diff --git a/configure.ac b/configure.ac index 854d46ec..a7063122 100644 --- a/configure.ac +++ b/configure.ac @@ -388,12 +388,18 @@ if test "x$build_aix" = "xno"; then AC_SUBST([LIBCAP_LIBS]) fi -dnl --- cca and soft tokens need lber, icsf needs only ldap +dnl --- icsf token needs lber and ldap (OpenLDAP) OPENLDAP_LIBS= -AC_CHECK_HEADERS([lber.h ldap.h], - [OPENLDAP_LIBS="-llber -lldap"], - [AC_MSG_ERROR([lber.h and ldap.h are missing. Please install - 'openldap-devel'.])]) +if test "x$enable_icsftok" != "xno"; then + AC_CHECK_HEADERS([lber.h ldap.h], + [OPENLDAP_LIBS="-llber -lldap"], + [if test "x$enable_icsftok" = "xyes"; then + AC_MSG_ERROR([ICSF token build requested but lber.h/ldap.h are missing. Please install 'openldap-devel'.]) + else + AC_MSG_WARN([lber.h or ldap.h not found -- disabling ICSF token (install 'openldap-devel' to enable)]) + enable_icsftok=no + fi]) +fi AC_SUBST([OPENLDAP_LIBS]) dnl --- first, check what external software is present or specified diff --git a/rpm/opencryptoki.spec b/rpm/opencryptoki.spec index daa7e242..93f4d1da 100644 --- a/rpm/opencryptoki.spec +++ b/rpm/opencryptoki.spec @@ -13,7 +13,9 @@ BuildRequires: openssl-devel >= 1.1.1 %if 0%{?tpmtok} BuildRequires: trousers-devel %endif +%if !0%{?no_icsftok} BuildRequires: openldap-devel +%endif BuildRequires: autoconf automake libtool autoconf-archive BuildRequires: bison flex %ifarch s390 s390x @@ -179,7 +181,11 @@ configured with Enterprise PKCS#11 (EP11) firmware. %configure --with-systemd=%{_unitdir} \ --with-pkcsslotd-user=pkcsslotd --with-pkcs-group=pkcs11 \ --enable-swtok \ - --enable-icsftok \ +%if !0%{?no_icsftok} + --enable-icsftok \ +%else + --disable-icsftok \ +%endif --enable-p11sak \ --enable-p11kmip \ %if 0%{?tpmtok} diff --git a/testcases/unit/unit.mk b/testcases/unit/unit.mk index ddcc6021..77bf5dcd 100644 --- a/testcases/unit/unit.mk +++ b/testcases/unit/unit.mk @@ -96,8 +96,6 @@ testcases_unit_asn1test_SOURCES=testcases/unit/asn1test.c \ testcases_unit_asn1test_CFLAGS=-I${top_srcdir}/usr/lib/common \ -I${top_srcdir}/usr/include -DSTDLL_NAME=\"asn1test\" -testcases_unit_asn1test_LDFLAGS=-llber - testcases_unit_asn1fuzztest_SOURCES=testcases/unit/asn1fuzztest.c \ usr/lib/common/asn1.c usr/lib/common/trace.c \ testcases/unit/asn1test_stubs.c @@ -105,8 +103,6 @@ testcases_unit_asn1fuzztest_SOURCES=testcases/unit/asn1fuzztest.c \ testcases_unit_asn1fuzztest_CFLAGS=-I${top_srcdir}/usr/lib/common \ -I${top_srcdir}/usr/include -DSTDLL_NAME=\"asn1fuzztest\" -testcases_unit_asn1fuzztest_LDFLAGS=-llber - testcases_unit_objectflattentest_SOURCES=testcases/unit/objectflattentest.c \ testcases/unit/objecttest_stubs.c \ usr/lib/common/object.c usr/lib/common/p11util.c \ diff --git a/usr/lib/cca_stdll/cca_stdll.mk b/usr/lib/cca_stdll/cca_stdll.mk index 6294e4da..40bc89ee 100644 --- a/usr/lib/cca_stdll/cca_stdll.mk +++ b/usr/lib/cca_stdll/cca_stdll.mk @@ -19,12 +19,12 @@ opencryptoki_stdll_libpkcs11_cca_la_CFLAGS = \ if AIX opencryptoki_stdll_libpkcs11_cca_la_LDFLAGS = -qmkshrobj -lcrypto \ - -lpthread -qnocrt -lrt -ldl -Wl,-bnoautoexp -Wl,-bstatic,-llber,-bdynamic \ + -lpthread -qnocrt -lrt -ldl -Wl,-bnoautoexp \ -export-symbols ${srcdir}/opencryptoki_tok.map.sym else opencryptoki_stdll_libpkcs11_cca_la_LDFLAGS = -shared \ -Wl,-z,defs,-Bsymbolic -lcrypto -lpthread -nostartfiles \ - -Wl,-soname,$@ -lrt -ldl -llber \ + -Wl,-soname,$@ -lrt -ldl \ -Wl,--version-script=${srcdir}/opencryptoki_tok.map endif diff --git a/usr/lib/common/asn1.c b/usr/lib/common/asn1.c index 5d8a31fd..6fde6b2d 100644 --- a/usr/lib/common/asn1.c +++ b/usr/lib/common/asn1.c @@ -16,8 +16,6 @@ #include #include #include -#include - #include "pkcs11types.h" #include "p11util.h" #include "defs.h" @@ -1829,8 +1827,8 @@ CK_RV ber_encode_RSAPublicKey(CK_BBOOL length_only, CK_BYTE **data, CK_BYTE *buf = NULL; CK_BYTE *buf2 = NULL; CK_BYTE *buf3 = NULL; - BerValue *val = NULL; - BerElement *ber; + CK_BYTE *bitstr = NULL; + CK_ULONG bitstr_len = 0; UNUSED(length_only); @@ -1917,28 +1915,23 @@ CK_RV ber_encode_RSAPublicKey(CK_BBOOL length_only, CK_BYTE **data, total_len += ber_AlgIdRSAEncryptionLen; /* need a bitstring */ - ber = ber_alloc_t(LBER_USE_DER); - rc = (ber_put_bitstring(ber, (char *)buf2, len * 8, 0x03) <= 0 ? 1 : 0); - rc |= ber_flatten(ber, &val); - if (rc != 0) { - TRACE_DEVEL("%s ber_alloc_t/ber_flatten failed \n", __func__); - rc = CKR_FUNCTION_FAILED; - ber_free(ber, 1); - ber_bvfree(val); - free(buf2); + rc = ber_encode_BIT_STRING(FALSE, &bitstr, &bitstr_len, buf2, len, 0); + free(buf2); + if (rc != CKR_OK) { + TRACE_DEVEL("%s ber_encode_BIT_STRING failed\n", __func__); goto out; } - memcpy(buf3 + total_len, val->bv_val, val->bv_len); - total_len += val->bv_len; - ber_free(ber, 1); - ber_bvfree(val); - free(buf2); + memcpy(buf3 + total_len, bitstr, bitstr_len); + total_len += bitstr_len; + free(bitstr); + bitstr = NULL; rc = ber_encode_SEQUENCE(FALSE, data, data_len, buf3, total_len); if (rc != CKR_OK) TRACE_DEVEL("%s ber_encode_Seq failed with rc=0x%lx\n", __func__, rc); out: + free(bitstr); free(buf3); return rc; } @@ -2397,8 +2390,8 @@ CK_RV ber_encode_DSAPublicKey(CK_BBOOL length_only, CK_BYTE **data, CK_RV rc = 0; CK_BYTE *buf = NULL; CK_BYTE *buf2 = NULL; - BerValue *val = NULL; - BerElement *ber; + CK_BYTE *bitstr = NULL; + CK_ULONG bitstr_len = 0; /* Calculate the BER container length * @@ -2429,24 +2422,12 @@ CK_RV ber_encode_DSAPublicKey(CK_BBOOL length_only, CK_BYTE **data, rc |= ber_encode_SEQUENCE(TRUE, NULL, &id_len, NULL, ber_idDSALen + parm_len); - /* public key */ + /* public key: compute encoded size only */ rc |= ber_encode_INTEGER(FALSE, &buf, &len, value->pValue, value->ulValueLen); - ber = ber_alloc_t(LBER_USE_DER); - rc |= (ber_put_bitstring(ber, (char *)buf, len * 8, 0x03) <= 0 ? 1 : 0); - rc |= ber_flatten(ber, &val); - if (rc != 0) { - TRACE_DEVEL("%s ber_alloc_t/ber_flatten failed \n", __func__); - ber_free(ber, 1); - ber_bvfree(val); - free(buf); - return CKR_FUNCTION_FAILED; - } - - pub_len = val->bv_len; - ber_free(ber, 1); free(buf); - ber_bvfree(val); + buf = NULL; + rc |= ber_encode_BIT_STRING(TRUE, NULL, &pub_len, NULL, len, 0); rc = ber_encode_SEQUENCE(TRUE, NULL, &total, NULL, id_len + pub_len); @@ -2536,23 +2517,19 @@ CK_RV ber_encode_DSAPublicKey(CK_BBOOL length_only, CK_BYTE **data, return rc; } - ber = ber_alloc_t(LBER_USE_DER); - rc = (ber_put_bitstring(ber, (char *)buf, len * 8, 0x03) <= 0 ? 1 : 0); - rc |= ber_flatten(ber, &val); + rc = ber_encode_BIT_STRING(FALSE, &bitstr, &bitstr_len, buf, len, 0); free(buf); - if (rc != 0) { - TRACE_DEVEL("%s ber_put_bitstring/ber_flatten failed\n", __func__); - ber_free(ber, 1); - ber_bvfree(val); + buf = NULL; + if (rc != CKR_OK) { + TRACE_DEVEL("%s ber_encode_BIT_STRING failed\n", __func__); free(buf2); - return CKR_FUNCTION_FAILED; + return rc; } - pub_len = val->bv_len; + pub_len = bitstr_len; if (ADD_OVERFLOW(id_len, pub_len)) { TRACE_ERROR("%s Integer overflow in allocation size\n", __func__); - ber_free(ber, 1); - ber_bvfree(val); + free(bitstr); free(buf2); return CKR_HOST_MEMORY; } @@ -2560,16 +2537,15 @@ CK_RV ber_encode_DSAPublicKey(CK_BBOOL length_only, CK_BYTE **data, buf = (CK_BYTE *) malloc(id_len + pub_len); if (!buf) { TRACE_ERROR("%s Memory allocation failed\n", __func__); - ber_free(ber, 1); - ber_bvfree(val); + free(bitstr); free(buf2); return CKR_HOST_MEMORY; } memcpy(buf, buf2, id_len); - memcpy(buf + id_len, val->bv_val, pub_len); + memcpy(buf + id_len, bitstr, pub_len); free(buf2); - ber_free(ber, 1); - ber_bvfree(val); + free(bitstr); + bitstr = NULL; /* outer sequence */ rc = ber_encode_SEQUENCE(FALSE, data, data_len, buf, id_len + pub_len); @@ -3745,8 +3721,8 @@ CK_RV ber_encode_DHPublicKey(CK_BBOOL length_only, CK_BYTE **data, CK_RV rc = 0; CK_BYTE *buf = NULL; CK_BYTE *buf2 = NULL; - BerValue *val = NULL; - BerElement *ber; + CK_BYTE *bitstr = NULL; + CK_ULONG bitstr_len = 0; /* Calculate the BER container length * @@ -3775,24 +3751,12 @@ CK_RV ber_encode_DHPublicKey(CK_BBOOL length_only, CK_BYTE **data, rc |= ber_encode_SEQUENCE(TRUE, NULL, &id_len, NULL, ber_idDHLen + parm_len); - /* public key */ + /* public key: compute encoded size only */ rc |= ber_encode_INTEGER(FALSE, &buf, &len, value->pValue, value->ulValueLen); - ber = ber_alloc_t(LBER_USE_DER); - rc |= (ber_put_bitstring(ber, (char *)buf, len * 8, 0x03) <= 0 ? 1 : 0); - rc |= ber_flatten(ber, &val); - if (rc != CKR_OK) { - TRACE_DEVEL("%s ber_put_bitstring/ber_flatten failed\n", __func__); - ber_free(ber, 1); - ber_bvfree(val); - free(buf); - return CKR_FUNCTION_FAILED; - } - - pub_len = val->bv_len; - ber_free(ber, 1); - ber_bvfree(val); free(buf); + buf = NULL; + rc |= ber_encode_BIT_STRING(TRUE, NULL, &pub_len, NULL, len, 0); rc |= ber_encode_SEQUENCE(TRUE, NULL, &total, NULL, id_len + pub_len); @@ -3871,23 +3835,19 @@ CK_RV ber_encode_DHPublicKey(CK_BBOOL length_only, CK_BYTE **data, return rc; } - ber = ber_alloc_t(LBER_USE_DER); - rc = (ber_put_bitstring(ber, (char *)buf, len * 8, 0x03) <= 0 ? 1 : 0); - rc |= ber_flatten(ber, &val); + rc = ber_encode_BIT_STRING(FALSE, &bitstr, &bitstr_len, buf, len, 0); free(buf); + buf = NULL; if (rc != CKR_OK) { - TRACE_DEVEL("%s ber_put_bitstring/ber_flatten failed\n", __func__); - ber_free(ber, 1); - ber_bvfree(val); + TRACE_DEVEL("%s ber_encode_BIT_STRING failed\n", __func__); free(buf2); - return CKR_FUNCTION_FAILED; + return rc; } - pub_len = val->bv_len; + pub_len = bitstr_len; if (ADD_OVERFLOW(id_len, pub_len)) { TRACE_ERROR("%s Integer overflow in allocation size\n", __func__); - ber_free(ber, 1); - ber_bvfree(val); + free(bitstr); free(buf2); return CKR_HOST_MEMORY; } @@ -3895,16 +3855,15 @@ CK_RV ber_encode_DHPublicKey(CK_BBOOL length_only, CK_BYTE **data, buf = (CK_BYTE *) malloc(id_len + pub_len); if (!buf) { TRACE_ERROR("%s Memory allocation failed\n", __func__); - ber_free(ber, 1); - ber_bvfree(val); + free(bitstr); free(buf2); return CKR_HOST_MEMORY; } memcpy(buf, buf2, id_len); - memcpy(buf + id_len, val->bv_val, pub_len); + memcpy(buf + id_len, bitstr, pub_len); free(buf2); - ber_free(ber, 1); - ber_bvfree(val); + free(bitstr); + bitstr = NULL; /* outer sequence */ rc = ber_encode_SEQUENCE(FALSE, data, data_len, buf, id_len + pub_len); diff --git a/usr/lib/ep11_stdll/ep11_specific.c b/usr/lib/ep11_stdll/ep11_specific.c index 9b493055..ed504551 100644 --- a/usr/lib/ep11_stdll/ep11_specific.c +++ b/usr/lib/ep11_stdll/ep11_specific.c @@ -44,7 +44,6 @@ #include #include #include -#include #include #include #include diff --git a/usr/lib/ep11_stdll/ep11_stdll.mk b/usr/lib/ep11_stdll/ep11_stdll.mk index d775617a..f5256f09 100644 --- a/usr/lib/ep11_stdll/ep11_stdll.mk +++ b/usr/lib/ep11_stdll/ep11_stdll.mk @@ -20,7 +20,7 @@ opencryptoki_stdll_libpkcs11_ep11_la_CFLAGS = \ opencryptoki_stdll_libpkcs11_ep11_la_LDFLAGS = \ -shared -Wl,-z,defs,-Bsymbolic -lc -lpthread -lcrypto -lrt \ - -llber -ldl -Wl,--version-script=${srcdir}/opencryptoki_tok.map + -ldl -Wl,--version-script=${srcdir}/opencryptoki_tok.map opencryptoki_stdll_libpkcs11_ep11_la_SOURCES = usr/lib/common/asn1.c \ usr/lib/common/cert.c usr/lib/common/hwf_obj.c \ diff --git a/usr/lib/ica_s390_stdll/ica_s390_stdll.mk b/usr/lib/ica_s390_stdll/ica_s390_stdll.mk index f718e04e..f41cdd83 100644 --- a/usr/lib/ica_s390_stdll/ica_s390_stdll.mk +++ b/usr/lib/ica_s390_stdll/ica_s390_stdll.mk @@ -13,7 +13,7 @@ opencryptoki_stdll_libpkcs11_ica_la_CFLAGS = \ opencryptoki_stdll_libpkcs11_ica_la_LDFLAGS = \ $(LIBICA_LIBS) -nostartfiles -shared \ -Wl,-z,defs,-Bsymbolic -Wl,-soname,$@ -lc -lpthread -lica -ldl \ - -lcrypto -lrt -llber \ + -lcrypto -lrt \ -Wl,--version-script=${srcdir}/opencryptoki_tok.map opencryptoki_stdll_libpkcs11_ica_la_SOURCES = \ diff --git a/usr/lib/soft_stdll/soft_stdll.mk b/usr/lib/soft_stdll/soft_stdll.mk index 8dc01220..2e546d95 100644 --- a/usr/lib/soft_stdll/soft_stdll.mk +++ b/usr/lib/soft_stdll/soft_stdll.mk @@ -12,12 +12,12 @@ opencryptoki_stdll_libpkcs11_sw_la_CFLAGS = \ if AIX opencryptoki_stdll_libpkcs11_sw_la_LDFLAGS = -qmkshrobj -lc \ - -lpthread -lcrypto -lrt -Wl,-bnoautoexp -Wl,-bstatic,-llber,-bdynamic \ + -lpthread -lcrypto -lrt -Wl,-bnoautoexp \ -export-symbols ${srcdir}/opencryptoki_tok.map.sym else opencryptoki_stdll_libpkcs11_sw_la_LDFLAGS = \ -shared -Wl,-z,defs,-Bsymbolic -lc -lpthread -lcrypto -lrt \ - -llber -Wl,--version-script=${srcdir}/opencryptoki_tok.map + -Wl,--version-script=${srcdir}/opencryptoki_tok.map endif opencryptoki_stdll_libpkcs11_sw_la_SOURCES = \ diff --git a/usr/lib/tpm_stdll/tpm_stdll.mk b/usr/lib/tpm_stdll/tpm_stdll.mk index 793eb633..f0c9e901 100644 --- a/usr/lib/tpm_stdll/tpm_stdll.mk +++ b/usr/lib/tpm_stdll/tpm_stdll.mk @@ -13,7 +13,7 @@ opencryptoki_stdll_libpkcs11_tpm_la_CFLAGS = \ opencryptoki_stdll_libpkcs11_tpm_la_LDFLAGS = \ -shared -Wl,-z,defs,-Bsymbolic -lcrypto -ltspi -lpthread -lrt \ - -llber -Wl,--version-script=${srcdir}/opencryptoki_tok.map + -Wl,--version-script=${srcdir}/opencryptoki_tok.map opencryptoki_stdll_libpkcs11_tpm_la_SOURCES = \ usr/lib/common/asn1.c usr/lib/common/dig_mgr.c \ diff --git a/usr/sbin/pkcscca/pkcscca.mk b/usr/sbin/pkcscca/pkcscca.mk index 02ff4eac..b93e5ac3 100644 --- a/usr/sbin/pkcscca/pkcscca.mk +++ b/usr/sbin/pkcscca/pkcscca.mk @@ -1,7 +1,7 @@ sbin_PROGRAMS += usr/sbin/pkcscca/pkcscca noinst_HEADERS += usr/sbin/pkcscca/pkcscca.h -usr_sbin_pkcscca_pkcscca_LDFLAGS = -lcrypto -ldl -lrt -llber -lpthread +usr_sbin_pkcscca_pkcscca_LDFLAGS = -lcrypto -ldl -lrt -lpthread if AIX usr_sbin_pkcscca_pkcscca_LDFLAGS += -lbsd -Wl,-blibpath:$(libdir)/opencryptoki:$(libdir)/opencryptoki/stdll:/usr/lib:/usr/lib64