src/usr.bin/ssh/ssh-keygen.c - diff

Return to ssh-keygen.c CVS log

Up to [local] / src / usr.bin / ssh

Diff for /src/usr.bin/ssh/ssh-keygen.c between version 1.421 and 1.433

version 1.421, 2020/10/18 11:32:02

version 1.433, 2021/07/24 02:08:13

Line 26

#include <fcntl.h>

#include <netdb.h>

#include <pwd.h>

#include <stdarg.h>

#include <stdio.h>

#include <stdlib.h>

#include <string.h>

#include <stdarg.h>

#include <unistd.h>

#include <limits.h>

#include <locale.h>

Line 55

#include "sshsig.h"

#include "ssh-sk.h"

#include "sk-api.h" /* XXX for SSH_SK_USER_PRESENCE_REQD; remove */

#include "cipher.h"

#ifdef ENABLE_PKCS11

#include "ssh-pkcs11.h"

Line 178

Line 179

fatal("unknown key type %s", key_type_name);

if (*bitsp == 0) {

#ifdef WITH_OPENSSL

u_int nid;

int nid;

switch(type) {

case KEY_DSA:

Line 1317

Line 1318

foreach_options |= print_fingerprint ? HKF_WANT_PARSE_KEY : 0;

if ((r = hostkeys_foreach(identity_file, (find_host || !hash_hosts) ?

known_hosts_find_delete : known_hosts_hash, &ctx, name, NULL,

foreach_options)) != 0) {

foreach_options, 0)) != 0) {

if (inplace)

unlink(tmp);

fatal_fr(r, "hostkeys_foreach");

Line 1831

Line 1832

}

r = sshkey_certify(public, ca, key_type_name,

sk_provider, pin);

notify_complete(notifier);

notify_complete(notifier, "User presence confirmed");

if (r != 0)

fatal_r(r, "Couldn't certify key %s", tmp);

}

Line 1985

Line 1986

fatal("Invalid source-address list");

certflags_src_addr = xstrdup(val);

} else if (strncasecmp(opt, "extension:", 10) == 0 ||

(iscrit = (strncasecmp(opt, "critical:", 9) == 0))) {

val = xstrdup(strchr(opt, ':') + 1);

if ((cp = strchr(val, '=')) != NULL)

*cp++ = '\0';

Line 2649

Line 2650

}

static int

sig_process_opts(char * const *opts, size_t nopts, uint64_t *verify_timep)

{

size_t i;

time_t now;

*verify_timep = 0;

for (i = 0; i < nopts; i++) {

if (strncasecmp(opts[i], "verify-time=", 12) == 0) {

if (parse_absolute_time(opts[i] + 12,

verify_timep) != 0 || *verify_timep == 0) {

error("Invalid \"verify-time\" option");

return SSH_ERR_INVALID_ARGUMENT;

}

} else {

error("Invalid option \"%s\"", opts[i]);

return SSH_ERR_INVALID_ARGUMENT;

}

if (*verify_timep == 0) {

if ((now = time(NULL)) < 0) {

error("Time is before epoch");

return SSH_ERR_INVALID_ARGUMENT;

}

*verify_timep = (uint64_t)now;

}

return 0;

}

static int

sig_verify(const char *signature, const char *sig_namespace,

const char *principal, const char *allowed_keys, const char *revoked_keys)

const char *principal, const char *allowed_keys, const char *revoked_keys,

char * const *opts, size_t nopts)

{

int r, ret = -1;

struct sshbuf *sigbuf = NULL, *abuf = NULL;

struct sshkey *sign_key = NULL;

char *fp = NULL;

struct sshkey_sig_details *sig_details = NULL;

uint64_t verify_time = 0;

if (sig_process_opts(opts, nopts, &verify_time) != 0)

goto done; /* error already logged */

memset(&sig_details, 0, sizeof(sig_details));

if ((r = sshbuf_load_file(signature, &abuf)) != 0) {

error_r(r, "Couldn't read signature file");

Line 2691

Line 2726

}

if (allowed_keys != NULL && (r = sshsig_check_allowed_keys(allowed_keys,

sign_key, principal, sig_namespace)) != 0) {

sign_key, principal, sig_namespace, verify_time)) != 0) {

debug3_fr(r, "sshsig_check_allowed_keys");

goto done;

}

Line 2705

Line 2740

fatal_f("sshkey_fingerprint failed");

if (principal == NULL) {

printf("Good \"%s\" signature with %s key %s\n",

sig_namespace, sshkey_type(sign_key), fp);

} else {

printf("Good \"%s\" signature for %s with %s key %s\n",

sig_namespace, principal,

sshkey_type(sign_key), fp);

}

} else {

printf("Could not verify signature.\n");

Line 2725

Line 2760

}

static int

sig_find_principals(const char *signature, const char *allowed_keys) {

sig_find_principals(const char *signature, const char *allowed_keys,

char * const *opts, size_t nopts)

{

int r, ret = -1;

struct sshbuf *sigbuf = NULL, *abuf = NULL;

struct sshkey *sign_key = NULL;

char *principals = NULL, *cp, *tmp;

uint64_t verify_time = 0;

if (sig_process_opts(opts, nopts, &verify_time) != 0)

goto done; /* error already logged */

if ((r = sshbuf_load_file(signature, &abuf)) != 0) {

error_r(r, "Couldn't read signature file");

goto done;

Line 2744

Line 2785

goto done;

}

if ((r = sshsig_find_principals(allowed_keys, sign_key,

&principals)) != 0) {

verify_time, &principals)) != 0) {

error_fr(r, "sshsig_get_principal");

if (r != SSH_ERR_KEY_NOT_FOUND)

error_fr(r, "sshsig_find_principal");

goto done;

}

ret = 0;

Line 3044

Line 3086

"usage: ssh-keygen [-q] [-a rounds] [-b bits] [-C comment] [-f output_keyfile]\n"

" [-m format] [-N new_passphrase] [-O option]\n"

" [-w provider]\n"

" [-w provider] [-Z cipher]\n"

" ssh-keygen -p [-a rounds] [-f keyfile] [-m format] [-N new_passphrase]\n"

" [-P old_passphrase]\n"

" [-P old_passphrase] [-Z cipher]\n"

#ifdef WITH_OPENSSL

" ssh-keygen -i [-f input_keyfile] [-m key_format]\n"

" ssh-keygen -e [-f input_keyfile] [-m key_format]\n"

" ssh-keygen -y [-f input_keyfile]\n"

#endif

" ssh-keygen -c [-a rounds] [-C comment] [-f keyfile] [-P passphrase]\n"

" ssh-keygen -l [-v] [-E fingerprint_hash] [-f input_keyfile]\n"

" ssh-keygen -B [-f input_keyfile]\n");

Line 3079

Line 3123

" ssh-keygen -Y check-novalidate -n namespace -s signature_file\n"

" ssh-keygen -Y sign -f key_file -n namespace file ...\n"

" ssh-keygen -Y verify -f allowed_signers_file -I signer_identity\n"

" -n namespace -s signature_file [-r revocation_file]\n");

exit(1);

}

Line 3129

Line 3173

pw = getpwuid(getuid());

if (!pw)

fatal("No user exists for uid %lu", (u_long)getuid());

pw = pwcopy(pw);

if (gethostname(hostname, sizeof(hostname)) == -1)

fatal("gethostname: %s", strerror(errno));

Line 3234

Line 3279

break;

case 'Z':

openssh_format_cipher = optarg;

if (cipher_by_name(openssh_format_cipher) == NULL)

fatal("Invalid OpenSSH-format cipher '%s'",

openssh_format_cipher);

break;

case 'C':

identity_comment = optarg;

Line 3340

Line 3388

if (strncmp(sign_op, "find-principals", 15) == 0) {

if (ca_key_path == NULL) {

error("Too few arguments for find-principals:"

"missing signature file");

exit(1);

}

if (!have_identity) {

error("Too few arguments for find-principals:"

"missing allowed keys file");

exit(1);

}

return sig_find_principals(ca_key_path, identity_file);

return sig_find_principals(ca_key_path, identity_file,

opts, nopts);

} else if (strncmp(sign_op, "sign", 4) == 0) {

if (cert_principals == NULL ||

*cert_principals == '\0') {

Line 3366

Line 3415

} else if (strncmp(sign_op, "check-novalidate", 16) == 0) {

if (ca_key_path == NULL) {

error("Too few arguments for check-novalidate: "

"missing signature file");

exit(1);

}

return sig_verify(ca_key_path, cert_principals,

NULL, NULL, NULL);

NULL, NULL, NULL, opts, nopts);

} else if (strncmp(sign_op, "verify", 6) == 0) {

if (cert_principals == NULL ||

*cert_principals == '\0') {

Line 3394

Line 3443

exit(1);

}

return sig_verify(ca_key_path, cert_principals,

cert_key_id, identity_file, rr_hostname);

cert_key_id, identity_file, rr_hostname,

opts, nopts);

}

error("Unsupported operation for -Y: \"%s\"", sign_op);

usage();