* New upstream release (LP: #535029).

  - After a transition period of about 10 years, this release disables SSH
    protocol 1 by default.  Clients and servers that need to use the
    legacy protocol must explicitly enable it in ssh_config / sshd_config
    or on the command-line.
  - Remove the libsectok/OpenSC-based smartcard code and add support for
    PKCS#11 tokens.  This support is enabled by default in the Debian
    packaging, since it now doesn't involve additional library
    dependencies (closes: #231472, LP: #16918).
  - Add support for certificate authentication of users and hosts using a
    new, minimal OpenSSH certificate format (closes: #482806).
  - Added a 'netcat mode' to ssh(1): "ssh -W host:port ...".
  - Add the ability to revoke keys in sshd(8) and ssh(1).  (For the Debian
    package, this overlaps with the key blacklisting facility added in
    openssh 1:4.7p1-9, but with different file formats and slightly
    different scopes; for the moment, I've roughly merged the two.)
  - Various multiplexing improvements, including support for requesting
    port-forwardings via the multiplex protocol (closes: #360151).
  - Allow setting an explicit umask on the sftp-server(8) commandline to
    override whatever default the user has (closes: #496843).
  - Many sftp client improvements, including tab-completion, more options,
    and recursive transfer support for get/put (LP: #33378).  The old
    mget/mput commands never worked properly and have been removed
    (closes: #270399, #428082).
  - Do not prompt for a passphrase if we fail to open a keyfile, and log
    the reason why the open failed to debug (closes: #431538).
  - Prevent sftp from crashing when given a "-" without a command.  Also,
    allow whitespace to follow a "-" (closes: #531561).

1 files changed, 29 insertions, 3 deletions

diff --git a/key.h b/key.h
index db609d326..aaf4b56bd 100644
--- a/key.h
+++ b/key.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: key.h,v 1.27 2008/06/11 21:01:35 grunk Exp $ */
+/* $OpenBSD: key.h,v 1.28 2010/02/26 20:29:54 djm Exp $ */
 
 /*
  * Copyright (c) 2000, 2001 Markus Friedl.  All rights reserved.
@@ -26,6 +26,7 @@
 #ifndef KEY_H
 #define KEY_H
 
+#include "buffer.h"
 #include <openssl/rsa.h>
 #include <openssl/dsa.h>
 
@@ -34,6 +35,8 @@ enum types {
         KEY_RSA1,
         KEY_RSA,
         KEY_DSA,
+        KEY_RSA_CERT,
+        KEY_DSA_CERT,
         KEY_NULL,
         KEY_UNSPEC
 };
@@ -50,20 +53,35 @@ enum fp_rep {
 /* key is stored in external hardware */
 #define KEY_FLAG_EXT            0x0001
 
+#define CERT_MAX_PRINCIPALS     256
+struct KeyCert {
+        Buffer           certblob; /* Kept around for use on wire */
+        u_int            type; /* SSH2_CERT_TYPE_USER or SSH2_CERT_TYPE_HOST */
+        char            *key_id;
+        u_int            nprincipals;
+        char            **principals;
+        u_int64_t        valid_after, valid_before;
+        Buffer           constraints;
+        Key             *signature_key;
+};
+
 struct Key {
         int      type;
         int      flags;
         RSA     *rsa;
         DSA     *dsa;
+        struct KeyCert *cert;
 };
 
 Key             *key_new(int);
+void             key_add_private(Key *);
 Key             *key_new_private(int);
 void             key_free(Key *);
 Key             *key_demote(const Key *);
+int              key_equal_public(const Key *, const Key *);
 int              key_equal(const Key *, const Key *);
-char            *key_fingerprint(const Key *, enum fp_type, enum fp_rep);
-u_char          *key_fingerprint_raw(const Key *, enum fp_type, u_int *);
+char            *key_fingerprint(Key *, enum fp_type, enum fp_rep);
+u_char          *key_fingerprint_raw(Key *, enum fp_type, u_int *);
 const char      *key_type(const Key *);
 int              key_write(const Key *, FILE *);
 int              key_read(Key *, char **);
@@ -72,6 +90,14 @@ u_int		 key_size(const Key *);
 Key     *key_generate(int, u_int);
 Key     *key_from_private(const Key *);
 int      key_type_from_name(char *);
+int      key_is_cert(const Key *);
+int      key_type_plain(int);
+int      key_to_certified(Key *);
+int      key_drop_cert(Key *);
+int      key_certify(Key *, Key *);
+void     key_cert_copy(const Key *, struct Key *);
+int      key_cert_check_authority(const Key *, int, int, const char *,
+            const char **);
 
 Key             *key_from_blob(const u_char *, u_int);
 int              key_to_blob(const Key *, u_char **, u_int *);