Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:18 as permitted sender) client-ip=2620:137:e000::1:18;
MIME-Version: 1.0
References: <CA+icZUUFdsEyNybVORm4x7_bAyoc0zTnudtNdgnTqjvbYXJRYA@mail.gmail.com>
 <CA+icZUWxyNeZnEBDpDWxGc-qJ-jHwR0rJMBhk1a8StPHRgC6qA@mail.gmail.com> <CA+icZUW7y3JxQ3dCB8Wy83EjEyYj7z55nFUw-kZ+V4We22HZZg@mail.gmail.com>
In-Reply-To: <CA+icZUW7y3JxQ3dCB8Wy83EjEyYj7z55nFUw-kZ+V4We22HZZg@mail.gmail.com>
Reply-To: sedat.dilek@gmail.com
From:   Sedat Dilek <sedat.dilek@gmail.com>
Date:   Fri, 27 May 2022 09:47:51 +0200
Message-ID: <CA+icZUVyp2CdX7m72GY-=DtK9J+64uHeWPr5-cvo8haQm_4hUw@mail.gmail.com>
Subject: Re: [Linux v5.17.9] -Wdeprecated-declarations warnings with LLVM-14
 and OpenSSL v3.0.x
To:     Kees Cook <keescook@chromium.org>
Cc:     keyrings@vger.kernel.org, linux-kernel@vger.kernel.org,
        Salvatore Bonaccorso <carnil@debian.org>,
        David Woodhouse <dwmw2@infradead.org>,
        David Howells <dhowells@redhat.com>,
        Tasmiya Nalatwad <tasmiya@linux.vnet.ibm.com>
Content-Type: multipart/mixed; boundary="00000000000029527c05dff98808"
Precedence: bulk

--00000000000029527c05dff98808
Content-Type: text/plain; charset="UTF-8"

On Tue, May 24, 2022 at 9:13 PM Sedat Dilek <sedat.dilek@gmail.com> wrote:
>
> On Thu, May 19, 2022 at 12:01 PM Sedat Dilek <sedat.dilek@gmail.com> wrote:
> >
> > [ CC Kees and Salvatore ]
> >
> > The Debian kernel-team ships a fix (4 hours young):
> >
> > commit: 13e234d459c11946efba647c3daf15e03abb0d99
> > "sign-file: Convert API usage to support OpenSSL v3"
> >
> > *untested*
>
> @Kees:
>
> Any updates on the part of certs/extract-cert.c?
>

[ CC Tasmiya Nalatwad ]

There are several more reports on this issue (see [3]).

I did a quick test with Kees' patch from [2] and my attached patch
"extract-cert: Suppress warnings with OpenSSL v3 API".

Now, I see no more warnings due to OpenSSL v3 API:

$ egrep 'sign-file|extract-cert'
../build-log_5.18.0-2-amd64-clang14-lto.txt
176:  clang -Wp,-MMD,scripts/.sign-file.d -Wall -Wmissing-prototypes
-Wstrict-prototypes -O2 -fomit-frame-pointer -std=gnu11
-Wdeclaration-after-statement         -o scripts/sign-file
scripts/sign-file.c   -lcrypto
2053:  clang -Wp,-MMD,certs/.extract-cert.d -Wall -Wmissing-prototypes
-Wstrict-prototypes -O2 -fomit-frame-pointer -std=gnu11
-Wdeclaration-after-statement       -Wno-deprecated-declarations   -o
certs/extract-cert certs/extract-cert.c   -lcrypto
2068:  certs/extract-cert "" certs/x509_certificate_list
2069:  certs/extract-cert "" certs/signing_key.x509

config-5.18-dileks: LLVM-14 + CONFIG_LTO_CLANG_THIN=y

-Sedat-

[1] https://marc.info/?l=linux-keyrings&m=165330697801670&w=2
[2] https://salsa.debian.org/kernel-team/linux/-/commit/13e234d459c11946efba647c3daf15e03abb0d99
[3] https://marc.info/?l=linux-keyrings&m=165330697801670&w=2

> >
> > On Thu, May 19, 2022 at 11:55 AM Sedat Dilek <sedat.dilek@gmail.com> wrote:
> > >
> > > Hi,
> > >
> > > here, I am on Debian/unstable AMD64.
> > >
> > > Recently (or still) there is/was a transition to OpenSSL see below link.
> > >
> > > The warnings look like:
> > >
> > > 189:scripts/sign-file.c:89:14: warning: 'ERR_get_error_line' is
> > > deprecated [-Wdeprecated-declarations]
> > > 201:scripts/sign-file.c:102:9: warning: 'ERR_get_error_line' is
> > > deprecated [-Wdeprecated-declarations]
> > > 213:scripts/sign-file.c:142:3: warning: 'ENGINE_load_builtin_engines'
> > > is deprecated [-Wdeprecated-declarations]
> > > 225:scripts/sign-file.c:144:7: warning: 'ENGINE_by_id' is deprecated
> > > [-Wdeprecated-declarations]
> > > 238:146:7: warning: 'ENGINE_init' is deprecated [-Wdeprecated-declarations]
> > > 250:scripts/sign-file.c:151:9: warning: 'ENGINE_ctrl_cmd_string' is
> > > deprecated [-Wdeprecated-declarations]
> > > 262:scripts/sign-file.c:153:17: warning: 'ENGINE_load_private_key' is
> > > deprecated [-Wdeprecated-declarations]
> > > 395:certs/extract-cert.c:46:14: warning: 'ERR_get_error_line' is
> > > deprecated [-Wdeprecated-declarations]
> > > 407:certs/extract-cert.c:59:9: warning: 'ERR_get_error_line' is
> > > deprecated [-Wdeprecated-declarations]
> > > 420:certs/extract-cert.c:124:3: warning: 'ENGINE_load_builtin_engines'
> > > is deprecated [-Wdeprecated-declarations]
> > > 432:certs/extract-cert.c:126:7: warning: 'ENGINE_by_id' is deprecated
> > > [-Wdeprecated-declarations]
> > > 444:certs/extract-cert.c:128:7: warning: 'ENGINE_init' is deprecated
> > > [-Wdeprecated-declarations]
> > > 456:certs/extract-cert.c:133:9: warning: 'ENGINE_ctrl_cmd_string' is
> > > deprecated [-Wdeprecated-declarations]
> > > 468:certs/extract-cert.c:134:3: warning: 'ENGINE_ctrl_cmd' is
> > > deprecated [-Wdeprecated-declarations]
> > >
> > > More detailed output:
> > >
> > > 189:scripts/sign-file.c:89:14: warning: 'ERR_get_error_line' is
> > > deprecated [-Wdeprecated-declarations]
> > > 190-        while ((e = ERR_get_error_line(&file, &line))) {
> > > 191-                    ^
> > > 192-/usr/include/openssl/err.h:410:1: note: 'ERR_get_error_line' has
> > > been explicitly marked deprecated here
> > > 193-OSSL_DEPRECATEDIN_3_0
> > > 194-^
> > > 195-/usr/include/openssl/macros.h:182:49: note: expanded from macro
> > > 'OSSL_DEPRECATEDIN_3_0'
> > > 196-#   define OSSL_DEPRECATEDIN_3_0                OSSL_DEPRECATED(3.0)
> > > 197-                                                ^
> > > 198-/usr/include/openssl/macros.h:62:52: note: expanded from macro
> > > 'OSSL_DEPRECATED'
> > > 199-#     define OSSL_DEPRECATED(since) __attribute__((deprecated))
> > > 200-                                                   ^
> > > 201:scripts/sign-file.c:102:9: warning: 'ERR_get_error_line' is
> > > deprecated [-Wdeprecated-declarations]
> > > 202-        while (ERR_get_error_line(&file, &line)) {}
> > > 203-               ^
> > > 204-/usr/include/openssl/err.h:410:1: note: 'ERR_get_error_line' has
> > > been explicitly marked deprecated here
> > > 205-OSSL_DEPRECATEDIN_3_0
> > > 206-^
> > > 207-/usr/include/openssl/macros.h:182:49: note: expanded from macro
> > > 'OSSL_DEPRECATEDIN_3_0'
> > > 208-#   define OSSL_DEPRECATEDIN_3_0                OSSL_DEPRECATED(3.0)
> > > 209-                                                ^
> > > 210-/usr/include/openssl/macros.h:62:52: note: expanded from macro
> > > 'OSSL_DEPRECATED'
> > > 211-#     define OSSL_DEPRECATED(since) __attribute__((deprecated))
> > > 212-                                                   ^
> > > 213:scripts/sign-file.c:142:3: warning: 'ENGINE_load_builtin_engines'
> > > is deprecated [-Wdeprecated-declarations]
> > > 214-                ENGINE_load_builtin_engines();
> > > 215-                ^
> > > 216-/usr/include/openssl/engine.h:358:1: note:
> > > 'ENGINE_load_builtin_engines' has been explicitly marked deprecated
> > > here
> > > 217-OSSL_DEPRECATEDIN_3_0 void ENGINE_load_builtin_engines(void);
> > > 218-^
> > > 219-/usr/include/openssl/macros.h:182:49: note: expanded from macro
> > > 'OSSL_DEPRECATEDIN_3_0'
> > > 220-#   define OSSL_DEPRECATEDIN_3_0                OSSL_DEPRECATED(3.0)
> > > 221-                                                ^
> > > 222-/usr/include/openssl/macros.h:62:52: note: expanded from macro
> > > 'OSSL_DEPRECATED'
> > > 223-#     define OSSL_DEPRECATED(since) __attribute__((deprecated))
> > > 224-                                                   ^
> > > 225:scripts/sign-file.c:144:7: warning: 'ENGINE_by_id' is deprecated
> > > [-Wdeprecated-declarations]
> > > 226-                e = ENGINE_by_id("pkcs11");
> > > 227-                    ^
> > > 228-/usr/include/openssl/engine.h:336:1: note: 'ENGINE_by_id' has been
> > > explicitly marked deprecated here
> > > 229-OSSL_DEPRECATEDIN_3_0 ENGINE *ENGINE_by_id(const char *id);
> > > 230-^
> > > 231-/usr/include/openssl/macros.h:182:49: note: expanded from macro
> > > 'OSSL_DEPRECATEDIN_3_0'
> > > 232-#   define OSSL_DEPRECATEDIN_3_0                OSSL_DEPRECATED(3.0)
> > > 233-                                                ^
> > > 234-/usr/include/openssl/macros.h:62:52: note: expanded from macro
> > > 'OSSL_DEPRECATED'
> > > 235-#     define OSSL_DEPRECATED(since) __attribute__((deprecated))
> > > 236-                                                   ^
> > > 237-scripts/sign-file.c:   ld.lld -r -o
> > > /home/dileks/src/linux-kernel/git/tools/objtool/arch/x86/objtool-in.o
> > > /home/dileks/src/linux-kernel/git/tools/objtool/arch/x86
> > > /special.o /home/dileks/src/linux-kernel/git/tools/objtool/arch/x86/decode.o
> > > 238:146:7: warning: 'ENGINE_init' is deprecated [-Wdeprecated-declarations]
> > > 239-                if (ENGINE_init(e))
> > > 240-                    ^
> > > 241-/usr/include/openssl/engine.h:620:1: note: 'ENGINE_init' has been
> > > explicitly marked deprecated here
> > > 242-OSSL_DEPRECATEDIN_3_0 int ENGINE_init(ENGINE *e);
> > > 243-^
> > > 244-/usr/include/openssl/macros.h:182:49: note: expanded from macro
> > > 'OSSL_DEPRECATEDIN_3_0'
> > > 245-#   define OSSL_DEPRECATEDIN_3_0                OSSL_DEPRECATED(3.0)
> > > 246-                                                ^
> > > 247-/usr/include/openssl/macros.h:62:52: note: expanded from macro
> > > 'OSSL_DEPRECATED'
> > > 248-#     define OSSL_DEPRECATED(since) __attribute__((deprecated))
> > > 249-                                                   ^
> > > 250:scripts/sign-file.c:151:9: warning: 'ENGINE_ctrl_cmd_string' is
> > > deprecated [-Wdeprecated-declarations]
> > > 251-                        ERR(!ENGINE_ctrl_cmd_string(e, "PIN", key_pass, 0),
> > > 252-                             ^
> > > 253-/usr/include/openssl/engine.h:478:1: note:
> > > 'ENGINE_ctrl_cmd_string' has been explicitly marked deprecated here
> > > 254-OSSL_DEPRECATEDIN_3_0
> > > 255-^
> > > 256-/usr/include/openssl/macros.h:182:49: note: expanded from macro
> > > 'OSSL_DEPRECATEDIN_3_0'
> > > 257-#   define OSSL_DEPRECATEDIN_3_0                OSSL_DEPRECATED(3.0)
> > > 258-                                                ^
> > > 259-/usr/include/openssl/macros.h:62:52: note: expanded from macro
> > > 'OSSL_DEPRECATED'
> > > 260-#     define OSSL_DEPRECATED(since) __attribute__((deprecated))
> > > 261-                                                   ^
> > > 262:scripts/sign-file.c:153:17: warning: 'ENGINE_load_private_key' is
> > > deprecated [-Wdeprecated-declarations]
> > > 263-                private_key = ENGINE_load_private_key(e, private_key_name,
> > > 264-                              ^
> > > 265-/usr/include/openssl/engine.h:637:1: note:
> > > 'ENGINE_load_private_key' has been explicitly marked deprecated here
> > > 266-OSSL_DEPRECATEDIN_3_0
> > > 267-^
> > > 268-/usr/include/openssl/macros.h:182:49: note: expanded from macro
> > > 'OSSL_DEPRECATEDIN_3_0'
> > > 269-#   define OSSL_DEPRECATEDIN_3_0                OSSL_DEPRECATED(3.0)
> > > 270-                                                ^
> > > 271-/usr/include/openssl/macros.h:62:52: note: expanded from macro
> > > 'OSSL_DEPRECATED'
> > > 272-#     define OSSL_DEPRECATED(since) __attribute__((deprecated))
> > > 273-
> > >
> > > Relevant OpenSSL v3.0.3 header files are attached.
> > > My kernel-config, too.
> > >
> > > If you need further information, please let me know.
> > >
> > > Regards,
> > > -Sedat-
> > >
> > > [1] https://release.debian.org/transitions/html/auto-openssl.html

--00000000000029527c05dff98808
Content-Type: text/x-patch; charset="US-ASCII"; 
	name="0001-extract-cert-Suppress-warnings-with-OpenSSL-v3-API.patch"
Content-Disposition: attachment; 
	filename="0001-extract-cert-Suppress-warnings-with-OpenSSL-v3-API.patch"
Content-Transfer-Encoding: base64
Content-ID: <f_l3o4zbot0>
X-Attachment-Id: f_l3o4zbot0

RnJvbSAzYjAxOWEyNDFhNzI3NDJjN2YyMzk5NjVlZDkyMzg1ZTlmZmQ5ZWQzIE1vbiBTZXAgMTcg
MDA6MDA6MDAgMjAwMQpGcm9tOiBTZWRhdCBEaWxlayA8c2VkYXQuZGlsZWtAZ21haWwuY29tPgpE
YXRlOiBGcmksIDI3IE1heSAyMDIyIDA5OjI1OjQ1ICswMjAwClN1YmplY3Q6IFtQQVRDSF0gZXh0
cmFjdC1jZXJ0OiBTdXBwcmVzcyB3YXJuaW5ncyB3aXRoIE9wZW5TU0wgdjMgQVBJCgpTaWduZWQt
b2ZmLWJ5OiBTZWRhdCBEaWxlayA8c2VkYXQuZGlsZWtAZ21haWwuY29tPgotLS0KIGNlcnRzL01h
a2VmaWxlIHwgMSArCiAxIGZpbGUgY2hhbmdlZCwgMSBpbnNlcnRpb24oKykKCmRpZmYgLS1naXQg
YS9jZXJ0cy9NYWtlZmlsZSBiL2NlcnRzL01ha2VmaWxlCmluZGV4IGQ4NDQzY2ZiMWM0MC4uNTJm
NzFmMDkyNWUyIDEwMDY0NAotLS0gYS9jZXJ0cy9NYWtlZmlsZQorKysgYi9jZXJ0cy9NYWtlZmls
ZQpAQCAtNzUsNCArNzUsNSBAQCB0YXJnZXRzICs9IHg1MDlfcmV2b2NhdGlvbl9saXN0CiBob3N0
cHJvZ3MgOj0gZXh0cmFjdC1jZXJ0CiAKIEhPU1RDRkxBR1NfZXh0cmFjdC1jZXJ0Lm8gPSAkKHNo
ZWxsIHBrZy1jb25maWcgLS1jZmxhZ3MgbGliY3J5cHRvIDI+IC9kZXYvbnVsbCkKK0hPU1RDRkxB
R1NfZXh0cmFjdC1jZXJ0Lm8gKz0gLVduby1kZXByZWNhdGVkLWRlY2xhcmF0aW9ucwogSE9TVExE
TElCU19leHRyYWN0LWNlcnQgPSAkKHNoZWxsIHBrZy1jb25maWcgLS1saWJzIGxpYmNyeXB0byAy
PiAvZGV2L251bGwgfHwgZWNobyAtbGNyeXB0bykKLS0gCjIuMzYuMQoK
--00000000000029527c05dff98808--