New upstream release (8.2p1)

1 files changed, 32 insertions, 7 deletions

diff --git a/auth2-pubkey.c b/auth2-pubkey.c
index df12c2c60..815ea0f25 100644
--- a/auth2-pubkey.c
+++ b/auth2-pubkey.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth2-pubkey.c,v 1.94 2019/09/06 04:53:27 djm Exp $ */
+/* $OpenBSD: auth2-pubkey.c,v 1.99 2020/02/06 22:30:54 naddy Exp $ */
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
  *
@@ -68,6 +68,7 @@
 #include "ssherr.h"
 #include "channels.h" /* XXX for session.h */
 #include "session.h" /* XXX for child_set_env(); refactor? */
+#include "sk-api.h"
 
 /* import */
 extern ServerOptions options;
@@ -96,8 +97,9 @@ userauth_pubkey(struct ssh *ssh)
         u_char *pkblob = NULL, *sig = NULL, have_sig;
         size_t blen, slen;
         int r, pktype;
-        int authenticated = 0;
+        int req_presence = 0, authenticated = 0;
         struct sshauthopt *authopts = NULL;
+        struct sshkey_sig_details *sig_details = NULL;
 
         if ((r = sshpkt_get_u8(ssh, &have_sig)) != 0 ||
             (r = sshpkt_get_cstring(ssh, &pkalg, NULL)) != 0 ||
@@ -213,9 +215,31 @@ userauth_pubkey(struct ssh *ssh)
                     PRIVSEP(sshkey_verify(key, sig, slen,
                     sshbuf_ptr(b), sshbuf_len(b),
                     (ssh->compat & SSH_BUG_SIGTYPE) == 0 ? pkalg : NULL,
-                    ssh->compat)) == 0) {
+                    ssh->compat, &sig_details)) == 0) {
                         authenticated = 1;
                 }
+                if (authenticated == 1 && sig_details != NULL) {
+                        auth2_record_info(authctxt, "signature count = %u",
+                            sig_details->sk_counter);
+                        debug("%s: sk_counter = %u, sk_flags = 0x%02x",
+                            __func__, sig_details->sk_counter,
+                            sig_details->sk_flags);
+                        req_presence = (options.pubkey_auth_options &
+                            PUBKEYAUTH_TOUCH_REQUIRED) ||
+                            !authopts->no_require_user_presence;
+                        if (req_presence && (sig_details->sk_flags &
+                            SSH_SK_USER_PRESENCE_REQD) == 0) {
+                                error("public key %s signature for %s%s from "
+                                    "%.128s port %d rejected: user presence "
+                                    "(authenticator touch) requirement "
+                                    "not met ", key_s,
+                                    authctxt->valid ? "" : "invalid user ",
+                                    authctxt->user, ssh_remote_ipaddr(ssh),
+                                    ssh_remote_port(ssh));
+                                authenticated = 0;
+                                goto done;
+                        }
+                }
                 auth2_record_key(authctxt, authenticated, key);
         } else {
                 debug("%s: test pkalg %s pkblob %s%s%s",
@@ -266,6 +290,7 @@ done:
         free(key_s);
         free(ca_s);
         free(sig);
+        sshkey_sig_details_free(sig_details);
         return authenticated;
 }
 
@@ -436,7 +461,7 @@ match_principals_command(struct ssh *ssh, struct passwd *user_pw,
          * NB. all returns later this function should go via "out" to
          * ensure the original SIGCHLD handler is restored properly.
          */
-        osigchld = signal(SIGCHLD, SIG_DFL);
+        osigchld = ssh_signal(SIGCHLD, SIG_DFL);
 
         /* Prepare and verify the user for the command */
         username = percent_expand(options.authorized_principals_command_user,
@@ -524,7 +549,7 @@ match_principals_command(struct ssh *ssh, struct passwd *user_pw,
  out:
         if (f != NULL)
                 fclose(f);
-        signal(SIGCHLD, osigchld);
+        ssh_signal(SIGCHLD, osigchld);
         for (i = 0; i < ac; i++)
                 free(av[i]);
         free(av);
@@ -874,7 +899,7 @@ user_key_command_allowed2(struct ssh *ssh, struct passwd *user_pw,
          * NB. all returns later this function should go via "out" to
          * ensure the original SIGCHLD handler is restored properly.
          */
-        osigchld = signal(SIGCHLD, SIG_DFL);
+        osigchld = ssh_signal(SIGCHLD, SIG_DFL);
 
         /* Prepare and verify the user for the command */
         username = percent_expand(options.authorized_keys_command_user,
@@ -963,7 +988,7 @@ user_key_command_allowed2(struct ssh *ssh, struct passwd *user_pw,
  out:
         if (f != NULL)
                 fclose(f);
-        signal(SIGCHLD, osigchld);
+        ssh_signal(SIGCHLD, osigchld);
         for (i = 0; i < ac; i++)
                 free(av[i]);
         free(av);