crypt/opencryptoki
1
0
Fork 0
mirror of https://github.com/opencryptoki/opencryptoki.git synced 2026-10-24 05:39:17 +03:00
Code Releases Activity

COMMON: Remove dependency on liblber in common code

Browse Source 
The use of liblber has been eliminated for most of the cases already.
The only leftover cases are in RSA, DSA, and DH public key encoding
functions for encoding BIT STRINGs.

Update these leftover places and use the already existing
ber_encode_BIT_STRING() function instead.

With this, '-lber' can be removed from the make files for most of
the tokens and tools. The ICSF token still requires liblber for its
LDAP communication.

Also adjust the configure script and example RPM spec accordingly.

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
This commit is contained in:
Ingo Franzki
2026-09-01 11:48:03 +02:00
committed by Ingo Franzki
parent e9c93d708f
commit 90df45fe70
11 changed files with 68 additions and 102 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
configure.ac
View File

@@ -388,12 +388,18 @@ if test "x$build_aix" = "xno"; then
AC_SUBST([LIBCAP_LIBS])
fi
dnl --- cca and soft tokens need lber, icsf needs only ldap
dnl --- icsf token needs lber and ldap (OpenLDAP)
OPENLDAP_LIBS=
AC_CHECK_HEADERS([lber.h ldap.h],
[OPENLDAP_LIBS="-llber -lldap"],
[AC_MSG_ERROR([lber.h and ldap.h are missing. Please install
'openldap-devel'.])])
if test "x$enable_icsftok" != "xno"; then
AC_CHECK_HEADERS([lber.h ldap.h],
[OPENLDAP_LIBS="-llber -lldap"],
[if test "x$enable_icsftok" = "xyes"; then
AC_MSG_ERROR([ICSF token build requested but lber.h/ldap.h are missing. Please install 'openldap-devel'.])
else
AC_MSG_WARN([lber.h or ldap.h not found -- disabling ICSF token (install 'openldap-devel' to enable)])
enable_icsftok=no
fi])
fi
AC_SUBST([OPENLDAP_LIBS])
dnl --- first, check what external software is present or specified

8
rpm/opencryptoki.spec
View File

@@ -13,7 +13,9 @@ BuildRequires: openssl-devel >= 1.1.1
%if 0%{?tpmtok}
BuildRequires: trousers-devel
%endif
%if !0%{?no_icsftok}
BuildRequires: openldap-devel
%endif
BuildRequires: autoconf automake libtool autoconf-archive
BuildRequires: bison flex
%ifarch s390 s390x
@@ -179,7 +181,11 @@ configured with Enterprise PKCS#11 (EP11) firmware.
%configure --with-systemd=%{_unitdir} \
--with-pkcsslotd-user=pkcsslotd --with-pkcs-group=pkcs11 \
--enable-swtok \
--enable-icsftok \
%if !0%{?no_icsftok}
--enable-icsftok \
%else
--disable-icsftok \
%endif
--enable-p11sak \
--enable-p11kmip \
%if 0%{?tpmtok}

4
testcases/unit/unit.mk
View File

@@ -96,8 +96,6 @@ testcases_unit_asn1test_SOURCES=testcases/unit/asn1test.c \
testcases_unit_asn1test_CFLAGS=-I${top_srcdir}/usr/lib/common \
-I${top_srcdir}/usr/include -DSTDLL_NAME=\"asn1test\"
testcases_unit_asn1test_LDFLAGS=-llber
testcases_unit_asn1fuzztest_SOURCES=testcases/unit/asn1fuzztest.c \
usr/lib/common/asn1.c usr/lib/common/trace.c \
testcases/unit/asn1test_stubs.c
@@ -105,8 +103,6 @@ testcases_unit_asn1fuzztest_SOURCES=testcases/unit/asn1fuzztest.c \
testcases_unit_asn1fuzztest_CFLAGS=-I${top_srcdir}/usr/lib/common \
-I${top_srcdir}/usr/include -DSTDLL_NAME=\"asn1fuzztest\"
testcases_unit_asn1fuzztest_LDFLAGS=-llber
testcases_unit_objectflattentest_SOURCES=testcases/unit/objectflattentest.c \
testcases/unit/objecttest_stubs.c \
usr/lib/common/object.c usr/lib/common/p11util.c \

4
usr/lib/cca_stdll/cca_stdll.mk
View File

@@ -19,12 +19,12 @@ opencryptoki_stdll_libpkcs11_cca_la_CFLAGS = \
if AIX
opencryptoki_stdll_libpkcs11_cca_la_LDFLAGS = -qmkshrobj -lcrypto \
-lpthread -qnocrt -lrt -ldl -Wl,-bnoautoexp -Wl,-bstatic,-llber,-bdynamic \
-lpthread -qnocrt -lrt -ldl -Wl,-bnoautoexp \
-export-symbols ${srcdir}/opencryptoki_tok.map.sym
else
opencryptoki_stdll_libpkcs11_cca_la_LDFLAGS = -shared \
-Wl,-z,defs,-Bsymbolic -lcrypto -lpthread -nostartfiles \
-Wl,-soname,$@ -lrt -ldl -llber \
-Wl,-soname,$@ -lrt -ldl \
-Wl,--version-script=${srcdir}/opencryptoki_tok.map
endif

125
usr/lib/common/asn1.c
View File

@@ -16,8 +16,6 @@
#include <pthread.h>
#include <stdlib.h>
#include <string.h>
#include <lber.h>
#include "pkcs11types.h"
#include "p11util.h"
#include "defs.h"
@@ -1829,8 +1827,8 @@ CK_RV ber_encode_RSAPublicKey(CK_BBOOL length_only, CK_BYTE **data,
CK_BYTE *buf = NULL;
CK_BYTE *buf2 = NULL;
CK_BYTE *buf3 = NULL;
BerValue *val = NULL;
BerElement *ber;
CK_BYTE *bitstr = NULL;
CK_ULONG bitstr_len = 0;
UNUSED(length_only);
@@ -1917,28 +1915,23 @@ CK_RV ber_encode_RSAPublicKey(CK_BBOOL length_only, CK_BYTE **data,
total_len += ber_AlgIdRSAEncryptionLen;
/* need a bitstring */
ber = ber_alloc_t(LBER_USE_DER);
rc = (ber_put_bitstring(ber, (char *)buf2, len * 8, 0x03) <= 0 ? 1 : 0);
rc |= ber_flatten(ber, &val);
if (rc != 0) {
TRACE_DEVEL("%s ber_alloc_t/ber_flatten failed \n", __func__);
rc = CKR_FUNCTION_FAILED;
ber_free(ber, 1);
ber_bvfree(val);
free(buf2);
rc = ber_encode_BIT_STRING(FALSE, &bitstr, &bitstr_len, buf2, len, 0);
free(buf2);
if (rc != CKR_OK) {
TRACE_DEVEL("%s ber_encode_BIT_STRING failed\n", __func__);
goto out;
}
memcpy(buf3 + total_len, val->bv_val, val->bv_len);
total_len += val->bv_len;
ber_free(ber, 1);
ber_bvfree(val);
free(buf2);
memcpy(buf3 + total_len, bitstr, bitstr_len);
total_len += bitstr_len;
free(bitstr);
bitstr = NULL;
rc = ber_encode_SEQUENCE(FALSE, data, data_len, buf3, total_len);
if (rc != CKR_OK)
TRACE_DEVEL("%s ber_encode_Seq failed with rc=0x%lx\n", __func__, rc);
out:
free(bitstr);
free(buf3);
return rc;
}
@@ -2397,8 +2390,8 @@ CK_RV ber_encode_DSAPublicKey(CK_BBOOL length_only, CK_BYTE **data,
CK_RV rc = 0;
CK_BYTE *buf = NULL;
CK_BYTE *buf2 = NULL;
BerValue *val = NULL;
BerElement *ber;
CK_BYTE *bitstr = NULL;
CK_ULONG bitstr_len = 0;
/* Calculate the BER container length
*
@@ -2429,24 +2422,12 @@ CK_RV ber_encode_DSAPublicKey(CK_BBOOL length_only, CK_BYTE **data,
rc |=
ber_encode_SEQUENCE(TRUE, NULL, &id_len, NULL, ber_idDSALen + parm_len);
/* public key */
/* public key: compute encoded size only */
rc |=
ber_encode_INTEGER(FALSE, &buf, &len, value->pValue, value->ulValueLen);
ber = ber_alloc_t(LBER_USE_DER);
rc |= (ber_put_bitstring(ber, (char *)buf, len * 8, 0x03) <= 0 ? 1 : 0);
rc |= ber_flatten(ber, &val);
if (rc != 0) {
TRACE_DEVEL("%s ber_alloc_t/ber_flatten failed \n", __func__);
ber_free(ber, 1);
ber_bvfree(val);
free(buf);
return CKR_FUNCTION_FAILED;
}
pub_len = val->bv_len;
ber_free(ber, 1);
free(buf);
ber_bvfree(val);
buf = NULL;
rc |= ber_encode_BIT_STRING(TRUE, NULL, &pub_len, NULL, len, 0);
rc = ber_encode_SEQUENCE(TRUE, NULL, &total, NULL, id_len + pub_len);
@@ -2536,23 +2517,19 @@ CK_RV ber_encode_DSAPublicKey(CK_BBOOL length_only, CK_BYTE **data,
return rc;
}
ber = ber_alloc_t(LBER_USE_DER);
rc = (ber_put_bitstring(ber, (char *)buf, len * 8, 0x03) <= 0 ? 1 : 0);
rc |= ber_flatten(ber, &val);
rc = ber_encode_BIT_STRING(FALSE, &bitstr, &bitstr_len, buf, len, 0);
free(buf);
if (rc != 0) {
TRACE_DEVEL("%s ber_put_bitstring/ber_flatten failed\n", __func__);
ber_free(ber, 1);
ber_bvfree(val);
buf = NULL;
if (rc != CKR_OK) {
TRACE_DEVEL("%s ber_encode_BIT_STRING failed\n", __func__);
free(buf2);
return CKR_FUNCTION_FAILED;
return rc;
}
pub_len = val->bv_len;
pub_len = bitstr_len;
if (ADD_OVERFLOW(id_len, pub_len)) {
TRACE_ERROR("%s Integer overflow in allocation size\n", __func__);
ber_free(ber, 1);
ber_bvfree(val);
free(bitstr);
free(buf2);
return CKR_HOST_MEMORY;
}
@@ -2560,16 +2537,15 @@ CK_RV ber_encode_DSAPublicKey(CK_BBOOL length_only, CK_BYTE **data,
buf = (CK_BYTE *) malloc(id_len + pub_len);
if (!buf) {
TRACE_ERROR("%s Memory allocation failed\n", __func__);
ber_free(ber, 1);
ber_bvfree(val);
free(bitstr);
free(buf2);
return CKR_HOST_MEMORY;
}
memcpy(buf, buf2, id_len);
memcpy(buf + id_len, val->bv_val, pub_len);
memcpy(buf + id_len, bitstr, pub_len);
free(buf2);
ber_free(ber, 1);
ber_bvfree(val);
free(bitstr);
bitstr = NULL;
/* outer sequence */
rc = ber_encode_SEQUENCE(FALSE, data, data_len, buf, id_len + pub_len);
@@ -3745,8 +3721,8 @@ CK_RV ber_encode_DHPublicKey(CK_BBOOL length_only, CK_BYTE **data,
CK_RV rc = 0;
CK_BYTE *buf = NULL;
CK_BYTE *buf2 = NULL;
BerValue *val = NULL;
BerElement *ber;
CK_BYTE *bitstr = NULL;
CK_ULONG bitstr_len = 0;
/* Calculate the BER container length
*
@@ -3775,24 +3751,12 @@ CK_RV ber_encode_DHPublicKey(CK_BBOOL length_only, CK_BYTE **data,
rc |=
ber_encode_SEQUENCE(TRUE, NULL, &id_len, NULL, ber_idDHLen + parm_len);
/* public key */
/* public key: compute encoded size only */
rc |=
ber_encode_INTEGER(FALSE, &buf, &len, value->pValue, value->ulValueLen);
ber = ber_alloc_t(LBER_USE_DER);
rc |= (ber_put_bitstring(ber, (char *)buf, len * 8, 0x03) <= 0 ? 1 : 0);
rc |= ber_flatten(ber, &val);
if (rc != CKR_OK) {
TRACE_DEVEL("%s ber_put_bitstring/ber_flatten failed\n", __func__);
ber_free(ber, 1);
ber_bvfree(val);
free(buf);
return CKR_FUNCTION_FAILED;
}
pub_len = val->bv_len;
ber_free(ber, 1);
ber_bvfree(val);
free(buf);
buf = NULL;
rc |= ber_encode_BIT_STRING(TRUE, NULL, &pub_len, NULL, len, 0);
rc |= ber_encode_SEQUENCE(TRUE, NULL, &total, NULL, id_len + pub_len);
@@ -3871,23 +3835,19 @@ CK_RV ber_encode_DHPublicKey(CK_BBOOL length_only, CK_BYTE **data,
return rc;
}
ber = ber_alloc_t(LBER_USE_DER);
rc = (ber_put_bitstring(ber, (char *)buf, len * 8, 0x03) <= 0 ? 1 : 0);
rc |= ber_flatten(ber, &val);
rc = ber_encode_BIT_STRING(FALSE, &bitstr, &bitstr_len, buf, len, 0);
free(buf);
buf = NULL;
if (rc != CKR_OK) {
TRACE_DEVEL("%s ber_put_bitstring/ber_flatten failed\n", __func__);
ber_free(ber, 1);
ber_bvfree(val);
TRACE_DEVEL("%s ber_encode_BIT_STRING failed\n", __func__);
free(buf2);
return CKR_FUNCTION_FAILED;
return rc;
}
pub_len = val->bv_len;
pub_len = bitstr_len;
if (ADD_OVERFLOW(id_len, pub_len)) {
TRACE_ERROR("%s Integer overflow in allocation size\n", __func__);
ber_free(ber, 1);
ber_bvfree(val);
free(bitstr);
free(buf2);
return CKR_HOST_MEMORY;
}
@@ -3895,16 +3855,15 @@ CK_RV ber_encode_DHPublicKey(CK_BBOOL length_only, CK_BYTE **data,
buf = (CK_BYTE *) malloc(id_len + pub_len);
if (!buf) {
TRACE_ERROR("%s Memory allocation failed\n", __func__);
ber_free(ber, 1);
ber_bvfree(val);
free(bitstr);
free(buf2);
return CKR_HOST_MEMORY;
}
memcpy(buf, buf2, id_len);
memcpy(buf + id_len, val->bv_val, pub_len);
memcpy(buf + id_len, bitstr, pub_len);
free(buf2);
ber_free(ber, 1);
ber_bvfree(val);
free(bitstr);
bitstr = NULL;
/* outer sequence */
rc = ber_encode_SEQUENCE(FALSE, data, data_len, buf, id_len + pub_len);

1
usr/lib/ep11_stdll/ep11_specific.c
View File

@@ -44,7 +44,6 @@
#include <fcntl.h>
#include <syslog.h>
#include <dlfcn.h>
#include <lber.h>
#include <grp.h>
#include <sys/time.h>
#include <time.h>

2
usr/lib/ep11_stdll/ep11_stdll.mk
View File

@@ -20,7 +20,7 @@ opencryptoki_stdll_libpkcs11_ep11_la_CFLAGS = \
opencryptoki_stdll_libpkcs11_ep11_la_LDFLAGS = \
-shared -Wl,-z,defs,-Bsymbolic -lc -lpthread -lcrypto -lrt \
-llber -ldl -Wl,--version-script=${srcdir}/opencryptoki_tok.map
-ldl -Wl,--version-script=${srcdir}/opencryptoki_tok.map
opencryptoki_stdll_libpkcs11_ep11_la_SOURCES = usr/lib/common/asn1.c \
usr/lib/common/cert.c usr/lib/common/hwf_obj.c \

2
usr/lib/ica_s390_stdll/ica_s390_stdll.mk
View File

@@ -13,7 +13,7 @@ opencryptoki_stdll_libpkcs11_ica_la_CFLAGS = \
opencryptoki_stdll_libpkcs11_ica_la_LDFLAGS = \
$(LIBICA_LIBS) -nostartfiles -shared \
-Wl,-z,defs,-Bsymbolic -Wl,-soname,$@ -lc -lpthread -lica -ldl \
-lcrypto -lrt -llber \
-lcrypto -lrt \
-Wl,--version-script=${srcdir}/opencryptoki_tok.map
opencryptoki_stdll_libpkcs11_ica_la_SOURCES = \

4
usr/lib/soft_stdll/soft_stdll.mk
View File

@@ -12,12 +12,12 @@ opencryptoki_stdll_libpkcs11_sw_la_CFLAGS = \
if AIX
opencryptoki_stdll_libpkcs11_sw_la_LDFLAGS = -qmkshrobj -lc \
-lpthread -lcrypto -lrt -Wl,-bnoautoexp -Wl,-bstatic,-llber,-bdynamic \
-lpthread -lcrypto -lrt -Wl,-bnoautoexp \
-export-symbols ${srcdir}/opencryptoki_tok.map.sym
else
opencryptoki_stdll_libpkcs11_sw_la_LDFLAGS = \
-shared -Wl,-z,defs,-Bsymbolic -lc -lpthread -lcrypto -lrt \
-llber -Wl,--version-script=${srcdir}/opencryptoki_tok.map
-Wl,--version-script=${srcdir}/opencryptoki_tok.map
endif
opencryptoki_stdll_libpkcs11_sw_la_SOURCES = \

2
usr/lib/tpm_stdll/tpm_stdll.mk
View File

@@ -13,7 +13,7 @@ opencryptoki_stdll_libpkcs11_tpm_la_CFLAGS = \
opencryptoki_stdll_libpkcs11_tpm_la_LDFLAGS = \
-shared -Wl,-z,defs,-Bsymbolic -lcrypto -ltspi -lpthread -lrt \
-llber -Wl,--version-script=${srcdir}/opencryptoki_tok.map
-Wl,--version-script=${srcdir}/opencryptoki_tok.map
opencryptoki_stdll_libpkcs11_tpm_la_SOURCES = \
usr/lib/common/asn1.c usr/lib/common/dig_mgr.c \

2
usr/sbin/pkcscca/pkcscca.mk
View File

@@ -1,7 +1,7 @@
sbin_PROGRAMS += usr/sbin/pkcscca/pkcscca
noinst_HEADERS += usr/sbin/pkcscca/pkcscca.h
usr_sbin_pkcscca_pkcscca_LDFLAGS = -lcrypto -ldl -lrt -llber -lpthread
usr_sbin_pkcscca_pkcscca_LDFLAGS = -lcrypto -ldl -lrt -lpthread
if AIX
usr_sbin_pkcscca_pkcscca_LDFLAGS += -lbsd -Wl,-blibpath:$(libdir)/opencryptoki:$(libdir)/opencryptoki/stdll:/usr/lib:/usr/lib64