Opened 12 months ago

Closed 6 weeks ago

#1453 closed Feature Wish (notabug)

Feature request: Add ability to specify initialize flags for pkcs11 provider

Reported by: lo1ol Owned by: Selva Nair
Priority: major Milestone: release 2.6
Component: Crypto Version:
Severity: Not set (select this one, unless your'e a OpenVPN developer) Keywords: pkcs11 smart-card pkcs11-helper
Cc:

Description

Hi! I previously written to you here about this feature. I can reformat my code as required, but firstly I want to get some feedback about changes at all.

Required changes is possible, because new version of pkcs11-helper released, which supports this feature.

This allows to resolves openvpn bug, linked with using pkcs11 args in multithread app without initialization pkcs11 library with CKF_OS_LOCKING_OK flag.

Change History (5)

comment:1 Changed 12 months ago by Gert Döring

Owner: changed from Steffan Karger to snair
Status: newassigned

comment:2 Changed 12 months ago by Gert Döring

Owner: changed from snair to Selva Nair

comment:3 Changed 12 months ago by Gert Döring

@selva, I have too little overview on pkcs#11 topics. Can you enlighten me on what we have, what we want, ...? thanks :-)

comment:4 Changed 4 months ago by Selva Nair

For cross-reference, this is what I wrote few months back in response to the corresponding patch in the ML https://sourceforge.net/p/openvpn/mailman/openvpn-devel/thread/20210930113308.815777-1-mkh199740@mail.ru/ -- somehow this patch is not in patchwork.

I don't quite understand the need for exposing "init-args" to the user. 
The only two supported flags in the cryptoki docs are related to the use 
of threads. But we are the application and we should know what flags to 
pass --- not the user --- isn't it? If CKF_OS_LOCKING_OK is required, 
can't we just set it unconditionally?
 
That said, OpenVPN2 is single threaded, so why is there a "bug in 
openvpn" related to the use of pkcs11 library from multiple threads 
referred to here?

I haven't seen any response to that. I'm not aware of any bug related to multi-threaded use in OpenVPN 2. We have forking related issues but, AFAICT, that is unrelated.

comment:5 Changed 6 weeks ago by Gert Döring

Resolution: notabug
Status: assignedclosed

Closing this due to unclear motivation for the patch, and no feedback.

Note: See TracTickets for help on using tickets.