import openssl-pkcs11-0.4.10-2.el8

2020-01-21 18:03:09 -05:00 · 2020-01-21 18:03:09 -05:00 · 4cb81df142
commit 4cb81df142
parent 00d5b9308f
20 changed files with 1071 additions and 1470 deletions
--- a/.gitignore
+++ b/.gitignore
@ -1 +1 @@
-SOURCES/libp11-0.4.8.tar.gz
+SOURCES/libp11-0.4.10.tar.gz
--- a/.openssl-pkcs11.metadata
+++ b/.openssl-pkcs11.metadata
@ -1 +1 @@
-c39ae70fda467b8096ed419fc6a1687421696717 SOURCES/libp11-0.4.8.tar.gz
+9407888f8f8fd144d0003390c20729cbfb75997f SOURCES/libp11-0.4.10.tar.gz
--- a/SOURCES/openssl-pkcs11-0.4.10-search-objects-in-all-matching-tokens.patch
+++ b/SOURCES/openssl-pkcs11-0.4.10-search-objects-in-all-matching-tokens.patch
@ -0,0 +1,929 @@
 From 3e219e92aecad385ba003c2276d58db3e80387cc Mon Sep 17 00:00:00 2001
 From: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
 Date: Thu, 5 Sep 2019 18:29:53 +0200
 Subject: [PATCH 1/4] tests/rsa-common: Add function to create various tokens
 This allows the creation of multiple devices in the test scripts.
 Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
 (cherry picked from commit 712e869189610f900ebf8c50090e228167b6bf8f)
 ---
 tests/rsa-common.sh | 54 +++++++++++++++++++++++++++++++++++----------
 1 file changed, 42 insertions(+), 12 deletions(-)
 diff --git a/tests/rsa-common.sh b/tests/rsa-common.sh
 index 7db5ba0..e6e12cb 100755
 --- a/tests/rsa-common.sh
 +++ b/tests/rsa-common.sh
@@ -86,13 +86,13 @@ init_db () {
 # Create a new device
 init_card () {
 -	PIN="$1"
 -	PUK="$2"
 -	DEV_LABEL="$3"
 +	pin="$1"
 +	puk="$2"
 +	dev_label="$3"
 -	echo -n "* Initializing smart card... "
 -	${SOFTHSM_TOOL} --init-token ${SLOT} --label "${DEV_LABEL}" \
 -		--so-pin "${PUK}" --pin "${PIN}" >/dev/null
 +	echo -n "* Initializing smart card ${dev_label}..."
 +	${SOFTHSM_TOOL} --init-token ${SLOT} --label "${dev_label}" \
 +		--so-pin "${puk}" --pin "${pin}" >/dev/null
 	if test $? = 0; then
 		echo ok
 	else
@@ -103,22 +103,26 @@ init_card () {
 # Import objects to the token
 import_objects () {
 -	ID=$1
 -	OBJ_LABEL=$2
 +	id=$1
 +	obj_label=$2
 +	token_label=$3
 -	pkcs11-tool -p ${PIN} --module ${MODULE} -d ${ID} -a ${OBJ_LABEL} -l -w \
 +	pkcs11-tool -p ${PIN} --module ${MODULE} -d ${id} \
 +		--token-label ${token_label} -a ${obj_label} -l -w \
 		${srcdir}/rsa-prvkey.der -y privkey >/dev/null
 	if test $? != 0;then
 		exit 1;
 	fi
 -	pkcs11-tool -p ${PIN} --module ${MODULE} -d ${ID} -a ${OBJ_LABEL} -l -w \
 +	pkcs11-tool -p ${PIN} --module ${MODULE} -d ${id} \
 +		--token-label ${token_label} -a ${obj_label} -l -w \
 		${srcdir}/rsa-pubkey.der -y pubkey >/dev/null
 	if test $? != 0;then
 		exit 1;
 	fi
 -	pkcs11-tool -p ${PIN} --module ${MODULE} -d ${ID} -a ${OBJ_LABEL} -l -w \
 +	pkcs11-tool -p ${PIN} --module ${MODULE} -d ${id} \
 +		--token-label ${token_label} -a ${obj_label} -l -w \
 		${srcdir}/rsa-cert.der -y cert >/dev/null
 	if test $? != 0;then
 		exit 1;
@@ -148,8 +152,34 @@ common_init () {
 	echo Importing
 	# Import the used objects (private key, public key, and certificate)
 -	import_objects 01020304 "server-key"
 +	import_objects 01020304 "server-key" "libp11-test"
 	# List the imported objects
 	list_objects
 }
 +
 +create_devices () {
 +	num_devices=$1
 +	pin="$2"
 +	puk="$3"
 +	common_label="$4"
 +	object_label="$5"
 +
 +	i=0
 +	while [ $i -le ${num_devices} ]; do
 +		init_card ${pin} ${puk} "${common_label}-$i"
 +
 +		echo "Importing objects to token ${common_label}-$i"
 +		# Import objects with different labels
 +		import_objects 01020304 "${object_label}-$i" "${common_label}-$i"
 +
 +		pkcs11-tool -p ${pin} --module ${MODULE} -l -O --token-label \
 +			"${common_label}-$i"
 +		if test $? != 0;then
 +			echo Failed!
 +			exit 1;
 +		fi
 +
 +		i=$(($i + 1))
 +	done
 +}
 -- 
 2.21.0
 From 7530dc3ae1350a9968733a9318825f187bd09f77 Mon Sep 17 00:00:00 2001
 From: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
 Date: Tue, 3 Sep 2019 19:04:27 +0200
 Subject: [PATCH 2/4] eng_back: Search objects in all matching tokens
 Previously, the search for objects would stop in the first matching
 token when a more generic PKCS#11 URI was provided (e.g.
 "pkcs11:type=public").  This change makes the search continue past the
 first matching token if the object was not found.
 In ctx_load_{key, cert}(), the search will try to login only if a single
 token matched the search.  This is to avoid trying the provided PIN
 against all matching tokens which could lock the devices.
 This also makes the search for objects to ignore uninitialized tokens
 and to avoid trying to login when the token does not require login.
 Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
 (cherry picked from commit 85a91f4502d48371df0d392d19cecfbced2388c0)
 ---
 src/eng_back.c                           | 393 +++++++++++++++--------
 tests/Makefile.am                        |   4 +-
 tests/pkcs11-uri-without-token.softhsm   |  62 ++++
 tests/search-all-matching-tokens.softhsm | 106 ++++++
 4 files changed, 426 insertions(+), 139 deletions(-)
 create mode 100755 tests/pkcs11-uri-without-token.softhsm
 create mode 100755 tests/search-all-matching-tokens.softhsm
 diff --git a/src/eng_back.c b/src/eng_back.c
 index 39a685a..afa6271 100644
 --- a/src/eng_back.c
 +++ b/src/eng_back.c
@@ -375,7 +375,7 @@ static X509 *ctx_load_cert(ENGINE_CTX *ctx, const char *s_slot_cert_id,
 		const int login)
 {
 	PKCS11_SLOT *slot;
 -	PKCS11_SLOT *found_slot = NULL;
 +	PKCS11_SLOT *found_slot = NULL, **matched_slots = NULL;
 	PKCS11_TOKEN *tok, *match_tok = NULL;
 	PKCS11_CERT *certs, *selected_cert = NULL;
 	X509 *x509;
@@ -387,6 +387,7 @@ static X509 *ctx_load_cert(ENGINE_CTX *ctx, const char *s_slot_cert_id,
 	size_t tmp_pin_len = MAX_PIN_LENGTH;
 	int slot_nr = -1;
 	char flags[64];
 +	size_t matched_count = 0;
 	if (ctx_init_libp11(ctx)) /* Delayed libp11 initialization */
 		return NULL;
@@ -401,11 +402,9 @@ static X509 *ctx_load_cert(ENGINE_CTX *ctx, const char *s_slot_cert_id,
 					"The certificate ID is not a valid PKCS#11 URI\n"
 					"The PKCS#11 URI format is defined by RFC7512\n");
 				ENGerr(ENG_F_CTX_LOAD_CERT, ENG_R_INVALID_ID);
 -				return NULL;
 +				goto error;
 			}
 			if (tmp_pin_len > 0 && tmp_pin[0] != 0) {
 -				if (!login)
 -					return NULL; /* Process on second attempt */
 				ctx_destroy_pin(ctx);
 				ctx->pin = OPENSSL_malloc(MAX_PIN_LENGTH+1);
 				if (ctx->pin != NULL) {
@@ -424,7 +423,7 @@ static X509 *ctx_load_cert(ENGINE_CTX *ctx, const char *s_slot_cert_id,
 					"The legacy ENGINE_pkcs11 ID format is also "
 					"still accepted for now\n");
 				ENGerr(ENG_F_CTX_LOAD_CERT, ENG_R_INVALID_ID);
 -				return NULL;
 +				goto error;
 			}
 		}
 		ctx_log(ctx, 1, "Looking in slot %d for certificate: ",
@@ -440,6 +439,13 @@ static X509 *ctx_load_cert(ENGINE_CTX *ctx, const char *s_slot_cert_id,
 		ctx_log(ctx, 1, "\n");
 	}
 +	matched_slots = (PKCS11_SLOT **)calloc(ctx->slot_count,
 +		sizeof(PKCS11_SLOT *));
 +	if (matched_slots == NULL) {
 +		ctx_log(ctx, 0, "Could not allocate memory for matched slots\n");
 +		goto error;
 +	}
 +
 	for (n = 0; n < ctx->slot_count; n++) {
 		slot = ctx->slot_list + n;
 		flags[0] = '\0';
@@ -463,6 +469,7 @@ static X509 *ctx_load_cert(ENGINE_CTX *ctx, const char *s_slot_cert_id,
 			slot_nr == (int)PKCS11_get_slotid_from_slot(slot)) {
 			found_slot = slot;
 		}
 +
 		if (match_tok && slot->token &&
 				(match_tok->label == NULL ||
 					!strcmp(match_tok->label, slot->token->label)) &&
@@ -483,75 +490,115 @@ static X509 *ctx_load_cert(ENGINE_CTX *ctx, const char *s_slot_cert_id,
 				slot->token->label : "no label");
 		}
 		ctx_log(ctx, 1, "\n");
 -	}
 -	if (match_tok) {
 -		OPENSSL_free(match_tok->model);
 -		OPENSSL_free(match_tok->manufacturer);
 -		OPENSSL_free(match_tok->serialnr);
 -		OPENSSL_free(match_tok->label);
 -		OPENSSL_free(match_tok);
 -	}
 -	if (found_slot) {
 -		slot = found_slot;
 -	} else if (match_tok) {
 -		ctx_log(ctx, 0, "Specified object not found\n");
 -		return NULL;
 -	} else if (slot_nr == -1) {
 -		if (!(slot = PKCS11_find_token(ctx->pkcs11_ctx,
 -				ctx->slot_list, ctx->slot_count))) {
 -			ctx_log(ctx, 0, "No tokens found\n");
 -			return NULL;
 -		}
 -	} else {
 -		ctx_log(ctx, 0, "Invalid slot number: %d\n", slot_nr);
 -		return NULL;
 -	}
 -	tok = slot->token;
 +		if (found_slot && found_slot->token && !found_slot->token->initialized)
 +			ctx_log(ctx, 0, "Found uninitialized token\n");
 -	if (tok == NULL) {
 -		ctx_log(ctx, 0, "Empty token found\n");
 -		return NULL;
 +		/* Ignore slots without tokens or with uninitialized token */
 +		if (found_slot && found_slot->token && found_slot->token->initialized) {
 +			matched_slots[matched_count] = found_slot;
 +			matched_count++;
 +		}
 +		found_slot = NULL;
 	}
 -	ctx_log(ctx, 1, "Found slot:  %s\n", slot->description);
 -	ctx_log(ctx, 1, "Found token: %s\n", slot->token->label);
 +	if (matched_count == 0) {
 +		if (match_tok) {
 +			ctx_log(ctx, 0, "Specified object not found\n");
 +			goto error;
 +		}
 -	/* In several tokens certificates are marked as private */
 -	if (login && !ctx_login(ctx, slot, tok,
 -			ctx->ui_method, ctx->callback_data)) {
 -		ctx_log(ctx, 0, "Login to token failed, returning NULL...\n");
 -		return NULL;
 +		/* If the legacy slot ID format was used */
 +		if (slot_nr != -1) {
 +			ctx_log(ctx, 0, "Invalid slot number: %d\n", slot_nr);
 +			goto error;
 +		} else {
 +			found_slot = PKCS11_find_token(ctx->pkcs11_ctx,
 +								ctx->slot_list, ctx->slot_count);
 +			/* Ignore if the the token is not initialized */
 +			if (found_slot && found_slot->token &&
 +					found_slot->token->initialized) {
 +				matched_slots[matched_count] = found_slot;
 +				matched_count++;
 +			} else {
 +				ctx_log(ctx, 0, "No tokens found\n");
 +				goto error;
 +			}
 +		}
 	}
 -	if (PKCS11_enumerate_certs(tok, &certs, &cert_count)) {
 -		ctx_log(ctx, 0, "Unable to enumerate certificates\n");
 -		return NULL;
 -	}
 +	for (n = 0; n < matched_count; n++) {
 +		slot = matched_slots[n];
 +		tok = slot->token;
 +		if (tok == NULL) {
 +			ctx_log(ctx, 0, "Empty token found\n");
 +			break;
 +		}
 -	ctx_log(ctx, 1, "Found %u cert%s:\n", cert_count,
 -		(cert_count <= 1) ? "" : "s");
 -	if ((s_slot_cert_id && *s_slot_cert_id) &&
 -			(cert_id_len != 0 || cert_label != NULL)) {
 -		for (n = 0; n < cert_count; n++) {
 -			PKCS11_CERT *k = certs + n;
 +		ctx_log(ctx, 1, "Found slot:  %s\n", slot->description);
 +		ctx_log(ctx, 1, "Found token: %s\n", slot->token->label);
 +
 +		/* In several tokens certificates are marked as private */
 +		if (login) {
 +			/* Only try to login if login is required */
 +			if (tok->loginRequired) {
 +				/* Only try to login if a single slot matched to avoiding trying
 +				 * the PIN against all matching slots */
 +				if (matched_count == 1) {
 +					if (!ctx_login(ctx, slot, tok,
 +							ctx->ui_method, ctx->callback_data)) {
 +						ctx_log(ctx, 0, "Login to token failed, returning NULL...\n");
 +						goto error;
 +					}
 +				} else {
 +					ctx_log(ctx, 0, "Multiple matching slots (%lu); will not try to"
 +						" login\n", matched_count);
 +					for (m = 0; m < matched_count; m++){
 +						slot = matched_slots[m];
 +						ctx_log(ctx, 0, "[%u] %s: %s\n", m + 1,
 +								slot->description? slot->description:
 +								"(no description)",
 +								(slot->token && slot->token->label)?
 +								slot->token->label: "no label");
 +					}
 +					goto error;
 +				}
 +			}
 +		}
 -			if (cert_label != NULL && strcmp(k->label, cert_label) == 0)
 -				selected_cert = k;
 -			if (cert_id_len != 0 && k->id_len == cert_id_len &&
 -					memcmp(k->id, cert_id, cert_id_len) == 0)
 -				selected_cert = k;
 +		if (PKCS11_enumerate_certs(tok, &certs, &cert_count)) {
 +			ctx_log(ctx, 0, "Unable to enumerate certificates\n");
 +			continue;
 		}
 -	} else {
 -		for (n = 0; n < cert_count; n++) {
 -			PKCS11_CERT *k = certs + n;
 -			if (k->id && *(k->id)) {
 -				selected_cert = k; /* Use the first certificate with nonempty id */
 -				break;
 +
 +		ctx_log(ctx, 1, "Found %u cert%s:\n", cert_count,
 +				(cert_count <= 1) ? "" : "s");
 +		if ((s_slot_cert_id && *s_slot_cert_id) &&
 +				(cert_id_len != 0 || cert_label != NULL)) {
 +			for (m = 0; m < cert_count; m++) {
 +				PKCS11_CERT *k = certs + m;
 +
 +				if (cert_label != NULL && strcmp(k->label, cert_label) == 0)
 +					selected_cert = k;
 +				if (cert_id_len != 0 && k->id_len == cert_id_len &&
 +						memcmp(k->id, cert_id, cert_id_len) == 0)
 +					selected_cert = k;
 +			}
 +		} else {
 +			for (m = 0; m < cert_count; m++) {
 +				PKCS11_CERT *k = certs + m;
 +				if (k->id && *(k->id)) {
 +					selected_cert = k; /* Use the first certificate with nonempty id */
 +					break;
 +				}
 			}
 +			if (!selected_cert)
 +				selected_cert = certs; /* Use the first certificate */
 +		}
 +
 +		if (selected_cert) {
 +			break;
 		}
 -		if (!selected_cert)
 -			selected_cert = certs; /* Use the first certificate */
 	}
 	if (selected_cert != NULL) {
@@ -561,8 +608,20 @@ static X509 *ctx_load_cert(ENGINE_CTX *ctx, const char *s_slot_cert_id,
 			ctx_log(ctx, 0, "Certificate not found.\n");
 		x509 = NULL;
 	}
 +error:
 +	/* Free the searched token data */
 +	if (match_tok) {
 +		OPENSSL_free(match_tok->model);
 +		OPENSSL_free(match_tok->manufacturer);
 +		OPENSSL_free(match_tok->serialnr);
 +		OPENSSL_free(match_tok->label);
 +		OPENSSL_free(match_tok);
 +	}
 +
 	if (cert_label != NULL)
 		OPENSSL_free(cert_label);
 +	if (matched_slots != NULL)
 +		free(matched_slots);
 	return x509;
 }
@@ -605,7 +664,7 @@ static EVP_PKEY *ctx_load_key(ENGINE_CTX *ctx, const char *s_slot_key_id,
 		const int isPrivate, const int login)
 {
 	PKCS11_SLOT *slot;
 -	PKCS11_SLOT *found_slot = NULL;
 +	PKCS11_SLOT *found_slot = NULL, **matched_slots = NULL;
 	PKCS11_TOKEN *tok, *match_tok = NULL;
 	PKCS11_KEY *keys, *selected_key = NULL;
 	EVP_PKEY *pk = NULL;
@@ -617,6 +676,7 @@ static EVP_PKEY *ctx_load_key(ENGINE_CTX *ctx, const char *s_slot_key_id,
 	char tmp_pin[MAX_PIN_LENGTH+1];
 	size_t tmp_pin_len = MAX_PIN_LENGTH;
 	char flags[64];
 +	size_t matched_count = 0;
 	if (ctx_init_libp11(ctx)) /* Delayed libp11 initialization */
 		goto error;
@@ -637,7 +697,9 @@ static EVP_PKEY *ctx_load_key(ENGINE_CTX *ctx, const char *s_slot_key_id,
 				goto error;
 			}
 			if (tmp_pin_len > 0 && tmp_pin[0] != 0) {
 -				if (!login)
 +				/* If the searched key is public, try without login once even
 +				 * when the PIN is provided */
 +				if (!login && isPrivate)
 					goto error; /* Process on second attempt */
 				ctx_destroy_pin(ctx);
 				ctx->pin = OPENSSL_malloc(MAX_PIN_LENGTH+1);
@@ -673,6 +735,13 @@ static EVP_PKEY *ctx_load_key(ENGINE_CTX *ctx, const char *s_slot_key_id,
 		ctx_log(ctx, 1, "\n");
 	}
 +	matched_slots = (PKCS11_SLOT **)calloc(ctx->slot_count,
 +		sizeof(PKCS11_SLOT *));
 +	if (matched_slots == NULL) {
 +		ctx_log(ctx, 0, "Could not allocate memory for matched slots\n");
 +		goto error;
 +	}
 +
 	for (n = 0; n < ctx->slot_count; n++) {
 		slot = ctx->slot_list + n;
 		flags[0] = '\0';
@@ -696,6 +765,7 @@ static EVP_PKEY *ctx_load_key(ENGINE_CTX *ctx, const char *s_slot_key_id,
 			slot_nr == (int)PKCS11_get_slotid_from_slot(slot)) {
 			found_slot = slot;
 		}
 +
 		if (match_tok && slot->token &&
 				(match_tok->label == NULL ||
 					!strcmp(match_tok->label, slot->token->label)) &&
@@ -716,92 +786,128 @@ static EVP_PKEY *ctx_load_key(ENGINE_CTX *ctx, const char *s_slot_key_id,
 				slot->token->label : "no label");
 		}
 		ctx_log(ctx, 1, "\n");
 -	}
 -	if (match_tok) {
 -		OPENSSL_free(match_tok->model);
 -		OPENSSL_free(match_tok->manufacturer);
 -		OPENSSL_free(match_tok->serialnr);
 -		OPENSSL_free(match_tok->label);
 -		OPENSSL_free(match_tok);
 +		if (found_slot && found_slot->token && !found_slot->token->initialized)
 +			ctx_log(ctx, 0, "Found uninitialized token\n");
 +
 +		/* Ignore slots without tokens or with uninitialized token */
 +		if (found_slot && found_slot->token && found_slot->token->initialized) {
 +			matched_slots[matched_count] = found_slot;
 +			matched_count++;
 +		}
 +		found_slot = NULL;
 	}
 -	if (found_slot) {
 -		slot = found_slot;
 -	} else if (match_tok) {
 -		ctx_log(ctx, 0, "Specified object not found\n");
 -		goto error;
 -	} else if (slot_nr == -1) {
 -		if (!(slot = PKCS11_find_token(ctx->pkcs11_ctx,
 -				ctx->slot_list, ctx->slot_count))) {
 -			ctx_log(ctx, 0, "No tokens found\n");
 +
 +	if (matched_count == 0) {
 +		if (match_tok) {
 +			ctx_log(ctx, 0, "Specified object not found\n");
 			goto error;
 		}
 -	} else {
 -		ctx_log(ctx, 0, "Invalid slot number: %d\n", slot_nr);
 -		goto error;
 -	}
 -	tok = slot->token;
 -	if (tok == NULL) {
 -		ctx_log(ctx, 0, "Found empty token\n");
 -		goto error;
 +		/* If the legacy slot ID format was used */
 +		if (slot_nr != -1) {
 +			ctx_log(ctx, 0, "Invalid slot number: %d\n", slot_nr);
 +			goto error;
 +		} else {
 +			found_slot = PKCS11_find_token(ctx->pkcs11_ctx,
 +								ctx->slot_list, ctx->slot_count);
 +			/* Ignore if the the token is not initialized */
 +			if (found_slot && found_slot->token &&
 +					found_slot->token->initialized) {
 +				matched_slots[matched_count] = found_slot;
 +				matched_count++;
 +			} else {
 +				ctx_log(ctx, 0, "No tokens found\n");
 +				goto error;
 +			}
 +		}
 	}
 -	/* The following check is non-critical to ensure interoperability
 -	 * with some other (which ones?) PKCS#11 libraries */
 -	if (!tok->initialized)
 -		ctx_log(ctx, 0, "Found uninitialized token\n");
 -	ctx_log(ctx, 1, "Found slot:  %s\n", slot->description);
 -	ctx_log(ctx, 1, "Found token: %s\n", slot->token->label);
 +	for (n = 0; n < matched_count; n++) {
 +		slot = matched_slots[n];
 +		tok = slot->token;
 +		if (tok == NULL) {
 +			ctx_log(ctx, 0, "Found empty token\n");
 +			break;
 +		}
 -	/* Both private and public keys can have the CKA_PRIVATE attribute
 -	 * set and thus require login (even to retrieve attributes!) */
 -	if (login && !ctx_login(ctx, slot, tok, ui_method, callback_data)) {
 -		ctx_log(ctx, 0, "Login to token failed, returning NULL...\n");
 -		goto error;
 -	}
 +		ctx_log(ctx, 1, "Found slot:  %s\n", slot->description);
 +		ctx_log(ctx, 1, "Found token: %s\n", slot->token->label);
 +
 +		/* Both private and public keys can have the CKA_PRIVATE attribute
 +		 * set and thus require login (even to retrieve attributes!) */
 +		if (login) {
 +			/* Try to login only if login is required */
 +			if (tok->loginRequired) {
 +				/* Try to login only if a single slot matched to avoiding trying
 +				 * the PIN against all matching slots */
 +				if (matched_count == 1) {
 +					if (!ctx_login(ctx, slot, tok, ui_method, callback_data)) {
 +						ctx_log(ctx, 0, "Login to token failed, returning NULL...\n");
 +						goto error;
 +					}
 +				} else {
 +					ctx_log(ctx, 0, "Multiple matching slots (%lu); will not try to"
 +						" login\n", matched_count);
 +					for (m = 0; m < matched_count; m++){
 +						slot = matched_slots[m];
 +						ctx_log(ctx, 1, "[%u] %s: %s\n", m + 1,
 +								slot->description? slot->description:
 +								"(no description)",
 +								(slot->token && slot->token->label)?
 +								slot->token->label: "no label");
 +					}
 +					goto error;
 +				}
 +			}
 +		}
 -	if (isPrivate) {
 -		/* Make sure there is at least one private key on the token */
 -		if (PKCS11_enumerate_keys(tok, &keys, &key_count)) {
 -			ctx_log(ctx, 0, "Unable to enumerate private keys\n");
 -			goto error;
 +		if (isPrivate) {
 +			/* Make sure there is at least one private key on the token */
 +			if (PKCS11_enumerate_keys(tok, &keys, &key_count)) {
 +				ctx_log(ctx, 0, "Unable to enumerate private keys\n");
 +				continue;
 +			}
 +		} else {
 +			/* Make sure there is at least one public key on the token */
 +			if (PKCS11_enumerate_public_keys(tok, &keys, &key_count)) {
 +				ctx_log(ctx, 0, "Unable to enumerate public keys\n");
 +				continue;
 +			}
 		}
 -	} else {
 -		/* Make sure there is at least one public key on the token */
 -		if (PKCS11_enumerate_public_keys(tok, &keys, &key_count)) {
 -			ctx_log(ctx, 0, "Unable to enumerate public keys\n");
 -			goto error;
 +		if (key_count == 0) {
 +			if (login) /* Only print the error on the second attempt */
 +				ctx_log(ctx, 0, "No %s keys found.\n",
 +						(char *)(isPrivate ? "private" : "public"));
 +			continue;
 		}
 -	}
 -	if (key_count == 0) {
 -		if (login) /* Only print the error on the second attempt */
 -			ctx_log(ctx, 0, "No %s keys found.\n",
 -				(char *)(isPrivate ? "private" : "public"));
 -		goto error;
 -	}
 -	ctx_log(ctx, 1, "Found %u %s key%s:\n", key_count,
 -		(char *)(isPrivate ? "private" : "public"),
 -		(key_count == 1) ? "" : "s");
 -
 -	if (s_slot_key_id && *s_slot_key_id &&
 -			(key_id_len != 0 || key_label != NULL)) {
 -		for (n = 0; n < key_count; n++) {
 -			PKCS11_KEY *k = keys + n;
 -
 -			ctx_log(ctx, 1, "  %2u %c%c id=", n + 1,
 -				k->isPrivate ? 'P' : ' ',
 -				k->needLogin ? 'L' : ' ');
 -			dump_hex(ctx, 1, k->id, k->id_len);
 -			ctx_log(ctx, 1, " label=%s\n", k->label);
 -			if (key_label != NULL && strcmp(k->label, key_label) == 0)
 -				selected_key = k;
 -			if (key_id_len != 0 && k->id_len == key_id_len
 -					&& memcmp(k->id, key_id, key_id_len) == 0)
 -				selected_key = k;
 +		ctx_log(ctx, 1, "Found %u %s key%s:\n", key_count,
 +				(char *)(isPrivate ? "private" : "public"),
 +				(key_count == 1) ? "" : "s");
 +
 +		if (s_slot_key_id && *s_slot_key_id &&
 +				(key_id_len != 0 || key_label != NULL)) {
 +			for (m = 0; m < key_count; m++) {
 +				PKCS11_KEY *k = keys + m;
 +
 +				ctx_log(ctx, 1, "  %2u %c%c id=", m + 1,
 +						k->isPrivate ? 'P' : ' ',
 +						k->needLogin ? 'L' : ' ');
 +				dump_hex(ctx, 1, k->id, k->id_len);
 +				ctx_log(ctx, 1, " label=%s\n", k->label);
 +				if (key_label != NULL && strcmp(k->label, key_label) == 0)
 +					selected_key = k;
 +				if (key_id_len != 0 && k->id_len == key_id_len
 +						&& memcmp(k->id, key_id, key_id_len) == 0)
 +					selected_key = k;
 +			}
 +		} else {
 +			selected_key = keys; /* Use the first key */
 +		}
 +
 +		if (selected_key) {
 +			break;
 		}
 -	} else {
 -		selected_key = keys; /* Use the first key */
 	}
 	if (selected_key != NULL) {
@@ -813,9 +919,20 @@ static EVP_PKEY *ctx_load_key(ENGINE_CTX *ctx, const char *s_slot_key_id,
 			ctx_log(ctx, 0, "Key not found.\n");
 		pk = NULL;
 	}
 +
 error:
 +	/* Free the searched token data */
 +	if (match_tok) {
 +		OPENSSL_free(match_tok->model);
 +		OPENSSL_free(match_tok->manufacturer);
 +		OPENSSL_free(match_tok->serialnr);
 +		OPENSSL_free(match_tok->label);
 +		OPENSSL_free(match_tok);
 +	}
 	if (key_label != NULL)
 		OPENSSL_free(key_label);
 +	if (matched_slots != NULL)
 +		free(matched_slots);
 	return pk;
 }
 diff --git a/tests/Makefile.am b/tests/Makefile.am
 index 2a84403..18886df 100644
 --- a/tests/Makefile.am
 +++ b/tests/Makefile.am
@@ -28,7 +28,9 @@ dist_check_SCRIPTS = \
 	rsa-pss-sign.softhsm \
 	rsa-oaep.softhsm \
 	case-insensitive.softhsm \
 -	ec-check-privkey.softhsm
 +	ec-check-privkey.softhsm \
 +	pkcs11-uri-without-token.softhsm \
 +	search-all-matching-tokens.softhsm
 dist_check_DATA = \
 	rsa-cert.der rsa-prvkey.der rsa-pubkey.der \
 	ec-cert.der ec-prvkey.der ec-pubkey.der
 diff --git a/tests/pkcs11-uri-without-token.softhsm b/tests/pkcs11-uri-without-token.softhsm
 new file mode 100755
 index 0000000..f82e1f4
 --- /dev/null
 +++ b/tests/pkcs11-uri-without-token.softhsm
@@ -0,0 +1,62 @@
 +#!/bin/sh
 +
 +# Copyright (C) 2015 Nikos Mavrogiannopoulos
 +#
 +# GnuTLS is free software; you can redistribute it and/or modify it
 +# under the terms of the GNU General Public License as published by the
 +# Free Software Foundation; either version 3 of the License, or (at
 +# your option) any later version.
 +#
 +# GnuTLS is distributed in the hope that it will be useful, but
 +# WITHOUT ANY WARRANTY; without even the implied warranty of
 +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 +# General Public License for more details.
 +#
 +# You should have received a copy of the GNU General Public License
 +# along with GnuTLS; if not, write to the Free Software Foundation,
 +# Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
 +
 +# This test checks if it is possible to use the keys without specifying the
 +# token if there is only one initialized token available.
 +
 +outdir="output.$$"
 +
 +# Load common test functions
 +. ${srcdir}/rsa-common.sh
 +
 +# Do the common test initialization
 +common_init
 +
 +sed -e "s|@MODULE_PATH@|${MODULE}|g" -e \
 +    "s|@ENGINE_PATH@|../src/.libs/pkcs11.so|g" \
 +    <"${srcdir}/engines.cnf.in" >"${outdir}/engines.cnf"
 +
 +export OPENSSL_ENGINES="../src/.libs/"
 +export OPENSSL_CONF="${outdir}/engines.cnf"
 +
 +# These URIs don't contain the token specification
 +PRIVATE_KEY="pkcs11:object=server-key;type=private;pin-value=1234"
 +PUBLIC_KEY="pkcs11:object=server-key;type=public;pin-value=1234"
 +
 +# Create input file
 +echo "secret" >"${outdir}/in.txt"
 +
 +# Generate signature without specifying the token in the PKCS#11 URI
 +openssl pkeyutl -engine pkcs11 -keyform engine -inkey "${PRIVATE_KEY}" \
 +	-sign -out "${outdir}/signature.bin" -in "${outdir}/in.txt"
 +if test $? != 0;then
 +	echo "Failed to generate signature using PKCS#11 URI ${PRIVATE_KEY}"
 +	exit 1;
 +fi
 +
 +# Verify the signature without specifying the token in the PKCS#11 URI
 +openssl pkeyutl -engine pkcs11 -keyform engine -pubin -inkey "${PUBLIC_KEY}" \
 +	-verify -sigfile "${outdir}/signature.bin" -in "${outdir}/in.txt"
 +if test $? != 0;then
 +	echo "Failed to verify signature using PKCS#11 URI ${PUBLIC_KEY}"
 +	exit 1;
 +fi
 +
 +rm -rf "$outdir"
 +
 +exit 0
 diff --git a/tests/search-all-matching-tokens.softhsm b/tests/search-all-matching-tokens.softhsm
 new file mode 100755
 index 0000000..d0810c4
 --- /dev/null
 +++ b/tests/search-all-matching-tokens.softhsm
@@ -0,0 +1,106 @@
 +#!/bin/sh
 +
 +# Copyright (C) 2015 Nikos Mavrogiannopoulos
 +#
 +# GnuTLS is free software; you can redistribute it and/or modify it
 +# under the terms of the GNU General Public License as published by the
 +# Free Software Foundation; either version 3 of the License, or (at
 +# your option) any later version.
 +#
 +# GnuTLS is distributed in the hope that it will be useful, but
 +# WITHOUT ANY WARRANTY; without even the implied warranty of
 +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 +# General Public License for more details.
 +#
 +# You should have received a copy of the GNU General Public License
 +# along with GnuTLS; if not, write to the Free Software Foundation,
 +# Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
 +
 +# This test checks if the search for objects in tokens will continue past the
 +# first token found.
 +#
 +# Generic PKCS#11 URIs are used to make the search to match more than one
 +# token. The search should be able to find the objects in each device, which are
 +# labeled differently per token.
 +#
 +# This test also contains a negative test to verify that the engine will not try
 +# to login to a token if more than one token matched the search. This is why it
 +# is required to have only one match to be able to use a private key.
 +
 +outdir="output.$$"
 +
 +# Load common test functions
 +. ${srcdir}/rsa-common.sh
 +
 +PIN=1234
 +PUK=1234
 +
 +NUM_DEVICES=5
 +
 +# Initialize the SoftHSM DB
 +init_db
 +
 +# Create some devices
 +create_devices $NUM_DEVICES $PIN $PUK "libp11-test" "label"
 +
 +sed -e "s|@MODULE_PATH@|${MODULE}|g" -e "s|@ENGINE_PATH@|../src/.libs/pkcs11.so|g" <"${srcdir}/engines.cnf.in" >"${outdir}/engines.cnf"
 +
 +export OPENSSL_ENGINES="../src/.libs/"
 +export OPENSSL_CONF="${outdir}/engines.cnf"
 +
 +PRIVATE_KEY="pkcs11:token=libp11-test-3;object=label-3;type=private;pin-value=1234"
 +PRIVATE_KEY_WITHOUT_TOKEN="pkcs11:object=label-3;type=private;pin-value=1234"
 +PUBLIC_KEY_ANY="pkcs11:type=public"
 +CERTIFICATE="pkcs11:object=label-3;type=cert;pin-value=1234"
 +
 +# Create input file
 +echo "secret" > "${outdir}/in.txt"
 +
 +# Verify that it doesn't try to login if more than one token matched the search
 +openssl pkeyutl -engine pkcs11 -keyform engine \
 +	-inkey "${PRIVATE_KEY_WITHOUT_TOKEN}" \
 +	-sign -out "${outdir}/signature.bin" -in "${outdir}/in.txt"
 +if test $? = 0;then
 +	echo "Did not fail when the PKCS#11 URI matched multiple tokens"
 +fi
 +
 +# Generate signature specifying the token in the PKCS#11 URI
 +openssl pkeyutl -engine pkcs11 -keyform engine -inkey "${PRIVATE_KEY}" \
 +	-sign -out "${outdir}/signature.bin" -in "${outdir}/in.txt"
 +if test $? != 0;then
 +	echo "Failed to sign file using PKCS#11 URI ${PRIVATE_KEY}"
 +	exit 1;
 +fi
 +
 +# Verify the signature using the public key from each token
 +i=0
 +while [ $i -le ${NUM_DEVICES} ]; do
 +	pubkey="pkcs11:object=label-$i;type=public;pin-value=1234"
 +	openssl pkeyutl -engine pkcs11 -keyform engine -pubin -inkey "${pubkey}" \
 +		-verify -sigfile "${outdir}/signature.bin" -in "${outdir}/in.txt"
 +	if test $? != 0;then
 +		echo "Failed to verify the signature using the PKCS#11 URI ${pubkey}"
 +		exit 1;
 +	fi
 +	i=$(($i + 1))
 +done
 +
 +# Verify the signature using a certificate without specifying the token
 +openssl pkeyutl -engine pkcs11 -keyform engine -pubin -inkey "${CERTIFICATE}" \
 +	-verify -sigfile "${outdir}/signature.bin" -in "${outdir}/in.txt"
 +if test $? != 0;then
 +	echo "Failed to verify the signature using the PKCS#11 URI ${CERTIFICATE}"
 +	exit 1;
 +fi
 +
 +# Verify the signature using the first public key found
 +openssl pkeyutl -engine pkcs11 -keyform engine -pubin -inkey "${PUBLIC_KEY_ANY}" \
 +	-verify -sigfile "${outdir}/signature.bin" -in "${outdir}/in.txt"
 +if test $? != 0;then
 +	echo "Failed to verify the signature using the PKCS#11 URI ${PUBLIC_KEY_ANY}."
 +	exit 1;
 +fi
 +
 +rm -rf "$outdir"
 +
 +exit 0
 -- 
 2.21.0
 From f7e9c100386e8ed9c0670e36c6023d4c928d132f Mon Sep 17 00:00:00 2001
 From: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
 Date: Thu, 21 Nov 2019 16:40:45 +0100
 Subject: [PATCH 3/4] eng_back: Initialize variable
 The unitialized variable could be returned to the caller in case of
 error, being the value undefined.
 Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
 (cherry picked from commit f9fd7e65f15d20d4f4f767bb84dfccce02f834e5)
 ---
 src/eng_back.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/src/eng_back.c b/src/eng_back.c
 index afa6271..0dd697d 100644
 --- a/src/eng_back.c
 +++ b/src/eng_back.c
@@ -378,7 +378,7 @@ static X509 *ctx_load_cert(ENGINE_CTX *ctx, const char *s_slot_cert_id,
 	PKCS11_SLOT *found_slot = NULL, **matched_slots = NULL;
 	PKCS11_TOKEN *tok, *match_tok = NULL;
 	PKCS11_CERT *certs, *selected_cert = NULL;
 -	X509 *x509;
 +	X509 *x509 = NULL;
 	unsigned int cert_count, n, m;
 	unsigned char cert_id[MAX_VALUE_LEN / 2];
 	size_t cert_id_len = sizeof(cert_id);
 -- 
 2.21.0
 From 823a97403c80d475c5a0ba88e1f63923dd540db8 Mon Sep 17 00:00:00 2001
 From: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
 Date: Mon, 25 Nov 2019 16:00:33 +0100
 Subject: [PATCH 4/4] tests: Add missing exit when test case fail
 The missing exit would make the test to pass even when the test case
 failed.
 Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
 (cherry picked from commit a41cbb29083545ceee8da35fa0067e402ed7d676)
 ---
 tests/search-all-matching-tokens.softhsm | 1 +
 1 file changed, 1 insertion(+)
 diff --git a/tests/search-all-matching-tokens.softhsm b/tests/search-all-matching-tokens.softhsm
 index d0810c4..0db697e 100755
 --- a/tests/search-all-matching-tokens.softhsm
 +++ b/tests/search-all-matching-tokens.softhsm
@@ -62,6 +62,7 @@ openssl pkeyutl -engine pkcs11 -keyform engine \
 	-sign -out "${outdir}/signature.bin" -in "${outdir}/in.txt"
 if test $? = 0;then
 	echo "Did not fail when the PKCS#11 URI matched multiple tokens"
 +	exit 1;
 fi
 # Generate signature specifying the token in the PKCS#11 URI
 -- 
 2.21.0
--- a/SOURCES/openssl-pkcs11-0.4.10-set-rsa-fips-method-flag.patch
+++ b/SOURCES/openssl-pkcs11-0.4.10-set-rsa-fips-method-flag.patch
@ -0,0 +1,11 @@
 --- a/src/p11_rsa.c	2019-04-03 21:58:18.000000000 +0200
 +++ b/src/p11_rsa.c	2019-11-28 15:46:18.898258545 +0100
@@ -478,7 +478,7 @@
 		if (ops == NULL)
 			return NULL;
 		RSA_meth_set1_name(ops, "libp11 RSA method");
 -		RSA_meth_set_flags(ops, 0);
 +		RSA_meth_set_flags(ops, RSA_FLAG_FIPS_METHOD);
 		RSA_meth_set_priv_enc(ops, pkcs11_rsa_priv_enc_method);
 		RSA_meth_set_priv_dec(ops, pkcs11_rsa_priv_dec_method);
 		RSA_meth_set_finish(ops, pkcs11_rsa_free_method);
--- a/SOURCES/openssl-pkcs11-0.4.10-small-bug-fixes.patch
+++ b/SOURCES/openssl-pkcs11-0.4.10-small-bug-fixes.patch
@ -0,0 +1,112 @@
 From 987ad38fbb16e5c4fb2f7e8ba7be50f54d108417 Mon Sep 17 00:00:00 2001
 From: Henrik Riomar <henrik.riomar@gmail.com>
 Date: Wed, 10 Apr 2019 13:54:17 +0200
 Subject: [PATCH 1/3] add needed include for getpid()
 Fixes:
 p11_atfork.c: In function '_P11_get_forkid':
 p11_atfork.c:78:9: warning: implicit declaration of function 'getpid'; did you mean 'getenv'? [-Wimplicit-function-declaration]
  return getpid();
 (cherry picked from commit 97700cb51ac1e84f5ac8bc402e6f9e0fc271d76b)
 ---
 src/p11_atfork.c | 1 +
 1 file changed, 1 insertion(+)
 diff --git a/src/p11_atfork.c b/src/p11_atfork.c
 index 8fc8689..43c38f7 100644
 --- a/src/p11_atfork.c
 +++ b/src/p11_atfork.c
@@ -23,6 +23,7 @@
 #include "libp11-int.h"
 #ifndef _WIN32
 +#include <unistd.h>
 #ifndef __STDC_VERSION__
 /* older than C90 */
 -- 
 2.21.0
 From 8103e98e452624e254beef0fd788f66d13fc8ae6 Mon Sep 17 00:00:00 2001
 From: ucq <ucq@cyberdefense.jp>
 Date: Tue, 14 May 2019 12:17:45 +0900
 Subject: [PATCH 2/3] fix use-after-free on PKCS11_pkey_meths.
 (cherry picked from commit e64496a198d4d2eb0310a22dc21be8b81367d319)
 ---
 src/p11_pkey.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)
 diff --git a/src/p11_pkey.c b/src/p11_pkey.c
 index 7eaf761..2995881 100644
 --- a/src/p11_pkey.c
 +++ b/src/p11_pkey.c
@@ -666,8 +666,8 @@ int PKCS11_pkey_meths(ENGINE *e, EVP_PKEY_METHOD **pmeth,
 		EVP_PKEY_EC,
 		0
 	};
 -	static EVP_PKEY_METHOD *pkey_method_rsa = NULL;
 -	static EVP_PKEY_METHOD *pkey_method_ec = NULL;
 +	EVP_PKEY_METHOD *pkey_method_rsa = NULL;
 +	EVP_PKEY_METHOD *pkey_method_ec = NULL;
 	(void)e; /* squash the unused parameter warning */
 	/* all PKCS#11 engines currently share the same pkey_meths */
@@ -680,16 +680,14 @@ int PKCS11_pkey_meths(ENGINE *e, EVP_PKEY_METHOD **pmeth,
 	/* get the EVP_PKEY_METHOD */
 	switch (nid) {
 	case EVP_PKEY_RSA:
 -		if (pkey_method_rsa == NULL)
 -			pkey_method_rsa = pkcs11_pkey_method_rsa();
 +		pkey_method_rsa = pkcs11_pkey_method_rsa();
 		if (pkey_method_rsa == NULL)
 			return 0;
 		*pmeth = pkey_method_rsa;
 		return 1; /* success */
 #ifndef OPENSSL_NO_EC
 	case EVP_PKEY_EC:
 -		if (pkey_method_ec == NULL)
 -			pkey_method_ec = pkcs11_pkey_method_ec();
 +		pkey_method_ec = pkcs11_pkey_method_ec();
 		if (pkey_method_ec == NULL)
 			return 0;
 		*pmeth = pkey_method_ec;
 -- 
 2.21.0
 From d24c5dfa149a15c002d202964c513624d7ae1380 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Micha=C5=82=20Trojnara?= <Michal.Trojnara@stunnel.org>
 Date: Wed, 14 Aug 2019 15:23:41 +0200
 Subject: [PATCH 3/3] Remove an unused variable
 (cherry picked from commit 5d48d2ff75918409684a6aefe5b1f3e5d8ec7f0d)
 ---
 src/p11_pkey.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)
 diff --git a/src/p11_pkey.c b/src/p11_pkey.c
 index 2995881..de0277e 100644
 --- a/src/p11_pkey.c
 +++ b/src/p11_pkey.c
@@ -545,7 +545,7 @@ static int pkcs11_try_pkey_ec_sign(EVP_PKEY_CTX *evp_pkey_ctx,
 	ossl_sig = ECDSA_SIG_new();
 	if (ossl_sig == NULL)
 -		return-1;
 +		return -1;
 	pkey = EVP_PKEY_CTX_get0_pkey(evp_pkey_ctx);
 	if (pkey == NULL)
@@ -578,7 +578,6 @@ static int pkcs11_try_pkey_ec_sign(EVP_PKEY_CTX *evp_pkey_ctx,
 		return -1;
 	if (!cpriv->sign_initialized) {
 -		int padding;
 		CK_MECHANISM mechanism;
 		memset(&mechanism, 0, sizeof mechanism);
 -- 
 2.21.0
--- a/SOURCES/openssl-pkcs11-0.4.8-allow-use-privkey-without-pin.patch
+++ b/SOURCES/openssl-pkcs11-0.4.8-allow-use-privkey-without-pin.patch
@ -1,18 +0,0 @@
 diff --git a/src/eng_back.c b/src/eng_back.c
 index 464c47b..fb94934 100644
 --- a/src/eng_back.c
 +++ b/src/eng_back.c
@@ -750,10 +750,6 @@ static EVP_PKEY *ctx_load_key(ENGINE_CTX *ctx, const char *s_slot_key_id,
 	 * with some other (which ones?) PKCS#11 libraries */
 	if (!tok->initialized)
 		ctx_log(ctx, 0, "Found uninitialized token\n");
 -	if (isPrivate && !tok->userPinSet && !tok->readOnly) {
 -		ctx_log(ctx, 0, "Found slot without user PIN\n");
 -		goto error;
 -	}
 	ctx_log(ctx, 1, "Found slot:  %s\n", slot->description);
 	ctx_log(ctx, 1, "Found token: %s\n", slot->token->label);
 -- 
 2.17.1
--- a/SOURCES/openssl-pkcs11-0.4.8-atfork-checks-rsa-and-ec-keys.patch
+++ b/SOURCES/openssl-pkcs11-0.4.8-atfork-checks-rsa-and-ec-keys.patch
@ -1,107 +0,0 @@
 From efce4defdf31ce74d905ae4dd47c6a36df532854 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Micha=C5=82=20Trojnara?= <Michal.Trojnara@stunnel.org>
 Date: Wed, 29 Aug 2018 23:05:05 +0200
 Subject: [PATCH 09/23] Atfork checks for RSA and EC_KEY methods
 ---
 src/p11_ec.c   | 9 +++------
 src/p11_pkey.c | 9 ++++-----
 src/p11_rsa.c  | 4 ++--
 3 files changed, 9 insertions(+), 13 deletions(-)
 diff --git a/src/p11_ec.c b/src/p11_ec.c
 index eb0cbb2..1b58c01 100644
 --- a/src/p11_ec.c
 +++ b/src/p11_ec.c
@@ -394,7 +394,7 @@ static ECDSA_SIG *pkcs11_ecdsa_sign_sig(const unsigned char *dgst, int dlen,
 	(void)rp; /* Precomputed values are not used for PKCS#11 */
 	key = pkcs11_get_ex_data_ec(ec);
 -	if (key == NULL) {
 +	if (check_key_fork(key) < 0) {
 		sign_sig_fn orig_sign_sig;
 #if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
 		const EC_KEY_METHOD *meth = EC_KEY_OpenSSL();
@@ -406,7 +406,6 @@ static ECDSA_SIG *pkcs11_ecdsa_sign_sig(const unsigned char *dgst, int dlen,
 #endif
 		return orig_sign_sig(dgst, dlen, kinv, rp, ec);
 	}
 -	/* TODO: Add an atfork check */
 	/* Truncate digest if its byte size is longer than needed */
 	order = BN_new();
@@ -580,9 +579,8 @@ static int pkcs11_ec_ckey(unsigned char **out, size_t *outlen,
 	int rv;
 	key = pkcs11_get_ex_data_ec(ecdh);
 -	if (key == NULL) /* The private key is not handled by PKCS#11 */
 +	if (check_key_fork(key) < 0)
 		return ossl_ecdh_compute_key(out, outlen, peer_point, ecdh);
 -	/* TODO: Add an atfork check */
 	/* both peer and ecdh use same group parameters */
 	parms = pkcs11_ecdh_params_alloc(EC_KEY_get0_group(ecdh), peer_point);
@@ -622,9 +620,8 @@ static int pkcs11_ec_ckey(void *out, size_t outlen,
 	int rv;
 	key = pkcs11_get_ex_data_ec(ecdh);
 -	if (key == NULL) /* The private key is not handled by PKCS#11 */
 +	if (check_key_fork(key) < 0)
 		return ossl_ecdh_compute_key(out, outlen, peer_point, ecdh, KDF);
 -	/* TODO: Add an atfork check */
 	/* both peer and ecdh use same group parameters */
 	parms = pkcs11_ecdh_params_alloc(EC_KEY_get0_group(ecdh), peer_point);
 diff --git a/src/p11_pkey.c b/src/p11_pkey.c
 index 0efcaa4..2ba23d9 100644
 --- a/src/p11_pkey.c
 +++ b/src/p11_pkey.c
@@ -309,7 +309,7 @@ static int pkcs11_try_pkey_rsa_sign(EVP_PKEY_CTX *evp_pkey_ctx,
 	if (rsa == NULL)
 		return -1;
 	key = pkcs11_get_ex_data_rsa(rsa);
 -	if (key == NULL)
 +	if (check_key_fork(key) < 0)
 		return -1;
 	slot = KEY2SLOT(key);
 	ctx = KEY2CTX(key);
@@ -413,11 +413,10 @@ static int pkcs11_try_pkey_rsa_decrypt(EVP_PKEY_CTX *evp_pkey_ctx,
 	if (rsa == NULL)
 		return -1;
 	key = pkcs11_get_ex_data_rsa(rsa);
 -	if (key == NULL)
 +	if (check_key_fork(key) < 0)
 		return -1;
 -
 -	slot  = KEY2SLOT(key);
 -	ctx   = KEY2CTX(key);
 +	slot = KEY2SLOT(key);
 +	ctx = KEY2CTX(key);
 	kpriv = PRIVKEY(key);
 	spriv = PRIVSLOT(slot);
 	cpriv = PRIVCTX(ctx);
 diff --git a/src/p11_rsa.c b/src/p11_rsa.c
 index f69a8a6..6a519f9 100644
 --- a/src/p11_rsa.c
 +++ b/src/p11_rsa.c
@@ -355,7 +355,7 @@ static int pkcs11_rsa_priv_dec_method(int flen, const unsigned char *from,
 	PKCS11_KEY *key = pkcs11_get_ex_data_rsa(rsa);
 	int (*priv_dec) (int flen, const unsigned char *from,
 		unsigned char *to, RSA *rsa, int padding);
 -	if (key == NULL) {
 +	if (check_key_fork(key) < 0) {
 		priv_dec = RSA_meth_get_priv_dec(RSA_get_default_method());
 		return priv_dec(flen, from, to, rsa, padding);
 	}
@@ -368,7 +368,7 @@ static int pkcs11_rsa_priv_enc_method(int flen, const unsigned char *from,
 	PKCS11_KEY *key = pkcs11_get_ex_data_rsa(rsa);
 	int (*priv_enc) (int flen, const unsigned char *from,
 		unsigned char *to, RSA *rsa, int padding);
 -	if (key == NULL) {
 +	if (check_key_fork(key) < 0) {
 		priv_enc = RSA_meth_get_priv_enc(RSA_get_default_method());
 		return priv_enc(flen, from, to, rsa, padding);
 	}
 -- 
 2.17.1
--- a/SOURCES/openssl-pkcs11-0.4.8-ec-sign-test.patch
+++ b/SOURCES/openssl-pkcs11-0.4.8-ec-sign-test.patch
@ -1,167 +0,0 @@
 From 10ed7e56f159dba8980644494532898c9063438d Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Micha=C5=82=20Trojnara?= <Michal.Trojnara@stunnel.org>
 Date: Thu, 23 Aug 2018 22:19:04 +0200
 Subject: [PATCH 03/23] ec-evp-sign test
 ---
 tests/Makefile.am         |  1 +
 tests/ec-common.sh        | 18 +++++-----
 tests/ec-evp-sign.softhsm | 71 +++++++++++++++++++++++++++++++++++++++
 tests/ec-testfork.softhsm |  2 +-
 4 files changed, 82 insertions(+), 10 deletions(-)
 create mode 100755 tests/ec-evp-sign.softhsm
 diff --git a/tests/Makefile.am b/tests/Makefile.am
 index 8864709..cd17051 100644
 --- a/tests/Makefile.am
 +++ b/tests/Makefile.am
@@ -21,6 +21,7 @@ dist_check_SCRIPTS = \
 	rsa-testfork.softhsm \
 	rsa-testlistkeys.softhsm \
 	rsa-evp-sign.softhsm \
 +	ec-evp-sign.softhsm \
 	ec-testfork.softhsm \
 	fork-change-slot.softhsm \
 	rsa-pss-sign.softhsm \
 diff --git a/tests/ec-common.sh b/tests/ec-common.sh
 index a709c0d..a53a4ee 100755
 --- a/tests/ec-common.sh
 +++ b/tests/ec-common.sh
@@ -35,11 +35,11 @@ mkdir -p $outdir
 for i in /usr/lib64/pkcs11 /usr/lib64/softhsm /usr/lib/x86_64-linux-gnu/softhsm /usr/local/lib/softhsm /opt/local/lib/softhsm /usr/lib/softhsm /usr/lib ;do
 	if test -f "$i/libsofthsm2.so"; then
 -		ADDITIONAL_PARAM="$i/libsofthsm2.so"
 +		MODULE="$i/libsofthsm2.so"
 		break
 	else
 		if test -f "$i/libsofthsm.so";then
 -			ADDITIONAL_PARAM="$i/libsofthsm.so"
 +			MODULE="$i/libsofthsm.so"
 			break
 		fi
 	fi
@@ -104,18 +104,18 @@ PUK=1234
 init_card $PIN $PUK
 # generate key in token
 -pkcs11-tool -p $PIN --module $ADDITIONAL_PARAM -d 01020304 -a server-key -l -w ${srcdir}/ec-prvkey.der -y privkey >/dev/null
 +pkcs11-tool -p $PIN --module $MODULE -d 01020304 -a server-key -l -w ${srcdir}/ec-prvkey.der -y privkey >/dev/null
 if test $? != 0;then
 	exit 1;
 fi
 # pkcs11-tool currently only supports RSA public keys
 -#pkcs11-tool -p $PIN --module $ADDITIONAL_PARAM -d 01020304 -a server-key -l -w ${srcdir}/ec-pubkey.der -y pubkey >/dev/null
 -#if test $? != 0;then
 -#	exit 1;
 -#fi
 +pkcs11-tool -p $PIN --module $MODULE -d 01020304 -a server-key -l -w ${srcdir}/ec-pubkey.der -y pubkey >/dev/null
 +if test $? != 0;then
 +	exit 1;
 +fi
 -pkcs11-tool -p $PIN --module $ADDITIONAL_PARAM -d 01020304 -a server-key -l -w ${srcdir}/ec-cert.der -y cert >/dev/null
 +pkcs11-tool -p $PIN --module $MODULE -d 01020304 -a server-key -l -w ${srcdir}/ec-cert.der -y cert >/dev/null
 if test $? != 0;then
 	exit 1;
 fi
@@ -123,4 +123,4 @@ fi
 echo "***************"
 echo "Listing objects"
 echo "***************"
 -pkcs11-tool -p $PIN --module $ADDITIONAL_PARAM -l -O
 +pkcs11-tool -p $PIN --module $MODULE -l -O
 diff --git a/tests/ec-evp-sign.softhsm b/tests/ec-evp-sign.softhsm
 new file mode 100755
 index 0000000..edecd4a
 --- /dev/null
 +++ b/tests/ec-evp-sign.softhsm
@@ -0,0 +1,71 @@
 +#!/bin/sh
 +
 +# Copyright (C) 2015 Nikos Mavrogiannopoulos
 +#
 +# GnuTLS is free software; you can redistribute it and/or modify it
 +# under the terms of the GNU General Public License as published by the
 +# Free Software Foundation; either version 3 of the License, or (at
 +# your option) any later version.
 +#
 +# GnuTLS is distributed in the hope that it will be useful, but
 +# WITHOUT ANY WARRANTY; without even the implied warranty of
 +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 +# General Public License for more details.
 +#
 +# You should have received a copy of the GNU General Public License
 +# along with GnuTLS; if not, write to the Free Software Foundation,
 +# Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
 +
 +outdir="output.$$"
 +
 +# Load common test functions
 +. ${srcdir}/ec-common.sh
 +
 +# Do the common test initialization
 +# common_init
 +
 +sed -e "s|@MODULE_PATH@|${MODULE}|g" -e "s|@ENGINE_PATH@|../src/.libs/pkcs11.so|g" <"${srcdir}/engines.cnf.in" >"${outdir}/engines.cnf"
 +
 +export OPENSSL_ENGINES="../src/.libs/"
 +PRIVATE_KEY="pkcs11:token=libp11-test;id=%01%02%03%04;object=server-key;type=private;pin-value=1234"
 +PUBLIC_KEY="pkcs11:token=libp11-test;id=%01%02%03%04;object=server-key;type=public;pin-value=1234"
 +
 +./evp-sign ctrl false "${outdir}/engines.cnf" ${PRIVATE_KEY} ${PUBLIC_KEY} ${MODULE}
 +if test $? != 0;then
 +	echo "Basic PKCS #11 test, using ctrl failed"
 +	exit 1;
 +fi
 +
 +./evp-sign default false "${outdir}/engines.cnf" ${PRIVATE_KEY} ${PUBLIC_KEY} ${MODULE}
 +if test $? != 0;then
 +	echo "Basic PKCS #11 test, using default failed"
 +	exit 1;
 +fi
 +
 +./evp-sign ctrl 1234 "${outdir}/engines.cnf" ${PRIVATE_KEY} ${PUBLIC_KEY} ${MODULE}
 +if test $? != 0;then
 +	echo "Basic PKCS #11 test without pin-value, using ctrl failed"
 +	exit 1;
 +fi
 +
 +./evp-sign default 1234 "${outdir}/engines.cnf" ${PRIVATE_KEY} ${PUBLIC_KEY} ${MODULE}
 +if test $? != 0;then
 +	echo "Basic PKCS #11 test without pin-value, using default failed"
 +	exit 1;
 +fi
 +
 +./evp-sign ctrl 1234 "${outdir}/engines.cnf" "label_server-key" "label_server-key" ${MODULE}
 +if test $? != 0;then
 +	echo "Basic PKCS #11 test with legacy name #1 failed"
 +	exit 1;
 +fi
 +
 +./evp-sign default 1234 "${outdir}/engines.cnf" "id_01020304" "id_01020304" ${MODULE}
 +if test $? != 0;then
 +	echo "Basic PKCS #11 test with legacy name #2 failed"
 +	exit 1;
 +fi
 +
 +rm -rf "$outdir"
 +
 +exit 0
 diff --git a/tests/ec-testfork.softhsm b/tests/ec-testfork.softhsm
 index 961424a..55b6516 100755
 --- a/tests/ec-testfork.softhsm
 +++ b/tests/ec-testfork.softhsm
@@ -21,7 +21,7 @@ outdir="output.$$"
 . ${srcdir}/ec-common.sh
 -./fork-test $ADDITIONAL_PARAM $PIN
 +./fork-test $MODULE $PIN
 if test $? != 0;then
 	exit 1;
 fi
 -- 
 2.17.1
--- a/SOURCES/openssl-pkcs11-0.4.8-error-handling-evp-pkey-set1-engine-fixed.patch
+++ b/SOURCES/openssl-pkcs11-0.4.8-error-handling-evp-pkey-set1-engine-fixed.patch
@ -1,19 +0,0 @@
 diff --git a/src/eng_front.c b/src/eng_front.c
 index 5fe8f55..286aaa9 100644
 --- a/src/eng_front.c
 +++ b/src/eng_front.c
@@ -233,11 +233,9 @@ static EVP_PKEY *load_privkey(ENGINE *engine, const char *s_key_id,
 #ifdef EVP_F_EVP_PKEY_SET1_ENGINE
 	/* EVP_PKEY_set1_engine() is required for OpenSSL 1.1.x,
 	 * but otherwise setting pkey->engine breaks OpenSSL 1.0.2 */
 -	if (pkey) {
 -		if (!EVP_PKEY_set1_engine(pkey, engine)) {
 -			EVP_PKEY_free(pkey);
 -			return NULL;
 -		}
 +	if (pkey && !EVP_PKEY_set1_engine(pkey, engine)) {
 +		EVP_PKEY_free(pkey);
 +		pkey = NULL;
 	}
 #endif /* EVP_F_EVP_PKEY_SET1_ENGINE */
 	return pkey;
--- a/SOURCES/openssl-pkcs11-0.4.8-error-handling-evp-pkey-set1-engine.patch
+++ b/SOURCES/openssl-pkcs11-0.4.8-error-handling-evp-pkey-set1-engine.patch
@ -1,31 +0,0 @@
 From f41dba3102f4257fe366adf4cd8f0a0088c9b3f1 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Micha=C5=82=20Trojnara?= <Michal.Trojnara@stunnel.org>
 Date: Thu, 23 Aug 2018 22:27:55 +0200
 Subject: [PATCH 04/23] Error handling for EVP_PKEY_set1_engine()
 ---
 src/eng_front.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)
 diff --git a/src/eng_front.c b/src/eng_front.c
 index 853fa5a..5fe8f55 100644
 --- a/src/eng_front.c
 +++ b/src/eng_front.c
@@ -233,8 +233,12 @@ static EVP_PKEY *load_privkey(ENGINE *engine, const char *s_key_id,
 #ifdef EVP_F_EVP_PKEY_SET1_ENGINE
 	/* EVP_PKEY_set1_engine() is required for OpenSSL 1.1.x,
 	 * but otherwise setting pkey->engine breaks OpenSSL 1.0.2 */
 -	if (pkey)
 -		EVP_PKEY_set1_engine(pkey, engine);
 +	if (pkey) {
 +		if (!EVP_PKEY_set1_engine(pkey, engine)) {
 +			EVP_PKEY_free(pkey);
 +			return NULL;
 +		}
 +	}
 #endif /* EVP_F_EVP_PKEY_SET1_ENGINE */
 	return pkey;
 }
 -- 
 2.17.1
--- a/SOURCES/openssl-pkcs11-0.4.8-evp-pkey-ec-framework.patch
+++ b/SOURCES/openssl-pkcs11-0.4.8-evp-pkey-ec-framework.patch
@ -1,157 +0,0 @@
 From 0a2df89ba517bfbeaeadb81e42fe7bc3288b1985 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Micha=C5=82=20Trojnara?= <Michal.Trojnara@stunnel.org>
 Date: Thu, 23 Aug 2018 22:35:53 +0200
 Subject: [PATCH 05/23] Initial EVP_PKEY_EC framework
 Fixes #243
 ---
 src/p11_pkey.c | 94 +++++++++++++++++++++++++++++++++++++++++---------
 1 file changed, 78 insertions(+), 16 deletions(-)
 diff --git a/src/p11_pkey.c b/src/p11_pkey.c
 index 45d5ad3..0efcaa4 100644
 --- a/src/p11_pkey.c
 +++ b/src/p11_pkey.c
@@ -29,6 +29,13 @@ static int (*orig_pkey_rsa_decrypt) (EVP_PKEY_CTX *ctx,
 	unsigned char *out, size_t *outlen,
 	const unsigned char *in, size_t inlen);
 +#ifndef OPENSSL_NO_EC
 +static int (*orig_pkey_ec_sign_init) (EVP_PKEY_CTX *ctx);
 +static int (*orig_pkey_ec_sign) (EVP_PKEY_CTX *ctx,
 +	unsigned char *sig, size_t *siglen,
 +	const unsigned char *tbs, size_t tbslen);
 +#endif /* OPENSSL_NO_EC */
 +
 #if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
 struct evp_pkey_method_st {
 	int pkey_id;
@@ -490,54 +497,109 @@ static int pkcs11_pkey_rsa_decrypt(EVP_PKEY_CTX *evp_pkey_ctx,
 static EVP_PKEY_METHOD *pkcs11_pkey_method_rsa()
 {
 -	EVP_PKEY_METHOD *orig_evp_pkey_meth_rsa, *new_evp_pkey_meth_rsa;
 +	EVP_PKEY_METHOD *orig_meth, *new_meth;
 -	orig_evp_pkey_meth_rsa = (EVP_PKEY_METHOD *)EVP_PKEY_meth_find(EVP_PKEY_RSA);
 -	EVP_PKEY_meth_get_sign(orig_evp_pkey_meth_rsa,
 +	orig_meth = (EVP_PKEY_METHOD *)EVP_PKEY_meth_find(EVP_PKEY_RSA);
 +	EVP_PKEY_meth_get_sign(orig_meth,
 		&orig_pkey_rsa_sign_init, &orig_pkey_rsa_sign);
 -	EVP_PKEY_meth_get_decrypt(orig_evp_pkey_meth_rsa,
 +	EVP_PKEY_meth_get_decrypt(orig_meth,
 		&orig_pkey_rsa_decrypt_init,
 		&orig_pkey_rsa_decrypt);
 -	new_evp_pkey_meth_rsa = EVP_PKEY_meth_new(EVP_PKEY_RSA,
 +	new_meth = EVP_PKEY_meth_new(EVP_PKEY_RSA,
 		EVP_PKEY_FLAG_AUTOARGLEN);
 -	EVP_PKEY_meth_copy(new_evp_pkey_meth_rsa, orig_evp_pkey_meth_rsa);
 +	EVP_PKEY_meth_copy(new_meth, orig_meth);
 -	EVP_PKEY_meth_set_sign(new_evp_pkey_meth_rsa,
 +	EVP_PKEY_meth_set_sign(new_meth,
 		orig_pkey_rsa_sign_init, pkcs11_pkey_rsa_sign);
 -	EVP_PKEY_meth_set_decrypt(new_evp_pkey_meth_rsa,
 +	EVP_PKEY_meth_set_decrypt(new_meth,
 		orig_pkey_rsa_decrypt_init, pkcs11_pkey_rsa_decrypt);
 -	return new_evp_pkey_meth_rsa;
 +	return new_meth;
 +}
 +
 +#ifndef OPENSSL_NO_EC
 +
 +static int pkcs11_try_pkey_ec_sign(EVP_PKEY_CTX *evp_pkey_ctx,
 +		unsigned char *sig, size_t *siglen,
 +		const unsigned char *tbs, size_t tbslen)
 +{
 +	fprintf(stderr, "%s:%d pkcs11_try_pkey_ec_sign() not implemented\n",
 +		__FILE__, __LINE__);
 +	return -1;
 }
 +static int pkcs11_pkey_ec_sign(EVP_PKEY_CTX *evp_pkey_ctx,
 +		unsigned char *sig, size_t *siglen,
 +		const unsigned char *tbs, size_t tbslen)
 +{
 +	int ret;
 +
 +	ret = pkcs11_try_pkey_ec_sign(evp_pkey_ctx, sig, siglen, tbs, tbslen);
 +	if (ret < 0)
 +		ret = (*orig_pkey_ec_sign)(evp_pkey_ctx, sig, siglen, tbs, tbslen);
 +	return ret;
 +}
 +
 +static EVP_PKEY_METHOD *pkcs11_pkey_method_ec()
 +{
 +	EVP_PKEY_METHOD *orig_meth, *new_meth;
 +
 +	orig_meth = (EVP_PKEY_METHOD *)EVP_PKEY_meth_find(EVP_PKEY_EC);
 +	EVP_PKEY_meth_get_sign(orig_meth,
 +		&orig_pkey_ec_sign_init, &orig_pkey_ec_sign);
 +
 +	new_meth = EVP_PKEY_meth_new(EVP_PKEY_EC,
 +		EVP_PKEY_FLAG_AUTOARGLEN);
 +
 +	EVP_PKEY_meth_copy(new_meth, orig_meth);
 +
 +	EVP_PKEY_meth_set_sign(new_meth,
 +		orig_pkey_ec_sign_init, pkcs11_pkey_ec_sign);
 +
 +	return new_meth;
 +}
 +
 +#endif /* OPENSSL_NO_EC */
 +
 int PKCS11_pkey_meths(ENGINE *e, EVP_PKEY_METHOD **pmeth,
 		const int **nids, int nid)
 {
 	static int pkey_nids[] = {
 		EVP_PKEY_RSA,
 +		EVP_PKEY_EC,
 		0
 	};
 	static EVP_PKEY_METHOD *pkey_method_rsa = NULL;
 +	static EVP_PKEY_METHOD *pkey_method_ec = NULL;
 	(void)e; /* squash the unused parameter warning */
 	/* all PKCS#11 engines currently share the same pkey_meths */
 -	if (pkey_method_rsa == NULL)
 -		pkey_method_rsa = pkcs11_pkey_method_rsa();
 -	if (pkey_method_rsa == NULL)
 -		return 0;
 -
 	if (!pmeth) { /* get the list of supported nids */
 		*nids = pkey_nids;
 -		return 1; /* the number of returned nids */
 +		return sizeof(pkey_nids) / sizeof(int) - 1;
 	}
 	/* get the EVP_PKEY_METHOD */
 -	if (nid == EVP_PKEY_RSA) {
 +	switch (nid) {
 +	case EVP_PKEY_RSA:
 +		if (pkey_method_rsa == NULL)
 +			pkey_method_rsa = pkcs11_pkey_method_rsa();
 +		if (pkey_method_rsa == NULL)
 +			return 0;
 		*pmeth = pkey_method_rsa;
 		return 1; /* success */
 +#ifndef OPENSSL_NO_EC
 +	case EVP_PKEY_EC:
 +		if (pkey_method_ec == NULL)
 +			pkey_method_ec = pkcs11_pkey_method_ec();
 +		if (pkey_method_ec == NULL)
 +			return 0;
 +		*pmeth = pkey_method_ec;
 +		return 1; /* success */
 +#endif /* OPENSSL_NO_EC */
 	}
 	*pmeth = NULL;
 	return 0;
 -- 
 2.17.1
--- a/SOURCES/openssl-pkcs11-0.4.8-ex-data-coding-style.patch
+++ b/SOURCES/openssl-pkcs11-0.4.8-ex-data-coding-style.patch
@ -1,129 +0,0 @@
 From cd6316777395bef8997324cd7152f383534779d3 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Micha=C5=82=20Trojnara?= <Michal.Trojnara@stunnel.org>
 Date: Wed, 29 Aug 2018 22:38:54 +0200
 Subject: [PATCH 08/23] ex_data coding style unification
 ---
 src/libp11-int.h |  2 +-
 src/p11_ec.c     | 31 ++++++++++++++++---------------
 src/p11_rsa.c    |  6 +++---
 3 files changed, 20 insertions(+), 19 deletions(-)
 diff --git a/src/libp11-int.h b/src/libp11-int.h
 index 411f2b0..3c4792b 100644
 --- a/src/libp11-int.h
 +++ b/src/libp11-int.h
@@ -367,7 +367,7 @@ extern int pkcs11_private_decrypt(
 	unsigned char *to, PKCS11_KEY * key, int padding);
 /* Retrieve PKCS11_KEY from an RSA key */
 -extern PKCS11_KEY *pkcs11_get_ex_data_rsa(RSA *rsa);
 +extern PKCS11_KEY *pkcs11_get_ex_data_rsa(const RSA *rsa);
 #endif
 diff --git a/src/p11_ec.c b/src/p11_ec.c
 index 8d458dc..eb0cbb2 100644
 --- a/src/p11_ec.c
 +++ b/src/p11_ec.c
@@ -260,7 +260,16 @@ static EC_KEY *pkcs11_get_ec(PKCS11_KEY *key)
 	return ec;
 }
 -static void pkcs11_set_ex_data_ec(EC_KEY* ec, PKCS11_KEY* key)
 +static PKCS11_KEY *pkcs11_get_ex_data_ec(const EC_KEY *ec)
 +{
 +#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
 +	return EC_KEY_get_ex_data(ec, ec_ex_index);
 +#else
 +	return ECDSA_get_ex_data((EC_KEY *)ec, ec_ex_index);
 +#endif
 +}
 +
 +static void pkcs11_set_ex_data_ec(EC_KEY *ec, PKCS11_KEY *key)
 {
 #if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
 	EC_KEY_set_ex_data(ec, ec_ex_index, key);
@@ -269,10 +278,10 @@ static void pkcs11_set_ex_data_ec(EC_KEY* ec, PKCS11_KEY* key)
 #endif
 }
 -static void pkcs11_update_ex_data_ec(PKCS11_KEY* key)
 +static void pkcs11_update_ex_data_ec(PKCS11_KEY *key)
 {
 -	EVP_PKEY* evp = key->evp_key;
 -	EC_KEY* ec;
 +	EVP_PKEY *evp = key->evp_key;
 +	EC_KEY *ec;
 	if (evp == NULL)
 		return;
 	if (EVP_PKEY_base_id(evp) != EVP_PKEY_EC)
@@ -384,11 +393,7 @@ static ECDSA_SIG *pkcs11_ecdsa_sign_sig(const unsigned char *dgst, int dlen,
 	(void)kinv; /* Precomputed values are not used for PKCS#11 */
 	(void)rp; /* Precomputed values are not used for PKCS#11 */
 -#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
 -	key = (PKCS11_KEY *)EC_KEY_get_ex_data(ec, ec_ex_index);
 -#else
 -	key = (PKCS11_KEY *)ECDSA_get_ex_data(ec, ec_ex_index);
 -#endif
 +	key = pkcs11_get_ex_data_ec(ec);
 	if (key == NULL) {
 		sign_sig_fn orig_sign_sig;
 #if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
@@ -574,7 +579,7 @@ static int pkcs11_ec_ckey(unsigned char **out, size_t *outlen,
 	size_t buflen;
 	int rv;
 -	key = (PKCS11_KEY *)EC_KEY_get_ex_data(ecdh, ec_ex_index);
 +	key = pkcs11_get_ex_data_ec(ecdh);
 	if (key == NULL) /* The private key is not handled by PKCS#11 */
 		return ossl_ecdh_compute_key(out, outlen, peer_point, ecdh);
 	/* TODO: Add an atfork check */
@@ -616,11 +621,7 @@ static int pkcs11_ec_ckey(void *out, size_t outlen,
 	size_t buflen;
 	int rv;
 -#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
 -	key = (PKCS11_KEY *)EC_KEY_get_ex_data(ecdh, ec_ex_index);
 -#else
 -	key = (PKCS11_KEY *)ECDSA_get_ex_data((EC_KEY *)ecdh, ec_ex_index);
 -#endif
 +	key = pkcs11_get_ex_data_ec(ecdh);
 	if (key == NULL) /* The private key is not handled by PKCS#11 */
 		return ossl_ecdh_compute_key(out, outlen, peer_point, ecdh, KDF);
 	/* TODO: Add an atfork check */
 diff --git a/src/p11_rsa.c b/src/p11_rsa.c
 index 97cd5a2..f69a8a6 100644
 --- a/src/p11_rsa.c
 +++ b/src/p11_rsa.c
@@ -233,7 +233,7 @@ success:
 }
 -PKCS11_KEY *pkcs11_get_ex_data_rsa(RSA *rsa)
 +PKCS11_KEY *pkcs11_get_ex_data_rsa(const RSA *rsa)
 {
 	return RSA_get_ex_data(rsa, rsa_ex_index);
 }
@@ -352,7 +352,7 @@ int (*RSA_meth_get_priv_dec(const RSA_METHOD *meth))
 static int pkcs11_rsa_priv_dec_method(int flen, const unsigned char *from,
 		unsigned char *to, RSA *rsa, int padding)
 {
 -	PKCS11_KEY *key = RSA_get_ex_data(rsa, rsa_ex_index);
 +	PKCS11_KEY *key = pkcs11_get_ex_data_rsa(rsa);
 	int (*priv_dec) (int flen, const unsigned char *from,
 		unsigned char *to, RSA *rsa, int padding);
 	if (key == NULL) {
@@ -365,7 +365,7 @@ static int pkcs11_rsa_priv_dec_method(int flen, const unsigned char *from,
 static int pkcs11_rsa_priv_enc_method(int flen, const unsigned char *from,
 		unsigned char *to, RSA *rsa, int padding)
 {
 -	PKCS11_KEY *key = RSA_get_ex_data(rsa, rsa_ex_index);
 +	PKCS11_KEY *key = pkcs11_get_ex_data_rsa(rsa);
 	int (*priv_enc) (int flen, const unsigned char *from,
 		unsigned char *to, RSA *rsa, int padding);
 	if (key == NULL) {
 -- 
 2.17.1
--- a/SOURCES/openssl-pkcs11-0.4.8-expose-check-fork.patch
+++ b/SOURCES/openssl-pkcs11-0.4.8-expose-check-fork.patch
@ -1,534 +0,0 @@
 From 45d6529dbe1b69f3a838d01a83f0688e91696377 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Micha=C5=82=20Trojnara?= <Michal.Trojnara@stunnel.org>
 Date: Wed, 29 Aug 2018 21:35:48 +0200
 Subject: [PATCH 07/23] Expose check_fork internal API
 ---
 src/Makefile.am  |   2 +-
 src/atfork.c     |  93 -------------------
 src/libp11-int.h |   7 ++
 src/p11_atfork.c | 231 +++++++++++++++++++++++++++++++++++++++++++++++
 src/p11_front.c  | 138 ----------------------------
 5 files changed, 239 insertions(+), 232 deletions(-)
 delete mode 100644 src/atfork.c
 create mode 100644 src/p11_atfork.c
 diff --git a/src/Makefile.am b/src/Makefile.am
 index 3cdbce1..2ca250e 100644
 --- a/src/Makefile.am
 +++ b/src/Makefile.am
@@ -14,7 +14,7 @@ SHARED_EXT=@SHARED_EXT@
 libp11_la_SOURCES = libpkcs11.c p11_attr.c p11_cert.c p11_err.c p11_ckr.c \
 	p11_key.c p11_load.c p11_misc.c p11_rsa.c p11_ec.c p11_pkey.c \
 -	p11_slot.c p11_front.c atfork.c libp11.exports
 +	p11_slot.c p11_front.c p11_atfork.c libp11.exports
 if WIN32
 libp11_la_SOURCES += libp11.rc
 else
 diff --git a/src/atfork.c b/src/atfork.c
 deleted file mode 100644
 index 04691fb..0000000
 --- a/src/atfork.c
 +++ /dev/null
@@ -1,93 +0,0 @@
 -/*
 - * Copyright (C) 2010-2012 Free Software Foundation, Inc.
 - * Copyright (C) 2014 Red Hat
 - *
 - * Author: Nikos Mavrogiannopoulos
 - *
 - * This is free software; you can redistribute it and/or
 - * modify it under the terms of the GNU Lesser General Public License
 - * as published by the Free Software Foundation; either version 2.1 of
 - * the License, or (at your option) any later version.
 - *
 - * This library is distributed in the hope that it will be useful, but
 - * WITHOUT ANY WARRANTY; without even the implied warranty of
 - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 - * Lesser General Public License for more details.
 - *
 - * You should have received a copy of the GNU Lesser General Public License
 - * along with this program.  If not, see <http://www.gnu.org/licenses/>
 - *
 - */
 -
 -#include "libp11-int.h"
 -#if defined(_WIN32) && !defined(__CYGWIN__)
 -#include <winsock2.h>
 -#else
 -#include <sys/socket.h>
 -#endif
 -#include <errno.h>
 -#include <sys/stat.h>
 -#include <sys/types.h>
 -#include <unistd.h>
 -#include <atfork.h>
 -
 -#ifdef __sun
 -# pragma fini(lib_deinit)
 -# pragma init(lib_init)
 -# define _CONSTRUCTOR
 -# define _DESTRUCTOR
 -#else
 -# define _CONSTRUCTOR __attribute__((constructor))
 -# define _DESTRUCTOR __attribute__((destructor))
 -#endif
 -
 -unsigned int P11_forkid = 0;
 -
 -#ifndef _WIN32
 -
 -# ifdef HAVE_ATFORK
 -static void fork_handler(void)
 -{
 -	P11_forkid++;
 -}
 -# endif
 -
 -# if defined(HAVE___REGISTER_ATFORK)
 -extern int __register_atfork(void (*)(void), void(*)(void), void (*)(void), void *);
 -extern void *__dso_handle;
 -
 -_CONSTRUCTOR
 -int _P11_register_fork_handler(void)
 -{
 -	if (__register_atfork(0, 0, fork_handler, __dso_handle) != 0)
 -		return -1;
 -	return 0;
 -}
 -
 -# else
 -
 -unsigned int _P11_get_forkid(void)
 -{
 -	return getpid();
 -}
 -
 -int _P11_detect_fork(unsigned int forkid)
 -{
 -	if (getpid() == forkid)
 -		return 0;
 -	return 1;
 -}
 -
 -/* we have to detect fork manually */
 -_CONSTRUCTOR
 -int _P11_register_fork_handler(void)
 -{
 -	P11_forkid = getpid();
 -	return 0;
 -}
 -
 -# endif
 -
 -#endif /* !_WIN32 */
 -
 -/* vim: set noexpandtab: */
 diff --git a/src/libp11-int.h b/src/libp11-int.h
 index b62a13e..411f2b0 100644
 --- a/src/libp11-int.h
 +++ b/src/libp11-int.h
@@ -323,6 +323,13 @@ extern int pkcs11_store_certificate(PKCS11_TOKEN * token, X509 * x509,
 extern int pkcs11_seed_random(PKCS11_SLOT *, const unsigned char *s, unsigned int s_len);
 extern int pkcs11_generate_random(PKCS11_SLOT *, unsigned char *r, unsigned int r_len);
 +/* Reinitialize the module afer fork if needed */
 +extern int check_fork(PKCS11_CTX *ctx);
 +extern int check_slot_fork(PKCS11_SLOT *slot);
 +extern int check_token_fork(PKCS11_TOKEN *token);
 +extern int check_key_fork(PKCS11_KEY *key);
 +extern int check_cert_fork(PKCS11_CERT *cert);
 +
 /* Internal implementation of deprecated features */
 /* Generate and store a private key on the token */
 diff --git a/src/p11_atfork.c b/src/p11_atfork.c
 new file mode 100644
 index 0000000..fce87c6
 --- /dev/null
 +++ b/src/p11_atfork.c
@@ -0,0 +1,231 @@
 +/*
 + * Copyright (C) 2010-2012 Free Software Foundation, Inc.
 + * Copyright (C) 2014 Red Hat
 + *
 + * Author: Nikos Mavrogiannopoulos
 + *
 + * This is free software; you can redistribute it and/or
 + * modify it under the terms of the GNU Lesser General Public License
 + * as published by the Free Software Foundation; either version 2.1 of
 + * the License, or (at your option) any later version.
 + *
 + * This library is distributed in the hope that it will be useful, but
 + * WITHOUT ANY WARRANTY; without even the implied warranty of
 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 + * Lesser General Public License for more details.
 + *
 + * You should have received a copy of the GNU Lesser General Public License
 + * along with this program.  If not, see <http://www.gnu.org/licenses/>
 + *
 + */
 +
 +#include "libp11-int.h"
 +#if defined(_WIN32) && !defined(__CYGWIN__)
 +#include <winsock2.h>
 +#else
 +#include <sys/socket.h>
 +#endif
 +#include <errno.h>
 +#include <sys/stat.h>
 +#include <sys/types.h>
 +#include <unistd.h>
 +#include <atfork.h>
 +
 +#ifdef __sun
 +# pragma fini(lib_deinit)
 +# pragma init(lib_init)
 +# define _CONSTRUCTOR
 +# define _DESTRUCTOR
 +#else
 +# define _CONSTRUCTOR __attribute__((constructor))
 +# define _DESTRUCTOR __attribute__((destructor))
 +#endif
 +
 +unsigned int P11_forkid = 0;
 +
 +#ifndef _WIN32
 +
 +# ifdef HAVE_ATFORK
 +static void fork_handler(void)
 +{
 +	P11_forkid++;
 +}
 +# endif
 +
 +# if defined(HAVE___REGISTER_ATFORK)
 +extern int __register_atfork(void (*)(void), void(*)(void), void (*)(void), void *);
 +extern void *__dso_handle;
 +
 +_CONSTRUCTOR
 +int _P11_register_fork_handler(void)
 +{
 +	if (__register_atfork(0, 0, fork_handler, __dso_handle) != 0)
 +		return -1;
 +	return 0;
 +}
 +
 +# else
 +
 +unsigned int _P11_get_forkid(void)
 +{
 +	return getpid();
 +}
 +
 +int _P11_detect_fork(unsigned int forkid)
 +{
 +	if (getpid() == forkid)
 +		return 0;
 +	return 1;
 +}
 +
 +/* we have to detect fork manually */
 +_CONSTRUCTOR
 +int _P11_register_fork_handler(void)
 +{
 +	P11_forkid = getpid();
 +	return 0;
 +}
 +
 +# endif
 +
 +#endif /* !_WIN32 */
 +
 +/*
 + * PKCS#11 reinitialization after fork
 + * It wipes out the internal state of the PKCS#11 library
 + * Any libp11 references to this state are no longer valid
 + */
 +static int check_fork_int(PKCS11_CTX *ctx)
 +{
 +	PKCS11_CTX_private *cpriv = PRIVCTX(ctx);
 +
 +	if (_P11_detect_fork(cpriv->forkid)) {
 +		if (pkcs11_CTX_reload(ctx) < 0)
 +			return -1;
 +		cpriv->forkid = _P11_get_forkid();
 +	}
 +	return 0;
 +}
 +
 +/*
 + * PKCS#11 reinitialization after fork
 + * Also relogins and reopens the session if needed
 + */
 +static int check_slot_fork_int(PKCS11_SLOT *slot)
 +{
 +	PKCS11_SLOT_private *spriv = PRIVSLOT(slot);
 +	PKCS11_CTX *ctx = SLOT2CTX(slot);
 +	PKCS11_CTX_private *cpriv = PRIVCTX(ctx);
 +
 +	if (check_fork_int(SLOT2CTX(slot)) < 0)
 +		return -1;
 +	if (spriv->forkid != cpriv->forkid) {
 +		if (spriv->loggedIn) {
 +			int saved = spriv->haveSession;
 +			spriv->haveSession = 0;
 +			spriv->loggedIn = 0;
 +			if (pkcs11_relogin(slot) < 0)
 +				return -1;
 +			spriv->haveSession = saved;
 +		}
 +		if (spriv->haveSession) {
 +			spriv->haveSession = 0;
 +			if (pkcs11_reopen_session(slot) < 0)
 +				return -1;
 +		}
 +		spriv->forkid = cpriv->forkid;
 +	}
 +	return 0;
 +}
 +
 +/*
 + * PKCS#11 reinitialization after fork
 + * Also reloads the key
 + */
 +static int check_key_fork_int(PKCS11_KEY *key)
 +{
 +	PKCS11_SLOT *slot = KEY2SLOT(key);
 +	PKCS11_KEY_private *kpriv = PRIVKEY(key);
 +	PKCS11_SLOT_private *spriv = PRIVSLOT(slot);
 +
 +	if (check_slot_fork_int(slot) < 0)
 +		return -1;
 +	if (spriv->forkid != kpriv->forkid) {
 +		pkcs11_reload_key(key);
 +		kpriv->forkid = spriv->forkid;
 +	}
 +	return 0;
 +}
 +
 +/*
 + * Locking interface to check_fork_int()
 + */
 +int check_fork(PKCS11_CTX *ctx)
 +{
 +	PKCS11_CTX_private *cpriv;
 +	int rv;
 +
 +	if (ctx == NULL)
 +		return -1;
 +	cpriv = PRIVCTX(ctx);
 +	CRYPTO_THREAD_write_lock(cpriv->rwlock);
 +	rv = check_fork_int(ctx);
 +	CRYPTO_THREAD_unlock(cpriv->rwlock);
 +	return rv;
 +}
 +
 +/*
 + * Locking interface to check_slot_fork_int()
 + */
 +int check_slot_fork(PKCS11_SLOT *slot)
 +{
 +	PKCS11_CTX_private *cpriv;
 +	int rv;
 +
 +	if (slot == NULL)
 +		return -1;
 +	cpriv = PRIVCTX(SLOT2CTX(slot));
 +	CRYPTO_THREAD_write_lock(cpriv->rwlock);
 +	rv = check_slot_fork_int(slot);
 +	CRYPTO_THREAD_unlock(cpriv->rwlock);
 +	return rv;
 +}
 +
 +/*
 + * Reinitialize token (just its slot)
 + */
 +int check_token_fork(PKCS11_TOKEN *token)
 +{
 +	if (token == NULL)
 +		return -1;
 +	return check_slot_fork(TOKEN2SLOT(token));
 +}
 +
 +/*
 + * Locking interface to check_key_fork_int()
 + */
 +int check_key_fork(PKCS11_KEY *key)
 +{
 +	PKCS11_CTX_private *cpriv;
 +	int rv;
 +
 +	if (key == NULL)
 +		return -1;
 +	cpriv = PRIVCTX(KEY2CTX(key));
 +	CRYPTO_THREAD_write_lock(cpriv->rwlock);
 +	rv = check_key_fork_int(key);
 +	CRYPTO_THREAD_unlock(cpriv->rwlock);
 +	return rv;
 +}
 +
 +/*
 + * Reinitialize cert (just its token)
 + */
 +int check_cert_fork(PKCS11_CERT *cert)
 +{
 +	if (cert == NULL)
 +		return -1;
 +	return check_token_fork(CERT2TOKEN(cert));
 +}
 +
 +/* vim: set noexpandtab: */
 diff --git a/src/p11_front.c b/src/p11_front.c
 index 167a778..efdd4c0 100644
 --- a/src/p11_front.c
 +++ b/src/p11_front.c
@@ -25,144 +25,6 @@
  * PKCS11_get_ec_key_method
  */
 -/*
 - * PKCS#11 reinitialization after fork
 - * It wipes out the internal state of the PKCS#11 library
 - * Any libp11 references to this state are no longer valid
 - */
 -static int check_fork_int(PKCS11_CTX *ctx)
 -{
 -	PKCS11_CTX_private *cpriv = PRIVCTX(ctx);
 -
 -	if (_P11_detect_fork(cpriv->forkid)) {
 -		if (pkcs11_CTX_reload(ctx) < 0)
 -			return -1;
 -		cpriv->forkid = _P11_get_forkid();
 -	}
 -	return 0;
 -}
 -
 -/*
 - * PKCS#11 reinitialization after fork
 - * Also relogins and reopens the session if needed
 - */
 -static int check_slot_fork_int(PKCS11_SLOT *slot)
 -{
 -	PKCS11_SLOT_private *spriv = PRIVSLOT(slot);
 -	PKCS11_CTX *ctx = SLOT2CTX(slot);
 -	PKCS11_CTX_private *cpriv = PRIVCTX(ctx);
 -
 -	if (check_fork_int(SLOT2CTX(slot)) < 0)
 -		return -1;
 -	if (spriv->forkid != cpriv->forkid) {
 -		if (spriv->loggedIn) {
 -			int saved = spriv->haveSession;
 -			spriv->haveSession = 0;
 -			spriv->loggedIn = 0;
 -			if (pkcs11_relogin(slot) < 0)
 -				return -1;
 -			spriv->haveSession = saved;
 -		}
 -		if (spriv->haveSession) {
 -			spriv->haveSession = 0;
 -			if (pkcs11_reopen_session(slot) < 0)
 -				return -1;
 -		}
 -		spriv->forkid = cpriv->forkid;
 -	}
 -	return 0;
 -}
 -
 -/*
 - * PKCS#11 reinitialization after fork
 - * Also reloads the key
 - */
 -static int check_key_fork_int(PKCS11_KEY *key)
 -{
 -	PKCS11_SLOT *slot = KEY2SLOT(key);
 -	PKCS11_KEY_private *kpriv = PRIVKEY(key);
 -	PKCS11_SLOT_private *spriv = PRIVSLOT(slot);
 -
 -	if (check_slot_fork_int(slot) < 0)
 -		return -1;
 -	if (spriv->forkid != kpriv->forkid) {
 -		pkcs11_reload_key(key);
 -		kpriv->forkid = spriv->forkid;
 -	}
 -	return 0;
 -}
 -
 -/*
 - * Locking interface to check_fork_int()
 - */
 -static int check_fork(PKCS11_CTX *ctx)
 -{
 -	PKCS11_CTX_private *cpriv;
 -	int rv;
 -
 -	if (ctx == NULL)
 -		return -1;
 -	cpriv = PRIVCTX(ctx);
 -	CRYPTO_THREAD_write_lock(cpriv->rwlock);
 -	rv = check_fork_int(ctx);
 -	CRYPTO_THREAD_unlock(cpriv->rwlock);
 -	return rv;
 -}
 -
 -/*
 - * Locking interface to check_slot_fork_int()
 - */
 -static int check_slot_fork(PKCS11_SLOT *slot)
 -{
 -	PKCS11_CTX_private *cpriv;
 -	int rv;
 -
 -	if (slot == NULL)
 -		return -1;
 -	cpriv = PRIVCTX(SLOT2CTX(slot));
 -	CRYPTO_THREAD_write_lock(cpriv->rwlock);
 -	rv = check_slot_fork_int(slot);
 -	CRYPTO_THREAD_unlock(cpriv->rwlock);
 -	return rv;
 -}
 -
 -/*
 - * Reinitialize token (just its slot)
 - */
 -static int check_token_fork(PKCS11_TOKEN *token)
 -{
 -	if (token == NULL)
 -		return -1;
 -	return check_slot_fork(TOKEN2SLOT(token));
 -}
 -
 -/*
 - * Locking interface to check_key_fork_int()
 - */
 -static int check_key_fork(PKCS11_KEY *key)
 -{
 -	PKCS11_CTX_private *cpriv;
 -	int rv;
 -
 -	if (key == NULL)
 -		return -1;
 -	cpriv = PRIVCTX(KEY2CTX(key));
 -	CRYPTO_THREAD_write_lock(cpriv->rwlock);
 -	rv = check_key_fork_int(key);
 -	CRYPTO_THREAD_unlock(cpriv->rwlock);
 -	return rv;
 -}
 -
 -/*
 - * Reinitialize cert (just its token)
 - */
 -static int check_cert_fork(PKCS11_CERT *cert)
 -{
 -	if (cert == NULL)
 -		return -1;
 -	return check_token_fork(CERT2TOKEN(cert));
 -}
 -
 /* External interface to the libp11 features */
 PKCS11_CTX *PKCS11_CTX_new(void)
 -- 
 2.17.1
--- a/SOURCES/openssl-pkcs11-0.4.8-fix-build-old-c-dialects.patch
+++ b/SOURCES/openssl-pkcs11-0.4.8-fix-build-old-c-dialects.patch
@ -1,55 +0,0 @@
 From c2512ee261efb6fdd81226549f48421bd57a8230 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Micha=C5=82=20Trojnara?= <Michal.Trojnara@stunnel.org>
 Date: Mon, 3 Sep 2018 20:54:59 +0200
 Subject: [PATCH 20/23] Build fixes for old C dialects
 ---
 src/p11_cert.c | 3 ++-
 src/p11_key.c  | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)
 diff --git a/src/p11_cert.c b/src/p11_cert.c
 index 811db85..bc78447 100644
 --- a/src/p11_cert.c
 +++ b/src/p11_cert.c
@@ -74,6 +74,7 @@ int pkcs11_remove_certificate(PKCS11_CERT *cert){
 	CK_ULONG count;
 	CK_ATTRIBUTE search_parameters[32];
 	unsigned int n = 0;
 +	int rv;
 	/* First, make sure we have a session */
 	if (!spriv->haveSession && PKCS11_open_session(slot, 1)){
@@ -88,7 +89,7 @@ int pkcs11_remove_certificate(PKCS11_CERT *cert){
 	 	pkcs11_addattr_s(search_parameters + n++, CKA_LABEL, cert->label);
 	}
 -	int rv = CRYPTOKI_call(ctx,
 +	rv = CRYPTOKI_call(ctx,
 		C_FindObjectsInit(spriv->session, search_parameters, n));
 	CRYPTOKI_checkerr(CKR_F_PKCS11_REMOVE_CERTIFICATE, rv);
 diff --git a/src/p11_key.c b/src/p11_key.c
 index 1681c7d..f73029b 100644
 --- a/src/p11_key.c
 +++ b/src/p11_key.c
@@ -457,6 +457,7 @@ int pkcs11_remove_key(PKCS11_KEY *key) {
 	CK_ULONG count;
 	CK_ATTRIBUTE search_parameters[32];
 	unsigned int n = 0;
 +	int rv;
 	/* First, make sure we have a session */
 	if (!spriv->haveSession && PKCS11_open_session(slot, 1))
@@ -470,7 +471,7 @@ int pkcs11_remove_key(PKCS11_KEY *key) {
 	if (key->label)
 	 	pkcs11_addattr_s(search_parameters + n++, CKA_LABEL, key->label);
 -	int rv = CRYPTOKI_call(ctx,
 +	rv = CRYPTOKI_call(ctx,
 		C_FindObjectsInit(spriv->session, search_parameters, n));
 	CRYPTOKI_checkerr(CKR_F_PKCS11_REMOVE_KEY, rv);
 -- 
 2.17.1
--- a/SOURCES/openssl-pkcs11-0.4.8-fix-leak-rsa-object-pkcs11-store-key.patch
+++ b/SOURCES/openssl-pkcs11-0.4.8-fix-leak-rsa-object-pkcs11-store-key.patch
@ -1,25 +0,0 @@
 From e420b22fab9b81d7f4ec8c82bd836269c9d2dc51 Mon Sep 17 00:00:00 2001
 From: lbonn <bonnans.l@gmail.com>
 Date: Thu, 30 Aug 2018 14:48:24 +0200
 Subject: [PATCH 11/23] Fix leak of RSA object in pkcs11_store_key()
 EVP_PKEY_get1_RSA() increments the reference count
 ---
 src/p11_key.c | 1 +
 1 file changed, 1 insertion(+)
 diff --git a/src/p11_key.c b/src/p11_key.c
 index 1e99e0d..6fb844f 100644
 --- a/src/p11_key.c
 +++ b/src/p11_key.c
@@ -265,6 +265,7 @@ static int pkcs11_store_key(PKCS11_TOKEN *token, EVP_PKEY *pk,
 		RSA_get0_key(rsa, &rsa_n, &rsa_e, &rsa_d);
 		RSA_get0_factors(rsa, &rsa_p, &rsa_q);
 		RSA_get0_crt_params(rsa, &rsa_dmp1, &rsa_dmq1, &rsa_iqmp);
 +		RSA_free(rsa);
 #else
 		rsa_n=rsa->n;
 		rsa_e=rsa->e;
 -- 
 2.17.1
--- a/SOURCES/openssl-pkcs11-0.4.8-improve-code-readability.patch
+++ b/SOURCES/openssl-pkcs11-0.4.8-improve-code-readability.patch
@ -1,43 +0,0 @@
 From 1462a0a25286d36cf85acb4bab189ae6cc8eabd0 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Micha=C5=82=20Trojnara?= <Michal.Trojnara@stunnel.org>
 Date: Fri, 31 Aug 2018 08:45:16 +0200
 Subject: [PATCH 14/23] Improved code readability
 ---
 src/p11_slot.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)
 diff --git a/src/p11_slot.c b/src/p11_slot.c
 index 94ec378..c5140c1 100644
 --- a/src/p11_slot.c
 +++ b/src/p11_slot.c
@@ -119,19 +119,20 @@ PKCS11_SLOT *pkcs11_find_token(PKCS11_CTX *ctx, PKCS11_SLOT *slots, unsigned int
  */
 PKCS11_SLOT *pkcs11_find_next_token(PKCS11_CTX *ctx, PKCS11_SLOT *slots, unsigned int nslots, PKCS11_SLOT *current)
 {
 +	int offset;
 +
 	if (slots == NULL)
 		return NULL;
 	if (current) {
 -		if (slots > current || (current - slots) > nslots)
 +		offset = current + 1 - slots;
 +		if (offset < 1 || (unsigned int)offset >= nslots)
 			return NULL;
 -
 -		current++;
 -		nslots -= (current - slots);
 -		slots = current;
 +	} else {
 +		offset = 0;
 	}
 -	return pkcs11_find_token(ctx, slots, nslots);
 +	return pkcs11_find_token(ctx, slots+offset, nslots-offset);
 }
 /*
 -- 
 2.17.1
--- a/SOURCES/openssl-pkcs11-0.4.8-missing-function-declaration.patch
+++ b/SOURCES/openssl-pkcs11-0.4.8-missing-function-declaration.patch
@ -1,24 +0,0 @@
 From 63e2039edb888bfa190b8dd6cfa646ccab7de5b7 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Micha=C5=82=20Trojnara?= <Michal.Trojnara@stunnel.org>
 Date: Thu, 9 Aug 2018 07:19:54 +0200
 Subject: [PATCH 02/23] Missing function declaration
 ---
 src/libp11.h | 1 +
 1 file changed, 1 insertion(+)
 diff --git a/src/libp11.h b/src/libp11.h
 index 844bab9..2a8aa64 100644
 --- a/src/libp11.h
 +++ b/src/libp11.h
@@ -40,6 +40,7 @@ int ERR_load_CKR_strings(void);
 void ERR_unload_CKR_strings(void);
 void ERR_CKR_error(int function, int reason, char *file, int line);
 # define CKRerr(f,r) ERR_CKR_error((f),(r),__FILE__,__LINE__)
 +int ERR_get_CKR_code(void);
 /*
  * The purpose of this library is to provide a simple PKCS11
 -- 
 2.17.1
--- a/SOURCES/openssl-pkcs11-0.4.8-openssl-license-update.patch
+++ b/SOURCES/openssl-pkcs11-0.4.8-openssl-license-update.patch
@ -1,91 +0,0 @@
 From 218edd6df9f9546eb0b6f55fbcff07a1aa4763c6 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Micha=C5=82=20Trojnara?= <Michal.Trojnara@stunnel.org>
 Date: Sat, 1 Sep 2018 06:26:43 +0200
 Subject: [PATCH 15/23] Updated OpenSSL license in the engine front-end
 The OpenSSL team has decided to re-license their library.
 This commit propagates the license change to our derived code.
 ---
 src/eng_front.c | 65 +++++++------------------------------------------
 1 file changed, 9 insertions(+), 56 deletions(-)
 diff --git a/src/eng_front.c b/src/eng_front.c
 index 286aaa9..95c2b03 100644
 --- a/src/eng_front.c
 +++ b/src/eng_front.c
@@ -1,63 +1,16 @@
 -/* crypto/engine/hw_pkcs11.c */
 -/* Written by Geoff Thorpe (geoff@geoffthorpe.net) for the OpenSSL
 +/*
 + * Copyright 1999-2001 The OpenSSL Project Authors. All Rights Reserved.
 + * Written by Geoff Thorpe (geoff@geoffthorpe.net) for the OpenSSL
  * project 2000.
 + * Portions Copyright (c) 2003 Kevin Stefanik (kstef@mtppi.org)
  * Copied/modified by Kevin Stefanik (kstef@mtppi.org) for the OpenSC
  * project 2003.
 - * Copyright (c) 2017 Michał Trojnara
 - */
 -/* ====================================================================
 - * Copyright (c) 1999-2001 The OpenSSL Project.  All rights reserved.
 - * Portions Copyright (c) 2003 Kevin Stefanik (kstef@mtppi.org)
 - *
 - * Redistribution and use in source and binary forms, with or without
 - * modification, are permitted provided that the following conditions
 - * are met:
 - *
 - * 1. Redistributions of source code must retain the above copyright
 - *    notice, this list of conditions and the following disclaimer.
 - *
 - * 2. Redistributions in binary form must reproduce the above copyright
 - *    notice, this list of conditions and the following disclaimer in
 - *    the documentation and/or other materials provided with the
 - *    distribution.
 - *
 - * 3. All advertising materials mentioning features or use of this
 - *    software must display the following acknowledgment:
 - *    "This product includes software developed by the OpenSSL Project
 - *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
 - *
 - * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
 - *    endorse or promote products derived from this software without
 - *    prior written permission. For written permission, please contact
 - *    licensing@OpenSSL.org.
 - *
 - * 5. Products derived from this software may not be called "OpenSSL"
 - *    nor may "OpenSSL" appear in their names without prior written
 - *    permission of the OpenSSL Project.
 - *
 - * 6. Redistributions of any form whatsoever must retain the following
 - *    acknowledgment:
 - *    "This product includes software developed by the OpenSSL Project
 - *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
 - *
 - * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
 - * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 - * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 - * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
 - * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 - * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 - * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
 - * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 - * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 - * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 - * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 - * OF THE POSSIBILITY OF SUCH DAMAGE.
 - * ====================================================================
 - *
 - * This product includes cryptographic software written by Eric Young
 - * (eay@cryptsoft.com).  This product includes software written by Tim
 - * Hudson (tjh@cryptsoft.com).
 + * Copyright (c) 2016-2018 Michał Trojnara
  *
 + * Licensed under the OpenSSL license (the "License").  You may not use
 + * this file except in compliance with the License.  You can obtain a copy
 + * in the file LICENSE in the source distribution or at
 + * https://www.openssl.org/source/license.html
  */
 #include "engine.h"
 -- 
 2.17.1
--- a/SOURCES/openssl-pkcs11-0.4.8-require-debug-to-print.patch
+++ b/SOURCES/openssl-pkcs11-0.4.8-require-debug-to-print.patch
@ -1,49 +0,0 @@
 From 58230eb4869fad540fab450b79f325ca76d2320e Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Micha=C5=82=20Trojnara?= <Michal.Trojnara@stunnel.org>
 Date: Wed, 12 Sep 2018 22:42:06 +0200
 Subject: [PATCH 22/23] Require DEBUG to print libp11 debugging messages
 Printing unneeded warnings was mentioned in #242
 ---
 src/p11_key.c  | 9 +++++----
 src/p11_pkey.c | 2 ++
 2 files changed, 7 insertions(+), 4 deletions(-)
 diff --git a/src/p11_key.c b/src/p11_key.c
 index f73029b..d226b86 100644
 --- a/src/p11_key.c
 +++ b/src/p11_key.c
@@ -331,10 +331,11 @@ EVP_PKEY *pkcs11_get_key(PKCS11_KEY *key, int isPrivate)
 		if (key->evp_key == NULL)
 			return NULL;
 		kpriv->always_authenticate = CK_FALSE;
 -		if(isPrivate) {
 -			if(key_getattr_val(key, CKA_ALWAYS_AUTHENTICATE,
 -					&kpriv->always_authenticate, sizeof(CK_BBOOL)))
 -				fprintf(stderr, "Missing CKA_ALWAYS_AUTHENTICATE attribute\n");
 +		if (isPrivate && key_getattr_val(key, CKA_ALWAYS_AUTHENTICATE,
 +				&kpriv->always_authenticate, sizeof(CK_BBOOL))) {
 +#ifdef DEBUG
 +			fprintf(stderr, "Missing CKA_ALWAYS_AUTHENTICATE attribute\n");
 +#endif
 		}
 	}
 #if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
 diff --git a/src/p11_pkey.c b/src/p11_pkey.c
 index 95c6458..88cbc79 100644
 --- a/src/p11_pkey.c
 +++ b/src/p11_pkey.c
@@ -524,8 +524,10 @@ static int pkcs11_try_pkey_ec_sign(EVP_PKEY_CTX *evp_pkey_ctx,
 		unsigned char *sig, size_t *siglen,
 		const unsigned char *tbs, size_t tbslen)
 {
 +#ifdef DEBUG
 	fprintf(stderr, "%s:%d pkcs11_try_pkey_ec_sign() not implemented\n",
 		__FILE__, __LINE__);
 +#endif
 	return -1;
 }
 -- 
 2.17.1
--- a/SPECS/openssl-pkcs11.spec
+++ b/SPECS/openssl-pkcs11.spec
@ -1,4 +1,4 @@
-Version: 0.4.8
+Version: 0.4.10
 Release: 2%{?dist}
 # Define the directory where the OpenSSL engines are installed
@ -11,23 +11,13 @@ License:        LGPLv2+ and BSD
 URL:            https://github.com/OpenSC/libp11
 Source0:        https://github.com/OpenSC/libp11/releases/download/libp11-%{version}/libp11-%{version}.tar.gz
-Patch0:         openssl-pkcs11-0.4.8-missing-function-declaration.patch
+Patch0:         openssl-pkcs11-0.4.10-small-bug-fixes.patch
-Patch1:         openssl-pkcs11-0.4.8-ec-sign-test.patch
+Patch1:         openssl-pkcs11-0.4.10-search-objects-in-all-matching-tokens.patch
-Patch2:         openssl-pkcs11-0.4.8-error-handling-evp-pkey-set1-engine.patch
+Patch2:         openssl-pkcs11-0.4.10-set-rsa-fips-method-flag.patch
 Patch3:         openssl-pkcs11-0.4.8-evp-pkey-ec-framework.patch
 Patch4:         openssl-pkcs11-0.4.8-error-handling-evp-pkey-set1-engine-fixed.patch
 Patch5:         openssl-pkcs11-0.4.8-expose-check-fork.patch
 Patch6:         openssl-pkcs11-0.4.8-ex-data-coding-style.patch
 Patch7:         openssl-pkcs11-0.4.8-atfork-checks-rsa-and-ec-keys.patch
 Patch8:         openssl-pkcs11-0.4.8-fix-leak-rsa-object-pkcs11-store-key.patch
 Patch9:         openssl-pkcs11-0.4.8-improve-code-readability.patch
 Patch10:        openssl-pkcs11-0.4.8-openssl-license-update.patch
 Patch11:        openssl-pkcs11-0.4.8-fix-build-old-c-dialects.patch
 Patch12:        openssl-pkcs11-0.4.8-allow-use-privkey-without-pin.patch
 Patch13:        openssl-pkcs11-0.4.8-require-debug-to-print.patch
 BuildRequires:  autoconf automake libtool
 BuildRequires:  openssl-devel
 BuildRequires:  openssl >= 1.0.2
 BuildRequires:  pkgconfig
 BuildRequires:  pkgconfig(p11-kit-1)
 # Needed for testsuite
@ -104,11 +94,9 @@ rm -f %{buildroot}%{_includedir}/*.h
 rm -rf %{buildroot}%{_docdir}/libp11/
 %check
-make check %{?_smp_mflags}
+make check %{?_smp_mflags} || if [ $? -ne 0 ]; then cat tests/*.log; exit 1; fi;
-%post -p /sbin/ldconfig
+%ldconfig_scriptlets
 %postun -p /sbin/ldconfig
 %files
 %license COPYING
@ -125,6 +113,16 @@ make check %{?_smp_mflags}
 %endif
 %changelog
 * Thu Nov 28 2019 Anderson Sasaki <ansasaki@redhat.com> - 0.4.10-2
 - Set RSA_FLAG_FIPS_METHOD for RSA methods (#1777892)
 * Thu Nov 21 2019 Anderson Sasaki <ansasaki@redhat.com> - 0.4.10-1
 - Update to 0.4.10 (#1745082)
 - Add BuildRequires for OpenSSL >= 1.0.2, required for testing
 - Print tests logs if failed during build
 - Small bug fixes such as removal of unused variable
 - Search objects in all matching tokens (#1705505)
 * Tue Sep 18 2018 Anderson Sasaki <ansasaki@redhat.com> - 0.4.8-2
 - Require OpenSSL >= 1.0.2
 - Fixed missing declaration of ERR_get_CKR_code()
`@ -1 +1 @@`
	`SOURCES/libp11-0.4.8.tar.gz`	`SOURCES/libp11-0.4.10.tar.gz`
`@ -1 +1 @@`
	`c39ae70fda467b8096ed419fc6a1687421696717 SOURCES/libp11-0.4.8.tar.gz`	`9407888f8f8fd144d0003390c20729cbfb75997f SOURCES/libp11-0.4.10.tar.gz`