version 1.444, 2022/01/05 04:27:54 |
version 1.445, 2022/01/05 04:50:11 |
|
|
|
|
static int |
static int |
sign_one(struct sshkey *signkey, const char *filename, int fd, |
sign_one(struct sshkey *signkey, const char *filename, int fd, |
const char *sig_namespace, sshsig_signer *signer, void *signer_ctx) |
const char *sig_namespace, const char *hashalg, sshsig_signer *signer, |
|
void *signer_ctx) |
{ |
{ |
struct sshbuf *sigbuf = NULL, *abuf = NULL; |
struct sshbuf *sigbuf = NULL, *abuf = NULL; |
int r = SSH_ERR_INTERNAL_ERROR, wfd = -1, oerrno; |
int r = SSH_ERR_INTERNAL_ERROR, wfd = -1, oerrno; |
|
|
free(fp); |
free(fp); |
} |
} |
} |
} |
if ((r = sshsig_sign_fd(signkey, NULL, sk_provider, pin, |
if ((r = sshsig_sign_fd(signkey, hashalg, sk_provider, pin, |
fd, sig_namespace, &sigbuf, signer, signer_ctx)) != 0) { |
fd, sig_namespace, &sigbuf, signer, signer_ctx)) != 0) { |
error_r(r, "Signing %s failed", filename); |
error_r(r, "Signing %s failed", filename); |
goto out; |
goto out; |
|
|
} |
} |
|
|
static int |
static int |
sig_process_opts(char * const *opts, size_t nopts, uint64_t *verify_timep, |
sig_process_opts(char * const *opts, size_t nopts, char **hashalgp, |
int *print_pubkey) |
uint64_t *verify_timep, int *print_pubkey) |
{ |
{ |
size_t i; |
size_t i; |
time_t now; |
time_t now; |
|
|
*verify_timep = 0; |
*verify_timep = 0; |
if (print_pubkey != NULL) |
if (print_pubkey != NULL) |
*print_pubkey = 0; |
*print_pubkey = 0; |
|
if (hashalgp != NULL) |
|
*hashalgp = NULL; |
for (i = 0; i < nopts; i++) { |
for (i = 0; i < nopts; i++) { |
if (verify_timep && |
if (hashalgp != NULL && |
|
strncasecmp(opts[i], "hashalg=", 8) == 0) { |
|
*hashalgp = xstrdup(opts[i] + 8); |
|
} else if (verify_timep && |
strncasecmp(opts[i], "verify-time=", 12) == 0) { |
strncasecmp(opts[i], "verify-time=", 12) == 0) { |
if (parse_absolute_time(opts[i] + 12, |
if (parse_absolute_time(opts[i] + 12, |
verify_timep) != 0 || *verify_timep == 0) { |
verify_timep) != 0 || *verify_timep == 0) { |
|
|
|
|
|
|
static int |
static int |
sig_sign(const char *keypath, const char *sig_namespace, int argc, char **argv) |
sig_sign(const char *keypath, const char *sig_namespace, int argc, char **argv, |
|
char * const *opts, size_t nopts) |
{ |
{ |
int i, fd = -1, r, ret = -1; |
int i, fd = -1, r, ret = -1; |
int agent_fd = -1; |
int agent_fd = -1; |
struct sshkey *pubkey = NULL, *privkey = NULL, *signkey = NULL; |
struct sshkey *pubkey = NULL, *privkey = NULL, *signkey = NULL; |
sshsig_signer *signer = NULL; |
sshsig_signer *signer = NULL; |
|
char *hashalg = NULL; |
|
|
/* Check file arguments. */ |
/* Check file arguments. */ |
for (i = 0; i < argc; i++) { |
for (i = 0; i < argc; i++) { |
|
|
fatal("Cannot sign mix of paths and standard input"); |
fatal("Cannot sign mix of paths and standard input"); |
} |
} |
|
|
|
if (sig_process_opts(opts, nopts, &hashalg, NULL, NULL) != 0) |
|
goto done; /* error already logged */ |
|
|
if ((r = sshkey_load_public(keypath, &pubkey, NULL)) != 0) { |
if ((r = sshkey_load_public(keypath, &pubkey, NULL)) != 0) { |
error_r(r, "Couldn't load public key %s", keypath); |
error_r(r, "Couldn't load public key %s", keypath); |
goto done; |
goto done; |
|
|
|
|
if (argc == 0) { |
if (argc == 0) { |
if ((r = sign_one(signkey, "(stdin)", STDIN_FILENO, |
if ((r = sign_one(signkey, "(stdin)", STDIN_FILENO, |
sig_namespace, signer, &agent_fd)) != 0) |
sig_namespace, hashalg, signer, &agent_fd)) != 0) |
goto done; |
goto done; |
} else { |
} else { |
for (i = 0; i < argc; i++) { |
for (i = 0; i < argc; i++) { |
|
|
goto done; |
goto done; |
} |
} |
if ((r = sign_one(signkey, argv[i], fd, sig_namespace, |
if ((r = sign_one(signkey, argv[i], fd, sig_namespace, |
signer, &agent_fd)) != 0) |
hashalg, signer, &agent_fd)) != 0) |
goto done; |
goto done; |
if (fd != STDIN_FILENO) |
if (fd != STDIN_FILENO) |
close(fd); |
close(fd); |
|
|
close(fd); |
close(fd); |
sshkey_free(pubkey); |
sshkey_free(pubkey); |
sshkey_free(privkey); |
sshkey_free(privkey); |
|
free(hashalg); |
return ret; |
return ret; |
} |
} |
|
|
|
|
struct sshkey_sig_details *sig_details = NULL; |
struct sshkey_sig_details *sig_details = NULL; |
uint64_t verify_time = 0; |
uint64_t verify_time = 0; |
|
|
if (sig_process_opts(opts, nopts, &verify_time, &print_pubkey) != 0) |
if (sig_process_opts(opts, nopts, NULL, &verify_time, |
|
&print_pubkey) != 0) |
goto done; /* error already logged */ |
goto done; /* error already logged */ |
|
|
memset(&sig_details, 0, sizeof(sig_details)); |
memset(&sig_details, 0, sizeof(sig_details)); |
|
|
char *principals = NULL, *cp, *tmp; |
char *principals = NULL, *cp, *tmp; |
uint64_t verify_time = 0; |
uint64_t verify_time = 0; |
|
|
if (sig_process_opts(opts, nopts, &verify_time, NULL) != 0) |
if (sig_process_opts(opts, nopts, NULL, &verify_time, NULL) != 0) |
goto done; /* error already logged */ |
goto done; /* error already logged */ |
|
|
if ((r = sshbuf_load_file(signature, &abuf)) != 0) { |
if ((r = sshbuf_load_file(signature, &abuf)) != 0) { |
|
|
char **principals = NULL; |
char **principals = NULL; |
size_t i, nprincipals = 0; |
size_t i, nprincipals = 0; |
|
|
if ((r = sig_process_opts(opts, nopts, NULL, NULL)) != 0) |
if ((r = sig_process_opts(opts, nopts, NULL, NULL, NULL)) != 0) |
return r; /* error already logged */ |
return r; /* error already logged */ |
|
|
if ((r = sshsig_match_principals(allowed_keys, principal, |
if ((r = sshsig_match_principals(allowed_keys, principal, |
|
|
" ssh-keygen -Y find-principals -s signature_file -f allowed_signers_file\n" |
" ssh-keygen -Y find-principals -s signature_file -f allowed_signers_file\n" |
" ssh-keygen -Y match-principals -I signer_identity -f allowed_signers_file\n" |
" ssh-keygen -Y match-principals -I signer_identity -f allowed_signers_file\n" |
" ssh-keygen -Y check-novalidate -n namespace -s signature_file\n" |
" ssh-keygen -Y check-novalidate -n namespace -s signature_file\n" |
" ssh-keygen -Y sign -f key_file -n namespace file ...\n" |
" ssh-keygen -Y sign -f key_file -n namespace file [-O option] ...\n" |
" ssh-keygen -Y verify -f allowed_signers_file -I signer_identity\n" |
" ssh-keygen -Y verify -f allowed_signers_file -I signer_identity\n" |
" -n namespace -s signature_file [-r revocation_file] [-O option]\n"); |
" -n namespace -s signature_file [-r krl_file] [-O option]\n"); |
exit(1); |
exit(1); |
} |
} |
|
|
|
|
exit(1); |
exit(1); |
} |
} |
return sig_sign(identity_file, cert_principals, |
return sig_sign(identity_file, cert_principals, |
argc, argv); |
argc, argv, opts, nopts); |
} else if (strncmp(sign_op, "check-novalidate", 16) == 0) { |
} else if (strncmp(sign_op, "check-novalidate", 16) == 0) { |
if (ca_key_path == NULL) { |
if (ca_key_path == NULL) { |
error("Too few arguments for check-novalidate: " |
error("Too few arguments for check-novalidate: " |