version 1.280, 2015/11/18 08:37:28 |
version 1.286, 2015/12/11 02:31:47 |
|
|
sshbuf_free(b); |
sshbuf_free(b); |
|
|
/* try the key */ |
/* try the key */ |
if (sshkey_sign(key, &sig, &slen, data, sizeof(data), 0) != 0 || |
if (sshkey_sign(key, &sig, &slen, data, sizeof(data), NULL, 0) != 0 || |
sshkey_verify(key, sig, slen, data, sizeof(data), 0) != 0) { |
sshkey_verify(key, sig, slen, data, sizeof(data), 0) != 0) { |
sshkey_free(key); |
sshkey_free(key); |
free(sig); |
free(sig); |
|
|
foreach_options |= print_fingerprint ? HKF_WANT_PARSE_KEY : 0; |
foreach_options |= print_fingerprint ? HKF_WANT_PARSE_KEY : 0; |
if ((r = hostkeys_foreach(identity_file, |
if ((r = hostkeys_foreach(identity_file, |
hash_hosts ? known_hosts_hash : known_hosts_find_delete, &ctx, |
hash_hosts ? known_hosts_hash : known_hosts_find_delete, &ctx, |
name, NULL, foreach_options)) != 0) |
name, NULL, foreach_options)) != 0) { |
|
if (inplace) |
|
unlink(tmp); |
fatal("%s: hostkeys_foreach failed: %s", __func__, ssh_err(r)); |
fatal("%s: hostkeys_foreach failed: %s", __func__, ssh_err(r)); |
|
} |
|
|
if (inplace) |
if (inplace) |
fclose(ctx.out); |
fclose(ctx.out); |
|
|
identity_file, ssh_err(r)); |
identity_file, ssh_err(r)); |
} |
} |
} |
} |
/* XXX what about new-format keys? */ |
|
if (private->type != KEY_RSA1) { |
if (private->type != KEY_RSA1 && private->type != KEY_ED25519 && |
error("Comments are only supported for RSA1 keys."); |
!use_new_format) { |
|
error("Comments are only supported for RSA1 or keys stored in " |
|
"the new format (-o)."); |
explicit_bzero(passphrase, strlen(passphrase)); |
explicit_bzero(passphrase, strlen(passphrase)); |
sshkey_free(private); |
sshkey_free(private); |
exit(1); |
exit(1); |
|
|
exit(0); |
exit(0); |
} |
} |
|
|
static const char * |
|
fmt_validity(u_int64_t valid_from, u_int64_t valid_to) |
|
{ |
|
char from[32], to[32]; |
|
static char ret[64]; |
|
time_t tt; |
|
struct tm *tm; |
|
|
|
*from = *to = '\0'; |
|
if (valid_from == 0 && valid_to == 0xffffffffffffffffULL) |
|
return "forever"; |
|
|
|
if (valid_from != 0) { |
|
/* XXX revisit INT_MAX in 2038 :) */ |
|
tt = valid_from > INT_MAX ? INT_MAX : valid_from; |
|
tm = localtime(&tt); |
|
strftime(from, sizeof(from), "%Y-%m-%dT%H:%M:%S", tm); |
|
} |
|
if (valid_to != 0xffffffffffffffffULL) { |
|
/* XXX revisit INT_MAX in 2038 :) */ |
|
tt = valid_to > INT_MAX ? INT_MAX : valid_to; |
|
tm = localtime(&tt); |
|
strftime(to, sizeof(to), "%Y-%m-%dT%H:%M:%S", tm); |
|
} |
|
|
|
if (valid_from == 0) { |
|
snprintf(ret, sizeof(ret), "before %s", to); |
|
return ret; |
|
} |
|
if (valid_to == 0xffffffffffffffffULL) { |
|
snprintf(ret, sizeof(ret), "after %s", from); |
|
return ret; |
|
} |
|
|
|
snprintf(ret, sizeof(ret), "from %s to %s", from, to); |
|
return ret; |
|
} |
|
|
|
static void |
static void |
add_flag_option(struct sshbuf *c, const char *name) |
add_flag_option(struct sshbuf *c, const char *name) |
{ |
{ |
|
|
int r, i, fd; |
int r, i, fd; |
u_int n; |
u_int n; |
struct sshkey *ca, *public; |
struct sshkey *ca, *public; |
char *otmp, *tmp, *cp, *out, *comment, **plist = NULL; |
char valid[64], *otmp, *tmp, *cp, *out, *comment, **plist = NULL; |
FILE *f; |
FILE *f; |
|
|
#ifdef ENABLE_PKCS11 |
#ifdef ENABLE_PKCS11 |
|
|
fclose(f); |
fclose(f); |
|
|
if (!quiet) { |
if (!quiet) { |
|
sshkey_format_cert_validity(public->cert, |
|
valid, sizeof(valid)); |
logit("Signed %s key %s: id \"%s\" serial %llu%s%s " |
logit("Signed %s key %s: id \"%s\" serial %llu%s%s " |
"valid %s", sshkey_cert_type(public), |
"valid %s", sshkey_cert_type(public), |
out, public->cert->key_id, |
out, public->cert->key_id, |
(unsigned long long)public->cert->serial, |
(unsigned long long)public->cert->serial, |
cert_principals != NULL ? " for " : "", |
cert_principals != NULL ? " for " : "", |
cert_principals != NULL ? cert_principals : "", |
cert_principals != NULL ? cert_principals : "", |
fmt_validity(cert_valid_from, cert_valid_to)); |
valid); |
} |
} |
|
|
sshkey_free(public); |
sshkey_free(public); |
|
|
char buf[32], *fmt; |
char buf[32], *fmt; |
|
|
/* |
/* |
* POSIX strptime says "The application shall ensure that there |
* POSIX strptime says "The application shall ensure that there |
* is white-space or other non-alphanumeric characters between |
* is white-space or other non-alphanumeric characters between |
* any two conversion specifications" so arrange things this way. |
* any two conversion specifications" so arrange things this way. |
*/ |
*/ |
|
|
static void |
static void |
print_cert(struct sshkey *key) |
print_cert(struct sshkey *key) |
{ |
{ |
char *key_fp, *ca_fp; |
char valid[64], *key_fp, *ca_fp; |
u_int i; |
u_int i; |
|
|
key_fp = sshkey_fingerprint(key, fingerprint_hash, SSH_FP_DEFAULT); |
key_fp = sshkey_fingerprint(key, fingerprint_hash, SSH_FP_DEFAULT); |
|
|
fingerprint_hash, SSH_FP_DEFAULT); |
fingerprint_hash, SSH_FP_DEFAULT); |
if (key_fp == NULL || ca_fp == NULL) |
if (key_fp == NULL || ca_fp == NULL) |
fatal("%s: sshkey_fingerprint fail", __func__); |
fatal("%s: sshkey_fingerprint fail", __func__); |
|
sshkey_format_cert_validity(key->cert, valid, sizeof(valid)); |
|
|
printf(" Type: %s %s certificate\n", sshkey_ssh_name(key), |
printf(" Type: %s %s certificate\n", sshkey_ssh_name(key), |
sshkey_cert_type(key)); |
sshkey_cert_type(key)); |
|
|
sshkey_type(key->cert->signature_key), ca_fp); |
sshkey_type(key->cert->signature_key), ca_fp); |
printf(" Key ID: \"%s\"\n", key->cert->key_id); |
printf(" Key ID: \"%s\"\n", key->cert->key_id); |
printf(" Serial: %llu\n", (unsigned long long)key->cert->serial); |
printf(" Serial: %llu\n", (unsigned long long)key->cert->serial); |
printf(" Valid: %s\n", |
printf(" Valid: %s\n", valid); |
fmt_validity(key->cert->valid_after, key->cert->valid_before)); |
|
printf(" Principals: "); |
printf(" Principals: "); |
if (key->cert->nprincipals == 0) |
if (key->cert->nprincipals == 0) |
printf("(none)\n"); |
printf("(none)\n"); |
|
|
close(fd); |
close(fd); |
sshbuf_free(kbuf); |
sshbuf_free(kbuf); |
ssh_krl_free(krl); |
ssh_krl_free(krl); |
if (ca != NULL) |
sshkey_free(ca); |
sshkey_free(ca); |
|
} |
} |
|
|
static void |
static void |