[PATCH] ssh-pkcs11: allow providing unconditional pin code for PKCS11

[Peter Stuge]

Juha-Matti Tapio wrote:
> +pkcs11_read_pinfile()
..
> +	if ((f = fopen(pinfilename, "r")) == NULL) {
> +		debug("failed to read SSH_PKCS11_PINFILE");
> +		return NULL;
> +	}
> +	if (fgets(buf, SSH_MAX_PKCS11_PIN_BYTES, f) == NULL)
> +		return NULL;

This leaks the open file on error.


> +	fclose(f);
> +
> +	/* truncate first line and ignore the rest */
> +	for (i = 0; buf[i] && i < SSH_MAX_PKCS11_PIN_BYTES; i++) {
> +		if (buf[i] == '\n' || buf[i] == '\r') {
> +			buf[i] = '\0';
> +			break;
> +		}
> +	}

Why not just a call to strtok() ?


> +	return xstrdup(buf);

Does this memory get freed somewhere?


I don't think this patch is ready yet, and I don't know if this
functionality is really desirable. Would it be an option to store the
pin itself in the environment? HSM seems a bit pointless if a PIN
must be stored in plain text on disk..


//Peter