Added gnutls_pkcs11_reinit().

diff --git a/NEWS b/NEWS
index fdb8bfe659faf9928e07ab3d0c9e1d815dd5faaf..6c78c4e3cbc47a406efb26305f9837e9a32b658a 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -17,10 +17,14 @@ sent that one.
 ** libgnutls: Added functions to parse authority key identifiers
 when stored as a 'general name' and serial combo.
 
+** libgnutls: Added function to force explicit reinitialization
+of PKCS #11 modules. This is required on the child process after
+a fork.
+
 ** API and ABI modifications:
 gnutls_x509_crt_get_authority_key_gn_serial: Added
 gnutls_x509_crl_get_authority_key_gn_serial: Added
-
+gnutls_pkcs11_reinit: Added
 
 * Version 3.0.12 (released 2012-01-20)
 

diff --git a/doc/cha-cert-auth2.texi b/doc/cha-cert-auth2.texi
index 1a410867ca11c84a97e386482f2b3a63d1212deb..251d73f2318268bb86a03180c0a08ebe44ac4bad 100644 (file)
--- a/doc/cha-cert-auth2.texi
+++ b/doc/cha-cert-auth2.texi
@@ -982,6 +982,12 @@ are sharing a module. To avoid this problem GnuTLS uses @acronym{p11-kit}
 that provides a middleware to control access to resources over the
 multiple users.
 
+Moreover PKCS #11 modules must be reinitialized on the child processes
+after a @funcintref{fork}. @acronym{GnuTLS} provides @funcref{gnutls_pkcs11_reinit}
+to be called for this purpose.
+
+@showfuncdesc{gnutls_pkcs11_reinit}
+
 @node Reading objects
 @subsection Reading objects
 

diff --git a/lib/includes/gnutls/pkcs11.h b/lib/includes/gnutls/pkcs11.h
index 91976616a3c6e76a177caff1dff90ccdffb7b1ba..1382954dd8a37de85779d821729f281650acbad9 100644 (file)
--- a/lib/includes/gnutls/pkcs11.h
+++ b/lib/includes/gnutls/pkcs11.h
@@ -130,6 +130,7 @@ typedef struct gnutls_pkcs11_obj_st *gnutls_pkcs11_obj_t;
  */
 
 int gnutls_pkcs11_init (unsigned int flags, const char *deprecated_config_file);
+int gnutls_pkcs11_reinit (void);
 void gnutls_pkcs11_deinit (void);
 void gnutls_pkcs11_set_token_function (gnutls_pkcs11_token_callback_t fn,
                                        void *userdata);

diff --git a/lib/libgnutls.map b/lib/libgnutls.map
index 0c68c71212c0406b57efcab91718c7c5d97fd892..cf3792c3af79de71fe5f296a2a30fc6f3532cfdc 100644 (file)
--- a/lib/libgnutls.map
+++ b/lib/libgnutls.map
@@ -762,6 +762,9 @@ GNUTLS_3_0_0 {
        gnutls_pubkey_encrypt_data;
        gnutls_x509_dn_oid_name;
        gnutls_session_resumption_requested;
+       gnutls_pkcs11_reinit;
+       gnutls_x509_crt_get_authority_key_gn_serial;
+       gnutls_x509_crl_get_authority_key_gn_serial;
 } GNUTLS_2_12;
 
 GNUTLS_PRIVATE {

diff --git a/lib/pkcs11.c b/lib/pkcs11.c
index 8b1d3c5d787f1611c397aa7d412121b5a2eff6b6..a98847167f4bce162689dd6fccf0743460165c5b 100644 (file)
--- a/lib/pkcs11.c
+++ b/lib/pkcs11.c
@@ -565,6 +565,34 @@ gnutls_pkcs11_init (unsigned int flags, const char *deprecated_config_file)
   return 0;
 }
 
+/**
+ * gnutls_pkcs11_reinit:
+ *
+ * This function will reinitialize the PKCS 11 subsystem in gnutls. 
+ * This is required by PKCS 11 when an application uses fork(). The
+ * reinitialization function must be called on the child.
+ *
+ * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise a
+ *   negative error value.
+ *
+ * Since: 3.0.0
+ **/
+int gnutls_pkcs11_reinit (void)
+{
+  int rv;
+
+  rv = p11_kit_initialize_registered ();
+  if (rv != CKR_OK)
+    {
+      gnutls_assert ();
+      _gnutls_debug_log ("Cannot initialize registered module: %s\n",
+                         p11_kit_strerror (rv));
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  return 0;
+}
+
 /**
  * gnutls_pkcs11_deinit:
  *