version 1.424, 2020/11/08 22:37:24 |
version 1.449, 2022/03/18 02:31:25 |
|
|
#include <fcntl.h> |
#include <fcntl.h> |
#include <netdb.h> |
#include <netdb.h> |
#include <pwd.h> |
#include <pwd.h> |
|
#include <stdarg.h> |
#include <stdio.h> |
#include <stdio.h> |
#include <stdlib.h> |
#include <stdlib.h> |
#include <string.h> |
#include <string.h> |
#include <stdarg.h> |
|
#include <unistd.h> |
#include <unistd.h> |
#include <limits.h> |
#include <limits.h> |
#include <locale.h> |
#include <locale.h> |
|
|
#include "sshsig.h" |
#include "sshsig.h" |
#include "ssh-sk.h" |
#include "ssh-sk.h" |
#include "sk-api.h" /* XXX for SSH_SK_USER_PRESENCE_REQD; remove */ |
#include "sk-api.h" /* XXX for SSH_SK_USER_PRESENCE_REQD; remove */ |
|
#include "cipher.h" |
|
|
#ifdef ENABLE_PKCS11 |
#ifdef ENABLE_PKCS11 |
#include "ssh-pkcs11.h" |
#include "ssh-pkcs11.h" |
|
|
if ((hashed = host_hash(cp, NULL, 0)) == NULL) |
if ((hashed = host_hash(cp, NULL, 0)) == NULL) |
fatal("hash_host failed"); |
fatal("hash_host failed"); |
fprintf(ctx->out, "%s %s\n", hashed, l->rawkey); |
fprintf(ctx->out, "%s %s\n", hashed, l->rawkey); |
|
free(hashed); |
ctx->has_unhashed = 1; |
ctx->has_unhashed = 1; |
} |
} |
free(ohosts); |
free(ohosts); |
|
|
foreach_options |= print_fingerprint ? HKF_WANT_PARSE_KEY : 0; |
foreach_options |= print_fingerprint ? HKF_WANT_PARSE_KEY : 0; |
if ((r = hostkeys_foreach(identity_file, (find_host || !hash_hosts) ? |
if ((r = hostkeys_foreach(identity_file, (find_host || !hash_hosts) ? |
known_hosts_find_delete : known_hosts_hash, &ctx, name, NULL, |
known_hosts_find_delete : known_hosts_hash, &ctx, name, NULL, |
foreach_options)) != 0) { |
foreach_options, 0)) != 0) { |
if (inplace) |
if (inplace) |
unlink(tmp); |
unlink(tmp); |
fatal_fr(r, "hostkeys_foreach"); |
fatal_fr(r, "hostkeys_foreach"); |
|
|
fatal("Invalid source-address list"); |
fatal("Invalid source-address list"); |
certflags_src_addr = xstrdup(val); |
certflags_src_addr = xstrdup(val); |
} else if (strncasecmp(opt, "extension:", 10) == 0 || |
} else if (strncasecmp(opt, "extension:", 10) == 0 || |
(iscrit = (strncasecmp(opt, "critical:", 9) == 0))) { |
(iscrit = (strncasecmp(opt, "critical:", 9) == 0))) { |
val = xstrdup(strchr(opt, ':') + 1); |
val = xstrdup(strchr(opt, ':') + 1); |
if ((cp = strchr(val, '=')) != NULL) |
if ((cp = strchr(val, '=')) != NULL) |
*cp++ = '\0'; |
*cp++ = '\0'; |
|
|
{ |
{ |
size_t i, slen, plen = strlen(keypath); |
size_t i, slen, plen = strlen(keypath); |
char *privpath = xstrdup(keypath); |
char *privpath = xstrdup(keypath); |
const char *suffixes[] = { "-cert.pub", ".pub", NULL }; |
static const char * const suffixes[] = { "-cert.pub", ".pub", NULL }; |
struct sshkey *ret = NULL, *privkey = NULL; |
struct sshkey *ret = NULL, *privkey = NULL; |
int r; |
int r; |
|
|
|
|
|
|
static int |
static int |
sign_one(struct sshkey *signkey, const char *filename, int fd, |
sign_one(struct sshkey *signkey, const char *filename, int fd, |
const char *sig_namespace, sshsig_signer *signer, void *signer_ctx) |
const char *sig_namespace, const char *hashalg, sshsig_signer *signer, |
|
void *signer_ctx) |
{ |
{ |
struct sshbuf *sigbuf = NULL, *abuf = NULL; |
struct sshbuf *sigbuf = NULL, *abuf = NULL; |
int r = SSH_ERR_INTERNAL_ERROR, wfd = -1, oerrno; |
int r = SSH_ERR_INTERNAL_ERROR, wfd = -1, oerrno; |
|
|
free(fp); |
free(fp); |
} |
} |
} |
} |
if ((r = sshsig_sign_fd(signkey, NULL, sk_provider, pin, |
if ((r = sshsig_sign_fd(signkey, hashalg, sk_provider, pin, |
fd, sig_namespace, &sigbuf, signer, signer_ctx)) != 0) { |
fd, sig_namespace, &sigbuf, signer, signer_ctx)) != 0) { |
error_r(r, "Signing %s failed", filename); |
error_r(r, "Signing %s failed", filename); |
goto out; |
goto out; |
|
|
} |
} |
|
|
static int |
static int |
sig_sign(const char *keypath, const char *sig_namespace, int argc, char **argv) |
sig_process_opts(char * const *opts, size_t nopts, char **hashalgp, |
|
uint64_t *verify_timep, int *print_pubkey) |
{ |
{ |
|
size_t i; |
|
time_t now; |
|
|
|
if (verify_timep != NULL) |
|
*verify_timep = 0; |
|
if (print_pubkey != NULL) |
|
*print_pubkey = 0; |
|
if (hashalgp != NULL) |
|
*hashalgp = NULL; |
|
for (i = 0; i < nopts; i++) { |
|
if (hashalgp != NULL && |
|
strncasecmp(opts[i], "hashalg=", 8) == 0) { |
|
*hashalgp = xstrdup(opts[i] + 8); |
|
} else if (verify_timep && |
|
strncasecmp(opts[i], "verify-time=", 12) == 0) { |
|
if (parse_absolute_time(opts[i] + 12, |
|
verify_timep) != 0 || *verify_timep == 0) { |
|
error("Invalid \"verify-time\" option"); |
|
return SSH_ERR_INVALID_ARGUMENT; |
|
} |
|
} else if (print_pubkey && |
|
strcasecmp(opts[i], "print-pubkey") == 0) { |
|
*print_pubkey = 1; |
|
} else { |
|
error("Invalid option \"%s\"", opts[i]); |
|
return SSH_ERR_INVALID_ARGUMENT; |
|
} |
|
} |
|
if (verify_timep && *verify_timep == 0) { |
|
if ((now = time(NULL)) < 0) { |
|
error("Time is before epoch"); |
|
return SSH_ERR_INVALID_ARGUMENT; |
|
} |
|
*verify_timep = (uint64_t)now; |
|
} |
|
return 0; |
|
} |
|
|
|
|
|
static int |
|
sig_sign(const char *keypath, const char *sig_namespace, int argc, char **argv, |
|
char * const *opts, size_t nopts) |
|
{ |
int i, fd = -1, r, ret = -1; |
int i, fd = -1, r, ret = -1; |
int agent_fd = -1; |
int agent_fd = -1; |
struct sshkey *pubkey = NULL, *privkey = NULL, *signkey = NULL; |
struct sshkey *pubkey = NULL, *privkey = NULL, *signkey = NULL; |
sshsig_signer *signer = NULL; |
sshsig_signer *signer = NULL; |
|
char *hashalg = NULL; |
|
|
/* Check file arguments. */ |
/* Check file arguments. */ |
for (i = 0; i < argc; i++) { |
for (i = 0; i < argc; i++) { |
|
|
fatal("Cannot sign mix of paths and standard input"); |
fatal("Cannot sign mix of paths and standard input"); |
} |
} |
|
|
|
if (sig_process_opts(opts, nopts, &hashalg, NULL, NULL) != 0) |
|
goto done; /* error already logged */ |
|
|
if ((r = sshkey_load_public(keypath, &pubkey, NULL)) != 0) { |
if ((r = sshkey_load_public(keypath, &pubkey, NULL)) != 0) { |
error_r(r, "Couldn't load public key %s", keypath); |
error_r(r, "Couldn't load public key %s", keypath); |
goto done; |
goto done; |
|
|
|
|
if (argc == 0) { |
if (argc == 0) { |
if ((r = sign_one(signkey, "(stdin)", STDIN_FILENO, |
if ((r = sign_one(signkey, "(stdin)", STDIN_FILENO, |
sig_namespace, signer, &agent_fd)) != 0) |
sig_namespace, hashalg, signer, &agent_fd)) != 0) |
goto done; |
goto done; |
} else { |
} else { |
for (i = 0; i < argc; i++) { |
for (i = 0; i < argc; i++) { |
|
|
goto done; |
goto done; |
} |
} |
if ((r = sign_one(signkey, argv[i], fd, sig_namespace, |
if ((r = sign_one(signkey, argv[i], fd, sig_namespace, |
signer, &agent_fd)) != 0) |
hashalg, signer, &agent_fd)) != 0) |
goto done; |
goto done; |
if (fd != STDIN_FILENO) |
if (fd != STDIN_FILENO) |
close(fd); |
close(fd); |
|
|
close(fd); |
close(fd); |
sshkey_free(pubkey); |
sshkey_free(pubkey); |
sshkey_free(privkey); |
sshkey_free(privkey); |
|
free(hashalg); |
return ret; |
return ret; |
} |
} |
|
|
static int |
static int |
sig_verify(const char *signature, const char *sig_namespace, |
sig_verify(const char *signature, const char *sig_namespace, |
const char *principal, const char *allowed_keys, const char *revoked_keys) |
const char *principal, const char *allowed_keys, const char *revoked_keys, |
|
char * const *opts, size_t nopts) |
{ |
{ |
int r, ret = -1; |
int r, ret = -1; |
|
int print_pubkey = 0; |
struct sshbuf *sigbuf = NULL, *abuf = NULL; |
struct sshbuf *sigbuf = NULL, *abuf = NULL; |
struct sshkey *sign_key = NULL; |
struct sshkey *sign_key = NULL; |
char *fp = NULL; |
char *fp = NULL; |
struct sshkey_sig_details *sig_details = NULL; |
struct sshkey_sig_details *sig_details = NULL; |
|
uint64_t verify_time = 0; |
|
|
|
if (sig_process_opts(opts, nopts, NULL, &verify_time, |
|
&print_pubkey) != 0) |
|
goto done; /* error already logged */ |
|
|
memset(&sig_details, 0, sizeof(sig_details)); |
memset(&sig_details, 0, sizeof(sig_details)); |
if ((r = sshbuf_load_file(signature, &abuf)) != 0) { |
if ((r = sshbuf_load_file(signature, &abuf)) != 0) { |
error_r(r, "Couldn't read signature file"); |
error_r(r, "Couldn't read signature file"); |
|
|
} |
} |
|
|
if (allowed_keys != NULL && (r = sshsig_check_allowed_keys(allowed_keys, |
if (allowed_keys != NULL && (r = sshsig_check_allowed_keys(allowed_keys, |
sign_key, principal, sig_namespace)) != 0) { |
sign_key, principal, sig_namespace, verify_time)) != 0) { |
debug3_fr(r, "sshsig_check_allowed_keys"); |
debug3_fr(r, "sshsig_check_allowed_keys"); |
goto done; |
goto done; |
} |
} |
|
|
fatal_f("sshkey_fingerprint failed"); |
fatal_f("sshkey_fingerprint failed"); |
if (principal == NULL) { |
if (principal == NULL) { |
printf("Good \"%s\" signature with %s key %s\n", |
printf("Good \"%s\" signature with %s key %s\n", |
sig_namespace, sshkey_type(sign_key), fp); |
sig_namespace, sshkey_type(sign_key), fp); |
|
|
} else { |
} else { |
printf("Good \"%s\" signature for %s with %s key %s\n", |
printf("Good \"%s\" signature for %s with %s key %s\n", |
sig_namespace, principal, |
sig_namespace, principal, |
sshkey_type(sign_key), fp); |
sshkey_type(sign_key), fp); |
} |
} |
} else { |
} else { |
printf("Could not verify signature.\n"); |
printf("Could not verify signature.\n"); |
} |
} |
} |
} |
|
/* Print the signature key if requested */ |
|
if (ret == 0 && print_pubkey && sign_key != NULL) { |
|
if ((r = sshkey_write(sign_key, stdout)) == 0) |
|
fputc('\n', stdout); |
|
else { |
|
error_r(r, "Could not print public key.\n"); |
|
ret = -1; |
|
} |
|
} |
sshbuf_free(sigbuf); |
sshbuf_free(sigbuf); |
sshbuf_free(abuf); |
sshbuf_free(abuf); |
sshkey_free(sign_key); |
sshkey_free(sign_key); |
|
|
} |
} |
|
|
static int |
static int |
sig_find_principals(const char *signature, const char *allowed_keys) { |
sig_find_principals(const char *signature, const char *allowed_keys, |
|
char * const *opts, size_t nopts) |
|
{ |
int r, ret = -1; |
int r, ret = -1; |
struct sshbuf *sigbuf = NULL, *abuf = NULL; |
struct sshbuf *sigbuf = NULL, *abuf = NULL; |
struct sshkey *sign_key = NULL; |
struct sshkey *sign_key = NULL; |
char *principals = NULL, *cp, *tmp; |
char *principals = NULL, *cp, *tmp; |
|
uint64_t verify_time = 0; |
|
|
|
if (sig_process_opts(opts, nopts, NULL, &verify_time, NULL) != 0) |
|
goto done; /* error already logged */ |
|
|
if ((r = sshbuf_load_file(signature, &abuf)) != 0) { |
if ((r = sshbuf_load_file(signature, &abuf)) != 0) { |
error_r(r, "Couldn't read signature file"); |
error_r(r, "Couldn't read signature file"); |
goto done; |
goto done; |
|
|
goto done; |
goto done; |
} |
} |
if ((r = sshsig_find_principals(allowed_keys, sign_key, |
if ((r = sshsig_find_principals(allowed_keys, sign_key, |
&principals)) != 0) { |
verify_time, &principals)) != 0) { |
error_fr(r, "sshsig_get_principal"); |
if (r != SSH_ERR_KEY_NOT_FOUND) |
|
error_fr(r, "sshsig_find_principal"); |
goto done; |
goto done; |
} |
} |
ret = 0; |
ret = 0; |
|
|
return ret; |
return ret; |
} |
} |
|
|
|
static int |
|
sig_match_principals(const char *allowed_keys, char *principal, |
|
char * const *opts, size_t nopts) |
|
{ |
|
int r; |
|
char **principals = NULL; |
|
size_t i, nprincipals = 0; |
|
|
|
if ((r = sig_process_opts(opts, nopts, NULL, NULL, NULL)) != 0) |
|
return r; /* error already logged */ |
|
|
|
if ((r = sshsig_match_principals(allowed_keys, principal, |
|
&principals, &nprincipals)) != 0) { |
|
debug_f("match: %s", ssh_err(r)); |
|
fprintf(stderr, "No principal matched.\n"); |
|
return r; |
|
} |
|
for (i = 0; i < nprincipals; i++) { |
|
printf("%s\n", principals[i]); |
|
free(principals[i]); |
|
} |
|
free(principals); |
|
|
|
return 0; |
|
} |
|
|
static void |
static void |
do_moduli_gen(const char *out_file, char **opts, size_t nopts) |
do_moduli_gen(const char *out_file, char **opts, size_t nopts) |
{ |
{ |
|
|
return passphrase1; |
return passphrase1; |
} |
} |
|
|
static const char * |
static char * |
skip_ssh_url_preamble(const char *s) |
sk_suffix(const char *application, const uint8_t *user, size_t userlen) |
{ |
{ |
if (strncmp(s, "ssh://", 6) == 0) |
char *ret, *cp; |
return s + 6; |
size_t slen, i; |
else if (strncmp(s, "ssh:", 4) == 0) |
|
return s + 4; |
/* Trim off URL-like preamble */ |
return s; |
if (strncmp(application, "ssh://", 6) == 0) |
|
ret = xstrdup(application + 6); |
|
else if (strncmp(application, "ssh:", 4) == 0) |
|
ret = xstrdup(application + 4); |
|
else |
|
ret = xstrdup(application); |
|
|
|
/* Count trailing zeros in user */ |
|
for (i = 0; i < userlen; i++) { |
|
if (user[userlen - i - 1] != 0) |
|
break; |
|
} |
|
if (i >= userlen) |
|
return ret; /* user-id was default all-zeros */ |
|
|
|
/* Append user-id, escaping non-UTF-8 characters */ |
|
slen = userlen - i; |
|
if (asmprintf(&cp, INT_MAX, NULL, "%.*s", (int)slen, user) == -1) |
|
fatal_f("asmprintf failed"); |
|
/* Don't emit a user-id that contains path or control characters */ |
|
if (strchr(cp, '/') != NULL || strstr(cp, "..") != NULL || |
|
strchr(cp, '\\') != NULL) { |
|
free(cp); |
|
cp = tohex(user, slen); |
|
} |
|
xextendf(&ret, "_", "%s", cp); |
|
free(cp); |
|
return ret; |
} |
} |
|
|
static int |
static int |
do_download_sk(const char *skprovider, const char *device) |
do_download_sk(const char *skprovider, const char *device) |
{ |
{ |
struct sshkey **keys; |
struct sshsk_resident_key **srks; |
size_t nkeys, i; |
size_t nsrks, i; |
int r, ret = -1; |
int r, ret = -1; |
char *fp, *pin = NULL, *pass = NULL, *path, *pubpath; |
char *fp, *pin = NULL, *pass = NULL, *path, *pubpath; |
const char *ext; |
const char *ext; |
|
struct sshkey *key; |
|
|
if (skprovider == NULL) |
if (skprovider == NULL) |
fatal("Cannot download keys without provider"); |
fatal("Cannot download keys without provider"); |
|
|
printf("You may need to touch your authenticator " |
printf("You may need to touch your authenticator " |
"to authorize key download.\n"); |
"to authorize key download.\n"); |
} |
} |
if ((r = sshsk_load_resident(skprovider, device, pin, |
if ((r = sshsk_load_resident(skprovider, device, pin, 0, |
&keys, &nkeys)) != 0) { |
&srks, &nsrks)) != 0) { |
if (pin != NULL) |
if (pin != NULL) |
freezero(pin, strlen(pin)); |
freezero(pin, strlen(pin)); |
error_r(r, "Unable to load resident keys"); |
error_r(r, "Unable to load resident keys"); |
return -1; |
return -1; |
} |
} |
if (nkeys == 0) |
if (nsrks == 0) |
logit("No keys to download"); |
logit("No keys to download"); |
if (pin != NULL) |
if (pin != NULL) |
freezero(pin, strlen(pin)); |
freezero(pin, strlen(pin)); |
|
|
for (i = 0; i < nkeys; i++) { |
for (i = 0; i < nsrks; i++) { |
if (keys[i]->type != KEY_ECDSA_SK && |
key = srks[i]->key; |
keys[i]->type != KEY_ED25519_SK) { |
if (key->type != KEY_ECDSA_SK && key->type != KEY_ED25519_SK) { |
error("Unsupported key type %s (%d)", |
error("Unsupported key type %s (%d)", |
sshkey_type(keys[i]), keys[i]->type); |
sshkey_type(key), key->type); |
continue; |
continue; |
} |
} |
if ((fp = sshkey_fingerprint(keys[i], |
if ((fp = sshkey_fingerprint(key, fingerprint_hash, |
fingerprint_hash, SSH_FP_DEFAULT)) == NULL) |
SSH_FP_DEFAULT)) == NULL) |
fatal_f("sshkey_fingerprint failed"); |
fatal_f("sshkey_fingerprint failed"); |
debug_f("key %zu: %s %s %s (flags 0x%02x)", i, |
debug_f("key %zu: %s %s %s (flags 0x%02x)", i, |
sshkey_type(keys[i]), fp, keys[i]->sk_application, |
sshkey_type(key), fp, key->sk_application, key->sk_flags); |
keys[i]->sk_flags); |
ext = sk_suffix(key->sk_application, |
ext = skip_ssh_url_preamble(keys[i]->sk_application); |
srks[i]->user_id, srks[i]->user_id_len); |
xasprintf(&path, "id_%s_rk%s%s", |
xasprintf(&path, "id_%s_rk%s%s", |
keys[i]->type == KEY_ECDSA_SK ? "ecdsa_sk" : "ed25519_sk", |
key->type == KEY_ECDSA_SK ? "ecdsa_sk" : "ed25519_sk", |
*ext == '\0' ? "" : "_", ext); |
*ext == '\0' ? "" : "_", ext); |
|
|
/* If the file already exists, ask the user to confirm. */ |
/* If the file already exists, ask the user to confirm. */ |
|
|
/* Save the key with the application string as the comment */ |
/* Save the key with the application string as the comment */ |
if (pass == NULL) |
if (pass == NULL) |
pass = private_key_passphrase(); |
pass = private_key_passphrase(); |
if ((r = sshkey_save_private(keys[i], path, pass, |
if ((r = sshkey_save_private(key, path, pass, |
keys[i]->sk_application, private_key_format, |
key->sk_application, private_key_format, |
openssh_format_cipher, rounds)) != 0) { |
openssh_format_cipher, rounds)) != 0) { |
error_r(r, "Saving key \"%s\" failed", path); |
error_r(r, "Saving key \"%s\" failed", path); |
free(path); |
free(path); |
break; |
break; |
} |
} |
if (!quiet) { |
if (!quiet) { |
printf("Saved %s key%s%s to %s\n", |
printf("Saved %s key%s%s to %s\n", sshkey_type(key), |
sshkey_type(keys[i]), |
|
*ext != '\0' ? " " : "", |
*ext != '\0' ? " " : "", |
*ext != '\0' ? keys[i]->sk_application : "", |
*ext != '\0' ? key->sk_application : "", |
path); |
path); |
} |
} |
|
|
/* Save public key too */ |
/* Save public key too */ |
xasprintf(&pubpath, "%s.pub", path); |
xasprintf(&pubpath, "%s.pub", path); |
free(path); |
free(path); |
if ((r = sshkey_save_public(keys[i], pubpath, |
if ((r = sshkey_save_public(key, pubpath, |
keys[i]->sk_application)) != 0) { |
key->sk_application)) != 0) { |
error_r(r, "Saving public key \"%s\" failed", pubpath); |
error_r(r, "Saving public key \"%s\" failed", pubpath); |
free(pubpath); |
free(pubpath); |
break; |
break; |
|
|
free(pubpath); |
free(pubpath); |
} |
} |
|
|
if (i >= nkeys) |
if (i >= nsrks) |
ret = 0; /* success */ |
ret = 0; /* success */ |
if (pass != NULL) |
if (pass != NULL) |
freezero(pass, strlen(pass)); |
freezero(pass, strlen(pass)); |
for (i = 0; i < nkeys; i++) |
sshsk_free_resident_keys(srks, nsrks); |
sshkey_free(keys[i]); |
|
free(keys); |
|
return ret; |
return ret; |
} |
} |
|
|
|
|
"usage: ssh-keygen [-q] [-a rounds] [-b bits] [-C comment] [-f output_keyfile]\n" |
"usage: ssh-keygen [-q] [-a rounds] [-b bits] [-C comment] [-f output_keyfile]\n" |
" [-m format] [-N new_passphrase] [-O option]\n" |
" [-m format] [-N new_passphrase] [-O option]\n" |
" [-t dsa | ecdsa | ecdsa-sk | ed25519 | ed25519-sk | rsa]\n" |
" [-t dsa | ecdsa | ecdsa-sk | ed25519 | ed25519-sk | rsa]\n" |
" [-w provider]\n" |
" [-w provider] [-Z cipher]\n" |
" ssh-keygen -p [-a rounds] [-f keyfile] [-m format] [-N new_passphrase]\n" |
" ssh-keygen -p [-a rounds] [-f keyfile] [-m format] [-N new_passphrase]\n" |
" [-P old_passphrase]\n" |
" [-P old_passphrase] [-Z cipher]\n" |
|
#ifdef WITH_OPENSSL |
" ssh-keygen -i [-f input_keyfile] [-m key_format]\n" |
" ssh-keygen -i [-f input_keyfile] [-m key_format]\n" |
" ssh-keygen -e [-f input_keyfile] [-m key_format]\n" |
" ssh-keygen -e [-f input_keyfile] [-m key_format]\n" |
|
#endif |
" ssh-keygen -y [-f input_keyfile]\n" |
" ssh-keygen -y [-f input_keyfile]\n" |
" ssh-keygen -c [-a rounds] [-C comment] [-f keyfile] [-P passphrase]\n" |
" ssh-keygen -c [-a rounds] [-C comment] [-f keyfile] [-P passphrase]\n" |
" ssh-keygen -l [-v] [-E fingerprint_hash] [-f input_keyfile]\n" |
" ssh-keygen -l [-v] [-E fingerprint_hash] [-f input_keyfile]\n" |
|
|
" file ...\n" |
" file ...\n" |
" ssh-keygen -Q [-l] -f krl_file [file ...]\n" |
" ssh-keygen -Q [-l] -f krl_file [file ...]\n" |
" ssh-keygen -Y find-principals -s signature_file -f allowed_signers_file\n" |
" ssh-keygen -Y find-principals -s signature_file -f allowed_signers_file\n" |
|
" ssh-keygen -Y match-principals -I signer_identity -f allowed_signers_file\n" |
" ssh-keygen -Y check-novalidate -n namespace -s signature_file\n" |
" ssh-keygen -Y check-novalidate -n namespace -s signature_file\n" |
" ssh-keygen -Y sign -f key_file -n namespace file ...\n" |
" ssh-keygen -Y sign -f key_file -n namespace file [-O option] ...\n" |
" ssh-keygen -Y verify -f allowed_signers_file -I signer_identity\n" |
" ssh-keygen -Y verify -f allowed_signers_file -I signer_identity\n" |
" -n namespace -s signature_file [-r revocation_file]\n"); |
" -n namespace -s signature_file [-r krl_file] [-O option]\n"); |
exit(1); |
exit(1); |
} |
} |
|
|
|
|
pw = getpwuid(getuid()); |
pw = getpwuid(getuid()); |
if (!pw) |
if (!pw) |
fatal("No user exists for uid %lu", (u_long)getuid()); |
fatal("No user exists for uid %lu", (u_long)getuid()); |
|
pw = pwcopy(pw); |
if (gethostname(hostname, sizeof(hostname)) == -1) |
if (gethostname(hostname, sizeof(hostname)) == -1) |
fatal("gethostname: %s", strerror(errno)); |
fatal("gethostname: %s", strerror(errno)); |
|
|
|
|
break; |
break; |
case 'Z': |
case 'Z': |
openssh_format_cipher = optarg; |
openssh_format_cipher = optarg; |
|
if (cipher_by_name(openssh_format_cipher) == NULL) |
|
fatal("Invalid OpenSSH-format cipher '%s'", |
|
openssh_format_cipher); |
break; |
break; |
case 'C': |
case 'C': |
identity_comment = optarg; |
identity_comment = optarg; |
|
|
if (strncmp(sign_op, "find-principals", 15) == 0) { |
if (strncmp(sign_op, "find-principals", 15) == 0) { |
if (ca_key_path == NULL) { |
if (ca_key_path == NULL) { |
error("Too few arguments for find-principals:" |
error("Too few arguments for find-principals:" |
"missing signature file"); |
"missing signature file"); |
exit(1); |
exit(1); |
} |
} |
if (!have_identity) { |
if (!have_identity) { |
error("Too few arguments for find-principals:" |
error("Too few arguments for find-principals:" |
"missing allowed keys file"); |
"missing allowed keys file"); |
exit(1); |
exit(1); |
} |
} |
return sig_find_principals(ca_key_path, identity_file); |
return sig_find_principals(ca_key_path, identity_file, |
|
opts, nopts); |
|
} else if (strncmp(sign_op, "match-principals", 16) == 0) { |
|
if (!have_identity) { |
|
error("Too few arguments for match-principals:" |
|
"missing allowed keys file"); |
|
exit(1); |
|
} |
|
if (cert_key_id == NULL) { |
|
error("Too few arguments for match-principals: " |
|
"missing principal ID"); |
|
exit(1); |
|
} |
|
return sig_match_principals(identity_file, cert_key_id, |
|
opts, nopts); |
} else if (strncmp(sign_op, "sign", 4) == 0) { |
} else if (strncmp(sign_op, "sign", 4) == 0) { |
|
/* NB. cert_principals is actually namespace, via -n */ |
if (cert_principals == NULL || |
if (cert_principals == NULL || |
*cert_principals == '\0') { |
*cert_principals == '\0') { |
error("Too few arguments for sign: " |
error("Too few arguments for sign: " |
|
|
exit(1); |
exit(1); |
} |
} |
return sig_sign(identity_file, cert_principals, |
return sig_sign(identity_file, cert_principals, |
argc, argv); |
argc, argv, opts, nopts); |
} else if (strncmp(sign_op, "check-novalidate", 16) == 0) { |
} else if (strncmp(sign_op, "check-novalidate", 16) == 0) { |
|
if (cert_principals == NULL || |
|
*cert_principals == '\0') { |
|
error("Too few arguments for check-novalidate: " |
|
"missing namespace"); |
|
exit(1); |
|
} |
if (ca_key_path == NULL) { |
if (ca_key_path == NULL) { |
error("Too few arguments for check-novalidate: " |
error("Too few arguments for check-novalidate: " |
"missing signature file"); |
"missing signature file"); |
exit(1); |
exit(1); |
} |
} |
return sig_verify(ca_key_path, cert_principals, |
return sig_verify(ca_key_path, cert_principals, |
NULL, NULL, NULL); |
NULL, NULL, NULL, opts, nopts); |
} else if (strncmp(sign_op, "verify", 6) == 0) { |
} else if (strncmp(sign_op, "verify", 6) == 0) { |
|
/* NB. cert_principals is actually namespace, via -n */ |
if (cert_principals == NULL || |
if (cert_principals == NULL || |
*cert_principals == '\0') { |
*cert_principals == '\0') { |
error("Too few arguments for verify: " |
error("Too few arguments for verify: " |
|
|
} |
} |
if (cert_key_id == NULL) { |
if (cert_key_id == NULL) { |
error("Too few arguments for verify: " |
error("Too few arguments for verify: " |
"missing principal ID"); |
"missing principal identity"); |
exit(1); |
exit(1); |
} |
} |
return sig_verify(ca_key_path, cert_principals, |
return sig_verify(ca_key_path, cert_principals, |
cert_key_id, identity_file, rr_hostname); |
cert_key_id, identity_file, rr_hostname, |
|
opts, nopts); |
} |
} |
error("Unsupported operation for -Y: \"%s\"", sign_op); |
error("Unsupported operation for -Y: \"%s\"", sign_op); |
usage(); |
usage(); |