src/usr.bin/ssh/ssh-keygen.c - diff

Return to ssh-keygen.c CVS log

Up to [local] / src / usr.bin / ssh

Diff for /src/usr.bin/ssh/ssh-keygen.c between version 1.25.2.5 and 1.31

version 1.25.2.5, 2001/03/21 18:53:09

version 1.31, 2000/09/07 20:27:54

Line 16

#include <openssl/evp.h>

#include <openssl/pem.h>

#include <openssl/rsa.h>

#include <openssl/dsa.h>

#include "ssh.h"

#include "xmalloc.h"

#include "key.h"

#include "rsa.h"

#include "dsa.h"

#include "authfile.h"

#include "uuencode.h"

#include "buffer.h"

#include "bufaux.h"

#include "pathnames.h"

#include "log.h"

#include "readpass.h"

/* Number of bits in the RSA/DSA key. This value can be changed on the command line. */

int bits = 1024;

Line 46

/* Flag indicating that we just want to see the key fingerprint */

int print_fingerprint = 0;

int print_bubblebabble = 0;

/* The identity file name, given on the command line or entered by the user. */

char identity_file[1024];

Line 65

Line 64

int convert_to_ssh2 = 0;

int convert_from_ssh2 = 0;

int print_public = 0;

int dsa_mode = 0;

/* default to RSA for SSH-1 */

char *key_type_name = "rsa1";

/* argv0 */

extern char *__progname;

Line 78

Line 75

ask_filename(struct passwd *pw, const char *prompt)

{

char buf[1024];

char *name = NULL;

snprintf(identity_file, sizeof(identity_file), "%s/%s",

pw->pw_dir,

switch (key_type_from_name(key_type_name)) {

dsa_mode ? SSH_CLIENT_ID_DSA: SSH_CLIENT_IDENTITY);

case KEY_RSA1:

printf("%s (%s): ", prompt, identity_file);

name = _PATH_SSH_CLIENT_IDENTITY;

fflush(stdout);

break;

case KEY_DSA:

name = _PATH_SSH_CLIENT_ID_DSA;

break;

case KEY_RSA:

name = _PATH_SSH_CLIENT_ID_RSA;

break;

default:

fprintf(stderr, "bad key type");

exit(1);

break;

}

snprintf(identity_file, sizeof(identity_file), "%s/%s", pw->pw_dir, name);

fprintf(stderr, "%s (%s): ", prompt, identity_file);

fflush(stderr);

if (fgets(buf, sizeof(buf), stdin) == NULL)

exit(1);

if (strchr(buf, '\n'))

Line 122

Line 104

return success;

}

#define SSH_COM_PUBLIC_BEGIN "---- BEGIN SSH2 PUBLIC KEY ----"

#define SSH_COM_MAGIC_BEGIN "---- BEGIN SSH2 PUBLIC KEY ----"

#define SSH_COM_PUBLIC_END "---- END SSH2 PUBLIC KEY ----"

#define SSH_COM_MAGIC_END "---- END SSH2 PUBLIC KEY ----"

#define SSH_COM_PRIVATE_BEGIN "---- BEGIN SSH2 ENCRYPTED PRIVATE KEY ----"

#define SSH_COM_PRIVATE_KEY_MAGIC 0x3f6ff9eb

void

do_convert_to_ssh2(struct passwd *pw)

{

Key *k;

int len;

u_char *blob;

unsigned char *blob;

struct stat st;

if (!have_identity)

Line 141

Line 121

perror(identity_file);

exit(1);

}

k = key_new(KEY_UNSPEC);

k = key_new(KEY_DSA);

if (!try_load_key(identity_file, k)) {

fprintf(stderr, "load failed\n");

exit(1);

}

key_to_blob(k, &blob, &len);

dsa_make_key_blob(k, &blob, &len);

fprintf(stdout, "%s\n", SSH_COM_PUBLIC_BEGIN);

fprintf(stdout, "%s\n", SSH_COM_MAGIC_BEGIN);

fprintf(stdout,

"Comment: \"%d-bit %s, converted from OpenSSH by %s@%s\"\n",

"Comment: \"%d-bit DSA, converted from openssh by %s@%s\"\n",

key_size(k), key_type(k),

BN_num_bits(k->dsa->p),

pw->pw_name, hostname);

dump_base64(stdout, blob, len);

fprintf(stdout, "%s\n", SSH_COM_PUBLIC_END);

fprintf(stdout, "%s\n", SSH_COM_MAGIC_END);

key_free(k);

xfree(blob);

exit(0);

}

void

buffer_get_bignum_bits(Buffer *b, BIGNUM *value)

{

int bits = buffer_get_int(b);

int bytes = (bits + 7) / 8;

if (buffer_len(b) < bytes)

fatal("buffer_get_bignum_bits: input buffer too small");

BN_bin2bn((u_char *)buffer_ptr(b), bytes, value);

buffer_consume(b, bytes);

}

Key *

do_convert_private_ssh2_from_blob(char *blob, int blen)

{

Buffer b;

DSA *dsa;

Key *key = NULL;

int ignore, magic, rlen;

char *type, *cipher;

buffer_init(&b);

buffer_append(&b, blob, blen);

magic = buffer_get_int(&b);

if (magic != SSH_COM_PRIVATE_KEY_MAGIC) {

error("bad magic 0x%x != 0x%x", magic, SSH_COM_PRIVATE_KEY_MAGIC);

buffer_free(&b);

return NULL;

}

ignore = buffer_get_int(&b);

type = buffer_get_string(&b, NULL);

cipher = buffer_get_string(&b, NULL);

ignore = buffer_get_int(&b);

xfree(type);

if (strcmp(cipher, "none") != 0) {

error("unsupported cipher %s", cipher);

xfree(cipher);

buffer_free(&b);

return NULL;

}

xfree(cipher);

key = key_new(KEY_DSA);

dsa = key->dsa;

dsa->priv_key = BN_new();

if (dsa->priv_key == NULL) {

error("alloc priv_key failed");

key_free(key);

return NULL;

}

buffer_get_bignum_bits(&b, dsa->p);

buffer_get_bignum_bits(&b, dsa->g);

buffer_get_bignum_bits(&b, dsa->q);

buffer_get_bignum_bits(&b, dsa->pub_key);

buffer_get_bignum_bits(&b, dsa->priv_key);

rlen = buffer_len(&b);

if(rlen != 0)

error("do_convert_private_ssh2_from_blob: remaining bytes in key blob %d", rlen);

buffer_free(&b);

return key;

}

void

do_convert_from_ssh2(struct passwd *pw)

{

Key *k;

Line 233

Line 148

char blob[8096];

char encoded[8096];

struct stat st;

int escaped = 0, private = 0, ok;

int escaped = 0;

FILE *fp;

if (!have_identity)

Line 257

Line 172

escaped++;

if (strncmp(line, "----", 4) == 0 ||

strstr(line, ": ") != NULL) {

if (strstr(line, SSH_COM_PRIVATE_BEGIN) != NULL)

private = 1;

fprintf(stderr, "ignore: %s", line);

continue;

}

Line 270

Line 183

*p = '\0';

strlcat(encoded, line, sizeof(encoded));

}

blen = uudecode(encoded, (u_char *)blob, sizeof(blob));

blen = uudecode(encoded, (unsigned char *)blob, sizeof(blob));

if (blen < 0) {

fprintf(stderr, "uudecode failed.\n");

exit(1);

}

k = private ?

k = dsa_key_from_blob(blob, blen);

do_convert_private_ssh2_from_blob(blob, blen) :

if (!key_write(k, stdout))

key_from_blob(blob, blen);

fprintf(stderr, "key_write failed");

if (k == NULL) {

fprintf(stderr, "decode blob failed.\n");

exit(1);

}

ok = private ?

PEM_write_DSAPrivateKey(stdout, k->dsa, NULL, NULL, 0, NULL, NULL) :

key_write(k, stdout);

if (!ok) {

fprintf(stderr, "key write failed");

exit(1);

}

key_free(k);

fprintf(stdout, "\n");

fclose(fp);

Line 299

Line 201

do_print_public(struct passwd *pw)

{

Key *k;

int len;

unsigned char *blob;

struct stat st;

if (!have_identity)

Line 307

Line 211

perror(identity_file);

exit(1);

}

k = key_new(KEY_UNSPEC);

k = key_new(KEY_DSA);

if (!try_load_key(identity_file, k)) {

fprintf(stderr, "load failed\n");

exit(1);

}

dsa_make_key_blob(k, &blob, &len);

if (!key_write(k, stdout))

fprintf(stderr, "key_write failed");

key_free(k);

xfree(blob);

fprintf(stdout, "\n");

exit(0);

}

Line 322

Line 228

void

do_fingerprint(struct passwd *pw)

{

/* XXX RSA1 only */

FILE *f;

Key *public;

char *comment = NULL, *cp, *ep, line[16*1024], *fp;

char *comment = NULL, *cp, *ep, line[16*1024];

int i, skip = 0, num = 1, invalid = 1, success = 0, rep, type;

int i, skip = 0, num = 1, invalid = 1;

unsigned int ignore;

struct stat st;

type = print_bubblebabble ? SSH_FP_SHA1 : SSH_FP_MD5;

rep = print_bubblebabble ? SSH_FP_BUBBLEBABBLE : SSH_FP_HEX;

if (!have_identity)

ask_filename(pw, "Enter file in which the key is");

if (stat(identity_file, &st) < 0) {

perror(identity_file);

exit(1);

}

public = key_new(KEY_RSA1);

public = key_new(KEY_RSA);

if (load_public_key(identity_file, public, &comment)) {

success = 1;

printf("%d %s %s\n", BN_num_bits(public->rsa->n),

} else {

key_fingerprint(public), comment);

key_free(public);

public = key_new(KEY_UNSPEC);

if (try_load_public_key(identity_file, public, &comment))

success = 1;

else

debug("try_load_public_key KEY_UNSPEC failed");

}

if (success) {

fp = key_fingerprint(public, type, rep);

printf("%d %s %s\n", key_size(public),

fp, comment);

key_free(public);

xfree(comment);

xfree(fp);

exit(0);

}

Line 394

Line 287

*cp++ = '\0';

}

ep = cp;

public = key_new(KEY_RSA1);

if (auth_rsa_read_key(&cp, &ignore, public->rsa->e, public->rsa->n)) {

if (key_read(public, &cp) != 1) {

invalid = 0;

cp = ep;

comment = *cp ? cp : comment;

key_free(public);

printf("%d %s %s\n", key_size(public),

public = key_new(KEY_UNSPEC);

key_fingerprint(public),

if (key_read(public, &cp) != 1) {

comment ? comment : "no comment");

key_free(public);

continue;

}

comment = *cp ? cp : comment;

fp = key_fingerprint(public, type, rep);

printf("%d %s %s\n", key_size(public), fp,

comment ? comment : "no comment");

xfree(fp);

invalid = 0;

}

fclose(f);

}

Line 433

Line 317

struct stat st;

Key *private;

Key *public;

int type = KEY_RSA1;

int type = dsa_mode ? KEY_DSA : KEY_RSA;

if (!have_identity)

ask_filename(pw, "Enter file in which the key is");

Line 441

Line 325

perror(identity_file);

exit(1);

}

public = key_new(type);

if (!load_public_key(identity_file, public, NULL)) {

if (type == KEY_RSA) {

type = KEY_UNSPEC;

/* XXX this works currently only for RSA */

} else {

public = key_new(type);

if (!load_public_key(identity_file, public, NULL)) {

printf("%s is not a valid key file.\n", identity_file);

exit(1);

}

/* Clear the public key since we are just about to load the whole file. */

key_free(public);

}

/* Try to load the file with empty passphrase. */

private = key_new(type);

if (!load_private_key(identity_file, "", private, &comment)) {

Line 515

Line 404

void

do_change_comment(struct passwd *pw)

{

char new_comment[1024], *comment, *passphrase;

char new_comment[1024], *comment;

Key *private, *public;

Key *private;

Key *public;

char *passphrase;

struct stat st;

FILE *f;

int fd;

if (!have_identity)

ask_filename(pw, "Enter file in which the key is");

Line 531

Line 421

* Try to load the public key from the file the verify that it is

* readable and of the proper format.

public = key_new(KEY_RSA1);

public = key_new(KEY_RSA);

if (!load_public_key(identity_file, public, NULL)) {

printf("%s is not a valid key file.\n", identity_file);

printf("Comments are only supported in RSA1 keys\n");

exit(1);

}

private = key_new(KEY_RSA1);

private = key_new(KEY_RSA);

if (load_private_key(identity_file, "", private, &comment))

passphrase = xstrdup("");

else {

Line 587

Line 476

key_free(private);

strlcat(identity_file, ".pub", sizeof(identity_file));

fd = open(identity_file, O_WRONLY | O_CREAT | O_TRUNC, 0644);

f = fopen(identity_file, "w");

if (fd == -1) {

if (!f) {

printf("Could not save your public key in %s\n", identity_file);

exit(1);

}

f = fdopen(fd, "w");

if (f == NULL) {

printf("fdopen %s failed", identity_file);

exit(1);

}

if (!key_write(public, f))

fprintf(stderr, "write key failed");

key_free(public);

Line 612

Line 496

void

usage(void)

{

printf("Usage: %s [-lpqxXyc] [-t type] [-b bits] [-f file] [-C comment] "

printf("Usage: %s [-lpqxXydc] [-b bits] [-f file] [-C comment] [-N new-pass] [-P pass]\n", __progname);

"[-N new-pass] [-P pass]\n", __progname);

exit(1);

}

Line 624

Line 507

main(int ac, char **av)

{

char dotsshdir[16 * 1024], comment[1024], *passphrase1, *passphrase2;

Key *private, *public;

struct passwd *pw;

int opt, type, fd;

int opt;

struct stat st;

FILE *f;

Key *private;

Key *public;

extern int optind;

extern char *optarg;

Line 646

Line 529

exit(1);

}

while ((opt = getopt(ac, av, "dqpclBRxXyb:f:t:P:N:C:")) != -1) {

while ((opt = getopt(ac, av, "dqpclRxXyb:f:P:N:C:")) != EOF) {

switch (opt) {

case 'b':

bits = atoi(optarg);

Line 660

Line 543

print_fingerprint = 1;

break;

case 'B':

print_bubblebabble = 1;

break;

case 'p':

change_passphrase = 1;

break;

Line 694

Line 573

break;

case 'R':

/* unused */

if (rsa_alive() == 0)

exit(0);

exit(1);

else

exit(0);

break;

case 'x':

Line 711

Line 592

break;

case 'd':

key_type_name = "dsa";

dsa_mode = 1;

break;

case 't':

key_type_name = optarg;

break;

case '?':

default:

usage();

Line 731

Line 608

printf("Can only have one of -p and -c.\n");

usage();

}

if (print_fingerprint || print_bubblebabble)

/* check if RSA support is needed and exists */

if (dsa_mode == 0 && rsa_alive() == 0) {

fprintf(stderr,

"%s: no RSA support in libssl and libcrypto. See ssl(8).\n",

__progname);

exit(1);

}

if (print_fingerprint)

do_fingerprint(pw);

if (change_passphrase)

do_change_passphrase(pw);

Line 746

Line 630

arc4random_stir();

type = key_type_from_name(key_type_name);

if (dsa_mode != 0) {

if (type == KEY_UNSPEC) {

if (!quiet)

fprintf(stderr, "unknown key type %s\n", key_type_name);

printf("Generating DSA parameter and key.\n");

exit(1);

public = private = dsa_generate_key(bits);

if (private == NULL) {

fprintf(stderr, "dsa_generate_keys failed");

exit(1);

}

} else {

if (quiet)

rsa_set_verbose(0);

/* Generate the rsa key pair. */

public = key_new(KEY_RSA);

private = key_new(KEY_RSA);

rsa_generate_key(private->rsa, public->rsa, bits);

}

if (!quiet)

printf("Generating public/private %s key pair.\n", key_type_name);

private = key_generate(type, bits);

if (private == NULL) {

fprintf(stderr, "key_generate failed");

exit(1);

}

public = key_from_private(private);

if (!have_identity)

ask_filename(pw, "Enter file in which to save the key");

/* Create ~/.ssh directory if it doesn\'t already exist. */

snprintf(dotsshdir, sizeof dotsshdir, "%s/%s", pw->pw_dir, _PATH_SSH_USER_DIR);

snprintf(dotsshdir, sizeof dotsshdir, "%s/%s", pw->pw_dir, SSH_USER_DIR);

if (strstr(identity_file, dotsshdir) != NULL &&

stat(dotsshdir, &st) < 0) {

if (mkdir(dotsshdir, 0700) < 0)

Line 827

Line 714

xfree(passphrase1);

/* Clear the private key and the random number generator. */

key_free(private);

if (private != public) {

key_free(private);

}

arc4random_stir();

if (!quiet)

printf("Your identification has been saved in %s.\n", identity_file);

strlcat(identity_file, ".pub", sizeof(identity_file));

fd = open(identity_file, O_WRONLY | O_CREAT | O_TRUNC, 0644);

f = fopen(identity_file, "w");

if (fd == -1) {

if (!f) {

printf("Could not save your public key in %s\n", identity_file);

exit(1);

}

f = fdopen(fd, "w");

if (f == NULL) {

printf("fdopen %s failed", identity_file);

exit(1);

}

if (!key_write(public, f))

fprintf(stderr, "write key failed");

fprintf(f, " %s\n", comment);

fclose(f);

if (!quiet) {

char *fp = key_fingerprint(public, SSH_FP_MD5, SSH_FP_HEX);

printf("Your public key has been saved in %s.\n",

identity_file);

printf("The key fingerprint is:\n");

printf("%s %s\n", fp, comment);

printf("%s %s\n", key_fingerprint(public), comment);

xfree(fp);

}

key_free(public);