Skip to contentSkip to conversation

pkcs11: Load p11-kit-proxy.so module by default

PATCH In review David Woodhouse 4 participants 11 messages Dec 11, 2014 – Dec 27, 2014

lore
Share & tools
lore

David Woodhouse

author
#0 lore raw

PATCH 1/1 pkcs11: Load p11-kit-proxy.so module by default

If the user specifies --pkcs11-id or --pkcs-id-management but neglects to explicitly provide a --pkcs11-provider argument, and if the system has p11-kit installed, then load the p11-kit proxy module so that the system-configured tokens are available.

Trac: 490

Signed-off-by David Woodhouse <[email protected]...>
---
 configure.ac          |  7 +++++++
 doc/openvpn.8         | 10 ++++++++++
 src/openvpn/options.c |  9 +++++++++
 3 files changed, 26 insertions(+)
configure.ac +7 -0
index ddaa2b2..b549452 100644
@@ -1139,6 +1139,13 @@ if test "${enable_pkcs11}" = "yes"; then
 	OPTIONAL_PKCS11_HELPER_CFLAGS="${PKCS11_HELPER_CFLAGS}"
 	OPTIONAL_PKCS11_HELPER_LIBS="${PKCS11_HELPER_LIBS}"
 	AC_DEFINE([ENABLE_PKCS11], [1], [Enable PKCS11])
+	PKG_CHECK_MODULES(
+		[P11KIT],
+		[p11-kit-1],
+		[proxy_module="`$PKG_CONFIG --variable=proxy_module p11-kit-1`"
+		 AC_DEFINE_UNQUOTED([DEFAULT_PKCS11_MODULE], "${proxy_module}", [p11-kit proxy])],
+		[]
+	)
 fi
 
 if test "${enable_pedantic}" = "yes"; then
doc/openvpn.8 +10 -0
index 532eda5..0bdea1f 100644
@@ -4393,6 +4393,16 @@ This option can be used instead of
 .B \-\-cert, \-\-key,
 and
 .B \-\-pkcs12.
+
+If p11-kit is present on the system, its
+.B p11-kit-proxy.so
+module will be loaded by default if either the
+.B \-\-pkcs11\-id
+or
+.B \-\-pkcs11\-id\-management
+options are specified without
+.B \-\-pkcs11\-provider
+being given.
 .\"*********************************************************
 .TP
 .B \-\-pkcs11-private-mode mode...
src/openvpn/options.c +9 -0
index f0091c2..b33eb4a 100644
@@ -2447,6 +2447,15 @@ options_postprocess_mutate_invariant (struct options *options)
 #endif
     }
 #endif
+
+#ifdef DEFAULT_PKCS11_MODULE
+  /* If p11-kit is present on the system then load its p11-kit-proxy.so
+     by default if the user asks for PKCS#11 without otherwise specifying
+     the module to use. */
+  if (!options->pkcs11_providers[0] &&
+      (options->pkcs11_id || options->pkcs11_id_management))
+    options->pkcs11_providers[0] = DEFAULT_PKCS11_MODULE;
+#endif
 }
 
 static void
Signature · 6 lines
2.1.0


-- 
David Woodhouse                            Open Source Technology Centre
[email protected]...                              Intel Corporation
author
#1 lore raw

PATCH 1/1 Make 'provider' option to --show-pkcs11-ids optional where p11-kit is present

Following on from the previous patch, this fixes --show-pkcs11-ids too.

Trac: 490

Signed-off-by David Woodhouse <[email protected]...>
---
 doc/openvpn.8         |  8 +++++++-
 src/openvpn/options.c | 21 ++++++++++++++++++++-
 2 files changed, 27 insertions(+), 2 deletions(-)
doc/openvpn.8 +7 -1
index 0bdea1f..49183ee 100644
@@ -5490,11 +5490,17 @@ adapter list.
 .SS PKCS#11 Standalone Options:
 .\"*********************************************************
 .TP
-.B \-\-show-pkcs11-ids provider [cert_private]
+.B \-\-show-pkcs11-ids [provider] [cert_private]
 (Standalone)
 Show PKCS#11 token object list. Specify cert_private as 1
 if certificates are stored as private objects.
 
+If p11-kit is present on the system, the
+.B provider
+argument is optional; if omitted the default
+.B p11-kit-proxy.so
+module will be queried.
+
 .B \-\-verb
 option can be used BEFORE this option to produce debugging information.
 .\"*********************************************************
src/openvpn/options.c +20 -1
index b33eb4a..5492516 100644
@@ -6935,11 +6935,30 @@ add_option (struct options *options,
 #endif /* ENABLE_SSL */
 #endif /* ENABLE_CRYPTO */
 #ifdef ENABLE_PKCS11
-  else if (streq (p[0], "show-pkcs11-ids") && p[1])
+  else if (streq (p[0], "show-pkcs11-ids")
+#ifndef DEFAULT_PKCS11_MODULE
+	   && p[1]
+#endif
+	   )
     {
       char *provider =  p[1];
       bool cert_private = (p[2] == NULL ? false : ( atoi (p[2]) != 0 ));
 
+#ifdef DEFAULT_PKCS11_MODULE
+      if (!provider)
+	provider = DEFAULT_PKCS11_MODULE;
+      else if (!p[2]) {
+	char *endp = NULL;
+	int i = strtol(provider, &endp, 10);
+
+	if (*endp == 0) {
+	  /* There was one argument, and it was purely numeric.
+	     Interpret it as the cert_private argument */
+	  provider = DEFAULT_PKCS11_MODULE;
+	  cert_private = i;
+	}
+      }
+#endif
       VERIFY_PERMISSION (OPT_P_GENERAL);
 
       set_debug_level (options->verbosity, SDL_CONSTRAIN);
Signature · 6 lines
2.1.0


-- 
David Woodhouse                            Open Source Technology Centre
[email protected]...                              Intel Corporation
#9 lore raw
In reply to David Woodhouse

ACK. Using smartcards really improves secuirty, but pkcs11 can have a steep learning curve. Making it easier for users is a good thing.

-Steffan

Quoted 89 lines · David Woodhouse

If the user specifies --pkcs11-id or --pkcs-id-management but neglects to explicitly provide a --pkcs11-provider argument, and if the system has p11-kit installed, then load the p11-kit proxy module so that the system-configured tokens are available.

Trac: 490

Signed-off-by David Woodhouse <[email protected]...>
---
 configure.ac          |  7 +++++++
 doc/openvpn.8         | 10 ++++++++++
 src/openvpn/options.c |  9 +++++++++
 3 files changed, 26 insertions(+)
configure.ac +7 -0
index ddaa2b2..b549452 100644
@@ -1139,6 +1139,13 @@ if test "${enable_pkcs11}" = "yes"; then
 	OPTIONAL_PKCS11_HELPER_CFLAGS="${PKCS11_HELPER_CFLAGS}"
 	OPTIONAL_PKCS11_HELPER_LIBS="${PKCS11_HELPER_LIBS}"
 	AC_DEFINE([ENABLE_PKCS11], [1], [Enable PKCS11])
+	PKG_CHECK_MODULES(
+		[P11KIT],
+		[p11-kit-1],
+		[proxy_module="`$PKG_CONFIG --variable=proxy_module p11-kit-1`"
+		 AC_DEFINE_UNQUOTED([DEFAULT_PKCS11_MODULE], "${proxy_module}", [p11-kit proxy])],
+		[]
+	)
 fi
 
 if test "${enable_pedantic}" = "yes"; then
doc/openvpn.8 +10 -0
index 532eda5..0bdea1f 100644
@@ -4393,6 +4393,16 @@ This option can be used instead of
 .B \-\-cert, \-\-key,
 and
 .B \-\-pkcs12.
+
+If p11-kit is present on the system, its
+.B p11-kit-proxy.so
+module will be loaded by default if either the
+.B \-\-pkcs11\-id
+or
+.B \-\-pkcs11\-id\-management
+options are specified without
+.B \-\-pkcs11\-provider
+being given.
 .\"*********************************************************
 .TP
 .B \-\-pkcs11-private-mode mode...
src/openvpn/options.c +9 -1
index f0091c2..b33eb4a 100644
@@ -2447,6 +2447,15 @@ options_postprocess_mutate_invariant (struct options *options)
 #endif
     }
 #endif
+
+#ifdef DEFAULT_PKCS11_MODULE
+  /* If p11-kit is present on the system then load its p11-kit-proxy.so
+     by default if the user asks for PKCS#11 without otherwise specifying
+     the module to use. */
+  if (!options->pkcs11_providers[0] &&
+      (options->pkcs11_id || options->pkcs11_id_management))
+    options->pkcs11_providers[0] = DEFAULT_PKCS11_MODULE;
+#endif
 }
 
 static void
 
 
 
------------------------------------------------------------------------------

Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server from Actuate! Instantly Supercharge Your Business Reports and Dashboards with Interactivity, Sharing, Native Excel Exports, App Integration & more Get technology previously reserved for billion-dollar corporations, FREE
http://pubads.g.doubleclick.net/gampad/clk?id=164703151&iu=/4140/ostg.clktrk

_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel

#2 lore raw

Re: [Openvpn-devel] [PATCH 2] Make 'provider' option to --show-pkcs11-ids optional where p11-kit is present

In reply to David Woodhouse

Hi David,

Feature-ACK, but a small remark:

src/openvpn/options.c add_option (struct options *options, · line 6942

Quoted 10 lines · David Woodhouse
src/openvpn/options.c +5 -1
@@ -6935,11 +6935,30 @@ add_option (struct options *options,
 #endif /* ENABLE_SSL */
 #endif /* ENABLE_CRYPTO */
 #ifdef ENABLE_PKCS11
-  else if (streq (p[0], "show-pkcs11-ids") && p[1])
+  else if (streq (p[0], "show-pkcs11-ids")
+#ifndef DEFAULT_PKCS11_MODULE
+	   && p[1]
+#endif
+	   )

Since this makes a '--show-pkcs11-ids' without the module argument valid for some openvpn builds, I think it is nicer to give a proper error message to the user. E.g. something like:

    #ifndef DEFAULT_PKCS11_MODULE
	if (!p[1])
	  {
	    msg (msglevel, "--show-pkcs11-ids requires a module parameter");
	    goto err;
	  }
    #endif

Regards,
-Steffan

author
#3 lore raw

Re: [Openvpn-devel] [PATCH 2] Make 'provider' option to --show-pkcs11-ids optional where p11-kit is present

Quoted 5 lines · Steffan Karger

Since this makes a '--show-pkcs11-ids' without the module argument valid
for some openvpn builds, I think it is nicer to give a proper error message to the user. E.g. something like:

Like this? If this incremental patch is what you were after I'll resubmit the original 'PATCH 2' with it.

src/openvpn/options.c +11 -4
index 5492516..66453b5 100644
@@ -738,7 +738,11 @@ static const char usage_message[] =
 #ifdef ENABLE_PKCS11
   "\n"
   "PKCS#11 standalone options:\n"
-  "--show-pkcs11-ids provider [cert_private] : Show PKCS#11 available ids.\n" 
+#ifndef DEFAULT_PKCS11_MODULE
+  "--show-pkcs11-ids [provider] [cert_private] : Show PKCS#11 available ids.\n"
+#else
+  "--show-pkcs11-ids provider [cert_private] : Show PKCS#11 available ids.\n"
+#endif
   "                                            --verb option can be added *BEFORE* this.\n"
 #endif				/* ENABLE_PKCS11 */
   "\n"

@@ -6936,9 +6940,6 @@ add_option (struct options *options,
 #endif /* ENABLE_CRYPTO */
 #ifdef ENABLE_PKCS11
   else if (streq (p[0], "show-pkcs11-ids")
-#ifndef DEFAULT_PKCS11_MODULE
-	   && p[1]
-#endif
 	   )
     {
       char *provider =  p[1];

@@ -6958,6 +6959,12 @@ add_option (struct options *options,
 	  cert_private = i;
 	}
       }
+#else
+      if (!provider)
+	{
+	  msg (msglevel, "--show-pkcs11-ids requires a provider parameter");
+            goto err;
+	}
 #endif
       VERIFY_PERMISSION (OPT_P_GENERAL);
Signature · 1 line
dwmw2
#4 lore raw

Re: [Openvpn-devel] [PATCH 2] Make 'provider' option to --show-pkcs11-ids optional where p11-kit is present

Quoted 2 lines · David Woodhouse

Like this? If this incremental patch is what you were after I'll resubmit the original 'PATCH 2' with it.

Yes, looks good to me. Even with an additional fix for something I overlooked in the first place!

-Steffan

author
#5 lore raw

PATCH v2 1/1 Make 'provider' option to --show-pkcs11-ids optional where p11-kit is present

Following on from the previous patch, this fixes --show-pkcs11-ids too.

Trac: 490

Signed-off-by David Woodhouse <[email protected]...>

---

As I compose the email, I spot that we're actually now looking at the value of p[2] even when p[1] is NULL. So if the add_option() function is supposed to be treating p[] as a traditional NULL-terminated array of pointers where it's invalid to access anything after the NULL one, that's bad.

In practice, however, it's always an array of MAX_PARMS which has been entirely cleared, so it's not really a problem. I can fix it anyway if you prefer...

 doc/openvpn.8         |  8 +++++++-
 src/openvpn/options.c | 30 ++++++++++++++++++++++++++++--
 2 files changed, 35 insertions(+), 3 deletions(-)
doc/openvpn.8 +7 -1
index 0bdea1f..49183ee 100644
@@ -5490,11 +5490,17 @@ adapter list.
 .SS PKCS#11 Standalone Options:
 .\"*********************************************************
 .TP
-.B \-\-show-pkcs11-ids provider [cert_private]
+.B \-\-show-pkcs11-ids [provider] [cert_private]
 (Standalone)
 Show PKCS#11 token object list. Specify cert_private as 1
 if certificates are stored as private objects.
 
+If p11-kit is present on the system, the
+.B provider
+argument is optional; if omitted the default
+.B p11-kit-proxy.so
+module will be queried.
+
 .B \-\-verb
 option can be used BEFORE this option to produce debugging information.
 .\"*********************************************************
src/openvpn/options.c +28 -2
index b33eb4a..66453b5 100644
@@ -738,7 +738,11 @@ static const char usage_message[] =
 #ifdef ENABLE_PKCS11
   "\n"
   "PKCS#11 standalone options:\n"
-  "--show-pkcs11-ids provider [cert_private] : Show PKCS#11 available ids.\n" 
+#ifndef DEFAULT_PKCS11_MODULE
+  "--show-pkcs11-ids [provider] [cert_private] : Show PKCS#11 available ids.\n"
+#else
+  "--show-pkcs11-ids provider [cert_private] : Show PKCS#11 available ids.\n"
+#endif
   "                                            --verb option can be added *BEFORE* this.\n"
 #endif				/* ENABLE_PKCS11 */
   "\n"

@@ -6935,11 +6939,33 @@ add_option (struct options *options,
 #endif /* ENABLE_SSL */
 #endif /* ENABLE_CRYPTO */
 #ifdef ENABLE_PKCS11
-  else if (streq (p[0], "show-pkcs11-ids") && p[1])
+  else if (streq (p[0], "show-pkcs11-ids")
+	   )
     {
       char *provider =  p[1];
       bool cert_private = (p[2] == NULL ? false : ( atoi (p[2]) != 0 ));
 
+#ifdef DEFAULT_PKCS11_MODULE
+      if (!provider)
+	provider = DEFAULT_PKCS11_MODULE;
+      else if (!p[2]) {
+	char *endp = NULL;
+	int i = strtol(provider, &endp, 10);
+
+	if (*endp == 0) {
+	  /* There was one argument, and it was purely numeric.
+	     Interpret it as the cert_private argument */
+	  provider = DEFAULT_PKCS11_MODULE;
+	  cert_private = i;
+	}
+      }
+#else
+      if (!provider)
+	{
+	  msg (msglevel, "--show-pkcs11-ids requires a provider parameter");
+            goto err;
+	}
+#endif
       VERIFY_PERMISSION (OPT_P_GENERAL);
 
       set_debug_level (options->verbosity, SDL_CONSTRAIN);
Signature · 7 lines
2.1.0



-- 
David Woodhouse                            Open Source Technology Centre
[email protected]...                              Intel Corporation
author
#6 lore raw

PATCH v3 1/1 Make 'provider' option to --show-pkcs11-ids optional where p11-kit is present

Trac: 490

Signed-off-by David Woodhouse <[email protected]...>

---
v2: Nicer error message if no provider given when there's no default.
v3: Get the usage messages the right way round (s/ifndef/ifdef).

I did look at cleaning it up to stop looking at p[2] even when p[1] isn't set, but it makes it somewhat more complicated for no *real* benefit. So unless someone really objects, I'll leave it as it is.

 doc/openvpn.8         |  8 +++++++-
 src/openvpn/options.c | 30 ++++++++++++++++++++++++++++--
 2 files changed, 35 insertions(+), 3 deletions(-)
doc/openvpn.8 +7 -1
index 0bdea1f..49183ee 100644
@@ -5490,11 +5490,17 @@ adapter list.
 .SS PKCS#11 Standalone Options:
 .\"*********************************************************
 .TP
-.B \-\-show-pkcs11-ids provider [cert_private]
+.B \-\-show-pkcs11-ids [provider] [cert_private]
 (Standalone)
 Show PKCS#11 token object list. Specify cert_private as 1
 if certificates are stored as private objects.
 
+If p11-kit is present on the system, the
+.B provider
+argument is optional; if omitted the default
+.B p11-kit-proxy.so
+module will be queried.
+
 .B \-\-verb
 option can be used BEFORE this option to produce debugging information.
 .\"*********************************************************
src/openvpn/options.c +28 -2
index b33eb4a..226b203 100644
@@ -738,7 +738,11 @@ static const char usage_message[] =
 #ifdef ENABLE_PKCS11
   "\n"
   "PKCS#11 standalone options:\n"
-  "--show-pkcs11-ids provider [cert_private] : Show PKCS#11 available ids.\n" 
+#ifdef DEFAULT_PKCS11_MODULE
+  "--show-pkcs11-ids [provider] [cert_private] : Show PKCS#11 available ids.\n"
+#else
+  "--show-pkcs11-ids provider [cert_private] : Show PKCS#11 available ids.\n"
+#endif
   "                                            --verb option can be added *BEFORE* this.\n"
 #endif				/* ENABLE_PKCS11 */
   "\n"

@@ -6935,11 +6939,33 @@ add_option (struct options *options,
 #endif /* ENABLE_SSL */
 #endif /* ENABLE_CRYPTO */
 #ifdef ENABLE_PKCS11
-  else if (streq (p[0], "show-pkcs11-ids") && p[1])
+  else if (streq (p[0], "show-pkcs11-ids")
+	   )
     {
       char *provider =  p[1];
       bool cert_private = (p[2] == NULL ? false : ( atoi (p[2]) != 0 ));
 
+#ifdef DEFAULT_PKCS11_MODULE
+      if (!provider)
+	provider = DEFAULT_PKCS11_MODULE;
+      else if (!p[2]) {
+	char *endp = NULL;
+	int i = strtol(provider, &endp, 10);
+
+	if (*endp == 0) {
+	  /* There was one argument, and it was purely numeric.
+	     Interpret it as the cert_private argument */
+	  provider = DEFAULT_PKCS11_MODULE;
+	  cert_private = i;
+	}
+      }
+#else
+      if (!provider)
+	{
+	  msg (msglevel, "--show-pkcs11-ids requires a provider parameter");
+            goto err;
+	}
+#endif
       VERIFY_PERMISSION (OPT_P_GENERAL);
 
       set_debug_level (options->verbosity, SDL_CONSTRAIN);
Signature · 6 lines
2.1.0


-- 
David Woodhouse                            Open Source Technology Centre
[email protected]...                              Intel Corporation
#7 lore raw

Re: [Openvpn-devel] [PATCH 2 v3] Make 'provider' option to --show-pkcs11-ids optional where p11-kit is present

ACK. Thanks for supplying and updating the patch!

-Steffan

Quoted 57 lines · David Woodhouse

Trac: 490 Signed-off-by: David Woodhouse <[email protected]...> --- v2: Nicer error message if no provider given when there's no default. v3: Get the usage messages the right way round (s/ifndef/ifdef).

I did look at cleaning it up to stop looking at p[2] even when p[1] isn't set, but it makes it somewhat more complicated for no *real* benefit. So unless someone really objects, I'll leave it as it is.

doc/openvpn.8 | 8 +++++++- src/openvpn/options.c | 30
++++++++++++++++++++++++++++-- 2 files changed, 35 insertions(+), 3 deletions(-)

doc/openvpn.8 index 0bdea1f..49183ee renamed from doc/openvpn.8 +0 -0

100644 --- a/doc/openvpn.8 +++ b/doc/openvpn.8 @@ -5490,11 +5490,17 @@ adapter list. .SS PKCS#11 Standalone Options:
.\"********************************************************* .TP -.B \-\-show-pkcs11-ids provider [cert_private] +.B \-\-show-pkcs11-ids [provider] [cert_private] (Standalone) Show PKCS#11 token object list. Specify cert_private as 1 if certificates are stored as private objects.

+If p11-kit is present on the system, the +.B provider +argument is optional; if omitted the default +.B p11-kit-proxy.so +module will be queried. + .B \-\-verb option can be used BEFORE this option to produce debugging information. .\"********************************************************* diff --git a/src/openvpn/options.c b/src/openvpn/options.c index b33eb4a..226b203 100644 --- a/src/openvpn/options.c +++ b/src/openvpn/options.c @@ -738,7 +738,11 @@ static const char usage_message[] = #ifdef ENABLE_PKCS11 "\n" "PKCS#11 standalone options:\n" - "--show-pkcs11-ids provider [cert_private] : Show PKCS#11 available ids.\n" +#ifdef DEFAULT_PKCS11_MODULE + "--show-pkcs11-ids [provider] [cert_private] : Show PKCS#11 available ids.\n" +#else + "--show-pkcs11-ids provider [cert_private] : Show PKCS#11 available ids.\n" +#endif "
--verb option can be added *BEFORE* this.\n" #endif /*
ENABLE_PKCS11 */ "\n" @@ -6935,11 +6939,33 @@ add_option (struct options *options, #endif /* ENABLE_SSL */ #endif /* ENABLE_CRYPTO */ #ifdef ENABLE_PKCS11 - else if (streq (p[0], "show-pkcs11-ids")
&& p[1]) + else if (streq (p[0], "show-pkcs11-ids") + ) { char
*provider = p[1]; bool cert_private = (p[2] == NULL ? false : ( atoi (p[2]) != 0 ));

+#ifdef DEFAULT_PKCS11_MODULE + if (!provider) + provider =
DEFAULT_PKCS11_MODULE; + else if (!p[2]) { + char *endp =
NULL; + int i = strtol(provider, &endp, 10); + + if (*endp == 0) {

doc/openvpn.8 index 0bdea1f..49183ee renamed from doc/openvpn.8 +1 -0
+	  /* There was one argument, and it was purely numeric. +

Interpret it as the cert_private argument */ + provider =
DEFAULT_PKCS11_MODULE; + cert_private = i; + } + } +#else +
if (!provider) + { + msg (msglevel, "--show-pkcs11-ids requires a
provider parameter"); + goto err; + } +#endif
VERIFY_PERMISSION (OPT_P_GENERAL);

set_debug_level (options->verbosity, SDL_CONSTRAIN);

#10 lore raw
In reply to David Woodhouse

Your patch has been applied to the release/2.3 and master branches.

commit 6f1d3cf062d5c33cbad4d521d157d43d53ffc7d1 (release/2.3) commit 3c6d32205db88348c07c720b710b41548497819c (master)

Author: David Woodhouse
Date:   Thu Dec 11 13:03:35 2014 +0000
     pkcs11: Load p11-kit-proxy.so module by default

     Signed-off-by: David Woodhouse <[email protected]...>
     Acked-by: Steffan Karger <[email protected]...>
     Message-Id: <[email protected]...>
     URL: http://article.gmane.org/gmane.network.openvpn.devel/9342
     Signed-off-by: Gert Doering <[email protected]...>

--
kind regards,

Gert Doering

#8 lore raw

[Openvpn-devel] [PATCH applied] Re: Make 'provider' option to --show-pkcs11-ids optional where p11-kit is present

In reply to David Woodhouse

Your patch has been applied to the release/2.3 and master branches.

Thanks for improving our pkcs#11 support.

I have taken the liberty to fix up some whitespace to conform to our current coding style - which we intend to change, but for the time being, we stick to it... - only whitespace, nothing else.

commit a91a06cb291414c9e657377e44f7a57343ae7f5a (release/2.3) commit 7c1d614c5c5282a73cb799f919eac6750363783a (master)

Author: David Woodhouse
Date:   Thu Dec 18 12:25:06 2014 +0000
     Make 'provider' option to --show-pkcs11-ids optional where p11-kit is present

     Signed-off-by: David Woodhouse <[email protected]...>
     Acked-by: Steffan Karger <[email protected]...>
     Message-Id: <[email protected]...>
     URL: http://article.gmane.org/gmane.network.openvpn.devel/9355
     Signed-off-by: Gert Doering <[email protected]...>

--
kind regards,

Gert Doering