Ubuntu
opencryptoki package

TPM token fails to reinitialize properly on reload

Bug #645576 reported by David Smith
30
This bug affects 4 people
Affects Status Importance Assigned to Milestone
openCryptoki
Unknown
Unknown
opencryptoki (Debian)
Fix Released
Unknown
opencryptoki (Ubuntu)
Fix Released
Undecided
Unassigned
Lucid
Fix Released
Undecided
Unassigned
Maverick
Won't Fix
Undecided
Unassigned
Natty
Won't Fix
Undecided
Unassigned

Bug Description

Binary package hint: opencryptoki

The TPM token code uses some global variables to track the storage root key, root public & private keys, and leaf public & private keys from the TPM. These variables are not properly reinitialized during unload and reload of the module. In the case of wpasupplicant, this results in PKCS#11 becoming unusable and one must kill the process to start a fresh reconfiguration.

Attached is a patch that cleans up the use of these variables in the token_specific_init() function called when the module is dlopen()'d.

Revision history for this message
David Smith (dds) wrote :

Also attaching debdiff from fixed package.

scm (scm)
tags: added: glucid
Revision history for this message
Etienne Goyer (etienne-goyer-outlands) wrote :

Tracked upstream at http://sourceforge.net/tracker/?func=detail&atid=710344&aid=3073688&group_id=128009

Revision history for this message
David Smith (dds) wrote :

How to reproduce, given a wpasupplicant configuration that uses PKCS#11 to use the TPM for private key:
  - Connect to the network once, ensure a normal connection is possible.
  - Kill the opencryptoki pkcsslotd process (send SIGKILL; it ignores SIGTERM while in use).
  - Start a new opencryptoki pkcsslotd process.
  - Attempt to reconnect to the same network.

Expected behavior:
  - wpasupplicant should unload the PKCS#11 openssl engine library and reload it for the reconnection attempt.
  - The connection should succeed.

Observed behavior:
  - wpasupplicant unloads the PKCS#11 openssl engine library and reloads it for the reconnection attempt.
  - Immediately after wpasupplicant loads the PKCS#11 openssl engine library, it fails to load the private key.

The failure to load the private key was debugged back to failure in the opencryptoki TPM library to load the private root key. The private key fails to load because the session object opencryptoki uses to load the key into the TPM is stale, left over from the first session.

Revision history for this message
David Smith (dds) wrote :

I have updated the patch upstream and am waiting on review.

Brian Murray (brian-murray)
tags: added: patch
Revision history for this message
David Smith (dds) wrote :

Bug also raised in Debian upstream, http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=603104. Will contact DD to merge updated patch there as well.

Revision history for this message
David Smith (dds) wrote :

Updating patch to same version as sourceforge.

Bug Watch Updater (bug-watch-updater)
Changed in opencryptoki (Debian):
status: Unknown → New
Revision history for this message
Etienne Goyer (etienne-goyer-outlands) wrote :

Subscribing ubuntu-sponsors, as there's a patch attached. Could this be considered for oneiric?

Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package opencryptoki - 2.3.1+dfsg-1ubuntu1

---------------
opencryptoki (2.3.1+dfsg-1ubuntu1) oneiric; urgency=low

  * Fix LP: #645576 - TPM token fails to reinitialize properly on reload.
    Add patch to reset TPM datastructures on init, and not just logout
    - add debian/patches/08-reset-tpm-structures.patch
    - update debian/patches/series
 -- David Smith <email address hidden> Mon, 11 Jul 2011 18:11:12 +0100

Changed in opencryptoki (Ubuntu):
status: New → Fix Released
Revision history for this message
Alessio Treglia (quadrispro) wrote :

Fixed in Debian too.

Thank you, David!

Bug Watch Updater (bug-watch-updater)
Changed in opencryptoki (Debian):
status: New → Fix Released
Revision history for this message
Stéphane Graber (stgraber) wrote :

Pushed the cherry-picked fix from the Debian package to lucid, maverick and natty (as they all had the same version of opencryptoki). The Ubuntu SRU team will be in touch soon.

Changed in opencryptoki (Ubuntu Lucid):
status: New → Fix Committed
Changed in opencryptoki (Ubuntu Maverick):
status: New → Fix Committed
Changed in opencryptoki (Ubuntu Natty):
status: New → Fix Committed
Revision history for this message
Clint Byrum (clint-fewbar) wrote : Please test proposed package

Hello David, or anyone else affected,

Accepted opencryptoki into lucid-proposed, the package will build now and be available in a few hours. Please test and give feedback here. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you in advance!

tags: added: verification-needed
Revision history for this message
Clint Byrum (clint-fewbar) wrote :

Hello David, or anyone else affected,

Accepted opencryptoki into maverick-proposed, the package will build now and be available in a few hours. Please test and give feedback here. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you in advance!

Revision history for this message
Clint Byrum (clint-fewbar) wrote :

Hello David, or anyone else affected,

Accepted opencryptoki into natty-proposed, the package will build now and be available in a few hours. Please test and give feedback here. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you in advance!

Revision history for this message
Steve Atwell (satwell) wrote :

I've tested version 2.2.8+dfsg-4ubuntu0.10.04.1 on Lucid, and it fixes this problem for me.

Martin Pitt (pitti)
tags: added: verification-done-lucid
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package opencryptoki - 2.2.8+dfsg-4ubuntu0.10.04.1

---------------
opencryptoki (2.2.8+dfsg-4ubuntu0.10.04.1) lucid-proposed; urgency=low

  * Cherry-pick patch from Deibna to reset TPM datastructures on init
    and not just logout, fixes TPM token reinitialization failure on reload.
    Thanks to David Smith for the patch (LP: #645576)
 -- Stephane Graber <email address hidden> Wed, 07 Dec 2011 11:25:22 -0500

Changed in opencryptoki (Ubuntu Lucid):
status: Fix Committed → Fix Released
Adolfo Jayme Barrientos (fitojb)
Changed in opencryptoki (Ubuntu Natty):
status: Fix Committed → Won't Fix
Changed in opencryptoki (Ubuntu Maverick):
status: Fix Committed → Won't Fix
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.