src/usr.bin/ssh/ssh-keygen.c - diff

Return to ssh-keygen.c CVS log

Up to [local] / src / usr.bin / ssh

Diff for /src/usr.bin/ssh/ssh-keygen.c between version 1.136 and 1.170

version 1.136, 2006/02/20 17:19:54

version 1.170, 2008/06/12 21:14:46

Line 1

/* $OpenBSD$ */

* Author: Tatu Ylonen <ylo@cs.hut.fi>

Line 11

Line 12

* called by a name other than "ssh" or "Secure Shell".

#include "includes.h"

RCSID("$OpenBSD$");

#include <sys/types.h>

#include <sys/stat.h>

#include <sys/socket.h>

#include <sys/param.h>

#include <openssl/evp.h>

#include <openssl/pem.h>

#include <errno.h>

#include <fcntl.h>

#include <pwd.h>

#include <stdio.h>

#include <stdlib.h>

#include <string.h>

#include <unistd.h>

#include "xmalloc.h"

#include "key.h"

#include "rsa.h"

#include "authfile.h"

#include "uuencode.h"

#include "buffer.h"

#include "bufaux.h"

#include "pathnames.h"

#include "log.h"

#include "misc.h"

#include "match.h"

#include "hostfile.h"

#include "dns.h"

#ifdef SMARTCARD

#include "scard.h"

#endif

#include "dns.h"

/* Number of bits in the RSA/DSA key. This value can be set on the command line. */

#define DEFAULT_BITS 2048

Line 57

Line 64

int quiet = 0;

int log_level = SYSLOG_LEVEL_INFO;

/* Flag indicating that we want to hash a known_hosts file */

int hash_hosts = 0;

/* Flag indicating that we want lookup a host in known_hosts file */

Line 106

Line 115

if (key_type_name == NULL)

name = _PATH_SSH_CLIENT_ID_RSA;

else

else {

switch (key_type_from_name(key_type_name)) {

case KEY_RSA1:

name = _PATH_SSH_CLIENT_IDENTITY;

Line 122

Line 131

exit(1);

break;

}

snprintf(identity_file, sizeof(identity_file), "%s/%s", pw->pw_dir, name);

fprintf(stderr, "%s (%s): ", prompt, identity_file);

if (fgets(buf, sizeof(buf), stdin) == NULL)

exit(1);

if (strchr(buf, '\n'))

buf[strcspn(buf, "\n")] = '\0';

*strchr(buf, '\n') = 0;

if (strcmp(buf, "") != 0)

strlcpy(identity_file, buf, sizeof(identity_file));

have_identity = 1;

Line 208

Line 216

if (buffer_len(b) < bytes)

fatal("buffer_get_bignum_bits: input buffer too small: "

"need %d have %d", bytes, buffer_len(b));

BN_bin2bn(buffer_ptr(b), bytes, value);

if (BN_bin2bn(buffer_ptr(b), bytes, value) == NULL)

fatal("buffer_get_bignum_bits: BN_bin2bn failed");

buffer_consume(b, bytes);

}

Line 226

Line 235

buffer_init(&b);

buffer_append(&b, blob, blen);

magic = buffer_get_int(&b);

if (magic != SSH_COM_PRIVATE_KEY_MAGIC) {

error("bad magic 0x%x != 0x%x", magic, SSH_COM_PRIVATE_KEY_MAGIC);

buffer_free(&b);

Line 238

Line 247

i2 = buffer_get_int(&b);

i3 = buffer_get_int(&b);

i4 = buffer_get_int(&b);

debug("ignore (%d %d %d %d)", i1,i2,i3,i4);

debug("ignore (%d %d %d %d)", i1, i2, i3, i4);

if (strcmp(cipher, "none") != 0) {

error("unsupported cipher %s", cipher);

xfree(cipher);

Line 269

Line 278

buffer_get_bignum_bits(&b, key->dsa->priv_key);

break;

case KEY_RSA:

e = buffer_get_char(&b);

debug("e %lx", e);

if (e < 30) {

e <<= 8;

Line 305

Line 314

return key;

}

static int

get_line(FILE *fp, char *line, size_t len)

{

int c;

size_t pos = 0;

line[0] = '\0';

while ((c = fgetc(fp)) != EOF) {

if (pos >= len - 1) {

fprintf(stderr, "input line too long.\n");

exit(1);

}

switch (c) {

case '\r':

c = fgetc(fp);

if (c != EOF && c != '\n' && ungetc(c, fp) == EOF) {

fprintf(stderr, "unget: %s\n", strerror(errno));

exit(1);

}

return pos;

case '\n':

return pos;

}

line[pos++] = c;

line[pos] = '\0';

}

/* We reached EOF */

return -1;

}

static void

do_convert_from_ssh2(struct passwd *pw)

{

Key *k;

int blen;

u_int len;

char line[1024], *p;

char line[1024];

u_char blob[8096];

char encoded[8096];

struct stat st;

Line 330

Line 369

exit(1);

}

encoded[0] = '\0';

while (fgets(line, sizeof(line), fp)) {

while ((blen = get_line(fp, line, sizeof(line))) != -1) {

if (!(p = strchr(line, '\n'))) {

if (line[blen - 1] == '\\')

fprintf(stderr, "input line too long.\n");

exit(1);

}

if (p > line && p[-1] == '\\')

escaped++;

if (strncmp(line, "----", 4) == 0 ||

strstr(line, ": ") != NULL) {

Line 352

Line 387

/* fprintf(stderr, "escaped: %s", line); */

continue;

}

*p = '\0';

strlcat(encoded, line, sizeof(encoded));

}

len = strlen(encoded);

Line 464

Line 498

{

FILE *f;

Key *public;

char *comment = NULL, *cp, *ep, line[16*1024], *fp;

char *comment = NULL, *cp, *ep, line[16*1024], *fp, *ra;

int i, skip = 0, num = 1, invalid = 1;

int i, skip = 0, num = 0, invalid = 1;

enum fp_rep rep;

enum fp_type fptype;

struct stat st;

Line 482

Line 516

public = key_load_public(identity_file, &comment);

if (public != NULL) {

fp = key_fingerprint(public, fptype, rep);

printf("%u %s %s\n", key_size(public), fp, comment);

ra = key_fingerprint(public, fptype, SSH_FP_RANDOMART);

printf("%u %s %s (%s)\n", key_size(public), fp, comment,

key_type(public));

if (log_level >= SYSLOG_LEVEL_VERBOSE)

printf("%s\n", ra);

key_free(public);

xfree(comment);

xfree(ra);

xfree(fp);

exit(0);

}

if (comment)

if (comment) {

xfree(comment);

comment = NULL;

}

f = fopen(identity_file, "r");

if (f != NULL) {

while (fgets(line, sizeof(line), f)) {

i = strlen(line) - 1;

if ((cp = strchr(line, '\n')) == NULL) {

if (line[i] != '\n') {

error("line %d too long: %.40s...",

error("line %d too long: %.40s...", num, line);

num + 1, line);

skip = 1;

continue;

}

Line 505

Line 546

skip = 0;

continue;

}

line[i] = '\0';

*cp = '\0';

/* Skip leading whitespace, empty and comment lines. */

for (cp = line; *cp == ' ' || *cp == '\t'; cp++)

;

if (!*cp || *cp == '\n' || *cp == '#')

continue ;

continue;

i = strtol(cp, &ep, 10);

if (i == 0 || ep == NULL || (*ep != ' ' && *ep != '\t')) {

int quoted = 0;

Line 540

Line 581

}

comment = *cp ? cp : comment;

fp = key_fingerprint(public, fptype, rep);

printf("%u %s %s\n", key_size(public), fp,

ra = key_fingerprint(public, fptype, SSH_FP_RANDOMART);

comment ? comment : "no comment");

printf("%u %s %s (%s)\n", key_size(public), fp,

comment ? comment : "no comment", key_type(public));

if (log_level >= SYSLOG_LEVEL_VERBOSE)

printf("%s\n", ra);

xfree(ra);

xfree(fp);

key_free(public);

invalid = 0;

Line 556

Line 601

}

static void

print_host(FILE *f, char *name, Key *public, int hash)

print_host(FILE *f, const char *name, Key *public, int hash)

{

if (hash && (name = host_hash(name, NULL, 0)) == NULL)

if (print_fingerprint) {

fatal("hash_host failed");

enum fp_rep rep;

fprintf(f, "%s ", name);

enum fp_type fptype;

if (!key_write(public, f))

char *fp, *ra;

fatal("key_write failed");

fprintf(f, "\n");

fptype = print_bubblebabble ? SSH_FP_SHA1 : SSH_FP_MD5;

rep = print_bubblebabble ? SSH_FP_BUBBLEBABBLE : SSH_FP_HEX;

fp = key_fingerprint(public, fptype, rep);

ra = key_fingerprint(public, fptype, SSH_FP_RANDOMART);

printf("%u %s %s (%s)\n%s\n", key_size(public), fp, name,

key_type(public), ra);

xfree(ra);

xfree(fp);

} else {

if (hash && (name = host_hash(name, NULL, 0)) == NULL)

fatal("hash_host failed");

fprintf(f, "%s ", name);

if (!key_write(public, f))

fatal("key_write failed");

fprintf(f, "\n");

}

static void

Line 573

Line 633

Key *public;

char *cp, *cp2, *kp, *kp2;

char line[16*1024], tmp[MAXPATHLEN], old[MAXPATHLEN];

int c, i, skip = 0, inplace = 0, num = 0, invalid = 0, has_unhashed = 0;

int c, skip = 0, inplace = 0, num = 0, invalid = 0, has_unhashed = 0;

if (!have_identity) {

cp = tilde_expand_filename(_PATH_SSH_USER_HOSTFILE, pw->pw_uid);

Line 608

Line 668

}

while (fgets(line, sizeof(line), in)) {

num++;

if ((cp = strchr(line, '\n')) == NULL) {

i = strlen(line) - 1;

error("line %d too long: %.40s...", num + 1, line);

if (line[i] != '\n') {

error("line %d too long: %.40s...", num, line);

skip = 1;

invalid = 1;

continue;

}

num++;

if (skip) {

skip = 0;

continue;

}

line[i] = '\0';

*cp = '\0';

/* Skip leading whitespace, empty and comment lines. */

for (cp = line; *cp == ' ' || *cp == '\t'; cp++)

Line 684

Line 743

printf("# Host %s found: "

"line %d type %s\n", name,

num, key_type(public));

print_host(out, cp, public, hash_hosts);

print_host(out, name, public,

hash_hosts);

}

if (delete_host && !c)

print_host(out, cp, public, 0);

Line 708

Line 768

fclose(in);

if (invalid) {

fprintf(stderr, "%s is not a valid known_host file.\n",

fprintf(stderr, "%s is not a valid known_hosts file.\n",

identity_file);

if (inplace) {

fprintf(stderr, "Not replacing existing known_hosts "

Line 835

Line 895

* Print the SSHFP RR.

static void

static int

do_print_resource_record(struct passwd *pw, char *hname)

do_print_resource_record(struct passwd *pw, char *fname, char *hname)

{

Key *public;

char *comment = NULL;

struct stat st;

if (!have_identity)

if (fname == NULL)

ask_filename(pw, "Enter file in which the key is");

if (stat(identity_file, &st) < 0) {

if (stat(fname, &st) < 0) {

perror(identity_file);

if (errno == ENOENT)

return 0;

perror(fname);

exit(1);

}

public = key_load_public(identity_file, &comment);

public = key_load_public(fname, &comment);

if (public != NULL) {

export_dns_rr(hname, public, stdout, print_generic);

key_free(public);

xfree(comment);

exit(0);

return 1;

}

if (comment)

xfree(comment);

printf("failed to read v2 public key from %s.\n", identity_file);

printf("failed to read v2 public key from %s.\n", fname);

exit(1);

}

Line 918

Line 980

key_free(private);

exit(1);

}

if (strchr(new_comment, '\n'))

new_comment[strcspn(new_comment, "\n")] = '\0';

*strchr(new_comment, '\n') = 0;

}

/* Save the file using the new passphrase. */

Line 962

Line 1023

static void

usage(void)

{

fprintf(stderr, "Usage: %s [options]\n", __progname);

fprintf(stderr, "usage: %s [options]\n", __progname);

fprintf(stderr, "Options:\n");

fprintf(stderr, " -a trials Number of trials for screening DH-GEX moduli.\n");

fprintf(stderr, " -B Show bubblebabble digest of key file.\n");

Line 972

Line 1033

#ifdef SMARTCARD

fprintf(stderr, " -D reader Download public key from smartcard.\n");

#endif /* SMARTCARD */

fprintf(stderr, " -e Convert OpenSSH to IETF SECSH key file.\n");

fprintf(stderr, " -e Convert OpenSSH to RFC 4716 key file.\n");

fprintf(stderr, " -F hostname Find hostname in known hosts file.\n");

fprintf(stderr, " -f filename Filename of the key file.\n");

fprintf(stderr, " -G file Generate candidates for DH-GEX moduli.\n");

fprintf(stderr, " -g Use generic DNS resource record format.\n");

fprintf(stderr, " -H Hash names in known_hosts file.\n");

fprintf(stderr, " -i Convert IETF SECSH to OpenSSH key file.\n");

fprintf(stderr, " -i Convert RFC 4716 to OpenSSH key file.\n");

fprintf(stderr, " -l Show fingerprint of key file.\n");

fprintf(stderr, " -M memory Amount of memory (MB) to use for generating DH-GEX moduli.\n");

fprintf(stderr, " -N phrase Provide new passphrase.\n");

Line 1004

Line 1065

* Main program for key management.

int

main(int ac, char **av)

main(int argc, char **argv)

{

char dotsshdir[MAXPATHLEN], comment[1024], *passphrase1, *passphrase2;

char out_file[MAXPATHLEN], *reader_id = NULL;

Line 1015

Line 1076

int opt, type, fd, download = 0;

u_int32_t memory = 0, generator_wanted = 0, trials = 100;

int do_gen_candidates = 0, do_screen_candidates = 0;

int log_level = SYSLOG_LEVEL_INFO;

BIGNUM *start = NULL;

FILE *f;

const char *errstr;

Line 1027

Line 1087

sanitise_stdfd();

SSLeay_add_all_algorithms();

log_init(av[0], SYSLOG_LEVEL_INFO, SYSLOG_FACILITY_USER, 1);

log_init(argv[0], SYSLOG_LEVEL_INFO, SYSLOG_FACILITY_USER, 1);

/* we need this for the home * directory. */

pw = getpwuid(getuid());

Line 1040

Line 1100

exit(1);

}

while ((opt = getopt(ac, av,

while ((opt = getopt(argc, argv,

"degiqpclBHvxXyF:b:f:t:U:D:P:N:C:r:g:R:T:G:M:S:a:W:")) != -1) {

switch (opt) {

case 'b':

bits = strtonum(optarg, 768, 32768, &errstr);

bits = (u_int32_t)strtonum(optarg, 768, 32768, &errstr);

if (errstr)

fatal("Bits has bad value %s (%s)",

optarg, errstr);

Line 1114

Line 1174

break;

case 'D':

download = 1;

/*FALLTHROUGH*/

case 'U':

reader_id = optarg;

break;

Line 1130

Line 1191

rr_hostname = optarg;

break;

case 'W':

generator_wanted = strtonum(optarg, 1, UINT_MAX, &errstr);

generator_wanted = (u_int32_t)strtonum(optarg, 1,

UINT_MAX, &errstr);

if (errstr)

fatal("Desired generator has bad value: %s (%s)",

optarg, errstr);

break;

case 'a':

trials = strtonum(optarg, 1, UINT_MAX, &errstr);

trials = (u_int32_t)strtonum(optarg, 1, UINT_MAX, &errstr);

if (errstr)

fatal("Invalid number of trials: %s (%s)",

optarg, errstr);

break;

case 'M':

memory = strtonum(optarg, 1, UINT_MAX, &errstr);

memory = (u_int32_t)strtonum(optarg, 1, UINT_MAX, &errstr);

if (errstr) {

fatal("Memory limit is %s: %s", errstr, optarg);

}

Line 1171

Line 1233

}

/* reinit */

log_init(av[0], log_level, SYSLOG_FACILITY_USER, 1);

log_init(argv[0], log_level, SYSLOG_FACILITY_USER, 1);

if (optind < ac) {

if (optind < argc) {

printf("Too many arguments.\n");

usage();

}

Line 1181

Line 1243

printf("Can only have one of -p and -c.\n");

usage();

}

if (print_fingerprint && (delete_host || hash_hosts)) {

printf("Cannot use -l with -D or -R.\n");

usage();

}

if (delete_host || hash_hosts || find_host)

do_known_hosts(pw, rr_hostname);

if (print_fingerprint || print_bubblebabble)

Line 1196

Line 1262

if (print_public)

do_print_public(pw);

if (rr_hostname != NULL) {

do_print_resource_record(pw, rr_hostname);

unsigned int n = 0;

if (have_identity) {

n = do_print_resource_record(pw,

identity_file, rr_hostname);

if (n == 0) {

perror(identity_file);

exit(1);

}

exit(0);

} else {

n += do_print_resource_record(pw,

_PATH_HOST_RSA_KEY_FILE, rr_hostname);

n += do_print_resource_record(pw,

_PATH_HOST_DSA_KEY_FILE, rr_hostname);

if (n == 0)

fatal("no keys found.");

exit(0);

}

if (reader_id != NULL) {

#ifdef SMARTCARD

Line 1365

Line 1451

if (!quiet) {

char *fp = key_fingerprint(public, SSH_FP_MD5, SSH_FP_HEX);

char *ra = key_fingerprint(public, SSH_FP_MD5,

SSH_FP_RANDOMART);

printf("Your public key has been saved in %s.\n",

identity_file);

printf("The key fingerprint is:\n");

printf("%s %s\n", fp, comment);

printf("The key's randomart image is:\n");

printf("%s\n", ra);

xfree(ra);

xfree(fp);

}