diff mbox series

[Openvpn-devel,v2] Remove support for pkcs11-helper < 1.28

Message ID 20261017203108.32063-1-gert@greenie.muc.de
State New
Headers
Series [Openvpn-devel,v2] Remove support for pkcs11-helper < 1.28 |

Commit Message

Gert Doering Oct. 17, 2026, 8:31 p.m. UTC 
  From: Frank Lichtenheld <frank@lichtenheld.com>

1.27 is in distros like Debian 11 (which is EOL) and
RHEL 9 (which has a version we can't build against due
to missing RSA support).

Simplify code and require 1.28.

Change-Id: I2d5cd41ad2e424530c73a4461bdd4a8f529b8b56
Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com>
Acked-by: Razvan Cojocaru <razvanc@mailbox.org>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1989
---

This change was reviewed on Gerrit and approved by at least one
developer. I request to merge it to master.

Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1989
This mail reflects revision 2 of this Change.

Acked-by according to Gerrit (reflected above):
Razvan Cojocaru <razvanc@mailbox.org>
diff mbox series

Patch

diff --git a/CMakeLists.txt b/CMakeLists.txt
index bac4dd4..0d71751 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -305,7 +305,7 @@ 
 endif ()
 
 if (${ENABLE_PKCS11})
-    pkg_search_module(pkcs11-helper libpkcs11-helper-1 REQUIRED IMPORTED_TARGET)
+    pkg_search_module(pkcs11-helper libpkcs11-helper-1>=1.28 REQUIRED IMPORTED_TARGET)
 endif ()
 
 function(check_mbed_configuration)
diff --git a/configure.ac b/configure.ac
index 56109af..7d1edb2 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1181,7 +1181,7 @@ 
 if test "${enable_pkcs11}" = "yes"; then
 	PKG_CHECK_MODULES(
 		[PKCS11_HELPER],
-		[libpkcs11-helper-1 >= 1.11],
+		[libpkcs11-helper-1 >= 1.28],
 		[have_pkcs11_helper="yes"],
 		[AC_MSG_ERROR([PKCS11 enabled but libpkcs11-helper is missing])]
 	)
diff --git a/src/openvpn/pkcs11.c b/src/openvpn/pkcs11.c
index d7dee97..b2173a8 100644
--- a/src/openvpn/pkcs11.c
+++ b/src/openvpn/pkcs11.c
@@ -329,7 +329,6 @@ 
 
     msg(M_INFO, "PKCS#11: Adding PKCS#11 provider '%s'", provider);
 
-#if PKCS11H_VERSION >= ((1 << 16) | (28 << 8) | (0 << 0))
     if ((rv = pkcs11h_registerProvider(provider)) != CKR_OK)
     {
         msg(M_WARN, "PKCS#11: Cannot register provider '%s' %ld-'%s'", provider, rv,
@@ -376,15 +375,6 @@ 
             pkcs11h_removeProvider(provider);
         }
     }
-#else  /* if PKCS11H_VERSION >= ((1<<16) | (28<<8) | (0<<0)) */
-    if ((rv = pkcs11h_addProvider(provider, provider, protected_auth, private_mode,
-                                  PKCS11H_SLOTEVENT_METHOD_AUTO, 0, cert_private))
-        != CKR_OK)
-    {
-        msg(M_WARN, "PKCS#11: Cannot initialize provider '%s' %ld-'%s'", provider, rv,
-            pkcs11h_getMessage(rv));
-    }
-#endif /* if PKCS11H_VERSION >= ((1<<16) | (28<<8) | (0<<0)) */
 
     dmsg(D_PKCS11_DEBUG, "PKCS#11: pkcs11_addProvider - return rv=%ld-'%s'", rv,
          pkcs11h_getMessage(rv));
diff --git a/src/openvpn/pkcs11_openssl.c b/src/openvpn/pkcs11_openssl.c
index 24dce84..8abd60a 100644
--- a/src/openvpn/pkcs11_openssl.c
+++ b/src/openvpn/pkcs11_openssl.c
@@ -43,8 +43,6 @@ 
 #ifdef HAVE_XKEY_PROVIDER
 static XKEY_EXTERNAL_SIGN_fn xkey_pkcs11h_sign;
 
-#if PKCS11H_VERSION > ((1 << 16) | (27 << 8)) /* version > 1.27 */
-
 /* Table linking OpenSSL digest NID with CKM and CKG constants in PKCS#11 */
 #define MD_TYPE(n) { NID_sha##n, CKM_SHA##n, CKG_MGF1_SHA##n }
 static const struct
@@ -132,31 +130,6 @@ 
     return ret;
 }
 
-#else  /* if PKCS11H_VERSION > ((1<<16) | (27<<8)) */
-
-/* Make set_pss_params a no-op that always succeeds */
-#define set_pss_params(...) (1)
-
-/* Use a wrapper for pkcs11h_certificate_signAny_ex() for versions < 1.28
- * where its not available.
- * We just call pkcs11h_certificate_signAny() unless the padding
- * is PSS in which case we return an error.
- */
-static CK_RV
-pkcs11h_certificate_signAny_ex(const pkcs11h_certificate_t cert, const CK_MECHANISM *mech,
-                               const unsigned char *tbs, size_t tbslen, unsigned char *sig,
-                               size_t *siglen)
-{
-    if (mech->mechanism == CKM_RSA_PKCS_PSS)
-    {
-        msg(M_NONFATAL, "PKCS#11: Error: PSS padding is not supported by "
-                        "this version of pkcs11-helper library.");
-        return CKR_MECHANISM_INVALID;
-    }
-    return pkcs11h_certificate_signAny(cert, mech->mechanism, tbs, tbslen, sig, siglen);
-}
-#endif /* PKCS11H_VERSION > 1.27 */
-
 /**
  * Sign op called from xkey provider
  *