Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1232050 > unrolled thread

Re: Linux 4.3-rc1 build error on CentOS 5.11 "scripts/sign-file.c:23:25: fatal error: openssl/cms.h: No such file or directory"

Started byDavid Howells <dhowells@redhat.com>
First post2015-09-24 13:20 +0200
Last post2015-09-26 03:50 +0200
Articles 6 — 2 participants

Back to article view | Back to linux.kernel

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Re: Linux 4.3-rc1 build error on CentOS 5.11 "scripts/sign-file.c:23:25: fatal error: openssl/cms.h: No such file or directory" David Howells <dhowells@redhat.com> - 2015-09-24 13:20 +0200
    Re: Linux 4.3-rc1 build error on CentOS 5.11 "scripts/sign-file.c:23:25: fatal error: openssl/cms.h: No such file or directory" David Howells <dhowells@redhat.com> - 2015-09-24 13:30 +0200
      Re: Linux 4.3-rc1 build error on CentOS 5.11 "scripts/sign-file.c:23:25:  fatal error: openssl/cms.h: No such file or directory" Vinson Lee <vlee@twopensource.com> - 2015-09-25 00:30 +0200
        Re: Linux 4.3-rc1 build error on CentOS 5.11 "scripts/sign-file.c:23:25: fatal error: openssl/cms.h: No such file or directory" David Howells <dhowells@redhat.com> - 2015-09-25 08:20 +0200
        Re: Linux 4.3-rc1 build error on CentOS 5.11 "scripts/sign-file.c:23:25: fatal error: openssl/cms.h: No such file or directory" David Howells <dhowells@redhat.com> - 2015-09-25 16:30 +0200
          Re: Linux 4.3-rc1 build error on CentOS 5.11 "scripts/sign-file.c:23:25:  fatal error: openssl/cms.h: No such file or directory" Vinson Lee <vlee@twopensource.com> - 2015-09-26 03:50 +0200

#1232050 — Re: Linux 4.3-rc1 build error on CentOS 5.11 "scripts/sign-file.c:23:25: fatal error: openssl/cms.h: No such file or directory"

FromDavid Howells <dhowells@redhat.com>
Date2015-09-24 13:20 +0200
SubjectRe: Linux 4.3-rc1 build error on CentOS 5.11 "scripts/sign-file.c:23:25: fatal error: openssl/cms.h: No such file or directory"
Message-ID<qccJb-1op-1@gated-at.bofh.it>
Vinson Lee <vlee@twopensource.com> wrote:

>   HOSTCC  scripts/sign-file
> scripts/sign-file.c: In function ‘main’:
> scripts/sign-file.c:289:3: warning: implicit declaration of function
> ‘i2d_PKCS7_bio_stream’ [-Wimplicit-function-declaration]
>    ERR(i2d_PKCS7_bio_stream(b, pkcs7, NULL, 0) < 0,
>    ^
> 
> sign-file.c:(.text.startup+0x3e7): undefined reference to `i2d_PKCS7_bio_stream'

Does this addition help?

David
---
diff --git a/scripts/sign-file.c b/scripts/sign-file.c
index f65120e2aa03..33c098225a57 100755
--- a/scripts/sign-file.c
+++ b/scripts/sign-file.c
@@ -307,7 +307,7 @@ int main(int argc, char **argv)
 #ifndef USE_PKCS7
 	ERR(i2d_CMS_bio_stream(bd, cms, NULL, 0) < 0, "%s", dest_name);
 #else
-	ERR(i2d_PKCS7_bio_stream(bd, pkcs7, NULL, 0) < 0, "%s", dest_name);
+	ERR(i2d_PKCS7_bio(bd, pkcs7) < 0, "%s", dest_name);
 #endif
 	sig_size = BIO_number_written(bd) - module_size;
 	sig_info.sig_len = htonl(sig_size);
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [next] | [standalone]

#1232053

FromDavid Howells <dhowells@redhat.com>
Date2015-09-24 13:30 +0200
Message-ID<qccSS-1zC-7@gated-at.bofh.it>
In reply to#1232050
David Howells <dhowells@redhat.com> wrote:

> Does this addition help?

Rather, this.  Seems I shouldn't pass PKCS7_STREAM.

David
---
commit 227ccb6a71bd9a04d1aaff08a52fcb5ae4149d1e
Author: David Howells <dhowells@redhat.com>
Date:   Thu Sep 24 12:15:06 2015 +0100

    Further pkcs7 signing changes

diff --git a/scripts/sign-file.c b/scripts/sign-file.c
index f65120e2aa03..811a37a1c6e3 100755
--- a/scripts/sign-file.c
+++ b/scripts/sign-file.c
@@ -271,7 +271,7 @@ int main(int argc, char **argv)
 #else
 	pkcs7 = PKCS7_sign(x509, private_key, NULL, bm,
 			   PKCS7_NOCERTS | PKCS7_BINARY |
-			   PKCS7_DETACHED | PKCS7_STREAM | use_signed_attrs);
+			   PKCS7_DETACHED | use_signed_attrs);
 	ERR(!pkcs7, "PKCS7_sign");
 #endif
 
@@ -307,7 +307,7 @@ int main(int argc, char **argv)
 #ifndef USE_PKCS7
 	ERR(i2d_CMS_bio_stream(bd, cms, NULL, 0) < 0, "%s", dest_name);
 #else
-	ERR(i2d_PKCS7_bio_stream(bd, pkcs7, NULL, 0) < 0, "%s", dest_name);
+	ERR(i2d_PKCS7_bio(bd, pkcs7) < 0, "%s", dest_name);
 #endif
 	sig_size = BIO_number_written(bd) - module_size;
 	sig_info.sig_len = htonl(sig_size);
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1232475 — Re: Linux 4.3-rc1 build error on CentOS 5.11 "scripts/sign-file.c:23:25: fatal error: openssl/cms.h: No such file or directory"

FromVinson Lee <vlee@twopensource.com>
Date2015-09-25 00:30 +0200
SubjectRe: Linux 4.3-rc1 build error on CentOS 5.11 "scripts/sign-file.c:23:25: fatal error: openssl/cms.h: No such file or directory"
Message-ID<qcnbA-7Zv-15@gated-at.bofh.it>
In reply to#1232053
On Thu, Sep 24, 2015 at 4:21 AM, David Howells <dhowells@redhat.com> wrote:
> David Howells <dhowells@redhat.com> wrote:
>
>> Does this addition help?
>
> Rather, this.  Seems I shouldn't pass PKCS7_STREAM.
>
> David
> ---
> commit 227ccb6a71bd9a04d1aaff08a52fcb5ae4149d1e
> Author: David Howells <dhowells@redhat.com>
> Date:   Thu Sep 24 12:15:06 2015 +0100
>
>     Further pkcs7 signing changes
>

With this additional 3rd patch, I get this build error.

  HOSTCC  scripts/sign-file
scripts/sign-file.c: In function ‘main’:
scripts/sign-file.c:289:3: warning: implicit declaration of function
‘i2d_PKCS7_bio_stream’ [-Wimplicit-function-declaration]
   ERR(i2d_PKCS7_bio_stream(b, pkcs7, NULL, 0) < 0,
   ^

   285  #ifndef USE_PKCS7
   286                  ERR(i2d_CMS_bio_stream(b, cms, NULL, 0) < 0,
   287                      "%s", sig_file_name);
   288  #else
   289                  ERR(i2d_PKCS7_bio_stream(b, pkcs7, NULL, 0) < 0,
   290                          "%s", sig_file_name);
   291  #endif

After a similar edit to line 289, replacing i2d_PKCS7_bio_stream with
i2d_PKCS7_bio, sign-file.c builds for me on CentOS 5.11.

Cheers,
Vinson
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1232591

FromDavid Howells <dhowells@redhat.com>
Date2015-09-25 08:20 +0200
Message-ID<qcuwq-1vM-13@gated-at.bofh.it>
In reply to#1232475
Vinson Lee <vlee@twopensource.com> wrote:

> After a similar edit to line 289, replacing i2d_PKCS7_bio_stream with
> i2d_PKCS7_bio, sign-file.c builds for me on CentOS 5.11.

Okay, thanks.  Does it then work?

David
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1232845

FromDavid Howells <dhowells@redhat.com>
Date2015-09-25 16:30 +0200
Message-ID<qcCaC-3Z4-19@gated-at.bofh.it>
In reply to#1232475
Here's my patch with the changes squashed into it for reference.

David
---
commit 81852354cf81402ae69fda4d67138accab2702d5
Author: David Howells <dhowells@redhat.com>
Date:   Thu Sep 24 14:06:02 2015 +0100

    MODSIGN: Change from CMS to PKCS#7 signing if the openssl is too old
    
    The sign-file.c program actually uses CMS rather than PKCS#7 to sign a file
    since that allows the target X.509 certificate to be specified by
    subjectKeyId rather than by issuer + serialNumber.
    
    However, older versions of the OpenSSL crypto library (such as may be found
    in CentOS 5.11) don't support CMS.  Assume everything prior to
    OpenSSL-1.0.0 doesn't support CMS and switch to using PKCS#7 in that case.
    
    Further, the pre-1.0.0 OpenSSL only supports PKCS#7 signing with SHA1, so
    give an error from the sign-file script if the caller requests anything
    other than SHA1.
    
    The compiler gives the following error with an OpenSSL crypto library
    that's too old:
    
      HOSTCC  scripts/sign-file
    scripts/sign-file.c:23:25: fatal error: openssl/cms.h: No such file or directory
     #include <openssl/cms.h>
    
    Reported-by: Vinson Lee <vlee@twopensource.com>
    Signed-off-by: David Howells <dhowells@redhat.com>
    Acked-by: David Woodhouse <David.Woodhouse@intel.com>

diff --git a/Documentation/Changes b/Documentation/Changes
index 6d8863004858..f447f0516f07 100644
--- a/Documentation/Changes
+++ b/Documentation/Changes
@@ -43,7 +43,7 @@ o  udev                   081                     # udevd --version
 o  grub                   0.93                    # grub --version || grub-install --version
 o  mcelog                 0.6                     # mcelog --version
 o  iptables               1.4.2                   # iptables -V
-o  openssl & libcrypto    1.0.1k                  # openssl version
+o  openssl & libcrypto    1.0.0                   # openssl version
 
 
 Kernel compilation
diff --git a/scripts/sign-file.c b/scripts/sign-file.c
index c3899ca4811c..250a7a645033 100755
--- a/scripts/sign-file.c
+++ b/scripts/sign-file.c
@@ -20,13 +20,34 @@
 #include <getopt.h>
 #include <err.h>
 #include <arpa/inet.h>
+#include <openssl/opensslv.h>
 #include <openssl/bio.h>
 #include <openssl/evp.h>
 #include <openssl/pem.h>
-#include <openssl/cms.h>
 #include <openssl/err.h>
 #include <openssl/engine.h>
 
+/*
+ * Use CMS if we have openssl-1.0.0 or newer available - otherwise we have to
+ * assume that it's not available and its header file is missing and that we
+ * should use PKCS#7 instead.  Switching to the older PKCS#7 format restricts
+ * the options we have on specifying the X.509 certificate we want.
+ *
+ * Further, older versions of OpenSSL don't support manually adding signers to
+ * the PKCS#7 message so have to accept that we get a certificate included in
+ * the signature message.  Nor do such older versions of OpenSSL support
+ * signing with anything other than SHA1 - so we're stuck with that if such is
+ * the case.
+ */
+#if OPENSSL_VERSION_NUMBER < 0x10000000L
+#define USE_PKCS7
+#endif
+#ifndef USE_PKCS7
+#include <openssl/cms.h>
+#else
+#include <openssl/pkcs7.h>
+#endif
+
 struct module_signature {
 	uint8_t		algo;		/* Public-key crypto algorithm [0] */
 	uint8_t		hash;		/* Digest algorithm [0] */
@@ -110,30 +131,42 @@ int main(int argc, char **argv)
 	struct module_signature sig_info = { .id_type = PKEY_ID_PKCS7 };
 	char *hash_algo = NULL;
 	char *private_key_name, *x509_name, *module_name, *dest_name;
-	bool save_cms = false, replace_orig;
+	bool save_sig = false, replace_orig;
 	bool sign_only = false;
 	unsigned char buf[4096];
-	unsigned long module_size, cms_size;
-	unsigned int use_keyid = 0, use_signed_attrs = CMS_NOATTR;
+	unsigned long module_size, sig_size;
+	unsigned int use_signed_attrs;
 	const EVP_MD *digest_algo;
 	EVP_PKEY *private_key;
+#ifndef USE_PKCS7
 	CMS_ContentInfo *cms;
+	unsigned int use_keyid = 0;
+#else
+	PKCS7 *pkcs7;
+#endif
 	X509 *x509;
 	BIO *b, *bd = NULL, *bm;
 	int opt, n;
-
 	OpenSSL_add_all_algorithms();
 	ERR_load_crypto_strings();
 	ERR_clear_error();
 
 	key_pass = getenv("KBUILD_SIGN_PIN");
 
+#ifndef USE_PKCS7
+	use_signed_attrs = CMS_NOATTR;
+#else
+	use_signed_attrs = PKCS7_NOATTR;
+#endif
+
 	do {
 		opt = getopt(argc, argv, "dpk");
 		switch (opt) {
-		case 'p': save_cms = true; break;
-		case 'd': sign_only = true; save_cms = true; break;
+		case 'p': save_sig = true; break;
+		case 'd': sign_only = true; save_sig = true; break;
+#ifndef USE_PKCS7
 		case 'k': use_keyid = CMS_USE_KEYID; break;
+#endif
 		case -1: break;
 		default: format();
 		}
@@ -157,6 +190,14 @@ int main(int argc, char **argv)
 		replace_orig = true;
 	}
 
+#ifdef USE_PKCS7
+	if (strcmp(hash_algo, "sha1") != 0) {
+		fprintf(stderr, "sign-file: %s only supports SHA1 signing\n",
+			OPENSSL_VERSION_TEXT);
+		exit(3);
+	}
+#endif
+
 	/* Read the private key and the X.509 cert the PKCS#7 message
 	 * will point to.
 	 */
@@ -213,7 +254,8 @@ int main(int argc, char **argv)
 	bm = BIO_new_file(module_name, "rb");
 	ERR(!bm, "%s", module_name);
 
-	/* Load the CMS message from the digest buffer. */
+#ifndef USE_PKCS7
+	/* Load the signature message from the digest buffer. */
 	cms = CMS_sign(NULL, NULL, NULL, NULL,
 		       CMS_NOCERTS | CMS_PARTIAL | CMS_BINARY | CMS_DETACHED | CMS_STREAM);
 	ERR(!cms, "CMS_sign");
@@ -221,17 +263,31 @@ int main(int argc, char **argv)
 	ERR(!CMS_add1_signer(cms, x509, private_key, digest_algo,
 			     CMS_NOCERTS | CMS_BINARY | CMS_NOSMIMECAP |
 			     use_keyid | use_signed_attrs),
-	    "CMS_sign_add_signer");
+	    "CMS_add1_signer");
 	ERR(CMS_final(cms, bm, NULL, CMS_NOCERTS | CMS_BINARY) < 0,
 	    "CMS_final");
 
-	if (save_cms) {
-		char *cms_name;
+#else
+	pkcs7 = PKCS7_sign(x509, private_key, NULL, bm,
+			   PKCS7_NOCERTS | PKCS7_BINARY |
+			   PKCS7_DETACHED | use_signed_attrs);
+	ERR(!pkcs7, "PKCS7_sign");
+#endif
 
-		ERR(asprintf(&cms_name, "%s.p7s", module_name) < 0, "asprintf");
-		b = BIO_new_file(cms_name, "wb");
-		ERR(!b, "%s", cms_name);
-		ERR(i2d_CMS_bio_stream(b, cms, NULL, 0) < 0, "%s", cms_name);
+	if (save_sig) {
+		char *sig_file_name;
+
+		ERR(asprintf(&sig_file_name, "%s.p7s", module_name) < 0,
+		    "asprintf");
+		b = BIO_new_file(sig_file_name, "wb");
+		ERR(!b, "%s", sig_file_name);
+#ifndef USE_PKCS7
+		ERR(i2d_CMS_bio_stream(b, cms, NULL, 0) < 0,
+		    "%s", sig_file_name);
+#else
+		ERR(i2d_PKCS7_bio(b, pkcs7) < 0,
+			"%s", sig_file_name);
+#endif
 		BIO_free(b);
 	}
 
@@ -247,9 +303,13 @@ int main(int argc, char **argv)
 	ERR(n < 0, "%s", module_name);
 	module_size = BIO_number_written(bd);
 
+#ifndef USE_PKCS7
 	ERR(i2d_CMS_bio_stream(bd, cms, NULL, 0) < 0, "%s", dest_name);
-	cms_size = BIO_number_written(bd) - module_size;
-	sig_info.sig_len = htonl(cms_size);
+#else
+	ERR(i2d_PKCS7_bio(bd, pkcs7) < 0, "%s", dest_name);
+#endif
+	sig_size = BIO_number_written(bd) - module_size;
+	sig_info.sig_len = htonl(sig_size);
 	ERR(BIO_write(bd, &sig_info, sizeof(sig_info)) < 0, "%s", dest_name);
 	ERR(BIO_write(bd, magic_number, sizeof(magic_number) - 1) < 0, "%s", dest_name);
 
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1233127 — Re: Linux 4.3-rc1 build error on CentOS 5.11 "scripts/sign-file.c:23:25: fatal error: openssl/cms.h: No such file or directory"

FromVinson Lee <vlee@twopensource.com>
Date2015-09-26 03:50 +0200
SubjectRe: Linux 4.3-rc1 build error on CentOS 5.11 "scripts/sign-file.c:23:25: fatal error: openssl/cms.h: No such file or directory"
Message-ID<qcMMF-2fQ-1@gated-at.bofh.it>
In reply to#1232845
On Fri, Sep 25, 2015 at 7:24 AM, David Howells <dhowells@redhat.com> wrote:
> Here's my patch with the changes squashed into it for reference.
>
> David
> ---
> commit 81852354cf81402ae69fda4d67138accab2702d5
> Author: David Howells <dhowells@redhat.com>
> Date:   Thu Sep 24 14:06:02 2015 +0100
>
>     MODSIGN: Change from CMS to PKCS#7 signing if the openssl is too old
>
>     The sign-file.c program actually uses CMS rather than PKCS#7 to sign a file
>     since that allows the target X.509 certificate to be specified by
>     subjectKeyId rather than by issuer + serialNumber.
>
>     However, older versions of the OpenSSL crypto library (such as may be found
>     in CentOS 5.11) don't support CMS.  Assume everything prior to
>     OpenSSL-1.0.0 doesn't support CMS and switch to using PKCS#7 in that case.
>
>     Further, the pre-1.0.0 OpenSSL only supports PKCS#7 signing with SHA1, so
>     give an error from the sign-file script if the caller requests anything
>     other than SHA1.
>
>     The compiler gives the following error with an OpenSSL crypto library
>     that's too old:
>
>       HOSTCC  scripts/sign-file
>     scripts/sign-file.c:23:25: fatal error: openssl/cms.h: No such file or directory
>      #include <openssl/cms.h>
>
>     Reported-by: Vinson Lee <vlee@twopensource.com>
>     Signed-off-by: David Howells <dhowells@redhat.com>
>     Acked-by: David Woodhouse <David.Woodhouse@intel.com>
>

This squashed patch also builds for me on CentOS 5.11.

Linux 4.2-rc2 plus this patch booted up without issue and it appears
this feature is available.

$ dmesg | grep -i 'x.*509'
[    1.888412] Asymmetric key parser 'x509' registered
[    3.485152] Loading compiled-in X.509 certificates
[    3.490659] Loaded X.509 cert 'Build time autogenerated kernel key:
ea8ef2f666280e4d429a8ff8a2056069bbb55979'

Vinson
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web