pool/tpm-tools
SHA256
2
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Accepting request 876508 from security

Browse Source 
- upgrade to minor version 1.3.9.2:
  - upstream now provide openssl 1.1 compatibility on their own
- dropped 0001-Fix-build-against-OpenSSL-1.1.0.patch since the tarbal is now
  compatible.

OBS-URL: https://build.opensuse.org/request/show/876508
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/tpm-tools?expand=0&rev=33
This commit is contained in:
Richard Brown 2021-03-30 19:10:52 +00:00 committed by Git OBS Bridge
commit f487f2ac58
5 changed files with 18 additions and 234 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

220
0001-Fix-build-against-OpenSSL-1.1.0.patch
View File

@ -1,220 +0,0 @@
From e6ef35d6a7dd4ab3d755c9cde5a5f589146af9e7 Mon Sep 17 00:00:00 2001
From: Matthias Gerstner <matthias.gerstner@suse.de>
Date: Thu, 9 Nov 2017 17:53:30 +0100
Subject: [PATCH] Fix build against OpenSSL 1.1.0 when P11 support is enabled
---
src/data_mgmt/data_import.c | 154 ++++++++++++++++++++++++++++++++++++++------
1 file changed, 133 insertions(+), 21 deletions(-)
diff --git a/src/data_mgmt/data_import.c b/src/data_mgmt/data_import.c
index f534717..0ba4162 100644
--- a/src/data_mgmt/data_import.c
+++ b/src/data_mgmt/data_import.c
@@ -39,6 +39,9 @@
#include <openssl/evp.h>
#include <openssl/err.h>
+#if OPENSSL_VERSION_NUMBER >= 0x1010000fL
+# define USE_OPENSSL_110_API
+#endif
/*
* Global variables
@@ -58,6 +61,104 @@ CK_ULONG g_ulIdLen = 0;
CK_BYTE *g_pchName = NULL; // LABEL attribute value
CK_ULONG g_ulNameLen = 0;
+static const BIGNUM*
+getRSAModulus( RSA *a_pRsa ) {
+#ifdef USE_OPENSSL_110_API
+ const BIGNUM *ret;
+ RSA_get0_key(a_pRsa, &ret, NULL, NULL);
+ return ret;
+#else
+ return a_pRsa->n;
+#endif
+}
+
+static const BIGNUM*
+getRSAPublicExponent( RSA *a_pRsa ) {
+#ifdef USE_OPENSSL_110_API
+ const BIGNUM *ret = NULL;
+ RSA_get0_key(a_pRsa, NULL, &ret, NULL);
+ return ret;
+#else
+ return a_pRsa->e;
+#endif
+}
+
+static const BIGNUM*
+getRSAPrivateExponent( RSA *a_pRsa ) {
+#ifdef USE_OPENSSL_110_API
+ const BIGNUM *ret = NULL;
+ RSA_get0_key(a_pRsa, NULL, NULL, &ret);
+ return ret;
+#else
+ return a_pRsa->d;
+#endif
+}
+
+static const BIGNUM*
+getRSAFactorP( RSA *a_pRsa ) {
+#ifdef USE_OPENSSL_110_API
+ const BIGNUM *ret = NULL;
+ RSA_get0_factors(a_pRsa, &ret, NULL);
+ return ret;
+#else
+ return a_pRsa->p;
+#endif
+}
+
+static const BIGNUM*
+getRSAFactorQ( RSA *a_pRsa ) {
+#ifdef USE_OPENSSL_110_API
+ const BIGNUM *ret = NULL;
+ RSA_get0_factors(a_pRsa, NULL, &ret);
+ return ret;
+#else
+ return a_pRsa->q;
+#endif
+}
+
+static const BIGNUM*
+getRSACrtParamDmp1( RSA *a_pRsa ) {
+#ifdef USE_OPENSSL_110_API
+ const BIGNUM *ret = NULL;
+ RSA_get0_crt_params(a_pRsa, &ret, NULL, NULL);
+ return ret;
+#else
+ return a_pRsa->dmp1;
+#endif
+}
+
+static const BIGNUM*
+getRSACrtParamDmq1( RSA *a_pRsa ) {
+#ifdef USE_OPENSSL_110_API
+ const BIGNUM *ret = NULL;
+ RSA_get0_crt_params(a_pRsa, NULL, &ret, NULL);
+ return ret;
+#else
+ return a_pRsa->dmq1;
+#endif
+}
+
+static const BIGNUM*
+getRSACrtParamIqmp( RSA *a_pRsa ) {
+#ifdef USE_OPENSSL_110_API
+ const BIGNUM *ret = NULL;
+ RSA_get0_crt_params(a_pRsa, NULL, NULL, &ret);
+ return ret;
+#else
+ return a_pRsa->iqmp;
+#endif
+}
+
+static int
+getEVPKeyType( EVP_PKEY *a_pKey ) {
+#ifdef USE_OPENSSL_110_API
+ return EVP_PKEY_base_id( a_pKey );
+#else
+ return EVP_PKEY_type( a_pKey->type );
+#endif
+}
+
+
/*
* parseCallback
* Process the command specific options.
@@ -372,7 +473,7 @@ readX509Cert( const char *a_pszFile,
goto out;
}
- if ( EVP_PKEY_type( pKey->type ) != EVP_PKEY_RSA ) {
+ if ( getEVPKeyType(pKey) != EVP_PKEY_RSA ) {
logError( TOKEN_RSA_KEY_ERROR );
X509_free( pX509 );
@@ -690,9 +791,11 @@ createRsaPubKeyObject( RSA *a_pRsa,
CK_OBJECT_HANDLE *a_hObject ) {
int rc = -1;
+ const BIGNUM *bn_n = getRSAModulus(a_pRsa);
+ const BIGNUM *bn_e = getRSAPublicExponent(a_pRsa);
- int nLen = BN_num_bytes( a_pRsa->n );
- int eLen = BN_num_bytes( a_pRsa->e );
+ int nLen = BN_num_bytes( bn_n );
+ int eLen = BN_num_bytes( bn_e );
CK_RV rv;
@@ -732,8 +835,8 @@ createRsaPubKeyObject( RSA *a_pRsa,
}
// Get binary representations of the RSA key information
- BN_bn2bin( a_pRsa->n, n );
- BN_bn2bin( a_pRsa->e, e );
+ BN_bn2bin( bn_n, n );
+ BN_bn2bin( bn_e, e );
// Create the RSA public key object
rv = createObject( a_hSession, tAttr, ulAttrCount, a_hObject );
@@ -760,14 +863,23 @@ createRsaPrivKeyObject( RSA *a_pRsa,
int rc = -1;
- int nLen = BN_num_bytes( a_pRsa->n );
- int eLen = BN_num_bytes( a_pRsa->e );
- int dLen = BN_num_bytes( a_pRsa->d );
- int pLen = BN_num_bytes( a_pRsa->p );
- int qLen = BN_num_bytes( a_pRsa->q );
- int dmp1Len = BN_num_bytes( a_pRsa->dmp1 );
- int dmq1Len = BN_num_bytes( a_pRsa->dmq1 );
- int iqmpLen = BN_num_bytes( a_pRsa->iqmp );
+ const BIGNUM *bn_n = getRSAModulus(a_pRsa);
+ const BIGNUM *bn_e = getRSAPublicExponent(a_pRsa);
+ const BIGNUM *bn_d = getRSAPrivateExponent(a_pRsa);
+ const BIGNUM *bn_p = getRSAFactorP(a_pRsa);
+ const BIGNUM *bn_q = getRSAFactorQ(a_pRsa);
+ const BIGNUM *bn_dmp1 = getRSACrtParamDmp1(a_pRsa);
+ const BIGNUM *bn_dmq1 = getRSACrtParamDmq1(a_pRsa);
+ const BIGNUM *bn_iqmp = getRSACrtParamIqmp(a_pRsa);
+
+ int nLen = BN_num_bytes( bn_n );
+ int eLen = BN_num_bytes( bn_e );
+ int dLen = BN_num_bytes( bn_d );
+ int pLen = BN_num_bytes( bn_p );
+ int qLen = BN_num_bytes( bn_q );
+ int dmp1Len = BN_num_bytes( bn_dmp1 );
+ int dmq1Len = BN_num_bytes( bn_dmq1 );
+ int iqmpLen = BN_num_bytes( bn_iqmp );
CK_RV rv;
@@ -821,14 +933,14 @@ createRsaPrivKeyObject( RSA *a_pRsa,
}
// Get binary representations of the RSA key information
- BN_bn2bin( a_pRsa->n, n );
- BN_bn2bin( a_pRsa->e, e );
- BN_bn2bin( a_pRsa->d, d );
- BN_bn2bin( a_pRsa->p, p );
- BN_bn2bin( a_pRsa->q, q );
- BN_bn2bin( a_pRsa->dmp1, dmp1 );
- BN_bn2bin( a_pRsa->dmq1, dmq1 );
- BN_bn2bin( a_pRsa->iqmp, iqmp );
+ BN_bn2bin( bn_n, n );
+ BN_bn2bin( bn_e, e );
+ BN_bn2bin( bn_d, d );
+ BN_bn2bin( bn_p, p );
+ BN_bn2bin( bn_q, q );
+ BN_bn2bin( bn_dmp1, dmp1 );
+ BN_bn2bin( bn_dmq1, dmq1 );
+ BN_bn2bin( bn_iqmp, iqmp );
// Create the RSA private key object
rv = createObject( a_hSession, tAttr, ulAttrCount, a_hObject );
--
2.13.6

3
tpm-tools-1.3.9.1.tar.gz
View File

@ -1,3 +0,0 @@
version https://git-lfs.github.com/spec/v1
oid sha256:9cb714e2650826e2e932f65bc0ba9d61b927dc5fea47f2c2a2b64f0fdfcbfa68
size 482859

BIN
tpm-tools-1.3.9.2.tar.gz (Stored with Git LFS) Normal file
View File

Binary file not shown.

8
tpm-tools.changes
View File

@ -1,3 +1,11 @@
-------------------------------------------------------------------
Wed Mar 3 11:29:22 UTC 2021 - Matthias Gerstner <matthias.gerstner@suse.com>
- upgrade to minor version 1.3.9.2:
- upstream now provide openssl 1.1 compatibility on their own
- dropped 0001-Fix-build-against-OpenSSL-1.1.0.patch since the tarbal is now
compatible.
-------------------------------------------------------------------
Thu Nov 9 17:14:32 UTC 2017 - matthias.gerstner@suse.com

16
tpm-tools.spec
View File

@ -1,7 +1,7 @@
#
# spec file for package tpm-tools
#
# Copyright (c) 2017 SUSE LINUX GmbH, Nuernberg, Germany.
# Copyright (c) 2021 SUSE LLC
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
@ -12,18 +12,18 @@
# license that conforms to the Open Source Definition (Version 1.9)
# published by the Open Source Initiative.
# Please submit bugfixes or comments via http://bugs.opensuse.org/
# Please submit bugfixes or comments via https://bugs.opensuse.org/
#
%define lib_name libtpm_unseal1
Name: tpm-tools
Version: 1.3.9.1
Version: 1.3.9.2
Release: 0
Summary: Trusted Platform Module (TPM) administration tools
License: IPL-1.0
Group: Productivity/Security
Url: http://trousers.sourceforge.net/
URL: http://trousers.sourceforge.net/
Source0: http://downloads.sourceforge.net/project/trousers/tpm-tools/%{version}/tpm-tools-%{version}.tar.gz
BuildRequires: autoconf
BuildRequires: automake
@ -32,9 +32,6 @@ BuildRequires: openCryptoki-devel
BuildRequires: openssl-devel
BuildRequires: trousers-devel
BuildRoot: %{_tmppath}/%{name}-%{version}-build
# upstream has already got a pull request for this problem but didn't react
# for some months... so this is my own patch to tackle the problem
Patch0: 0001-Fix-build-against-OpenSSL-1.1.0.patch
%description
Trusted Computing is a set of specifications published by the Trusted
@ -92,11 +89,10 @@ This package contains the libraries and headers necessary for developing
tpm-tools applications.
%prep
%setup -q -c %{name}-%{version}
%patch0 -p1
%setup -q -n %{name}-%{version}
%build
autoreconf -fiv
sh bootstrap.sh
# Disable unused-but-set warnings with gcc >= 4.6
%configure \
--disable-static