mirror of
https://git.libssh.org/projects/libssh.git
synced 2026-10-24 03:48:55 +03:00
pkcs11: add support for kryoptic as a PKCS#11 soft token
If it's available, prefer it, otherwise fall back to SoftHSM. Signed-off-by: Pavol Žáčik <pzacik@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com> Merge-Request: <https://gitlab.com/libssh/libssh-mirror/-/merge_requests/859>
This commit is contained in:
Pavol Žáčik
Jakub Jelen
38
cmake/Modules/Findkryoptic.cmake
Normal file
38
cmake/Modules/Findkryoptic.cmake
Normal file
@@ -0,0 +1,38 @@
|
||||
# - Try to find kryoptic
|
||||
# Once done this will define
|
||||
#
|
||||
# KRYOPTIC_FOUND - system has kryoptic
|
||||
# KRYOPTIC_LIBRARIES - Link these to use kryoptic
|
||||
#
|
||||
#=============================================================================
|
||||
# Copyright (c) 2026 Pavol Žáčik <pzacik@redhat.com>
|
||||
#
|
||||
# Distributed under the OSI-approved BSD License (the "License");
|
||||
# see accompanying file Copyright.txt for details.
|
||||
#
|
||||
# This software is distributed WITHOUT ANY WARRANTY; without even the
|
||||
# implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
|
||||
# See the License for more information.
|
||||
#=============================================================================
|
||||
#
|
||||
|
||||
|
||||
find_library(KRYOPTIC_LIBRARY
|
||||
NAMES
|
||||
kryoptic_pkcs11
|
||||
PATH_SUFFIXES
|
||||
pkcs11
|
||||
)
|
||||
|
||||
if (KRYOPTIC_LIBRARY)
|
||||
set(KRYOPTIC_LIBRARIES
|
||||
${KRYOPTIC_LIBRARIES}
|
||||
${KRYOPTIC_LIBRARY}
|
||||
)
|
||||
endif (KRYOPTIC_LIBRARY)
|
||||
|
||||
include(FindPackageHandleStandardArgs)
|
||||
find_package_handle_standard_args(kryoptic DEFAULT_MSG KRYOPTIC_LIBRARIES)
|
||||
|
||||
# show the KRYOPTIC_LIBRARIES variable only in the advanced view
|
||||
mark_as_advanced(KRYOPTIC_LIBRARIES)
|
||||
@@ -282,17 +282,22 @@ find_program(SSHD_EXECUTABLE
|
||||
/usr/local/sbin)
|
||||
|
||||
if (WITH_PKCS11_URI)
|
||||
find_package(kryoptic)
|
||||
find_package(softhsm)
|
||||
if (NOT SOFTHSM_FOUND)
|
||||
message(SEND_ERROR "Could not find softhsm module!")
|
||||
endif (NOT SOFTHSM_FOUND)
|
||||
if (KRYOPTIC_FOUND)
|
||||
set(SOFT_TOKEN_MODULE ${KRYOPTIC_LIBRARY})
|
||||
elseif(SOFTHSM_FOUND)
|
||||
set(SOFT_TOKEN_MODULE ${SOFTHSM2_LIBRARY})
|
||||
else()
|
||||
message(SEND_ERROR "Could not find any PKCS#11 soft token module!")
|
||||
endif ()
|
||||
find_library(PKCS11SPY
|
||||
NAMES
|
||||
pkcs11-spy.so
|
||||
)
|
||||
|
||||
#Copy the script to setup PKCS11 tokens
|
||||
file(COPY pkcs11/setup-softhsm-tokens.sh DESTINATION ${CMAKE_CURRENT_BINARY_DIR}/pkcs11 FILE_PERMISSIONS OWNER_READ OWNER_WRITE OWNER_EXECUTE)
|
||||
file(COPY pkcs11/setup-soft-tokens.sh DESTINATION ${CMAKE_CURRENT_BINARY_DIR}/pkcs11 FILE_PERMISSIONS OWNER_READ OWNER_WRITE OWNER_EXECUTE)
|
||||
endif (WITH_PKCS11_URI)
|
||||
|
||||
if (CLIENT_TESTING OR SERVER_TESTING)
|
||||
|
||||
113
tests/pkcs11/setup-soft-tokens.sh
Normal file
113
tests/pkcs11/setup-soft-tokens.sh
Normal file
@@ -0,0 +1,113 @@
|
||||
#!/bin/bash
|
||||
|
||||
# The client keys are stored in a soft token.
|
||||
|
||||
TESTDIR=$1
|
||||
PRIVKEY=$2
|
||||
OBJNAME=$3
|
||||
TOKENLABEL=$3 # yeah. The same as object label
|
||||
LOADPUBLIC=$4
|
||||
SOFT_TOKEN_MODULE=$5
|
||||
shift 5
|
||||
|
||||
PUBKEY="$PRIVKEY.pub"
|
||||
|
||||
echo "TESTDIR: $TESTDIR"
|
||||
echo "PRIVKEY: $PRIVKEY"
|
||||
echo "PUBKEY: $PUBKEY"
|
||||
echo "OBJNAME: $OBJNAME"
|
||||
echo "TOKENLABEL: $TOKENLABEL"
|
||||
echo "LOADPUBLIC: $LOADPUBLIC"
|
||||
echo "SOFT_TOKEN_MODULE: $SOFT_TOKEN_MODULE"
|
||||
|
||||
if echo "$SOFT_TOKEN_MODULE" | grep -q "kryoptic"; then
|
||||
export KRYOPTIC_CONF="$TESTDIR/kryoptic.conf"
|
||||
if [ ! -f "$KRYOPTIC_CONF" ]; then
|
||||
touch "$KRYOPTIC_CONF"
|
||||
fi
|
||||
# Kryoptic does not auto-create slots, so count existing ones in config to find the next free one
|
||||
FREE_SLOT=$(grep -c '^\[\[slots\]\]' "$KRYOPTIC_CONF")
|
||||
cat >>"$KRYOPTIC_CONF" <<EOF
|
||||
[[slots]]
|
||||
slot = $FREE_SLOT
|
||||
dbtype = "sqlite"
|
||||
dbargs = "$TESTDIR/$TOKENLABEL.sql"
|
||||
EOF
|
||||
cat "$KRYOPTIC_CONF"
|
||||
elif echo "$SOFT_TOKEN_MODULE" | grep -q "softhsm"; then
|
||||
export SOFTHSM2_CONF=$TESTDIR/softhsm.conf
|
||||
if [ ! -d "$TESTDIR/db" ]; then
|
||||
# Create temporary directory for tokens
|
||||
install -d -m 0755 "$TESTDIR/db"
|
||||
|
||||
# Create SoftHSM configuration file
|
||||
cat >"$SOFTHSM2_CONF" <<EOF
|
||||
directories.tokendir = $TESTDIR/db
|
||||
objectstore.backend = file
|
||||
log.level = DEBUG
|
||||
# # The hashed ECDSA mechanisms wrongly do not support multi-part operations
|
||||
# https://github.com/softhsm/SoftHSMv2/issues/842
|
||||
slots.mechanisms = -CKM_ECDSA_SHA1,CKM_ECDSA_SHA224,CKM_ECDSA_SHA256,CKM_ECDSA_SHA384,CKM_ECDSA_SHA512
|
||||
EOF
|
||||
fi
|
||||
# SoftHSM2 creates a new uninitialized slot after each init
|
||||
FREE_SLOT=$(pkcs11-tool --module "$SOFT_TOKEN_MODULE" --list-slots 2>/dev/null | awk '/Slot [0-9][0-9]*/{slot=$2} /uninitialized/{print slot; exit}')
|
||||
cat "$SOFTHSM2_CONF"
|
||||
else
|
||||
echo "Unknown PKCS#11 soft token module: $SOFT_TOKEN_MODULE"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
#init -- each object will have its own token
|
||||
cmd="pkcs11-tool --module $SOFT_TOKEN_MODULE --init-token --slot-index $FREE_SLOT --label $TOKENLABEL --init-pin --pin 1234 --so-pin 1234"
|
||||
eval echo "$cmd"
|
||||
out=$(eval "$cmd")
|
||||
ret=$?
|
||||
if [ $ret -ne 0 ]; then
|
||||
echo "Init token failed"
|
||||
echo "$out"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
#load private key
|
||||
cmd="p11tool --provider $SOFT_TOKEN_MODULE --write --load-privkey $PRIVKEY --label $OBJNAME --login --set-pin=1234 \"pkcs11:token=$TOKENLABEL\""
|
||||
eval echo "$cmd"
|
||||
out=$(eval "$cmd")
|
||||
ret=$?
|
||||
if [ $ret -ne 0 ]; then
|
||||
echo "Loading privkey failed"
|
||||
echo "$out"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
cat "$PUBKEY"
|
||||
|
||||
ls -l "$TESTDIR"
|
||||
|
||||
if [ "$LOADPUBLIC" -ne 0 ]; then
|
||||
#load public key
|
||||
cmd="p11tool --provider $SOFT_TOKEN_MODULE --write --load-pubkey $PUBKEY --label $OBJNAME --login --set-pin=1234 \"pkcs11:token=$TOKENLABEL\""
|
||||
eval echo "$cmd"
|
||||
out=$(eval "$cmd")
|
||||
ret=$?
|
||||
if [ $ret -ne 0 ]; then
|
||||
echo "Loading pubkey failed"
|
||||
echo "$out"
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
|
||||
cmd="p11tool --list-all --login \"pkcs11:token=$TOKENLABEL\" --set-pin=1234"
|
||||
eval echo "$cmd"
|
||||
out=$(eval "$cmd")
|
||||
ret=$?
|
||||
if [ $ret -ne 0 ]; then
|
||||
echo "Logging in failed"
|
||||
echo "$out"
|
||||
exit 1
|
||||
fi
|
||||
echo "$out"
|
||||
|
||||
pkcs11-tool -M --login --pin=1234 --module="$SOFT_TOKEN_MODULE" --token-label="$TOKENLABEL"
|
||||
|
||||
exit 0
|
||||
@@ -1,93 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
# The client keys are stored in a SoftHSM device.
|
||||
|
||||
TESTDIR=$1
|
||||
PRIVKEY=$2
|
||||
OBJNAME=$3
|
||||
TOKENLABEL=$3 # yeah. The same as object label
|
||||
LOADPUBLIC=$4
|
||||
LIBSOFTHSM_PATH=$5
|
||||
shift 5
|
||||
|
||||
PUBKEY="$PRIVKEY.pub"
|
||||
|
||||
echo "TESTDIR: $TESTDIR"
|
||||
echo "PRIVKEY: $PRIVKEY"
|
||||
echo "PUBKEY: $PUBKEY"
|
||||
echo "OBJNAME: $OBJNAME"
|
||||
echo "TOKENLABEL: $TOKENLABEL"
|
||||
echo "LOADPUBLIC: $LOADPUBLIC"
|
||||
|
||||
if [ ! -d "$TESTDIR/db" ]; then
|
||||
# Create temporary directory for tokens
|
||||
install -d -m 0755 "$TESTDIR/db"
|
||||
|
||||
# Create SoftHSM configuration file
|
||||
cat >"$TESTDIR/softhsm.conf" <<EOF
|
||||
directories.tokendir = $TESTDIR/db
|
||||
objectstore.backend = file
|
||||
log.level = DEBUG
|
||||
# # The hashed ECDSA mechanisms wrongly do not support multi-part operations
|
||||
# https://github.com/softhsm/SoftHSMv2/issues/842
|
||||
slots.mechanisms = -CKM_ECDSA_SHA1,CKM_ECDSA_SHA224,CKM_ECDSA_SHA256,CKM_ECDSA_SHA384,CKM_ECDSA_SHA512
|
||||
EOF
|
||||
|
||||
cat "$TESTDIR/softhsm.conf"
|
||||
fi
|
||||
|
||||
export SOFTHSM2_CONF=$TESTDIR/softhsm.conf
|
||||
|
||||
#init -- each object will have its own token
|
||||
cmd="softhsm2-util --init-token --label $TOKENLABEL --free --pin 1234 --so-pin 1234"
|
||||
eval echo "$cmd"
|
||||
out=$(eval "$cmd")
|
||||
ret=$?
|
||||
if [ $ret -ne 0 ]; then
|
||||
echo "Init token failed"
|
||||
echo "$out"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
#load private key
|
||||
cmd="p11tool --provider $LIBSOFTHSM_PATH --write --load-privkey $PRIVKEY --label $OBJNAME --login --set-pin=1234 \"pkcs11:token=$TOKENLABEL\""
|
||||
eval echo "$cmd"
|
||||
out=$(eval "$cmd")
|
||||
ret=$?
|
||||
if [ $ret -ne 0 ]; then
|
||||
echo "Loading privkey failed"
|
||||
echo "$out"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
cat "$PUBKEY"
|
||||
|
||||
ls -l "$TESTDIR"
|
||||
|
||||
if [ "$LOADPUBLIC" -ne 0 ]; then
|
||||
#load public key
|
||||
cmd="p11tool --provider $LIBSOFTHSM_PATH --write --load-pubkey $PUBKEY --label $OBJNAME --login --set-pin=1234 \"pkcs11:token=$TOKENLABEL\""
|
||||
eval echo "$cmd"
|
||||
out=$(eval "$cmd")
|
||||
ret=$?
|
||||
if [ $ret -ne 0 ]; then
|
||||
echo "Loading pubkey failed"
|
||||
echo "$out"
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
|
||||
cmd="p11tool --list-all --login \"pkcs11:token=$TOKENLABEL\" --set-pin=1234"
|
||||
eval echo "$cmd"
|
||||
out=$(eval "$cmd")
|
||||
ret=$?
|
||||
if [ $ret -ne 0 ]; then
|
||||
echo "Logging in failed"
|
||||
echo "$out"
|
||||
exit 1
|
||||
fi
|
||||
echo "$out"
|
||||
|
||||
pkcs11-tool -M --login --pin=1234 --module="$LIBSOFTHSM_PATH" --token-label="$TOKENLABEL"
|
||||
|
||||
exit 0
|
||||
@@ -83,6 +83,8 @@
|
||||
#cmakedefine WITH_TIMEOUT ${WITH_TIMEOUT}
|
||||
#cmakedefine TIMEOUT_EXECUTABLE "${TIMEOUT_EXECUTABLE}"
|
||||
#cmakedefine SOFTHSM2_LIBRARY "${SOFTHSM2_LIBRARY}"
|
||||
#cmakedefine KRYOPTIC_LIBRARY "${KRYOPTIC_LIBRARY}"
|
||||
#cmakedefine SOFT_TOKEN_MODULE "${SOFT_TOKEN_MODULE}"
|
||||
#cmakedefine PKCS11SPY "${PKCS11SPY}"
|
||||
#cmakedefine HAVE_SK_DUMMY 1
|
||||
#cmakedefine SK_DUMMY_LIBRARY_PATH "${SK_DUMMY_LIBRARY_PATH}"
|
||||
|
||||
@@ -1715,26 +1715,26 @@ void torture_setup_tokens(const char *temp_dir,
|
||||
|
||||
rc = snprintf(token_setup_start_cmd,
|
||||
sizeof(token_setup_start_cmd),
|
||||
"%s/tests/pkcs11/setup-softhsm-tokens.sh %s %s %s %s %s",
|
||||
"%s/tests/pkcs11/setup-soft-tokens.sh %s %s %s %s %s",
|
||||
BINARYDIR,
|
||||
temp_dir,
|
||||
filename,
|
||||
object_name,
|
||||
load_public,
|
||||
SOFTHSM2_LIBRARY);
|
||||
SOFT_TOKEN_MODULE);
|
||||
assert_int_not_equal(rc, sizeof(token_setup_start_cmd));
|
||||
|
||||
rc = system(token_setup_start_cmd);
|
||||
assert_return_code(rc, errno);
|
||||
|
||||
#ifdef WITH_PKCS11_PROVIDER
|
||||
setenv("PKCS11_PROVIDER_MODULE", SOFTHSM2_LIBRARY, 1);
|
||||
setenv("PKCS11_PROVIDER_MODULE", SOFT_TOKEN_MODULE, 1);
|
||||
|
||||
/* This is useful for debugging PKCS#11 calls */
|
||||
env = getenv("TORTURE_PKCS11");
|
||||
if (env != NULL && env[0] != '\0') {
|
||||
#ifdef PKCS11SPY
|
||||
setenv("PKCS11SPY", SOFTHSM2_LIBRARY, 1);
|
||||
setenv("PKCS11SPY", SOFT_TOKEN_MODULE, 1);
|
||||
setenv("PKCS11_PROVIDER_MODULE", PKCS11SPY, 1);
|
||||
#else
|
||||
fprintf(stderr, "[ TORTURE ] >>> pkcs11-spy not found\n");
|
||||
@@ -1742,6 +1742,9 @@ void torture_setup_tokens(const char *temp_dir,
|
||||
}
|
||||
#endif /* WITH_PKCS11_PROVIDER */
|
||||
|
||||
snprintf(conf_path, sizeof(conf_path), "%s/kryoptic.conf", temp_dir);
|
||||
setenv("KRYOPTIC_CONF", conf_path, 1);
|
||||
|
||||
snprintf(conf_path, sizeof(conf_path), "%s/softhsm.conf", temp_dir);
|
||||
setenv("SOFTHSM2_CONF", conf_path, 1);
|
||||
}
|
||||
@@ -1749,6 +1752,7 @@ void torture_setup_tokens(const char *temp_dir,
|
||||
void torture_cleanup_tokens(const char *temp_dir)
|
||||
{
|
||||
unsetenv("SOFTHSM2_CONF");
|
||||
unsetenv("KRYOPTIC_CONF");
|
||||
}
|
||||
#endif /* WITH_PKCS11_URI */
|
||||
|
||||
|
||||
Reference in New Issue
Block a user