv.bin > run.out
+ checkSuccess $?
-echo "Load the RSA 2048 encryption key 80000001"
-${PREFIX}load -hp 80000000 -pwdp sto -ipu tmppub.bin -ipr tmppriv.bin > run.out
-checkSuccess $?
+ echo "RSA encrypt with the encryption key"
+ ${PREFIX}rsaencrypt -hk 80000001 -id policies/aaa -oe enc.bin > run.out
+ checkSuccess $?
-echo "RSA encrypt with the encryption key"
-${PREFIX}rsaencrypt -hk 80000001 -id policies/aaa -oe enc.bin > run.out
-checkSuccess $?
+ echo "RSA decrypt with the decryption key and password"
+ ${PREFIX}rsadecrypt -hk 80000001 -pwdk rrrr -ie enc.bin -od dec.bin > run.out
+ checkSuccess $?
-echo "RSA decrypt with the decryption key and password"
-${PREFIX}rsadecrypt -hk 80000001 -pwdk rrrr -ie enc.bin -od dec.bin > run.out
-checkSuccess $?
+ echo "Flush the encryption key"
+ ${PREFIX}flushcontext -ha 80000001 > run.out
+ checkSuccess $?
-echo "Flush the encryption key"
-${PREFIX}flushcontext -ha 80000001 > run.out
-checkSuccess $?
+ echo "Import the RSA 2048 encryption key under the primary key, userWithAuth false"
+ ${PREFIX}importpem -hp 80000000 -si -pwdp sto -ipem tmpkeypairrsa2048.pem -pwdk rrrr -uwa -opu tmppub.bin -opr tmppriv.bin > run.out
+ checkSuccess $?
-echo "Import the RSA 2048 encryption key under the primary key, userWithAuth false"
-${PREFIX}importpem -hp 80000000 -si -pwdp sto -ipem tmpkeypairrsa2048.pem -pwdk rrrr -uwa -opu tmppub.bin -opr tmppriv.bin > run.out
-checkSuccess $?
+ echo "Load the RSA 2048 encryption key"
+ ${PREFIX}load -hp 80000000 -pwdp sto -ipu tmppub.bin -ipr tmppriv.bin > run.out
+ checkSuccess $?
-echo "Load the RSA 2048 encryption key"
-${PREFIX}load -hp 80000000 -pwdp sto -ipu tmppub.bin -ipr tmppriv.bin > run.out
-checkSuccess $?
+ echo "RSA decrypt with the decryption key and password - should fail"
+ ${PREFIX}rsadecrypt -hk 80000001 -pwdk rrrr -ie enc.bin -od dec.bin > run.out
+ checkFailure $?
-echo "RSA decrypt with the decryption key and password - should fail"
-${PREFIX}rsadecrypt -hk 80000001 -pwdk rrrr -ie enc.bin -od dec.bin > run.out
-checkFailure $?
+ echo "Flush the encryption key"
+ ${PREFIX}flushcontext -ha 80000001 > run.out
+ checkSuccess $?
-echo "Flush the encryption key"
-${PREFIX}flushcontext -ha 80000001 > run.out
-checkSuccess $?
+ echo ""
+ echo "Loadexternal DER encryption key"
+ echo ""
+ for BITS in 2048 3072
+ do
-echo ""
-echo "Loadexternal DER encryption key"
-echo ""
+ echo "Start an HMAC auth session"
+ ${PREFIX}startauthsession -se h > run.out
+ checkSuccess $?
-for BITS in 2048 3072
-do
+ for SESS in "" "-se0 02000000 1"
+ do
- echo "Start an HMAC auth session"
- ${PREFIX}startauthsession -se h > run.out
- checkSuccess $?
+ echo "Load the openssl key pair in the NULL hierarchy 80000001"
+ ${PREFIX}loadexternal -den -ider tmpkeypairrsa${BITS}.der -pwdk rrrr > run.out
+ checkSuccess $?
- for SESS in "" "-se0 02000000 1"
- do
+ echo "RSA encrypt with the encryption key"
+ ${PREFIX}rsaencrypt -hk 80000001 -id policies/aaa -oe enc.bin > run.out
+ checkSuccess $?
- echo "Load the openssl key pair in the NULL hierarchy 80000001"
- ${PREFIX}loadexternal -den -ider tmpkeypairrsa${BITS}.der -pwdk rrrr > run.out
- checkSuccess $?
+ echo "RSA decrypt with the decryption key ${SESS}"
+ ${PREFIX}rsadecrypt -hk 80000001 -pwdk rrrr -ie enc.bin -od dec.bin ${SESS} > run.out
+ checkSuccess $?
- echo "RSA encrypt with the encryption key"
- ${PREFIX}rsaencrypt -hk 80000001 -id policies/aaa -oe enc.bin > run.out
- checkSuccess $?
+ echo "Verify the decrypt result"
+ tail -c 3 dec.bin > tmp.bin
+ diff policies/aaa tmp.bin > run.out
+ checkSuccess $?
- echo "RSA decrypt with the decryption key ${SESS}"
- ${PREFIX}rsadecrypt -hk 80000001 -pwdk rrrr -ie enc.bin -od dec.bin ${SESS} > run.out
- checkSuccess $?
+ echo "Flush the encryption key"
+ ${PREFIX}flushcontext -ha 80000001 > run.out
+ checkSuccess $?
- echo "Verify the decrypt result"
- tail -c 3 dec.bin > tmp.bin
- diff policies/aaa tmp.bin > run.out
- checkSuccess $?
+ done
- echo "Flush the encryption key"
- ${PREFIX}flushcontext -ha 80000001 > run.out
+ echo "Flush the session"
+ ${PREFIX}flushcontext -ha 02000000 > run.out
checkSuccess $?
done
- echo "Flush the session"
- ${PREFIX}flushcontext -ha 02000000 > run.out
- checkSuccess $?
-
-done
+fi
echo ""
echo "Encrypt with OpenSSL OAEP, decrypt with TPM"
diff --git a/utils/regtests/testsalt.sh b/utils/regtests/testsalt.sh
index 1bdc1a7..e0c3376 100755
--- a/utils/regtests/testsalt.sh
+++ b/utils/regtests/testsalt.sh
@@ -91,16 +91,17 @@ echo ""
echo "Salt Session - Load External"
echo ""
-echo "Create RSA and ECC key pairs in PEM format using openssl"
+echo "Create RSA key pair in DER format using openssl"
-openssl genrsa -out tmpkeypairrsa.pem -aes256 -passout pass:rrrr 2048 > run.out 2>&1
-openssl ecparam -name prime256v1 -genkey -noout -out tmpkeypairecc.pem > run.out 2>&1
+openssl genpkey -out tmpkeypairrsa.der -outform der -aes-256-cbc -algorithm rsa -pkeyopt rsa_keygen_bits:2048 -pass pass:rrrr > run.out 2>&1
+echo "Create ECC key pair in PEM format using openssl"
echo "Convert key pair to plaintext DER format"
-openssl rsa -inform pem -outform der -in tmpkeypairrsa.pem -out tmpkeypairrsa.der -passin pass:rrrr > run.out 2>&1
+openssl ecparam -name prime256v1 -genkey -noout -out tmpkeypairecc.pem > run.out 2>&1
openssl ec -inform pem -outform der -in tmpkeypairecc.pem -out tmpkeypairecc.der -passin pass:rrrr > run.out 2>&1
+
for HALG in ${ITERATE_ALGS}
do
diff --git a/utils/regtests/testsign.sh b/utils/regtests/testsign.sh
index edfa014..3002ceb 100755
--- a/utils/regtests/testsign.sh
+++ b/utils/regtests/testsign.sh
@@ -47,11 +47,9 @@ echo ""
for BITS in 2048 3072
do
- echo "Create an RSA $BITS key pair in PEM format using openssl"
- openssl genrsa -out tmpkeypairrsa${BITS}.pem -aes256 -passout pass:rrrr 2048 > run.out 2>&1
+ echo "Create an RSA $BITS key pair in DER format using openssl"
- echo "Convert RSA $BITS key pair to plaintext DER format"
- openssl rsa -inform pem -outform der -in tmpkeypairrsa${BITS}.pem -out tmpkeypairrsa${BITS}.der -passin pass:rrrr > run.out 2>&1
+ openssl genpkey -out tmpkeypairrsa${BITS}.der -outform der -aes-256-cbc -algorithm rsa -pkeyopt rsa_keygen_bits:${BITS} -pass pass:rrrr > run.out 2>&1
echo "Load the RSA $BITS signing key under the primary key"
${PREFIX}load -hp 80000000 -ipr signrsa${BITS}priv.bin -ipu signrsa${BITS}pub.bin -pwdp sto > run.out
--
2.38.0

237
ibmtss-tss-Port-HMAC-operations-to-openssl-3.0.patch Normal file
View File

@ -0,0 +1,237 @@
From 6e22032d637ea8c28cf84efa837a22909873466a Mon Sep 17 00:00:00 2001
From: Ken Goldman <kgold@linux.ibm.com>
Date: Fri, 10 Sep 2021 16:33:10 -0400
Subject: tss: Port HMAC operations to openssl 3.0
Replace the deprecated APIs.
Signed-off-by: Ken Goldman <kgold@linux.ibm.com>
diff --git a/utils/tsscrypto.c b/utils/tsscrypto.c
index 35f0ed3..c2ce01a 100644
--- a/utils/tsscrypto.c
+++ b/utils/tsscrypto.c
@@ -79,6 +79,7 @@ extern int tssVerbose;
/* local prototypes */
+static TPM_RC TSS_Hash_GetOsslString(const char **str, TPMI_ALG_HASH hashAlg);
static TPM_RC TSS_Hash_GetMd(const EVP_MD **md,
TPMI_ALG_HASH hashAlg);
@@ -129,36 +130,51 @@ TPM_RC TSS_Crypto_Init(void)
Digests
*/
-static TPM_RC TSS_Hash_GetMd(const EVP_MD **md,
- TPMI_ALG_HASH hashAlg)
+/* TSS_Hash_GetString() maps from the TCG hash algorithm to the OpenSSL string */
+
+static TPM_RC TSS_Hash_GetOsslString(const char **str, TPMI_ALG_HASH hashAlg)
{
- TPM_RC rc = 0;
+ TPM_RC rc = 0;
- if (rc == 0) {
- switch (hashAlg) {
+ switch (hashAlg) {
#ifdef TPM_ALG_SHA1
- case TPM_ALG_SHA1:
- *md = EVP_get_digestbyname("sha1");
- break;
+ case TPM_ALG_SHA1:
+ *str = "sha1";
+ break;
#endif
-#ifdef TPM_ALG_SHA256
- case TPM_ALG_SHA256:
- *md = EVP_get_digestbyname("sha256");
- break;
+#ifdef TPM_ALG_SHA256
+ case TPM_ALG_SHA256:
+ *str = "sha256";
+ break;
#endif
#ifdef TPM_ALG_SHA384
- case TPM_ALG_SHA384:
- *md = EVP_get_digestbyname("sha384");
- break;
+ case TPM_ALG_SHA384:
+ *str = "sha384";
+ break;
#endif
#ifdef TPM_ALG_SHA512
- case TPM_ALG_SHA512:
- *md = EVP_get_digestbyname("sha512");
- break;
+ case TPM_ALG_SHA512:
+ *str = "sha512";
+ break;
#endif
- default:
- rc = TSS_RC_BAD_HASH_ALGORITHM;
- }
+ default:
+ *str = NULL;
+ rc = TSS_RC_BAD_HASH_ALGORITHM;
+ }
+ return rc;
+}
+
+static TPM_RC TSS_Hash_GetMd(const EVP_MD **md,
+ TPMI_ALG_HASH hashAlg)
+{
+ TPM_RC rc = 0;
+ const char *str = NULL;
+
+ if (rc == 0) {
+ rc = TSS_Hash_GetOsslString(&str, hashAlg);
+ }
+ if (rc == 0) {
+ *md = EVP_get_digestbyname(str);
}
return rc;
}
@@ -175,37 +191,84 @@ TPM_RC TSS_HMAC_Generate_valist(TPMT_HA *digest, /* largest size of a digest */
TPM_RC rc = 0;
int irc = 0;
int done = FALSE;
- const EVP_MD *md; /* message digest method */
-#if OPENSSL_VERSION_NUMBER < 0x10100000
+ uint8_t *buffer; /* segment to hash */
+ int length; /* segment to hash */
+#if OPENSSL_VERSION_NUMBER < 0x10100000
HMAC_CTX ctx;
+ const EVP_MD *md = NULL; /* message digest method */
+#elif OPENSSL_VERSION_NUMBER < 0x30000000
+ HMAC_CTX *ctx = NULL;
+ const EVP_MD *md = NULL; /* message digest method */
#else
- HMAC_CTX *ctx;
+ EVP_MAC *mac = NULL;
+ EVP_MAC_CTX *ctx = NULL;
+ const char *algString = NULL;
+ OSSL_PARAM params[2];
+ size_t outLength;
#endif
- int length;
- uint8_t *buffer;
-
+
+ /* initialize the HMAC context */
#if OPENSSL_VERSION_NUMBER < 0x10100000
HMAC_CTX_init(&ctx);
+#elif OPENSSL_VERSION_NUMBER < 0x30000000
+ if (rc == 0) {
+ ctx = HMAC_CTX_new();
+ if (ctx == NULL) {
+ if (tssVerbose) printf("TSS_Hash_Generate_valist: HMAC_CTX_new failed\n");
+ rc = TSS_RC_OUT_OF_MEMORY;
+ }
+ }
#else
- ctx = HMAC_CTX_new();
+ if (rc == 0) {
+ mac = EVP_MAC_fetch(NULL, "hmac", NULL);
+ if (mac == NULL) {
+ if (tssVerbose) printf("TSS_Hash_Generate_valist: EVP_MAC_new failed\n");
+ rc = TSS_RC_OUT_OF_MEMORY;
+ }
+ }
+ if (rc == 0) {
+ ctx = EVP_MAC_CTX_new(mac);
+ if (ctx == NULL) {
+ if (tssVerbose) printf("TSS_Hash_Generate_valist: EVP_MAC_CTX_new failed\n");
+ rc = TSS_RC_OUT_OF_MEMORY;
+ }
+ }
#endif
+
+ /* get the message digest */
+#if OPENSSL_VERSION_NUMBER < 0x30000000
if (rc == 0) {
rc = TSS_Hash_GetMd(&md, digest->hashAlg);
}
+#else
+ /* map algorithm to string */
+ if (rc == 0) {
+ rc = TSS_Hash_GetOsslString(&algString, digest->hashAlg);
+ }
+#endif
+
+ /* initialize the MAC context */
if (rc == 0) {
#if OPENSSL_VERSION_NUMBER < 0x10100000
irc = HMAC_Init_ex(&ctx,
hmacKey->b.buffer, hmacKey->b.size, /* HMAC key */
md, /* message digest method */
NULL);
-#else
+#elif OPENSSL_VERSION_NUMBER < 0x30000000
irc = HMAC_Init_ex(ctx,
hmacKey->b.buffer, hmacKey->b.size, /* HMAC key */
md, /* message digest method */
NULL);
+#else
+ params[0] = OSSL_PARAM_construct_utf8_string("digest", (char *)algString, 0);
+ params[1] = OSSL_PARAM_construct_end();
+ irc = EVP_MAC_init(ctx,
+ hmacKey->b.buffer, hmacKey->b.size, /* HMAC key */
+ params); /* message digest method */
#endif
-
- if (irc == 0) {
+
+ if (irc != 1) {
+ if (tssVerbose) printf("TSS_HMAC_Generate: HMAC Init failed\n");
rc = TSS_RC_HMAC;
}
}
@@ -220,11 +283,13 @@ TPM_RC TSS_HMAC_Generate_valist(TPMT_HA *digest, /* largest size of a digest */
else {
#if OPENSSL_VERSION_NUMBER < 0x10100000
irc = HMAC_Update(&ctx, buffer, length);
-#else
+#elif OPENSSL_VERSION_NUMBER < 0x30000000
irc = HMAC_Update(ctx, buffer, length);
+#else
+ irc = EVP_MAC_update(ctx, buffer, length);
#endif
- if (irc == 0) {
- if (tssVerbose) printf("TSS_HMAC_Generate: HMAC_Update failed\n");
+ if (irc != 1) {
+ if (tssVerbose) printf("TSS_HMAC_Generate: HMAC Update failed\n");
rc = TSS_RC_HMAC;
}
}
@@ -237,18 +302,24 @@ TPM_RC TSS_HMAC_Generate_valist(TPMT_HA *digest, /* largest size of a digest */
if (rc == 0) {
#if OPENSSL_VERSION_NUMBER < 0x10100000
irc = HMAC_Final(&ctx, (uint8_t *)&digest->digest, NULL);
-#else
+#elif OPENSSL_VERSION_NUMBER < 0x30000000
irc = HMAC_Final(ctx, (uint8_t *)&digest->digest, NULL);
+#else
+ irc = EVP_MAC_final(ctx, (uint8_t *)&digest->digest, &outLength, sizeof(digest->digest));
#endif
if (irc == 0) {
+ if (tssVerbose) printf("TSS_HMAC_Generate: HMAC Final failed\n");
rc = TSS_RC_HMAC;
}
}
#if OPENSSL_VERSION_NUMBER < 0x10100000
HMAC_CTX_cleanup(&ctx);
-#else
+#elif OPENSSL_VERSION_NUMBER < 0x30000000
HMAC_CTX_free(ctx);
-#endif
+#else
+ EVP_MAC_CTX_free(ctx);
+ EVP_MAC_free(mac);
+ #endif
return rc;
}
--
2.38.0

1399
ibmtss-utils-Port-to-openssl-3.0.0-replaces-RSA-with-EVP_PK.patch Normal file
View File

File diff suppressed because it is too large Load Diff

51
ibmtss-utils-Remove-unused-variables-from-certifyx509.patch Normal file
View File

@ -0,0 +1,51 @@
From f335860d99fe11eec5599e1e53960ff1e75c0f82 Mon Sep 17 00:00:00 2001
From: Ken Goldman <kgoldman@us.ibm.com>
Date: Mon, 23 Aug 2021 17:30:56 -0400
Subject: utils: Remove unused variables from certifyx509
notBefore and notAfter are set driectly in the partialCertificate
structure, and that is used to directly set the x509 structure.
Signed-off-by: Ken Goldman <kgoldman@us.ibm.com>
diff --git a/utils/certifyx509.c b/utils/certifyx509.c
index ed42ac0..44640aa 100644
--- a/utils/certifyx509.c
+++ b/utils/certifyx509.c
@@ -204,6 +204,7 @@ int main(int argc, char *argv[])
setvbuf(stdout, 0, _IONBF, 0); /* output may be going through pipe to log file */
TSS_SetProperty(NULL, TPM_TRACE_LEVEL, "1");
+ curveID = curveID; /* no longer used, get from parent */
/* command line argument defaults */
for (i=1 ; (i<argc) && (rc == 0) ; i++) {
if (strcmp(argv[i],"-ho") == 0) {
@@ -686,8 +687,6 @@ TPM_RC createPartialCertificate(TPM_PARTIAL_CERT *partialCertificate, /* input /
X509_NAME *x509SubjectName = NULL;/* composite subject name, key/value pairs */
size_t issuerEntriesSize = sizeof(issuerEntries)/sizeof(char *);
size_t subjectEntriesSize = sizeof(subjectEntries)/sizeof(char *);
- ASN1_TIME *notBefore = NULL;
- ASN1_TIME *notAfter = NULL;
uint8_t *tmpPartialDer = NULL; /* for the i2d */
/* add issuer */
@@ -717,8 +716,6 @@ TPM_RC createPartialCertificate(TPM_PARTIAL_CERT *partialCertificate, /* input /
}
}
if (rc == 0) {
- /* can't fail, just returns a structure member */
- notBefore = X509_get_notBefore(x509Certificate);
irc = X509_set1_notBefore(x509Certificate, partialCertificate->validity->notBefore);
if (irc == 0) {
printf("createPartialCertificate: Error setting notBefore time\n");
@@ -737,7 +734,6 @@ TPM_RC createPartialCertificate(TPM_PARTIAL_CERT *partialCertificate, /* input /
}
}
if (rc == 0) {
- notAfter = X509_get_notAfter(x509Certificate);
irc = X509_set1_notAfter(x509Certificate,partialCertificate->validity->notAfter);
if (irc == 0) {
printf("createPartialCertificate: Error setting notAfter time\n");
--
2.38.0

1447
ibmtss-utils-Update-certifyx509-for-Openssl-3.0.0.patch Normal file
View File

File diff suppressed because it is too large Load Diff

13
ibmtss.changes
View File

@ -1,3 +1,16 @@
-------------------------------------------------------------------
Wed Nov 9 13:33:51 UTC 2022 - Pedro Monreal <pmonreal@suse.com>
- Build with OpenSSL 3.0 deprecated functions until fixed upstream
in the next version update [bsc#1205042]
* ibmtss-openssl3-deprecation.patch
- Add upstream patches to fix build with OpenSSL 3.0
* ibmtss-regtests-Update-openssl-key-generation-for-3.0.0.patch
* ibmtss-utils-Update-certifyx509-for-Openssl-3.0.0.patch
* ibmtss-utils-Remove-unused-variables-from-certifyx509.patch
* ibmtss-tss-Port-HMAC-operations-to-openssl-3.0.patch
* ibmtss-utils-Port-to-openssl-3.0.0-replaces-RSA-with-EVP_PK.patch
-------------------------------------------------------------------
Thu Nov 25 11:48:53 UTC 2021 - Michal Suchanek <msuchanek@suse.com>

8
ibmtss.spec
View File

@ -1,7 +1,7 @@
#
# spec file for package ibmtss
#
# Copyright (c) 2021 SUSE LLC
# Copyright (c) 2022 SUSE LLC
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
@ -32,6 +32,12 @@ URL: https://sourceforge.net/projects/ibmtpm20tss
Source: https://sourceforge.net/projects/ibmtpm20tss/files/ibmtss%{version}.tar.gz
Source1: 90-tpm-ibmtss.rules
Patch1: ibmtss-configure.ac-Do-not-disable-optimization-for-debug-b.patch
Patch2: ibmtss-regtests-Update-openssl-key-generation-for-3.0.0.patch
Patch3: ibmtss-utils-Update-certifyx509-for-Openssl-3.0.0.patch
Patch4: ibmtss-utils-Remove-unused-variables-from-certifyx509.patch
Patch5: ibmtss-tss-Port-HMAC-operations-to-openssl-3.0.patch
Patch6: ibmtss-utils-Port-to-openssl-3.0.0-replaces-RSA-with-EVP_PK.patch
Patch7: ibmtss-openssl3-deprecation.patch
BuildRequires: autoconf
BuildRequires: automake
BuildRequires: ibmswtpm2