From 2330c4e5abbfdb57bf4a17b152c602ffb372f281 Mon Sep 17 00:00:00 2001 From: William Roberts Date: Fri, 31 Jul 2020 11:28:40 -0500 Subject: [PATCH] C_Login: fix segfault when user pin not setup A command like: pkcs11-tool --module /usr/lib/libtpm2_pkcs11.so --init-token --label tpmhsm --so-pin foo --pin bar Will cause a C_Login event becuase --pin is specified. However, C_InitPIN has not been called to initialize the userpin. This causes an NPD when trying to load the user sealobjects public and private blobs. Fixes: #563 Signed-off-by: William Roberts --- src/lib/session_ctx.c | 13 +++++++++---- test/integration/pkcs11-tool-init.sh.nosetup | 12 ++++++++++++ 2 files changed, 21 insertions(+), 4 deletions(-) diff --git a/src/lib/session_ctx.c b/src/lib/session_ctx.c index 8df7154a..d23b3b91 100644 --- a/src/lib/session_ctx.c +++ b/src/lib/session_ctx.c @@ -266,6 +266,15 @@ CK_RV session_ctx_login(session_ctx *ctx, CK_USER_TYPE user, CK_BYTE_PTR pin, CK return CKR_OK; } + sealobject *sealobj = &tok->sealobject; + twist sealpub = is_user(user) ? sealobj->userpub : sealobj->sopub; + twist sealpriv = is_user(user) ? sealobj->userpriv : sealobj->sopriv; + + /* Detect if PIN has not been set and thus missing the respective user seal object */ + if (!sealpub) { + LOGE("User pin is not initialized, call C_InitPIN"); + return CKR_USER_PIN_NOT_INITIALIZED; + } CK_RV tmp = tpm_session_start(tok->tctx, tok->pobject.objauth, tok->pobject.handle); if (tmp != CKR_OK) { @@ -275,10 +284,6 @@ CK_RV session_ctx_login(session_ctx *ctx, CK_USER_TYPE user, CK_BYTE_PTR pin, CK on_error_flush_session = true; /* load seal object */ - sealobject *sealobj = &tok->sealobject; - twist sealpub = is_user(user) ? sealobj->userpub : sealobj->sopub; - twist sealpriv = is_user(user) ? sealobj->userpriv : sealobj->sopriv; - uint32_t pobj_handle = tok->pobject.handle; twist pobjauth = tok->pobject.objauth; diff --git a/test/integration/pkcs11-tool-init.sh.nosetup b/test/integration/pkcs11-tool-init.sh.nosetup index 623479b3..b02cbac2 100755 --- a/test/integration/pkcs11-tool-init.sh.nosetup +++ b/test/integration/pkcs11-tool-init.sh.nosetup @@ -82,4 +82,16 @@ fi pkcs11_tool --slot-index=0 --login --pin=mynewuserpin --read-object --type data --label dataobj1 -o objdata2 cmp objdata objdata2 +# +# Negative test, ensure that this fails +# +trap - ERR + +# Reproduce https://github.com/tpm2-software/tpm2-pkcs11/issues/563 +pkcs11_tool --slot-index=1 --init-token --label tpmhsm --so-pin foo --pin bar +if [ $? -eq 0 ]; then + echo "Expected login to fail without user pin set" + exit 1 +fi + exit 0