version 1.318, 2018/07/09 21:59:10 |
version 1.320, 2018/09/12 01:21:34 |
|
|
char *pkcs11provider = NULL; |
char *pkcs11provider = NULL; |
|
|
/* Use new OpenSSH private key format when writing SSH2 keys instead of PEM */ |
/* Use new OpenSSH private key format when writing SSH2 keys instead of PEM */ |
int use_new_format = 0; |
int use_new_format = 1; |
|
|
/* Cipher for new-format private keys */ |
/* Cipher for new-format private keys */ |
char *new_format_cipher = NULL; |
char *new_format_cipher = NULL; |
|
|
} |
} |
|
|
static void |
static void |
|
hash_to_blob(const char *cp, u_char **blobp, size_t *lenp, |
|
const char *file, u_long lnum) |
|
{ |
|
char *tmp; |
|
size_t tlen; |
|
struct sshbuf *b; |
|
int r; |
|
|
|
if (strncmp(cp, "SHA256:", 7) != 0) |
|
fatal("%s:%lu: unsupported hash algorithm", file, lnum); |
|
cp += 7; |
|
|
|
/* |
|
* OpenSSH base64 hashes omit trailing '=' |
|
* characters; put them back for decode. |
|
*/ |
|
tlen = strlen(cp); |
|
tmp = xmalloc(tlen + 4 + 1); |
|
strlcpy(tmp, cp, tlen + 1); |
|
while ((tlen % 4) != 0) { |
|
tmp[tlen++] = '='; |
|
tmp[tlen] = '\0'; |
|
} |
|
if ((b = sshbuf_new()) == NULL) |
|
fatal("%s: sshbuf_new failed", __func__); |
|
if ((r = sshbuf_b64tod(b, tmp)) != 0) |
|
fatal("%s:%lu: decode hash failed: %s", file, lnum, ssh_err(r)); |
|
free(tmp); |
|
*lenp = sshbuf_len(b); |
|
*blobp = xmalloc(*lenp); |
|
memcpy(*blobp, sshbuf_ptr(b), *lenp); |
|
sshbuf_free(b); |
|
} |
|
|
|
static void |
update_krl_from_file(struct passwd *pw, const char *file, int wild_ca, |
update_krl_from_file(struct passwd *pw, const char *file, int wild_ca, |
const struct sshkey *ca, struct ssh_krl *krl) |
const struct sshkey *ca, struct ssh_krl *krl) |
{ |
{ |
struct sshkey *key = NULL; |
struct sshkey *key = NULL; |
u_long lnum = 0; |
u_long lnum = 0; |
char *path, *cp, *ep, *line = NULL; |
char *path, *cp, *ep, *line = NULL; |
size_t linesize = 0; |
u_char *blob = NULL; |
|
size_t blen = 0, linesize = 0; |
unsigned long long serial, serial2; |
unsigned long long serial, serial2; |
int i, was_explicit_key, was_sha1, r; |
int i, was_explicit_key, was_sha1, was_sha256, was_hash, r; |
FILE *krl_spec; |
FILE *krl_spec; |
|
|
path = tilde_expand_filename(file, pw->pw_uid); |
path = tilde_expand_filename(file, pw->pw_uid); |
|
|
printf("Revoking from %s\n", path); |
printf("Revoking from %s\n", path); |
while (getline(&line, &linesize, krl_spec) != -1) { |
while (getline(&line, &linesize, krl_spec) != -1) { |
lnum++; |
lnum++; |
was_explicit_key = was_sha1 = 0; |
was_explicit_key = was_sha1 = was_sha256 = was_hash = 0; |
cp = line + strspn(line, " \t"); |
cp = line + strspn(line, " \t"); |
/* Trim trailing space, comments and strip \n */ |
/* Trim trailing space, comments and strip \n */ |
for (i = 0, r = -1; cp[i] != '\0'; i++) { |
for (i = 0, r = -1; cp[i] != '\0'; i++) { |
|
|
cp = cp + strspn(cp, " \t"); |
cp = cp + strspn(cp, " \t"); |
if (ssh_krl_revoke_cert_by_key_id(krl, ca, cp) != 0) |
if (ssh_krl_revoke_cert_by_key_id(krl, ca, cp) != 0) |
fatal("%s: revoke key ID failed", __func__); |
fatal("%s: revoke key ID failed", __func__); |
|
} else if (strncasecmp(cp, "hash:", 5) == 0) { |
|
cp += 5; |
|
cp = cp + strspn(cp, " \t"); |
|
hash_to_blob(cp, &blob, &blen, file, lnum); |
|
r = ssh_krl_revoke_key_sha256(krl, blob, blen); |
} else { |
} else { |
if (strncasecmp(cp, "key:", 4) == 0) { |
if (strncasecmp(cp, "key:", 4) == 0) { |
cp += 4; |
cp += 4; |
|
|
cp += 5; |
cp += 5; |
cp = cp + strspn(cp, " \t"); |
cp = cp + strspn(cp, " \t"); |
was_sha1 = 1; |
was_sha1 = 1; |
} else { |
} else if (strncasecmp(cp, "sha256:", 7) == 0) { |
|
cp += 7; |
|
cp = cp + strspn(cp, " \t"); |
|
was_sha256 = 1; |
/* |
/* |
* Just try to process the line as a key. |
* Just try to process the line as a key. |
* Parsing will fail if it isn't. |
* Parsing will fail if it isn't. |
|
|
path, lnum, ssh_err(r)); |
path, lnum, ssh_err(r)); |
if (was_explicit_key) |
if (was_explicit_key) |
r = ssh_krl_revoke_key_explicit(krl, key); |
r = ssh_krl_revoke_key_explicit(krl, key); |
else if (was_sha1) |
else if (was_sha1) { |
r = ssh_krl_revoke_key_sha1(krl, key); |
if (sshkey_fingerprint_raw(key, |
else |
SSH_DIGEST_SHA1, &blob, &blen) != 0) { |
|
fatal("%s:%lu: fingerprint failed", |
|
file, lnum); |
|
} |
|
r = ssh_krl_revoke_key_sha1(krl, blob, blen); |
|
} else if (was_sha256) { |
|
if (sshkey_fingerprint_raw(key, |
|
SSH_DIGEST_SHA256, &blob, &blen) != 0) { |
|
fatal("%s:%lu: fingerprint failed", |
|
file, lnum); |
|
} |
|
r = ssh_krl_revoke_key_sha256(krl, blob, blen); |
|
} else |
r = ssh_krl_revoke_key(krl, key); |
r = ssh_krl_revoke_key(krl, key); |
if (r != 0) |
if (r != 0) |
fatal("%s: revoke key failed: %s", |
fatal("%s: revoke key failed: %s", |
__func__, ssh_err(r)); |
__func__, ssh_err(r)); |
|
freezero(blob, blen); |
|
blob = NULL; |
|
blen = 0; |
sshkey_free(key); |
sshkey_free(key); |
} |
} |
} |
} |
|
|
} |
} |
if (strcasecmp(optarg, "PEM") == 0) { |
if (strcasecmp(optarg, "PEM") == 0) { |
convert_format = FMT_PEM; |
convert_format = FMT_PEM; |
|
use_new_format = 0; |
break; |
break; |
} |
} |
fatal("Unsupported conversion format \"%s\"", optarg); |
fatal("Unsupported conversion format \"%s\"", optarg); |
|
|
cert_principals = optarg; |
cert_principals = optarg; |
break; |
break; |
case 'o': |
case 'o': |
use_new_format = 1; |
/* no-op; new format is already the default */ |
break; |
break; |
case 'p': |
case 'p': |
change_passphrase = 1; |
change_passphrase = 1; |