CIE-Middleware-RPM-Package/cie-middleware-fix-pkcs11-cant-lock.patch at main · Leuca/CIE-Middleware-RPM-Package · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
From d7d431300752c15d0c1a02b9be9054d075df402d Mon Sep 17 00:00:00 2001
From: Luca Magrone <luca@magrone.cc>
Date: Tue, 15 Oct 2024 16:36:19 +0200
Subject: [PATCH] PKCS11: Fix implementation of PKCS#11 2.11 paragraph 11.4

According to the specification, if CKF_OS_LOCKING_OK is set and 'fields
are supplied (i.e., they all have nonNULL_PTR values)' the library can
decide to use app locking or os locking (locking with 'the native
operating system primitives') or return CKR_CANT_LOCK (which is what it
currently does). Since the library is already using system primitives to
implement locking, it is de-facto using os locking and it should not
return CKR_CANT_LOCK because it can actually lock.

This is critical for allowing the library to be loaded by p11-kit in a
manged way which in turn allows it to be loaded by p11-kit-proxy.

Also:
    - Comment unused string.
    - Throw CKR_CRYPTOKI_ALREADY_INITIALIZED if the library is already
      initialized.

Note related to p11-kit:
In the scenario where p11-kit loads both opensc-pkcs11 and libcie-pkcs11
the Smart Card reader is picked up by both modules and it is likely that
both modules will try to access the CIE. This means opensc is going to
get stuck at reading the CIE (because it cannot read it properly). As a
result the user will be unable to use the CIE.
As a workaround the user should tell opensc to ignore the smart card
reader in opensc settings (i.e. adding 'ignored_readers = Reader Name;'
to the proper section of opensc.conf)

Signed-off-by: Luca Magrone <luca@magrone.cc>
---
 cie-pkcs11/PKCS11/PKCS11Functions.cpp | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/cie-pkcs11/PKCS11/PKCS11Functions.cpp b/cie-pkcs11/PKCS11/PKCS11Functions.cpp
index a4a7213..93eef49 100755
--- a/cie-pkcs11/PKCS11/PKCS11Functions.cpp
+++ b/cie-pkcs11/PKCS11/PKCS11Functions.cpp
@@ -67,7 +67,7 @@ BOOL APIENTRY DllMainP11( HANDLE hModule,
 	if (ul_reason_for_call==DLL_PROCESS_ATTACH && !bModuleInit) {
 		bModuleInit=true;
 		moduleInfo.init(hModule);
-		std::string mainMutexName;
+		//std::string mainMutexName;
 		//mainMutexName="CIE_P11_Mutex_"+moduleInfo.szModuleName;
 		//p11Mutex.Create(mainMutexName.c_str());
 		//xmlInit();
@@ -326,8 +326,8 @@ CK_RV CK_ENTRY C_Initialize(CK_VOID_PTR pReserved)
 //    CK_C_INITIALIZE_ARGS_PTR ptr=(CK_C_INITIALIZE_ARGS_PTR)pReserved;

 	if (bP11Initialized)
-		return CKR_OK;
-	//	throw p11_error(CKR_CRYPTOKI_ALREADY_INITIALIZED)
+		throw p11_error(CKR_CRYPTOKI_ALREADY_INITIALIZED);
+	//	return CKR_OK;

 	// verifico che i flag siano supportati
 	CK_C_INITIALIZE_ARGS_PTR iargs = NULL_PTR;
@@ -338,8 +338,7 @@ CK_RV CK_ENTRY C_Initialize(CK_VOID_PTR pReserved)

 		if (iargs->flags	& CKF_OS_LOCKING_OK)
 		{
-			if ((iargs->CreateMutex) || (iargs->DestroyMutex) || (iargs->LockMutex) || (iargs->UnlockMutex))
-				throw p11_error(CKR_CANT_LOCK);
+			// Nothing to do because we will use os locking
 		}
 		else if (iargs->flags == 0)
 		{
--
2.43.5