upstream: translate and return error codes; retry on bad PIN

Define some well-known error codes in the SK API and pass
them back via ssh-sk-helper.

Use the new "wrong PIN" error code to retry PIN prompting during
ssh-keygen of resident keys.

feedback and ok markus@

OpenBSD-Commit-ID: 9663c6a2bb7a0bc8deaccc6c30d9a2983b481620

1 files changed, 21 insertions, 11 deletions

diff --git a/ssh-keygen.c b/ssh-keygen.c
index 79e2e92b5..696891e0e 100644
--- a/ssh-keygen.c
+++ b/ssh-keygen.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-keygen.c,v 1.378 2019/12/30 09:23:28 djm Exp $ */
+/* $OpenBSD: ssh-keygen.c,v 1.379 2019/12/30 09:24:45 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1994 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -3361,16 +3361,26 @@ main(int argc, char **argv)
         switch (type) {
         case KEY_ECDSA_SK:
         case KEY_ED25519_SK:
-                if (!quiet) {
-                        printf("You may need to touch your security key "
-                            "to authorize key generation.\n");
-                }
-                fflush(stdout);
-                if (sshsk_enroll(type, sk_provider,
-                    cert_key_id == NULL ? "ssh:" : cert_key_id,
-                    sk_flags, NULL, NULL, &private, NULL) != 0)
-                        exit(1); /* error message already printed */
-                break;
+                passphrase1 = NULL;
+                for (i = 0 ; i < 3; i++) {
+                        if (!quiet) {
+                                printf("You may need to touch your security "
+                                    "key to authorize key generation.\n");
+                        }
+                        fflush(stdout);
+                        r = sshsk_enroll(type, sk_provider,
+                            cert_key_id == NULL ? "ssh:" : cert_key_id,
+                            sk_flags, passphrase1, NULL, &private, NULL);
+                        if (r == 0)
+                                break;
+                        if (r != SSH_ERR_KEY_WRONG_PASSPHRASE)
+                                exit(1); /* error message already printed */
+                        passphrase1 = read_passphrase("Enter PIN for security "
+                            "key: ", RP_ALLOW_STDIN);
+                }
+                if (i > 3)
+                        fatal("Too many incorrect PINs");
+                break;
         default:
                 if ((r = sshkey_generate(type, bits, &private)) != 0)
                         fatal("sshkey_generate failed");