dilim/openssh-portable
1
0 Fork 0
mirror of https://github.com/openssh/openssh-portable.git synced 2026-11-06 05:16:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

upstream: sk-usbhid: preserve UV requirement for resident keys

Browse Source 
When loading resident credentials, derive SSH_SK_USER_VERIFICATION_REQD
directly from the credential's credProtect policy.

The previous code only preserved the flag when the authenticator did not
report the uv capability. As a result, UV_REQUIRED credentials downloaded
from authenticators with built-in UV were saved with flags 0x21 instead
of 0x25.

Do not make preservation of the credential policy depend on the
authenticator's current UV capability. Keep compatibility with libfido2
versions without fido_cred_prot().

GHPR701 from Savely Krasovsky

OpenBSD-Commit-ID: ece9e236cdb6a2b7e973fdc266801f65a3feb12e
This commit is contained in:
djm@openbsd.org authored and Damien Miller committed 2026-09-15 18:30:38 +10:00
1 parent 961cc92164
commit e1d1c95160
1 file changed
+6 -9
Download Patch File Download Diff File Expand all files Collapse all files
sk-usbhid.c
+6 -9
View File
@@ -1,4 +1,4 @@
/* $OpenBSD: sk-usbhid.c,v 1.49 2026/06/01 05:49:20 djm Exp $ */
/* $OpenBSD: sk-usbhid.c,v 1.50 2026/09/15 08:28:26 djm Exp $ */
/*
* Copyright (c) 2019 Markus Friedl
* Copyright (c) 2020 Pedro Martelletto
@@ -1252,7 +1252,7 @@ static int
read_rks(struct sk_usbhid *sk, const char *pin,
struct sk_resident_key ***rksp, size_t *nrksp)
{
int ret = SSH_SK_ERR_GENERAL, r = -1, internal_uv;
int ret = SSH_SK_ERR_GENERAL, r = -1;
uint32_t alg;
fido_credman_metadata_t *metadata = NULL;
fido_credman_rp_t *rp = NULL;
@@ -1272,11 +1272,6 @@ read_rks(struct sk_usbhid *sk, const char *pin,
skdebug(__func__, "alloc failed");
goto out;
}
if (check_sk_options(sk->dev, "uv", &internal_uv) != 0) {
skdebug(__func__, "check_sk_options failed");
goto out;
}
if ((r = fido_credman_get_dev_metadata(sk->dev, metadata, pin)) != 0) {
if (r == FIDO_ERR_INVALID_COMMAND) {
skdebug(__func__, "device %s does not support "
@@ -1383,9 +1378,11 @@ read_rks(struct sk_usbhid *sk, const char *pin,
if (srk->user_id_len != 0)
memcpy(srk->user_id, user_id, srk->user_id_len);
if (fido_cred_prot(cred) == FIDO_CRED_PROT_UV_REQUIRED
&& internal_uv == -1)
#ifdef HAVE_FIDO_CRED_PROT
if (fido_cred_prot(cred) ==
FIDO_CRED_PROT_UV_REQUIRED)
srk->flags |= SSH_SK_USER_VERIFICATION_REQD;
#endif
if ((r = pack_public_key(srk->alg, cred,
&srk->key)) != 0) {