Smartcard + pkcs11 = segmentation fault...

[Sven Geggus-5]

Hello,

Im trying to enable pkcs11 support in gnutls (2.12.16).

Unfortunately I'm currently stuck with a proprietary pkcs11 library (which
however works well in firefox/thunderbird).

Here is what I have so far:

 ~/ > p11-kit -l
aet: /usr/lib/libaetpkss.so
    library-description: Cryptographic Token Interface
    library-manufacturer: A.E.T. Europe B.V.
    library-version: 3.0
    token: Fraunhofer-Smartcard
        manufacturer: A.E.T. Europe B.V.
        model: 3384110107000000
        serial-number: 00113C3800009B09
        flags:
               rng
               login-required
               user-pin-initialized
               token-initialized
 ~/ > /usr/lib/libgnutls26/p11tool --login --list-all
Token 'Fraunhofer-Smartcard' with URL
'pkcs11:model=3384110107000000;manufacturer=A.E.T.%20Europe%20B.V.;serial=00113C3800009B09;token=Fraunhofer-Smartcard'
requires user PIN
Enter PIN:
Object 0:
        URL:
pkcs11:library-description=Cryptographic%20Token%20Interface;library-manufacturer=A.E.T.%20Europe%20B.V.;model=3384110107000000;manufacturer=A.E.T.%20Europe%20B.V.;serial=00113C3800009B09;token=Fraunhofer-Smartcard;object=Secude%20Token%20ID;object-type=data
        Type: Data
        Label: Secude Token ID
Segmentation fault

Any hint?

Sven


--
The main thing to note is that when you choose open source you don't
get a Windows operating system.
                                  (from http://www.dell.com/ubuntu)
/me is giggls@ircnet, http://sven.gegg.us/ on the Web

_______________________________________________
Help-gnutls mailing list
Help-gnutls@...
https://lists.gnu.org/mailman/listinfo/help-gnutls

[Nikos Mavrogiannopoulos]

On Wed, Feb 29, 2012 at 3:19 PM, Sven Geggus
<lists@...> wrote:
> Hello,
>
> Im trying to enable pkcs11 support in gnutls (2.12.16).
> Unfortunately I'm currently stuck with a proprietary pkcs11 library (which
> however works well in firefox/thunderbird).

Hello,
 Could you try using valgrind or gdb to pinpoint the crash? Could you
also try whether that issue occurs in gnutls 3.0.14?

regards,
Nikos

_______________________________________________
Help-gnutls mailing list
Help-gnutls@...
https://lists.gnu.org/mailman/listinfo/help-gnutls

[Sven Geggus-5]

Nikos Mavrogiannopoulos <nmav@...> wrote:

> Could you try using valgrind or gdb to pinpoint the crash?

Hm, looks like the proprietary library has some issues, but also does gnutls:

(proprietary library warnings about uninitialised values skipped)

Object 0:
        URL: pkcs11:library-description=Cryptographic%20Token%20Interface;library-manufacturer=A.E.T.%20Europe%20B.V.;model=3384110107000000;manufacturer=A.E.T.%20Europe%20B.V.;serial=00113C3800009B09;token=Fraunhofer-Smartcard;object=Secude%20Token%20ID;object-type=data
        Type: Data
        Label: Secude Token ID
==19018== Invalid read of size 1
==19018==    at 0x4E653CF: _gnutls_bin2hex (gnutls_str.c:443)
==19018==    by 0x4E75D41: pkcs11_get_info (pkcs11.c:409)
==19018==    by 0x40424D: pkcs11_list (pkcs11.c:193)
==19018==    by 0x403750: main (p11tool.c:135)
==19018==  Address 0x0 is not stack'd, malloc'd or (recently) free'd
==19018==
==19018==
==19018== Process terminating with default action of signal 11 (SIGSEGV)
==19018==  Access not within mapped region at address 0x0
==19018==    at 0x4E653CF: _gnutls_bin2hex (gnutls_str.c:443)
==19018==    by 0x4E75D41: pkcs11_get_info (pkcs11.c:409)
==19018==    by 0x40424D: pkcs11_list (pkcs11.c:193)
==19018==    by 0x403750: main (p11tool.c:135)
==19018==  If you believe this happened as a result of a stack
==19018==  overflow in your program's main thread (unlikely but
==19018==  possible), you can try to increase the size of the
==19018==  main thread stack using the --main-stacksize= flag.
==19018==  The main thread stack size used in this run was 8388608.
==19018==
==19018== HEAP SUMMARY:
==19018==     in use at exit: 551,735 bytes in 1,892 blocks
==19018==   total heap usage: 14,940 allocs, 13,048 frees, 8,311,394 bytes
allocated
==19018==
==19018== LEAK SUMMARY:
==19018==    definitely lost: 4 bytes in 1 blocks
==19018==    indirectly lost: 0 bytes in 0 blocks
==19018==      possibly lost: 288 bytes in 1 blocks
==19018==    still reachable: 551,443 bytes in 1,890 blocks
==19018==         suppressed: 0 bytes in 0 blocks
==19018== Rerun with --leak-check=full to see details of leaked memory
==19018==
==19018== For counts of detected and suppressed errors, rerun with: -v
==19018== ERROR SUMMARY: 34 errors from 15 contexts (suppressed: 25 from 7)
Killed

> Could you also try whether that issue occurs in gnutls 3.0.14?

Jepp, I just compiled gnutls-3.0.14 from sources. Same Problem here.

BTW "p11tool --login --list-certs" seems to work.

Regards

Sven

--
Software patents are the software project equivalent of land mines: Each
design decision carries a risk of stepping on a patent, which can destroy
your project. (Richard M. Stallman)
/me is giggls@ircnet, http://sven.gegg.us/ on the Web

_______________________________________________
Help-gnutls mailing list
Help-gnutls@...
https://lists.gnu.org/mailman/listinfo/help-gnutls

[Nikos Mavrogiannopoulos]

To my understanding the token contains an object without an ID.
Could you add below this code (after else if (version != NULL))
http://git.savannah.gnu.org/gitweb/?p=gnutls.git;a=blob;f=lib/pkcs11.c;h=83fad64b893c0e79d26428a539a6f2ab3db13f02;hb=gnutls_2_12_x#l398
the following:
else
  {
    *output_size = 0;
    if (output) output[0] = 0;
    return 0;
  }

This would allow printing that object without crashing.

regards,
Nikos

On Thu, Mar 1, 2012 at 9:52 AM, Sven Geggus <lists@...> wrote:

> Nikos Mavrogiannopoulos <nmav@...> wrote:
>
>> Could you try using valgrind or gdb to pinpoint the crash?
>
> Hm, looks like the proprietary library has some issues, but also does gnutls:
>
> (proprietary library warnings about uninitialised values skipped)
>
> Object 0:
>        URL: pkcs11:library-description=Cryptographic%20Token%20Interface;library-manufacturer=A.E.T.%20Europe%20B.V.;model=3384110107000000;manufacturer=A.E.T.%20Europe%20B.V.;serial=00113C3800009B09;token=Fraunhofer-Smartcard;object=Secude%20Token%20ID;object-type=data
>        Type: Data
>        Label: Secude Token ID
> ==19018== Invalid read of size 1
> ==19018==    at 0x4E653CF: _gnutls_bin2hex (gnutls_str.c:443)
> ==19018==    by 0x4E75D41: pkcs11_get_info (pkcs11.c:409)
> ==19018==    by 0x40424D: pkcs11_list (pkcs11.c:193)
> ==19018==    by 0x403750: main (p11tool.c:135)
> ==19018==  Address 0x0 is not stack'd, malloc'd or (recently) free'd
> ==19018==
> ==19018==
> ==19018== Process terminating with default action of signal 11 (SIGSEGV)
> ==19018==  Access not within mapped region at address 0x0
> ==19018==    at 0x4E653CF: _gnutls_bin2hex (gnutls_str.c:443)
> ==19018==    by 0x4E75D41: pkcs11_get_info (pkcs11.c:409)
> ==19018==    by 0x40424D: pkcs11_list (pkcs11.c:193)
> ==19018==    by 0x403750: main (p11tool.c:135)
> ==19018==  If you believe this happened as a result of a stack
> ==19018==  overflow in your program's main thread (unlikely but
> ==19018==  possible), you can try to increase the size of the
> ==19018==  main thread stack using the --main-stacksize= flag.
> ==19018==  The main thread stack size used in this run was 8388608.
> ==19018==
> ==19018== HEAP SUMMARY:
> ==19018==     in use at exit: 551,735 bytes in 1,892 blocks
> ==19018==   total heap usage: 14,940 allocs, 13,048 frees, 8,311,394 bytes
> allocated
> ==19018==
> ==19018== LEAK SUMMARY:
> ==19018==    definitely lost: 4 bytes in 1 blocks
> ==19018==    indirectly lost: 0 bytes in 0 blocks
> ==19018==      possibly lost: 288 bytes in 1 blocks
> ==19018==    still reachable: 551,443 bytes in 1,890 blocks
> ==19018==         suppressed: 0 bytes in 0 blocks
> ==19018== Rerun with --leak-check=full to see details of leaked memory
> ==19018==
> ==19018== For counts of detected and suppressed errors, rerun with: -v
> ==19018== ERROR SUMMARY: 34 errors from 15 contexts (suppressed: 25 from 7)
> Killed
>
>> Could you also try whether that issue occurs in gnutls 3.0.14?
>
> Jepp, I just compiled gnutls-3.0.14 from sources. Same Problem here.
>
> BTW "p11tool --login --list-certs" seems to work.
>
> Regards
>
> Sven
>
> --
> Software patents are the software project equivalent of land mines: Each
> design decision carries a risk of stepping on a patent, which can destroy
> your project. (Richard M. Stallman)
> /me is giggls@ircnet, http://sven.gegg.us/ on the Web
>
> _______________________________________________
> Help-gnutls mailing list
> Help-gnutls@...
> https://lists.gnu.org/mailman/listinfo/help-gnutls

_______________________________________________
Help-gnutls mailing list
Help-gnutls@...
https://lists.gnu.org/mailman/listinfo/help-gnutls

[Sven Geggus-5]

Nikos Mavrogiannopoulos <nmav@...> wrote:

> To my understanding the token contains an object without an ID.
> Could you add below this code (after else if (version != NULL))
> http://git.savannah.gnu.org/gitweb/?p=gnutls.git;a=blob;f=lib/pkcs11.c;h=83fad64b893c0e79d26428a539a6f2ab3db13f02;hb=gnutls_2_12_x#l398
> the following:
> else
>  {
>    *output_size = 0;
>    if (output) output[0] = 0;
>    return 0;
>  }
>
> This would allow printing that object without crashing.

This gives a compiler error, but this slightly different Version does
compile and makes "p11tool --login --list-all" work!

 gnutls-3.0.14/ > diff -u ./lib/pkcs11.c.orig ./lib/pkcs11.c
--- ./lib/pkcs11.c.orig 2012-02-23 08:43:11.000000000 +0100
+++ ./lib/pkcs11.c 2012-03-01 12:07:14.864362795 +0100
@@ -400,7 +400,14 @@
                          (int)version->minor);
       terminate = 1;
     }
-
+  else
+    {
+      *output_size = 0;
+      // if (output) output[0] = 0;
+      if (output) output = NULL;
+      return 0;
+    }
+    
   if (hexify)
     {
       /* terminate is assumed with hexify */

Thanks

Sven

--
"Das Einzige wovor wir Angst haben müssen ist die Angst selbst"
                                                (Franklin D. Roosevelt)

/me is giggls@ircnet, http://sven.gegg.us/ on the Web

_______________________________________________
Help-gnutls mailing list
Help-gnutls@...
https://lists.gnu.org/mailman/listinfo/help-gnutls

[Nikos Mavrogiannopoulos]

On Thu, Mar 1, 2012 at 12:14 PM, Sven Geggus
<lists@...> wrote:

> This gives a compiler error, but this slightly different Version does
> compile and makes "p11tool --login --list-all" work!

May I see the output if it is not private? I would be interested to
know what kind of object doesn't have an id.

regards,
Nikos

_______________________________________________
Help-gnutls mailing list
Help-gnutls@...
https://lists.gnu.org/mailman/listinfo/help-gnutls