Precompiled .so does not seem to work

hongkongkiwi commented 3 years ago

Following instructions and using the pre-compiled module gives these errors:

osslsigncode sign -verbose -h sha256     -pkcs11engine /usr/lib/x86_64-linux-gnu/engines-1.1/pkcs11.so     -pkcs11module /usr/lib/x86_64-linux-gnu/pkcs11/aws_kms_pkcs11.so     -certs mycert.pem -key 'pkcs11:' -in /etc/hosts -out /tmp/hosts.signed
Engine "pkcs11" set.
Unable to load module /usr/lib/x86_64-linux-gnu/pkcs11/aws_kms_pkcs11.so
Unable to load module /usr/lib/x86_64-linux-gnu/pkcs11/aws_kms_pkcs11.so
PKCS11_get_private_key returned NULL
Failed to load private key pkcs11:
140102532925248:error:81065401:libp11:pkcs11_CTX_load:Unable to load PKCS#11 module:p11_load.c:77:
140102532925248:error:26096080:engine routines:ENGINE_load_private_key:failed loading private key:../crypto/engine/eng_pkey.c:78:
Failed

ssh-add produces the following error:

ssh-add -s /usr/lib/x86_64-linux-gnu/pkcs11/aws_kms_pkcs11.so
Enter passphrase for PKCS#11:
Could not add card "/usr/lib/x86_64-linux-gnu/pkcs11/aws_kms_pkcs11.so": agent refused operation

The module is available and I have chmod +x:

ls -lh /usr/lib/x86_64-linux-gnu/pkcs11/aws_kms_pkcs11.so
-rwxr-xr-x 1 root root 3.8M Feb 27 05:45 /usr/lib/x86_64-linux-gnu/pkcs11/aws_kms_pkcs11.so

The config is available here:

cat /etc/aws-kms-pkcs11/config.json
{
  "kms_key_id": "xxxx-xxxxx-xxxxxx-xxxxx-xxxxxxxx",
  "aws_region": "us-west-1"
}

Any ideas what could cause this error? I couldn't find a way to get better debug information about what hte problem is.

JackOfMostTrades commented 3 years ago

Hmm, the above looks right to me. Can you run ldd /usr/lib/x86_64-linux-gnu/pkcs11/aws_kms_pkcs11.so to check that all of the expected dependencies are available? Assuming that doesn't yield anything obvious I'll throw in some extra debug lines and hopefully that will give us some clues.

JackOfMostTrades commented 3 years ago

I just added a few debug lines and did a release if you want to try testing with it. FWIW here's what it looks like in my environment:

$ AWS_KMS_PKCS11_DEBUG=1 osslsigncode sign -h sha256 -pkcs11engine /usr/lib/x86_64-linux-gnu/engines-1.1/pkcs11.so     -pkcs11module /usr/lib/x86_64-linux-gnu/pkcs11/aws_kms_pkcs11.so -certs mycert.pem -key 'pkcs11:' -in foo.exe -out foo-signed.exe
AWS_KMS: Debug enabled.
AWS_KMS: Attempting to load config from path: /etc/aws-kms-pkcs11/config.json
AWS_KMS: Attempting to load config from path: /home/ihaken/.config/aws-kms-pkcs11/config.json
AWS_KMS: Skipping config because we couldn't open the file.
AWS_KMS: Configured to use AWS key: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
AWS_KMS: Configured to use AWS region: us-east-1
AWS_KMS: Successfully fetched public key data.
AWS_KMS: Successfully called KMS to do a signing operation.
Succeeded

Install:

$ cat /etc/aws-kms-pkcs11/config.json 
{
  "kms_key_id": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
  "aws_region": "us-east-1"
}
$ ls -lh /usr/lib/x86_64-linux-gnu/pkcs11/aws_kms_pkcs11.so 
-rwxr-xr-x 1 root root 3.8M May 29 13:56 /usr/lib/x86_64-linux-gnu/pkcs11/aws_kms_pkcs11.so

hongkongkiwi commented 3 years ago

Resolved.

o6uoq commented 1 month ago

Resolved.

How did you resolve this @hongkongkiwi ?

JackOfMostTrades / aws-kms-pkcs11

Precompiled .so does not seem to work #3