diff options
| author | djm@openbsd.org <djm@openbsd.org> | 2020-01-06 02:00:46 +0000 |
|---|---|---|
| committer | Damien Miller <djm@mindrot.org> | 2020-01-06 13:12:46 +1100 |
| commit | c312ca077cd2a6c15545cd6b4d34ee2f69289174 (patch) | |
| tree | b8dd974c55dd0de351dfcbfc4f33fddb935a1c12 /ssh-sk-client.c | |
| parent | 2ab335712d084d9ccaf3f53afc3fa9535329da87 (diff) | |
| download | openssh-git-c312ca077cd2a6c15545cd6b4d34ee2f69289174.tar.gz | |
upstream: Extends the SK API to accept a set of key/value options
for all operations. These are intended to future-proof the API a little by
making it easier to specify additional fields for without having to change
the API version for each.
At present, only two options are defined: one to explicitly specify
the device for an operation (rather than accepting the middleware's
autoselection) and another to specify the FIDO2 username that may
be used when generating a resident key. These new options may be
invoked at key generation time via ssh-keygen -O
This also implements a suggestion from Markus to avoid "int" in favour
of uint32_t for the algorithm argument in the API, to make implementation
of ssh-sk-client/helper a little easier.
feedback, fixes and ok markus@
OpenBSD-Commit-ID: 973ce11704609022ab36abbdeb6bc23c8001eabc
Diffstat (limited to 'ssh-sk-client.c')
| -rw-r--r-- | ssh-sk-client.c | 14 |
1 files changed, 9 insertions, 5 deletions
diff --git a/ssh-sk-client.c b/ssh-sk-client.c index 0033a665..d3d37f79 100644 --- a/ssh-sk-client.c +++ b/ssh-sk-client.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ssh-sk-client.c,v 1.3 2019/12/30 09:23:28 djm Exp $ */ +/* $OpenBSD: ssh-sk-client.c,v 1.4 2020/01/06 02:00:46 djm Exp $ */ /* * Copyright (c) 2019 Google LLC * @@ -282,8 +282,9 @@ sshsk_sign(const char *provider, struct sshkey *key, } int -sshsk_enroll(int type, const char *provider_path, const char *application, - uint8_t flags, const char *pin, struct sshbuf *challenge_buf, +sshsk_enroll(int type, const char *provider_path, const char *device, + const char *application, const char *userid, uint8_t flags, + const char *pin, struct sshbuf *challenge_buf, struct sshkey **keyp, struct sshbuf *attest) { int oerrno, r = SSH_ERR_INTERNAL_ERROR; @@ -311,7 +312,9 @@ sshsk_enroll(int type, const char *provider_path, const char *application, if ((r = sshbuf_put_u32(req, SSH_SK_HELPER_ENROLL)) != 0 || (r = sshbuf_put_u32(req, (u_int)type)) != 0 || (r = sshbuf_put_cstring(req, provider_path)) != 0 || + (r = sshbuf_put_cstring(req, device)) != 0 || (r = sshbuf_put_cstring(req, application)) != 0 || + (r = sshbuf_put_cstring(req, userid)) != 0 || (r = sshbuf_put_u8(req, flags)) != 0 || (r = sshbuf_put_cstring(req, pin)) != 0 || (r = sshbuf_put_stringb(req, challenge_buf)) != 0) { @@ -358,8 +361,8 @@ sshsk_enroll(int type, const char *provider_path, const char *application, } int -sshsk_load_resident(const char *provider_path, const char *pin, - struct sshkey ***keysp, size_t *nkeysp) +sshsk_load_resident(const char *provider_path, const char *device, + const char *pin, struct sshkey ***keysp, size_t *nkeysp) { int oerrno, r = SSH_ERR_INTERNAL_ERROR; struct sshbuf *kbuf = NULL, *req = NULL, *resp = NULL; @@ -378,6 +381,7 @@ sshsk_load_resident(const char *provider_path, const char *pin, if ((r = sshbuf_put_u32(req, SSH_SK_HELPER_LOAD_RESIDENT)) != 0 || (r = sshbuf_put_cstring(req, provider_path)) != 0 || + (r = sshbuf_put_cstring(req, device)) != 0 || (r = sshbuf_put_cstring(req, pin)) != 0) { error("%s: compose: %s", __func__, ssh_err(r)); goto out; |