WIP: Feature/pkcs11 token by MPeisl · Pull Request #461 · gyroidos/cml

MPeisl · 2024-04-18T13:09:16Z

Support for generic PKCS#11 tokens:

scd/pkcs11-lib/*: contains headers and helper libraries
scd/pkcs11-test/*: unit-tests for p11token module
scd/p11token: actual scd_token implementation for PKCS#11-API

~~TODO: integration in daemon~~
TODO: integration testing
TODO before merging: squash commits

quitschbo · 2024-04-19T13:46:20Z

daemon/c_smartcard.c

+	if (smartcard->token_type == CONTAINER_TOKEN_TYPE_PKCS11) {
+		if (NULL == container_get_pkcs11_module(smartcard->container)) {
+			ERROR("PKCS#11 module missing in container config. Abort creation of container");
+			mem_free0(smartcard);


return NULL;

quitschbo · 2024-04-19T13:51:04Z

daemon/c_smartcard.c

 	smartcard->sock = sock_unix_create_and_connect(SOCK_SEQPACKET, scd_sock_path);
 	if (smartcard->sock < 0) {
-		mem_free0(smartcard);
+		mem_free0(smartcard); //? potential mem_leak for usbtoken


yes smartcard->token_serial may be allocated here. Thus should be freed, same counts for smartcard->pkcs11_module. May instead of return NULL in error cases. We introduce a jump mark err:
and do cleanup there

daemon/container.h

quitschbo · 2024-04-19T13:55:43Z

scd/p11token.h

+#include "pkcs11-lib/pkcs11.h"
+#include <stddef.h>
+
+// todo: move to c-file -> hide implementation details to user


remove comment

quitschbo · 2024-04-19T13:56:22Z

scd/p11token.h

+#define P11TOKEN_H
+
+#include <stdbool.h>
+#include "pkcs11-lib/pkcs11.h"


I think this header is not used here, -> move this to p11token.c

Correct, header was only needed for struct p11token which is now defined in p11token.c. Will be moved.

quitschbo · 2024-04-19T14:11:24Z

scd/p11token.c

+	CK_UTF8CHAR label[32];
+	unsigned int wrong_unlock_attempts;
+	CK_FUNCTION_LIST_PTR ctx;
+	CK_SESSION_HANDLE_PTR sh;


could we use the "GNU" typedefs of pkcs11.h? would be much better to read. (in the whole p11token.c)
e.g.:
ck_function_list_t *ctx;
ck_session_handle_t *sh;

quitschbo · 2024-04-19T14:19:26Z

scd/scd.c


 	create_data.type = scd_proto_to_tokentype(msg);

+	// ? why no switch statement here


yes a "switch" would look nicer here for me, too :)

quitschbo · 2024-04-19T14:29:03Z

scd/token.c

+		new_token->reset_auth = int_reset_auth_p11;
+		new_token->get_atr = int_get_atr_p11;
+		new_token->send_apdu = int_send_apdu_p11;
+		break;


For a followup refactoring, we should consider to introduce a struct for all those functions and hide
the token specific functions in the corresponding p11token.c/usbtoken.c files (analogues to the compartment_module_t)

quitschbo · 2024-12-03T08:20:11Z

scd/pkcs11-lib/libpkcs11.c

+#include <stdio.h>
+#include <string.h>
+
+#include "libscdl.h"


get rid of this wrapper lib, we do not need win32 compat.
directly call dlopen, dlsym and dlclose in the following.

quitschbo · 2025-04-02T15:00:11Z

scd/p11token.c

+	return -1;
+}
+
+// internal helper functions


put those functions at the beginning of the c file where you now have the prototype definitions.
remove the prototype definitions and declare those functions static.

quitschbo · 2025-04-02T15:06:06Z

scd/Makefile

 		-DSCD_CONTROL_SOCKET=NULL
 endif
+ifeq ($(PKCS11), y)
+    # If requested, we build sc-hsm support into trustme


# If requested, we build pkcs11 support into the scd

scd/scd.c

This commit unifies the usage of the 'const' qualifier in the token API. Signed-off-by: Maximilian Peisl <maximilian.peisl@aisec.fraunhofer.de>

The scd now supports a new tokentype which is build upon PKCS#11. In order to use the new token type a path to a valid PKCS#11-Module needs to be specified In order to use the new token type a path to a valid PKCS#11-Module needs to be specified. Signed-off-by: Maximilian Peisl <maximilian.peisl@aisec.fraunhofer.de>

Add support for new tokentype offered by scd. Add new 'pkcs11_module' configuration option. Similar to usbtoken or softtoken one can now configure a container to use a specific PKCS#11 module. Signed-off-by: Maximilian Peisl <maximilian.peisl@aisec.fraunhofer.de>

MPeisl force-pushed the feature/pkcs11-token branch from b99a779 to cb36751 Compare April 18, 2024 15:02

quitschbo reviewed Apr 19, 2024

View reviewed changes

daemon/container.h Show resolved Hide resolved

quitschbo reviewed Apr 19, 2024

View reviewed changes

MPeisl force-pushed the feature/pkcs11-token branch from 14e15bd to 20f9bb3 Compare April 25, 2024 06:34

MPeisl force-pushed the feature/pkcs11-token branch 2 times, most recently from eb35e2b to 2c49d9f Compare June 21, 2024 12:04

quitschbo reviewed Dec 3, 2024

View reviewed changes

MPeisl force-pushed the feature/pkcs11-token branch from 2c49d9f to 28e753e Compare December 3, 2024 09:35

MPeisl force-pushed the feature/pkcs11-token branch 2 times, most recently from 5e8f238 to f8c7d67 Compare February 24, 2025 16:59

MPeisl changed the base branch from kirkstone to main February 24, 2025 17:01

MPeisl force-pushed the feature/pkcs11-token branch 3 times, most recently from 3a80617 to da880e5 Compare February 25, 2025 10:26

MPeisl force-pushed the feature/pkcs11-token branch from da880e5 to b07efe0 Compare April 1, 2025 08:14

quitschbo requested changes Apr 2, 2025

View reviewed changes

MPeisl force-pushed the feature/pkcs11-token branch from fdc37d7 to 8352011 Compare April 29, 2025 07:50

MPeisl force-pushed the feature/pkcs11-token branch from 8352011 to 691ffaf Compare August 12, 2025 07:41

MPeisl commented Aug 12, 2025

View reviewed changes

scd/scd.c Outdated Show resolved Hide resolved

MPeisl force-pushed the feature/pkcs11-token branch from 691ffaf to b8549f6 Compare September 2, 2025 11:12

MPeisl force-pushed the feature/pkcs11-token branch from b8549f6 to 1d8ae17 Compare December 3, 2025 13:04

MPeisl force-pushed the feature/pkcs11-token branch from 6e19fc5 to b78b1f3 Compare January 9, 2026 12:52

MPeisl force-pushed the feature/pkcs11-token branch from b78b1f3 to 54b8cd2 Compare January 26, 2026 09:25

MPeisl force-pushed the feature/pkcs11-token branch from 54b8cd2 to 7f2da99 Compare February 17, 2026 15:27

MPeisl force-pushed the feature/pkcs11-token branch from 7f2da99 to 06bef70 Compare February 19, 2026 12:23

MPeisl added 3 commits March 2, 2026 14:38

scd/token,softtoken,usbtoken: unify usage of 'const'

3de6cb3

This commit unifies the usage of the 'const' qualifier in the token API. Signed-off-by: Maximilian Peisl <maximilian.peisl@aisec.fraunhofer.de>

MPeisl force-pushed the feature/pkcs11-token branch from 06bef70 to 997d86b Compare March 2, 2026 13:41


		create_data.type = scd_proto_to_tokentype(msg);

		// ? why no switch statement here

Conversation

MPeisl commented Apr 18, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

quitschbo Apr 19, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

MPeisl commented Apr 18, 2024 •

edited

Loading

quitschbo Apr 19, 2024 •

edited

Loading