From 90df45fe70b00d3d161deebfc788880ee542804a Mon Sep 17 00:00:00 2001 From: Ingo Franzki Date: Tue, 1 Sep 2026 11:48:03 +0200 Subject: [PATCH] COMMON: Remove dependency on liblber in common code The use of liblber has been eliminated for most of the cases already. The only leftover cases are in RSA, DSA, and DH public key encoding functions for encoding BIT STRINGs. Update these leftover places and use the already existing ber_encode_BIT_STRING() function instead. With this, '-lber' can be removed from the make files for most of the tokens and tools. The ICSF token still requires liblber for its LDAP communication. Also adjust the configure script and example RPM spec accordingly. Signed-off-by: Ingo Franzki --- configure.ac | 16 ++- rpm/opencryptoki.spec | 8 +- testcases/unit/unit.mk | 4 - usr/lib/cca_stdll/cca_stdll.mk | 4 +- usr/lib/common/asn1.c | 125 ++++++++--------------- usr/lib/ep11_stdll/ep11_specific.c | 1 - usr/lib/ep11_stdll/ep11_stdll.mk | 2 +- usr/lib/ica_s390_stdll/ica_s390_stdll.mk | 2 +- usr/lib/soft_stdll/soft_stdll.mk | 4 +- usr/lib/tpm_stdll/tpm_stdll.mk | 2 +- usr/sbin/pkcscca/pkcscca.mk | 2 +- 11 files changed, 68 insertions(+), 102 deletions(-) diff --git a/configure.ac b/configure.ac index 854d46ec..a7063122 100644 --- a/configure.ac +++ b/configure.ac @@ -388,12 +388,18 @@ if test "x$build_aix" = "xno"; then AC_SUBST([LIBCAP_LIBS]) fi -dnl --- cca and soft tokens need lber, icsf needs only ldap +dnl --- icsf token needs lber and ldap (OpenLDAP) OPENLDAP_LIBS= -AC_CHECK_HEADERS([lber.h ldap.h], - [OPENLDAP_LIBS="-llber -lldap"], - [AC_MSG_ERROR([lber.h and ldap.h are missing. Please install - 'openldap-devel'.])]) +if test "x$enable_icsftok" != "xno"; then + AC_CHECK_HEADERS([lber.h ldap.h], + [OPENLDAP_LIBS="-llber -lldap"], + [if test "x$enable_icsftok" = "xyes"; then + AC_MSG_ERROR([ICSF token build requested but lber.h/ldap.h are missing. Please install 'openldap-devel'.]) + else + AC_MSG_WARN([lber.h or ldap.h not found -- disabling ICSF token (install 'openldap-devel' to enable)]) + enable_icsftok=no + fi]) +fi AC_SUBST([OPENLDAP_LIBS]) dnl --- first, check what external software is present or specified diff --git a/rpm/opencryptoki.spec b/rpm/opencryptoki.spec index daa7e242..93f4d1da 100644 --- a/rpm/opencryptoki.spec +++ b/rpm/opencryptoki.spec @@ -13,7 +13,9 @@ BuildRequires: openssl-devel >= 1.1.1 %if 0%{?tpmtok} BuildRequires: trousers-devel %endif +%if !0%{?no_icsftok} BuildRequires: openldap-devel +%endif BuildRequires: autoconf automake libtool autoconf-archive BuildRequires: bison flex %ifarch s390 s390x @@ -179,7 +181,11 @@ configured with Enterprise PKCS#11 (EP11) firmware. %configure --with-systemd=%{_unitdir} \ --with-pkcsslotd-user=pkcsslotd --with-pkcs-group=pkcs11 \ --enable-swtok \ - --enable-icsftok \ +%if !0%{?no_icsftok} + --enable-icsftok \ +%else + --disable-icsftok \ +%endif --enable-p11sak \ --enable-p11kmip \ %if 0%{?tpmtok} diff --git a/testcases/unit/unit.mk b/testcases/unit/unit.mk index ddcc6021..77bf5dcd 100644 --- a/testcases/unit/unit.mk +++ b/testcases/unit/unit.mk @@ -96,8 +96,6 @@ testcases_unit_asn1test_SOURCES=testcases/unit/asn1test.c \ testcases_unit_asn1test_CFLAGS=-I${top_srcdir}/usr/lib/common \ -I${top_srcdir}/usr/include -DSTDLL_NAME=\"asn1test\" -testcases_unit_asn1test_LDFLAGS=-llber - testcases_unit_asn1fuzztest_SOURCES=testcases/unit/asn1fuzztest.c \ usr/lib/common/asn1.c usr/lib/common/trace.c \ testcases/unit/asn1test_stubs.c @@ -105,8 +103,6 @@ testcases_unit_asn1fuzztest_SOURCES=testcases/unit/asn1fuzztest.c \ testcases_unit_asn1fuzztest_CFLAGS=-I${top_srcdir}/usr/lib/common \ -I${top_srcdir}/usr/include -DSTDLL_NAME=\"asn1fuzztest\" -testcases_unit_asn1fuzztest_LDFLAGS=-llber - testcases_unit_objectflattentest_SOURCES=testcases/unit/objectflattentest.c \ testcases/unit/objecttest_stubs.c \ usr/lib/common/object.c usr/lib/common/p11util.c \ diff --git a/usr/lib/cca_stdll/cca_stdll.mk b/usr/lib/cca_stdll/cca_stdll.mk index 6294e4da..40bc89ee 100644 --- a/usr/lib/cca_stdll/cca_stdll.mk +++ b/usr/lib/cca_stdll/cca_stdll.mk @@ -19,12 +19,12 @@ opencryptoki_stdll_libpkcs11_cca_la_CFLAGS = \ if AIX opencryptoki_stdll_libpkcs11_cca_la_LDFLAGS = -qmkshrobj -lcrypto \ - -lpthread -qnocrt -lrt -ldl -Wl,-bnoautoexp -Wl,-bstatic,-llber,-bdynamic \ + -lpthread -qnocrt -lrt -ldl -Wl,-bnoautoexp \ -export-symbols ${srcdir}/opencryptoki_tok.map.sym else opencryptoki_stdll_libpkcs11_cca_la_LDFLAGS = -shared \ -Wl,-z,defs,-Bsymbolic -lcrypto -lpthread -nostartfiles \ - -Wl,-soname,$@ -lrt -ldl -llber \ + -Wl,-soname,$@ -lrt -ldl \ -Wl,--version-script=${srcdir}/opencryptoki_tok.map endif diff --git a/usr/lib/common/asn1.c b/usr/lib/common/asn1.c index 5d8a31fd..6fde6b2d 100644 --- a/usr/lib/common/asn1.c +++ b/usr/lib/common/asn1.c @@ -16,8 +16,6 @@ #include #include #include -#include - #include "pkcs11types.h" #include "p11util.h" #include "defs.h" @@ -1829,8 +1827,8 @@ CK_RV ber_encode_RSAPublicKey(CK_BBOOL length_only, CK_BYTE **data, CK_BYTE *buf = NULL; CK_BYTE *buf2 = NULL; CK_BYTE *buf3 = NULL; - BerValue *val = NULL; - BerElement *ber; + CK_BYTE *bitstr = NULL; + CK_ULONG bitstr_len = 0; UNUSED(length_only); @@ -1917,28 +1915,23 @@ CK_RV ber_encode_RSAPublicKey(CK_BBOOL length_only, CK_BYTE **data, total_len += ber_AlgIdRSAEncryptionLen; /* need a bitstring */ - ber = ber_alloc_t(LBER_USE_DER); - rc = (ber_put_bitstring(ber, (char *)buf2, len * 8, 0x03) <= 0 ? 1 : 0); - rc |= ber_flatten(ber, &val); - if (rc != 0) { - TRACE_DEVEL("%s ber_alloc_t/ber_flatten failed \n", __func__); - rc = CKR_FUNCTION_FAILED; - ber_free(ber, 1); - ber_bvfree(val); - free(buf2); + rc = ber_encode_BIT_STRING(FALSE, &bitstr, &bitstr_len, buf2, len, 0); + free(buf2); + if (rc != CKR_OK) { + TRACE_DEVEL("%s ber_encode_BIT_STRING failed\n", __func__); goto out; } - memcpy(buf3 + total_len, val->bv_val, val->bv_len); - total_len += val->bv_len; - ber_free(ber, 1); - ber_bvfree(val); - free(buf2); + memcpy(buf3 + total_len, bitstr, bitstr_len); + total_len += bitstr_len; + free(bitstr); + bitstr = NULL; rc = ber_encode_SEQUENCE(FALSE, data, data_len, buf3, total_len); if (rc != CKR_OK) TRACE_DEVEL("%s ber_encode_Seq failed with rc=0x%lx\n", __func__, rc); out: + free(bitstr); free(buf3); return rc; } @@ -2397,8 +2390,8 @@ CK_RV ber_encode_DSAPublicKey(CK_BBOOL length_only, CK_BYTE **data, CK_RV rc = 0; CK_BYTE *buf = NULL; CK_BYTE *buf2 = NULL; - BerValue *val = NULL; - BerElement *ber; + CK_BYTE *bitstr = NULL; + CK_ULONG bitstr_len = 0; /* Calculate the BER container length * @@ -2429,24 +2422,12 @@ CK_RV ber_encode_DSAPublicKey(CK_BBOOL length_only, CK_BYTE **data, rc |= ber_encode_SEQUENCE(TRUE, NULL, &id_len, NULL, ber_idDSALen + parm_len); - /* public key */ + /* public key: compute encoded size only */ rc |= ber_encode_INTEGER(FALSE, &buf, &len, value->pValue, value->ulValueLen); - ber = ber_alloc_t(LBER_USE_DER); - rc |= (ber_put_bitstring(ber, (char *)buf, len * 8, 0x03) <= 0 ? 1 : 0); - rc |= ber_flatten(ber, &val); - if (rc != 0) { - TRACE_DEVEL("%s ber_alloc_t/ber_flatten failed \n", __func__); - ber_free(ber, 1); - ber_bvfree(val); - free(buf); - return CKR_FUNCTION_FAILED; - } - - pub_len = val->bv_len; - ber_free(ber, 1); free(buf); - ber_bvfree(val); + buf = NULL; + rc |= ber_encode_BIT_STRING(TRUE, NULL, &pub_len, NULL, len, 0); rc = ber_encode_SEQUENCE(TRUE, NULL, &total, NULL, id_len + pub_len); @@ -2536,23 +2517,19 @@ CK_RV ber_encode_DSAPublicKey(CK_BBOOL length_only, CK_BYTE **data, return rc; } - ber = ber_alloc_t(LBER_USE_DER); - rc = (ber_put_bitstring(ber, (char *)buf, len * 8, 0x03) <= 0 ? 1 : 0); - rc |= ber_flatten(ber, &val); + rc = ber_encode_BIT_STRING(FALSE, &bitstr, &bitstr_len, buf, len, 0); free(buf); - if (rc != 0) { - TRACE_DEVEL("%s ber_put_bitstring/ber_flatten failed\n", __func__); - ber_free(ber, 1); - ber_bvfree(val); + buf = NULL; + if (rc != CKR_OK) { + TRACE_DEVEL("%s ber_encode_BIT_STRING failed\n", __func__); free(buf2); - return CKR_FUNCTION_FAILED; + return rc; } - pub_len = val->bv_len; + pub_len = bitstr_len; if (ADD_OVERFLOW(id_len, pub_len)) { TRACE_ERROR("%s Integer overflow in allocation size\n", __func__); - ber_free(ber, 1); - ber_bvfree(val); + free(bitstr); free(buf2); return CKR_HOST_MEMORY; } @@ -2560,16 +2537,15 @@ CK_RV ber_encode_DSAPublicKey(CK_BBOOL length_only, CK_BYTE **data, buf = (CK_BYTE *) malloc(id_len + pub_len); if (!buf) { TRACE_ERROR("%s Memory allocation failed\n", __func__); - ber_free(ber, 1); - ber_bvfree(val); + free(bitstr); free(buf2); return CKR_HOST_MEMORY; } memcpy(buf, buf2, id_len); - memcpy(buf + id_len, val->bv_val, pub_len); + memcpy(buf + id_len, bitstr, pub_len); free(buf2); - ber_free(ber, 1); - ber_bvfree(val); + free(bitstr); + bitstr = NULL; /* outer sequence */ rc = ber_encode_SEQUENCE(FALSE, data, data_len, buf, id_len + pub_len); @@ -3745,8 +3721,8 @@ CK_RV ber_encode_DHPublicKey(CK_BBOOL length_only, CK_BYTE **data, CK_RV rc = 0; CK_BYTE *buf = NULL; CK_BYTE *buf2 = NULL; - BerValue *val = NULL; - BerElement *ber; + CK_BYTE *bitstr = NULL; + CK_ULONG bitstr_len = 0; /* Calculate the BER container length * @@ -3775,24 +3751,12 @@ CK_RV ber_encode_DHPublicKey(CK_BBOOL length_only, CK_BYTE **data, rc |= ber_encode_SEQUENCE(TRUE, NULL, &id_len, NULL, ber_idDHLen + parm_len); - /* public key */ + /* public key: compute encoded size only */ rc |= ber_encode_INTEGER(FALSE, &buf, &len, value->pValue, value->ulValueLen); - ber = ber_alloc_t(LBER_USE_DER); - rc |= (ber_put_bitstring(ber, (char *)buf, len * 8, 0x03) <= 0 ? 1 : 0); - rc |= ber_flatten(ber, &val); - if (rc != CKR_OK) { - TRACE_DEVEL("%s ber_put_bitstring/ber_flatten failed\n", __func__); - ber_free(ber, 1); - ber_bvfree(val); - free(buf); - return CKR_FUNCTION_FAILED; - } - - pub_len = val->bv_len; - ber_free(ber, 1); - ber_bvfree(val); free(buf); + buf = NULL; + rc |= ber_encode_BIT_STRING(TRUE, NULL, &pub_len, NULL, len, 0); rc |= ber_encode_SEQUENCE(TRUE, NULL, &total, NULL, id_len + pub_len); @@ -3871,23 +3835,19 @@ CK_RV ber_encode_DHPublicKey(CK_BBOOL length_only, CK_BYTE **data, return rc; } - ber = ber_alloc_t(LBER_USE_DER); - rc = (ber_put_bitstring(ber, (char *)buf, len * 8, 0x03) <= 0 ? 1 : 0); - rc |= ber_flatten(ber, &val); + rc = ber_encode_BIT_STRING(FALSE, &bitstr, &bitstr_len, buf, len, 0); free(buf); + buf = NULL; if (rc != CKR_OK) { - TRACE_DEVEL("%s ber_put_bitstring/ber_flatten failed\n", __func__); - ber_free(ber, 1); - ber_bvfree(val); + TRACE_DEVEL("%s ber_encode_BIT_STRING failed\n", __func__); free(buf2); - return CKR_FUNCTION_FAILED; + return rc; } - pub_len = val->bv_len; + pub_len = bitstr_len; if (ADD_OVERFLOW(id_len, pub_len)) { TRACE_ERROR("%s Integer overflow in allocation size\n", __func__); - ber_free(ber, 1); - ber_bvfree(val); + free(bitstr); free(buf2); return CKR_HOST_MEMORY; } @@ -3895,16 +3855,15 @@ CK_RV ber_encode_DHPublicKey(CK_BBOOL length_only, CK_BYTE **data, buf = (CK_BYTE *) malloc(id_len + pub_len); if (!buf) { TRACE_ERROR("%s Memory allocation failed\n", __func__); - ber_free(ber, 1); - ber_bvfree(val); + free(bitstr); free(buf2); return CKR_HOST_MEMORY; } memcpy(buf, buf2, id_len); - memcpy(buf + id_len, val->bv_val, pub_len); + memcpy(buf + id_len, bitstr, pub_len); free(buf2); - ber_free(ber, 1); - ber_bvfree(val); + free(bitstr); + bitstr = NULL; /* outer sequence */ rc = ber_encode_SEQUENCE(FALSE, data, data_len, buf, id_len + pub_len); diff --git a/usr/lib/ep11_stdll/ep11_specific.c b/usr/lib/ep11_stdll/ep11_specific.c index 9b493055..ed504551 100644 --- a/usr/lib/ep11_stdll/ep11_specific.c +++ b/usr/lib/ep11_stdll/ep11_specific.c @@ -44,7 +44,6 @@ #include #include #include -#include #include #include #include diff --git a/usr/lib/ep11_stdll/ep11_stdll.mk b/usr/lib/ep11_stdll/ep11_stdll.mk index d775617a..f5256f09 100644 --- a/usr/lib/ep11_stdll/ep11_stdll.mk +++ b/usr/lib/ep11_stdll/ep11_stdll.mk @@ -20,7 +20,7 @@ opencryptoki_stdll_libpkcs11_ep11_la_CFLAGS = \ opencryptoki_stdll_libpkcs11_ep11_la_LDFLAGS = \ -shared -Wl,-z,defs,-Bsymbolic -lc -lpthread -lcrypto -lrt \ - -llber -ldl -Wl,--version-script=${srcdir}/opencryptoki_tok.map + -ldl -Wl,--version-script=${srcdir}/opencryptoki_tok.map opencryptoki_stdll_libpkcs11_ep11_la_SOURCES = usr/lib/common/asn1.c \ usr/lib/common/cert.c usr/lib/common/hwf_obj.c \ diff --git a/usr/lib/ica_s390_stdll/ica_s390_stdll.mk b/usr/lib/ica_s390_stdll/ica_s390_stdll.mk index f718e04e..f41cdd83 100644 --- a/usr/lib/ica_s390_stdll/ica_s390_stdll.mk +++ b/usr/lib/ica_s390_stdll/ica_s390_stdll.mk @@ -13,7 +13,7 @@ opencryptoki_stdll_libpkcs11_ica_la_CFLAGS = \ opencryptoki_stdll_libpkcs11_ica_la_LDFLAGS = \ $(LIBICA_LIBS) -nostartfiles -shared \ -Wl,-z,defs,-Bsymbolic -Wl,-soname,$@ -lc -lpthread -lica -ldl \ - -lcrypto -lrt -llber \ + -lcrypto -lrt \ -Wl,--version-script=${srcdir}/opencryptoki_tok.map opencryptoki_stdll_libpkcs11_ica_la_SOURCES = \ diff --git a/usr/lib/soft_stdll/soft_stdll.mk b/usr/lib/soft_stdll/soft_stdll.mk index 8dc01220..2e546d95 100644 --- a/usr/lib/soft_stdll/soft_stdll.mk +++ b/usr/lib/soft_stdll/soft_stdll.mk @@ -12,12 +12,12 @@ opencryptoki_stdll_libpkcs11_sw_la_CFLAGS = \ if AIX opencryptoki_stdll_libpkcs11_sw_la_LDFLAGS = -qmkshrobj -lc \ - -lpthread -lcrypto -lrt -Wl,-bnoautoexp -Wl,-bstatic,-llber,-bdynamic \ + -lpthread -lcrypto -lrt -Wl,-bnoautoexp \ -export-symbols ${srcdir}/opencryptoki_tok.map.sym else opencryptoki_stdll_libpkcs11_sw_la_LDFLAGS = \ -shared -Wl,-z,defs,-Bsymbolic -lc -lpthread -lcrypto -lrt \ - -llber -Wl,--version-script=${srcdir}/opencryptoki_tok.map + -Wl,--version-script=${srcdir}/opencryptoki_tok.map endif opencryptoki_stdll_libpkcs11_sw_la_SOURCES = \ diff --git a/usr/lib/tpm_stdll/tpm_stdll.mk b/usr/lib/tpm_stdll/tpm_stdll.mk index 793eb633..f0c9e901 100644 --- a/usr/lib/tpm_stdll/tpm_stdll.mk +++ b/usr/lib/tpm_stdll/tpm_stdll.mk @@ -13,7 +13,7 @@ opencryptoki_stdll_libpkcs11_tpm_la_CFLAGS = \ opencryptoki_stdll_libpkcs11_tpm_la_LDFLAGS = \ -shared -Wl,-z,defs,-Bsymbolic -lcrypto -ltspi -lpthread -lrt \ - -llber -Wl,--version-script=${srcdir}/opencryptoki_tok.map + -Wl,--version-script=${srcdir}/opencryptoki_tok.map opencryptoki_stdll_libpkcs11_tpm_la_SOURCES = \ usr/lib/common/asn1.c usr/lib/common/dig_mgr.c \ diff --git a/usr/sbin/pkcscca/pkcscca.mk b/usr/sbin/pkcscca/pkcscca.mk index 02ff4eac..b93e5ac3 100644 --- a/usr/sbin/pkcscca/pkcscca.mk +++ b/usr/sbin/pkcscca/pkcscca.mk @@ -1,7 +1,7 @@ sbin_PROGRAMS += usr/sbin/pkcscca/pkcscca noinst_HEADERS += usr/sbin/pkcscca/pkcscca.h -usr_sbin_pkcscca_pkcscca_LDFLAGS = -lcrypto -ldl -lrt -llber -lpthread +usr_sbin_pkcscca_pkcscca_LDFLAGS = -lcrypto -ldl -lrt -lpthread if AIX usr_sbin_pkcscca_pkcscca_LDFLAGS += -lbsd -Wl,-blibpath:$(libdir)/opencryptoki:$(libdir)/opencryptoki/stdll:/usr/lib:/usr/lib64