mirror of
https://github.com/obgm/libcoap.git
synced 2026-10-26 12:41:22 +03:00
Jon Shallow
9443d9034a
Add in a new PKI_KEY type for PKCS11 URI to get the PKI information from a smart card or HSM device. Currently only OpenSSL and GnuTLS are supported. Makefile.am: Do not expose coap_dtls_shutdown() function. examples/client.c: examples/coap-server.c: Add in support for using pkcs11: URIs for defining the Certificates and Private Keys. include/coap2/coap_dtls.h: Add in COAP_PKI_KEY_PKCS11 Key type. man/coap-client.txt.in: man/coap-server.txt.in: Update documentation for supporting PKCS11. man/coap_encryption.txt.in: Add in documentation for COAP_PKI_KEY_PKCS11. Correct some typos. HOWTO.dual.gnutls (new): HOWTO.dual.openssl (new): HOWTO.dual.softhsm2 (new): HOWTO.pkcs11 (new): HowTo information. src/coap_gnutls.c: src/coap_openssl.c: Add in PKCS11 support. src/coap_mbedtls.c: PKCS11 not yet supported. Add in no-op coap_dtls_shutdown() function. src/coap_notls.c: src/coap_tinydtls.c: Add in no-op coap_dtls_shutdown() function. src/net.c: Invoke coap_dtls_shutdown() function in coap_cleanup(). NOTE: There are memory leaks after cleanly closing down. These are not within libcoap as far as can be determined. These leaks are a work in progress.
87 lines
2.7 KiB
Plaintext
87 lines
2.7 KiB
Plaintext
############################################################################
|
|
#
|
|
# SoftHSMv2 dual versions
|
|
#
|
|
# Works with CentOS 7
|
|
#
|
|
# The opensc package needs to be installed.
|
|
#
|
|
############################################################################
|
|
#
|
|
# Install a software HSM module for doing the PKCS11 testing of libcoap.
|
|
# Real hardware can be used if you have the appropriate library module.
|
|
#
|
|
# It is assumed that the opensc package is installed.
|
|
#
|
|
# When installing SoftHSMv2 from your system's package manager, check that the
|
|
# OpenSSL version is at least 1.1.0. If not, then you will need to dual
|
|
# install SoftHSMv2 as below; otherwise you can use the existing SoftHSMv2.
|
|
#
|
|
# SoftHSMv2 is built using OpenSSL, but GnuTLS can use the PKCS11 interface.
|
|
# Note that if the default OpenSSL version is less than 1.1.0, you will need
|
|
# to install a dual stack version of OpenSSL as per HOWTO.dual.openssl.
|
|
#
|
|
# Creates module /usr/local/lib/softhsm/libsofthsm2.so
|
|
#
|
|
|
|
# Add line below to /etc/security/limits.conf to support memory locking
|
|
|
|
* - memlock unlimited
|
|
|
|
# Get the latest SoftHSM
|
|
git clone https://github.com/opendnssec/SoftHSMv2.git
|
|
|
|
# Build code
|
|
cd SoftHSMv2/
|
|
sh autogen.sh
|
|
PKG_CONFIG_PATH=/opt/openssl/lib/pkgconfig ./configure --enable-silent-rules \
|
|
--with-crypto-backend=openssl --disable-gost LDFLAGS=-L/opt/openssl/lib \
|
|
CPPFLAGS=-I/opt/openssl/include --with-openssl=/opt/openssl
|
|
make
|
|
# You may need to comment out constexpr lines (fixes for gcc10) in
|
|
# src/lib/crypto/PublicKey.h src/lib/crypto/PrivateKey.h if you get
|
|
# compile errors.
|
|
sudo make install
|
|
cd ..
|
|
|
|
# Make sure p11-kit softhsm modules have the correct module: fully qualified
|
|
# path where the entry is of the form (in particular for GnuTLS) :-
|
|
# /usr/share/p11-kit/modules/softhsm*
|
|
#
|
|
# module: /usr/local/lib/softhsm/libsofthsm2.so
|
|
|
|
# If /var/lib/softhsm/tokens is owned by user ods (because softhsm2 package is
|
|
# alread installed), make the logged in <user> a part of the group ods so
|
|
# that the tokens can be accessed.
|
|
sudo usermod -a -G ods <user>
|
|
# log out and then log back in again
|
|
# Confirm that you have ods in your group
|
|
id
|
|
|
|
############################################################################
|
|
#
|
|
# libp11 (needed for OpenSSL as it provides the PKCS11 engine)
|
|
#
|
|
############################################################################
|
|
#
|
|
# Install a pkcs11 library for OpenSSL to use as an engine.
|
|
# [GnuTLS has this built in]
|
|
#
|
|
|
|
# Get the latest libp11
|
|
git clone https://github.com/OpenSC/libp11.git
|
|
|
|
# Build code
|
|
cd libp11
|
|
./bootstrap
|
|
PKG_CONFIG_PATH=/opt/openssl/lib/pkgconfig ./configure \
|
|
--with-pkcs11-module=/usr/local/lib/softhsm/libsofthsm2.so
|
|
make
|
|
sudo make install
|
|
cd ..
|
|
|
|
# Verify that pkcs11 is available
|
|
|
|
/opt/openssl/bin/openssl engine pkcs11 -t
|
|
|