lib/rsa: allow matching pkcs11 path by object id

The object= part matches against the label that the pkcs11 token uses
for that object, but in some cases, specifically with a Yubikey using
ykcs11, where the keys have been imported, the labels differ between the
private and public keys [1], making the object= matching useless. These
keys will have the same id however, so matching against that works for
both the private and public part.

[1]: https://github.com/Yubico/yubico-piv-tool/blob/master/doc/YKCS11/Functions_and_values.adoc#key-alias-per-slot-and-object-type

Signed-off-by: Tobias Olausson <tobias@eub.se>

diff --git a/lib/rsa/rsa-sign.c b/lib/rsa/rsa-sign.c
index fa9e143b4ca8cbc50297acdfbb4ccb39cb160f84..92b9d7876e52ef535cc32fbcdb0c10bcf8aceba8 100644 (file)
--- a/lib/rsa/rsa-sign.c
+++ b/lib/rsa/rsa-sign.c
@@ -122,7 +122,7 @@ static int rsa_engine_get_pub_key(const char *keydir, const char *name,
                                fprintf(stderr, "WARNING: Legacy URI specified. Please add '%s'.\n", pkcs11_schema);
                        }
 
-                       if (strstr(keydir, "object="))
+                       if (strstr(keydir, "object=") || strstr(keydir, "id="))
                                snprintf(key_id, sizeof(key_id),
                                         "%s%s;type=public",
                                         pkcs11_uri_prepend, keydir);
@@ -253,7 +253,7 @@ static int rsa_engine_get_priv_key(const char *keydir, const char *name,
                                fprintf(stderr, "WARNING: Legacy URI specified. Please add '%s'.\n", pkcs11_schema);
                        }
 
-                       if (strstr(keydir, "object="))
+                       if (strstr(keydir, "object=") || strstr(keydir, "id="))
                                snprintf(key_id, sizeof(key_id),
                                         "%s%s;type=private",
                                         pkcs11_uri_prepend, keydir);