summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--configure.ac57
-rw-r--r--ssh-ecdsa-sk.c3
-rw-r--r--ssh-keygen.c10
-rw-r--r--ssh-sk-helper.c11
-rw-r--r--ssh-sk.c3
5 files changed, 74 insertions, 10 deletions
diff --git a/configure.ac b/configure.ac
index 9b4a7ee62..8f007e635 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1878,16 +1878,53 @@ AC_ARG_ENABLE([pkcs11],
1878 ] 1878 ]
1879) 1879)
1880 1880
1881# PKCS11 depends on OpenSSL. 1881disable_sk=
1882if test "x$openssl" = "xyes" && test "x$disable_pkcs11" = "x"; then 1882AC_ARG_ENABLE([security-key],
1883 # PKCS#11 support requires dlopen() and co 1883 [ --disable-security-key disable U2F/FIDO support code [no]],
1884 AC_SEARCH_LIBS([dlopen], [dl], 1884 [
1885 AC_CHECK_DECL([RTLD_NOW], 1885 if test "x$enableval" = "xno" ; then
1886 AC_DEFINE([ENABLE_PKCS11], [], [Enable for PKCS#11 support]), 1886 disable_sk=1
1887 [], [#include <dlfcn.h>] 1887 fi
1888 ) 1888 ]
1889 ) 1889)
1890
1891# PKCS11/U2F depend on OpenSSL and dlopen().
1892AC_SEARCH_LIBS([dlopen], [dl])
1893AC_CHECK_FUNCS([dlopen])
1894AC_CHECK_DECL([RTLD_NOW], [], [], [#include <dlfcn.h>])
1895
1896enable_pkcs11=yes
1897enable_sk=yes
1898if test "x$openssl" != "xyes" ; then
1899 enable_pkcs11="disabled; missing libcrypto"
1900 enable_sk="disabled; missing libcrypto"
1901fi
1902if test "x$ac_cv_func_dlopen" != "xyes" ; then
1903 enable_pkcs11="disabled; missing dlopen(3)"
1904 enable_sk="disabled; missing dlopen(3)"
1905fi
1906if test "x$ac_cv_have_decl_RTLD_NOW" != "xyes" ; then
1907 enable_pkcs11="disabled; missing RTLD_NOW"
1908 enable_sk="disabled; missing RTLD_NOW"
1909fi
1910if test ! -z "$disable_pkcs11" ; then
1911 enable_pkcs11="disabled by user"
1912fi
1913if test ! -z "$disable_sk" ; then
1914 enable_sk="disabled by user"
1915fi
1916
1917AC_MSG_CHECKING([whether to enable PKCS11])
1918if test "x$enable_pkcs11" = "xyes" ; then
1919 AC_DEFINE([ENABLE_PKCS11], [], [Enable for PKCS#11 support])
1920fi
1921AC_MSG_RESULT([$enable_pkcs11])
1922
1923AC_MSG_CHECKING([whether to enable U2F])
1924if test "x$enable_sk" = "xyes" ; then
1925 AC_DEFINE([ENABLE_SK], [], [Enable for U2F/FIDO support])
1890fi 1926fi
1927AC_MSG_RESULT([$enable_sk])
1891 1928
1892# IRIX has a const char return value for gai_strerror() 1929# IRIX has a const char return value for gai_strerror()
1893AC_CHECK_FUNCS([gai_strerror], [ 1930AC_CHECK_FUNCS([gai_strerror], [
@@ -5247,6 +5284,8 @@ echo " Translate v4 in v6 hack: $IPV4_IN6_HACK_MSG"
5247echo " BSD Auth support: $BSD_AUTH_MSG" 5284echo " BSD Auth support: $BSD_AUTH_MSG"
5248echo " Random number source: $RAND_MSG" 5285echo " Random number source: $RAND_MSG"
5249echo " Privsep sandbox style: $SANDBOX_STYLE" 5286echo " Privsep sandbox style: $SANDBOX_STYLE"
5287echo " PKCS#11 support: $enable_pkcs11"
5288echo " U2F/FIDO support: $enable_sk"
5250 5289
5251echo "" 5290echo ""
5252 5291
diff --git a/ssh-ecdsa-sk.c b/ssh-ecdsa-sk.c
index 6441cd7fa..355924657 100644
--- a/ssh-ecdsa-sk.c
+++ b/ssh-ecdsa-sk.c
@@ -29,6 +29,8 @@
29 29
30#include "includes.h" 30#include "includes.h"
31 31
32#ifdef ENABLE_SK
33
32#include <sys/types.h> 34#include <sys/types.h>
33 35
34#include <openssl/bn.h> 36#include <openssl/bn.h>
@@ -178,3 +180,4 @@ ssh_ecdsa_sk_verify(const struct sshkey *key,
178 free(ktype); 180 free(ktype);
179 return ret; 181 return ret;
180} 182}
183#endif /* ENABLE_SK */
diff --git a/ssh-keygen.c b/ssh-keygen.c
index 0d0586576..1d2a93f66 100644
--- a/ssh-keygen.c
+++ b/ssh-keygen.c
@@ -2783,7 +2783,6 @@ main(int argc, char **argv)
2783 unsigned long long ull, cert_serial = 0; 2783 unsigned long long ull, cert_serial = 0;
2784 char *identity_comment = NULL, *ca_key_path = NULL; 2784 char *identity_comment = NULL, *ca_key_path = NULL;
2785 u_int32_t bits = 0; 2785 u_int32_t bits = 0;
2786 uint8_t sk_flags = SSH_SK_USER_PRESENCE_REQD;
2787 FILE *f; 2786 FILE *f;
2788 const char *errstr; 2787 const char *errstr;
2789 int log_level = SYSLOG_LEVEL_INFO; 2788 int log_level = SYSLOG_LEVEL_INFO;
@@ -2796,6 +2795,9 @@ main(int argc, char **argv)
2796 unsigned long start_lineno = 0, lines_to_process = 0; 2795 unsigned long start_lineno = 0, lines_to_process = 0;
2797 BIGNUM *start = NULL; 2796 BIGNUM *start = NULL;
2798#endif 2797#endif
2798#ifdef ENABLE_SK
2799 uint8_t sk_flags = SSH_SK_USER_PRESENCE_REQD;
2800#endif
2799 2801
2800 extern int optind; 2802 extern int optind;
2801 extern char *optarg; 2803 extern char *optarg;
@@ -2991,7 +2993,9 @@ main(int argc, char **argv)
2991 "number", optarg); 2993 "number", optarg);
2992 if (ull > 0xff) 2994 if (ull > 0xff)
2993 fatal("Invalid security key flags 0x%llx", ull); 2995 fatal("Invalid security key flags 0x%llx", ull);
2996#ifdef ENABLE_SK
2994 sk_flags = (uint8_t)ull; 2997 sk_flags = (uint8_t)ull;
2998#endif
2995 break; 2999 break;
2996 case 'z': 3000 case 'z':
2997 errno = 0; 3001 errno = 0;
@@ -3250,10 +3254,14 @@ main(int argc, char **argv)
3250 printf("Generating public/private %s key pair.\n", 3254 printf("Generating public/private %s key pair.\n",
3251 key_type_name); 3255 key_type_name);
3252 if (type == KEY_ECDSA_SK) { 3256 if (type == KEY_ECDSA_SK) {
3257#ifndef ENABLE_SK
3258 fatal("Security key support was disabled at compile time");
3259#else /* ENABLE_SK */
3253 if (sshsk_enroll(sk_provider, 3260 if (sshsk_enroll(sk_provider,
3254 cert_key_id == NULL ? "ssh:" : cert_key_id, 3261 cert_key_id == NULL ? "ssh:" : cert_key_id,
3255 sk_flags, NULL, &private, NULL) != 0) 3262 sk_flags, NULL, &private, NULL) != 0)
3256 exit(1); /* error message already printed */ 3263 exit(1); /* error message already printed */
3264#endif /* ENABLE_SK */
3257 } else if ((r = sshkey_generate(type, bits, &private)) != 0) 3265 } else if ((r = sshkey_generate(type, bits, &private)) != 0)
3258 fatal("sshkey_generate failed"); 3266 fatal("sshkey_generate failed");
3259 if ((r = sshkey_from_private(private, &public)) != 0) 3267 if ((r = sshkey_from_private(private, &public)) != 0)
diff --git a/ssh-sk-helper.c b/ssh-sk-helper.c
index 0a0c92a44..ced00d955 100644
--- a/ssh-sk-helper.c
+++ b/ssh-sk-helper.c
@@ -51,6 +51,7 @@
51#include "ssherr.h" 51#include "ssherr.h"
52#include "ssh-sk.h" 52#include "ssh-sk.h"
53 53
54#ifdef ENABLE_SK
54extern char *__progname; 55extern char *__progname;
55 56
56int 57int
@@ -141,3 +142,13 @@ main(int argc, char **argv)
141 142
142 return (0); 143 return (0);
143} 144}
145#else /* ENABLE_SK */
146#include <stdio.h>
147
148int
149main(int argc, char **argv)
150{
151 fprintf(stderr, "ssh-sk-helper: disabled at compile time\n");
152 return -1;
153}
154#endif /* ENABLE_SK */
diff --git a/ssh-sk.c b/ssh-sk.c
index 7d313f57b..122a1e2b7 100644
--- a/ssh-sk.c
+++ b/ssh-sk.c
@@ -19,6 +19,8 @@
19 19
20#include "includes.h" 20#include "includes.h"
21 21
22#ifdef ENABLE_SK
23
22#include <dlfcn.h> 24#include <dlfcn.h>
23#include <stddef.h> 25#include <stddef.h>
24#include <stdint.h> 26#include <stdint.h>
@@ -375,3 +377,4 @@ sshsk_ecdsa_sign(const char *provider_path, const struct sshkey *key,
375 sshbuf_free(inner_sig); 377 sshbuf_free(inner_sig);
376 return r; 378 return r;
377} 379}
380#endif /* ENABLE_SK */