Open LMattsson opened 6 months ago
ueno
commented
6 months ago While in theory the protocol should work with both 32-bit and 64-bit systems, it might need to assume the same data model, in which GNU/Linux (LP64) and Windows (LLP64) have some differences. That's one of the reasons why we don't enable building p11-kit-client.dll on Windows by default.
abarisani
commented
6 months ago I've experienced the following command differs whether executed on a 32-bit client or 64-bit client against the same token (with forwarded socket).
On a 32-bit the data object IDs are truncated and do not match the corresponding 64-bit value.
For example one of these objects (converted to hex) is 4159ea64efdded8d while the pkcs11-tool client looks for efdded8d (4024298893).
This makes all clients unusable on a 32-bit platform.
$ pkcs11-tool --module /usr/lib/arm-linux-gnueabihf/pkcs11/p11-kit-client.so --list-objects
Using slot 0 with a present token (0x1)
warning: PKCS11 function C_GetAttributeValue(CLASS) failed: rv = CKR_OBJECT_HANDLE_INVALID (0x82)
Data object 4024298893
label: <empty>
application: <empty>
app_id: <empty>
flags: <empty>
warning: PKCS11 function C_GetAttributeValue(CLASS) failed: rv = CKR_OBJECT_HANDLE_INVALID (0x82)
Data object 763047029
label: <empty>
application: <empty>
app_id: <empty>
flags: <empty>
warning: PKCS11 function C_GetAttributeValue(CLASS) failed: rv = CKR_OBJECT_HANDLE_INVALID (0x82)
Data object 4086046842
label: <empty>
application: <empty>
app_id: <empty>
flags: <empty>
LMattsson
commented
6 months ago @abarisani Out of curiosity, is the issue you see a recent problem or have you seen it for a longer time?
abarisani
commented
6 months ago @abarisani Out of curiosity, is the issue you see a recent problem or have you seen it for a longer time?
I am experiencing this as we speak while integrating p11-kit on a 32-bit installation using https://github.com/google/go-p11-kit as RPC server.
I think the 32-bit client is requesting a ulValueLen of 4 while the RPC server responds with 8, then the p11-kit client library is hitting CKR_BUFFER_TOO_SMALL and the object class is not being parsed correctly.
I am running p11-kit as a server on Fedora 39. For the client side, I got one client on Linux and one on Windows. Both server and clients are running p11-kit v. 0.25.3.
Note that both clients are running in a bit of a non-standard environment, and that when running directly on my regular system I do not have this problem.
When running
p11-kit list-moduleson the client side, I can see my added module on both client platforms. However, when running p11-kitlist-objects <token>, I get different results depending on the client platform.On the Linux client, things look to be in order:
On the Windows client, data for the token is missing:
To your knowledge, does p11-kit have any specific requirements for the combination of server and client platforms, e.g. not allowing mixing of 32- and 64-bit systems?