Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package intel-ipsec-mb for openSUSE:Factory checked in at 2026-10-31 23:06:40 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/intel-ipsec-mb (Old) and /work/SRC/openSUSE:Factory/.intel-ipsec-mb.new.1255 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "intel-ipsec-mb" Sat Oct 31 23:06:40 2026 rev:8 rq:1393977 version:3.0.1 Changes: -------- --- /work/SRC/openSUSE:Factory/intel-ipsec-mb/intel-ipsec-mb.changes 2026-05-29 18:08:12.509107274 +0200 +++ /work/SRC/openSUSE:Factory/.intel-ipsec-mb.new.1255/intel-ipsec-mb.changes 2026-10-31 23:06:43.049824851 +0100 @@ -1,0 +2,66 @@ +Fri Oct 30 21:50:01 UTC 2026 - Tomasz Kantecki <[email protected]> + +- Added ipsecmb_v3_1.patch file fixing 15.7 x86_64 compilation errors and warnings +- Added intel-ipsec-mb-rpmlintrc file to fix one rpmlint warning + +------------------------------------------------------------------- +Fri Oct 30 21:42:41 UTC 2026 - Tomasz Kantecki <[email protected]> + +- Removed installation of the man page +- Fixed rpmlint warning +- Fixed compilation errors and warnings on 15.7 x86_64 + +------------------------------------------------------------------- +Fri Oct 23 15:10:36 UTC 2026 - Tomasz Kantecki <[email protected]> + +- Fixed spec file references to README and ReleaseNotes.txt + +------------------------------------------------------------------- +Fri Oct 23 10:05:54 UTC 2026 - Tomasz Kantecki <[email protected]> + +- Update to v3.0.1: + * Build system: removed legacy Makefile and Windows `.mak` builds; CMake is now the only supported build flow. + * Build system: GCC and Clang builds now use the C11 standard. + * Licensing: replaced full BSD-3-Clause license text in source files with SPDX identifiers. + * OpenSSL: added `imb-provider`, an OpenSSL 3.x test provider supporting symmetric crypto, hash/HMAC and PQC operations, including asynchronous operation. + * Self-tests: library initialization now fails closed on self-test failure, preventing cryptographic operations on the affected manager until successful reinitialization. + * Architecture support: added AVX10 architecture support. + * AES: added AVX2 Type 2 implementations for AES-CFB, AES-CBC, AES-CMAC and AES-CCM. + * HMAC-SHA1: added variable tag sizes from 4 to 20 bytes. + * SHA3/SHAKE: added SHA3-224/256/384/512, SHAKE128/256 and HMAC-SHA3 support, including optimized AVX2 and AVX512 implementations. + * Zero-length messages: extended support across HMAC and AES-CBC algorithms. + * 3GPP: added implementations of the new 256-bit confidentiality, integrity and combined algorithms based on AES, SNOW5G and ZUC. + * DES/3DES: added a new common SSE Type 1 DES block encryption implementation. + * PQC: added ML-DSA (FIPS 204) and ML-KEM (FIPS 203), including all standardized parameter sets. + * CRC: added AVX2 Type 2 implementations using 256-bit VPCLMULQDQ polynomial folding. + * Constant-time validation: added `CONSTANT_TIME_VALIDATION` build option for detecting secret-dependent branches and memory accesses using Valgrind. + * Wireless algorithms: removed bit-length APIs and non-byte-aligned message length/offset support. + * Direct APIs: removed direct API support for ZUC-EEA3/EIA3, SNOW3G-UEA2/UIA2, KASUMI-F8/F9 and CRC; these algorithms remain available through the job API. + * Removed AES-CTR bit-length, AES-CBCS 1:9, SNOW-V/AEAD SNOW-V, ZUC-EEA3-256 and ZUC-EIA3-256 support. + * Removed QUIC API, custom cipher and custom hash support. + * API validation: added AES-CBC/AES-CFB message length checks and updated CFB APIs to return operation status. + * Test applications: added `imb-safe-check` for detection of sensitive data left in registers and memory. + * Test applications: added `imb-oob` for detecting out-of-bounds reads and writes using guard pages. + * Test applications: expanded SHA3, SHAKE, ML-DSA and ML-KEM coverage across `imb-kat`, `imb-xvalid`, `imb-acvp` and fuzz testing. + * Test applications: added ABI checking and improved zero-length message testing. + * Wycheproof: moved Project Wycheproof coverage into `imb-kat`, updated to the upstream v1 vector set and removed `imb-wycheproof`. + * Performance: added `imb-perf-cmp.py`, PQC benchmarking with `imb-speed-pqc`, SHA3/SHAKE and AVX10 support, and improved `imb-perf` stability. + * Performance: renamed `ipsec_perf_tool.py` to `imb-perf-tool.py` and enhanced core selection and algorithm filtering. + * Tools: added assembly formatting and coverage tools, plus source-file non-ASCII character detection and replacement. +- Fixed issues: + * Fixed SM4-GCM plaintext/ciphertext address calculation (issue #159). + * Fixed SNOW3G and KASUMI JOB API destination pointer calculation (issue #162). + * Fixed SNOW-V-AEAD ciphertext address calculation (issue #161). + * Fixed MD5-HMAC mapping in the performance application. + * Fixed AES-GCM key structure alignment. + * Fixed DES/3DES-CBC plaintext/ciphertext output (issue #169). + * Fixed key pointer handling for AES-GCM, AES-GCM-SGL and SM4-GCM decryption. + * Fixed PON XGEM PLI validation that could result in out-of-bounds memory access. + * Fixed MinGW build issues (issue #185). + * Fixed Windows GCC/MinGW stack alignment issue affecting ZUC-NCA6. + * Fixed AVX10 architecture auto-detection. + * Fixed GHASH job API out-of-bounds read for tag lengths below 16 bytes. +- More details at: + * [intel-ipsec-mb v3.0.0 release](https://github.com/intel/intel-ipsec-mb/releases/tag/v3.0.0) + +------------------------------------------------------------------- Old: ---- intel-ipsec-mb-2.0.2.tar.gz New: ---- intel-ipsec-mb-3.0.1.tar.gz intel-ipsec-mb-rpmlintrc ipsecmb_v3_1.patch ----------(New B)---------- New: - Added ipsecmb_v3_1.patch file fixing 15.7 x86_64 compilation errors and warnings - Added intel-ipsec-mb-rpmlintrc file to fix one rpmlint warning ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ intel-ipsec-mb.spec ++++++ --- /var/tmp/diff_new_pack.BhN39b/_old 2026-10-31 23:06:43.946861912 +0100 +++ /var/tmp/diff_new_pack.BhN39b/_new 2026-10-31 23:06:43.948861994 +0100 @@ -17,9 +17,9 @@ # -%global major 2 +%global major 3 %global minor 0 -%global patch 2 +%global patch 1 # GitHub properties %global githubver %{major}.%{minor}.%{patch} @@ -30,11 +30,13 @@ Name: intel-ipsec-mb Summary: IPSec cryptography library optimized for Intel Architecture Release: 0 -Version: 2.0.2 -License: BSD-3-Clause +Version: 3.0.1 +License: Apache-2.0 AND BSD-3-Clause Group: Development/Libraries/C and C++ URL: https://github.com/intel/%{name} Source0: https://github.com/intel/%{name}/archive/v%{githubver}.tar.gz#/%{githubfull}.tar.gz +Source1: intel-ipsec-mb-rpmlintrc +Patch1: ipsecmb_v3_1.patch ExclusiveArch: x86_64 BuildRequires: cmake BuildRequires: gcc >= 4.8.3 @@ -65,28 +67,29 @@ and primarily targeted at packet processing applications. %prep -%autosetup -n %{name}-%{githubver} +%autosetup -p1 -n %{name}-%{githubver} %build -%cmake +%cmake --no-warn-unused-cli %cmake_build %install %cmake_install +# Do not install the library and development man pages +rm -f %{buildroot}%{_mandir}/man7/libipsec-mb.7* +rm -f %{buildroot}%{_mandir}/man7/libipsec-mb-dev.7* %check %ctest %files -n %{rpm_name}%{major} %license LICENSE -%doc README ReleaseNotes.txt +%doc README.md ReleaseNotes.md %{_libdir}/libIPSec_MB.so.%{version} %{_libdir}/libIPSec_MB.so.%{major} -%{_mandir}/man7/libipsec-mb.7.gz %files devel %{_includedir}/intel-ipsec-mb.h -%{_mandir}/man7/libipsec-mb-dev.7.gz %{_libdir}/libIPSec_MB.so %post -n %{rpm_name}%{major} -p /sbin/ldconfig ++++++ intel-ipsec-mb-2.0.2.tar.gz -> intel-ipsec-mb-3.0.1.tar.gz ++++++ /work/SRC/openSUSE:Factory/intel-ipsec-mb/intel-ipsec-mb-2.0.2.tar.gz /work/SRC/openSUSE:Factory/.intel-ipsec-mb.new.1255/intel-ipsec-mb-3.0.1.tar.gz differ: char 12, line 1 ++++++ intel-ipsec-mb-rpmlintrc ++++++ addFilter("intel-ipsec-mb-devel.*no-dependency-on") ++++++ ipsecmb_v3_1.patch ++++++ diff --git a/lib/openssl/crypto/sha/asm/keccak1600x4-avx512vl.pl b/lib/openssl/crypto/sha/asm/keccak1600x4-avx512vl.pl index 8d80aed6..27fba7cc 100755 --- a/lib/openssl/crypto/sha/asm/keccak1600x4-avx512vl.pl +++ b/lib/openssl/crypto/sha/asm/keccak1600x4-avx512vl.pl @@ -95,7 +95,8 @@ $sf_size="856"; # 48 + 808 = 856 bytes # Emit an internal helper call used by one-shot wrappers. # - Win64: call the provided *_internal shim and bracket it with 32-byte # shadow space so shim entry can use xlate-compatible [rsp+8]/[rsp+16]. -# - non-Win64: call the public API symbol (same base name without _internal). +# - non-Win64: call the local .L_ entry label of the public API function +# (same base name without _internal). # The argument must be the shim/internal symbol name, e.g. # SHA3_shake128_x4_inc_squeeze_avx512vl_internal sub call_internal { @@ -110,8 +111,11 @@ sub call_internal { add \$32, %rsp ___ + # Call the file-local entry label rather than the global symbol so + # no PC32 relocation against a preemptible symbol is emitted + # (rejected by older linkers when building a shared object). return <<___; - call $external_name + call .L_$external_name ___ } diff --git a/perf/ipsec_perf.c b/perf/ipsec_perf.c index 3ce86d96..dbf0fdbc 100644 --- a/perf/ipsec_perf.c +++ b/perf/ipsec_perf.c @@ -1774,7 +1774,7 @@ static inline void set_job_fields(IMB_JOB *job, uint8_t *p_buffer, imb_uint128_t *p_keys, const uint32_t i, const uint32_t index, const IMB_JOB *template) { - uint32_t list_idx; + uint32_t list_idx = 0; /* If IMIX testing is being done, set the buffer size to cipher and hash * going through the list of sizes precalculated */ @@ -1792,10 +1792,7 @@ set_job_fields(IMB_JOB *job, uint8_t *p_buffer, imb_uint128_t *p_keys, const uin uint64_t *p_src = (uint64_t *) get_src_buffer(index, p_buffer); job->src = (const uint8_t *) p_src; - if (imix_list_count != 0) - p_src[0] = xgem_hdr_list[list_idx]; - else - p_src[0] = xgem_hdr_list[0]; + p_src[0] = xgem_hdr_list[list_idx]; } else job->src = get_src_buffer(index, p_buffer); diff --git a/test/oob-app/oob_test.c b/test/oob-app/oob_test.c index e3517ed5..badbdd5a 100644 --- a/test/oob-app/oob_test.c +++ b/test/oob-app/oob_test.c @@ -2151,7 +2151,7 @@ test_ml_dsa_keyops_oob(struct pqc_test_ctx *t, IMB_ML_DSA *ctx, const struct ml_ /* volatile: live across the TEST_SETJMP() checkpoint below */ uint8_t *const volatile sk = oob_buf(&mem->privkey, tv->sk_len, t->oob); uint8_t *const volatile pk = oob_buf(&mem->pubkey, tv->pk_len, t->oob); - int ok = 0; + volatile int ok = 0; memcpy(sk, ref_sk, tv->sk_len); @@ -2213,8 +2213,9 @@ test_ml_dsa_sign_verify_oob(struct pqc_test_ctx *t, IMB_ML_DSA *ctx, const unsigned msg_len, const unsigned ctx_len, const int hedged, const int msg_is_mu) { - uint8_t *msg = oob_buf(&mem->msg, msg_len, t->oob); - uint8_t *sig = oob_buf(&mem->sig, tv->sig_len, t->oob); + /* volatile: reassigned between TEST_SETJMP() checkpoints below */ + uint8_t *volatile msg = oob_buf(&mem->msg, msg_len, t->oob); + uint8_t *volatile sig = oob_buf(&mem->sig, tv->sig_len, t->oob); uint8_t *cstr = oob_buf(&mem->ctxstr, ctx_len, t->oob); uint8_t *rnd = oob_buf(&mem->seed, IMB_ML_DSA_SIGN_RND_BYTES, t->oob); IMB_ML_DSA_SIGN_PARAMS sp; @@ -2534,8 +2535,9 @@ test_ml_kem_encap_decap_oob(struct pqc_test_ctx *t, IMB_ML_KEM *ctx, const int seeded) { uint8_t ref_ss[IMB_ML_KEM_SHARED_SECRET_BYTES]; - uint8_t *ct = oob_buf(&mem->sig, tv->ct_len, t->oob); - uint8_t *ss = oob_buf(&mem->ss, IMB_ML_KEM_SHARED_SECRET_BYTES, t->oob); + /* volatile: reassigned between TEST_SETJMP() checkpoints below */ + uint8_t *volatile ct = oob_buf(&mem->sig, tv->ct_len, t->oob); + uint8_t *volatile ss = oob_buf(&mem->ss, IMB_ML_KEM_SHARED_SECRET_BYTES, t->oob); uint8_t *const m = oob_buf(&mem->seed, IMB_ML_KEM_ENCAP_SEED_BYTES, t->oob); IMB_ML_KEM_ENCAP_PARAMS params;
