use global flag for initialised state

.gitattributes

@@ -0,0 +1,3 @@
+# shell files have unix(LF) end-of-line conversion
+
+*.sh text eol=lf

.github/workflows/ci.yml

@@ -62,7 +62,7 @@ jobs:
       - name: Prepare
         run: |
           sudo apt-get update -qq
-          sudo apt-get install -y libcppunit-dev libssl-dev p11-kit
+          sudo apt-get install -y libcppunit-dev libssl-dev p11-kit pkcs11-provider
       - name: Build
         # Once all OpenSSL deprecations fixed, uncomment this
         # env:

src/bin/util/test/.gitignore

@@ -0,0 +1 @@
+/tokens

src/bin/util/test/CMakeLists.txt

@@ -20,6 +20,13 @@ add_test(
 		bash ${CMAKE_CURRENT_SOURCE_DIR}/mlkem512-import-key-test.sh
 )
 
+add_test(
+	NAME ${PROJECT_NAME}-p11prov
+	COMMAND ${CMAKE_COMMAND} -E env
+	bash ${CMAKE_CURRENT_SOURCE_DIR}/p11prov-test.sh
+)
+
 # Make tests returning code 77 considered as skipped, to avoid marking the test suite as failed when running on an unsupported OpenSSL version or with a Botan-based SoftHSM2.
 set_tests_properties(${PROJECT_NAME}-ml-dsa PROPERTIES SKIP_RETURN_CODE 77)
-set_tests_properties(${PROJECT_NAME}-ml-kem PROPERTIES SKIP_RETURN_CODE 77)
+set_tests_properties(${PROJECT_NAME}-ml-kem PROPERTIES SKIP_RETURN_CODE 77)
+set_tests_properties(${PROJECT_NAME}-p11prov PROPERTIES SKIP_RETURN_CODE 77)

src/bin/util/test/Makefile.am

@@ -3,10 +3,14 @@ MAINTAINERCLEANFILES = 		$(srcdir)/Makefile.in
 TESTS_ENVIRONMENT =		top_builddir='$(top_builddir)' top_srcdir='$(top_srcdir)' srcdir='$(srcdir)' builddir='$(builddir)'
 
 TESTS = 			mldsa44-import-key-test.sh mlkem512-import-key-test.sh
+if WITH_OPENSSL
+TESTS +=			p11prov-test.sh
+endif
 
 check_SCRIPTS =			$(TESTS)
 
 EXTRA_DIST =			$(srcdir)/CMakeLists.txt \
+				$(srcdir)/p11prov-test.sh \
 				$(srcdir)/import-key-test-common.sh \
 				$(srcdir)/mldsa44-import-key-test.sh \
 				$(srcdir)/mlkem512-import-key-test.sh

src/bin/util/test/p11prov-test.sh

@@ -0,0 +1,191 @@
+#! /bin/sh
+# This file is in the public domain
+
+CWD=`pwd`
+
+# binaries
+
+OPENSSL=${OPENSSL-openssl}
+OPENSSL=`command -v "$OPENSSL"`
+if test -z "$OPENSSL" ; then
+  echo "error: openssl utility not found" >&2
+  exit 77
+fi
+
+openssl() {
+"$OPENSSL" ${1+"$@"}
+}
+
+openssl_version=`openssl version` || exit $?
+if test -z "$openssl_version" ; then
+  echo "cannot determine OpenSSL version" >&2
+  exit 99
+fi
+
+case $openssl_version in
+*"OpenSSL 0.9."*|\
+*"OpenSSL 1."*)
+  echo "$openssl_version is not impacted" >&2
+  exit 77
+  ;;
+*"OpenSSL "*)
+  # OpenSSL 3+ - with provider loadable module
+  ;;
+*)
+  echo "unsupported: $openssl_version" >&2
+  exit 77
+  ;;
+esac
+# NOTE OpenSSL > 1.*
+
+
+# find a PKCS#11 provider
+p11_find_provider() {
+  if test -z "$PROV_PKCS11" ; then
+
+    # try to extract path ...
+    moduledir=`openssl version -m 2>/dev/null \
+      | sed -e 's/^MODULESDIR: "//' -e 's/"$//'`
+    if test -z "$moduledir" ; then
+      echo "cannot determine OpenSSL MODULESDIR" >&2
+      exit 99
+    fi
+    if test -d "$moduledir" ; then :
+    else
+      echo "does not exist MODULESDIR: $moduledir" >&2
+      exit 99
+    fi
+
+    for N in pkcs11 libpkcs11 ; do
+      for S in so dll ; do
+        test -f "$moduledir"/$N.$S || continue
+        PROV_PKCS11="$moduledir"/$N.$S
+        break
+      done
+      test -n "$PROV_PKCS11" && break
+    done
+    test -n "$PROV_PKCS11"
+  else
+    test -f "$PROV_PKCS11"
+  fi
+}
+
+if p11_find_provider ; then :
+else
+  echo "error: PKCS#11 provider not found" >&2
+  exit 77
+fi
+
+
+# get absolute path to SoftHSM pkcs#11 module
+# NOTE: Depending on the build model, the module
+# may be located in a subdirectory.
+D=`cd ../../../lib/ && pwd`
+if test -z "$D" ; then
+  echo "unexpectedly missing library directory" >&2
+  exit 99
+fi
+P11MODULE=
+for S in ".libs" "$CMAKE_CONFIG_TYPE" ; do
+  for F in "$D/$S/"*softhsm2.* ; do
+    case "$F" in
+    *.so|*.dll);;
+    *) continue;;
+    esac
+    P11MODULE="$F"
+    break;
+  done
+  test -n "$P11MODULE" && break
+done
+if test -z "$P11MODULE" ; then
+  echo "error: unexpected module suffix" >&2
+  exit 99
+fi
+if command -v realpath > /dev/null ; then
+  P11MODULE=`realpath "$P11MODULE"`
+fi
+
+
+# get path to SoftHSM utility
+SOFTHSM2_UTIL=
+for S in "" "$CMAKE_CONFIG_TYPE" ; do
+  F="$CWD/../$S/softhsm2-util"
+  # NOTE: test should succeded for files with specific suffixes
+  test -x "$F" || continue
+  SOFTHSM2_UTIL="$F"
+  break
+done
+if test -z "$SOFTHSM2_UTIL" ; then
+  echo "error: SoftHSM utility not found" >&2
+  exit 99
+fi
+
+softhsm2_tool() {
+"$SOFTHSM2_UTIL" --module "$P11MODULE" ${1+"$@"}
+}
+
+
+# configurations
+TOKEN_DIR="$CWD"/tokens
+rm -rf "$TOKEN_DIR"
+mkdir "$TOKEN_DIR"
+
+
+OPENSSL_CONF="$TOKEN_DIR"/openssl.conf
+cat > "$OPENSSL_CONF" <<EOF
+openssl_conf = config
+
+[ config ]
+providers = provider_section
+
+[ provider_section ]
+default = default_section
+provider1 = provider1_section
+
+[default_section]
+activate = 1
+
+[provider1_section]
+pkcs11-module-path = $P11MODULE
+module = $PROV_PKCS11
+activate = 1
+EOF
+export OPENSSL_CONF
+
+
+SOFTHSM2_CONF="$TOKEN_DIR"/softhsm2.conf
+cat > "$SOFTHSM2_CONF" <<EOF
+directories.tokendir = $TOKEN_DIR
+objectstore.backend = file
+slots.removable = false
+slots.mechanisms = ALL
+log.level = ERROR
+EOF
+export SOFTHSM2_CONF
+
+
+# execution
+set -e
+
+TOKEN_PIN=4321
+TOKEN_ID=01
+PASS_URI=pass:$TOKEN_PIN
+PASS_FILE=pass:dcba
+KEY_URI=pkcs11:id=%$TOKEN_ID
+KEY_FILE="$TOKEN_DIR"/test_key
+SIGN_FILE="$TOKEN_DIR"/test_sign
+
+softhsm2_tool --init-token --label test0 --slot free --so-pin 12345678 --pin $TOKEN_PIN
+openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out "$KEY_FILE" -pass $PASS_FILE
+softhsm2_tool --import "$KEY_FILE" --import-type keypair --id $TOKEN_ID --label test_key --token test0 --pin $TOKEN_PIN
+
+#openssl storeutl -passin $PASS_URI $KEY_URI
+
+# sample command that crash before workaround due to OpenSSL "at_exit" flaw
+openssl pkeyutl -sign -inkey $KEY_URI -passin $PASS_URI -rawin -in "$SOFTHSM2_UTIL" -out "$SIGN_FILE"
+
+# just in case
+openssl pkeyutl -verify -inkey "$KEY_FILE" -passin $PASS_FILE -rawin -in "$SOFTHSM2_UTIL" -sigfile "$SIGN_FILE"
+
+# clean-up
+rm -rf "$TOKEN_DIR"

src/lib/SoftHSM.cpp

@@ -101,6 +101,8 @@
 #include <unistd.h>
 #endif
 
+bool SoftHSM::isInitialised;
+
 // Initialise the one-and-only instance
 
 #ifdef HAVE_CXX11

src/lib/SoftHSM.h

@@ -209,7 +209,7 @@ class SoftHSM
 #endif
 
 	// Is the SoftHSM PKCS #11 library initialised?
-	bool isInitialised;
+	static bool isInitialised;
 	bool isRemovable;
 
 	SessionObjectStore* sessionObjectStore;