rpms/openssh
7
0
Fork 1
Code Issues Pull Requests Releases Activity

pkcs11: Add support for 'serial' in PKCS#11 URI

Browse Source 
The patch was updated by the upstream MR
https://github.com/openssh/openssh-portable/pull/406
by npocs@redhat.com
This commit is contained in:
Jakub Jelen 2023-04-13 14:59:50 +02:00 committed by Norbert Pocs
parent c7af8ecb76
commit d77b1b790a
3 changed files with 129 additions and 60 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

178
openssh-8.0p1-pkcs11-uri.patch
View File

@ -68,7 +68,7 @@ diff -up openssh-8.7p1/configure.ac.pkcs11-uri openssh-8.7p1/configure.ac
diff -up openssh-8.7p1/Makefile.in.pkcs11-uri openssh-8.7p1/Makefile.in diff -up openssh-8.7p1/Makefile.in.pkcs11-uri openssh-8.7p1/Makefile.in
--- openssh-8.7p1/Makefile.in.pkcs11-uri 2021-08-30 13:07:43.571699324 +0200 --- openssh-8.7p1/Makefile.in.pkcs11-uri 2021-08-30 13:07:43.571699324 +0200
+++ openssh-8.7p1/Makefile.in 2021-08-30 13:07:43.663700096 +0200 +++ openssh-8.7p1/Makefile.in 2021-08-30 13:07:43.663700096 +0200
@@ -103,7 +103,7 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \ @@ -105,7 +105,7 @@
monitor_fdpass.o rijndael.o ssh-dss.o ssh-ecdsa.o ssh-ecdsa-sk.o \ monitor_fdpass.o rijndael.o ssh-dss.o ssh-ecdsa.o ssh-ecdsa-sk.o \
ssh-ed25519-sk.o ssh-rsa.o dh.o \ ssh-ed25519-sk.o ssh-rsa.o dh.o \
msg.o progressmeter.o dns.o entropy.o gss-genr.o umac.o umac128.o \ msg.o progressmeter.o dns.o entropy.o gss-genr.o umac.o umac128.o \
@ -103,7 +103,7 @@ diff -up openssh-8.7p1/Makefile.in.pkcs11-uri openssh-8.7p1/Makefile.in
$(MKDIR_P) `pwd`/regress/misc/sk-dummy $(MKDIR_P) `pwd`/regress/misc/sk-dummy
[ -f `pwd`/regress/Makefile ] || \ [ -f `pwd`/regress/Makefile ] || \
ln -s `cd $(srcdir) && pwd`/regress/Makefile `pwd`/regress/Makefile ln -s `cd $(srcdir) && pwd`/regress/Makefile `pwd`/regress/Makefile
@@ -677,6 +682,16 @@ regress/unittests/utf8/test_utf8$(EXEEXT @@ -685,6 +690,16 @@
regress/unittests/test_helper/libtest_helper.a \ regress/unittests/test_helper/libtest_helper.a \
-lssh -lopenbsd-compat -lssh -lopenbsd-compat $(TESTLIBS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(TESTLIBS)
@ -534,7 +534,7 @@ diff -up openssh-8.7p1/regress/unittests/Makefile.pkcs11-uri openssh-8.7p1/regre
diff -up openssh-8.7p1/regress/unittests/pkcs11/tests.c.pkcs11-uri openssh-8.7p1/regress/unittests/pkcs11/tests.c diff -up openssh-8.7p1/regress/unittests/pkcs11/tests.c.pkcs11-uri openssh-8.7p1/regress/unittests/pkcs11/tests.c
--- openssh-8.7p1/regress/unittests/pkcs11/tests.c.pkcs11-uri 2021-08-30 13:07:43.664700104 +0200 --- openssh-8.7p1/regress/unittests/pkcs11/tests.c.pkcs11-uri 2021-08-30 13:07:43.664700104 +0200
+++ openssh-8.7p1/regress/unittests/pkcs11/tests.c 2021-08-30 13:07:43.664700104 +0200 +++ openssh-8.7p1/regress/unittests/pkcs11/tests.c 2021-08-30 13:07:43.664700104 +0200
@@ -0,0 +1,337 @@ @@ -0,0 +1,346 @@
+/* +/*
+ * Copyright (c) 2017 Red Hat + * Copyright (c) 2017 Red Hat
+ * + *
@ -563,7 +563,7 @@ diff -up openssh-8.7p1/regress/unittests/pkcs11/tests.c.pkcs11-uri openssh-8.7p1
+#include "sshbuf.h" +#include "sshbuf.h"
+#include "ssh-pkcs11-uri.h" +#include "ssh-pkcs11-uri.h"
+ +
+#define EMPTY_URI compose_uri(NULL, 0, NULL, NULL, NULL, NULL, NULL, NULL) +#define EMPTY_URI compose_uri(NULL, 0, NULL, NULL, NULL, NULL, NULL, NULL, NULL)
+ +
+/* prototypes are not public -- specify them here internally for tests */ +/* prototypes are not public -- specify them here internally for tests */
+struct sshbuf *percent_encode(const char *, size_t, char *); +struct sshbuf *percent_encode(const char *, size_t, char *);
@ -596,6 +596,10 @@ diff -up openssh-8.7p1/regress/unittests/pkcs11/tests.c.pkcs11-uri openssh-8.7p1
+ ASSERT_STRING_EQ(a->lib_manuf, b->lib_manuf); + ASSERT_STRING_EQ(a->lib_manuf, b->lib_manuf);
+ else /* both should be null */ + else /* both should be null */
+ ASSERT_PTR_EQ(a->lib_manuf, b->lib_manuf); + ASSERT_PTR_EQ(a->lib_manuf, b->lib_manuf);
+ if (b->serial != NULL)
+ ASSERT_STRING_EQ(a->serial, b->serial);
+ else /* both should be null */
+ ASSERT_PTR_EQ(a->serial, b->serial);
+} +}
+ +
+void +void
@ -630,7 +634,7 @@ diff -up openssh-8.7p1/regress/unittests/pkcs11/tests.c.pkcs11-uri openssh-8.7p1
+ +
+struct pkcs11_uri * +struct pkcs11_uri *
+compose_uri(unsigned char *id, size_t id_len, char *token, char *lib_manuf, +compose_uri(unsigned char *id, size_t id_len, char *token, char *lib_manuf,
+ char *manuf, char *module_path, char *object, char *pin) + char *manuf, char *serial, char *module_path, char *object, char *pin)
+{ +{
+ struct pkcs11_uri *uri = pkcs11_uri_init(); + struct pkcs11_uri *uri = pkcs11_uri_init();
+ if (id_len > 0) { + if (id_len > 0) {
@ -641,6 +645,7 @@ diff -up openssh-8.7p1/regress/unittests/pkcs11/tests.c.pkcs11-uri openssh-8.7p1
+ uri->token = token; + uri->token = token;
+ uri->lib_manuf = lib_manuf; + uri->lib_manuf = lib_manuf;
+ uri->manuf = manuf; + uri->manuf = manuf;
+ uri->serial = serial;
+ uri->object = object; + uri->object = object;
+ uri->pin = pin; + uri->pin = pin;
+ return uri; + return uri;
@ -651,47 +656,49 @@ diff -up openssh-8.7p1/regress/unittests/pkcs11/tests.c.pkcs11-uri openssh-8.7p1
+{ +{
+ /* path arguments */ + /* path arguments */
+ check_parse("pkcs11:id=%01", + check_parse("pkcs11:id=%01",
+ compose_uri("\x01", 1, NULL, NULL, NULL, NULL, NULL, NULL)); + compose_uri("\x01", 1, NULL, NULL, NULL, NULL, NULL, NULL, NULL));
+ check_parse("pkcs11:id=%00%01", + check_parse("pkcs11:id=%00%01",
+ compose_uri("\x00\x01", 2, NULL, NULL, NULL, NULL, NULL, NULL)); + compose_uri("\x00\x01", 2, NULL, NULL, NULL, NULL, NULL, NULL, NULL));
+ check_parse("pkcs11:token=SSH%20Keys", + check_parse("pkcs11:token=SSH%20Keys",
+ compose_uri(NULL, 0, "SSH Keys", NULL, NULL, NULL, NULL, NULL)); + compose_uri(NULL, 0, "SSH Keys", NULL, NULL, NULL, NULL, NULL, NULL));
+ check_parse("pkcs11:library-manufacturer=OpenSC", + check_parse("pkcs11:library-manufacturer=OpenSC",
+ compose_uri(NULL, 0, NULL, "OpenSC", NULL, NULL, NULL, NULL)); + compose_uri(NULL, 0, NULL, "OpenSC", NULL, NULL, NULL, NULL, NULL));
+ check_parse("pkcs11:manufacturer=piv_II", + check_parse("pkcs11:manufacturer=piv_II",
+ compose_uri(NULL, 0, NULL, NULL, "piv_II", NULL, NULL, NULL)); + compose_uri(NULL, 0, NULL, NULL, "piv_II", NULL, NULL, NULL, NULL));
+ check_parse("pkcs11:serial=IamSerial",
+ compose_uri(NULL, 0, NULL, NULL, NULL, "IamSerial", NULL, NULL, NULL));
+ check_parse("pkcs11:object=SIGN%20Key", + check_parse("pkcs11:object=SIGN%20Key",
+ compose_uri(NULL, 0, NULL, NULL, NULL, NULL, "SIGN Key", NULL)); + compose_uri(NULL, 0, NULL, NULL, NULL, NULL, NULL, "SIGN Key", NULL));
+ /* query arguments */ + /* query arguments */
+ check_parse("pkcs11:?module-path=/usr/lib64/p11-kit-proxy.so", + check_parse("pkcs11:?module-path=/usr/lib64/p11-kit-proxy.so",
+ compose_uri(NULL, 0, NULL, NULL, NULL, "/usr/lib64/p11-kit-proxy.so", NULL, NULL)); + compose_uri(NULL, 0, NULL, NULL, NULL, NULL, "/usr/lib64/p11-kit-proxy.so", NULL, NULL));
+ check_parse("pkcs11:?pin-value=123456", + check_parse("pkcs11:?pin-value=123456",
+ compose_uri(NULL, 0, NULL, NULL, NULL, NULL, NULL, "123456")); + compose_uri(NULL, 0, NULL, NULL, NULL, NULL, NULL, NULL, "123456"));
+ +
+ /* combinations */ + /* combinations */
+ /* ID SHOULD be percent encoded */ + /* ID SHOULD be percent encoded */
+ check_parse("pkcs11:token=SSH%20Key;id=0", + check_parse("pkcs11:token=SSH%20Key;id=0",
+ compose_uri("0", 1, "SSH Key", NULL, NULL, NULL, NULL, NULL)); + compose_uri("0", 1, "SSH Key", NULL, NULL, NULL, NULL, NULL, NULL));
+ check_parse( + check_parse(
+ "pkcs11:manufacturer=CAC?module-path=/usr/lib64/p11-kit-proxy.so", + "pkcs11:manufacturer=CAC?module-path=/usr/lib64/p11-kit-proxy.so",
+ compose_uri(NULL, 0, NULL, NULL, "CAC", + compose_uri(NULL, 0, NULL, NULL, "CAC", NULL,
+ "/usr/lib64/p11-kit-proxy.so", NULL, NULL)); + "/usr/lib64/p11-kit-proxy.so", NULL, NULL));
+ check_parse( + check_parse(
+ "pkcs11:object=RSA%20Key?module-path=/usr/lib64/pkcs11/opencryptoki.so", + "pkcs11:object=RSA%20Key?module-path=/usr/lib64/pkcs11/opencryptoki.so",
+ compose_uri(NULL, 0, NULL, NULL, NULL, + compose_uri(NULL, 0, NULL, NULL, NULL, NULL,
+ "/usr/lib64/pkcs11/opencryptoki.so", "RSA Key", NULL)); + "/usr/lib64/pkcs11/opencryptoki.so", "RSA Key", NULL));
+ check_parse("pkcs11:?module-path=/usr/lib64/p11-kit-proxy.so&pin-value=123456", + check_parse("pkcs11:?module-path=/usr/lib64/p11-kit-proxy.so&pin-value=123456",
+ compose_uri(NULL, 0, NULL, NULL, NULL, "/usr/lib64/p11-kit-proxy.so", NULL, "123456")); + compose_uri(NULL, 0, NULL, NULL, NULL, NULL, "/usr/lib64/p11-kit-proxy.so", NULL, "123456"));
+ +
+ /* empty path component matches everything */ + /* empty path component matches everything */
+ check_parse("pkcs11:", EMPTY_URI); + check_parse("pkcs11:", EMPTY_URI);
+ +
+ /* empty string is a valid to match against (and different from NULL) */ + /* empty string is a valid to match against (and different from NULL) */
+ check_parse("pkcs11:token=", + check_parse("pkcs11:token=",
+ compose_uri(NULL, 0, "", NULL, NULL, NULL, NULL, NULL)); + compose_uri(NULL, 0, "", NULL, NULL, NULL, NULL, NULL, NULL));
+ /* Percent character needs to be percent-encoded */ + /* Percent character needs to be percent-encoded */
+ check_parse("pkcs11:token=%25", + check_parse("pkcs11:token=%25",
+ compose_uri(NULL, 0, "%", NULL, NULL, NULL, NULL, NULL)); + compose_uri(NULL, 0, "%", NULL, NULL, NULL, NULL, NULL, NULL));
+} +}
+ +
+static void +static void
@ -703,7 +710,7 @@ diff -up openssh-8.7p1/regress/unittests/pkcs11/tests.c.pkcs11-uri openssh-8.7p1
+ check_parse_rv("pkcs11:id=%ZZ", EMPTY_URI, -1); + check_parse_rv("pkcs11:id=%ZZ", EMPTY_URI, -1);
+ /* Space MUST be percent encoded -- XXX not enforced yet */ + /* Space MUST be percent encoded -- XXX not enforced yet */
+ check_parse("pkcs11:token=SSH Keys", + check_parse("pkcs11:token=SSH Keys",
+ compose_uri(NULL, 0, "SSH Keys", NULL, NULL, NULL, NULL, NULL)); + compose_uri(NULL, 0, "SSH Keys", NULL, NULL, NULL, NULL, NULL, NULL));
+ /* MUST NOT contain duplicate attributes of the same name */ + /* MUST NOT contain duplicate attributes of the same name */
+ check_parse_rv("pkcs11:id=%01;id=%02", EMPTY_URI, -1); + check_parse_rv("pkcs11:id=%01;id=%02", EMPTY_URI, -1);
+ /* MUST NOT contain duplicate attributes of the same name */ + /* MUST NOT contain duplicate attributes of the same name */
@ -734,29 +741,31 @@ diff -up openssh-8.7p1/regress/unittests/pkcs11/tests.c.pkcs11-uri openssh-8.7p1
+{ +{
+ /* path arguments */ + /* path arguments */
+ check_gen("pkcs11:id=%01", + check_gen("pkcs11:id=%01",
+ compose_uri("\x01", 1, NULL, NULL, NULL, NULL, NULL, NULL)); + compose_uri("\x01", 1, NULL, NULL, NULL, NULL, NULL, NULL, NULL));
+ check_gen("pkcs11:id=%00%01", + check_gen("pkcs11:id=%00%01",
+ compose_uri("\x00\x01", 2, NULL, NULL, NULL, NULL, NULL, NULL)); + compose_uri("\x00\x01", 2, NULL, NULL, NULL, NULL, NULL, NULL, NULL));
+ check_gen("pkcs11:token=SSH%20Keys", /* space must be percent encoded */ + check_gen("pkcs11:token=SSH%20Keys", /* space must be percent encoded */
+ compose_uri(NULL, 0, "SSH Keys", NULL, NULL, NULL, NULL, NULL)); + compose_uri(NULL, 0, "SSH Keys", NULL, NULL, NULL, NULL, NULL, NULL));
+ /* library-manufacturer is not implmented now */ + /* library-manufacturer is not implmented now */
+ /*check_gen("pkcs11:library-manufacturer=OpenSC", + /*check_gen("pkcs11:library-manufacturer=OpenSC",
+ compose_uri(NULL, 0, NULL, "OpenSC", NULL, NULL, NULL, NULL));*/ + compose_uri(NULL, 0, NULL, "OpenSC", NULL, NULL, NULL, NULL, NULL));*/
+ check_gen("pkcs11:manufacturer=piv_II", + check_gen("pkcs11:manufacturer=piv_II",
+ compose_uri(NULL, 0, NULL, NULL, "piv_II", NULL, NULL, NULL)); + compose_uri(NULL, 0, NULL, NULL, "piv_II", NULL, NULL, NULL, NULL));
+ check_gen("pkcs11:serial=IamSerial",
+ compose_uri(NULL, 0, NULL, NULL, NULL, "IamSerial", NULL, NULL, NULL));
+ check_gen("pkcs11:object=RSA%20Key", + check_gen("pkcs11:object=RSA%20Key",
+ compose_uri(NULL, 0, NULL, NULL, NULL, NULL, "RSA Key", NULL)); + compose_uri(NULL, 0, NULL, NULL, NULL, NULL, NULL, "RSA Key", NULL));
+ /* query arguments */ + /* query arguments */
+ check_gen("pkcs11:?module-path=/usr/lib64/p11-kit-proxy.so", + check_gen("pkcs11:?module-path=/usr/lib64/p11-kit-proxy.so",
+ compose_uri(NULL, 0, NULL, NULL, NULL, "/usr/lib64/p11-kit-proxy.so", NULL, NULL)); + compose_uri(NULL, 0, NULL, NULL, NULL, NULL, "/usr/lib64/p11-kit-proxy.so", NULL, NULL));
+ +
+ /* combinations */ + /* combinations */
+ check_gen("pkcs11:id=%02;token=SSH%20Keys", + check_gen("pkcs11:id=%02;token=SSH%20Keys",
+ compose_uri("\x02", 1, "SSH Keys", NULL, NULL, NULL, NULL, NULL)); + compose_uri("\x02", 1, "SSH Keys", NULL, NULL, NULL, NULL, NULL, NULL));
+ check_gen("pkcs11:id=%EE%02?module-path=/usr/lib64/p11-kit-proxy.so", + check_gen("pkcs11:id=%EE%02?module-path=/usr/lib64/p11-kit-proxy.so",
+ compose_uri("\xEE\x02", 2, NULL, NULL, NULL, "/usr/lib64/p11-kit-proxy.so", NULL, NULL)); + compose_uri("\xEE\x02", 2, NULL, NULL, NULL, NULL, "/usr/lib64/p11-kit-proxy.so", NULL, NULL));
+ check_gen("pkcs11:object=Encryption%20Key;manufacturer=piv_II", + check_gen("pkcs11:object=Encryption%20Key;manufacturer=piv_II",
+ compose_uri(NULL, 0, NULL, NULL, "piv_II", NULL, "Encryption Key", NULL)); + compose_uri(NULL, 0, NULL, NULL, "piv_II", NULL, NULL, "Encryption Key", NULL));
+ +
+ /* empty path component matches everything */ + /* empty path component matches everything */
+ check_gen("pkcs11:", EMPTY_URI); + check_gen("pkcs11:", EMPTY_URI);
@ -1545,7 +1554,7 @@ diff -up openssh-8.7p1/ssh-pkcs11.c.pkcs11-uri openssh-8.7p1/ssh-pkcs11.c
} }
static RSA_METHOD *rsa_method; static RSA_METHOD *rsa_method;
@@ -195,6 +286,55 @@ static EC_KEY_METHOD *ec_key_method; @@ -195,6 +286,56 @@ static EC_KEY_METHOD *ec_key_method;
static int ec_key_idx = 0; static int ec_key_idx = 0;
#endif /* OPENSSL_HAS_ECC && HAVE_EC_KEY_METHOD_NEW */ #endif /* OPENSSL_HAS_ECC && HAVE_EC_KEY_METHOD_NEW */
@ -1587,6 +1596,7 @@ diff -up openssh-8.7p1/ssh-pkcs11.c.pkcs11-uri openssh-8.7p1/ssh-pkcs11.c
+ uri.module_path = k11->provider->module->module_path; + uri.module_path = k11->provider->module->module_path;
+ uri.lib_manuf = k11->provider->module->info.manufacturerID; + uri.lib_manuf = k11->provider->module->info.manufacturerID;
+ uri.manuf = k11->provider->module->slotinfo[k11->slotidx].token.manufacturerID; + uri.manuf = k11->provider->module->slotinfo[k11->slotidx].token.manufacturerID;
+ uri.serial = k11->provider->module->slotinfo[k11->slotidx].token.serialNumber;
+ +
+ p = pkcs11_uri_get(&uri); + p = pkcs11_uri_get(&uri);
+ /* do not cleanup -- we do not allocate here, only reference */ + /* do not cleanup -- we do not allocate here, only reference */
@ -1620,9 +1630,12 @@ diff -up openssh-8.7p1/ssh-pkcs11.c.pkcs11-uri openssh-8.7p1/ssh-pkcs11.c
if ((rv = f->C_FindObjectsInit(session, attr, nattr)) != CKR_OK) { if ((rv = f->C_FindObjectsInit(session, attr, nattr)) != CKR_OK) {
error("C_FindObjectsInit failed (nattr %lu): %lu", nattr, rv); error("C_FindObjectsInit failed (nattr %lu): %lu", nattr, rv);
return (-1); return (-1);
@@ -262,12 +403,12 @@ pkcs11_login_slot(struct pkcs11_provider @@ -260,14 +403,14 @@ pkcs11_login_slot(struct pkcs11_provider
if (si->token.flags & CKF_PROTECTED_AUTHENTICATION_PATH)
verbose("Deferring PIN entry to reader keypad.");
else { else {
snprintf(prompt, sizeof(prompt), "Enter PIN for '%s': ", - snprintf(prompt, sizeof(prompt), "Enter PIN for '%s': ",
+ snprintf(prompt, sizeof(prompt), "Enter PIN for '%.32s': ",
si->token.label); si->token.label);
- if ((pin = read_passphrase(prompt, RP_ALLOW_EOF)) == NULL) { - if ((pin = read_passphrase(prompt, RP_ALLOW_EOF)) == NULL) {
+ if ((pin = read_passphrase(prompt, RP_ALLOW_EOF|RP_ALLOW_STDIN)) == NULL) { + if ((pin = read_passphrase(prompt, RP_ALLOW_EOF|RP_ALLOW_STDIN)) == NULL) {
@ -1754,6 +1767,27 @@ diff -up openssh-8.7p1/ssh-pkcs11.c.pkcs11-uri openssh-8.7p1/ssh-pkcs11.c
EC_KEY_set_method(ec, ec_key_method); EC_KEY_set_method(ec, ec_key_method);
EC_KEY_set_ex_data(ec, ec_key_idx, k11); EC_KEY_set_ex_data(ec, ec_key_idx, k11);
@@ -622,7 +779,8 @@
}
#endif /* OPENSSL_HAS_ECC && HAVE_EC_KEY_METHOD_NEW */
-/* remove trailing spaces */
+/* remove trailing spaces. Note, that this does NOT guarantee the buffer
+ * will be null terminated if there are no trailing spaces! */
static void
rmspace(u_char *buf, size_t len)
{
@@ -630,8 +788,8 @@
if (!len)
return;
- for (i = len - 1; i > 0; i--)
- if (i == len - 1 || buf[i] == ' ')
+ for (i = len - 1; i > 0; i--)
+ if (buf[i] == ' ')
buf[i] = '\0';
else
break;
@@ -650,8 +806,8 @@ pkcs11_open_session(struct pkcs11_provid @@ -650,8 +806,8 @@ pkcs11_open_session(struct pkcs11_provid
CK_SESSION_HANDLE session; CK_SESSION_HANDLE session;
int login_required, ret; int login_required, ret;
@ -2157,7 +2191,7 @@ diff -up openssh-8.7p1/ssh-pkcs11.c.pkcs11-uri openssh-8.7p1/ssh-pkcs11.c
int ret = -1; int ret = -1;
struct pkcs11_provider *p = NULL; struct pkcs11_provider *p = NULL;
void *handle = NULL; void *handle = NULL;
@@ -1517,164 +1702,298 @@ pkcs11_register_provider(char *provider_ @@ -1517,164 +1702,305 @@
CK_FUNCTION_LIST *f = NULL; CK_FUNCTION_LIST *f = NULL;
CK_TOKEN_INFO *token; CK_TOKEN_INFO *token;
CK_ULONG i; CK_ULONG i;
@ -2243,20 +2277,12 @@ diff -up openssh-8.7p1/ssh-pkcs11.c.pkcs11-uri openssh-8.7p1/ssh-pkcs11.c
error("C_GetInfo for provider %s failed: %lu", error("C_GetInfo for provider %s failed: %lu",
- provider_id, rv); - provider_id, rv);
+ provider_module, rv); + provider_module, rv);
+ goto fail;
+ }
+ rmspace(m->info.manufacturerID, sizeof(m->info.manufacturerID));
+ if (uri->lib_manuf != NULL &&
+ strcmp(uri->lib_manuf, m->info.manufacturerID)) {
+ debug_f("Skipping provider %s not matching library_manufacturer",
+ m->info.manufacturerID);
goto fail; goto fail;
} }
- rmspace(p->info.manufacturerID, sizeof(p->info.manufacturerID)); - rmspace(p->info.manufacturerID, sizeof(p->info.manufacturerID));
- rmspace(p->info.libraryDescription, sizeof(p->info.libraryDescription)); - rmspace(p->info.libraryDescription, sizeof(p->info.libraryDescription));
+ rmspace(m->info.libraryDescription, sizeof(m->info.libraryDescription)); - debug("provider %s: manufacturerID <%s> cryptokiVersion %d.%d"
debug("provider %s: manufacturerID <%s> cryptokiVersion %d.%d" - " libraryDescription <%s> libraryVersion %d.%d",
" libraryDescription <%s> libraryVersion %d.%d",
- provider_id, - provider_id,
- p->info.manufacturerID, - p->info.manufacturerID,
- p->info.cryptokiVersion.major, - p->info.cryptokiVersion.major,
@ -2265,6 +2291,16 @@ diff -up openssh-8.7p1/ssh-pkcs11.c.pkcs11-uri openssh-8.7p1/ssh-pkcs11.c
- p->info.libraryVersion.major, - p->info.libraryVersion.major,
- p->info.libraryVersion.minor); - p->info.libraryVersion.minor);
- if ((rv = f->C_GetSlotList(CK_TRUE, NULL, &p->nslots)) != CKR_OK) { - if ((rv = f->C_GetSlotList(CK_TRUE, NULL, &p->nslots)) != CKR_OK) {
+ rmspace(m->info.manufacturerID, sizeof(m->info.manufacturerID));
+ if (uri->lib_manuf != NULL &&
+ strncmp(uri->lib_manuf, m->info.manufacturerID, 32)) {
+ debug_f("Skipping provider %s not matching library_manufacturer",
+ m->info.manufacturerID);
+ goto fail;
+ }
+ rmspace(m->info.libraryDescription, sizeof(m->info.libraryDescription));
+ debug("provider %s: manufacturerID <%.32s> cryptokiVersion %d.%d"
+ " libraryDescription <%.32s> libraryVersion %d.%d",
+ provider_module, + provider_module,
+ m->info.manufacturerID, + m->info.manufacturerID,
+ m->info.cryptokiVersion.major, + m->info.cryptokiVersion.major,
@ -2321,6 +2357,9 @@ diff -up openssh-8.7p1/ssh-pkcs11.c.pkcs11-uri openssh-8.7p1/ssh-pkcs11.c
rmspace(token->manufacturerID, sizeof(token->manufacturerID)); rmspace(token->manufacturerID, sizeof(token->manufacturerID));
rmspace(token->model, sizeof(token->model)); rmspace(token->model, sizeof(token->model));
rmspace(token->serialNumber, sizeof(token->serialNumber)); rmspace(token->serialNumber, sizeof(token->serialNumber));
- debug("provider %s slot %lu: label <%s> manufacturerID <%s> "
- "model <%s> serial <%s> flags 0x%lx",
- provider_id, (unsigned long)i,
+ } + }
+ m->module_path = provider_module; + m->module_path = provider_module;
+ provider_module = NULL; + provider_module = NULL;
@ -2389,22 +2428,28 @@ diff -up openssh-8.7p1/ssh-pkcs11.c.pkcs11-uri openssh-8.7p1/ssh-pkcs11.c
+ continue; + continue;
+ } + }
+ if (uri->token != NULL && + if (uri->token != NULL &&
+ strcmp(token->label, uri->token) != 0) { + strncmp(token->label, uri->token, 32) != 0) {
+ debug2_f("ignoring token not matching label (%s) " + debug2_f("ignoring token not matching label (%.32s) "
+ "specified by PKCS#11 URI in slot %lu", + "specified by PKCS#11 URI in slot %lu",
+ token->label, (unsigned long)i); + token->label, (unsigned long)i);
+ continue; + continue;
+ } + }
+ if (uri->manuf != NULL && + if (uri->manuf != NULL &&
+ strcmp(token->manufacturerID, uri->manuf) != 0) { + strncmp(token->manufacturerID, uri->manuf, 32) != 0) {
+ debug2_f("ignoring token not matching requrested " + debug2_f("ignoring token not matching requrested "
+ "manufacturerID (%s) specified by PKCS#11 URI in " + "manufacturerID (%.32s) specified by PKCS#11 URI in "
+ "slot %lu", token->manufacturerID, (unsigned long)i); + "slot %lu", token->manufacturerID, (unsigned long)i);
+ continue; + continue;
+ } + }
debug("provider %s slot %lu: label <%s> manufacturerID <%s> " + if (uri->serial != NULL &&
"model <%s> serial <%s> flags 0x%lx", + strncmp(token->serialNumber, uri->serial, 16) != 0) {
- provider_id, (unsigned long)i, + debug2_f("ignoring token not matching requrested "
+ "serialNumber (%s) specified by PKCS#11 URI in "
+ "slot %lu", token->serialNumber, (unsigned long)i);
+ continue;
+ }
+ debug("provider %s slot %lu: label <%.32s> manufacturerID <%.32s> "
+ "model <%.16s> serial <%.16s> flags 0x%lx",
+ provider_uri, (unsigned long)i, + provider_uri, (unsigned long)i,
token->label, token->manufacturerID, token->model, token->label, token->manufacturerID, token->model,
token->serialNumber, token->flags); token->serialNumber, token->flags);
@ -2443,7 +2488,7 @@ diff -up openssh-8.7p1/ssh-pkcs11.c.pkcs11-uri openssh-8.7p1/ssh-pkcs11.c
+ pkcs11_fetch_certs(p, i, keyp, labelsp, &nkeys, uri); + pkcs11_fetch_certs(p, i, keyp, labelsp, &nkeys, uri);
+ } + }
+ if (nkeys == 0 && uri->object != NULL) { + if (nkeys == 0 && uri->object != NULL) {
+ debug3_f("No keys found. Retrying without label (%s) ", + debug3_f("No keys found. Retrying without label (%.32s) ",
+ uri->object); + uri->object);
+ /* Try once more without the label filter */ + /* Try once more without the label filter */
+ char *label = uri->object; + char *label = uri->object;
@ -2531,7 +2576,7 @@ diff -up openssh-8.7p1/ssh-pkcs11.c.pkcs11-uri openssh-8.7p1/ssh-pkcs11.c
/* no keys found or some other error, de-register provider */ /* no keys found or some other error, de-register provider */
if (nkeys <= 0 && p != NULL) { if (nkeys <= 0 && p != NULL) {
@@ -1683,7 +2002,37 @@ pkcs11_add_provider(char *provider_id, c @@ -1684,7 +2012,37 @@ pkcs11_add_provider(char *provider_id, c
pkcs11_provider_unref(p); pkcs11_provider_unref(p);
} }
if (nkeys == 0) if (nkeys == 0)
@ -2591,7 +2636,7 @@ diff -up openssh-8.7p1/ssh-pkcs11.h.pkcs11-uri openssh-8.7p1/ssh-pkcs11.h
diff -up openssh-8.7p1/ssh-pkcs11-uri.c.pkcs11-uri openssh-8.7p1/ssh-pkcs11-uri.c diff -up openssh-8.7p1/ssh-pkcs11-uri.c.pkcs11-uri openssh-8.7p1/ssh-pkcs11-uri.c
--- openssh-8.7p1/ssh-pkcs11-uri.c.pkcs11-uri 2021-08-30 13:07:43.667700130 +0200 --- openssh-8.7p1/ssh-pkcs11-uri.c.pkcs11-uri 2021-08-30 13:07:43.667700130 +0200
+++ openssh-8.7p1/ssh-pkcs11-uri.c 2021-08-30 13:07:43.667700130 +0200 +++ openssh-8.7p1/ssh-pkcs11-uri.c 2021-08-30 13:07:43.667700130 +0200
@@ -0,0 +1,419 @@ @@ -0,0 +1,437 @@
+/* +/*
+ * Copyright (c) 2017 Red Hat + * Copyright (c) 2017 Red Hat
+ * + *
@ -2634,13 +2679,14 @@ diff -up openssh-8.7p1/ssh-pkcs11-uri.c.pkcs11-uri openssh-8.7p1/ssh-pkcs11-uri.
+#define PKCS11_URI_OBJECT "object" +#define PKCS11_URI_OBJECT "object"
+#define PKCS11_URI_LIB_MANUF "library-manufacturer" +#define PKCS11_URI_LIB_MANUF "library-manufacturer"
+#define PKCS11_URI_MANUF "manufacturer" +#define PKCS11_URI_MANUF "manufacturer"
+#define PKCS11_URI_SERIAL "serial"
+#define PKCS11_URI_MODULE_PATH "module-path" +#define PKCS11_URI_MODULE_PATH "module-path"
+#define PKCS11_URI_PIN_VALUE "pin-value" +#define PKCS11_URI_PIN_VALUE "pin-value"
+ +
+/* Keyword tokens. */ +/* Keyword tokens. */
+typedef enum { +typedef enum {
+ pId, pToken, pObject, pLibraryManufacturer, pManufacturer, pModulePath, + pId, pToken, pObject, pLibraryManufacturer, pManufacturer, pSerial,
+ pPinValue, pBadOption + pModulePath, pPinValue, pBadOption
+} pkcs11uriOpCodes; +} pkcs11uriOpCodes;
+ +
+/* Textual representation of the tokens. */ +/* Textual representation of the tokens. */
@ -2653,6 +2699,7 @@ diff -up openssh-8.7p1/ssh-pkcs11-uri.c.pkcs11-uri openssh-8.7p1/ssh-pkcs11-uri.
+ { PKCS11_URI_OBJECT, pObject }, + { PKCS11_URI_OBJECT, pObject },
+ { PKCS11_URI_LIB_MANUF, pLibraryManufacturer }, + { PKCS11_URI_LIB_MANUF, pLibraryManufacturer },
+ { PKCS11_URI_MANUF, pManufacturer }, + { PKCS11_URI_MANUF, pManufacturer },
+ { PKCS11_URI_SERIAL, pSerial },
+ { PKCS11_URI_MODULE_PATH, pModulePath }, + { PKCS11_URI_MODULE_PATH, pModulePath },
+ { PKCS11_URI_PIN_VALUE, pPinValue }, + { PKCS11_URI_PIN_VALUE, pPinValue },
+ { NULL, pBadOption } + { NULL, pBadOption }
@ -2811,6 +2858,16 @@ diff -up openssh-8.7p1/ssh-pkcs11-uri.c.pkcs11-uri openssh-8.7p1/ssh-pkcs11-uri.
+ goto err; + goto err;
+ } + }
+ +
+ /* Write serial */
+ if (uri->serial) {
+ struct sshbuf *serial = percent_encode(uri->serial,
+ strlen(uri->serial), PKCS11_URI_WHITELIST);
+ path = pkcs11_uri_append(path, PKCS11_URI_PATH_SEPARATOR,
+ PKCS11_URI_SERIAL, serial);
+ if (path == NULL)
+ goto err;
+ }
+
+ /* Write module_path */ + /* Write module_path */
+ if (uri->module_path) { + if (uri->module_path) {
+ struct sshbuf *module = percent_encode(uri->module_path, + struct sshbuf *module = percent_encode(uri->module_path,
@ -2853,6 +2910,7 @@ diff -up openssh-8.7p1/ssh-pkcs11-uri.c.pkcs11-uri openssh-8.7p1/ssh-pkcs11-uri.
+ free(pkcs11->object); + free(pkcs11->object);
+ free(pkcs11->lib_manuf); + free(pkcs11->lib_manuf);
+ free(pkcs11->manuf); + free(pkcs11->manuf);
+ free(pkcs11->serial);
+ if (pkcs11->pin) + if (pkcs11->pin)
+ freezero(pkcs11->pin, strlen(pkcs11->pin)); + freezero(pkcs11->pin, strlen(pkcs11->pin));
+ free(pkcs11); + free(pkcs11);
@ -2948,6 +3006,11 @@ diff -up openssh-8.7p1/ssh-pkcs11-uri.c.pkcs11-uri openssh-8.7p1/ssh-pkcs11-uri.
+ charptr = &pkcs11->manuf; + charptr = &pkcs11->manuf;
+ goto parse_string; + goto parse_string;
+ +
+ case pSerial:
+ /* CK_TOKEN_INFO -> serialNumber */
+ charptr = &pkcs11->serial;
+ goto parse_string;
+
+ case pLibraryManufacturer: + case pLibraryManufacturer:
+ /* CK_INFO -> manufacturerID */ + /* CK_INFO -> manufacturerID */
+ charptr = &pkcs11->lib_manuf; + charptr = &pkcs11->lib_manuf;
@ -3014,7 +3077,7 @@ diff -up openssh-8.7p1/ssh-pkcs11-uri.c.pkcs11-uri openssh-8.7p1/ssh-pkcs11-uri.
diff -up openssh-8.7p1/ssh-pkcs11-uri.h.pkcs11-uri openssh-8.7p1/ssh-pkcs11-uri.h diff -up openssh-8.7p1/ssh-pkcs11-uri.h.pkcs11-uri openssh-8.7p1/ssh-pkcs11-uri.h
--- openssh-8.7p1/ssh-pkcs11-uri.h.pkcs11-uri 2021-08-30 13:07:43.667700130 +0200 --- openssh-8.7p1/ssh-pkcs11-uri.h.pkcs11-uri 2021-08-30 13:07:43.667700130 +0200
+++ openssh-8.7p1/ssh-pkcs11-uri.h 2021-08-30 13:07:43.667700130 +0200 +++ openssh-8.7p1/ssh-pkcs11-uri.h 2021-08-30 13:07:43.667700130 +0200
@@ -0,0 +1,42 @@ @@ -0,0 +1,43 @@
+/* +/*
+ * Copyright (c) 2017 Red Hat + * Copyright (c) 2017 Red Hat
+ * + *
@ -3046,6 +3109,7 @@ diff -up openssh-8.7p1/ssh-pkcs11-uri.h.pkcs11-uri openssh-8.7p1/ssh-pkcs11-uri.
+ char *object; + char *object;
+ char *lib_manuf; + char *lib_manuf;
+ char *manuf; + char *manuf;
+ char *serial;
+ /* query */ + /* query */
+ char *module_path; + char *module_path;
+ char *pin; /* Only parsed, but not printed */ + char *pin; /* Only parsed, but not printed */

4
openssh-9.3p1-merged-openssl-evp.patch
View File

@ -710,9 +710,9 @@ diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x
+ return 0; + return 0;
+} +}
+ +
/* remove trailing spaces */ /* remove trailing spaces. Note, that this does NOT guarantee the buffer
* will be null terminated if there are no trailing spaces! */
static void static void
rmspace(u_char *buf, size_t len)
diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x config.status -x configure~ -x configure.ac openssh-9.3p1/ssh-pkcs11-client.c openssh-9.3p1-patched/ssh-pkcs11-client.c diff --color -ru -x regress -x autom4te.cache -x '*.o' -x '*.lo' -x Makefile -x config.status -x configure~ -x configure.ac openssh-9.3p1/ssh-pkcs11-client.c openssh-9.3p1-patched/ssh-pkcs11-client.c
--- openssh-9.3p1/ssh-pkcs11-client.c 2023-06-06 15:53:36.591443976 +0200 --- openssh-9.3p1/ssh-pkcs11-client.c 2023-06-06 15:53:36.591443976 +0200
+++ openssh-9.3p1-patched/ssh-pkcs11-client.c 2023-06-06 15:52:25.626551768 +0200 +++ openssh-9.3p1-patched/ssh-pkcs11-client.c 2023-06-06 15:52:25.626551768 +0200

7
openssh.spec
View File

@ -47,7 +47,7 @@
# Do not forget to bump pam_ssh_agent_auth release if you rewind the main package release to 1 # Do not forget to bump pam_ssh_agent_auth release if you rewind the main package release to 1
%global openssh_ver 9.3p1 %global openssh_ver 9.3p1
%global openssh_rel 8 %global openssh_rel 9
%global pam_ssh_agent_ver 0.10.4 %global pam_ssh_agent_ver 0.10.4
%global pam_ssh_agent_rel 9 %global pam_ssh_agent_rel 9
@ -741,6 +741,11 @@ test -f %{sysconfig_anaconda} && \
%endif %endif
%changelog %changelog
* Thu Aug 03 2023 Norbert Pocs <npocs@redhat.com> - 9.3p1-9
- pkcs11: Add support for 'serial' in PKCS#11 URI
- Apply the upstream MR related to the previous pkcs11 issue
- https://github.com/openssh/openssh-portable/pull/406
* Thu Aug 03 2023 Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.3p1-8 * Thu Aug 03 2023 Dmitry Belyavskiy <dbelyavs@redhat.com> - 9.3p1-8
- Split including crypto-policies to a separate config (rhbz#1970566) - Split including crypto-policies to a separate config (rhbz#1970566)
- Disable forking of ssh-agent on startup (rhbz#2148555) - Disable forking of ssh-agent on startup (rhbz#2148555)