Skip to content

Commit 955b351

Browse files
committed
Fix compatibility with p11-kit-proxy
- Add patch to fix the PKCS11 module locking issue - Add patch to fix buffer overflow on chromium - Add patch to override turorial - Add p11-kit module configuration - Create symlink in the p11-kit modules directory The module should be now loaded by the whole system without further configuration, unless OpenSC is installed. In such case the user should instruct OpenSC to ignore the smart card reader used with the CIE. Signed-off-by: Luca Magrone <luca@magrone.cc>
1 parent 4fe7685 commit 955b351

5 files changed

Lines changed: 399 additions & 0 deletions
Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
From 754dbb4a06c626817bddde261cf8ddfd1468293f Mon Sep 17 00:00:00 2001
2+
From: Luca Magrone <luca@magrone.cc>
3+
Date: Tue, 15 Oct 2024 19:15:00 +0200
4+
Subject: [PATCH] cie-pkcs11: LOGGER: debug: increase buffer size to 8192
5+
6+
It fixes a buffer overflow on chromium-based browsers
7+
8+
Signed-off-by: Luca Magrone <luca@magrone.cc>
9+
---
10+
cie-pkcs11/LOGGER/Logger.cpp | 2 +-
11+
1 file changed, 1 insertion(+), 1 deletion(-)
12+
13+
diff --git a/cie-pkcs11/LOGGER/Logger.cpp b/cie-pkcs11/LOGGER/Logger.cpp
14+
index 3df99b5..6591215 100644
15+
--- a/cie-pkcs11/LOGGER/Logger.cpp
16+
+++ b/cie-pkcs11/LOGGER/Logger.cpp
17+
@@ -265,7 +265,7 @@ void Logger::log_log(ostream& out, LogLevel level, const char* text) throw() {
18+
// Interface for Debug Log
19+
void Logger::debug(const char* fmt, ...) throw()
20+
{
21+
- char buffer[4096];
22+
+ char buffer[8192];
23+
va_list args;
24+
va_start(args, fmt);
25+
26+
--
27+
2.43.5
28+
Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
From d7d431300752c15d0c1a02b9be9054d075df402d Mon Sep 17 00:00:00 2001
2+
From: Luca Magrone <luca@magrone.cc>
3+
Date: Tue, 15 Oct 2024 16:36:19 +0200
4+
Subject: [PATCH] PKCS11: Fix implementation of PKCS#11 2.11 paragraph 11.4
5+
6+
According to the specification, if CKF_OS_LOCKING_OK is set and 'fields
7+
are supplied (i.e., they all have nonNULL_PTR values)' the library can
8+
decide to use app locking or os locking (locking with 'the native
9+
operating system primitives') or return CKR_CANT_LOCK (which is what it
10+
currently does). Since the library is already using system primitives to
11+
implement locking, it is de-facto using os locking and it should not
12+
return CKR_CANT_LOCK because it can actually lock.
13+
14+
This is critical for allowing the library to be loaded by p11-kit in a
15+
manged way which in turn allows it to be loaded by p11-kit-proxy.
16+
17+
Also:
18+
- Comment unused string.
19+
- Throw CKR_CRYPTOKI_ALREADY_INITIALIZED if the library is already
20+
initialized.
21+
22+
Note related to p11-kit:
23+
In the scenario where p11-kit loads both opensc-pkcs11 and libcie-pkcs11
24+
the Smart Card reader is picked up by both modules and it is likely that
25+
both modules will try to access the CIE. This means opensc is going to
26+
get stuck at reading the CIE (because it cannot read it properly). As a
27+
result the user will be unable to use the CIE.
28+
As a workaround the user should tell opensc to ignore the smart card
29+
reader in opensc settings (i.e. adding 'ignored_readers = Reader Name;'
30+
to the proper section of opensc.conf)
31+
32+
Signed-off-by: Luca Magrone <luca@magrone.cc>
33+
---
34+
cie-pkcs11/PKCS11/PKCS11Functions.cpp | 9 ++++-----
35+
1 file changed, 4 insertions(+), 5 deletions(-)
36+
37+
diff --git a/cie-pkcs11/PKCS11/PKCS11Functions.cpp b/cie-pkcs11/PKCS11/PKCS11Functions.cpp
38+
index a4a7213..93eef49 100755
39+
--- a/cie-pkcs11/PKCS11/PKCS11Functions.cpp
40+
+++ b/cie-pkcs11/PKCS11/PKCS11Functions.cpp
41+
@@ -67,7 +67,7 @@ BOOL APIENTRY DllMainP11( HANDLE hModule,
42+
if (ul_reason_for_call==DLL_PROCESS_ATTACH && !bModuleInit) {
43+
bModuleInit=true;
44+
moduleInfo.init(hModule);
45+
- std::string mainMutexName;
46+
+ //std::string mainMutexName;
47+
//mainMutexName="CIE_P11_Mutex_"+moduleInfo.szModuleName;
48+
//p11Mutex.Create(mainMutexName.c_str());
49+
//xmlInit();
50+
@@ -326,8 +326,8 @@ CK_RV CK_ENTRY C_Initialize(CK_VOID_PTR pReserved)
51+
// CK_C_INITIALIZE_ARGS_PTR ptr=(CK_C_INITIALIZE_ARGS_PTR)pReserved;
52+
53+
if (bP11Initialized)
54+
- return CKR_OK;
55+
- // throw p11_error(CKR_CRYPTOKI_ALREADY_INITIALIZED)
56+
+ throw p11_error(CKR_CRYPTOKI_ALREADY_INITIALIZED);
57+
+ // return CKR_OK;
58+
59+
// verifico che i flag siano supportati
60+
CK_C_INITIALIZE_ARGS_PTR iargs = NULL_PTR;
61+
@@ -338,8 +338,7 @@ CK_RV CK_ENTRY C_Initialize(CK_VOID_PTR pReserved)
62+
63+
if (iargs->flags & CKF_OS_LOCKING_OK)
64+
{
65+
- if ((iargs->CreateMutex) || (iargs->DestroyMutex) || (iargs->LockMutex) || (iargs->UnlockMutex))
66+
- throw p11_error(CKR_CANT_LOCK);
67+
+ // Nothing to do because we will use os locking
68+
}
69+
else if (iargs->flags == 0)
70+
{
71+
--
72+
2.43.5
73+
Lines changed: 278 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,278 @@
1+
From 0f8746e40656ddbde6a63031ee2e961d5323f019 Mon Sep 17 00:00:00 2001
2+
From: Luca Magrone <luca@magrone.cc>
3+
Date: Tue, 15 Oct 2024 22:16:03 +0200
4+
Subject: [PATCH] CIEID: Override turorial to explain the OpenSC issue
5+
6+
Replace the remote webpage loaded from the tutorial tab with a bundled
7+
one that reflects the new changes introduced with the set of patches
8+
included in the RPM package.
9+
10+
Specifically, inform the user that no further configuration has to be
11+
done unless there is OpenSC installed on the system. Walk the user
12+
through what to do if that's the case.
13+
14+
Signed-off-by: Luca Magrone <luca@magrone.cc>
15+
---
16+
CIEID/src/it/ipzs/cieid/MainFrame.java | 2 +-
17+
.../src/it/ipzs/cieid/res/tutorial_linux.html | 236 ++++++++++++++++++
18+
2 files changed, 237 insertions(+), 1 deletion(-)
19+
create mode 100644 CIEID/src/it/ipzs/cieid/res/tutorial_linux.html
20+
21+
diff --git a/CIEID/src/it/ipzs/cieid/MainFrame.java b/CIEID/src/it/ipzs/cieid/MainFrame.java
22+
index ac56eca..1c42a7e 100644
23+
--- a/CIEID/src/it/ipzs/cieid/MainFrame.java
24+
+++ b/CIEID/src/it/ipzs/cieid/MainFrame.java
25+
@@ -1244,7 +1244,7 @@ public class MainFrame extends JFrame {
26+
MiniWebView webView = new MiniWebView();
27+
webView.setBounds(12, 99, 571, 362);
28+
panel_8.add(webView);
29+
- webView.showPage("https://idserver.servizicie.interno.gov.it/idp/tutorial/computer/lettoreusb/linux/tutorial_linux_firefox.jsp");
30+
+ webView.showPage(MainFrame.class.getResource("/it/ipzs/cieid/res/tutorial_linux.html"));
31+
panel_9 = new JPanel();
32+
panel_9.setLayout(null);
33+
panel_9.setBackground(Color.WHITE);
34+
diff --git a/CIEID/src/it/ipzs/cieid/res/tutorial_linux.html b/CIEID/src/it/ipzs/cieid/res/tutorial_linux.html
35+
new file mode 100644
36+
index 0000000..0509ce2
37+
--- /dev/null
38+
+++ b/CIEID/src/it/ipzs/cieid/res/tutorial_linux.html
39+
@@ -0,0 +1,236 @@
40+
+<!doctype html>
41+
+<html lang="it">
42+
+<head>
43+
+<meta charset="UTF-8">
44+
+<title>Aiuto</title>
45+
+<link rel="preconnect" href="https://fonts.googleapis.com">
46+
+<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
47+
+<link href="https://fonts.googleapis.com/css2?family=Titillium+Web:wght@300;400;600;700&display=swap" rel="stylesheet">
48+
+<style type="text/css" media="screen">
49+
+/* latin-ext */
50+
+@font-face {
51+
+ font-family: 'Titillium Web', sans-serif;
52+
+ font-style: normal;
53+
+ font-weight: 300;
54+
+}
55+
+
56+
+
57+
+/* latin */
58+
+@font-face {
59+
+ font-family: 'Titillium Web', sans-serif;
60+
+ font-style: normal;
61+
+ font-weight: 300;
62+
+}
63+
+
64+
+
65+
+/* latin-ext */
66+
+@font-face {
67+
+ font-family: 'Titillium Web', sans-serif;
68+
+ font-style: normal;
69+
+ font-weight: 400;
70+
+}
71+
+/* latin */
72+
+@font-face {
73+
+ font-family: 'Titillium Web', sans-serif;
74+
+ font-style: normal;
75+
+ font-weight: 400;
76+
+}
77+
+
78+
+/* latin-ext */
79+
+@font-face {
80+
+ font-family: 'Titillium Web', sans-serif;
81+
+ font-style: normal;
82+
+ font-weight: 600;
83+
+}
84+
+/* latin */
85+
+@font-face {
86+
+ font-family: 'Titillium Web', sans-serif;
87+
+ font-style: normal;
88+
+ font-weight: 600;
89+
+}
90+
+/* latin-ext */
91+
+@font-face {
92+
+ font-family: 'Titillium Web', sans-serif;
93+
+ font-style: normal;
94+
+ font-weight: 700;
95+
+}
96+
+/* latin */
97+
+@font-face {
98+
+ font-family: 'Titillium Web', sans-serif;
99+
+ font-style: normal;
100+
+ font-weight: 700;
101+
+}
102+
+
103+
+
104+
+body {
105+
+ height: 94.5%;
106+
+ width: 88.2%;
107+
+ font-family: Titillium Web;
108+
+ color: #747474;
109+
+ font-size: 21px;
110+
+ font-weight: 400;
111+
+ text-align:justify
112+
+}
113+
+
114+
+.title {
115+
+font-family: Titillium Web;
116+
+ color: #747474;
117+
+ font-size: 30px;
118+
+ font-weight: 700;
119+
+ text-align: center
120+
+}
121+
+
122+
+.subtitle {
123+
+font-family: Titillium Web;
124+
+ color: #9D9D9D;
125+
+ font-size: 26px;
126+
+ font-weight: 700;
127+
+ text-align: center
128+
+}
129+
+
130+
+.margine {
131+
+
132+
+display: block;
133+
+ padding-left: 10%;
134+
+ padding-right: 10%;
135+
+}
136+
+
137+
+.icon_image{
138+
+ width: 18%;
139+
+ max-width: 40%;
140+
+ display: block;
141+
+ margin-left: auto;
142+
+ margin-right: auto;
143+
+}
144+
+
145+
+.screen_image{
146+
+ width: 60%;
147+
+ max-width: 60%;
148+
+ display: block;
149+
+ margin-left: auto;
150+
+ margin-right: auto;
151+
+}
152+
+
153+
+.android_image{
154+
+ width: 30%;
155+
+ max-width: 60%;
156+
+ display: block;
157+
+ margin-left: auto;
158+
+ margin-right: auto;
159+
+}
160+
+
161+
+@media screen and (min-width: 600px) and (max-width: 1000px) {
162+
+.screen_image{
163+
+ width: 50%;
164+
+ max-width: 60%;
165+
+ display: block;
166+
+ margin-left: auto;
167+
+ margin-right: auto;
168+
+}
169+
+.android_image{
170+
+ width: 50%;
171+
+ max-width: 60%;
172+
+ display: block;
173+
+ margin-left: auto;
174+
+ margin-right: auto;
175+
+}
176+
+ .icon_image{
177+
+ width: 25%;
178+
+ max-width: 40%;
179+
+ display: block;
180+
+ margin-left: auto;
181+
+ margin-right: auto;
182+
+}
183+
+body {
184+
+ font-size: 19px;
185+
+ }
186+
+}
187+
+
188+
+@media screen and (max-width: 600px) {
189+
+.screen_image{
190+
+ width: 60%;
191+
+ max-width: 60%;
192+
+ display: block;
193+
+ margin-left: auto;
194+
+ margin-right: auto;
195+
+}
196+
+.android_image{
197+
+ width: 60%;
198+
+ max-width: 60%;
199+
+ display: block;
200+
+ margin-left: auto;
201+
+ margin-right: auto;
202+
+}
203+
+ .icon_image{
204+
+ width: 30%;
205+
+ max-width: 40%;
206+
+ display: block;
207+
+ margin-left: auto;
208+
+ margin-right: auto;
209+
+}
210+
+body {
211+
+ font-size: 17px;
212+
+ }
213+
+}
214+
+</style>
215+
+
216+
+</head>
217+
+
218+
+<body>
219+
+<div class="margine">
220+
+ <p class="title">Come usare Cie ID</p>
221+
+ <p class="subtitle">Sul browser web</p>
222+
+ <p>&nbsp;</p>
223+
+
224+
+<ol>
225+
+ <p>
226+
+ Il browser web dovrebbe essere gi&agrave; correttamente configurato, se riscontri dei problemi potresti aver installato sul tuo sistema <a href="https://github.com/OpenSC/OpenSC/wiki" targets="_blank">OpenSC</a>.
227+
+ </p>
228+
+ <p>
229+
+ Per risolvere il problema <strong>puoi disinstallare OpenSC</strong> oppure, alternativamente, puoi <strong>configurare OpenSC per ignorare il tuo lettore di smart card</strong>:
230+
+ </p>
231+
+ <ul>
232+
+ <li>
233+
+ Da riga di comando: lancia "opensc-tool --list-readers", sotto la voce "Name" troverai l'elenco dei lettori disponibili, prendi nota del nome del tuo lettore.
234+
+ </li>
235+
+ <li>
236+
+ Apri il file di configurazione "opensc.conf" con un editor di testo (di solito si trova presso /etc/opensc.conf).
237+
+ </li>
238+
+ <li>
239+
+ Inserisci "ignored_readers = nome del tuo lettore;" dentro le parentesi graffe di "app default".
240+
+ </li>
241+
+ <li>
242+
+ Salva, ed esci.
243+
+ </li>
244+
+ </ul>
245+
+ <p>&nbsp;</p>
246+
+ Per autenticarti con la CIE, digita l’URL del servizio di tuo interesse e clicca sul pulsante <strong>Entra con CIE</strong>.
247+
+ <p>&nbsp;</p>
248+
+ <img class="android_image" src="https://idserver.servizicie.interno.gov.it/idp/images/entra_con_cie.png" alt="image">
249+
+ <p>&nbsp;</p>
250+
+ <p>&nbsp;</p>
251+
+ Quando richiesto, procedi ad effettuare l’abilitazione della tua CIE sul computer, necessaria solo per il primo utilizzo. Ti occorrerà il codice <a href="https://www.cartaidentita.interno.gov.it/cosa-pin-puk-utilizzarli/" target="_blank">PIN</a> composto da 4 cifre ricevute al momento di presentazione della domanda e altre 4 cifre che ti sono state recapitate a casa insieme alla nuova Carta di Identità Elettronica. <strong>Ricorda: dopo aver terminato l'abilitazione, ogni volta che ti sarà richiesto l'inserimento del PIN è necessario inserire solo le ultime 4 cifre del PIN.</strong><a href="https://www.cartaidentita.interno.gov.it/richiesta-di-ristampa/" target="_blank">Clicca qui</a> se hai smarrito il PIN.
252+
+ <p>&nbsp;</p>
253+
+ <img class="android_image" src="https://idserver.servizicie.interno.gov.it/idp/images/win_abbina.png" alt="image">
254+
+ <p>&nbsp;</p>
255+
+ <p>&nbsp;</p>
256+
+
257+
+ Terminata l’abilitazione, ti verrà richiesto di scegliere il certificato con cui accedere al servizio e di inserire la seconda metà del PIN.
258+
+ <p>&nbsp;</p>
259+
+ <img class="android_image" src="https://idserver.servizicie.interno.gov.it/idp/images/win_firefox_pin.png" alt="image">
260+
+ <p>&nbsp;</p>
261+
+ <p>&nbsp;</p>
262+
+
263+
+ Inserito il PIN, clicca su OK o premi INVIO per accedere al servizio. Ti verrà mostrato il certificato digitale con cui accedere. Clicca su OK per proseguire.
264+
+ <p>&nbsp;</p>
265+
+ <img class="android_image" src="https://idserver.servizicie.interno.gov.it/idp/images/win_firefox7.png" alt="image">
266+
+ <p>&nbsp;</p>
267+
+ <p>&nbsp;</p>
268+
+
269+
+</ol>
270+
+ <p>In caso di difficoltà, contatta il servizio di assistenza per i cittadini secondo le modalità indicate all’indirizzo <a href="https://www.cartaidentita.interno.gov.it/contatti/" target="_blank">https://www.cartaidentita.interno.gov.it/contatti/</a>. Se vuoi cambiare il PIN o l’hai dimenticato e intendi cambiarlo (avrai bisogno del PUK) consulta il manuale del Software CIE per conoscere la procedura. Il manuale è disponibile all’indirizzo <a href="https://www.cartaidentita.interno.gov.it/software-cie/" target="_blank">https://www.cartaidentita.interno.gov.it/software-cie/.</a></p>
271+
+
272+
+ <p>&nbsp;</p>
273+
+</div>
274+
+</body>
275+
+</html>
276+
--
277+
2.43.5
278+

0 commit comments

Comments
 (0)