version 1.311, 2018/02/10 05:43:26 |
version 1.316, 2018/06/01 04:21:29 |
|
|
case KEY_ED25519_CERT: |
case KEY_ED25519_CERT: |
name = _PATH_SSH_CLIENT_ID_ED25519; |
name = _PATH_SSH_CLIENT_ID_ED25519; |
break; |
break; |
|
case KEY_XMSS: |
|
case KEY_XMSS_CERT: |
|
name = _PATH_SSH_CLIENT_ID_XMSS; |
|
break; |
default: |
default: |
fatal("bad key type"); |
fatal("bad key type"); |
} |
} |
|
|
{ "ecdsa", "ECDSA",_PATH_HOST_ECDSA_KEY_FILE }, |
{ "ecdsa", "ECDSA",_PATH_HOST_ECDSA_KEY_FILE }, |
#endif /* WITH_OPENSSL */ |
#endif /* WITH_OPENSSL */ |
{ "ed25519", "ED25519",_PATH_HOST_ED25519_KEY_FILE }, |
{ "ed25519", "ED25519",_PATH_HOST_ED25519_KEY_FILE }, |
|
#ifdef WITH_XMSS |
|
{ "xmss", "XMSS",_PATH_HOST_XMSS_KEY_FILE }, |
|
#endif /* WITH_XMSS */ |
{ NULL, NULL, NULL } |
{ NULL, NULL, NULL } |
}; |
}; |
|
|
|
|
} |
} |
inplace = 1; |
inplace = 1; |
} |
} |
|
|
/* XXX support identity_file == "-" for stdin */ |
/* XXX support identity_file == "-" for stdin */ |
foreach_options = find_host ? HKF_WANT_MATCH : 0; |
foreach_options = find_host ? HKF_WANT_MATCH : 0; |
foreach_options |= print_fingerprint ? HKF_WANT_PARSE_KEY : 0; |
foreach_options |= print_fingerprint ? HKF_WANT_PARSE_KEY : 0; |
if ((r = hostkeys_foreach(identity_file, |
if ((r = hostkeys_foreach(identity_file, (find_host || !hash_hosts) ? |
hash_hosts ? known_hosts_hash : known_hosts_find_delete, &ctx, |
known_hosts_find_delete : known_hosts_hash, &ctx, name, NULL, |
name, NULL, foreach_options)) != 0) { |
foreach_options)) != 0) { |
if (inplace) |
if (inplace) |
unlink(tmp); |
unlink(tmp); |
fatal("%s: hostkeys_foreach failed: %s", __func__, ssh_err(r)); |
fatal("%s: hostkeys_foreach failed: %s", __func__, ssh_err(r)); |
|
|
} |
} |
} |
} |
|
|
if (private->type != KEY_ED25519 && !use_new_format) { |
if (private->type != KEY_ED25519 && private->type != KEY_XMSS && |
|
!use_new_format) { |
error("Comments are only supported for keys stored in " |
error("Comments are only supported for keys stored in " |
"the new format (-o)."); |
"the new format (-o)."); |
explicit_bzero(passphrase, strlen(passphrase)); |
explicit_bzero(passphrase, strlen(passphrase)); |
|
|
} |
} |
free(otmp); |
free(otmp); |
} |
} |
|
if (n > SSHKEY_CERT_MAX_PRINCIPALS) |
|
fatal("Too many certificate principals specified"); |
|
|
tmp = tilde_expand_filename(argv[i], pw->pw_uid); |
tmp = tilde_expand_filename(argv[i], pw->pw_uid); |
if ((r = sshkey_load_public(tmp, &public, &comment)) != 0) |
if ((r = sshkey_load_public(tmp, &public, &comment)) != 0) |
fatal("%s: unable to open \"%s\": %s", |
fatal("%s: unable to open \"%s\": %s", |
__func__, tmp, ssh_err(r)); |
__func__, tmp, ssh_err(r)); |
if (public->type != KEY_RSA && public->type != KEY_DSA && |
if (public->type != KEY_RSA && public->type != KEY_DSA && |
public->type != KEY_ECDSA && public->type != KEY_ED25519) |
public->type != KEY_ECDSA && public->type != KEY_ED25519 && |
|
public->type != KEY_XMSS) |
fatal("%s: key \"%s\" type %s cannot be certified", |
fatal("%s: key \"%s\" type %s cannot be certified", |
__func__, tmp, sshkey_type(public)); |
__func__, tmp, sshkey_type(public)); |
|
|
|
|
return now + (u_int64_t)(secs * mul); |
return now + (u_int64_t)(secs * mul); |
} |
} |
|
|
static u_int64_t |
|
parse_absolute_time(const char *s) |
|
{ |
|
struct tm tm; |
|
time_t tt; |
|
char buf[32], *fmt; |
|
|
|
/* |
|
* POSIX strptime says "The application shall ensure that there |
|
* is white-space or other non-alphanumeric characters between |
|
* any two conversion specifications" so arrange things this way. |
|
*/ |
|
switch (strlen(s)) { |
|
case 8: |
|
fmt = "%Y-%m-%d"; |
|
snprintf(buf, sizeof(buf), "%.4s-%.2s-%.2s", s, s + 4, s + 6); |
|
break; |
|
case 14: |
|
fmt = "%Y-%m-%dT%H:%M:%S"; |
|
snprintf(buf, sizeof(buf), "%.4s-%.2s-%.2sT%.2s:%.2s:%.2s", |
|
s, s + 4, s + 6, s + 8, s + 10, s + 12); |
|
break; |
|
default: |
|
fatal("Invalid certificate time format \"%s\"", s); |
|
} |
|
|
|
memset(&tm, 0, sizeof(tm)); |
|
if (strptime(buf, fmt, &tm) == NULL) |
|
fatal("Invalid certificate time %s", s); |
|
if ((tt = mktime(&tm)) < 0) |
|
fatal("Certificate time %s cannot be represented", s); |
|
return (u_int64_t)tt; |
|
} |
|
|
|
static void |
static void |
parse_cert_times(char *timespec) |
parse_cert_times(char *timespec) |
{ |
{ |
|
|
cert_valid_from = parse_relative_time(from, now); |
cert_valid_from = parse_relative_time(from, now); |
else if (strcmp(from, "always") == 0) |
else if (strcmp(from, "always") == 0) |
cert_valid_from = 0; |
cert_valid_from = 0; |
else |
else if (parse_absolute_time(from, &cert_valid_from) != 0) |
cert_valid_from = parse_absolute_time(from); |
fatal("Invalid from time \"%s\"", from); |
|
|
if (*to == '-' || *to == '+') |
if (*to == '-' || *to == '+') |
cert_valid_to = parse_relative_time(to, now); |
cert_valid_to = parse_relative_time(to, now); |
else if (strcmp(to, "forever") == 0) |
else if (strcmp(to, "forever") == 0) |
cert_valid_to = ~(u_int64_t)0; |
cert_valid_to = ~(u_int64_t)0; |
else |
else if (parse_absolute_time(to, &cert_valid_to) != 0) |
cert_valid_to = parse_absolute_time(to); |
fatal("Invalid to time \"%s\"", to); |
|
|
if (cert_valid_to <= cert_valid_from) |
if (cert_valid_to <= cert_valid_from) |
fatal("Empty certificate validity interval"); |
fatal("Empty certificate validity interval"); |
|
|
gen_all_hostkeys = 1; |
gen_all_hostkeys = 1; |
break; |
break; |
case 'b': |
case 'b': |
bits = (u_int32_t)strtonum(optarg, 256, 32768, &errstr); |
bits = (u_int32_t)strtonum(optarg, 10, 32768, &errstr); |
if (errstr) |
if (errstr) |
fatal("Bits has bad value %s (%s)", |
fatal("Bits has bad value %s (%s)", |
optarg, errstr); |
optarg, errstr); |
|
|
_PATH_HOST_ECDSA_KEY_FILE, rr_hostname); |
_PATH_HOST_ECDSA_KEY_FILE, rr_hostname); |
n += do_print_resource_record(pw, |
n += do_print_resource_record(pw, |
_PATH_HOST_ED25519_KEY_FILE, rr_hostname); |
_PATH_HOST_ED25519_KEY_FILE, rr_hostname); |
|
n += do_print_resource_record(pw, |
|
_PATH_HOST_XMSS_KEY_FILE, rr_hostname); |
if (n == 0) |
if (n == 0) |
fatal("no keys found."); |
fatal("no keys found."); |
exit(0); |
exit(0); |