Fix handling of invalid object handles

[bukka]

Description

This is an initial fix for #494 which describes all the details about the actual issue.

The fix first removes the errors in session refreshing if the session was successfully re-opened.

It then exposes function for refreshing of invalid objects - this uses the same logic as after the fork refreshing triggered from store.

And it adds a logic in signature for handling CKR_OBJECT_HANDLE_INVALID error. It basically refreshes the object and repeat the operation. It also clears errors if refreshing and repeated operation is successful.

For my use case signInit is enough but I realise that this would be quite incomplete so other places should be addressed in the similar way. But before I look into it, I wanted to hear if this approach would be acceptable so please let me know your thoughts. Also if acceptable I will be happy to look into providing some tests.

Checklist

• Code modified for feature
• Test suite updated with functionality tests
• Test suite updated with negative tests
• Documentation updated

Reviewer's checklist:

• Any issues marked for closing are addressed
• There is a test suite reasonably covering new functionality or modifications
• This feature/change has adequate documentation added
• Code conform to coding style that today cannot yet be enforced via the check style test
• Commits have short titles and sensible commit messages
• Coverity Scan has run if needed (code PR) and no new defects were found

[simo5]

Sounds reasonable in principle, however this change would have to be added to any "_init()" for any operation.
So all the operation in asymmetric_cpiher.c and exchange.c etc...

[simo5]

you should move this whole section directly in p11prov_sig_operate_init()

[simo5]

if you do the refreshing in this function, as you should, then this will go away, as it should.
This exception here is a trap for any of the callers.

[simo5]

Note that this kind of change will need tests, or it will regress easily.

[bukka]

@simo5 Cool, thanks. Ok I will look into adding that to other _init and make it more generic and will also take into account your comments.

In terms of test I could look into adding an integration test for nginx and pkcs11-proxy which should cover the sign one and would be probably useful for testing the fork reload as nginx forks workers. Would you also want tests for other _init? If so, I would probably have to look into some longer running app so I can restart daemon and then retry it. If you have an idea about some existing application for such testing, that would be great!

[simo5]

@simo5 Cool, thanks. Ok I will look into adding that to other _init and make it more generic and will also take into account your comments.

In terms of test I could look into adding an integration test for nginx and pkcs11-proxy which should cover the sign one and would be probably useful for testing the fork reload as nginx forks workers. Would you also want tests for other _init? If so, I would probably have to look into some longer running app so I can restart daemon and then retry it. If you have an idea about some existing application for such testing, that would be great!

Assuming we can make a generic function for this, then just one test application with the proxy should be fine. Let's see where it goes as you add code.

[simo5]

Just a word of warning, closing sessions means destroying all ephemeral keys created as session objects.
This means some handles will never be recoverable. I think we need a way to destroy or mark those objects as unrecoverable otherwise we may end up trying to recover them over and over in some cases.

[bukka]

Ah yeah, good point. I will look into it.