tests: Remove p11-kit remoting from pkcs11 tests

The p11-kit remoting was initially introduced because softhsm
was crashing during cleanup with OpenSSL 3.0. This was resolved
since then and this code introduces a lot of complexity and
possible bugs, such as when using the mechanisms from PKCS#11 3.0
that are unknown to the p11-kit remoting tool. It decides to remove
them from the list as demonstrated here:

https://github.com/p11-glue/p11-kit/issues/668

This resulted in pkcs11-provider not registering EDDSA siganture
methods to the OpenSSL and failing when asked to provide a singature
by the Ed25519 key from the PKCS#11 token.

Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Reviewed-by: Sahana Prasad <sahana@redhat.com>
(cherry picked from commit 99fcd56135)

doc/pkcs11.dox

@@ -81,10 +81,6 @@ We recommend the users to provide a specific PKCS #11 URI so that it matches onl
 If the engine discovers multiple slots that could potentially contain the private keys referenced
 by the provided PKCS #11 URI, the engine will not try to authenticate.
 
-For testing, the SoftHSM PKCS#11 library is used. But it has some issues with
+For testing, the SoftHSM PKCS#11 library is used.
-OpenSSL initialization/cleanup when used with OpenSSL 3.0 so we are using it
-indirectly through a p11-kit remoting as described in the following article:
-
-https://p11-glue.github.io/p11-glue/p11-kit/manual/remoting.html
 
 */

tests/CMakeLists.txt

@@ -171,6 +171,20 @@ find_program(SSHD_EXECUTABLE
                 /usr/sbin
                 /usr/local/sbin)
 
+if (WITH_PKCS11_URI)
+    find_package(softhsm)
+    if (NOT SOFTHSM_FOUND)
+        message(SEND_ERROR "Could not find softhsm module!")
+    endif (NOT SOFTHSM_FOUND)
+    find_library(PKCS11SPY
+        NAMES
+            pkcs11-spy.so
+    )
+
+    #Copy the script to setup PKCS11 tokens
+    file(COPY pkcs11/setup-softhsm-tokens.sh DESTINATION ${CMAKE_CURRENT_BINARY_DIR}/pkcs11 FILE_PERMISSIONS OWNER_READ OWNER_WRITE OWNER_EXECUTE)
+endif (WITH_PKCS11_URI)
+
 if (CLIENT_TESTING OR SERVER_TESTING)
     find_package(socket_wrapper 1.1.5 REQUIRED)
     find_package(nss_wrapper 1.1.2 REQUIRED)
@@ -189,27 +203,6 @@ if (CLIENT_TESTING OR SERVER_TESTING)
                     /usr/bin
                     /usr/local/bin)
 
-    if (WITH_PKCS11_URI)
-        find_package(softhsm)
-        if (NOT SOFTHSM_FOUND)
-            message(SEND_ERROR "Could not find softhsm module!")
-        endif (NOT SOFTHSM_FOUND)
-        find_library(PKCS11SPY
-            NAMES
-                pkcs11-spy.so
-        )
-        if (WITH_PKCS11_PROVIDER)
-            find_package(PkgConfig)
-            if (PKG_CONFIG_FOUND)
-                pkg_check_modules(P11_KIT p11-kit-1)
-                if (P11_KIT_FOUND)
-                    pkg_get_variable(P11_MODULE_PATH p11-kit-1 p11_module_path)
-                    set(P11_KIT_CLIENT ${P11_MODULE_PATH}/p11-kit-client.so)
-                endif (P11_KIT_FOUND)
-            endif (PKG_CONFIG_FOUND)
-        endif (WITH_PKCS11_PROVIDER)
-    endif (WITH_PKCS11_URI)
-
     set(LOCAL_USER "nobody")
     set(LOCAL_UID "65533")
     find_program(ID_EXECUTABLE NAMES id)
@@ -330,11 +323,6 @@ if (CLIENT_TESTING OR SERVER_TESTING)
         ${CMAKE_CURRENT_BINARY_DIR}/home/doe/.ssh/ FILE_PERMISSIONS OWNER_READ OWNER_WRITE)
 endif ()
 
-if (WITH_PKCS11_URI)
-    #Copy the script to setup PKCS11 tokens
-    file(COPY pkcs11/setup-softhsm-tokens.sh DESTINATION ${CMAKE_CURRENT_BINARY_DIR}/pkcs11 FILE_PERMISSIONS OWNER_READ OWNER_WRITE OWNER_EXECUTE)
-endif (WITH_PKCS11_URI)
-
 file(COPY gss/kdcsetup.sh DESTINATION ${CMAKE_CURRENT_BINARY_DIR}/gss FILE_PERMISSIONS OWNER_READ OWNER_WRITE OWNER_EXECUTE)
 
 message(STATUS "TORTURE_ENVIRONMENT=${TORTURE_ENVIRONMENT}")

tests/pkcs11/setup-softhsm-tokens.sh

@@ -8,7 +8,6 @@ OBJNAME=$3
 TOKENLABEL=$3 # yeah. The same as object label
 LOADPUBLIC=$4
 LIBSOFTHSM_PATH=$5
-P11_KIT_CLIENT=$6
 shift 5
 
 PUBKEY="$PRIVKEY.pub"
@@ -86,55 +85,6 @@ if [ $ret -ne 0 ]; then
 fi
 echo "$out"
 
-# Skip the p11-kit if not needed
+pkcs11-tool -M --login --pin=1234 --module="$LIBSOFTHSM_PATH" --token-label="$TOKENLABEL"
-if [ -z "$P11_KIT_CLIENT" ]; then
-    exit 0
-fi
-
-# when creating more keys, we need to restart the p11-kit
-# so it can pick up the new keys
-if [ -h "$TESTDIR/p11-kit-server.socket" ]; then
-    kill -9 "$(cat "$TESTDIR/p11-kit-server.pid")"
-    rm "$TESTDIR/p11-kit-server.socket"
-fi
-
-# p11-kit complains if there is no runtime directory
-if [ -z "$XDG_RUNTIME_DIR" ]; then
-    export XDG_RUNTIME_DIR=$PWD
-fi
-
-# Start the p11-kit server
-cmd="p11-kit server --provider $LIBSOFTHSM_PATH pkcs11:"
-echo "$cmd"
-out=$(eval "$cmd")
-ret=$?
-if [ $ret -ne 0 ]; then
-    echo "Starting p11-kit server failed"
-    echo "$out"
-    exit 1
-fi
-eval "$out"
-
-# Symlink the p11-kit-server socket to "known place"
-P11_KIT_SERVER_ADDRESS_PATH=${P11_KIT_SERVER_ADDRESS:10}
-cmd="ln -s $P11_KIT_SERVER_ADDRESS_PATH $TESTDIR/p11-kit-server.socket"
-echo "$cmd"
-out=$(eval "$cmd")
-
-# Save the PID for the C code to clean up
-cmd="echo $P11_KIT_SERVER_PID > $TESTDIR/p11-kit-server.pid"
-echo "$cmd"
-out=$(eval "$cmd")
-
-cmd="pkcs11-tool -O --login --pin=1234 --module=$P11_KIT_CLIENT --token-label=$TOKENLABEL"
-echo "$cmd"
-out=$(eval "$cmd")
-ret=$?
-echo "$out"
-if [ $ret -ne 0 ]; then
-    echo "Failed to list keys through p11-kit remoting"
-    echo "$out"
-    exit 1
-fi
 
 exit 0

tests/tests_config.h.cmake

@@ -68,5 +68,4 @@
 #cmakedefine WITH_TIMEOUT ${WITH_TIMEOUT}
 #cmakedefine TIMEOUT_EXECUTABLE "${TIMEOUT_EXECUTABLE}"
 #cmakedefine SOFTHSM2_LIBRARY "${SOFTHSM2_LIBRARY}"
-#cmakedefine P11_KIT_CLIENT "${P11_KIT_CLIENT}"
 #cmakedefine PKCS11SPY "${PKCS11SPY}"

tests/torture.c

@@ -1385,70 +1385,48 @@ void torture_setup_tokens(const char *temp_dir,
 {
     char token_setup_start_cmd[1024] = {0};
     char socket_path[1204] = {0};
-#ifndef WITH_PKCS11_PROVIDER
     char conf_path[1024] = {0};
-#endif /* WITH_PKCS11_PROVIDER */
+#ifdef WITH_PKCS11_PROVIDER
     char *env = NULL;
+#endif /* WITH_PKCS11_PROVIDER */
     int rc;
 
     rc = snprintf(token_setup_start_cmd,
                   sizeof(token_setup_start_cmd),
-                  "%s/tests/pkcs11/setup-softhsm-tokens.sh %s %s %s %s %s %s",
+                  "%s/tests/pkcs11/setup-softhsm-tokens.sh %s %s %s %s %s",
                   BINARYDIR,
                   temp_dir,
                   filename,
                   object_name,
                   load_public,
-                  SOFTHSM2_LIBRARY,
+                  SOFTHSM2_LIBRARY);
-#ifdef WITH_PKCS11_PROVIDER
-                  P11_KIT_CLIENT
-#else
-                  ""
-#endif /* WITH_PKCS11_PROVIDER */
-    );
     assert_int_not_equal(rc, sizeof(token_setup_start_cmd));
 
     rc = system(token_setup_start_cmd);
     assert_return_code(rc, errno);
 
 #ifdef WITH_PKCS11_PROVIDER
-    rc = snprintf(socket_path,
+    setenv("PKCS11_PROVIDER_MODULE", SOFTHSM2_LIBRARY, 1);
-                  sizeof(socket_path),
-                  "unix:path=%s/p11-kit-server.socket",
-                  temp_dir);
-    assert_int_not_equal(rc, sizeof(socket_path));
-    setenv("P11_KIT_SERVER_ADDRESS", socket_path, 1);
 
-    setenv("PKCS11_PROVIDER_MODULE", P11_KIT_CLIENT, 1);
     /* This is useful for debugging PKCS#11 calls */
-
     env = getenv("TORTURE_PKCS11");
     if (env != NULL && env[0] != '\0') {
 #ifdef PKCS11SPY
-        setenv("PKCS11SPY", P11_KIT_CLIENT, 1);
+        setenv("PKCS11SPY", SOFTHSM2_LIBRARY, 1);
         setenv("PKCS11_PROVIDER_MODULE", PKCS11SPY, 1);
 #else
         fprintf(stderr, "[ TORTURE  ] >>> pkcs11-spy not found\n");
 #endif /* PKCS11SPY */
     }
-#else
+#endif /* WITH_PKCS11_PROVIDER */
-    (void)env;
 
     snprintf(conf_path, sizeof(conf_path), "%s/softhsm.conf", temp_dir);
     setenv("SOFTHSM2_CONF", conf_path, 1);
-#endif /* WITH_PKCS11_PROVIDER */
 }
 
 void torture_cleanup_tokens(const char *temp_dir)
 {
-#ifdef WITH_PKCS11_PROVIDER
-    char pidfile[1024] = {0};
-
-    snprintf(pidfile, sizeof(pidfile), "%s/p11-kit-server.pid", temp_dir);
-    torture_terminate_process(pidfile);
-#else
     unsetenv("SOFTHSM2_CONF");
-#endif /* WITH_PKCS11_PROVIDER */
 }
 #endif /* WITH_PKCS11_URI */