iksaif / pkcs11-proxy Goto Github PK

Dans le cadre d'une mission dans un ministère, on utilise cette lib pour un projet open source. On l'utilise aujourd'hui pour simuler un HSM dans des containeurs docker via softhsm.

Depuis peu, on souhaite l'utiliser pour taper sur un HSM sur les env de DEV. Cette bibliothèque est très utile pour faire du remote debug depuis nos postes (Windows).

La communication se fait bien entre le daemon (sous linux) et le proxy (windows). Les informations sur le slot, l'init d'une session, pas de problème :

Listening on: 0.0.0.0:80

New session 2433-16039

DEBUG: C_Initialize: enter
DEBUG: ret: 0
DEBUG: C_GetInfo: enter
DEBUG: ret: 0
...

Cependant, on rencontre des problèmes lors de l'utilisation du FindObject:
Au niveau du daemon :
DEBUG: C_FindObjectsInit: enter
DEBUG: ret: 19

Le détail de la commande via p11-spy :

****************************** 2021-01-12 14:44:40 ***
0x00003d6c : 0x00002994 : Calling C_FindObjectsInit
0x00003d6c : 0x00002994 : Input
0x00003d6c : 0x00002994 :  hSession: 16777217
0x00003d6c : 0x00002994 :  pTemplate: 000001F2626EF3F0
0x00003d6c : 0x00002994 :  ulCount: 1
0x00003d6c : 0x00002994 :   *** Begin attribute template ***
0x00003d6c : 0x00002994 :   Attribute 0
0x00003d6c : 0x00002994 :    Attribute: 0 (CKA_CLASS)
0x00003d6c : 0x00002994 :    pValue: 000001F2624DEFF0
0x00003d6c : 0x00002994 :    ulValueLen: 4
0x00003d6c : 0x00002994 :    *pValue: HEX(06000000)
0x00003d6c : 0x00002994 :   *** End attribute template ***
0x00003d6c : 0x00002994 : Returning 19 (CKR_ATTRIBUTE_VALUE_INVALID)

auriez vous une idée ? merci.

When I try:

pkcs11-tool --module=/usr/local/lib/softhsm/libsofthsm2.so -l -t --token-label token-2

Works!

But when I use libpkcs11-proxy module like:

PKCS11_PROXY_SOCKET="tcp://SoftHSM:5657" pkcs11-tool --module=/usr/local/lib/libpkcs11-proxy.so  -l -t --token-label token-2

Fails!

Hi!

It seems this has support for Windows? It would be great if it were possible to have a GitHub Action that built the win32 build every week or so to have fresh builds available for download for non-dev Windows users/machines.

(And to check while I'm here, this would allow me to forward a PIV-smartcard from Windws to my remote Linux devbox?)

We're trying to use this proxy (thanks for the work!) together with SoftHSMv2 and Graphene to encrypt using AES GCM. We started by patching the following files to allow for AES GCM support:

• added CKM_AES_GCM: in gck-rpc-util.c
• added #define CKM_AES_GCM (0x1087UL) in pkcs11/pkcs11.h

However, that yields a segfault in libsofthsm2.so at this spot. Probably it's the access of CK_GCM_PARAMS_PTR(pMechanism->pParameter)->pIv that's failing here.

Judging from the implementation we're calling C_EncryptInit with the following mechanism parameters:

{ 
  iv: <Buffer 31 32 33 34 35 36 37 38 39 30 31 32>, // that's 123456789012 in UTF-8
  ivBits: 128,
  ivLen: 12,
  aad: <Buffer >,
  aadLen: 0,
  tagBits: 128,
}

Can you/somebody give any advice or help on how we can fix or at least debug this issue?