Skip to content

Commit 56dcccf

Browse files
author
Roumen Petrov
committed
use global flag for initialised state
Resolves #780 , and closes #729 .
1 parent cd7a909 commit 56dcccf

5 files changed

Lines changed: 173 additions & 1 deletion

File tree

‎src/bin/util/.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
/tokens

‎src/bin/util/Makefile.am‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,5 +37,14 @@ softhsm2_util_SOURCES += softhsm2-util-botan.cpp
3737
endif
3838

3939
EXTRA_DIST = $(srcdir)/CMakeLists.txt \
40+
$(srcdir)/p11prov \
4041
$(srcdir)/*.h \
4142
$(srcdir)/*.cpp
43+
44+
TESTS =
45+
if WITH_OPENSSL
46+
TESTS += p11prov
47+
endif
48+
49+
clean-local:
50+
-rm -rf tokens

‎src/bin/util/p11prov‎

Lines changed: 160 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,160 @@
1+
#! /bin/sh
2+
# This file is in the public domain
3+
4+
CWD=`pwd`
5+
6+
# binaries
7+
8+
OPENSSL=${OPENSSL-openssl}
9+
OPENSSL=`command -v $OPENSSL`
10+
if test -z "$OPENSSL" ; then
11+
echo "error: openssl utility not found" >&2
12+
exit 77
13+
fi
14+
15+
openssl() {
16+
"$OPENSSL" ${1+"$@"}
17+
}
18+
19+
openssl_version=`openssl version` || exit $?
20+
if test -z "$openssl_version" ; then
21+
echo "cannot determine OpenSSL version" >&2
22+
exit 99
23+
fi
24+
25+
case $openssl_version in
26+
*"OpenSSL 0.9."*|\
27+
*"OpenSSL 1."*)
28+
echo "$openssl_version is not impacted" >&2
29+
exit 77
30+
;;
31+
esac
32+
# NOTE OpenSSL > 1.*
33+
34+
35+
# find a PKCS#11 provider
36+
p11_find_provider() {
37+
if test -z "$PROV_PKCS11" ; then
38+
39+
# try to extract path ...
40+
moduledir=`openssl version -m 2>/dev/null \
41+
| sed -e 's/^MODULESDIR: "//' -e 's/"$//'`
42+
if test -z "$moduledir" ; then
43+
echo "cannot determine OpenSSL MODULESDIR" >&2
44+
exit 99
45+
fi
46+
if test -d "$moduledir" ; then :
47+
else
48+
echo "does not exist MODULESDIR: $moduledir" >&2
49+
exit 99
50+
fi
51+
52+
for N in pkcs11 libpkcs11 ; do
53+
for S in so dll ; do
54+
test -f "$moduledir"/$N.$S || continue
55+
PROV_PKCS11="$moduledir"/$N.$S
56+
break
57+
done
58+
test -n "$PROV_PKCS11" && break
59+
done
60+
test -n "$PROV_PKCS11"
61+
else
62+
test -f "$PROV_PKCS11"
63+
fi
64+
}
65+
66+
if p11_find_provider ; then :
67+
else
68+
echo "error: PKCS#11 provider not found" >&2
69+
exit 77
70+
fi
71+
72+
73+
D=`cd ../../lib/.libs/ && pwd`
74+
if test -z "$D" ; then
75+
echo "unexpectedly missing library directory" >&2
76+
exit 99
77+
fi
78+
P11MODULE=
79+
for S in so dll ; do
80+
for F in "$D"/*softhsm2.$S ; do
81+
test -f "$F" || continue
82+
P11MODULE="$F"
83+
break
84+
done
85+
test -n "$P11MODULE" && break
86+
done
87+
if test -z "$P11MODULE" ; then
88+
echo "error: unexpected module suffix" >&2
89+
exit 1
90+
fi
91+
if command -v realpath > /dev/null ; then
92+
P11MODULE=`realpath "$P11MODULE"`
93+
fi
94+
95+
softhsm2_tool() {
96+
"$CWD"/softhsm2-util --module "$P11MODULE" ${1+"$@"}
97+
}
98+
99+
100+
# configurations
101+
TOKEN_DIR="$CWD"/tokens
102+
rm -rf "$TOKEN_DIR"
103+
mkdir "$TOKEN_DIR"
104+
105+
106+
OPENSSL_CONF="$TOKEN_DIR"/openssl.conf
107+
cat > "$OPENSSL_CONF" <<EOF
108+
openssl_conf = config
109+
110+
[ config ]
111+
providers = provider_section
112+
113+
[ provider_section ]
114+
default = default_section
115+
provider1 = provider1_section
116+
117+
[default_section]
118+
activate = 1
119+
120+
[provider1_section]
121+
pkcs11-module-path = $P11MODULE
122+
module = $PROV_PKCS11
123+
activate = 1
124+
EOF
125+
export OPENSSL_CONF
126+
127+
128+
SOFTHSM2_CONF="$TOKEN_DIR"/softhsm2.conf
129+
cat > "$SOFTHSM2_CONF" <<EOF
130+
directories.tokendir = $TOKEN_DIR
131+
objectstore.backend = file
132+
slots.removable = false
133+
slots.mechanisms = ALL
134+
log.level = ERROR
135+
EOF
136+
export SOFTHSM2_CONF
137+
138+
139+
# execution
140+
set -e
141+
142+
TOKEN_PIN=4321
143+
TOKEN_ID=01
144+
PASS_URI=pass:$TOKEN_PIN
145+
PASS_FILE=pass:
146+
KEY_URI=pkcs11:id=%$TOKEN_ID
147+
KEY_FILE="$TOKEN_DIR"/test_key
148+
SIGN_FILE="$TOKEN_DIR"/test_sign
149+
150+
softhsm2_tool --init-token --label test0 --slot free --so-pin 12345678 --pin $TOKEN_PIN
151+
openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out "$KEY_FILE" -pass $PASS_FILE
152+
softhsm2_tool --import "$KEY_FILE" --import-type keypair --id $TOKEN_ID --label test_key --token test0 --pin $TOKEN_PIN
153+
154+
#openssl storeutl -passin "$PASS_URI" "$KEY_URI"
155+
156+
# sample command that crash before workaround due to OpenSSL "at_exit" flaw
157+
openssl pkeyutl -sign -inkey $KEY_URI -passin $PASS_URI -rawin -in ./Makefile -out "$SIGN_FILE"
158+
159+
# just in case
160+
openssl pkeyutl -verify -inkey "$KEY_FILE" -passin $PASS_FILE -rawin -in ./Makefile -sigfile "$SIGN_FILE"

‎src/lib/SoftHSM.cpp‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -93,6 +93,8 @@
9393
#include <unistd.h>
9494
#endif
9595

96+
bool SoftHSM::isInitialised;
97+
9698
// Initialise the one-and-only instance
9799

98100
#ifdef HAVE_CXX11

‎src/lib/SoftHSM.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -184,7 +184,7 @@ class SoftHSM
184184
#endif
185185

186186
// Is the SoftHSM PKCS #11 library initialised?
187-
bool isInitialised;
187+
static bool isInitialised;
188188
bool isRemovable;
189189

190190
SessionObjectStore* sessionObjectStore;

0 commit comments

Comments
 (0)