summaryrefslogtreecommitdiff
path: root/p11-kit
Commit message (Collapse)AuthorAgeFilesLines
* filter: New virtual wrapper for access controlDaiki Ueno2017-02-084-0/+623
|
* iter: Enable iteration over slots/tokens/modulesDaiki Ueno2017-02-083-27/+295
| | | | | | | | | While PKCS#11 URI can identify slots/tokens/modules, P11KitIter is only capable of iterating over objects. This patch adds new behaviors to P11KitIter to support iterations over slots/tokens/modules, using the C coroutine trick as described in: http://www.chiark.greenend.org.uk/~sgtatham/coroutines.html
* uri: Relax pin-* parsing for compatibilityDaiki Ueno2017-02-021-5/+26
| | | | | | | | | | | | While 'pin-source' and 'pin-value' are defined as query atttribute, they were defined as path attribute in earlier drafts, and some implementations still stick to it. For backward compatibility, accept those in path attributes when parsing (but not when formatting). Reported by Andreas Metzler in: https://lists.freedesktop.org/archives/p11-glue/2017-January/000637.html
* virtual: Make virtual-fixed internal API cleanerDaiki Ueno2017-01-254-11/+16
| | | | | Add proper inclusion guard to virtual-fixed.h and move the declarations of the (un)initialization functions there.
* test: Release transport mock moduleDaiki Ueno2017-01-251-0/+1
| | | | | To prevent leaks of fixed closures, p11_kit_module_release() needs to be called on the mock module itself.
* test: Check exhaustion of fixed closuresNikos Mavrogiannopoulos2017-01-242-5/+82
|
* build: Make libffi closure optionalDaiki Ueno2017-01-249-145/+1661
| | | | | | | | libffi's closure support is not available on all platforms and may fail at run time if running under a stricter SELinux policy. Fallback to pre-compiled closures if it is not usable. https://bugs.freedesktop.org/show_bug.cgi?id=97611
* Fix compiler warnings on FreeBSDRoman Bogorodskiy2017-01-231-1/+1
| | | | | | | | | | | * common/compat.c: Fix "implicit declaration of function 'issetugid'" warning. On FreeBSD, it's required to define __BSD_VISIBLE to make issetugid(2) visible * common/test-message.c: Fix "implicit declaration of function 'asprintf'" by including <stdio.h> * p11-kit/test-iter.c: Fix "format '%lu' expects argument of type 'long unsigned int', but argument 3 has type 'int'" by changing format string to "%d"
* systemd: add per-user remoting socketLubomir Rintel2017-01-203-0/+31
| | | | | | This allows daemons outside user's session to use per-user PKCS#11 modules. Useful for letting VPN daemons or wpa_supplicant use certificates stored in user's GNOME keyring, etc.
* uri: Support query attributes to specify moduleDaiki Ueno2017-01-193-9/+237
| | | | | Accept and produce 'module-name' and 'module-path' query attributes defined in RFC 7512.
* uri: Avoid typecasting confusion on s390xDaiki Ueno2017-01-171-2/+4
| | | | | | | | | Like memcpy(), the 'void *' argument of p11_buffer_add() points to the memory area ordered in host's endianness. Add typecast of int->char to avoid the confusion. Reported by Andreas Metzler in: https://lists.freedesktop.org/archives/p11-glue/2017-January/000633.html
* uri: fix producing the query attributesLubomir Rintel2017-01-122-35/+48
| | | | Put the pin-* attributes where they belong: to the query part.
* uri: fix the query attribute parsingLubomir Rintel2017-01-122-14/+42
| | | | | | | | | | | | The pin-* attributes belong to the query part. We should not parse them until we see a '?' and they're separated with a '&'. This might be an important thing -- some of the query attributes may have security implications reaching outside scope of the token itself, to the host system itself. E.g. a pin-source may cause the consumer to access a file or module-path (unimplemented) execute code. The user may want to just chop the attribute part off if they want the consumer access the token and not take the security considerations into account.
* build: improve p11-kit-proxy symlink handlingRoman Bogorodskiy2017-01-091-1/+9
| | | | | | | | | | - Current command for creation of the p11-kit-proxy symlink uses shell brace expansion that isn't supported by all the shells (e.g. FreeBSD's /bin/sh does not support that). Replace it with the old-fashioned 'for' loop - Match extension of the source and the target, i.e. so links to so, dylib links to dylib (previously dylib linked to so) - Add an uninstall-local target to clean up the symlink
* rpc: Fix typo flagged by lintianAndreas Metzler2016-12-151-1/+1
|
* proxy: Remove redundant NULL checkPankaj2016-12-131-1/+1
| | | | https://bugs.freedesktop.org/show_bug.cgi?id=93589
* modules: Remove redundant NULL checkPankaj2016-12-131-1/+1
| | | | https://bugs.freedesktop.org/show_bug.cgi?id=93588
* proxy: Check return value of calloc()Pankaj2016-12-131-0/+1
| | | | https://bugs.freedesktop.org/show_bug.cgi?id=92815
* pkg-config: Expose p11_trust_paths variableDaiki Ueno2016-11-151-0/+1
| | | | | The variable is mentioned in the manual but wasn't exposed from the pkg-config.
* build: Remove *.in files from EXTRA_DISTDaiki Ueno2016-11-151-2/+0
| | | | | The files created with AC_CONFIG_FILES are automatically added to the distribution.
* test: Remove /proxy/deinit-after-fork testDaiki Ueno2016-10-311-37/+0
| | | | | | | This test hasn't been working since the removal of the pthread_atfork() deinit code. To properly clean up, the child process needs to call C_Initialize() and C_Finalize(), and it is already tested by /proxy/initialize-child.
* modules: Reset the init count on fork()Daiki Ueno2016-10-311-0/+4
| | | | | | | | | | | | | | | Reset mod->init_count when forkid has changed. Otherwise C_Finalize does not get called. GCC's asan spotted this: Direct leak of 48 byte(s) in 1 object(s) allocated from: #0 0x7f89bc7bfe20 in malloc (/lib64/libasan.so.3+0xc6e20) #1 0x7f89bc47a1f1 in p11_dict_new ../common/dict.c:278 #2 0x7f89bc42143d in managed_C_Initialize ../p11-kit/modules.c:1477 #3 0x7f89bc464c72 in binding_C_Initialize ../p11-kit/virtual.c:121 #4 0x7f89bc1b0a51 in ffi_closure_unix64_inner (/lib64/libffi.so.6+0x5a51) #5 0x7f89bc1b0dbf in ffi_closure_unix64 (/lib64/libffi.so.6+0x5dbf) #6 0x7f89bc44f9e8 in rpc_C_Initialize ../p11-kit/rpc-server.c:691
* modules: Fix memleak when loading remote moduleDaiki Ueno2016-10-311-0/+2
| | | | | | | | | | | | Make sure to call p11_virtual_uninit() on managed module. Otherwise the associated lower_module will not be released. GCC's asan spotted this: Direct leak of 56 byte(s) in 1 object(s) allocated from: #0 0x7f6c5368dfe0 in calloc (/lib64/libasan.so.3+0xc6fe0) #1 0x4436ba in p11_rpc_client_init ../p11-kit/rpc-client.c:2082 #2 0x42c147 in p11_rpc_transport_new ../p11-kit/rpc-transport.c:850 #3 0x415d95 in setup_module_for_remote_inlock ../p11-kit/modules.c:411
* rpc: Fix memleak in rpc_socket cleanupDaiki Ueno2016-10-311-0/+1
| | | | | | | | GCC's asan spotted this: Direct leak of 120 byte(s) in 1 object(s) allocated from: #0 0x7f8d4f221fe0 in calloc (/lib64/libasan.so.3+0xc6fe0) #1 0x427f55 in rpc_socket_new ../p11-kit/rpc-transport.c:100 #2 0x42bc1b in rpc_exec_connect ../p11-kit/rpc-transport.c:767
* uri: Port to PKCS#11 GNU calling conventionDaiki Ueno2016-10-311-0/+2
| | | | https://bugs.freedesktop.org/show_bug.cgi?id=97245
* uri: Fix buffer overflow in memcmp()Daiki Ueno2016-10-311-25/+32
| | | | | | | The commit 63644dc introduced several memcmp() calls without checking the length of the first argument. https://bugs.freedesktop.org/show_bug.cgi?id=97245
* rpc: Send x-init-reserved to remote moduleDaiki Ueno2016-10-057-16/+144
| | | | | | | Signed-off-by: Stef Walter <stefw@redhat.com> * Fixed up indentation https://bugs.freedesktop.org/show_bug.cgi?id=80519
* test: Fix p11_virtual_init() usageDaiki Ueno2016-10-051-1/+1
| | | | | | | p11_virtual_init() should take a CK_FUNCTION_LIST as the 3rd argument, if the 2nd argument is &p11_virtual_base. https://bugs.freedesktop.org/show_bug.cgi?id=87192
* Fix link of p11-kit-proxy.dylib on Mac OS XLeonardo Brondani Schenkel2016-10-031-1/+1
| | | | | | | | | However, on Mac OS X the library is named libp11-kit.dylib so in the above command the source of the link resolves to nothing, the destination becomes the source and the link to a non-existent file is created in the working directory. https://bugs.freedesktop.org/show_bug.cgi?id=98022
* iter: Utilize 'slot-id' URI path attributeDaiki Ueno2016-09-022-1/+83
| | | | https://bugs.freedesktop.org/show_bug.cgi?id=97245
* iter: Utilize slot info URI path attributesDaiki Ueno2016-09-023-0/+134
| | | | https://bugs.freedesktop.org/show_bug.cgi?id=97245
* uri: Support 'slot-id' path attributeDaiki Ueno2016-09-023-3/+126
| | | | | | Accept 'slot-id' path attribute defined in RFC 7512. https://bugs.freedesktop.org/show_bug.cgi?id=97245
* uri: Support slot info path attributesDaiki Ueno2016-09-024-0/+180
| | | | | | | Accept 'slot-description' and 'slot-manifacturer' path attributes defined in RFC 7512. https://bugs.freedesktop.org/show_bug.cgi?id=97245
* uri: Remove whitespace early when parsingDaiki Ueno2016-09-021-66/+78
| | | | | | | | | | | For every path/query component, p11_kit_uri_parse() allocates a small buffer to strip whitespace out. This patch removes any whitespace in the URI at the entry of the function to simplify the code. Note that RFC 7512 actually suggests to ignore whitespace at the extracting phase rather than the parsing phase. https://bugs.freedesktop.org/show_bug.cgi?id=97245
* Fix leak when C_Initialize() is called from childDaiki Ueno2016-08-221-0/+2
| | | | | | | The test case added for bug 90289 (commit c73edd00) revealed that some of the C_Initialize() implementations do not consider the case where it is called from the parent process and then from the child process, without calling C_Finalize() in between.
* Fix typos flagged by codespellDaiki Ueno2016-08-225-9/+9
|
* Doc: p11_kit_module_load accepts a filename arg.Andreas Metzler2016-02-241-1/+4
| | | | | | | | p11_kit_module_load() hands on the module_path argument to load_module_from_file_inlock() which accepts relative paths, prepending P11_MODULE_PATH. Update API documentation accordingly. https://lists.freedesktop.org/archives/p11-glue/2016-February/000587.html
* Avoiding redundant checkPankaj2016-01-051-3/+1
| | | | https://bugs.freedesktop.org/show_bug.cgi?id=93587
* rpc-transport.c: include sys/select.h for fd_setGustavo Zacarias2015-12-071-0/+1
| | | | | | | | | | | | | | fd_set and friends, according to POSIX.1-2001, needs sys/select.h, so include it otherwise the build fails for uClibc: p11-kit/rpc-transport.c: In function ‘rpc_socket_read’: p11-kit/rpc-transport.c:350:2: error: unknown type name ‘fd_set’ p11-kit/rpc-transport.c:416:4: warning: implicit declaration of function ‘FD_ZERO’ [-Wimplicit-function-declaration] Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> https://bugs.freedesktop.org/show_bug.cgi?id=93211
* p11-kit: Remove unused pointerPankaj2015-10-211-2/+0
| | | | https://bugs.freedesktop.org/show_bug.cgi?id=92532
* p11-kit: Fix warnings related to use dangling pointerPankaj2015-10-201-2/+6
| | | | https://bugs.freedesktop.org/show_bug.cgi?id=92551
* p11-kit: 'int' comparison with 'unsigned int' in for() for array indexPankaj2015-10-191-1/+1
| | | | https://bugs.freedesktop.org/show_bug.cgi?id=92445
* p11-kit: Fix expression 'call_id < 0' is always falsePankaj2015-10-121-1/+1
| | | | https://bugs.freedesktop.org/show_bug.cgi?id=92434
* Fix build on Mingw due to missing EWOULDBLOCKLew Palm2015-07-141-0/+3
| | | | https://bugs.freedesktop.org/show_bug.cgi?id=89081
* Added p11_kit_module_get_filename()Nikos Mavrogiannopoulos2015-07-143-1/+85
| | | | | | | | | | | That function allows to obtain the filename used by the PKCS #11 module. That is the filename used by dlopen(). Note that we don't provide p11_kit_module_for_filename() because it would have to deal with filename equivalences. Signed-off-by: Stef Walter <stefw@redhat.com> * Fixed up whitespace
* In proxy module don't call C_Finalize on a forked process.Nikos Mavrogiannopoulos2015-06-291-6/+13
| | | | | | | | | | | | This corrects a deadlock on the forked process. The deadlock happened because the proxy called C_Finalize prior to a C_Initialize which is wrong according to PKCS #11 (2.40). This patch eliminates the C_Finalize call in that case. This resolves #90289 https://bugs.freedesktop.org/show_bug.cgi?id=90289 Reviewed-by: Stef Walter <stefw@redhat.com>
* Add test case for bug 90289 (deadlock on C_Initialize() in child after fork)David Woodhouse2015-06-291-0/+57
| | | | Reviewed-by: Stef Walter <stefw@redhat.com>
* Do not deinitialize libffi's wrapper functionsNikos Mavrogiannopoulos2015-06-291-0/+11
| | | | | | | | Libffi uses shared memory to store them, and a deallocation in a child will cause issues for the parent or vice versa. Signed-off-by: Stef Walter <stefw@redhat.com> * Use #if to comment out code, avoid compiler warnings
* Added test case for crash after a fork in proxy moduleNikos Mavrogiannopoulos2015-06-291-1/+45
| | | | Reviewed-by: Stef Walter <stefw@redhat.com>
* p11-kit: Missing unlock in function rpc_socket_read()Pankaj2015-06-031-1/+3
| | | | https://bugs.freedesktop.org/show_bug.cgi?id=90827
generated by cgit v1.1 at 2024-10-16 22:33:21 +0000