From: Nikos Mavrogiannopoulos <nmav@gnutls.org>
Date: Mon, 23 Jan 2012 19:04:04 +0000 (+0100)
Subject: Added gnutls_pkcs11_reinit().
X-Git-Tag: gnutls_3_0_13~217
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=5ed7b64a5ea61829a7e0691176ba31600355a247;p=thirdparty%2Fgnutls.git

Added gnutls_pkcs11_reinit().
---

diff --git a/NEWS b/NEWS
index fdb8bfe659..6c78c4e3cb 100644
--- a/NEWS
+++ b/NEWS
@@ -17,10 +17,14 @@ sent that one.
 ** libgnutls: Added functions to parse authority key identifiers
 when stored as a 'general name' and serial combo.
 
+** libgnutls: Added function to force explicit reinitialization
+of PKCS #11 modules. This is required on the child process after
+a fork.
+
 ** API and ABI modifications:
 gnutls_x509_crt_get_authority_key_gn_serial: Added
 gnutls_x509_crl_get_authority_key_gn_serial: Added
-
+gnutls_pkcs11_reinit: Added
 
 * Version 3.0.12 (released 2012-01-20)
 
diff --git a/doc/cha-cert-auth2.texi b/doc/cha-cert-auth2.texi
index 1a410867ca..251d73f231 100644
--- a/doc/cha-cert-auth2.texi
+++ b/doc/cha-cert-auth2.texi
@@ -982,6 +982,12 @@ are sharing a module. To avoid this problem GnuTLS uses @acronym{p11-kit}
 that provides a middleware to control access to resources over the
 multiple users.
 
+Moreover PKCS #11 modules must be reinitialized on the child processes
+after a @funcintref{fork}. @acronym{GnuTLS} provides @funcref{gnutls_pkcs11_reinit}
+to be called for this purpose.
+
+@showfuncdesc{gnutls_pkcs11_reinit}
+
 @node Reading objects
 @subsection Reading objects
 
diff --git a/lib/includes/gnutls/pkcs11.h b/lib/includes/gnutls/pkcs11.h
index 91976616a3..1382954dd8 100644
--- a/lib/includes/gnutls/pkcs11.h
+++ b/lib/includes/gnutls/pkcs11.h
@@ -130,6 +130,7 @@ typedef struct gnutls_pkcs11_obj_st *gnutls_pkcs11_obj_t;
  */
 
 int gnutls_pkcs11_init (unsigned int flags, const char *deprecated_config_file);
+int gnutls_pkcs11_reinit (void);
 void gnutls_pkcs11_deinit (void);
 void gnutls_pkcs11_set_token_function (gnutls_pkcs11_token_callback_t fn,
                                        void *userdata);
diff --git a/lib/libgnutls.map b/lib/libgnutls.map
index 0c68c71212..cf3792c3af 100644
--- a/lib/libgnutls.map
+++ b/lib/libgnutls.map
@@ -762,6 +762,9 @@ GNUTLS_3_0_0 {
 	gnutls_pubkey_encrypt_data;
 	gnutls_x509_dn_oid_name;
 	gnutls_session_resumption_requested;
+	gnutls_pkcs11_reinit;
+	gnutls_x509_crt_get_authority_key_gn_serial;
+	gnutls_x509_crl_get_authority_key_gn_serial;
 } GNUTLS_2_12;
 
 GNUTLS_PRIVATE {
diff --git a/lib/pkcs11.c b/lib/pkcs11.c
index 8b1d3c5d78..a98847167f 100644
--- a/lib/pkcs11.c
+++ b/lib/pkcs11.c
@@ -565,6 +565,34 @@ gnutls_pkcs11_init (unsigned int flags, const char *deprecated_config_file)
   return 0;
 }
 
+/**
+ * gnutls_pkcs11_reinit:
+ *
+ * This function will reinitialize the PKCS 11 subsystem in gnutls. 
+ * This is required by PKCS 11 when an application uses fork(). The
+ * reinitialization function must be called on the child.
+ *
+ * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise a
+ *   negative error value.
+ *
+ * Since: 3.0.0
+ **/
+int gnutls_pkcs11_reinit (void)
+{
+  int rv;
+
+  rv = p11_kit_initialize_registered ();
+  if (rv != CKR_OK)
+    {
+      gnutls_assert ();
+      _gnutls_debug_log ("Cannot initialize registered module: %s\n",
+                         p11_kit_strerror (rv));
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  return 0;
+}
+
 /**
  * gnutls_pkcs11_deinit:
  *