How to manage a network down and avoid error with PKCS11Interop

空扰寡人 提交于 2020-01-04 13:36:23

问题


Using PKCS11Interop on Safenet HSMs, I got this error

"Method C_OpenSession returned 2147484548"

the error, in my documentation, is CKR_SMS_ERROR: "General error from secure messaging system - probably caused by HSM failure or network failure".

This confirm the problem it happens when the connectivity is lacking.

The problem is when this happens, the service isn't able to resume the communication when the connectivity is back, until I restart manually the service managing the HSM access.

When the service starts, I call this:

private Pkcs11 _pkcs11 = null;
private Slot _slot = null;
private Session _session = null;

public async void InitPkcs11()
{
    try
    {
        _pkcs11 = new Pkcs11(pathCryptoki, Inter_Settings.AppType);
        _slot = Inter_Helpers.GetUsableSlot(_pkcs11, nSlot);
        _session = _slot.OpenSession(SessionType.ReadOnly);
        _session.Login(CKU.CKU_USER, Inter_Settings.NormalUserPin);
    }
    catch (Exception e)
    {
        ...
    }
}

When I have to use the HSM, I call something like:

using (var LocalSession = _slot.OpenSession(SessionType.ReadOnly))
{
    ...
}

And, when I fail the communication due to a connectivity lack, I call a function to reset the connection and try to change the slot:

private bool switching = false;

public async void SwitchSlot()
{
    try
    {
        if (!switching)
        {
            switching = true;
            if (nSlot == 0)
            {
                nSlot = 2;
            }
            else
            {
                nSlot = 0;
            }
            _session.Logout();
            _slot.CloseAllSessions();
            _pkcs11.Dispose();
            InitPkcs11();
            switching = false;
        }
    }
    catch (Exception e)
    {
        ...
    }
}

But, this last snippet doens't work as expected: it tries to change the slot, but it fails always to communicate with the HSM (after a network down). If I restart the service manually (when the connectivity is back), it works like charms. So, I'm sure I'm doing something wrong in the SwitchSlot function, when I try to close the _session and open a new one.

Do you see any errors/misunderstoonding here?

来源:https://stackoverflow.com/questions/48063467/how-to-manage-a-network-down-and-avoid-error-with-pkcs11interop

易学教程内所有资源均来自网络或用户发布的内容,如有违反法律规定的内容欢迎反馈
该文章没有解决你所遇到的问题?点击提问,说说你的问题,让更多的人一起探讨吧!