Hi, I'm seeking some advice on the following issue: I got a smart card (Nitrokey Pro 2) which I want to use in conjunction with OpenVPN to authorize the client side. If I fire up the openvpn client side, I get ask for the PIN, verification is successful, and openvpn goes on till it hits: [code] Mon Mar 18 08:45:02 2019 us=442991 /sbin/ifconfig tun0 X.X.X.X X.X.X.X mtu 1500 netmask 255.255.255.255 up Mon Mar 18 08:45:02 2019 us=445727 PKCS#11: __pkcs11h_forkFixup entry pid=15139, activate_slotevent=1 [/code] and it freezes right there forever (or at least for 24 hours till I killed it). So I already did some research on the topic and it seems like the pkcs11-helper library is quite a controversial issue. It seems that there have been various issues over the past years all tight to pkcs11-helper and these have all in common that a fork happened: OpenSC Issue 159 [url]https://github.com/OpenSC/OpenSC/issues/159[/url] Red Hat Bugzilla – Bug 1432152[url]https://bugzilla.redhat.com/show_bug.cgi?id=1432152[/url] OpenVPN - Bug 538 [url]https://community.openvpn.net/openvpn/ticket/538[/url] OpenVPN - PKCS11 [url]https://forums.openvpn.net/viewtopic.php?t=23318[/url] (BTW: I already tried this, unfortunately it's not helping) GnuTLS quote: [quote] Note that, PKCS #11 modules behave in a peculiar way after a fork; they require a reinitialization of all the used PKCS #11 resources. While GnuTLS automates that process, there are corner cases where it is not possible to handle it correctly in an automated way11. For that, it is recommended not to mix fork() and PKCS #11 module usage. It is recommended to initialize and use any PKCS #11 resources in a single process. [/quote] GnuTLS Manual [url]https://www.gnutls.org/manual/html_node/PKCS11-Initialization.html[/url] So did someone experienced the same and got a workaround on this ? Any advice would be appreciated, thank you for considering my post. Regards, tanis Following some maybe helpful information: All commands are performed as root to avoid any permission issues. packages: pkcs11-helper-1.25.1 openvpn-v2.4.7 [code] # openvpn --version OpenVPN 2.4.7 x86_64-unknown-freebsd11.2 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [MH/RECVDA] [AEAD] built on Mar 18 2019 library versions: OpenSSL 1.0.2r 26 Feb 2019, LZO 2.10 Originally developed by James Yonan Copyright (C) 2002-2018 OpenVPN Inc Compile time defines: enable_async_push=no enable_comp_stub=no enable_crypto=yes enable_crypto_ofb_cfb=yes enable_debug=yes enable_def_auth=yes enable_dlopen=unknown enable_dlopen_self=unknown enable_dlopen_self_static=unknown enable_fast_install=needless enable_fragment=yes enable_iproute2=no enable_libtool_lock=yes enable_lz4=yes enable_lzo=yes enable_management=yes enable_multihome=yes enable_pam_dlopen=no enable_pedantic=no enable_pf=yes enable_pkcs11=yes enable_plugin_auth_pam=yes enable_plugin_down_root=yes enable_plugins=yes enable_port_share=yes enable_selinux=no enable_server=yes enable_shared=yes enable_shared_with_static_runtimes=no enable_small=no enable_static=yes enable_strict=no enable_strict_options=no enable_systemd=no enable_werror=no enable_win32_dll=yes enable_x509_alt_username=no with_aix_soname=aix with_crypto_library=openssl with_gnu_ld=yes with_mem_check=no with_sysroot=no [/code] [code] FreeBSD hostname 11.2-RELEASE-p9 FreeBSD 11.2-RELEASE-p9 #0: Tue Feb 5 15:30:36 UTC 2019 root@amd64-builder.daemonology.net:/usr/obj/usr/src/sys/GENERIC amd64 [/code]

subject: PKCS#11: __pkcs11h_forkFixup freeze

tanis

Hi,

I'm seeking some advice on the following issue:

I got a smart card (Nitrokey Pro 2) which I want to use in conjunction with OpenVPN to authorize the client side.
If I fire up the openvpn client side, I get ask for the PIN, verification is successful, and openvpn goes on till it hits:

Mon Mar 18 08:45:02 2019 us=442991 /sbin/ifconfig tun0 X.X.X.X X.X.X.X mtu 1500 netmask 255.255.255.255 up
Mon Mar 18 08:45:02 2019 us=445727 PKCS#11: __pkcs11h_forkFixup entry pid=15139, activate_slotevent=1

and it freezes right there forever (or at least for 24 hours till I killed it).

So I already did some research on the topic and it seems like the pkcs11-helper library is quite a controversial issue. It seems that there have been various issues over the past years all tight to pkcs11-helper and these have all in common that a fork happened:

OpenSC Issue 159 https://github.com/OpenSC/OpenSC/issues/159
Red Hat Bugzilla – Bug 1432152https://bugzilla.redhat.com/show_bug.cgi?id=1432152
OpenVPN - Bug 538 https://community.openvpn.net/openvpn/ticket/538
OpenVPN - PKCS11 https://forums.openvpn.net/viewtopic.php?t=23318 (BTW: I already tried this, unfortunately it's not helping)

GnuTLS quote:

Note that, PKCS #11 modules behave in a peculiar way after a fork; they require a reinitialization of all the used PKCS #11 resources. While GnuTLS automates that process, there are corner cases where it is not possible to handle it correctly in an automated way11. For that, it is recommended not to mix fork() and PKCS #11 module usage. It is recommended to initialize and use any PKCS #11 resources in a single process.

GnuTLS Manual https://www.gnutls.org/manual/html_node/PKCS11-Initialization.html

So did someone experienced the same and got a workaround on this ?

Any advice would be appreciated, thank you for considering my post.

Regards,
tanis

Following some maybe helpful information:

All commands are performed as root to avoid any permission issues.

packages:
pkcs11-helper-1.25.1
openvpn-v2.4.7

# openvpn --version
OpenVPN 2.4.7 x86_64-unknown-freebsd11.2 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [MH/RECVDA] [AEAD] built on Mar 18 2019
library versions: OpenSSL 1.0.2r  26 Feb 2019, LZO 2.10
Originally developed by James Yonan
Copyright (C) 2002-2018 OpenVPN Inc 
Compile time defines: enable_async_push=no enable_comp_stub=no enable_crypto=yes enable_crypto_ofb_cfb=yes enable_debug=yes enable_def_auth=yes enable_dlopen=unknown enable_dlopen_self=unknown enable_dlopen_self_static=unknown enable_fast_install=needless enable_fragment=yes enable_iproute2=no enable_libtool_lock=yes enable_lz4=yes enable_lzo=yes enable_management=yes enable_multihome=yes enable_pam_dlopen=no enable_pedantic=no enable_pf=yes enable_pkcs11=yes enable_plugin_auth_pam=yes enable_plugin_down_root=yes enable_plugins=yes enable_port_share=yes enable_selinux=no enable_server=yes enable_shared=yes enable_shared_with_static_runtimes=no enable_small=no enable_static=yes enable_strict=no enable_strict_options=no enable_systemd=no enable_werror=no enable_win32_dll=yes enable_x509_alt_username=no with_aix_soname=aix with_crypto_library=openssl with_gnu_ld=yes with_mem_check=no with_sysroot=no

FreeBSD hostname 11.2-RELEASE-p9 FreeBSD 11.2-RELEASE-p9 #0: Tue Feb  5 15:30:36 UTC 2019     root@amd64-builder.daemonology.net:/usr/obj/usr/src/sys/GENERIC  amd64

TinCanTech

tanis wrote I already did some research on the topic and it seems like the pkcs11-helper library is quite a controversial issue

All I can tell you is that pkcs11-helper is old and poorly maintained .. openvpn have been considering alternatives but nothing has been agreed upon or planned.

At this time, if your card does not work then you cannot use it with openvpn.

The only card I know which ought to work is Ubikey because a developer specifically provided patches for it.
There are others that work but there is no documentation as to what those cards are .. sorry.

Try the dev mailing list to ask for some better information. (or IRC freenode #openvpn-devel)

tanis

Thank you for the advice, I'll try the developer mailing list.