src/usr.bin/ssh/ssh-keygen.c - diff

Return to ssh-keygen.c CVS log

Up to [local] / src / usr.bin / ssh

Diff for /src/usr.bin/ssh/ssh-keygen.c between version 1.90 and 1.113.2.1

version 1.90, 2002/01/09 13:49:27

version 1.113.2.1, 2004/08/19 04:13:27

Line 26

#include "bufaux.h"

#include "pathnames.h"

#include "log.h"

#include "readpass.h"

#include "misc.h"

#ifdef SMARTCARD

#include <sectok.h>

#include <openssl/engine.h>

#include "scard.h"

#endif

#include "dns.h"

/* Number of bits in the RSA/DSA key. This value can be changed on the command line. */

int bits = 1024;

Line 72

Line 71

int convert_to_ssh2 = 0;

int convert_from_ssh2 = 0;

int print_public = 0;

int print_generic = 0;

char *key_type_name = NULL;

Line 80

char hostname[MAXHOSTNAMELEN];

/* moduli.c */

int gen_candidates(FILE *, int, int, BIGNUM *);

int prime_test(FILE *, FILE *, u_int32_t, u_int32_t);

static void

ask_filename(struct passwd *pw, const char *prompt)

{

char buf[1024];

char *name = NULL;

switch (key_type_from_name(key_type_name)) {

if (key_type_name == NULL)

case KEY_RSA1:

name = _PATH_SSH_CLIENT_IDENTITY;

break;

case KEY_DSA:

name = _PATH_SSH_CLIENT_ID_DSA;

break;

case KEY_RSA:

name = _PATH_SSH_CLIENT_ID_RSA;

break;

else

default:

switch (key_type_from_name(key_type_name)) {

fprintf(stderr, "bad key type");

case KEY_RSA1:

exit(1);

name = _PATH_SSH_CLIENT_IDENTITY;

break;

}

case KEY_DSA:

name = _PATH_SSH_CLIENT_ID_DSA;

break;

case KEY_RSA:

name = _PATH_SSH_CLIENT_ID_RSA;

break;

default:

fprintf(stderr, "bad key type");

exit(1);

break;

}

snprintf(identity_file, sizeof(identity_file), "%s/%s", pw->pw_dir, name);

fprintf(stderr, "%s (%s): ", prompt, identity_file);

fflush(stderr);

if (fgets(buf, sizeof(buf), stdin) == NULL)

exit(1);

if (strchr(buf, '\n'))

Line 134

Line 141

}

#define SSH_COM_PUBLIC_BEGIN "---- BEGIN SSH2 PUBLIC KEY ----"

#define SSH_COM_PUBLIC_END "---- END SSH2 PUBLIC KEY ----"

#define SSH_COM_PRIVATE_BEGIN "---- BEGIN SSH2 ENCRYPTED PRIVATE KEY ----"

#define SSH_COM_PRIVATE_KEY_MAGIC 0x3f6ff9eb

Line 142

Line 149

do_convert_to_ssh2(struct passwd *pw)

{

Key *k;

int len;

u_int len;

u_char *blob;

struct stat st;

Line 158

Line 165

exit(1);

}

if (k->type == KEY_RSA1) {

fprintf(stderr, "version 1 keys are not supported\n");

exit(1);

}

if (key_to_blob(k, &blob, &len) <= 0) {

fprintf(stderr, "key_to_blob failed\n");

exit(1);

}

fprintf(stdout, "%s\n", SSH_COM_PUBLIC_BEGIN);

fprintf(stdout,

"Comment: \"%d-bit %s, converted from OpenSSH by %s@%s\"\n",

"Comment: \"%u-bit %s, converted from OpenSSH by %s@%s\"\n",

key_size(k), key_type(k),

pw->pw_name, hostname);

dump_base64(stdout, blob, len);

Line 177

Line 188

static void

buffer_get_bignum_bits(Buffer *b, BIGNUM *value)

{

int bits = buffer_get_int(b);

u_int bignum_bits = buffer_get_int(b);

int bytes = (bits + 7) / 8;

u_int bytes = (bignum_bits + 7) / 8;

if (buffer_len(b) < bytes)

fatal("buffer_get_bignum_bits: input buffer too small: "

Line 188

Line 199

}

static Key *

do_convert_private_ssh2_from_blob(u_char *blob, int blen)

do_convert_private_ssh2_from_blob(u_char *blob, u_int blen)

{

Buffer b;

Key *key = NULL;

Line 284

Line 295

{

Key *k;

int blen;

u_int len;

char line[1024], *p;

u_char blob[8096];

char encoded[8096];

Line 328

Line 340

*p = '\0';

strlcat(encoded, line, sizeof(encoded));

}

blen = uudecode(encoded, (u_char *)blob, sizeof(blob));

len = strlen(encoded);

if (((len % 4) == 3) &&

(encoded[len-1] == '=') &&

(encoded[len-2] == '=') &&

(encoded[len-3] == '='))

encoded[len-3] = '\0';

blen = uudecode(encoded, blob, sizeof(blob));

if (blen < 0) {

fprintf(stderr, "uudecode failed.\n");

exit(1);

Line 381

Line 399

}

#ifdef SMARTCARD

#define NUM_RSA_KEY_ELEMENTS 5+1

#define COPY_RSA_KEY(x, i) \

do { \

len = BN_num_bytes(prv->rsa->x); \

elements[i] = xmalloc(len); \

debug("#bytes %d", len); \

if (BN_bn2bin(prv->rsa->x, elements[i]) < 0) \

goto done; \

} while (0)

static int

get_AUT0(char *aut0)

{

EVP_MD *evp_md = EVP_sha1();

EVP_MD_CTX md;

char *pass;

pass = read_passphrase("Enter passphrase for smartcard: ", RP_ALLOW_STDIN);

if (pass == NULL)

return -1;

EVP_DigestInit(&md, evp_md);

EVP_DigestUpdate(&md, pass, strlen(pass));

EVP_DigestFinal(&md, aut0, NULL);

memset(pass, 0, strlen(pass));

xfree(pass);

return 0;

}

static void

do_upload(struct passwd *pw, const char *sc_reader_id)

{

Key *prv = NULL;

struct stat st;

u_char *elements[NUM_RSA_KEY_ELEMENTS];

int ret;

u_char key_fid[2];

u_char DEFAUT0[] = {0xad, 0x9f, 0x61, 0xfe, 0xfa, 0x20, 0xce, 0x63};

u_char AUT0[EVP_MAX_MD_SIZE];

int len, status = 1, i, fd = -1, ret;

int sw = 0, cla = 0x00;

for (i = 0; i < NUM_RSA_KEY_ELEMENTS; i++)

elements[i] = NULL;

if (!have_identity)

ask_filename(pw, "Enter file in which the key is");

if (stat(identity_file, &st) < 0) {

perror(identity_file);

goto done;

exit(1);

}

prv = load_identity(identity_file);

if (prv == NULL) {

error("load failed");

goto done;

exit(1);

}

COPY_RSA_KEY(q, 0);

ret = sc_put_key(prv, sc_reader_id);

COPY_RSA_KEY(p, 1);

key_free(prv);

COPY_RSA_KEY(iqmp, 2);

if (ret < 0)

COPY_RSA_KEY(dmq1, 3);

exit(1);

COPY_RSA_KEY(dmp1, 4);

logit("loading key done");

COPY_RSA_KEY(n, 5);

exit(0);

len = BN_num_bytes(prv->rsa->n);

fd = sectok_friendly_open(sc_reader_id, STONOWAIT, &sw);

if (fd < 0) {

error("sectok_open failed: %s", sectok_get_sw(sw));

goto done;

}

if (! sectok_cardpresent(fd)) {

error("smartcard in reader %s not present",

sc_reader_id);

goto done;

}

ret = sectok_reset(fd, 0, NULL, &sw);

if (ret <= 0) {

error("sectok_reset failed: %s", sectok_get_sw(sw));

goto done;

}

if ((cla = cyberflex_inq_class(fd)) < 0) {

error("cyberflex_inq_class failed");

goto done;

}

memcpy(AUT0, DEFAUT0, sizeof(DEFAUT0));

if (cyberflex_verify_AUT0(fd, cla, AUT0, sizeof(DEFAUT0)) < 0) {

if (get_AUT0(AUT0) < 0 ||

cyberflex_verify_AUT0(fd, cla, AUT0, sizeof(DEFAUT0)) < 0) {

error("cyberflex_verify_AUT0 failed");

goto done;

}

key_fid[0] = 0x00;

key_fid[1] = 0x12;

if (cyberflex_load_rsa_priv(fd, cla, key_fid, 5, 8*len, elements,

&sw) < 0) {

error("cyberflex_load_rsa_priv failed: %s", sectok_get_sw(sw));

goto done;

}

if (!sectok_swOK(sw))

goto done;

log("cyberflex_load_rsa_priv done");

key_fid[0] = 0x73;

key_fid[1] = 0x68;

if (cyberflex_load_rsa_pub(fd, cla, key_fid, len, elements[5],

&sw) < 0) {

error("cyberflex_load_rsa_pub failed: %s", sectok_get_sw(sw));

goto done;

}

if (!sectok_swOK(sw))

goto done;

log("cyberflex_load_rsa_pub done");

status = 0;

log("loading key done");

done:

memset(elements[0], '\0', BN_num_bytes(prv->rsa->q));

memset(elements[1], '\0', BN_num_bytes(prv->rsa->p));

memset(elements[2], '\0', BN_num_bytes(prv->rsa->iqmp));

memset(elements[3], '\0', BN_num_bytes(prv->rsa->dmq1));

memset(elements[4], '\0', BN_num_bytes(prv->rsa->dmp1));

memset(elements[5], '\0', BN_num_bytes(prv->rsa->n));

if (prv)

key_free(prv);

for (i = 0; i < NUM_RSA_KEY_ELEMENTS; i++)

if (elements[i])

xfree(elements[i]);

if (fd != -1)

sectok_close(fd);

exit(status);

}

static void

do_download(struct passwd *pw, const char *sc_reader_id)

{

Key *pub = NULL;

Key **keys = NULL;

int i;

pub = sc_get_key(sc_reader_id);

keys = sc_get_keys(sc_reader_id, NULL);

if (pub == NULL)

if (keys == NULL)

fatal("cannot read public key from smartcard");

key_write(pub, stdout);

for (i = 0; keys[i]; i++) {

key_free(pub);

key_write(keys[i], stdout);

fprintf(stdout, "\n");

key_free(keys[i]);

fprintf(stdout, "\n");

}

xfree(keys);

exit(0);

}

#endif /* SMARTCARD */

Line 547

Line 467

public = key_load_public(identity_file, &comment);

if (public != NULL) {

fp = key_fingerprint(public, fptype, rep);

printf("%d %s %s\n", key_size(public), fp, comment);

printf("%u %s %s\n", key_size(public), fp, comment);

key_free(public);

xfree(comment);

xfree(fp);

Line 581

Line 501

if (i == 0 || ep == NULL || (*ep != ' ' && *ep != '\t')) {

int quoted = 0;

comment = cp;

for (; *cp && (quoted || (*cp != ' ' && *cp != '\t')); cp++) {

for (; *cp && (quoted || (*cp != ' ' &&

*cp != '\t')); cp++) {

if (*cp == '\\' && cp[1] == '"')

cp++; /* Skip both */

else if (*cp == '"')

Line 604

Line 525

}

comment = *cp ? cp : comment;

fp = key_fingerprint(public, fptype, rep);

printf("%d %s %s\n", key_size(public), fp,

printf("%u %s %s\n", key_size(public), fp,

comment ? comment : "no comment");

xfree(fp);

key_free(public);

Line 702

Line 623

}

* Print the SSHFP RR.

static void

do_print_resource_record(struct passwd *pw, char *hname)

{

Key *public;

char *comment = NULL;

struct stat st;

if (!have_identity)

ask_filename(pw, "Enter file in which the key is");

if (stat(identity_file, &st) < 0) {

perror(identity_file);

exit(1);

}

public = key_load_public(identity_file, &comment);

if (public != NULL) {

export_dns_rr(hname, public, stdout, print_generic);

key_free(public);

xfree(comment);

exit(0);

}

if (comment)

xfree(comment);

printf("failed to read v2 public key from %s.\n", identity_file);

exit(1);

}

* Change the comment of a private key file.

static void

Line 807

Line 758

fprintf(stderr, " -c Change comment in private and public key files.\n");

fprintf(stderr, " -e Convert OpenSSH to IETF SECSH key file.\n");

fprintf(stderr, " -f filename Filename of the key file.\n");

fprintf(stderr, " -g Use generic DNS resource record format.\n");

fprintf(stderr, " -i Convert IETF SECSH to OpenSSH key file.\n");

fprintf(stderr, " -l Show fingerprint of key file.\n");

fprintf(stderr, " -p Change passphrase of private key file.\n");

Line 817

Line 769

fprintf(stderr, " -C comment Provide new comment.\n");

fprintf(stderr, " -N phrase Provide new passphrase.\n");

fprintf(stderr, " -P phrase Provide old passphrase.\n");

fprintf(stderr, " -r hostname Print DNS resource record.\n");

#ifdef SMARTCARD

fprintf(stderr, " -D reader Download public key from smartcard.\n");

fprintf(stderr, " -U reader Upload private key to smartcard.\n");

#endif /* SMARTCARD */

fprintf(stderr, " -G file Generate candidates for DH-GEX moduli\n");

fprintf(stderr, " -T file Screen candidates for DH-GEX moduli\n");

exit(1);

}

Line 832

Line 788

main(int ac, char **av)

{

char dotsshdir[MAXPATHLEN], comment[1024], *passphrase1, *passphrase2;

char *reader_id = NULL;

char out_file[MAXPATHLEN], *reader_id = NULL;

char *resource_record_hostname = NULL;

Key *private, *public;

struct passwd *pw;

struct stat st;

int opt, type, fd, download = 0;

int opt, type, fd, download = 0, memory = 0;

int generator_wanted = 0, trials = 100;

int do_gen_candidates = 0, do_screen_candidates = 0;

int log_level = SYSLOG_LEVEL_INFO;

BIGNUM *start = NULL;

FILE *f;

extern int optind;

extern char *optarg;

SSLeay_add_all_algorithms();

log_init(av[0], SYSLOG_LEVEL_INFO, SYSLOG_FACILITY_USER, 1);

/* we need this for the home * directory. */

pw = getpwuid(getuid());

Line 855

Line 817

exit(1);

}

while ((opt = getopt(ac, av, "deiqpclBRxXyb:f:t:U:D:P:N:C:")) != -1) {

while ((opt = getopt(ac, av,

"degiqpclBRvxXyb:f:t:U:D:P:N:C:r:g:T:G:M:S:a:W:")) != -1) {

switch (opt) {

case 'b':

bits = atoi(optarg);

Line 880

Line 843

strlcpy(identity_file, optarg, sizeof(identity_file));

have_identity = 1;

break;

case 'g':

print_generic = 1;

break;

case 'P':

identity_passphrase = optarg;

break;

Line 920

Line 886

case 'U':

reader_id = optarg;

break;

case 'v':

if (log_level == SYSLOG_LEVEL_INFO)

log_level = SYSLOG_LEVEL_DEBUG1;

else {

if (log_level >= SYSLOG_LEVEL_DEBUG1 &&

log_level < SYSLOG_LEVEL_DEBUG3)

log_level++;

}

break;

case 'r':

resource_record_hostname = optarg;

break;

case 'W':

generator_wanted = atoi(optarg);

if (generator_wanted < 1)

fatal("Desired generator has bad value.");

break;

case 'a':

trials = atoi(optarg);

break;

case 'M':

memory = atoi(optarg);

break;

case 'G':

do_gen_candidates = 1;

strlcpy(out_file, optarg, sizeof(out_file));

break;

case 'T':

do_screen_candidates = 1;

strlcpy(out_file, optarg, sizeof(out_file));

break;

case 'S':

/* XXX - also compare length against bits */

if (BN_hex2bn(&start, optarg) == 0)

fatal("Invalid start point.");

break;

case '?':

default:

usage();

}

/* reinit */

log_init(av[0], log_level, SYSLOG_FACILITY_USER, 1);

if (optind < ac) {

printf("Too many arguments.\n");

usage();

Line 945

Line 951

do_convert_from_ssh2(pw);

if (print_public)

do_print_public(pw);

if (resource_record_hostname != NULL) {

do_print_resource_record(pw, resource_record_hostname);

}

if (reader_id != NULL) {

#ifdef SMARTCARD

if (download)

Line 954

Line 963

#else /* SMARTCARD */

fatal("no support for smartcards.");

#endif /* SMARTCARD */

}

if (do_gen_candidates) {

FILE *out = fopen(out_file, "w");

if (out == NULL) {

error("Couldn't open modulus candidate file \"%s\": %s",

out_file, strerror(errno));

return (1);

}

if (gen_candidates(out, memory, bits, start) != 0)

fatal("modulus candidate generation failed\n");

return (0);

}

if (do_screen_candidates) {

FILE *in;

FILE *out = fopen(out_file, "w");

if (have_identity && strcmp(identity_file, "-") != 0) {

if ((in = fopen(identity_file, "r")) == NULL) {

fatal("Couldn't open modulus candidate "

"file \"%s\": %s", identity_file,

strerror(errno));

}

} else

in = stdin;

if (out == NULL) {

fatal("Couldn't open moduli file \"%s\": %s",

out_file, strerror(errno));

}

if (prime_test(in, out, trials, generator_wanted) != 0)

fatal("modulus screening failed\n");

return (0);

}

arc4random_stir();