kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

libekmfweb: Ensure that libcurl supports the OpenSSL backend

Browse Source 
The callback function used for CURLOPT_SSL_CTX_FUNCTION requires
that OpenSSL is used as SSL backend.

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Ingo Franzki
2021-06-23 14:53:50 +02:00
committed by Jan Höppner
parent 8db32a8cb9
commit 317384b5c9
2 changed files with 33 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
libekmfweb/Makefile
View File

@@ -49,7 +49,9 @@ check-dep-libekmfweb: detect-openssl-version.dep
"libekmfweb", \
"curl/curl.h", \
"libcurl-devel", \
"HAVE_LIBCURL=0")
"HAVE_LIBCURL=0" \
`curl-config --cflags` `curl-config --libs`)
curl-config --ssl-backends | grep OpenSSL >/dev/null 2>&1 || { echo "Error: libcurl is not built with the OpenSSL backend"; exit 1; }
touch check-dep-libekmfweb
skip-libekmfweb-openssl:
@@ -67,8 +69,8 @@ ekmfweb.o: check-dep-libekmfweb ekmfweb.c utilities.h cca.h $(rootdir)include/ek
utilities.o: check-dep-libekmfweb utilities.c utilities.h $(rootdir)include/ekmfweb/ekmfweb.h
cca.o: check-dep-libekmfweb cca.c cca.h utilities.h $(rootdir)include/ekmfweb/ekmfweb.h
libekmfweb.so.$(VERSION): ALL_CFLAGS += -fPIC
libekmfweb.so.$(VERSION): LDLIBS = -ljson-c -lcrypto -lssl -lcurl -ldl
libekmfweb.so.$(VERSION): ALL_CFLAGS += -fPIC `curl-config --cflags`
libekmfweb.so.$(VERSION): LDLIBS = -ljson-c -lcrypto -lssl `curl-config --libs` -ldl
libekmfweb.so.$(VERSION): ALL_LDFLAGS += -shared -Wl,--version-script=libekmfweb.map \
-Wl,-z,defs,-Bsymbolic -Wl,-soname,libekmfweb.so.$(VERM)
libekmfweb.so.$(VERSION): ekmfweb.o utilities.o cca.o

28
libekmfweb/ekmfweb.c
View File

@@ -705,6 +705,7 @@ static int _ekmf_perform_request(const struct ekmf_config *config,
long *status_code, char **error_msg,
CURL *curl, bool verbose)
{
const struct curl_tlssessioninfo *info = NULL;
struct curl_header_cb_data header_cb = { 0 };
struct curl_sslctx_cb_data sslctx_cb = { 0 };
struct curl_write_cb_data write_cb = { 0 };
@@ -732,6 +733,19 @@ static int _ekmf_perform_request(const struct ekmf_config *config,
curl_easy_reset(curl);
/*
* The CURLOPT_SSL_CTX_FUNCTION callback only works with the OpenSSL
* curl backend. Check that OpenSSL is the current curl backend.
*/
rc = curl_easy_getinfo(curl, CURLINFO_TLS_SSL_PTR, &info);
CURL_ERROR_CHECK(rc, "curl_easy_getinfo CURLINFO_TLS_SSL_PTR", verbose,
out);
if (info->backend != CURLSSLBACKEND_OPENSSL) {
pr_verbose(verbose, "libcurl is not using the OpenSSL backend");
rc = -EIO;
goto out;
}
rc = curl_easy_setopt(curl, CURLOPT_VERBOSE, verbose ? 1 : 0);
CURL_ERROR_CHECK(rc, "curl_easy_setopt CURLOPT_VERBOSE", verbose, out);
@@ -5617,6 +5631,20 @@ void ekmf_curl_destroy(CURL *curl_handle)
*/
void __attribute__ ((constructor)) ekmf_init(void)
{
CURLsslset rc;
/*
* Ensure that curl uses OpenSSL as SSL backend. If curl has already
* been itialized by the calling application, the backend can't be
* changed anymore, but we continue anyway. However, it will later be
* checked if curl uses the OpenSSL backend, and a HTTPS connection
* will fail if it is not using the OpenSSL backend.
*/
rc = curl_global_sslset(CURLSSLBACKEND_OPENSSL, NULL, NULL);
if (rc != CURLSSLSET_OK && rc != CURLSSLSET_TOO_LATE)
errx(EXIT_FAILURE, "libekmfweb: libcurl was not built with "
"the OpenSSL backend");
curl_global_init(CURL_GLOBAL_ALL);
}