search

p11-glue / p11-kit

Provides a way to load and enumerate PKCS#11 modules.
https://p11-glue.github.io/p11-glue/p11-kit.html
Other
149 stars 91 forks source link

[RFE] Bad module with C_GetInterface returning 0x54 - fallback to C_GetFunctionList #621

Closed space88man closed 5 months ago

space88man commented 6 months ago 
p11-kit: call to C_GetInterface failed in module: /usr/lib64/pkcs11/../../lib/libCryptoki2_64.so: This operation is not supported

I have a module that exports C_GetInterfaceList and C_GetInterface and returns 0x54, so p11-kit-proxy will error out.

RFE: In this case could we still fallback to C_GetFunctionList like pkcs11-spy or make this configurable.

The module works when wrapped by pkcs11-spy, though which seems to be more forgiving.

The module in question is Luna HSM v10.5.

When p11-kit calls C_GetInterface it checks for CKR_OK, perhaps it could also check for CKR_FUNCTION_NOT_SUPPORTED and bail out to C_GetFunctionList in that case.

ZoltanFridrich commented 6 months ago

Thank you for the RFE. Perhaps there could be a fallback to C_GetFunctionList in case C_GetInterface is not supported. We will look into it.

ZoltanFridrich commented 5 months ago

This has been done in https://github.com/p11-glue/p11-kit/pull/622