Bug 1278323 - Can't load pkcs11 engine into openssl
Can't load pkcs11 engine into openssl
Status: CLOSED ERRATA
Product: Fedora
Classification: Fedora
Component: libp11 (Show other bugs)
23
x86_64 Linux
unspecified Severity high
: ---
: ---
Assigned To: Kalev Lember
Fedora Extras Quality Assurance
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2015-11-05 04:27 EST by Denis Kostousov
Modified: 2015-11-17 10:51 EST (History)
5 users (show)

See Also:
Fixed In Version: libp11-0.3.0-1.fc23
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2015-11-17 10:51:41 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Denis Kostousov 2015-11-05 04:27:35 EST
Description of problem:
openssl shows an error after engine command:
OpenSSL> engine -t dynamic -pre SO_PATH:/usr/lib64/openssl/engines/engine_pkcs11.so -pre ID:pkcs11 -pre LIST_ADD:1 -pre LOAD -pre MODULE_PATH:/usr/lib64/opensc-pkcs11.so
(dynamic) Dynamic engine loading support
[Success]: SO_PATH:/usr/lib64/openssl/engines/engine_pkcs11.so
[Success]: ID:pkcs11
[Success]: LIST_ADD:1
[Failure]: LOAD
140233360377720:error:25066067:DSO support routines:DLFCN_LOAD:could not load the shared library:dso_dlfcn.c:187:filename(/usr/lib64/openssl/engines/engine_pkcs11.so): /lib64/libp11.so.2: undefined symbol: lt_dlopen
140233360377720:error:25070067:DSO support routines:DSO_load:could not load the shared library:dso_lib.c:232:
140233360377720:error:260B6084:engine routines:DYNAMIC_LOAD:dso not found:eng_dyn.c:465:
[Failure]: MODULE_PATH:/usr/lib64/opensc-pkcs11.so
140233360377720:error:260AC089:engine routines:INT_CTRL_HELPER:invalid cmd name:eng_ctrl.c:131:
140233360377720:error:260AB089:engine routines:ENGINE_ctrl_cmd_string:invalid cmd name:eng_ctrl.c:311:
 

Version-Release number of selected component (if applicable):
% rpm -qa openssl\*
openssl-libs-1.0.2d-2.fc23.i686
openssl-1.0.2d-2.fc23.x86_64
openssl-libs-1.0.2d-2.fc23.x86_64

% rpm -qa engine\*
engine_pkcs11-0.1.8-12.fc23.x86_64

% rpm -qa opensc\*
opensc-0.15.0-2.fc23.x86_64

How reproducible:


Steps to Reproduce:
1. exec openssl
2. enter in the openssl command prompt:
engine -t dynamic -pre SO_PATH:/usr/lib64/openssl/engines/engine_pkcs11.so -pre ID:pkcs11 -pre LIST_ADD:1 -pre LOAD -pre MODULE_PATH:/usr/lib64/opensc-pkcs11.so
3.

Actual results:


Expected results:


Additional info:
Comment 1 David Woodhouse 2015-11-05 05:55:24 EST
Or, put more simply since ENGINE_pkcs11 now does the right thing and automatically loads the correct PKCS#11 modules so you shouldn't need all the complex configuration:

$ openssl engine pkcs11
139716144940920:error:25066067:DSO support routines:DLFCN_LOAD:could not load the shared library:dso_dlfcn.c:187:filename(/usr/lib64/openssl/engines/libpkcs11.so): /lib64/libp11.so.2: undefined symbol: lt_dlopen
139716144940920:error:25070067:DSO support routines:DSO_load:could not load the shared library:dso_lib.c:232:
139716144940920:error:260B6084:engine routines:DYNAMIC_LOAD:dso not found:eng_dyn.c:465:
139716144940920:error:2606A074:engine routines:ENGINE_by_id:no such engine:eng_list.c:391:id=pkcs11
Comment 2 David Woodhouse 2015-11-05 06:02:25 EST
If I fix that with the following patch, I still get a failure:

[dwoodhou@i7 f23]$ openssl engine pkcs11
140288589592440:error:25066067:DSO support routines:DLFCN_LOAD:could not load the shared library:dso_dlfcn.c:187:filename(/usr/lib64/openssl/engines/libpkcs11.so): /lib64/libp11.so.2: undefined symbol: LOCK


--- libp11-0.2.8/src/Makefile.am~	2015-11-05 10:55:08.656434013 +0000
+++ libp11-0.2.8/src/Makefile.am	2015-11-05 10:58:01.151574773 +0000
@@ -17,7 +17,7 @@ else
 dist_noinst_DATA = versioninfo.rc
 endif
 libp11_la_CFLAGS = $(AM_CFLAGS) $(OPENSSL_CFLAGS) $(LTLIB_CFLAGS)
-libp11_la_LIBADD = $(OPENSSL_LIBS)
+libp11_la_LIBADD = $(OPENSSL_LIBS) $(LTLIB_LIBS)
 
 libp11_la_LDFLAGS = $(AM_LDFLAGS) \
 	-version-info @LIBP11_LT_CURRENT@:@LIBP11_LT_REVISION@:@LIBP11_LT_AGE@ \
Comment 3 Nikos Mavrogiannopoulos 2015-11-05 06:07:17 EST
I'll bring libp11 0.3.0 and engine_pkcs11 0.2.0 to f23, which fix both issues.
Comment 4 Fedora Update System 2015-11-05 06:09:41 EST
libp11-0.3.0-1.fc23 has been submitted as an update to Fedora 23. https://bodhi.fedoraproject.org/updates/FEDORA-2015-b911ae7eb4
Comment 5 David Woodhouse 2015-11-05 06:12:27 EST
I had to install softhsm to build that. And now...

[root@i7 f23]# openssl engine pkcs11 -t
(pkcs11) pkcs11 engine
     [ available ]
Segmentation fault (core dumped)
Comment 6 David Woodhouse 2015-11-05 06:15:38 EST
Program received signal SIGSEGV, Segmentation fault.
0x00007ffff4754840 in ?? ()
(gdb) bt
#0  0x00007ffff4754840 in ?? ()
#1  0x00007ffff6e192f2 in CRYPTO_THREADID_current () from /lib64/libcrypto.so.10
#2  0x00007ffff6ec578c in ERR_print_errors_cb () from /lib64/libcrypto.so.10
#3  0x000000000045ed18 in engine_main ()
#4  0x000000000041a458 in do_cmd ()
#5  0x000000000041a0c7 in main ()

Is some library registering thread locking functions with OpenSSL and failing to unregister them when it gets unloaded?
Comment 7 David Woodhouse 2015-11-05 06:32:24 EST
Without SoftHSM installed, it's working (the engine can only access keys through the engine easily; certs are handled strangely by OpenSSL so we extract it first):

$ p11tool --export 'pkcs11:manufacturer=piv_II;id=%01;type=cert' > cert.pem
$ openssl smime -sign -engine pkcs11  -keyform engine -inkey 'pkcs11:manufacturer=piv_II;id=%01' -in libp11.spec -out signed -signer cert.pem
engine "pkcs11" set.
PKCS#11 token PIN: 
$
Comment 8 Nikos Mavrogiannopoulos 2015-11-05 07:16:18 EST
I was seeing something similar. Could it be related with that?
https://github.com/OpenSC/libp11/commit/b2ac83353e4d51115744da96fc5a5bd00b964dd2
Comment 9 Fedora Update System 2015-11-05 21:35:10 EST
engine_pkcs11-0.2.0-1.fc23, libp11-0.3.0-1.fc23 has been pushed to the Fedora 23 testing repository. If problems still persist, please make note of it in this bug report.
If you want to test the update, you can install it with
$ su -c 'dnf --enablerepo=updates-testing update engine_pkcs11 libp11'
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2015-b911ae7eb4
Comment 10 Nikos Mavrogiannopoulos 2015-11-16 08:36:58 EST
Denis could you verify that the update works for you?
Comment 11 Denis Kostousov 2015-11-16 10:13:47 EST
It's works in my case
Comment 12 Fedora Update System 2015-11-17 10:51:38 EST
engine_pkcs11-0.2.0-1.fc23, libp11-0.3.0-1.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.