<div dir="ltr"><br><div class="gmail_extra"><br><br><div class="gmail_quote">On Tue, Aug 12, 2014 at 5:32 AM, Stef Walter <span dir="ltr"><<a href="mailto:stefw@redhat.com" target="_blank">stefw@redhat.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div><div>On 12.08.2014 10:18, David Woodhouse wrote:<br>
> On Tue, 2014-08-12 at 09:38 +0200, Stef Walter wrote:<br>
>> On 12.08.2014 08:12, Watson Sato wrote:<br>
>>> Hi,<br>
>>><br>
>>> I'm a GSoC student and I'm developing a PKCS#11 module for Evolution.<br>
>>> I'm about to integrate it into Evolution, and planning to load it by<br>
>>> calling SECMOD_LoadUserModule().<br>
>>><br>
>>> Some people recommended me to take a look on other approaches, like Gck<br>
>>> and p11-kit.<br>
>>> For what I have tried and tested, with both approaches I managed to load<br>
>>> and initialize the modules. But the references to the modules remain in<br>
>>> the application, and I need NSS to be able to use the module.<br>
>>><br>
>>> Is there a way for an application to load a PKCS#11 module and make it<br>
>>> available to NSS with p11-kit?<br>
>><br>
>> Well, sorta ... You can use the p11-kit-proxy.so module. By using that<br>
>> all configured p11-kit modules become available to NSS.<br>
>><br>
>> But I think what you're trying to do SECMOD_LoadUserModule() is the<br>
>> perfect function to use. As I understand it, you're not trying to build<br>
>> a globally configured/installed module, but rather something specific to<br>
>> the running Evolution process. There's no need to involve p11-kit in the<br>
>> loading.<br>
><br>
> Yes and no.<br>
><br>
> In fact, this module is exposing X.509 certificates from Evolution<br>
> addressbooks. Yes, the *primary* use case is for Evolution itself, so<br>
> you can send S/MIME-encrypted mail to someone in your addressbook, and<br>
> you don't throw your computer out the window in frustration when it says<br>
> it has no certificate for them.... despite clearly showing the<br>
> appropriate X-CERT-X509 field when you look at their addressbook entry.<br>
<br>
</div></div>This is indeed a very good thing to fix.<br>
<div><br>
> But actually, there's no reason why the data in the same PKCS#11 module<br>
> shouldn't be made available to other crypto users in the general case...<br>
> which is where p11-kit comes in.<br>
<br>
</div>Perhaps, but you'll quickly get into the weeds here. It's all possible<br>
... but it's not that pretty.<br>
<br>
* You'll *definitely* want to use the 'isolate' functionality in<br>
p11-kit 0.21.x, since GLib (and by extension Camel, and whatever) is<br>
not unloadable and would crash when your PKCS#11 module is unloaded.<br></blockquote><div><br></div><div>This kind of explains the crashes while trying to unload the module, even when not using p11-kit.</div><div> </div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<br>
* Make sure to use a *enable-in* directive so random PKCS#11 aware<br>
applications (as in stuff using gnutls) don't try to load EDS just<br>
because they load your module. Whitelist the use of your module.<br>
<br>
* In order to use NSS with p11-kit you currently have to use<br>
p11-kit-proxy.so ... so loading your module is dependent on<br>
p11-kit configuration. You have no explicit control here from within<br>
evolution, although you can configure things appropriately at a<br>
distro level.<br>
<br>
* ... and I'm sure there's several more issues that will eventually<br>
make you cry. Solvable yes ... but painful.<br>
<br>
I think you're overcomplicating the actual real world use case above by<br>
dragging all this in. I would again suggest making it work with<br>
Evolution first, and then worrying about everything else in a later<br>
iteration.<span><font color="#888888"><br></font></span></blockquote></div><div class="gmail_extra"> <br></div>Thanks for all the answers.<br clear="all"><div>For now I'll try to do it without p11-kit, if needed it will be added later.<br>
</div><div><br></div>-- <br><div dir="ltr">Watson Yuuma Sato</div>
</div></div>