[openssh-commits] [openssh] 02/03: upstream: sk-usbhid: preserve UV requirement for resident keys

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit e1d1c95160f75e50890fad446aa2f89216037a9f
Author: djm at openbsd.org <djm at openbsd.org>
AuthorDate: Tue Sep 15 08:28:26 2026 +0000

    upstream: sk-usbhid: preserve UV requirement for resident keys
    
    When loading resident credentials, derive SSH_SK_USER_VERIFICATION_REQD
    directly from the credential's credProtect policy.
    
    The previous code only preserved the flag when the authenticator did not
    report the uv capability. As a result, UV_REQUIRED credentials downloaded
    from authenticators with built-in UV were saved with flags 0x21 instead
    of 0x25.
    
    Do not make preservation of the credential policy depend on the
    authenticator's current UV capability. Keep compatibility with libfido2
    versions without fido_cred_prot().
    
    GHPR701 from Savely Krasovsky
    
    OpenBSD-Commit-ID: ece9e236cdb6a2b7e973fdc266801f65a3feb12e
---
 sk-usbhid.c | 15 ++++++---------
 1 file changed, 6 insertions(+), 9 deletions(-)

diff --git a/sk-usbhid.c b/sk-usbhid.c
index 647f88f61..8691febf1 100644
--- a/sk-usbhid.c
+++ b/sk-usbhid.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sk-usbhid.c,v 1.49 2026/06/01 05:49:20 djm Exp $ */
+/* $OpenBSD: sk-usbhid.c,v 1.50 2026/09/15 08:28:26 djm Exp $ */
 /*
  * Copyright (c) 2019 Markus Friedl
  * Copyright (c) 2020 Pedro Martelletto
@@ -1252,7 +1252,7 @@ static int
 read_rks(struct sk_usbhid *sk, const char *pin,
     struct sk_resident_key ***rksp, size_t *nrksp)
 {
-	int ret = SSH_SK_ERR_GENERAL, r = -1, internal_uv;
+	int ret = SSH_SK_ERR_GENERAL, r = -1;
 	uint32_t alg;
 	fido_credman_metadata_t *metadata = NULL;
 	fido_credman_rp_t *rp = NULL;
@@ -1272,11 +1272,6 @@ read_rks(struct sk_usbhid *sk, const char *pin,
 		skdebug(__func__, "alloc failed");
 		goto out;
 	}
-	if (check_sk_options(sk->dev, "uv", &internal_uv) != 0) {
-		skdebug(__func__, "check_sk_options failed");
-		goto out;
-	}
-
 	if ((r = fido_credman_get_dev_metadata(sk->dev, metadata, pin)) != 0) {
 		if (r == FIDO_ERR_INVALID_COMMAND) {
 			skdebug(__func__, "device %s does not support "
@@ -1383,9 +1378,11 @@ read_rks(struct sk_usbhid *sk, const char *pin,
 			if (srk->user_id_len != 0)
 				memcpy(srk->user_id, user_id, srk->user_id_len);
 
-			if (fido_cred_prot(cred) == FIDO_CRED_PROT_UV_REQUIRED
-			    && internal_uv == -1)
+#ifdef HAVE_FIDO_CRED_PROT
+			if (fido_cred_prot(cred) ==
+			    FIDO_CRED_PROT_UV_REQUIRED)
 				srk->flags |=  SSH_SK_USER_VERIFICATION_REQD;
+#endif
 
 			if ((r = pack_public_key(srk->alg, cred,
 			    &srk->key)) != 0) {

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.