management.c: unable to handle PIN request during pkcs11-id-count interaction

Affected platforms: Linux, Windows, others(?)

How to reproduce (Requires a hardware token or soft token with one or more certificates loaded)

Run openvpn from command prompt as (assuming sofhsm2 token)

openvpn --verb 4 --management 127.0.0.1 7505 --pkcs11-id-management --pkcs11-providers /usr/lib/x86_64-linux-gnu/softhsm/libsofthsm2.so --management-query-passwords --dev tun --client --remote 127.0.0.1 --capath ./

Notes:

• capath ./ and --remote 127.0.0.1 are bogus but irrelevant
• If using a hardware token change the provider module path to match

In paralelel, run telnet as

telnet 127.0.0.1 7505

Telnet will show that openvpn is waiting for pkcs11-id. Type pkcs11-id-count at the telnet prompt. If no PIN is required for certificate enumeration, this will succeed with something like >PKCS11-ID-COUNT:1. In that case repeat the above command with --pkcs11-cert-private 1 to force PIN prompt:

openvpn --verb 4 --management 127.0.0.1 7505 --pkcs11-id-management --pkcs11-providers /usr/lib/x86_64-linux-gnu/softhsm/libsofthsm2.so --management-query-passwords --dev tun --client --remote 127.0.0.1 --capath ./ --pkcs11-cert-private 1
(Note: this is the same as the first command except for the last argument).

Type pkcs11-id-count as before. A request for token password will appears as:
>PASSWORD:Need 'Foo token' password
Respond to it as
password 'Foo token' 1234

('Foo token' should match the actual text after "Need" in the password request. Instead of 1234 one can use the actual token pin)

OpenVPN will hang with no further progress. Quiting telnet and reconnecting makes no difference.

Start in management.c and reproduce the pkcs11-id-count interaction with the commands and telnet steps described in the issue. Trace the password request and response handling, then verify that enumeration continues after the token password is supplied instead of hanging.