commit ed3eaf7d68c083b6015ca3425b75932999dafaad

Author: Jakub Jelen <jjelen@redhat.com>

Date:   Wed Apr 24 17:23:21 2019 +0200

    PKCS#11 URI from Fedora

     * Print PKCS#11 URIs from ssh-keygen

     * Accept PKCS#11 URIs in -i argument to ssh

     * Allow PKCS#11 URI specification in ssh_config

     * Fallback to p11-kit-proxy

     * PKCS#11 URI support for ssh-add and ssh-agent

      * internal representation is URI

     * Allow to specify pin-value in URI to avoid interactive prompts

    Currently recognized and used parts of PKCS#11 URI:

     * path (optional)

      * token

      * id

      * manufacturer

      * (library-manufacturer)

     * query (optional)

      * module-path

      * pin-value

    Unit test for PKCS#11 URIs

     * test PKCS#11 URI parser, generator

     * test percent_encodeer and decoder

    Regression tests for PKCS#11 URI support

     * soft-pkcs11.so  from people.su.se/~lha/soft-pkcs11

      * Return correct CKR for unknown attributes

      * Adjust and build it with regress tests (allowing agent-pkcs11 test)

     * Test PKCS#11 URIs support with soft-pkcs11

      * Direct usage from commandline (URI, provider and combination)

      * Usage from configuration files

      * Usage in ssh-agent (add, sign, remove)

      * Make sure it is built with correct paths

diff --git a/Makefile.in b/Makefile.in

index e7549470..4511f82a 100644

--- a/Makefile.in

+++ b/Makefile.in

@@ -102,7 +102,7 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \

 	monitor_fdpass.o rijndael.o ssh-dss.o ssh-ecdsa.o ssh-ecdsa-sk.o \

 	ssh-ed25519-sk.o ssh-rsa.o dh.o \

 	msg.o progressmeter.o dns.o entropy.o gss-genr.o umac.o umac128.o \

-	ssh-pkcs11.o smult_curve25519_ref.o \

+	ssh-pkcs11.o ssh-pkcs11-uri.o smult_curve25519_ref.o \

 	poly1305.o chacha.o cipher-chachapoly.o cipher-chachapoly-libcrypto.o \

 	ssh-ed25519.o digest-openssl.o digest-libc.o \

 	hmac.o sc25519.o ge25519.o fe25519.o ed25519.o verify.o hash.o \

@@ -289,6 +289,8 @@ clean:	regressclean

 	rm -f regress/unittests/match/test_match$(EXEEXT)

 	rm -f regress/unittests/utf8/*.o

 	rm -f regress/unittests/utf8/test_utf8$(EXEEXT)

+	rm -f regress/unittests/pkcs11/*.o

+	rm -f regress/unittests/pkcs11/test_pkcs11$(EXEEXT)

 	rm -f regress/misc/sk-dummy/*.o

 	rm -f regress/misc/sk-dummy/*.lo

 	rm -f regress/misc/sk-dummy/sk-dummy.so

@@ -322,6 +324,8 @@ distclean:	regressclean

 	rm -f regress/unittests/match/test_match

 	rm -f regress/unittests/utf8/*.o

 	rm -f regress/unittests/utf8/test_utf8

+	rm -f regress/unittests/pkcs11/*.o

+	rm -f regress/unittests/pkcs11/test_pkcs11

 	(cd openbsd-compat && $(MAKE) distclean)

 	if test -d pkg ; then \

 		rm -fr pkg ; \

@@ -490,6 +494,7 @@ regress-prep:

 	$(MKDIR_P) `pwd`/regress/unittests/kex

 	$(MKDIR_P) `pwd`/regress/unittests/match

 	$(MKDIR_P) `pwd`/regress/unittests/utf8

+	$(MKDIR_P) `pwd`/regress/unittests/pkcs11

 	$(MKDIR_P) `pwd`/regress/misc/sk-dummy

 	[ -f `pwd`/regress/Makefile ] || \

 	    ln -s `cd $(srcdir) && pwd`/regress/Makefile `pwd`/regress/Makefile

@@ -617,6 +622,16 @@ regress/unittests/utf8/test_utf8$(EXEEXT): \

 	    regress/unittests/test_helper/libtest_helper.a \

 	    -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS)

+UNITTESTS_TEST_PKCS11_OBJS=\

+	regress/unittests/pkcs11/tests.o

+

+regress/unittests/pkcs11/test_pkcs11$(EXEEXT): \

+    ${UNITTESTS_TEST_PKCS11_OBJS} \

+    regress/unittests/test_helper/libtest_helper.a libssh.a

+	$(LD) -o $@ $(LDFLAGS) $(UNITTESTS_TEST_PKCS11_OBJS) \

+	    regress/unittests/test_helper/libtest_helper.a \

+	    -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS)

+

 # These all need to be compiled -fPIC, so they are treated differently.

 SK_DUMMY_OBJS=\

 	regress/misc/sk-dummy/sk-dummy.lo \

@@ -655,6 +670,7 @@ regress-unit-binaries: regress-prep $(REGRESSLIBS) \

 	regress/unittests/kex/test_kex$(EXEEXT) \

 	regress/unittests/match/test_match$(EXEEXT) \

 	regress/unittests/utf8/test_utf8$(EXEEXT) \

+	regress/unittests/pkcs11/test_pkcs11$(EXEEXT) \

 tests:	file-tests t-exec interop-tests unit

 	echo all tests passed

diff --git a/configure.ac b/configure.ac

index b689db4b..98d3ce4f 100644

--- a/configure.ac

+++ b/configure.ac

@@ -1911,12 +1911,14 @@ AC_LINK_IFELSE(

 	[AC_DEFINE([HAVE_ISBLANK], [1], [Define if you have isblank(3C).])

 ])

+SCARD_MSG="yes"

 disable_pkcs11=

 AC_ARG_ENABLE([pkcs11],

 	[  --disable-pkcs11        disable PKCS#11 support code [no]],

 	[

 		if test "x$enableval" = "xno" ; then

 			disable_pkcs11=1

+			SCARD_MSG="no"

 		fi

 	]

 )

@@ -1945,6 +1947,40 @@ AC_SEARCH_LIBS([dlopen], [dl])

 AC_CHECK_FUNCS([dlopen])

 AC_CHECK_DECL([RTLD_NOW], [], [], [#include <dlfcn.h>])

+# Check whether we have a p11-kit, we got default provider on command line

+DEFAULT_PKCS11_PROVIDER_MSG="no"

+AC_ARG_WITH([default-pkcs11-provider],

+	[  --with-default-pkcs11-provider[[=PATH]]   Use default pkcs11 provider (p11-kit detected by default)],

+	[ if test "x$withval" != "xno" && test "x$disable_pkcs11" = "x"; then

+		if test "x$withval" = "xyes" ; then

+			AC_PATH_TOOL([PKGCONFIG], [pkg-config], [no])

+			if test "x$PKGCONFIG" != "xno"; then

+				AC_MSG_CHECKING([if $PKGCONFIG knows about p11-kit])

+				if "$PKGCONFIG" "p11-kit-1"; then

+					AC_MSG_RESULT([yes])

+					use_pkgconfig_for_p11kit=yes

+				else

+					AC_MSG_RESULT([no])

+				fi

+			fi

+		else

+			PKCS11_PATH="${withval}"

+		fi

+		if test "x$use_pkgconfig_for_p11kit" = "xyes"; then

+			PKCS11_PATH=`$PKGCONFIG --variable=proxy_module p11-kit-1`

+		fi

+		AC_CHECK_FILE("$PKCS11_PATH",

+			[ AC_DEFINE_UNQUOTED([PKCS11_DEFAULT_PROVIDER], ["$PKCS11_PATH"], [Path to default PKCS#11 provider (p11-kit proxy)])

+			  DEFAULT_PKCS11_PROVIDER_MSG="$PKCS11_PATH"

+			],

+			[ AC_MSG_ERROR([Requested PKCS11 provided not found]) ]

+		)

+	else

+		AC_MSG_WARN([Needs PKCS11 support to enable default pkcs11 provider])

+	fi ]

+)

+

+

 # IRIX has a const char return value for gai_strerror()

 AC_CHECK_FUNCS([gai_strerror], [

 	AC_DEFINE([HAVE_GAI_STRERROR])

@@ -5401,6 +5437,7 @@ echo "                  BSD Auth support: $BSD_AUTH_MSG"

 echo "              Random number source: $RAND_MSG"

 echo "             Privsep sandbox style: $SANDBOX_STYLE"

 echo "                   PKCS#11 support: $enable_pkcs11"

+echo "          Default PKCS#11 provider: $DEFAULT_PKCS11_PROVIDER_MSG"

 echo "                  U2F/FIDO support: $enable_sk"

 echo ""

diff --git a/regress/Makefile b/regress/Makefile

index 774c10d4..6bf3b627 100644

--- a/regress/Makefile

+++ b/regress/Makefile

@@ -116,7 +116,8 @@ CLEANFILES=	*.core actual agent-key.* authorized_keys_${USERNAME} \

 		known_hosts known_hosts-cert known_hosts.* krl-* ls.copy \

 		modpipe netcat no_identity_config \

 		pidfile putty.rsa2 ready regress.log remote_pid \

-		revoked-* rsa rsa-agent rsa-agent.pub rsa.pub rsa_ssh2_cr.prv \

+		revoked-* rsa rsa-agent rsa-agent.pub rsa-agent-cert.pub \

+		rsa.pub rsa_ssh2_cr.prv pkcs11*.crt pkcs11*.key pkcs11.info \

 		rsa_ssh2_crnl.prv scp-ssh-wrapper.exe \

 		scp-ssh-wrapper.scp setuid-allowed sftp-server.log \

 		sftp-server.sh sftp.log ssh-log-wrapper.sh ssh.log \

@@ -246,6 +247,7 @@ unit:

 		V="" ; \

 		test "x${USE_VALGRIND}" = "x" || \

 		    V=${.CURDIR}/valgrind-unit.sh ; \

+		$$V ${.OBJDIR}/unittests/pkcs11/test_pkcs11 ; \

 		$$V ${.OBJDIR}/unittests/sshbuf/test_sshbuf ; \

 		$$V ${.OBJDIR}/unittests/sshkey/test_sshkey \

 			-d ${.CURDIR}/unittests/sshkey/testdata ; \

diff --git a/regress/agent-pkcs11.sh b/regress/agent-pkcs11.sh

index fbbaea51..5d75d69f 100644

--- a/regress/agent-pkcs11.sh

+++ b/regress/agent-pkcs11.sh

@@ -113,7 +113,7 @@ else

 	done

 	trace "remove pkcs11 keys"

-	echo ${TEST_SSH_PIN} | notty ${SSHADD} -e ${TEST_SSH_PKCS11} > /dev/null 2>&1

+	${SSHADD} -e ${TEST_SSH_PKCS11} > /dev/null 2>&1

 	r=$?

 	if [ $r -ne 0 ]; then

 		fail "ssh-add -e failed: exit code $r"

diff --git a/regress/pkcs11.sh b/regress/pkcs11.sh

new file mode 100644

index 00000000..a91aee94

--- /dev/null

+++ b/regress/pkcs11.sh

@@ -0,0 +1,349 @@

+#

+#  Copyright (c) 2017 Red Hat

+#

+#  Authors: Jakub Jelen <jjelen@redhat.com>

+#

+#  Permission to use, copy, modify, and distribute this software for any

+#  purpose with or without fee is hereby granted, provided that the above

+#  copyright notice and this permission notice appear in all copies.

+#

+#  THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES

+#  WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF

+#  MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR

+#  ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES

+#  WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN

+#  ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF

+#  OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

+

+tid="pkcs11 tests with soft token"

+

+try_token_libs() {

+	for _lib in "$@" ; do

+		if test -f "$_lib" ; then

+			verbose "Using token library $_lib"

+			TEST_SSH_PKCS11="$_lib"

+			return

+		fi

+	done

+	echo "skipped: Unable to find PKCS#11 token library"

+	exit 0

+}

+

+try_token_libs \

+	/usr/local/lib/softhsm/libsofthsm2.so \

+	/usr/lib64/pkcs11/libsofthsm2.so \

+	/usr/lib/x86_64-linux-gnu/softhsm/libsofthsm2.so

+

+TEST_SSH_PIN=1234

+TEST_SSH_SOPIN=12345678

+if [ "x$TEST_SSH_SSHPKCS11HELPER" != "x" ]; then

+	SSH_PKCS11_HELPER="${TEST_SSH_SSHPKCS11HELPER}"

+	export SSH_PKCS11_HELPER

+fi

+

+test -f "$TEST_SSH_PKCS11" || fatal "$TEST_SSH_PKCS11 does not exist"

+

+# setup environment for softhsm token

+DIR=$OBJ/SOFTHSM

+rm -rf $DIR

+TOKEN=$DIR/tokendir

+mkdir -p $TOKEN

+SOFTHSM2_CONF=$DIR/softhsm2.conf

+export SOFTHSM2_CONF

+cat > $SOFTHSM2_CONF << EOF

+# SoftHSM v2 configuration file

+directories.tokendir = ${TOKEN}

+objectstore.backend = file

+# ERROR, WARNING, INFO, DEBUG

+log.level = DEBUG

+# If CKF_REMOVABLE_DEVICE flag should be set

+slots.removable = false

+EOF

+out=$(softhsm2-util --init-token --free --label token-slot-0 --pin "$TEST_SSH_PIN" --so-pin "$TEST_SSH_SOPIN")

+slot=$(echo -- $out | sed 's/.* //')

+

+# prevent ssh-agent from calling ssh-askpass

+SSH_ASKPASS=/usr/bin/true

+export SSH_ASKPASS

+unset DISPLAY

+# We need interactive access to test PKCS# since it prompts for PIN

+sed -i 's/.*BatchMode.*//g' $OBJ/ssh_proxy

+

+# start command w/o tty, so ssh accepts pin from stdin (from agent-pkcs11.sh)

+notty() {

+	perl -e 'use POSIX; POSIX::setsid();

+	    if (fork) { wait; exit($? >> 8); } else { exec(@ARGV) }' "$@"

+}

+

+trace "generating keys"

+ID1="02"

+ID2="04"

+RSA=${DIR}/RSA

+EC=${DIR}/EC

+openssl genpkey -algorithm rsa > $RSA

+openssl pkcs8 -nocrypt -in $RSA |\

+    softhsm2-util --slot "$slot" --label "SSH RSA Key $ID1" --id $ID1 \

+	--pin "$TEST_SSH_PIN" --import /dev/stdin

+openssl genpkey \

+    -genparam \

+    -algorithm ec \

+    -pkeyopt ec_paramgen_curve:prime256v1 |\

+    openssl genpkey \

+    -paramfile /dev/stdin > $EC

+openssl pkcs8 -nocrypt -in $EC |\

+    softhsm2-util --slot "$slot" --label "SSH ECDSA Key $ID2" --id $ID2 \

+	--pin "$TEST_SSH_PIN" --import /dev/stdin

+

+trace "List the keys in the ssh-keygen with PKCS#11 URIs"

+${SSHKEYGEN} -D ${TEST_SSH_PKCS11} > $OBJ/token_keys

+if [ $? -ne 0 ]; then

+	fail "FAIL: keygen fails to enumerate keys on PKCS#11 token"

+fi

+grep "pkcs11:" $OBJ/token_keys > /dev/null

+if [ $? -ne 0 ]; then

+	fail "FAIL: The keys from ssh-keygen do not contain PKCS#11 URI as a comment"

+fi

+

+# Set the ECDSA key to authorized keys

+grep "ECDSA" $OBJ/token_keys > $OBJ/authorized_keys_$USER

+

+trace "Simple connect with ssh (without PKCS#11 URI)"

+echo ${TEST_SSH_PIN} | notty ${SSH} -I ${TEST_SSH_PKCS11} \

+    -F $OBJ/ssh_proxy somehost exit 5

+r=$?

+if [ $r -ne 5 ]; then

+	fail "FAIL: ssh connect with pkcs11 failed (exit code $r)"

+fi

+

+trace "Connect with PKCS#11 URI"

+trace "  (ECDSA key should succeed)"

+echo ${TEST_SSH_PIN} | notty ${SSH} -F $OBJ/ssh_proxy \

+    -i "pkcs11:id=%${ID2}?module-path=${TEST_SSH_PKCS11}" somehost exit 5

+r=$?

+if [ $r -ne 5 ]; then

+	fail "FAIL: ssh connect with PKCS#11 URI failed (exit code $r)"

+fi

+

+trace "  (RSA key should fail)"

+echo ${TEST_SSH_PIN} | notty ${SSH} -F $OBJ/ssh_proxy \

+     -i "pkcs11:id=%${ID1}?module-path=${TEST_SSH_PKCS11}" somehost exit 5

+r=$?

+if [ $r -eq 5 ]; then

+	fail "FAIL: ssh connect with PKCS#11 URI succeeded (should fail)"

+fi

+

+trace "Connect with PKCS#11 URI including PIN should not prompt"

+trace "  (ECDSA key should succeed)"

+${SSH} -F $OBJ/ssh_proxy -i \

+    "pkcs11:id=%${ID2}?module-path=${TEST_SSH_PKCS11}&pin-value=${TEST_SSH_PIN}" somehost exit 5

+r=$?

+if [ $r -ne 5 ]; then

+	fail "FAIL: ssh connect with PKCS#11 URI failed (exit code $r)"

+fi

+

+trace "  (RSA key should fail)"

+${SSH} -F $OBJ/ssh_proxy -i \

+    "pkcs11:id=%${ID1}?module-path=${TEST_SSH_PKCS11}&pin-value=${TEST_SSH_PIN}" somehost exit 5

+r=$?

+if [ $r -eq 5 ]; then

+	fail "FAIL: ssh connect with PKCS#11 URI succeeded (should fail)"

+fi

+

+trace "Connect with various filtering options in PKCS#11 URI"

+trace "  (by object label, ECDSA should succeed)"

+echo ${TEST_SSH_PIN} | notty ${SSH} -F $OBJ/ssh_proxy \

+    -i "pkcs11:object=SSH%20ECDSA%20Key%2004?module-path=${TEST_SSH_PKCS11}" somehost exit 5

+r=$?

+if [ $r -ne 5 ]; then

+	fail "FAIL: ssh connect with PKCS#11 URI failed (exit code $r)"

+fi

+

+trace "  (by object label, RSA key should fail)"

+echo ${TEST_SSH_PIN} | notty ${SSH} -F $OBJ/ssh_proxy \

+     -i "pkcs11:object=SSH%20RSA%20Key%2002?module-path=${TEST_SSH_PKCS11}" somehost exit 5

+r=$?

+if [ $r -eq 5 ]; then

+	fail "FAIL: ssh connect with PKCS#11 URI succeeded (should fail)"

+fi

+

+trace "  (by token label, ECDSA key should succeed)"

+echo ${TEST_SSH_PIN} | notty ${SSH} -F $OBJ/ssh_proxy \

+    -i "pkcs11:id=%${ID2};token=token-slot-0?module-path=${TEST_SSH_PKCS11}" somehost exit 5

+r=$?

+if [ $r -ne 5 ]; then

+	fail "FAIL: ssh connect with PKCS#11 URI failed (exit code $r)"

+fi

+

+trace "  (by wrong token label, should fail)"

+echo ${TEST_SSH_PIN} | notty ${SSH} -F $OBJ/ssh_proxy \

+     -i "pkcs11:token=token-slot-99?module-path=${TEST_SSH_PKCS11}" somehost exit 5

+r=$?

+if [ $r -eq 5 ]; then

+	fail "FAIL: ssh connect with PKCS#11 URI succeeded (should fail)"

+fi

+

+

+

+

+trace "Test PKCS#11 URI specification in configuration files"

+echo "IdentityFile \"pkcs11:id=%${ID2}?module-path=${TEST_SSH_PKCS11}\"" \

+    >> $OBJ/ssh_proxy

+trace "  (ECDSA key should succeed)"

+echo ${TEST_SSH_PIN} | notty ${SSH} -F $OBJ/ssh_proxy somehost exit 5

+r=$?

+if [ $r -ne 5 ]; then

+	fail "FAIL: ssh connect with PKCS#11 URI in config failed (exit code $r)"

+fi

+

+# Set the RSA key as authorized

+grep "RSA" $OBJ/token_keys > $OBJ/authorized_keys_$USER

+

+trace "  (RSA key should fail)"

+echo ${TEST_SSH_PIN} | notty ${SSH} -F $OBJ/ssh_proxy somehost exit 5

+r=$?

+if [ $r -eq 5 ]; then

+	fail "FAIL: ssh connect with PKCS#11 URI in config succeeded (should fail)"

+fi

+sed -i -e "/IdentityFile/d" $OBJ/ssh_proxy

+

+trace "Test PKCS#11 URI specification in configuration files with bogus spaces"

+echo "IdentityFile \"    pkcs11:?module-path=${TEST_SSH_PKCS11}    \"" \

+    >> $OBJ/ssh_proxy

+echo ${TEST_SSH_PIN} | notty ${SSH} -F $OBJ/ssh_proxy somehost exit 5

+r=$?

+if [ $r -ne 5 ]; then

+	fail "FAIL: ssh connect with PKCS#11 URI with bogus spaces in config failed" \

+	    "(exit code $r)"

+fi

+sed -i -e "/IdentityFile/d" $OBJ/ssh_proxy

+

+

+trace "Combination of PKCS11Provider and PKCS11URI on commandline"

+trace "  (RSA key should succeed)"

+echo ${TEST_SSH_PIN} | notty ${SSH} -F $OBJ/ssh_proxy \

+    -i "pkcs11:id=%${ID1}" -I ${TEST_SSH_PKCS11} somehost exit 5

+r=$?

+if [ $r -ne 5 ]; then

+	fail "FAIL: ssh connect with PKCS#11 URI and provider combination" \

+	    "failed (exit code $r)"

+fi

+

+trace "Regress: Missing provider in PKCS11URI option"

+${SSH} -F $OBJ/ssh_proxy \

+    -o IdentityFile=\"pkcs11:token=segfault\" somehost exit 5

+r=$?

+if [ $r -eq 139 ]; then

+	fail "FAIL: ssh connect with missing provider_id from configuration option" \

+	    "crashed (exit code $r)"

+fi

+

+

+trace "SSH Agent can work with PKCS#11 URI"

+trace "start the agent"

+eval `${SSHAGENT} -s` >  /dev/null

+

+r=$?

+if [ $r -ne 0 ]; then

+	fail "could not start ssh-agent: exit code $r"

+else

+	trace "add whole provider to agent"

+	echo ${TEST_SSH_PIN} | notty ${SSHADD} \

+	    "pkcs11:?module-path=${TEST_SSH_PKCS11}" #> /dev/null 2>&1

+	r=$?

+	if [ $r -ne 0 ]; then

+		fail "FAIL: ssh-add failed with whole provider: exit code $r"

+	fi

+

+	trace " pkcs11 list via agent (all keys)"

+	${SSHADD} -l > /dev/null 2>&1

+	r=$?

+	if [ $r -ne 0 ]; then

+		fail "FAIL: ssh-add -l failed with whole provider: exit code $r"

+	fi

+

+	trace " pkcs11 connect via agent (all keys)"

+	${SSH} -F $OBJ/ssh_proxy somehost exit 5

+	r=$?

+	if [ $r -ne 5 ]; then

+		fail "FAIL: ssh connect failed with whole provider (exit code $r)"

+	fi

+

+	trace " remove pkcs11 keys (all keys)"

+	${SSHADD} -d "pkcs11:?module-path=${TEST_SSH_PKCS11}" > /dev/null 2>&1

+	r=$?

+	if [ $r -ne 0 ]; then

+		fail "FAIL: ssh-add -d failed with whole provider: exit code $r"

+	fi

+

+	trace "add only RSA key to the agent"

+	echo ${TEST_SSH_PIN} | notty ${SSHADD} \

+	    "pkcs11:id=%${ID1}?module-path=${TEST_SSH_PKCS11}" > /dev/null 2>&1

+	r=$?

+	if [ $r -ne 0 ]; then

+		fail "FAIL ssh-add failed with RSA key: exit code $r"

+	fi

+

+	trace " pkcs11 connect via agent (RSA key)"

+	${SSH} -F $OBJ/ssh_proxy somehost exit 5

+	r=$?

+	if [ $r -ne 5 ]; then

+		fail "FAIL: ssh connect failed with RSA key (exit code $r)"

+	fi

+

+	trace " remove RSA pkcs11 key"

+	${SSHADD} -d "pkcs11:id=%${ID1}?module-path=${TEST_SSH_PKCS11}" \

+	    > /dev/null 2>&1

+	r=$?

+	if [ $r -ne 0 ]; then

+		fail "FAIL: ssh-add -d failed with RSA key: exit code $r"

+	fi

+

+	trace "add only ECDSA key to the agent"

+	echo ${TEST_SSH_PIN} | notty ${SSHADD} \

+	    "pkcs11:id=%${ID2}?module-path=${TEST_SSH_PKCS11}" > /dev/null 2>&1

+	r=$?

+	if [ $r -ne 0 ]; then

+		fail "FAIL: ssh-add failed with second key: exit code $r"

+	fi

+

+	trace " pkcs11 connect via agent (ECDSA key should fail)"

+	${SSH} -F $OBJ/ssh_proxy somehost exit 5

+	r=$?

+	if [ $r -eq 5 ]; then

+		fail "FAIL: ssh connect passed with ECDSA key (should fail)"

+	fi

+

+	trace "add also the RSA key to the agent"

+	echo ${TEST_SSH_PIN} | notty ${SSHADD} \

+	    "pkcs11:id=%${ID1}?module-path=${TEST_SSH_PKCS11}" > /dev/null 2>&1

+	r=$?

+	if [ $r -ne 0 ]; then

+		fail "FAIL: ssh-add failed with first key: exit code $r"

+	fi

+

+	trace " remove ECDSA pkcs11 key"

+	${SSHADD} -d "pkcs11:id=%${ID2}?module-path=${TEST_SSH_PKCS11}" \

+	    > /dev/null 2>&1

+	r=$?

+	if [ $r -ne 0 ]; then

+		fail "ssh-add -d failed with ECDSA key: exit code $r"

+	fi

+

+	trace " remove already-removed pkcs11 key should fail"

+	${SSHADD} -d "pkcs11:id=%${ID2}?module-path=${TEST_SSH_PKCS11}" \

+	    > /dev/null 2>&1

+	r=$?

+	if [ $r -eq 0 ]; then

+		fail "FAIL: ssh-add -d passed with non-existing key (should fail)"

+	fi

+

+	trace " pkcs11 connect via agent (the RSA key should be still usable)"

+	${SSH} -F $OBJ/ssh_proxy somehost exit 5

+	r=$?

+	if [ $r -ne 5 ]; then

+		fail "ssh connect failed with RSA key (after removing ECDSA): exit code $r"

+	fi

+

+	trace "kill agent"

+	${SSHAGENT} -k > /dev/null

+fi

diff --git a/regress/unittests/Makefile b/regress/unittests/Makefile

index 4e56e110..2690ebeb 100644

--- a/regress/unittests/Makefile

+++ b/regress/unittests/Makefile

@@ -2,6 +2,6 @@

 REGRESS_FAIL_EARLY?=	yes

 SUBDIR=	test_helper sshbuf sshkey bitmap kex hostkeys utf8 match conversion

-SUBDIR+=authopt misc sshsig

+SUBDIR+=authopt misc sshsig pkcs11

 .include <bsd.subdir.mk>

diff --git a/regress/unittests/pkcs11/tests.c b/regress/unittests/pkcs11/tests.c

new file mode 100644

index 00000000..b637cb13

--- /dev/null

+++ b/regress/unittests/pkcs11/tests.c

@@ -0,0 +1,337 @@

+/*

+ * Copyright (c) 2017 Red Hat

+ *

+ * Authors: Jakub Jelen <jjelen@redhat.com>

+ *

+ * Permission to use, copy, modify, and distribute this software for any

+ * purpose with or without fee is hereby granted, provided that the above

+ * copyright notice and this permission notice appear in all copies.

+ *

+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES

+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF

+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR

+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES

+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN

+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF

+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

+ */

+

+#include "includes.h"

+

+#include <locale.h>

+#include <string.h>

+

+#include "../test_helper/test_helper.h"

+

+#include "sshbuf.h"

+#include "ssh-pkcs11-uri.h"

+

+#define EMPTY_URI compose_uri(NULL, 0, NULL, NULL, NULL, NULL, NULL, NULL)

+

+/* prototypes are not public -- specify them here internally for tests */

+struct sshbuf *percent_encode(const char *, size_t, char *);

+int percent_decode(char *, char **);

+

+void

+compare_uri(struct pkcs11_uri *a, struct pkcs11_uri *b)

+{

+	ASSERT_PTR_NE(a, NULL);

+	ASSERT_PTR_NE(b, NULL);

+	ASSERT_SIZE_T_EQ(a->id_len, b->id_len);

+	ASSERT_MEM_EQ(a->id, b->id, a->id_len);

+	if (b->object != NULL)

+		ASSERT_STRING_EQ(a->object, b->object);

+	else /* both should be null */

+		ASSERT_PTR_EQ(a->object, b->object);

+	if (b->module_path != NULL)

+		ASSERT_STRING_EQ(a->module_path, b->module_path);

+	else /* both should be null */

+		ASSERT_PTR_EQ(a->module_path, b->module_path);

+	if (b->token != NULL)

+		ASSERT_STRING_EQ(a->token, b->token);

+	else /* both should be null */

+		ASSERT_PTR_EQ(a->token, b->token);

+	if (b->manuf != NULL)

+		ASSERT_STRING_EQ(a->manuf, b->manuf);

+	else /* both should be null */

+		ASSERT_PTR_EQ(a->manuf, b->manuf);

+	if (b->lib_manuf != NULL)

+		ASSERT_STRING_EQ(a->lib_manuf, b->lib_manuf);

+	else /* both should be null */

+		ASSERT_PTR_EQ(a->lib_manuf, b->lib_manuf);

+}

+

+void

+check_parse_rv(char *uri, struct pkcs11_uri *expect, int expect_rv)

+{

+	char *buf = NULL, *str;

+	struct pkcs11_uri *pkcs11uri = NULL;

+	int rv;

+

+	if (expect_rv == 0)

+		str = "Valid";

+	else

+		str = "Invalid";

+	asprintf(&buf, "%s PKCS#11 URI parsing: %s", str, uri);

+	TEST_START(buf);

+	free(buf);

+	pkcs11uri = pkcs11_uri_init();

+	rv = pkcs11_uri_parse(uri, pkcs11uri);

+	ASSERT_INT_EQ(rv, expect_rv);

+	if (rv == 0) /* in case of failure result is undefined */

+		compare_uri(pkcs11uri, expect);

+	pkcs11_uri_cleanup(pkcs11uri);

+	free(expect);

+	TEST_DONE();

+}

+

+void

+check_parse(char *uri, struct pkcs11_uri *expect)

+{

+	check_parse_rv(uri, expect, 0);

+}

+

+struct pkcs11_uri *

+compose_uri(unsigned char *id, size_t id_len, char *token, char *lib_manuf,

+    char *manuf, char *module_path, char *object, char *pin)

+{

+	struct pkcs11_uri *uri = pkcs11_uri_init();

+	if (id_len > 0) {

+		uri->id_len = id_len;

+		uri->id = id;

+	}

+	uri->module_path = module_path;

+	uri->token = token;

+	uri->lib_manuf = lib_manuf;

+	uri->manuf = manuf;

+	uri->object = object;

+	uri->pin = pin;

+	return uri;

+}

+

+static void

+test_parse_valid(void)

+{

+	/* path arguments */

+	check_parse("pkcs11:id=%01",

+	    compose_uri("\x01", 1, NULL, NULL, NULL, NULL, NULL, NULL));

+	check_parse("pkcs11:id=%00%01",

+	    compose_uri("\x00\x01", 2, NULL, NULL, NULL, NULL, NULL, NULL));

+	check_parse("pkcs11:token=SSH%20Keys",

+	    compose_uri(NULL, 0, "SSH Keys", NULL, NULL, NULL, NULL, NULL));

+	check_parse("pkcs11:library-manufacturer=OpenSC",

+	    compose_uri(NULL, 0, NULL, "OpenSC", NULL, NULL, NULL, NULL));

+	check_parse("pkcs11:manufacturer=piv_II",

+	    compose_uri(NULL, 0, NULL, NULL, "piv_II", NULL, NULL, NULL));

+	check_parse("pkcs11:object=SIGN%20Key",

+	    compose_uri(NULL, 0, NULL, NULL, NULL, NULL, "SIGN Key", NULL));

+	/* query arguments */

+	check_parse("pkcs11:?module-path=/usr/lib64/p11-kit-proxy.so",

+	    compose_uri(NULL, 0, NULL, NULL, NULL, "/usr/lib64/p11-kit-proxy.so", NULL, NULL));

+	check_parse("pkcs11:?pin-value=123456",

+	    compose_uri(NULL, 0, NULL, NULL, NULL, NULL, NULL, "123456"));

+

+	/* combinations */

+	/* ID SHOULD be percent encoded */

+	check_parse("pkcs11:token=SSH%20Key;id=0",

+	    compose_uri("0", 1, "SSH Key", NULL, NULL, NULL, NULL, NULL));

+	check_parse(

+	    "pkcs11:manufacturer=CAC?module-path=/usr/lib64/p11-kit-proxy.so",

+	    compose_uri(NULL, 0, NULL, NULL, "CAC",

+	    "/usr/lib64/p11-kit-proxy.so", NULL, NULL));

+	check_parse(

+	    "pkcs11:object=RSA%20Key?module-path=/usr/lib64/pkcs11/opencryptoki.so",

+	    compose_uri(NULL, 0, NULL, NULL, NULL,

+	    "/usr/lib64/pkcs11/opencryptoki.so", "RSA Key", NULL));

+	check_parse("pkcs11:?module-path=/usr/lib64/p11-kit-proxy.so&pin-value=123456",

+	    compose_uri(NULL, 0, NULL, NULL, NULL, "/usr/lib64/p11-kit-proxy.so", NULL, "123456"));

+

+	/* empty path component matches everything */

+	check_parse("pkcs11:", EMPTY_URI);

+

+	/* empty string is a valid to match against (and different from NULL) */

+	check_parse("pkcs11:token=",

+	    compose_uri(NULL, 0, "", NULL, NULL, NULL, NULL, NULL));

+	/* Percent character needs to be percent-encoded */

+	check_parse("pkcs11:token=%25",

+	     compose_uri(NULL, 0, "%", NULL, NULL, NULL, NULL, NULL));

+}

+

+static void

+test_parse_invalid(void)

+{

+	/* Invalid percent encoding */

+	check_parse_rv("pkcs11:id=%0", EMPTY_URI, -1);

+	/* Invalid percent encoding */

+	check_parse_rv("pkcs11:id=%ZZ", EMPTY_URI, -1);

+	/* Space MUST be percent encoded -- XXX not enforced yet */

+	check_parse("pkcs11:token=SSH Keys",

+	    compose_uri(NULL, 0, "SSH Keys", NULL, NULL, NULL, NULL, NULL));

+	/* MUST NOT contain duplicate attributes of the same name */

+	check_parse_rv("pkcs11:id=%01;id=%02", EMPTY_URI, -1);

+	/* MUST NOT contain duplicate attributes of the same name */

+	check_parse_rv("pkcs11:?pin-value=111111&pin-value=123456", EMPTY_URI, -1);

+	/* Unrecognized attribute in path are ignored with log message */

+	check_parse("pkcs11:key_name=SSH", EMPTY_URI);

+	/* Unrecognized attribute in query SHOULD be ignored */

+	check_parse("pkcs11:?key_name=SSH", EMPTY_URI);

+}

+

+void

+check_gen(char *expect, struct pkcs11_uri *uri)

+{

+	char *buf = NULL, *uri_str;

+

+	asprintf(&buf, "Valid PKCS#11 URI generation: %s", expect);

+	TEST_START(buf);

+	free(buf);

+	uri_str = pkcs11_uri_get(uri);

+	ASSERT_PTR_NE(uri_str, NULL);

+	ASSERT_STRING_EQ(uri_str, expect);

+	free(uri_str);

+	TEST_DONE();

+}

+

+static void

+test_generate_valid(void)

+{

+	/* path arguments */

+	check_gen("pkcs11:id=%01",

+	    compose_uri("\x01", 1, NULL, NULL, NULL, NULL, NULL, NULL));

+	check_gen("pkcs11:id=%00%01",

+	    compose_uri("\x00\x01", 2, NULL, NULL, NULL, NULL, NULL, NULL));

+	check_gen("pkcs11:token=SSH%20Keys", /* space must be percent encoded */

+	    compose_uri(NULL, 0, "SSH Keys", NULL, NULL, NULL, NULL, NULL));

+	/* library-manufacturer is not implmented now */

+	/*check_gen("pkcs11:library-manufacturer=OpenSC",

+	    compose_uri(NULL, 0, NULL, "OpenSC", NULL, NULL, NULL, NULL));*/

+	check_gen("pkcs11:manufacturer=piv_II",

+	    compose_uri(NULL, 0, NULL, NULL, "piv_II", NULL, NULL, NULL));

+	check_gen("pkcs11:object=RSA%20Key",

+	    compose_uri(NULL, 0, NULL, NULL, NULL, NULL, "RSA Key", NULL));

+	/* query arguments */

+	check_gen("pkcs11:?module-path=/usr/lib64/p11-kit-proxy.so",

+	    compose_uri(NULL, 0, NULL, NULL, NULL, "/usr/lib64/p11-kit-proxy.so", NULL, NULL));

+

+	/* combinations */

+	check_gen("pkcs11:id=%02;token=SSH%20Keys",

+	    compose_uri("\x02", 1, "SSH Keys", NULL, NULL, NULL, NULL, NULL));

+	check_gen("pkcs11:id=%EE%02?module-path=/usr/lib64/p11-kit-proxy.so",

+	    compose_uri("\xEE\x02", 2, NULL, NULL, NULL, "/usr/lib64/p11-kit-proxy.so", NULL, NULL));

+	check_gen("pkcs11:object=Encryption%20Key;manufacturer=piv_II",

+	    compose_uri(NULL, 0, NULL, NULL, "piv_II", NULL, "Encryption Key", NULL));

+

+	/* empty path component matches everything */

+	check_gen("pkcs11:", EMPTY_URI);

+

+}

+

+void

+check_encode(char *source, size_t len, char *allow_list, char *expect)

+{

+	char *buf = NULL;

+	struct sshbuf *b;

+

+	asprintf(&buf, "percent_encode: expected %s", expect);

+	TEST_START(buf);

+	free(buf);

+

+	b = percent_encode(source, len, allow_list);

+	ASSERT_STRING_EQ(sshbuf_ptr(b), expect);

+	sshbuf_free(b);

+	TEST_DONE();

+}

+

+static void

+test_percent_encode_multibyte(void)

+{

+	/* SHOULD be encoded as octets according to the UTF-8 character encoding */

+

+	/* multi-byte characters are "for free" */

+	check_encode("$", 1, "", "%24");

+	check_encode("¢", 2, "", "%C2%A2");

+	check_encode("€", 3, "", "%E2%82%AC");

+	check_encode("𐍈", 4, "", "%F0%90%8D%88");

+

+	/* CK_UTF8CHAR is unsigned char (1 byte) */

+	/* labels SHOULD be normalized to NFC [UAX15] */

+

+}

+

+static void

+test_percent_encode(void)

+{

+	/* Without allow list encodes everything (for CKA_ID) */

+	check_encode("A*", 2, "", "%41%2A");

+	check_encode("\x00", 1, "", "%00");

+	check_encode("\x7F", 1, "", "%7F");

+	check_encode("\x80", 1, "", "%80");

+	check_encode("\xff", 1, "", "%FF");

+

+	/* Default allow list encodes anything but safe letters */

+	check_encode("test" "\x00" "0alpha", 11, PKCS11_URI_WHITELIST,

+	    "test%000alpha");

+	check_encode(" ", 1, PKCS11_URI_WHITELIST,

+	    "%20"); /* Space MUST be percent encoded */

+	check_encode("/", 1, PKCS11_URI_WHITELIST,

+	    "%2F"); /* '/' delimiter MUST be percent encoded (in the path) */

+	check_encode("?", 1, PKCS11_URI_WHITELIST,

+	    "%3F"); /* delimiter '?' MUST be percent encoded (in the path) */

+	check_encode("#", 1, PKCS11_URI_WHITELIST,

+	    "%23"); /* '#' MUST be always percent encoded */

+	check_encode("key=value;separator?query&#anch", 35, PKCS11_URI_WHITELIST,

+	    "key%3Dvalue%3Bseparator%3Fquery%26amp%3B%23anch");

+

+	/* Components in query can have '/' unencoded (useful for paths) */

+	check_encode("/path/to.file", 13, PKCS11_URI_WHITELIST "/",

+	    "/path/to.file");

+}

+

+void

+check_decode(char *source, char *expect, int expect_len)

+{

+	char *buf = NULL, *out = NULL;

+	int rv;

+

+	asprintf(&buf, "percent_decode: %s", source);

+	TEST_START(buf);

+	free(buf);

+