Log in slots with CKF_USER_PIN_INITIALIZED and not CKF_LOGIN_REQUIRED

Fixes: #123 (for OpenSSL build)
Signed-off-by: David Woodhouse <dwmw2@infradead.org>

diff --git a/openssl-pkcs11.c b/openssl-pkcs11.c
index 0ba6b16363b48cd9aa2436c7f8dba81ac21e7a6c..171d65a86250765d4aaeb25f5a57d67e89d78e66 100644 (file)
--- a/openssl-pkcs11.c
+++ b/openssl-pkcs11.c
@@ -381,7 +381,7 @@ int load_pkcs11_certificate(struct openconnect_info *vpninfo)
        }
        /* If there was precisely one matching slot, and we still didn't find the cert,
           try logging in to it. */
-       if (matching_slots == 1 && login_slot->token->loginRequired) {
+       if (matching_slots == 1 && (login_slot->token->loginRequired || login_slot->token->userPinSet)) {
                slot = login_slot;
                vpn_progress(vpninfo, PRG_INFO,
                             _("Logging in to PKCS#11 slot '%s'\n"),
@@ -615,7 +615,7 @@ int load_pkcs11_key(struct openconnect_info *vpninfo)
                login_slot = vpninfo->pkcs11_cert_slot;
                vpninfo->pkcs11_cert_slot = NULL;
        }
-       if (matching_slots == 1 && login_slot->token->loginRequired) {
+       if (matching_slots == 1 && (login_slot->token->loginRequired || login_slot->token->userPinSet)) {
                slot = login_slot;
                vpn_progress(vpninfo, PRG_INFO,
                             _("Logging in to PKCS#11 slot '%s'\n"),

diff --git a/tests/Makefile.am b/tests/Makefile.am
index ba7b88f74fdb311475ed2c39192b55b5645e0338..4645fe45e64759fb6b99207ae1f818835c1cf09c 100644 (file)
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -69,6 +69,10 @@ if OPENCONNECT_GNUTLS
 # the certs after we log in. Perhaps it's cached the results?
 PKCS11_TOKENS += openconnect-test2
 endif # OPENCONNECT_GNUTLS
+if OPENCONNECT_OPENSSL
+# GnuTLS build fails this one: https://gitlab.com/gnutls/gnutls/-/issues/977
+PKCS11_TOKENS += openconnect-test3
+endif # OPENCONNECT_OPENSSL
 endif # TEST_PKCS11
 endif # HAVE_CWRAP
 
@@ -258,3 +262,33 @@ softhsm-setup2:
                   --load-privkey $(certsdir)/ec-key-pkcs8.pem \
                   --label EC --id 03 --login \
                   --write "pkcs11:token=openconnect-test2;pin-value=1234"
+
+# Fourth test: token lacks CKF_LOGIN_REQUIRED (#123)
+softhsm-setup3:
+       $(SHM2_UTIL) --show-slots
+       $(SHM2_UTIL) --init-token --free --label openconnect-test3 \
+               --so-pin 12345678 --pin 1234
+
+# Remove the CKF_LOGIN_REQUIRED flag
+       TOKOBJ=$$(grep -l openconnect-test3 $(srcdir)/softhsm/*/token.object); \
+       if [ -n "$$TOKOBJ" ] && od -t x1 $$TOKOBJ | grep -q '^0000160.* 04 2d$$'; then \
+               echo -en \\x29 | dd bs=1 count=1 conv=notrunc seek=127 of=$$TOKOBJ; \
+       else \
+               echo "Token file not understood"; \
+               exit 1; \
+       fi
+
+       $(P11TOOL) --load-certificate $(certsdir)/user-cert.pem \
+                  --load-privkey $(certsdir)/user-key-pkcs8.pem \
+                  --label RSA --id 01 --login \
+                  --write "pkcs11:token=openconnect-test3;pin-value=1234"
+
+       $(P11TOOL) --load-certificate $(certsdir)/dsa-cert.pem \
+                  --load-privkey $(certsdir)/dsa-key-pkcs8.pem \
+                  --label DSA --id 02 --login \
+                  --write "pkcs11:token=openconnect-test3;pin-value=1234"
+
+       $(P11TOOL) --load-certificate $(certsdir)/ec-cert.pem \
+                  --load-privkey $(certsdir)/ec-key-pkcs8.pem \
+                  --label EC --id 03 --login \
+                  --write "pkcs11:token=openconnect-test3;pin-value=1234"

diff --git a/tests/softhsm/e0a4adf3-068e-288d-1c53-a97935ad11e7/2da91be2-c722-1e38-acb9-d42aa5911b3b.lock b/tests/softhsm/e0a4adf3-068e-288d-1c53-a97935ad11e7/2da91be2-c722-1e38-acb9-d42aa5911b3b.lock
new file mode 100644 (file)
index 0000000..e69de29

diff --git a/tests/softhsm/e0a4adf3-068e-288d-1c53-a97935ad11e7/2da91be2-c722-1e38-acb9-d42aa5911b3b.object b/tests/softhsm/e0a4adf3-068e-288d-1c53-a97935ad11e7/2da91be2-c722-1e38-acb9-d42aa5911b3b.object
new file mode 100644 (file)
index 0000000..d63cabb
Binary files /dev/null and b/tests/softhsm/e0a4adf3-068e-288d-1c53-a97935ad11e7/2da91be2-c722-1e38-acb9-d42aa5911b3b.object differ

diff --git a/tests/softhsm/e0a4adf3-068e-288d-1c53-a97935ad11e7/53c2b10f-0c5e-de1d-2d1e-22fd048e3d70.lock b/tests/softhsm/e0a4adf3-068e-288d-1c53-a97935ad11e7/53c2b10f-0c5e-de1d-2d1e-22fd048e3d70.lock
new file mode 100644 (file)
index 0000000..e69de29

diff --git a/tests/softhsm/e0a4adf3-068e-288d-1c53-a97935ad11e7/53c2b10f-0c5e-de1d-2d1e-22fd048e3d70.object b/tests/softhsm/e0a4adf3-068e-288d-1c53-a97935ad11e7/53c2b10f-0c5e-de1d-2d1e-22fd048e3d70.object
new file mode 100644 (file)
index 0000000..7f60141
Binary files /dev/null and b/tests/softhsm/e0a4adf3-068e-288d-1c53-a97935ad11e7/53c2b10f-0c5e-de1d-2d1e-22fd048e3d70.object differ

diff --git a/tests/softhsm/e0a4adf3-068e-288d-1c53-a97935ad11e7/6795319c-f776-6faa-b1d7-3878b9096eff.lock b/tests/softhsm/e0a4adf3-068e-288d-1c53-a97935ad11e7/6795319c-f776-6faa-b1d7-3878b9096eff.lock
new file mode 100644 (file)
index 0000000..e69de29

diff --git a/tests/softhsm/e0a4adf3-068e-288d-1c53-a97935ad11e7/6795319c-f776-6faa-b1d7-3878b9096eff.object b/tests/softhsm/e0a4adf3-068e-288d-1c53-a97935ad11e7/6795319c-f776-6faa-b1d7-3878b9096eff.object
new file mode 100644 (file)
index 0000000..e1ecdf3
Binary files /dev/null and b/tests/softhsm/e0a4adf3-068e-288d-1c53-a97935ad11e7/6795319c-f776-6faa-b1d7-3878b9096eff.object differ

diff --git a/tests/softhsm/e0a4adf3-068e-288d-1c53-a97935ad11e7/9bf49199-36eb-ac67-8fee-644f9a743af2.lock b/tests/softhsm/e0a4adf3-068e-288d-1c53-a97935ad11e7/9bf49199-36eb-ac67-8fee-644f9a743af2.lock
new file mode 100644 (file)
index 0000000..e69de29

diff --git a/tests/softhsm/e0a4adf3-068e-288d-1c53-a97935ad11e7/9bf49199-36eb-ac67-8fee-644f9a743af2.object b/tests/softhsm/e0a4adf3-068e-288d-1c53-a97935ad11e7/9bf49199-36eb-ac67-8fee-644f9a743af2.object
new file mode 100644 (file)
index 0000000..3b9c194
Binary files /dev/null and b/tests/softhsm/e0a4adf3-068e-288d-1c53-a97935ad11e7/9bf49199-36eb-ac67-8fee-644f9a743af2.object differ

diff --git a/tests/softhsm/e0a4adf3-068e-288d-1c53-a97935ad11e7/a273d1ac-570a-d217-b4b1-a8d7ed34203c.lock b/tests/softhsm/e0a4adf3-068e-288d-1c53-a97935ad11e7/a273d1ac-570a-d217-b4b1-a8d7ed34203c.lock
new file mode 100644 (file)
index 0000000..e69de29

diff --git a/tests/softhsm/e0a4adf3-068e-288d-1c53-a97935ad11e7/a273d1ac-570a-d217-b4b1-a8d7ed34203c.object b/tests/softhsm/e0a4adf3-068e-288d-1c53-a97935ad11e7/a273d1ac-570a-d217-b4b1-a8d7ed34203c.object
new file mode 100644 (file)
index 0000000..8e9ba97
Binary files /dev/null and b/tests/softhsm/e0a4adf3-068e-288d-1c53-a97935ad11e7/a273d1ac-570a-d217-b4b1-a8d7ed34203c.object differ

diff --git a/tests/softhsm/e0a4adf3-068e-288d-1c53-a97935ad11e7/ea59535b-eecb-e2fd-a6e3-99d828e5972f.lock b/tests/softhsm/e0a4adf3-068e-288d-1c53-a97935ad11e7/ea59535b-eecb-e2fd-a6e3-99d828e5972f.lock
new file mode 100644 (file)
index 0000000..e69de29

diff --git a/tests/softhsm/e0a4adf3-068e-288d-1c53-a97935ad11e7/ea59535b-eecb-e2fd-a6e3-99d828e5972f.object b/tests/softhsm/e0a4adf3-068e-288d-1c53-a97935ad11e7/ea59535b-eecb-e2fd-a6e3-99d828e5972f.object
new file mode 100644 (file)
index 0000000..a9ae8fc
Binary files /dev/null and b/tests/softhsm/e0a4adf3-068e-288d-1c53-a97935ad11e7/ea59535b-eecb-e2fd-a6e3-99d828e5972f.object differ

diff --git a/tests/softhsm/e0a4adf3-068e-288d-1c53-a97935ad11e7/generation b/tests/softhsm/e0a4adf3-068e-288d-1c53-a97935ad11e7/generation
new file mode 100644 (file)
index 0000000..379d85c
Binary files /dev/null and b/tests/softhsm/e0a4adf3-068e-288d-1c53-a97935ad11e7/generation differ

diff --git a/tests/softhsm/e0a4adf3-068e-288d-1c53-a97935ad11e7/token.lock b/tests/softhsm/e0a4adf3-068e-288d-1c53-a97935ad11e7/token.lock
new file mode 100644 (file)
index 0000000..e69de29

diff --git a/tests/softhsm/e0a4adf3-068e-288d-1c53-a97935ad11e7/token.object b/tests/softhsm/e0a4adf3-068e-288d-1c53-a97935ad11e7/token.object
new file mode 100644 (file)
index 0000000..dd6294b
Binary files /dev/null and b/tests/softhsm/e0a4adf3-068e-288d-1c53-a97935ad11e7/token.object differ

diff --git a/www/changelog.xml b/www/changelog.xml
index b3a96c0c7d723f1191934c818c5136fe484f95e0..ba0c2b53f4a58df719913dc991fc5dcf98bdcf6b 100644 (file)
--- a/www/changelog.xml
+++ b/www/changelog.xml
@@ -27,6 +27,7 @@
        <li>Fix crash with uninitialised OIDC token.</li>
        <li>GlobalProtect: more resilient handling of periodic HIP check and login arguments, and predictable naming of challenge forms</li>
        <li>Disable <a href="https://en.wikipedia.org/wiki/Nagle's_algorithm">Nagle's algorithm</a> for TLS sockets, to improve interactivity when tunnel runs over TCP rather than UDP.</li>
+       <li>Work around PKCS#11 tokens which forget to set <tt>CKF_LOGIN_REQUIRED</tt> (<a href="https://gitlab.com/openconnect/openconnect/issues/123">#123</a>).</li>
      </ul><br/>
   </li>
   <li><b><a href="ftp://ftp.infradead.org/pub/openconnect/openconnect-8.07.tar.gz">OpenConnect v8.07</a></b>