Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.
Bug 1264645 - Card error learning certificate RFC7512 PKCS#11 URI from eToken
Summary: Card error learning certificate RFC7512 PKCS#11 URI from eToken
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: pkcs11-helper
Version: 22
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: David Woodhouse
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2015-09-19 20:17 UTC by c.keil
Modified: 2015-10-23 17:26 UTC (History)
3 users (show)

Fixed In Version: pkcs11-helper-1.11-7.fc23 pkcs11-helper-1.11-7.fc22
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2015-09-27 07:26:53 UTC
Type: Bug


Attachments (Terms of Use)
Patch to fix card error (584 bytes, patch)
2015-09-19 20:17 UTC, c.keil
no flags Details | Diff

Description c.keil 2015-09-19 20:17:25 UTC
Created attachment 1075257 [details]
Patch to fix card error

Description of problem:

The pkcs11-helper-rfc7512.patch to support corresponding PKCS#11 URIs for certificates yields an "card error" trying to learn a certificate from an eToken with "gpgsm --learn".

The error seems to be in lib/pkcs11h-serialization.c:__parse_pkcs11_uri. The id part of the PKCS#11 URI is parsed into a field that is one character too short. The call to __parse_token_uri_attr thus fails with return value "CKR_ATTRIBUTE_VALUE_INVALID" since it could not parse the whole id parameter.

The attached patch applied after pkcs11-helper-rfc7512.patch allows to successfully learn the certificate.


Version-Release number of selected component (if applicable):

pkcs11-helper-1.11-5.fc22.i686

How reproducible:

Take an eToken with a PKCS#11 URI identified certificate.

Steps to Reproduce:
1. Insert the token
2. Execute "gpgsm --learn"

Actual results:

$ LC_ALL=C gpgsm --learn
gpgsm: error learning card: Card error

Expected results:


Additional info:

Comment 1 Kalev Lember 2015-09-20 12:05:57 UTC
Thanks for the patch. Can you submit it upstream at https://github.com/OpenSC/pkcs11-helper please?

Comment 2 c.keil 2015-09-22 19:56:48 UTC
Erm, the error is in the code added with the pkcs11-helper-rfc7512 patch that is in the Fedora package. As far as I saw it, the code to parse PKCS11 URIs is not present upstream?

Comment 3 Kalev Lember 2015-09-22 20:29:52 UTC
Ohh, you are absolutely right, sorry.

Comment 4 David Woodhouse 2015-09-22 20:48:04 UTC
Thanks for the patch.

I've updated the (outstanding since December 2014) pull request at https://github.com/OpenSC/pkcs11-helper/pull/4 and packages are building for f22/f23/rawhide.

Comment 5 Fedora Update System 2015-09-22 21:02:00 UTC
pkcs11-helper-1.11-7.fc22 has been submitted as an update to Fedora 22. https://bodhi.fedoraproject.org/updates/FEDORA-2015-16466

Comment 6 Fedora Update System 2015-09-22 21:03:19 UTC
pkcs11-helper-1.11-7.fc23 has been submitted as an update to Fedora 23. https://bodhi.fedoraproject.org/updates/FEDORA-2015-16467

Comment 7 Fedora Update System 2015-09-25 21:21:41 UTC
pkcs11-helper-1.11-7.fc22 has been pushed to the Fedora 22 testing repository. If problems still persist, please make note of it in this bug report.
If you want to test the update, you can install it with
$ su -c 'dnf --enablerepo=updates-testing update pkcs11-helper'
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2015-16466

Comment 8 Fedora Update System 2015-09-27 07:26:49 UTC
pkcs11-helper-1.11-7.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.

Comment 9 Fedora Update System 2015-10-23 17:26:01 UTC
pkcs11-helper-1.11-7.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.