RepoMirrors/openssh
1
0
Fork 0
mirror of git://anongit.mindrot.org/openssh.git synced 2025-01-03 00:02:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

- djm@cvs.openbsd.org 2012/12/02 20:26:11

Browse Source 
[ssh_config.5 sshconnect2.c]
     Make IdentitiesOnly apply to keys obtained from a PKCS11Provider.
     This allows control of which keys are offered from tokens using
     IdentityFile. ok markus@
This commit is contained in:
Damien Miller 2012-12-03 09:49:52 +11:00
parent cf6ef137b5
commit cb6b68b209
3 changed files with 36 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
ChangeLog
View File

@ -1,6 +1,12 @@
20121203 20121203
- (djm) [openbsd-compat/sys-queue.h] Sync with OpenBSD to get - (djm) [openbsd-compat/sys-queue.h] Sync with OpenBSD to get
TAILQ_FOREACH_SAFE needed for upcoming changes. TAILQ_FOREACH_SAFE needed for upcoming changes.
- (djm) OpenBSD CVS Sync
- djm@cvs.openbsd.org 2012/12/02 20:26:11
[ssh_config.5 sshconnect2.c]
Make IdentitiesOnly apply to keys obtained from a PKCS11Provider.
This allows control of which keys are offered from tokens using
IdentityFile. ok markus@
20121114 20121114
- (djm) OpenBSD CVS Sync - (djm) OpenBSD CVS Sync

6
ssh_config.5
View File

@ -33,8 +33,8 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\" .\"
.\" $OpenBSD: ssh_config.5,v 1.158 2012/10/04 13:21:50 markus Exp $ .\" $OpenBSD: ssh_config.5,v 1.159 2012/12/02 20:26:10 djm Exp $
.Dd $Mdocdate: October 4 2012 $ .Dd $Mdocdate: December 2 2012 $
.Dt SSH_CONFIG 5 .Dt SSH_CONFIG 5
.Os .Os
.Sh NAME .Sh NAME
@ -602,6 +602,8 @@ should only use the authentication identity files configured in the
files, files,
even if even if
.Xr ssh-agent 1 .Xr ssh-agent 1
or a
.Cm PKCS11Provider
offers more identities. offers more identities.
The argument to this keyword must be The argument to this keyword must be
.Dq yes .Dq yes

29
sshconnect2.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: sshconnect2.c,v 1.189 2012/06/22 12:30:26 dtucker Exp $ */ /* $OpenBSD: sshconnect2.c,v 1.190 2012/12/02 20:26:11 djm Exp $ */
/* /*
* Copyright (c) 2000 Markus Friedl. All rights reserved. * Copyright (c) 2000 Markus Friedl. All rights reserved.
* Copyright (c) 2008 Damien Miller. All rights reserved. * Copyright (c) 2008 Damien Miller. All rights reserved.
@ -1359,7 +1359,7 @@ load_identity_file(char *filename)
static void static void
pubkey_prepare(Authctxt *authctxt) pubkey_prepare(Authctxt *authctxt)
{ {
Identity *id; Identity *id, *id2, *tmp;
Idlist agent, files, *preferred; Idlist agent, files, *preferred;
Key *key; Key *key;
AuthenticationConnection *ac; AuthenticationConnection *ac;
@ -1371,7 +1371,7 @@ pubkey_prepare(Authctxt *authctxt)
preferred = &authctxt->keys; preferred = &authctxt->keys;
TAILQ_INIT(preferred); /* preferred order of keys */ TAILQ_INIT(preferred); /* preferred order of keys */
/* list of keys stored in the filesystem */ /* list of keys stored in the filesystem and PKCS#11 */
for (i = 0; i < options.num_identity_files; i++) { for (i = 0; i < options.num_identity_files; i++) {
key = options.identity_keys[i]; key = options.identity_keys[i];
if (key && key->type == KEY_RSA1) if (key && key->type == KEY_RSA1)
@ -1384,6 +1384,29 @@ pubkey_prepare(Authctxt *authctxt)
id->filename = xstrdup(options.identity_files[i]); id->filename = xstrdup(options.identity_files[i]);
TAILQ_INSERT_TAIL(&files, id, next); TAILQ_INSERT_TAIL(&files, id, next);
} }
/* Prefer PKCS11 keys that are explicitly listed */
TAILQ_FOREACH_SAFE(id, &files, next, tmp) {
if (id->key == NULL || (id->key->flags & KEY_FLAG_EXT) == 0)
continue;
found = 0;
TAILQ_FOREACH(id2, &files, next) {
if (id2->key == NULL ||
(id2->key->flags & KEY_FLAG_EXT) != 0)
continue;
if (key_equal(id->key, id2->key)) {
TAILQ_REMOVE(&files, id, next);
TAILQ_INSERT_TAIL(preferred, id, next);
found = 1;
break;
}
}
/* If IdentitiesOnly set and key not found then don't use it */
if (!found && options.identities_only) {
TAILQ_REMOVE(&files, id, next);
bzero(id, sizeof(id));
free(id);
}
}
/* list of keys supported by the agent */ /* list of keys supported by the agent */
if ((ac = ssh_get_authentication_connection())) { if ((ac = ssh_get_authentication_connection())) {
for (key = ssh_get_first_identity(ac, &comment, 2); for (key = ssh_get_first_identity(ac, &comment, 2);