- djm@cvs.openbsd.org 2003/06/11 11:18:38
[authfd.c authfd.h ssh-add.c ssh-agent.c]
make agent constraints (lifetime, confirm) work with smartcard keys;
ok markus@
diff --git a/ChangeLog b/ChangeLog
index fab1da4..fc17be0 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -18,6 +18,10 @@
- jakob@cvs.openbsd.org 2003/06/11 10:18:47
[dns.c]
sync with check_host_key() change
+ - djm@cvs.openbsd.org 2003/06/11 11:18:38
+ [authfd.c authfd.h ssh-add.c ssh-agent.c]
+ make agent constraints (lifetime, confirm) work with smartcard keys;
+ ok markus@
20030609
@@ -502,4 +506,4 @@
- Fix sshd BindAddress and -b options for systems using fake-getaddrinfo.
Report from murple@murple.net, diagnosis from dtucker@zip.com.au
-$Id: ChangeLog,v 1.2796 2003/06/11 12:05:45 djm Exp $
+$Id: ChangeLog,v 1.2797 2003/06/11 12:06:33 djm Exp $
diff --git a/authfd.c b/authfd.c
index 7e96269..368544b 100644
--- a/authfd.c
+++ b/authfd.c
@@ -35,7 +35,7 @@
*/
#include "includes.h"
-RCSID("$OpenBSD: authfd.c,v 1.59 2003/04/08 20:21:28 itojun Exp $");
+RCSID("$OpenBSD: authfd.c,v 1.60 2003/06/11 11:18:38 djm Exp $");
#include <openssl/evp.h>
@@ -589,16 +589,33 @@
}
int
-ssh_update_card(AuthenticationConnection *auth, int add, const char *reader_id, const char *pin)
+ssh_update_card(AuthenticationConnection *auth, int add,
+ const char *reader_id, const char *pin, u_int life, u_int confirm)
{
Buffer msg;
- int type;
+ int type, constrained = (life || confirm);
+
+ if (add) {
+ type = constrained ?
+ SSH_AGENTC_ADD_SMARTCARD_KEY_CONSTRAINED :
+ SSH_AGENTC_ADD_SMARTCARD_KEY;
+ } else
+ type = SSH_AGENTC_REMOVE_SMARTCARD_KEY;
buffer_init(&msg);
- buffer_put_char(&msg, add ? SSH_AGENTC_ADD_SMARTCARD_KEY :
- SSH_AGENTC_REMOVE_SMARTCARD_KEY);
+ buffer_put_char(&msg, type);
buffer_put_cstring(&msg, reader_id);
buffer_put_cstring(&msg, pin);
+
+ if (constrained) {
+ if (life != 0) {
+ buffer_put_char(&msg, SSH_AGENT_CONSTRAIN_LIFETIME);
+ buffer_put_int(&msg, life);
+ }
+ if (confirm != 0)
+ buffer_put_char(&msg, SSH_AGENT_CONSTRAIN_CONFIRM);
+ }
+
if (ssh_request_reply(auth, &msg, &msg) == 0) {
buffer_free(&msg);
return 0;
diff --git a/authfd.h b/authfd.h
index 2a8751e..74b825c 100644
--- a/authfd.h
+++ b/authfd.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: authfd.h,v 1.32 2003/01/23 13:50:27 markus Exp $ */
+/* $OpenBSD: authfd.h,v 1.33 2003/06/11 11:18:38 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo@cs.hut.fi>
@@ -49,6 +49,7 @@
/* add key with constraints */
#define SSH_AGENTC_ADD_RSA_ID_CONSTRAINED 24
#define SSH2_AGENTC_ADD_ID_CONSTRAINED 25
+#define SSH_AGENTC_ADD_SMARTCARD_KEY_CONSTRAINED 26
#define SSH_AGENT_CONSTRAIN_LIFETIME 1
#define SSH_AGENT_CONSTRAIN_CONFIRM 2
@@ -82,7 +83,8 @@
int ssh_remove_identity(AuthenticationConnection *, Key *);
int ssh_remove_all_identities(AuthenticationConnection *, int);
int ssh_lock_agent(AuthenticationConnection *, int, const char *);
-int ssh_update_card(AuthenticationConnection *, int, const char *, const char *);
+int ssh_update_card(AuthenticationConnection *, int, const char *,
+ const char *, u_int, u_int);
int
ssh_decrypt_challenge(AuthenticationConnection *, Key *, BIGNUM *, u_char[16],
diff --git a/ssh-add.c b/ssh-add.c
index 9adec30..9d14a36 100644
--- a/ssh-add.c
+++ b/ssh-add.c
@@ -35,7 +35,7 @@
*/
#include "includes.h"
-RCSID("$OpenBSD: ssh-add.c,v 1.66 2003/03/05 22:33:43 markus Exp $");
+RCSID("$OpenBSD: ssh-add.c,v 1.67 2003/06/11 11:18:38 djm Exp $");
#include <openssl/evp.h>
@@ -201,7 +201,7 @@
if (pin == NULL)
return -1;
- if (ssh_update_card(ac, add, id, pin)) {
+ if (ssh_update_card(ac, add, id, pin, lifetime, confirm)) {
fprintf(stderr, "Card %s: %s\n",
add ? "added" : "removed", id);
ret = 0;
diff --git a/ssh-agent.c b/ssh-agent.c
index fbd4183..61ea345 100644
--- a/ssh-agent.c
+++ b/ssh-agent.c
@@ -35,7 +35,7 @@
#include "includes.h"
#include "openbsd-compat/sys-queue.h"
-RCSID("$OpenBSD: ssh-agent.c,v 1.109 2003/04/08 20:21:29 itojun Exp $");
+RCSID("$OpenBSD: ssh-agent.c,v 1.110 2003/06/11 11:18:38 djm Exp $");
#include <openssl/evp.h>
#include <openssl/md5.h>
@@ -580,13 +580,29 @@
process_add_smartcard_key (SocketEntry *e)
{
char *sc_reader_id = NULL, *pin;
- int i, version, success = 0;
+ int i, version, success = 0, death = 0, confirm = 0;
Key **keys, *k;
Identity *id;
Idtab *tab;
sc_reader_id = buffer_get_string(&e->request, NULL);
pin = buffer_get_string(&e->request, NULL);
+
+ while (buffer_len(&e->request)) {
+ switch (buffer_get_char(&e->request)) {
+ case SSH_AGENT_CONSTRAIN_LIFETIME:
+ death = time(NULL) + buffer_get_int(&e->request);
+ break;
+ case SSH_AGENT_CONSTRAIN_CONFIRM:
+ confirm = 1;
+ break;
+ default:
+ break;
+ }
+ }
+ if (lifetime && !death)
+ death = time(NULL) + lifetime;
+
keys = sc_get_keys(sc_reader_id, pin);
xfree(sc_reader_id);
xfree(pin);
@@ -603,8 +619,8 @@
id = xmalloc(sizeof(Identity));
id->key = k;
id->comment = xstrdup("smartcard key");
- id->death = 0;
- id->confirm = 0;
+ id->death = death;
+ id->confirm = confirm;
TAILQ_INSERT_TAIL(&tab->idlist, id, next);
tab->nentries++;
success = 1;
@@ -748,6 +764,7 @@
break;
#ifdef SMARTCARD
case SSH_AGENTC_ADD_SMARTCARD_KEY:
+ case SSH_AGENTC_ADD_SMARTCARD_KEY_CONSTRAINED:
process_add_smartcard_key(e);
break;
case SSH_AGENTC_REMOVE_SMARTCARD_KEY: