Gert Doering has uploaded a new patch set (#3) to the change originally created by Frank Lichtenheld. ( https://gerrit.openvpn.net/c/openvpn/+/1989?usp=email )
The following approvals got outdated and were removed: Code-Review+2 by Răzvan Cojocaru Change subject: Remove support for pkcs11-helper < 1.28 ...................................................................... Remove support for pkcs11-helper < 1.28 1.27 is in distros like Debian 11 (which is EOL) and RHEL 9 (which has a version we can't build against due to missing RSA support). Simplify code and require 1.28. Change-Id: I2d5cd41ad2e424530c73a4461bdd4a8f529b8b56 Signed-off-by: Frank Lichtenheld <[email protected]> Acked-by: Razvan Cojocaru <[email protected]> Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1989 Message-Id: <[email protected]> URL: https://www.mail-archive.com/[email protected]/msg39957.html Signed-off-by: Gert Doering <[email protected]> --- M CMakeLists.txt M configure.ac M src/openvpn/pkcs11.c M src/openvpn/pkcs11_openssl.c 4 files changed, 2 insertions(+), 39 deletions(-) git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/89/1989/3 diff --git a/CMakeLists.txt b/CMakeLists.txt index b286ee2..b85e461 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -306,7 +306,7 @@ endif () if (${ENABLE_PKCS11}) - pkg_search_module(pkcs11-helper libpkcs11-helper-1 REQUIRED IMPORTED_TARGET) + pkg_search_module(pkcs11-helper libpkcs11-helper-1>=1.28 REQUIRED IMPORTED_TARGET) endif () function(check_mbed_configuration) diff --git a/configure.ac b/configure.ac index 6617c8d..e83aba7 100644 --- a/configure.ac +++ b/configure.ac @@ -1183,7 +1183,7 @@ if test "${enable_pkcs11}" = "yes"; then PKG_CHECK_MODULES( [PKCS11_HELPER], - [libpkcs11-helper-1 >= 1.11], + [libpkcs11-helper-1 >= 1.28], [have_pkcs11_helper="yes"], [AC_MSG_ERROR([PKCS11 enabled but libpkcs11-helper is missing])] ) diff --git a/src/openvpn/pkcs11.c b/src/openvpn/pkcs11.c index 09c8996..f00ba9b 100644 --- a/src/openvpn/pkcs11.c +++ b/src/openvpn/pkcs11.c @@ -329,7 +329,6 @@ msg(M_INFO, "PKCS#11: Adding PKCS#11 provider '%s'", provider); -#if PKCS11H_VERSION >= ((1 << 16) | (28 << 8) | (0 << 0)) if ((rv = pkcs11h_registerProvider(provider)) != CKR_OK) { msg(M_WARN, "PKCS#11: Cannot register provider '%s' %ld-'%s'", provider, rv, @@ -376,15 +375,6 @@ pkcs11h_removeProvider(provider); } } -#else /* if PKCS11H_VERSION >= ((1<<16) | (28<<8) | (0<<0)) */ - if ((rv = pkcs11h_addProvider(provider, provider, protected_auth, private_mode, - PKCS11H_SLOTEVENT_METHOD_AUTO, 0, cert_private)) - != CKR_OK) - { - msg(M_WARN, "PKCS#11: Cannot initialize provider '%s' %ld-'%s'", provider, rv, - pkcs11h_getMessage(rv)); - } -#endif /* if PKCS11H_VERSION >= ((1<<16) | (28<<8) | (0<<0)) */ dmsg(D_PKCS11_DEBUG, "PKCS#11: pkcs11_addProvider - return rv=%ld-'%s'", rv, pkcs11h_getMessage(rv)); diff --git a/src/openvpn/pkcs11_openssl.c b/src/openvpn/pkcs11_openssl.c index 24dce84..8abd60a 100644 --- a/src/openvpn/pkcs11_openssl.c +++ b/src/openvpn/pkcs11_openssl.c @@ -43,8 +43,6 @@ #ifdef HAVE_XKEY_PROVIDER static XKEY_EXTERNAL_SIGN_fn xkey_pkcs11h_sign; -#if PKCS11H_VERSION > ((1 << 16) | (27 << 8)) /* version > 1.27 */ - /* Table linking OpenSSL digest NID with CKM and CKG constants in PKCS#11 */ #define MD_TYPE(n) { NID_sha##n, CKM_SHA##n, CKG_MGF1_SHA##n } static const struct @@ -132,31 +130,6 @@ return ret; } -#else /* if PKCS11H_VERSION > ((1<<16) | (27<<8)) */ - -/* Make set_pss_params a no-op that always succeeds */ -#define set_pss_params(...) (1) - -/* Use a wrapper for pkcs11h_certificate_signAny_ex() for versions < 1.28 - * where its not available. - * We just call pkcs11h_certificate_signAny() unless the padding - * is PSS in which case we return an error. - */ -static CK_RV -pkcs11h_certificate_signAny_ex(const pkcs11h_certificate_t cert, const CK_MECHANISM *mech, - const unsigned char *tbs, size_t tbslen, unsigned char *sig, - size_t *siglen) -{ - if (mech->mechanism == CKM_RSA_PKCS_PSS) - { - msg(M_NONFATAL, "PKCS#11: Error: PSS padding is not supported by " - "this version of pkcs11-helper library."); - return CKR_MECHANISM_INVALID; - } - return pkcs11h_certificate_signAny(cert, mech->mechanism, tbs, tbslen, sig, siglen); -} -#endif /* PKCS11H_VERSION > 1.27 */ - /** * Sign op called from xkey provider * -- To view, visit https://gerrit.openvpn.net/c/openvpn/+/1989?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.openvpn.net/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: openvpn Gerrit-Branch: master Gerrit-Change-Id: I2d5cd41ad2e424530c73a4461bdd4a8f529b8b56 Gerrit-Change-Number: 1989 Gerrit-PatchSet: 3 Gerrit-Owner: Frank Lichtenheld <[email protected]> Gerrit-Reviewer: Arne Schwabe <[email protected]> Gerrit-Reviewer: Răzvan Cojocaru <[email protected]> Gerrit-CC: openvpn-devel <[email protected]>
_______________________________________________ Openvpn-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/openvpn-devel
