tyler.durden
/
openssh-portable
mirror of https://github.com/PowerShell/openssh-portable.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

upstream commit 

allow certificate validity intervals that specify only a
start or stop time (we already support specifying both or neither)

OpenBSD-Commit-ID: 9be486545603c003030bdb5c467d1318b46b4e42
This commit is contained in:
djm@openbsd.org@openbsd.org 2017-11-03 05:14:04 +00:00 committed by Damien Miller
parent fbe8e7ac94
commit d52131a983
2 changed files with 24 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
ssh-keygen.1
View File

@ -1,4 +1,4 @@
.\" $OpenBSD: ssh-keygen.1,v 1.144 2017/07/08 18:32:54 jmc Exp $ .\" $OpenBSD: ssh-keygen.1,v 1.145 2017/11/03 05:14:04 djm Exp $
.\" .\"
.\" Author: Tatu Ylonen <ylo@cs.hut.fi> .\" Author: Tatu Ylonen <ylo@cs.hut.fi>
.\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland .\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@ -35,7 +35,7 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\" .\"
.Dd $Mdocdate: July 8 2017 $ .Dd $Mdocdate: November 3 2017 $
.Dt SSH-KEYGEN 1 .Dt SSH-KEYGEN 1
.Os .Os
.Sh NAME .Sh NAME
@ -584,13 +584,20 @@ Specify a validity interval when signing a certificate.
A validity interval may consist of a single time, indicating that the A validity interval may consist of a single time, indicating that the
certificate is valid beginning now and expiring at that time, or may consist certificate is valid beginning now and expiring at that time, or may consist
of two times separated by a colon to indicate an explicit time interval. of two times separated by a colon to indicate an explicit time interval.
The start time may be specified as a date in YYYYMMDD format, a time .Pp
in YYYYMMDDHHMMSS format or a relative time (to the current time) consisting The start time may be specified as the string
of a minus sign followed by a relative time in the format described in the .Dq always
to indicate the certificate has no specified start time,
a date in YYYYMMDD format, a time in YYYYMMDDHHMMSS format,
a relative time (to the current time) consisting of a minus sign followed by
an interval in the format described in the
TIME FORMATS section of TIME FORMATS section of
.Xr sshd_config 5 . .Xr sshd_config 5 .
The end time may be specified as a YYYYMMDD date, a YYYYMMDDHHMMSS time or .Pp
a relative time starting with a plus character. The end time may be specified as a YYYYMMDD date, a YYYYMMDDHHMMSS time,
a relative time starting with a plus character or the string
.Dq forever
to indicate that the certificate has no expirty date.
.Pp .Pp
For example: For example:
.Dq +52w1d .Dq +52w1d
@ -601,6 +608,8 @@ For example:
(valid from 12:30 PM, January 1st, 2010 to 12:30 PM, January 1st, 2011), (valid from 12:30 PM, January 1st, 2010 to 12:30 PM, January 1st, 2011),
.Dq -1d:20110101 .Dq -1d:20110101
(valid from yesterday to midnight, January 1st, 2011). (valid from yesterday to midnight, January 1st, 2011).
.Dq -1m:forever
(valid from one minute ago and never expiring).
.It Fl v .It Fl v
Verbose mode. Verbose mode.
Causes Causes

12
ssh-keygen.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: ssh-keygen.c,v 1.307 2017/07/07 03:53:12 djm Exp $ */ /* $OpenBSD: ssh-keygen.c,v 1.308 2017/11/03 05:14:04 djm Exp $ */
/* /*
* Author: Tatu Ylonen <ylo@cs.hut.fi> * Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1994 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland * Copyright (c) 1994 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@ -1832,7 +1832,7 @@ parse_absolute_time(const char *s)
s, s + 4, s + 6, s + 8, s + 10, s + 12); s, s + 4, s + 6, s + 8, s + 10, s + 12);
break; break;
default: default:
fatal("Invalid certificate time format %s", s); fatal("Invalid certificate time format \"%s\"", s);
} }
memset(&tm, 0, sizeof(tm)); memset(&tm, 0, sizeof(tm));
@ -1865,8 +1865,8 @@ parse_cert_times(char *timespec)
/* /*
* from:to, where * from:to, where
* from := [+-]timespec | YYYYMMDD | YYYYMMDDHHMMSS * from := [+-]timespec | YYYYMMDD | YYYYMMDDHHMMSS | "always"
* to := [+-]timespec | YYYYMMDD | YYYYMMDDHHMMSS * to := [+-]timespec | YYYYMMDD | YYYYMMDDHHMMSS | "forever"
*/ */
from = xstrdup(timespec); from = xstrdup(timespec);
to = strchr(from, ':'); to = strchr(from, ':');
@ -1876,11 +1876,15 @@ parse_cert_times(char *timespec)
if (*from == '-' || *from == '+') if (*from == '-' || *from == '+')
cert_valid_from = parse_relative_time(from, now); cert_valid_from = parse_relative_time(from, now);
else if (strcmp(from, "always") == 0)
cert_valid_from = 0;
else else
cert_valid_from = parse_absolute_time(from); cert_valid_from = parse_absolute_time(from);
if (*to == '-' || *to == '+') if (*to == '-' || *to == '+')
cert_valid_to = parse_relative_time(to, now); cert_valid_to = parse_relative_time(to, now);
else if (strcmp(to, "forever") == 0)
cert_valid_to = ~(u_int64_t)0;
else else
cert_valid_to = parse_absolute_time(to); cert_valid_to = parse_absolute_time(to);