[openssh-commits] [openssh] branch master updated: upstream: support FIDO tokens that return no attestation data, e.g.

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

The following commit(s) were added to refs/heads/master by this push:
     new d3a7ff7c upstream: support FIDO tokens that return no attestation data, e.g.
d3a7ff7c is described below

commit d3a7ff7cecbc23cc37044bdf02e7118d05bf3c35
Author: djm at openbsd.org <djm at openbsd.org>
AuthorDate: Tue Dec 3 08:31:49 2024 +0000

    upstream: support FIDO tokens that return no attestation data, e.g.
    
    recent WinHello. From Michael Braun via GHPR542
    
    OpenBSD-Commit-ID: a71b0542f2f7819ba0e33a88908e01b6fc49e4ce
---
 sk-usbhid.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/sk-usbhid.c b/sk-usbhid.c
index 36f089a5..427431b9 100644
--- a/sk-usbhid.c
+++ b/sk-usbhid.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sk-usbhid.c,v 1.46 2023/03/28 06:12:38 dtucker Exp $ */
+/* $OpenBSD: sk-usbhid.c,v 1.47 2024/12/03 08:31:49 djm Exp $ */
 /*
  * Copyright (c) 2019 Markus Friedl
  * Copyright (c) 2020 Pedro Martelletto
@@ -961,13 +961,15 @@ sk_enroll(uint32_t alg, const uint8_t *challenge, size_t challenge_len,
 			    fido_strerr(r));
 			goto out;
 		}
-	} else {
+	} else if (strcmp(fido_cred_fmt(cred), "none") != 0) {
 		skdebug(__func__, "self-attested credential");
 		if ((r = fido_cred_verify_self(cred)) != FIDO_OK) {
 			skdebug(__func__, "fido_cred_verify_self: %s",
 			    fido_strerr(r));
 			goto out;
 		}
+	} else {
+		skdebug(__func__, "no attestation data");
 	}
 	if ((response = calloc(1, sizeof(*response))) == NULL) {
 		skdebug(__func__, "calloc response failed");

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.