C_Initialize could return CKR_USER_PIN_NOT_INITIALIZED

[Jakuje]

There sounds some intermittent issue where kryoptic can return CKR_USER_PIN_NOT_INITIALIZED from C_Initialize() which we hit in #341:

---- cryptoki/src/context/session_management.rs - context::session_management::Pkcs11::open_ro_session (line 47) stdout ----
Test executable failed (exit status: 101).

stderr:

thread 'main' (4188) panicked at cryptoki/src/context/session_management.rs:14:1:
error: cryptoki::error::Error - Function::Initialize: PKCS11 error: This value can only be returned by C_Login.  It indicates that the normal user’s PIN has not yet been initialized with C_InitPIN.
stack backtrace:
   0: __rustc::rust_begin_unwind
             at /builddir/build/BUILD/rust-1.92.0-build/rustc-1.92.0-src/library/std/src/panicking.rs:698:5
   1: core::panicking::panic_fmt
             at /builddir/build/BUILD/rust-1.92.0-build/rustc-1.92.0-src/library/core/src/panicking.rs:80:14
   2: <testresult::TestError as core::convert::From<T>>::from
   3: <core::result::Result<T,F> as core::ops::try_trait::FromResidual<core::result::Result<core::convert::Infallible,E>>>::from_residual
   4: rust_out::main
   5: core::ops::function::FnOnce::call_once

This is not from the testsuite, but from the docstring example code so I am not completely sure on which context it runs, but it should not be sufficiently different from how other tests are executed.

[simo5]

Sounds like a race condition in the rust-cryptoki CI ?
Can you point me to the test that causes this ?

[Jakuje]

Sounds like a race condition in the rust-cryptoki CI ? Can you point me to the test that causes this ?

This should be the one:

https://github.com/parallaxsecond/rust-cryptoki/actions/runs/20783892465/job/59687990540

[Jakuje]

I was posting the test to the cryptoki PR:

https://github.com/keldonin/rust-cryptoki/blob/accelerate_fetching_attributes_clean/cryptoki/src/context/session_management.rs#L49

[simo5]

I don't think this is a kryoptic issue, this error is returned only when the database is not properly initialized ...

[simo5]

Well I guess we could translate it to another error, is that the ask?

[Jakuje]

I don't think this is a kryoptic issue, this error is returned only when the database is not properly initialized ...

That is also my understanding

Well I guess we could translate it to another error, is that the ask?

That would be best to make sure we follow the specs as the CKR_USER_PIN_NOT_INITIALIZED should be returned only from the Login/LoginUser functions.

[simo5]

I think that to do this, the best course of action would be to provide a table of errors that are allowed per function, and remap to CKR_GENERAL_ERROR any error that is not allowed to be returned by the specific function. WDYT?

[simo5]

(that said, I often used intentionally bogus error codes in some difficult debug sessions in the past to figure out where something failed when using GDB was too bothersome, that will become more complicated with such a facility ...

[keldonin]

Here is one of such occurrences:

https://github.com/parallaxsecond/rust-cryptoki/actions/runs/20783892465/job/59687990540?pr=341

Note that this issue has happened randomly in different tests. It may dissapear at the next test run.

[simo5]

@keldonin to be clear, I can change what error you get, but you will keep seeing an error, because what is happening here, I think, is that the doc test is racing with other tests that set up the token, so that sometimes this test gets an actually un-initialized token.

[keldonin]

@Jakuje might not necessarily be a kryoptic issue. I'll try to see if that can be reproduced locally - I have already, at random, encounteres this problem on my local host, without paying too much attention.

@simo5 can we park this one for a while, until we carry on investigation?