diff options
author | Damien Miller <djm@mindrot.org> | 2010-04-16 15:56:21 +1000 |
---|---|---|
committer | Damien Miller <djm@mindrot.org> | 2010-04-16 15:56:21 +1000 |
commit | 4e270b05dd9d850fb9e2e0ac43f33cb4090d3ebc (patch) | |
tree | 4fc84942b5966e9f38f18a1257ac43ddbed336be /sshd.c | |
parent | 031c9100dfe3ee65a29084ebbd61965a76b3ad26 (diff) |
- djm@cvs.openbsd.org 2010/04/16 01:47:26
[PROTOCOL.certkeys auth-options.c auth-options.h auth-rsa.c]
[auth2-pubkey.c authfd.c key.c key.h myproposal.h ssh-add.c]
[ssh-agent.c ssh-dss.c ssh-keygen.1 ssh-keygen.c ssh-rsa.c]
[sshconnect.c sshconnect2.c sshd.c]
revised certificate format ssh-{dss,rsa}-cert-v01@openssh.com with the
following changes:
move the nonce field to the beginning of the certificate where it can
better protect against chosen-prefix attacks on the signature hash
Rename "constraints" field to "critical options"
Add a new non-critical "extensions" field
Add a serial number
The older format is still support for authentication and cert generation
(use "ssh-keygen -t v00 -s ca_key ..." to generate a v00 certificate)
ok markus@
Diffstat (limited to 'sshd.c')
-rw-r--r-- | sshd.c | 15 |
1 files changed, 12 insertions, 3 deletions
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: sshd.c,v 1.374 2010/03/07 11:57:13 dtucker Exp $ */ | 1 | /* $OpenBSD: sshd.c,v 1.375 2010/04/16 01:47:26 djm Exp $ */ |
2 | /* | 2 | /* |
3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> | 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland | 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland |
@@ -744,6 +744,8 @@ list_hostkey_types(void) | |||
744 | if (key == NULL) | 744 | if (key == NULL) |
745 | continue; | 745 | continue; |
746 | switch (key->type) { | 746 | switch (key->type) { |
747 | case KEY_RSA_CERT_V00: | ||
748 | case KEY_DSA_CERT_V00: | ||
747 | case KEY_RSA_CERT: | 749 | case KEY_RSA_CERT: |
748 | case KEY_DSA_CERT: | 750 | case KEY_DSA_CERT: |
749 | if (buffer_len(&b) > 0) | 751 | if (buffer_len(&b) > 0) |
@@ -767,10 +769,17 @@ get_hostkey_by_type(int type, int need_private) | |||
767 | Key *key; | 769 | Key *key; |
768 | 770 | ||
769 | for (i = 0; i < options.num_host_key_files; i++) { | 771 | for (i = 0; i < options.num_host_key_files; i++) { |
770 | if (type == KEY_RSA_CERT || type == KEY_DSA_CERT) | 772 | switch (type) { |
773 | case KEY_RSA_CERT_V00: | ||
774 | case KEY_DSA_CERT_V00: | ||
775 | case KEY_RSA_CERT: | ||
776 | case KEY_DSA_CERT: | ||
771 | key = sensitive_data.host_certificates[i]; | 777 | key = sensitive_data.host_certificates[i]; |
772 | else | 778 | break; |
779 | default: | ||
773 | key = sensitive_data.host_keys[i]; | 780 | key = sensitive_data.host_keys[i]; |
781 | break; | ||
782 | } | ||
774 | if (key != NULL && key->type == type) | 783 | if (key != NULL && key->type == type) |
775 | return need_private ? | 784 | return need_private ? |
776 | sensitive_data.host_keys[i] : key; | 785 | sensitive_data.host_keys[i] : key; |