The branch stable/13 has been updated by emaste:

URL: 
https://cgit.FreeBSD.org/src/commit/?id=a613d68fff9af03730e1c18438f85d80649547e4

commit a613d68fff9af03730e1c18438f85d80649547e4
Author:     Ed Maste <ema...@freebsd.org>
AuthorDate: 2021-10-07 03:31:17 +0000
Commit:     Ed Maste <ema...@freebsd.org>
CommitDate: 2022-02-10 00:03:21 +0000

    ssh: enable FIDO/U2F keys
    
    Description of FIDO/U2F support (from OpenSSH 8.2 release notes,
    https://www.openssh.com/txt/release-8.2):
    
      This release adds support for FIDO/U2F hardware authenticators to
      OpenSSH. U2F/FIDO are open standards for inexpensive two-factor
      authentication hardware that are widely used for website
      authentication.  In OpenSSH FIDO devices are supported by new public
      key types "ecdsa-sk" and "ed25519-sk", along with corresponding
      certificate types.
    
      ssh-keygen(1) may be used to generate a FIDO token-backed key, after
      which they may be used much like any other key type supported by
      OpenSSH, so long as the hardware token is attached when the keys are
      used. FIDO tokens also generally require the user explicitly
      authorise operations by touching or tapping them.
    
      Generating a FIDO key requires the token be attached, and will
      usually require the user tap the token to confirm the operation:
    
        $ ssh-keygen -t ecdsa-sk -f ~/.ssh/id_ecdsa_sk
        Generating public/private ecdsa-sk key pair.
        You may need to touch your security key to authorize key generation.
        Enter file in which to save the key (/home/djm/.ssh/id_ecdsa_sk):
        Enter passphrase (empty for no passphrase):
        Enter same passphrase again:
        Your identification has been saved in /home/djm/.ssh/id_ecdsa_sk
        Your public key has been saved in /home/djm/.ssh/id_ecdsa_sk.pub
    
      This will yield a public and private key-pair. The private key file
      should be useless to an attacker who does not have access to the
      physical token. After generation, this key may be used like any
      other supported key in OpenSSH and may be listed in authorized_keys,
      added to ssh-agent(1), etc. The only additional stipulation is that
      the FIDO token that the key belongs to must be attached when the key
      is used.
    
    To enable FIDO/U2F support, this change regenerates ssh_namespace.h,
    adds ssh-sk-helper, and sets ENABLE_SK_INTERNAL (unless building
    WITHOUT_USB).
    
    devd integration is not included in this change, and is under
    investigation for the base system.  In the interim the security/u2f-devd
    port can be installed to provide appropriate devd rules.
    
    Reviewed by:    delphij, kevans
    Relnotes:       Yes
    Sponsored by:   The FreeBSD Foundation
    Differential Revision:  https://reviews.freebsd.org/D32509
    
    (cherry picked from commit e9a994639b2af232f994ba2ad23ca45a17718d2b)
---
 crypto/openssh/ssh_namespace.h           | 12 ++++++++++++
 secure/libexec/Makefile                  |  2 +-
 secure/libexec/ssh-sk-helper/Makefile    | 16 ++++++++++++++++
 secure/ssh.mk                            |  6 ++++++
 tools/build/mk/OptionalObsoleteFiles.inc |  2 ++
 5 files changed, 37 insertions(+), 1 deletion(-)

diff --git a/crypto/openssh/ssh_namespace.h b/crypto/openssh/ssh_namespace.h
index 2c2060567460..94a391ee5f45 100644
--- a/crypto/openssh/ssh_namespace.h
+++ b/crypto/openssh/ssh_namespace.h
@@ -87,6 +87,10 @@
 #define chacha_encrypt_bytes                   Fssh_chacha_encrypt_bytes
 #define chacha_ivsetup                         Fssh_chacha_ivsetup
 #define chacha_keysetup                                Fssh_chacha_keysetup
+#define chachapoly_crypt                       Fssh_chachapoly_crypt
+#define chachapoly_free                                Fssh_chachapoly_free
+#define chachapoly_get_length                  Fssh_chachapoly_get_length
+#define chachapoly_new                         Fssh_chachapoly_new
 #define chan_ibuf_empty                                Fssh_chan_ibuf_empty
 #define chan_is_dead                           Fssh_chan_is_dead
 #define chan_mark_dead                         Fssh_chan_mark_dead
@@ -553,8 +557,10 @@
 #define ssh_dss_sign                           Fssh_ssh_dss_sign
 #define ssh_dss_verify                         Fssh_ssh_dss_verify
 #define ssh_ecdsa_sign                         Fssh_ssh_ecdsa_sign
+#define ssh_ecdsa_sk_verify                    Fssh_ssh_ecdsa_sk_verify
 #define ssh_ecdsa_verify                       Fssh_ssh_ecdsa_verify
 #define ssh_ed25519_sign                       Fssh_ssh_ed25519_sign
+#define ssh_ed25519_sk_verify                  Fssh_ssh_ed25519_sk_verify
 #define ssh_ed25519_verify                     Fssh_ssh_ed25519_verify
 #define ssh_err                                        Fssh_ssh_err
 #define ssh_fetch_identitylist                 Fssh_ssh_fetch_identitylist
@@ -871,6 +877,12 @@
 #define sshpkt_start                           Fssh_sshpkt_start
 #define sshpkt_vfatal                          Fssh_sshpkt_vfatal
 #define sshsigdie                              Fssh_sshsigdie
+#define sshsk_add_option                       Fssh_sshsk_add_option
+#define sshsk_enroll                           Fssh_sshsk_enroll
+#define sshsk_key_from_response                        
Fssh_sshsk_key_from_response
+#define sshsk_load_resident                    Fssh_sshsk_load_resident
+#define sshsk_open                             Fssh_sshsk_open
+#define sshsk_sign                             Fssh_sshsk_sign
 #define start_progress_meter                   Fssh_start_progress_meter
 #define stdfd_devnull                          Fssh_stdfd_devnull
 #define stop_progress_meter                    Fssh_stop_progress_meter
diff --git a/secure/libexec/Makefile b/secure/libexec/Makefile
index 3438b412d5da..f07454db3643 100644
--- a/secure/libexec/Makefile
+++ b/secure/libexec/Makefile
@@ -4,7 +4,7 @@
 
 SUBDIR=
 .if ${MK_OPENSSH} != "no"
-SUBDIR+=sftp-server ssh-keysign ssh-pkcs11-helper
+SUBDIR+=sftp-server ssh-keysign ssh-pkcs11-helper ssh-sk-helper
 .endif
 
 SUBDIR.${MK_TESTS}+= tests
diff --git a/secure/libexec/ssh-sk-helper/Makefile 
b/secure/libexec/ssh-sk-helper/Makefile
new file mode 100644
index 000000000000..622b0ac682bd
--- /dev/null
+++ b/secure/libexec/ssh-sk-helper/Makefile
@@ -0,0 +1,16 @@
+.include <src.opts.mk>
+.include "${SRCTOP}/secure/ssh.mk"
+
+PROG=  ssh-sk-helper
+SRCS=  ssh-sk-helper.c ssh-sk.c sk-usbhid.c
+MAN=   ssh-sk-helper.8
+CFLAGS+=-I${SRCTOP}/contrib/libfido2/src
+
+LIBADD=        ssh crypto z
+.if ${MK_USB} != "no"
+LIBADD+= fido2 cbor
+.endif
+
+.include <bsd.prog.mk>
+
+.PATH: ${SSHDIR}
diff --git a/secure/ssh.mk b/secure/ssh.mk
index 4ab8cd399ae8..822946253263 100644
--- a/secure/ssh.mk
+++ b/secure/ssh.mk
@@ -1,6 +1,12 @@
 # Common Make variables for OpenSSH
 
+.include <src.opts.mk>
+
 SSHDIR=                ${SRCTOP}/crypto/openssh
 
 CFLAGS+= -I${SSHDIR} -include ssh_namespace.h
 SRCS+=  ssh_namespace.h
+
+.if ${MK_USB} != "no"
+CFLAGS+=       -DENABLE_SK_INTERNAL=1
+.endif
diff --git a/tools/build/mk/OptionalObsoleteFiles.inc 
b/tools/build/mk/OptionalObsoleteFiles.inc
index 972a58a330dc..21336b55fb89 100644
--- a/tools/build/mk/OptionalObsoleteFiles.inc
+++ b/tools/build/mk/OptionalObsoleteFiles.inc
@@ -7220,6 +7220,7 @@ OLD_FILES+=usr/lib32/libprivatessh_p.a
 OLD_FILES+=usr/libexec/sftp-server
 OLD_FILES+=usr/libexec/ssh-keysign
 OLD_FILES+=usr/libexec/ssh-pkcs11-helper
+OLD_FILES+=usr/libexec/ssh-sk-helper
 OLD_FILES+=usr/sbin/sshd
 OLD_FILES+=usr/share/man/man1/scp.1.gz
 OLD_FILES+=usr/share/man/man1/sftp.1.gz
@@ -7236,6 +7237,7 @@ OLD_FILES+=usr/share/man/man8/pam_ssh.8.gz
 OLD_FILES+=usr/share/man/man8/sftp-server.8.gz
 OLD_FILES+=usr/share/man/man8/ssh-keysign.8.gz
 OLD_FILES+=usr/share/man/man8/ssh-pkcs11-helper.8.gz
+OLD_FILES+=usr/share/man/man8/ssh-sk-helper.8.gz
 OLD_FILES+=usr/share/man/man8/sshd.8.gz
 .endif
 

Reply via email to