- djm@cvs.openbsd.org 2010/04/16 01:47:26

     [PROTOCOL.certkeys auth-options.c auth-options.h auth-rsa.c]
     [auth2-pubkey.c authfd.c key.c key.h myproposal.h ssh-add.c]
     [ssh-agent.c ssh-dss.c ssh-keygen.1 ssh-keygen.c ssh-rsa.c]
     [sshconnect.c sshconnect2.c sshd.c]
     revised certificate format ssh-{dss,rsa}-cert-v01@openssh.com with the
     following changes:

     move the nonce field to the beginning of the certificate where it can
     better protect against chosen-prefix attacks on the signature hash

     Rename "constraints" field to "critical options"

     Add a new non-critical "extensions" field

     Add a serial number

     The older format is still support for authentication and cert generation
     (use "ssh-keygen -t v00 -s ca_key ..." to generate a v00 certificate)

     ok markus@

1 files changed, 4 insertions, 5 deletions

diff --git a/auth2-pubkey.c b/auth2-pubkey.c
index c4cadf4e7..83ecd6590 100644
--- a/auth2-pubkey.c
+++ b/auth2-pubkey.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth2-pubkey.c,v 1.22 2010/03/10 23:27:17 djm Exp $ */
+/* $OpenBSD: auth2-pubkey.c,v 1.23 2010/04/16 01:47:26 djm Exp $ */
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
  *
@@ -235,7 +235,7 @@ user_key_allowed2(struct passwd *pw, Key *key, char *file)
                 }
                 if (auth_parse_options(pw, key_options, file, linenum) != 1)
                         continue;
-                if (key->type == KEY_RSA_CERT || key->type == KEY_DSA_CERT) {
+                if (key_is_cert(key)) {
                         if (!key_is_cert_authority)
                                 continue;
                         if (!key_equal(found, key->cert->signature_key))
@@ -251,8 +251,7 @@ user_key_allowed2(struct passwd *pw, Key *key, char *file)
                                 auth_debug_add("%s", reason);
                                 continue;
                         }
-                        if (auth_cert_constraints(&key->cert->constraints,
-                            pw) != 0) {
+                        if (auth_cert_options(key, pw) != 0) {
                                 xfree(fp);
                                 continue;
                         }
@@ -307,7 +306,7 @@ user_cert_trusted_ca(struct passwd *pw, Key *key)
                 auth_debug_add("%s", reason);
                 goto out;
         }
-        if (auth_cert_constraints(&key->cert->constraints, pw) != 0)
+        if (auth_cert_options(key, pw) != 0)
                 goto out;
 
         verbose("Accepted certificate ID \"%s\" signed by %s CA %s via %s",