traxtopel
commented
1 year ago Interesting if I add -batch the seg fault no longer occurs.
Closed traxtopel closed 7 months ago
traxtopel
commented
1 year ago Interesting if I add -batch the seg fault no longer occurs.
beldmit
commented
1 year ago Could you please provide a stack trace? On Fedora it can be done via coredumpctl utility
simo5
commented
1 year ago @traxtopel if you could do this and post the reults (sanitized as needed) we can do something otherwise we do not have enough data:
> gdb --args whichever_command_crashes and its arguments
> run
after crash
> bt
(__ptr=0x5555556b4220, this=<optimized out>) at /usr/include/c++/13/bits/unique_ptr.h:100(__p=0x0, this=<optimized out>) at /usr/include/c++/13/bits/unique_ptr.h:212(__p=0x0, this=<optimized out>) at /usr/include/c++/13/bits/unique_ptr.h:510at SoftHSM.cpp:597at ../p11-kit/modules.c:1779--Type
at /usr/src/debug/pkcs11-provider-0.2-2.fc38.x86_64/src/interface.gen.c:33at /usr/src/debug/pkcs11-provider-0.2-2.fc38.x86_64/src/interface.c:357at /usr/src/debug/pkcs11-provider-0.2-2.fc38.x86_64/src/provider.c:548at crypto/stack/stack.c:426at crypto/stack/stack.c:418(freefunc=0x7ffff7bc6da0 <provider_deactivate_free>, sk=<optimized out>) at crypto/provider_core.c:199(class_index=class_index@entry=16, obj=obj@entry=0x0, ad=ad@entry=0x7ffff7e23508 <default_context_int.lto_priv+8>) at crypto/ex_data.c:402at crypto/context.c:169(status=status@entry=0, listp=<optimized out>, run_list_atexit=run_list_atexit@entry=true, run_dtors=run_dtors@entry=true) at exit.c:111Ah yes this is softhsm looping back into pkcs11provider during finalization after it already freed some internal structures. This is due to softhsm using the default openssl context instead of creating it own.
You can try to work around this issue by setting the no de-init quirk, see: https://github.com/latchset/pkcs11-provider/blob/main/docs/provider-pkcs11.7.md#pkcs11-module-quirks
There is nothing that can be done within pkcs11-provider, it is a softhsm issue. p11tool could also somewhat work around it by preventing openssl from setting an atexit handler I guess...
simo5
commented
1 year ago Actually I wonder if I could figure out if openssl has already set an atexit() handler and optionally set one in pkcs11-provider to ensure it runs before the main library one ... this could be also raised as an openssl issue, perhaps they should free providers before they do any other deinitialization ... and that could "solve" deinitialization ordering problems.
simo5
commented
7 months ago I think this is a well known crash in SoftHSM already discussed in OpenSSL itself in a loong bug report (sorry I forgot the id). The solution will have to come from SoftHSM as it is a problem with atexit and C++ deconstructors, and not something we can deal with in pkcs11-provider except for settging the no-deinit quirk which already exists.
Fedora 38 RPM : pkcs11-provider-0.2-2.fc38.x86_64
I am generating a CSR using the following code.
mkdir -p /etc/tpm2_pkcs11 [ -f /etc/tpm2_pkcs11/tpm2_pkcs11.sqlite3 ] && rm -f /etc/tpm2_pkcs11/tpm2_pkcs11.sqlite3 ||: export TSS2_LOG=fapi+NONE export USERPIN=userpin export SOPIN=sopin export TPM2TOOLS_TCTI="device:/dev/tpmrm0" export TPM2_PKCS11_TCTI="device:/dev/tpmrm0"
KEY_LABEL=KEY_LABEL TOKEN_LABEL=LABEL SUBJ="/C=US/ST=NY/L=Amsterdam/O=Acme/OU=ACME/OU=1234/CN=1234/emailAddress=bob@acme.com" tpm2_clear tpm2_ptool init tpm2_ptool addtoken --pid=1 --sopin=${SOPIN} --userpin=${USERPIN} --label=${TOKEN_LABEL} tpm2_ptool addkey --algorithm=rsa2048 --label=${TOKEN_LABEL} --key-label=${KEY_LABEL} --userpin=${USERPIN} tpm2_ptool config --key tcti --value "device:/dev/tpmrm0" --label=${TOKEN_LABEL} TOKEN=$(p11tool --list-token-urls 2> /dev/null | grep "token=${TOKEN_LABEL}") p11tool --login --list-all "${TOKEN}" --set-pin="${USERPIN}" --outfile p11tool.out [ -f p11tool.out ] && echo "created p11tool.out" PRIVATE_KEY=$(cat p11tool.out | grep private | awk '{ print $2 }') yaml_rsa0=$(tpm2_ptool export --label="${TOKEN_LABEL}" --key-label="${KEY_LABEL}" --userpin="${USERPIN}") auth_rsa0=$(echo "${yaml_rsa0}" | grep "object-auth" | cut -d' ' -f2-)
Using tpm2-openssl as the provider I can generate a csr. Using the following code. openssl req -new -provider tpm2 -propquery '?provider=tpm2' -key "${KEY_LABEL}.pem" -passin "pass:${auth_rsa0}" -subj "${SUBJ}" -out tpm2-openssl.csr
Using pkcs11-provider it generates a csr file. However I am seeing a segmentation fault. Maybe my syntax is incorrect, any guidance would be appreciated. openssl req -new -provider pkcs11 -propquery '?provider=pkcs11' -key "pkcs11:token=${TOKEN_LABEL};object=${KEY_LABEL};type=private;pin-value=${USERPIN}" -subj "${SUBJ}" -out "pkcs11-provider.csr" Segmentation fault (core dumped)