remove a bunch of ENABLE_SK #ifdefs

The ssh-sk-helper client API gives us a nice place to disable
security key support when it is wasn't enabled at compile time,
so we don't need to check everywere.

Also, verification of security key signatures can remain enabled
all the time - it has no additional dependencies. So sshd can
accept security key pubkeys in authorized_keys, etc regardless of
the host's support for dlopen, etc.

1 files changed, 8 insertions, 0 deletions

diff --git a/ssh-sk-client.c b/ssh-sk-client.c
index 92ac0e7e1..8a7ac97c4 100644
--- a/ssh-sk-client.c
+++ b/ssh-sk-client.c
@@ -198,6 +198,10 @@ sshsk_sign(const char *provider, struct sshkey *key,
         *sigp = NULL;
         *lenp = 0;
 
+#ifndef ENABLE_SK
+        return SSH_ERR_KEY_TYPE_UNKNOWN;
+#endif
+
         if ((kbuf = sshbuf_new()) == NULL ||
             (req = sshbuf_new()) == NULL) {
                 r = SSH_ERR_ALLOC_FAIL;
@@ -266,6 +270,10 @@ sshsk_enroll(int type, const char *provider_path, const char *application,
         if (attest != NULL)
                 sshbuf_reset(attest);
 
+#ifndef ENABLE_SK
+        return SSH_ERR_KEY_TYPE_UNKNOWN;
+#endif
+
         if (type < 0)
                 return SSH_ERR_INVALID_ARGUMENT;