Build and run the provider on a Windows system

[snaper3]

I would like to build and run the provider on a Windows system.
Is Windows compatibility planned in the near future?

[simo5]

I will accept non-invasive patches to build on Windows but it is not a primary target for me at the moment.

[manison]

I maintain Windows/Visual Studio support in my fork of pkcs11-provider. This contains potentially invasive patches however.

[gowdamanil]

@manison

Thank you very much for your work.

[simo5]

Excluding the VS project files stuff that would not be appropriate (because I would not be able to keep up to date anyway), I think most other changes are reasonable.
The main issue I have is the VLA_DEF thing ... would have to think how to deal with VCC still not handling moder C ... sigh.

[mlt]

I'm trying to build it on Windows using msys2. It builds alright, however I'm getting SEGFAULT using it. Any insight?

$ PKCS11_PROVIDER_DEBUG=file:err.txt,level:2 openssl storeutl -keys -text pkcs11:
Segmentation fault

err.txt (Click me)

[../pkcs11-provider-0.5/src/provider.c:1438] OSSL_provider_init(): Provided config params:
[../pkcs11-provider-0.5/src/provider.c:1448] OSSL_provider_init():   pkcs11-module-path: libykcs11.dll
[../pkcs11-provider-0.5/src/provider.c:1448] OSSL_provider_init():   pkcs11-module-init-args: [none]
[../pkcs11-provider-0.5/src/provider.c:1448] OSSL_provider_init():   pkcs11-module-token-pin: [****]
[../pkcs11-provider-0.5/src/provider.c:1448] OSSL_provider_init():   pkcs11-module-allow-export: [none]
[../pkcs11-provider-0.5/src/provider.c:1448] OSSL_provider_init():   pkcs11-module-login-behavior: [none]
[../pkcs11-provider-0.5/src/provider.c:1448] OSSL_provider_init():   pkcs11-module-load-behavior: [none]
[../pkcs11-provider-0.5/src/provider.c:1448] OSSL_provider_init():   pkcs11-module-cache-pins: [none]
[../pkcs11-provider-0.5/src/provider.c:1448] OSSL_provider_init():   pkcs11-module-cache-keys: [none]
[../pkcs11-provider-0.5/src/provider.c:1448] OSSL_provider_init():   pkcs11-module-quirks: [none]
[../pkcs11-provider-0.5/src/provider.c:1448] OSSL_provider_init():   pkcs11-module-cache-sessions: [none]
[../pkcs11-provider-0.5/src/provider.c:1448] OSSL_provider_init():   pkcs11-module-encode-provider-uri-to-pem: [none]
[../pkcs11-provider-0.5/src/provider.c:1467] OSSL_provider_init(): PIN available
[../pkcs11-provider-0.5/src/provider.c:1481] OSSL_provider_init(): Export allowed
[../pkcs11-provider-0.5/src/provider.c:1500] OSSL_provider_init(): Login behavior: auto
[../pkcs11-provider-0.5/src/provider.c:1517] OSSL_provider_init(): PINs will not be cached
[../pkcs11-provider-0.5/src/provider.c:1534] OSSL_provider_init(): Key caching: in session object
[../pkcs11-provider-0.5/src/provider.c:1579] OSSL_provider_init(): No quirks
[../pkcs11-provider-0.5/src/provider.c:1598] OSSL_provider_init(): Cache Sessions: 5
[../pkcs11-provider-0.5/src/provider.c:1606] OSSL_provider_init(): PK11-URI will not be written instead of PrivateKeyInfo
[../pkcs11-provider-0.5/src/provider.c:1619] OSSL_provider_init(): Load behavior: default
[../pkcs11-provider-0.5/src/store.c:198] p11prov_store_open(): object open (000001bf4c182460, pkcs11:)
[../pkcs11-provider-0.5/src/interface.c:290] p11prov_module_init(): PKCS#11: Initializing the module: libykcs11.dll
[../pkcs11-provider-0.5/src/interface.c:100] populate_interface(): Populating Interfaces with 'PKCS 11', version 3.0
[../pkcs11-provider-0.5/src/interface.gen.c:16] p11prov_Initialize(): Calling C_Initialize

Stack trace

Thread 1 received signal SIGSEGV, Segmentation fault.
0x00007ff8c1b2edf1 in p11prov_Initialize (ctx=0x7b9970, pInitArgs=0x5ff840)
    at ../pkcs11-provider-0.5/src/interface.gen.c:18
18          ret = intf->Initialize(pInitArgs);
(gdb) bt
#0  0x00007ff8c1b2edf1 in p11prov_Initialize (ctx=0x7b9970, pInitArgs=0x5ff840)
    at ../pkcs11-provider-0.5/src/interface.gen.c:18
#1  0x00007ff8c1b34fb4 in p11prov_module_init (mctx=0x7dc470)
    at ../pkcs11-provider-0.5/src/interface.c:309
#2  0x00007ff8c1b41508 in p11prov_ctx_status (ctx=0x7b9970)
    at ../pkcs11-provider-0.5/src/provider.c:474
#3  0x00007ff8c1b5193f in p11prov_store_open (pctx=0x7b9970, uri=0x75b750 "pkcs11:")
    at ../pkcs11-provider-0.5/src/store.c:200
#4  0x00007ff8c2f7bd41 in ?? () from C:\msys64\ucrt64\bin\libcrypto-3-x64.dll
#5  0x00007ff7de5239ec in ?? ()
#6  0x00007ff7de52459c in ?? ()
#7  0x00007ff7de4ed348 in ?? ()
#8  0x00007ff7de5429ad in ?? ()
#9  0x00007ff7de4c12e9 in ?? ()
#10 0x00007ff7de4c13f6 in ?? ()
#11 0x00007ff9a9f253e0 in KERNEL32!BaseThreadInitThunk () from C:\Windows\System32\kernel32.dll
#12 0x00007ff9aad6485b in ntdll!RtlUserThreadStart () from C:\Windows\SYSTEM32\ntdll.dll
#13 0x0000000000000000 in ?? ()

openssl.cnf

HOME = .
openssl_conf = openssl_init
[openssl_init]
providers = provider_sect
[provider_sect]
default = default_sect
pkcs11 = pkcs11_sect
[default_sect]
activate = 1
[pkcs11_sect]
module = pkcs11.dll
# pkcs11-module-path = libykcs11.dll
pkcs11-module-token-pin = 123456
activate = 1

I tried explicit YubiKey module as well as implicit OpenSC proxied via p11-kit. Both work fine with libp11 engine.

[simo5]

I do not think we set the correct pragma and alignment compiler option for the pkcs11 headers for windows builds, so when trying to call into a pkcs11 module built for windows data structures are probably out of alignment and not packed and cause crashes.

See the comments in the Oasis header file: https://github.com/oasis-tcs/pkcs11/blob/master/published/3-01/pkcs11.h

That stuff (#pragma pack) need to be done before including our own pkcs11.h as well for windows builds...

[mlt]

It works! msys2/MINGW-packages#22621 and uses patched p11-kit
Here is the snippet for openssl.cnf

…
[pkcs11_sect]
pkcs11-module-quirks = no-deinit
module = pkcs11.dll
pkcs11-module-token-pin = 123456
activate = 1

[simo5]

If the patch you have works and is small feel free to contribute it so we get it fixed for all.