===================================================================
RCS file: /cvsrepo/anoncvs/cvs/src/usr.bin/ssh/ssh-agent.c,v
retrieving revision 1.292.4.1
retrieving revision 1.293
diff -u -r1.292.4.1 -r1.293
--- src/usr.bin/ssh/ssh-agent.c	2023/07/19 14:08:59	1.292.4.1
+++ src/usr.bin/ssh/ssh-agent.c	2022/10/07 06:00:58	1.293
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-agent.c,v 1.292.4.1 2023/07/19 14:08:59 bluhm Exp $ */
+/* $OpenBSD: ssh-agent.c,v 1.293 2022/10/07 06:00:58 jmc Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -158,12 +158,6 @@
 /* Pattern-list of allowed PKCS#11/Security key paths */
 static char *allowed_providers;
 
-/*
- * Allows PKCS11 providers or SK keys that use non-internal providers to
- * be added over a remote connection (identified by session-bind@openssh.com).
- */
-static int remote_add_provider;
-
 /* locking */
 #define LOCK_SIZE	32
 #define LOCK_SALT_SIZE	16
@@ -1223,12 +1217,6 @@
 		if (strcasecmp(sk_provider, "internal") == 0) {
 			debug_f("internal provider");
 		} else {
-			if (e->nsession_ids != 0 && !remote_add_provider) {
-				verbose("failed add of SK provider \"%.100s\": "
-				    "remote addition of providers is disabled",
-				    sk_provider);
-				goto out;
-			}
 			if (realpath(sk_provider, canonical_provider) == NULL) {
 				verbose("failed provider \"%.100s\": "
 				    "realpath: %s", sk_provider,
@@ -1392,11 +1380,6 @@
 		error_f("failed to parse constraints");
 		goto send;
 	}
-	if (e->nsession_ids != 0 && !remote_add_provider) {
-		verbose("failed PKCS#11 add of \"%.100s\": remote addition of "
-		    "providers is disabled", provider);
-		goto send;
-	}
 	if (realpath(provider, canonical_provider) == NULL) {
 		verbose("failed PKCS#11 add of \"%.100s\": realpath: %s",
 		    provider, strerror(errno));
@@ -1996,9 +1979,9 @@
 {
 	fprintf(stderr,
 	    "usage: ssh-agent [-c | -s] [-Dd] [-a bind_address] [-E fingerprint_hash]\n"
-	    "                 [-P allowed_providers] [-t life]\n"
-	    "       ssh-agent [-a bind_address] [-E fingerprint_hash] [-P allowed_providers]\n"
-	    "                 [-t life] command [arg ...]\n"
+	    "                 [-O option] [-P allowed_providers] [-t life]\n"
+	    "       ssh-agent [-a bind_address] [-E fingerprint_hash] [-O option]\n"
+	    "                 [-P allowed_providers] [-t life] command [arg ...]\n"
 	    "       ssh-agent [-c | -s] -k\n");
 	exit(1);
 }
@@ -2052,9 +2035,7 @@
 			break;
 		case 'O':
 			if (strcmp(optarg, "no-restrict-websafe") == 0)
-				restrict_websafe = 0;
-			else if (strcmp(optarg, "allow-remote-pkcs11") == 0)
-				remote_add_provider = 1;
+				restrict_websafe  = 0;
 			else
 				fatal("Unknown -O option");
 			break;