search

opendnssec / SoftHSMv2

SoftHSM version 2
http://www.softhsm.org/
Other
767 stars 340 forks source link

Emulate token remove/insert #370

Open alonbl opened 6 years ago

alonbl commented 6 years ago

Hi,

It would be very helpful if softhsm supports token remove/add to test smartcard behaviour.

softhsm2-util can be used to perform eject/insert per slot# or token name.

Thanks!

bellgrim commented 6 years ago

What behaviour are you interested of having implemented? Just returning CKR_TOKEN_NOT_PRESENT when accessing a slot and CKR_SESSION_HANDLE_INVALID when a token for a given session has been removed? Implementation of C_WaitForSlotEvent()?

SoftHSMv2 is currently designed to always have a token in a slot, but pull requests are welcome.

alonbl commented 6 years ago

Hi, Runtime insert/remove with CKR_TOKEN_NOT_PRESENT/CKR_SESSION_HANDLE_INVALID are good starting point and sufficient in most cases. The C_WaitForSlotEvent() is a nice to have, it is more complex as involved threading. I tried to use softhsm as unit test for smartcard library, but then realized that I must keep the manual procedure. This functionality requires significant resources, I am unsure that I will be able to make it myself, but never say never. Thanks!

pkalapat commented 6 years ago

Are there workarounds available for unit testing softhsm? Due to the lack of support for delete token API I'm looking for alternatives. I thought of looking through config.h and deleting the token dir for each test run. But that would involve implementing the full logic like in softhsm/util. Is there any other low hanging known workaround for this

massey101 commented 5 years ago

Hey. I'm interested in implementing C_WaitForSlotEvent for SoftHSM. See https://github.com/OpenSC/OpenSC/issues/1771 for some background. I'm just planning on implementing the non-blocking case. I think most people use p11-kit and p11-kit doesn't support the blocking case, and OpenSC only supports the blocking case for recent version of pcsc-lite so I think it's fair enough.

rijswijk commented 5 years ago

I assume you'll be implementing it such that C_WaitForSlotEvent always returns the case where there is a token present?

massey101 commented 5 years ago

C_WaitForSlotEvent should return CKR_NO_EVENT regardless of the number of slots present unless there has been a change on a slot. As I'm reading through the code it appears that SoftHSM reads in the tokens when the library is initialised, assigns each of them a slot (plus an uninitialised slot), and then doesn't check again. So the only way for there to be a slot change is if the application calls C_InitToken()?

EDIT: Because the next time SlotManager::getSlotList() is called it will create a new uninitialised slot. EDIT: So basically yes. With the exception of the above.

rijswijk commented 5 years ago

That behaviour is indeed as implemented. Returning CKR_NO_EVENT in all cases is fine.

massey101 commented 5 years ago

Ah true. Since the slot (and token) is only added when SlotManager::getSlotList() is called the client presumably has an updated list of the slots and there's no point in notifying them about the event. Well that's easy.