1110233 - Firefox does not consistently work with CKF_PROTECTED_AUTHENTICATION_PATH

Status: RESOLVED INVALID

(Firefox :: Untriaged, defect)

Description

[David Woodhouse]

Attachment: PKCS#11 operation log from failing attempt

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:34.0) Gecko/20100101 Firefox/34.0
Build ID: 20141201111728

Steps to reproduce:

Configure firefox to use GNOME keyring's PKCs#11 module. Repeatedly start browser pointed at a site which asks for a certificate.


Actual results:

Each time I'm asked for a certificate and choose the one in GNOME keyring. Sometimes it works, and other times I get an error that the PKCS#11 token is not logged in.


Expected results:

It should work every time.

Comment 1

[David Woodhouse]

The interesting part of the log is here:

C_OpenSession
  IN: slotID = SL18
  IN: flags = 4 = CKF_SERIAL_SESSION
  IN: pApplication = 0x7FC996646800
  IN: Notify = 0x7FC9B29F5360
 OUT: phSession = 0x7FC9A91FE940 = S3003
C_OpenSession = CKR_OK
C_SignInit
  IN: hSession = S3003
  IN: pMechanism = {
	mechanism: CKM_RSA_PKCS
	pParameter: (0) NULL
      }
  IN: hKey = H319
C_SignInit = CKR_USER_NOT_LOGGED_IN

Comment 2

[David Woodhouse]

Not quite sure what's going on here. Other times we *can* use C_SignInit() right after opening a new session...

C_OpenSession
  IN: slotID = SL18
  IN: flags = 4 = CKF_SERIAL_SESSION
  IN: pApplication = 0x7FC996646800
  IN: Notify = 0x7FC9B29F5360
 OUT: phSession = 0x7FC9A91FE940 = S3001
C_OpenSession = CKR_OK
C_SignInit
  IN: hSession = S3001
  IN: pMechanism = {
        mechanism: CKM_RSA_PKCS
        pParameter: (0) NULL
      }
  IN: hKey = H319
C_SignInit = CKR_OK


This might possibly be misbehaviour of the gnome-keyring module. I've filed a bug in Red Hat bugzilla to hopefully get some clarification: https://bugzilla.redhat.com/show_bug.cgi?id=1173279

Comment 3

[David Woodhouse]

After further investigation I'm fairly sure this is a bug in the gnome-keyring-pkcs11.so module itself, not coping with concurrent access (legally to different sessions) from different threads in Firefox.