src/usr.bin/ssh/ssh-keygen.c - diff

Return to ssh-keygen.c CVS log

Up to [local] / src / usr.bin / ssh

Diff for /src/usr.bin/ssh/ssh-keygen.c between version 1.321 and 1.339

version 1.321, 2018/09/13 02:08:33

version 1.339, 2019/08/05 21:45:27

Line 33

#include "xmalloc.h"

#include "sshkey.h"

#include "authfile.h"

#include "uuencode.h"

#include "sshbuf.h"

#include "pathnames.h"

#include "log.h"

Line 60

Line 59

# define DEFAULT_KEY_TYPE_NAME "ed25519"

#endif

/* Number of bits in the RSA/DSA key. This value can be set on the command line. */

#define DEFAULT_BITS 2048

* Default number of bits in the RSA, DSA and ECDSA keys. These value can be

* overridden on the command line.

* These values, with the exception of DSA, provide security equivalent to at

* least 128 bits of security according to NIST Special Publication 800-57:

* Recommendation for Key Management Part 1 rev 4 section 5.6.1.

* For DSA it (and FIPS-186-4 section 4.2) specifies that the only size for

* which a 160bit hash is acceptable is 1kbit, and since ssh-dss specifies only

* SHA1 we limit the DSA key size 1k bits.

#define DEFAULT_BITS 3072

#define DEFAULT_BITS_DSA 1024

#define DEFAULT_BITS_ECDSA 256

u_int32_t bits = 0;

static int quiet = 0;

* Flag indicating that we just want to change the passphrase. This can be

* set on the command line.

int change_passphrase = 0;

* Flag indicating that we just want to change the comment. This can be set

* on the command line.

int change_comment = 0;

int quiet = 0;

int log_level = SYSLOG_LEVEL_INFO;

/* Flag indicating that we want to hash a known_hosts file */

int hash_hosts = 0;

/* Flag indicating that we want lookup a host in known_hosts file */

int find_host = 0;

/* Flag indicating that we want to delete a host from a known_hosts file */

int delete_host = 0;

/* Flag indicating that we want to show the contents of a certificate */

int show_cert = 0;

/* Flag indicating that we just want to see the key fingerprint */

int print_fingerprint = 0;

static int print_fingerprint = 0;

int print_bubblebabble = 0;

static int print_bubblebabble = 0;

/* Hash algorithm to use for fingerprints. */

int fingerprint_hash = SSH_FP_HASH_DEFAULT;

static int fingerprint_hash = SSH_FP_HASH_DEFAULT;

/* The identity file name, given on the command line or entered by the user. */

char identity_file[1024];

static char identity_file[1024];

int have_identity = 0;

static int have_identity = 0;

/* This is set to the passphrase if given on the command line. */

char *identity_passphrase = NULL;

static char *identity_passphrase = NULL;

/* This is set to the new passphrase if given on the command line. */

char *identity_new_passphrase = NULL;

static char *identity_new_passphrase = NULL;

/* This is set to the new comment if given on the command line. */

char *identity_comment = NULL;

/* Path to CA key when certifying keys. */

char *ca_key_path = NULL;

/* Prefer to use agent keys for CA signing */

int prefer_agent = 0;

/* Certificate serial number */

unsigned long long cert_serial = 0;

/* Key type when certifying */

u_int cert_key_type = SSH2_CERT_TYPE_USER;

static u_int cert_key_type = SSH2_CERT_TYPE_USER;

/* "key ID" of signed key */

char *cert_key_id = NULL;

static char *cert_key_id = NULL;

/* Comma-separated list of principal names for certifying keys */

char *cert_principals = NULL;

static char *cert_principals = NULL;

/* Validity period for certificates */

u_int64_t cert_valid_from = 0;

static u_int64_t cert_valid_from = 0;

u_int64_t cert_valid_to = ~0ULL;

static u_int64_t cert_valid_to = ~0ULL;

/* Certificate options */

#define CERTOPT_X_FWD (1)

Line 142

Line 114

#define CERTOPT_USER_RC (1<<4)

#define CERTOPT_DEFAULT (CERTOPT_X_FWD|CERTOPT_AGENT_FWD| \

CERTOPT_PORT_FWD|CERTOPT_PTY|CERTOPT_USER_RC)

u_int32_t certflags_flags = CERTOPT_DEFAULT;

static u_int32_t certflags_flags = CERTOPT_DEFAULT;

char *certflags_command = NULL;

static char *certflags_command = NULL;

char *certflags_src_addr = NULL;

static char *certflags_src_addr = NULL;

/* Arbitrary extensions specified by user */

struct cert_userext {

Line 152

Line 124

char *val;

int crit;

};

struct cert_userext *cert_userext;

static struct cert_userext *cert_userext;

size_t ncert_userext;

static size_t ncert_userext;

/* Conversion to/from various formats */

int convert_to = 0;

int convert_from = 0;

enum {

FMT_RFC4716,

FMT_PKCS8,

FMT_PEM

} convert_format = FMT_RFC4716;

int print_public = 0;

int print_generic = 0;

char *key_type_name = NULL;

static char *key_type_name = NULL;

/* Load key from this PKCS#11 provider */

char *pkcs11provider = NULL;

static char *pkcs11provider = NULL;

/* Use new OpenSSH private key format when writing SSH2 keys instead of PEM */

/* Format for writing private keys */

int use_new_format = 1;

static int private_key_format = SSHKEY_PRIVATE_OPENSSH;

/* Cipher for new-format private keys */

char *new_format_cipher = NULL;

static char *openssh_format_cipher = NULL;

* Number of KDF rounds to derive new format keys /

* number of primality trials when screening moduli.

int rounds = 0;

static int rounds = 0;

/* argv0 */

extern char *__progname;

char hostname[NI_MAXHOST];

static char hostname[NI_MAXHOST];

#ifdef WITH_OPENSSL

/* moduli.c */

Line 198

Line 166

static void

type_bits_valid(int type, const char *name, u_int32_t *bitsp)

{

#ifdef WITH_OPENSSL

u_int maxbits, nid;

#endif

if (type == KEY_UNSPEC)

fatal("unknown key type %s", key_type_name);

if (*bitsp == 0) {

#ifdef WITH_OPENSSL

if (type == KEY_DSA)

u_int nid;

switch(type) {

case KEY_DSA:

*bitsp = DEFAULT_BITS_DSA;

else if (type == KEY_ECDSA) {

break;

case KEY_ECDSA:

if (name != NULL &&

(nid = sshkey_ecdsa_nid_from_name(name)) > 0)

*bitsp = sshkey_curve_nid_to_bits(nid);

if (*bitsp == 0)

*bitsp = DEFAULT_BITS_ECDSA;

} else

break;

#endif

case KEY_RSA:

*bitsp = DEFAULT_BITS;

break;

}

#endif

}

#ifdef WITH_OPENSSL

maxbits = (type == KEY_DSA) ?

OPENSSL_DSA_MAX_MODULUS_BITS : OPENSSL_RSA_MAX_MODULUS_BITS;

if (*bitsp > maxbits)

fatal("key bits exceeds maximum %d", maxbits);

switch (type) {

case KEY_DSA:

if (*bitsp != 1024)

Line 232

Line 199

if (*bitsp < SSH_RSA_MINIMUM_MODULUS_SIZE)

fatal("Invalid RSA key length: minimum is %d bits",

SSH_RSA_MINIMUM_MODULUS_SIZE);

else if (*bitsp > OPENSSL_RSA_MAX_MODULUS_BITS)

fatal("Invalid RSA key length: maximum is %d bits",

OPENSSL_RSA_MAX_MODULUS_BITS);

break;

case KEY_ECDSA:

if (sshkey_ecdsa_bits_to_nid(*bitsp) == -1)

Line 319

Line 289

static void

do_convert_to_ssh2(struct passwd *pw, struct sshkey *k)

{

size_t len;

struct sshbuf *b;

u_char *blob;

char comment[61], *b64;

char comment[61];

int r;

if ((r = sshkey_to_blob(k, &blob, &len)) != 0)

if ((b = sshbuf_new()) == NULL)

fatal("%s: sshbuf_new failed", __func__);

if ((r = sshkey_putb(k, b)) != 0)

fatal("key_to_blob failed: %s", ssh_err(r));

if ((b64 = sshbuf_dtob64_string(b, 1)) == NULL)

fatal("%s: sshbuf_dtob64_string failed", __func__);

/* Comment + surrounds must fit into 72 chars (RFC 4716 sec 3.3) */

snprintf(comment, sizeof(comment),

"%u-bit %s, converted by %s@%s from OpenSSH",

sshkey_size(k), sshkey_type(k),

pw->pw_name, hostname);

sshkey_free(k);

sshbuf_free(b);

fprintf(stdout, "%s\n", SSH_COM_PUBLIC_BEGIN);

fprintf(stdout, "Comment: \"%s\"\n", comment);

fprintf(stdout, "Comment: \"%s\"\n%s", comment, b64);

dump_base64(stdout, blob, len);

fprintf(stdout, "%s\n", SSH_COM_PUBLIC_END);

sshkey_free(k);

free(b64);

free(blob);

exit(0);

}

Line 386

Line 361

if (!have_identity)

ask_filename(pw, "Enter file in which the key is");

if (stat(identity_file, &st) < 0)

if (stat(identity_file, &st) == -1)

fatal("%s: %s: %s", __progname, identity_file, strerror(errno));

if ((r = sshkey_load_public(identity_file, &k, NULL)) != 0)

k = load_identity(identity_file);

Line 429

Line 404

}

static struct sshkey *

do_convert_private_ssh2_from_blob(u_char *blob, u_int blen)

do_convert_private_ssh2(struct sshbuf *b)

{

struct sshbuf *b;

struct sshkey *key = NULL;

char *type, *cipher;

u_char e1, e2, e3, *sig = NULL, data[] = "abcde12345";

Line 443

Line 417

BIGNUM *dsa_pub_key = NULL, *dsa_priv_key = NULL;

BIGNUM *rsa_n = NULL, *rsa_e = NULL, *rsa_d = NULL;

BIGNUM *rsa_p = NULL, *rsa_q = NULL, *rsa_iqmp = NULL;

if ((b = sshbuf_from(blob, blen)) == NULL)

fatal("%s: sshbuf_from failed", __func__);

if ((r = sshbuf_get_u32(b, &magic)) != 0)

fatal("%s: buffer error: %s", __func__, ssh_err(r));

if (magic != SSH_COM_PRIVATE_KEY_MAGIC) {

error("bad magic 0x%x != 0x%x", magic,

SSH_COM_PRIVATE_KEY_MAGIC);

sshbuf_free(b);

return NULL;

}

if ((r = sshbuf_get_u32(b, &i1)) != 0 ||

Line 465

Line 437

if (strcmp(cipher, "none") != 0) {

error("unsupported cipher %s", cipher);

free(cipher);

sshbuf_free(b);

free(type);

return NULL;

}

Line 476

Line 447

} else if (strstr(type, "rsa")) {

ktype = KEY_RSA;

} else {

sshbuf_free(b);

free(type);

return NULL;

}

if ((key = sshkey_new_private(ktype)) == NULL)

if ((key = sshkey_new(ktype)) == NULL)

fatal("sshkey_new_private failed");

fatal("sshkey_new failed");

free(type);

switch (key->type) {

Line 523

Line 493

fatal("%s: BN_new", __func__);

if (!BN_set_word(rsa_e, e)) {

BN_clear_free(rsa_e);

sshbuf_free(b);

sshkey_free(key);

return NULL;

}

Line 551

Line 520

}

rlen = sshbuf_len(b);

if (rlen != 0)

error("do_convert_private_ssh2_from_blob: "

error("%s: remaining bytes in key blob %d", __func__, rlen);

"remaining bytes in key blob %d", rlen);

sshbuf_free(b);

/* try the key */

if (sshkey_sign(key, &sig, &slen, data, sizeof(data), NULL, 0) != 0 ||

Line 598

Line 565

int r, blen, escaped = 0;

u_int len;

char line[1024];

u_char blob[8096];

struct sshbuf *buf;

char encoded[8096];

FILE *fp;

if ((buf = sshbuf_new()) == NULL)

fatal("sshbuf_new failed");

if ((fp = fopen(identity_file, "r")) == NULL)

fatal("%s: %s: %s", __progname, identity_file, strerror(errno));

encoded[0] = '\0';

Line 631

Line 600

(encoded[len-2] == '=') &&

(encoded[len-3] == '='))

encoded[len-3] = '\0';

blen = uudecode(encoded, blob, sizeof(blob));

if ((r = sshbuf_b64tod(buf, encoded)) != 0)

if (blen < 0)

fatal("%s: base64 decoding failed: %s", __func__, ssh_err(r));

fatal("uudecode failed.");

if (*private)

*k = do_convert_private_ssh2_from_blob(blob, blen);

*k = do_convert_private_ssh2(buf);

else if ((r = sshkey_from_blob(blob, blen, k)) != 0)

else if ((r = sshkey_fromb(buf, k)) != 0)

fatal("decode blob failed: %s", ssh_err(r));

fclose(fp);

}

Line 710

Line 678

if (!have_identity)

ask_filename(pw, "Enter file in which the key is");

if (stat(identity_file, &st) < 0)

if (stat(identity_file, &st) == -1)

fatal("%s: %s: %s", __progname, identity_file, strerror(errno));

switch (convert_format) {

Line 768

Line 736

if (!have_identity)

ask_filename(pw, "Enter file in which the key is");

if (stat(identity_file, &st) < 0)

if (stat(identity_file, &st) == -1)

fatal("%s: %s", identity_file, strerror(errno));

prv = load_identity(identity_file);

if ((r = sshkey_write(prv, stdout)) != 0)

Line 791

Line 759

fptype = print_bubblebabble ? SSH_DIGEST_SHA1 : fingerprint_hash;

rep = print_bubblebabble ? SSH_FP_BUBBLEBABBLE : SSH_FP_DEFAULT;

pkcs11_init(0);

pkcs11_init(1);

nkeys = pkcs11_add_provider(pkcs11provider, NULL, &keys);

if (nkeys <= 0)

fatal("cannot read public key from pkcs11");

Line 804

Line 772

fatal("%s: sshkey_fingerprint fail", __func__);

printf("%u %s %s (PKCS11 key)\n", sshkey_size(keys[i]),

fp, sshkey_type(keys[i]));

if (log_level >= SYSLOG_LEVEL_VERBOSE)

if (log_level_get() >= SYSLOG_LEVEL_VERBOSE)

printf("%s\n", ra);

free(ra);

free(fp);

Line 852

Line 820

fatal("%s: sshkey_fingerprint failed", __func__);

mprintf("%u %s %s (%s)\n", sshkey_size(public), fp,

comment ? comment : "no comment", sshkey_type(public));

if (log_level >= SYSLOG_LEVEL_VERBOSE)

if (log_level_get() >= SYSLOG_LEVEL_VERBOSE)

printf("%s\n", ra);

free(ra);

free(fp);

Line 866

Line 834

struct sshkey *public = NULL;

int r;

if (stat(identity_file, &st) < 0)

if (stat(identity_file, &st) == -1)

fatal("%s: %s", path, strerror(errno));

if ((r = sshkey_load_public(path, &public, &comment)) != 0) {

debug("load public \"%s\": %s", path, ssh_err(r));

Line 998

Line 966

{ NULL, NULL, NULL }

};

u_int bits = 0;

int first = 0;

struct stat st;

struct sshkey *private, *public;

Line 1057

Line 1026

snprintf(comment, sizeof comment, "%s@%s", pw->pw_name,

hostname);

if ((r = sshkey_save_private(private, prv_tmp, "",

comment, use_new_format, new_format_cipher, rounds)) != 0) {

comment, private_key_format, openssh_format_cipher,

rounds)) != 0) {

error("Saving key \"%s\" failed: %s",

prv_tmp, ssh_err(r));

goto failnext;

Line 1121

Line 1091

int has_unhashed; /* When hashing, original had unhashed hosts */

int found_key; /* For find/delete, host was found */

int invalid; /* File contained invalid items; don't delete */

int hash_hosts; /* Hash hostnames as we go */

int find_host; /* Search for specific hostname */

int delete_host; /* Delete host from known_hosts */

};

static int

Line 1140

Line 1113

if (was_hashed || has_wild || l->marker != MRK_NONE) {

fprintf(ctx->out, "%s\n", l->line);

if (has_wild && !find_host) {

if (has_wild && !ctx->find_host) {

logit("%s:%lu: ignoring host name "

"with wildcard: %.64s", l->path,

l->linenum, l->hosts);

Line 1180

Line 1153

struct known_hosts_ctx *ctx = (struct known_hosts_ctx *)_ctx;

enum sshkey_fp_rep rep;

int fptype;

char *fp;

char *fp = NULL, *ra = NULL;

fptype = print_bubblebabble ? SSH_DIGEST_SHA1 : fingerprint_hash;

rep = print_bubblebabble ? SSH_FP_BUBBLEBABBLE : SSH_FP_DEFAULT;

if (l->status == HKF_STATUS_MATCHED) {

if (delete_host) {

if (ctx->delete_host) {

if (l->marker != MRK_NONE) {

/* Don't remove CA and revocation lines */

fprintf(ctx->out, "%s\n", l->line);

Line 1202

Line 1175

ctx->host, l->linenum);

}

return 0;

} else if (find_host) {

} else if (ctx->find_host) {

ctx->found_key = 1;

if (!quiet) {

printf("# Host %s found: line %lu %s\n",

Line 1210

Line 1183

l->linenum, l->marker == MRK_CA ? "CA" :

(l->marker == MRK_REVOKE ? "REVOKED" : ""));

}

if (hash_hosts)

if (ctx->hash_hosts)

known_hosts_hash(l, ctx);

else if (print_fingerprint) {

fp = sshkey_fingerprint(l->key, fptype, rep);

ra = sshkey_fingerprint(l->key,

fingerprint_hash, SSH_FP_RANDOMART);

if (fp == NULL || ra == NULL)

fatal("%s: sshkey_fingerprint failed",

__func__);

mprintf("%s %s %s %s\n", ctx->host,

sshkey_type(l->key), fp, l->comment);

if (log_level_get() >= SYSLOG_LEVEL_VERBOSE)

printf("%s\n", ra);

free(ra);

free(fp);

} else

fprintf(ctx->out, "%s\n", l->line);

return 0;

}

} else if (delete_host) {

} else if (ctx->delete_host) {

/* Retain non-matching hosts when deleting */

if (l->status == HKF_STATUS_INVALID) {

ctx->invalid = 1;

Line 1233

Line 1214

}

static void

do_known_hosts(struct passwd *pw, const char *name)

do_known_hosts(struct passwd *pw, const char *name, int find_host,

int delete_host, int hash_hosts)

{

char *cp, tmp[PATH_MAX], old[PATH_MAX];

int r, fd, oerrno, inplace = 0;

Line 1252

Line 1234

memset(&ctx, 0, sizeof(ctx));

ctx.out = stdout;

ctx.host = name;

ctx.hash_hosts = hash_hosts;

ctx.find_host = find_host;

ctx.delete_host = delete_host;

* Find hosts goes to stdout, hash and deletions happen in-place

Line 1342

Line 1327

if (!have_identity)

ask_filename(pw, "Enter file in which the key is");

if (stat(identity_file, &st) < 0)

if (stat(identity_file, &st) == -1)

fatal("%s: %s", identity_file, strerror(errno));

/* Try to load the file with empty passphrase. */

r = sshkey_load_private(identity_file, "", &private, &comment);

Line 1393

Line 1378

/* Save the file using the new passphrase. */

if ((r = sshkey_save_private(private, identity_file, passphrase1,

comment, use_new_format, new_format_cipher, rounds)) != 0) {

comment, private_key_format, openssh_format_cipher, rounds)) != 0) {

error("Saving key \"%s\" failed: %s.",

identity_file, ssh_err(r));

explicit_bzero(passphrase1, strlen(passphrase1));

Line 1416

Line 1401

* Print the SSHFP RR.

static int

do_print_resource_record(struct passwd *pw, char *fname, char *hname)

do_print_resource_record(struct passwd *pw, char *fname, char *hname,

int print_generic)

{

struct sshkey *public;

char *comment = NULL;

Line 1425

Line 1411

if (fname == NULL)

fatal("%s: no filename", __func__);

if (stat(fname, &st) < 0) {

if (stat(fname, &st) == -1) {

if (errno == ENOENT)

return 0;

fatal("%s: %s", fname, strerror(errno));

Line 1443

Line 1429

* Change the comment of a private key file.

static void

do_change_comment(struct passwd *pw)

do_change_comment(struct passwd *pw, const char *identity_comment)

{

char new_comment[1024], *comment, *passphrase;

struct sshkey *private;

Line 1454

Line 1440

if (!have_identity)

ask_filename(pw, "Enter file in which the key is");

if (stat(identity_file, &st) < 0)

if (stat(identity_file, &st) == -1)

fatal("%s: %s", identity_file, strerror(errno));

if ((r = sshkey_load_private(identity_file, "",

&private, &comment)) == 0)

Line 1481

Line 1467

}

if (private->type != KEY_ED25519 && private->type != KEY_XMSS &&

!use_new_format) {

private_key_format != SSHKEY_PRIVATE_OPENSSH) {

error("Comments are only supported for keys stored in "

"the new format (-o).");

explicit_bzero(passphrase, strlen(passphrase));

Line 1489

Line 1475

exit(1);

}

if (comment)

printf("Key now has comment '%s'\n", comment);

printf("Old comment: %s\n", comment);

else

printf("Key now has no comment\n");

printf("No existing comment\n");

if (identity_comment) {

strlcpy(new_comment, identity_comment, sizeof(new_comment));

} else {

printf("Enter new comment: ");

printf("New comment: ");

fflush(stdout);

if (!fgets(new_comment, sizeof(new_comment), stdin)) {

explicit_bzero(passphrase, strlen(passphrase));

Line 1505

Line 1491

}

new_comment[strcspn(new_comment, "\n")] = '\0';

}

if (comment != NULL && strcmp(comment, new_comment) == 0) {

printf("No change to comment\n");

free(passphrase);

sshkey_free(private);

free(comment);

exit(0);

}

/* Save the file using the new passphrase. */

if ((r = sshkey_save_private(private, identity_file, passphrase,

new_comment, use_new_format, new_format_cipher, rounds)) != 0) {

new_comment, private_key_format, openssh_format_cipher,

rounds)) != 0) {

error("Saving key \"%s\" failed: %s",

identity_file, ssh_err(r));

explicit_bzero(passphrase, strlen(passphrase));

Line 1538

Line 1532

free(comment);

printf("The comment in your key file has been changed.\n");

if (strlen(new_comment) > 0)

printf("Comment '%s' applied\n", new_comment);

else

printf("Comment removed\n");

exit(0);

}

Line 1644

Line 1642

/* Signer for sshkey_certify_custom that uses the agent */

static int

agent_signer(const struct sshkey *key, u_char **sigp, size_t *lenp,

agent_signer(struct sshkey *key, u_char **sigp, size_t *lenp,

const u_char *data, size_t datalen,

const char *alg, u_int compat, void *ctx)

{

Line 1655

Line 1653

}

static void

do_ca_sign(struct passwd *pw, int argc, char **argv)

do_ca_sign(struct passwd *pw, const char *ca_key_path, int prefer_agent,

unsigned long long cert_serial, int cert_serial_autoinc,

int argc, char **argv)

{

int r, i, fd, found, agent_fd = -1;

u_int n;

Line 1725

}

if (n > SSHKEY_CERT_MAX_PRINCIPALS)

fatal("Too many certificate principals specified");

tmp = tilde_expand_filename(argv[i], pw->pw_uid);

if ((r = sshkey_load_public(tmp, &public, &comment)) != 0)

fatal("%s: unable to open \"%s\": %s",

Line 1795

sshkey_free(public);

free(out);

if (cert_serial_autoinc)

cert_serial++;

}

#ifdef ENABLE_PKCS11

pkcs11_terminate();

Line 1986

Line 1988

printf(" Type: %s %s certificate\n", sshkey_ssh_name(key),

sshkey_cert_type(key));

printf(" Public key: %s %s\n", sshkey_type(key), key_fp);

printf(" Signing CA: %s %s\n",

printf(" Signing CA: %s %s (using %s)\n",

sshkey_type(key->cert->signature_key), ca_fp);

sshkey_type(key->cert->signature_key), ca_fp,

key->cert->signature_type);

printf(" Key ID: \"%s\"\n", key->cert->key_id);

printf(" Serial: %llu\n", (unsigned long long)key->cert->serial);

printf(" Valid: %s\n", valid);

Line 2030

Line 2033

if (!have_identity)

ask_filename(pw, "Enter file in which the key is");

if (strcmp(identity_file, "-") != 0 && stat(identity_file, &st) < 0)

if (strcmp(identity_file, "-") != 0 && stat(identity_file, &st) == -1)

fatal("%s: %s: %s", __progname, identity_file, strerror(errno));

path = identity_file;

Line 2281

Line 2284

}

static void

do_gen_krl(struct passwd *pw, int updating, int argc, char **argv)

do_gen_krl(struct passwd *pw, int updating, const char *ca_key_path,

unsigned long long krl_version, const char *krl_comment,

int argc, char **argv)

{

struct ssh_krl *krl;

struct stat sb;

Line 2316

Line 2321

else if ((krl = ssh_krl_init()) == NULL)

fatal("couldn't create KRL");

if (cert_serial != 0)

if (krl_version != 0)

ssh_krl_set_version(krl, cert_serial);

ssh_krl_set_version(krl, krl_version);

if (identity_comment != NULL)

if (krl_comment != NULL)

ssh_krl_set_comment(krl, identity_comment);

ssh_krl_set_comment(krl, krl_comment);

for (i = 0; i < argc; i++)

update_krl_from_file(pw, argv[i], wild_ca, ca, krl);

Line 2372

Line 2377

usage(void)

{

fprintf(stderr,

"usage: ssh-keygen [-q] [-b bits] [-t dsa | ecdsa | ed25519 | rsa]\n"

"usage: ssh-keygen [-q] [-b bits] [-t dsa | ecdsa | ed25519 | rsa] [-m format]\n"

" [-N new_passphrase] [-C comment] [-f output_keyfile]\n"

" ssh-keygen -p [-P old_passphrase] [-N new_passphrase] [-f keyfile]\n"

" ssh-keygen -p [-P old_passphrase] [-N new_passphrase] [-m format]\n"

" [-f keyfile]\n"

" ssh-keygen -i [-m key_format] [-f input_keyfile]\n"

" ssh-keygen -e [-m key_format] [-f input_keyfile]\n"

" ssh-keygen -y [-f input_keyfile]\n"

Line 2418

Line 2424

struct passwd *pw;

struct stat st;

int r, opt, type, fd;

int change_passphrase = 0, change_comment = 0, show_cert = 0;

int find_host = 0, delete_host = 0, hash_hosts = 0;

int gen_all_hostkeys = 0, gen_krl = 0, update_krl = 0, check_krl = 0;

int prefer_agent = 0, convert_to = 0, convert_from = 0;

int print_public = 0, print_generic = 0, cert_serial_autoinc = 0;

unsigned long long cert_serial = 0;

char *identity_comment = NULL, *ca_key_path = NULL;

u_int bits = 0;

FILE *f;

const char *errstr;

int log_level = SYSLOG_LEVEL_INFO;

#ifdef WITH_OPENSSL

/* Moduli generation/screening */

char out_file[PATH_MAX], *checkpoint = NULL;

Line 2433

Line 2447

extern int optind;

extern char *optarg;

ssh_malloc_init(); /* must be called before any mallocs */

/* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */

sanitise_stdfd();

Line 2446

Line 2459

pw = getpwuid(getuid());

if (!pw)

fatal("No user exists for uid %lu", (u_long)getuid());

if (gethostname(hostname, sizeof(hostname)) < 0)

if (gethostname(hostname, sizeof(hostname)) == -1)

fatal("gethostname: %s", strerror(errno));

/* Remaining characters: Ydw */

Line 2499

Line 2512

}

if (strcasecmp(optarg, "PKCS8") == 0) {

convert_format = FMT_PKCS8;

private_key_format = SSHKEY_PRIVATE_PKCS8;

break;

}

if (strcasecmp(optarg, "PEM") == 0) {

convert_format = FMT_PEM;

use_new_format = 0;

private_key_format = SSHKEY_PRIVATE_PEM;

break;

}

fatal("Unsupported conversion format \"%s\"", optarg);

Line 2541

Line 2555

add_cert_option(optarg);

break;

case 'Z':

new_format_cipher = optarg;

openssh_format_cipher = optarg;

break;

case 'C':

identity_comment = optarg;

Line 2607

Line 2621

break;

case 'z':

errno = 0;

if (*optarg == '+') {

cert_serial_autoinc = 1;

optarg++;

}

cert_serial = strtoull(optarg, &ep, 10);

if (*optarg < '0' || *optarg > '9' || *ep != '\0' ||

(errno == ERANGE && cert_serial == ULLONG_MAX))

Line 2687

Line 2705

}

#ifdef WITH_OPENSSL

if (gen_krl) {

do_gen_krl(pw, update_krl, argc, argv);

do_gen_krl(pw, update_krl, ca_key_path,

cert_serial, identity_comment, argc, argv);

return (0);

}

if (check_krl) {

Line 2698

Line 2717

if (ca_key_path != NULL) {

if (cert_key_id == NULL)

fatal("Must specify key id (-I) when certifying");

do_ca_sign(pw, argc, argv);

do_ca_sign(pw, ca_key_path, prefer_agent,

cert_serial, cert_serial_autoinc, argc, argv);

}

if (show_cert)

do_show_cert(pw);

if (delete_host || hash_hosts || find_host)

if (delete_host || hash_hosts || find_host) {

do_known_hosts(pw, rr_hostname);

do_known_hosts(pw, rr_hostname, find_host,

delete_host, hash_hosts);

}

if (pkcs11provider != NULL)

do_download(pw);

if (print_fingerprint || print_bubblebabble)

Line 2711

Line 2733

if (change_passphrase)

do_change_passphrase(pw);

if (change_comment)

do_change_comment(pw);

do_change_comment(pw, identity_comment);

#ifdef WITH_OPENSSL

if (convert_to)

do_convert_to(pw);

Line 2724

Line 2746

unsigned int n = 0;

if (have_identity) {

n = do_print_resource_record(pw,

n = do_print_resource_record(pw, identity_file,

identity_file, rr_hostname);

rr_hostname, print_generic);

if (n == 0)

fatal("%s: %s", identity_file, strerror(errno));

exit(0);

} else {

n += do_print_resource_record(pw,

_PATH_HOST_RSA_KEY_FILE, rr_hostname);

_PATH_HOST_RSA_KEY_FILE, rr_hostname,

print_generic);

n += do_print_resource_record(pw,

_PATH_HOST_DSA_KEY_FILE, rr_hostname);

_PATH_HOST_DSA_KEY_FILE, rr_hostname,

print_generic);

n += do_print_resource_record(pw,

_PATH_HOST_ECDSA_KEY_FILE, rr_hostname);

_PATH_HOST_ECDSA_KEY_FILE, rr_hostname,

print_generic);

n += do_print_resource_record(pw,

_PATH_HOST_ED25519_KEY_FILE, rr_hostname);

_PATH_HOST_ED25519_KEY_FILE, rr_hostname,

print_generic);

n += do_print_resource_record(pw,

_PATH_HOST_XMSS_KEY_FILE, rr_hostname);

_PATH_HOST_XMSS_KEY_FILE, rr_hostname,

print_generic);

if (n == 0)

fatal("no keys found.");

exit(0);

Line 2815

Line 2842

snprintf(dotsshdir, sizeof dotsshdir, "%s/%s",

pw->pw_dir, _PATH_SSH_USER_DIR);

if (strstr(identity_file, dotsshdir) != NULL) {

if (stat(dotsshdir, &st) < 0) {

if (stat(dotsshdir, &st) == -1) {

if (errno != ENOENT) {

error("Could not stat %s: %s", dotsshdir,

strerror(errno));

} else if (mkdir(dotsshdir, 0700) < 0) {

} else if (mkdir(dotsshdir, 0700) == -1) {

error("Could not create directory '%s': %s",

dotsshdir, strerror(errno));

} else if (!quiet)

Line 2875

Line 2902

/* Save the key with the given passphrase and comment. */

if ((r = sshkey_save_private(private, identity_file, passphrase1,

comment, use_new_format, new_format_cipher, rounds)) != 0) {

comment, private_key_format, openssh_format_cipher, rounds)) != 0) {

error("Saving key \"%s\" failed: %s",

identity_file, ssh_err(r));

explicit_bzero(passphrase1, strlen(passphrase1));