version 1.288, 2016/02/15 09:47:49 |
version 1.296, 2017/03/03 06:13:11 |
|
|
#include <string.h> |
#include <string.h> |
#include <unistd.h> |
#include <unistd.h> |
#include <limits.h> |
#include <limits.h> |
|
#include <locale.h> |
|
|
#include "xmalloc.h" |
#include "xmalloc.h" |
#include "sshkey.h" |
#include "sshkey.h" |
|
|
#include "atomicio.h" |
#include "atomicio.h" |
#include "krl.h" |
#include "krl.h" |
#include "digest.h" |
#include "digest.h" |
|
#include "utf8.h" |
|
|
#ifdef ENABLE_PKCS11 |
#ifdef ENABLE_PKCS11 |
#include "ssh-pkcs11.h" |
#include "ssh-pkcs11.h" |
|
|
*bitsp = sshkey_curve_nid_to_bits(nid); |
*bitsp = sshkey_curve_nid_to_bits(nid); |
if (*bitsp == 0) |
if (*bitsp == 0) |
*bitsp = DEFAULT_BITS_ECDSA; |
*bitsp = DEFAULT_BITS_ECDSA; |
} |
} else |
else |
|
#endif |
#endif |
*bitsp = DEFAULT_BITS; |
*bitsp = DEFAULT_BITS; |
} |
} |
|
|
ra = sshkey_fingerprint(public, fingerprint_hash, SSH_FP_RANDOMART); |
ra = sshkey_fingerprint(public, fingerprint_hash, SSH_FP_RANDOMART); |
if (fp == NULL || ra == NULL) |
if (fp == NULL || ra == NULL) |
fatal("%s: sshkey_fingerprint failed", __func__); |
fatal("%s: sshkey_fingerprint failed", __func__); |
printf("%u %s %s (%s)\n", sshkey_size(public), fp, |
mprintf("%u %s %s (%s)\n", sshkey_size(public), fp, |
comment ? comment : "no comment", sshkey_type(public)); |
comment ? comment : "no comment", sshkey_type(public)); |
if (log_level >= SYSLOG_LEVEL_VERBOSE) |
if (log_level >= SYSLOG_LEVEL_VERBOSE) |
printf("%s\n", ra); |
printf("%s\n", ra); |
|
|
char *comment = NULL, *cp, *ep, line[SSH_MAX_PUBKEY_BYTES]; |
char *comment = NULL, *cp, *ep, line[SSH_MAX_PUBKEY_BYTES]; |
int i, invalid = 1; |
int i, invalid = 1; |
const char *path; |
const char *path; |
long int lnum = 0; |
u_long lnum = 0; |
|
|
if (!have_identity) |
if (!have_identity) |
ask_filename(pw, "Enter file in which the key is"); |
ask_filename(pw, "Enter file in which the key is"); |
|
|
} |
} |
/* Retry after parsing leading hostname/key options */ |
/* Retry after parsing leading hostname/key options */ |
if (public == NULL && (public = try_read_key(&cp)) == NULL) { |
if (public == NULL && (public = try_read_key(&cp)) == NULL) { |
debug("%s:%ld: not a public key", path, lnum); |
debug("%s:%lu: not a public key", path, lnum); |
continue; |
continue; |
} |
} |
|
|
|
|
struct known_hosts_ctx *ctx = (struct known_hosts_ctx *)_ctx; |
struct known_hosts_ctx *ctx = (struct known_hosts_ctx *)_ctx; |
char *hashed, *cp, *hosts, *ohosts; |
char *hashed, *cp, *hosts, *ohosts; |
int has_wild = l->hosts && strcspn(l->hosts, "*?!") != strlen(l->hosts); |
int has_wild = l->hosts && strcspn(l->hosts, "*?!") != strlen(l->hosts); |
|
int was_hashed = l->hosts[0] == HASH_DELIM; |
|
|
switch (l->status) { |
switch (l->status) { |
case HKF_STATUS_OK: |
case HKF_STATUS_OK: |
|
|
* Don't hash hosts already already hashed, with wildcard |
* Don't hash hosts already already hashed, with wildcard |
* characters or a CA/revocation marker. |
* characters or a CA/revocation marker. |
*/ |
*/ |
if ((l->match & HKF_MATCH_HOST_HASHED) != 0 || |
if (was_hashed || has_wild || l->marker != MRK_NONE) { |
has_wild || l->marker != MRK_NONE) { |
|
fprintf(ctx->out, "%s\n", l->line); |
fprintf(ctx->out, "%s\n", l->line); |
if (has_wild && !find_host) { |
if (has_wild && !find_host) { |
logit("%s:%ld: ignoring host name " |
logit("%s:%ld: ignoring host name " |
|
|
known_hosts_hash(l, ctx); |
known_hosts_hash(l, ctx); |
else if (print_fingerprint) { |
else if (print_fingerprint) { |
fp = sshkey_fingerprint(l->key, fptype, rep); |
fp = sshkey_fingerprint(l->key, fptype, rep); |
printf("%s %s %s %s\n", ctx->host, |
mprintf("%s %s %s %s\n", ctx->host, |
sshkey_type(l->key), fp, l->comment); |
sshkey_type(l->key), fp, l->comment); |
free(fp); |
free(fp); |
} else |
} else |
|
|
fatal("Failed to load key %s: %s", identity_file, ssh_err(r)); |
fatal("Failed to load key %s: %s", identity_file, ssh_err(r)); |
} |
} |
if (comment) |
if (comment) |
printf("Key has comment '%s'\n", comment); |
mprintf("Key has comment '%s'\n", comment); |
|
|
/* Ask the new passphrase (twice). */ |
/* Ask the new passphrase (twice). */ |
if (identity_new_passphrase) { |
if (identity_new_passphrase) { |
|
|
sshkey_free(private); |
sshkey_free(private); |
exit(1); |
exit(1); |
} |
} |
printf("Key now has comment '%s'\n", comment); |
if (comment) |
|
printf("Key now has comment '%s'\n", comment); |
|
else |
|
printf("Key now has no comment\n"); |
|
|
if (identity_comment) { |
if (identity_comment) { |
strlcpy(new_comment, identity_comment, sizeof(new_comment)); |
strlcpy(new_comment, identity_comment, sizeof(new_comment)); |
|
|
ca = load_identity(tmp); |
ca = load_identity(tmp); |
free(tmp); |
free(tmp); |
|
|
|
if (key_type_name != NULL && |
|
sshkey_type_from_name(key_type_name) != ca->type) { |
|
fatal("CA key type %s doesn't match specified %s", |
|
sshkey_ssh_name(ca), key_type_name); |
|
} |
|
|
for (i = 0; i < argc; i++) { |
for (i = 0; i < argc; i++) { |
/* Split list of principals */ |
/* Split list of principals */ |
n = 0; |
n = 0; |
|
|
&public->cert->signature_key)) != 0) |
&public->cert->signature_key)) != 0) |
fatal("key_from_private (ca key): %s", ssh_err(r)); |
fatal("key_from_private (ca key): %s", ssh_err(r)); |
|
|
if (sshkey_certify(public, ca) != 0) |
if ((r = sshkey_certify(public, ca, key_type_name)) != 0) |
fatal("Couldn't not certify key %s", tmp); |
fatal("Couldn't certify key %s: %s", tmp, ssh_err(r)); |
|
|
if ((cp = strrchr(tmp, '.')) != NULL && strcmp(cp, ".pub") == 0) |
if ((cp = strrchr(tmp, '.')) != NULL && strcmp(cp, ".pub") == 0) |
*cp = '\0'; |
*cp = '\0'; |
|
|
FILE *f; |
FILE *f; |
char *cp, line[SSH_MAX_PUBKEY_BYTES]; |
char *cp, line[SSH_MAX_PUBKEY_BYTES]; |
const char *path; |
const char *path; |
long int lnum = 0; |
u_long lnum = 0; |
|
|
if (!have_identity) |
if (!have_identity) |
ask_filename(pw, "Enter file in which the key is"); |
ask_filename(pw, "Enter file in which the key is"); |
|
|
} |
} |
#endif |
#endif |
|
|
|
#ifdef WITH_SSH1 |
|
# define RSA1_USAGE " | rsa1" |
|
#else |
|
# define RSA1_USAGE "" |
|
#endif |
|
|
static void |
static void |
usage(void) |
usage(void) |
{ |
{ |
fprintf(stderr, |
fprintf(stderr, |
"usage: ssh-keygen [-q] [-b bits] [-t dsa | ecdsa | ed25519 | rsa | rsa1]\n" |
"usage: ssh-keygen [-q] [-b bits] [-t dsa | ecdsa | ed25519 | rsa%s]\n" |
" [-N new_passphrase] [-C comment] [-f output_keyfile]\n" |
" [-N new_passphrase] [-C comment] [-f output_keyfile]\n" |
" ssh-keygen -p [-P old_passphrase] [-N new_passphrase] [-f keyfile]\n" |
" ssh-keygen -p [-P old_passphrase] [-N new_passphrase] [-f keyfile]\n" |
" ssh-keygen -i [-m key_format] [-f input_keyfile]\n" |
" ssh-keygen -i [-m key_format] [-f input_keyfile]\n" |
|
|
" ssh-keygen -y [-f input_keyfile]\n" |
" ssh-keygen -y [-f input_keyfile]\n" |
" ssh-keygen -c [-P passphrase] [-C comment] [-f keyfile]\n" |
" ssh-keygen -c [-P passphrase] [-C comment] [-f keyfile]\n" |
" ssh-keygen -l [-v] [-E fingerprint_hash] [-f input_keyfile]\n" |
" ssh-keygen -l [-v] [-E fingerprint_hash] [-f input_keyfile]\n" |
" ssh-keygen -B [-f input_keyfile]\n"); |
" ssh-keygen -B [-f input_keyfile]\n", RSA1_USAGE); |
#ifdef ENABLE_PKCS11 |
#ifdef ENABLE_PKCS11 |
fprintf(stderr, |
fprintf(stderr, |
" ssh-keygen -D pkcs11\n"); |
" ssh-keygen -D pkcs11\n"); |
|
|
OpenSSL_add_all_algorithms(); |
OpenSSL_add_all_algorithms(); |
log_init(argv[0], SYSLOG_LEVEL_INFO, SYSLOG_FACILITY_USER, 1); |
log_init(argv[0], SYSLOG_LEVEL_INFO, SYSLOG_FACILITY_USER, 1); |
|
|
|
setlocale(LC_CTYPE, ""); |
|
|
/* we need this for the home * directory. */ |
/* we need this for the home * directory. */ |
pw = getpwuid(getuid()); |
pw = getpwuid(getuid()); |
if (!pw) |
if (!pw) |
|
|
break; |
break; |
case 'J': |
case 'J': |
lines_to_process = strtoul(optarg, NULL, 10); |
lines_to_process = strtoul(optarg, NULL, 10); |
break; |
break; |
case 'j': |
case 'j': |
start_lineno = strtoul(optarg, NULL, 10); |
start_lineno = strtoul(optarg, NULL, 10); |
break; |
break; |
case 'K': |
case 'K': |
if (strlen(optarg) >= PATH_MAX) |
if (strlen(optarg) >= PATH_MAX) |
fatal("Checkpoint filename too long"); |
fatal("Checkpoint filename too long"); |