Implement PKCS#11 certificate support in ssh-agent

contrib/win32/openssh/bash_tests_iterator.ps1

@@ -17,6 +17,7 @@ $ErrorActionPreference = 'Continue'
 # Resolve the relative paths
 $OpenSSHBinPath = Resolve-Path $OpenSSHBinPath -ErrorAction Stop | select -ExpandProperty Path
 $BashTestsPath = Resolve-Path $BashTestsPath -ErrorAction Stop | select -ExpandProperty Path
+$BashTestsWindowsPath = $BashTestsPath
 $ShellPath = Resolve-Path $ShellPath -ErrorAction Stop | select -ExpandProperty Path
 $ArtifactsDirectoryPath = Resolve-Path $ArtifactsDirectoryPath -ErrorAction Stop | select -ExpandProperty Path
 if ($TestFilePath) {
@@ -25,6 +26,10 @@ if ($TestFilePath) {
 	$TestFilePath = $TestFilePath -replace "\\","/"
 }
 $OriginalSystemPath = [System.Environment]::GetEnvironmentVariable('Path', [System.EnvironmentVariableTarget]::Machine)
+$AgentServiceRegistryPath = 'HKLM:\SYSTEM\CurrentControlSet\Services\ssh-agent'
+$AgentEnvironmentConfigured = $false
+$OriginalAgentEnvironmentPresent = $false
+$OriginalAgentEnvironment = $null
 
 # Make sure config.h exists. It is used in some bashstests (Ex - sftp-glob.sh, cfgparse.sh)
 # first check in $BashTestsPath folder. If not then it's parent folder. If not then in the $OpenSSHBinPath
@@ -62,6 +67,12 @@ if(!$SkipInstallSSHD) {
 
 	# We need ssh-agent to be installed as service to run some bash tests.
 	& "$OpenSSHBinPath\install-sshd.ps1"
+	if (-not [string]::IsNullOrEmpty($env:TEST_SSH_PKCS11_PROVIDER)) {
+		$testProvider = (& $ShellPath -c "cygpath -w '$env:TEST_SSH_PKCS11_PROVIDER'").Trim()
+		$agentImagePath = '"{0}" -P "{1}"' -f (Join-Path $OpenSSHBinPath 'ssh-agent.exe'), $testProvider
+		Set-ItemProperty -Path $AgentServiceRegistryPath `
+			-Name ImagePath -Value $agentImagePath -Force
+	}
 }
 
 try
@@ -147,6 +158,7 @@ try
 	$env:TEST_SSH_SFTP = $OpenSSHBinPath_shell_fmt+"/sftp.exe"
 	$env:TEST_SSH_SFTPSERVER = $OpenSSHBinPath_shell_fmt+"/sftp-server.exe"
 	$env:TEST_SSH_SCP = $OpenSSHBinPath_shell_fmt+"/scp.exe"
+	$env:TEST_SSH_OPENSSL = ([string](&$ShellPath -c "command -v openssl")).Trim()
 	$env:BUILDDIR = $BUILDDIR
 	$env:TEST_WINDOWS_SSH = 1
 	$env:TEST_SSH_ASKPASS = $TEST_SSH_ASKPASS
@@ -173,6 +185,24 @@ try
 	$temp_test_path = "temp_test"
 	$null = Remove-Item -Recurse -Force $temp_test_path -ErrorAction SilentlyContinue
 	$null = New-Item -ItemType directory -Path $temp_test_path -Force -ErrorAction Stop
+	if (-not [string]::IsNullOrEmpty($env:TEST_SSH_PKCS11_PROVIDER)) {
+		$testSoftHsmConf = Join-Path $BashTestsWindowsPath "$temp_test_path\SOFTHSM\softhsm2.conf"
+		$agentEnvironmentProperty = Get-ItemProperty -Path $AgentServiceRegistryPath `
+			-Name Environment -ErrorAction SilentlyContinue
+		if ($null -ne $agentEnvironmentProperty) {
+			$OriginalAgentEnvironmentPresent = $true
+			$OriginalAgentEnvironment = @($agentEnvironmentProperty.Environment)
+		}
+		$agentEnvironment = @($OriginalAgentEnvironment | Where-Object {
+			-not ([string]$_).StartsWith('SOFTHSM2_CONF=',
+				[StringComparison]::OrdinalIgnoreCase)
+		})
+		$agentEnvironment += "SOFTHSM2_CONF=$testSoftHsmConf"
+		New-ItemProperty -Path $AgentServiceRegistryPath -Name Environment `
+			-PropertyType MultiString -Value $agentEnvironment -Force `
+			-ErrorAction Stop | Out-Null
+		$AgentEnvironmentConfigured = $true
+	}
 
 	# remove the summary, output files.
 	$bash_test_summary = "$ArtifactsDirectoryPath\bash_tests_summary.txt"
@@ -271,6 +301,16 @@ finally
 {
 	# Restore User Path variable in the registry once the tests finish running.
 	[System.Environment]::SetEnvironmentVariable('Path', $OriginalSystemPath, [System.EnvironmentVariableTarget]::Machine)
+	if ($AgentEnvironmentConfigured) {
+		if ($OriginalAgentEnvironmentPresent) {
+			New-ItemProperty -Path $AgentServiceRegistryPath -Name Environment `
+				-PropertyType MultiString -Value $OriginalAgentEnvironment `
+				-Force -ErrorAction SilentlyContinue | Out-Null
+		} else {
+			Remove-ItemProperty -Path $AgentServiceRegistryPath -Name Environment `
+				-ErrorAction SilentlyContinue
+		}
+	}
 	# remove temp test directory
 	if (!$SkipCleanup)
 	{

contrib/win32/openssh/ssh-agent.vcxproj

@@ -416,12 +416,18 @@
   <ItemGroup>
     <ClInclude Include="$(OpenSSH-Src-Path)\contrib\win32\win32compat\ssh-agent\agent-request.h" />
     <ClInclude Include="$(OpenSSH-Src-Path)\contrib\win32\win32compat\ssh-agent\agent.h" />
+    <ClInclude Include="$(OpenSSH-Src-Path)\contrib\win32\win32compat\pkcs11-cert.h" />
+    <ClInclude Include="$(OpenSSH-Src-Path)\contrib\win32\win32compat\ssh-agent\keyagent-pkcs11.h" />
+    <ClInclude Include="$(OpenSSH-Src-Path)\contrib\win32\win32compat\ssh-agent\keyagent-registry.h" />
   </ItemGroup>
   <ItemGroup>
     <ClCompile Include="$(OpenSSH-Src-Path)\contrib\win32\win32compat\ssh-agent\agent-main.c" />
     <ClCompile Include="$(OpenSSH-Src-Path)\contrib\win32\win32compat\ssh-agent\agent.c" />
     <ClCompile Include="$(OpenSSH-Src-Path)\contrib\win32\win32compat\ssh-agent\connection.c" />
+    <ClCompile Include="$(OpenSSH-Src-Path)\contrib\win32\win32compat\ssh-agent\keyagent-pkcs11.c" />
+    <ClCompile Include="$(OpenSSH-Src-Path)\contrib\win32\win32compat\ssh-agent\keyagent-registry.c" />
     <ClCompile Include="$(OpenSSH-Src-Path)\contrib\win32\win32compat\ssh-agent\keyagent-request.c" />
+    <ClCompile Include="$(OpenSSH-Src-Path)\contrib\win32\win32compat\pkcs11-cert.c" />
     <ClCompile Include="$(OpenSSH-Src-Path)ssh-pkcs11-client.c" />
     <ClCompile Include="$(OpenSSH-Src-Path)ssh-sk-client.c" />
   </ItemGroup>

contrib/win32/openssh/unittest-win32compat.vcxproj

@@ -36,6 +36,15 @@
     </ProjectConfiguration>
   </ItemGroup>
   <ItemGroup>
+    <ClCompile Include="$(OpenSSH-Src-Path)contrib\win32\win32compat\pkcs11-cert.c">
+      <ExcludedFromBuild Condition="$(UseOpenSSL)=='false'">true</ExcludedFromBuild>
+    </ClCompile>
+    <ClCompile Include="$(OpenSSH-Src-Path)ssh-sk-client.c">
+      <ExcludedFromBuild Condition="$(UseOpenSSL)=='false'">true</ExcludedFromBuild>
+    </ClCompile>
+    <ClCompile Include="$(OpenSSH-Src-Path)regress\unittests\win32compat\pkcs11_cert_tests.c">
+      <ExcludedFromBuild Condition="$(UseOpenSSL)=='false'">true</ExcludedFromBuild>
+    </ClCompile>
     <ClCompile Include="$(OpenSSH-Src-Path)regress\unittests\win32compat\file_tests.c">
       <ExcludedFromBuild Condition="$(UseOpenSSL)=='false'">true</ExcludedFromBuild>
     </ClCompile>
@@ -65,6 +74,7 @@
     </ClCompile>
   </ItemGroup>
   <ItemGroup>
+    <ClInclude Include="$(OpenSSH-Src-Path)contrib\win32\win32compat\pkcs11-cert.h" />
     <ClInclude Include="$(OpenSSH-Src-Path)regress\unittests\win32compat\tests.h" />
   </ItemGroup>
   <PropertyGroup Label="Globals">

contrib/win32/win32compat/pkcs11-cert.c

@@ -0,0 +1,213 @@
+/*
+ * Copyright (c) 2026 Sebastian Ott.  All rights reserved.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "includes.h"
+
+#include "authfd.h"
+#include "digest.h"
+#include "log.h"
+#include "sshbuf.h"
+#include "ssherr.h"
+#include "sshkey.h"
+#include "xmalloc.h"
+
+#include "pkcs11-cert.h"
+
+char *
+pkcs11_identity_name(const struct sshkey *key, const u_char *blob,
+    size_t blob_len)
+{
+	u_char digest[SSH_DIGEST_MAX_LENGTH];
+	char *name;
+	size_t i, digest_len;
+
+	if (!sshkey_is_cert(key))
+		return sshkey_fingerprint(key, SSH_FP_HASH_DEFAULT,
+		    SSH_FP_DEFAULT);
+	digest_len = ssh_digest_bytes(SSH_DIGEST_SHA256);
+	if (ssh_digest_memory(SSH_DIGEST_SHA256, blob, blob_len, digest,
+	    sizeof(digest)) != 0)
+		return NULL;
+	name = xmalloc(5 + digest_len * 2 + 1);
+	memcpy(name, "cert-", 5);
+	for (i = 0; i < digest_len; i++)
+		snprintf(name + 5 + i * 2, 3, "%02x", digest[i]);
+	return name;
+}
+
+const char *
+pkcs11_identity_comment(const char *provider, const char *label)
+{
+	return label == NULL || *label == '\0' ? provider : label;
+}
+
+/*
+ * Compare a provider path stored in the Registry, which is not NUL
+ * terminated, with a canonical provider path. Windows paths are case
+ * insensitive, and the whole value must match.
+ */
+int
+pkcs11_provider_equal(const u_char *stored, size_t stored_len,
+    const char *provider)
+{
+	if (stored == NULL || provider == NULL || stored_len == 0 ||
+	    strlen(provider) != stored_len)
+		return 0;
+	return strncasecmp((const char *)stored, provider, stored_len) == 0;
+}
+
+/*
+ * Decide whether an existing Registry identity may be reused for the PKCS#11
+ * identity (blob, key_type) of provider. Only identities previously created
+ * for the same key by the same provider qualify: a software key that happens
+ * to have the same public key stores its private key as default value and
+ * must not be adopted by, and later removed with, a provider.
+ */
+int
+pkcs11_identity_entry_matches(const struct pkcs11_identity_entry *e,
+    const u_char *blob, size_t blob_len, int key_type, const char *provider)
+{
+	const u_char *association;
+	size_t association_len;
+
+	if (e == NULL || blob == NULL || blob_len == 0 || provider == NULL)
+		return 0;
+	if (e->pub == NULL || e->pub_len != blob_len ||
+	    memcmp(e->pub, blob, blob_len) != 0)
+		return 0;
+	if (e->dflt == NULL || e->dflt_len != blob_len ||
+	    memcmp(e->dflt, blob, blob_len) != 0)
+		return 0;
+	if (!e->has_type || e->type != key_type)
+		return 0;
+	/* Entries created before the provider value existed use the comment. */
+	if (e->provider != NULL) {
+		association = e->provider;
+		association_len = e->provider_len;
+	} else {
+		association = e->comment;
+		association_len = e->comment_len;
+	}
+	return pkcs11_provider_equal(association, association_len, provider);
+}
+
+void
+free_pkcs11_certs(struct sshkey **certs, size_t ncerts)
+{
+	size_t i;
+
+	for (i = 0; i < ncerts; i++)
+		sshkey_free(certs[i]);
+	free(certs);
+}
+
+int
+parse_pkcs11_add_constraints(struct sshbuf *m, int *cert_onlyp,
+    struct sshkey ***certsp, size_t *ncertsp)
+{
+	struct sshbuf *b = NULL;
+	struct sshkey *key = NULL;
+	char *ext_name = NULL;
+	u_char ctype, value;
+	u_int seconds;
+	int r, seen = 0, seen_lifetime = 0, seen_confirm = 0;
+	int seen_destinations = 0;
+
+	if (m == NULL || cert_onlyp == NULL || certsp == NULL ||
+	    ncertsp == NULL || *certsp != NULL || *ncertsp != 0)
+		return SSH_ERR_INVALID_ARGUMENT;
+	*cert_onlyp = 0;
+
+	while (sshbuf_len(m) != 0) {
+		if ((r = sshbuf_get_u8(m, &ctype)) != 0)
+			goto out;
+		if (ctype == SSH_AGENT_CONSTRAIN_LIFETIME) {
+			if (seen_lifetime ||
+			    (r = sshbuf_get_u32(m, &seconds)) != 0) {
+				r = SSH_ERR_INVALID_FORMAT;
+				goto out;
+			}
+			seen_lifetime = 1;
+			continue;
+		}
+		if (ctype == SSH_AGENT_CONSTRAIN_CONFIRM) {
+			if (seen_confirm) {
+				r = SSH_ERR_INVALID_FORMAT;
+				goto out;
+			}
+			seen_confirm = 1;
+			continue;
+		}
+		if (ctype != SSH_AGENT_CONSTRAIN_EXTENSION) {
+			error_f("unsupported smartcard constraint %u", ctype);
+			r = SSH_ERR_FEATURE_UNSUPPORTED;
+			goto out;
+		}
+		if ((r = sshbuf_get_cstring(m, &ext_name, NULL)) != 0)
+			goto out;
+		if (strcmp(ext_name,
+		    "restrict-destination-v00@openssh.com") == 0) {
+			if (seen_destinations || sshbuf_skip_string(m) != 0) {
+				r = SSH_ERR_INVALID_FORMAT;
+				goto out;
+			}
+			seen_destinations = 1;
+			free(ext_name);
+			ext_name = NULL;
+			continue;
+		}
+		if (strcmp(ext_name,
+		    "associated-certs-v00@openssh.com") != 0) {
+			error_f("unsupported smartcard constraint \"%s\"",
+			    ext_name);
+			r = SSH_ERR_FEATURE_UNSUPPORTED;
+			goto out;
+		}
+		if (seen) {
+			error_f("%s already set", ext_name);
+			r = SSH_ERR_INVALID_FORMAT;
+			goto out;
+		}
+		seen = 1;
+		if ((r = sshbuf_get_u8(m, &value)) != 0 ||
+		    (r = sshbuf_froms(m, &b)) != 0)
+			goto out;
+		*cert_onlyp = value != 0;
+		while (sshbuf_len(b) != 0) {
+			if (*ncertsp >= AGENT_MAX_EXT_CERTS) {
+				error_f("too many %s constraints", ext_name);
+				r = SSH_ERR_INVALID_FORMAT;
+				goto out;
+			}
+			if ((r = sshkey_froms(b, &key)) != 0)
+				goto out;
+			*certsp = xrecallocarray(*certsp, *ncertsp,
+			    *ncertsp + 1, sizeof(**certsp));
+			(*certsp)[(*ncertsp)++] = key;
+			key = NULL;
+		}
+		sshbuf_free(b);
+		b = NULL;
+		free(ext_name);
+		ext_name = NULL;
+	}
+	r = 0;
+ out:
+	sshkey_free(key);
+	sshbuf_free(b);
+	free(ext_name);
+	return r;
+}

contrib/win32/win32compat/pkcs11-cert.h

@@ -0,0 +1,38 @@
+/*
+ * Copyright (c) 2026 Sebastian Ott.  All rights reserved.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#pragma once
+
+#include "sshbuf.h"
+#include "sshkey.h"
+
+#define AGENT_MAX_EXT_CERTS	1024
+
+/* Values of an existing Registry identity, NULL when not present. */
+struct pkcs11_identity_entry {
+	const u_char *pub, *dflt, *provider, *comment;
+	size_t pub_len, dflt_len, provider_len, comment_len;
+	int has_type, type;
+};
+
+char *pkcs11_identity_name(const struct sshkey *, const u_char *, size_t);
+const char *pkcs11_identity_comment(const char *, const char *);
+int pkcs11_provider_equal(const u_char *, size_t, const char *);
+int pkcs11_identity_entry_matches(const struct pkcs11_identity_entry *,
+    const u_char *, size_t, int, const char *);
+int parse_pkcs11_add_constraints(struct sshbuf *, int *,
+    struct sshkey ***, size_t *);
+void free_pkcs11_certs(struct sshkey **, size_t);