From: Karsten Ohme (widerstandt-online.de)
Date: Mon Feb 07 2005 - 18:45:45 CST

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

I work in a very secure environment with two smart card readers. So I
have tried the PKCS11 module under these hard conditions. Reality
slapped in my face and left me broken-hearted in front of my 19" CRT.

With my remarkable programing knowledges I examined this problem and
probably found a working solution.

The error is thrown about line 883:

I believe the original code looked like this:

while (session_l)
{
        if (session_l->session.slotID == slotID)
                 session_FreeSession(session_l);
        session_l = st.sessions;
}

If the slotID matches the slotID of the session, free this session. In
the case of one readers the st.sessions is NULL after this.
Not in the case of two and more readers. If the session is not the first
session, the if never matches, the actual session is always set back to
the first session of the st (P11_State) object. The program is in a
never ending loop (if the hardware not fails).

May be a better approach is the following:

If the slotID of the session matches the actual slotID free this session
and leave the while loop. Else jump to the next session in the session list.
I do not have the deep understanding of the ideology behind the code,
but it seams to work at the moment.

while (session_l)
{
        if (session_l->session.slotID == slotID) {
                 session_FreeSession(session_l);
                break;
        }
        else {
                session_l = session_l->next;
        }
}

Please patch the sources accordingly, may be some people would
appreciate this.

Bye, Karsten

PS1: A cosmetic detail: Thunderbird lists readers with a inserted token
at start time of the "Manage Security Devices ..." dialog with the
string "MuscleCard Applet". Else the reader name is displayed. If the
card is removed this does not change. Is this a problem of the PKCS#11
module or of Thunderbird? (I'm to lazy to search for this.) Could always
be displayed the reader name?

PS2: Here is the whole function:

CK_RV slot_DisconnectSlot(CK_ULONG slotID, CK_ULONG action)
{
     CK_RV rv = CKR_OK;
     P11_Session *session_l;
     P11_Slot *slot;
        P11_LOG_START("slot_DisconnectSlot");
        if (INVALID_SLOT) {
                rv = CKR_SLOT_ID_INVALID;
        }
     else
     {
         slot = &st.slots[slotID - 1];
         session_l = st.sessions;

                while (session_l)
         {
                        if (session_l->session.slotID == slotID) {
                 session_FreeSession(session_l);
                                break;
                        }
                        else {
                                session_l = session_l->next;
                        }
                }
         object_FreeAllObjects(slotID, st.slots[slotID - 1].objects);
                slot_FreeAllMechanisms(slot->mechanisms);
                slot->mechanisms = 0;
                memset(slot->pins, 0x00, sizeof(slot->pins));
         slot->pin_state = 0;
         slot_BlankTokenInfo(&slot->token_info);

         memset(&slot->status_info, 0x00, sizeof(slot->status_info));

         if (slot->conn.hCard)
         {
             log_Log(LOG_LOW, "Releasing connection (slot_DisconnectSlot)");
             (void)MSC_ERROR(msc_ReleaseConnection(&slot->conn, action));
         }

         slot->conn.hCard = 0;
         slot->slot_info.flags = (slot->slot_info.flags &
~CKF_TOKEN_PRESENT);
     }
        P11_LOG_END("slot_DisconnectSlot");
     return rv;
}
_______________________________________________
Muscle mailing list
Musclelists.musclecard.com
http://lists.drizzle.com/mailman/listinfo/muscle

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]