version 1.421, 2020/10/18 11:32:02 |
version 1.432, 2021/07/23 03:37:52 |
|
|
#include <fcntl.h> |
#include <fcntl.h> |
#include <netdb.h> |
#include <netdb.h> |
#include <pwd.h> |
#include <pwd.h> |
|
#include <stdarg.h> |
#include <stdio.h> |
#include <stdio.h> |
#include <stdlib.h> |
#include <stdlib.h> |
#include <string.h> |
#include <string.h> |
#include <stdarg.h> |
|
#include <unistd.h> |
#include <unistd.h> |
#include <limits.h> |
#include <limits.h> |
#include <locale.h> |
#include <locale.h> |
|
|
#include "sshsig.h" |
#include "sshsig.h" |
#include "ssh-sk.h" |
#include "ssh-sk.h" |
#include "sk-api.h" /* XXX for SSH_SK_USER_PRESENCE_REQD; remove */ |
#include "sk-api.h" /* XXX for SSH_SK_USER_PRESENCE_REQD; remove */ |
|
#include "cipher.h" |
|
|
#ifdef ENABLE_PKCS11 |
#ifdef ENABLE_PKCS11 |
#include "ssh-pkcs11.h" |
#include "ssh-pkcs11.h" |
|
|
fatal("unknown key type %s", key_type_name); |
fatal("unknown key type %s", key_type_name); |
if (*bitsp == 0) { |
if (*bitsp == 0) { |
#ifdef WITH_OPENSSL |
#ifdef WITH_OPENSSL |
u_int nid; |
int nid; |
|
|
switch(type) { |
switch(type) { |
case KEY_DSA: |
case KEY_DSA: |
|
|
foreach_options |= print_fingerprint ? HKF_WANT_PARSE_KEY : 0; |
foreach_options |= print_fingerprint ? HKF_WANT_PARSE_KEY : 0; |
if ((r = hostkeys_foreach(identity_file, (find_host || !hash_hosts) ? |
if ((r = hostkeys_foreach(identity_file, (find_host || !hash_hosts) ? |
known_hosts_find_delete : known_hosts_hash, &ctx, name, NULL, |
known_hosts_find_delete : known_hosts_hash, &ctx, name, NULL, |
foreach_options)) != 0) { |
foreach_options, 0)) != 0) { |
if (inplace) |
if (inplace) |
unlink(tmp); |
unlink(tmp); |
fatal_fr(r, "hostkeys_foreach"); |
fatal_fr(r, "hostkeys_foreach"); |
|
|
} |
} |
r = sshkey_certify(public, ca, key_type_name, |
r = sshkey_certify(public, ca, key_type_name, |
sk_provider, pin); |
sk_provider, pin); |
notify_complete(notifier); |
notify_complete(notifier, "User presence confirmed"); |
if (r != 0) |
if (r != 0) |
fatal_r(r, "Couldn't certify key %s", tmp); |
fatal_r(r, "Couldn't certify key %s", tmp); |
} |
} |
|
|
fatal("Invalid source-address list"); |
fatal("Invalid source-address list"); |
certflags_src_addr = xstrdup(val); |
certflags_src_addr = xstrdup(val); |
} else if (strncasecmp(opt, "extension:", 10) == 0 || |
} else if (strncasecmp(opt, "extension:", 10) == 0 || |
(iscrit = (strncasecmp(opt, "critical:", 9) == 0))) { |
(iscrit = (strncasecmp(opt, "critical:", 9) == 0))) { |
val = xstrdup(strchr(opt, ':') + 1); |
val = xstrdup(strchr(opt, ':') + 1); |
if ((cp = strchr(val, '=')) != NULL) |
if ((cp = strchr(val, '=')) != NULL) |
*cp++ = '\0'; |
*cp++ = '\0'; |
|
|
} |
} |
|
|
static int |
static int |
|
sig_process_opts(char * const *opts, size_t nopts, uint64_t *verify_timep) |
|
{ |
|
size_t i; |
|
time_t now; |
|
|
|
*verify_timep = 0; |
|
for (i = 0; i < nopts; i++) { |
|
if (strncasecmp(opts[i], "verify-time=", 12) == 0) { |
|
if (parse_absolute_time(opts[i] + 12, |
|
verify_timep) != 0 || *verify_timep == 0) { |
|
error("Invalid \"verify-time\" option"); |
|
return SSH_ERR_INVALID_ARGUMENT; |
|
} |
|
} else { |
|
error("Invalid option \"%s\"", opts[i]); |
|
return SSH_ERR_INVALID_ARGUMENT; |
|
} |
|
} |
|
if (*verify_timep == 0) { |
|
if ((now = time(NULL)) < 0) { |
|
error("Time is before epoch"); |
|
return SSH_ERR_INVALID_ARGUMENT; |
|
} |
|
*verify_timep = (uint64_t)now; |
|
} |
|
return 0; |
|
} |
|
|
|
static int |
sig_verify(const char *signature, const char *sig_namespace, |
sig_verify(const char *signature, const char *sig_namespace, |
const char *principal, const char *allowed_keys, const char *revoked_keys) |
const char *principal, const char *allowed_keys, const char *revoked_keys, |
|
char * const *opts, size_t nopts) |
{ |
{ |
int r, ret = -1; |
int r, ret = -1; |
struct sshbuf *sigbuf = NULL, *abuf = NULL; |
struct sshbuf *sigbuf = NULL, *abuf = NULL; |
struct sshkey *sign_key = NULL; |
struct sshkey *sign_key = NULL; |
char *fp = NULL; |
char *fp = NULL; |
struct sshkey_sig_details *sig_details = NULL; |
struct sshkey_sig_details *sig_details = NULL; |
|
uint64_t verify_time = 0; |
|
|
|
if (sig_process_opts(opts, nopts, &verify_time) != 0) |
|
goto done; /* error already logged */ |
|
|
memset(&sig_details, 0, sizeof(sig_details)); |
memset(&sig_details, 0, sizeof(sig_details)); |
if ((r = sshbuf_load_file(signature, &abuf)) != 0) { |
if ((r = sshbuf_load_file(signature, &abuf)) != 0) { |
error_r(r, "Couldn't read signature file"); |
error_r(r, "Couldn't read signature file"); |
|
|
} |
} |
|
|
if (allowed_keys != NULL && (r = sshsig_check_allowed_keys(allowed_keys, |
if (allowed_keys != NULL && (r = sshsig_check_allowed_keys(allowed_keys, |
sign_key, principal, sig_namespace)) != 0) { |
sign_key, principal, sig_namespace, verify_time)) != 0) { |
debug3_fr(r, "sshsig_check_allowed_keys"); |
debug3_fr(r, "sshsig_check_allowed_keys"); |
goto done; |
goto done; |
} |
} |
|
|
fatal_f("sshkey_fingerprint failed"); |
fatal_f("sshkey_fingerprint failed"); |
if (principal == NULL) { |
if (principal == NULL) { |
printf("Good \"%s\" signature with %s key %s\n", |
printf("Good \"%s\" signature with %s key %s\n", |
sig_namespace, sshkey_type(sign_key), fp); |
sig_namespace, sshkey_type(sign_key), fp); |
|
|
} else { |
} else { |
printf("Good \"%s\" signature for %s with %s key %s\n", |
printf("Good \"%s\" signature for %s with %s key %s\n", |
sig_namespace, principal, |
sig_namespace, principal, |
sshkey_type(sign_key), fp); |
sshkey_type(sign_key), fp); |
} |
} |
} else { |
} else { |
printf("Could not verify signature.\n"); |
printf("Could not verify signature.\n"); |
|
|
} |
} |
|
|
static int |
static int |
sig_find_principals(const char *signature, const char *allowed_keys) { |
sig_find_principals(const char *signature, const char *allowed_keys, |
|
char * const *opts, size_t nopts) |
|
{ |
int r, ret = -1; |
int r, ret = -1; |
struct sshbuf *sigbuf = NULL, *abuf = NULL; |
struct sshbuf *sigbuf = NULL, *abuf = NULL; |
struct sshkey *sign_key = NULL; |
struct sshkey *sign_key = NULL; |
char *principals = NULL, *cp, *tmp; |
char *principals = NULL, *cp, *tmp; |
|
uint64_t verify_time = 0; |
|
|
|
if (sig_process_opts(opts, nopts, &verify_time) != 0) |
|
goto done; /* error already logged */ |
|
|
if ((r = sshbuf_load_file(signature, &abuf)) != 0) { |
if ((r = sshbuf_load_file(signature, &abuf)) != 0) { |
error_r(r, "Couldn't read signature file"); |
error_r(r, "Couldn't read signature file"); |
goto done; |
goto done; |
|
|
goto done; |
goto done; |
} |
} |
if ((r = sshsig_find_principals(allowed_keys, sign_key, |
if ((r = sshsig_find_principals(allowed_keys, sign_key, |
&principals)) != 0) { |
verify_time, &principals)) != 0) { |
error_fr(r, "sshsig_get_principal"); |
if (r != SSH_ERR_KEY_NOT_FOUND) |
|
error_fr(r, "sshsig_find_principal"); |
goto done; |
goto done; |
} |
} |
ret = 0; |
ret = 0; |
|
|
"usage: ssh-keygen [-q] [-a rounds] [-b bits] [-C comment] [-f output_keyfile]\n" |
"usage: ssh-keygen [-q] [-a rounds] [-b bits] [-C comment] [-f output_keyfile]\n" |
" [-m format] [-N new_passphrase] [-O option]\n" |
" [-m format] [-N new_passphrase] [-O option]\n" |
" [-t dsa | ecdsa | ecdsa-sk | ed25519 | ed25519-sk | rsa]\n" |
" [-t dsa | ecdsa | ecdsa-sk | ed25519 | ed25519-sk | rsa]\n" |
" [-w provider]\n" |
" [-w provider] [-Z cipher]\n" |
" ssh-keygen -p [-a rounds] [-f keyfile] [-m format] [-N new_passphrase]\n" |
" ssh-keygen -p [-a rounds] [-f keyfile] [-m format] [-N new_passphrase]\n" |
" [-P old_passphrase]\n" |
" [-P old_passphrase] [-Z cipher]\n" |
" ssh-keygen -i [-f input_keyfile] [-m key_format]\n" |
" ssh-keygen -i [-f input_keyfile] [-m key_format]\n" |
" ssh-keygen -e [-f input_keyfile] [-m key_format]\n" |
" ssh-keygen -e [-f input_keyfile] [-m key_format]\n" |
" ssh-keygen -y [-f input_keyfile]\n" |
" ssh-keygen -y [-f input_keyfile]\n" |
|
|
" ssh-keygen -Y check-novalidate -n namespace -s signature_file\n" |
" ssh-keygen -Y check-novalidate -n namespace -s signature_file\n" |
" ssh-keygen -Y sign -f key_file -n namespace file ...\n" |
" ssh-keygen -Y sign -f key_file -n namespace file ...\n" |
" ssh-keygen -Y verify -f allowed_signers_file -I signer_identity\n" |
" ssh-keygen -Y verify -f allowed_signers_file -I signer_identity\n" |
" -n namespace -s signature_file [-r revocation_file]\n"); |
" -n namespace -s signature_file [-r revocation_file]\n"); |
exit(1); |
exit(1); |
} |
} |
|
|
|
|
pw = getpwuid(getuid()); |
pw = getpwuid(getuid()); |
if (!pw) |
if (!pw) |
fatal("No user exists for uid %lu", (u_long)getuid()); |
fatal("No user exists for uid %lu", (u_long)getuid()); |
|
pw = pwcopy(pw); |
if (gethostname(hostname, sizeof(hostname)) == -1) |
if (gethostname(hostname, sizeof(hostname)) == -1) |
fatal("gethostname: %s", strerror(errno)); |
fatal("gethostname: %s", strerror(errno)); |
|
|
|
|
break; |
break; |
case 'Z': |
case 'Z': |
openssh_format_cipher = optarg; |
openssh_format_cipher = optarg; |
|
if (cipher_by_name(openssh_format_cipher) == NULL) |
|
fatal("Invalid OpenSSH-format cipher '%s'", |
|
openssh_format_cipher); |
break; |
break; |
case 'C': |
case 'C': |
identity_comment = optarg; |
identity_comment = optarg; |
|
|
if (strncmp(sign_op, "find-principals", 15) == 0) { |
if (strncmp(sign_op, "find-principals", 15) == 0) { |
if (ca_key_path == NULL) { |
if (ca_key_path == NULL) { |
error("Too few arguments for find-principals:" |
error("Too few arguments for find-principals:" |
"missing signature file"); |
"missing signature file"); |
exit(1); |
exit(1); |
} |
} |
if (!have_identity) { |
if (!have_identity) { |
error("Too few arguments for find-principals:" |
error("Too few arguments for find-principals:" |
"missing allowed keys file"); |
"missing allowed keys file"); |
exit(1); |
exit(1); |
} |
} |
return sig_find_principals(ca_key_path, identity_file); |
return sig_find_principals(ca_key_path, identity_file, |
|
opts, nopts); |
} else if (strncmp(sign_op, "sign", 4) == 0) { |
} else if (strncmp(sign_op, "sign", 4) == 0) { |
if (cert_principals == NULL || |
if (cert_principals == NULL || |
*cert_principals == '\0') { |
*cert_principals == '\0') { |
|
|
} else if (strncmp(sign_op, "check-novalidate", 16) == 0) { |
} else if (strncmp(sign_op, "check-novalidate", 16) == 0) { |
if (ca_key_path == NULL) { |
if (ca_key_path == NULL) { |
error("Too few arguments for check-novalidate: " |
error("Too few arguments for check-novalidate: " |
"missing signature file"); |
"missing signature file"); |
exit(1); |
exit(1); |
} |
} |
return sig_verify(ca_key_path, cert_principals, |
return sig_verify(ca_key_path, cert_principals, |
NULL, NULL, NULL); |
NULL, NULL, NULL, opts, nopts); |
} else if (strncmp(sign_op, "verify", 6) == 0) { |
} else if (strncmp(sign_op, "verify", 6) == 0) { |
if (cert_principals == NULL || |
if (cert_principals == NULL || |
*cert_principals == '\0') { |
*cert_principals == '\0') { |
|
|
exit(1); |
exit(1); |
} |
} |
return sig_verify(ca_key_path, cert_principals, |
return sig_verify(ca_key_path, cert_principals, |
cert_key_id, identity_file, rr_hostname); |
cert_key_id, identity_file, rr_hostname, |
|
opts, nopts); |
} |
} |
error("Unsupported operation for -Y: \"%s\"", sign_op); |
error("Unsupported operation for -Y: \"%s\"", sign_op); |
usage(); |
usage(); |