1 files changed, 46 insertions, 175 deletions

diff --git a/ssh-pkcs11-helper.c b/ssh-pkcs11-helper.c
index a8154f21c058..7ed4bdb76841 100644
--- a/ssh-pkcs11-helper.c
+++ b/ssh-pkcs11-helper.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-pkcs11-helper.c,v 1.27 2024/08/15 00:51:51 djm Exp $ */
+/* $OpenBSD: ssh-pkcs11-helper.c,v 1.29 2025/07/30 04:27:42 djm Exp $ */
 /*
  * Copyright (c) 2010 Markus Friedl.  All rights reserved.
  *
@@ -18,17 +18,11 @@
 #include "includes.h"
 
 #include <sys/types.h>
-#ifdef HAVE_SYS_TIME_H
-# include <sys/time.h>
-#endif
-
-#include "openbsd-compat/sys-queue.h"
+#include <sys/time.h>
 
 #include <stdlib.h>
 #include <errno.h>
-#ifdef HAVE_POLL_H
 #include <poll.h>
-#endif
 #include <stdarg.h>
 #include <string.h>
 #include <unistd.h>
@@ -44,20 +38,9 @@
 
 #ifdef ENABLE_PKCS11
 
-#ifdef WITH_OPENSSL
-#include <openssl/evp.h>
-#include <openssl/ec.h>
-#include <openssl/rsa.h>
-
 /* borrows code from sftp-server and ssh-agent */
 
-struct pkcs11_keyinfo {
-	struct sshkey	*key;
-	char		*providername, *label;
-	TAILQ_ENTRY(pkcs11_keyinfo) next;
-};
-
-TAILQ_HEAD(, pkcs11_keyinfo) pkcs11_keylist;
+static char *providername; /* Provider for this helper */
 
 #define MAX_MSG_LENGTH		10240 /*XXX*/
 
@@ -66,50 +49,6 @@ struct sshbuf *iqueue;
 struct sshbuf *oqueue;
 
 static void
-add_key(struct sshkey *k, char *name, char *label)
-{
-	struct pkcs11_keyinfo *ki;
-
-	ki = xcalloc(1, sizeof(*ki));
-	ki->providername = xstrdup(name);
-	ki->key = k;
-	ki->label = xstrdup(label);
-	TAILQ_INSERT_TAIL(&pkcs11_keylist, ki, next);
-}
-
-static void
-del_keys_by_name(char *name)
-{
-	struct pkcs11_keyinfo *ki, *nxt;
-
-	for (ki = TAILQ_FIRST(&pkcs11_keylist); ki; ki = nxt) {
-		nxt = TAILQ_NEXT(ki, next);
-		if (!strcmp(ki->providername, name)) {
-			TAILQ_REMOVE(&pkcs11_keylist, ki, next);
-			free(ki->providername);
-			free(ki->label);
-			sshkey_free(ki->key);
-			free(ki);
-		}
-	}
-}
-
-/* lookup matching 'private' key */
-static struct sshkey *
-lookup_key(struct sshkey *k)
-{
-	struct pkcs11_keyinfo *ki;
-
-	TAILQ_FOREACH(ki, &pkcs11_keylist, next) {
-		debug("check %s %s %s", sshkey_type(ki->key),
-		    ki->providername, ki->label);
-		if (sshkey_equal(k, ki->key))
-			return (ki->key);
-	}
-	return (NULL);
-}
-
-static void
 send_msg(struct sshbuf *m)
 {
 	int r;
@@ -121,34 +60,32 @@ send_msg(struct sshbuf *m)
 static void
 process_add(void)
 {
-	char *name, *pin;
+	char *pin;
 	struct sshkey **keys = NULL;
 	int r, i, nkeys;
-	u_char *blob;
-	size_t blen;
 	struct sshbuf *msg;
 	char **labels = NULL;
 
+	if (providername != NULL)
+		fatal_f("provider already set");
 	if ((msg = sshbuf_new()) == NULL)
 		fatal_f("sshbuf_new failed");
-	if ((r = sshbuf_get_cstring(iqueue, &name, NULL)) != 0 ||
+	if ((r = sshbuf_get_cstring(iqueue, &providername, NULL)) != 0 ||
 	    (r = sshbuf_get_cstring(iqueue, &pin, NULL)) != 0)
 		fatal_fr(r, "parse");
-	if ((nkeys = pkcs11_add_provider(name, pin, &keys, &labels)) > 0) {
+	debug3_f("add %s", providername);
+	if ((nkeys = pkcs11_add_provider(providername, pin,
+	    &keys, &labels)) > 0) {
 		if ((r = sshbuf_put_u8(msg,
 		    SSH2_AGENT_IDENTITIES_ANSWER)) != 0 ||
 		    (r = sshbuf_put_u32(msg, nkeys)) != 0)
 			fatal_fr(r, "compose");
 		for (i = 0; i < nkeys; i++) {
-			if ((r = sshkey_to_blob(keys[i], &blob, &blen)) != 0) {
-				debug_fr(r, "encode key");
-				continue;
-			}
-			if ((r = sshbuf_put_string(msg, blob, blen)) != 0 ||
+			if ((r = sshkey_puts(keys[i], msg)) != 0 ||
 			    (r = sshbuf_put_cstring(msg, labels[i])) != 0)
 				fatal_fr(r, "compose key");
-			free(blob);
-			add_key(keys[i], name, labels[i]);
+			debug3_f("%s: %s \"%s\"", providername,
+			    sshkey_type(keys[i]), labels[i]);
 			free(labels[i]);
 		}
 	} else if ((r = sshbuf_put_u8(msg, SSH_AGENT_FAILURE)) != 0 ||
@@ -157,95 +94,39 @@ process_add(void)
 	free(labels);
 	free(keys); /* keys themselves are transferred to pkcs11_keylist */
 	free(pin);
-	free(name);
 	send_msg(msg);
 	sshbuf_free(msg);
 }
 
 static void
-process_del(void)
+process_sign(void)
 {
-	char *name, *pin;
+	const u_char *data;
+	u_char *signature = NULL;
+	size_t dlen, slen = 0;
+	u_int compat;
+	int r, ok = -1;
+	struct sshkey *key = NULL;
 	struct sshbuf *msg;
-	int r;
+	char *alg = NULL;
 
-	if ((msg = sshbuf_new()) == NULL)
-		fatal_f("sshbuf_new failed");
-	if ((r = sshbuf_get_cstring(iqueue, &name, NULL)) != 0 ||
-	    (r = sshbuf_get_cstring(iqueue, &pin, NULL)) != 0)
+	if ((r = sshkey_froms(iqueue, &key)) != 0 ||
+	    (r = sshbuf_get_string_direct(iqueue, &data, &dlen)) != 0 ||
+	    (r = sshbuf_get_cstring(iqueue, &alg, NULL)) != 0 ||
+	    (r = sshbuf_get_u32(iqueue, &compat)) != 0)
 		fatal_fr(r, "parse");
-	del_keys_by_name(name);
-	if ((r = sshbuf_put_u8(msg, pkcs11_del_provider(name) == 0 ?
-	    SSH_AGENT_SUCCESS : SSH_AGENT_FAILURE)) != 0)
-		fatal_fr(r, "compose");
-	free(pin);
-	free(name);
-	send_msg(msg);
-	sshbuf_free(msg);
-}
 
-static void
-process_sign(void)
-{
-	u_char *blob, *data, *signature = NULL;
-	size_t blen, dlen;
-	u_int slen = 0;
-	int len, r, ok = -1;
-	struct sshkey *key = NULL, *found;
-	struct sshbuf *msg;
-#ifdef WITH_OPENSSL
-	RSA *rsa = NULL;
-#ifdef OPENSSL_HAS_ECC
-	EC_KEY *ecdsa = NULL;
-#endif /* OPENSSL_HAS_ECC */
-#endif /* WITH_OPENSSL */
-
-	/* XXX support SHA2 signature flags */
-	if ((r = sshbuf_get_string(iqueue, &blob, &blen)) != 0 ||
-	    (r = sshbuf_get_string(iqueue, &data, &dlen)) != 0 ||
-	    (r = sshbuf_get_u32(iqueue, NULL)) != 0)
-		fatal_fr(r, "parse");
+	if (*alg == '\0') {
+		free(alg);
+		alg = NULL;
+	}
 
-	if ((r = sshkey_from_blob(blob, blen, &key)) != 0)
-		fatal_fr(r, "decode key");
-	if ((found = lookup_key(key)) == NULL)
+	if ((r = pkcs11_sign(key, &signature, &slen, data, dlen,
+	    alg, NULL, NULL, compat)) != 0) {
+		error_fr(r, "sign %s", sshkey_type(key));
 		goto reply;
-
-	/* XXX use pkey API properly for signing */
-	switch (key->type) {
-#ifdef WITH_OPENSSL
-	case KEY_RSA:
-		if ((rsa = EVP_PKEY_get1_RSA(found->pkey)) == NULL)
-			fatal_f("no RSA in pkey");
-		if ((len = RSA_size(rsa)) < 0)
-			fatal_f("bad RSA length");
-		signature = xmalloc(len);
-		if ((len = RSA_private_encrypt(dlen, data, signature,
-		    rsa, RSA_PKCS1_PADDING)) < 0) {
-			error_f("RSA_private_encrypt failed");
-			goto reply;
-		}
-		slen = (u_int)len;
-		break;
-#ifdef OPENSSL_HAS_ECC
-	case KEY_ECDSA:
-		if ((ecdsa = EVP_PKEY_get1_EC_KEY(found->pkey)) == NULL)
-			fatal_f("no ECDSA in pkey");
-		if ((len = ECDSA_size(ecdsa)) < 0)
-			fatal_f("bad ECDSA length");
-		slen = (u_int)len;
-		signature = xmalloc(slen);
-		/* "The parameter type is ignored." */
-		if (!ECDSA_sign(-1, data, dlen, signature, &slen, ecdsa)) {
-			error_f("ECDSA_sign failed");
-			goto reply;
-		}
-		break;
-#endif /* OPENSSL_HAS_ECC */
-#endif /* WITH_OPENSSL */
-	default:
-		fatal_f("unsupported key type %d", key->type);
 	}
+
 	/* success */
 	ok = 0;
  reply:
@@ -260,12 +141,7 @@ process_sign(void)
 			fatal_fr(r, "compose failure response");
 	}
 	sshkey_free(key);
-	RSA_free(rsa);
-#if defined(WITH_OPENSSL) && defined(OPENSSL_HAS_ECC)
-	EC_KEY_free(ecdsa);
-#endif
-	free(data);
-	free(blob);
+	free(alg);
 	free(signature);
 	send_msg(msg);
 	sshbuf_free(msg);
@@ -301,10 +177,6 @@ process(void)
 		debug("process_add");
 		process_add();
 		break;
-	case SSH_AGENTC_REMOVE_SMARTCARD_KEY:
-		debug("process_del");
-		process_del();
-		break;
 	case SSH2_AGENTC_SIGN_REQUEST:
 		debug("process_sign");
 		process_sign();
@@ -336,7 +208,6 @@ cleanup_exit(int i)
 	_exit(i);
 }
 
-
 int
 main(int argc, char **argv)
 {
@@ -350,7 +221,6 @@ main(int argc, char **argv)
 
 	__progname = ssh_get_progname(argv[0]);
 	seed_rng();
-	TAILQ_INIT(&pkcs11_keylist);
 
 	log_init(__progname, log_level, log_facility, log_stderr);
 
@@ -439,22 +309,23 @@ main(int argc, char **argv)
 			fatal_fr(r, "reserve");
 	}
 }
-
-#else /* WITH_OPENSSL */
-void
-cleanup_exit(int i)
+#else /* ENABLE_PKCS11 */
+/* stubs */
+int
+pkcs11_sign(struct sshkey *key,
+    u_char **sigp, size_t *lenp,
+    const u_char *data, size_t datalen,
+    const char *alg, const char *sk_provider,
+    const char *sk_pin, u_int compat)
 {
-	_exit(i);
+	return SSH_ERR_INTERNAL_ERROR;
 }
 
-int
-main(int argc, char **argv)
+void
+pkcs11_key_free(struct sshkey *key)
 {
-	fprintf(stderr, "PKCS#11 code is not enabled\n");
-	return 1;
 }
-#endif /* WITH_OPENSSL */
-#else /* ENABLE_PKCS11 */
+
 int
 main(int argc, char **argv)
 {