C_Login: fix segfault when user pin not setup

A command like:
pkcs11-tool --module /usr/lib/libtpm2_pkcs11.so --init-token --label tpmhsm --so-pin foo --pin bar

Will cause a C_Login event because --pin is specified. However, C_InitPIN
has not been called to initialize the userpin. This causes an NPD when
trying to load the user sealobjects public and private blobs.

Fixes: #563
Signed-off-by: William Roberts <william.c.roberts@intel.com>

src/lib/session_ctx.c

@@ -266,6 +266,15 @@ CK_RV session_ctx_login(session_ctx *ctx, CK_USER_TYPE user, CK_BYTE_PTR pin, CK
         return CKR_OK;
     }
 
+    sealobject *sealobj = &tok->sealobject;
+    twist sealpub = is_user(user) ? sealobj->userpub : sealobj->sopub;
+    twist sealpriv = is_user(user) ? sealobj->userpriv : sealobj->sopriv;
+
+    /* Detect if PIN has not been set and thus missing the respective user seal object */
+    if (!sealpub) {
+        LOGE("User pin is not initialized, call C_InitPIN");
+        return CKR_USER_PIN_NOT_INITIALIZED;
+    }
 
     CK_RV tmp = tpm_session_start(tok->tctx, tok->pobject.objauth, tok->pobject.handle);
     if (tmp != CKR_OK) {
@@ -275,10 +284,6 @@ CK_RV session_ctx_login(session_ctx *ctx, CK_USER_TYPE user, CK_BYTE_PTR pin, CK
     on_error_flush_session = true;
 
     /* load seal object */
-    sealobject *sealobj = &tok->sealobject;
-    twist sealpub = is_user(user) ? sealobj->userpub : sealobj->sopub;
-    twist sealpriv = is_user(user) ? sealobj->userpriv : sealobj->sopriv;
-
     uint32_t pobj_handle = tok->pobject.handle;
     twist pobjauth = tok->pobject.objauth;
 

test/integration/pkcs-login-logout.int.c

@@ -661,6 +661,70 @@ static void test_double_init_token(void **state) {
 	assert_int_equal(rv, CKR_DEVICE_ERROR);
 }
 
+static void test_init_token(void **state) {
+    UNUSED(state);
+
+    CK_SLOT_ID slots[10];
+    CK_ULONG slot_cnt = ARRAY_LEN(slots);
+
+    CK_RV rv = C_GetSlotList (CK_TRUE, slots, &slot_cnt);
+    assert_int_equal(rv, CKR_OK);
+
+    bool found = false;
+    CK_SLOT_ID slot = 0;
+    CK_ULONG i;
+    for (i=0; i < slot_cnt; i++) {
+        CK_SLOT_ID s = slots[i];
+
+        CK_TOKEN_INFO info = { 0 };
+        rv = C_GetTokenInfo (s, &info);
+        assert_int_equal(rv, CKR_OK);
+
+        if (!(info.flags & CKF_TOKEN_INITIALIZED)) {
+            found = true;
+            slot = s;
+            break;
+        }
+        /* keep looking */
+    }
+
+    /* We better find an empty slot, or something is broken */
+    assert_int_equal(found, true);
+
+    /* Initialize a token */
+    unsigned char sopin[] = GOOD_SOPIN;
+    CK_BYTE label[32 + 1] = "mynewtoken42                    ";
+    rv = C_InitToken(slot, sopin, sizeof(sopin) - 1, label);
+    assert_int_equal(rv, CKR_OK);
+
+    /*
+     * Verify that we cannot do a USER login until pin is initialized
+     * Bug: https://github.com/tpm2-software/tpm2-pkcs11/issues/563
+     */
+    CK_SESSION_HANDLE session = 0;
+    rv = C_OpenSession(slot, CKF_SERIAL_SESSION|CKF_RW_SESSION, NULL, NULL, &session);
+    assert_int_equal(rv, CKR_OK);
+
+    rv = C_Login(session, CKU_USER, C("anypin"), 6);
+    assert_int_equal(rv, CKR_USER_PIN_NOT_INITIALIZED);
+
+    /* establish R/W SO Functions login state */
+    rv = C_Login(session, CKU_SO, sopin, sizeof(sopin) - 1);
+    assert_int_equal(rv, CKR_OK);
+
+    /* Initialize the Pin */
+    const char userpin[] = GOOD_USERPIN;
+    rv = C_InitPIN(session, C(userpin), sizeof(userpin) - 1);
+    assert_int_equal(rv, CKR_OK);
+
+    /* logout of the SO session */
+    rv = C_Logout(session);
+    assert_int_equal(rv, CKR_OK);
+
+    user_login(session);
+    logout(session);
+}
+
 int main() {
 
     const struct CMUnitTest tests[] = {
@@ -720,6 +784,7 @@ int main() {
         /* These work on new tokens via slots and thus don't matter the order */
         cmocka_unit_test_setup_teardown(test_double_init_token,
                 test_setup_ro, test_teardown),
+        cmocka_unit_test(test_init_token),
     };
 
     return cmocka_run_group_tests(tests, _group_setup_locking, _group_teardown);