Skip to content

Commit f49a344

Browse files
author
Roumen Petrov
committed
use global flag for initialised state
Resolves #780 , and closes #729 .
1 parent cd7a909 commit f49a344

5 files changed

Lines changed: 169 additions & 1 deletion

File tree

‎src/bin/util/.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
/tokens

‎src/bin/util/Makefile.am‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,5 +37,14 @@ softhsm2_util_SOURCES += softhsm2-util-botan.cpp
3737
endif
3838

3939
EXTRA_DIST = $(srcdir)/CMakeLists.txt \
40+
$(srcdir)/p11prov \
4041
$(srcdir)/*.h \
4142
$(srcdir)/*.cpp
43+
44+
TESTS =
45+
if WITH_OPENSSL
46+
TESTS += p11prov
47+
endif
48+
49+
clean-local:
50+
-rm -rf tokens

‎src/bin/util/p11prov‎

Lines changed: 156 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,156 @@
1+
#! /bin/sh
2+
# This file is in the public domain
3+
4+
CWD=`pwd`
5+
6+
# binaries
7+
8+
OPENSSL=${OPENSSL-openssl}
9+
OPENSSL=`command -v $OPENSSL`
10+
if test -z "$OPENSSL" ; then
11+
echo "error: openssl utility not found" >&2
12+
exit 77
13+
fi
14+
15+
openssl() {
16+
"$OPENSSL" ${1+"$@"}
17+
}
18+
19+
openssl_version=`openssl version` || exit $?
20+
if test -z "$openssl_version" ; then
21+
echo "cannot determine OpenSSL version" >&2
22+
exit 99
23+
fi
24+
25+
case $openssl_version in
26+
*"OpenSSL 0.9."*|\
27+
*"OpenSSL 1."*)
28+
echo "$openssl_version is not impacted" >&2
29+
exit 77
30+
;;
31+
esac
32+
# NOTE OpenSSL > 1.*
33+
34+
35+
# find a PKCS#11 provider
36+
p11_find_provider() {
37+
if test -z "$PROV_PKCS11" ; then
38+
39+
# try to extract path ...
40+
moduledir=`openssl version -m 2>/dev/null \
41+
| sed -e 's/^MODULESDIR: "//' -e 's/"$//'`
42+
if test -z "$moduledir" ; then
43+
echo "cannot determine OpenSSL MODULESDIR" >&2
44+
exit 99
45+
fi
46+
if test -d "$moduledir" ; then :
47+
else
48+
echo "does not exist MODULESDIR: $moduledir" >&2
49+
exit 99
50+
fi
51+
52+
for N in pkcs11 libpkcs11 ; do
53+
for S in so dll ; do
54+
test -f "$moduledir"/$N.$S || continue
55+
PROV_PKCS11="$moduledir"/$N.$S
56+
break
57+
done
58+
test -n "$PROV_PKCS11" && break
59+
done
60+
test -n "$PROV_PKCS11"
61+
else
62+
test -f "$PROV_PKCS11"
63+
fi
64+
}
65+
66+
if p11_find_provider ; then :
67+
else
68+
echo "error: PKCS#11 provider not found" >&2
69+
exit 77
70+
fi
71+
72+
73+
P11MODULE=
74+
D=`cd ../../lib/.libs/; pwd`
75+
for S in so dll ; do
76+
for F in "$D"/*softhsm2.$S ; do
77+
test -f "$F" || continue
78+
P11MODULE="$F"
79+
break
80+
done
81+
test -n "$P11MODULE" && break
82+
done
83+
if test -z "$P11MODULE" ; then
84+
echo "error: unexpected module suffix" >&2
85+
exit 1
86+
fi
87+
if command -v realpath > /dev/null ; then
88+
P11MODULE=`realpath $P11MODULE`
89+
fi
90+
91+
softhsm2_tool() {
92+
"$CWD"/softhsm2-util --module "$P11MODULE" ${1+"$@"}
93+
}
94+
95+
96+
# configurations
97+
TOKEN_DIR="$CWD"/tokens
98+
rm -rf "$TOKEN_DIR"
99+
mkdir "$TOKEN_DIR"
100+
101+
102+
OPENSSL_CONF="$TOKEN_DIR"/openssl.conf
103+
cat > "$OPENSSL_CONF" <<EOF
104+
openssl_conf = config
105+
106+
[ config ]
107+
providers = provider_section
108+
109+
[ provider_section ]
110+
default = default_section
111+
provider1 = provider1_section
112+
113+
[default_section]
114+
activate = 1
115+
116+
[provider1_section]
117+
pkcs11-module-path = $P11MODULE
118+
module = $PROV_PKCS11
119+
activate = 1
120+
EOF
121+
export OPENSSL_CONF
122+
123+
124+
SOFTHSM2_CONF="$TOKEN_DIR"/softhsm2.conf
125+
cat > "$SOFTHSM2_CONF" <<EOF
126+
directories.tokendir = $TOKEN_DIR
127+
objectstore.backend = file
128+
slots.removable = false
129+
slots.mechanisms = ALL
130+
log.level = ERROR
131+
EOF
132+
export SOFTHSM2_CONF
133+
134+
135+
# execution
136+
set -e
137+
138+
TOKEN_PIN=4321
139+
TOKEN_ID=01
140+
PASS_URI=pass:$TOKEN_PIN
141+
PASS_FILE=pass:
142+
KEY_URI=pkcs11:id=%$TOKEN_ID
143+
KEY_FILE="$TOKEN_DIR"/test_key
144+
SIGN_FILE="$TOKEN_DIR"/test_sign
145+
146+
softhsm2_tool --init-token --label test0 --slot free --so-pin 12345678 --pin $TOKEN_PIN
147+
openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out "$KEY_FILE" -pass $PASS_FILE
148+
softhsm2_tool --import "$KEY_FILE" --import-type keypair --id $TOKEN_ID --label test_key --token test0 --pin $TOKEN_PIN
149+
150+
#openssl storeutl -passin "$PASS_URI" "$KEY_URI"
151+
152+
# sample command that crash before workaround due to OpenSSL "at_exit" flaw
153+
openssl pkeyutl -sign -inkey $KEY_URI -passin $PASS_URI -rawin -in ./Makefile -out "$SIGN_FILE"
154+
155+
# just in case
156+
openssl pkeyutl -verify -inkey "$KEY_FILE" -passin $PASS_FILE -rawin -in ./Makefile -sigfile "$SIGN_FILE"

‎src/lib/SoftHSM.cpp‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -93,6 +93,8 @@
9393
#include <unistd.h>
9494
#endif
9595

96+
bool SoftHSM::isInitialised;
97+
9698
// Initialise the one-and-only instance
9799

98100
#ifdef HAVE_CXX11

‎src/lib/SoftHSM.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -184,7 +184,7 @@ class SoftHSM
184184
#endif
185185

186186
// Is the SoftHSM PKCS #11 library initialised?
187-
bool isInitialised;
187+
static bool isInitialised;
188188
bool isRemovable;
189189

190190
SessionObjectStore* sessionObjectStore;

0 commit comments

Comments
 (0)