get_objects() issue about python-pkcs11 HOT 10 CLOSED

Actually it seems that get_objects(), when specifying label and class, will return an iterator containing multiple entries for the same key. For the same reason, using get_key() raises MultipleObjectsReturned.

from python-pkcs11.

This is a strange one. get_objects is a fairly thin wrapper around C_FindObjects. What PKCS#11 library are you using?

If you call get_objects with no filters, what do you get? Does this match pkcs11-tool --list-objects?

Are you using any multi-threading? python-pkcs11 includes locking to prevent using the same Python session twice, but it trusts the PKCS#11 library to keep sessions separate and thread-safe on its side. It doesn't link PKCS#11 to Python's threading semantics, as this doesn't seem widely supported, but due to the GIL nearly all calls from Python into C are defacto threadsafe.

from python-pkcs11.

• get_objects() returns all keys
• get_objects() with Attribute.CLASS: ObjectClass.PUBLIC_KEY/PRIVATE_KEY works fine
• get_objects() with Attribute.KEY_TYPE: KeyType.EC and/or Attribute.LABEL: 'LABEL' works fine

Somehow get_objects() with the combination of Attribute.CLASS: ObjectClass.PUBLIC_KEY/PRIVATE_KEY and Attribute.LABEL: 'LABEL' keeps returning the same key with the generator never ending (need to kill it to stop). Surely must be an issue with the pkcs11 provider (I'm using an HSM provider's custom/private pkcs11 library).

No threading involved.

I tried using pkcs11-tool but it doesn't seem to be included with the pkcs11 distribution. Is it only through OpenSC I can get it now?

from python-pkcs11.

It's maintained by OpenSC yes. There's another one, p11tool if you have that.

You could try adding KEY_TYPE and OBJECT_CLASS together? You could also limit it down to some small list and filter manually :-/

It's not unusual for vendor PKCS#11 libraries to have bugs. Which vendor is it? Many vendors expose environment variables to help debug what's going on.

from python-pkcs11.

Yeah I was doing that before. Now I supply the LABEL as well to avoid filtering. It's not really a problem since the generator returns the key I want, though it returns it 325 times instead of one, and I can just get the first item and proceed. It's just weird because instead of returning it once it returns it that many times and makes get_key() unavailable due to MultipleObjectsReturned. Vendor is securosys. I guess I'll try ping them as well. Thanks!

from python-pkcs11.

You could also next() on the generator and ignore the fact there's more data.

from python-pkcs11.

Yep 😀

from python-pkcs11.

Did we conclude whether this error is in the PKCS#11 lib or python-pkcs#11?

from python-pkcs11.

I've been told it's an issue with the library for EC keys only. Still waiting to learn the exact reason.

from python-pkcs11.

Okay thanks. Closing as a vendor bug.

from python-pkcs11.