RepoMirrors
/
openssh
mirror of git://anongit.mindrot.org/openssh.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

- djm@cvs.openbsd.org 2010/05/14 00:47:22 

[ssh-add.c]
     check that the certificate matches the corresponding private key before
     grafting it on
This commit is contained in:
Damien Miller 2010-05-21 14:56:47 +10:00
parent 3b903827eb
commit c6afb5f2c0
2 changed files with 33 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
ChangeLog
View File

@ -7,6 +7,10 @@
- djm@cvs.openbsd.org 2010/05/11 02:58:04 - djm@cvs.openbsd.org 2010/05/11 02:58:04
[auth-rsa.c] [auth-rsa.c]
don't accept certificates marked as "cert-authority" here; ok markus@ don't accept certificates marked as "cert-authority" here; ok markus@
- djm@cvs.openbsd.org 2010/05/14 00:47:22
[ssh-add.c]
check that the certificate matches the corresponding private key before
grafting it on
20100511 20100511
- (dtucker) [Makefile.in] Bug #1770: Link libopenbsd-compat twice to solve - (dtucker) [Makefile.in] Bug #1770: Link libopenbsd-compat twice to solve

50
ssh-add.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: ssh-add.c,v 1.95 2010/04/16 01:47:26 djm Exp $ */ /* $OpenBSD: ssh-add.c,v 1.96 2010/05/14 00:47:22 djm Exp $ */
/* /*
* Author: Tatu Ylonen <ylo@cs.hut.fi> * Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@ -194,7 +194,7 @@ add_file(AuthenticationConnection *ac, const char *filename)
"Lifetime set to %d seconds\n", lifetime); "Lifetime set to %d seconds\n", lifetime);
if (confirm != 0) if (confirm != 0)
fprintf(stderr, fprintf(stderr,
"The user has to confirm each use of the key\n"); "The user must confirm each use of the key\n");
} else { } else {
fprintf(stderr, "Could not add identity: %s\n", filename); fprintf(stderr, "Could not add identity: %s\n", filename);
} }
@ -202,29 +202,37 @@ add_file(AuthenticationConnection *ac, const char *filename)
/* Now try to add the certificate flavour too */ /* Now try to add the certificate flavour too */
xasprintf(&certpath, "%s-cert.pub", filename); xasprintf(&certpath, "%s-cert.pub", filename);
if ((cert = key_load_public(certpath, NULL)) != NULL) { if ((cert = key_load_public(certpath, NULL)) == NULL)
/* Graft with private bits */ goto out;
if (key_to_certified(private, key_cert_is_legacy(cert)) != 0)
fatal("%s: key_to_certified failed", __func__); if (!key_equal_public(cert, private)) {
key_cert_copy(cert, private); error("Certificate %s does not match private key %s",
certpath, filename);
key_free(cert); key_free(cert);
goto out;
}
if (ssh_add_identity_constrained(ac, private, comment, /* Graft with private bits */
lifetime, confirm)) { if (key_to_certified(private, key_cert_is_legacy(cert)) != 0) {
fprintf(stderr, "Certificate added: %s (%s)\n", error("%s: key_to_certified failed", __func__);
certpath, private->cert->key_id); key_free(cert);
if (lifetime != 0) goto out;
fprintf(stderr, "Lifetime set to %d seconds\n",
lifetime);
if (confirm != 0)
fprintf(stderr, "The user has to confirm each "
"use of the key\n");
} else {
error("Certificate %s (%s) add failed", certpath,
private->cert->key_id);
}
} }
key_cert_copy(cert, private);
key_free(cert);
if (!ssh_add_identity_constrained(ac, private, comment,
lifetime, confirm)) {
error("Certificate %s (%s) add failed", certpath,
private->cert->key_id);
}
fprintf(stderr, "Certificate added: %s (%s)\n", certpath,
private->cert->key_id);
if (lifetime != 0)
fprintf(stderr, "Lifetime set to %d seconds\n", lifetime);
if (confirm != 0)
fprintf(stderr, "The user must confirm each use of the key\n");
out:
xfree(certpath); xfree(certpath);
xfree(comment); xfree(comment);
key_free(private); key_free(private);