From nobody Fri Jul 21 16:15:55 2023 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4R6vmr2dRmz4pQgR; Fri, 21 Jul 2023 16:15:56 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4R6vmr1dL6z4XlB; Fri, 21 Jul 2023 16:15:56 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1689956156; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=xZhdbxwRMnZsubAcRlBQirj75BV1fX3yIjDvylhUJlc=; b=pmgazkqbObSaxPPEwno8Tugrao+52KeCestQ3NQHVrmN/0EmmRWYKkZvAPHzmMUqAcYXhv DZyI4/tCP4ABSw7dsq54BQ8cJtUJQN034QL35nH4G4/nLydL58bB4N4NV1Vbp34v8Yrwsn sWJaf49jZ6DmBOy1whuKlqxL7WZtsEY77hSXI32aH0Ny7Ys6Jw/asX8Iv6VfrYTsVJVL1I nFgeQ5uGo5ydJER44c/TVJxBuwfG5GgC5oR/7cN8uZ6rIZEU66vX3pyMqPEKa3C8n/qYgl uLrttQe3zXp9X7WArVDZ6cb7tEXmccvXDisClx1ROZiEvwZbncc/sJqPYJOVdw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1689956156; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=xZhdbxwRMnZsubAcRlBQirj75BV1fX3yIjDvylhUJlc=; b=WxQBvSM1lD32zASgH2ME0GPSULjJPUAY1jjvhx7RnpQqR0AjVkO4qn3oy6rYFE8MlO/Ukl mI0M0bcbxtV5sdKIZAzp05232vm2uNd3dBbErWjuI74eIb914Xbt4jJkjoTI6FJvGm7iNF n85R1kCi36Oktw1NAax3LmnEw2WyPvjFORM0TQjl7fvADqzgJYyYXCxwrrE2E7svBojMZx dNwwDoTgl6dnbSwn4nna3yjdog3J3Fc5lJRagYR1KhWx2V6rkfpqBpIigtywRwtktiHYZR dnILArlD6AfYuIFlnfKbOD/as5CIZK6RM6Iaht7rt3jG33xXHbVw02ncaX79GQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1689956156; a=rsa-sha256; cv=none; b=Ni4aLCukdVhU+r5DCgDKtPH76J4jyI1YaZ0aqoXCPatwq7HrA68hmCpnC0ds0iYGSDiPWm wc6wvWw9pj7ncuYO7Gcr6UpQPwKK3wjUIBN+KVigWAliY3yCpYrT+RimBXG+NN8oUIcnow VsnWUIzrJcfjuSvtxdJ+gnxE1rC6rOVomSOzJ69haONBrYGR/C0CteHNwROCzRWKOHuxOK 5uw4gvlhNZSrJXvlYEfZYrk+ulnYY0nfZ3p6FfwyWMg/Ji2JV3SYifp1qQ34OhPabD3Zzi JfVfXUFuGhpDSrv+flM799DGMi8QCmlvnrjDpD1pyBOB1SNdoRqhSLO5YhqxVA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4R6vmr0T7HzK7c; Fri, 21 Jul 2023 16:15:56 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.17.1/8.17.1) with ESMTP id 36LGFtuS075653; Fri, 21 Jul 2023 16:15:55 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.17.1/8.17.1/Submit) id 36LGFtTl075652; Fri, 21 Jul 2023 16:15:55 GMT (envelope-from git) Date: Fri, 21 Jul 2023 16:15:55 GMT Message-Id: <202307211615.36LGFtTl075652@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Ed Maste Subject: git: 039d7ad8ee6b - stable/12 - ssh-agent: document "-O no-restrict-websafe" List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-branches@freebsd.org X-BeenThere: dev-commits-src-branches@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: emaste X-Git-Repository: src X-Git-Refname: refs/heads/stable/12 X-Git-Reftype: branch X-Git-Commit: 039d7ad8ee6b6c40044123a118b037179ac7c203 Auto-Submitted: auto-generated The branch stable/12 has been updated by emaste: URL: https://cgit.FreeBSD.org/src/commit/?id=039d7ad8ee6b6c40044123a118b037179ac7c203 commit 039d7ad8ee6b6c40044123a118b037179ac7c203 Author: Ed Maste AuthorDate: 2023-07-21 15:59:09 +0000 Commit: Ed Maste CommitDate: 2023-07-21 16:08:12 +0000 ssh-agent: document "-O no-restrict-websafe" OpenSSH commits 9fd2441113fc and 4a4883664d6b, which are part of OpenSSH 9.2p1. Sponsored by: The FreeBSD Foundation --- crypto/openssh/ssh-agent.1 | 27 +++++++++++++++++++++++++-- crypto/openssh/ssh-agent.c | 8 ++++---- 2 files changed, 29 insertions(+), 6 deletions(-) diff --git a/crypto/openssh/ssh-agent.1 b/crypto/openssh/ssh-agent.1 index 8844b2eb45e8..b9d28b8e103e 100644 --- a/crypto/openssh/ssh-agent.1 +++ b/crypto/openssh/ssh-agent.1 @@ -1,4 +1,4 @@ -.\" $OpenBSD: ssh-agent.1,v 1.73 2022/03/31 17:27:27 naddy Exp $ +.\" $OpenBSD: ssh-agent.1,v 1.75 2022/10/07 06:00:58 jmc Exp $ .\" $FreeBSD$ .\" .\" Author: Tatu Ylonen @@ -35,7 +35,7 @@ .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. .\" -.Dd $Mdocdate: March 31 2022 $ +.Dd $Mdocdate: October 7 2022 $ .Dt SSH-AGENT 1 .Os .Sh NAME @@ -47,11 +47,13 @@ .Op Fl \&Ddx .Op Fl a Ar bind_address .Op Fl E Ar fingerprint_hash +.Op Fl O Ar option .Op Fl P Ar allowed_providers .Op Fl t Ar life .Nm ssh-agent .Op Fl a Ar bind_address .Op Fl E Ar fingerprint_hash +.Op Fl O Ar option .Op Fl P Ar allowed_providers .Op Fl t Ar life .Ar command Op Ar arg ... @@ -103,6 +105,27 @@ The default is Kill the current agent (given by the .Ev SSH_AGENT_PID environment variable). +.It Fl O Ar option +Specify an option when starting +.Nm . +Currently only one option is supported: +.Cm no-restrict-websafe . +This instructs +.Nm +to permit signatures using FIDO keys that might be web authentication +requests. +By default, +.Nm +refuses signature requests for FIDO keys where the key application string +does not start with +.Dq ssh: +and when the data to be signed does not appear to be a +.Xr ssh 1 +user authentication request or a +.Xr ssh-keygen 1 +signature. +The default behaviour prevents forwarded access to a FIDO key from also +implicitly forwarding the ability to authenticate to websites. .It Fl P Ar allowed_providers Specify a pattern-list of acceptable paths for PKCS#11 provider and FIDO authenticator middleware shared libraries that may be used with the diff --git a/crypto/openssh/ssh-agent.c b/crypto/openssh/ssh-agent.c index 2c2c7a639907..9f376f83a798 100644 --- a/crypto/openssh/ssh-agent.c +++ b/crypto/openssh/ssh-agent.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ssh-agent.c,v 1.292 2022/09/17 10:11:29 djm Exp $ */ +/* $OpenBSD: ssh-agent.c,v 1.293 2022/10/07 06:00:58 jmc Exp $ */ /* * Author: Tatu Ylonen * Copyright (c) 1995 Tatu Ylonen , Espoo, Finland @@ -2015,9 +2015,9 @@ usage(void) { fprintf(stderr, "usage: ssh-agent [-c | -s] [-Ddx] [-a bind_address] [-E fingerprint_hash]\n" - " [-P allowed_providers] [-t life]\n" - " ssh-agent [-a bind_address] [-E fingerprint_hash] [-P allowed_providers]\n" - " [-t life] command [arg ...]\n" + " [-O option] [-P allowed_providers] [-t life]\n" + " ssh-agent [-a bind_address] [-E fingerprint_hash] [-O option]\n" + " [-P allowed_providers] [-t life] command [arg ...]\n" " ssh-agent [-c | -s] -k\n"); exit(1); }