openssh unix dev - Jun 2020 - [PATCH 0/1] Add support for RFC7512 PKCS#11 URIs

Once engine keys are supported, adding PKCS#11 URI support becomes
easy because the libp11 engine already supports them.  For openssh,
all that has to happen is that openssh must not assume the URI passed
in to ssh-add is a file which can be opened.  When the transition to
openssl providers is done, PKCS#11 will have its own separate
provider, but the URI will be the same, so this entire scheme will
survive the transition even though the underlying implementation will
change slightly.

This is how it works: I've got two tokens set up in p11-kit, which is
the PKCS#11 provider on linux.  I can see this by using the gnutls
p11tool, which is already p11-kit integrated:
> p11tool --list-token-urls
pkcs11:model=p11-kit-trust;manufacturer=PKCS%2311%20Kit;serial=1;token=System%20Trust
pkcs11:model=p11-kit-trust;manufacturer=PKCS%2311%20Kit;serial=1;token=Default%20Trust
pkcs11:model=single-key;manufacturer=jejb-rsa-token;serial=14da9bd1140939b7;token=id_rsa_new
pkcs11:model=single-key;manufacturer=jejb-ec-token;serial=23f4c12d1c02c943;token=id_ecdsa

My tokens are single key tokens, but for multiple key tokens, I'd have
to specify the key by id or object inside the token, but since I don't
I can do:
> ssh-add 'pkcs11:token=id_rsa_new'
Enter engine key passphrase:
Engine Identity added: pkcs11:token=id_rsa_new

Using the shortest URI that uniquely identifies the key (I've named my
tokens to be unique, if you don't you often get a generic token name
and you'd have to use other distinguishing data like the serial).  Now
ssh-add shows this token added to the agent by URI:
> ssh-add -l
2048 SHA256:6q8CFWO4m3Ky99h+Mp9b6KEBTdobxUZQGzd0Sgxilpg pkcs11:token=id_rsa_new
(RSA)

This makes quite a neat way of handling tokens on a modern Linux
system without the user having to worry about provider shared objects.

---

James Bottomley (1):
  Support PKCS#11 URI keys vi libp11

 ssh-add.c | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

-- 
2.26.2

PKCS#11 URIs are an RFC7512 scheme for naming individual token based
keys.  In a system which supports them (Such as via p11-kit), every
key may be uniquely specified via such a URI (so you can add specific
keys from token which have more than one).  libp11 is a project that
installs an openssl engine which supports PKCS#11 URIs via modules
installed in the p11-kit directory.

Support is simple in that the OpenSSL libp11 engine already supports
the URI scheme, so all that has to be done is to add extra code to try
the engines anyway, even if a file corresponding to the ssh-add can't
be found.  The only problem with this scheme is that it can't return a
meaningful error if there's a problem with the PKCS#11 URI.  This will
be fixed in the provider architecture, but it's a historical remnant
of the way the engine keys work (returning NULL for every error).

The key can be inserted by URI:
> ssh-add 'pkcs11:token=id_rsa_new'
And when successfully added, it will be shown by URI:
> ssh-add -l
2048 SHA256:6q8CFWO4m3Ky99h+Mp9b6KEBTdobxUZQGzd0Sgxilpg pkcs11:token=id_rsa_new
(RSA)

Signed-off-by: James Bottomley <James.Bottomley at HansenPartnership.com>
---
 ssh-add.c | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/ssh-add.c b/ssh-add.c
index b0ce393c7..017dea228 100644
--- a/ssh-add.c
+++ b/ssh-add.c
@@ -227,13 +227,19 @@ add_file(int agent_fd, const char *filename, int key_only,
int qflag,
 	int r, fd, ret = -1;
 	size_t i;
 	u_int32_t left;
-	struct sshbuf *keyblob;
+	struct sshbuf *keyblob = NULL;
 	struct ssh_identitylist *idlist;
 
 	if (strcmp(filename, "-") == 0) {
 		fd = STDIN_FILENO;
 		filename = "(stdin)";
 	} else if ((fd = open(filename, O_RDONLY)) == -1) {
+#ifdef USE_OPENSSL_ENGINE
+		if (errno == ENOENT) {
+			r = 0;
+			goto engine;
+		}
+#endif
 		perror(filename);
 		return -1;
 	}
@@ -261,12 +267,17 @@ add_file(int agent_fd, const char *filename, int key_only,
int qflag,
 	if ((r = sshkey_parse_private_fileblob(keyblob, "", &private,
 	    &comment)) != 0 && r != SSH_ERR_KEY_WRONG_PASSPHRASE) {
 #ifdef USE_OPENSSL_ENGINE
-		int n_r = add_engine_key(agent_fd, filename);
+		int n_r;
 
+	engine:
+		n_r = add_engine_key(agent_fd, filename);
 		if (n_r == SSH_AGENT_SUCCESS) {
 			clear_pass();
 			sshbuf_free(keyblob);
 			return 0;
+		} else if (r == 0 && n_r == SSH_ERR_INTERNAL_ERROR) {
+			perror(filename);
+			return -1;
 		} else if (n_r != SSH_ERR_INTERNAL_ERROR) {
 			r = n_r;
 		}
-- 
2.26.2