[Openvpn-devel] [PATCH] Fix loading PKCS12 files on Windows

[Openvpn-devel] [PATCH] Fix loading PKCS12 files on Windows

[Lev Stipakov]

From: Lev Stipakov <lev@...515...>

Starting from 2.5.4 we have switched to MSVC builds,
including dependencies such as OpenSSL.

When we link with natively-built OpenSSL .DLLs
(not cross compiled with MinGW), we are expected to include
applink.c, which provides glue between OpenSSL BIO layer
and compiler run-time. This doesn't apply to ARM64.

Failure to do that results in "no OPENSSL_Applink" fatal error
when calling, for example, d2i_PKCS12_fp(), which we do when
loading PKCS12 files.

Signed-off-by: Lev Stipakov <lev@...515...>
---
 src/openvpn/ssl_openssl.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/openvpn/ssl_openssl.c b/src/openvpn/ssl_openssl.c
index 31d94f2b..27fb66aa 100644
--- a/src/openvpn/ssl_openssl.c
+++ b/src/openvpn/ssl_openssl.c
@@ -65,6 +65,10 @@
 #include <openssl/ec.h>
 #endif
 
+#if defined(_MSC_VER) && !defined(_M_ARM64)
+#include <openssl/applink.c>
+#endif
+
 /*
  * Allocate space in SSL objects in which to store a struct tls_session
  * pointer back to parent.
-- 
2.23.0.windows.1

[Openvpn-devel] [PATCH applied] Re: Fix loading PKCS12 files on Windows

[Gert Doering]

Acked-by: Gert Doering <gert@...1296...>

As discussed on IRC, and checked with the OpenSSL documentation and
"Internet knowledge".  Most important: confirmed that it breaks with
--pkcs12 without that patch, and works with it (IRC, I did not test
myself).

Your patch has been applied to the master and release/2.5 branch.

commit af5de933a0633436e0fe00c42464f4a7ab5ac509 (master)
commit f397c3bfe728e0163fe6d226f62874e1dd25ec60 (release/2.5)
Author: Lev Stipakov
Date:   Wed Oct 6 12:07:09 2021 +0300

     Fix loading PKCS12 files on Windows

     Signed-off-by: Lev Stipakov <lev@...515...>
     Acked-by: Gert Doering <gert@...1296...>
     Message-Id: <20211006090709.200-1-lstipakov@...277...>
     URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22920.html
     Signed-off-by: Gert Doering <gert@...1296...>


--
kind regards,

Gert Doering

Re: [Openvpn-devel] [PATCH] Fix loading PKCS12 files on Windows

[Lev Stipakov]

Adding openvpn-devel.

> Does that mean that CFG and Spectre protection are already included?

Those are merged into the "master" branch, but not into "released". We
could probably include those into the next 2.5 release? Otherwise
they'll be part of 2.6.

-Lev

Re: [Openvpn-devel] [PATCH] Fix loading PKCS12 files on Windows

[Gert Doering]

[-- Attachment #1: Type: text/plain, Size: 804 bytes --]

Hi,

On Wed, Oct 06, 2021 at 03:40:55PM +0300, Lev Stipakov wrote:
> > Does that mean that CFG and Spectre protection are already included?
> 
> Those are merged into the "master" branch, but not into "released". We
> could probably include those into the next 2.5 release? Otherwise
> they'll be part of 2.6.

"You tell me".

It was not relevant before as we did not build 2.5 with MSVC (except
for ARM).

gert

-- 
"If was one thing all people took for granted, was conviction that if you 
 feed honest figures into a computer, honest figures come out. Never doubted 
 it myself till I met a computer with a sense of humor."
                             Robert A. Heinlein, The Moon is a Harsh Mistress

Gert Doering - Munich, Germany                             gert@...1296...

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 630 bytes --]

Re: [Openvpn-devel] [PATCH] Fix loading PKCS12 files on Windows

[Lev Stipakov]

Hi,

> > Those are merged into the "master" branch, but not into "released". We
> > could probably include those into the next 2.5 release? Otherwise
> > they'll be part of 2.6.
>
> "You tell me".

The probable performance impact should be a less issue for master,
which in most cases will use dco on Windows.

For 2.5, let's conduct performance tests first. Balancing security
with performance tradeoffs is a difficult task.

-- 
-Lev