From eb52ab718432da1ecdf6559afcb0c515e2ab017a Mon Sep 17 00:00:00 2001 From: Matthias Valvekens Date: Sat, 6 Dec 2025 22:55:13 +0100 Subject: [PATCH] Fallback to 1-by-1 fetch when determining capas If fetching all flags on an object is not possible in one go, try fetching one at a time. This is meant to alleviate some issues with misbehaving tokens. Fixes #221 --- pkcs11/_pkcs11.pyx | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/pkcs11/_pkcs11.pyx b/pkcs11/_pkcs11.pyx index 6428607..27f692e 100644 --- a/pkcs11/_pkcs11.pyx +++ b/pkcs11/_pkcs11.pyx @@ -1366,8 +1366,15 @@ cdef object make_object(Session session, CK_OBJECT_HANDLE handle) with gil: # Determine a list of base classes to manufacture our class with try: attributes = wrapper.get_attribute_list(&attr_keys[0], 8) - except (AttributeTypeInvalid, FunctionFailed) as e: + except PKCS11Error: + # retry fetching the flags one by one, some tokens do not implement error handling + # on bulk fetches correctly. attributes = {} + for key in attr_keys: + try: + attributes[key] = wrapper[key] + except (AttributeTypeInvalid, AttributeSensitive, FunctionFailed): + continue object_class = attributes.get(Attribute.CLASS, session.attribute_mapper) bases = (_CLASS_MAP[object_class],)