summaryrefslogtreecommitdiff
path: root/usr.bin/ssh/ssh-pkcs11.c
AgeCommit message (Collapse)Author
2021-11-18avoid xmalloc(0) for PKCS#11 keyid for ECDSA keys (we already did thisDamien Miller
for RSA keys). Avoids fatal errors for PKCS#11 libraries that return empty keyid, e.g. Microchip ATECC608B "cryptoauthlib"; bz#3364
2021-08-11remove a bunch of %p in format strings; leftovers of debuggingsDamien Miller
past. prompted by Michael Forney, ok dtucker@
2021-06-25fix decoding of X.509 subject name; from Leif Thuresson via bz3327Damien Miller
ok markus@
2020-11-22when loading PKCS#11 keys, include the key fingerprints and provider/slotDamien Miller
information in debug output.
2020-10-18use the new variant log macros instead of prepending __func__ andDamien Miller
appending ssh_err(r) manually; ok markus@
2020-05-29fix compilation on !HAVE_DLOPEN platforms; stub function was notDamien Miller
updated to match API change. From Dale Rahn via beck@ ok markus@
2020-03-13improve error messages for some common PKCS#11 C_Login failure cases;Damien Miller
based on patch from Jacob Hoffman-Andrews in bz3130; ok dtucker
2020-03-06pkcs11_register_provider: return < 0 on error; ok djmMarkus Friedl
2020-01-25expose PKCS#11 key labels/X.509 subjects as commentsDamien Miller
Extract the key label or X.509 subject string when PKCS#11 keys are retrieved from the token and plumb this through to places where it may be used as a comment. based on https://github.com/openssh/openssh-portable/pull/138 by Danielle Church feedback and ok markus@
2019-10-01revert unconditional forced login implemented in r1.41 of ssh-pkcs11.c;Damien Miller
r1.45 added a forced login as a fallback for cases where the token returns no objects and this is less disruptive for users of tokens directly in ssh (rather than via ssh-agent) and in ssh-keygen bz3006, patch from Jakub Jelen; ok markus
2019-09-05if a PKCS#11 token returns no keys then try to login and refetchDamien Miller
them. Based on patch from Jakub Jelen; bz#2430 ok markus@
2019-09-02downgrade PKCS#11 "provider returned no slots" warning from log levelDamien Miller
error to debug. This is common when attempting to enumerate keys on smartcard readers with no cards plugged in. bz#3058 ok dtucker@
2019-03-08fix use-after-free in ssh-pkcs11; found by hshoexer w/AFLMarkus Friedl
2019-02-04fix NULL-deref crash in PKCS#11 code when attempting login to a tokenDamien Miller
requiring a PIN; reported by benno@ fix mostly by markus@
2019-01-22Correct some bugs in PKCS#11 token PIN handling at initial login,Damien Miller
the attempt at reading the PIN could be skipped in some cases especially on devices with integrated PIN readers. based on patch from Daniel Kucera in bz#2652; ok markus@
2019-01-22Support keys that set the CKA_ALWAYS_AUTHENTICATE by requring aDamien Miller
fresh login after the C_SignInit operation. based on patch from Jakub Jelen in bz#2638; ok markus
2019-01-21always print the caller's error message in ossl_error(), even when thereDamien Miller
are no libcrypto errors to report.
2019-01-21get the ex_data (pkcs11_key object) back from the keys at theDamien Miller
index at which it was inserted, rather than assuming index 0
2019-01-21use ECDSA_SIG_set0() instead of poking signature values intoDamien Miller
structure directly; the latter works on LibreSSL but not on OpenSSL. From portable.
2019-01-20we use singleton pkcs#11 RSA_METHOD and EC_KEY_METHOD now, so thereDamien Miller
is no need to keep a copy of each in the pkcs11_key object. work by markus@, ok djm@
2019-01-20KNF previous; from markus@Damien Miller
2019-01-20use OpenSSL's RSA reference counting hooks to implicitly clean upDamien Miller
pkcs11_key objects when their owning RSA object's reference count drops to zero. Simplifies the cleanup path and makes it more like ECDSA's work by markus@, ok djm@
2019-01-20make the PKCS#11 RSA code more like the new PKCS#11 ECDSA code:Damien Miller
use a single custom RSA_METHOD instead of a method per key suggested by me, but markus@ did all the work. ok djm@
2019-01-20fix leak of ECDSA pkcs11_key objectsDamien Miller
work by markus, ok djm@
2019-01-20use EVP_PKEY_get0_EC_KEY() instead of direct access of EC_KEY internalsDamien Miller
as that won't work on OpenSSL work by markus@, feedback and ok djm@
2019-01-20cleanup PKCS#11 ECDSA pubkey loading: the returned object should neverDamien Miller
have a DER header work by markus; feedback and ok djm@
2019-01-20cleanup unnecessary code in ECDSA pkcs#11 signature support: theDamien Miller
sign operation does not return DER, but a concatenation of r|s work by markus@, feedback and ok djm@
2019-01-20add support for ECDSA keys in PKCS#11 tokensDamien Miller
Work by markus@ and Pedro Martelletto, feedback and ok me@
2018-09-13hold our collective noses and use the openssl-1.1.x API in OpenSSH;Damien Miller
feedback and ok tb@ jsing@ markus@
2018-02-07Remove all guards for calls to OpenSSL free functions - all of theseJoel Sing
functions handle NULL, from at least OpenSSL 1.0.1g onwards. Prompted by dtucker@ asking about guards for RSA_free(), when looking at openssh-portable pr#84 on github. ok deraadt@ dtucker@
2017-05-31Switch to recallocarray() for a few operations. Both growth and shrinkageTheo de Raadt
are handled safely, and there also is no need for preallocation dances. Future changes in this area will be less error prone. Review and one bug found by markus
2017-05-30sshkey_new() might return NULL (pkcs#11 code only); ok djm@Markus Friedl
2016-10-28Improve pkcs11_add_provider() logging: demote some excessivelyDamien Miller
verbose error()s to debug()s, include PKCS#11 provider name and slot in log messages where possible. bz#2610, based on patch from Jakub Jelen
2016-02-12avoid fatal() for PKCS11 tokens that present empty key IDsDamien Miller
bz#1773, ok markus@
2015-07-18don't ignore PKCS#11 hosted keys that return empty CKA_ID;Damien Miller
patch by Jakub Jelen via bz#2429; ok markus
2015-07-18skip uninitialised PKCS#11 slots; patch from Jakub Jelen in bz#2427Damien Miller
ok markus@
2015-05-27support PKCS#11 devices with external PIN entry devicesDamien Miller
bz#2240, based on patch from Dirk-Willem van Gulik; feedback and ok dtucker@
2015-04-24rename xrealloc() to xreallocarray() since it follows that form.Theo de Raadt
ok djm
2015-02-03missing ;Theo de Raadt
djm and mlarkin really having great interactions recently
2015-02-02handle PKCS#11 C_Login returning CKR_USER_ALREADY_LOGGED_IN;Damien Miller
based on patch from Yuri Samoilenko; ok markus@
2015-01-15sync ssh-keysign, ssh-keygen and some dependencies to the newDamien Miller
buffer/key API; mostly mechanical, ok markus@
2014-06-24New key API: refactor key-related functions to be more library-like,Damien Miller
existing API is offered as a set of wrappers. with and ok markus@ Thanks also to Ben Hawkes, David Tomaschik, Ivan Fratric, Matthew Dempsky and Ron Bowes for a detailed review a few months ago.
2014-05-02revert __bounded change; it causes way more problems for portable thanDamien Miller
it solves; pointed out by dtucker@
2014-03-26use __bounded(...) attribute recently added to sys/cdefs.h instead ofDamien Miller
longform __attribute__(__bounded(...)); for brevity and a warning free compilation with llvm/clan
2013-11-13add missing braces found by pedroMarkus Friedl
2013-11-06from portable: s/true/true_val/ to avoid name collisions on dump platformsDamien Miller
2013-11-02support pkcs#11 tokes that only provide x509 zerts instead of raw pubkeys;Markus Friedl
fixes bz#1908; based on patch from Laurent Barbe; ok djm
2013-07-12fix pointer-signedness warnings from clang/llvm-3.3; "seems nice" deraadt@Damien Miller
2013-05-17bye, bye xfree(); ok markus@Damien Miller
2010-06-08check length of value returned C_GetAttributValue for != 0Markus Friedl
from mdrtbugzilla@codefive.co.uk; bugzilla #1773; ok dtucker@
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-11 21:55:21 +0000