upstream: add a "no-touch-required" option for authorized_keys and

a similar extension for certificates. This option disables the default
requirement that security key signatures attest that the user touched their
key to authorize them.

feedback deraadt, ok markus

OpenBSD-Commit-ID: f1fb56151ba68d55d554d0f6d3d4dba0cf1a452e

1 files changed, 4 insertions, 1 deletions

diff --git a/auth-options.h b/auth-options.h
index 14cbfa49d..d96ffedee 100644
--- a/auth-options.h
+++ b/auth-options.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth-options.h,v 1.28 2019/07/09 04:15:00 djm Exp $ */
+/* $OpenBSD: auth-options.h,v 1.29 2019/11/25 00:54:23 djm Exp $ */
 
 /*
  * Copyright (c) 2018 Damien Miller <djm@mindrot.org>
@@ -68,6 +68,9 @@ struct sshauthopt {
          */
         char *required_from_host_cert;
         char *required_from_host_keys;
+
+        /* Key requires user presence asserted */
+        int no_require_user_presence;
 };
 
 struct sshauthopt *sshauthopt_new(void);