version 1.440, 2021/10/29 03:20:46 |
version 1.469, 2023/07/14 05:31:44 |
|
|
#define CERTOPT_PTY (1<<3) |
#define CERTOPT_PTY (1<<3) |
#define CERTOPT_USER_RC (1<<4) |
#define CERTOPT_USER_RC (1<<4) |
#define CERTOPT_NO_REQUIRE_USER_PRESENCE (1<<5) |
#define CERTOPT_NO_REQUIRE_USER_PRESENCE (1<<5) |
|
#define CERTOPT_REQUIRE_VERIFY (1<<6) |
#define CERTOPT_DEFAULT (CERTOPT_X_FWD|CERTOPT_AGENT_FWD| \ |
#define CERTOPT_DEFAULT (CERTOPT_X_FWD|CERTOPT_AGENT_FWD| \ |
CERTOPT_PORT_FWD|CERTOPT_PTY|CERTOPT_USER_RC) |
CERTOPT_PORT_FWD|CERTOPT_PTY|CERTOPT_USER_RC) |
static u_int32_t certflags_flags = CERTOPT_DEFAULT; |
static u_int32_t certflags_flags = CERTOPT_DEFAULT; |
|
|
{ |
{ |
struct sshkey *key = NULL; |
struct sshkey *key = NULL; |
char *type, *cipher; |
char *type, *cipher; |
|
const char *alg = NULL; |
u_char e1, e2, e3, *sig = NULL, data[] = "abcde12345"; |
u_char e1, e2, e3, *sig = NULL, data[] = "abcde12345"; |
int r, rlen, ktype; |
int r, rlen, ktype; |
u_int magic, i1, i2, i3, i4; |
u_int magic, i1, i2, i3, i4; |
|
|
if ((r = ssh_rsa_complete_crt_parameters(key, rsa_iqmp)) != 0) |
if ((r = ssh_rsa_complete_crt_parameters(key, rsa_iqmp)) != 0) |
fatal_fr(r, "generate RSA parameters"); |
fatal_fr(r, "generate RSA parameters"); |
BN_clear_free(rsa_iqmp); |
BN_clear_free(rsa_iqmp); |
|
alg = "rsa-sha2-256"; |
break; |
break; |
} |
} |
rlen = sshbuf_len(b); |
rlen = sshbuf_len(b); |
|
|
error_f("remaining bytes in key blob %d", rlen); |
error_f("remaining bytes in key blob %d", rlen); |
|
|
/* try the key */ |
/* try the key */ |
if (sshkey_sign(key, &sig, &slen, data, sizeof(data), |
if ((r = sshkey_sign(key, &sig, &slen, data, sizeof(data), |
NULL, NULL, NULL, 0) != 0 || |
alg, NULL, NULL, 0)) != 0) |
sshkey_verify(key, sig, slen, data, sizeof(data), |
error_fr(r, "signing with converted key failed"); |
NULL, 0, NULL) != 0) { |
else if ((r = sshkey_verify(key, sig, slen, data, sizeof(data), |
|
alg, 0, NULL)) != 0) |
|
error_fr(r, "verification with converted key failed"); |
|
if (r != 0) { |
sshkey_free(key); |
sshkey_free(key); |
free(sig); |
free(sig); |
return NULL; |
return NULL; |
|
|
* accept a public key prefixed with a hostname or options. |
* accept a public key prefixed with a hostname or options. |
* Try a bare key first, otherwise skip the leading stuff. |
* Try a bare key first, otherwise skip the leading stuff. |
*/ |
*/ |
|
comment = NULL; |
if ((public = try_read_key(&cp)) == NULL) { |
if ((public = try_read_key(&cp)) == NULL) { |
i = strtol(cp, &ep, 10); |
i = strtol(cp, &ep, 10); |
if (i == 0 || ep == NULL || |
if (i == 0 || ep == NULL || |
|
|
} key_types[] = { |
} key_types[] = { |
#ifdef WITH_OPENSSL |
#ifdef WITH_OPENSSL |
{ "rsa", "RSA" ,_PATH_HOST_RSA_KEY_FILE }, |
{ "rsa", "RSA" ,_PATH_HOST_RSA_KEY_FILE }, |
{ "dsa", "DSA", _PATH_HOST_DSA_KEY_FILE }, |
|
{ "ecdsa", "ECDSA",_PATH_HOST_ECDSA_KEY_FILE }, |
{ "ecdsa", "ECDSA",_PATH_HOST_ECDSA_KEY_FILE }, |
#endif /* WITH_OPENSSL */ |
#endif /* WITH_OPENSSL */ |
{ "ed25519", "ED25519",_PATH_HOST_ED25519_KEY_FILE }, |
{ "ed25519", "ED25519",_PATH_HOST_ED25519_KEY_FILE }, |
|
|
case HKF_STATUS_OK: |
case HKF_STATUS_OK: |
case HKF_STATUS_MATCHED: |
case HKF_STATUS_MATCHED: |
/* |
/* |
* Don't hash hosts already already hashed, with wildcard |
* Don't hash hosts already hashed, with wildcard |
* characters or a CA/revocation marker. |
* characters or a CA/revocation marker. |
*/ |
*/ |
if (was_hashed || has_wild || l->marker != MRK_NONE) { |
if (was_hashed || has_wild || l->marker != MRK_NONE) { |
|
|
unlink(tmp); |
unlink(tmp); |
fatal("fdopen: %s", strerror(oerrno)); |
fatal("fdopen: %s", strerror(oerrno)); |
} |
} |
fchmod(fd, sb.st_mode & 0644); |
(void)fchmod(fd, sb.st_mode & 0644); |
inplace = 1; |
inplace = 1; |
} |
} |
/* XXX support identity_file == "-" for stdin */ |
/* XXX support identity_file == "-" for stdin */ |
|
|
*/ |
*/ |
static int |
static int |
do_print_resource_record(struct passwd *pw, char *fname, char *hname, |
do_print_resource_record(struct passwd *pw, char *fname, char *hname, |
int print_generic) |
int print_generic, char * const *opts, size_t nopts) |
{ |
{ |
struct sshkey *public; |
struct sshkey *public; |
char *comment = NULL; |
char *comment = NULL; |
struct stat st; |
struct stat st; |
int r; |
int r, hash = -1; |
|
size_t i; |
|
|
|
for (i = 0; i < nopts; i++) { |
|
if (strncasecmp(opts[i], "hashalg=", 8) == 0) { |
|
if ((hash = ssh_digest_alg_by_name(opts[i] + 8)) == -1) |
|
fatal("Unsupported hash algorithm"); |
|
} else { |
|
error("Invalid option \"%s\"", opts[i]); |
|
return SSH_ERR_INVALID_ARGUMENT; |
|
} |
|
} |
if (fname == NULL) |
if (fname == NULL) |
fatal_f("no filename"); |
fatal_f("no filename"); |
if (stat(fname, &st) == -1) { |
if (stat(fname, &st) == -1) { |
|
|
} |
} |
if ((r = sshkey_load_public(fname, &public, &comment)) != 0) |
if ((r = sshkey_load_public(fname, &public, &comment)) != 0) |
fatal_r(r, "Failed to read v2 public key from \"%s\"", fname); |
fatal_r(r, "Failed to read v2 public key from \"%s\"", fname); |
export_dns_rr(hname, public, stdout, print_generic); |
export_dns_rr(hname, public, stdout, print_generic, hash); |
sshkey_free(public); |
sshkey_free(public); |
free(comment); |
free(comment); |
return 1; |
return 1; |
|
|
cert_ext_add("force-command", certflags_command, 1); |
cert_ext_add("force-command", certflags_command, 1); |
if (certflags_src_addr != NULL) |
if (certflags_src_addr != NULL) |
cert_ext_add("source-address", certflags_src_addr, 1); |
cert_ext_add("source-address", certflags_src_addr, 1); |
|
if ((certflags_flags & CERTOPT_REQUIRE_VERIFY) != 0) |
|
cert_ext_add("verify-required", NULL, 1); |
/* extensions */ |
/* extensions */ |
if ((certflags_flags & CERTOPT_X_FWD) != 0) |
if ((certflags_flags & CERTOPT_X_FWD) != 0) |
cert_ext_add("permit-X11-forwarding", NULL, 0); |
cert_ext_add("permit-X11-forwarding", NULL, 0); |
|
|
} |
} |
|
|
static void |
static void |
|
parse_hex_u64(const char *s, uint64_t *up) |
|
{ |
|
char *ep; |
|
unsigned long long ull; |
|
|
|
errno = 0; |
|
ull = strtoull(s, &ep, 16); |
|
if (*s == '\0' || *ep != '\0') |
|
fatal("Invalid certificate time: not a number"); |
|
if (errno == ERANGE && ull == ULONG_MAX) |
|
fatal_fr(SSH_ERR_SYSTEM_ERROR, "Invalid certificate time"); |
|
*up = (uint64_t)ull; |
|
} |
|
|
|
static void |
parse_cert_times(char *timespec) |
parse_cert_times(char *timespec) |
{ |
{ |
char *from, *to; |
char *from, *to; |
|
|
|
|
/* |
/* |
* from:to, where |
* from:to, where |
* from := [+-]timespec | YYYYMMDD | YYYYMMDDHHMMSS | "always" |
* from := [+-]timespec | YYYYMMDD | YYYYMMDDHHMMSS | 0x... | "always" |
* to := [+-]timespec | YYYYMMDD | YYYYMMDDHHMMSS | "forever" |
* to := [+-]timespec | YYYYMMDD | YYYYMMDDHHMMSS | 0x... | "forever" |
*/ |
*/ |
from = xstrdup(timespec); |
from = xstrdup(timespec); |
to = strchr(from, ':'); |
to = strchr(from, ':'); |
|
|
cert_valid_from = parse_relative_time(from, now); |
cert_valid_from = parse_relative_time(from, now); |
else if (strcmp(from, "always") == 0) |
else if (strcmp(from, "always") == 0) |
cert_valid_from = 0; |
cert_valid_from = 0; |
|
else if (strncmp(from, "0x", 2) == 0) |
|
parse_hex_u64(from, &cert_valid_from); |
else if (parse_absolute_time(from, &cert_valid_from) != 0) |
else if (parse_absolute_time(from, &cert_valid_from) != 0) |
fatal("Invalid from time \"%s\"", from); |
fatal("Invalid from time \"%s\"", from); |
|
|
|
|
cert_valid_to = parse_relative_time(to, now); |
cert_valid_to = parse_relative_time(to, now); |
else if (strcmp(to, "forever") == 0) |
else if (strcmp(to, "forever") == 0) |
cert_valid_to = ~(u_int64_t)0; |
cert_valid_to = ~(u_int64_t)0; |
|
else if (strncmp(to, "0x", 2) == 0) |
|
parse_hex_u64(to, &cert_valid_to); |
else if (parse_absolute_time(to, &cert_valid_to) != 0) |
else if (parse_absolute_time(to, &cert_valid_to) != 0) |
fatal("Invalid to time \"%s\"", to); |
fatal("Invalid to time \"%s\"", to); |
|
|
|
|
certflags_flags &= ~CERTOPT_NO_REQUIRE_USER_PRESENCE; |
certflags_flags &= ~CERTOPT_NO_REQUIRE_USER_PRESENCE; |
else if (strcasecmp(opt, "no-touch-required") == 0) |
else if (strcasecmp(opt, "no-touch-required") == 0) |
certflags_flags |= CERTOPT_NO_REQUIRE_USER_PRESENCE; |
certflags_flags |= CERTOPT_NO_REQUIRE_USER_PRESENCE; |
|
else if (strcasecmp(opt, "no-verify-required") == 0) |
|
certflags_flags &= ~CERTOPT_REQUIRE_VERIFY; |
|
else if (strcasecmp(opt, "verify-required") == 0) |
|
certflags_flags |= CERTOPT_REQUIRE_VERIFY; |
else if (strncasecmp(opt, "force-command=", 14) == 0) { |
else if (strncasecmp(opt, "force-command=", 14) == 0) { |
val = opt + 14; |
val = opt + 14; |
if (*val == '\0') |
if (*val == '\0') |
|
|
fatal_fr(r, "parse critical"); |
fatal_fr(r, "parse critical"); |
printf(" %s\n", arg); |
printf(" %s\n", arg); |
free(arg); |
free(arg); |
|
} else if (in_critical && |
|
strcmp(name, "verify-required") == 0) { |
|
printf("\n"); |
} else if (sshbuf_len(option) > 0) { |
} else if (sshbuf_len(option) > 0) { |
hex = sshbuf_dtob16(option); |
hex = sshbuf_dtob16(option); |
printf(" UNKNOWN OPTION: %s (len %zu)\n", |
printf(" UNKNOWN OPTION: %s (len %zu)\n", |
|
|
* OpenSSH base64 hashes omit trailing '=' |
* OpenSSH base64 hashes omit trailing '=' |
* characters; put them back for decode. |
* characters; put them back for decode. |
*/ |
*/ |
tlen = strlen(cp); |
if ((tlen = strlen(cp)) >= SIZE_MAX - 5) |
|
fatal_f("hash too long: %zu bytes", tlen); |
tmp = xmalloc(tlen + 4 + 1); |
tmp = xmalloc(tlen + 4 + 1); |
strlcpy(tmp, cp, tlen + 1); |
strlcpy(tmp, cp, tlen + 1); |
while ((tlen % 4) != 0) { |
while ((tlen % 4) != 0) { |
|
|
if (!quiet) |
if (!quiet) |
printf("Revoking from %s\n", path); |
printf("Revoking from %s\n", path); |
while (getline(&line, &linesize, krl_spec) != -1) { |
while (getline(&line, &linesize, krl_spec) != -1) { |
|
if (linesize >= INT_MAX) { |
|
fatal_f("%s contains unparsable line, len=%zu", |
|
path, linesize); |
|
} |
lnum++; |
lnum++; |
was_explicit_key = was_sha1 = was_sha256 = was_hash = 0; |
was_explicit_key = was_sha1 = was_sha256 = was_hash = 0; |
cp = line + strspn(line, " \t"); |
cp = line + strspn(line, " \t"); |
|
|
{ |
{ |
size_t i, slen, plen = strlen(keypath); |
size_t i, slen, plen = strlen(keypath); |
char *privpath = xstrdup(keypath); |
char *privpath = xstrdup(keypath); |
const char *suffixes[] = { "-cert.pub", ".pub", NULL }; |
static const char * const suffixes[] = { "-cert.pub", ".pub", NULL }; |
struct sshkey *ret = NULL, *privkey = NULL; |
struct sshkey *ret = NULL, *privkey = NULL; |
int r; |
int r, waspub = 0; |
|
struct stat st; |
|
|
/* |
/* |
* If passed a public key filename, then try to locate the corresponding |
* If passed a public key filename, then try to locate the corresponding |
|
|
privpath[plen - slen] = '\0'; |
privpath[plen - slen] = '\0'; |
debug_f("%s looks like a public key, using private key " |
debug_f("%s looks like a public key, using private key " |
"path %s instead", keypath, privpath); |
"path %s instead", keypath, privpath); |
|
waspub = 1; |
} |
} |
if ((privkey = load_identity(privpath, NULL)) == NULL) { |
if (waspub && stat(privpath, &st) != 0 && errno == ENOENT) |
error("Couldn't load identity %s", keypath); |
fatal("No private key found for public key \"%s\"", keypath); |
goto done; |
if ((r = sshkey_load_private(privpath, "", &privkey, NULL)) != 0 && |
} |
(r != SSH_ERR_KEY_WRONG_PASSPHRASE)) { |
|
debug_fr(r, "load private key \"%s\"", privpath); |
|
fatal("No private key found for \"%s\"", privpath); |
|
} else if (privkey == NULL) |
|
privkey = load_identity(privpath, NULL); |
|
|
if (!sshkey_equal_public(pubkey, privkey)) { |
if (!sshkey_equal_public(pubkey, privkey)) { |
error("Public key %s doesn't match private %s", |
error("Public key %s doesn't match private %s", |
keypath, privpath); |
keypath, privpath); |
|
|
|
|
static int |
static int |
sign_one(struct sshkey *signkey, const char *filename, int fd, |
sign_one(struct sshkey *signkey, const char *filename, int fd, |
const char *sig_namespace, sshsig_signer *signer, void *signer_ctx) |
const char *sig_namespace, const char *hashalg, sshsig_signer *signer, |
|
void *signer_ctx) |
{ |
{ |
struct sshbuf *sigbuf = NULL, *abuf = NULL; |
struct sshbuf *sigbuf = NULL, *abuf = NULL; |
int r = SSH_ERR_INTERNAL_ERROR, wfd = -1, oerrno; |
int r = SSH_ERR_INTERNAL_ERROR, wfd = -1, oerrno; |
|
|
free(fp); |
free(fp); |
} |
} |
} |
} |
if ((r = sshsig_sign_fd(signkey, NULL, sk_provider, pin, |
if ((r = sshsig_sign_fd(signkey, hashalg, sk_provider, pin, |
fd, sig_namespace, &sigbuf, signer, signer_ctx)) != 0) { |
fd, sig_namespace, &sigbuf, signer, signer_ctx)) != 0) { |
error_r(r, "Signing %s failed", filename); |
error_r(r, "Signing %s failed", filename); |
goto out; |
goto out; |
|
|
} |
} |
|
|
static int |
static int |
sig_sign(const char *keypath, const char *sig_namespace, int argc, char **argv) |
sig_process_opts(char * const *opts, size_t nopts, char **hashalgp, |
|
uint64_t *verify_timep, int *print_pubkey) |
{ |
{ |
|
size_t i; |
|
time_t now; |
|
|
|
if (verify_timep != NULL) |
|
*verify_timep = 0; |
|
if (print_pubkey != NULL) |
|
*print_pubkey = 0; |
|
if (hashalgp != NULL) |
|
*hashalgp = NULL; |
|
for (i = 0; i < nopts; i++) { |
|
if (hashalgp != NULL && |
|
strncasecmp(opts[i], "hashalg=", 8) == 0) { |
|
*hashalgp = xstrdup(opts[i] + 8); |
|
} else if (verify_timep && |
|
strncasecmp(opts[i], "verify-time=", 12) == 0) { |
|
if (parse_absolute_time(opts[i] + 12, |
|
verify_timep) != 0 || *verify_timep == 0) { |
|
error("Invalid \"verify-time\" option"); |
|
return SSH_ERR_INVALID_ARGUMENT; |
|
} |
|
} else if (print_pubkey && |
|
strcasecmp(opts[i], "print-pubkey") == 0) { |
|
*print_pubkey = 1; |
|
} else { |
|
error("Invalid option \"%s\"", opts[i]); |
|
return SSH_ERR_INVALID_ARGUMENT; |
|
} |
|
} |
|
if (verify_timep && *verify_timep == 0) { |
|
if ((now = time(NULL)) < 0) { |
|
error("Time is before epoch"); |
|
return SSH_ERR_INVALID_ARGUMENT; |
|
} |
|
*verify_timep = (uint64_t)now; |
|
} |
|
return 0; |
|
} |
|
|
|
|
|
static int |
|
sig_sign(const char *keypath, const char *sig_namespace, int require_agent, |
|
int argc, char **argv, char * const *opts, size_t nopts) |
|
{ |
int i, fd = -1, r, ret = -1; |
int i, fd = -1, r, ret = -1; |
int agent_fd = -1; |
int agent_fd = -1; |
struct sshkey *pubkey = NULL, *privkey = NULL, *signkey = NULL; |
struct sshkey *pubkey = NULL, *privkey = NULL, *signkey = NULL; |
sshsig_signer *signer = NULL; |
sshsig_signer *signer = NULL; |
|
char *hashalg = NULL; |
|
|
/* Check file arguments. */ |
/* Check file arguments. */ |
for (i = 0; i < argc; i++) { |
for (i = 0; i < argc; i++) { |
|
|
fatal("Cannot sign mix of paths and standard input"); |
fatal("Cannot sign mix of paths and standard input"); |
} |
} |
|
|
|
if (sig_process_opts(opts, nopts, &hashalg, NULL, NULL) != 0) |
|
goto done; /* error already logged */ |
|
|
if ((r = sshkey_load_public(keypath, &pubkey, NULL)) != 0) { |
if ((r = sshkey_load_public(keypath, &pubkey, NULL)) != 0) { |
error_r(r, "Couldn't load public key %s", keypath); |
error_r(r, "Couldn't load public key %s", keypath); |
goto done; |
goto done; |
} |
} |
|
|
if ((r = ssh_get_authentication_socket(&agent_fd)) != 0) |
if ((r = ssh_get_authentication_socket(&agent_fd)) != 0) { |
|
if (require_agent) |
|
fatal("Couldn't get agent socket"); |
debug_r(r, "Couldn't get agent socket"); |
debug_r(r, "Couldn't get agent socket"); |
else { |
} else { |
if ((r = ssh_agent_has_key(agent_fd, pubkey)) == 0) |
if ((r = ssh_agent_has_key(agent_fd, pubkey)) == 0) |
signer = agent_signer; |
signer = agent_signer; |
else |
else { |
|
if (require_agent) |
|
fatal("Couldn't find key in agent"); |
debug_r(r, "Couldn't find key in agent"); |
debug_r(r, "Couldn't find key in agent"); |
|
} |
} |
} |
|
|
if (signer == NULL) { |
if (signer == NULL) { |
|
|
|
|
if (argc == 0) { |
if (argc == 0) { |
if ((r = sign_one(signkey, "(stdin)", STDIN_FILENO, |
if ((r = sign_one(signkey, "(stdin)", STDIN_FILENO, |
sig_namespace, signer, &agent_fd)) != 0) |
sig_namespace, hashalg, signer, &agent_fd)) != 0) |
goto done; |
goto done; |
} else { |
} else { |
for (i = 0; i < argc; i++) { |
for (i = 0; i < argc; i++) { |
|
|
goto done; |
goto done; |
} |
} |
if ((r = sign_one(signkey, argv[i], fd, sig_namespace, |
if ((r = sign_one(signkey, argv[i], fd, sig_namespace, |
signer, &agent_fd)) != 0) |
hashalg, signer, &agent_fd)) != 0) |
goto done; |
goto done; |
if (fd != STDIN_FILENO) |
if (fd != STDIN_FILENO) |
close(fd); |
close(fd); |
|
|
close(fd); |
close(fd); |
sshkey_free(pubkey); |
sshkey_free(pubkey); |
sshkey_free(privkey); |
sshkey_free(privkey); |
|
free(hashalg); |
return ret; |
return ret; |
} |
} |
|
|
static int |
static int |
sig_process_opts(char * const *opts, size_t nopts, uint64_t *verify_timep, |
|
int *print_pubkey) |
|
{ |
|
size_t i; |
|
time_t now; |
|
|
|
if (verify_timep != NULL) |
|
*verify_timep = 0; |
|
if (print_pubkey != NULL) |
|
*print_pubkey = 0; |
|
for (i = 0; i < nopts; i++) { |
|
if (verify_timep && |
|
strncasecmp(opts[i], "verify-time=", 12) == 0) { |
|
if (parse_absolute_time(opts[i] + 12, |
|
verify_timep) != 0 || *verify_timep == 0) { |
|
error("Invalid \"verify-time\" option"); |
|
return SSH_ERR_INVALID_ARGUMENT; |
|
} |
|
} else if (print_pubkey && |
|
strcasecmp(opts[i], "print-pubkey") == 0) { |
|
*print_pubkey = 1; |
|
} else { |
|
error("Invalid option \"%s\"", opts[i]); |
|
return SSH_ERR_INVALID_ARGUMENT; |
|
} |
|
} |
|
if (verify_timep && *verify_timep == 0) { |
|
if ((now = time(NULL)) < 0) { |
|
error("Time is before epoch"); |
|
return SSH_ERR_INVALID_ARGUMENT; |
|
} |
|
*verify_timep = (uint64_t)now; |
|
} |
|
return 0; |
|
} |
|
|
|
static int |
|
sig_verify(const char *signature, const char *sig_namespace, |
sig_verify(const char *signature, const char *sig_namespace, |
const char *principal, const char *allowed_keys, const char *revoked_keys, |
const char *principal, const char *allowed_keys, const char *revoked_keys, |
char * const *opts, size_t nopts) |
char * const *opts, size_t nopts) |
|
|
struct sshkey_sig_details *sig_details = NULL; |
struct sshkey_sig_details *sig_details = NULL; |
uint64_t verify_time = 0; |
uint64_t verify_time = 0; |
|
|
if (sig_process_opts(opts, nopts, &verify_time, &print_pubkey) != 0) |
if (sig_process_opts(opts, nopts, NULL, &verify_time, |
|
&print_pubkey) != 0) |
goto done; /* error already logged */ |
goto done; /* error already logged */ |
|
|
memset(&sig_details, 0, sizeof(sig_details)); |
memset(&sig_details, 0, sizeof(sig_details)); |
|
|
char *principals = NULL, *cp, *tmp; |
char *principals = NULL, *cp, *tmp; |
uint64_t verify_time = 0; |
uint64_t verify_time = 0; |
|
|
if (sig_process_opts(opts, nopts, &verify_time, NULL) != 0) |
if (sig_process_opts(opts, nopts, NULL, &verify_time, NULL) != 0) |
goto done; /* error already logged */ |
goto done; /* error already logged */ |
|
|
if ((r = sshbuf_load_file(signature, &abuf)) != 0) { |
if ((r = sshbuf_load_file(signature, &abuf)) != 0) { |
|
|
return ret; |
return ret; |
} |
} |
|
|
|
static int |
|
sig_match_principals(const char *allowed_keys, char *principal, |
|
char * const *opts, size_t nopts) |
|
{ |
|
int r; |
|
char **principals = NULL; |
|
size_t i, nprincipals = 0; |
|
|
|
if ((r = sig_process_opts(opts, nopts, NULL, NULL, NULL)) != 0) |
|
return r; /* error already logged */ |
|
|
|
if ((r = sshsig_match_principals(allowed_keys, principal, |
|
&principals, &nprincipals)) != 0) { |
|
debug_f("match: %s", ssh_err(r)); |
|
fprintf(stderr, "No principal matched.\n"); |
|
return r; |
|
} |
|
for (i = 0; i < nprincipals; i++) { |
|
printf("%s\n", principals[i]); |
|
free(principals[i]); |
|
} |
|
free(principals); |
|
|
|
return 0; |
|
} |
|
|
static void |
static void |
do_moduli_gen(const char *out_file, char **opts, size_t nopts) |
do_moduli_gen(const char *out_file, char **opts, size_t nopts) |
{ |
{ |
|
|
} else if (strncmp(opts[i], "start-line=", 11) == 0) { |
} else if (strncmp(opts[i], "start-line=", 11) == 0) { |
start_lineno = strtoul(opts[i]+11, NULL, 10); |
start_lineno = strtoul(opts[i]+11, NULL, 10); |
} else if (strncmp(opts[i], "checkpoint=", 11) == 0) { |
} else if (strncmp(opts[i], "checkpoint=", 11) == 0) { |
|
free(checkpoint); |
checkpoint = xstrdup(opts[i]+11); |
checkpoint = xstrdup(opts[i]+11); |
} else if (strncmp(opts[i], "generator=", 10) == 0) { |
} else if (strncmp(opts[i], "generator=", 10) == 0) { |
generator_wanted = (u_int32_t)strtonum( |
generator_wanted = (u_int32_t)strtonum( |
|
|
generator_wanted, checkpoint, |
generator_wanted, checkpoint, |
start_lineno, lines_to_process) != 0) |
start_lineno, lines_to_process) != 0) |
fatal("modulus screening failed"); |
fatal("modulus screening failed"); |
|
if (in != stdin) |
|
(void)fclose(in); |
|
free(checkpoint); |
#else /* WITH_OPENSSL */ |
#else /* WITH_OPENSSL */ |
fatal("Moduli screening is not supported"); |
fatal("Moduli screening is not supported"); |
#endif /* WITH_OPENSSL */ |
#endif /* WITH_OPENSSL */ |
} |
} |
|
|
|
/* Read and confirm a passphrase */ |
static char * |
static char * |
private_key_passphrase(void) |
read_check_passphrase(const char *prompt1, const char *prompt2, |
|
const char *retry_prompt) |
{ |
{ |
char *passphrase1, *passphrase2; |
char *passphrase1, *passphrase2; |
|
|
/* Ask for a passphrase (twice). */ |
for (;;) { |
if (identity_passphrase) |
passphrase1 = read_passphrase(prompt1, RP_ALLOW_STDIN); |
passphrase1 = xstrdup(identity_passphrase); |
passphrase2 = read_passphrase(prompt2, RP_ALLOW_STDIN); |
else if (identity_new_passphrase) |
if (strcmp(passphrase1, passphrase2) == 0) { |
passphrase1 = xstrdup(identity_new_passphrase); |
|
else { |
|
passphrase_again: |
|
passphrase1 = |
|
read_passphrase("Enter passphrase (empty for no " |
|
"passphrase): ", RP_ALLOW_STDIN); |
|
passphrase2 = read_passphrase("Enter same passphrase again: ", |
|
RP_ALLOW_STDIN); |
|
if (strcmp(passphrase1, passphrase2) != 0) { |
|
/* |
|
* The passphrases do not match. Clear them and |
|
* retry. |
|
*/ |
|
freezero(passphrase1, strlen(passphrase1)); |
|
freezero(passphrase2, strlen(passphrase2)); |
freezero(passphrase2, strlen(passphrase2)); |
printf("Passphrases do not match. Try again.\n"); |
return passphrase1; |
goto passphrase_again; |
|
} |
} |
/* Clear the other copy of the passphrase. */ |
/* The passphrases do not match. Clear them and retry. */ |
|
freezero(passphrase1, strlen(passphrase1)); |
freezero(passphrase2, strlen(passphrase2)); |
freezero(passphrase2, strlen(passphrase2)); |
|
fputs(retry_prompt, stdout); |
|
fputc('\n', stdout); |
|
fflush(stdout); |
} |
} |
return passphrase1; |
/* NOTREACHED */ |
|
return NULL; |
} |
} |
|
|
static char * |
static char * |
|
private_key_passphrase(void) |
|
{ |
|
if (identity_passphrase) |
|
return xstrdup(identity_passphrase); |
|
if (identity_new_passphrase) |
|
return xstrdup(identity_new_passphrase); |
|
|
|
return read_check_passphrase( |
|
"Enter passphrase (empty for no passphrase): ", |
|
"Enter same passphrase again: ", |
|
"Passphrases do not match. Try again."); |
|
} |
|
|
|
static char * |
sk_suffix(const char *application, const uint8_t *user, size_t userlen) |
sk_suffix(const char *application, const uint8_t *user, size_t userlen) |
{ |
{ |
char *ret, *cp; |
char *ret, *cp; |
|
|
"%s\n", path); |
"%s\n", path); |
} |
} |
|
|
|
static int |
|
confirm_sk_overwrite(const char *application, const char *user) |
|
{ |
|
char yesno[3]; |
|
|
|
printf("A resident key scoped to '%s' with user id '%s' already " |
|
"exists.\n", application == NULL ? "ssh:" : application, |
|
user == NULL ? "null" : user); |
|
printf("Overwrite key in token (y/n)? "); |
|
fflush(stdout); |
|
if (fgets(yesno, sizeof(yesno), stdin) == NULL) |
|
return 0; |
|
if (yesno[0] != 'y' && yesno[0] != 'Y') |
|
return 0; |
|
return 1; |
|
} |
|
|
static void |
static void |
usage(void) |
usage(void) |
{ |
{ |
|
|
" file ...\n" |
" file ...\n" |
" ssh-keygen -Q [-l] -f krl_file [file ...]\n" |
" ssh-keygen -Q [-l] -f krl_file [file ...]\n" |
" ssh-keygen -Y find-principals -s signature_file -f allowed_signers_file\n" |
" ssh-keygen -Y find-principals -s signature_file -f allowed_signers_file\n" |
|
" ssh-keygen -Y match-principals -I signer_identity -f allowed_signers_file\n" |
" ssh-keygen -Y check-novalidate -n namespace -s signature_file\n" |
" ssh-keygen -Y check-novalidate -n namespace -s signature_file\n" |
" ssh-keygen -Y sign -f key_file -n namespace file ...\n" |
" ssh-keygen -Y sign -f key_file -n namespace file [-O option] ...\n" |
" ssh-keygen -Y verify -f allowed_signers_file -I signer_identity\n" |
" ssh-keygen -Y verify -f allowed_signers_file -I signer_identity\n" |
" -n namespace -s signature_file [-r revocation_file]\n"); |
" -n namespace -s signature_file [-r krl_file] [-O option]\n"); |
exit(1); |
exit(1); |
} |
} |
|
|
|
|
int |
int |
main(int argc, char **argv) |
main(int argc, char **argv) |
{ |
{ |
char comment[1024], *passphrase; |
char comment[1024], *passphrase = NULL; |
char *rr_hostname = NULL, *ep, *fp, *ra; |
char *rr_hostname = NULL, *ep, *fp, *ra; |
struct sshkey *private, *public; |
struct sshkey *private, *public; |
struct passwd *pw; |
struct passwd *pw; |
|
|
else |
else |
fatal("Unsupported moduli option %s", optarg); |
fatal("Unsupported moduli option %s", optarg); |
break; |
break; |
case '?': |
|
default: |
default: |
usage(); |
usage(); |
} |
} |
|
|
} |
} |
return sig_find_principals(ca_key_path, identity_file, |
return sig_find_principals(ca_key_path, identity_file, |
opts, nopts); |
opts, nopts); |
|
} else if (strncmp(sign_op, "match-principals", 16) == 0) { |
|
if (!have_identity) { |
|
error("Too few arguments for match-principals:" |
|
"missing allowed keys file"); |
|
exit(1); |
|
} |
|
if (cert_key_id == NULL) { |
|
error("Too few arguments for match-principals: " |
|
"missing principal ID"); |
|
exit(1); |
|
} |
|
return sig_match_principals(identity_file, cert_key_id, |
|
opts, nopts); |
} else if (strncmp(sign_op, "sign", 4) == 0) { |
} else if (strncmp(sign_op, "sign", 4) == 0) { |
|
/* NB. cert_principals is actually namespace, via -n */ |
if (cert_principals == NULL || |
if (cert_principals == NULL || |
*cert_principals == '\0') { |
*cert_principals == '\0') { |
error("Too few arguments for sign: " |
error("Too few arguments for sign: " |
|
|
exit(1); |
exit(1); |
} |
} |
return sig_sign(identity_file, cert_principals, |
return sig_sign(identity_file, cert_principals, |
argc, argv); |
prefer_agent, argc, argv, opts, nopts); |
} else if (strncmp(sign_op, "check-novalidate", 16) == 0) { |
} else if (strncmp(sign_op, "check-novalidate", 16) == 0) { |
|
/* NB. cert_principals is actually namespace, via -n */ |
|
if (cert_principals == NULL || |
|
*cert_principals == '\0') { |
|
error("Too few arguments for check-novalidate: " |
|
"missing namespace"); |
|
exit(1); |
|
} |
if (ca_key_path == NULL) { |
if (ca_key_path == NULL) { |
error("Too few arguments for check-novalidate: " |
error("Too few arguments for check-novalidate: " |
"missing signature file"); |
"missing signature file"); |
|
|
return sig_verify(ca_key_path, cert_principals, |
return sig_verify(ca_key_path, cert_principals, |
NULL, NULL, NULL, opts, nopts); |
NULL, NULL, NULL, opts, nopts); |
} else if (strncmp(sign_op, "verify", 6) == 0) { |
} else if (strncmp(sign_op, "verify", 6) == 0) { |
|
/* NB. cert_principals is actually namespace, via -n */ |
if (cert_principals == NULL || |
if (cert_principals == NULL || |
*cert_principals == '\0') { |
*cert_principals == '\0') { |
error("Too few arguments for verify: " |
error("Too few arguments for verify: " |
|
|
} |
} |
if (cert_key_id == NULL) { |
if (cert_key_id == NULL) { |
error("Too few arguments for verify: " |
error("Too few arguments for verify: " |
"missing principal ID"); |
"missing principal identity"); |
exit(1); |
exit(1); |
} |
} |
return sig_verify(ca_key_path, cert_principals, |
return sig_verify(ca_key_path, cert_principals, |
|
|
|
|
if (have_identity) { |
if (have_identity) { |
n = do_print_resource_record(pw, identity_file, |
n = do_print_resource_record(pw, identity_file, |
rr_hostname, print_generic); |
rr_hostname, print_generic, opts, nopts); |
if (n == 0) |
if (n == 0) |
fatal("%s: %s", identity_file, strerror(errno)); |
fatal("%s: %s", identity_file, strerror(errno)); |
exit(0); |
exit(0); |
|
|
|
|
n += do_print_resource_record(pw, |
n += do_print_resource_record(pw, |
_PATH_HOST_RSA_KEY_FILE, rr_hostname, |
_PATH_HOST_RSA_KEY_FILE, rr_hostname, |
print_generic); |
print_generic, opts, nopts); |
n += do_print_resource_record(pw, |
n += do_print_resource_record(pw, |
_PATH_HOST_DSA_KEY_FILE, rr_hostname, |
_PATH_HOST_DSA_KEY_FILE, rr_hostname, |
print_generic); |
print_generic, opts, nopts); |
n += do_print_resource_record(pw, |
n += do_print_resource_record(pw, |
_PATH_HOST_ECDSA_KEY_FILE, rr_hostname, |
_PATH_HOST_ECDSA_KEY_FILE, rr_hostname, |
print_generic); |
print_generic, opts, nopts); |
n += do_print_resource_record(pw, |
n += do_print_resource_record(pw, |
_PATH_HOST_ED25519_KEY_FILE, rr_hostname, |
_PATH_HOST_ED25519_KEY_FILE, rr_hostname, |
print_generic); |
print_generic, opts, nopts); |
n += do_print_resource_record(pw, |
n += do_print_resource_record(pw, |
_PATH_HOST_XMSS_KEY_FILE, rr_hostname, |
_PATH_HOST_XMSS_KEY_FILE, rr_hostname, |
print_generic); |
print_generic, opts, nopts); |
if (n == 0) |
if (n == 0) |
fatal("no keys found."); |
fatal("no keys found."); |
exit(0); |
exit(0); |
|
|
"FIDO authenticator enrollment", opts[i]); |
"FIDO authenticator enrollment", opts[i]); |
} |
} |
} |
} |
if (!quiet) { |
|
printf("You may need to touch your authenticator " |
|
"to authorize key generation.\n"); |
|
} |
|
if ((attest = sshbuf_new()) == NULL) |
if ((attest = sshbuf_new()) == NULL) |
fatal("sshbuf_new failed"); |
fatal("sshbuf_new failed"); |
if ((sk_flags & |
r = 0; |
(SSH_SK_USER_VERIFICATION_REQD|SSH_SK_RESIDENT_KEY))) { |
for (i = 0 ;;) { |
passphrase = read_passphrase("Enter PIN for " |
if (!quiet) { |
"authenticator: ", RP_ALLOW_STDIN); |
printf("You may need to touch your " |
} else { |
"authenticator%s to authorize key " |
passphrase = NULL; |
"generation.\n", |
} |
r == 0 ? "" : " again"); |
for (i = 0 ; ; i++) { |
} |
fflush(stdout); |
fflush(stdout); |
r = sshsk_enroll(type, sk_provider, sk_device, |
r = sshsk_enroll(type, sk_provider, sk_device, |
sk_application == NULL ? "ssh:" : sk_application, |
sk_application == NULL ? "ssh:" : sk_application, |
|
|
&private, attest); |
&private, attest); |
if (r == 0) |
if (r == 0) |
break; |
break; |
|
if (r == SSH_ERR_KEY_BAD_PERMISSIONS && |
|
(sk_flags & SSH_SK_RESIDENT_KEY) != 0 && |
|
(sk_flags & SSH_SK_FORCE_OPERATION) == 0 && |
|
confirm_sk_overwrite(sk_application, sk_user)) { |
|
sk_flags |= SSH_SK_FORCE_OPERATION; |
|
continue; |
|
} |
if (r != SSH_ERR_KEY_WRONG_PASSPHRASE) |
if (r != SSH_ERR_KEY_WRONG_PASSPHRASE) |
fatal_r(r, "Key enrollment failed"); |
fatal_r(r, "Key enrollment failed"); |
else if (passphrase != NULL) { |
else if (passphrase != NULL) { |
|
|
freezero(passphrase, strlen(passphrase)); |
freezero(passphrase, strlen(passphrase)); |
passphrase = NULL; |
passphrase = NULL; |
} |
} |
if (i >= 3) |
if (++i >= 3) |
fatal("Too many incorrect PINs"); |
fatal("Too many incorrect PINs"); |
passphrase = read_passphrase("Enter PIN for " |
passphrase = read_passphrase("Enter PIN for " |
"authenticator: ", RP_ALLOW_STDIN); |
"authenticator: ", RP_ALLOW_STDIN); |
if (!quiet) { |
|
printf("You may need to touch your " |
|
"authenticator (again) to authorize " |
|
"key generation.\n"); |
|
} |
|
} |
} |
if (passphrase != NULL) { |
if (passphrase != NULL) { |
freezero(passphrase, strlen(passphrase)); |
freezero(passphrase, strlen(passphrase)); |