version 1.308, 2017/11/03 05:14:04 |
version 1.313, 2018/02/23 15:58:38 |
|
|
case KEY_ED25519_CERT: |
case KEY_ED25519_CERT: |
name = _PATH_SSH_CLIENT_ID_ED25519; |
name = _PATH_SSH_CLIENT_ID_ED25519; |
break; |
break; |
|
case KEY_XMSS: |
|
case KEY_XMSS_CERT: |
|
name = _PATH_SSH_CLIENT_ID_XMSS; |
|
break; |
default: |
default: |
fatal("bad key type"); |
fatal("bad key type"); |
} |
} |
|
|
if (!PEM_write_RSAPublicKey(stdout, k->rsa)) |
if (!PEM_write_RSAPublicKey(stdout, k->rsa)) |
fatal("PEM_write_RSAPublicKey failed"); |
fatal("PEM_write_RSAPublicKey failed"); |
break; |
break; |
#if notyet /* OpenSSH 0.9.8 lacks this function */ |
|
case KEY_DSA: |
|
if (!PEM_write_DSAPublicKey(stdout, k->dsa)) |
|
fatal("PEM_write_DSAPublicKey failed"); |
|
break; |
|
#endif |
|
/* XXX ECDSA? */ |
|
default: |
default: |
fatal("%s: unsupported key type %s", __func__, sshkey_type(k)); |
fatal("%s: unsupported key type %s", __func__, sshkey_type(k)); |
} |
} |
|
|
|
|
/* try the key */ |
/* try the key */ |
if (sshkey_sign(key, &sig, &slen, data, sizeof(data), NULL, 0) != 0 || |
if (sshkey_sign(key, &sig, &slen, data, sizeof(data), NULL, 0) != 0 || |
sshkey_verify(key, sig, slen, data, sizeof(data), 0) != 0) { |
sshkey_verify(key, sig, slen, data, sizeof(data), NULL, 0) != 0) { |
sshkey_free(key); |
sshkey_free(key); |
free(sig); |
free(sig); |
return NULL; |
return NULL; |
|
|
{ |
{ |
FILE *fp; |
FILE *fp; |
RSA *rsa; |
RSA *rsa; |
#ifdef notyet |
|
DSA *dsa; |
|
#endif |
|
|
|
if ((fp = fopen(identity_file, "r")) == NULL) |
if ((fp = fopen(identity_file, "r")) == NULL) |
fatal("%s: %s: %s", __progname, identity_file, strerror(errno)); |
fatal("%s: %s: %s", __progname, identity_file, strerror(errno)); |
|
|
fclose(fp); |
fclose(fp); |
return; |
return; |
} |
} |
#if notyet /* OpenSSH 0.9.8 lacks this function */ |
|
rewind(fp); |
|
if ((dsa = PEM_read_DSAPublicKey(fp, NULL, NULL, NULL)) != NULL) { |
|
if ((*k = sshkey_new(KEY_UNSPEC)) == NULL) |
|
fatal("sshkey_new failed"); |
|
(*k)->type = KEY_DSA; |
|
(*k)->dsa = dsa; |
|
fclose(fp); |
|
return; |
|
} |
|
/* XXX ECDSA */ |
|
#endif |
|
fatal("%s: unrecognised raw private key format", __func__); |
fatal("%s: unrecognised raw private key format", __func__); |
} |
} |
|
|
|
|
{ "ecdsa", "ECDSA",_PATH_HOST_ECDSA_KEY_FILE }, |
{ "ecdsa", "ECDSA",_PATH_HOST_ECDSA_KEY_FILE }, |
#endif /* WITH_OPENSSL */ |
#endif /* WITH_OPENSSL */ |
{ "ed25519", "ED25519",_PATH_HOST_ED25519_KEY_FILE }, |
{ "ed25519", "ED25519",_PATH_HOST_ED25519_KEY_FILE }, |
|
#ifdef WITH_XMSS |
|
{ "xmss", "XMSS",_PATH_HOST_XMSS_KEY_FILE }, |
|
#endif /* WITH_XMSS */ |
{ NULL, NULL, NULL } |
{ NULL, NULL, NULL } |
}; |
}; |
|
|
|
|
} |
} |
} |
} |
|
|
if (private->type != KEY_ED25519 && !use_new_format) { |
if (private->type != KEY_ED25519 && private->type != KEY_XMSS && |
|
!use_new_format) { |
error("Comments are only supported for keys stored in " |
error("Comments are only supported for keys stored in " |
"the new format (-o)."); |
"the new format (-o)."); |
explicit_bzero(passphrase, strlen(passphrase)); |
explicit_bzero(passphrase, strlen(passphrase)); |
|
|
} |
} |
free(otmp); |
free(otmp); |
} |
} |
|
if (n > SSHKEY_CERT_MAX_PRINCIPALS) |
|
fatal("Too many certificate principals specified"); |
|
|
tmp = tilde_expand_filename(argv[i], pw->pw_uid); |
tmp = tilde_expand_filename(argv[i], pw->pw_uid); |
if ((r = sshkey_load_public(tmp, &public, &comment)) != 0) |
if ((r = sshkey_load_public(tmp, &public, &comment)) != 0) |
fatal("%s: unable to open \"%s\": %s", |
fatal("%s: unable to open \"%s\": %s", |
__func__, tmp, ssh_err(r)); |
__func__, tmp, ssh_err(r)); |
if (public->type != KEY_RSA && public->type != KEY_DSA && |
if (public->type != KEY_RSA && public->type != KEY_DSA && |
public->type != KEY_ECDSA && public->type != KEY_ED25519) |
public->type != KEY_ECDSA && public->type != KEY_ED25519 && |
|
public->type != KEY_XMSS) |
fatal("%s: key \"%s\" type %s cannot be certified", |
fatal("%s: key \"%s\" type %s cannot be certified", |
__func__, tmp, sshkey_type(public)); |
__func__, tmp, sshkey_type(public)); |
|
|
|
|
gen_all_hostkeys = 1; |
gen_all_hostkeys = 1; |
break; |
break; |
case 'b': |
case 'b': |
bits = (u_int32_t)strtonum(optarg, 256, 32768, &errstr); |
bits = (u_int32_t)strtonum(optarg, 10, 32768, &errstr); |
if (errstr) |
if (errstr) |
fatal("Bits has bad value %s (%s)", |
fatal("Bits has bad value %s (%s)", |
optarg, errstr); |
optarg, errstr); |
|
|
_PATH_HOST_ECDSA_KEY_FILE, rr_hostname); |
_PATH_HOST_ECDSA_KEY_FILE, rr_hostname); |
n += do_print_resource_record(pw, |
n += do_print_resource_record(pw, |
_PATH_HOST_ED25519_KEY_FILE, rr_hostname); |
_PATH_HOST_ED25519_KEY_FILE, rr_hostname); |
|
n += do_print_resource_record(pw, |
|
_PATH_HOST_XMSS_KEY_FILE, rr_hostname); |
if (n == 0) |
if (n == 0) |
fatal("no keys found."); |
fatal("no keys found."); |
exit(0); |
exit(0); |
|
|
if ((r = sshkey_write(public, f)) != 0) |
if ((r = sshkey_write(public, f)) != 0) |
error("write key failed: %s", ssh_err(r)); |
error("write key failed: %s", ssh_err(r)); |
fprintf(f, " %s\n", comment); |
fprintf(f, " %s\n", comment); |
fclose(f); |
if (ferror(f) || fclose(f) != 0) |
|
fatal("write public failed: %s", strerror(errno)); |
|
|
if (!quiet) { |
if (!quiet) { |
fp = sshkey_fingerprint(public, fingerprint_hash, |
fp = sshkey_fingerprint(public, fingerprint_hash, |