p11-glue / p11-kit

Provides a way to load and enumerate PKCS#11 modules.
https://p11-glue.github.io/p11-glue/p11-kit.html
Other
150 stars 92 forks source link

`p11-kit list-modules` lists multiple URL entries for the same token with different query attributes #556

Closed ueno closed 12 months ago

ueno commented 12 months ago

Steps to reproduce:

$ cat softhsm2.conf
directories.tokendir = /tmp/softhsm/
$ mkdir /tmp/softhsm
$ export SOFTHSM2_CONF=$PWD/softhsm2.conf
$ softhsm2-util --init-token --free --label test
$ p11tool --list-tokens
Token 0:
    URL: pkcs11:model=p11-kit-trust;manufacturer=PKCS%2311%20Kit;serial=1;token=System%20Trust
    Label: System Trust
    Type: Trust module
    Flags: uPIN uninitialized
    Manufacturer: PKCS#11 Kit
    Model: p11-kit-trust
    Serial: 1
    Module: p11-kit-trust.so

Token 1:
    URL: pkcs11:model=p11-kit-trust;manufacturer=PKCS%2311%20Kit;serial=1;token=Default%20Trust
    Label: Default Trust
    Type: Trust module
    Flags: uPIN uninitialized
    Manufacturer: PKCS#11 Kit
    Model: p11-kit-trust
    Serial: 1
    Module: p11-kit-trust.so

Token 2:
    URL: pkcs11:model=SoftHSM%20v2;manufacturer=SoftHSM%20project;serial=bf507779ef856d30;token=test
    Label: test
    Type: Generic token
    Flags: RNG, Requires login
    Manufacturer: SoftHSM project
    Model: SoftHSM v2
    Serial: bf507779ef856d30
    Module: /usr/lib64/pkcs11/libsofthsm2.so
$ p11-kit list-modules | grep uri | grep -i softhsm
    uri: pkcs11:library-description=Implementation%20of%20PKCS11;library-manufacturer=SoftHSM?module-name=softhsm2&module-path=%2Fusr%2Flib64%2Fpkcs11%2Flibsofthsm2.so
        uri: pkcs11:model=SoftHSM%20v2;manufacturer=SoftHSM%20project;serial=bf507779ef856d30;token=test?module-name=softhsm2&module-path=%2Fusr%2Flib64%2Fpkcs11%2Flibsofthsm2.so
        uri: pkcs11:model=SoftHSM%20v2;manufacturer=SoftHSM%20project;serial=;token=?module-name=softhsm2&module-path=%2Fusr%2Flib64%2Fpkcs11%2Flibsofthsm2.so

As you see, the last coulple of URIs are only different in the presence of module-path, which is a query attribute (not a path attribute) and should be aggregated.

ueno commented 12 months ago

This might be actually an issue in p11tool (GnuTLS), as the second token (with empty label) exists but not initialized.