1 files changed, 69 insertions, 23 deletions

diff --git a/ssh-add.c b/ssh-add.c
index a40198ab5..936dc2128 100644
--- a/ssh-add.c
+++ b/ssh-add.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-add.c,v 1.155 2020/03/16 02:17:02 dtucker Exp $ */
+/* $OpenBSD: ssh-add.c,v 1.157 2020/08/31 04:33:17 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -67,6 +67,7 @@
 #include "ssherr.h"
 #include "digest.h"
 #include "ssh-sk.h"
+#include "sk-api.h"
 
 /* argv0 */
 extern char *__progname;
@@ -111,25 +112,69 @@ clear_pass(void)
 }
 
 static int
+delete_one(int agent_fd, const struct sshkey *key, const char *comment,
+    const char *path, int qflag)
+{
+        int r;
+
+        if ((r = ssh_remove_identity(agent_fd, key)) != 0) {
+                fprintf(stderr, "Could not remove identity \"%s\": %s\n",
+                    path, ssh_err(r));
+                return r;
+        }
+        if (!qflag) {
+                fprintf(stderr, "Identity removed: %s %s (%s)\n", path,
+                    sshkey_type(key), comment);
+        }
+        return 0;
+}
+
+static int
+delete_stdin(int agent_fd, int qflag)
+{
+        char *line = NULL, *cp;
+        size_t linesize = 0;
+        struct sshkey *key = NULL;
+        int lnum = 0, r, ret = -1;
+
+        while (getline(&line, &linesize, stdin) != -1) {
+                lnum++;
+                sshkey_free(key);
+                key = NULL;
+                line[strcspn(line, "\n")] = '\0';
+                cp = line + strspn(line, " \t");
+                if (*cp == '#' || *cp == '\0')
+                        continue;
+                if ((key = sshkey_new(KEY_UNSPEC)) == NULL)
+                        fatal("%s: sshkey_new", __func__);
+                if ((r = sshkey_read(key, &cp)) != 0) {
+                        error("(stdin):%d: invalid key: %s", lnum, ssh_err(r));
+                        continue;
+                }
+                if (delete_one(agent_fd, key, cp, "(stdin)", qflag) == 0)
+                        ret = 0;
+        }
+        sshkey_free(key);
+        free(line);
+        return ret;
+}
+
+static int
 delete_file(int agent_fd, const char *filename, int key_only, int qflag)
 {
         struct sshkey *public, *cert = NULL;
         char *certpath = NULL, *comment = NULL;
         int r, ret = -1;
 
+        if (strcmp(filename, "-") == 0)
+                return delete_stdin(agent_fd, qflag);
+
         if ((r = sshkey_load_public(filename, &public,  &comment)) != 0) {
                 printf("Bad key file %s: %s\n", filename, ssh_err(r));
                 return -1;
         }
-        if ((r = ssh_remove_identity(agent_fd, public)) == 0) {
-                if (!qflag) {
-                        fprintf(stderr, "Identity removed: %s (%s)\n",
-                            filename, comment);
-                }
+        if (delete_one(agent_fd, public, comment, filename, qflag) == 0)
                 ret = 0;
-        } else
-                fprintf(stderr, "Could not remove identity \"%s\": %s\n",
-                    filename, ssh_err(r));
 
         if (key_only)
                 goto out;
@@ -149,15 +194,8 @@ delete_file(int agent_fd, const char *filename, int key_only, int qflag)
                 fatal("Certificate %s does not match private key %s",
                     certpath, filename);
 
-        if ((r = ssh_remove_identity(agent_fd, cert)) == 0) {
-                if (!qflag) {
-                        fprintf(stderr, "Identity removed: %s (%s)\n",
-                            certpath, comment);
-                }
+        if (delete_one(agent_fd, cert, comment, certpath, qflag) == 0)
                 ret = 0;
-        } else
-                fprintf(stderr, "Could not remove identity \"%s\": %s\n",
-                    certpath, ssh_err(r));
 
  out:
         sshkey_free(cert);
@@ -311,12 +349,20 @@ add_file(int agent_fd, const char *filename, int key_only, int qflag,
                 ssh_free_identitylist(idlist);
         }
 
-        if (!sshkey_is_sk(private))
-                skprovider = NULL; /* Don't send constraint for other keys */
-        else if (skprovider == NULL) {
-                fprintf(stderr, "Cannot load authenticator-hosted key %s "
-                    "without provider\n", filename);
-                goto out;
+        if (sshkey_is_sk(private)) {
+                if (skprovider == NULL) {
+                        fprintf(stderr, "Cannot load FIDO key %s "
+                            "without provider\n", filename);
+                        goto out;
+                }
+                if ((private->sk_flags & SSH_SK_USER_VERIFICATION_REQD) != 0) {
+                        fprintf(stderr, "FIDO verify-required key %s is not "
+                            "currently supported by ssh-agent\n", filename);
+                        goto out;
+                }
+        } else {
+                /* Don't send provider constraint for other keys */
+                skprovider = NULL;
         }
 
         if ((r = ssh_add_identity_constrained(agent_fd, private, comment,