From eb79423a7544ec43dabb01fd4ae08094d32852b6 Mon Sep 17 00:00:00 2001 From: Roumen Petrov Date: Sat, 25 Apr 2026 18:08:22 +0300 Subject: [PATCH 1/3] use global flag for initialised state Resolves https://github.com/softhsm/SoftHSMv2/issues/780 , and closes https://github.com/softhsm/SoftHSMv2/issues/729 . --- src/bin/util/test/.gitignore | 1 + src/bin/util/test/CMakeLists.txt | 9 +- src/bin/util/test/Makefile.am | 4 + src/bin/util/test/p11prov-test.sh | 191 ++++++++++++++++++++++++++++++ src/lib/SoftHSM.cpp | 2 + src/lib/SoftHSM.h | 2 +- 6 files changed, 207 insertions(+), 2 deletions(-) create mode 100644 src/bin/util/test/.gitignore create mode 100755 src/bin/util/test/p11prov-test.sh diff --git a/src/bin/util/test/.gitignore b/src/bin/util/test/.gitignore new file mode 100644 index 000000000..96ecd1af6 --- /dev/null +++ b/src/bin/util/test/.gitignore @@ -0,0 +1 @@ +/tokens diff --git a/src/bin/util/test/CMakeLists.txt b/src/bin/util/test/CMakeLists.txt index 3b0a78e53..514bcbccb 100644 --- a/src/bin/util/test/CMakeLists.txt +++ b/src/bin/util/test/CMakeLists.txt @@ -20,6 +20,13 @@ add_test( bash ${CMAKE_CURRENT_SOURCE_DIR}/mlkem512-import-key-test.sh ) +add_test( + NAME ${PROJECT_NAME}-p11prov + COMMAND ${CMAKE_COMMAND} -E env + bash ${CMAKE_CURRENT_SOURCE_DIR}/p11prov-test.sh +) + # Make tests returning code 77 considered as skipped, to avoid marking the test suite as failed when running on an unsupported OpenSSL version or with a Botan-based SoftHSM2. set_tests_properties(${PROJECT_NAME}-ml-dsa PROPERTIES SKIP_RETURN_CODE 77) -set_tests_properties(${PROJECT_NAME}-ml-kem PROPERTIES SKIP_RETURN_CODE 77) \ No newline at end of file +set_tests_properties(${PROJECT_NAME}-ml-kem PROPERTIES SKIP_RETURN_CODE 77) +set_tests_properties(${PROJECT_NAME}-p11prov PROPERTIES SKIP_RETURN_CODE 77) diff --git a/src/bin/util/test/Makefile.am b/src/bin/util/test/Makefile.am index fb7ce2f94..4606a9d47 100644 --- a/src/bin/util/test/Makefile.am +++ b/src/bin/util/test/Makefile.am @@ -3,10 +3,14 @@ MAINTAINERCLEANFILES = $(srcdir)/Makefile.in TESTS_ENVIRONMENT = top_builddir='$(top_builddir)' top_srcdir='$(top_srcdir)' srcdir='$(srcdir)' builddir='$(builddir)' TESTS = mldsa44-import-key-test.sh mlkem512-import-key-test.sh +if WITH_OPENSSL +TESTS += p11prov-test.sh +endif check_SCRIPTS = $(TESTS) EXTRA_DIST = $(srcdir)/CMakeLists.txt \ + $(srcdir)/p11prov-test.sh \ $(srcdir)/import-key-test-common.sh \ $(srcdir)/mldsa44-import-key-test.sh \ $(srcdir)/mlkem512-import-key-test.sh diff --git a/src/bin/util/test/p11prov-test.sh b/src/bin/util/test/p11prov-test.sh new file mode 100755 index 000000000..adb6b2759 --- /dev/null +++ b/src/bin/util/test/p11prov-test.sh @@ -0,0 +1,191 @@ +#! /bin/sh +# This file is in the public domain + +CWD=`pwd` + +# binaries + +OPENSSL=${OPENSSL-openssl} +OPENSSL=`command -v "$OPENSSL"` +if test -z "$OPENSSL" ; then + echo "error: openssl utility not found" >&2 + exit 77 +fi + +openssl() { +"$OPENSSL" ${1+"$@"} +} + +openssl_version=`openssl version` || exit $? +if test -z "$openssl_version" ; then + echo "cannot determine OpenSSL version" >&2 + exit 99 +fi + +case $openssl_version in +*"OpenSSL 0.9."*|\ +*"OpenSSL 1."*) + echo "$openssl_version is not impacted" >&2 + exit 77 + ;; +*"OpenSSL "*) + # OpenSSL 3+ - with provider loadable module + ;; +*) + echo "unsupported: $openssl_version" >&2 + exit 77 + ;; +esac +# NOTE OpenSSL > 1.* + + +# find a PKCS#11 provider +p11_find_provider() { + if test -z "$PROV_PKCS11" ; then + + # try to extract path ... + moduledir=`openssl version -m 2>/dev/null \ + | sed -e 's/^MODULESDIR: "//' -e 's/"$//'` + if test -z "$moduledir" ; then + echo "cannot determine OpenSSL MODULESDIR" >&2 + exit 99 + fi + if test -d "$moduledir" ; then : + else + echo "does not exist MODULESDIR: $moduledir" >&2 + exit 99 + fi + + for N in pkcs11 libpkcs11 ; do + for S in so dll ; do + test -f "$moduledir"/$N.$S || continue + PROV_PKCS11="$moduledir"/$N.$S + break + done + test -n "$PROV_PKCS11" && break + done + test -n "$PROV_PKCS11" + else + test -f "$PROV_PKCS11" + fi +} + +if p11_find_provider ; then : +else + echo "error: PKCS#11 provider not found" >&2 + exit 77 +fi + + +# get absolute path to SoftHSM pkcs#11 module +# NOTE: Depending on the build model, the module +# may be located in a subdirectory. +D=`cd ../../../lib/ && pwd` +if test -z "$D" ; then + echo "unexpectedly missing library directory" >&2 + exit 99 +fi +P11MODULE= +for S in ".libs" "$CMAKE_CONFIG_TYPE" ; do + for F in "$D/$S/"*softhsm2.* ; do + case "$F" in + *.so|*.dll);; + *) continue;; + esac + P11MODULE="$F" + break; + done + test -n "$P11MODULE" && break +done +if test -z "$P11MODULE" ; then + echo "error: unexpected module suffix" >&2 + exit 99 +fi +if command -v realpath > /dev/null ; then + P11MODULE=`realpath "$P11MODULE"` +fi + + +# get path to SoftHSM utility +SOFTHSM2_UTIL= +for S in "" "$CMAKE_CONFIG_TYPE" ; do + F="$CWD/../$S/softhsm2-util" + # NOTE: test should succeded for files with specific suffixes + test -x "$F" || continue + SOFTHSM2_UTIL="$F" + break +done +if test -z "$SOFTHSM2_UTIL" ; then + echo "error: SoftHSM utility not found" >&2 + exit 99 +fi + +softhsm2_tool() { +"$SOFTHSM2_UTIL" --module "$P11MODULE" ${1+"$@"} +} + + +# configurations +TOKEN_DIR="$CWD"/tokens +rm -rf "$TOKEN_DIR" +mkdir "$TOKEN_DIR" + + +OPENSSL_CONF="$TOKEN_DIR"/openssl.conf +cat > "$OPENSSL_CONF" < "$SOFTHSM2_CONF" < #endif +bool SoftHSM::isInitialised; + // Initialise the one-and-only instance #ifdef HAVE_CXX11 diff --git a/src/lib/SoftHSM.h b/src/lib/SoftHSM.h index 724812c91..4bbb39875 100644 --- a/src/lib/SoftHSM.h +++ b/src/lib/SoftHSM.h @@ -209,7 +209,7 @@ class SoftHSM #endif // Is the SoftHSM PKCS #11 library initialised? - bool isInitialised; + static bool isInitialised; bool isRemovable; SessionObjectStore* sessionObjectStore; From 157068122607dd39d308db216b470b90e2f6af83 Mon Sep 17 00:00:00 2001 From: Roumen Petrov Date: Wed, 29 Jul 2026 19:49:05 +0300 Subject: [PATCH 2/3] add pkcs11-provider to the CI workflow tests with host OpenSSL 3+ --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index c223ca40d..18ae75075 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -62,7 +62,7 @@ jobs: - name: Prepare run: | sudo apt-get update -qq - sudo apt-get install -y libcppunit-dev libssl-dev p11-kit + sudo apt-get install -y libcppunit-dev libssl-dev p11-kit pkcs11-provider - name: Build # Once all OpenSSL deprecations fixed, uncomment this # env: From df2ecc15252da0e4fb11d8aab26aafb4c3e58218 Mon Sep 17 00:00:00 2001 From: Roumen Petrov Date: Thu, 30 Jul 2026 19:48:13 +0300 Subject: [PATCH 3/3] extract shell files with unix end-of-line --- .gitattributes | 3 +++ 1 file changed, 3 insertions(+) create mode 100644 .gitattributes diff --git a/.gitattributes b/.gitattributes new file mode 100644 index 000000000..a1e5a3def --- /dev/null +++ b/.gitattributes @@ -0,0 +1,3 @@ +# shell files have unix(LF) end-of-line conversion + +*.sh text eol=lf