Normalize logging of OpenSSL errors #2922

xhanulik · 2023-11-01T09:15:20Z

This pull request enhances and unifies the logging of OpenSSL errors throughout the OpenSC codebase. The newly introduced sc_log_openssl() function internally utilizes OpenSSL's ERR_print_errors_cb() to log and clear the error queue.

Most of the error handling code in libopensc/, sm/, pkcs15init/ and tools (where sc_context_t is accessible) is adjusted to incorporate the logging. Additionally, some error handling code has been added in places where it was previously missing.

Checklist

PKCS#11 module is tested
Windows minidriver is tested
macOS tokend is tested

src/libopensc/card-entersafe.c

src/libopensc/log.c

src/pkcs11/openssl.c

src/pkcs15init/pkcs15-lib.c

src/tools/cryptoflex-tool.c

src/pkcs15init/pkcs15-lib.c

src/libopensc/padding.c

src/libopensc/pkcs15-oberthur.c

frankmorgner

Thanks for also having a look at the OpenSSL related error handling. The code looks good, I found only some minor issues.

I think it would be useful to additionally have a dedicated debug level for OpenSC dependencies, e.g.

diff --git a/src/libopensc/log.c b/src/libopensc/log.c
index cee59bcd9..2764efd83 100644
--- a/src/libopensc/log.c
+++ b/src/libopensc/log.c
@@ -197,7 +197,7 @@ void _sc_log(struct sc_context *ctx, const char *format, ...)
 
 void _sc_log_openssl(struct sc_context *ctx)
 {
-       sc_do_log_openssl(ctx, SC_LOG_DEBUG_NORMAL, NULL, 0, NULL);
+       sc_do_log_openssl(ctx, SC_LOG_DEBUG_DEPS, NULL, 0, NULL);
 }
 
 static int is_a_tty(FILE *fp)
diff --git a/src/libopensc/log.h b/src/libopensc/log.h
index 8179faa6c..97082e0d4 100644
--- a/src/libopensc/log.h
+++ b/src/libopensc/log.h
@@ -37,6 +37,8 @@ enum {
        SC_LOG_DEBUG_SM,                /* secure messaging */
        SC_LOG_DEBUG_ASN1,              /* asn1.c */
        SC_LOG_DEBUG_MATCH,             /* card matching */
+       SC_LOG_DEBUG_DEPS,              /* debugging of dependencies, e.g. OpenSSL */
+       SC_LOG_DEBUG_RFU3,              /* RFU */
        SC_LOG_DEBUG_PIN,               /* PIN commands */
 };

src/libopensc/log.h

src/libopensc/log.c

src/libopensc/pkcs15-prkey.c

src/libopensc/card-authentic.c

src/libopensc/card-entersafe.c

src/libopensc/card-epass2003.c

src/tools/netkey-tool.c

src/tools/piv-tool.c

src/tools/pkcs15-init.c

src/libopensc/log.h

src/libopensc/pkcs15-oberthur.c

Jakuje

two last nits and I think we are good to go.

src/libopensc/card-entersafe.c

src/tools/piv-tool.c

xhanulik · 2024-03-20T14:51:47Z

By now, all review comments should be fixed, just cleaned the commits.

frankmorgner · 2024-03-20T22:23:43Z

Thank you.

New in 0.26.1; 2025-01-14 General improvements Align allocations of sc_mem_secure_alloc (OpenSC/OpenSC#3281) Fix -O3 gcc optimization failure on amd64 and ppc64el (OpenSC/OpenSC#3299) pkcs11-spy Avoid crash while spying C_GetInterface() (OpenSC/OpenSC#3275) TCOS Fix reading certificate (OpenSC/OpenSC#3296) New in 0.26.0; 2024-11-13 Security CVE-2024-45615: Usage of uninitialized values in libopensc and pkcs15init (OpenSC/OpenSC#3225) CVE-2024-45616: Uninitialized values after incorrect check or usage of APDU response values in libopensc (OpenSC/OpenSC#3225) CVE-2024-45617: Uninitialized values after incorrect or missing checking return values of functions in libopensc (OpenSC/OpenSC#3225) CVE-2024-45618: Uninitialized values after incorrect or missing checking return values of functions in pkcs15init (OpenSC/OpenSC#3225) CVE-2024-45619: Incorrect handling length of buffers or files in libopensc (OpenSC/OpenSC#3225) CVE-2024-45620: Incorrect handling of the length of buffers or files in pkcs15init (OpenSC/OpenSC#3225) CVE-2024-8443: Heap buffer overflow in OpenPGP driver when generating key (OpenSC/OpenSC#3219) General improvements Fix reselection of DF after error in PKCSOpenSC/OpenSC#15 layer (OpenSC/OpenSC#3067) Unify OpenSSL logging throughout code (OpenSC/OpenSC#2922) Extend the p11test to support kryoptic (OpenSC/OpenSC#3141) Fix for error in PCSC reconnection (OpenSC/OpenSC#3150) Fixed various issues reported by OSS-Fuzz and Coverity in drivers, PKCS#11 and PKCS#15 layer PKCS#15 Documentation for PKCS#15 profile files (OpenSC/OpenSC#3132) minidriver Support PinCacheAlwaysPrompt usable for PIV cards (OpenSC/OpenSC#3167) pkcs11-tool Show URI when listing token information (OpenSC/OpenSC#3125) and objects (OpenSC/OpenSC#3130) Do not limit size of objects to 5000 bytes (OpenSC/OpenSC#3174) Add support for AES CMAC (OpenSC/OpenSC#3184) Add support for AES GCM encryption (OpenSC/OpenSC#3195) Add support for RSA OAEP encryption (OpenSC/OpenSC#3175) Add support for HKDF (OpenSC/OpenSC#3193) Implement better support for wrapping and unwrapping (OpenSC/OpenSC#3198) Add support for EdDSA sign and verify (OpenSC/OpenSC#2979) pkcs15-crypt Fix PKCS#1 encoding function to correctly detect padding type (OpenSC/OpenSC#3075) piv-tool Fix RSA key generation (OpenSC/OpenSC#3158) Avoid possible state change when matching unknown card (OpenSC/OpenSC#3112) sc-hsm-tool Cleanse buffer with plaintext key share (OpenSC/OpenSC#3226) pkcs11-register Fix pkcs11-register defaults on macOS and Windows (OpenSC/OpenSC#3053) IDPrime Fix identification of IDPrime 840 cards (OpenSC/OpenSC#3146) Fix container mapping for IDPrime 940 cards (OpenSC/OpenSC#3220) Reorder ATRs for matching cards (OpenSC/OpenSC#3154) OpenPGP Fix state tracking after erasing card (OpenSC/OpenSC#3024) Belpic Disable Applet V1.8 (OpenSC/OpenSC#3109) MICARDO Deactivate driver (OpenSC/OpenSC#3152) SmartCard-HSM Fix signing with secp521r1 signature (OpenSC/OpenSC#3157) eOI Set model via sc_card_ctl function (OpenSC/OpenSC#3189) Rutoken increase the minimum PIN size to support Rutoken ECP BIO (OpenSC/OpenSC#3208) JPKI Adjust parameters for public key in PKCS#15 emulator (OpenSC/OpenSC#3182) D-Trust Add support for ECDSA signatures and ECDH key agreement for D-Trust Signatures Cards 4.1/4.4 (OpenSC/OpenSC#3240, OpenSC/OpenSC#openwrt#3248) Signed-off-by: Daniel Golle <[email protected]>

New in 0.26.1; 2025-01-14 General improvements Align allocations of sc_mem_secure_alloc (OpenSC/OpenSC#3281) Fix -O3 gcc optimization failure on amd64 and ppc64el (OpenSC/OpenSC#3299) pkcs11-spy Avoid crash while spying C_GetInterface() (OpenSC/OpenSC#3275) TCOS Fix reading certificate (OpenSC/OpenSC#3296) New in 0.26.0; 2024-11-13 Security CVE-2024-45615: Usage of uninitialized values in libopensc and pkcs15init (OpenSC/OpenSC#3225) CVE-2024-45616: Uninitialized values after incorrect check or usage of APDU response values in libopensc (OpenSC/OpenSC#3225) CVE-2024-45617: Uninitialized values after incorrect or missing checking return values of functions in libopensc (OpenSC/OpenSC#3225) CVE-2024-45618: Uninitialized values after incorrect or missing checking return values of functions in pkcs15init (OpenSC/OpenSC#3225) CVE-2024-45619: Incorrect handling length of buffers or files in libopensc (OpenSC/OpenSC#3225) CVE-2024-45620: Incorrect handling of the length of buffers or files in pkcs15init (OpenSC/OpenSC#3225) CVE-2024-8443: Heap buffer overflow in OpenPGP driver when generating key (OpenSC/OpenSC#3219) General improvements Fix reselection of DF after error in PKCSOpenSC/OpenSC#15 layer (OpenSC/OpenSC#3067) Unify OpenSSL logging throughout code (OpenSC/OpenSC#2922) Extend the p11test to support kryoptic (OpenSC/OpenSC#3141) Fix for error in PCSC reconnection (OpenSC/OpenSC#3150) Fixed various issues reported by OSS-Fuzz and Coverity in drivers, PKCS#11 and PKCS#15 layer PKCS#15 Documentation for PKCS#15 profile files (OpenSC/OpenSC#3132) minidriver Support PinCacheAlwaysPrompt usable for PIV cards (OpenSC/OpenSC#3167) pkcs11-tool Show URI when listing token information (OpenSC/OpenSC#3125) and objects (OpenSC/OpenSC#3130) Do not limit size of objects to 5000 bytes (OpenSC/OpenSC#3174) Add support for AES CMAC (OpenSC/OpenSC#3184) Add support for AES GCM encryption (OpenSC/OpenSC#3195) Add support for RSA OAEP encryption (OpenSC/OpenSC#3175) Add support for HKDF (OpenSC/OpenSC#3193) Implement better support for wrapping and unwrapping (OpenSC/OpenSC#3198) Add support for EdDSA sign and verify (OpenSC/OpenSC#2979) pkcs15-crypt Fix PKCS#1 encoding function to correctly detect padding type (OpenSC/OpenSC#3075) piv-tool Fix RSA key generation (OpenSC/OpenSC#3158) Avoid possible state change when matching unknown card (OpenSC/OpenSC#3112) sc-hsm-tool Cleanse buffer with plaintext key share (OpenSC/OpenSC#3226) pkcs11-register Fix pkcs11-register defaults on macOS and Windows (OpenSC/OpenSC#3053) IDPrime Fix identification of IDPrime 840 cards (OpenSC/OpenSC#3146) Fix container mapping for IDPrime 940 cards (OpenSC/OpenSC#3220) Reorder ATRs for matching cards (OpenSC/OpenSC#3154) OpenPGP Fix state tracking after erasing card (OpenSC/OpenSC#3024) Belpic Disable Applet V1.8 (OpenSC/OpenSC#3109) MICARDO Deactivate driver (OpenSC/OpenSC#3152) SmartCard-HSM Fix signing with secp521r1 signature (OpenSC/OpenSC#3157) eOI Set model via sc_card_ctl function (OpenSC/OpenSC#3189) Rutoken increase the minimum PIN size to support Rutoken ECP BIO (OpenSC/OpenSC#3208) JPKI Adjust parameters for public key in PKCS#15 emulator (OpenSC/OpenSC#3182) D-Trust Add support for ECDSA signatures and ECDH key agreement for D-Trust Signatures Cards 4.1/4.4 (OpenSC/OpenSC#3240, OpenSC/OpenSC##3248) Signed-off-by: Daniel Golle <[email protected]>

xhanulik force-pushed the openssl-log branch 2 times, most recently from f488c01 to eb9cced Compare November 1, 2023 14:12

Jakuje reviewed Nov 2, 2023

View reviewed changes

frankmorgner mentioned this pull request Jan 26, 2024

OpenSC's use of OpenSSL ERR_print_errors_fp #2701

Closed

xhanulik force-pushed the openssl-log branch 5 times, most recently from cc8d905 to b1af38a Compare February 7, 2024 08:26

xhanulik marked this pull request as ready for review February 7, 2024 08:30

xhanulik requested a review from Jakuje February 7, 2024 08:31

Jakuje reviewed Feb 7, 2024

View reviewed changes

src/tools/cryptoflex-tool.c Outdated Show resolved Hide resolved

src/pkcs15init/pkcs15-lib.c Outdated Show resolved Hide resolved

src/libopensc/padding.c Outdated Show resolved Hide resolved

src/libopensc/pkcs15-oberthur.c Outdated Show resolved Hide resolved

xhanulik force-pushed the openssl-log branch from b1af38a to 025ae2c Compare February 7, 2024 10:33

frankmorgner requested changes Mar 11, 2024

View reviewed changes

src/libopensc/log.h Outdated Show resolved Hide resolved

src/libopensc/log.c Outdated Show resolved Hide resolved

src/libopensc/pkcs15-prkey.c Outdated Show resolved Hide resolved

xhanulik force-pushed the openssl-log branch 4 times, most recently from b0f5979 to a5e0c30 Compare March 13, 2024 10:27

Jakuje reviewed Mar 18, 2024

View reviewed changes

xhanulik added 4 commits March 19, 2024 11:47

Add OpenSSL logging function

e71b050

card-piv: Rewrite OpenSSL logging

897e151

card-authentic: Remove unneeded openssl headers

c32e6ee

card-coolkey: Remove unneeded openssl headers

740e3c3

xhanulik force-pushed the openssl-log branch from 1efa02d to 1890209 Compare March 19, 2024 10:48

Jakuje approved these changes Mar 19, 2024

View reviewed changes

src/libopensc/card-entersafe.c Outdated Show resolved Hide resolved

src/tools/piv-tool.c Outdated Show resolved Hide resolved

xhanulik added 5 commits March 20, 2024 11:24

cwa-dnie, cwa14980: Update OpenSSL error logging

6bf605a

card-entersafe: Update OpenSSL error logging

602e19e

card-entersafe: Reformat code

df5f9e2

sm-eac: Update OpenSSL error logging

8b00f7a

card-eoi: Update OpenSSL logging

870ad75

xhanulik added 18 commits March 20, 2024 15:38

pkcs15-authentic: Remove unneeded openssl headers

2e8c6aa

pkcs15-iasecc: Remove unneeded openssl headers

8321ba3

pkcs15-lib: Add openssl error checking

bd1f724

pkcs15-oberthut-awp: Update OpenSSL logging

c88d247

sm-common: Update OpenSSL logging

b9ec918

sm-eac: Update OpenSSL logging

9f057ef

npa-tool: Update OpenSSL logging

96bec4f

Remove sslutil.h

b1193b4

cards-tool: Update OpenSSL logging

ccb91ba

cryptoflex-tool: Update OpenSSL logging

38b3374

netkey-tool: Update OpenSSL logging

d1a1180

piv-tool: Update OpenSSL logging

8dd1ae3

pkcs15-crypt: Remove unneeded openssl headers

5367917

pkcs15-init: Update OpenSSL logging

25c65ae

sc-hsm-tool: Update OpenSSL logging

7227b42

piv-tool: Reformat code

6fee632

card-gids: Reformat code

69a18b8

npa-tool: Ordering of header files

4e0f42e

Jakuje approved these changes Mar 20, 2024

View reviewed changes

xhanulik force-pushed the openssl-log branch from 57806e7 to 4e0f42e Compare March 20, 2024 14:50

frankmorgner merged commit d1d0aed into OpenSC:master Mar 20, 2024

xhanulik deleted the openssl-log branch July 19, 2024 16:40

xhanulik mentioned this pull request Aug 29, 2024

Towards new release 0.26.0 #3223

Closed

kgodara912 mentioned this pull request Jun 16, 2025

[AUTOPATCHER-CORE] Upgrade opensc to 0.26.1 for fixing multiple CVEs microsoft/azurelinux#13981

Merged

Normalize logging of OpenSSL errors #2922

Normalize logging of OpenSSL errors #2922

Uh oh!

Conversation

xhanulik commented Nov 1, 2023

Checklist

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

frankmorgner left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Jakuje left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

xhanulik commented Mar 20, 2024

Uh oh!

frankmorgner commented Mar 20, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants