diff options
| author | djm@openbsd.org <djm@openbsd.org> | 2020-08-31 06:33:17 +0200 |
|---|---|---|
| committer | Damien Miller <djm@mindrot.org> | 2020-08-31 06:34:41 +0200 |
| commit | 785f0f315bf7ac5909e988bb1ac3e019fb5e1594 (patch) | |
| tree | 557a9faa23b6724a7378ed1a8a0b2f0fddd387b7 | |
| parent | upstream: Add RCS IDs to the few files that are missing them; from (diff) | |
| download | openssh-785f0f315bf7ac5909e988bb1ac3e019fb5e1594.tar.xz openssh-785f0f315bf7ac5909e988bb1ac3e019fb5e1594.zip | |
upstream: refuse to add verify-required (PINful) FIDO keys to
ssh-agent until the agent supports them properly
OpenBSD-Commit-ID: 125bd55a8df32c87c3ec33c6ebe437673a3d037e
| -rw-r--r-- | ssh-add.c | 23 |
1 files changed, 16 insertions, 7 deletions
@@ -1,4 +1,4 @@ -/* $OpenBSD: ssh-add.c,v 1.156 2020/06/26 05:04:07 djm Exp $ */ +/* $OpenBSD: ssh-add.c,v 1.157 2020/08/31 04:33:17 djm Exp $ */ /* * Author: Tatu Ylonen <ylo@cs.hut.fi> * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland @@ -67,6 +67,7 @@ #include "ssherr.h" #include "digest.h" #include "ssh-sk.h" +#include "sk-api.h" /* argv0 */ extern char *__progname; @@ -348,12 +349,20 @@ add_file(int agent_fd, const char *filename, int key_only, int qflag, ssh_free_identitylist(idlist); } - if (!sshkey_is_sk(private)) - skprovider = NULL; /* Don't send constraint for other keys */ - else if (skprovider == NULL) { - fprintf(stderr, "Cannot load authenticator-hosted key %s " - "without provider\n", filename); - goto out; + if (sshkey_is_sk(private)) { + if (skprovider == NULL) { + fprintf(stderr, "Cannot load FIDO key %s " + "without provider\n", filename); + goto out; + } + if ((private->sk_flags & SSH_SK_USER_VERIFICATION_REQD) != 0) { + fprintf(stderr, "FIDO verify-required key %s is not " + "currently supported by ssh-agent\n", filename); + goto out; + } + } else { + /* Don't send provider constraint for other keys */ + skprovider = NULL; } if ((r = ssh_add_identity_constrained(agent_fd, private, comment, |