Hi, Thanks for the hint. I will give it a try.
You are right, I forgot host-openssl as dependency. Regards, Denis Am Freitag, den 12.03.2021, 08:47 +0100 schrieb Michael Olbrich: > On Mon, Mar 08, 2021 at 12:35:08PM +0000, Denis Osterland-Heim wrote: > > This package provides the pkcs11 plugin for yubi HSMs, > > which allows to create a signing provider for it. > > > > Patches are sent upstream: https://github.com/Yubico/yubihsm-shell/pull/162 > > > > To use it together with a CA server: > > Since ab4af48ba ("ptxd_make_world_init: try to prevent downloads outside > > the get stage") > > `noproxy=*` in the yubihsm.conf is required to allow libcurl HTTP > > communication in compile stage. > > Hmmm, I think you should be able to extend CODE_SIGNING_ENV and add > "HTTPS_PROXY= HTTP_PROXY= https_proxy= http_proxy=". That should be > evaluated after the variables set by ab4af48ba and clear them. > > And expanding CODE_SIGNING_ENV depending on the signing provider is > expected. We already do this for softhsm: > rules/pre/020-code-signing-softhsm.make > > Michael > > > Signed-off-by: Denis Osterland-Heim <[email protected]> > > --- > > ...lient-cert-support-for-pkcs11-module.patch | 88 +++++++++++++++++++ > > ...002-add-bash-like-variable-extension.patch | 67 ++++++++++++++ > > .../0003-add-noproxy-option.patch | 76 ++++++++++++++++ > > patches/yubihsm-shell-2.1.0/series | 6 ++ > > rules/host-yubihsm-shell.in | 13 +++ > > rules/host-yubihsm-shell.make | 37 ++++++++ > > 6 files changed, 287 insertions(+) > > create mode 100644 > > patches/yubihsm-shell-2.1.0/0001-add-client-cert-support-for-pkcs11-module.patch > > create mode 100644 > > patches/yubihsm-shell-2.1.0/0002-add-bash-like-variable-extension.patch > > create mode 100644 > > patches/yubihsm-shell-2.1.0/0003-add-noproxy-option.patch > > create mode 100644 patches/yubihsm-shell-2.1.0/series > > create mode 100644 rules/host-yubihsm-shell.in > > create mode 100644 rules/host-yubihsm-shell.make > > > > diff --git > > a/patches/yubihsm-shell-2.1.0/0001-add-client-cert-support-for-pkcs11-module.patch > > > > b/patches/yubihsm-shell-2.1.0/0001-add-client-cert-support-for-pkcs11-module.patch > > new file mode 100644 > > index 000000000..dbce11c85 > > --- /dev/null > > +++ > > b/patches/yubihsm-shell-2.1.0/0001-add-client-cert-support-for-pkcs11-module.patch > > @@ -0,0 +1,88 @@ > > +From: Denis Osterland-Heim <[email protected]> > > +Date: Tue, 26 Jan 2021 14:19:52 +0100 > > +Subject: [PATCH] add client cert support for pkcs11 module > > + > > +Allows to authenticate with client certificates at HSM server. > > + > > +Signed-off-by: Denis Osterland-Heim <[email protected]> > > +--- > > + lib/yubihsm.h | 6 ++++++ > > + lib/yubihsm_curl.c | 8 ++++++++ > > + pkcs11/cmdline.ggo | 2 ++ > > + pkcs11/yubihsm_pkcs11.c | 14 ++++++++++++++ > > + 4 files changed, 30 insertions(+) > > + > > +diff --git a/lib/yubihsm.h b/lib/yubihsm.h > > +index ef80d42b1865..da08f68038dd 100644 > > +--- a/lib/yubihsm.h > > ++++ b/lib/yubihsm.h > > +@@ -518,6 +518,12 @@ typedef enum { > > + /// Proxy server to use for connecting to the connector (const char *). > > Not > > + /// implemented on Windows > > + YH_CONNECTOR_PROXY_SERVER = 2, > > ++ /// File with client certificate to authenticate client with (const > > char *). > > ++ /// Not implemented on Windows > > ++ YH_CONNECTOR_HTTPS_CERT = 3, > > ++ /// File with client certificates key (const char *). > > ++ /// Not implemented on Windows > > ++ YH_CONNECTOR_HTTPS_KEY = 4, > > + } yh_connector_option; > > + > > + #pragma pack(push, 1) > > +diff --git a/lib/yubihsm_curl.c b/lib/yubihsm_curl.c > > +index 6360f3693268..2f46802e0fe1 100644 > > +--- a/lib/yubihsm_curl.c > > ++++ b/lib/yubihsm_curl.c > > +@@ -231,6 +231,14 @@ static yh_rc backend_option(yh_backend *connection, > > yh_connector_option opt, > > + option = CURLOPT_CAINFO; > > + optname = "CURLOPT_CAINFO"; > > + break; > > ++ case YH_CONNECTOR_HTTPS_CERT: > > ++ option = CURLOPT_SSLCERT; > > ++ optname = "CURLOPT_SSLCERT"; > > ++ break; > > ++ case YH_CONNECTOR_HTTPS_KEY: > > ++ option = CURLOPT_SSLKEY; > > ++ optname = "CURLOPT_SSLKEY"; > > ++ break; > > + case YH_CONNECTOR_PROXY_SERVER: > > + option = CURLOPT_PROXY; > > + optname = "CURLOPT_PROXY"; > > +diff --git a/pkcs11/cmdline.ggo b/pkcs11/cmdline.ggo > > +index 9a357b73062d..9e87e2aa2861 100644 > > +--- a/pkcs11/cmdline.ggo > > ++++ b/pkcs11/cmdline.ggo > > +@@ -21,6 +21,8 @@ option "dinout" - "Enable pkcs11 function tracing" flag > > off > > + option "libdebug" - "Enable libyubihsm debugging" flag off > > + option "debug-file" - "Output file for debugging" string optional > > default="stderr" > > + option "cacert" - "Cacert to use for HTTPS validation" string optional > > ++option "cert" - "HTTPS client certificate to authenticate with" string > > optional > > ++option "key" - "HTTPS client certificate key" string optional > > + option "proxy" - "Proxy server to use for connector" string optional > > + option "timeout" - "Timeout to use for initial connection to connector" > > int optional default="5" > > + option "device-pubkey" - "List of device public keys allowed for > > asymmetric authentication" string optional multiple > > +diff --git a/pkcs11/yubihsm_pkcs11.c b/pkcs11/yubihsm_pkcs11.c > > +index f543c94ed373..25aec8e7c5fe 100644 > > +--- a/pkcs11/yubihsm_pkcs11.c > > ++++ b/pkcs11/yubihsm_pkcs11.c > > +@@ -275,6 +275,20 @@ CK_DEFINE_FUNCTION(CK_RV, C_Initialize)(CK_VOID_PTR > > pInitArgs) { > > + goto c_i_failure; > > + } > > + } > > ++ if (args_info.cert_given) { > > ++ if (yh_set_connector_option(connector_list[i], > > YH_CONNECTOR_HTTPS_CERT, > > ++ args_info.cert_arg) != YHR_SUCCESS) { > > ++ DBG_ERR("Failed to set HTTPS cert option"); > > ++ goto c_i_failure; > > ++ } > > ++ } > > ++ if (args_info.key_given) { > > ++ if (yh_set_connector_option(connector_list[i], > > YH_CONNECTOR_HTTPS_KEY, > > ++ args_info.key_arg) != YHR_SUCCESS) { > > ++ DBG_ERR("Failed to set HTTPS key option"); > > ++goto c_i_failure; > > ++ } > > ++ } > > + if (args_info.proxy_given) { > > + if (yh_set_connector_option(connector_list[i], > > YH_CONNECTOR_PROXY_SERVER, > > + args_info.proxy_arg) != YHR_SUCCESS) { > > diff --git > > a/patches/yubihsm-shell-2.1.0/0002-add-bash-like-variable-extension.patch > > b/patches/yubihsm-shell-2.1.0/0002-add-bash-like-variable-extension.patch > > new file mode 100644 > > index 000000000..e3d64659a > > --- /dev/null > > +++ > > b/patches/yubihsm-shell-2.1.0/0002-add-bash-like-variable-extension.patch > > @@ -0,0 +1,67 @@ > > +From: Denis Osterland-Heim <[email protected]> > > +Date: Tue, 2 Feb 2021 08:50:48 +0100 > > +Subject: [PATCH] add bash like variable extension > > + > > +Support for `~` and environment variables like `${HOME}`. > > + > > +Signed-off-by: Denis Osterland-Heim <[email protected]> > > +--- > > + lib/yubihsm_curl.c | 18 +++++++++++++++++- > > + 1 file changed, 17 insertions(+), 1 deletion(-) > > + > > +diff --git a/lib/yubihsm_curl.c b/lib/yubihsm_curl.c > > +index 2f46802e0fe1..52ca14ddf2d4 100644 > > +--- a/lib/yubihsm_curl.c > > ++++ b/lib/yubihsm_curl.c > > +@@ -16,6 +16,7 @@ > > + > > + #include <string.h> > > + #include <errno.h> > > ++#include <wordexp.h> > > + > > + #include <arpa/inet.h> > > + > > +@@ -225,19 +226,24 @@ static yh_rc backend_option(yh_backend *connection, > > yh_connector_option opt, > > + const void *val) { > > + CURLoption option; > > + const char *optname; > > ++ wordexp_t expanded; > > ++ bool expand = false; > > + > > + switch (opt) { > > + case YH_CONNECTOR_HTTPS_CA: > > + option = CURLOPT_CAINFO; > > + optname = "CURLOPT_CAINFO"; > > ++ expand = true; > > + break; > > + case YH_CONNECTOR_HTTPS_CERT: > > + option = CURLOPT_SSLCERT; > > + optname = "CURLOPT_SSLCERT"; > > ++ expand = true; > > + break; > > + case YH_CONNECTOR_HTTPS_KEY: > > + option = CURLOPT_SSLKEY; > > + optname = "CURLOPT_SSLKEY"; > > ++ expand = true; > > + break; > > + case YH_CONNECTOR_PROXY_SERVER: > > + option = CURLOPT_PROXY; > > +@@ -247,7 +253,17 @@ static yh_rc backend_option(yh_backend *connection, > > yh_connector_option opt, > > + DBG_ERR("%d is an unknown option", opt); > > + return YHR_INVALID_PARAMETERS; > > + } > > +- CURLcode rc = curl_easy_setopt(connection, option, (char *) val); > > ++ if (expand) > > ++ { > > ++ if (wordexp((const char *)val, &expanded, 0)) > > ++ { > > ++ DBG_ERR("Failed to expand %s\n", optname); > > ++ return YHR_CONNECTOR_ERROR; > > ++ } > > ++ } > > ++ CURLcode rc = curl_easy_setopt(connection, option, expand ? > > expanded.we_wordv[0] : (char *) val); > > ++ if (expand) > > ++ wordfree(&expanded); > > + if (rc == CURLE_OK) { > > + DBG_INFO("Successfully set %s.", optname); > > + return YHR_SUCCESS; > > diff --git a/patches/yubihsm-shell-2.1.0/0003-add-noproxy-option.patch > > b/patches/yubihsm-shell-2.1.0/0003-add-noproxy-option.patch > > new file mode 100644 > > index 000000000..788b9cacf > > --- /dev/null > > +++ b/patches/yubihsm-shell-2.1.0/0003-add-noproxy-option.patch > > @@ -0,0 +1,76 @@ > > +From: Denis Osterland-Heim <[email protected]> > > +Date: Tue, 2 Feb 2021 08:32:54 +0100 > > +Subject: [PATCH] add noproxy option > > + > > +work-around for > > https://git.pengutronix.de/cgit/ptxdist/commit/?id=ab4af48ba403167f42c417f8ecfef1d0a870c0c3 > > + > > +Use `noproxy=*` in your config file to use the plugin outside of > > +get stage, e.g. in barebox compile stage. > > + > > +Signed-off-by: Denis Osterland-Heim <[email protected]> > > +--- > > + lib/yubihsm.h | 3 +++ > > + lib/yubihsm_curl.c | 4 ++++ > > + pkcs11/cmdline.ggo | 1 + > > + pkcs11/yubihsm_pkcs11.c | 7 +++++++ > > + 4 files changed, 15 insertions(+) > > + > > +diff --git a/lib/yubihsm.h b/lib/yubihsm.h > > +index da08f68038dd..5f90eca0d8e8 100644 > > +--- a/lib/yubihsm.h > > ++++ b/lib/yubihsm.h > > +@@ -524,6 +524,9 @@ typedef enum { > > + /// File with client certificates key (const char *). > > + /// Not implemented on Windows > > + YH_CONNECTOR_HTTPS_KEY = 4, > > ++ /// Comma separated list of hosts ignoring proxy, `*` to disable proxy. > > ++ /// Not implemented on Windows > > ++ YH_CONNECTOR_NOPROXY = 5, > > + } yh_connector_option; > > + > > + #pragma pack(push, 1) > > +diff --git a/lib/yubihsm_curl.c b/lib/yubihsm_curl.c > > +index 52ca14ddf2d4..f7f7cd8f54da 100644 > > +--- a/lib/yubihsm_curl.c > > ++++ b/lib/yubihsm_curl.c > > +@@ -249,6 +249,10 @@ static yh_rc backend_option(yh_backend *connection, > > yh_connector_option opt, > > + option = CURLOPT_PROXY; > > + optname = "CURLOPT_PROXY"; > > + break; > > ++ case YH_CONNECTOR_NOPROXY: > > ++ option = CURLOPT_NOPROXY; > > ++ optname = "CURLOPT_NOPROXY"; > > ++ break; > > + default: > > + DBG_ERR("%d is an unknown option", opt); > > + return YHR_INVALID_PARAMETERS; > > +diff --git a/pkcs11/cmdline.ggo b/pkcs11/cmdline.ggo > > +index 9e87e2aa2861..cdf97ae0d33d 100644 > > +--- a/pkcs11/cmdline.ggo > > ++++ b/pkcs11/cmdline.ggo > > +@@ -24,6 +24,7 @@ option "cacert" - "Cacert to use for HTTPS validation" > > string optional > > + option "cert" - "HTTPS client certificate to authenticate with" string > > optional > > + option "key" - "HTTPS client certificate key" string optional > > + option "proxy" - "Proxy server to use for connector" string optional > > ++option "noproxy" - "Comma separated list of hosts ignore proxy for" > > string optional > > + option "timeout" - "Timeout to use for initial connection to connector" > > int optional default="5" > > + option "device-pubkey" - "List of device public keys allowed for > > asymmetric authentication" string optional multiple > > + > > +diff --git a/pkcs11/yubihsm_pkcs11.c b/pkcs11/yubihsm_pkcs11.c > > +index 25aec8e7c5fe..38b08bbf8000 100644 > > +--- a/pkcs11/yubihsm_pkcs11.c > > ++++ b/pkcs11/yubihsm_pkcs11.c > > +@@ -296,6 +296,13 @@ CK_DEFINE_FUNCTION(CK_RV, C_Initialize)(CK_VOID_PTR > > pInitArgs) { > > + goto c_i_failure; > > + } > > + } > > ++ if (args_info.noproxy_given) { > > ++ if (yh_set_connector_option(connector_list[i], YH_CONNECTOR_NOPROXY, > > ++ args_info.noproxy_arg) != YHR_SUCCESS) { > > ++ DBG_ERR("Failed to set noproxy option"); > > ++goto c_i_failure; > > ++ } > > ++ } > > + > > + if (yh_connect(connector_list[i], args_info.timeout_arg) != > > YHR_SUCCESS) { > > + DBG_ERR("Failed to connect '%s'", args_info.connector_arg[i]); > > diff --git a/patches/yubihsm-shell-2.1.0/series > > b/patches/yubihsm-shell-2.1.0/series > > new file mode 100644 > > index 000000000..a0fbb2915 > > --- /dev/null > > +++ b/patches/yubihsm-shell-2.1.0/series > > @@ -0,0 +1,6 @@ > > +# generated by git-ptx-patches > > +#tag:base --start-number 1 > > +0001-add-client-cert-support-for-pkcs11-module.patch > > +0002-add-bash-like-variable-extension.patch > > +0003-add-noproxy-option.patch > > +# fcbee908545e468ec4e840d2d56da1be - git-ptx-patches magic > > diff --git a/rules/host-yubihsm-shell.in b/rules/host-yubihsm-shell.in > > new file mode 100644 > > index 000000000..3b17a2e98 > > --- /dev/null > > +++ b/rules/host-yubihsm-shell.in > > @@ -0,0 +1,13 @@ > > +## SECTION=hosttools_noprompt > > + > > +config HOST_YUBIHSM_SHELL > > +tristate > > +default ALLYES > > +select HOST_CMAKE > > +select HOST_OPENSSL > > +select HOST_LIBCURL > > +select HOST_LIBUSB > > +select HOST_GENGETOPT > > +select HOST_LIBEDIT > > +select HOST_PCSC_LITE > > +select HOST_LIBP11 > > diff --git a/rules/host-yubihsm-shell.make b/rules/host-yubihsm-shell.make > > new file mode 100644 > > index 000000000..3ebfc8c1f > > --- /dev/null > > +++ b/rules/host-yubihsm-shell.make > > @@ -0,0 +1,37 @@ > > +# -*-makefile-*- > > +# > > +# Copyright (C) 2021 by Denis Osterland-Heim <[email protected]> > > +# > > +# For further information about the PTXdist project and license conditions > > +# see the README file. > > +# > > + > > +HOST_PACKAGES-$(PTXCONF_HOST_YUBIHSM_SHELL) += host-yubihsm-shell > > + > > +# > > +# Paths and names > > +# > > +HOST_YUBIHSM_SHELL_VERSION:= 2.1.0 > > +HOST_YUBIHSM_SHELL_MD5:= 7363c0bc4ed037e262474beaa6e1407b > > +HOST_YUBIHSM_SHELL:= yubihsm-shell-$(HOST_YUBIHSM_SHELL_VERSION) > > +HOST_YUBIHSM_SHELL_SUFFIX:= tar.gz > > +HOST_YUBIHSM_SHELL_URL:= > > https://github.com/Yubico/yubihsm-shell/archive/$(HOST_YUBIHSM_SHELL_VERSION).$(HOST_YUBIHSM_SHELL_SUFFIX) > > +HOST_YUBIHSM_SHELL_SOURCE:= > > $(SRCDIR)/$(HOST_YUBIHSM_SHELL).$(HOST_YUBIHSM_SHELL_SUFFIX) > > +HOST_YUBIHSM_SHELL_DIR:= $(HOST_BUILDDIR)/$(HOST_YUBIHSM_SHELL) > > + > > +# > > ---------------------------------------------------------------------------- > > +# Prepare > > +# > > ---------------------------------------------------------------------------- > > + > > +# > > +# cmake > > +# > > +HOST_YUBIHSM_SHELL_CONF_TOOL:= cmake > > +HOST_YUBIHSM_SHELL_CONF_OPT:= \ > > +$(HOST_CMAKE_OPT) \ > > +-DBUILD_ONLY_LIB=OFF \ > > +-DENABLE_COVERAGE=OFF \ > > +-DSUPRESS_MSVC_WARNINGS=ON \ > > +-DWITHOUT_MANPAGES=1 > > + > > +# vim: syntax=make > > -- > > 2.30.1 > > > > Diehl Connectivity Solutions GmbH > > Geschäftsführung: Horst Leonberger > > Sitz der Gesellschaft: Nürnberg - Registergericht: Amtsgericht > > Nürnberg: HRB 32315 > > > > ________________________________ > > > > Der Inhalt der vorstehenden E-Mail ist nicht rechtlich bindend. Diese > > E-Mail enthaelt vertrauliche und/oder rechtlich geschuetzte Informationen. > > Informieren Sie uns bitte, wenn Sie diese E-Mail faelschlicherweise > > erhalten haben. Bitte loeschen Sie in diesem Fall die Nachricht. > > Jede unerlaubte Form der Reproduktion, Bekanntgabe, Aenderung, Verteilung > > und/oder Publikation dieser E-Mail ist strengstens untersagt. > > > > - Informationen zum Datenschutz, insbesondere zu Ihren Rechten, erhalten > > Sie unter: > > > > https://www.diehl.com/group/de/transparenz-und-informationspflichten/ > > > > The contents of the above mentioned e-mail is not legally binding. This > > e-mail contains confidential and/or legally protected information. Please > > inform us if you have received this e-mail by > > mistake and delete it in such a case. Each unauthorized reproduction, > > disclosure, alteration, distribution and/or publication of this e-mail is > > strictly prohibited. > > > > - For general information on data protection and your respective rights > > please visit: > > > > https://www.diehl.com/group/en/transparency-and-information-obligations/ > > > > > > > > _______________________________________________ > > ptxdist mailing list > > [email protected] > > To unsubscribe, send a mail with subject "unsubscribe" to > > [email protected] > > > > _______________________________________________ > ptxdist mailing list > [email protected] > To unsubscribe, send a mail with subject "unsubscribe" to > [email protected] Diehl Connectivity Solutions GmbH Geschäftsführung: Horst Leonberger Sitz der Gesellschaft: Nürnberg - Registergericht: Amtsgericht Nürnberg: HRB 32315 ________________________________ Der Inhalt der vorstehenden E-Mail ist nicht rechtlich bindend. Diese E-Mail enthaelt vertrauliche und/oder rechtlich geschuetzte Informationen. Informieren Sie uns bitte, wenn Sie diese E-Mail faelschlicherweise erhalten haben. Bitte loeschen Sie in diesem Fall die Nachricht. Jede unerlaubte Form der Reproduktion, Bekanntgabe, Aenderung, Verteilung und/oder Publikation dieser E-Mail ist strengstens untersagt. - Informationen zum Datenschutz, insbesondere zu Ihren Rechten, erhalten Sie unter: https://www.diehl.com/group/de/transparenz-und-informationspflichten/ The contents of the above mentioned e-mail is not legally binding. This e-mail contains confidential and/or legally protected information. Please inform us if you have received this e-mail by mistake and delete it in such a case. Each unauthorized reproduction, disclosure, alteration, distribution and/or publication of this e-mail is strictly prohibited. - For general information on data protection and your respective rights please visit: https://www.diehl.com/group/en/transparency-and-information-obligations/ _______________________________________________ ptxdist mailing list [email protected] To unsubscribe, send a mail with subject "unsubscribe" to [email protected]
