From patchwork Sat Oct 17 20:31:02 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gert Doering X-Patchwork-Id: 5483 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:7001:a68f:b0:8d7:ebbe:b250 with SMTP id wf15csp4748187mab; Sat, 17 Oct 2026 13:31:34 -0700 (PDT) X-Forwarded-Encrypted: i=2; AKwUvBzbD6CaQ9hgOu8Z4GVDbfq8imG7P5bNBcJOGnEb7wokvpKbWvJUevq18pRqI0Xc7VsB2+i1zLMIT3g=@openvpn.net X-Received: by 2002:a05:6808:318b:b0:522:1ac7:a573 with SMTP id 5614622812f47-53ccf2f4046mr3383113b6e.43.1792269094422; Sat, 17 Oct 2026 13:31:34 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1792269094; cv=none; d=google.com; s=arc-20260327; b=EIi45uGqUuXAMLjPQu6Hc+P1LZ6vnZkh/5DIwCckMgcefMWZkfWA9559w/wB3hwfjB o+FCnLDAKfB5U0sxn4S2OgSSuNV8pGfnGRLga+f8U6lYTw1JyzOh/zSYS+9ARgfyylD8 bjI84o8xTuZQA2+naxgAq/Tbre2IO9W8tgQMTwSJJ2E1Y2a9c8RT+WO3q9mPTGUvFPPM idNRVs+P3jifVP0FRCGQLSQ497D8lxhj41szwSQgt5jaRUHXZvpEWlSBv9oqVR91UhC4 PNPvPHOVJQlZk2pFWW9YMm4fBYIREGSVQZT5rjycquEFZKVoa7Awi1U8ogSvkH3nZgx0 Aqew== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature; bh=Ss5Tjaq/2nTqwKq5VD0YQ6JW4MyvRthUVna3U2e/cwU=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=sw38ADwrSK8zLl8KLFpyZp5u6g7h1H4Q2jhDXG9OkhmPDDt/p4sDA8/G+/4ce0sllS m7YHqb4p4LH4zS7+TJGVRCDf8cRJ99FwLztkKncZWqry3gWgNgycAyZeh0rgcH7iGFTd 8sj/6X74HNcP9l1e/NVS3RLDAGNiOcC61QNxcgSgP48GyjltZNysP+R9DPZCtsa3MQn/ MhaHuBL8rEwvaudYQsVa8EOhcP3IIErP1NtAgQaknIuN/IWnX+W3K4Czqma3lFcm9afS DeXunX/lWKQhdPdUQLFcIg8THj4hPIko6bv2aJPr5v4xhGlLUH2Bl28Q7cK42RUkOYdL LpuA==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=Ecbr96gS; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=WXEqxYtK; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=m1qdoYkL; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id 586e51a60fabf-4a73b6a97f3si9179731fac.142.2026.10.17.13.31.34 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Sat, 17 Oct 2026 13:31:34 -0700 (PDT) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=Ecbr96gS; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=WXEqxYtK; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=m1qdoYkL; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=muc.de DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=Ss5Tjaq/2nTqwKq5VD0YQ6JW4MyvRthUVna3U2e/cwU=; b=Ecbr96gSOVxotKJhQgMTlCZ1q4 uqFcp3s/obMQ2VN4hraM72bMDqH951DmJi3gKxoTT0HkfYpnqZcjmaVQ1Qu5wBMlSli7qeE8+1C5P qaa1eTujbxpTE50Bfc+msuZQQkMTNtRJP526jy2HOkncNnKqJ2UYw25mv5t735WR3aM4=; Received: from [127.0.0.1] (helo=sfs-ml-3.v29.lw.sourceforge.com) by sfs-ml-3.v29.lw.sourceforge.com with esmtp (Exim 4.95) (envelope-from ) id 1xIB3m-0005yH-Cc; Sat, 17 Oct 2026 20:31:19 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-3.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1xIB3k-0005y9-LL for openvpn-devel@lists.sourceforge.net; Sat, 17 Oct 2026 20:31:17 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=xOXyByrwOxIoGxsmp1LZXfsP/durmMlmX32sfFvbWsw=; b=WXEqxYtK6uetUzri/c97DgJi/m 4ks3/yTWAPSb/aho+YncLS/bQhj9XA8mYwBZTb0Nv8RuGGWs0p5fy89elck3kEB2u+AUNCm2G8etf 0ttESzfU5fzWizGKll6k6frSeNV5iLLHp9MhPyMZVz+xXP1urBjYJPAPshk9mpW6vNb0=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=xOXyByrwOxIoGxsmp1LZXfsP/durmMlmX32sfFvbWsw=; b=m1qdoYkL3fAixhLOt/Mggk8LYD /itBEYGrnpo1h7IzdePmnap8fn+nUqvIouJZD3rQ9qye8VghSWWzH2jKflF0L7eeo5C5mBXl/mArZ MlX2eLdBt6SM+S/U63Lf1ruyeXPzQHYLMR9SYPgXvIn8BzB55l6Uc7hrwiNkPgUdoFAA=; Received: from [193.149.48.129] (helo=blue.greenie.muc.de) by sfi-mx-1.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.95) id 1xIB3j-00022D-Pv for openvpn-devel@lists.sourceforge.net; Sat, 17 Oct 2026 20:31:17 +0000 Received: from blue.greenie.muc.de (localhost [127.0.0.1]) by blue.greenie.muc.de (8.18.1/8.18.1) with ESMTP id 69HKV8UU032080 for ; Sat, 17 Oct 2026 22:31:08 +0200 Received: (from gert@localhost) by blue.greenie.muc.de (8.18.2/8.18.1/Submit) id 69HKV8MC032079 for openvpn-devel@lists.sourceforge.net; Sat, 17 Oct 2026 22:31:08 +0200 From: Gert Doering To: openvpn-devel@lists.sourceforge.net Date: Sat, 17 Oct 2026 22:31:02 +0200 Message-ID: <20261017203108.32063-1-gert@greenie.muc.de> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: MIME-Version: 1.0 X-Spam-Score: 1.3 (+) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-2.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: From: Frank Lichtenheld 1.27 is in distros like Debian 11 (which is EOL) and RHEL 9 (which has a version we can't build against due to missing RSA support). Simplify code and require 1.28. Content analysis details: (1.3 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 1.3 RDNS_NONE Delivered to internal network by a host with no rDNS X-Headers-End: 1xIB3j-00022D-Pv Subject: [Openvpn-devel] [PATCH v2] Remove support for pkcs11-helper < 1.28 X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1879330358423489423 X-GMAIL-MSGID: 1879330358423489423 From: Frank Lichtenheld 1.27 is in distros like Debian 11 (which is EOL) and RHEL 9 (which has a version we can't build against due to missing RSA support). Simplify code and require 1.28. Change-Id: I2d5cd41ad2e424530c73a4461bdd4a8f529b8b56 Signed-off-by: Frank Lichtenheld Acked-by: Razvan Cojocaru Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1989 --- This change was reviewed on Gerrit and approved by at least one developer. I request to merge it to master. Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1989 This mail reflects revision 2 of this Change. Acked-by according to Gerrit (reflected above): Razvan Cojocaru diff --git a/CMakeLists.txt b/CMakeLists.txt index bac4dd4..0d71751 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -305,7 +305,7 @@ endif () if (${ENABLE_PKCS11}) - pkg_search_module(pkcs11-helper libpkcs11-helper-1 REQUIRED IMPORTED_TARGET) + pkg_search_module(pkcs11-helper libpkcs11-helper-1>=1.28 REQUIRED IMPORTED_TARGET) endif () function(check_mbed_configuration) diff --git a/configure.ac b/configure.ac index 56109af..7d1edb2 100644 --- a/configure.ac +++ b/configure.ac @@ -1181,7 +1181,7 @@ if test "${enable_pkcs11}" = "yes"; then PKG_CHECK_MODULES( [PKCS11_HELPER], - [libpkcs11-helper-1 >= 1.11], + [libpkcs11-helper-1 >= 1.28], [have_pkcs11_helper="yes"], [AC_MSG_ERROR([PKCS11 enabled but libpkcs11-helper is missing])] ) diff --git a/src/openvpn/pkcs11.c b/src/openvpn/pkcs11.c index d7dee97..b2173a8 100644 --- a/src/openvpn/pkcs11.c +++ b/src/openvpn/pkcs11.c @@ -329,7 +329,6 @@ msg(M_INFO, "PKCS#11: Adding PKCS#11 provider '%s'", provider); -#if PKCS11H_VERSION >= ((1 << 16) | (28 << 8) | (0 << 0)) if ((rv = pkcs11h_registerProvider(provider)) != CKR_OK) { msg(M_WARN, "PKCS#11: Cannot register provider '%s' %ld-'%s'", provider, rv, @@ -376,15 +375,6 @@ pkcs11h_removeProvider(provider); } } -#else /* if PKCS11H_VERSION >= ((1<<16) | (28<<8) | (0<<0)) */ - if ((rv = pkcs11h_addProvider(provider, provider, protected_auth, private_mode, - PKCS11H_SLOTEVENT_METHOD_AUTO, 0, cert_private)) - != CKR_OK) - { - msg(M_WARN, "PKCS#11: Cannot initialize provider '%s' %ld-'%s'", provider, rv, - pkcs11h_getMessage(rv)); - } -#endif /* if PKCS11H_VERSION >= ((1<<16) | (28<<8) | (0<<0)) */ dmsg(D_PKCS11_DEBUG, "PKCS#11: pkcs11_addProvider - return rv=%ld-'%s'", rv, pkcs11h_getMessage(rv)); diff --git a/src/openvpn/pkcs11_openssl.c b/src/openvpn/pkcs11_openssl.c index 24dce84..8abd60a 100644 --- a/src/openvpn/pkcs11_openssl.c +++ b/src/openvpn/pkcs11_openssl.c @@ -43,8 +43,6 @@ #ifdef HAVE_XKEY_PROVIDER static XKEY_EXTERNAL_SIGN_fn xkey_pkcs11h_sign; -#if PKCS11H_VERSION > ((1 << 16) | (27 << 8)) /* version > 1.27 */ - /* Table linking OpenSSL digest NID with CKM and CKG constants in PKCS#11 */ #define MD_TYPE(n) { NID_sha##n, CKM_SHA##n, CKG_MGF1_SHA##n } static const struct @@ -132,31 +130,6 @@ return ret; } -#else /* if PKCS11H_VERSION > ((1<<16) | (27<<8)) */ - -/* Make set_pss_params a no-op that always succeeds */ -#define set_pss_params(...) (1) - -/* Use a wrapper for pkcs11h_certificate_signAny_ex() for versions < 1.28 - * where its not available. - * We just call pkcs11h_certificate_signAny() unless the padding - * is PSS in which case we return an error. - */ -static CK_RV -pkcs11h_certificate_signAny_ex(const pkcs11h_certificate_t cert, const CK_MECHANISM *mech, - const unsigned char *tbs, size_t tbslen, unsigned char *sig, - size_t *siglen) -{ - if (mech->mechanism == CKM_RSA_PKCS_PSS) - { - msg(M_NONFATAL, "PKCS#11: Error: PSS padding is not supported by " - "this version of pkcs11-helper library."); - return CKR_MECHANISM_INVALID; - } - return pkcs11h_certificate_signAny(cert, mech->mechanism, tbs, tbslen, sig, siglen); -} -#endif /* PKCS11H_VERSION > 1.27 */ - /** * Sign op called from xkey provider *