summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2019-11-25unbreak fuzzers for recent security key changesDamien Miller
2019-11-25upstream: unbreak tests for recent security key changesdjm@openbsd.org
OpenBSD-Regress-ID: 2cdf2fcae9962ca4d711338f3ceec3c1391bdf95
2019-11-25upstream: unbreak after security key support landeddjm@openbsd.org
OpenBSD-Regress-ID: 3ab578b0dbeb2aa6d9969b54a9c1bad329c0dcba
2019-11-25upstream: Remove workaround for broken 'openssl rsa -text' outputtb@openbsd.org
that was fixed in libcrypto/rsa/rsa_ameth.c r1.24. ok dtucker inoguchi OpenBSD-Regress-ID: c260edfac177daa8fcce90141587cf04a95c4f5f
2019-11-25upstream: redundant testdjm@openbsd.org
OpenBSD-Commit-ID: 38fa7806c528a590d91ae560e67bd8b246c2d7a3
2019-11-25upstream: document the "no-touch-required" certificate extension;djm@openbsd.org
ok markus, feedback deraadt OpenBSD-Commit-ID: 47640122b13f825e9c404ea99803b2372246579d
2019-11-25upstream: Print a key touch reminder when generating a securitydjm@openbsd.org
key. Most keys require a touch to authorize the operation. OpenBSD-Commit-ID: 7fe8b23edbf33e1bb81741b9f25e9a63be5f6b68
2019-11-25upstream: allow "ssh-keygen -x no-touch-required" when generating adjm@openbsd.org
security key keypair to request one that does not require a touch for each authentication attempt. The default remains to require touch. feedback deraadt; ok markus@ OpenBSD-Commit-ID: 887e7084b2e89c0c62d1598ac378aad8e434bcbd
2019-11-25upstream: add a "no-touch-required" option for authorized_keys anddjm@openbsd.org
a similar extension for certificates. This option disables the default requirement that security key signatures attest that the user touched their key to authorize them. feedback deraadt, ok markus OpenBSD-Commit-ID: f1fb56151ba68d55d554d0f6d3d4dba0cf1a452e
2019-11-25upstream: Add a sshd_config PubkeyAuthOptions directivedjm@openbsd.org
This directive has a single valid option "no-touch-required" that causes sshd to skip checking whether user presence was tested before a security key signature was made (usually by the user touching the key). ok markus@ OpenBSD-Commit-ID: 46e434a49802d4ed82bc0aa38cb985c198c407de
2019-11-25upstream: Add new structure for signature optionsdjm@openbsd.org
This is populated during signature verification with additional fields that are present in and covered by the signature. At the moment, it is only used to record security key-specific options, especially the flags field. with and ok markus@ OpenBSD-Commit-ID: 338a1f0e04904008836130bedb9ece4faafd4e49
2019-11-25upstream: memleak in error pathdjm@openbsd.org
OpenBSD-Commit-ID: 93488431bf02dde85a854429362695d2d43d9112
2019-11-22upstream: Wait for FD to be readable or writeable during a nonblockingdtucker@openbsd.org
connect, not just readable. Prevents a timeout when the server doesn't immediately send a banner (eg multiplexers like sslh) but is also slightly quicker for other connections since, unlike ssh1, ssh2 doesn't specify that the client should parse the server banner before sending its own. Patch from mnissler@chromium.org, ok djm@ OpenBSD-Commit-ID: aba9cd8480d1d9dd31d0ca0422ea155c26c5df1d
2019-11-20Include openssl compat header.Darren Tucker
Fixes warning for ECDSA_SIG_set0 on OpenSSL versions prior to 1.1.
2019-11-20upstream: adjust on-wire signature encoding for ecdsa-sk keys todjm@openbsd.org
better match ec25519-sk keys. Discussed with markus@ and Sebastian Kinne NB. if you are depending on security keys (already?) then make sure you update both your clients and servers. OpenBSD-Commit-ID: 53d88d8211f0dd02a7954d3af72017b1a79c0679
2019-11-20upstream: a little more information from the monitor when signaturedjm@openbsd.org
verification fails. OpenBSD-Commit-ID: e6a30071e0518cac512f9e10be3dc3500e2003f3
2019-11-20upstream: revert previous: naddy pointed out what's meant tojmc@openbsd.org
happen. rethink needed... OpenBSD-Commit-ID: fb0fede8123ea7f725fd65e00d49241c40bd3421
2019-11-20upstream: -c and -s do not make sense with -k; reshuffle -k intojmc@openbsd.org
the main synopsis/usage; ok djm OpenBSD-Commit-ID: f881ba253da015398ae8758d973e3390754869bc
2019-11-20upstream: document '$' environment variable expansion fornaddy@openbsd.org
SecurityKeyProvider; ok djm@ OpenBSD-Commit-ID: 76db507ebd336a573e1cd4146cc40019332c5799
2019-11-20upstream: more missing mentions of ed25519-sk; ok djm@naddy@openbsd.org
OpenBSD-Commit-ID: f242e53366f61697dffd53af881bc5daf78230ff
2019-11-20upstream: additional missing stdarg.h includes when built withoutnaddy@openbsd.org
WITH_OPENSSL; ok djm@ OpenBSD-Commit-ID: 881f9a2c4e2239849cee8bbf4faec9bab128f55b
2019-11-20upstream: add the missing WITH_OPENSSL ifdefs after the ED25519-SKnaddy@openbsd.org
addition; ok djm@ OpenBSD-Commit-ID: a9545e1c273e506cf70e328cbb9d0129b6d62474
2019-11-19remove all EC algs from proposals, no just sk onesDamien Miller
ok dtucker@
2019-11-18filter PUBKEY_DEFAULT_PK_ALG for ECC algorithmsDamien Miller
Remove ECC algorithms from the PUBKEY_DEFAULT_PK_ALG list when compiling without ECC support in libcrypto.
2019-11-18upstream: LibreSSL change the format for openssl rsa -text output fromdtucker@openbsd.org
"publicExponent" to "Exponent" so accept either. with djm. OpenBSD-Regress-ID: b7e6c4bf700029a31c98be14600d4472fe0467e6
2019-11-18upstream: fix a bug that prevented serialisation of ed25519-sk keysdjm@openbsd.org
OpenBSD-Commit-ID: 066682b79333159cac04fcbe03ebd9c8dcc152a9
2019-11-18upstream: Fix incorrect error message when key certification failsdjm@openbsd.org
OpenBSD-Commit-ID: 7771bd77ee73f7116df37c734c41192943a73cee
2019-11-18upstream: fix bug that prevented certification of ed25519-sk keysdjm@openbsd.org
OpenBSD-Commit-ID: 64c8cc6f5de2cdd0ee3a81c3a9dee8d862645996
2019-11-18upstream: allow *-sk key types to be turned into certificatesdjm@openbsd.org
OpenBSD-Commit-ID: cd365ee343934862286d0b011aa77fa739d2a945
2019-11-18upstream: mention ed25519-sk key/cert types here too; prompted bydjm@openbsd.org
jmc@ OpenBSD-Commit-ID: e281977e4a4f121f3470517cbd5e483eee37b818
2019-11-18upstream: mention ed25519-sk in places where it is accepted;djm@openbsd.org
prompted by jmc@ OpenBSD-Commit-ID: 076d386739ebe7336c2137e583bc7a5c9538a442
2019-11-18upstream: document ed25519-sk pubkey, private key and certificatedjm@openbsd.org
formats OpenBSD-Commit-ID: 795a7c1c80315412e701bef90e31e376ea2f3c88
2019-11-18upstream: correct order or ecdsa-sk private key fieldsdjm@openbsd.org
OpenBSD-Commit-ID: 4d4a0c13226a79f0080ce6cbe74f73b03ed8092e
2019-11-18upstream: correct description of fields in pub/private keys (wasdjm@openbsd.org
missing curve name); spotted by Sebastian Kinne OpenBSD-Commit-ID: 2a11340dc7ed16200342d384fb45ecd4fcce26e7
2019-11-18Teach the GTK2/3 ssh-askpass the new prompt hintsDamien Miller
ssh/ssh-agent now sets a hint environment variable $SSH_ASKPASS_PROMPT when running the askpass program. This is intended to allow the askpass to vary its UI across the three cases it supports: asking for a passphrase, confirming the use of a key and (recently) reminding a user to touch their security key. This adapts the gnome-ssh-askpass[23] to use these hints. Specifically, for SSH_ASKPASS_PROMPT=confirm it will skip the text input box and show only "yes"/"no" buttons. For SSH_ASKPASS_PROMPT=none (used to remind users to tap their security key), it shows only a "close" button. Help wanted: adapt the other askpass programs in active use, including x11-ssh-askpass, lxqt-openssh-askpass, etc.
2019-11-18Move ifdef OPENSSL_HAS_ECC.Darren Tucker
Found by -Wimplicit-fallthrough: one ECC case was not inside the ifdef. ok djm@
2019-11-18Enable -Wimplicit-fallthrough if supportedDarren Tucker
Suggested by djm.
2019-11-18upstream: missing break in getopt switch; spotted by Sebastian Kinnedjm@openbsd.org
OpenBSD-Commit-ID: f002dbf14dba5586e8407e90f0141148ade8e8fc
2019-11-18upstream: tweak debug messagedjm@openbsd.org
OpenBSD-Commit-ID: 2bf336d3be0b7e3dd97920d7e7471146a281d2b9
2019-11-17upstream: a little debug() in the security key interfacedjm@openbsd.org
OpenBSD-Commit-ID: 4c70300609a5c8b19707207bb7ad4109e963b0e8
2019-11-17upstream: always use ssh-sk-helper, even for the internal USB HIDdjm@openbsd.org
support. This avoid the need for a wpath pledge in ssh-agent. reported by jmc@ OpenBSD-Commit-ID: 19f799c4d020b870741d221335dbfa5e76691c23
2019-11-17upstream: fix typos in sk_enrollmarkus@openbsd.org
OpenBSD-Commit-ID: faa9bf779e008b3e64e2eb1344d9b7d83b3c4487
2019-11-17upstream: double word;jmc@openbsd.org
OpenBSD-Commit-ID: 43d09bafa4ea9002078cb30ca9adc3dcc0b9c2b9
2019-11-17upstream: remove most uses of BN_CTXdjm@openbsd.org
We weren't following the rules re BN_CTX_start/BN_CTX_end and the places we were using it didn't benefit from its use anyway. ok dtucker@ OpenBSD-Commit-ID: ea9ba6c0d2e6f6adfe00b309a8f41842fe12fc7a
2019-11-15Add wrappers for other ultrix headers.Darren Tucker
Wrappers protect against multiple inclusions for headers that don't do it themselves.
2019-11-15Add SSIZE_MAX when we define ssize_t.Darren Tucker
2019-11-15Remove ultrix realpath hack.Darren Tucker
2019-11-15upstream: unshield security key privkey before attempting signaturedjm@openbsd.org
in agent. spotted by dtucker@ OpenBSD-Commit-ID: fb67d451665385b8a0a55371231c50aac67b91d2
2019-11-15upstream: rewrite c99-ismderaadt@openbsd.org
OpenBSD-Commit-ID: d0c70cca29cfa7e6d9f7ec1d6d5dabea112499b3
2019-11-15upstream: only clang understands those new -W optionsderaadt@openbsd.org
OpenBSD-Commit-ID: d9b910e412d139141b072a905e66714870c38ac0
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-14 22:27:19 +0000