version 1.308, 2017/11/03 05:14:04 |
version 1.318, 2018/07/09 21:59:10 |
|
|
case KEY_ED25519_CERT: |
case KEY_ED25519_CERT: |
name = _PATH_SSH_CLIENT_ID_ED25519; |
name = _PATH_SSH_CLIENT_ID_ED25519; |
break; |
break; |
|
case KEY_XMSS: |
|
case KEY_XMSS_CERT: |
|
name = _PATH_SSH_CLIENT_ID_XMSS; |
|
break; |
default: |
default: |
fatal("bad key type"); |
fatal("bad key type"); |
} |
} |
|
|
if (!PEM_write_RSAPublicKey(stdout, k->rsa)) |
if (!PEM_write_RSAPublicKey(stdout, k->rsa)) |
fatal("PEM_write_RSAPublicKey failed"); |
fatal("PEM_write_RSAPublicKey failed"); |
break; |
break; |
#if notyet /* OpenSSH 0.9.8 lacks this function */ |
|
case KEY_DSA: |
|
if (!PEM_write_DSAPublicKey(stdout, k->dsa)) |
|
fatal("PEM_write_DSAPublicKey failed"); |
|
break; |
|
#endif |
|
/* XXX ECDSA? */ |
|
default: |
default: |
fatal("%s: unsupported key type %s", __func__, sshkey_type(k)); |
fatal("%s: unsupported key type %s", __func__, sshkey_type(k)); |
} |
} |
|
|
|
|
/* try the key */ |
/* try the key */ |
if (sshkey_sign(key, &sig, &slen, data, sizeof(data), NULL, 0) != 0 || |
if (sshkey_sign(key, &sig, &slen, data, sizeof(data), NULL, 0) != 0 || |
sshkey_verify(key, sig, slen, data, sizeof(data), 0) != 0) { |
sshkey_verify(key, sig, slen, data, sizeof(data), NULL, 0) != 0) { |
sshkey_free(key); |
sshkey_free(key); |
free(sig); |
free(sig); |
return NULL; |
return NULL; |
|
|
{ |
{ |
FILE *fp; |
FILE *fp; |
RSA *rsa; |
RSA *rsa; |
#ifdef notyet |
|
DSA *dsa; |
|
#endif |
|
|
|
if ((fp = fopen(identity_file, "r")) == NULL) |
if ((fp = fopen(identity_file, "r")) == NULL) |
fatal("%s: %s: %s", __progname, identity_file, strerror(errno)); |
fatal("%s: %s: %s", __progname, identity_file, strerror(errno)); |
|
|
fclose(fp); |
fclose(fp); |
return; |
return; |
} |
} |
#if notyet /* OpenSSH 0.9.8 lacks this function */ |
|
rewind(fp); |
|
if ((dsa = PEM_read_DSAPublicKey(fp, NULL, NULL, NULL)) != NULL) { |
|
if ((*k = sshkey_new(KEY_UNSPEC)) == NULL) |
|
fatal("sshkey_new failed"); |
|
(*k)->type = KEY_DSA; |
|
(*k)->dsa = dsa; |
|
fclose(fp); |
|
return; |
|
} |
|
/* XXX ECDSA */ |
|
#endif |
|
fatal("%s: unrecognised raw private key format", __func__); |
fatal("%s: unrecognised raw private key format", __func__); |
} |
} |
|
|
|
|
{ |
{ |
FILE *f; |
FILE *f; |
struct sshkey *public = NULL; |
struct sshkey *public = NULL; |
char *comment = NULL, *cp, *ep, line[SSH_MAX_PUBKEY_BYTES]; |
char *comment = NULL, *cp, *ep, *line = NULL; |
|
size_t linesize = 0; |
int i, invalid = 1; |
int i, invalid = 1; |
const char *path; |
const char *path; |
u_long lnum = 0; |
u_long lnum = 0; |
|
|
} else if ((f = fopen(path, "r")) == NULL) |
} else if ((f = fopen(path, "r")) == NULL) |
fatal("%s: %s: %s", __progname, path, strerror(errno)); |
fatal("%s: %s: %s", __progname, path, strerror(errno)); |
|
|
while (read_keyfile_line(f, path, line, sizeof(line), &lnum) == 0) { |
while (getline(&line, &linesize, f) != -1) { |
|
lnum++; |
cp = line; |
cp = line; |
cp[strcspn(cp, "\n")] = '\0'; |
cp[strcspn(cp, "\n")] = '\0'; |
/* Trim leading space and comments */ |
/* Trim leading space and comments */ |
|
|
*/ |
*/ |
if (lnum == 1 && strcmp(identity_file, "-") != 0 && |
if (lnum == 1 && strcmp(identity_file, "-") != 0 && |
strstr(cp, "PRIVATE KEY") != NULL) { |
strstr(cp, "PRIVATE KEY") != NULL) { |
|
free(line); |
fclose(f); |
fclose(f); |
fingerprint_private(path); |
fingerprint_private(path); |
exit(0); |
exit(0); |
|
|
invalid = 0; /* One good key in the file is sufficient */ |
invalid = 0; /* One good key in the file is sufficient */ |
} |
} |
fclose(f); |
fclose(f); |
|
free(line); |
|
|
if (invalid) |
if (invalid) |
fatal("%s is not a public key file.", path); |
fatal("%s is not a public key file.", path); |
|
|
{ "ecdsa", "ECDSA",_PATH_HOST_ECDSA_KEY_FILE }, |
{ "ecdsa", "ECDSA",_PATH_HOST_ECDSA_KEY_FILE }, |
#endif /* WITH_OPENSSL */ |
#endif /* WITH_OPENSSL */ |
{ "ed25519", "ED25519",_PATH_HOST_ED25519_KEY_FILE }, |
{ "ed25519", "ED25519",_PATH_HOST_ED25519_KEY_FILE }, |
|
#ifdef WITH_XMSS |
|
{ "xmss", "XMSS",_PATH_HOST_XMSS_KEY_FILE }, |
|
#endif /* WITH_XMSS */ |
{ NULL, NULL, NULL } |
{ NULL, NULL, NULL } |
}; |
}; |
|
|
|
|
} |
} |
inplace = 1; |
inplace = 1; |
} |
} |
|
|
/* XXX support identity_file == "-" for stdin */ |
/* XXX support identity_file == "-" for stdin */ |
foreach_options = find_host ? HKF_WANT_MATCH : 0; |
foreach_options = find_host ? HKF_WANT_MATCH : 0; |
foreach_options |= print_fingerprint ? HKF_WANT_PARSE_KEY : 0; |
foreach_options |= print_fingerprint ? HKF_WANT_PARSE_KEY : 0; |
if ((r = hostkeys_foreach(identity_file, |
if ((r = hostkeys_foreach(identity_file, (find_host || !hash_hosts) ? |
hash_hosts ? known_hosts_hash : known_hosts_find_delete, &ctx, |
known_hosts_find_delete : known_hosts_hash, &ctx, name, NULL, |
name, NULL, foreach_options)) != 0) { |
foreach_options)) != 0) { |
if (inplace) |
if (inplace) |
unlink(tmp); |
unlink(tmp); |
fatal("%s: hostkeys_foreach failed: %s", __func__, ssh_err(r)); |
fatal("%s: hostkeys_foreach failed: %s", __func__, ssh_err(r)); |
|
|
} |
} |
} |
} |
|
|
if (private->type != KEY_ED25519 && !use_new_format) { |
if (private->type != KEY_ED25519 && private->type != KEY_XMSS && |
|
!use_new_format) { |
error("Comments are only supported for keys stored in " |
error("Comments are only supported for keys stored in " |
"the new format (-o)."); |
"the new format (-o)."); |
explicit_bzero(passphrase, strlen(passphrase)); |
explicit_bzero(passphrase, strlen(passphrase)); |
|
|
} |
} |
free(otmp); |
free(otmp); |
} |
} |
|
if (n > SSHKEY_CERT_MAX_PRINCIPALS) |
|
fatal("Too many certificate principals specified"); |
|
|
tmp = tilde_expand_filename(argv[i], pw->pw_uid); |
tmp = tilde_expand_filename(argv[i], pw->pw_uid); |
if ((r = sshkey_load_public(tmp, &public, &comment)) != 0) |
if ((r = sshkey_load_public(tmp, &public, &comment)) != 0) |
fatal("%s: unable to open \"%s\": %s", |
fatal("%s: unable to open \"%s\": %s", |
__func__, tmp, ssh_err(r)); |
__func__, tmp, ssh_err(r)); |
if (public->type != KEY_RSA && public->type != KEY_DSA && |
if (public->type != KEY_RSA && public->type != KEY_DSA && |
public->type != KEY_ECDSA && public->type != KEY_ED25519) |
public->type != KEY_ECDSA && public->type != KEY_ED25519 && |
|
public->type != KEY_XMSS) |
fatal("%s: key \"%s\" type %s cannot be certified", |
fatal("%s: key \"%s\" type %s cannot be certified", |
__func__, tmp, sshkey_type(public)); |
__func__, tmp, sshkey_type(public)); |
|
|
|
|
return now + (u_int64_t)(secs * mul); |
return now + (u_int64_t)(secs * mul); |
} |
} |
|
|
static u_int64_t |
|
parse_absolute_time(const char *s) |
|
{ |
|
struct tm tm; |
|
time_t tt; |
|
char buf[32], *fmt; |
|
|
|
/* |
|
* POSIX strptime says "The application shall ensure that there |
|
* is white-space or other non-alphanumeric characters between |
|
* any two conversion specifications" so arrange things this way. |
|
*/ |
|
switch (strlen(s)) { |
|
case 8: |
|
fmt = "%Y-%m-%d"; |
|
snprintf(buf, sizeof(buf), "%.4s-%.2s-%.2s", s, s + 4, s + 6); |
|
break; |
|
case 14: |
|
fmt = "%Y-%m-%dT%H:%M:%S"; |
|
snprintf(buf, sizeof(buf), "%.4s-%.2s-%.2sT%.2s:%.2s:%.2s", |
|
s, s + 4, s + 6, s + 8, s + 10, s + 12); |
|
break; |
|
default: |
|
fatal("Invalid certificate time format \"%s\"", s); |
|
} |
|
|
|
memset(&tm, 0, sizeof(tm)); |
|
if (strptime(buf, fmt, &tm) == NULL) |
|
fatal("Invalid certificate time %s", s); |
|
if ((tt = mktime(&tm)) < 0) |
|
fatal("Certificate time %s cannot be represented", s); |
|
return (u_int64_t)tt; |
|
} |
|
|
|
static void |
static void |
parse_cert_times(char *timespec) |
parse_cert_times(char *timespec) |
{ |
{ |
|
|
cert_valid_from = parse_relative_time(from, now); |
cert_valid_from = parse_relative_time(from, now); |
else if (strcmp(from, "always") == 0) |
else if (strcmp(from, "always") == 0) |
cert_valid_from = 0; |
cert_valid_from = 0; |
else |
else if (parse_absolute_time(from, &cert_valid_from) != 0) |
cert_valid_from = parse_absolute_time(from); |
fatal("Invalid from time \"%s\"", from); |
|
|
if (*to == '-' || *to == '+') |
if (*to == '-' || *to == '+') |
cert_valid_to = parse_relative_time(to, now); |
cert_valid_to = parse_relative_time(to, now); |
else if (strcmp(to, "forever") == 0) |
else if (strcmp(to, "forever") == 0) |
cert_valid_to = ~(u_int64_t)0; |
cert_valid_to = ~(u_int64_t)0; |
else |
else if (parse_absolute_time(to, &cert_valid_to) != 0) |
cert_valid_to = parse_absolute_time(to); |
fatal("Invalid to time \"%s\"", to); |
|
|
if (cert_valid_to <= cert_valid_from) |
if (cert_valid_to <= cert_valid_from) |
fatal("Empty certificate validity interval"); |
fatal("Empty certificate validity interval"); |
|
|
struct stat st; |
struct stat st; |
int r, is_stdin = 0, ok = 0; |
int r, is_stdin = 0, ok = 0; |
FILE *f; |
FILE *f; |
char *cp, line[SSH_MAX_PUBKEY_BYTES]; |
char *cp, *line = NULL; |
const char *path; |
const char *path; |
|
size_t linesize = 0; |
u_long lnum = 0; |
u_long lnum = 0; |
|
|
if (!have_identity) |
if (!have_identity) |
|
|
} else if ((f = fopen(identity_file, "r")) == NULL) |
} else if ((f = fopen(identity_file, "r")) == NULL) |
fatal("fopen %s: %s", identity_file, strerror(errno)); |
fatal("fopen %s: %s", identity_file, strerror(errno)); |
|
|
while (read_keyfile_line(f, path, line, sizeof(line), &lnum) == 0) { |
while (getline(&line, &linesize, f) != -1) { |
|
lnum++; |
sshkey_free(key); |
sshkey_free(key); |
key = NULL; |
key = NULL; |
/* Trim leading space and comments */ |
/* Trim leading space and comments */ |
|
|
printf("%s:%lu:\n", path, lnum); |
printf("%s:%lu:\n", path, lnum); |
print_cert(key); |
print_cert(key); |
} |
} |
|
free(line); |
sshkey_free(key); |
sshkey_free(key); |
fclose(f); |
fclose(f); |
exit(ok ? 0 : 1); |
exit(ok ? 0 : 1); |
|
|
{ |
{ |
struct sshkey *key = NULL; |
struct sshkey *key = NULL; |
u_long lnum = 0; |
u_long lnum = 0; |
char *path, *cp, *ep, line[SSH_MAX_PUBKEY_BYTES]; |
char *path, *cp, *ep, *line = NULL; |
|
size_t linesize = 0; |
unsigned long long serial, serial2; |
unsigned long long serial, serial2; |
int i, was_explicit_key, was_sha1, r; |
int i, was_explicit_key, was_sha1, r; |
FILE *krl_spec; |
FILE *krl_spec; |
|
|
|
|
if (!quiet) |
if (!quiet) |
printf("Revoking from %s\n", path); |
printf("Revoking from %s\n", path); |
while (read_keyfile_line(krl_spec, path, line, sizeof(line), |
while (getline(&line, &linesize, krl_spec) != -1) { |
&lnum) == 0) { |
lnum++; |
was_explicit_key = was_sha1 = 0; |
was_explicit_key = was_sha1 = 0; |
cp = line + strspn(line, " \t"); |
cp = line + strspn(line, " \t"); |
/* Trim trailing space, comments and strip \n */ |
/* Trim trailing space, comments and strip \n */ |
|
|
} |
} |
if (strcmp(path, "-") != 0) |
if (strcmp(path, "-") != 0) |
fclose(krl_spec); |
fclose(krl_spec); |
|
free(line); |
free(path); |
free(path); |
} |
} |
|
|
|
|
fatal("Couldn't generate KRL"); |
fatal("Couldn't generate KRL"); |
if ((fd = open(identity_file, O_WRONLY|O_CREAT|O_TRUNC, 0644)) == -1) |
if ((fd = open(identity_file, O_WRONLY|O_CREAT|O_TRUNC, 0644)) == -1) |
fatal("open %s: %s", identity_file, strerror(errno)); |
fatal("open %s: %s", identity_file, strerror(errno)); |
if (atomicio(vwrite, fd, (void *)sshbuf_ptr(kbuf), sshbuf_len(kbuf)) != |
if (atomicio(vwrite, fd, sshbuf_mutable_ptr(kbuf), sshbuf_len(kbuf)) != |
sshbuf_len(kbuf)) |
sshbuf_len(kbuf)) |
fatal("write %s: %s", identity_file, strerror(errno)); |
fatal("write %s: %s", identity_file, strerror(errno)); |
close(fd); |
close(fd); |
|
|
gen_all_hostkeys = 1; |
gen_all_hostkeys = 1; |
break; |
break; |
case 'b': |
case 'b': |
bits = (u_int32_t)strtonum(optarg, 256, 32768, &errstr); |
bits = (u_int32_t)strtonum(optarg, 10, 32768, &errstr); |
if (errstr) |
if (errstr) |
fatal("Bits has bad value %s (%s)", |
fatal("Bits has bad value %s (%s)", |
optarg, errstr); |
optarg, errstr); |
|
|
_PATH_HOST_ECDSA_KEY_FILE, rr_hostname); |
_PATH_HOST_ECDSA_KEY_FILE, rr_hostname); |
n += do_print_resource_record(pw, |
n += do_print_resource_record(pw, |
_PATH_HOST_ED25519_KEY_FILE, rr_hostname); |
_PATH_HOST_ED25519_KEY_FILE, rr_hostname); |
|
n += do_print_resource_record(pw, |
|
_PATH_HOST_XMSS_KEY_FILE, rr_hostname); |
if (n == 0) |
if (n == 0) |
fatal("no keys found."); |
fatal("no keys found."); |
exit(0); |
exit(0); |
|
|
if ((r = sshkey_write(public, f)) != 0) |
if ((r = sshkey_write(public, f)) != 0) |
error("write key failed: %s", ssh_err(r)); |
error("write key failed: %s", ssh_err(r)); |
fprintf(f, " %s\n", comment); |
fprintf(f, " %s\n", comment); |
fclose(f); |
if (ferror(f) || fclose(f) != 0) |
|
fatal("write public failed: %s", strerror(errno)); |
|
|
if (!quiet) { |
if (!quiet) { |
fp = sshkey_fingerprint(public, fingerprint_hash, |
fp = sshkey_fingerprint(public, fingerprint_hash, |