Generate a CSR against tpm private using pkcs11 segmentation fault. #291
Comments
|
Interesting if I add -batch the seg fault no longer occurs. |
|
Could you please provide a stack trace? On Fedora it can be done via |
|
@traxtopel if you could do this and post the reults (sanitized as needed) we can do something otherwise we do not have enough data: |
|
#0 0x00007ffff7626a30 in std::default_delete::operator()(OSSLCryptoFactory*) const |
|
Ah yes this is softhsm looping back into pkcs11provider during finalization after it already freed some internal structures. You can try to work around this issue by setting the no de-init quirk, see: https://github.com/latchset/pkcs11-provider/blob/main/docs/provider-pkcs11.7.md#pkcs11-module-quirks There is nothing that can be done within pkcs11-provider, it is a softhsm issue. |
|
Actually I wonder if I could figure out if openssl has already set an atexit() handler and optionally set one in pkcs11-provider to ensure it runs before the main library one ... this could be also raised as an openssl issue, perhaps they should free providers before they do any other deinitialization ... and that could "solve" deinitialization ordering problems. |
|
I think this is a well known crash in SoftHSM already discussed in OpenSSL itself in a loong bug report (sorry I forgot the id). The solution will have to come from SoftHSM as it is a problem with atexit and C++ deconstructors, and not something we can deal with in pkcs11-provider except for settging the no-deinit quirk which already exists. |
Fedora 38
RPM : pkcs11-provider-0.2-2.fc38.x86_64
I am generating a CSR using the following code.
mkdir -p /etc/tpm2_pkcs11
[ -f /etc/tpm2_pkcs11/tpm2_pkcs11.sqlite3 ] && rm -f /etc/tpm2_pkcs11/tpm2_pkcs11.sqlite3 ||:
export TSS2_LOG=fapi+NONE
export USERPIN=userpin
export SOPIN=sopin
export TPM2TOOLS_TCTI="device:/dev/tpmrm0"
export TPM2_PKCS11_TCTI="device:/dev/tpmrm0"
KEY_LABEL=KEY_LABEL
TOKEN_LABEL=LABEL
SUBJ="/C=US/ST=NY/L=Amsterdam/O=Acme/OU=ACME/OU=1234/CN=1234/emailAddress=bob@acme.com"
tpm2_clear
tpm2_ptool init
tpm2_ptool addtoken --pid=1 --sopin=${SOPIN} --userpin=${USERPIN} --label=${TOKEN_LABEL}
tpm2_ptool addkey --algorithm=rsa2048 --label=${TOKEN_LABEL} --key-label=${KEY_LABEL} --userpin=${USERPIN}
tpm2_ptool config --key tcti --value "device:/dev/tpmrm0" --label=${TOKEN_LABEL}
TOKEN=$(p11tool --list-token-urls 2> /dev/null | grep "token=${TOKEN_LABEL}")
p11tool --login --list-all "${TOKEN}" --set-pin="${USERPIN}" --outfile p11tool.out
[ -f p11tool.out ] && echo "created p11tool.out"
PRIVATE_KEY=$(cat p11tool.out | grep private | awk '{ print $2 }')
yaml_rsa0=$(tpm2_ptool export --label="${TOKEN_LABEL}" --key-label="${KEY_LABEL}" --userpin="${USERPIN}")
auth_rsa0=$(echo "${yaml_rsa0}" | grep "object-auth" | cut -d' ' -f2-)
Using tpm2-openssl as the provider I can generate a csr. Using the following code.
openssl req -new -provider tpm2 -propquery '?provider=tpm2' -key "${KEY_LABEL}.pem" -passin "pass:${auth_rsa0}" -subj "${SUBJ}" -out tpm2-openssl.csr
Using pkcs11-provider it generates a csr file. However I am seeing a segmentation fault. Maybe my syntax is incorrect, any guidance would be appreciated.
openssl req -new -provider pkcs11 -propquery '?provider=pkcs11' -key "pkcs11:token=${TOKEN_LABEL};object=${KEY_LABEL};type=private;pin-value=${USERPIN}" -subj "${SUBJ}" -out "pkcs11-provider.csr"
Segmentation fault (core dumped)
The text was updated successfully, but these errors were encountered: