tyler.durden/openssh-portable
1
0
Fork 0
mirror of https://github.com/PowerShell/openssh-portable.git synced 2025-07-31 01:35:11 +02:00
Code Issues Packages Projects Releases Wiki Activity

upstream: refuse to add verify-required (PINful) FIDO keys to

Browse Source 
ssh-agent until the agent supports them properly

OpenBSD-Commit-ID: 125bd55a8df32c87c3ec33c6ebe437673a3d037e
This commit is contained in:
djm@openbsd.org 2020-08-31 04:33:17 +00:00 committed by Damien Miller
parent 39e88aeff9
commit 785f0f315b
1 changed files with 16 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
ssh-add.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: ssh-add.c,v 1.156 2020/06/26 05:04:07 djm Exp $ */ /* $OpenBSD: ssh-add.c,v 1.157 2020/08/31 04:33:17 djm Exp $ */
/* /*
* Author: Tatu Ylonen <ylo@cs.hut.fi> * Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@ -67,6 +67,7 @@
#include "ssherr.h" #include "ssherr.h"
#include "digest.h" #include "digest.h"
#include "ssh-sk.h" #include "ssh-sk.h"
#include "sk-api.h"
/* argv0 */ /* argv0 */
extern char *__progname; extern char *__progname;
@ -348,12 +349,20 @@ add_file(int agent_fd, const char *filename, int key_only, int qflag,
ssh_free_identitylist(idlist); ssh_free_identitylist(idlist);
} }
if (!sshkey_is_sk(private)) if (sshkey_is_sk(private)) {
skprovider = NULL; /* Don't send constraint for other keys */ if (skprovider == NULL) {
else if (skprovider == NULL) { fprintf(stderr, "Cannot load FIDO key %s "
fprintf(stderr, "Cannot load authenticator-hosted key %s " "without provider\n", filename);
"without provider\n", filename); goto out;
goto out; }
if ((private->sk_flags & SSH_SK_USER_VERIFICATION_REQD) != 0) {
fprintf(stderr, "FIDO verify-required key %s is not "
"currently supported by ssh-agent\n", filename);
goto out;
}
} else {
/* Don't send provider constraint for other keys */
skprovider = NULL;
} }
if ((r = ssh_add_identity_constrained(agent_fd, private, comment, if ((r = ssh_add_identity_constrained(agent_fd, private, comment,