From: Hilko Bengen Date: Mon, 18 Feb 2019 15:31:28 +0000 (+0100) Subject: Do not set pkcs11-helper 'safe fork mode' X-Git-Tag: v2.4.8~13 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=5fd3d1d58ef0e26616e34a9144d0c984cf435444;p=thirdparty%2Fopenvpn.git Do not set pkcs11-helper 'safe fork mode' From the pkcs11-helper API documentation about pkcs11h_setForkMode(): > This funciton is releavant if PKCS11H_FEATURE_MASK_THREADING is > set. If safe mode is on, the child process can use the loaded > PKCS#11 providers but it cannot use fork(), while it is in one of > the hooks functions, since locked mutexes cannot be released. As far as I can tell, pkcs11-helper functionality is not used in a child process that is created after initialization. Even if OpenVPN is turned into a daemon, the pkcs11-helper library is only initialized after calling possibly_become_daemon(), i.e. in the child process. All other uses of fork() are immediately followed by an exec() This simple change fixes the symptoms described in both (hang on password prompt when systemd support is enabled) and (hang on initialization with newer versions of pkcs11-helper). I have successfully tested that this makes the described symptoms go away. For this, I used a YubiKey NEO on Debian/stable, a rebuild of OpenVPN 2.4.6 and two versions of libpkcs11-helper: - libpkcs11-helper 1.21-1 from Debian/stretch - a backport of libpkcs11-helper 1.25-1 from Debian/buster Acked-by: Steffan Karger Message-Id: <20190218153129.3818-1-bengen@hilluzination.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg18218.html Signed-off-by: Gert Doering (cherry picked from commit 59e45a8bbc9084329c683730325bc5b676058e71) --- diff --git a/src/openvpn/pkcs11.c b/src/openvpn/pkcs11.c index 93f8580ae..d40ca458d 100644 --- a/src/openvpn/pkcs11.c +++ b/src/openvpn/pkcs11.c @@ -312,7 +312,7 @@ pkcs11_initialize( pkcs11h_setLogLevel(_pkcs11_msg_openvpn2pkcs11(get_debug_level())); - if ((rv = pkcs11h_setForkMode(TRUE)) != CKR_OK) + if ((rv = pkcs11h_setForkMode(FALSE)) != CKR_OK) { msg(M_FATAL, "PKCS#11: Cannot set fork mode %ld-'%s'", rv, pkcs11h_getMessage(rv)); goto cleanup;