- djm@cvs.openbsd.org 2003/06/11 11:18:38

     [authfd.c authfd.h ssh-add.c ssh-agent.c]
     make agent constraints (lifetime, confirm) work with smartcard keys;
     ok markus@

diff --git a/ChangeLog b/ChangeLog
index e5716fcff04cb60c4e6613a9b9bf8737cf81b28b..22b11c4e05b43951c0c33080b9d6379ffb1d2020 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -18,6 +18,10 @@
    - jakob@cvs.openbsd.org 2003/06/11 10:18:47
      [dns.c]
      sync with check_host_key() change
+   - djm@cvs.openbsd.org 2003/06/11 11:18:38
+     [authfd.c authfd.h ssh-add.c ssh-agent.c]
+     make agent constraints (lifetime, confirm) work with smartcard keys; 
+     ok markus@
 
 
 20030609

diff --git a/authfd.c b/authfd.c
index 7e96269a468cd1a8840dcc487464d1142aefba6d..368544b17b65a02f04a88735f716febadbfae332 100644 (file)
--- a/authfd.c
+++ b/authfd.c
@@ -35,7 +35,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: authfd.c,v 1.59 2003/04/08 20:21:28 itojun Exp $");
+RCSID("$OpenBSD: authfd.c,v 1.60 2003/06/11 11:18:38 djm Exp $");
 
 #include <openssl/evp.h>
 
@@ -589,16 +589,33 @@ ssh_remove_identity(AuthenticationConnection *auth, Key *key)
 }
 
 int
-ssh_update_card(AuthenticationConnection *auth, int add, const char *reader_id, const char *pin)
+ssh_update_card(AuthenticationConnection *auth, int add, 
+    const char *reader_id, const char *pin, u_int life, u_int confirm)
 {
        Buffer msg;
-       int type;
+       int type, constrained = (life || confirm);
+
+       if (add) {
+               type = constrained ?
+                   SSH_AGENTC_ADD_SMARTCARD_KEY_CONSTRAINED :
+                   SSH_AGENTC_ADD_SMARTCARD_KEY;
+       } else
+               type = SSH_AGENTC_REMOVE_SMARTCARD_KEY;
 
        buffer_init(&msg);
-       buffer_put_char(&msg, add ? SSH_AGENTC_ADD_SMARTCARD_KEY :
-           SSH_AGENTC_REMOVE_SMARTCARD_KEY);
+       buffer_put_char(&msg, type);
        buffer_put_cstring(&msg, reader_id);
        buffer_put_cstring(&msg, pin);
+       
+       if (constrained) {
+               if (life != 0) {
+                       buffer_put_char(&msg, SSH_AGENT_CONSTRAIN_LIFETIME);
+                       buffer_put_int(&msg, life);
+               }
+               if (confirm != 0)
+                       buffer_put_char(&msg, SSH_AGENT_CONSTRAIN_CONFIRM);
+       }
+
        if (ssh_request_reply(auth, &msg, &msg) == 0) {
                buffer_free(&msg);
                return 0;

diff --git a/authfd.h b/authfd.h
index 2a8751ec18bf503f33db3eff77e0273d392f9c6a..74b825c51d1dddf385591993d03ea3ee0656a3e9 100644 (file)
--- a/authfd.h
+++ b/authfd.h
@@ -1,4 +1,4 @@
-/*     $OpenBSD: authfd.h,v 1.32 2003/01/23 13:50:27 markus Exp $      */
+/*     $OpenBSD: authfd.h,v 1.33 2003/06/11 11:18:38 djm Exp $ */
 
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
@@ -49,6 +49,7 @@
 /* add key with constraints */
 #define SSH_AGENTC_ADD_RSA_ID_CONSTRAINED      24
 #define SSH2_AGENTC_ADD_ID_CONSTRAINED         25
+#define SSH_AGENTC_ADD_SMARTCARD_KEY_CONSTRAINED 26
 
 #define        SSH_AGENT_CONSTRAIN_LIFETIME            1
 #define        SSH_AGENT_CONSTRAIN_CONFIRM             2
@@ -82,7 +83,8 @@ int    ssh_add_identity_constrained(AuthenticationConnection *, Key *,
 int     ssh_remove_identity(AuthenticationConnection *, Key *);
 int     ssh_remove_all_identities(AuthenticationConnection *, int);
 int     ssh_lock_agent(AuthenticationConnection *, int, const char *);
-int     ssh_update_card(AuthenticationConnection *, int, const char *, const char *);
+int     ssh_update_card(AuthenticationConnection *, int, const char *, 
+    const char *, u_int, u_int);
 
 int
 ssh_decrypt_challenge(AuthenticationConnection *, Key *, BIGNUM *, u_char[16],

diff --git a/ssh-add.c b/ssh-add.c
index 9adec3094419fc9adeaec28ffa2ca68f35b8770f..9d14a3649d20f94f96330450ae3763ff6cf76ff7 100644 (file)
--- a/ssh-add.c
+++ b/ssh-add.c
@@ -35,7 +35,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: ssh-add.c,v 1.66 2003/03/05 22:33:43 markus Exp $");
+RCSID("$OpenBSD: ssh-add.c,v 1.67 2003/06/11 11:18:38 djm Exp $");
 
 #include <openssl/evp.h>
 
@@ -201,7 +201,7 @@ update_card(AuthenticationConnection *ac, int add, const char *id)
        if (pin == NULL)
                return -1;
 
-       if (ssh_update_card(ac, add, id, pin)) {
+       if (ssh_update_card(ac, add, id, pin, lifetime, confirm)) {
                fprintf(stderr, "Card %s: %s\n",
                    add ? "added" : "removed", id);
                ret = 0;

diff --git a/ssh-agent.c b/ssh-agent.c
index fbd41834e126801db5d806b079fbc44bd6754f87..61ea3458007aadb897f14689f5b671443cebd0ee 100644 (file)
--- a/ssh-agent.c
+++ b/ssh-agent.c
@@ -35,7 +35,7 @@
 
 #include "includes.h"
 #include "openbsd-compat/sys-queue.h"
-RCSID("$OpenBSD: ssh-agent.c,v 1.109 2003/04/08 20:21:29 itojun Exp $");
+RCSID("$OpenBSD: ssh-agent.c,v 1.110 2003/06/11 11:18:38 djm Exp $");
 
 #include <openssl/evp.h>
 #include <openssl/md5.h>
@@ -580,13 +580,29 @@ static void
 process_add_smartcard_key (SocketEntry *e)
 {
        char *sc_reader_id = NULL, *pin;
-       int i, version, success = 0;
+       int i, version, success = 0, death = 0, confirm = 0;
        Key **keys, *k;
        Identity *id;
        Idtab *tab;
 
        sc_reader_id = buffer_get_string(&e->request, NULL);
        pin = buffer_get_string(&e->request, NULL);
+
+       while (buffer_len(&e->request)) {
+               switch (buffer_get_char(&e->request)) {
+               case SSH_AGENT_CONSTRAIN_LIFETIME:
+                       death = time(NULL) + buffer_get_int(&e->request);
+                       break;
+               case SSH_AGENT_CONSTRAIN_CONFIRM:
+                       confirm = 1;
+                       break;
+               default:
+                       break;
+               }
+       }
+       if (lifetime && !death)
+               death = time(NULL) + lifetime;
+
        keys = sc_get_keys(sc_reader_id, pin);
        xfree(sc_reader_id);
        xfree(pin);
@@ -603,8 +619,8 @@ process_add_smartcard_key (SocketEntry *e)
                        id = xmalloc(sizeof(Identity));
                        id->key = k;
                        id->comment = xstrdup("smartcard key");
-                       id->death = 0;
-                       id->confirm = 0;
+                       id->death = death;
+                       id->confirm = confirm;
                        TAILQ_INSERT_TAIL(&tab->idlist, id, next);
                        tab->nentries++;
                        success = 1;
@@ -748,6 +764,7 @@ process_message(SocketEntry *e)
                break;
 #ifdef SMARTCARD
        case SSH_AGENTC_ADD_SMARTCARD_KEY:
+       case SSH_AGENTC_ADD_SMARTCARD_KEY_CONSTRAINED:
                process_add_smartcard_key(e);
                break;
        case SSH_AGENTC_REMOVE_SMARTCARD_KEY: