agent-pkcs11.sh revision 1.12
1# $OpenBSD: agent-pkcs11.sh,v 1.12 2023/10/30 17:32:00 djm Exp $ 2# Placed in the Public Domain. 3 4tid="pkcs11 agent test" 5 6# Find a PKCS#11 library. 7p11_find_lib() { 8 TEST_SSH_PKCS11="" 9 for _lib in "$@" ; do 10 if test -f "$_lib" ; then 11 TEST_SSH_PKCS11="$_lib" 12 return 13 fi 14 done 15} 16 17# Perform PKCS#11 setup: prepares a softhsm2 token configuration, generated 18# keys and loads them into the virtual token. 19PKCS11_OK= 20export PKCS11_OK 21p11_setup() { 22 p11_find_lib \ 23 /usr/local/lib/softhsm/libsofthsm2.so 24 test -z "$TEST_SSH_PKCS11" && return 1 25 verbose "using token library $TEST_SSH_PKCS11" 26 TEST_SSH_PIN=1234 27 TEST_SSH_SOPIN=12345678 28 if [ "x$TEST_SSH_SSHPKCS11HELPER" != "x" ]; then 29 SSH_PKCS11_HELPER="${TEST_SSH_SSHPKCS11HELPER}" 30 export SSH_PKCS11_HELPER 31 fi 32 33 # setup environment for softhsm2 token 34 DIR=$OBJ/SOFTHSM 35 rm -rf $DIR 36 TOKEN=$DIR/tokendir 37 mkdir -p $TOKEN 38 SOFTHSM2_CONF=$DIR/softhsm2.conf 39 export SOFTHSM2_CONF 40 cat > $SOFTHSM2_CONF << EOF 41# SoftHSM v2 configuration file 42directories.tokendir = ${TOKEN} 43objectstore.backend = file 44# ERROR, WARNING, INFO, DEBUG 45log.level = DEBUG 46# If CKF_REMOVABLE_DEVICE flag should be set 47slots.removable = false 48EOF 49 out=$(softhsm2-util --init-token --free --label token-slot-0 --pin "$TEST_SSH_PIN" --so-pin "$TEST_SSH_SOPIN") 50 slot=$(echo -- $out | sed 's/.* //') 51 trace "generating keys" 52 # RSA key 53 RSA=${DIR}/RSA 54 RSAP8=${DIR}/RSAP8 55 $OPENSSL_BIN genpkey -algorithm rsa > $RSA 2>/dev/null || \ 56 fatal "genpkey RSA fail" 57 $OPENSSL_BIN pkcs8 -nocrypt -in $RSA > $RSAP8 || fatal "pkcs8 RSA fail" 58 softhsm2-util --slot "$slot" --label 01 --id 01 --pin "$TEST_SSH_PIN" \ 59 --import $RSAP8 >/dev/null || fatal "softhsm import RSA fail" 60 chmod 600 $RSA 61 ssh-keygen -y -f $RSA > ${RSA}.pub 62 # ECDSA key 63 ECPARAM=${DIR}/ECPARAM 64 EC=${DIR}/EC 65 ECP8=${DIR}/ECP8 66 $OPENSSL_BIN genpkey -genparam -algorithm ec \ 67 -pkeyopt ec_paramgen_curve:prime256v1 > $ECPARAM || \ 68 fatal "param EC fail" 69 $OPENSSL_BIN genpkey -paramfile $ECPARAM > $EC || \ 70 fatal "genpkey EC fail" 71 $OPENSSL_BIN pkcs8 -nocrypt -in $EC > $ECP8 || fatal "pkcs8 EC fail" 72 softhsm2-util --slot "$slot" --label 02 --id 02 --pin "$TEST_SSH_PIN" \ 73 --import $ECP8 >/dev/null || fatal "softhsm import EC fail" 74 chmod 600 $EC 75 ssh-keygen -y -f $EC > ${EC}.pub 76 # Prepare askpass script to load PIN. 77 PIN_SH=$DIR/pin.sh 78 cat > $PIN_SH << EOF 79#!/bin/sh 80echo "${TEST_SSH_PIN}" 81EOF 82 chmod 0700 "$PIN_SH" 83 PKCS11_OK=yes 84 return 0 85} 86 87# Peforms ssh-add with the right token PIN. 88p11_ssh_add() { 89 env SSH_ASKPASS="$PIN_SH" SSH_ASKPASS_REQUIRE=force ${SSHADD} "$@" 90} 91 92p11_setup || skip "No PKCS#11 library found" 93 94trace "start agent" 95eval `${SSHAGENT} ${EXTRA_AGENT_ARGS} -s` > /dev/null 96r=$? 97if [ $r -ne 0 ]; then 98 fail "could not start ssh-agent: exit code $r" 99else 100 trace "add pkcs11 key to agent" 101 p11_ssh_add -s ${TEST_SSH_PKCS11} > /dev/null 2>&1 102 r=$? 103 if [ $r -ne 0 ]; then 104 fail "ssh-add -s failed: exit code $r" 105 fi 106 107 trace "pkcs11 list via agent" 108 ${SSHADD} -l > /dev/null 2>&1 109 r=$? 110 if [ $r -ne 0 ]; then 111 fail "ssh-add -l failed: exit code $r" 112 fi 113 114 for k in $RSA $EC; do 115 trace "testing $k" 116 pub=$(cat $k.pub) 117 ${SSHADD} -L | grep -q "$pub" || \ 118 fail "key $k missing in ssh-add -L" 119 ${SSHADD} -T $k.pub || fail "ssh-add -T with $k failed" 120 121 # add to authorized keys 122 cat $k.pub > $OBJ/authorized_keys_$USER 123 trace "pkcs11 connect via agent ($k)" 124 ${SSH} -F $OBJ/ssh_proxy somehost exit 5 125 r=$? 126 if [ $r -ne 5 ]; then 127 fail "ssh connect failed (exit code $r)" 128 fi 129 done 130 131 trace "remove pkcs11 keys" 132 p11_ssh_add -e ${TEST_SSH_PKCS11} > /dev/null 2>&1 133 r=$? 134 if [ $r -ne 0 ]; then 135 fail "ssh-add -e failed: exit code $r" 136 fi 137 138 trace "kill agent" 139 ${SSHAGENT} -k > /dev/null 140fi 141