src/usr.bin/ssh/ssh-keygen.c - diff

Return to ssh-keygen.c CVS log

Up to [local] / src / usr.bin / ssh

Diff for /src/usr.bin/ssh/ssh-keygen.c between version 1.67 and 1.113.2.1

version 1.67, 2001/06/27 05:35:42

version 1.113.2.1, 2004/08/19 04:13:27

Line 17

#include <openssl/evp.h>

#include <openssl/pem.h>

#ifdef SMARTCARD

#include <sectok.h>

#endif

#include "xmalloc.h"

#include "key.h"

#include "rsa.h"

Line 30

Line 26

#include "bufaux.h"

#include "pathnames.h"

#include "log.h"

#include "readpass.h"

#include "misc.h"

#ifdef SMARTCARD

#include "scard.h"

#endif

#include "dns.h"

/* Number of bits in the RSA/DSA key. This value can be changed on the command line. */

int bits = 1024;

Line 71

int convert_to_ssh2 = 0;

int convert_from_ssh2 = 0;

int print_public = 0;

int print_generic = 0;

/* default to RSA for SSH-1 */

char *key_type_name = NULL;

char *key_type_name = "rsa1";

/* argv0 */

extern char *__progname;

char hostname[MAXHOSTNAMELEN];

/* moduli.c */

int gen_candidates(FILE *, int, int, BIGNUM *);

int prime_test(FILE *, FILE *, u_int32_t, u_int32_t);

static void

ask_filename(struct passwd *pw, const char *prompt)

{

char buf[1024];

char *name = NULL;

switch (key_type_from_name(key_type_name)) {

if (key_type_name == NULL)

case KEY_RSA1:

name = _PATH_SSH_CLIENT_IDENTITY;

break;

case KEY_DSA:

name = _PATH_SSH_CLIENT_ID_DSA;

break;

case KEY_RSA:

name = _PATH_SSH_CLIENT_ID_RSA;

break;

else

default:

switch (key_type_from_name(key_type_name)) {

fprintf(stderr, "bad key type");

case KEY_RSA1:

exit(1);

name = _PATH_SSH_CLIENT_IDENTITY;

break;

}

case KEY_DSA:

name = _PATH_SSH_CLIENT_ID_DSA;

break;

case KEY_RSA:

name = _PATH_SSH_CLIENT_ID_RSA;

break;

default:

fprintf(stderr, "bad key type");

exit(1);

break;

}

snprintf(identity_file, sizeof(identity_file), "%s/%s", pw->pw_dir, name);

fprintf(stderr, "%s (%s): ", prompt, identity_file);

fflush(stderr);

if (fgets(buf, sizeof(buf), stdin) == NULL)

exit(1);

if (strchr(buf, '\n'))

Line 134

Line 141

}

#define SSH_COM_PUBLIC_BEGIN "---- BEGIN SSH2 PUBLIC KEY ----"

#define SSH_COM_PUBLIC_END "---- END SSH2 PUBLIC KEY ----"

#define SSH_COM_PRIVATE_BEGIN "---- BEGIN SSH2 ENCRYPTED PRIVATE KEY ----"

#define SSH_COM_PRIVATE_KEY_MAGIC 0x3f6ff9eb

Line 142

Line 149

do_convert_to_ssh2(struct passwd *pw)

{

Key *k;

int len;

u_int len;

u_char *blob;

struct stat st;

Line 158

Line 165

exit(1);

}

key_to_blob(k, &blob, &len);

if (k->type == KEY_RSA1) {

fprintf(stderr, "version 1 keys are not supported\n");

exit(1);

}

if (key_to_blob(k, &blob, &len) <= 0) {

fprintf(stderr, "key_to_blob failed\n");

exit(1);

}

fprintf(stdout, "%s\n", SSH_COM_PUBLIC_BEGIN);

fprintf(stdout,

"Comment: \"%d-bit %s, converted from OpenSSH by %s@%s\"\n",

"Comment: \"%u-bit %s, converted from OpenSSH by %s@%s\"\n",

key_size(k), key_type(k),

pw->pw_name, hostname);

dump_base64(stdout, blob, len);

Line 174

Line 188

static void

buffer_get_bignum_bits(Buffer *b, BIGNUM *value)

{

int bits = buffer_get_int(b);

u_int bignum_bits = buffer_get_int(b);

int bytes = (bits + 7) / 8;

u_int bytes = (bignum_bits + 7) / 8;

if (buffer_len(b) < bytes)

fatal("buffer_get_bignum_bits: input buffer too small: "

"need %d have %d", bytes, buffer_len(b));

BN_bin2bn((u_char *)buffer_ptr(b), bytes, value);

BN_bin2bn(buffer_ptr(b), bytes, value);

buffer_consume(b, bytes);

}

static Key *

do_convert_private_ssh2_from_blob(char *blob, int blen)

do_convert_private_ssh2_from_blob(u_char *blob, u_int blen)

{

Buffer b;

Key *key = NULL;

char *type, *cipher;

u_char *sig, data[10] = "abcde12345";

u_char *sig, data[] = "abcde12345";

int magic, rlen, ktype, i1, i2, i3, i4;

u_int slen;

u_long e;

Line 260

Line 274

buffer_get_bignum_bits(&b, key->rsa->iqmp);

buffer_get_bignum_bits(&b, key->rsa->q);

buffer_get_bignum_bits(&b, key->rsa->p);

generate_additional_parameters(key->rsa);

rsa_generate_additional_parameters(key->rsa);

break;

}

rlen = buffer_len(&b);

if(rlen != 0)

if (rlen != 0)

error("do_convert_private_ssh2_from_blob: "

"remaining bytes in key blob %d", rlen);

buffer_free(&b);

Line 281

Line 295

{

Key *k;

int blen;

u_int len;

char line[1024], *p;

char blob[8096];

u_char blob[8096];

char encoded[8096];

struct stat st;

int escaped = 0, private = 0, ok;

Line 325

Line 340

*p = '\0';

strlcat(encoded, line, sizeof(encoded));

}

blen = uudecode(encoded, (u_char *)blob, sizeof(blob));

len = strlen(encoded);

if (((len % 4) == 3) &&

(encoded[len-1] == '=') &&

(encoded[len-2] == '=') &&

(encoded[len-3] == '='))

encoded[len-3] = '\0';

blen = uudecode(encoded, blob, sizeof(blob));

if (blen < 0) {

fprintf(stderr, "uudecode failed.\n");

exit(1);

Line 347

Line 368

exit(1);

}

key_free(k);

fprintf(stdout, "\n");

if (!private)

fprintf(stdout, "\n");

fclose(fp);

exit(0);

}

Line 376

Line 398

exit(0);

}

#define NUM_RSA_KEY_ELEMENTS 5+1

#ifdef SMARTCARD

#define COPY_RSA_KEY(x, i) \

do { \

len = BN_num_bytes(prv->rsa->x); \

elements[i] = xmalloc(len); \

error("#bytes %d", len); \

if (BN_bn2bin(prv->rsa->x, elements[i]) < 0) \

goto done; \

} while(0)

static void

do_upload(struct passwd *pw, int reader)

do_upload(struct passwd *pw, const char *sc_reader_id)

{

#ifndef SMARTCARD

fatal("no support for smartcards.");

#else

Key *prv = NULL;

struct stat st;

u_char *elements[NUM_RSA_KEY_ELEMENTS];

int ret;

u_char key_fid[2];

u_char atr[256];

u_char AUT0[] = {0xad, 0x9f, 0x61, 0xfe, 0xfa, 0x20, 0xce, 0x63};

int len, status = 1, i, fd = -1, ret;

int cla = 0x00;

if (!have_identity)

ask_filename(pw, "Enter file in which the key is");

if (stat(identity_file, &st) < 0) {

perror(identity_file);

goto done;

exit(1);

}

prv = load_identity(identity_file);

if (prv == NULL) {

error("load failed");

goto done;

exit(1);

}

for (i = 0; i < NUM_RSA_KEY_ELEMENTS; i++)

ret = sc_put_key(prv, sc_reader_id);

elements[i] = NULL;

key_free(prv);

COPY_RSA_KEY(q, 0);

if (ret < 0)

COPY_RSA_KEY(p, 1);

exit(1);

COPY_RSA_KEY(iqmp, 2);

logit("loading key done");

COPY_RSA_KEY(dmq1, 3);

exit(0);

COPY_RSA_KEY(dmp1, 4);

}

COPY_RSA_KEY(n, 5);

len = BN_num_bytes(prv->rsa->n);

static void

fd = scopen(reader, 0, NULL);

do_download(struct passwd *pw, const char *sc_reader_id)

if (fd < 0) {

{

error("scopen failed %d.", fd);

Key **keys = NULL;

goto done;

int i;

}

ret = screset(fd, atr, NULL);

keys = sc_get_keys(sc_reader_id, NULL);

if (ret <= 0) {

if (keys == NULL)

error("screset failed.");

fatal("cannot read public key from smartcard");

goto done;

for (i = 0; keys[i]; i++) {

}

key_write(keys[i], stdout);

if ((cla = cyberflex_inq_class(fd)) < 0) {

key_free(keys[i]);

error("cyberflex_inq_class failed");

fprintf(stdout, "\n");

goto done;

}

if (cyberflex_verify_AUT0(fd, cla, AUT0, sizeof(AUT0)) < 0) {

xfree(keys);

error("cyberflex_verify_AUT0 failed");

exit(0);

goto done;

}

key_fid[0] = 0x00;

key_fid[1] = 0x12;

if (cyberflex_load_rsa_priv(fd, cla, key_fid, 5, 8*len, elements) < 0)

goto done;

log("cyberflex_load_rsa_priv done");

key_fid[0] = 0x73;

key_fid[1] = 0x68;

if (cyberflex_load_rsa_pub(fd, cla, key_fid, len, elements[5]) < 0)

goto done;

log("cyberflex_load_rsa_pub done");

status = 0;

log("loading key done");

done:

if (prv)

key_free(prv);

for (i = 0; i < NUM_RSA_KEY_ELEMENTS; i++)

xfree(elements[i]);

if (fd != -1)

scclose(fd);

exit(status);

#endif

}

#endif /* SMARTCARD */

static void

do_fingerprint(struct passwd *pw)

Line 468

Line 450

FILE *f;

Key *public;

char *comment = NULL, *cp, *ep, line[16*1024], *fp;

int i, skip = 0, num = 1, invalid = 1, rep, fptype;

int i, skip = 0, num = 1, invalid = 1;

enum fp_rep rep;

enum fp_type fptype;

struct stat st;

fptype = print_bubblebabble ? SSH_FP_SHA1 : SSH_FP_MD5;

Line 483

Line 467

public = key_load_public(identity_file, &comment);

if (public != NULL) {

fp = key_fingerprint(public, fptype, rep);

printf("%d %s %s\n", key_size(public), fp, comment);

printf("%u %s %s\n", key_size(public), fp, comment);

key_free(public);

xfree(comment);

xfree(fp);

Line 517

Line 501

if (i == 0 || ep == NULL || (*ep != ' ' && *ep != '\t')) {

int quoted = 0;

comment = cp;

for (; *cp && (quoted || (*cp != ' ' && *cp != '\t')); cp++) {

for (; *cp && (quoted || (*cp != ' ' &&

*cp != '\t')); cp++) {

if (*cp == '\\' && cp[1] == '"')

cp++; /* Skip both */

else if (*cp == '"')

Line 540

Line 525

}

comment = *cp ? cp : comment;

fp = key_fingerprint(public, fptype, rep);

printf("%d %s %s\n", key_size(public), fp,

printf("%u %s %s\n", key_size(public), fp,

comment ? comment : "no comment");

xfree(fp);

key_free(public);

Line 549

Line 534

fclose(f);

}

if (invalid) {

printf("%s is not a valid key file.\n", identity_file);

printf("%s is not a public key file.\n", identity_file);

exit(1);

}

exit(0);

Line 602

Line 587

read_passphrase("Enter new passphrase (empty for no "

"passphrase): ", RP_ALLOW_STDIN);

passphrase2 = read_passphrase("Enter same passphrase again: ",

RP_ALLOW_STDIN);

/* Verify that they are the same. */

if (strcmp(passphrase1, passphrase2) != 0) {

Line 638

Line 623

}

* Print the SSHFP RR.

static void

do_print_resource_record(struct passwd *pw, char *hname)

{

Key *public;

char *comment = NULL;

struct stat st;

if (!have_identity)

ask_filename(pw, "Enter file in which the key is");

if (stat(identity_file, &st) < 0) {

perror(identity_file);

exit(1);

}

public = key_load_public(identity_file, &comment);

if (public != NULL) {

export_dns_rr(hname, public, stdout, print_generic);

key_free(public);

xfree(comment);

exit(0);

}

if (comment)

xfree(comment);

printf("failed to read v2 public key from %s.\n", identity_file);

exit(1);

}

* Change the comment of a private key file.

static void

Line 680

Line 695

fprintf(stderr, "Comments are only supported for RSA1 keys.\n");

key_free(private);

exit(1);

}

printf("Key now has comment '%s'\n", comment);

if (identity_comment) {

Line 737

Line 752

static void

usage(void)

{

printf("Usage: %s [-ceilpqyB] [-t type] [-b bits] [-f file] [-C comment] "

fprintf(stderr, "Usage: %s [options]\n", __progname);

"[-N new-pass] [-P pass]\n", __progname);

fprintf(stderr, "Options:\n");

fprintf(stderr, " -b bits Number of bits in the key to create.\n");

fprintf(stderr, " -c Change comment in private and public key files.\n");

fprintf(stderr, " -e Convert OpenSSH to IETF SECSH key file.\n");

fprintf(stderr, " -f filename Filename of the key file.\n");

fprintf(stderr, " -g Use generic DNS resource record format.\n");

fprintf(stderr, " -i Convert IETF SECSH to OpenSSH key file.\n");

fprintf(stderr, " -l Show fingerprint of key file.\n");

fprintf(stderr, " -p Change passphrase of private key file.\n");

fprintf(stderr, " -q Quiet.\n");

fprintf(stderr, " -y Read private key file and print public key.\n");

fprintf(stderr, " -t type Specify type of key to create.\n");

fprintf(stderr, " -B Show bubblebabble digest of key file.\n");

fprintf(stderr, " -C comment Provide new comment.\n");

fprintf(stderr, " -N phrase Provide new passphrase.\n");

fprintf(stderr, " -P phrase Provide old passphrase.\n");

fprintf(stderr, " -r hostname Print DNS resource record.\n");

#ifdef SMARTCARD

fprintf(stderr, " -D reader Download public key from smartcard.\n");

fprintf(stderr, " -U reader Upload private key to smartcard.\n");

#endif /* SMARTCARD */

fprintf(stderr, " -G file Generate candidates for DH-GEX moduli\n");

fprintf(stderr, " -T file Screen candidates for DH-GEX moduli\n");

exit(1);

}

Line 748

Line 787

int

main(int ac, char **av)

{

char dotsshdir[16 * 1024], comment[1024], *passphrase1, *passphrase2;

char dotsshdir[MAXPATHLEN], comment[1024], *passphrase1, *passphrase2;

char out_file[MAXPATHLEN], *reader_id = NULL;

char *resource_record_hostname = NULL;

Key *private, *public;

struct passwd *pw;

int opt, type, fd, reader = -1;

struct stat st;

int opt, type, fd, download = 0, memory = 0;

int generator_wanted = 0, trials = 100;

int do_gen_candidates = 0, do_screen_candidates = 0;

int log_level = SYSLOG_LEVEL_INFO;

BIGNUM *start = NULL;

FILE *f;

extern int optind;

extern char *optarg;

SSLeay_add_all_algorithms();

log_init(av[0], SYSLOG_LEVEL_INFO, SYSLOG_FACILITY_USER, 1);

/* we need this for the home * directory. */

pw = getpwuid(getuid());

Line 771

Line 817

exit(1);

}

while ((opt = getopt(ac, av, "deiqpclBRxXyb:f:t:u:P:N:C:")) != -1) {

while ((opt = getopt(ac, av,

"degiqpclBRvxXyb:f:t:U:D:P:N:C:r:g:T:G:M:S:a:W:")) != -1) {

switch (opt) {

case 'b':

bits = atoi(optarg);

Line 796

Line 843

strlcpy(identity_file, optarg, sizeof(identity_file));

have_identity = 1;

break;

case 'g':

print_generic = 1;

break;

case 'P':

identity_passphrase = optarg;

break;

Line 831

Line 881

case 't':

key_type_name = optarg;

break;

case 'u':

case 'D':

reader = atoi(optarg); /*XXX*/

download = 1;

case 'U':

reader_id = optarg;

break;

case 'v':

if (log_level == SYSLOG_LEVEL_INFO)

log_level = SYSLOG_LEVEL_DEBUG1;

else {

if (log_level >= SYSLOG_LEVEL_DEBUG1 &&

log_level < SYSLOG_LEVEL_DEBUG3)

log_level++;

}

break;

case 'r':

resource_record_hostname = optarg;

break;

case 'W':

generator_wanted = atoi(optarg);

if (generator_wanted < 1)

fatal("Desired generator has bad value.");

break;

case 'a':

trials = atoi(optarg);

break;

case 'M':

memory = atoi(optarg);

break;

case 'G':

do_gen_candidates = 1;

strlcpy(out_file, optarg, sizeof(out_file));

break;

case 'T':

do_screen_candidates = 1;

strlcpy(out_file, optarg, sizeof(out_file));

break;

case 'S':

/* XXX - also compare length against bits */

if (BN_hex2bn(&start, optarg) == 0)

fatal("Invalid start point.");

break;

case '?':

default:

usage();

}

/* reinit */

log_init(av[0], log_level, SYSLOG_FACILITY_USER, 1);

if (optind < ac) {

printf("Too many arguments.\n");

usage();

Line 859

Line 951

do_convert_from_ssh2(pw);

if (print_public)

do_print_public(pw);

if (reader != -1)

if (resource_record_hostname != NULL) {

do_upload(pw, reader);

do_print_resource_record(pw, resource_record_hostname);

}

if (reader_id != NULL) {

#ifdef SMARTCARD

if (download)

do_download(pw, reader_id);

else

do_upload(pw, reader_id);

#else /* SMARTCARD */

fatal("no support for smartcards.");

#endif /* SMARTCARD */

}

if (do_gen_candidates) {

FILE *out = fopen(out_file, "w");

if (out == NULL) {

error("Couldn't open modulus candidate file \"%s\": %s",

out_file, strerror(errno));

return (1);

}

if (gen_candidates(out, memory, bits, start) != 0)

fatal("modulus candidate generation failed\n");

return (0);

}

if (do_screen_candidates) {

FILE *in;

FILE *out = fopen(out_file, "w");

if (have_identity && strcmp(identity_file, "-") != 0) {

if ((in = fopen(identity_file, "r")) == NULL) {

fatal("Couldn't open modulus candidate "

"file \"%s\": %s", identity_file,

strerror(errno));

}

} else

in = stdin;

if (out == NULL) {

fatal("Couldn't open moduli file \"%s\": %s",

out_file, strerror(errno));

}

if (prime_test(in, out, trials, generator_wanted) != 0)

fatal("modulus screening failed\n");

return (0);

}

arc4random_stir();

if (key_type_name == NULL) {

printf("You must specify a key type (-t).\n");

usage();

}

type = key_type_from_name(key_type_name);

if (type == KEY_UNSPEC) {

fprintf(stderr, "unknown key type %s\n", key_type_name);