summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authordjm@openbsd.org <djm@openbsd.org>2015-07-18 08:02:17 +0000
committerDamien Miller <djm@mindrot.org>2015-07-20 10:32:25 +1000
commit63ebcd0005e9894fcd6871b7b80aeea1fec0ff76 (patch)
treeb84db7274b2a52d4f17baeb56f0ee41543d798c3
parentb15fd989c8c62074397160147a8d5bc34b3f3c63 (diff)
upstream commit
don't ignore PKCS#11 hosted keys that return empty CKA_ID; patch by Jakub Jelen via bz#2429; ok markus Upstream-ID: 2f7c94744eb0342f8ee8bf97b2351d4e00116485
-rw-r--r--ssh-pkcs11.c20
1 files changed, 14 insertions, 6 deletions
diff --git a/ssh-pkcs11.c b/ssh-pkcs11.c
index 4156d0886..92614a52d 100644
--- a/ssh-pkcs11.c
+++ b/ssh-pkcs11.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: ssh-pkcs11.c,v 1.20 2015/07/18 08:00:21 djm Exp $ */ 1/* $OpenBSD: ssh-pkcs11.c,v 1.21 2015/07/18 08:02:17 djm Exp $ */
2/* 2/*
3 * Copyright (c) 2010 Markus Friedl. All rights reserved. 3 * Copyright (c) 2010 Markus Friedl. All rights reserved.
4 * 4 *
@@ -481,15 +481,23 @@ pkcs11_fetch_keys_filter(struct pkcs11_provider *p, CK_ULONG slotidx,
481 error("C_GetAttributeValue failed: %lu", rv); 481 error("C_GetAttributeValue failed: %lu", rv);
482 continue; 482 continue;
483 } 483 }
484 /* check that none of the attributes are zero length */ 484 /*
485 if (attribs[0].ulValueLen == 0 || 485 * Allow CKA_ID (always first attribute) to be empty, but
486 attribs[1].ulValueLen == 0 || 486 * ensure that none of the others are zero length.
487 * XXX assumes CKA_ID is always first.
488 */
489 if (attribs[1].ulValueLen == 0 ||
487 attribs[2].ulValueLen == 0) { 490 attribs[2].ulValueLen == 0) {
488 continue; 491 continue;
489 } 492 }
490 /* allocate buffers for attributes */ 493 /* allocate buffers for attributes */
491 for (i = 0; i < 3; i++) 494 for (i = 0; i < 3; i++) {
492 attribs[i].pValue = xmalloc(attribs[i].ulValueLen); 495 if (attribs[i].ulValueLen > 0) {
496 attribs[i].pValue = xmalloc(
497 attribs[i].ulValueLen);
498 }
499 }
500
493 /* 501 /*
494 * retrieve ID, modulus and public exponent of RSA key, 502 * retrieve ID, modulus and public exponent of RSA key,
495 * or ID, subject and value for certificates. 503 * or ID, subject and value for certificates.