Attachment #3119 for bug #2817

Lines 85-91 LIBSSH_OBJS=${LIBOPENSSH_OBJS} \ Link Here

(-)a/Makefile.in (-1 / +23 lines)
85	atomicio.o key.o dispatch.o mac.o uidswap.o uuencode.o misc.o utf8.o \	85	atomicio.o key.o dispatch.o mac.o uidswap.o uuencode.o misc.o utf8.o \
86	monitor_fdpass.o rijndael.o ssh-dss.o ssh-ecdsa.o ssh-rsa.o dh.o \	86	monitor_fdpass.o rijndael.o ssh-dss.o ssh-ecdsa.o ssh-rsa.o dh.o \
87	msg.o progressmeter.o dns.o entropy.o gss-genr.o umac.o umac128.o \	87	msg.o progressmeter.o dns.o entropy.o gss-genr.o umac.o umac128.o \
88	ssh-pkcs11.o smult_curve25519_ref.o \	88	ssh-pkcs11.o ssh-pkcs11-uri.o smult_curve25519_ref.o \
89	poly1305.o chacha.o cipher-chachapoly.o \	89	poly1305.o chacha.o cipher-chachapoly.o \
90	ssh-ed25519.o digest-openssl.o digest-libc.o hmac.o \	90	ssh-ed25519.o digest-openssl.o digest-libc.o hmac.o \
91	sc25519.o ge25519.o fe25519.o ed25519.o verify.o hash.o \	91	sc25519.o ge25519.o fe25519.o ed25519.o verify.o hash.o \
Lines 240-245 clean: regressclean Link Here
240	rm -f regress/unittests/match/test_match$(EXEEXT)	240	rm -f regress/unittests/match/test_match$(EXEEXT)
241	rm -f regress/unittests/utf8/*.o	241	rm -f regress/unittests/utf8/*.o
242	rm -f regress/unittests/utf8/test_utf8$(EXEEXT)	242	rm -f regress/unittests/utf8/test_utf8$(EXEEXT)
		243	rm -f regress/unittests/pkcs11/*.o
		244	rm -f regress/unittests/pkcs11/test_pkcs11$(EXEEXT)
243	rm -f regress/misc/kexfuzz/*.o	245	rm -f regress/misc/kexfuzz/*.o
244	rm -f regress/misc/kexfuzz/kexfuzz$(EXEEXT)	246	rm -f regress/misc/kexfuzz/kexfuzz$(EXEEXT)
245	(cd openbsd-compat && $(MAKE) clean)	247	(cd openbsd-compat && $(MAKE) clean)
Lines 268-273 distclean: regressclean Link Here
268	rm -f regress/unittests/match/test_match	270	rm -f regress/unittests/match/test_match
269	rm -f regress/unittests/utf8/*.o	271	rm -f regress/unittests/utf8/*.o
270	rm -f regress/unittests/utf8/test_utf8	272	rm -f regress/unittests/utf8/test_utf8
		273	rm -f regress/unittests/pkcs11/*.o
		274	rm -f regress/unittests/pkcs11/test_pkcs11
271	rm -f regress/unittests/misc/kexfuzz	275	rm -f regress/unittests/misc/kexfuzz
272	(cd openbsd-compat && $(MAKE) distclean)	276	(cd openbsd-compat && $(MAKE) distclean)
273	if test -d pkg ; then \	277	if test -d pkg ; then \
Lines 429-434 regress-prep: Link Here
429	$(MKDIR_P) `pwd`/regress/unittests/kex	433	$(MKDIR_P) `pwd`/regress/unittests/kex
430	$(MKDIR_P) `pwd`/regress/unittests/match	434	$(MKDIR_P) `pwd`/regress/unittests/match
431	$(MKDIR_P) `pwd`/regress/unittests/utf8	435	$(MKDIR_P) `pwd`/regress/unittests/utf8
		436	$(MKDIR_P) `pwd`/regress/unittests/pkcs11
432	$(MKDIR_P) `pwd`/regress/misc/kexfuzz	437	$(MKDIR_P) `pwd`/regress/misc/kexfuzz
433	[ -f `pwd`/regress/Makefile ] \|\| \	438	[ -f `pwd`/regress/Makefile ] \|\| \
434	ln -s `cd $(srcdir) && pwd`/regress/Makefile `pwd`/regress/Makefile	439	ln -s `cd $(srcdir) && pwd`/regress/Makefile `pwd`/regress/Makefile
Lines 447-452 regress/netcat$(EXEEXT): $(srcdir)/regress/netcat.c $(REGRESSLIBS) Link Here
447	$(CC) $(CFLAGS) $(CPPFLAGS) -o $@ $(srcdir)/regress/netcat.c \	452	$(CC) $(CFLAGS) $(CPPFLAGS) -o $@ $(srcdir)/regress/netcat.c \
448	$(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS)	453	$(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS)
449		454
		455	regress/soft-pkcs11.so: $(srcdir)/regress/soft-pkcs11.c $(REGRESSLIBS)
		456	$(CC) $(CFLAGS) $(CPPFLAGS) -fpic -c $(srcdir)/regress/soft-pkcs11.c \
		457	-o $(srcdir)/regress/soft-pkcs11.o
		458	$(CC) -shared -o $@ $(srcdir)/regress/soft-pkcs11.o
		459
450	regress/check-perm$(EXEEXT): $(srcdir)/regress/check-perm.c $(REGRESSLIBS)	460	regress/check-perm$(EXEEXT): $(srcdir)/regress/check-perm.c $(REGRESSLIBS)
451	$(CC) $(CFLAGS) $(CPPFLAGS) -o $@ $(srcdir)/regress/check-perm.c \	461	$(CC) $(CFLAGS) $(CPPFLAGS) -o $@ $(srcdir)/regress/check-perm.c \
452	$(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS)	462	$(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS)
Lines 548-553 regress/unittests/utf8/test_utf8$(EXEEXT): \ Link Here
548	regress/unittests/test_helper/libtest_helper.a \	558	regress/unittests/test_helper/libtest_helper.a \
549	-lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS)	559	-lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS)
550		560
		561	UNITTESTS_TEST_PKCS11_OBJS=\
		562	regress/unittests/pkcs11/tests.o
		563
		564	regress/unittests/pkcs11/test_pkcs11$(EXEEXT): \
		565	${UNITTESTS_TEST_PKCS11_OBJS} \
		566	regress/unittests/test_helper/libtest_helper.a libssh.a
		567	$(LD) -o $@ $(LDFLAGS) $(UNITTESTS_TEST_PKCS11_OBJS) \
		568	regress/unittests/test_helper/libtest_helper.a \
		569	-lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS)
		570
551	MISC_KEX_FUZZ_OBJS=\	571	MISC_KEX_FUZZ_OBJS=\
552	regress/misc/kexfuzz/kexfuzz.o	572	regress/misc/kexfuzz/kexfuzz.o
553		573
Lines 558-563 regress/misc/kexfuzz/kexfuzz$(EXEEXT): ${MISC_KEX_FUZZ_OBJS} libssh.a Link Here
558	regress-binaries: regress/modpipe$(EXEEXT) \	578	regress-binaries: regress/modpipe$(EXEEXT) \
559	regress/setuid-allowed$(EXEEXT) \	579	regress/setuid-allowed$(EXEEXT) \
560	regress/netcat$(EXEEXT) \	580	regress/netcat$(EXEEXT) \
		581	regress/soft-pkcs11.so \
561	regress/check-perm$(EXEEXT) \	582	regress/check-perm$(EXEEXT) \
562	regress/unittests/sshbuf/test_sshbuf$(EXEEXT) \	583	regress/unittests/sshbuf/test_sshbuf$(EXEEXT) \
563	regress/unittests/sshkey/test_sshkey$(EXEEXT) \	584	regress/unittests/sshkey/test_sshkey$(EXEEXT) \
Lines 567-572 regress-binaries: regress/modpipe$(EXEEXT) \ Link Here
567	regress/unittests/kex/test_kex$(EXEEXT) \	588	regress/unittests/kex/test_kex$(EXEEXT) \
568	regress/unittests/match/test_match$(EXEEXT) \	589	regress/unittests/match/test_match$(EXEEXT) \
569	regress/unittests/utf8/test_utf8$(EXEEXT) \	590	regress/unittests/utf8/test_utf8$(EXEEXT) \
		591	regress/unittests/pkcs11/test_pkcs11$(EXEEXT) \
570	regress/misc/kexfuzz/kexfuzz$(EXEEXT)	592	regress/misc/kexfuzz/kexfuzz$(EXEEXT)
571		593
572	tests interop-tests t-exec unit: regress-prep regress-binaries $(TARGETS)	594	tests interop-tests t-exec unit: regress-prep regress-binaries $(TARGETS)




	[AC_DEFINE([HAVE_ISBLANK], [1], [Define if you have isblank(3C).])
])

SCARD_MSG="yes"
disable_pkcs11=
AC_ARG_ENABLE([pkcs11],
	[  --disable-pkcs11        disable PKCS#11 support code [no]],
	[
		if test "x$enableval" = "xno" ; then
			disable_pkcs11=1
			SCARD_MSG="no"
		fi
	]
)

	)
fi

# Check whether we have a p11-kit, we got default provider on command line
DEFAULT_PKCS11_PROVIDER_MSG="no"
AC_ARG_WITH([default-pkcs11-provider],
	[  --with-default-pkcs11-provider[[=PATH]]   Use default pkcs11 provider (p11-kit detected by default)],
	[ if test "x$withval" != "xno" && test "x$disable_pkcs11" = "x"; then
		if test "x$withval" = "xyes" ; then
			AC_PATH_TOOL([PKGCONFIG], [pkg-config], [no])
			if test "x$PKGCONFIG" != "xno"; then
				AC_MSG_CHECKING([if $PKGCONFIG knows about p11-kit])
				if "$PKGCONFIG" "p11-kit-1"; then
					AC_MSG_RESULT([yes])
					use_pkgconfig_for_p11kit=yes
				else
					AC_MSG_RESULT([no])
				fi
			fi
		else
			PKCS11_PATH="${withval}"
		fi
		if test "x$use_pkgconfig_for_p11kit" = "xyes"; then
			PKCS11_PATH=`$PKGCONFIG --variable=proxy_module p11-kit-1`
		fi
		AC_CHECK_FILE("$PKCS11_PATH",
			[ AC_DEFINE_UNQUOTED([PKCS11_DEFAULT_PROVIDER], ["$PKCS11_PATH"], [Path to default PKCS#11 provider (p11-kit proxy)])
			  DEFAULT_PKCS11_PROVIDER_MSG="$PKCS11_PATH"
			],
			[ AC_MSG_ERROR([Requested PKCS11 provided not found]) ]
		)
	else
		AC_MSG_WARN([Needs PKCS11 support to enable default pkcs11 provider])
	fi ]
)


# IRIX has a const char return value for gai_strerror()
AC_CHECK_FUNCS([gai_strerror], [
	AC_DEFINE([HAVE_GAI_STRERROR])

echo "                  BSD Auth support: $BSD_AUTH_MSG"
echo "              Random number source: $RAND_MSG"
echo "             Privsep sandbox style: $SANDBOX_STYLE"
echo "          Default PKCS#11 provider: $DEFAULT_PKCS11_PROVIDER_MSG"

echo ""


Lines 1015-1021 parse_time: Link Here

(-)a/readconf.c (-2 / +3 lines)
1015	break;	1015	break;
1016		1016
1017	case oIdentityFile:	1017	case oIdentityFile:
1018	arg = strdelim(&s);	1018	/* Can't use strdelim() becase it would break on equal signs */
		1019	arg = xstrdup(s);
1019	if (!arg \|\| *arg == '\0')	1020	if (!arg \|\| *arg == '\0')
1020	fatal("%.200s line %d: Missing argument.", filename, linenum);	1021	fatal("%.200s line %d: Missing argument.", filename, linenum);
1021	if (*activep) {	1022	if (*activep) {
Lines 1026-1032 parse_time: Link Here
1026	add_identity_file(options, NULL,	1027	add_identity_file(options, NULL,
1027	arg, flags & SSHCONF_USERCONF);	1028	arg, flags & SSHCONF_USERCONF);
1028	}	1029	}
1029	break;	1030	return 0;
1030		1031
1031	case oCertificateFile:	1032	case oCertificateFile:
1032	arg = strdelim(&s);	1033	arg = strdelim(&s);

Lines 42-47 LTESTS= connect \ Link Here

(-)a/regress/Makefile (-2 / +7 lines)
42	keygen-convert \	42	keygen-convert \
43	keygen-moduli \	43	keygen-moduli \
44	key-options \	44	key-options \
		45	pkcs11 \
		46	agent-pkcs11 \
45	scp \	47	scp \
46	scp-uri \	48	scp-uri \
47	sftp \	49	sftp \
Lines 108-116 CLEANFILES= .core actual agent-key. authorized_keys_${USERNAME} \ Link Here
108	known_hosts known_hosts-cert known_hosts.* krl-* ls.copy \	110	known_hosts known_hosts-cert known_hosts.* krl-* ls.copy \
109	modpipe netcat no_identity_config \	111	modpipe netcat no_identity_config \
110	pidfile putty.rsa2 ready regress.log \	112	pidfile putty.rsa2 ready regress.log \
111	remote_pid revoked-* rsa rsa-agent rsa-agent.pub rsa.pub \	113	remote_pid revoked-* rsa rsa-agent rsa-agent.pub \
		114	rsa-agent-cert.pub rsa.pub \
112	rsa1 rsa1-agent rsa1-agent.pub rsa1.pub rsa_ssh2_cr.prv \	115	rsa1 rsa1-agent rsa1-agent.pub rsa1.pub rsa_ssh2_cr.prv \
113	rsa_ssh2_crnl.prv scp-ssh-wrapper.exe \	116	soft-pkcs11.so soft-pkcs11.o pkcs11.crt pkcs11.key \
		117	pkcs11.info rsa_ssh2_crnl.prv scp-ssh-wrapper.exe \
114	scp-ssh-wrapper.scp setuid-allowed sftp-server.log \	118	scp-ssh-wrapper.scp setuid-allowed sftp-server.log \
115	sftp-server.sh sftp.log ssh-log-wrapper.sh ssh.log \	119	sftp-server.sh sftp.log ssh-log-wrapper.sh ssh.log \
116	ssh_config ssh_config.* ssh_proxy ssh_proxy_bak \	120	ssh_config ssh_config.* ssh_proxy ssh_proxy_bak \
Lines 225-230 unit: Link Here
225	V="" ; \	229	V="" ; \
226	test "x${USE_VALGRIND}" = "x" \|\| \	230	test "x${USE_VALGRIND}" = "x" \|\| \
227	V=${.CURDIR}/valgrind-unit.sh ; \	231	V=${.CURDIR}/valgrind-unit.sh ; \
		232	$$V ${.OBJDIR}/unittests/pkcs11/test_pkcs11 ; \
228	$$V ${.OBJDIR}/unittests/sshbuf/test_sshbuf ; \	233	$$V ${.OBJDIR}/unittests/sshbuf/test_sshbuf ; \
229	$$V ${.OBJDIR}/unittests/sshkey/test_sshkey \	234	$$V ${.OBJDIR}/unittests/sshkey/test_sshkey \
230	-d ${.CURDIR}/unittests/sshkey/testdata ; \	235	-d ${.CURDIR}/unittests/sshkey/testdata ; \

Lines 4-13 Link Here

(-)a/regress/agent-pkcs11.sh (-3 / +10 lines)
4	tid="pkcs11 agent test"	4	tid="pkcs11 agent test"
5		5
6	TEST_SSH_PIN=""	6	TEST_SSH_PIN=""
7	TEST_SSH_PKCS11=/usr/local/lib/soft-pkcs11.so.0.0	7	TEST_SSH_PKCS11=$OBJ/soft-pkcs11.so
8		8
9	test -f "$TEST_SSH_PKCS11" \|\| fatal "$TEST_SSH_PKCS11 does not exist"	9	test -f "$TEST_SSH_PKCS11" \|\| fatal "$TEST_SSH_PKCS11 does not exist"
10		10
		11	# requires ssh-agent built with correct path to ssh-pkcs11-helper
		12	# otherwise it fails to start the helper
		13	strings ${TEST_SSH_SSHAGENT} \| grep "$TEST_SSH_SSHPKCS11HELPER"
		14	if [ $? -ne 0 ]; then
		15	fatal "Needs to reconfigure with --libexecdir=\`pwd\` or so"
		16	fi
		17
11	# setup environment for soft-pkcs11 token	18	# setup environment for soft-pkcs11 token
12	SOFTPKCS11RC=$OBJ/pkcs11.info	19	SOFTPKCS11RC=$OBJ/pkcs11.info
13	export SOFTPKCS11RC	20	export SOFTPKCS11RC
Lines 23-29 notty() { Link Here
23	}	30	}
24		31
25	trace "start agent"	32	trace "start agent"
26	eval `${SSHAGENT} -s` > /dev/null	33	eval `${SSHAGENT} -s -P "${OBJ}/*"` > /dev/null
27	r=$?	34	r=$?
28	if [ $r -ne 0 ]; then	35	if [ $r -ne 0 ]; then
29	fail "could not start ssh-agent: exit code $r"	36	fail "could not start ssh-agent: exit code $r"
Lines 60-66 else Link Here
60	fi	67	fi
61		68
62	trace "remove pkcs11 keys"	69	trace "remove pkcs11 keys"
63	echo ${TEST_SSH_PIN} \| notty ${SSHADD} -e ${TEST_SSH_PKCS11} > /dev/null 2>&1	70	${SSHADD} -e ${TEST_SSH_PKCS11} > /dev/null 2>&1
64	r=$?	71	r=$?
65	if [ $r -ne 0 ]; then	72	if [ $r -ne 0 ]; then
66	fail "ssh-add -e failed: exit code $r"	73	fail "ssh-add -e failed: exit code $r"




/*
 * Copyright (c) 2004, Stockholms universitet
 * (Stockholm University, Stockholm Sweden)
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 *
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * 3. Neither the name of the university nor the names of its contributors
 *    may be used to endorse or promote products derived from this software
 *    without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 * POSSIBILITY OF SUCH DAMAGE.
 */

/* $Id: locl.h,v 1.5 2005/08/28 15:30:31 lha Exp $ */

#ifdef HAVE_CONFIG_H
#include <config.h>
#endif

#include <openssl/err.h>
#include <openssl/evp.h>
#include <openssl/pem.h>
#include <openssl/rand.h>
#include <openssl/x509.h>
#include "../libcrypto-compat.h"

#include <ctype.h>
#include <errno.h>
#include <pwd.h>
#include <stdarg.h>
#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

#include "../pkcs11.h"

#define OPENSSL_ASN1_MALLOC_ENCODE(T, B, BL, S, R)			\
{									\
  unsigned char *p;							\
  (BL) = i2d_##T((S), NULL);						\
  if ((BL) <= 0) {							\
     (R) = EINVAL;							\
  } else {								\
    (B) = malloc((BL));							\
    if ((B) == NULL) {							\
       (R) = ENOMEM;							\
    } else {								\
        p = (B);							\
        (R) = 0;							\
        (BL) = i2d_##T((S), &p);					\
        if ((BL) <= 0) {						\
           free((B));                                          		\
           (R) = EINVAL;						\
        }								\
    }									\
  }									\
}




#
#  Copyright (c) 2017 Red Hat
#
#  Authors: Jakub Jelen <jjelen@redhat.com>
#
#  Permission to use, copy, modify, and distribute this software for any
#  purpose with or without fee is hereby granted, provided that the above
#  copyright notice and this permission notice appear in all copies.
#
#  THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
#  WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
#  MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
#  ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
#  WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
#  ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
#  OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

tid="pkcs11 tests with soft token"

TEST_SSH_PIN=""
TEST_SSH_PKCS11=$OBJ/soft-pkcs11.so

test -f "$TEST_SSH_PKCS11" || fatal "$TEST_SSH_PKCS11 does not exist"

# requires ssh-agent built with correct path to ssh-pkcs11-helper
# otherwise it fails to start the helper
strings ${TEST_SSH_SSHAGENT} | grep "$TEST_SSH_SSHPKCS11HELPER"
if [ $? -ne 0 ]; then
	fatal "Needs to reconfigure with --libexecdir=\`pwd\` or so"
fi

# setup environment for soft-pkcs11 token
SOFTPKCS11RC=$OBJ/pkcs11.info
rm -f $SOFTPKCS11RC
export SOFTPKCS11RC
# prevent ssh-agent from calling ssh-askpass
SSH_ASKPASS=/usr/bin/true
export SSH_ASKPASS
unset DISPLAY

# start command w/o tty, so ssh accepts pin from stdin (from agent-pkcs11.sh)
notty() {
	perl -e 'use POSIX; POSIX::setsid();
	    if (fork) { wait; exit($? >> 8); } else { exec(@ARGV) }' "$@"
}

create_key() {
	ID=$1
	LABEL=$2
	rm -f $OBJ/pkcs11-${ID}.key $OBJ/pkcs11-${ID}.crt
	openssl genrsa -out $OBJ/pkcs11-${ID}.key 2048 > /dev/null 2>&1
	chmod 600 $OBJ/pkcs11-${ID}.key
	openssl req -key $OBJ/pkcs11-${ID}.key -new -x509 \
	    -out $OBJ/pkcs11-${ID}.crt -text -subj '/CN=pkcs11 test' >/dev/null
	printf "${ID}\t${LABEL}\t$OBJ/pkcs11-${ID}.crt\t$OBJ/pkcs11-${ID}.key\n" \
	    >> $SOFTPKCS11RC
}

trace "Create a key pairs on soft token"
ID1="02"
ID2="04"
create_key "$ID1" "SSH RSA Key"
create_key "$ID2" "SSH RSA Key 2"

trace "List the keys in the ssh-keygen with PKCS#11 URIs"
${SSHKEYGEN} -D ${TEST_SSH_PKCS11} > $OBJ/token_keys
if [ $? -ne 0 ]; then
	fail "keygen fails to enumerate keys on PKCS#11 token"
fi
grep "pkcs11:" $OBJ/token_keys > /dev/null
if [ $? -ne 0 ]; then
	fail "The keys from ssh-keygen do not contain PKCS#11 URI as a comment"
fi
tail -n 1 $OBJ/token_keys > $OBJ/authorized_keys_$USER


trace "Simple connect with ssh (without PKCS#11 URI)"
echo ${TEST_SSH_PIN} | notty ${SSH} -I ${TEST_SSH_PKCS11} \
    -F $OBJ/ssh_proxy somehost exit 5
r=$?
if [ $r -ne 5 ]; then
	fail "ssh connect with pkcs11 failed (exit code $r)"
fi


trace "Connect with PKCS#11 URI"
trace "  (second key should succeed)"
echo ${TEST_SSH_PIN} | notty ${SSH} -F $OBJ/ssh_proxy \
    -i "pkcs11:id=${ID2}?module-path=${TEST_SSH_PKCS11}" somehost exit 5
r=$?
if [ $r -ne 5 ]; then
	fail "ssh connect with PKCS#11 URI failed (exit code $r)"
fi

trace "  (first key should fail)"
echo ${TEST_SSH_PIN} | notty ${SSH} -F $OBJ/ssh_proxy \
     -i "pkcs11:id=${ID1}?module-path=${TEST_SSH_PKCS11}" somehost exit 5
r=$?
if [ $r -eq 5 ]; then
	fail "ssh connect with PKCS#11 URI succeeded (should fail)"
fi

trace "Connect with various filtering options in PKCS#11 URI"
trace "  (by object label, second key should succeed)"
echo ${TEST_SSH_PIN} | notty ${SSH} -F $OBJ/ssh_proxy \
    -i "pkcs11:object=SSH%20RSA%20Key%202?module-path=${TEST_SSH_PKCS11}" somehost exit 5
r=$?
if [ $r -ne 5 ]; then
	fail "ssh connect with PKCS#11 URI failed (exit code $r)"
fi

trace "  (by object label, first key should fail)"
echo ${TEST_SSH_PIN} | notty ${SSH} -F $OBJ/ssh_proxy \
     -i "pkcs11:object=SSH%20RSA%20Key?module-path=${TEST_SSH_PKCS11}" somehost exit 5
r=$?
if [ $r -eq 5 ]; then
	fail "ssh connect with PKCS#11 URI succeeded (should fail)"
fi

trace "  (by token label, second key should succeed)"
echo ${TEST_SSH_PIN} | notty ${SSH} -F $OBJ/ssh_proxy \
    -i "pkcs11:id=${ID2};token=SoftToken%20(token)?module-path=${TEST_SSH_PKCS11}" somehost exit 5
r=$?
if [ $r -ne 5 ]; then
	fail "ssh connect with PKCS#11 URI failed (exit code $r)"
fi

trace "  (by wrong token label, should fail)"
echo ${TEST_SSH_PIN} | notty ${SSH} -F $OBJ/ssh_proxy \
     -i "pkcs11:token=SoftToken?module-path=${TEST_SSH_PKCS11}" somehost exit 5
r=$?
if [ $r -eq 5 ]; then
	fail "ssh connect with PKCS#11 URI succeeded (should fail)"
fi




trace "Test PKCS#11 URI specification in configuration files"
echo "IdentityFile pkcs11:id=${ID2}?module-path=${TEST_SSH_PKCS11}" \
    >> $OBJ/ssh_proxy
trace "  (second key should succeed)"
echo ${TEST_SSH_PIN} | notty ${SSH} -F $OBJ/ssh_proxy somehost exit 5
r=$?
if [ $r -ne 5 ]; then
	fail "ssh connect with PKCS#11 URI in config failed (exit code $r)"
fi

trace "  (first key should fail)"
head -n 1 $OBJ/token_keys > $OBJ/authorized_keys_$USER
echo ${TEST_SSH_PIN} | notty ${SSH} -F $OBJ/ssh_proxy somehost exit 5
r=$?
if [ $r -eq 5 ]; then
	fail "ssh connect with PKCS#11 URI in config succeeded (should fail)"
fi
sed -i -e "/IdentityFile/d" $OBJ/ssh_proxy

trace "Test PKCS#11 URI specification in configuration files with bogus spaces"
echo "IdentityFile     pkcs11:id=${ID1}?module-path=${TEST_SSH_PKCS11}    " \
    >> $OBJ/ssh_proxy
echo ${TEST_SSH_PIN} | notty ${SSH} -F $OBJ/ssh_proxy somehost exit 5
r=$?
if [ $r -ne 5 ]; then
	fail "ssh connect with PKCS#11 URI with bogus spaces in config failed" \
	    "(exit code $r)"
fi
sed -i -e "/IdentityFile/d" $OBJ/ssh_proxy


trace "Combination of PKCS11Provider and PKCS11URI on commandline"
trace "  (first key should succeed)"
echo ${TEST_SSH_PIN} | notty ${SSH} -F $OBJ/ssh_proxy \
    -i "pkcs11:id=${ID1}" -I ${TEST_SSH_PKCS11} somehost exit 5
r=$?
if [ $r -ne 5 ]; then
	fail "ssh connect with PKCS#11 URI and provider combination" \
	    "failed (exit code $r)"
fi

trace "Regress: Missing provider in PKCS11URI option"
${SSH} -F $OBJ/ssh_proxy \
    -o IdentityFile='pkcs11:token=segfault' somehost exit 5
r=$?
if [ $r -eq 139 ]; then
	fail "ssh connect with missing provider_id from configuration option" \
	    "crashed (exit code $r)"
fi


trace "SSH Agent can work with PKCS#11 URI"
trace "start the agent"
eval `${SSHAGENT} -s -P "${OBJ}/*"` > /dev/null

r=$?
if [ $r -ne 0 ]; then
	fail "could not start ssh-agent: exit code $r"
else
	trace "add whole provider to agent"
	echo ${TEST_SSH_PIN} | notty ${SSHADD} \
	    "pkcs11:?module-path=${TEST_SSH_PKCS11}" > /dev/null 2>&1
	r=$?
	if [ $r -ne 0 ]; then
		fail "ssh-add failed with whole provider: exit code $r"
	fi

	trace " pkcs11 list via agent (all keys)"
	${SSHADD} -l > /dev/null 2>&1
	r=$?
	if [ $r -ne 0 ]; then
		fail "ssh-add -l failed with whole provider: exit code $r"
	fi

	trace " pkcs11 connect via agent (all keys)"
	${SSH} -F $OBJ/ssh_proxy somehost exit 5
	r=$?
	if [ $r -ne 5 ]; then
		fail "ssh connect failed with whole provider (exit code $r)"
	fi

	trace " remove pkcs11 keys (all keys)"
	${SSHADD} -d "pkcs11:?module-path=${TEST_SSH_PKCS11}" > /dev/null 2>&1
	r=$?
	if [ $r -ne 0 ]; then
		fail "ssh-add -d failed with whole provider: exit code $r"
	fi

	trace "add only first key to the agent"
	echo ${TEST_SSH_PIN} | notty ${SSHADD} \
	    "pkcs11:id=${ID1}?module-path=${TEST_SSH_PKCS11}" > /dev/null 2>&1
	r=$?
	if [ $r -ne 0 ]; then
		fail "ssh-add failed with first key: exit code $r"
	fi

	trace " pkcs11 connect via agent (first key)"
	${SSH} -F $OBJ/ssh_proxy somehost exit 5
	r=$?
	if [ $r -ne 5 ]; then
		fail "ssh connect failed with first key (exit code $r)"
	fi

	trace " remove first pkcs11 key"
	${SSHADD} -d "pkcs11:id=${ID1}?module-path=${TEST_SSH_PKCS11}" \
	    > /dev/null 2>&1
	r=$?
	if [ $r -ne 0 ]; then
		fail "ssh-add -d failed with first key: exit code $r"
	fi

	trace "add only second key to the agent"
	echo ${TEST_SSH_PIN} | notty ${SSHADD} \
	    "pkcs11:id=${ID2}?module-path=${TEST_SSH_PKCS11}" > /dev/null 2>&1
	r=$?
	if [ $r -ne 0 ]; then
		fail "ssh-add failed with second key: exit code $r"
	fi

	trace " pkcs11 connect via agent (second key should fail)"
	${SSH} -F $OBJ/ssh_proxy somehost exit 5
	r=$?
	if [ $r -eq 5 ]; then
		fail "ssh connect passed without key (should fail)"
	fi

	trace " remove second pkcs11 key"
	${SSHADD} -d "pkcs11:id=${ID2}?module-path=${TEST_SSH_PKCS11}" \
	    > /dev/null 2>&1
	r=$?
	if [ $r -ne 0 ]; then
		fail "ssh-add -d failed with second key: exit code $r"
	fi

	trace " remove already-removed pkcs11 key should fail"
	${SSHADD} -d "pkcs11:id=${ID1}?module-path=${TEST_SSH_PKCS11}" \
	    > /dev/null 2>&1
	r=$?
	if [ $r -eq 0 ]; then
		fail "ssh-add -d passed with non-existing key (should fail)"
	fi

	trace "kill agent"
	${SSHAGENT} -k > /dev/null
fi

rm -rf $OBJ/.tokens $OBJ/token_keys




/*
 * Copyright (c) 2004-2006, Stockholms universitet
 * (Stockholm University, Stockholm Sweden)
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 *
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * 3. Neither the name of the university nor the names of its contributors
 *    may be used to endorse or promote products derived from this software
 *    without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 * POSSIBILITY OF SUCH DAMAGE.
 */

#include "locl.h"

/* RCSID("$Id: main.c,v 1.24 2006/01/11 12:42:53 lha Exp $"); */

#define OBJECT_ID_MASK		0xfff
#define HANDLE_OBJECT_ID(h)	((h) & OBJECT_ID_MASK)
#define OBJECT_ID(obj)		HANDLE_OBJECT_ID((obj)->object_handle)

#if OPENSSL_VERSION_NUMBER < 0x10100000L
 #define RSA_PKCS1_SSLeay RSA_PKCS1_OpenSSL
#endif

struct st_attr {
    CK_ATTRIBUTE attribute;
    int secret;
};

struct st_object {
    CK_OBJECT_HANDLE object_handle;
    struct st_attr *attrs;
    int num_attributes;
    enum {
	STO_T_CERTIFICATE,
	STO_T_PRIVATE_KEY,
	STO_T_PUBLIC_KEY
    } type;
    union {
	X509 *cert;
	EVP_PKEY *public_key;
	struct {
	    const char *file;
	    EVP_PKEY *key;
	    X509 *cert;
	} private_key;
    } u;
};

static struct soft_token {
    CK_VOID_PTR application;
    CK_NOTIFY notify;
    struct {
	struct st_object **objs;
	int num_objs;
    } object;
    struct {
	int hardware_slot;
	int app_error_fatal;
	int login_done;
    } flags;
    int open_sessions;
    struct session_state {
	CK_SESSION_HANDLE session_handle;

	struct {
	    CK_ATTRIBUTE *attributes;
	    CK_ULONG num_attributes;
	    int next_object;
	} find;

	int encrypt_object;
	CK_MECHANISM_PTR encrypt_mechanism;
	int decrypt_object;
	CK_MECHANISM_PTR decrypt_mechanism;
	int sign_object;
	CK_MECHANISM_PTR sign_mechanism;
	int verify_object;
	CK_MECHANISM_PTR verify_mechanism;
	int digest_object;
    } state[10];
#define MAX_NUM_SESSION (sizeof(soft_token.state)/sizeof(soft_token.state[0]))
    FILE *logfile;
} soft_token;

static void
application_error(const char *fmt, ...)
{
    va_list ap;
    va_start(ap, fmt);
    vprintf(fmt, ap);
    va_end(ap);
    if (soft_token.flags.app_error_fatal)
	abort();
}

static void
st_logf(const char *fmt, ...)
{
    va_list ap;
    if (soft_token.logfile == NULL)
	return;
    va_start(ap, fmt);
    vfprintf(soft_token.logfile, fmt, ap);
    va_end(ap);
    fflush(soft_token.logfile);
}

static void
snprintf_fill(char *str, size_t size, char fillchar, const char *fmt, ...)
{
    int len;
    va_list ap;
    len = vsnprintf(str, size, fmt, ap);
    va_end(ap);
    if (len < 0 || len > (int) size)
	return;
    while(len < (int) size)
	str[len++] = fillchar;
}

#ifndef TEST_APP
#define printf error_use_st_logf
#endif

#define VERIFY_SESSION_HANDLE(s, state)			\
{							\
    CK_RV ret;						\
    ret = verify_session_handle(s, state);		\
    if (ret != CKR_OK) {				\
	/* return CKR_OK */;				\
    }							\
}

static CK_RV
verify_session_handle(CK_SESSION_HANDLE hSession,
		      struct session_state **state)
{
    size_t i;

    for (i = 0; i < MAX_NUM_SESSION; i++){
	if (soft_token.state[i].session_handle == hSession)
	    break;
    }
    if (i == MAX_NUM_SESSION) {
	application_error("use of invalid handle: 0x%08lx\n",
			  (unsigned long)hSession);
	return CKR_SESSION_HANDLE_INVALID;
    }
    if (state)
	*state = &soft_token.state[i];
    return CKR_OK;
}

static CK_RV
object_handle_to_object(CK_OBJECT_HANDLE handle,
			struct st_object **object)
{
    int i = HANDLE_OBJECT_ID(handle);

    *object = NULL;
    if (i >= soft_token.object.num_objs)
	return CKR_ARGUMENTS_BAD;
    if (soft_token.object.objs[i] == NULL)
	return CKR_ARGUMENTS_BAD;
    if (soft_token.object.objs[i]->object_handle != handle)
	return CKR_ARGUMENTS_BAD;
    *object = soft_token.object.objs[i];
    return CKR_OK;
}

static int
attributes_match(const struct st_object *obj,
		 const CK_ATTRIBUTE *attributes,
		 CK_ULONG num_attributes)
{
    CK_ULONG i;
    int j;
    st_logf("attributes_match: %ld\n", (unsigned long)OBJECT_ID(obj));

    for (i = 0; i < num_attributes; i++) {
	int match = 0;
	for (j = 0; j < obj->num_attributes; j++) {
	    if (attributes[i].type == obj->attrs[j].attribute.type &&
		attributes[i].ulValueLen == obj->attrs[j].attribute.ulValueLen &&
		memcmp(attributes[i].pValue, obj->attrs[j].attribute.pValue,
		       attributes[i].ulValueLen) == 0) {
		match = 1;
		break;
	    }
	}
	if (match == 0) {
	    st_logf("type %d attribute have no match\n", attributes[i].type);
	    return 0;
	}
    }
    st_logf("attribute matches\n");
    return 1;
}

static void
print_attributes(const CK_ATTRIBUTE *attributes,
		 CK_ULONG num_attributes)
{
    CK_ULONG i;

    st_logf("find objects: attrs: %lu\n", (unsigned long)num_attributes);

    for (i = 0; i < num_attributes; i++) {
	st_logf("  type: ");
	switch (attributes[i].type) {
	case CKA_TOKEN: {
	    CK_BBOOL *ck_true;
	    if (attributes[i].ulValueLen != sizeof(CK_BBOOL)) {
		application_error("token attribute wrong length\n");
		break;
	    }
	    ck_true = attributes[i].pValue;
	    st_logf("token: %s", *ck_true ? "TRUE" : "FALSE");
	    break;
	}
	case CKA_CLASS: {
	    CK_OBJECT_CLASS *class;
	    if (attributes[i].ulValueLen != sizeof(CK_ULONG)) {
		application_error("class attribute wrong length\n");
		break;
	    }
	    class = attributes[i].pValue;
	    st_logf("class ");
	    switch (*class) {
	    case CKO_CERTIFICATE:
		st_logf("certificate");
		break;
	    case CKO_PUBLIC_KEY:
		st_logf("public key");
		break;
	    case CKO_PRIVATE_KEY:
		st_logf("private key");
		break;
	    case CKO_SECRET_KEY:
		st_logf("secret key");
		break;
	    case CKO_DOMAIN_PARAMETERS:
		st_logf("domain parameters");
		break;
	    default:
		st_logf("[class %lx]", (long unsigned)*class);
		break;
	    }
	    break;
	}
	case CKA_PRIVATE:
	    st_logf("private");
	    break;
	case CKA_LABEL:
	    st_logf("label");
	    break;
	case CKA_APPLICATION:
	    st_logf("application");
	    break;
	case CKA_VALUE:
	    st_logf("value");
	    break;
	case CKA_ID:
	    st_logf("id");
	    break;
	default:
	    st_logf("[unknown 0x%08lx]", (unsigned long)attributes[i].type);
	    break;
	}
	st_logf("\n");
    }
}

static struct st_object *
add_st_object(void)
{
    struct st_object *o, **objs;
    int i;

    o = malloc(sizeof(*o));
    if (o == NULL)
	return NULL;
    memset(o, 0, sizeof(*o));
    o->attrs = NULL;
    o->num_attributes = 0;

    for (i = 0; i < soft_token.object.num_objs; i++) {
	if (soft_token.object.objs == NULL) {
	    soft_token.object.objs[i] = o;
	    break;
	}
    }
    if (i == soft_token.object.num_objs) {
	objs = realloc(soft_token.object.objs,
		       (soft_token.object.num_objs + 1) * sizeof(soft_token.object.objs[0]));
	if (objs == NULL) {
	    free(o);
	    return NULL;
	}
	soft_token.object.objs = objs;
	soft_token.object.objs[soft_token.object.num_objs++] = o;
    }	
    soft_token.object.objs[i]->object_handle =
	(random() & (~OBJECT_ID_MASK)) | i;

    return o;
}

static CK_RV
add_object_attribute(struct st_object *o,
		     int secret,
		     CK_ATTRIBUTE_TYPE type,
		     CK_VOID_PTR pValue,
		     CK_ULONG ulValueLen)
{
    struct st_attr *a;
    int i;

    i = o->num_attributes;
    a = realloc(o->attrs, (i + 1) * sizeof(o->attrs[0]));
    if (a == NULL)
	return CKR_DEVICE_MEMORY;
    o->attrs = a;
    o->attrs[i].secret = secret;
    o->attrs[i].attribute.type = type;
    o->attrs[i].attribute.pValue = malloc(ulValueLen);
    if (o->attrs[i].attribute.pValue == NULL && ulValueLen != 0)
	return CKR_DEVICE_MEMORY;
    memcpy(o->attrs[i].attribute.pValue, pValue, ulValueLen);
    o->attrs[i].attribute.ulValueLen = ulValueLen;
    o->num_attributes++;

    return CKR_OK;
}

static CK_RV
add_pubkey_info(struct st_object *o, CK_KEY_TYPE key_type, EVP_PKEY *key)
{
    switch (key_type) {
    case CKK_RSA: {
	CK_BYTE *modulus = NULL;
	size_t modulus_len = 0;
	CK_ULONG modulus_bits = 0;
	CK_BYTE *exponent = NULL;
	size_t exponent_len = 0;
	RSA* rsa = NULL;
	const BIGNUM *n = NULL, *e = NULL;

	rsa = EVP_PKEY_get0_RSA(key);
	RSA_get0_key(rsa, &n, &e, NULL);

	modulus_bits = BN_num_bits(n);

	modulus_len = BN_num_bytes(n);
	modulus = malloc(modulus_len);
	BN_bn2bin(n, modulus);
	
	exponent_len = BN_num_bytes(e);
	exponent = malloc(exponent_len);
	BN_bn2bin(e, exponent);
	
	add_object_attribute(o, 0, CKA_MODULUS, modulus, modulus_len);
	add_object_attribute(o, 0, CKA_MODULUS_BITS,
			     &modulus_bits, sizeof(modulus_bits));
	add_object_attribute(o, 0, CKA_PUBLIC_EXPONENT,
			     exponent, exponent_len);

	RSA_set_method(rsa, RSA_PKCS1_OpenSSL());

	free(modulus);
	free(exponent);
    }
    default:
	/* XXX */
	break;
    }
    return CKR_OK;
}


static int
pem_callback(char *buf, int num, int w, void *key)
{
    return -1;
}


static CK_RV
add_certificate(char *label,
		const char *cert_file,
		const char *private_key_file,
		char *id,
		int anchor)
{
    struct st_object *o = NULL;
    CK_BBOOL bool_true = CK_TRUE;
    CK_BBOOL bool_false = CK_FALSE;
    CK_OBJECT_CLASS c;
    CK_CERTIFICATE_TYPE cert_type = CKC_X_509;
    CK_KEY_TYPE key_type;
    CK_MECHANISM_TYPE mech_type;
    void *cert_data = NULL;
    size_t cert_length;
    void *subject_data = NULL;
    size_t subject_length;
    void *issuer_data = NULL;
    size_t issuer_length;
    void *serial_data = NULL;
    size_t serial_length;
    CK_RV ret = CKR_GENERAL_ERROR;
    X509 *cert;
    EVP_PKEY *public_key;

    size_t id_len = strlen(id);

    {
	FILE *f;
	
	f = fopen(cert_file, "r");
	if (f == NULL) {
	    st_logf("failed to open file %s\n", cert_file);
	    return CKR_GENERAL_ERROR;
	}

	cert = PEM_read_X509(f, NULL, NULL, NULL);
	fclose(f);
	if (cert == NULL) {
	    st_logf("failed reading PEM cert\n");
	    return CKR_GENERAL_ERROR;
	}

	OPENSSL_ASN1_MALLOC_ENCODE(X509, cert_data, cert_length, cert, ret);
	if (ret)
	    goto out;

	OPENSSL_ASN1_MALLOC_ENCODE(X509_NAME, issuer_data, issuer_length,
				   X509_get_issuer_name(cert), ret);
	if (ret)
	    goto out;

	OPENSSL_ASN1_MALLOC_ENCODE(X509_NAME, subject_data, subject_length,
				   X509_get_subject_name(cert), ret);
	if (ret)
	    goto out;

	OPENSSL_ASN1_MALLOC_ENCODE(ASN1_INTEGER, serial_data, serial_length,
				   X509_get_serialNumber(cert), ret);
	if (ret)
	    goto out;

    }

    st_logf("done parsing, adding to internal structure\n");

    o = add_st_object();
    if (o == NULL) {
	ret = CKR_DEVICE_MEMORY;
	goto out;
    }
    o->type = STO_T_CERTIFICATE;
    o->u.cert = cert;
    public_key = X509_get_pubkey(o->u.cert);

    switch (EVP_PKEY_base_id(public_key)) {
    case EVP_PKEY_RSA:
	key_type = CKK_RSA;
	break;
    case EVP_PKEY_DSA:
	key_type = CKK_DSA;
	break;
    default:
	/* XXX */
	break;
    }

    c = CKO_CERTIFICATE;
    add_object_attribute(o, 0, CKA_CLASS, &c, sizeof(c));
    add_object_attribute(o, 0, CKA_TOKEN, &bool_true, sizeof(bool_true));
    add_object_attribute(o, 0, CKA_PRIVATE, &bool_false, sizeof(bool_false));
    add_object_attribute(o, 0, CKA_MODIFIABLE, &bool_false, sizeof(bool_false));
    add_object_attribute(o, 0, CKA_LABEL, label, strlen(label));

    add_object_attribute(o, 0, CKA_CERTIFICATE_TYPE, &cert_type, sizeof(cert_type));
    add_object_attribute(o, 0, CKA_ID, id, id_len);

    add_object_attribute(o, 0, CKA_SUBJECT, subject_data, subject_length);
    add_object_attribute(o, 0, CKA_ISSUER, issuer_data, issuer_length);
    add_object_attribute(o, 0, CKA_SERIAL_NUMBER, serial_data, serial_length);
    add_object_attribute(o, 0, CKA_VALUE, cert_data, cert_length);
    if (anchor)
	add_object_attribute(o, 0, CKA_TRUSTED, &bool_true, sizeof(bool_true));
    else
	add_object_attribute(o, 0, CKA_TRUSTED, &bool_false, sizeof(bool_false));

    st_logf("add cert ok: %lx\n", (unsigned long)OBJECT_ID(o));

    o = add_st_object();
    if (o == NULL) {
	ret = CKR_DEVICE_MEMORY;
	goto out;
    }
    o->type = STO_T_PUBLIC_KEY;
    o->u.public_key = public_key;

    c = CKO_PUBLIC_KEY;
    add_object_attribute(o, 0, CKA_CLASS, &c, sizeof(c));
    add_object_attribute(o, 0, CKA_TOKEN, &bool_true, sizeof(bool_true));
    add_object_attribute(o, 0, CKA_PRIVATE, &bool_false, sizeof(bool_false));
    add_object_attribute(o, 0, CKA_MODIFIABLE, &bool_false, sizeof(bool_false));
    add_object_attribute(o, 0, CKA_LABEL, label, strlen(label));

    add_object_attribute(o, 0, CKA_KEY_TYPE, &key_type, sizeof(key_type));
    add_object_attribute(o, 0, CKA_ID, id, id_len);
    add_object_attribute(o, 0, CKA_START_DATE, "", 1); /* XXX */
    add_object_attribute(o, 0, CKA_END_DATE, "", 1); /* XXX */
    add_object_attribute(o, 0, CKA_DERIVE, &bool_false, sizeof(bool_false));
    add_object_attribute(o, 0, CKA_LOCAL, &bool_false, sizeof(bool_false));
    mech_type = CKM_RSA_X_509;
    add_object_attribute(o, 0, CKA_KEY_GEN_MECHANISM, &mech_type, sizeof(mech_type));

    add_object_attribute(o, 0, CKA_SUBJECT, subject_data, subject_length);
    add_object_attribute(o, 0, CKA_ENCRYPT, &bool_true, sizeof(bool_true));
    add_object_attribute(o, 0, CKA_VERIFY, &bool_true, sizeof(bool_true));
    add_object_attribute(o, 0, CKA_VERIFY_RECOVER, &bool_false, sizeof(bool_false));
    add_object_attribute(o, 0, CKA_WRAP, &bool_true, sizeof(bool_true));
    add_object_attribute(o, 0, CKA_TRUSTED, &bool_true, sizeof(bool_true));

    add_pubkey_info(o, key_type, public_key);

    st_logf("add key ok: %lx\n", (unsigned long)OBJECT_ID(o));

    if (private_key_file) {
	CK_FLAGS flags;
	FILE *f;

	o = add_st_object();
	if (o == NULL) {
	    ret = CKR_DEVICE_MEMORY;
	    goto out;
	}
	o->type = STO_T_PRIVATE_KEY;
	o->u.private_key.file = strdup(private_key_file);
	o->u.private_key.key = NULL;

	o->u.private_key.cert = cert;

	c = CKO_PRIVATE_KEY;
	add_object_attribute(o, 0, CKA_CLASS, &c, sizeof(c));
	add_object_attribute(o, 0, CKA_TOKEN, &bool_true, sizeof(bool_true));
	add_object_attribute(o, 0, CKA_PRIVATE, &bool_true, sizeof(bool_false));
	add_object_attribute(o, 0, CKA_MODIFIABLE, &bool_false, sizeof(bool_false));
	add_object_attribute(o, 0, CKA_LABEL, label, strlen(label));

	add_object_attribute(o, 0, CKA_KEY_TYPE, &key_type, sizeof(key_type));
	add_object_attribute(o, 0, CKA_ID, id, id_len);
	add_object_attribute(o, 0, CKA_START_DATE, "", 1); /* XXX */
	add_object_attribute(o, 0, CKA_END_DATE, "", 1); /* XXX */
	add_object_attribute(o, 0, CKA_DERIVE, &bool_false, sizeof(bool_false));
	add_object_attribute(o, 0, CKA_LOCAL, &bool_false, sizeof(bool_false));
	mech_type = CKM_RSA_X_509;
	add_object_attribute(o, 0, CKA_KEY_GEN_MECHANISM, &mech_type, sizeof(mech_type));

	add_object_attribute(o, 0, CKA_SUBJECT, subject_data, subject_length);
	add_object_attribute(o, 0, CKA_SENSITIVE, &bool_true, sizeof(bool_true));
	add_object_attribute(o, 0, CKA_SECONDARY_AUTH, &bool_false, sizeof(bool_true));
	flags = 0;
	add_object_attribute(o, 0, CKA_AUTH_PIN_FLAGS, &flags, sizeof(flags));

	add_object_attribute(o, 0, CKA_DECRYPT, &bool_true, sizeof(bool_true));
	add_object_attribute(o, 0, CKA_SIGN, &bool_true, sizeof(bool_true));
	add_object_attribute(o, 0, CKA_SIGN_RECOVER, &bool_false, sizeof(bool_false));
	add_object_attribute(o, 0, CKA_UNWRAP, &bool_true, sizeof(bool_true));
	add_object_attribute(o, 0, CKA_EXTRACTABLE, &bool_true, sizeof(bool_true));
	add_object_attribute(o, 0, CKA_NEVER_EXTRACTABLE, &bool_false, sizeof(bool_false));

	add_pubkey_info(o, key_type, public_key);

	f = fopen(private_key_file, "r");
	if (f == NULL) {
	    st_logf("failed to open private key\n");
	    return CKR_GENERAL_ERROR;
	}

	o->u.private_key.key = PEM_read_PrivateKey(f, NULL, pem_callback, NULL);
	fclose(f);
	if (o->u.private_key.key == NULL) {
	    st_logf("failed to read private key a startup\n");
	    /* don't bother with this failure for now,
	       fix it at C_Login time */;
	} else {
	    /* XXX verify keytype */

	    if (key_type == CKK_RSA) {
		RSA *rsa = EVP_PKEY_get0_RSA(o->u.private_key.key);
		RSA_set_method(rsa, RSA_PKCS1_OpenSSL());
	    }

	    if (X509_check_private_key(cert, o->u.private_key.key) != 1) {
		EVP_PKEY_free(o->u.private_key.key);
		o->u.private_key.key = NULL;
		st_logf("private key doesn't verify\n");
	    } else {
		st_logf("private key usable\n");
		soft_token.flags.login_done = 1;
	    }
	}
    }

    ret = CKR_OK;
 out:
    if (ret != CKR_OK) {
	st_logf("something went wrong when adding cert!\n");

	/* XXX wack o */;
    }
    free(cert_data);
    free(serial_data);
    free(issuer_data);
    free(subject_data);

    return ret;
}

static void
find_object_final(struct session_state *state)
{
    if (state->find.attributes) {
	CK_ULONG i;

	for (i = 0; i < state->find.num_attributes; i++) {
	    if (state->find.attributes[i].pValue)
		free(state->find.attributes[i].pValue);
	}
	free(state->find.attributes);
	state->find.attributes = NULL;
	state->find.num_attributes = 0;
	state->find.next_object = -1;
    }
}

static void
reset_crypto_state(struct session_state *state)
{
    state->encrypt_object = -1;
    if (state->encrypt_mechanism)
	free(state->encrypt_mechanism);
    state->encrypt_mechanism = NULL_PTR;
    state->decrypt_object = -1;
    if (state->decrypt_mechanism)
	free(state->decrypt_mechanism);
    state->decrypt_mechanism = NULL_PTR;
    state->sign_object = -1;
    if (state->sign_mechanism)
	free(state->sign_mechanism);
    state->sign_mechanism = NULL_PTR;
    state->verify_object = -1;
    if (state->verify_mechanism)
	free(state->verify_mechanism);
    state->verify_mechanism = NULL_PTR;
    state->digest_object = -1;
}

static void
close_session(struct session_state *state)
{
    if (state->find.attributes) {
	application_error("application didn't do C_FindObjectsFinal\n");
	find_object_final(state);
    }

    state->session_handle = CK_INVALID_HANDLE;
    soft_token.application = NULL_PTR;
    soft_token.notify = NULL_PTR;
    reset_crypto_state(state);
}

static const char *
has_session(void)
{
    return soft_token.open_sessions > 0 ? "yes" : "no";
}

static void
read_conf_file(const char *fn)
{
    char buf[1024], *cert, *key, *id, *label, *s, *p;
    int anchor;
    FILE *f;

    f = fopen(fn, "r");
    if (f == NULL) {
	st_logf("can't open configuration file %s\n", fn);
	return;
    }

    while(fgets(buf, sizeof(buf), f) != NULL) {
	buf[strcspn(buf, "\n")] = '\0';

	anchor = 0;

	st_logf("line: %s\n", buf);

	p = buf;
	while (isspace(*p))
	    p++;
	if (*p == '#')
	    continue;
	while (isspace(*p))
	    p++;

	s = NULL;
	id = strtok_r(p, "\t", &s);
	if (id == NULL)
	    continue;
	label = strtok_r(NULL, "\t", &s);
	if (label == NULL)
	    continue;
	cert = strtok_r(NULL, "\t", &s);
	if (cert == NULL)
	    continue;
	key = strtok_r(NULL, "\t", &s);

	/* XXX */
	if (strcmp(id, "anchor") == 0) {
	    id = "\x00\x00";
	    anchor = 1;
	}

	st_logf("adding: %s\n", label);

	add_certificate(label, cert, key, id, anchor);
    }
}

static CK_RV
func_not_supported(void)
{
    st_logf("function not supported\n");
    return CKR_FUNCTION_NOT_SUPPORTED;
}

CK_RV
C_Initialize(CK_VOID_PTR a)
{
    CK_C_INITIALIZE_ARGS_PTR args = a;
    st_logf("Initialize\n");
    size_t i;

    OpenSSL_add_all_algorithms();
    ERR_load_crypto_strings();

    srandom(getpid() ^ time(NULL));

    for (i = 0; i < MAX_NUM_SESSION; i++) {
	soft_token.state[i].session_handle = CK_INVALID_HANDLE;
	soft_token.state[i].find.attributes = NULL;
	soft_token.state[i].find.num_attributes = 0;
	soft_token.state[i].find.next_object = -1;
	reset_crypto_state(&soft_token.state[i]);
    }

    soft_token.flags.hardware_slot = 1;
    soft_token.flags.app_error_fatal = 0;
    soft_token.flags.login_done = 0;

    soft_token.object.objs = NULL;
    soft_token.object.num_objs = 0;

    soft_token.logfile = NULL;
#if 1
//     soft_token.logfile = stdout;
#endif
#if 0
    soft_token.logfile = fopen("/tmp/log-pkcs11.txt", "a");
#endif

    if (a != NULL_PTR) {
	st_logf("\tCreateMutex:\t%p\n", args->CreateMutex);
	st_logf("\tDestroyMutext\t%p\n", args->DestroyMutex);
	st_logf("\tLockMutext\t%p\n", args->LockMutex);
	st_logf("\tUnlockMutext\t%p\n", args->UnlockMutex);
	st_logf("\tFlags\t%04x\n", (unsigned int)args->flags);
    }

    {
	char *fn = NULL, *home = NULL;

	if (getuid() == geteuid()) {
	    fn = getenv("SOFTPKCS11RC");
	    if (fn)
		fn = strdup(fn);
	    home = getenv("HOME");
	}
	if (fn == NULL && home == NULL) {
	    struct passwd *pw = getpwuid(getuid());	
	    if(pw != NULL)
		home = pw->pw_dir;
	}
	if (fn == NULL) {
	    if (home)
		asprintf(&fn, "%s/.soft-token.rc", home);
	    else
		fn = strdup("/etc/soft-token.rc");
	}

	read_conf_file(fn);
	free(fn);
    }

    return CKR_OK;
}

CK_RV
C_Finalize(CK_VOID_PTR args)
{
    size_t i;

    st_logf("Finalize\n");

    for (i = 0; i < MAX_NUM_SESSION; i++) {
	if (soft_token.state[i].session_handle != CK_INVALID_HANDLE) {
	    application_error("application finalized without "
			      "closing session\n");
	    close_session(&soft_token.state[i]);
	}
    }

    return CKR_OK;
}

CK_RV
C_GetInfo(CK_INFO_PTR args)
{
    st_logf("GetInfo\n");

    memset(args, 17, sizeof(*args));
    args->cryptokiVersion.major = 2;
    args->cryptokiVersion.minor = 10;
    snprintf_fill((char *)args->manufacturerID,
		  sizeof(args->manufacturerID),
		  ' ',
		  "SoftToken");
    snprintf_fill((char *)args->libraryDescription,
		  sizeof(args->libraryDescription), ' ',
		  "SoftToken");
    args->libraryVersion.major = 1;
    args->libraryVersion.minor = 8;

    return CKR_OK;
}

extern CK_FUNCTION_LIST funcs;

CK_RV
C_GetFunctionList(CK_FUNCTION_LIST_PTR_PTR ppFunctionList)
{
    *ppFunctionList = &funcs;
    return CKR_OK;
}

CK_RV
C_GetSlotList(CK_BBOOL tokenPresent,
	      CK_SLOT_ID_PTR pSlotList,
	      CK_ULONG_PTR   pulCount)
{
    st_logf("GetSlotList: %s\n",
	    tokenPresent ? "tokenPresent" : "token not Present");
    if (pSlotList)
	pSlotList[0] = 1;
    *pulCount = 1;
    return CKR_OK;
}

CK_RV
C_GetSlotInfo(CK_SLOT_ID slotID,
	      CK_SLOT_INFO_PTR pInfo)
{
    st_logf("GetSlotInfo: slot: %d : %s\n", (int)slotID, has_session());

    memset(pInfo, 18, sizeof(*pInfo));

    if (slotID != 1)
	return CKR_ARGUMENTS_BAD;

    snprintf_fill((char *)pInfo->slotDescription,
		  sizeof(pInfo->slotDescription),
		  ' ',
		  "SoftToken (slot)");
    snprintf_fill((char *)pInfo->manufacturerID,
		  sizeof(pInfo->manufacturerID),
		  ' ',
		  "SoftToken (slot)");
    pInfo->flags = CKF_TOKEN_PRESENT;
    if (soft_token.flags.hardware_slot)
	pInfo->flags |= CKF_HW_SLOT;
    pInfo->hardwareVersion.major = 1;
    pInfo->hardwareVersion.minor = 0;
    pInfo->firmwareVersion.major = 1;
    pInfo->firmwareVersion.minor = 0;

    return CKR_OK;
}

CK_RV
C_GetTokenInfo(CK_SLOT_ID slotID,
	       CK_TOKEN_INFO_PTR pInfo)
{
    st_logf("GetTokenInfo: %s\n", has_session());

    memset(pInfo, 19, sizeof(*pInfo));

    snprintf_fill((char *)pInfo->label,
		  sizeof(pInfo->label),
		  ' ',
		  "SoftToken (token)");
    snprintf_fill((char *)pInfo->manufacturerID,
		  sizeof(pInfo->manufacturerID),
		  ' ',
		  "SoftToken (token)");
    snprintf_fill((char *)pInfo->model,
		  sizeof(pInfo->model),
		  ' ',
		  "SoftToken (token)");
    snprintf_fill((char *)pInfo->serialNumber,
		  sizeof(pInfo->serialNumber),
		  ' ',
		  "4711");
    pInfo->flags =
	CKF_TOKEN_INITIALIZED |
	CKF_USER_PIN_INITIALIZED;

    if (soft_token.flags.login_done == 0)
	pInfo->flags |= CKF_LOGIN_REQUIRED;

    /* CFK_RNG |
       CKF_RESTORE_KEY_NOT_NEEDED |
    */
    pInfo->ulMaxSessionCount = MAX_NUM_SESSION;
    pInfo->ulSessionCount = soft_token.open_sessions;
    pInfo->ulMaxRwSessionCount = MAX_NUM_SESSION;
    pInfo->ulRwSessionCount = soft_token.open_sessions;
    pInfo->ulMaxPinLen = 1024;
    pInfo->ulMinPinLen = 0;
    pInfo->ulTotalPublicMemory = 4711;
    pInfo->ulFreePublicMemory = 4712;
    pInfo->ulTotalPrivateMemory = 4713;
    pInfo->ulFreePrivateMemory = 4714;
    pInfo->hardwareVersion.major = 2;
    pInfo->hardwareVersion.minor = 0;
    pInfo->firmwareVersion.major = 2;
    pInfo->firmwareVersion.minor = 0;

    return CKR_OK;
}

CK_RV
C_GetMechanismList(CK_SLOT_ID slotID,
		   CK_MECHANISM_TYPE_PTR pMechanismList,
		   CK_ULONG_PTR pulCount)
{
    st_logf("GetMechanismList\n");

    *pulCount = 2;
    if (pMechanismList == NULL_PTR)
	return CKR_OK;
    pMechanismList[0] = CKM_RSA_X_509;
    pMechanismList[1] = CKM_RSA_PKCS;

    return CKR_OK;
}

CK_RV
C_GetMechanismInfo(CK_SLOT_ID slotID,
		   CK_MECHANISM_TYPE type,
		   CK_MECHANISM_INFO_PTR pInfo)
{
    st_logf("GetMechanismInfo: slot %d type: %d\n",
	    (int)slotID, (int)type);
    return CKR_FUNCTION_NOT_SUPPORTED;
}

CK_RV
C_InitToken(CK_SLOT_ID slotID,
	    CK_UTF8CHAR_PTR pPin,
	    CK_ULONG ulPinLen,
	    CK_UTF8CHAR_PTR pLabel)
{
    st_logf("InitToken: slot %d\n", (int)slotID);
    return CKR_FUNCTION_NOT_SUPPORTED;
}

CK_RV
C_OpenSession(CK_SLOT_ID slotID,
	      CK_FLAGS flags,
	      CK_VOID_PTR pApplication,
	      CK_NOTIFY Notify,
	      CK_SESSION_HANDLE_PTR phSession)
{
    size_t i;

    st_logf("OpenSession: slot: %d\n", (int)slotID);

    if (soft_token.open_sessions == MAX_NUM_SESSION)
	return CKR_SESSION_COUNT;

    soft_token.application = pApplication;
    soft_token.notify = Notify;

    for (i = 0; i < MAX_NUM_SESSION; i++)
	if (soft_token.state[i].session_handle == CK_INVALID_HANDLE)
	    break;
    if (i == MAX_NUM_SESSION)
	abort();

    soft_token.open_sessions++;

    soft_token.state[i].session_handle =
	(CK_SESSION_HANDLE)(random() & 0xfffff);
    *phSession = soft_token.state[i].session_handle;

    return CKR_OK;
}

CK_RV
C_CloseSession(CK_SESSION_HANDLE hSession)
{
    struct session_state *state;
    st_logf("CloseSession\n");

    if (verify_session_handle(hSession, &state) != CKR_OK)
	application_error("closed session not open");
    else
	close_session(state);

    return CKR_OK;
}

CK_RV
C_CloseAllSessions(CK_SLOT_ID slotID)
{
    size_t i;

    st_logf("CloseAllSessions\n");

    for (i = 0; i < MAX_NUM_SESSION; i++)
	if (soft_token.state[i].session_handle != CK_INVALID_HANDLE)
	    close_session(&soft_token.state[i]);

    return CKR_OK;
}

CK_RV
C_GetSessionInfo(CK_SESSION_HANDLE hSession,
		 CK_SESSION_INFO_PTR pInfo)
{
    st_logf("GetSessionInfo\n");

    VERIFY_SESSION_HANDLE(hSession, NULL);

    memset(pInfo, 20, sizeof(*pInfo));

    pInfo->slotID = 1;
    if (soft_token.flags.login_done)
	pInfo->state = CKS_RO_USER_FUNCTIONS;
    else
	pInfo->state = CKS_RO_PUBLIC_SESSION;
    pInfo->flags = CKF_SERIAL_SESSION;
    pInfo->ulDeviceError = 0;

    return CKR_OK;
}

CK_RV
C_Login(CK_SESSION_HANDLE hSession,
	CK_USER_TYPE userType,
	CK_UTF8CHAR_PTR pPin,
	CK_ULONG ulPinLen)
{
    char *pin = NULL;
    int i;

    st_logf("Login\n");

    VERIFY_SESSION_HANDLE(hSession, NULL);

    if (pPin != NULL_PTR) {
	asprintf(&pin, "%.*s", (int)ulPinLen, pPin);
	st_logf("type: %d password: %s\n", (int)userType, pin);
    }

    for (i = 0; i < soft_token.object.num_objs; i++) {
	struct st_object *o = soft_token.object.objs[i];
	FILE *f;

	if (o->type != STO_T_PRIVATE_KEY)
	    continue;

	if (o->u.private_key.key)
	    continue;

	f = fopen(o->u.private_key.file, "r");
	if (f == NULL) {
	    st_logf("can't open private file: %s\n", o->u.private_key.file);
	    continue;
	}
	
	o->u.private_key.key = PEM_read_PrivateKey(f, NULL, NULL, pin);
	fclose(f);
	if (o->u.private_key.key == NULL) {
	    st_logf("failed to read key: %s error: %s\n",
		    o->u.private_key.file,
		    ERR_error_string(ERR_get_error(), NULL));
	    /* just ignore failure */;
	    continue;
	}

	/* XXX check keytype */
	RSA *rsa = EVP_PKEY_get0_RSA(o->u.private_key.key);
	RSA_set_method(rsa, RSA_PKCS1_OpenSSL());

	if (X509_check_private_key(o->u.private_key.cert, o->u.private_key.key) != 1) {
	    EVP_PKEY_free(o->u.private_key.key);
	    o->u.private_key.key = NULL;
	    st_logf("private key %s doesn't verify\n", o->u.private_key.file);
	    continue;
	}

	soft_token.flags.login_done = 1;
    }
    free(pin);

    return soft_token.flags.login_done ? CKR_OK : CKR_PIN_INCORRECT;
}

CK_RV
C_Logout(CK_SESSION_HANDLE hSession)
{
    st_logf("Logout\n");
    VERIFY_SESSION_HANDLE(hSession, NULL);
    return CKR_FUNCTION_NOT_SUPPORTED;
}

CK_RV
C_GetObjectSize(CK_SESSION_HANDLE hSession,
		CK_OBJECT_HANDLE hObject,
		CK_ULONG_PTR pulSize)
{
    st_logf("GetObjectSize\n");
    VERIFY_SESSION_HANDLE(hSession, NULL);
    return CKR_FUNCTION_NOT_SUPPORTED;
}

CK_RV
C_GetAttributeValue(CK_SESSION_HANDLE hSession,
		    CK_OBJECT_HANDLE hObject,
		    CK_ATTRIBUTE_PTR pTemplate,
		    CK_ULONG ulCount)
{
    struct session_state *state;
    struct st_object *obj;
    CK_ULONG i;
    CK_RV ret;
    int j;

    st_logf("GetAttributeValue: %lx\n",
	    (unsigned long)HANDLE_OBJECT_ID(hObject));
    VERIFY_SESSION_HANDLE(hSession, &state);

    if ((ret = object_handle_to_object(hObject, &obj)) != CKR_OK) {
	st_logf("object not found: %lx\n",
		(unsigned long)HANDLE_OBJECT_ID(hObject));
	return ret;
    }

    ret = CKR_OK;
    for (i = 0; i < ulCount; i++) {
	st_logf("	getting 0x%08lx\n", (unsigned long)pTemplate[i].type);
	for (j = 0; j < obj->num_attributes; j++) {
	    if (obj->attrs[j].secret) {
		pTemplate[i].ulValueLen = (CK_ULONG)-1;
		break;
	    }
	    if (pTemplate[i].type == obj->attrs[j].attribute.type) {
		if (pTemplate[i].pValue != NULL_PTR && obj->attrs[j].secret == 0) {
		    if (pTemplate[i].ulValueLen >= obj->attrs[j].attribute.ulValueLen)
			memcpy(pTemplate[i].pValue, obj->attrs[j].attribute.pValue,
			       obj->attrs[j].attribute.ulValueLen);
		}
		pTemplate[i].ulValueLen = obj->attrs[j].attribute.ulValueLen;
		break;
	    }
	}
	if (j == obj->num_attributes) {
	    st_logf("key type: 0x%08lx not found\n", (unsigned long)pTemplate[i].type);
	    pTemplate[i].ulValueLen = (CK_ULONG)-1;
            ret = CKR_ATTRIBUTE_TYPE_INVALID;
	}

    }
    return ret;
}

CK_RV
C_FindObjectsInit(CK_SESSION_HANDLE hSession,
		  CK_ATTRIBUTE_PTR pTemplate,
		  CK_ULONG ulCount)
{
    struct session_state *state;

    st_logf("FindObjectsInit\n");

    VERIFY_SESSION_HANDLE(hSession, &state);

    if (state->find.next_object != -1) {
	application_error("application didn't do C_FindObjectsFinal\n");
	find_object_final(state);
    }
    if (ulCount) {
	CK_ULONG i;

	print_attributes(pTemplate, ulCount);

	state->find.attributes =
	    calloc(1, ulCount * sizeof(state->find.attributes[0]));
	if (state->find.attributes == NULL)
	    return CKR_DEVICE_MEMORY;
	for (i = 0; i < ulCount; i++) {
	    state->find.attributes[i].pValue =
		malloc(pTemplate[i].ulValueLen);
	    if (state->find.attributes[i].pValue == NULL) {
		find_object_final(state);
		return CKR_DEVICE_MEMORY;
	    }
	    memcpy(state->find.attributes[i].pValue,
		   pTemplate[i].pValue, pTemplate[i].ulValueLen);
	    state->find.attributes[i].type = pTemplate[i].type;
	    state->find.attributes[i].ulValueLen = pTemplate[i].ulValueLen;
	}
	state->find.num_attributes = ulCount;
	state->find.next_object = 0;
    } else {
	st_logf("find all objects\n");
	state->find.attributes = NULL;
	state->find.num_attributes = 0;
	state->find.next_object = 0;
    }

    return CKR_OK;
}

CK_RV
C_FindObjects(CK_SESSION_HANDLE hSession,
	      CK_OBJECT_HANDLE_PTR phObject,
	      CK_ULONG ulMaxObjectCount,
	      CK_ULONG_PTR pulObjectCount)
{
    struct session_state *state;
    int i;

    st_logf("FindObjects\n");

    VERIFY_SESSION_HANDLE(hSession, &state);

    if (state->find.next_object == -1) {
	application_error("application didn't do C_FindObjectsInit\n");
	return CKR_ARGUMENTS_BAD;
    }
    if (ulMaxObjectCount == 0) {
	application_error("application asked for 0 objects\n");
	return CKR_ARGUMENTS_BAD;
    }
    *pulObjectCount = 0;
    for (i = state->find.next_object; i < soft_token.object.num_objs; i++) {
	st_logf("FindObjects: %d\n", i);
	state->find.next_object = i + 1;
	if (attributes_match(soft_token.object.objs[i],
			     state->find.attributes,
			     state->find.num_attributes)) {
	    *phObject++ = soft_token.object.objs[i]->object_handle;
	    ulMaxObjectCount--;
	    (*pulObjectCount)++;
	    if (ulMaxObjectCount == 0)
		break;
	}
    }
    return CKR_OK;
}

CK_RV
C_FindObjectsFinal(CK_SESSION_HANDLE hSession)
{
    struct session_state *state;

    st_logf("FindObjectsFinal\n");
    VERIFY_SESSION_HANDLE(hSession, &state);
    find_object_final(state);
    return CKR_OK;
}

static CK_RV
commonInit(CK_ATTRIBUTE *attr_match, int attr_match_len,
	   const CK_MECHANISM_TYPE *mechs, int mechs_len,
	   const CK_MECHANISM_PTR pMechanism, CK_OBJECT_HANDLE hKey,
	   struct st_object **o)
{
    CK_RV ret;
    int i;

    *o = NULL;
    if ((ret = object_handle_to_object(hKey, o)) != CKR_OK)
	return ret;

    ret = attributes_match(*o, attr_match, attr_match_len);
    if (!ret) {
	application_error("called commonInit on key that doesn't "
			  "support required attr");
	return CKR_ARGUMENTS_BAD;
    }

    for (i = 0; i < mechs_len; i++)
	if (mechs[i] == pMechanism->mechanism)
	    break;
    if (i == mechs_len) {
	application_error("called mech (%08lx) not supported\n",
			  pMechanism->mechanism);
	return CKR_ARGUMENTS_BAD;
    }
    return CKR_OK;
}


static CK_RV
dup_mechanism(CK_MECHANISM_PTR *dup, const CK_MECHANISM_PTR pMechanism)
{
    CK_MECHANISM_PTR p;

    p = malloc(sizeof(*p));
    if (p == NULL)
	return CKR_DEVICE_MEMORY;

    if (*dup)
	free(*dup);
    *dup = p;
    memcpy(p, pMechanism, sizeof(*p));

    return CKR_OK;
}


CK_RV
C_EncryptInit(CK_SESSION_HANDLE hSession,
	      CK_MECHANISM_PTR pMechanism,
	      CK_OBJECT_HANDLE hKey)
{
    struct session_state *state;
    CK_MECHANISM_TYPE mechs[] = { CKM_RSA_PKCS, CKM_RSA_X_509 };
    CK_BBOOL bool_true = CK_TRUE;
    CK_ATTRIBUTE attr[] = {
	{ CKA_ENCRYPT, &bool_true, sizeof(bool_true) }
    };
    struct st_object *o;
    CK_RV ret;

    st_logf("EncryptInit\n");
    VERIFY_SESSION_HANDLE(hSession, &state);

    ret = commonInit(attr, sizeof(attr)/sizeof(attr[0]),
		     mechs, sizeof(mechs)/sizeof(mechs[0]),
		     pMechanism, hKey, &o);
    if (ret)
	return ret;

    ret = dup_mechanism(&state->encrypt_mechanism, pMechanism);
    if (ret == CKR_OK)
	state->encrypt_object = OBJECT_ID(o);
			
    return ret;
}

CK_RV
C_Encrypt(CK_SESSION_HANDLE hSession,
	  CK_BYTE_PTR pData,
	  CK_ULONG ulDataLen,
	  CK_BYTE_PTR pEncryptedData,
	  CK_ULONG_PTR pulEncryptedDataLen)
{
    struct session_state *state;
    struct st_object *o;
    void *buffer = NULL;
    CK_RV ret;
    RSA *rsa;
    int padding, len, buffer_len, padding_len;

    st_logf("Encrypt\n");

    VERIFY_SESSION_HANDLE(hSession, &state);

    if (state->encrypt_object == -1)
	return CKR_ARGUMENTS_BAD;

    o = soft_token.object.objs[state->encrypt_object];

    if (o->u.public_key == NULL) {
	st_logf("public key NULL\n");
	return CKR_ARGUMENTS_BAD;
    }

    rsa = EVP_PKEY_get0_RSA(o->u.public_key);
    if (rsa == NULL)
	return CKR_ARGUMENTS_BAD;

    RSA_blinding_off(rsa); /* XXX RAND is broken while running in mozilla ? */

    buffer_len = RSA_size(rsa);

    buffer = malloc(buffer_len);
    if (buffer == NULL) {
	ret = CKR_DEVICE_MEMORY;
	goto out;
    }

    ret = CKR_OK;
    switch(state->encrypt_mechanism->mechanism) {
    case CKM_RSA_PKCS:
	padding = RSA_PKCS1_PADDING;
	padding_len = RSA_PKCS1_PADDING_SIZE;
	break;
    case CKM_RSA_X_509:
	padding = RSA_NO_PADDING;
	padding_len = 0;
	break;
    default:
	ret = CKR_FUNCTION_NOT_SUPPORTED;
	goto out;
    }

    if (buffer_len + padding_len < (long) ulDataLen) {
	ret = CKR_ARGUMENTS_BAD;
	goto out;
    }

    if (pulEncryptedDataLen == NULL) {
	st_logf("pulEncryptedDataLen NULL\n");
	ret = CKR_ARGUMENTS_BAD;
	goto out;
    }

    if (pData == NULL_PTR) {
	st_logf("data NULL\n");
	ret = CKR_ARGUMENTS_BAD;
	goto out;
    }

    len = RSA_public_encrypt(ulDataLen, pData, buffer, rsa, padding);
    if (len <= 0) {
	ret = CKR_DEVICE_ERROR;
	goto out;
    }
    if (len > buffer_len)
	abort();
	
    if (pEncryptedData != NULL_PTR)
	memcpy(pEncryptedData, buffer, len);
    *pulEncryptedDataLen = len;

 out:
    if (buffer) {
	memset(buffer, 0, buffer_len);
	free(buffer);
    }
    return ret;
}

CK_RV
C_EncryptUpdate(CK_SESSION_HANDLE hSession,
		CK_BYTE_PTR pPart,
		CK_ULONG ulPartLen,
		CK_BYTE_PTR pEncryptedPart,
		CK_ULONG_PTR pulEncryptedPartLen)
{
    st_logf("EncryptUpdate\n");
    VERIFY_SESSION_HANDLE(hSession, NULL);
    return CKR_FUNCTION_NOT_SUPPORTED;
}


CK_RV
C_EncryptFinal(CK_SESSION_HANDLE hSession,
	       CK_BYTE_PTR pLastEncryptedPart,
	       CK_ULONG_PTR pulLastEncryptedPartLen)
{
    st_logf("EncryptFinal\n");
    VERIFY_SESSION_HANDLE(hSession, NULL);
    return CKR_FUNCTION_NOT_SUPPORTED;
}


/* C_DecryptInit initializes a decryption operation. */
CK_RV
C_DecryptInit(CK_SESSION_HANDLE hSession,
	      CK_MECHANISM_PTR pMechanism,
	      CK_OBJECT_HANDLE hKey)
{
    struct session_state *state;
    CK_MECHANISM_TYPE mechs[] = { CKM_RSA_PKCS, CKM_RSA_X_509 };
    CK_BBOOL bool_true = CK_TRUE;
    CK_ATTRIBUTE attr[] = {
	{ CKA_DECRYPT, &bool_true, sizeof(bool_true) }
    };
    struct st_object *o;
    CK_RV ret;

    st_logf("DecryptInit\n");
    VERIFY_SESSION_HANDLE(hSession, &state);

    ret = commonInit(attr, sizeof(attr)/sizeof(attr[0]),
		     mechs, sizeof(mechs)/sizeof(mechs[0]),
		     pMechanism, hKey, &o);
    if (ret)
	return ret;

    ret = dup_mechanism(&state->decrypt_mechanism, pMechanism);
    if (ret == CKR_OK)
	state->decrypt_object = OBJECT_ID(o);

    return CKR_OK;
}


CK_RV
C_Decrypt(CK_SESSION_HANDLE hSession,
	  CK_BYTE_PTR       pEncryptedData,
	  CK_ULONG          ulEncryptedDataLen,
	  CK_BYTE_PTR       pData,
	  CK_ULONG_PTR      pulDataLen)
{
    struct session_state *state;
    struct st_object *o;
    void *buffer = NULL;
    CK_RV ret;
    RSA *rsa;
    int padding, len, buffer_len, padding_len;

    st_logf("Decrypt\n");

    VERIFY_SESSION_HANDLE(hSession, &state);

    if (state->decrypt_object == -1)
	return CKR_ARGUMENTS_BAD;

    o = soft_token.object.objs[state->decrypt_object];

    if (o->u.private_key.key == NULL) {
	st_logf("private key NULL\n");
	return CKR_ARGUMENTS_BAD;
    }

    rsa = EVP_PKEY_get0_RSA(o->u.private_key.key);
    if (rsa == NULL)
	return CKR_ARGUMENTS_BAD;

    RSA_blinding_off(rsa); /* XXX RAND is broken while running in mozilla ? */

    buffer_len = RSA_size(rsa);

    buffer = malloc(buffer_len);
    if (buffer == NULL) {
	ret = CKR_DEVICE_MEMORY;
	goto out;
    }

    ret = CKR_OK;
    switch(state->decrypt_mechanism->mechanism) {
    case CKM_RSA_PKCS:
	padding = RSA_PKCS1_PADDING;
	padding_len = RSA_PKCS1_PADDING_SIZE;
	break;
    case CKM_RSA_X_509:
	padding = RSA_NO_PADDING;
	padding_len = 0;
	break;
    default:
	ret = CKR_FUNCTION_NOT_SUPPORTED;
	goto out;
    }

    if (buffer_len + padding_len < (long) ulEncryptedDataLen) {
	ret = CKR_ARGUMENTS_BAD;
	goto out;
    }

    if (pulDataLen == NULL) {
	st_logf("pulDataLen NULL\n");
	ret = CKR_ARGUMENTS_BAD;
	goto out;
    }

    if (pEncryptedData == NULL_PTR) {
	st_logf("data NULL\n");
	ret = CKR_ARGUMENTS_BAD;
	goto out;
    }

    len = RSA_private_decrypt(ulEncryptedDataLen, pEncryptedData, buffer,
			      rsa, padding);
    if (len <= 0) {
	ret = CKR_DEVICE_ERROR;
	goto out;
    }
    if (len > buffer_len)
	abort();
	
    if (pData != NULL_PTR)
	memcpy(pData, buffer, len);
    *pulDataLen = len;

 out:
    if (buffer) {
	memset(buffer, 0, buffer_len);
	free(buffer);
    }
    return ret;
}


CK_RV
C_DecryptUpdate(CK_SESSION_HANDLE hSession,
		CK_BYTE_PTR pEncryptedPart,
		CK_ULONG ulEncryptedPartLen,
		CK_BYTE_PTR pPart,
		CK_ULONG_PTR pulPartLen)

{
    st_logf("DecryptUpdate\n");
    VERIFY_SESSION_HANDLE(hSession, NULL);
    return CKR_FUNCTION_NOT_SUPPORTED;
}


CK_RV
C_DecryptFinal(CK_SESSION_HANDLE hSession,
	       CK_BYTE_PTR pLastPart,
	       CK_ULONG_PTR pulLastPartLen)
{
    st_logf("DecryptFinal\n");
    VERIFY_SESSION_HANDLE(hSession, NULL);
    return CKR_FUNCTION_NOT_SUPPORTED;
}

CK_RV
C_DigestInit(CK_SESSION_HANDLE hSession,
	     CK_MECHANISM_PTR pMechanism)
{
    st_logf("DigestInit\n");
    VERIFY_SESSION_HANDLE(hSession, NULL);
    return CKR_FUNCTION_NOT_SUPPORTED;
}

CK_RV
C_SignInit(CK_SESSION_HANDLE hSession,
	   CK_MECHANISM_PTR pMechanism,
	   CK_OBJECT_HANDLE hKey)
{
    struct session_state *state;
    CK_MECHANISM_TYPE mechs[] = { CKM_RSA_PKCS, CKM_RSA_X_509 };
    CK_BBOOL bool_true = CK_TRUE;
    CK_ATTRIBUTE attr[] = {
	{ CKA_SIGN, &bool_true, sizeof(bool_true) }
    };
    struct st_object *o;
    CK_RV ret;

    st_logf("SignInit\n");
    VERIFY_SESSION_HANDLE(hSession, &state);

    ret = commonInit(attr, sizeof(attr)/sizeof(attr[0]),
		     mechs, sizeof(mechs)/sizeof(mechs[0]),
		     pMechanism, hKey, &o);
    if (ret)
	return ret;

    ret = dup_mechanism(&state->sign_mechanism, pMechanism);
    if (ret == CKR_OK)
	state->sign_object = OBJECT_ID(o);

    return CKR_OK;
}

CK_RV
C_Sign(CK_SESSION_HANDLE hSession,
       CK_BYTE_PTR pData,
       CK_ULONG ulDataLen,
       CK_BYTE_PTR pSignature,
       CK_ULONG_PTR pulSignatureLen)
{
    struct session_state *state;
    struct st_object *o;
    void *buffer = NULL;
    CK_RV ret;
    RSA *rsa;
    int padding, len, buffer_len;
    size_t padding_len;

    st_logf("Sign\n");
    VERIFY_SESSION_HANDLE(hSession, &state);

    if (state->sign_object == -1)
	return CKR_ARGUMENTS_BAD;

    o = soft_token.object.objs[state->sign_object];

    if (o->u.private_key.key == NULL) {
	st_logf("private key NULL\n");
	return CKR_ARGUMENTS_BAD;
    }

    rsa = EVP_PKEY_get0_RSA(o->u.private_key.key);
    if (rsa == NULL)
	return CKR_ARGUMENTS_BAD;

    RSA_blinding_off(rsa); /* XXX RAND is broken while running in mozilla ? */

    buffer_len = RSA_size(rsa);

    buffer = malloc(buffer_len);
    if (buffer == NULL) {
	ret = CKR_DEVICE_MEMORY;
	goto out;
    }

    switch(state->sign_mechanism->mechanism) {
    case CKM_RSA_PKCS:
	padding = RSA_PKCS1_PADDING;
	padding_len = RSA_PKCS1_PADDING_SIZE;
	break;
    case CKM_RSA_X_509:
	padding = RSA_NO_PADDING;
	padding_len = 0;
	break;
    default:
	ret = CKR_FUNCTION_NOT_SUPPORTED;
	goto out;
    }

    if ((size_t) buffer_len < ulDataLen + padding_len) {
	ret = CKR_ARGUMENTS_BAD;
	goto out;
    }

    if (pulSignatureLen == NULL) {
	st_logf("signature len NULL\n");
	ret = CKR_ARGUMENTS_BAD;
	goto out;
    }

    if (pData == NULL_PTR) {
	st_logf("data NULL\n");
	ret = CKR_ARGUMENTS_BAD;
	goto out;
    }

    len = RSA_private_encrypt(ulDataLen, pData, buffer, rsa, padding);
    st_logf("private encrypt done\n");
    if (len <= 0) {
	ret = CKR_DEVICE_ERROR;
	goto out;
    }
    if (len > buffer_len)
	abort();
	
    if (pSignature != NULL_PTR)
	memcpy(pSignature, buffer, len);
    *pulSignatureLen = len;

    ret = CKR_OK;

 out:
    if (buffer) {
	memset(buffer, 0, buffer_len);
	free(buffer);
    }
    return ret;
}

CK_RV
C_SignUpdate(CK_SESSION_HANDLE hSession,
	     CK_BYTE_PTR pPart,
	     CK_ULONG ulPartLen)
{
    st_logf("SignUpdate\n");
    VERIFY_SESSION_HANDLE(hSession, NULL);
    return CKR_FUNCTION_NOT_SUPPORTED;
}


CK_RV
C_SignFinal(CK_SESSION_HANDLE hSession,
	    CK_BYTE_PTR pSignature,
	    CK_ULONG_PTR pulSignatureLen)
{
    st_logf("SignUpdate\n");
    VERIFY_SESSION_HANDLE(hSession, NULL);
    return CKR_FUNCTION_NOT_SUPPORTED;
}

CK_RV
C_VerifyInit(CK_SESSION_HANDLE hSession,
	     CK_MECHANISM_PTR pMechanism,
	     CK_OBJECT_HANDLE hKey)
{
    struct session_state *state;
    CK_MECHANISM_TYPE mechs[] = { CKM_RSA_PKCS, CKM_RSA_X_509 };
    CK_BBOOL bool_true = CK_TRUE;
    CK_ATTRIBUTE attr[] = {
	{ CKA_VERIFY, &bool_true, sizeof(bool_true) }
    };
    struct st_object *o;
    CK_RV ret;

    st_logf("VerifyInit\n");
    VERIFY_SESSION_HANDLE(hSession, &state);

    ret = commonInit(attr, sizeof(attr)/sizeof(attr[0]),
		     mechs, sizeof(mechs)/sizeof(mechs[0]),
		     pMechanism, hKey, &o);
    if (ret)
	return ret;

    ret = dup_mechanism(&state->verify_mechanism, pMechanism);
    if (ret == CKR_OK)
	state->verify_object = OBJECT_ID(o);
			
    return ret;
}

CK_RV
C_Verify(CK_SESSION_HANDLE hSession,
	 CK_BYTE_PTR pData,
	 CK_ULONG ulDataLen,
	 CK_BYTE_PTR pSignature,
	 CK_ULONG ulSignatureLen)
{
    struct session_state *state;
    struct st_object *o;
    void *buffer = NULL;
    CK_RV ret;
    RSA *rsa;
    int padding, len, buffer_len;

    st_logf("Verify\n");
    VERIFY_SESSION_HANDLE(hSession, &state);

    if (state->verify_object == -1)
	return CKR_ARGUMENTS_BAD;

    o = soft_token.object.objs[state->verify_object];

    if (o->u.public_key == NULL) {
	st_logf("public key NULL\n");
	return CKR_ARGUMENTS_BAD;
    }

    rsa = EVP_PKEY_get0_RSA(o->u.public_key);
    if (rsa == NULL)
	return CKR_ARGUMENTS_BAD;

    RSA_blinding_off(rsa); /* XXX RAND is broken while running in mozilla ? */

    buffer_len = RSA_size(rsa);

    buffer = malloc(buffer_len);
    if (buffer == NULL) {
	ret = CKR_DEVICE_MEMORY;
	goto out;
    }

    ret = CKR_OK;
    switch(state->verify_mechanism->mechanism) {
    case CKM_RSA_PKCS:
	padding = RSA_PKCS1_PADDING;
	break;
    case CKM_RSA_X_509:
	padding = RSA_NO_PADDING;
	break;
    default:
	ret = CKR_FUNCTION_NOT_SUPPORTED;
	goto out;
    }

    if (buffer_len < (long) ulDataLen) {
	ret = CKR_ARGUMENTS_BAD;
	goto out;
    }

    if (pSignature == NULL) {
	st_logf("signature NULL\n");
	ret = CKR_ARGUMENTS_BAD;
	goto out;
    }

    if (pData == NULL_PTR) {
	st_logf("data NULL\n");
	ret = CKR_ARGUMENTS_BAD;
	goto out;
    }

    len = RSA_public_decrypt(ulDataLen, pData, buffer, rsa, padding);
    st_logf("private encrypt done\n");
    if (len <= 0) {
	ret = CKR_DEVICE_ERROR;
	goto out;
    }
    if (len > buffer_len)
	abort();
	
    if ((size_t) len != ulSignatureLen) {
	ret = CKR_GENERAL_ERROR;
	goto out;
    }
	
    if (memcmp(pSignature, buffer, len) != 0) {
	ret = CKR_GENERAL_ERROR;
	goto out;
    }

 out:
    if (buffer) {
	memset(buffer, 0, buffer_len);
	free(buffer);
    }
    return ret;
}


CK_RV
C_VerifyUpdate(CK_SESSION_HANDLE hSession,
	       CK_BYTE_PTR pPart,
	       CK_ULONG ulPartLen)
{
    st_logf("VerifyUpdate\n");
    VERIFY_SESSION_HANDLE(hSession, NULL);
    return CKR_FUNCTION_NOT_SUPPORTED;
}

CK_RV
C_VerifyFinal(CK_SESSION_HANDLE hSession,
	      CK_BYTE_PTR pSignature,
	      CK_ULONG ulSignatureLen)
{
    st_logf("VerifyFinal\n");
    VERIFY_SESSION_HANDLE(hSession, NULL);
    return CKR_FUNCTION_NOT_SUPPORTED;
}

CK_RV
C_GenerateRandom(CK_SESSION_HANDLE hSession,
		 CK_BYTE_PTR RandomData,
		 CK_ULONG ulRandomLen)
{
    st_logf("GenerateRandom\n");
    VERIFY_SESSION_HANDLE(hSession, NULL);
    return CKR_FUNCTION_NOT_SUPPORTED;
}


CK_FUNCTION_LIST funcs = {
    { 2, 11 },
    C_Initialize,
    C_Finalize,
    C_GetInfo,
    C_GetFunctionList,
    C_GetSlotList,
    C_GetSlotInfo,
    C_GetTokenInfo,
    C_GetMechanismList,
    C_GetMechanismInfo,
    C_InitToken,
    (void *)func_not_supported, /* C_InitPIN */
    (void *)func_not_supported, /* C_SetPIN */
    C_OpenSession,
    C_CloseSession,
    C_CloseAllSessions,
    C_GetSessionInfo,
    (void *)func_not_supported, /* C_GetOperationState */
    (void *)func_not_supported, /* C_SetOperationState */
    C_Login,
    C_Logout,
    (void *)func_not_supported, /* C_CreateObject */
    (void *)func_not_supported, /* C_CopyObject */
    (void *)func_not_supported, /* C_DestroyObject */
    (void *)func_not_supported, /* C_GetObjectSize */
    C_GetAttributeValue,
    (void *)func_not_supported, /* C_SetAttributeValue */
    C_FindObjectsInit,
    C_FindObjects,
    C_FindObjectsFinal,
    C_EncryptInit,
    C_Encrypt,
    C_EncryptUpdate,
    C_EncryptFinal,
    C_DecryptInit,
    C_Decrypt,
    C_DecryptUpdate,
    C_DecryptFinal,
    C_DigestInit,
    (void *)func_not_supported, /* C_Digest */
    (void *)func_not_supported, /* C_DigestUpdate */
    (void *)func_not_supported, /* C_DigestKey */
    (void *)func_not_supported, /* C_DigestFinal */
    C_SignInit,
    C_Sign,
    C_SignUpdate,
    C_SignFinal,
    (void *)func_not_supported, /* C_SignRecoverInit */
    (void *)func_not_supported, /* C_SignRecover */
    C_VerifyInit,
    C_Verify,
    C_VerifyUpdate,
    C_VerifyFinal,
    (void *)func_not_supported, /* C_VerifyRecoverInit */
    (void *)func_not_supported, /* C_VerifyRecover */
    (void *)func_not_supported, /* C_DigestEncryptUpdate */
    (void *)func_not_supported, /* C_DecryptDigestUpdate */
    (void *)func_not_supported, /* C_SignEncryptUpdate */
    (void *)func_not_supported, /* C_DecryptVerifyUpdate */
    (void *)func_not_supported, /* C_GenerateKey */
    (void *)func_not_supported, /* C_GenerateKeyPair */
    (void *)func_not_supported, /* C_WrapKey */
    (void *)func_not_supported, /* C_UnwrapKey */
    (void *)func_not_supported, /* C_DeriveKey */
    (void *)func_not_supported, /* C_SeedRandom */
    C_GenerateRandom,
    (void *)func_not_supported, /* C_GetFunctionStatus */
    (void *)func_not_supported, /* C_CancelFunction */
    (void *)func_not_supported  /* C_WaitForSlotEvent */
};

Lines 1-6 Link Here

(-)a/regress/unittests/Makefile (-1 / +1 lines)
1	# $OpenBSD: Makefile,v 1.9 2017/03/14 01:20:29 dtucker Exp $	1	# $OpenBSD: Makefile,v 1.9 2017/03/14 01:20:29 dtucker Exp $
2		2
3	REGRESS_FAIL_EARLY?= yes	3	REGRESS_FAIL_EARLY?= yes
4	SUBDIR= test_helper sshbuf sshkey bitmap kex hostkeys utf8 match conversion	4	SUBDIR= test_helper sshbuf sshkey bitmap kex hostkeys utf8 match conversion pkcs11
5		5
6	.include <bsd.subdir.mk>	6	.include <bsd.subdir.mk>

Line 0 Link Here

(-)a/regress/unittests/pkcs11/Makefile (+9 lines)
	1
	2	PROG=test_pkcs11
	3	SRCS=tests.c
	4	REGRESS_TARGETS=run-regress-${PROG}
	5
	6	run-regress-${PROG}: ${PROG}
	7	env ${TEST_ENV} ./${PROG}
	8
	9	.include <bsd.regress.mk>




/*
 * Copyright (c) 2017 Red Hat
 *
 * Authors: Jakub Jelen <jjelen@redhat.com>
 *
 * Permission to use, copy, modify, and distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 */

#include "includes.h"

#include <locale.h>
#include <string.h>

#include "../test_helper/test_helper.h"

#include "ssh-pkcs11-uri.h"

#define EMPTY_URI compose_uri(NULL, 0, NULL, NULL, NULL, NULL, NULL)

/* prototypes are not public -- specify them here internally for tests */
struct sshbuf *percent_encode(const char *, size_t, char *);
int percent_decode(char *, char **);

void
compare_uri(struct pkcs11_uri *a, struct pkcs11_uri *b)
{
	ASSERT_PTR_NE(a, NULL);
	ASSERT_PTR_NE(b, NULL);
	ASSERT_SIZE_T_EQ(a->id_len, b->id_len);
	ASSERT_MEM_EQ(a->id, b->id, a->id_len);
	if (b->object != NULL)
		ASSERT_STRING_EQ(a->object, b->object);
	else /* both should be null */
		ASSERT_PTR_EQ(a->object, b->object);
	if (b->module_path != NULL)
		ASSERT_STRING_EQ(a->module_path, b->module_path);
	else /* both should be null */
		ASSERT_PTR_EQ(a->module_path, b->module_path);
	if (b->token != NULL)
		ASSERT_STRING_EQ(a->token, b->token);
	else /* both should be null */
		ASSERT_PTR_EQ(a->token, b->token);
	if (b->manuf != NULL)
		ASSERT_STRING_EQ(a->manuf, b->manuf);
	else /* both should be null */
		ASSERT_PTR_EQ(a->manuf, b->manuf);
	if (b->lib_manuf != NULL)
		ASSERT_STRING_EQ(a->lib_manuf, b->lib_manuf);
	else /* both should be null */
		ASSERT_PTR_EQ(a->lib_manuf, b->lib_manuf);
}

void
check_parse_rv(char *uri, struct pkcs11_uri *expect, int expect_rv)
{
	char *buf = NULL, *str;
	struct pkcs11_uri *pkcs11uri = NULL;
	int rv;

	if (expect_rv == 0)
		str = "Valid";
	else
		str = "Invalid";
	asprintf(&buf, "%s PKCS#11 URI parsing: %s", str, uri);
	TEST_START(buf);
	free(buf);
	pkcs11uri = pkcs11_uri_init();
	rv = pkcs11_uri_parse(uri, pkcs11uri);
	ASSERT_INT_EQ(rv, expect_rv);
	if (rv == 0) /* in case of failure result is undefined */
		compare_uri(pkcs11uri, expect);
	pkcs11_uri_cleanup(pkcs11uri);
	free(expect);
	TEST_DONE();
}

void
check_parse(char *uri, struct pkcs11_uri *expect)
{
	check_parse_rv(uri, expect, 0);
}

struct pkcs11_uri *
compose_uri(unsigned char *id, size_t id_len, char *token, char *lib_manuf,
    char *manuf, char *module_path, char *object)
{
	struct pkcs11_uri *uri = pkcs11_uri_init();
	if (id_len > 0) {
		uri->id_len = id_len;
		uri->id = id;
	}
	uri->module_path = module_path;
	uri->token = token;
	uri->lib_manuf = lib_manuf;
	uri->manuf = manuf;
	uri->object = object;
	return uri;
}

static void
test_parse_valid(void)
{
	/* path arguments */
	check_parse("pkcs11:id=%01",
	    compose_uri("\x01", 1, NULL, NULL, NULL, NULL, NULL));
	check_parse("pkcs11:id=%00%01",
	    compose_uri("\x00\x01", 2, NULL, NULL, NULL, NULL, NULL));
	check_parse("pkcs11:token=SSH%20Keys",
	    compose_uri(NULL, 0, "SSH Keys", NULL, NULL, NULL, NULL));
	check_parse("pkcs11:library-manufacturer=OpenSC",
	    compose_uri(NULL, 0, NULL, "OpenSC", NULL, NULL, NULL));
	check_parse("pkcs11:manufacturer=piv_II",
	    compose_uri(NULL, 0, NULL, NULL, "piv_II", NULL, NULL));
	check_parse("pkcs11:object=SIGN%20Key",
	    compose_uri(NULL, 0, NULL, NULL, NULL, NULL, "SIGN Key"));
	/* query arguments */
	check_parse("pkcs11:?module-path=/usr/lib64/p11-kit-proxy.so",
	    compose_uri(NULL, 0, NULL, NULL, NULL, "/usr/lib64/p11-kit-proxy.so", NULL));

	/* combinations */
	/* ID SHOULD be percent encoded */
	check_parse("pkcs11:token=SSH%20Key;id=0",
	    compose_uri("0", 1, "SSH Key", NULL, NULL, NULL, NULL));
	check_parse(
	    "pkcs11:manufacturer=CAC?module-path=/usr/lib64/p11-kit-proxy.so",
	    compose_uri(NULL, 0, NULL, NULL, "CAC",
	    "/usr/lib64/p11-kit-proxy.so", NULL));
	check_parse(
	    "pkcs11:object=RSA%20Key?module-path=/usr/lib64/pkcs11/opencryptoki.so",
	    compose_uri(NULL, 0, NULL, NULL, NULL,
	    "/usr/lib64/pkcs11/opencryptoki.so", "RSA Key"));

	/* empty path component matches everything */
	check_parse("pkcs11:", EMPTY_URI);

	/* empty string is a valid to match against (and different from NULL) */
	check_parse("pkcs11:token=",
	    compose_uri(NULL, 0, "", NULL, NULL, NULL, NULL));
	/* Percent character needs to be percent-encoded */
	check_parse("pkcs11:token=%25",
	     compose_uri(NULL, 0, "%", NULL, NULL, NULL, NULL));
}

static void
test_parse_invalid(void)
{
	/* Invalid percent encoding */
	check_parse_rv("pkcs11:id=%0", EMPTY_URI, -1);
	/* Invalid percent encoding */
	check_parse_rv("pkcs11:id=%ZZ", EMPTY_URI, -1);
	/* Space MUST be percent encoded -- XXX not enforced yet */
	check_parse("pkcs11:token=SSH Keys",
	    compose_uri(NULL, 0, "SSH Keys", NULL, NULL, NULL, NULL));
	/* MUST NOT contain duplicate attributes of the same name */
	check_parse_rv("pkcs11:id=%01;id=%02", EMPTY_URI, -1);
	/* Unrecognized attribute in path SHOULD be error */
	check_parse_rv("pkcs11:key_name=SSH", EMPTY_URI, -1);
	/* Unrecognized attribute in query SHOULD be ignored */
	check_parse("pkcs11:?key_name=SSH", EMPTY_URI);
}

void
check_gen(char *expect, struct pkcs11_uri *uri)
{
	char *buf = NULL, *uri_str;

	asprintf(&buf, "Valid PKCS#11 URI generation: %s", expect);
	TEST_START(buf);
	free(buf);
	uri_str = pkcs11_uri_get(uri);
	ASSERT_PTR_NE(uri_str, NULL);
	ASSERT_STRING_EQ(uri_str, expect);
	free(uri_str);
	TEST_DONE();
}

static void
test_generate_valid(void)
{
	/* path arguments */
	check_gen("pkcs11:id=%01",
	    compose_uri("\x01", 1, NULL, NULL, NULL, NULL, NULL));
	check_gen("pkcs11:id=%00%01",
	    compose_uri("\x00\x01", 2, NULL, NULL, NULL, NULL, NULL));
	check_gen("pkcs11:token=SSH%20Keys", /* space must be percent encoded */
	    compose_uri(NULL, 0, "SSH Keys", NULL, NULL, NULL, NULL));
	/* library-manufacturer is not implmented now */
	/*check_gen("pkcs11:library-manufacturer=OpenSC",
	    compose_uri(NULL, 0, NULL, "OpenSC", NULL, NULL, NULL));*/
	check_gen("pkcs11:manufacturer=piv_II",
	    compose_uri(NULL, 0, NULL, NULL, "piv_II", NULL, NULL));
	check_gen("pkcs11:object=RSA%20Key",
	    compose_uri(NULL, 0, NULL, NULL, NULL, NULL, "RSA Key"));
	/* query arguments */
	check_gen("pkcs11:?module-path=/usr/lib64/p11-kit-proxy.so",
	    compose_uri(NULL, 0, NULL, NULL, NULL, "/usr/lib64/p11-kit-proxy.so", NULL));

	/* combinations */
	check_gen("pkcs11:id=%02;token=SSH%20Keys",
	    compose_uri("\x02", 1, "SSH Keys", NULL, NULL, NULL, NULL));
	check_gen("pkcs11:id=%EE%02?module-path=/usr/lib64/p11-kit-proxy.so",
	    compose_uri("\xEE\x02", 2, NULL, NULL, NULL, "/usr/lib64/p11-kit-proxy.so", NULL));
	check_gen("pkcs11:object=Encryption%20Key;manufacturer=piv_II",
	    compose_uri(NULL, 0, NULL, NULL, "piv_II", NULL, "Encryption Key"));

	/* empty path component matches everything */
	check_gen("pkcs11:", EMPTY_URI);

}

void
check_encode(char *source, size_t len, char *whitelist, char *expect)
{
	char *buf = NULL;
	struct sshbuf *b;

	asprintf(&buf, "percent_encode: expected %s", expect);
	TEST_START(buf);
	free(buf);

	b = percent_encode(source, len, whitelist);
	ASSERT_STRING_EQ(sshbuf_ptr(b), expect);
	sshbuf_free(b);
	TEST_DONE();
}

static void
test_percent_encode_multibyte(void)
{
	/* SHOULD be encoded as octets according to the UTF-8 character encoding */

	/* multi-byte characters are "for free" */
	check_encode("$", 1, "", "%24");
	check_encode("¢", 2, "", "%C2%A2");
	check_encode("€", 3, "", "%E2%82%AC");
	check_encode("𐍈", 4, "", "%F0%90%8D%88");

	/* CK_UTF8CHAR is unsigned char (1 byte) */
	/* labels SHOULD be normalized to NFC [UAX15] */

}

static void
test_percent_encode(void)
{
	/* Without whitelist encodes everything (for CKA_ID) */
	check_encode("A*", 2, "", "%41%2A");
	check_encode("\x00", 1, "", "%00");
	check_encode("\x7F", 1, "", "%7F");
	check_encode("\x80", 1, "", "%80");
	check_encode("\xff", 1, "", "%FF");

	/* Default whitelist encodes anything but safe letters */
	check_encode("test" "\x00" "0alpha", 11, PKCS11_URI_WHITELIST,
	    "test%000alpha");
	check_encode(" ", 1, PKCS11_URI_WHITELIST,
	    "%20"); /* Space MUST be percent encoded */
	check_encode("/", 1, PKCS11_URI_WHITELIST,
	    "%2F"); /* '/' delimiter MUST be percent encoded (in the path) */
	check_encode("?", 1, PKCS11_URI_WHITELIST,
	    "%3F"); /* delimiter '?' MUST be percent encoded (in the path) */
	check_encode("#", 1, PKCS11_URI_WHITELIST,
	    "%23"); /* '#' MUST be always percent encoded */
	check_encode("key=value;separator?query&amp;#anch", 35, PKCS11_URI_WHITELIST,
	    "key%3Dvalue%3Bseparator%3Fquery%26amp%3B%23anch");

	/* Components in query can have '/' unencoded (useful for paths) */
	check_encode("/path/to.file", 13, PKCS11_URI_WHITELIST "/",
	    "/path/to.file");
}

void
check_decode(char *source, char *expect, int expect_len)
{
	char *buf = NULL, *out = NULL;
	int rv;

	asprintf(&buf, "percent_decode: %s", source);
	TEST_START(buf);
	free(buf);

	rv = percent_decode(source, &out);
	ASSERT_INT_EQ(rv, expect_len);
	if (rv >= 0)
		ASSERT_MEM_EQ(out, expect, expect_len);
	free(out);
	TEST_DONE();
}

static void
test_percent_decode(void)
{
	/* simple valid cases */
	check_decode("%00", "\x00", 1);
	check_decode("%FF", "\xFF", 1);

	/* normal strings shold be kept intact */
	check_decode("strings are left", "strings are left", 16);
	check_decode("10%25 of trees", "10% of trees", 12);

	/* make sure no more than 2 bytes are parsed */
	check_decode("%222", "\x22" "2", 2);

	/* invalid expects failure */
	check_decode("%0", "", -1);
	check_decode("%Z", "", -1);
	check_decode("%FG", "", -1);
}

void
tests(void)
{
	test_percent_encode();
	test_percent_encode_multibyte();
	test_percent_decode();
	test_parse_valid();
	test_parse_invalid();
	test_generate_valid();
}




#include "misc.h"
#include "ssherr.h"
#include "digest.h"
#include "ssh-pkcs11-uri.h"

/* argv0 */
extern char *__progname;

	return ret;
}

#ifdef ENABLE_PKCS11
static int update_card(int, int, const char *);

int
update_pkcs11_uri(int agent_fd, int adding, const char *pkcs11_uri)
{
	struct pkcs11_uri *uri;

	/* dry-run parse to make sure the URI is valid and to report errors */
	uri = pkcs11_uri_init();
	if (pkcs11_uri_parse((char *) pkcs11_uri, uri) != 0)
		fatal("Failed to parse PKCS#11 URI");
	pkcs11_uri_cleanup(uri);

	return update_card(agent_fd, adding, pkcs11_uri);
}
#endif

static int
add_file(int agent_fd, const char *filename, int key_only, int qflag)
{

static int
do_file(int agent_fd, int deleting, int key_only, char *file, int qflag)
{
#ifdef ENABLE_PKCS11
	if (strlen(file) >= strlen(PKCS11_URI_SCHEME) &&
	    strncmp(file, PKCS11_URI_SCHEME,
	    strlen(PKCS11_URI_SCHEME)) == 0) {
		return update_pkcs11_uri(agent_fd, !deleting, file);
	}
#endif
	if (deleting) {
		if (delete_file(agent_fd, file, key_only, qflag) == -1)
			return -1;




}

#ifdef ENABLE_PKCS11
static char *
sanitize_pkcs11_provider(const char *provider)
{
	struct pkcs11_uri *uri = NULL;
	char *sane_uri, *module_path = NULL; /* default path */
	char canonical_provider[PATH_MAX];

	if (provider == NULL)
		return NULL;

	if (strlen(provider) >= strlen(PKCS11_URI_SCHEME) &&
	    strncmp(provider, PKCS11_URI_SCHEME,
	    strlen(PKCS11_URI_SCHEME)) == 0) {
		/* PKCS#11 URI */
		uri = pkcs11_uri_init();
		if (uri == NULL) {
			error("Failed to init PCKS#11 URI");
			return NULL;
		}

		if (pkcs11_uri_parse(provider, uri) != 0) {
			error("Failed to parse PKCS#11 URI");
			return NULL;
		}
		/* validate also provider from URI */
		if (uri->module_path)
			module_path = strdup(uri->module_path);
	} else
		module_path = strdup(provider); /* simple path */

	if (module_path != NULL) { /* do not validate default NULL path in URI */
		if (realpath(module_path, canonical_provider) == NULL) {
			verbose("failed PKCS#11 provider \"%.100s\": realpath: %s",
			    module_path, strerror(errno));
			free(module_path);
			return NULL;
		}
		free(module_path);
		if (match_pattern_list(canonical_provider, pkcs11_whitelist, 0) != 1) {
			verbose("refusing PKCS#11 provider \"%.100s\": "
			    "not whitelisted", canonical_provider);
			return NULL;
		}

		/* copy verified and sanitized provider path back to the uri */
		if (uri) {
			free(uri->module_path);
			uri->module_path = xstrdup(canonical_provider);
		}
	}

	if (uri) {
		sane_uri = pkcs11_uri_get(uri);
		pkcs11_uri_cleanup(uri);
		return sane_uri;
	} else {
		return xstrdup(canonical_provider); /* simple path */
	}
}

static void
process_add_smartcard_key(SocketEntry *e)
{
	char *provider = NULL, *pin = NULL, *sane_uri = NULL;
	int r, i, count = 0, success = 0, confirm = 0;
	u_int seconds;
	time_t death = 0;

			goto send;
		}
	}

	sane_uri = sanitize_pkcs11_provider(provider);
	if (sane_uri == NULL)
		goto send;
	}
	if (match_pattern_list(canonical_provider, pkcs11_whitelist, 0) != 1) {
		verbose("refusing PKCS#11 add of \"%.100s\": "
		    "provider not whitelisted", canonical_provider);
		goto send;

	debug("%s: add %.100s", __func__, canonical_provider);
	if (lifetime && !death)
		death = monotime() + lifetime;

	debug("%s: add %.100s", __func__, sane_uri);
	count = pkcs11_add_provider(sane_uri, pin, &keys);
	for (i = 0; i < count; i++) {
		k = keys[i];
		if (lookup_identity(k) == NULL) {
			id = xcalloc(1, sizeof(Identity));
			id->key = k;
			id->provider = xstrdup(sane_uri);
			id->comment = xstrdup(sane_uri);
			id->death = death;
			id->confirm = confirm;
			TAILQ_INSERT_TAIL(&idtab->idlist, id, next);

send:
	free(pin);
	free(provider);
	free(sane_uri);
	free(keys);
	send_status(e, success);
}

static void
process_remove_smartcard_key(SocketEntry *e)
{
	char *provider = NULL, *pin = NULL, *sane_uri = NULL;
	int r, success = 0;
	Identity *id, *nxt;


	}
	free(pin);

	sane_uri = sanitize_pkcs11_provider(provider);
	if (sane_uri == NULL)
		    provider, strerror(errno));
		goto send;
	}

	debug("%s: remove %.100s", __func__, sane_uri);
	for (id = TAILQ_FIRST(&idtab->idlist); id; id = nxt) {
		nxt = TAILQ_NEXT(id, next);
		/* Skip file--based keys */
		if (id->provider == NULL)
			continue;
		if (!strcmp(sane_uri, id->provider)) {
			TAILQ_REMOVE(&idtab->idlist, id, next);
			free_identity(id);
			idtab->nentries--;
		}
	}
	if (pkcs11_del_provider(sane_uri) == 0)
		success = 1;
	else
		error("%s: pkcs11_del_provider failed", __func__);
send:
	free(provider);
	free(sane_uri);
	send_status(e, success);
}
#endif /* ENABLE_PKCS11 */

Lines 816-821 do_download(struct passwd *pw) Link Here

(-)a/ssh-keygen.c (+1 lines)
816	free(fp);	816	free(fp);
817	} else {	817	} else {
818	(void) sshkey_write(keys[i], stdout); /* XXX check */	818	(void) sshkey_write(keys[i], stdout); /* XXX check */
		819	(void) pkcs11_uri_write(keys[i], stdout);
819	fprintf(stdout, "\n");	820	fprintf(stdout, "\n");
820	}	821	}
821	sshkey_free(keys[i]);	822	sshkey_free(keys[i]);

Lines 195-200 pkcs11_add_provider(char name, char pin, Key ***keysp) Link Here

(-)a/ssh-pkcs11-client.c (+3 lines)
195	u_int blen;	195	u_int blen;
196	Buffer msg;	196	Buffer msg;
197		197
		198	debug("%s: called, name = %s", __func__, name);
		199
198	if (fd < 0 && pkcs11_start_helper() < 0)	200	if (fd < 0 && pkcs11_start_helper() < 0)
199	return (-1);	201	return (-1);
200		202
Lines 208-213 pkcs11_add_provider(char name, char pin, Key ***keysp) Link Here
208	if (recv_msg(&msg) == SSH2_AGENT_IDENTITIES_ANSWER) {	210	if (recv_msg(&msg) == SSH2_AGENT_IDENTITIES_ANSWER) {
209	nkeys = buffer_get_int(&msg);	211	nkeys = buffer_get_int(&msg);
210	keysp = xcalloc(nkeys, sizeof(Key ));	212	keysp = xcalloc(nkeys, sizeof(Key ));
		213	debug("%s: nkeys = %d", __func__, nkeys);
211	for (i = 0; i < nkeys; i++) {	214	for (i = 0; i < nkeys; i++) {
212	blob = buffer_get_string(&msg, &blen);	215	blob = buffer_get_string(&msg, &blen);
213	free(buffer_get_string(&msg, NULL));	216	free(buffer_get_string(&msg, NULL));




/*
 * Copyright (c) 2017 Red Hat
 *
 * Authors: Jakub Jelen <jjelen@redhat.com>
 *
 * Permission to use, copy, modify, and distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 */

#include "includes.h"

#ifdef ENABLE_PKCS11

#include <stdio.h>
#include <string.h>

#include "sshkey.h"
#include "log.h"

#define CRYPTOKI_COMPAT
#include "pkcs11.h"

#include "ssh-pkcs11-uri.h"

#define PKCS11_URI_PATH_SEPARATOR ";"
#define PKCS11_URI_QUERY_SEPARATOR "&"
#define PKCS11_URI_VALUE_SEPARATOR "="
#define PKCS11_URI_ID "id"
#define PKCS11_URI_TOKEN "token"
#define PKCS11_URI_OBJECT "object"
#define PKCS11_URI_LIB_MANUF "library-manufacturer"
#define PKCS11_URI_MANUF "manufacturer"
#define PKCS11_URI_MODULE_PATH "module-path"

/* Keyword tokens. */
typedef enum {
	pId, pToken, pObject, pLibraryManufacturer, pManufacturer, pModulePath,
	pBadOption
} pkcs11uriOpCodes;

/* Textual representation of the tokens. */
static struct {
	const char *name;
	pkcs11uriOpCodes opcode;
} keywords[] = {
	{ PKCS11_URI_ID, pId },
	{ PKCS11_URI_TOKEN, pToken },
	{ PKCS11_URI_OBJECT, pObject },
	{ PKCS11_URI_LIB_MANUF, pLibraryManufacturer },
	{ PKCS11_URI_MANUF, pManufacturer },
	{ PKCS11_URI_MODULE_PATH, pModulePath },
	{ NULL, pBadOption }
};

static pkcs11uriOpCodes
parse_token(const char *cp)
{
	u_int i;

	for (i = 0; keywords[i].name; i++)
		if (strncasecmp(cp, keywords[i].name,
		    strlen(keywords[i].name)) == 0)
			return keywords[i].opcode;

	return pBadOption;
}

int
percent_decode(char *data, char **outp)
{
	char tmp[3];
	char *out, *tmp_end;
	char *p = data;
	long value;
	size_t outlen = 0;

	out = malloc(strlen(data)+1); /* upper bound */
	if (out == NULL)
		return -1;
	while (*p != '\0') {
		switch (*p) {
		case '%':
			p++;
			if (*p == '\0')
				goto fail;
			tmp[0] = *p++;
			if (*p == '\0')
				goto fail;
			tmp[1] = *p++;
			tmp[2] = '\0';
			tmp_end = NULL;
			value = strtol(tmp, &tmp_end, 16);
			if (tmp_end != tmp+2)
				goto fail;
			else
				out[outlen++] = (char) value;
			break;
		default:
			out[outlen++] = *p++;
			break;
		}
	}

	/* zero terminate */
	out[outlen] = '\0';
	*outp = out;
	return outlen;
fail:
	free(out);
	return -1;
}

struct sshbuf *
percent_encode(const char *data, size_t length, const char *whitelist)
{
	struct sshbuf *b = NULL;
	char tmp[4], *cp;
	size_t i;

	if ((b = sshbuf_new()) == NULL)
		return NULL;
	for (i = 0; i < length; i++) {
		cp = strchr(whitelist, data[i]);
		/* if c is specified as '\0' pointer to terminator is returned !! */
		if (cp != NULL && *cp != '\0') {
			if (sshbuf_put(b, &data[i], 1) != 0)
				goto err;
		} else
			if (snprintf(tmp, 4, "%%%02X", (unsigned char) data[i]) < 3
			    || sshbuf_put(b, tmp, 3) != 0)
				goto err;
	}
	if (sshbuf_put(b, "\0", 1) == 0)
		return b;
err:
	sshbuf_free(b);
	return NULL;
}

char *
pkcs11_uri_append(char *part, const char *separator, const char *key,
    struct sshbuf *value)
{
	char *new_part;
	size_t size;

	if (value == NULL)
		return NULL;

	size = asprintf(&new_part,
	    "%s%s%s"  PKCS11_URI_VALUE_SEPARATOR "%s",
	    (part != NULL ? part : ""),
	    (part != NULL ? separator : ""),
	    key, sshbuf_ptr(value));
	sshbuf_free(value);
	free(part);

	if (size < 0)
		return NULL;
	return new_part;
}

char *
pkcs11_uri_get(struct pkcs11_uri *uri)
{
	size_t size = -1;
	char *p = NULL, *path = NULL, *query = NULL;

	/* compose a percent-encoded ID */
	if (uri->id_len > 0) {
		struct sshbuf *key_id = percent_encode(uri->id, uri->id_len, "");
		path = pkcs11_uri_append(path, PKCS11_URI_PATH_SEPARATOR,
		    PKCS11_URI_ID, key_id);
		if (path == NULL)
			goto err;
	}

	/* Write object label */
	if (uri->object) {
		struct sshbuf *label = percent_encode(uri->object, strlen(uri->object),
		    PKCS11_URI_WHITELIST);
		path = pkcs11_uri_append(path, PKCS11_URI_PATH_SEPARATOR,
		    PKCS11_URI_OBJECT, label);
		if (path == NULL)
			goto err;
	}

	/* Write token label */
	if (uri->token) {
		struct sshbuf *label = percent_encode(uri->token, strlen(uri->token),
		    PKCS11_URI_WHITELIST);
		path = pkcs11_uri_append(path, PKCS11_URI_PATH_SEPARATOR,
		    PKCS11_URI_TOKEN, label);
		if (path == NULL)
			goto err;
	}

	/* Write manufacturer */
	if (uri->manuf) {
		struct sshbuf *manuf = percent_encode(uri->manuf,
		    strlen(uri->manuf), PKCS11_URI_WHITELIST);
		path = pkcs11_uri_append(path, PKCS11_URI_PATH_SEPARATOR,
		    PKCS11_URI_MANUF, manuf);
		if (path == NULL)
			goto err;
	}

	/* Write module_path */
	if (uri->module_path) {
		struct sshbuf *module = percent_encode(uri->module_path,
		    strlen(uri->module_path), PKCS11_URI_WHITELIST "/");
		query = pkcs11_uri_append(query, PKCS11_URI_QUERY_SEPARATOR,
		    PKCS11_URI_MODULE_PATH, module);
		if (query == NULL)
			goto err;
	}

	size = asprintf(&p, PKCS11_URI_SCHEME "%s%s%s",
	    path != NULL ? path : "",
	    query != NULL ? "?" : "",
	    query != NULL ? query : "");
err:
	free(query);
	free(path);
	if (size < 0)
		return NULL;
	return p;
}

struct pkcs11_uri *
pkcs11_uri_init()
{
	struct pkcs11_uri *d = calloc(1, sizeof(struct pkcs11_uri));
	return d;
}

void
pkcs11_uri_cleanup(struct pkcs11_uri *pkcs11)
{
	free(pkcs11->id);
	free(pkcs11->module_path);
	free(pkcs11->token);
	free(pkcs11->object);
	free(pkcs11->lib_manuf);
	free(pkcs11->manuf);
	free(pkcs11);
}

int
pkcs11_uri_parse(const char *uri, struct pkcs11_uri *pkcs11)
{
	char *saveptr1, *saveptr2, *str1, *str2, *tok;
	int rv = 0, len;
	char *p = NULL;

	size_t scheme_len = strlen(PKCS11_URI_SCHEME);
	if (strlen(uri) < scheme_len || /* empty URI matches everything */
	    strncmp(uri, PKCS11_URI_SCHEME, scheme_len) != 0) {
		error("%s: The '%s' does not look like PKCS#11 URI",
		    __func__, uri);
		return -1;
	}

	if (pkcs11 == NULL) {
		error("%s: Bad arguments. The pkcs11 can't be null", __func__);
		return -1;
	}

	/* skip URI schema name */
	p = strdup(uri);
	str1 = p;

	/* everything before ? */
	tok = strtok_r(str1, "?", &saveptr1);
	if (tok == NULL) {
		free(p);
		error("%s: pk11-path expected, got EOF", __func__);
		return -1;
	}

	/* skip URI schema name:
	 * the scheme ensures that there is at least something before "?"
	 * allowing empty pk11-path. Resulting token at worst pointing to
	 * \0 byte */
	tok = tok + scheme_len;

	/* parse pk11-path */
	for (str2 = tok; ; str2 = NULL) {
		char **charptr;
		pkcs11uriOpCodes opcode;
		tok = strtok_r(str2, PKCS11_URI_PATH_SEPARATOR, &saveptr2);
		if (tok == NULL)
			break;
		opcode = parse_token(tok);
		if (opcode == pBadOption) {
			verbose("Unknown key in PKCS#11 URI: %s", tok);
			return -1;
		}

		char *arg = tok + strlen(keywords[opcode].name) + 1; /* separator "=" */
		switch (opcode) {
		case pId:
			/* CKA_ID */
			if (pkcs11->id != NULL) {
				verbose("%s: The id already set in the PKCS#11 URI",
					__func__);
				rv = -1;
			}
			len = percent_decode(arg, &pkcs11->id);
			if (len <= 0) {
				verbose("%s: Failed to percent-decode CKA_ID: %s",
				    __func__, arg);
				rv = -1;
			} else
				pkcs11->id_len = len;
			debug3("%s: Setting CKA_ID = %s from PKCS#11 URI",
			    __func__, arg);
			break;
		case pToken:
			/* CK_TOKEN_INFO -> label */
			charptr = &pkcs11->token;
 parse_string:
			if (*charptr != NULL) {
				verbose("%s: The %s already set in the PKCS#11 URI",
				    keywords[opcode].name, __func__);
				rv = -1;
			}
			percent_decode(arg, charptr);
			debug3("%s: Setting %s = %s from PKCS#11 URI",
			    __func__, keywords[opcode].name, *charptr);
			break;

		case pObject:
			/* CK_TOKEN_INFO -> manufacturerID */
			charptr = &pkcs11->object;
			goto parse_string;

		case pManufacturer:
			/* CK_TOKEN_INFO -> manufacturerID */
			charptr = &pkcs11->manuf;
			goto parse_string;

		case pLibraryManufacturer:
			/* CK_INFO -> manufacturerID */
			charptr = &pkcs11->lib_manuf;
			goto parse_string;

		case pBadOption:
		default:
			/* Unrecognized attribute in the URI path SHOULD be error */
			verbose("%s: Unknown part of path in PKCS#11 URI: %s",
			    __func__, tok);
			rv = -1;
		}
	}

	tok = strtok_r(NULL, "?", &saveptr1);
	if (tok == NULL) {
		free(p);
		return rv;
	}
	/* parse pk11-query (optional) */
	for (str2 = tok; ; str2 = NULL) {
		size_t key_len = strlen(PKCS11_URI_MODULE_PATH) + 1;
		tok = strtok_r(str2, PKCS11_URI_QUERY_SEPARATOR, &saveptr2);
		if (tok == NULL)
			break;
		if (strncasecmp(tok, PKCS11_URI_MODULE_PATH
		    PKCS11_URI_VALUE_SEPARATOR, key_len) == 0) {
			/* module-path is PKCS11Provider */
			if (pkcs11->module_path != NULL) {
				verbose("%s: Multiple module-path attributes are"
				    "not supported the PKCS#11 URI", __func__);
				rv = -1;
			}
			percent_decode(tok + key_len, &pkcs11->module_path);
			debug3("%s: Setting PKCS11Provider = %s from PKCS#11 URI\n",
			    __func__, pkcs11->module_path);
		/* } else if ( pin-value ) { */
		} else {
			/* Unrecognized attribute in the URI query SHOULD be ignored */
			verbose("%s: Unknown part of query in PKCS#11 URI: %s",
			    __func__, tok);
		}
	}
	free(p);
	return rv;
}

#endif /* ENABLE_PKCS11 */




/*
 * Copyright (c) 2017 Red Hat
 *
 * Authors: Jakub Jelen <jjelen@redhat.com>
 *
 * Permission to use, copy, modify, and distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 */

#define PKCS11_URI_SCHEME "pkcs11:"
#define PKCS11_URI_WHITELIST	"abcdefghijklmnopqrstuvwxyz" \
				"ABCDEFGHIJKLMNOPQRSTUVWXYZ" \
				"0123456789_-.()"

struct pkcs11_uri {
	/* path */
	char *id;
	size_t id_len;
	char *token;
	char *object;
	char *lib_manuf;
	char *manuf;
	/* query */
	char *module_path;
};

struct pkcs11_uri *pkcs11_uri_init();
void pkcs11_uri_cleanup(struct pkcs11_uri *);
int	pkcs11_uri_parse(const char *, struct pkcs11_uri *);
struct pkcs11_uri *pkcs11_uri_init();
char * pkcs11_uri_get(struct pkcs11_uri *uri);






struct pkcs11_provider {
	char			*name;
	char			*module_path;
	void			*handle;
	CK_FUNCTION_LIST	*function_list;
	CK_INFO			info;

	int			(*orig_finish)(RSA *rsa);
	RSA_METHOD		*rsa_method;
	char			*keyid;
	char			*label;
	int			keyid_len;
};

int pkcs11_interactive = 0;

/*
 * This can't be in the ssh-pkcs11-uri, becase we can not depend on
 * PKCS#11 structures in ssh-agent (using client-helper communication)
 */
int
pkcs11_uri_write(const struct sshkey *key, FILE *f)
{
	char *p = NULL;
	struct pkcs11_uri uri;
	struct pkcs11_key *k11;

	/* sanity - is it a RSA key with associated app_data? */
	if (key->type != KEY_RSA ||
	    (k11 = RSA_get_app_data(key->rsa)) == NULL)
		return -1;

	/* omit type -- we are looking for private-public or private-certificate pairs */
	uri.id = k11->keyid;
	uri.id_len = k11->keyid_len;
	uri.token = k11->provider->slotinfo[k11->slotidx].token.label;
	uri.object = k11->label;
	uri.module_path = k11->provider->module_path;
	uri.lib_manuf = k11->provider->info.manufacturerID;
	uri.manuf = k11->provider->slotinfo[k11->slotidx].token.manufacturerID;

	p = pkcs11_uri_get(&uri);
	/* do not cleanup -- we do not allocate here, only reference */
	if (p == NULL)
		return -1;

	fprintf(f, " %s", p);
	free(p);
	return 0;
}

int
pkcs11_init(int interactive)
{

			error("pkcs11_provider_unref: %p still valid", p);
		free(p->slotlist);
		free(p->slotinfo);
		free(p->name);
		free(p->module_path);
		free(p);
	}
}

	return (NULL);
}

int pkcs11_del_provider_by_uri(struct pkcs11_uri *);

/* unregister provider by name */
int
pkcs11_del_provider(char *provider_id)
{
	int rv;
	struct pkcs11_uri *uri;

	debug("%s: called, provider_id = %s", __func__, provider_id);

	uri = pkcs11_uri_init();
	if (uri == NULL)
		fatal("Failed to init PCKS#11 URI");

	if (strlen(provider_id) >= strlen(PKCS11_URI_SCHEME) &&
	    strncmp(provider_id, PKCS11_URI_SCHEME, strlen(PKCS11_URI_SCHEME)) == 0) {
		if (pkcs11_uri_parse(provider_id, uri) != 0)
			fatal("Failed to parse PKCS#11 URI");
	} else {
		uri->module_path = strdup(provider_id);
	}

	rv = pkcs11_del_provider_by_uri(uri);
	pkcs11_uri_cleanup(uri);
	return rv;
}

/* unregister provider by PKCS#11 URI */
int
pkcs11_del_provider_by_uri(struct pkcs11_uri *uri)
{
	struct pkcs11_provider *p;
	int rv = -1;
	char *provider_uri = pkcs11_uri_get(uri);

	debug3("%s(%s): called", __func__, provider_uri);

	if ((p = pkcs11_provider_lookup(provider_uri)) != NULL) {
		TAILQ_REMOVE(&pkcs11_providers, p, next);
		pkcs11_provider_finalize(p);
		pkcs11_provider_unref(p);
		rv = 0;
	}
	free(provider_uri);
	return rv;
}

/* openssl callback for freeing an RSA key */

		if (k11->provider)
			pkcs11_provider_unref(k11->provider);
		free(k11->keyid);
		free(k11->label);
		free(k11);
	}
	return (rv);

/* redirect private key operations for rsa key to pkcs11 token */
static int
pkcs11_rsa_wrap(struct pkcs11_provider *provider, CK_ULONG slotidx,
    CK_ATTRIBUTE *keyid_attrib, CK_ATTRIBUTE *label_attrib, RSA *rsa)
{
	struct pkcs11_key	*k11;
	const RSA_METHOD	*def = RSA_get_default_method();

		k11->keyid = xmalloc(k11->keyid_len);
		memcpy(k11->keyid, keyid_attrib->pValue, k11->keyid_len);
	}
	if (label_attrib->ulValueLen > 0 ) {
		k11->label = xmalloc(label_attrib->ulValueLen+1);
		memcpy(k11->label, label_attrib->pValue, label_attrib->ulValueLen);
		k11->label[label_attrib->ulValueLen] = 0;
	}
	k11->orig_finish = RSA_meth_get_finish(def);
	if ((k11->rsa_method = RSA_meth_dup(def)) == NULL ||
	    RSA_meth_set1_name(k11->rsa_method, "pkcs11") == 0 ||

	if ((rv = f->C_OpenSession(p->slotlist[slotidx], CKF_RW_SESSION|
	    CKF_SERIAL_SESSION, NULL, NULL, &session))
	    != CKR_OK) {
		error("C_OpenSession failed for slot %lu: %lu", slotidx, rv);
		return (-1);
	}
	if (login_required && pin) {

 * keysp points to an (possibly empty) array with *nkeys keys.
 */
static int pkcs11_fetch_keys_filter(struct pkcs11_provider *, CK_ULONG,
    CK_ATTRIBUTE [], size_t, CK_ATTRIBUTE [3], struct sshkey ***, int *)
	__attribute__((__bounded__(__minbytes__,4, 3 * sizeof(CK_ATTRIBUTE))));

static int
pkcs11_fetch_keys(struct pkcs11_provider *p, CK_ULONG slotidx,
    struct sshkey ***keysp, int *nkeys, struct pkcs11_uri *uri)
{
	size_t filter_size = 1;
	CK_OBJECT_CLASS	pubkey_class = CKO_PUBLIC_KEY;
	CK_OBJECT_CLASS	cert_class = CKO_CERTIFICATE;
	CK_ATTRIBUTE		pubkey_filter[] = {
		{ CKA_CLASS, NULL, sizeof(pubkey_class) },
		{ CKA_ID, NULL, 0 },
		{ CKA_LABEL, NULL, 0 }
	};
	CK_ATTRIBUTE		cert_filter[] = {
		{ CKA_CLASS, NULL, sizeof(cert_class) },
		{ CKA_ID, NULL, 0 },
		{ CKA_LABEL, NULL, 0 }
	};
	CK_ATTRIBUTE		pubkey_attribs[] = {
		{ CKA_ID, NULL, 0 },
		{ CKA_LABEL, NULL, 0 },
		{ CKA_MODULUS, NULL, 0 },
		{ CKA_PUBLIC_EXPONENT, NULL, 0 }
	};
	CK_ATTRIBUTE		cert_attribs[] = {
		{ CKA_ID, NULL, 0 },
		{ CKA_LABEL, NULL, 0 },
		{ CKA_SUBJECT, NULL, 0 },
		{ CKA_VALUE, NULL, 0 }
	};
	pubkey_filter[0].pValue = &pubkey_class;
	cert_filter[0].pValue = &cert_class;

	if (uri->id != NULL) {
		pubkey_filter[filter_size].pValue = uri->id;
		pubkey_filter[filter_size].ulValueLen = uri->id_len;
		cert_filter[filter_size].pValue = uri->id;
		cert_filter[filter_size].ulValueLen = uri->id_len;
		filter_size++;
	}
	if (uri->object != NULL) {
		pubkey_filter[filter_size].pValue = uri->object;
		pubkey_filter[filter_size].ulValueLen = strlen(uri->object);
		pubkey_filter[filter_size].type = CKA_LABEL;
		cert_filter[filter_size].pValue = uri->object;
		cert_filter[filter_size].ulValueLen = strlen(uri->object);
		cert_filter[filter_size].type = CKA_LABEL;
		filter_size++;
	}

	if (pkcs11_fetch_keys_filter(p, slotidx, pubkey_filter, filter_size,
	    pubkey_attribs, keysp, nkeys) < 0 ||
	    pkcs11_fetch_keys_filter(p, slotidx, cert_filter, filter_size,
	    cert_attribs, keysp, nkeys) < 0)
		return (-1);
	return (0);
}


static int
pkcs11_fetch_keys_filter(struct pkcs11_provider *p, CK_ULONG slotidx,
    CK_ATTRIBUTE filter[], size_t filter_size, CK_ATTRIBUTE attribs[4],
    struct sshkey ***keysp, int *nkeys)
{
	struct sshkey		*key;
	RSA			*rsa;
	X509 			*x509;
	EVP_PKEY		*evp = NULL;
	int			i;
	int			nattribs = 4;
	const u_char		*cp;
	CK_RV			rv;
	CK_OBJECT_HANDLE	obj;

	f = p->function_list;
	session = p->slotinfo[slotidx].session;
	/* setup a filter the looks for public keys */
	if ((rv = f->C_FindObjectsInit(session, filter, filter_size)) != CKR_OK) {
		error("C_FindObjectsInit failed: %lu", rv);
		return (-1);
	}
	while (1) {
		/* XXX 3 attributes in attribs[] */
		for (i = 0; i < nattribs; i++) {
			attribs[i].pValue = NULL;
			attribs[i].ulValueLen = 0;
		}

		    || nfound == 0)
			break;
		/* found a key, so figure out size of the attributes */
		if ((rv = f->C_GetAttributeValue(session, obj, attribs, nattribs))
		    != CKR_OK) {
			error("C_GetAttributeValue failed: %lu", rv);
			continue;
		}
		/*
		 * Allow CKA_ID (always first attribute) and CKA_LABEL (second)
		 * to be empty, but ensure that none of the others are zero length.
		 * XXX assumes CKA_ID is always first.
		 */
		if (attribs[2].ulValueLen == 0 ||
		    attribs[3].ulValueLen == 0) {
			continue;
		}
		/* allocate buffers for attributes */
		for (i = 0; i < nattribs; i++) {
			if (attribs[i].ulValueLen > 0) {
				attribs[i].pValue = xmalloc(
				    attribs[i].ulValueLen);

		}

		/*
		 * retrieve ID, label, modulus and public exponent of RSA key,
		 * or ID, label, subject and value for certificates.
		 */
		rsa = NULL;
		if ((rv = f->C_GetAttributeValue(session, obj, attribs, nattribs))
		    != CKR_OK) {
			error("C_GetAttributeValue failed: %lu", rv);
		} else if (attribs[2].type == CKA_MODULUS ) {
			if ((rsa = RSA_new()) == NULL) {
				error("RSA_new failed");
			} else {
				BIGNUM *rsa_n, *rsa_e;

				rsa_n = BN_bin2bn(attribs[2].pValue,
				    attribs[1].ulValueLen, NULL);
				rsa_e = BN_bin2bn(attribs[2].pValue,
				    attribs[2].ulValueLen, NULL);
				rsa_e = BN_bin2bn(attribs[3].pValue,
				    attribs[3].ulValueLen, NULL);
				if (RSA_set0_key(rsa, rsa_n, rsa_e, NULL) == 0)
					error("RSA_set0_key failed");
			}
		} else {
			cp = attribs[3].pValue;
			if ((x509 = X509_new()) == NULL) {
				error("X509_new failed");
			} else if (d2i_X509(&x509, &cp, attribs[3].ulValueLen)
			    == NULL) {
				error("d2i_X509 failed");
			} else if ((evp = X509_get_pubkey(x509)) == NULL ||

				error("RSAPublicKey_dup");
			}
			X509_free(x509);
			EVP_PKEY_free(evp);
		}
		if (rsa)
			RSA_get0_key(rsa, &n, &e, NULL);
		if (rsa && n && e &&
		    pkcs11_rsa_wrap(p, slotidx, &attribs[0], &attribs[1], rsa) == 0) {
			if ((key = sshkey_new(KEY_UNSPEC)) == NULL)
				fatal("sshkey_new failed");
			key->rsa = rsa;

		} else if (rsa) {
			RSA_free(rsa);
		}
		for (i = 0; i < nattribs; i++)
			free(attribs[i].pValue);
	}
	if ((rv = f->C_FindObjectsFinal(session)) != CKR_OK)

/* register a new provider, fails if provider already exists */
int
pkcs11_add_provider(char *provider_id, char *pin, struct sshkey ***keyp)
{
	int rv;
	struct pkcs11_uri *uri;

	debug("%s: called, provider_id = %s", __func__, provider_id);

	uri = pkcs11_uri_init();
	if (uri == NULL)
		fatal("Failed to init PCKS#11 URI");

	if (strlen(provider_id) >= strlen(PKCS11_URI_SCHEME) &&
	    strncmp(provider_id, PKCS11_URI_SCHEME, strlen(PKCS11_URI_SCHEME)) == 0) {
		if (pkcs11_uri_parse(provider_id, uri) != 0)
			fatal("Failed to parse PKCS#11 URI");
	} else {
		uri->module_path = strdup(provider_id);
	}

	rv = pkcs11_add_provider_by_uri(uri, pin, keyp);
	pkcs11_uri_cleanup(uri);
	return rv;
}

int
pkcs11_add_provider_by_uri(struct pkcs11_uri *uri, char *pin, struct sshkey ***keyp)
{
	int nkeys, need_finalize = 0;
	struct pkcs11_provider *p = NULL;

	CK_FUNCTION_LIST *f = NULL;
	CK_TOKEN_INFO *token;
	CK_ULONG i;
	char *provider_id = NULL;
	char *provider_uri = pkcs11_uri_get(uri);

	debug("%s: called, provider_uri = %s", __func__, provider_uri);

	/* if no provider specified, fallback to p11-kit */
	if (uri->module_path == NULL) {
#ifdef PKCS11_DEFAULT_PROVIDER
		provider_id = strdup(PKCS11_DEFAULT_PROVIDER);
#else
		error("%s: No module path provided", __func__);
		goto fail;
#endif
	} else
		provider_id = strdup(uri->module_path);

	*keyp = NULL;
	if (pkcs11_provider_lookup(provider_uri) != NULL) {
		debug("%s: provider already registered: %s",
		    __func__, provider_uri);
		goto fail;
	}
	/* open shared pkcs11-libarary */

		goto fail;
	}
	p = xcalloc(1, sizeof(*p));
	p->name = provider_uri;
	p->module_path = provider_id;
	p->handle = handle;
	/* setup the pkcs11 callbacks */
	if ((rv = (*getfunctionlist)(&f)) != CKR_OK) {
		error("C_GetFunctionList for provider %s failed: %lu",
		    provider_uri, rv);
		goto fail;
	}
	p->function_list = f;
	if ((rv = f->C_Initialize(NULL)) != CKR_OK) {
		error("C_Initialize for provider %s failed: %lu",
		    provider_uri, rv);
		goto fail;
	}
	need_finalize = 1;
	if ((rv = f->C_GetInfo(&p->info)) != CKR_OK) {
		error("C_GetInfo for provider %s failed: %lu",
		    provider_uri, rv);
		goto fail;
	}
	rmspace(p->info.manufacturerID, sizeof(p->info.manufacturerID));
	if (uri->lib_manuf != NULL &&
	    strcmp(uri->lib_manuf, p->info.manufacturerID)) {
		debug("%s: Skipping provider %s not matching library_manufacturer",
		    __func__, p->info.manufacturerID);
		goto fail;
	}
	rmspace(p->info.libraryDescription, sizeof(p->info.libraryDescription));
	debug("provider %s: manufacturerID <%s> cryptokiVersion %d.%d"
	    " libraryDescription <%s> libraryVersion %d.%d",
	    provider_uri,
	    p->info.manufacturerID,
	    p->info.cryptokiVersion.major,
	    p->info.cryptokiVersion.minor,

	}
	if (p->nslots == 0) {
		debug("%s: provider %s returned no slots", __func__,
		    provider_uri);
		goto fail;
	}
	p->slotlist = xcalloc(p->nslots, sizeof(CK_SLOT_ID));
	if ((rv = f->C_GetSlotList(CK_TRUE, p->slotlist, &p->nslots))
	    != CKR_OK) {
		error("C_GetSlotList for provider %s failed: %lu",
		    provider_uri, rv);
		goto fail;
	}
	p->slotinfo = xcalloc(p->nslots, sizeof(struct pkcs11_slotinfo));

		if ((rv = f->C_GetTokenInfo(p->slotlist[i], token))
		    != CKR_OK) {
			error("C_GetTokenInfo for provider %s slot %lu "
			    "failed: %lu", provider_uri, (unsigned long)i, rv);
			continue;
		}
		if ((token->flags & CKF_TOKEN_INITIALIZED) == 0) {
			debug2("%s: ignoring uninitialised token in "
			    "provider %s slot %lu", __func__,
			    provider_uri, (unsigned long)i);
			continue;
		}
		rmspace(token->label, sizeof(token->label));
		rmspace(token->manufacturerID, sizeof(token->manufacturerID));
		rmspace(token->model, sizeof(token->model));
		rmspace(token->serialNumber, sizeof(token->serialNumber));
		if (uri->token != NULL &&
		    strcmp(token->label, uri->token) != 0) {
			debug2("%s: ignoring token not matching label (%s) "
			    "specified by PKCS#11 URI in slot %lu", __func__,
			    token->label, (unsigned long)i);
			continue;
		}
		if (uri->manuf != NULL &&
		    strcmp(token->manufacturerID, uri->manuf) != 0) {
			debug2("%s: ignoring token not matching requrested "
			    "manufacturerID (%s) specified by PKCS#11 URI in "
			    "slot %lu", __func__,
			    token->manufacturerID, (unsigned long)i);
			continue;
		}
		debug("provider %s slot %lu: label <%s> manufacturerID <%s> "
		    "model <%s> serial <%s> flags 0x%lx",
		    provider_uri, (unsigned long)i,
		    token->label, token->manufacturerID, token->model,
		    token->serialNumber, token->flags);
		/* open session, login with pin and retrieve public keys */
		if (pkcs11_open_session(p, i, pin) == 0)
			pkcs11_fetch_keys(p, i, keyp, &nkeys, uri);
	}
	if (nkeys > 0) {
		TAILQ_INSERT_TAIL(&pkcs11_providers, p, next);
		p->refcount++;	/* add to provider list */
		return (nkeys);
	}
	debug("%s: provider %s returned no keys", __func__, provider_uri);
	/* don't add the provider, since it does not have any keys */
fail:
	if (need_finalize && (rv = f->C_Finalize(NULL)) != CKR_OK)
		error("C_Finalize for provider %s failed: %lu",
		    provider_uri, rv);
	if (p) {
		free(p->slotlist);
		free(p->slotinfo);

	}
	if (handle)
		dlclose(handle);
	free(provider_id);
	free(provider_uri);
	return (-1);
}


Lines 14-23 Link Here

(-)a/ssh-pkcs11.h (+5 lines)
14	* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF	14	* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15	* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.	15	* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16	*/	16	*/
		17
		18	#include "ssh-pkcs11-uri.h"
		19
17	int pkcs11_init(int);	20	int pkcs11_init(int);
18	void pkcs11_terminate(void);	21	void pkcs11_terminate(void);
19	int pkcs11_add_provider(char , char , struct sshkey ***);	22	int pkcs11_add_provider(char , char , struct sshkey ***);
		23	int pkcs11_add_provider_by_uri(struct pkcs11_uri , char , struct sshkey ***);
20	int pkcs11_del_provider(char *);	24	int pkcs11_del_provider(char *);
		25	int pkcs11_uri_write(const struct sshkey , FILE );
21		26
22	#if !defined(WITH_OPENSSL) && defined(ENABLE_PKCS11)	27	#if !defined(WITH_OPENSSL) && defined(ENABLE_PKCS11)
23	#undef ENABLE_PKCS11	28	#undef ENABLE_PKCS11

Lines 769-774 main(int ac, char **av) Link Here

(-)a/ssh.c (-23 / +76 lines)
769	options.gss_deleg_creds = 1;	769	options.gss_deleg_creds = 1;
770	break;	770	break;
771	case 'i':	771	case 'i':
		772	#ifdef ENABLE_PKCS11
		773	if (strlen(optarg) >= strlen(PKCS11_URI_SCHEME) &&
		774	strncmp(optarg, PKCS11_URI_SCHEME,
		775	strlen(PKCS11_URI_SCHEME)) == 0) {
		776	p = strdup(optarg);
		777	add_identity_file(&options, NULL, p, 1);
		778	break;
		779	}
		780	#endif
772	p = tilde_expand_filename(optarg, original_real_uid);	781	p = tilde_expand_filename(optarg, original_real_uid);
773	if (stat(p, &st) < 0)	782	if (stat(p, &st) < 0)
774	fprintf(stderr, "Warning: Identity file %s "	783	fprintf(stderr, "Warning: Identity file %s "
Lines 1987-1992 ssh_session2(struct ssh ssh, struct passwd pw) Link Here
1987	options.escape_char : SSH_ESCAPECHAR_NONE, id);	1996	options.escape_char : SSH_ESCAPECHAR_NONE, id);
1988	}	1997	}
1989		1998
		1999	#ifdef ENABLE_PKCS11
		2000	static void
		2001	load_pkcs11_identity(char pkcs11_uri, char identity_files[],
		2002	struct sshkey identity_keys[], int n_ids)
		2003	{
		2004	int nkeys, i;
		2005	struct sshkey **keys;
		2006	struct pkcs11_uri *uri;
		2007
		2008	debug("identity file '%s' from pkcs#11", pkcs11_uri);
		2009	uri = pkcs11_uri_init();
		2010	if (uri == NULL)
		2011	fatal("Failed to init PCKS#11 URI");
		2012
		2013	if (pkcs11_uri_parse(pkcs11_uri, uri) != 0)
		2014	fatal("Failed to parse PKCS#11 URI %s", pkcs11_uri);
		2015
		2016	/* we need to merge URI and provider together */
		2017	if (options.pkcs11_provider != NULL && uri->module_path == NULL)
		2018	uri->module_path = strdup(options.pkcs11_provider);
		2019
		2020	if (pkcs11_init(!options.batch_mode) == 0 &&
		2021	options.num_identity_files < SSH_MAX_IDENTITY_FILES &&
		2022	(nkeys = pkcs11_add_provider_by_uri(uri, NULL, &keys)) > 0) {
		2023	for (i = 0; i < nkeys; i++) {
		2024	if (*n_ids >= SSH_MAX_IDENTITY_FILES) {
		2025	key_free(keys[i]);
		2026	continue;
		2027	}
		2028	identity_keys[*n_ids] = keys[i];
		2029	identity_files[*n_ids] = pkcs11_uri_get(uri);
		2030	(*n_ids)++;
		2031	}
		2032	free(keys);
		2033	}
		2034
		2035	pkcs11_uri_cleanup(uri);
		2036	}
		2037	#endif /* ENABLE_PKCS11 */
		2038
1990	/* Loads all IdentityFile and CertificateFile keys */	2039	/* Loads all IdentityFile and CertificateFile keys */
1991	static void	2040	static void
1992	load_public_identity_files(struct passwd *pw)	2041	load_public_identity_files(struct passwd *pw)
Lines 1999-2008 load_public_identity_files(struct passwd *pw) Link Here
1999	struct sshkey *identity_keys[SSH_MAX_IDENTITY_FILES];	2048	struct sshkey *identity_keys[SSH_MAX_IDENTITY_FILES];
2000	char *certificate_files[SSH_MAX_CERTIFICATE_FILES];	2049	char *certificate_files[SSH_MAX_CERTIFICATE_FILES];
2001	struct sshkey *certificates[SSH_MAX_CERTIFICATE_FILES];	2050	struct sshkey *certificates[SSH_MAX_CERTIFICATE_FILES];
2002	#ifdef ENABLE_PKCS11
2003	struct sshkey **keys;
2004	int nkeys;
2005	#endif /* PKCS11 */
2006		2051
2007	n_ids = n_certs = 0;	2052	n_ids = n_certs = 0;
2008	memset(identity_files, 0, sizeof(identity_files));	2053	memset(identity_files, 0, sizeof(identity_files));
Lines 2011-2045 load_public_identity_files(struct passwd *pw) Link Here
2011	memset(certificates, 0, sizeof(certificates));	2056	memset(certificates, 0, sizeof(certificates));
2012		2057
2013	#ifdef ENABLE_PKCS11	2058	#ifdef ENABLE_PKCS11
2014	if (options.pkcs11_provider != NULL &&	2059	/* handle fallback from PKCS11Provider option */
2015	options.num_identity_files < SSH_MAX_IDENTITY_FILES &&	2060	if (options.pkcs11_provider != NULL) {
2016	(pkcs11_init(!options.batch_mode) == 0) &&	2061	struct pkcs11_uri *uri;
2017	(nkeys = pkcs11_add_provider(options.pkcs11_provider, NULL,	2062
2018	&keys)) > 0) {	2063	uri = pkcs11_uri_init();
2019	for (i = 0; i < nkeys; i++) {	2064	if (uri == NULL)
2020	if (n_ids >= SSH_MAX_IDENTITY_FILES) {	2065	fatal("Failed to init PCKS#11 URI");
2021	key_free(keys[i]);	2066
2022	continue;	2067	/* Construct simple PKCS#11 URI to simplify access */
2023	}	2068	uri->module_path = strdup(options.pkcs11_provider);
2024	identity_keys[n_ids] = keys[i];	2069
2025	identity_files[n_ids] =	2070	/* Add it as any other IdentityFile */
2026	xstrdup(options.pkcs11_provider); /* XXX */	2071	add_identity_file(&options, NULL, pkcs11_uri_get(uri), 1);
2027	n_ids++;	2072
2028	}	2073	pkcs11_uri_cleanup(uri);
2029	free(keys);
2030	}	2074	}
2031	#endif /* ENABLE_PKCS11 */	2075	#endif /* ENABLE_PKCS11 */
2032	if ((pw = getpwuid(original_real_uid)) == NULL)	2076	if ((pw = getpwuid(original_real_uid)) == NULL)
2033	fatal("load_public_identity_files: getpwuid failed");	2077	fatal("load_public_identity_files: getpwuid failed");
2034	for (i = 0; i < options.num_identity_files; i++) {	2078	for (i = 0; i < options.num_identity_files; i++) {
		2079	char *name = options.identity_files[i];
2035	if (n_ids >= SSH_MAX_IDENTITY_FILES \|\|	2080	if (n_ids >= SSH_MAX_IDENTITY_FILES \|\|
2036	strcasecmp(options.identity_files[i], "none") == 0) {	2081	strcasecmp(name, "none") == 0) {
2037	free(options.identity_files[i]);	2082	free(options.identity_files[i]);
2038	options.identity_files[i] = NULL;	2083	options.identity_files[i] = NULL;
2039	continue;	2084	continue;
2040	}	2085	}
2041	cp = tilde_expand_filename(options.identity_files[i],	2086	#ifdef ENABLE_PKCS11
2042	original_real_uid);	2087	if (strlen(name) >= strlen(PKCS11_URI_SCHEME) &&
		2088	strncmp(name, PKCS11_URI_SCHEME,
		2089	strlen(PKCS11_URI_SCHEME)) == 0) {
		2090	load_pkcs11_identity(name, identity_files,
		2091	identity_keys, &n_ids);
		2092	continue;
		2093	}
		2094	#endif /* ENABLE_PKCS11 */
		2095	cp = tilde_expand_filename(name, original_real_uid);
2043	filename = percent_expand(cp, "d", pw->pw_dir,	2096	filename = percent_expand(cp, "d", pw->pw_dir,
2044	"u", pw->pw_name, "l", thishost, "h", host,	2097	"u", pw->pw_name, "l", thishost, "h", host,
2045	"r", options.user, (char *)NULL);	2098	"r", options.user, (char *)NULL);




.Cm CertificateFile
in order to provide any certificate also needed for authentication with
the identity.
.Pp
The authentication identity can be also specified in a form of PKCS#11 URI
starting with a string
.Cm pkcs11: .
There is supported a subset of the PKCS#11 URI as defined
in RFC 7512 (implemented path arguments
.Cm id ,
.Cm manufacturer ,
.Cm object ,
.Cm token
and query argument
.Cm module-path
). The URI can not be in quotes.
.It Cm IgnoreUnknown
Specifies a pattern-list of unknown options to be ignored if they are
encountered in configuration parsing.

Return to bug 2817

Lines 1848-1859 AC_LINK_IFELSE( Link Here

(-)a/configure.ac (+37 lines)
1848	[AC_DEFINE([HAVE_ISBLANK], [1], [Define if you have isblank(3C).])	1848	[AC_DEFINE([HAVE_ISBLANK], [1], [Define if you have isblank(3C).])
1849	])	1849	])
1850		1850
		1851	SCARD_MSG="yes"
1851	disable_pkcs11=	1852	disable_pkcs11=
1852	AC_ARG_ENABLE([pkcs11],	1853	AC_ARG_ENABLE([pkcs11],
1853	[ --disable-pkcs11 disable PKCS#11 support code [no]],	1854	[ --disable-pkcs11 disable PKCS#11 support code [no]],
1854	[	1855	[
1855	if test "x$enableval" = "xno" ; then	1856	if test "x$enableval" = "xno" ; then
1856	disable_pkcs11=1	1857	disable_pkcs11=1
		1858	SCARD_MSG="no"
1857	fi	1859	fi
1858	]	1860	]
1859	)	1861	)
Lines 1866-1871 if test "x$openssl" = "xyes" && test "x$disable_pkcs11" = "x"; then Link Here
1866	)	1868	)
1867	fi	1869	fi
1868		1870
		1871	# Check whether we have a p11-kit, we got default provider on command line
		1872	DEFAULT_PKCS11_PROVIDER_MSG="no"
		1873	AC_ARG_WITH([default-pkcs11-provider],
		1874	[ --with-default-pkcs11-provider[[=PATH]] Use default pkcs11 provider (p11-kit detected by default)],
		1875	[ if test "x$withval" != "xno" && test "x$disable_pkcs11" = "x"; then
		1876	if test "x$withval" = "xyes" ; then
		1877	AC_PATH_TOOL([PKGCONFIG], [pkg-config], [no])
		1878	if test "x$PKGCONFIG" != "xno"; then
		1879	AC_MSG_CHECKING([if $PKGCONFIG knows about p11-kit])
		1880	if "$PKGCONFIG" "p11-kit-1"; then
		1881	AC_MSG_RESULT([yes])
		1882	use_pkgconfig_for_p11kit=yes
		1883	else
		1884	AC_MSG_RESULT([no])
		1885	fi
		1886	fi
		1887	else
		1888	PKCS11_PATH="${withval}"
		1889	fi
		1890	if test "x$use_pkgconfig_for_p11kit" = "xyes"; then
		1891	PKCS11_PATH=`$PKGCONFIG --variable=proxy_module p11-kit-1`
		1892	fi
		1893	AC_CHECK_FILE("$PKCS11_PATH",
		1894	[ AC_DEFINE_UNQUOTED([PKCS11_DEFAULT_PROVIDER], ["$PKCS11_PATH"], [Path to default PKCS#11 provider (p11-kit proxy)])
		1895	DEFAULT_PKCS11_PROVIDER_MSG="$PKCS11_PATH"
		1896	],
		1897	[ AC_MSG_ERROR([Requested PKCS11 provided not found]) ]
		1898	)
		1899	else
		1900	AC_MSG_WARN([Needs PKCS11 support to enable default pkcs11 provider])
		1901	fi ]
		1902	)
		1903
		1904
1869	# IRIX has a const char return value for gai_strerror()	1905	# IRIX has a const char return value for gai_strerror()
1870	AC_CHECK_FUNCS([gai_strerror], [	1906	AC_CHECK_FUNCS([gai_strerror], [
1871	AC_DEFINE([HAVE_GAI_STRERROR])	1907	AC_DEFINE([HAVE_GAI_STRERROR])
Lines 5141-5146 echo " Translate v4 in v6 hack: $IPV4_IN6_HACK_MSG" Link Here
5141	echo " BSD Auth support: $BSD_AUTH_MSG"	5177	echo " BSD Auth support: $BSD_AUTH_MSG"
5142	echo " Random number source: $RAND_MSG"	5178	echo " Random number source: $RAND_MSG"
5143	echo " Privsep sandbox style: $SANDBOX_STYLE"	5179	echo " Privsep sandbox style: $SANDBOX_STYLE"
		5180	echo " Default PKCS#11 provider: $DEFAULT_PKCS11_PROVIDER_MSG"
5144		5181
5145	echo ""	5182	echo ""
5146		5183

Lines 912-917 may also be used in conjunction with Link Here

(-)a/ssh_config.5 (+13 lines)
912	.Cm CertificateFile	912	.Cm CertificateFile
913	in order to provide any certificate also needed for authentication with	913	in order to provide any certificate also needed for authentication with
914	the identity.	914	the identity.
		915	.Pp
		916	The authentication identity can be also specified in a form of PKCS#11 URI
		917	starting with a string
		918	.Cm pkcs11: .
		919	There is supported a subset of the PKCS#11 URI as defined
		920	in RFC 7512 (implemented path arguments
		921	.Cm id ,
		922	.Cm manufacturer ,
		923	.Cm object ,
		924	.Cm token
		925	and query argument
		926	.Cm module-path
		927	). The URI can not be in quotes.
915	.It Cm IgnoreUnknown	928	.It Cm IgnoreUnknown
916	Specifies a pattern-list of unknown options to be ignored if they are	929	Specifies a pattern-list of unknown options to be ignored if they are
917	encountered in configuration parsing.	930	encountered in configuration parsing.

Line 0 Link Here

(-)a/regress/locl.h (+79 lines)
		1	/*
		2	* Copyright (c) 2004, Stockholms universitet
		3	* (Stockholm University, Stockholm Sweden)
		4	* All rights reserved.
		5	*
		6	* Redistribution and use in source and binary forms, with or without
		7	* modification, are permitted provided that the following conditions
		8	* are met:
		9	*
		10	* 1. Redistributions of source code must retain the above copyright
		11	* notice, this list of conditions and the following disclaimer.
		12	*
		13	* 2. Redistributions in binary form must reproduce the above copyright
		14	* notice, this list of conditions and the following disclaimer in the
		15	* documentation and/or other materials provided with the distribution.
		16	*
		17	* 3. Neither the name of the university nor the names of its contributors
		18	* may be used to endorse or promote products derived from this software
		19	* without specific prior written permission.
		20	*
		21	* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
		22	* AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
		23	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
		24	* ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
		25	* LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
		26	* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
		27	* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
		28	* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
		29	* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
		30	* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
		31	* POSSIBILITY OF SUCH DAMAGE.
		32	*/
		33
		34	/* $Id: locl.h,v 1.5 2005/08/28 15:30:31 lha Exp $ */
		35
		36	#ifdef HAVE_CONFIG_H
		37	#include <config.h>
		38	#endif
		39
		40	#include <openssl/err.h>
		41	#include <openssl/evp.h>
		42	#include <openssl/pem.h>
		43	#include <openssl/rand.h>
		44	#include <openssl/x509.h>
		45	#include "../libcrypto-compat.h"
		46
		47	#include <ctype.h>
		48	#include <errno.h>
		49	#include <pwd.h>
		50	#include <stdarg.h>
		51	#define _GNU_SOURCE
		52	#include <stdio.h>
		53	#include <stdlib.h>
		54	#include <string.h>
		55	#include <unistd.h>
		56
		57	#include "../pkcs11.h"
		58
		59	#define OPENSSL_ASN1_MALLOC_ENCODE(T, B, BL, S, R) \
		60	{ \
		61	unsigned char *p; \
		62	(BL) = i2d_##T((S), NULL); \
		63	if ((BL) <= 0) { \
		64	(R) = EINVAL; \
65	} else { \
66	(B) = malloc((BL)); \
67	if ((B) == NULL) { \
68	(R) = ENOMEM; \
69	} else { \
70	p = (B); \
71	(R) = 0; \
72	(BL) = i2d_##T((S), &p); \
73	if ((BL) <= 0) { \
74	free((B)); \
75	(R) = EINVAL; \
76	} \
77	} \
78	} \
79	}

Line 0 Link Here

(-)a/regress/pkcs11.sh (+285 lines)
		1	#
		2	# Copyright (c) 2017 Red Hat
		3	#
		4	# Authors: Jakub Jelen <jjelen@redhat.com>
		5	#
		6	# Permission to use, copy, modify, and distribute this software for any
		7	# purpose with or without fee is hereby granted, provided that the above
		8	# copyright notice and this permission notice appear in all copies.
		9	#
		10	# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
		11	# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
		12	# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
		13	# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
		14	# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
		15	# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
		16	# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
		17
		18	tid="pkcs11 tests with soft token"
		19
		20	TEST_SSH_PIN=""
		21	TEST_SSH_PKCS11=$OBJ/soft-pkcs11.so
		22
		23	test -f "$TEST_SSH_PKCS11" \|\| fatal "$TEST_SSH_PKCS11 does not exist"
		24
		25	# requires ssh-agent built with correct path to ssh-pkcs11-helper
		26	# otherwise it fails to start the helper
		27	strings ${TEST_SSH_SSHAGENT} \| grep "$TEST_SSH_SSHPKCS11HELPER"
		28	if [ $? -ne 0 ]; then
		29	fatal "Needs to reconfigure with --libexecdir=\`pwd\` or so"
		30	fi
		31
		32	# setup environment for soft-pkcs11 token
		33	SOFTPKCS11RC=$OBJ/pkcs11.info
		34	rm -f $SOFTPKCS11RC
		35	export SOFTPKCS11RC
		36	# prevent ssh-agent from calling ssh-askpass
		37	SSH_ASKPASS=/usr/bin/true
		38	export SSH_ASKPASS
		39	unset DISPLAY
		40
		41	# start command w/o tty, so ssh accepts pin from stdin (from agent-pkcs11.sh)
		42	notty() {
		43	perl -e 'use POSIX; POSIX::setsid();
		44	if (fork) { wait; exit($? >> 8); } else { exec(@ARGV) }' "$@"
		45	}
		46
		47	create_key() {
		48	ID=$1
		49	LABEL=$2
		50	rm -f $OBJ/pkcs11-${ID}.key $OBJ/pkcs11-${ID}.crt
		51	openssl genrsa -out $OBJ/pkcs11-${ID}.key 2048 > /dev/null 2>&1
		52	chmod 600 $OBJ/pkcs11-${ID}.key
		53	openssl req -key $OBJ/pkcs11-${ID}.key -new -x509 \
		54	-out $OBJ/pkcs11-${ID}.crt -text -subj '/CN=pkcs11 test' >/dev/null
		55	printf "${ID}\t${LABEL}\t$OBJ/pkcs11-${ID}.crt\t$OBJ/pkcs11-${ID}.key\n" \
		56	>> $SOFTPKCS11RC
		57	}
		58
		59	trace "Create a key pairs on soft token"
		60	ID1="02"
		61	ID2="04"
		62	create_key "$ID1" "SSH RSA Key"
		63	create_key "$ID2" "SSH RSA Key 2"
		64
65	trace "List the keys in the ssh-keygen with PKCS#11 URIs"
66	${SSHKEYGEN} -D ${TEST_SSH_PKCS11} > $OBJ/token_keys
67	if [ $? -ne 0 ]; then
68	fail "keygen fails to enumerate keys on PKCS#11 token"
69	fi
70	grep "pkcs11:" $OBJ/token_keys > /dev/null
71	if [ $? -ne 0 ]; then
72	fail "The keys from ssh-keygen do not contain PKCS#11 URI as a comment"
73	fi
74	tail -n 1 $OBJ/token_keys > $OBJ/authorized_keys_$USER
75
76
77	trace "Simple connect with ssh (without PKCS#11 URI)"
78	echo ${TEST_SSH_PIN} \| notty ${SSH} -I ${TEST_SSH_PKCS11} \
79	-F $OBJ/ssh_proxy somehost exit 5
80	r=$?
81	if [ $r -ne 5 ]; then
82	fail "ssh connect with pkcs11 failed (exit code $r)"
83	fi
84
85
86	trace "Connect with PKCS#11 URI"
87	trace " (second key should succeed)"
88	echo ${TEST_SSH_PIN} \| notty ${SSH} -F $OBJ/ssh_proxy \
89	-i "pkcs11:id=${ID2}?module-path=${TEST_SSH_PKCS11}" somehost exit 5
90	r=$?
91	if [ $r -ne 5 ]; then
92	fail "ssh connect with PKCS#11 URI failed (exit code $r)"
93	fi
94
95	trace " (first key should fail)"
96	echo ${TEST_SSH_PIN} \| notty ${SSH} -F $OBJ/ssh_proxy \
97	-i "pkcs11:id=${ID1}?module-path=${TEST_SSH_PKCS11}" somehost exit 5
98	r=$?
99	if [ $r -eq 5 ]; then
100	fail "ssh connect with PKCS#11 URI succeeded (should fail)"
101	fi
102
103	trace "Connect with various filtering options in PKCS#11 URI"
104	trace " (by object label, second key should succeed)"
105	echo ${TEST_SSH_PIN} \| notty ${SSH} -F $OBJ/ssh_proxy \
106	-i "pkcs11:object=SSH%20RSA%20Key%202?module-path=${TEST_SSH_PKCS11}" somehost exit 5
107	r=$?
108	if [ $r -ne 5 ]; then
109	fail "ssh connect with PKCS#11 URI failed (exit code $r)"
110	fi
111
112	trace " (by object label, first key should fail)"
113	echo ${TEST_SSH_PIN} \| notty ${SSH} -F $OBJ/ssh_proxy \
114	-i "pkcs11:object=SSH%20RSA%20Key?module-path=${TEST_SSH_PKCS11}" somehost exit 5
115	r=$?
116	if [ $r -eq 5 ]; then
117	fail "ssh connect with PKCS#11 URI succeeded (should fail)"
118	fi
119
120	trace " (by token label, second key should succeed)"
121	echo ${TEST_SSH_PIN} \| notty ${SSH} -F $OBJ/ssh_proxy \
122	-i "pkcs11:id=${ID2};token=SoftToken%20(token)?module-path=${TEST_SSH_PKCS11}" somehost exit 5
123	r=$?
124	if [ $r -ne 5 ]; then
125	fail "ssh connect with PKCS#11 URI failed (exit code $r)"
126	fi
127
128	trace " (by wrong token label, should fail)"
129	echo ${TEST_SSH_PIN} \| notty ${SSH} -F $OBJ/ssh_proxy \
130	-i "pkcs11:token=SoftToken?module-path=${TEST_SSH_PKCS11}" somehost exit 5
131	r=$?
132	if [ $r -eq 5 ]; then
133	fail "ssh connect with PKCS#11 URI succeeded (should fail)"
134	fi
135
136
137
138
139	trace "Test PKCS#11 URI specification in configuration files"
140	echo "IdentityFile pkcs11:id=${ID2}?module-path=${TEST_SSH_PKCS11}" \
141	>> $OBJ/ssh_proxy
142	trace " (second key should succeed)"
143	echo ${TEST_SSH_PIN} \| notty ${SSH} -F $OBJ/ssh_proxy somehost exit 5
144	r=$?
145	if [ $r -ne 5 ]; then
146	fail "ssh connect with PKCS#11 URI in config failed (exit code $r)"
147	fi
148
149	trace " (first key should fail)"
150	head -n 1 $OBJ/token_keys > $OBJ/authorized_keys_$USER
151	echo ${TEST_SSH_PIN} \| notty ${SSH} -F $OBJ/ssh_proxy somehost exit 5
152	r=$?
153	if [ $r -eq 5 ]; then
154	fail "ssh connect with PKCS#11 URI in config succeeded (should fail)"
155	fi
156	sed -i -e "/IdentityFile/d" $OBJ/ssh_proxy
157
158	trace "Test PKCS#11 URI specification in configuration files with bogus spaces"
159	echo "IdentityFile pkcs11:id=${ID1}?module-path=${TEST_SSH_PKCS11} " \
160	>> $OBJ/ssh_proxy
161	echo ${TEST_SSH_PIN} \| notty ${SSH} -F $OBJ/ssh_proxy somehost exit 5
162	r=$?
163	if [ $r -ne 5 ]; then
164	fail "ssh connect with PKCS#11 URI with bogus spaces in config failed" \
165	"(exit code $r)"
166	fi
167	sed -i -e "/IdentityFile/d" $OBJ/ssh_proxy
168
169
170	trace "Combination of PKCS11Provider and PKCS11URI on commandline"
171	trace " (first key should succeed)"
172	echo ${TEST_SSH_PIN} \| notty ${SSH} -F $OBJ/ssh_proxy \
173	-i "pkcs11:id=${ID1}" -I ${TEST_SSH_PKCS11} somehost exit 5
174	r=$?
175	if [ $r -ne 5 ]; then
176	fail "ssh connect with PKCS#11 URI and provider combination" \
177	"failed (exit code $r)"
178	fi
179
180	trace "Regress: Missing provider in PKCS11URI option"
181	${SSH} -F $OBJ/ssh_proxy \
182	-o IdentityFile='pkcs11:token=segfault' somehost exit 5
183	r=$?
184	if [ $r -eq 139 ]; then
185	fail "ssh connect with missing provider_id from configuration option" \
186	"crashed (exit code $r)"
187	fi
188
189
190	trace "SSH Agent can work with PKCS#11 URI"
191	trace "start the agent"
192	eval `${SSHAGENT} -s -P "${OBJ}/*"` > /dev/null
193
194	r=$?
195	if [ $r -ne 0 ]; then
196	fail "could not start ssh-agent: exit code $r"
197	else
198	trace "add whole provider to agent"
199	echo ${TEST_SSH_PIN} \| notty ${SSHADD} \
200	"pkcs11:?module-path=${TEST_SSH_PKCS11}" > /dev/null 2>&1
201	r=$?
202	if [ $r -ne 0 ]; then
203	fail "ssh-add failed with whole provider: exit code $r"
204	fi
205
206	trace " pkcs11 list via agent (all keys)"
207	${SSHADD} -l > /dev/null 2>&1
208	r=$?
209	if [ $r -ne 0 ]; then
210	fail "ssh-add -l failed with whole provider: exit code $r"
211	fi
212
213	trace " pkcs11 connect via agent (all keys)"
214	${SSH} -F $OBJ/ssh_proxy somehost exit 5
215	r=$?
216	if [ $r -ne 5 ]; then
217	fail "ssh connect failed with whole provider (exit code $r)"
218	fi
219
220	trace " remove pkcs11 keys (all keys)"
221	${SSHADD} -d "pkcs11:?module-path=${TEST_SSH_PKCS11}" > /dev/null 2>&1
222	r=$?
223	if [ $r -ne 0 ]; then
224	fail "ssh-add -d failed with whole provider: exit code $r"
225	fi
226
227	trace "add only first key to the agent"
228	echo ${TEST_SSH_PIN} \| notty ${SSHADD} \
229	"pkcs11:id=${ID1}?module-path=${TEST_SSH_PKCS11}" > /dev/null 2>&1
230	r=$?
231	if [ $r -ne 0 ]; then
232	fail "ssh-add failed with first key: exit code $r"
233	fi
234
235	trace " pkcs11 connect via agent (first key)"
236	${SSH} -F $OBJ/ssh_proxy somehost exit 5
237	r=$?
238	if [ $r -ne 5 ]; then
239	fail "ssh connect failed with first key (exit code $r)"
240	fi
241
242	trace " remove first pkcs11 key"
243	${SSHADD} -d "pkcs11:id=${ID1}?module-path=${TEST_SSH_PKCS11}" \
244	> /dev/null 2>&1
245	r=$?
246	if [ $r -ne 0 ]; then
247	fail "ssh-add -d failed with first key: exit code $r"
248	fi
249
250	trace "add only second key to the agent"
251	echo ${TEST_SSH_PIN} \| notty ${SSHADD} \
252	"pkcs11:id=${ID2}?module-path=${TEST_SSH_PKCS11}" > /dev/null 2>&1
253	r=$?
254	if [ $r -ne 0 ]; then
255	fail "ssh-add failed with second key: exit code $r"
256	fi
257
258	trace " pkcs11 connect via agent (second key should fail)"
259	${SSH} -F $OBJ/ssh_proxy somehost exit 5
260	r=$?
261	if [ $r -eq 5 ]; then
262	fail "ssh connect passed without key (should fail)"
263	fi
264
265	trace " remove second pkcs11 key"
266	${SSHADD} -d "pkcs11:id=${ID2}?module-path=${TEST_SSH_PKCS11}" \
267	> /dev/null 2>&1
268	r=$?
269	if [ $r -ne 0 ]; then
270	fail "ssh-add -d failed with second key: exit code $r"
271	fi
272
273	trace " remove already-removed pkcs11 key should fail"
274	${SSHADD} -d "pkcs11:id=${ID1}?module-path=${TEST_SSH_PKCS11}" \
275	> /dev/null 2>&1
276	r=$?
277	if [ $r -eq 0 ]; then
278	fail "ssh-add -d passed with non-existing key (should fail)"
279	fi
280
281	trace "kill agent"
282	${SSHAGENT} -k > /dev/null
283	fi
284
285	rm -rf $OBJ/.tokens $OBJ/token_keys

Line 0 Link Here

(-)a/regress/unittests/pkcs11/tests.c (+329 lines)
		1	/*
		2	* Copyright (c) 2017 Red Hat
		3	*
		4	* Authors: Jakub Jelen <jjelen@redhat.com>
		5	*
		6	* Permission to use, copy, modify, and distribute this software for any
		7	* purpose with or without fee is hereby granted, provided that the above
		8	* copyright notice and this permission notice appear in all copies.
		9	*
		10	* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
		11	* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
		12	* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
		13	* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
		14	* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
		15	* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
		16	* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
		17	*/
		18
		19	#include "includes.h"
		20
		21	#include <locale.h>
		22	#include <string.h>
		23
		24	#include "../test_helper/test_helper.h"
		25
		26	#include "ssh-pkcs11-uri.h"
		27
		28	#define EMPTY_URI compose_uri(NULL, 0, NULL, NULL, NULL, NULL, NULL)
		29
		30	/* prototypes are not public -- specify them here internally for tests */
		31	struct sshbuf percent_encode(const char , size_t, char *);
		32	int percent_decode(char , char *);
		33
		34	void
		35	compare_uri(struct pkcs11_uri a, struct pkcs11_uri b)
		36	{
		37	ASSERT_PTR_NE(a, NULL);
		38	ASSERT_PTR_NE(b, NULL);
		39	ASSERT_SIZE_T_EQ(a->id_len, b->id_len);
		40	ASSERT_MEM_EQ(a->id, b->id, a->id_len);
		41	if (b->object != NULL)
		42	ASSERT_STRING_EQ(a->object, b->object);
		43	else /* both should be null */
		44	ASSERT_PTR_EQ(a->object, b->object);
		45	if (b->module_path != NULL)
		46	ASSERT_STRING_EQ(a->module_path, b->module_path);
		47	else /* both should be null */
		48	ASSERT_PTR_EQ(a->module_path, b->module_path);
		49	if (b->token != NULL)
		50	ASSERT_STRING_EQ(a->token, b->token);
		51	else /* both should be null */
		52	ASSERT_PTR_EQ(a->token, b->token);
		53	if (b->manuf != NULL)
		54	ASSERT_STRING_EQ(a->manuf, b->manuf);
		55	else /* both should be null */
		56	ASSERT_PTR_EQ(a->manuf, b->manuf);
		57	if (b->lib_manuf != NULL)
		58	ASSERT_STRING_EQ(a->lib_manuf, b->lib_manuf);
		59	else /* both should be null */
		60	ASSERT_PTR_EQ(a->lib_manuf, b->lib_manuf);
		61	}
		62
		63	void
		64	check_parse_rv(char uri, struct pkcs11_uri expect, int expect_rv)
65	{
66	char buf = NULL, str;
67	struct pkcs11_uri *pkcs11uri = NULL;
68	int rv;
69
70	if (expect_rv == 0)
71	str = "Valid";
72	else
73	str = "Invalid";
74	asprintf(&buf, "%s PKCS#11 URI parsing: %s", str, uri);
75	TEST_START(buf);
76	free(buf);
77	pkcs11uri = pkcs11_uri_init();
78	rv = pkcs11_uri_parse(uri, pkcs11uri);
79	ASSERT_INT_EQ(rv, expect_rv);
80	if (rv == 0) /* in case of failure result is undefined */
81	compare_uri(pkcs11uri, expect);
82	pkcs11_uri_cleanup(pkcs11uri);
83	free(expect);
84	TEST_DONE();
85	}
86
87	void
88	check_parse(char uri, struct pkcs11_uri expect)
89	{
90	check_parse_rv(uri, expect, 0);
91	}
92
93	struct pkcs11_uri *
94	compose_uri(unsigned char id, size_t id_len, char token, char *lib_manuf,
95	char manuf, char module_path, char *object)
96	{
97	struct pkcs11_uri *uri = pkcs11_uri_init();
98	if (id_len > 0) {
99	uri->id_len = id_len;
100	uri->id = id;
101	}
102	uri->module_path = module_path;
103	uri->token = token;
104	uri->lib_manuf = lib_manuf;
105	uri->manuf = manuf;
106	uri->object = object;
107	return uri;
108	}
109
110	static void
111	test_parse_valid(void)
112	{
113	/* path arguments */
114	check_parse("pkcs11:id=%01",
115	compose_uri("\x01", 1, NULL, NULL, NULL, NULL, NULL));
116	check_parse("pkcs11:id=%00%01",
117	compose_uri("\x00\x01", 2, NULL, NULL, NULL, NULL, NULL));
118	check_parse("pkcs11:token=SSH%20Keys",
119	compose_uri(NULL, 0, "SSH Keys", NULL, NULL, NULL, NULL));
120	check_parse("pkcs11:library-manufacturer=OpenSC",
121	compose_uri(NULL, 0, NULL, "OpenSC", NULL, NULL, NULL));
122	check_parse("pkcs11:manufacturer=piv_II",
123	compose_uri(NULL, 0, NULL, NULL, "piv_II", NULL, NULL));
124	check_parse("pkcs11:object=SIGN%20Key",
125	compose_uri(NULL, 0, NULL, NULL, NULL, NULL, "SIGN Key"));
126	/* query arguments */
127	check_parse("pkcs11:?module-path=/usr/lib64/p11-kit-proxy.so",
128	compose_uri(NULL, 0, NULL, NULL, NULL, "/usr/lib64/p11-kit-proxy.so", NULL));
129
130	/* combinations */
131	/* ID SHOULD be percent encoded */
132	check_parse("pkcs11:token=SSH%20Key;id=0",
133	compose_uri("0", 1, "SSH Key", NULL, NULL, NULL, NULL));
134	check_parse(
135	"pkcs11:manufacturer=CAC?module-path=/usr/lib64/p11-kit-proxy.so",
136	compose_uri(NULL, 0, NULL, NULL, "CAC",
137	"/usr/lib64/p11-kit-proxy.so", NULL));
138	check_parse(
139	"pkcs11:object=RSA%20Key?module-path=/usr/lib64/pkcs11/opencryptoki.so",
140	compose_uri(NULL, 0, NULL, NULL, NULL,
141	"/usr/lib64/pkcs11/opencryptoki.so", "RSA Key"));
142
143	/* empty path component matches everything */
144	check_parse("pkcs11:", EMPTY_URI);
145
146	/* empty string is a valid to match against (and different from NULL) */
147	check_parse("pkcs11:token=",
148	compose_uri(NULL, 0, "", NULL, NULL, NULL, NULL));
149	/* Percent character needs to be percent-encoded */
150	check_parse("pkcs11:token=%25",
151	compose_uri(NULL, 0, "%", NULL, NULL, NULL, NULL));
152	}
153
154	static void
155	test_parse_invalid(void)
156	{
157	/* Invalid percent encoding */
158	check_parse_rv("pkcs11:id=%0", EMPTY_URI, -1);
159	/* Invalid percent encoding */
160	check_parse_rv("pkcs11:id=%ZZ", EMPTY_URI, -1);
161	/* Space MUST be percent encoded -- XXX not enforced yet */
162	check_parse("pkcs11:token=SSH Keys",
163	compose_uri(NULL, 0, "SSH Keys", NULL, NULL, NULL, NULL));
164	/* MUST NOT contain duplicate attributes of the same name */
165	check_parse_rv("pkcs11:id=%01;id=%02", EMPTY_URI, -1);
166	/* Unrecognized attribute in path SHOULD be error */
167	check_parse_rv("pkcs11:key_name=SSH", EMPTY_URI, -1);
168	/* Unrecognized attribute in query SHOULD be ignored */
169	check_parse("pkcs11:?key_name=SSH", EMPTY_URI);
170	}
171
172	void
173	check_gen(char expect, struct pkcs11_uri uri)
174	{
175	char buf = NULL, uri_str;
176
177	asprintf(&buf, "Valid PKCS#11 URI generation: %s", expect);
178	TEST_START(buf);
179	free(buf);
180	uri_str = pkcs11_uri_get(uri);
181	ASSERT_PTR_NE(uri_str, NULL);
182	ASSERT_STRING_EQ(uri_str, expect);
183	free(uri_str);
184	TEST_DONE();
185	}
186
187	static void
188	test_generate_valid(void)
189	{
190	/* path arguments */
191	check_gen("pkcs11:id=%01",
192	compose_uri("\x01", 1, NULL, NULL, NULL, NULL, NULL));
193	check_gen("pkcs11:id=%00%01",
194	compose_uri("\x00\x01", 2, NULL, NULL, NULL, NULL, NULL));
195	check_gen("pkcs11:token=SSH%20Keys", /* space must be percent encoded */
196	compose_uri(NULL, 0, "SSH Keys", NULL, NULL, NULL, NULL));
197	/* library-manufacturer is not implmented now */
198	/*check_gen("pkcs11:library-manufacturer=OpenSC",
199	compose_uri(NULL, 0, NULL, "OpenSC", NULL, NULL, NULL));*/
200	check_gen("pkcs11:manufacturer=piv_II",
201	compose_uri(NULL, 0, NULL, NULL, "piv_II", NULL, NULL));
202	check_gen("pkcs11:object=RSA%20Key",
203	compose_uri(NULL, 0, NULL, NULL, NULL, NULL, "RSA Key"));
204	/* query arguments */
205	check_gen("pkcs11:?module-path=/usr/lib64/p11-kit-proxy.so",
206	compose_uri(NULL, 0, NULL, NULL, NULL, "/usr/lib64/p11-kit-proxy.so", NULL));
207
208	/* combinations */
209	check_gen("pkcs11:id=%02;token=SSH%20Keys",
210	compose_uri("\x02", 1, "SSH Keys", NULL, NULL, NULL, NULL));
211	check_gen("pkcs11:id=%EE%02?module-path=/usr/lib64/p11-kit-proxy.so",
212	compose_uri("\xEE\x02", 2, NULL, NULL, NULL, "/usr/lib64/p11-kit-proxy.so", NULL));
213	check_gen("pkcs11:object=Encryption%20Key;manufacturer=piv_II",
214	compose_uri(NULL, 0, NULL, NULL, "piv_II", NULL, "Encryption Key"));
215
216	/* empty path component matches everything */
217	check_gen("pkcs11:", EMPTY_URI);
218
219	}
220
221	void
222	check_encode(char source, size_t len, char whitelist, char *expect)
223	{
224	char *buf = NULL;
225	struct sshbuf *b;
226
227	asprintf(&buf, "percent_encode: expected %s", expect);
228	TEST_START(buf);
229	free(buf);
230
231	b = percent_encode(source, len, whitelist);
232	ASSERT_STRING_EQ(sshbuf_ptr(b), expect);
233	sshbuf_free(b);
234	TEST_DONE();
235	}
236
237	static void
238	test_percent_encode_multibyte(void)
239	{
240	/* SHOULD be encoded as octets according to the UTF-8 character encoding */
241
242	/* multi-byte characters are "for free" */
243	check_encode("$", 1, "", "%24");
244	check_encode("¢", 2, "", "%C2%A2");
245	check_encode("€", 3, "", "%E2%82%AC");
246	check_encode("𐍈", 4, "", "%F0%90%8D%88");
247
248	/* CK_UTF8CHAR is unsigned char (1 byte) */
249	/* labels SHOULD be normalized to NFC [UAX15] */
250
251	}
252
253	static void
254	test_percent_encode(void)
255	{
256	/* Without whitelist encodes everything (for CKA_ID) */
257	check_encode("A*", 2, "", "%41%2A");
258	check_encode("\x00", 1, "", "%00");
259	check_encode("\x7F", 1, "", "%7F");
260	check_encode("\x80", 1, "", "%80");
261	check_encode("\xff", 1, "", "%FF");
262
263	/* Default whitelist encodes anything but safe letters */
264	check_encode("test" "\x00" "0alpha", 11, PKCS11_URI_WHITELIST,
265	"test%000alpha");
266	check_encode(" ", 1, PKCS11_URI_WHITELIST,
267	"%20"); /* Space MUST be percent encoded */
268	check_encode("/", 1, PKCS11_URI_WHITELIST,
269	"%2F"); /* '/' delimiter MUST be percent encoded (in the path) */
270	check_encode("?", 1, PKCS11_URI_WHITELIST,
271	"%3F"); /* delimiter '?' MUST be percent encoded (in the path) */
272	check_encode("#", 1, PKCS11_URI_WHITELIST,
273	"%23"); /* '#' MUST be always percent encoded */
274	check_encode("key=value;separator?query&#anch", 35, PKCS11_URI_WHITELIST,
275	"key%3Dvalue%3Bseparator%3Fquery%26amp%3B%23anch");
276
277	/* Components in query can have '/' unencoded (useful for paths) */
278	check_encode("/path/to.file", 13, PKCS11_URI_WHITELIST "/",
279	"/path/to.file");
280	}
281
282	void
283	check_decode(char source, char expect, int expect_len)
284	{
285	char buf = NULL, out = NULL;
286	int rv;
287
288	asprintf(&buf, "percent_decode: %s", source);
289	TEST_START(buf);
290	free(buf);
291
292	rv = percent_decode(source, &out);
293	ASSERT_INT_EQ(rv, expect_len);
294	if (rv >= 0)
295	ASSERT_MEM_EQ(out, expect, expect_len);
296	free(out);
297	TEST_DONE();
298	}
299
300	static void
301	test_percent_decode(void)
302	{
303	/* simple valid cases */
304	check_decode("%00", "\x00", 1);
305	check_decode("%FF", "\xFF", 1);
306
307	/* normal strings shold be kept intact */
308	check_decode("strings are left", "strings are left", 16);
309	check_decode("10%25 of trees", "10% of trees", 12);
310
311	/* make sure no more than 2 bytes are parsed */
312	check_decode("%222", "\x22" "2", 2);
313
314	/* invalid expects failure */
315	check_decode("%0", "", -1);
316	check_decode("%Z", "", -1);
317	check_decode("%FG", "", -1);
318	}
319
320	void
321	tests(void)
322	{
323	test_percent_encode();
324	test_percent_encode_multibyte();
325	test_percent_decode();
326	test_parse_valid();
327	test_parse_invalid();
328	test_generate_valid();
329	}

Lines 64-69 Link Here

(-)a/ssh-add.c (+26 lines)
64	#include "misc.h"	64	#include "misc.h"
65	#include "ssherr.h"	65	#include "ssherr.h"
66	#include "digest.h"	66	#include "digest.h"
		67	#include "ssh-pkcs11-uri.h"
67		68
68	/* argv0 */	69	/* argv0 */
69	extern char *__progname;	70	extern char *__progname;
Lines 183-188 delete_all(int agent_fd) Link Here
183	return ret;	184	return ret;
184	}	185	}
185		186
		187	#ifdef ENABLE_PKCS11
		188	static int update_card(int, int, const char *);
		189
		190	int
		191	update_pkcs11_uri(int agent_fd, int adding, const char *pkcs11_uri)
		192	{
		193	struct pkcs11_uri *uri;
		194
		195	/* dry-run parse to make sure the URI is valid and to report errors */
		196	uri = pkcs11_uri_init();
		197	if (pkcs11_uri_parse((char *) pkcs11_uri, uri) != 0)
		198	fatal("Failed to parse PKCS#11 URI");
		199	pkcs11_uri_cleanup(uri);
		200
		201	return update_card(agent_fd, adding, pkcs11_uri);
		202	}
		203	#endif
		204
186	static int	205	static int
187	add_file(int agent_fd, const char *filename, int key_only, int qflag)	206	add_file(int agent_fd, const char *filename, int key_only, int qflag)
188	{	207	{
Lines 434-439 lock_agent(int agent_fd, int lock) Link Here
434	static int	453	static int
435	do_file(int agent_fd, int deleting, int key_only, char *file, int qflag)	454	do_file(int agent_fd, int deleting, int key_only, char *file, int qflag)
436	{	455	{
		456	#ifdef ENABLE_PKCS11
		457	if (strlen(file) >= strlen(PKCS11_URI_SCHEME) &&
		458	strncmp(file, PKCS11_URI_SCHEME,
		459	strlen(PKCS11_URI_SCHEME)) == 0) {
		460	return update_pkcs11_uri(agent_fd, !deleting, file);
		461	}
		462	#endif
437	if (deleting) {	463	if (deleting) {
438	if (delete_file(agent_fd, file, key_only, qflag) == -1)	464	if (delete_file(agent_fd, file, key_only, qflag) == -1)
439	return -1;	465	return -1;

Lines 532-541 no_identities(SocketEntry *e) Link Here

(-)a/ssh-agent.c (-22 / +77 lines)
532	}	532	}
533		533
534	#ifdef ENABLE_PKCS11	534	#ifdef ENABLE_PKCS11
		535	static char *
		536	sanitize_pkcs11_provider(const char *provider)
		537	{
		538	struct pkcs11_uri *uri = NULL;
		539	char sane_uri, module_path = NULL; /* default path */
		540	char canonical_provider[PATH_MAX];
		541
		542	if (provider == NULL)
		543	return NULL;
		544
		545	if (strlen(provider) >= strlen(PKCS11_URI_SCHEME) &&
		546	strncmp(provider, PKCS11_URI_SCHEME,
		547	strlen(PKCS11_URI_SCHEME)) == 0) {
		548	/* PKCS#11 URI */
		549	uri = pkcs11_uri_init();
		550	if (uri == NULL) {
		551	error("Failed to init PCKS#11 URI");
		552	return NULL;
		553	}
		554
		555	if (pkcs11_uri_parse(provider, uri) != 0) {
		556	error("Failed to parse PKCS#11 URI");
		557	return NULL;
		558	}
		559	/* validate also provider from URI */
		560	if (uri->module_path)
		561	module_path = strdup(uri->module_path);
		562	} else
		563	module_path = strdup(provider); /* simple path */
		564
		565	if (module_path != NULL) { /* do not validate default NULL path in URI */
		566	if (realpath(module_path, canonical_provider) == NULL) {
		567	verbose("failed PKCS#11 provider \"%.100s\": realpath: %s",
		568	module_path, strerror(errno));
		569	free(module_path);
		570	return NULL;
		571	}
		572	free(module_path);
		573	if (match_pattern_list(canonical_provider, pkcs11_whitelist, 0) != 1) {
		574	verbose("refusing PKCS#11 provider \"%.100s\": "
		575	"not whitelisted", canonical_provider);
		576	return NULL;
		577	}
		578
		579	/* copy verified and sanitized provider path back to the uri */
		580	if (uri) {
		581	free(uri->module_path);
		582	uri->module_path = xstrdup(canonical_provider);
		583	}
		584	}
		585
		586	if (uri) {
		587	sane_uri = pkcs11_uri_get(uri);
		588	pkcs11_uri_cleanup(uri);
		589	return sane_uri;
		590	} else {
		591	return xstrdup(canonical_provider); /* simple path */
		592	}
		593	}
		594
535	static void	595	static void
536	process_add_smartcard_key(SocketEntry *e)	596	process_add_smartcard_key(SocketEntry *e)
537	{	597	{
538	char provider = NULL, pin = NULL, canonical_provider[PATH_MAX];	598	char provider = NULL, pin = NULL, *sane_uri = NULL;
539	int r, i, count = 0, success = 0, confirm = 0;	599	int r, i, count = 0, success = 0, confirm = 0;
540	u_int seconds;	600	u_int seconds;
541	time_t death = 0;	601	time_t death = 0;
Lines 571-598 process_add_smartcard_key(SocketEntry *e) Link Here
571	goto send;	631	goto send;
572	}	632	}
573	}	633	}
574	if (realpath(provider, canonical_provider) == NULL) {	634
575	verbose("failed PKCS#11 add of \"%.100s\": realpath: %s",	635	sane_uri = sanitize_pkcs11_provider(provider);
576	provider, strerror(errno));	636	if (sane_uri == NULL)
577	goto send;
578	}
579	if (match_pattern_list(canonical_provider, pkcs11_whitelist, 0) != 1) {
580	verbose("refusing PKCS#11 add of \"%.100s\": "
581	"provider not whitelisted", canonical_provider);
582	goto send;	637	goto send;
583	}	638
584	debug("%s: add %.100s", __func__, canonical_provider);
585	if (lifetime && !death)	639	if (lifetime && !death)
586	death = monotime() + lifetime;	640	death = monotime() + lifetime;
587		641
588	count = pkcs11_add_provider(canonical_provider, pin, &keys);	642	debug("%s: add %.100s", __func__, sane_uri);
		643	count = pkcs11_add_provider(sane_uri, pin, &keys);
589	for (i = 0; i < count; i++) {	644	for (i = 0; i < count; i++) {
590	k = keys[i];	645	k = keys[i];
591	if (lookup_identity(k) == NULL) {	646	if (lookup_identity(k) == NULL) {
592	id = xcalloc(1, sizeof(Identity));	647	id = xcalloc(1, sizeof(Identity));
593	id->key = k;	648	id->key = k;
594	id->provider = xstrdup(canonical_provider);	649	id->provider = xstrdup(sane_uri);
595	id->comment = xstrdup(canonical_provider); /* XXX */	650	id->comment = xstrdup(sane_uri);
596	id->death = death;	651	id->death = death;
597	id->confirm = confirm;	652	id->confirm = confirm;
598	TAILQ_INSERT_TAIL(&idtab->idlist, id, next);	653	TAILQ_INSERT_TAIL(&idtab->idlist, id, next);
Lines 606-611 process_add_smartcard_key(SocketEntry *e) Link Here
606	send:	661	send:
607	free(pin);	662	free(pin);
608	free(provider);	663	free(provider);
		664	free(sane_uri);
609	free(keys);	665	free(keys);
610	send_status(e, success);	666	send_status(e, success);
611	}	667	}
Lines 613-619 send: Link Here
613	static void	669	static void
614	process_remove_smartcard_key(SocketEntry *e)	670	process_remove_smartcard_key(SocketEntry *e)
615	{	671	{
616	char provider = NULL, pin = NULL, canonical_provider[PATH_MAX];	672	char provider = NULL, pin = NULL, *sane_uri = NULL;
617	int r, success = 0;	673	int r, success = 0;
618	Identity id, nxt;	674	Identity id, nxt;
619		675
Lines 624-653 process_remove_smartcard_key(SocketEntry *e) Link Here
624	}	680	}
625	free(pin);	681	free(pin);
626		682
627	if (realpath(provider, canonical_provider) == NULL) {	683	sane_uri = sanitize_pkcs11_provider(provider);
628	verbose("failed PKCS#11 add of \"%.100s\": realpath: %s",	684	if (sane_uri == NULL)
629	provider, strerror(errno));
630	goto send;	685	goto send;
631	}
632		686
633	debug("%s: remove %.100s", __func__, canonical_provider);	687	debug("%s: remove %.100s", __func__, sane_uri);
634	for (id = TAILQ_FIRST(&idtab->idlist); id; id = nxt) {	688	for (id = TAILQ_FIRST(&idtab->idlist); id; id = nxt) {
635	nxt = TAILQ_NEXT(id, next);	689	nxt = TAILQ_NEXT(id, next);
636	/* Skip file--based keys */	690	/* Skip file--based keys */
637	if (id->provider == NULL)	691	if (id->provider == NULL)
638	continue;	692	continue;
639	if (!strcmp(canonical_provider, id->provider)) {	693	if (!strcmp(sane_uri, id->provider)) {
640	TAILQ_REMOVE(&idtab->idlist, id, next);	694	TAILQ_REMOVE(&idtab->idlist, id, next);
641	free_identity(id);	695	free_identity(id);
642	idtab->nentries--;	696	idtab->nentries--;
643	}	697	}
644	}	698	}
645	if (pkcs11_del_provider(canonical_provider) == 0)	699	if (pkcs11_del_provider(sane_uri) == 0)
646	success = 1;	700	success = 1;
647	else	701	else
648	error("%s: pkcs11_del_provider failed", __func__);	702	error("%s: pkcs11_del_provider failed", __func__);
649	send:	703	send:
650	free(provider);	704	free(provider);
		705	free(sane_uri);
651	send_status(e, success);	706	send_status(e, success);
652	}	707	}
653	#endif /* ENABLE_PKCS11 */	708	#endif /* ENABLE_PKCS11 */

Line 0 Link Here

(-)a/ssh-pkcs11-uri.c (+399 lines)
		1	/*
		2	* Copyright (c) 2017 Red Hat
		3	*
		4	* Authors: Jakub Jelen <jjelen@redhat.com>
		5	*
		6	* Permission to use, copy, modify, and distribute this software for any
		7	* purpose with or without fee is hereby granted, provided that the above
		8	* copyright notice and this permission notice appear in all copies.
		9	*
		10	* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
		11	* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
		12	* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
		13	* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
		14	* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
		15	* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
		16	* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
		17	*/
		18
		19	#include "includes.h"
		20
		21	#ifdef ENABLE_PKCS11
		22
		23	#include <stdio.h>
		24	#include <string.h>
		25
		26	#include "sshkey.h"
		27	#include "log.h"
		28
		29	#define CRYPTOKI_COMPAT
		30	#include "pkcs11.h"
		31
		32	#include "ssh-pkcs11-uri.h"
		33
		34	#define PKCS11_URI_PATH_SEPARATOR ";"
		35	#define PKCS11_URI_QUERY_SEPARATOR "&"
		36	#define PKCS11_URI_VALUE_SEPARATOR "="
		37	#define PKCS11_URI_ID "id"
		38	#define PKCS11_URI_TOKEN "token"
		39	#define PKCS11_URI_OBJECT "object"
		40	#define PKCS11_URI_LIB_MANUF "library-manufacturer"
		41	#define PKCS11_URI_MANUF "manufacturer"
		42	#define PKCS11_URI_MODULE_PATH "module-path"
		43
		44	/* Keyword tokens. */
		45	typedef enum {
		46	pId, pToken, pObject, pLibraryManufacturer, pManufacturer, pModulePath,
		47	pBadOption
		48	} pkcs11uriOpCodes;
		49
		50	/* Textual representation of the tokens. */
		51	static struct {
		52	const char *name;
		53	pkcs11uriOpCodes opcode;
		54	} keywords[] = {
		55	{ PKCS11_URI_ID, pId },
		56	{ PKCS11_URI_TOKEN, pToken },
		57	{ PKCS11_URI_OBJECT, pObject },
		58	{ PKCS11_URI_LIB_MANUF, pLibraryManufacturer },
		59	{ PKCS11_URI_MANUF, pManufacturer },
		60	{ PKCS11_URI_MODULE_PATH, pModulePath },
		61	{ NULL, pBadOption }
		62	};
		63
		64	static pkcs11uriOpCodes
65	parse_token(const char *cp)
66	{
67	u_int i;
68
69	for (i = 0; keywords[i].name; i++)
70	if (strncasecmp(cp, keywords[i].name,
71	strlen(keywords[i].name)) == 0)
72	return keywords[i].opcode;
73
74	return pBadOption;
75	}
76
77	int
78	percent_decode(char data, char *outp)
79	{
80	char tmp[3];
81	char out, tmp_end;
82	char *p = data;
83	long value;
84	size_t outlen = 0;
85
86	out = malloc(strlen(data)+1); /* upper bound */
87	if (out == NULL)
88	return -1;
89	while (*p != '\0') {
90	switch (*p) {
91	case '%':
92	p++;
93	if (*p == '\0')
94	goto fail;
95	tmp[0] = *p++;
96	if (*p == '\0')
97	goto fail;
98	tmp[1] = *p++;
99	tmp[2] = '\0';
100	tmp_end = NULL;
101	value = strtol(tmp, &tmp_end, 16);
102	if (tmp_end != tmp+2)
103	goto fail;
104	else
105	out[outlen++] = (char) value;
106	break;
107	default:
108	out[outlen++] = *p++;
109	break;
110	}
111	}
112
113	/* zero terminate */
114	out[outlen] = '\0';
115	*outp = out;
116	return outlen;
117	fail:
118	free(out);
119	return -1;
120	}
121
122	struct sshbuf *
123	percent_encode(const char data, size_t length, const char whitelist)
124	{
125	struct sshbuf *b = NULL;
126	char tmp[4], *cp;
127	size_t i;
128
129	if ((b = sshbuf_new()) == NULL)
130	return NULL;
131	for (i = 0; i < length; i++) {
132	cp = strchr(whitelist, data[i]);
133	/* if c is specified as '\0' pointer to terminator is returned !! */
134	if (cp != NULL && *cp != '\0') {
135	if (sshbuf_put(b, &data[i], 1) != 0)
136	goto err;
137	} else
138	if (snprintf(tmp, 4, "%%%02X", (unsigned char) data[i]) < 3
139	\|\| sshbuf_put(b, tmp, 3) != 0)
140	goto err;
141	}
142	if (sshbuf_put(b, "\0", 1) == 0)
143	return b;
144	err:
145	sshbuf_free(b);
146	return NULL;
147	}
148
149	char *
150	pkcs11_uri_append(char part, const char separator, const char *key,
151	struct sshbuf *value)
152	{
153	char *new_part;
154	size_t size;
155
156	if (value == NULL)
157	return NULL;
158
159	size = asprintf(&new_part,
160	"%s%s%s" PKCS11_URI_VALUE_SEPARATOR "%s",
161	(part != NULL ? part : ""),
162	(part != NULL ? separator : ""),
163	key, sshbuf_ptr(value));
164	sshbuf_free(value);
165	free(part);
166
167	if (size < 0)
168	return NULL;
169	return new_part;
170	}
171
172	char *
173	pkcs11_uri_get(struct pkcs11_uri *uri)
174	{
175	size_t size = -1;
176	char p = NULL, path = NULL, *query = NULL;
177
178	/* compose a percent-encoded ID */
179	if (uri->id_len > 0) {
180	struct sshbuf *key_id = percent_encode(uri->id, uri->id_len, "");
181	path = pkcs11_uri_append(path, PKCS11_URI_PATH_SEPARATOR,
182	PKCS11_URI_ID, key_id);
183	if (path == NULL)
184	goto err;
185	}
186
187	/* Write object label */
188	if (uri->object) {
189	struct sshbuf *label = percent_encode(uri->object, strlen(uri->object),
190	PKCS11_URI_WHITELIST);
191	path = pkcs11_uri_append(path, PKCS11_URI_PATH_SEPARATOR,
192	PKCS11_URI_OBJECT, label);
193	if (path == NULL)
194	goto err;
195	}
196
197	/* Write token label */
198	if (uri->token) {
199	struct sshbuf *label = percent_encode(uri->token, strlen(uri->token),
200	PKCS11_URI_WHITELIST);
201	path = pkcs11_uri_append(path, PKCS11_URI_PATH_SEPARATOR,
202	PKCS11_URI_TOKEN, label);
203	if (path == NULL)
204	goto err;
205	}
206
207	/* Write manufacturer */
208	if (uri->manuf) {
209	struct sshbuf *manuf = percent_encode(uri->manuf,
210	strlen(uri->manuf), PKCS11_URI_WHITELIST);
211	path = pkcs11_uri_append(path, PKCS11_URI_PATH_SEPARATOR,
212	PKCS11_URI_MANUF, manuf);
213	if (path == NULL)
214	goto err;
215	}
216
217	/* Write module_path */
218	if (uri->module_path) {
219	struct sshbuf *module = percent_encode(uri->module_path,
220	strlen(uri->module_path), PKCS11_URI_WHITELIST "/");
221	query = pkcs11_uri_append(query, PKCS11_URI_QUERY_SEPARATOR,
222	PKCS11_URI_MODULE_PATH, module);
223	if (query == NULL)
224	goto err;
225	}
226
227	size = asprintf(&p, PKCS11_URI_SCHEME "%s%s%s",
228	path != NULL ? path : "",
229	query != NULL ? "?" : "",
230	query != NULL ? query : "");
231	err:
232	free(query);
233	free(path);
234	if (size < 0)
235	return NULL;
236	return p;
237	}
238
239	struct pkcs11_uri *
240	pkcs11_uri_init()
241	{
242	struct pkcs11_uri *d = calloc(1, sizeof(struct pkcs11_uri));
243	return d;
244	}
245
246	void
247	pkcs11_uri_cleanup(struct pkcs11_uri *pkcs11)
248	{
249	free(pkcs11->id);
250	free(pkcs11->module_path);
251	free(pkcs11->token);
252	free(pkcs11->object);
253	free(pkcs11->lib_manuf);
254	free(pkcs11->manuf);
255	free(pkcs11);
256	}
257
258	int
259	pkcs11_uri_parse(const char uri, struct pkcs11_uri pkcs11)
260	{
261	char saveptr1, saveptr2, str1, str2, *tok;
262	int rv = 0, len;
263	char *p = NULL;
264
265	size_t scheme_len = strlen(PKCS11_URI_SCHEME);
266	if (strlen(uri) < scheme_len \|\| /* empty URI matches everything */
267	strncmp(uri, PKCS11_URI_SCHEME, scheme_len) != 0) {
268	error("%s: The '%s' does not look like PKCS#11 URI",
269	__func__, uri);
270	return -1;
271	}
272
273	if (pkcs11 == NULL) {
274	error("%s: Bad arguments. The pkcs11 can't be null", __func__);
275	return -1;
276	}
277
278	/* skip URI schema name */
279	p = strdup(uri);
280	str1 = p;
281
282	/* everything before ? */
283	tok = strtok_r(str1, "?", &saveptr1);
284	if (tok == NULL) {
285	free(p);
286	error("%s: pk11-path expected, got EOF", __func__);
287	return -1;
288	}
289
290	/* skip URI schema name:
291	* the scheme ensures that there is at least something before "?"
292	* allowing empty pk11-path. Resulting token at worst pointing to
293	* \0 byte */
294	tok = tok + scheme_len;
295
296	/* parse pk11-path */
297	for (str2 = tok; ; str2 = NULL) {
298	char **charptr;
299	pkcs11uriOpCodes opcode;
300	tok = strtok_r(str2, PKCS11_URI_PATH_SEPARATOR, &saveptr2);
301	if (tok == NULL)
302	break;
303	opcode = parse_token(tok);
304	if (opcode == pBadOption) {
305	verbose("Unknown key in PKCS#11 URI: %s", tok);
306	return -1;
307	}
308
309	char arg = tok + strlen(keywords[opcode].name) + 1; / separator "=" */
310	switch (opcode) {
311	case pId:
312	/* CKA_ID */
313	if (pkcs11->id != NULL) {
314	verbose("%s: The id already set in the PKCS#11 URI",
315	__func__);
316	rv = -1;
317	}
318	len = percent_decode(arg, &pkcs11->id);
319	if (len <= 0) {
320	verbose("%s: Failed to percent-decode CKA_ID: %s",
321	__func__, arg);
322	rv = -1;
323	} else
324	pkcs11->id_len = len;
325	debug3("%s: Setting CKA_ID = %s from PKCS#11 URI",
326	__func__, arg);
327	break;
328	case pToken:
329	/* CK_TOKEN_INFO -> label */
330	charptr = &pkcs11->token;
331	parse_string:
332	if (*charptr != NULL) {
333	verbose("%s: The %s already set in the PKCS#11 URI",
334	keywords[opcode].name, __func__);
335	rv = -1;
336	}
337	percent_decode(arg, charptr);
338	debug3("%s: Setting %s = %s from PKCS#11 URI",
339	__func__, keywords[opcode].name, *charptr);
340	break;
341
342	case pObject:
343	/* CK_TOKEN_INFO -> manufacturerID */
344	charptr = &pkcs11->object;
345	goto parse_string;
346
347	case pManufacturer:
348	/* CK_TOKEN_INFO -> manufacturerID */
349	charptr = &pkcs11->manuf;
350	goto parse_string;
351
352	case pLibraryManufacturer:
353	/* CK_INFO -> manufacturerID */
354	charptr = &pkcs11->lib_manuf;
355	goto parse_string;
356
357	case pBadOption:
358	default:
359	/* Unrecognized attribute in the URI path SHOULD be error */
360	verbose("%s: Unknown part of path in PKCS#11 URI: %s",
361	__func__, tok);
362	rv = -1;
363	}
364	}
365
366	tok = strtok_r(NULL, "?", &saveptr1);
367	if (tok == NULL) {
368	free(p);
369	return rv;
370	}
371	/* parse pk11-query (optional) */
372	for (str2 = tok; ; str2 = NULL) {
373	size_t key_len = strlen(PKCS11_URI_MODULE_PATH) + 1;
374	tok = strtok_r(str2, PKCS11_URI_QUERY_SEPARATOR, &saveptr2);
375	if (tok == NULL)
376	break;
377	if (strncasecmp(tok, PKCS11_URI_MODULE_PATH
378	PKCS11_URI_VALUE_SEPARATOR, key_len) == 0) {
379	/* module-path is PKCS11Provider */
380	if (pkcs11->module_path != NULL) {
381	verbose("%s: Multiple module-path attributes are"
382	"not supported the PKCS#11 URI", __func__);
383	rv = -1;
384	}
385	percent_decode(tok + key_len, &pkcs11->module_path);
386	debug3("%s: Setting PKCS11Provider = %s from PKCS#11 URI\n",
387	__func__, pkcs11->module_path);
388	/* } else if ( pin-value ) { */
389	} else {
390	/* Unrecognized attribute in the URI query SHOULD be ignored */
391	verbose("%s: Unknown part of query in PKCS#11 URI: %s",
392	__func__, tok);
393	}
394	}
395	free(p);
396	return rv;
397	}
398
399	#endif /* ENABLE_PKCS11 */

Line 0 Link Here

(-)a/ssh-pkcs11-uri.h (+41 lines)
	1	/*
	2	* Copyright (c) 2017 Red Hat
	3	*
	4	* Authors: Jakub Jelen <jjelen@redhat.com>
	5	*
	6	* Permission to use, copy, modify, and distribute this software for any
	7	* purpose with or without fee is hereby granted, provided that the above
	8	* copyright notice and this permission notice appear in all copies.
	9	*
	10	* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
	11	* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
	12	* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
	13	* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
	14	* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
	15	* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
	16	* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
	17	*/
	18
	19	#define PKCS11_URI_SCHEME "pkcs11:"
	20	#define PKCS11_URI_WHITELIST "abcdefghijklmnopqrstuvwxyz" \
	21	"ABCDEFGHIJKLMNOPQRSTUVWXYZ" \
	22	"0123456789_-.()"
	23
	24	struct pkcs11_uri {
	25	/* path */
	26	char *id;
	27	size_t id_len;
	28	char *token;
	29	char *object;
	30	char *lib_manuf;
	31	char *manuf;
	32	/* query */
	33	char *module_path;
	34	};
	35
	36	struct pkcs11_uri *pkcs11_uri_init();
	37	void pkcs11_uri_cleanup(struct pkcs11_uri *);
	38	int pkcs11_uri_parse(const char , struct pkcs11_uri );
	39	struct pkcs11_uri *pkcs11_uri_init();
	40	char * pkcs11_uri_get(struct pkcs11_uri *uri);
	41