diff options
| author | Damien Miller <djm@cvs.openbsd.org> | 2017-05-04 06:10:58 +0000 |
|---|---|---|
| committer | Damien Miller <djm@cvs.openbsd.org> | 2017-05-04 06:10:58 +0000 |
| commit | 1a335f7e2048ade410163acb60ada62f2f8c6e0f (patch) | |
| tree | 4ee2d38b5850f52b633307013104d2593054ee51 /usr.bin | |
| parent | 63a0f2f01928a597b748a5c116dea8aacaaffe23 (diff) | |
since a couple of people have asked, leave a comment explaining why we
retain SSH v.1 support in the "delete all keys from agent" path.
Diffstat (limited to 'usr.bin')
| -rw-r--r-- | usr.bin/ssh/authfd.c | 6 | ||||
| -rw-r--r-- | usr.bin/ssh/ssh-add.c | 7 |
2 files changed, 11 insertions, 2 deletions
diff --git a/usr.bin/ssh/authfd.c b/usr.bin/ssh/authfd.c index b0b8ded7f70..827d31b5dea 100644 --- a/usr.bin/ssh/authfd.c +++ b/usr.bin/ssh/authfd.c @@ -1,4 +1,4 @@ -/* $OpenBSD: authfd.c,v 1.101 2017/04/30 23:10:43 djm Exp $ */ +/* $OpenBSD: authfd.c,v 1.102 2017/05/04 06:10:57 djm Exp $ */ /* * Author: Tatu Ylonen <ylo@cs.hut.fi> * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland @@ -573,6 +573,10 @@ ssh_update_card(int sock, int add, const char *reader_id, const char *pin, /* * Removes all identities from the agent. * This call is intended only for use by ssh-add(1) and like applications. + * + * This supports the SSH protocol 1 message to because, when clearing all + * keys from an agent, we generally want to clear both protocol v1 and v2 + * keys. */ int ssh_remove_all_identities(int sock, int version) diff --git a/usr.bin/ssh/ssh-add.c b/usr.bin/ssh/ssh-add.c index e72d8ae2865..11ae9eaee34 100644 --- a/usr.bin/ssh/ssh-add.c +++ b/usr.bin/ssh/ssh-add.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ssh-add.c,v 1.129 2017/04/30 23:10:43 djm Exp $ */ +/* $OpenBSD: ssh-add.c,v 1.130 2017/05/04 06:10:57 djm Exp $ */ /* * Author: Tatu Ylonen <ylo@cs.hut.fi> * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland @@ -153,6 +153,11 @@ delete_all(int agent_fd) { int ret = -1; + /* + * Since the agent might be forwarded, old or non-OpenSSH, when asked + * to remove all keys, attempt to remove both protocol v.1 and v.2 + * keys. + */ if (ssh_remove_all_identities(agent_fd, 2) == 0) ret = 0; /* ignore error-code for ssh1 */ |