6 files changed, 24 insertions, 17 deletions
diff --git a/src/libstrongswan/plugins/pkcs11/Makefile.in b/src/libstrongswan/plugins/pkcs11/Makefile.in
index 7bf33d967..00d5a6a5d 100644
--- a/src/libstrongswan/plugins/pkcs11/Makefile.in
+++ b/src/libstrongswan/plugins/pkcs11/Makefile.in
@@ -249,9 +249,11 @@ ECHO_T = @ECHO_T@
 EGREP = @EGREP@
 EXEEXT = @EXEEXT@
 FGREP = @FGREP@
+FUZZING_LDFLAGS = @FUZZING_LDFLAGS@
 GEM = @GEM@
 GENHTML = @GENHTML@
 GPERF = @GPERF@
+GPERF_LEN_TYPE = @GPERF_LEN_TYPE@
 GPRBUILD = @GPRBUILD@
 GREP = @GREP@
 INSTALL = @INSTALL@
diff --git a/src/libstrongswan/plugins/pkcs11/pkcs11_dh.c b/src/libstrongswan/plugins/pkcs11/pkcs11_dh.c
index c0033bd8e..b0fa41b6a 100644
--- a/src/libstrongswan/plugins/pkcs11/pkcs11_dh.c
+++ b/src/libstrongswan/plugins/pkcs11/pkcs11_dh.c
@@ -415,13 +415,15 @@ static chunk_t ecparams_lookup(diffie_hellman_group_t group)
 /**
  * Described in header.
  */
-pkcs11_dh_t *pkcs11_dh_create(diffie_hellman_group_t group,
-							  chunk_t g, chunk_t p)
+pkcs11_dh_t *pkcs11_dh_create(diffie_hellman_group_t group, ...)
 {
 	switch (group)
 	{
 		case MODP_CUSTOM:
 		{
+			chunk_t g, p;
+
+			VA_ARGS_GET(group, g, p);
 			return create_modp(group, p.len, g, p);
 		}
 		case ECP_192_BIT:
diff --git a/src/libstrongswan/plugins/pkcs11/pkcs11_dh.h b/src/libstrongswan/plugins/pkcs11/pkcs11_dh.h
index 2654130c0..1ad58e7a1 100644
--- a/src/libstrongswan/plugins/pkcs11/pkcs11_dh.h
+++ b/src/libstrongswan/plugins/pkcs11/pkcs11_dh.h
@@ -40,12 +40,10 @@ struct pkcs11_dh_t {
  * Creates a new pkcs11_dh_t object.
  *
  * @param group			Diffie Hellman group number to use
- * @param g				generator in case group is MODP_CUSTOM
- * @param p				prime in case group is MODP_CUSTOM
+ * @param ...			expects generator and prime as chunk_t if MODP_CUSTOM
  * @return				pkcs11_dh_t object, NULL if not supported
  */
-pkcs11_dh_t *pkcs11_dh_create(diffie_hellman_group_t group,
-							  chunk_t g, chunk_t p);
+pkcs11_dh_t *pkcs11_dh_create(diffie_hellman_group_t group, ...);
 
 #endif /** PKCS11_DH_H_ @}*/
 
diff --git a/src/libstrongswan/plugins/pkcs11/pkcs11_manager.c b/src/libstrongswan/plugins/pkcs11/pkcs11_manager.c
index 31bcb0d25..c7dfe69d7 100644
--- a/src/libstrongswan/plugins/pkcs11/pkcs11_manager.c
+++ b/src/libstrongswan/plugins/pkcs11/pkcs11_manager.c
@@ -164,18 +164,13 @@ static void handle_slot(lib_entry_t *entry, CK_SLOT_ID slot, bool hot)
 	}
 }
 
-/**
- * Dispatch slot events
- */
-static job_requeue_t dispatch_slot_events(lib_entry_t *entry)
+CALLBACK(dispatch_slot_events, job_requeue_t,
+	lib_entry_t *entry)
 {
 	CK_SLOT_ID slot;
 	CK_RV rv;
-	bool old;
 
-	old = thread_cancelability(TRUE);
 	rv = entry->lib->f->C_WaitForSlotEvent(0, &slot, NULL);
-	thread_cancelability(old);
 	if (rv == CKR_FUNCTION_NOT_SUPPORTED || rv == CKR_NO_EVENT)
 	{
 		DBG1(DBG_CFG, "module '%s' does not support hot-plugging, cancelled",
@@ -195,6 +190,16 @@ static job_requeue_t dispatch_slot_events(lib_entry_t *entry)
 	return JOB_REQUEUE_DIRECT;
 }
 
+CALLBACK(cancel_events, bool,
+	lib_entry_t *entry)
+{
+	/* it's possible other threads still use the API after this call, but we
+	 * have no other way to return from C_WaitForSlotEvent() if we can't cancel
+	 * the thread because libraries hold locks they don't release */
+	entry->lib->f->C_Finalize(NULL);
+	return TRUE;
+}
+
 /**
  * Get the slot list of a library
  */
@@ -377,8 +382,8 @@ pkcs11_manager_t *pkcs11_manager_create(pkcs11_manager_token_event_t cb,
 	{
 		query_slots(entry);
 		lib->processor->queue_job(lib->processor,
-			(job_t*)callback_job_create_with_prio((void*)dispatch_slot_events,
-						entry, NULL, (void*)return_false, JOB_PRIO_CRITICAL));
+			(job_t*)callback_job_create_with_prio(dispatch_slot_events,
+						entry, NULL, cancel_events, JOB_PRIO_CRITICAL));
 	}
 	enumerator->destroy(enumerator);
 
diff --git a/src/libstrongswan/plugins/pkcs11/pkcs11_private_key.c b/src/libstrongswan/plugins/pkcs11/pkcs11_private_key.c
index 1d1016911..6158f6d25 100644
--- a/src/libstrongswan/plugins/pkcs11/pkcs11_private_key.c
+++ b/src/libstrongswan/plugins/pkcs11/pkcs11_private_key.c
@@ -243,7 +243,7 @@ static bool reauth(private_pkcs11_private_key_t *this,
 }
 
 METHOD(private_key_t, sign, bool,
-	private_pkcs11_private_key_t *this, signature_scheme_t scheme,
+	private_pkcs11_private_key_t *this, signature_scheme_t scheme, void *params,
 	chunk_t data, chunk_t *signature)
 {
 	CK_MECHANISM_PTR mechanism;
diff --git a/src/libstrongswan/plugins/pkcs11/pkcs11_public_key.c b/src/libstrongswan/plugins/pkcs11/pkcs11_public_key.c
index 384777610..36029fa30 100644
--- a/src/libstrongswan/plugins/pkcs11/pkcs11_public_key.c
+++ b/src/libstrongswan/plugins/pkcs11/pkcs11_public_key.c
@@ -201,7 +201,7 @@ METHOD(public_key_t, get_keysize, int,
 }
 
 METHOD(public_key_t, verify, bool,
-	private_pkcs11_public_key_t *this, signature_scheme_t scheme,
+	private_pkcs11_public_key_t *this, signature_scheme_t scheme, void *params,
 	chunk_t data, chunk_t sig)
 {
 	CK_MECHANISM_PTR mechanism;