|
 |
17c662 |
diff --git a/lib/pkcs11.c b/lib/pkcs11.c
|
|
|
17c662 |
index 4fdd58f39..68ee2960a 100644
|
|
|
17c662 |
--- a/lib/pkcs11.c
|
|
|
17c662 |
+++ b/lib/pkcs11.c
|
|
|
17c662 |
@@ -2368,6 +2368,11 @@ retrieve_pin(struct pin_info_st *pin_info, struct p11_kit_uri *info,
|
|
|
17c662 |
/* First check for pin-value field */
|
|
|
17c662 |
pinfile = p11_kit_uri_get_pin_value(info);
|
|
|
17c662 |
if (pinfile != NULL) {
|
|
|
17c662 |
+ if (attempts > 0) {
|
|
|
17c662 |
+ _gnutls_debug_log("p11: refusing more than a single attempts with pin-value\n");
|
|
|
17c662 |
+ return gnutls_assert_val(GNUTLS_E_PKCS11_PIN_ERROR);
|
|
|
17c662 |
+ }
|
|
|
17c662 |
+
|
|
|
17c662 |
_gnutls_debug_log("p11: Using pin-value to retrieve PIN\n");
|
|
|
17c662 |
*pin = p11_kit_pin_new_for_string(pinfile);
|
|
|
17c662 |
if (*pin != NULL)
|
|
|
17c662 |
@@ -2376,6 +2381,11 @@ retrieve_pin(struct pin_info_st *pin_info, struct p11_kit_uri *info,
|
|
|
17c662 |
/* Check if a pinfile is specified, and use that if possible */
|
|
|
17c662 |
pinfile = p11_kit_uri_get_pin_source(info);
|
|
|
17c662 |
if (pinfile != NULL) {
|
|
|
17c662 |
+ if (attempts > 0) {
|
|
|
17c662 |
+ _gnutls_debug_log("p11: refusing more than a single attempts with pin-source\n");
|
|
|
17c662 |
+ return gnutls_assert_val(GNUTLS_E_PKCS11_PIN_ERROR);
|
|
|
17c662 |
+ }
|
|
|
17c662 |
+
|
|
|
17c662 |
_gnutls_debug_log("p11: Using pin-source to retrieve PIN\n");
|
|
|
17c662 |
ret =
|
|
|
17c662 |
retrieve_pin_from_source(pinfile, token_info, attempts,
|
|
|
17c662 |
diff --git a/tests/pkcs11/pkcs11-import-with-pin.c b/tests/pkcs11/pkcs11-import-with-pin.c
|
|
|
17c662 |
index e43591927..ecc98175d 100644
|
|
|
17c662 |
--- a/tests/pkcs11/pkcs11-import-with-pin.c
|
|
|
17c662 |
+++ b/tests/pkcs11/pkcs11-import-with-pin.c
|
|
|
17c662 |
@@ -157,6 +157,16 @@ void doit()
|
|
|
17c662 |
assert(gnutls_privkey_init(&pkey) == 0);
|
|
|
17c662 |
|
|
|
17c662 |
/* Test 1
|
|
|
17c662 |
+ * Try importing with wrong pin-value */
|
|
|
17c662 |
+ ret = gnutls_privkey_import_pkcs11_url(pkey, SOFTHSM_URL";object=cert;object-type=private;pin-value=XXXX");
|
|
|
17c662 |
+ if (ret != GNUTLS_E_PKCS11_PIN_ERROR) {
|
|
|
17c662 |
+ fprintf(stderr, "unexpected error in %d: %s\n", __LINE__, gnutls_strerror(ret));
|
|
|
17c662 |
+ exit(1);
|
|
|
17c662 |
+ }
|
|
|
17c662 |
+ gnutls_privkey_deinit(pkey);
|
|
|
17c662 |
+ assert(gnutls_privkey_init(&pkey) == 0);
|
|
|
17c662 |
+
|
|
|
17c662 |
+ /* Test 2
|
|
|
17c662 |
* Try importing with pin-value */
|
|
|
17c662 |
ret = gnutls_privkey_import_pkcs11_url(pkey, SOFTHSM_URL";object=cert;object-type=private;pin-value="PIN);
|
|
|
17c662 |
if (ret < 0) {
|
|
|
17c662 |
@@ -169,13 +179,26 @@ void doit()
|
|
|
17c662 |
gnutls_free(sig.data);
|
|
|
17c662 |
gnutls_privkey_deinit(pkey);
|
|
|
17c662 |
|
|
|
17c662 |
- /* Test 2
|
|
|
17c662 |
- * Try importing with pin-source */
|
|
|
17c662 |
+ /* Test 3
|
|
|
17c662 |
+ * Try importing with wrong pin-source */
|
|
|
17c662 |
track_temp_files();
|
|
|
17c662 |
get_tmpname(file);
|
|
|
17c662 |
|
|
|
17c662 |
- write_pin(file, PIN);
|
|
|
17c662 |
+ write_pin(file, "XXXX");
|
|
|
17c662 |
+
|
|
|
17c662 |
+ assert(gnutls_privkey_init(&pkey) == 0);
|
|
|
17c662 |
+ snprintf(buf, sizeof(buf), "%s;object=cert;object-type=private;pin-source=%s", SOFTHSM_URL, file);
|
|
|
17c662 |
+ ret = gnutls_privkey_import_pkcs11_url(pkey, buf);
|
|
|
17c662 |
+ if (ret != GNUTLS_E_PKCS11_PIN_ERROR) {
|
|
|
17c662 |
+ fprintf(stderr, "error in %d: %s\n", __LINE__, gnutls_strerror(ret));
|
|
|
17c662 |
+ exit(1);
|
|
|
17c662 |
+ }
|
|
|
17c662 |
+
|
|
|
17c662 |
+ gnutls_privkey_deinit(pkey);
|
|
|
17c662 |
|
|
|
17c662 |
+ /* Test 4
|
|
|
17c662 |
+ * Try importing with pin-source */
|
|
|
17c662 |
+ write_pin(file, PIN);
|
|
|
17c662 |
|
|
|
17c662 |
assert(gnutls_privkey_init(&pkey) == 0);
|
|
|
17c662 |
snprintf(buf, sizeof(buf), "%s;object=cert;object-type=private;pin-source=%s", SOFTHSM_URL, file);
|
|
|
17c662 |
--
|
|
|
17c662 |
2.14.3
|
|
|
17c662 |
|