diff options
| author | djm@openbsd.org <djm@openbsd.org> | 2019-12-30 10:24:45 +0100 |
|---|---|---|
| committer | Damien Miller <djm@mindrot.org> | 2019-12-30 11:01:51 +0100 |
| commit | 43ce96427b76c4918e39af654e2fc9ee18d5d478 (patch) | |
| tree | dfb3a5b32e02368f9739bb742e0aa858ced03701 /ssh-keygen.c | |
| parent | upstream: improve some error messages; ok markus@ (diff) | |
| download | openssh-43ce96427b76c4918e39af654e2fc9ee18d5d478.tar.xz openssh-43ce96427b76c4918e39af654e2fc9ee18d5d478.zip | |
upstream: translate and return error codes; retry on bad PIN
Define some well-known error codes in the SK API and pass
them back via ssh-sk-helper.
Use the new "wrong PIN" error code to retry PIN prompting during
ssh-keygen of resident keys.
feedback and ok markus@
OpenBSD-Commit-ID: 9663c6a2bb7a0bc8deaccc6c30d9a2983b481620
Diffstat (limited to 'ssh-keygen.c')
| -rw-r--r-- | ssh-keygen.c | 32 |
1 files changed, 21 insertions, 11 deletions
diff --git a/ssh-keygen.c b/ssh-keygen.c index 79e2e92b5..696891e0e 100644 --- a/ssh-keygen.c +++ b/ssh-keygen.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ssh-keygen.c,v 1.378 2019/12/30 09:23:28 djm Exp $ */ +/* $OpenBSD: ssh-keygen.c,v 1.379 2019/12/30 09:24:45 djm Exp $ */ /* * Author: Tatu Ylonen <ylo@cs.hut.fi> * Copyright (c) 1994 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland @@ -3361,16 +3361,26 @@ main(int argc, char **argv) switch (type) { case KEY_ECDSA_SK: case KEY_ED25519_SK: - if (!quiet) { - printf("You may need to touch your security key " - "to authorize key generation.\n"); - } - fflush(stdout); - if (sshsk_enroll(type, sk_provider, - cert_key_id == NULL ? "ssh:" : cert_key_id, - sk_flags, NULL, NULL, &private, NULL) != 0) - exit(1); /* error message already printed */ - break; + passphrase1 = NULL; + for (i = 0 ; i < 3; i++) { + if (!quiet) { + printf("You may need to touch your security " + "key to authorize key generation.\n"); + } + fflush(stdout); + r = sshsk_enroll(type, sk_provider, + cert_key_id == NULL ? "ssh:" : cert_key_id, + sk_flags, passphrase1, NULL, &private, NULL); + if (r == 0) + break; + if (r != SSH_ERR_KEY_WRONG_PASSPHRASE) + exit(1); /* error message already printed */ + passphrase1 = read_passphrase("Enter PIN for security " + "key: ", RP_ALLOW_STDIN); + } + if (i > 3) + fatal("Too many incorrect PINs"); + break; default: if ((r = sshkey_generate(type, bits, &private)) != 0) fatal("sshkey_generate failed"); |