PKCS11 Provider with AWS CloudHSM

[Maks027]

Hello,
I am trying to integrate the pkcs11 provider with AWS CloudHSM

I've added the pkcs11 provider to the OpenSSL config and, at first, everything seemed to go fine, but I was unable to perform any operations with it.

The debug logs indicate that the issue occurs in C_OpenSession

[interface.gen.c:214] p11prov_OpenSession(): Calling C_OpenSession
[interface.gen.c:218] p11prov_OpenSession(): Error: 0x00000007; Error returned by C_OpenSession
[session.c:73] token_session_open(): C_OpenSession ret:7 (session: 0)
[store.c:126] store_fetch(): Failed to get session to load keys (slotid=ffffffffffffffff, ret=7)

Logs from libcloudhsm_pkcs11.so :

2024-02-12T12:51:47.364Z ERROR [1821500] ThreadId(3) [cloudhsm_pkcs11::session::C_OpenSession][][] BP000: Notify callback function is not supported, please pass in NULL_PTR for both pApplication and Notify
2024-02-12T12:51:47.364Z ERROR [1821500] ThreadId(3) [cloudhsm_pkcs11::session::C_OpenSession][][] C_OpenSession failed, returning 0x00000007

It looks like the implementation of PKCS11 from AWS does not support callbacks in the C_OpenSession.

I've tried to update the token_session_open function in src/session.c:70 to set NULL values for pApplication and Notify (also added a new 'quirk' for that).

if (p11prov_ctx_no_session_callbacks(session->provctx)) {
    P11PROV_debug("Openning session without callbacks %lu", session->session);
    ret = p11prov_OpenSession(session->provctx, session->slotid, flags,
                            NULL, NULL, &session->session);
} else {
    ret = p11prov_OpenSession(session->provctx, session->slotid, flags,
                            session, token_session_callback,
                            &session->session);
}

Everything seems to work with that change, but I'm not sure about other implications. Is there

Can somebody advice if this is a viable solution?

[simo5]

Bleah, they are buggy, they should just ignore the callbacks ...
That said your quirk is just fine, I would lve to get a PR with that contributed.
Callbacks are rarely supported and not very much ued anyway, I might even make the quirk the default down the line...