tyler.durden
/
openssh-portable
mirror of https://github.com/PowerShell/openssh-portable.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

upstream: allow pin-required FIDO keys to be added to ssh-agent(1). 

ssh-askpass will be used to request the PIN at authentication time.

From Pedro Martelletto, ok djm

OpenBSD-Commit-ID: de8189fcd35b45f632484864523c1655550e2950
This commit is contained in:
djm@openbsd.org 2022-01-14 03:43:48 +00:00 committed by Damien Miller
parent 52423f64e1
commit 39d17e189f
2 changed files with 36 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
ssh-add.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: ssh-add.c,v 1.163 2021/12/22 06:56:41 jmc Exp $ */ /* $OpenBSD: ssh-add.c,v 1.164 2022/01/14 03:43:48 djm Exp $ */
/* /*
* Author: Tatu Ylonen <ylo@cs.hut.fi> * Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@ -356,11 +356,6 @@ add_file(int agent_fd, const char *filename, int key_only, int qflag,
"without provider\n", filename); "without provider\n", filename);
goto out; goto out;
} }
if ((private->sk_flags & SSH_SK_USER_VERIFICATION_REQD) != 0) {
fprintf(stderr, "FIDO verify-required key %s is not "
"currently supported by ssh-agent\n", filename);
goto out;
}
} else { } else {
/* Don't send provider constraint for other keys */ /* Don't send provider constraint for other keys */
skprovider = NULL; skprovider = NULL;

41
ssh-agent.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: ssh-agent.c,v 1.286 2022/01/12 03:30:32 dtucker Exp $ */ /* $OpenBSD: ssh-agent.c,v 1.287 2022/01/14 03:43:48 djm Exp $ */
/* /*
* Author: Tatu Ylonen <ylo@cs.hut.fi> * Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@ -724,8 +724,9 @@ process_sign_request2(SocketEntry *e)
u_char *signature = NULL; u_char *signature = NULL;
size_t slen = 0; size_t slen = 0;
u_int compat = 0, flags; u_int compat = 0, flags;
int r, ok = -1; int r, ok = -1, retried = 0;
char *fp = NULL, *user = NULL, *sig_dest = NULL; char *fp = NULL, *pin = NULL, *prompt = NULL;
char *user = NULL, *sig_dest = NULL;
const char *fwd_host = NULL, *dest_host = NULL; const char *fwd_host = NULL, *dest_host = NULL;
struct sshbuf *msg = NULL, *data = NULL, *sid = NULL; struct sshbuf *msg = NULL, *data = NULL, *sid = NULL;
struct sshkey *key = NULL, *hostkey = NULL; struct sshkey *key = NULL, *hostkey = NULL;
@ -812,7 +813,16 @@ process_sign_request2(SocketEntry *e)
/* error already logged */ /* error already logged */
goto send; goto send;
} }
if ((id->key->sk_flags & SSH_SK_USER_PRESENCE_REQD)) { if ((id->key->sk_flags & SSH_SK_USER_VERIFICATION_REQD)) {
/* XXX include sig_dest */
xasprintf(&prompt, "Enter PIN%sfor %s key %s: ",
(id->key->sk_flags & SSH_SK_USER_PRESENCE_REQD) ?
" and confirm user presence " : " ",
sshkey_type(id->key), fp);
pin = read_passphrase(prompt, RP_USE_ASKPASS);
free(prompt);
prompt = NULL;
} else if ((id->key->sk_flags & SSH_SK_USER_PRESENCE_REQD)) {
notifier = notify_start(0, notifier = notify_start(0,
"Confirm user presence for key %s %s%s%s", "Confirm user presence for key %s %s%s%s",
sshkey_type(id->key), fp, sshkey_type(id->key), fp,
@ -820,10 +830,26 @@ process_sign_request2(SocketEntry *e)
sig_dest == NULL ? "" : sig_dest); sig_dest == NULL ? "" : sig_dest);
} }
} }
/* XXX support PIN required FIDO keys */ retry_pin:
if ((r = sshkey_sign(id->key, &signature, &slen, if ((r = sshkey_sign(id->key, &signature, &slen,
sshbuf_ptr(data), sshbuf_len(data), agent_decode_alg(key, flags), sshbuf_ptr(data), sshbuf_len(data), agent_decode_alg(key, flags),
id->sk_provider, NULL, compat)) != 0) { id->sk_provider, pin, compat)) != 0) {
debug_fr(r, "sshkey_sign");
if (pin == NULL && !retried && sshkey_is_sk(id->key) &&
r == SSH_ERR_KEY_WRONG_PASSPHRASE) {
if (notifier) {
notify_complete(notifier, NULL);
notifier = NULL;
}
/* XXX include sig_dest */
xasprintf(&prompt, "Enter PIN%sfor %s key %s: ",
(id->key->sk_flags & SSH_SK_USER_PRESENCE_REQD) ?
" and confirm user presence " : " ",
sshkey_type(id->key), fp);
pin = read_passphrase(prompt, RP_USE_ASKPASS);
retried = 1;
goto retry_pin;
}
error_fr(r, "sshkey_sign"); error_fr(r, "sshkey_sign");
goto send; goto send;
} }
@ -851,6 +877,9 @@ process_sign_request2(SocketEntry *e)
free(signature); free(signature);
free(sig_dest); free(sig_dest);
free(user); free(user);
free(prompt);
if (pin != NULL)
freezero(pin, strlen(pin));
} }
/* shared */ /* shared */