ensure that all the exported pkcs11 functions initialize PKCS #11.

diff --git a/lib/pkcs11.c b/lib/pkcs11.c
index 00fa871f58edc79a4d4c544d318f1b49e0a11f2b..1a7471bb470fd58b84bf681eef4f808b2494d661 100644 (file)
--- a/lib/pkcs11.c
+++ b/lib/pkcs11.c
@@ -212,8 +212,7 @@ pkcs11_add_module(const char* name, struct ck_function_list *module)
        return 0;
 }
 
-static int
-pkcs11_check_init(void)
+int _gnutls_pkcs11_check_init(void)
 {
        int ret;
        
@@ -942,11 +941,6 @@ pkcs11_find_slot(struct ck_function_list **module, ck_slot_id_t * slot,
        unsigned long nslots;
        ck_slot_id_t slots[MAX_SLOTS];
        
-       /* make sure that modules are initialized */
-       ret = pkcs11_check_init();
-       if (ret < 0)
-               return gnutls_assert_val(ret);
-
        for (x = 0; x < active_providers; x++) {
                if (providers[x].active == 0)
                        continue;
@@ -1009,7 +1003,7 @@ pkcs11_open_session(struct pkcs11_session_info *sinfo,
        struct ck_function_list *module;
        ck_slot_id_t slot;
        struct token_info tinfo;
-
+       
        ret = pkcs11_find_slot(&module, &slot, info, &tinfo);
        if (ret < 0) {
                gnutls_assert();
@@ -1059,11 +1053,6 @@ _pkcs11_traverse_tokens(find_func_t find_func, void *input,
        unsigned long nslots;
        ck_slot_id_t slots[MAX_SLOTS];
 
-       /* make sure that modules are initialized */
-       ret = pkcs11_check_init();
-       if (ret < 0)
-               return gnutls_assert_val(ret);
-
        for (x = 0; x < active_providers; x++) {
                if (providers[x].active == 0)
                        continue;
@@ -1651,6 +1640,8 @@ gnutls_pkcs11_obj_import_url(gnutls_pkcs11_obj_t obj, const char *url,
        int ret;
        struct url_find_data_st find_data;
 
+       PKCS11_CHECK_INIT;
+
        /* fill in the find data structure */
        find_data.crt = obj;
 
@@ -1728,6 +1719,8 @@ gnutls_pkcs11_token_get_url(unsigned int seq,
        int ret;
        struct token_num tn;
 
+       PKCS11_CHECK_INIT;
+
        memset(&tn, 0, sizeof(tn));
        tn.seq = seq;
        tn.info = p11_kit_uri_new();
@@ -2582,6 +2575,8 @@ gnutls_pkcs11_obj_list_import_url(gnutls_pkcs11_obj_t * p_list,
        int ret;
        struct crt_find_data_st priv;
 
+       PKCS11_CHECK_INIT;
+
        memset(&priv, 0, sizeof(priv));
 
        /* fill in the find data structure */
@@ -2842,6 +2837,8 @@ int gnutls_pkcs11_token_get_flags(const char *url, unsigned int *flags)
        struct flags_find_data_st find_data;
        int ret;
 
+       PKCS11_CHECK_INIT;
+
        memset(&find_data, 0, sizeof(find_data));
        ret = pkcs11_url_to_info(url, &find_data.info);
        if (ret < 0) {
@@ -2893,6 +2890,8 @@ gnutls_pkcs11_token_get_mechanism(const char *url, unsigned int idx,
        struct p11_kit_uri *info = NULL;
        unsigned long count;
        ck_mechanism_type_t mlist[400];
+       
+       PKCS11_CHECK_INIT;
 
        ret = pkcs11_url_to_info(url, &info);
        if (ret < 0) {
@@ -3135,6 +3134,8 @@ int gnutls_pkcs11_get_raw_issuer(const char *url, gnutls_x509_crt_t cert,
        size_t id_size;
        struct p11_kit_uri *info = NULL;
 
+       PKCS11_CHECK_INIT;
+
        memset(&priv, 0, sizeof(priv));
 
        if (url == NULL || url[0] == 0) {

diff --git a/lib/pkcs11_int.h b/lib/pkcs11_int.h
index 78e64c335d8a390a2af9828cb3b6011bc9c46ac1..d05a2727223f9a6e61637dc1a2a7107699ba18d8 100644 (file)
--- a/lib/pkcs11_int.h
+++ b/lib/pkcs11_int.h
@@ -34,7 +34,6 @@
 #include <p11-kit/uri.h>
 typedef unsigned char ck_bool_t;
 
-
 struct pkcs11_session_info {
        struct ck_function_list *module;
        struct ck_token_info tinfo;
@@ -62,6 +61,15 @@ struct gnutls_pkcs11_obj_st {
        struct pin_info_st pin;
 };
 
+/* This must be called on every function that uses a PKCS #11 function
+ * directly */
+int _gnutls_pkcs11_check_init(void);
+
+#define PKCS11_CHECK_INIT \
+       ret = _gnutls_pkcs11_check_init(); \
+       if (ret < 0) \
+               return gnutls_assert_val(ret)
+
 /* thus function is called for every token in the traverse_tokens
  * function. Once everything is traversed it is called with NULL tinfo.
  * It should return 0 if found what it was looking for.

diff --git a/lib/pkcs11_privkey.c b/lib/pkcs11_privkey.c
index e5eeb82fb5fe58904dc38e3bb1e280c24d892614..eaec7e1683b3deef574e94c9320652b20b51689a 100644 (file)
--- a/lib/pkcs11_privkey.c
+++ b/lib/pkcs11_privkey.c
@@ -218,6 +218,8 @@ _gnutls_pkcs11_privkey_sign_hash(gnutls_pkcs11_privkey_t key,
        struct pkcs11_session_info *sinfo;
        ck_object_handle_t obj;
 
+       PKCS11_CHECK_INIT;
+
        if (key->sinfo.init != 0) {
                sinfo = &key->sinfo;
                obj = key->obj;
@@ -322,6 +324,8 @@ int gnutls_pkcs11_privkey_status(gnutls_pkcs11_privkey_t key)
        struct pkcs11_session_info *sinfo;
        ck_object_handle_t obj;
        struct ck_session_info session_info;
+       
+       PKCS11_CHECK_INIT;
 
        if (key->sinfo.init != 0) {
                sinfo = &key->sinfo;
@@ -371,6 +375,8 @@ gnutls_pkcs11_privkey_import_url(gnutls_pkcs11_privkey_t pkey,
        ck_key_type_t key_type;
        struct pkcs11_session_info sinfo;
 
+       PKCS11_CHECK_INIT;
+
        memset(&sinfo, 0, sizeof(sinfo));
 
        ret = pkcs11_url_to_info(url, &pkey->info);
@@ -461,6 +467,8 @@ _gnutls_pkcs11_privkey_decrypt_data(gnutls_pkcs11_privkey_t key,
        struct pkcs11_session_info _sinfo;
        struct pkcs11_session_info *sinfo;
 
+       PKCS11_CHECK_INIT;
+
        if (key->sinfo.init != 0) {
                sinfo = &key->sinfo;
                obj = key->obj;
@@ -614,6 +622,8 @@ gnutls_pkcs11_privkey_generate2(const char *url, gnutls_pk_algorithm_t pk,
        gnutls_pubkey_t pkey = NULL;
        gnutls_pkcs11_obj_t obj = NULL;
 
+       PKCS11_CHECK_INIT;
+
        memset(&sinfo, 0, sizeof(sinfo));
 
        ret = pkcs11_url_to_info(url, &info);

diff --git a/lib/pkcs11_secret.c b/lib/pkcs11_secret.c
index 3d01912420b2b346d90ca3b0725a82d2436bd5b5..8e75ed1d2c357a8cf89dfc34b52926642407faa4 100644 (file)
--- a/lib/pkcs11_secret.c
+++ b/lib/pkcs11_secret.c
@@ -60,6 +60,8 @@ gnutls_pkcs11_copy_secret_key(const char *token_url, gnutls_datum_t * key,
        int a_val;
        uint8_t id[16];
        struct pkcs11_session_info sinfo;
+       
+       PKCS11_CHECK_INIT;
 
        memset(&sinfo, 0, sizeof(sinfo));
 

diff --git a/lib/pkcs11_write.c b/lib/pkcs11_write.c
index 9a9bd3cdfebc384d5a305aaa352967ba379a44ff..0172c7409618e704d59569794c9d3a3e93b6658a 100644 (file)
--- a/lib/pkcs11_write.c
+++ b/lib/pkcs11_write.c
@@ -61,6 +61,8 @@ gnutls_pkcs11_copy_x509_crt(const char *token_url,
        ck_object_handle_t obj;
        int a_val;
        struct pkcs11_session_info sinfo;
+       
+       PKCS11_CHECK_INIT;
 
        memset(&sinfo, 0, sizeof(sinfo));
 
@@ -229,6 +231,8 @@ gnutls_pkcs11_copy_x509_privkey(const char *token_url,
        gnutls_datum_t m, e, d, u, exp1, exp2;
        struct pkcs11_session_info sinfo;
 
+       PKCS11_CHECK_INIT;
+
        memset(&sinfo, 0, sizeof(sinfo));
 
        memset(&p, 0, sizeof(p));
@@ -634,6 +638,8 @@ int gnutls_pkcs11_delete_url(const char *object_url, unsigned int flags)
        int ret;
        struct delete_data_st find_data;
 
+       PKCS11_CHECK_INIT;
+
        memset(&find_data, 0, sizeof(find_data));
 
        ret = pkcs11_url_to_info(object_url, &find_data.info);
@@ -682,6 +688,8 @@ gnutls_pkcs11_token_init(const char *token_url,
        ck_slot_id_t slot;
        char flabel[32];
 
+       PKCS11_CHECK_INIT;
+
        ret = pkcs11_url_to_info(token_url, &info);
        if (ret < 0) {
                gnutls_assert();
@@ -738,6 +746,8 @@ gnutls_pkcs11_token_set_pin(const char *token_url,
        unsigned int ses_flags;
        struct pkcs11_session_info sinfo;
 
+       PKCS11_CHECK_INIT;
+
        memset(&sinfo, 0, sizeof(sinfo));
 
        ret = pkcs11_url_to_info(token_url, &info);
@@ -813,6 +823,8 @@ gnutls_pkcs11_token_get_random(const char *token_url,
        ck_rv_t rv;
        struct pkcs11_session_info sinfo;
 
+       PKCS11_CHECK_INIT;
+
        memset(&sinfo, 0, sizeof(sinfo));
 
        ret = pkcs11_url_to_info(token_url, &info);