upstream: revert unconditional forced login implemented in r1.41 of

ssh-pkcs11.c; r1.45 added a forced login as a fallback for cases where the
token returns no objects and this is less disruptive for users of tokens
directly in ssh (rather than via ssh-agent) and in ssh-keygen

bz3006, patch from Jakub Jelen; ok markus

OpenBSD-Commit-ID: 33d6df589b072094384631ff93b1030103b3d02e

diff --git a/ssh-pkcs11.c b/ssh-pkcs11.c
index d4053ea829a50af5a1a3f7058935464e47ac3a86..09f1ea347cfab29af37eed0c0d2b1b8ead6cb96b 100644 (file)
--- a/ssh-pkcs11.c
+++ b/ssh-pkcs11.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-pkcs11.c,v 1.45 2019/09/05 10:05:51 djm Exp $ */
+/* $OpenBSD: ssh-pkcs11.c,v 1.46 2019/10/01 10:22:53 djm Exp $ */
 /*
  * Copyright (c) 2010 Markus Friedl.  All rights reserved.
  * Copyright (c) 2014 Pedro Martelletto. All rights reserved.
@@ -633,17 +633,15 @@ pkcs11_open_session(struct pkcs11_provider *p, CK_ULONG slotidx, char *pin,
        CK_FUNCTION_LIST        *f;
        CK_RV                   rv;
        CK_SESSION_HANDLE       session;
-       int                     login_required, have_pinpad, ret;
-       char                    prompt[1024], *xpin = NULL;
+       int                     login_required, ret;
 
        f = p->function_list;
        si = &p->slotinfo[slotidx];
 
-       have_pinpad = si->token.flags & CKF_PROTECTED_AUTHENTICATION_PATH;
        login_required = si->token.flags & CKF_LOGIN_REQUIRED;
 
        /* fail early before opening session */
-       if (login_required && !have_pinpad && !pkcs11_interactive &&
+       if (login_required && !pkcs11_interactive &&
            (pin == NULL || strlen(pin) == 0)) {
                error("pin required");
                return (-SSH_PKCS11_ERR_PIN_REQUIRED);
@@ -653,27 +651,8 @@ pkcs11_open_session(struct pkcs11_provider *p, CK_ULONG slotidx, char *pin,
                error("C_OpenSession failed: %lu", rv);
                return (-1);
        }
-       if (login_required) {
-               if (have_pinpad && (pin == NULL || strlen(pin) == 0)) {
-                       /* defer PIN entry to the reader keypad */
-                       rv = f->C_Login(session, CKU_USER, NULL_PTR, 0);
-               } else {
-                       if (pkcs11_interactive) {
-                               snprintf(prompt, sizeof(prompt),
-                                   "Enter PIN for '%s': ", si->token.label);
-                               if ((xpin = read_passphrase(prompt,
-                                   RP_ALLOW_EOF)) == NULL) {
-                                       debug("%s: no pin specified",
-                                           __func__);
-                                       return (-SSH_PKCS11_ERR_PIN_REQUIRED);
-                               }
-                               pin = xpin;
-                       }
-                       rv = f->C_Login(session, CKU_USER,
-                           (u_char *)pin, strlen(pin));
-                       if (xpin != NULL)
-                               freezero(xpin, strlen(xpin));
-               }
+       if (login_required && pin != NULL && strlen(pin) != 0) {
+               rv = f->C_Login(session, user, (u_char *)pin, strlen(pin));
                if (rv != CKR_OK && rv != CKR_USER_ALREADY_LOGGED_IN) {
                        error("C_Login failed: %lu", rv);
                        ret = (rv == CKR_PIN_LOCKED) ?