- djm@cvs.openbsd.org 2010/08/04 05:40:39

     [PROTOCOL.certkeys ssh-keygen.c]
     tighten the rules for certificate encoding by requiring that options
     appear in lexical order and make our ssh-keygen comply. ok markus@

1 files changed, 7 insertions, 7 deletions

diff --git a/ssh-keygen.c b/ssh-keygen.c
index 56bfee20d..4c60a659f 100644
--- a/ssh-keygen.c
+++ b/ssh-keygen.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-keygen.c,v 1.195 2010/07/16 04:45:30 djm Exp $ */
+/* $OpenBSD: ssh-keygen.c,v 1.196 2010/08/04 05:40:39 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1994 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -1295,9 +1295,9 @@ static void
 prepare_options_buf(Buffer *c, int which)
 {
         buffer_clear(c);
-        if ((which & OPTIONS_EXTENSIONS) != 0 &&
-            (certflags_flags & CERTOPT_X_FWD) != 0)
-                add_flag_option(c, "permit-X11-forwarding");
+        if ((which & OPTIONS_CRITICAL) != 0 &&
+            certflags_command != NULL)
+                add_string_option(c, "force-command", certflags_command);
         if ((which & OPTIONS_EXTENSIONS) != 0 &&
             (certflags_flags & CERTOPT_AGENT_FWD) != 0)
                 add_flag_option(c, "permit-agent-forwarding");
@@ -1310,9 +1310,9 @@ prepare_options_buf(Buffer *c, int which)
         if ((which & OPTIONS_EXTENSIONS) != 0 &&
             (certflags_flags & CERTOPT_USER_RC) != 0)
                 add_flag_option(c, "permit-user-rc");
-        if ((which & OPTIONS_CRITICAL) != 0 &&
-            certflags_command != NULL)
-                add_string_option(c, "force-command", certflags_command);
+        if ((which & OPTIONS_EXTENSIONS) != 0 &&
+            (certflags_flags & CERTOPT_X_FWD) != 0)
+                add_flag_option(c, "permit-X11-forwarding");
         if ((which & OPTIONS_CRITICAL) != 0 &&
             certflags_src_addr != NULL)
                 add_string_option(c, "source-address", certflags_src_addr);