From: Frank Lichtenheld <[email protected]> 1.27 is in distros like Debian 11 (which is EOL) and RHEL 9 (which has a version we can't build against due to missing RSA support).
Simplify code and require 1.28. Change-Id: I2d5cd41ad2e424530c73a4461bdd4a8f529b8b56 Signed-off-by: Frank Lichtenheld <[email protected]> Acked-by: Razvan Cojocaru <[email protected]> Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1989 --- This change was reviewed on Gerrit and approved by at least one developer. I request to merge it to master. Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1989 This mail reflects revision 2 of this Change. Acked-by according to Gerrit (reflected above): Razvan Cojocaru <[email protected]> diff --git a/CMakeLists.txt b/CMakeLists.txt index bac4dd4..0d71751 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -305,7 +305,7 @@ endif () if (${ENABLE_PKCS11}) - pkg_search_module(pkcs11-helper libpkcs11-helper-1 REQUIRED IMPORTED_TARGET) + pkg_search_module(pkcs11-helper libpkcs11-helper-1>=1.28 REQUIRED IMPORTED_TARGET) endif () function(check_mbed_configuration) diff --git a/configure.ac b/configure.ac index 56109af..7d1edb2 100644 --- a/configure.ac +++ b/configure.ac @@ -1181,7 +1181,7 @@ if test "${enable_pkcs11}" = "yes"; then PKG_CHECK_MODULES( [PKCS11_HELPER], - [libpkcs11-helper-1 >= 1.11], + [libpkcs11-helper-1 >= 1.28], [have_pkcs11_helper="yes"], [AC_MSG_ERROR([PKCS11 enabled but libpkcs11-helper is missing])] ) diff --git a/src/openvpn/pkcs11.c b/src/openvpn/pkcs11.c index d7dee97..b2173a8 100644 --- a/src/openvpn/pkcs11.c +++ b/src/openvpn/pkcs11.c @@ -329,7 +329,6 @@ msg(M_INFO, "PKCS#11: Adding PKCS#11 provider '%s'", provider); -#if PKCS11H_VERSION >= ((1 << 16) | (28 << 8) | (0 << 0)) if ((rv = pkcs11h_registerProvider(provider)) != CKR_OK) { msg(M_WARN, "PKCS#11: Cannot register provider '%s' %ld-'%s'", provider, rv, @@ -376,15 +375,6 @@ pkcs11h_removeProvider(provider); } } -#else /* if PKCS11H_VERSION >= ((1<<16) | (28<<8) | (0<<0)) */ - if ((rv = pkcs11h_addProvider(provider, provider, protected_auth, private_mode, - PKCS11H_SLOTEVENT_METHOD_AUTO, 0, cert_private)) - != CKR_OK) - { - msg(M_WARN, "PKCS#11: Cannot initialize provider '%s' %ld-'%s'", provider, rv, - pkcs11h_getMessage(rv)); - } -#endif /* if PKCS11H_VERSION >= ((1<<16) | (28<<8) | (0<<0)) */ dmsg(D_PKCS11_DEBUG, "PKCS#11: pkcs11_addProvider - return rv=%ld-'%s'", rv, pkcs11h_getMessage(rv)); diff --git a/src/openvpn/pkcs11_openssl.c b/src/openvpn/pkcs11_openssl.c index 24dce84..8abd60a 100644 --- a/src/openvpn/pkcs11_openssl.c +++ b/src/openvpn/pkcs11_openssl.c @@ -43,8 +43,6 @@ #ifdef HAVE_XKEY_PROVIDER static XKEY_EXTERNAL_SIGN_fn xkey_pkcs11h_sign; -#if PKCS11H_VERSION > ((1 << 16) | (27 << 8)) /* version > 1.27 */ - /* Table linking OpenSSL digest NID with CKM and CKG constants in PKCS#11 */ #define MD_TYPE(n) { NID_sha##n, CKM_SHA##n, CKG_MGF1_SHA##n } static const struct @@ -132,31 +130,6 @@ return ret; } -#else /* if PKCS11H_VERSION > ((1<<16) | (27<<8)) */ - -/* Make set_pss_params a no-op that always succeeds */ -#define set_pss_params(...) (1) - -/* Use a wrapper for pkcs11h_certificate_signAny_ex() for versions < 1.28 - * where its not available. - * We just call pkcs11h_certificate_signAny() unless the padding - * is PSS in which case we return an error. - */ -static CK_RV -pkcs11h_certificate_signAny_ex(const pkcs11h_certificate_t cert, const CK_MECHANISM *mech, - const unsigned char *tbs, size_t tbslen, unsigned char *sig, - size_t *siglen) -{ - if (mech->mechanism == CKM_RSA_PKCS_PSS) - { - msg(M_NONFATAL, "PKCS#11: Error: PSS padding is not supported by " - "this version of pkcs11-helper library."); - return CKR_MECHANISM_INVALID; - } - return pkcs11h_certificate_signAny(cert, mech->mechanism, tbs, tbslen, sig, siglen); -} -#endif /* PKCS11H_VERSION > 1.27 */ - /** * Sign op called from xkey provider * _______________________________________________ Openvpn-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/openvpn-devel
