- djm@cvs.openbsd.org 2010/08/04 05:42:47

     [auth.c auth2-hostbased.c authfile.c authfile.h ssh-keysign.8]
     [ssh-keysign.c ssh.c]
     enable certificates for hostbased authentication, from Iain Morgan;
     "looks ok" markus@

1 files changed, 28 insertions, 3 deletions

diff --git a/auth2-hostbased.c b/auth2-hostbased.c
index 721646520..cdf442f97 100644
--- a/auth2-hostbased.c
+++ b/auth2-hostbased.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth2-hostbased.c,v 1.13 2010/03/04 10:36:03 djm Exp $ */
+/* $OpenBSD: auth2-hostbased.c,v 1.14 2010/08/04 05:42:47 djm Exp $ */
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
  *
@@ -141,9 +141,10 @@ int
 hostbased_key_allowed(struct passwd *pw, const char *cuser, char *chost,
     Key *key)
 {
-        const char *resolvedname, *ipaddr, *lookup;
+        const char *resolvedname, *ipaddr, *lookup, *reason;
         HostStatus host_status;
         int len;
+        char *fp;
 
         if (auth_key_is_revoked(key))
                 return 0;
@@ -174,16 +175,40 @@ hostbased_key_allowed(struct passwd *pw, const char *cuser, char *chost,
         }
         debug2("userauth_hostbased: access allowed by auth_rhosts2");
 
+        if (key_is_cert(key) && 
+            key_cert_check_authority(key, 1, 0, lookup, &reason)) {
+                error("%s", reason);
+                auth_debug_add("%s", reason);
+                return 0;
+        }
+
         host_status = check_key_in_hostfiles(pw, key, lookup,
             _PATH_SSH_SYSTEM_HOSTFILE,
             options.ignore_user_known_hosts ? NULL : _PATH_SSH_USER_HOSTFILE);
 
         /* backward compat if no key has been found. */
-        if (host_status == HOST_NEW)
+        if (host_status == HOST_NEW) {
                 host_status = check_key_in_hostfiles(pw, key, lookup,
                     _PATH_SSH_SYSTEM_HOSTFILE2,
                     options.ignore_user_known_hosts ? NULL :
                     _PATH_SSH_USER_HOSTFILE2);
+        }
+
+        if (host_status == HOST_OK) {
+                if (key_is_cert(key)) {
+                        fp = key_fingerprint(key->cert->signature_key,
+                            SSH_FP_MD5, SSH_FP_HEX);
+                        verbose("Accepted certificate ID \"%s\" signed by "
+                            "%s CA %s from %s@%s", key->cert->key_id,
+                            key_type(key->cert->signature_key), fp,
+                            cuser, lookup);
+                } else {
+                        fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
+                        verbose("Accepted %s public key %s from %s@%s",
+                            key_type(key), fp, cuser, lookup);
+                }
+                xfree(fp);
+        }
 
         return (host_status == HOST_OK);
 }