diff options
Diffstat (limited to 'sys-auth/yubico-piv-tool/files')
-rw-r--r-- | sys-auth/yubico-piv-tool/files/yubico-piv-tool-1.5.0-openssl110.patch | 170 |
1 files changed, 170 insertions, 0 deletions
diff --git a/sys-auth/yubico-piv-tool/files/yubico-piv-tool-1.5.0-openssl110.patch b/sys-auth/yubico-piv-tool/files/yubico-piv-tool-1.5.0-openssl110.patch new file mode 100644 index 000000000000..86b8bf9bedc9 --- /dev/null +++ b/sys-auth/yubico-piv-tool/files/yubico-piv-tool-1.5.0-openssl110.patch @@ -0,0 +1,170 @@ +From c8372f27d791aa445e879ded4efe4a267e3ff48e Mon Sep 17 00:00:00 2001 +From: quentin <quentin@minster.io> +Date: Mon, 26 Feb 2018 02:43:41 +0100 +Subject: [PATCH] Improve compatibility with OpenSSL 1.1.0 + +* add missing headers +* stop using deprecated APIs +--- + tool/util.c | 1 + + tool/yubico-piv-tool.c | 24 +++++++++++++++++++++++- + ykcs11/openssl_types.h | 1 + + ykcs11/openssl_utils.c | 11 +++++++++++ + 4 files changed, 36 insertions(+), 1 deletion(-) + +diff --git a/tool/util.c b/tool/util.c +index de6b071..5b299ca 100644 +--- a/tool/util.c ++++ b/tool/util.c +@@ -38,6 +38,7 @@ + #endif + + #include "openssl-compat.h" ++#include <openssl/bn.h> + #include <openssl/evp.h> + #include <openssl/x509.h> + #include <openssl/rsa.h> +diff --git a/tool/yubico-piv-tool.c b/tool/yubico-piv-tool.c +index c40b027..f8b72b1 100644 +--- a/tool/yubico-piv-tool.c ++++ b/tool/yubico-piv-tool.c +@@ -43,10 +43,12 @@ + #endif + + #include "openssl-compat.h" ++#include <openssl/bn.h> + #include <openssl/des.h> + #include <openssl/pem.h> + #include <openssl/pkcs12.h> + #include <openssl/rand.h> ++#include <openssl/rsa.h> + + #include "cmdline.h" + #include "util.h" +@@ -868,11 +870,19 @@ static bool selfsign_certificate(ykpiv_state *state, enum enum_key_format key_fo + fprintf(stderr, "Failed to set certificate serial.\n"); + goto selfsign_out; + } ++#if OPENSSL_VERSION_NUMBER < 0x10100000L + if(!X509_gmtime_adj(X509_get_notBefore(x509), 0)) { ++#else ++ if(!X509_gmtime_adj(X509_getm_notBefore(x509), 0)) { ++#endif + fprintf(stderr, "Failed to set certificate notBefore.\n"); + goto selfsign_out; + } ++#if OPENSSL_VERSION_NUMBER < 0x10100000L + if(!X509_gmtime_adj(X509_get_notAfter(x509), 60L * 60L * 24L * validDays)) { ++#else ++ if(!X509_gmtime_adj(X509_getm_notAfter(x509), 60L * 60L * 24L * validDays)) { ++#endif + fprintf(stderr, "Failed to set certificate notAfter.\n"); + goto selfsign_out; + } +@@ -1241,7 +1251,7 @@ static void print_cert_info(ykpiv_state *state, enum enum_slot slot, const EVP_M + + if(*ptr++ == 0x70) { + unsigned int md_len = sizeof(data); +- ASN1_TIME *not_before, *not_after; ++ const ASN1_TIME *not_before, *not_after; + + ptr += get_length(ptr, &cert_len); + x509 = X509_new(); +@@ -1299,13 +1309,21 @@ static void print_cert_info(ykpiv_state *state, enum enum_slot slot, const EVP_M + dump_data(data, md_len, output, false, format_arg_hex); + + bio = BIO_new_fp(output, BIO_NOCLOSE | BIO_FP_TEXT); ++#if OPENSSL_VERSION_NUMBER < 0x10100000L + not_before = X509_get_notBefore(x509); ++#else ++ not_before = X509_get0_notBefore(x509); ++#endif + if(not_before) { + fprintf(output, "\tNot Before:\t"); + ASN1_TIME_print(bio, not_before); + fprintf(output, "\n"); + } ++#if OPENSSL_VERSION_NUMBER < 0x10100000L + not_after = X509_get_notAfter(x509); ++#else ++ not_after = X509_get0_notAfter(x509); ++#endif + if(not_after) { + fprintf(output, "\tNot After:\t"); + ASN1_TIME_print(bio, not_after); +@@ -1950,7 +1968,9 @@ int main(int argc, char *argv[]) { + + + /* openssl setup.. */ ++#if OPENSSL_VERSION_NUMBER < 0x10100000L + OpenSSL_add_all_algorithms(); ++#endif + + + for(i = 0; i < args_info.action_given; i++) { +@@ -2191,6 +2211,8 @@ int main(int argc, char *argv[]) { + } + + ykpiv_done(state); ++#if OPENSSL_VERSION_NUMBER < 0x10100000L + EVP_cleanup(); ++#endif + return ret; + } +diff --git a/ykcs11/openssl_types.h b/ykcs11/openssl_types.h +index 307f746..08170fc 100644 +--- a/ykcs11/openssl_types.h ++++ b/ykcs11/openssl_types.h +@@ -31,6 +31,7 @@ + #ifndef OPENSSL_TYPES_H + #define OPENSSL_TYPES_H + ++#include <openssl/bn.h> + #include <openssl/x509.h> + #include <openssl/evp.h> + #include <openssl/rsa.h> +diff --git a/ykcs11/openssl_utils.c b/ykcs11/openssl_utils.c +index 5a7f85d..edfe0ea 100644 +--- a/ykcs11/openssl_utils.c ++++ b/ykcs11/openssl_utils.c +@@ -35,6 +35,11 @@ + #include "debug.h" + #include <string.h> + ++#if OPENSSL_VERSION_NUMBER >= 0x10100000L ++# define X509_set_notBefore X509_set1_notBefore ++# define X509_set_notAfter X509_set1_notAfter ++#endif ++ + CK_RV do_store_cert(CK_BYTE_PTR data, CK_ULONG len, X509 **cert) { + + const unsigned char *p = data; // Mandatory temp variable required by OpenSSL +@@ -580,7 +585,9 @@ CK_RV do_pkcs_pss(ykcs11_rsa_key_t *key, CK_BYTE_PTR in, CK_ULONG in_len, + int nid, CK_BYTE_PTR out, CK_ULONG_PTR out_len) { + unsigned char em[RSA_size(key)]; + ++#if OPENSSL_VERSION_NUMBER < 0x10100000L + OpenSSL_add_all_digests(); ++#endif + + DBG("Apply PSS padding to %lu bytes and get %d", in_len, RSA_size(key)); + +@@ -590,14 +597,18 @@ CK_RV do_pkcs_pss(ykcs11_rsa_key_t *key, CK_BYTE_PTR in, CK_ULONG in_len, + + // In case of raw PSS (no hash) this function will fail because OpenSSL requires an MD + if (RSA_padding_add_PKCS1_PSS(key, em, out, EVP_get_digestbynid(nid), -2) == 0) { ++#if OPENSSL_VERSION_NUMBER < 0x10100000L + EVP_cleanup(); ++#endif + return CKR_FUNCTION_FAILED; + } + + memcpy(out, em, sizeof(em)); + *out_len = (CK_ULONG) sizeof(em); + ++#if OPENSSL_VERSION_NUMBER < 0x10100000L + EVP_cleanup(); ++#endif + + return CKR_OK; + } |