included libpkcs11-helper-1.dll is compiled without Elliptic Curve support >=2.4.5

[uriseja]

Trying to use pkcs11 tokens with EC keys and openpn >= 2.4.5 yields with an error:

PKCS#11: Adding PKCS#11 provider 'onepin-opensc-pkcs11.dll'
PKCS#11: Invalid public key algorithm 408
PKCS#11: Unable get evp object

OpenVPN builds <=2.4.4 work as expected

[becm]

According to build logs, pkcs11-helper 1.22 fails to detect EC support in OpenSSL 1.1.x library. OpenVPN 2.4.4 used OpenSSL 1.0.x.

@dwmw2 seems to affect Fedora as well (see build.log files):
First detection miss of EC support with pkcs11-helper 1.22/OpenSSL 1.1.1.
Last success for pkcs11-helper 1.11/OpenSSL 1.0.x.

Also seem to happen with self-compiled versions on Debian sarge, the builtin still uses libcrypto.so.1.0.2.

Used configure.am should only work up to OpenSSL 1.0.x, even with ecs_locl.h hack.
Later pkcs11-helper versions have detection and code refinements and compile with EC support for current Fedora OpenSSL (unable to test if it actually works for PKI tokens).

Support in pkcs11-helperfor Elliptic Curves with OpenSSL 1.1.1 seems to be in release 1.23 or should require at least parts of changes in February 2018 commit.

[becm]

The pkcs11-helper/OpenSSL combination in current OpenVPN 2.5 beta releases should support EC operations.
@uriseja can you (or anyone else with a EC-capable token) verify this fixes the problem?

Test exposure for different PKCS#11 tokens is severely limited.
Since this update is also to be incorporated into OpenVPN 2.4.10 release for Windows, please report any unexpected behavioural changes. Some effects may only show with certain hard- or middleware.

[dwmw2]

Test exposure for different PKCS#11 tokens is severely limited

Little excuse for that with SoftHSM being so readily available. Feel free to lift from the OpenConnect test suite, which tests EC, RSA and even DSA keys from PKCS#11 in various permutations.

[flichtenheld]

There never was confirmation that this problem is indeed fixed. But also no reports that it is not. Let's go with fixed for now.