Skip to contentSkip to conversation

ubifs-utils: Don't compile engine support if not available

PATCH In review Sebastian Andrzej Siewior 2 participants 3 messages Aug 29 – Aug 31 Memory technology devices (MTD)

lore
Share & tools
lore

Sebastian Andrzej Siewior

author
#0 lore raw

PATCH 1/1 ubifs-utils: Don't compile engine support if not available

OpenSSL 4.0 dropped engine support which was deprecated since 3.0. The replacement is the "providers" API.

Add an ifndef OPENSSL_NO_ENGINE around the engine code so it can be left out where it is not supported.

Signed-off-by Sebastian Andrzej Siewior <[email protected]>
---
 ubifs-utils/common/sign.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)
ubifs-utils/common/sign.c +9 -1
index 032a6acc045d..5f94c0ad176f 100644
@@ -23,11 +23,14 @@
 #include <openssl/bio.h>
 #include <openssl/pem.h>
 #include <openssl/err.h>
-#include <openssl/engine.h>
 #include <openssl/cms.h>
 #include <openssl/conf.h>
 #include <err.h>
 
+#ifndef OPENSSL_NO_ENGINE
+#include <openssl/engine.h>
+#endif
+
 #include "linux_types.h"
 #include "sign.h"
 #include "ubifs.h"

@@ -139,6 +142,7 @@ static EVP_PKEY *read_private_key(const char *private_key_name, X509 **cert)
 	*cert = NULL;
 
 	if (!strncmp(private_key_name, "pkcs11:", 7)) {
+#ifndef OPENSSL_NO_ENGINE
 		ENGINE *e;
 		struct {
 			const char *url;

@@ -177,6 +181,10 @@ static EVP_PKEY *read_private_key(const char *private_key_name, X509 **cert)
 		}
 		*cert = parms.cert;
 		fprintf(stderr, "Using cert %p\n", *cert);
+#else
+		ssl_err_msg("PKCS#11 ENGINE support not available.");
+		return NULL;
+#endif
 	} else {
 		BIO *b;
Signature · 6 lines
2.55.0


______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/
#1 lore raw
Quoted 40 lines · Sebastian Andrzej Siewior

OpenSSL 4.0 dropped engine support which was deprecated since 3.0. The replacement is the "providers" API.

Add an ifndef OPENSSL_NO_ENGINE around the engine code so it can be left out where it is not supported.

Signed-off-by Sebastian Andrzej Siewior <[email protected]>
---
  ubifs-utils/common/sign.c | 10 +++++++++-
  1 file changed, 9 insertions(+), 1 deletion(-)
ubifs-utils/common/sign.c +5 -1
index 032a6acc045d..5f94c0ad176f 100644
@@ -23,11 +23,14 @@
  #include <openssl/bio.h>
  #include <openssl/pem.h>
  #include <openssl/err.h>
-#include <openssl/engine.h>
  #include <openssl/cms.h>
  #include <openssl/conf.h>
  #include <err.h>
 
+#ifndef OPENSSL_NO_ENGINE
+#include <openssl/engine.h>
+#endif
+
  #include "linux_types.h"
  #include "sign.h"
  #include "ubifs.h"

@@ -139,6 +142,7 @@ static EVP_PKEY *read_private_key(const char *private_key_name, X509 **cert)
  	*cert = NULL;
 
  	if (!strncmp(private_key_name, "pkcs11:", 7)) {
+#ifndef OPENSSL_NO_ENGINE
  		ENGINE *e;
  		struct {
  			const char *url;

ubifs-utils/common/sign.c static EVP_PKEY *read_private_key(const char *private_key_name, X509 **cert) · line 186

Quoted 6 lines
ubifs-utils/common/sign.c +3 -0
@@ -177,6 +181,10 @@ static EVP_PKEY *read_private_key(const char *private_key_name, X509 **cert)
  		}
  		*cert = parms.cert;
  		fprintf(stderr, "Using cert %p\n", *cert);
+#else
+		ssl_err_msg("PKCS#11 ENGINE support not available.");
+		return NULL;

Hi Sebastian,
Thanks for pointing that. I am wondering whether it would be better to implement PKCS11 encryption in #else branch by the OpenSSL 4.0 API provider.

ubifs-utils/common/sign.c static EVP_PKEY *read_private_key(const char *private_key_name, X509 **cert) · line 190

Quoted 5 lines
ubifs-utils/common/sign.c +1 -0
+#endif
  	} else {
  		BIO *b;

______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/

author
#2 lore raw
Quoted 10 lines · Zhihao Cheng
Quoted 9 lines · Sebastian Andrzej Siewior
ubifs-utils/common/sign.c +1 -0
@@ -139,6 +142,7 @@ static EVP_PKEY *read_private_key(const char *private_key_name, X509 **cert)
  	*cert = NULL;
  	if (!strncmp(private_key_name, "pkcs11:", 7)) {
+#ifndef OPENSSL_NO_ENGINE
  		ENGINE *e;
  		struct {
  			const char *url;

@@ -177,6 +181,10 @@ static EVP_PKEY *read_private_key(const char *private_key_name, X509 **cert)
  		}
Quoted 8 lines

ubifs-utils/common/sign.c static EVP_PKEY *read_private_key(const char *private_key_name, X509 **cert) · line 186

Quoted 5 lines
ubifs-utils/common/sign.c +3 -0
  		*cert = parms.cert;
  		fprintf(stderr, "Using cert %p\n", *cert);
+#else
+		ssl_err_msg("PKCS#11 ENGINE support not available.");
+		return NULL;

Hi Sebastian,
Thanks for pointing that. I am wondering whether it would be better to implement PKCS11 encryption in #else branch by the OpenSSL 4.0 API provider.

Well. This is a the very least gets it compiled. The provider API is supported since OpenSSL 3.0 so I wouldn't make it available only if ENGINE isn't supported. You still need the actual provider.

Quoted 4 lines

ubifs-utils/common/sign.c static EVP_PKEY *read_private_key(const char *private_key_name, X509 **cert) · line 190

Quoted 4 lines
ubifs-utils/common/sign.c +1 -0
+#endif
  	} else {
  		BIO *b;

Sebastian

______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/