Skip to content

Fix building against LibreSSL#482

Merged
kristelmerilain merged 5 commits intoopen-eid:masterfrom
klemensn:libressl
Jul 26, 2022
Merged

Fix building against LibreSSL#482
kristelmerilain merged 5 commits intoopen-eid:masterfrom
klemensn:libressl

Conversation

@klemensn
Copy link
Copy Markdown
Contributor

@klemensn klemensn commented Jul 8, 2022

With the upcoming 3.6 release LibreSSL will ship
X509_VERIFY_PARAM_get_time() as required by libdigidocpp.

Furthermore, the following changes are required to build latest HEAD against
current LibreSSL:

  • Omit SHA3 with LibreSSL
  • Omit BIO_F_BIO_LOOKUP_EX handling with LibreSSL
  • Provide OPENSSL_memdup() and TS accessors with LibreSSL
  • Use old-style STACK_OF stuff for LibreSSL
  • Do not define ESS_ISSUER_SERIAL with LibreSSL

All patches patches were written by @botovq against the 3.14.8 release during
review of my OpenBSD ports/package submission for libdigidocpp[0].

I rebased the patches onto latest HEAD (d9fd053) and retested on
OpenBSD/amd64 7.1 -CURRENT, i.e. today's latest LibreSSL development version.

0: openbsd/ports@a015763

@klemensn
Copy link
Copy Markdown
Contributor Author

This PR is a good start, but signature validation is still broken with LibreSSL.

v3.14.8 built against OpenSSL on OpenBSD works:

$ digidoc-tool create --file=/tmp/hello.txt /tmp/hello.asice
Version
  digidoc-tool version: 3.14.8.0
  libdigidocpp version: 3.14.8.0
Available certificates:
  label: ...
Selected:
  label: ...
Please enter PIN for token '...' or <enter> to cancel: 
    Validation: OK

but both v3.14.8 and latest HEAD (d9fd053) built with this PR fail with

    Validation: FAILED
     Exception:
SignatureXAdES_LTA.cpp:203 code(General) Signature validation
TS.cpp:288 code(General) Failed to verify TS response.

@klemensn
Copy link
Copy Markdown
Contributor Author

This PR is a good start, but signature validation is still broken with LibreSSL.

This was due to lack of RFC 5035 support in LibreSSL.

I added the missing pieces such that latest libdigidocpp HEAD (06a755d) can now successfully validate documents on OpenBSD/LibreSSL (with uncommitted changes):

$ LD_LIBRARY_PATH=$PWD/obj digidoc-tool sign /tmp/hello.asice
Version
  digidoc-tool version: 3.14.10.0
  libdigidocpp version: 3.14.10.0
Available certificates:
  label: ...
Selected:
  label: ...
Please enter PIN for token '...' or <enter> to cancel: 
    Validation: OK

@klemensn
Copy link
Copy Markdown
Contributor Author

klemensn commented Jul 17, 2022

Latest LibreSSL is now able to validate libdigidocpp's timestamps: openbsd/src@9c1c430

@kristelmerilain kristelmerilain requested a review from metsma July 18, 2022 13:05
klemensn added 5 commits July 24, 2022 23:48
LibreSSL does not provide any SHA3 implementation, thus make the code
OpenSSL-only.

Signed-off-by: Klemens Nanni <klemens@posteo.de>
LibreSSL doesn't have BIO_ADDR support, so this exception cannot be hit.

Signed-off-by: Klemens Nanni <klemens@posteo.de>
LibreSSL does not provide these.

Signed-off-by: Klemens Nanni <klemens@posteo.de>
Signed-off-by: Klemens Nanni <klemens@posteo.de>
LibreSSL does provide d2i_ESS_ISSUER_SERIAL().

Signed-off-by: Klemens Nanni <klemens@posteo.de>
@klemensn
Copy link
Copy Markdown
Contributor Author

Updated with the following:

  • size 0 yields NULL as per OpenSSL's CRYPTO_malloc() semantics[0],
    so treat size == 0 in the added OPENSSL_memdup() accordingly

  • LibreSSL has ASN1_STRING_get0_data(3), so no need to redefine it.

0: https://github.com/openssl/openssl/blob/OpenSSL_1_1_1-stable/crypto/mem.c#L200-L201

@kristelmerilain kristelmerilain merged commit 97f4412 into open-eid:master Jul 26, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants