blob: 678dafe87d55fb434312a735588b1627b69293b2 [file] [log] [blame]
Damien Miller5b01b0d2013-10-23 16:31:31 +11001/* $OpenBSD: ssh-keygen.c,v 1.235 2013/10/23 04:16:22 djm Exp $ */
Damien Millerd4a8b7e1999-10-27 13:42:43 +10002/*
Damien Miller95def091999-11-25 00:26:21 +11003 * Author: Tatu Ylonen <ylo@cs.hut.fi>
4 * Copyright (c) 1994 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
5 * All rights reserved
Damien Miller95def091999-11-25 00:26:21 +11006 * Identity and host key generation and maintenance.
Damien Millere4340be2000-09-16 13:29:08 +11007 *
8 * As far as I am concerned, the code I have written for this software
9 * can be used freely for any purpose. Any derived versions of this
10 * software must be clearly marked as such, and if the derived work is
11 * incompatible with the protocol description in the RFC file, it must be
12 * called by a name other than "ssh" or "Secure Shell".
Damien Miller95def091999-11-25 00:26:21 +110013 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +100014
15#include "includes.h"
Damien Millerf17883e2006-03-15 11:45:54 +110016
17#include <sys/types.h>
Damien Millere3b60b52006-07-10 21:08:03 +100018#include <sys/socket.h>
Damien Millerf17883e2006-03-15 11:45:54 +110019#include <sys/stat.h>
Damien Miller8dbffe72006-08-05 11:02:17 +100020#include <sys/param.h>
Damien Millerd4a8b7e1999-10-27 13:42:43 +100021
Damien Millereba71ba2000-04-29 23:57:08 +100022#include <openssl/evp.h>
23#include <openssl/pem.h>
Darren Tuckerbfaaf962008-02-28 19:13:52 +110024#include "openbsd-compat/openssl-compat.h"
Damien Millereba71ba2000-04-29 23:57:08 +100025
Darren Tucker39972492006-07-12 22:22:46 +100026#include <errno.h>
Damien Miller57cf6382006-07-10 21:13:46 +100027#include <fcntl.h>
Damien Millerb8fe89c2006-07-24 14:51:00 +100028#include <netdb.h>
Darren Tucker2ee50c52006-07-11 18:55:05 +100029#ifdef HAVE_PATHS_H
30# include <paths.h>
31#endif
Damien Miller9f2abc42006-07-10 20:53:08 +100032#include <pwd.h>
Damien Millerded319c2006-09-01 15:38:36 +100033#include <stdarg.h>
Damien Millera7a73ee2006-08-05 11:37:59 +100034#include <stdio.h>
Damien Millere7a1e5c2006-08-05 11:34:19 +100035#include <stdlib.h>
Damien Millere3476ed2006-07-24 14:13:33 +100036#include <string.h>
Damien Millere6b3b612006-07-24 14:01:23 +100037#include <unistd.h>
Damien Miller9f2abc42006-07-10 20:53:08 +100038
Damien Millerd4a8b7e1999-10-27 13:42:43 +100039#include "xmalloc.h"
Damien Millereba71ba2000-04-29 23:57:08 +100040#include "key.h"
Ben Lindstromd09fcf52001-03-29 00:29:54 +000041#include "rsa.h"
Damien Millereba71ba2000-04-29 23:57:08 +100042#include "authfile.h"
43#include "uuencode.h"
Damien Miller874d77b2000-10-14 16:23:11 +110044#include "buffer.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +000045#include "pathnames.h"
46#include "log.h"
Darren Tuckere608ca22004-05-13 16:15:47 +100047#include "misc.h"
Damien Miller4b42d7f2005-03-01 21:48:35 +110048#include "match.h"
49#include "hostfile.h"
Damien Miller69996102006-07-10 20:53:31 +100050#include "dns.h"
Damien Millerf3747bf2013-01-18 11:44:04 +110051#include "ssh.h"
Damien Miller0a80ca12010-02-27 07:55:05 +110052#include "ssh2.h"
Damien Miller7ea845e2010-02-12 09:21:02 +110053#include "ssh-pkcs11.h"
Damien Millerf3747bf2013-01-18 11:44:04 +110054#include "atomicio.h"
55#include "krl.h"
Ben Lindstromcd392282001-07-04 03:44:03 +000056
Damien Miller3f54a9f2005-11-05 14:52:18 +110057/* Number of bits in the RSA/DSA key. This value can be set on the command line. */
58#define DEFAULT_BITS 2048
59#define DEFAULT_BITS_DSA 1024
Damien Miller6e9f6802010-09-10 11:17:38 +100060#define DEFAULT_BITS_ECDSA 256
Damien Miller3f54a9f2005-11-05 14:52:18 +110061u_int32_t bits = 0;
Damien Millerd4a8b7e1999-10-27 13:42:43 +100062
Damien Miller5428f641999-11-25 11:54:57 +110063/*
64 * Flag indicating that we just want to change the passphrase. This can be
65 * set on the command line.
66 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +100067int change_passphrase = 0;
68
Damien Miller5428f641999-11-25 11:54:57 +110069/*
70 * Flag indicating that we just want to change the comment. This can be set
71 * on the command line.
72 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +100073int change_comment = 0;
74
75int quiet = 0;
76
Darren Tucker35c45532008-06-13 04:43:15 +100077int log_level = SYSLOG_LEVEL_INFO;
78
Damien Miller4b42d7f2005-03-01 21:48:35 +110079/* Flag indicating that we want to hash a known_hosts file */
80int hash_hosts = 0;
81/* Flag indicating that we want lookup a host in known_hosts file */
82int find_host = 0;
83/* Flag indicating that we want to delete a host from a known_hosts file */
84int delete_host = 0;
85
Damien Millerf2b70ca2010-03-05 07:39:35 +110086/* Flag indicating that we want to show the contents of a certificate */
87int show_cert = 0;
88
Damien Miller10f6f6b1999-11-17 17:29:08 +110089/* Flag indicating that we just want to see the key fingerprint */
90int print_fingerprint = 0;
Ben Lindstrom8fd372b2001-03-12 03:02:17 +000091int print_bubblebabble = 0;
Damien Miller10f6f6b1999-11-17 17:29:08 +110092
Damien Miller431f66b1999-11-21 18:31:57 +110093/* The identity file name, given on the command line or entered by the user. */
94char identity_file[1024];
95int have_identity = 0;
Damien Millerd4a8b7e1999-10-27 13:42:43 +100096
97/* This is set to the passphrase if given on the command line. */
98char *identity_passphrase = NULL;
99
100/* This is set to the new passphrase if given on the command line. */
101char *identity_new_passphrase = NULL;
102
103/* This is set to the new comment if given on the command line. */
104char *identity_comment = NULL;
105
Damien Miller0a80ca12010-02-27 07:55:05 +1100106/* Path to CA key when certifying keys. */
107char *ca_key_path = NULL;
108
Damien Miller4e270b02010-04-16 15:56:21 +1000109/* Certificate serial number */
Damien Miller55aca022012-12-03 11:25:30 +1100110unsigned long long cert_serial = 0;
Damien Miller4e270b02010-04-16 15:56:21 +1000111
Damien Miller0a80ca12010-02-27 07:55:05 +1100112/* Key type when certifying */
113u_int cert_key_type = SSH2_CERT_TYPE_USER;
114
115/* "key ID" of signed key */
116char *cert_key_id = NULL;
117
118/* Comma-separated list of principal names for certifying keys */
119char *cert_principals = NULL;
120
121/* Validity period for certificates */
122u_int64_t cert_valid_from = 0;
123u_int64_t cert_valid_to = ~0ULL;
124
Damien Miller4e270b02010-04-16 15:56:21 +1000125/* Certificate options */
Damien Millerd0e4a8e2010-05-21 14:58:32 +1000126#define CERTOPT_X_FWD (1)
127#define CERTOPT_AGENT_FWD (1<<1)
128#define CERTOPT_PORT_FWD (1<<2)
129#define CERTOPT_PTY (1<<3)
130#define CERTOPT_USER_RC (1<<4)
131#define CERTOPT_DEFAULT (CERTOPT_X_FWD|CERTOPT_AGENT_FWD| \
132 CERTOPT_PORT_FWD|CERTOPT_PTY|CERTOPT_USER_RC)
133u_int32_t certflags_flags = CERTOPT_DEFAULT;
134char *certflags_command = NULL;
135char *certflags_src_addr = NULL;
Damien Miller0a80ca12010-02-27 07:55:05 +1100136
Damien Miller44b25042010-07-02 13:35:01 +1000137/* Conversion to/from various formats */
138int convert_to = 0;
139int convert_from = 0;
140enum {
141 FMT_RFC4716,
142 FMT_PKCS8,
143 FMT_PEM
144} convert_format = FMT_RFC4716;
Damien Millereba71ba2000-04-29 23:57:08 +1000145int print_public = 0;
Damien Miller37876e92003-05-15 10:19:46 +1000146int print_generic = 0;
Damien Miller0bc1bd82000-11-13 22:57:25 +1100147
Damien Millera41c8b12002-01-22 23:05:08 +1100148char *key_type_name = NULL;
Damien Millereba71ba2000-04-29 23:57:08 +1000149
Damien Miller757f34e2010-08-05 13:05:31 +1000150/* Load key from this PKCS#11 provider */
151char *pkcs11provider = NULL;
Damien Miller44b25042010-07-02 13:35:01 +1000152
Damien Miller431f66b1999-11-21 18:31:57 +1100153/* argv0 */
154extern char *__progname;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000155
Damien Millereba71ba2000-04-29 23:57:08 +1000156char hostname[MAXHOSTNAMELEN];
157
Darren Tucker770fc012004-05-13 16:24:32 +1000158/* moduli.c */
Damien Millerb089fb52005-05-26 12:16:18 +1000159int gen_candidates(FILE *, u_int32_t, u_int32_t, BIGNUM *);
Damien Millerdfceafe2012-07-06 13:44:19 +1000160int prime_test(FILE *, FILE *, u_int32_t, u_int32_t, char *, unsigned long,
161 unsigned long);
Darren Tucker770fc012004-05-13 16:24:32 +1000162
Ben Lindstrombba81212001-06-25 05:01:22 +0000163static void
Damien Miller884b63a2011-05-05 14:14:52 +1000164type_bits_valid(int type, u_int32_t *bitsp)
Damien Miller58f1baf2011-05-05 14:06:15 +1000165{
166 u_int maxbits;
167
168 if (type == KEY_UNSPEC) {
169 fprintf(stderr, "unknown key type %s\n", key_type_name);
170 exit(1);
171 }
Damien Miller884b63a2011-05-05 14:14:52 +1000172 if (*bitsp == 0) {
Damien Miller58f1baf2011-05-05 14:06:15 +1000173 if (type == KEY_DSA)
Damien Miller884b63a2011-05-05 14:14:52 +1000174 *bitsp = DEFAULT_BITS_DSA;
Damien Miller58f1baf2011-05-05 14:06:15 +1000175 else if (type == KEY_ECDSA)
Damien Miller884b63a2011-05-05 14:14:52 +1000176 *bitsp = DEFAULT_BITS_ECDSA;
Damien Miller58f1baf2011-05-05 14:06:15 +1000177 else
Damien Miller884b63a2011-05-05 14:14:52 +1000178 *bitsp = DEFAULT_BITS;
Damien Miller58f1baf2011-05-05 14:06:15 +1000179 }
180 maxbits = (type == KEY_DSA) ?
181 OPENSSL_DSA_MAX_MODULUS_BITS : OPENSSL_RSA_MAX_MODULUS_BITS;
Damien Miller884b63a2011-05-05 14:14:52 +1000182 if (*bitsp > maxbits) {
Damien Miller58f1baf2011-05-05 14:06:15 +1000183 fprintf(stderr, "key bits exceeds maximum %d\n", maxbits);
184 exit(1);
185 }
Damien Miller884b63a2011-05-05 14:14:52 +1000186 if (type == KEY_DSA && *bitsp != 1024)
Damien Miller58f1baf2011-05-05 14:06:15 +1000187 fatal("DSA keys must be 1024 bits");
Damien Miller884b63a2011-05-05 14:14:52 +1000188 else if (type != KEY_ECDSA && *bitsp < 768)
Damien Miller58f1baf2011-05-05 14:06:15 +1000189 fatal("Key must at least be 768 bits");
Damien Miller884b63a2011-05-05 14:14:52 +1000190 else if (type == KEY_ECDSA && key_ecdsa_bits_to_nid(*bitsp) == -1)
Damien Miller58f1baf2011-05-05 14:06:15 +1000191 fatal("Invalid ECDSA key length - valid lengths are "
192 "256, 384 or 521 bits");
193}
194
195static void
Damien Miller431f66b1999-11-21 18:31:57 +1100196ask_filename(struct passwd *pw, const char *prompt)
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000197{
Damien Miller95def091999-11-25 00:26:21 +1100198 char buf[1024];
Damien Millere39cacc2000-11-29 12:18:44 +1100199 char *name = NULL;
200
Damien Miller993dd552002-02-19 15:22:47 +1100201 if (key_type_name == NULL)
Ben Lindstrom226cfa02001-01-22 05:34:40 +0000202 name = _PATH_SSH_CLIENT_ID_RSA;
Damien Miller90967402006-03-26 14:07:26 +1100203 else {
Damien Miller993dd552002-02-19 15:22:47 +1100204 switch (key_type_from_name(key_type_name)) {
205 case KEY_RSA1:
206 name = _PATH_SSH_CLIENT_IDENTITY;
207 break;
Damien Miller4e270b02010-04-16 15:56:21 +1000208 case KEY_DSA_CERT:
209 case KEY_DSA_CERT_V00:
Damien Miller993dd552002-02-19 15:22:47 +1100210 case KEY_DSA:
211 name = _PATH_SSH_CLIENT_ID_DSA;
212 break;
Damien Millerdd190dd2010-11-11 14:17:02 +1100213#ifdef OPENSSL_HAS_ECC
Damien Millereb8b60e2010-08-31 22:41:14 +1000214 case KEY_ECDSA_CERT:
215 case KEY_ECDSA:
216 name = _PATH_SSH_CLIENT_ID_ECDSA;
217 break;
Damien Millerdd190dd2010-11-11 14:17:02 +1100218#endif
Damien Miller4e270b02010-04-16 15:56:21 +1000219 case KEY_RSA_CERT:
220 case KEY_RSA_CERT_V00:
Damien Miller993dd552002-02-19 15:22:47 +1100221 case KEY_RSA:
222 name = _PATH_SSH_CLIENT_ID_RSA;
223 break;
224 default:
Damien Miller9eab9562009-02-22 08:47:02 +1100225 fprintf(stderr, "bad key type\n");
Damien Miller993dd552002-02-19 15:22:47 +1100226 exit(1);
227 break;
228 }
Damien Miller90967402006-03-26 14:07:26 +1100229 }
Damien Millere39cacc2000-11-29 12:18:44 +1100230 snprintf(identity_file, sizeof(identity_file), "%s/%s", pw->pw_dir, name);
Ben Lindstrom3deda8b2000-12-22 20:27:43 +0000231 fprintf(stderr, "%s (%s): ", prompt, identity_file);
Damien Miller95def091999-11-25 00:26:21 +1100232 if (fgets(buf, sizeof(buf), stdin) == NULL)
233 exit(1);
Damien Miller14b017d2007-09-17 16:09:15 +1000234 buf[strcspn(buf, "\n")] = '\0';
Damien Miller95def091999-11-25 00:26:21 +1100235 if (strcmp(buf, "") != 0)
236 strlcpy(identity_file, buf, sizeof(identity_file));
237 have_identity = 1;
Damien Miller10f6f6b1999-11-17 17:29:08 +1100238}
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000239
Ben Lindstrombba81212001-06-25 05:01:22 +0000240static Key *
Ben Lindstromd78ae762001-06-05 20:35:09 +0000241load_identity(char *filename)
Damien Millereba71ba2000-04-29 23:57:08 +1000242{
Ben Lindstromd0fca422001-03-26 13:44:06 +0000243 char *pass;
244 Key *prv;
245
Ben Lindstroma3700052001-04-05 23:26:32 +0000246 prv = key_load_private(filename, "", NULL);
Ben Lindstromd0fca422001-03-26 13:44:06 +0000247 if (prv == NULL) {
Ben Lindstromd78ae762001-06-05 20:35:09 +0000248 if (identity_passphrase)
249 pass = xstrdup(identity_passphrase);
250 else
Ben Lindstrom949974b2001-06-25 05:20:31 +0000251 pass = read_passphrase("Enter passphrase: ",
252 RP_ALLOW_STDIN);
Ben Lindstromd0fca422001-03-26 13:44:06 +0000253 prv = key_load_private(filename, pass, NULL);
Damien Millereba71ba2000-04-29 23:57:08 +1000254 memset(pass, 0, strlen(pass));
Darren Tuckera627d422013-06-02 07:31:17 +1000255 free(pass);
Damien Millereba71ba2000-04-29 23:57:08 +1000256 }
Ben Lindstromd0fca422001-03-26 13:44:06 +0000257 return prv;
Damien Millereba71ba2000-04-29 23:57:08 +1000258}
259
Damien Miller874d77b2000-10-14 16:23:11 +1100260#define SSH_COM_PUBLIC_BEGIN "---- BEGIN SSH2 PUBLIC KEY ----"
Ben Lindstromcb72e4f2002-06-21 00:41:51 +0000261#define SSH_COM_PUBLIC_END "---- END SSH2 PUBLIC KEY ----"
Damien Miller874d77b2000-10-14 16:23:11 +1100262#define SSH_COM_PRIVATE_BEGIN "---- BEGIN SSH2 ENCRYPTED PRIVATE KEY ----"
Kevin Stevesef4eea92001-02-05 12:42:17 +0000263#define SSH_COM_PRIVATE_KEY_MAGIC 0x3f6ff9eb
Damien Millereba71ba2000-04-29 23:57:08 +1000264
Ben Lindstrombba81212001-06-25 05:01:22 +0000265static void
Damien Miller44b25042010-07-02 13:35:01 +1000266do_convert_to_ssh2(struct passwd *pw, Key *k)
Damien Millereba71ba2000-04-29 23:57:08 +1000267{
Ben Lindstromc58ab022002-02-26 18:15:09 +0000268 u_int len;
Ben Lindstrom46c16222000-12-22 01:43:59 +0000269 u_char *blob;
Darren Tuckerd04758d2010-01-12 19:41:57 +1100270 char comment[61];
Damien Millereba71ba2000-04-29 23:57:08 +1000271
Damien Millera563cce2012-04-22 11:07:28 +1000272 if (k->type == KEY_RSA1) {
273 fprintf(stderr, "version 1 keys are not supported\n");
274 exit(1);
275 }
Ben Lindstrom99a30f12001-09-18 05:49:14 +0000276 if (key_to_blob(k, &blob, &len) <= 0) {
277 fprintf(stderr, "key_to_blob failed\n");
278 exit(1);
279 }
Darren Tuckerd04758d2010-01-12 19:41:57 +1100280 /* Comment + surrounds must fit into 72 chars (RFC 4716 sec 3.3) */
281 snprintf(comment, sizeof(comment),
282 "%u-bit %s, converted by %s@%s from OpenSSH",
Ben Lindstrom46c264f2001-04-24 16:56:58 +0000283 key_size(k), key_type(k),
Damien Millereba71ba2000-04-29 23:57:08 +1000284 pw->pw_name, hostname);
Darren Tuckerd04758d2010-01-12 19:41:57 +1100285
286 fprintf(stdout, "%s\n", SSH_COM_PUBLIC_BEGIN);
287 fprintf(stdout, "Comment: \"%s\"\n", comment);
Damien Millereba71ba2000-04-29 23:57:08 +1000288 dump_base64(stdout, blob, len);
Damien Miller874d77b2000-10-14 16:23:11 +1100289 fprintf(stdout, "%s\n", SSH_COM_PUBLIC_END);
Ben Lindstrom46c264f2001-04-24 16:56:58 +0000290 key_free(k);
Darren Tuckera627d422013-06-02 07:31:17 +1000291 free(blob);
Damien Millereba71ba2000-04-29 23:57:08 +1000292 exit(0);
293}
294
Ben Lindstrombba81212001-06-25 05:01:22 +0000295static void
Damien Miller44b25042010-07-02 13:35:01 +1000296do_convert_to_pkcs8(Key *k)
297{
298 switch (key_type_plain(k->type)) {
Damien Millera563cce2012-04-22 11:07:28 +1000299 case KEY_RSA1:
Damien Miller44b25042010-07-02 13:35:01 +1000300 case KEY_RSA:
301 if (!PEM_write_RSA_PUBKEY(stdout, k->rsa))
302 fatal("PEM_write_RSA_PUBKEY failed");
303 break;
304 case KEY_DSA:
305 if (!PEM_write_DSA_PUBKEY(stdout, k->dsa))
306 fatal("PEM_write_DSA_PUBKEY failed");
307 break;
Damien Miller6af914a2010-09-10 11:39:26 +1000308#ifdef OPENSSL_HAS_ECC
Damien Millereb8b60e2010-08-31 22:41:14 +1000309 case KEY_ECDSA:
310 if (!PEM_write_EC_PUBKEY(stdout, k->ecdsa))
311 fatal("PEM_write_EC_PUBKEY failed");
312 break;
Damien Miller6af914a2010-09-10 11:39:26 +1000313#endif
Damien Miller44b25042010-07-02 13:35:01 +1000314 default:
315 fatal("%s: unsupported key type %s", __func__, key_type(k));
316 }
317 exit(0);
318}
319
320static void
321do_convert_to_pem(Key *k)
322{
323 switch (key_type_plain(k->type)) {
Damien Millera563cce2012-04-22 11:07:28 +1000324 case KEY_RSA1:
Damien Miller44b25042010-07-02 13:35:01 +1000325 case KEY_RSA:
326 if (!PEM_write_RSAPublicKey(stdout, k->rsa))
327 fatal("PEM_write_RSAPublicKey failed");
328 break;
329#if notyet /* OpenSSH 0.9.8 lacks this function */
330 case KEY_DSA:
331 if (!PEM_write_DSAPublicKey(stdout, k->dsa))
332 fatal("PEM_write_DSAPublicKey failed");
333 break;
334#endif
Damien Millereb8b60e2010-08-31 22:41:14 +1000335 /* XXX ECDSA? */
Damien Miller44b25042010-07-02 13:35:01 +1000336 default:
337 fatal("%s: unsupported key type %s", __func__, key_type(k));
338 }
339 exit(0);
340}
341
342static void
343do_convert_to(struct passwd *pw)
344{
345 Key *k;
346 struct stat st;
347
348 if (!have_identity)
349 ask_filename(pw, "Enter file in which the key is");
350 if (stat(identity_file, &st) < 0)
351 fatal("%s: %s: %s", __progname, identity_file, strerror(errno));
352 if ((k = key_load_public(identity_file, NULL)) == NULL) {
353 if ((k = load_identity(identity_file)) == NULL) {
354 fprintf(stderr, "load failed\n");
355 exit(1);
356 }
357 }
Damien Miller44b25042010-07-02 13:35:01 +1000358
359 switch (convert_format) {
360 case FMT_RFC4716:
361 do_convert_to_ssh2(pw, k);
362 break;
363 case FMT_PKCS8:
364 do_convert_to_pkcs8(k);
365 break;
366 case FMT_PEM:
367 do_convert_to_pem(k);
368 break;
369 default:
370 fatal("%s: unknown key format %d", __func__, convert_format);
371 }
372 exit(0);
373}
374
375static void
Damien Miller874d77b2000-10-14 16:23:11 +1100376buffer_get_bignum_bits(Buffer *b, BIGNUM *value)
377{
Darren Tucker3f9fdc72004-06-22 12:56:01 +1000378 u_int bignum_bits = buffer_get_int(b);
379 u_int bytes = (bignum_bits + 7) / 8;
Ben Lindstromd09fcf52001-03-29 00:29:54 +0000380
Damien Miller874d77b2000-10-14 16:23:11 +1100381 if (buffer_len(b) < bytes)
Ben Lindstromd09fcf52001-03-29 00:29:54 +0000382 fatal("buffer_get_bignum_bits: input buffer too small: "
383 "need %d have %d", bytes, buffer_len(b));
Darren Tucker0bc85572006-11-07 23:14:41 +1100384 if (BN_bin2bn(buffer_ptr(b), bytes, value) == NULL)
385 fatal("buffer_get_bignum_bits: BN_bin2bn failed");
Damien Miller874d77b2000-10-14 16:23:11 +1100386 buffer_consume(b, bytes);
387}
388
Ben Lindstrombba81212001-06-25 05:01:22 +0000389static Key *
Ben Lindstrom90fd8142002-02-26 18:09:42 +0000390do_convert_private_ssh2_from_blob(u_char *blob, u_int blen)
Damien Miller874d77b2000-10-14 16:23:11 +1100391{
392 Buffer b;
Damien Miller874d77b2000-10-14 16:23:11 +1100393 Key *key = NULL;
Damien Miller874d77b2000-10-14 16:23:11 +1100394 char *type, *cipher;
Ben Lindstrom511d69e2001-07-04 05:05:27 +0000395 u_char *sig, data[] = "abcde12345";
Ben Lindstrome586c4c2001-06-25 05:04:58 +0000396 int magic, rlen, ktype, i1, i2, i3, i4;
397 u_int slen;
398 u_long e;
Damien Miller874d77b2000-10-14 16:23:11 +1100399
400 buffer_init(&b);
401 buffer_append(&b, blob, blen);
402
Darren Tucker82a3d2b2007-02-19 22:10:25 +1100403 magic = buffer_get_int(&b);
Damien Miller874d77b2000-10-14 16:23:11 +1100404 if (magic != SSH_COM_PRIVATE_KEY_MAGIC) {
405 error("bad magic 0x%x != 0x%x", magic, SSH_COM_PRIVATE_KEY_MAGIC);
406 buffer_free(&b);
407 return NULL;
408 }
Ben Lindstrom34f91882001-06-25 04:47:54 +0000409 i1 = buffer_get_int(&b);
Damien Miller874d77b2000-10-14 16:23:11 +1100410 type = buffer_get_string(&b, NULL);
411 cipher = buffer_get_string(&b, NULL);
Ben Lindstrom34f91882001-06-25 04:47:54 +0000412 i2 = buffer_get_int(&b);
413 i3 = buffer_get_int(&b);
414 i4 = buffer_get_int(&b);
Damien Miller80163902007-01-05 16:30:16 +1100415 debug("ignore (%d %d %d %d)", i1, i2, i3, i4);
Damien Miller874d77b2000-10-14 16:23:11 +1100416 if (strcmp(cipher, "none") != 0) {
417 error("unsupported cipher %s", cipher);
Darren Tuckera627d422013-06-02 07:31:17 +1000418 free(cipher);
Damien Miller874d77b2000-10-14 16:23:11 +1100419 buffer_free(&b);
Darren Tuckera627d422013-06-02 07:31:17 +1000420 free(type);
Damien Miller874d77b2000-10-14 16:23:11 +1100421 return NULL;
422 }
Darren Tuckera627d422013-06-02 07:31:17 +1000423 free(cipher);
Damien Miller874d77b2000-10-14 16:23:11 +1100424
Ben Lindstromd09fcf52001-03-29 00:29:54 +0000425 if (strstr(type, "dsa")) {
426 ktype = KEY_DSA;
427 } else if (strstr(type, "rsa")) {
428 ktype = KEY_RSA;
429 } else {
Darren Tucker7cfeecf2005-01-20 10:56:31 +1100430 buffer_free(&b);
Darren Tuckera627d422013-06-02 07:31:17 +1000431 free(type);
Damien Miller874d77b2000-10-14 16:23:11 +1100432 return NULL;
433 }
Ben Lindstromd09fcf52001-03-29 00:29:54 +0000434 key = key_new_private(ktype);
Darren Tuckera627d422013-06-02 07:31:17 +1000435 free(type);
Ben Lindstromd09fcf52001-03-29 00:29:54 +0000436
437 switch (key->type) {
438 case KEY_DSA:
439 buffer_get_bignum_bits(&b, key->dsa->p);
440 buffer_get_bignum_bits(&b, key->dsa->g);
441 buffer_get_bignum_bits(&b, key->dsa->q);
442 buffer_get_bignum_bits(&b, key->dsa->pub_key);
443 buffer_get_bignum_bits(&b, key->dsa->priv_key);
444 break;
445 case KEY_RSA:
Darren Tucker82a3d2b2007-02-19 22:10:25 +1100446 e = buffer_get_char(&b);
Ben Lindstrom34f91882001-06-25 04:47:54 +0000447 debug("e %lx", e);
448 if (e < 30) {
449 e <<= 8;
450 e += buffer_get_char(&b);
451 debug("e %lx", e);
452 e <<= 8;
453 e += buffer_get_char(&b);
454 debug("e %lx", e);
455 }
456 if (!BN_set_word(key->rsa->e, e)) {
Ben Lindstromd09fcf52001-03-29 00:29:54 +0000457 buffer_free(&b);
458 key_free(key);
459 return NULL;
460 }
461 buffer_get_bignum_bits(&b, key->rsa->d);
462 buffer_get_bignum_bits(&b, key->rsa->n);
463 buffer_get_bignum_bits(&b, key->rsa->iqmp);
464 buffer_get_bignum_bits(&b, key->rsa->q);
465 buffer_get_bignum_bits(&b, key->rsa->p);
Ben Lindstromf7297dd2001-07-04 05:02:23 +0000466 rsa_generate_additional_parameters(key->rsa);
Ben Lindstromd09fcf52001-03-29 00:29:54 +0000467 break;
468 }
Damien Miller874d77b2000-10-14 16:23:11 +1100469 rlen = buffer_len(&b);
Ben Lindstrom1c37c6a2001-12-06 18:00:18 +0000470 if (rlen != 0)
Ben Lindstromd09fcf52001-03-29 00:29:54 +0000471 error("do_convert_private_ssh2_from_blob: "
472 "remaining bytes in key blob %d", rlen);
Damien Miller874d77b2000-10-14 16:23:11 +1100473 buffer_free(&b);
Ben Lindstromd09fcf52001-03-29 00:29:54 +0000474
Ben Lindstrome586c4c2001-06-25 05:04:58 +0000475 /* try the key */
476 key_sign(key, &sig, &slen, data, sizeof(data));
477 key_verify(key, sig, slen, data, sizeof(data));
Darren Tuckera627d422013-06-02 07:31:17 +1000478 free(sig);
Damien Miller874d77b2000-10-14 16:23:11 +1100479 return key;
480}
481
Damien Miller8056a9d2006-03-15 12:05:40 +1100482static int
483get_line(FILE *fp, char *line, size_t len)
484{
485 int c;
486 size_t pos = 0;
487
488 line[0] = '\0';
489 while ((c = fgetc(fp)) != EOF) {
490 if (pos >= len - 1) {
491 fprintf(stderr, "input line too long.\n");
492 exit(1);
493 }
Damien Miller90967402006-03-26 14:07:26 +1100494 switch (c) {
Damien Miller8056a9d2006-03-15 12:05:40 +1100495 case '\r':
496 c = fgetc(fp);
497 if (c != EOF && c != '\n' && ungetc(c, fp) == EOF) {
498 fprintf(stderr, "unget: %s\n", strerror(errno));
499 exit(1);
500 }
501 return pos;
502 case '\n':
503 return pos;
504 }
505 line[pos++] = c;
506 line[pos] = '\0';
507 }
Damien Miller6c7439f2007-01-05 16:29:55 +1100508 /* We reached EOF */
509 return -1;
Damien Miller8056a9d2006-03-15 12:05:40 +1100510}
511
Ben Lindstrombba81212001-06-25 05:01:22 +0000512static void
Damien Miller44b25042010-07-02 13:35:01 +1000513do_convert_from_ssh2(struct passwd *pw, Key **k, int *private)
Damien Millereba71ba2000-04-29 23:57:08 +1000514{
Damien Millereba71ba2000-04-29 23:57:08 +1000515 int blen;
Ben Lindstrom155b9812002-04-02 20:26:26 +0000516 u_int len;
Damien Miller8056a9d2006-03-15 12:05:40 +1100517 char line[1024];
Ben Lindstrom9e0ddd42001-09-18 05:41:19 +0000518 u_char blob[8096];
Damien Millereba71ba2000-04-29 23:57:08 +1000519 char encoded[8096];
Damien Miller44b25042010-07-02 13:35:01 +1000520 int escaped = 0;
Damien Millereba71ba2000-04-29 23:57:08 +1000521 FILE *fp;
522
Damien Millerba3420a2010-06-26 09:39:07 +1000523 if ((fp = fopen(identity_file, "r")) == NULL)
524 fatal("%s: %s: %s", __progname, identity_file, strerror(errno));
Damien Millereba71ba2000-04-29 23:57:08 +1000525 encoded[0] = '\0';
Damien Miller8056a9d2006-03-15 12:05:40 +1100526 while ((blen = get_line(fp, line, sizeof(line))) != -1) {
Damien Miller746d1a62013-07-18 16:13:02 +1000527 if (blen > 0 && line[blen - 1] == '\\')
Damien Miller30c3d422000-05-09 11:02:59 +1000528 escaped++;
Damien Millereba71ba2000-04-29 23:57:08 +1000529 if (strncmp(line, "----", 4) == 0 ||
530 strstr(line, ": ") != NULL) {
Damien Miller874d77b2000-10-14 16:23:11 +1100531 if (strstr(line, SSH_COM_PRIVATE_BEGIN) != NULL)
Damien Miller44b25042010-07-02 13:35:01 +1000532 *private = 1;
Ben Lindstrome586c4c2001-06-25 05:04:58 +0000533 if (strstr(line, " END ") != NULL) {
534 break;
535 }
Ben Lindstrom30358602001-04-24 16:59:28 +0000536 /* fprintf(stderr, "ignore: %s", line); */
Damien Millereba71ba2000-04-29 23:57:08 +1000537 continue;
538 }
Damien Miller30c3d422000-05-09 11:02:59 +1000539 if (escaped) {
540 escaped--;
Ben Lindstrom30358602001-04-24 16:59:28 +0000541 /* fprintf(stderr, "escaped: %s", line); */
Damien Miller30c3d422000-05-09 11:02:59 +1000542 continue;
Damien Millereba71ba2000-04-29 23:57:08 +1000543 }
Damien Millereba71ba2000-04-29 23:57:08 +1000544 strlcat(encoded, line, sizeof(encoded));
545 }
Ben Lindstrom155b9812002-04-02 20:26:26 +0000546 len = strlen(encoded);
547 if (((len % 4) == 3) &&
548 (encoded[len-1] == '=') &&
549 (encoded[len-2] == '=') &&
550 (encoded[len-3] == '='))
551 encoded[len-3] = '\0';
Damien Miller4a8ed542002-01-22 23:33:31 +1100552 blen = uudecode(encoded, blob, sizeof(blob));
Damien Millereba71ba2000-04-29 23:57:08 +1000553 if (blen < 0) {
554 fprintf(stderr, "uudecode failed.\n");
555 exit(1);
556 }
Damien Miller44b25042010-07-02 13:35:01 +1000557 *k = *private ?
Damien Miller874d77b2000-10-14 16:23:11 +1100558 do_convert_private_ssh2_from_blob(blob, blen) :
Damien Miller0bc1bd82000-11-13 22:57:25 +1100559 key_from_blob(blob, blen);
Damien Miller44b25042010-07-02 13:35:01 +1000560 if (*k == NULL) {
Damien Miller874d77b2000-10-14 16:23:11 +1100561 fprintf(stderr, "decode blob failed.\n");
562 exit(1);
563 }
Damien Miller44b25042010-07-02 13:35:01 +1000564 fclose(fp);
565}
566
567static void
568do_convert_from_pkcs8(Key **k, int *private)
569{
570 EVP_PKEY *pubkey;
571 FILE *fp;
572
573 if ((fp = fopen(identity_file, "r")) == NULL)
574 fatal("%s: %s: %s", __progname, identity_file, strerror(errno));
575 if ((pubkey = PEM_read_PUBKEY(fp, NULL, NULL, NULL)) == NULL) {
576 fatal("%s: %s is not a recognised public key format", __func__,
577 identity_file);
578 }
579 fclose(fp);
580 switch (EVP_PKEY_type(pubkey->type)) {
581 case EVP_PKEY_RSA:
582 *k = key_new(KEY_UNSPEC);
583 (*k)->type = KEY_RSA;
584 (*k)->rsa = EVP_PKEY_get1_RSA(pubkey);
585 break;
586 case EVP_PKEY_DSA:
587 *k = key_new(KEY_UNSPEC);
588 (*k)->type = KEY_DSA;
589 (*k)->dsa = EVP_PKEY_get1_DSA(pubkey);
590 break;
Damien Miller6af914a2010-09-10 11:39:26 +1000591#ifdef OPENSSL_HAS_ECC
Damien Millereb8b60e2010-08-31 22:41:14 +1000592 case EVP_PKEY_EC:
593 *k = key_new(KEY_UNSPEC);
594 (*k)->type = KEY_ECDSA;
595 (*k)->ecdsa = EVP_PKEY_get1_EC_KEY(pubkey);
Damien Millerb472a902010-11-05 10:19:49 +1100596 (*k)->ecdsa_nid = key_ecdsa_key_to_nid((*k)->ecdsa);
Damien Millereb8b60e2010-08-31 22:41:14 +1000597 break;
Damien Miller6af914a2010-09-10 11:39:26 +1000598#endif
Damien Miller44b25042010-07-02 13:35:01 +1000599 default:
600 fatal("%s: unsupported pubkey type %d", __func__,
601 EVP_PKEY_type(pubkey->type));
602 }
603 EVP_PKEY_free(pubkey);
604 return;
605}
606
607static void
608do_convert_from_pem(Key **k, int *private)
609{
610 FILE *fp;
611 RSA *rsa;
612#ifdef notyet
613 DSA *dsa;
614#endif
615
616 if ((fp = fopen(identity_file, "r")) == NULL)
617 fatal("%s: %s: %s", __progname, identity_file, strerror(errno));
618 if ((rsa = PEM_read_RSAPublicKey(fp, NULL, NULL, NULL)) != NULL) {
619 *k = key_new(KEY_UNSPEC);
620 (*k)->type = KEY_RSA;
621 (*k)->rsa = rsa;
622 fclose(fp);
623 return;
624 }
625#if notyet /* OpenSSH 0.9.8 lacks this function */
626 rewind(fp);
627 if ((dsa = PEM_read_DSAPublicKey(fp, NULL, NULL, NULL)) != NULL) {
628 *k = key_new(KEY_UNSPEC);
629 (*k)->type = KEY_DSA;
630 (*k)->dsa = dsa;
631 fclose(fp);
632 return;
633 }
Damien Millereb8b60e2010-08-31 22:41:14 +1000634 /* XXX ECDSA */
Damien Miller44b25042010-07-02 13:35:01 +1000635#endif
636 fatal("%s: unrecognised raw private key format", __func__);
637}
638
639static void
640do_convert_from(struct passwd *pw)
641{
642 Key *k = NULL;
Damien Miller844cccf2010-08-03 16:03:29 +1000643 int private = 0, ok = 0;
Damien Miller44b25042010-07-02 13:35:01 +1000644 struct stat st;
645
646 if (!have_identity)
647 ask_filename(pw, "Enter file in which the key is");
648 if (stat(identity_file, &st) < 0)
649 fatal("%s: %s: %s", __progname, identity_file, strerror(errno));
650
651 switch (convert_format) {
652 case FMT_RFC4716:
653 do_convert_from_ssh2(pw, &k, &private);
654 break;
655 case FMT_PKCS8:
656 do_convert_from_pkcs8(&k, &private);
657 break;
658 case FMT_PEM:
659 do_convert_from_pem(&k, &private);
660 break;
661 default:
662 fatal("%s: unknown key format %d", __func__, convert_format);
663 }
664
665 if (!private)
666 ok = key_write(k, stdout);
667 if (ok)
668 fprintf(stdout, "\n");
669 else {
670 switch (k->type) {
671 case KEY_DSA:
672 ok = PEM_write_DSAPrivateKey(stdout, k->dsa, NULL,
673 NULL, 0, NULL, NULL);
674 break;
Damien Miller6af914a2010-09-10 11:39:26 +1000675#ifdef OPENSSL_HAS_ECC
Damien Millereb8b60e2010-08-31 22:41:14 +1000676 case KEY_ECDSA:
677 ok = PEM_write_ECPrivateKey(stdout, k->ecdsa, NULL,
678 NULL, 0, NULL, NULL);
679 break;
Damien Miller6af914a2010-09-10 11:39:26 +1000680#endif
Damien Miller44b25042010-07-02 13:35:01 +1000681 case KEY_RSA:
682 ok = PEM_write_RSAPrivateKey(stdout, k->rsa, NULL,
683 NULL, 0, NULL, NULL);
684 break;
685 default:
686 fatal("%s: unsupported key type %s", __func__,
687 key_type(k));
688 }
689 }
690
Damien Miller874d77b2000-10-14 16:23:11 +1100691 if (!ok) {
Damien Miller9eab9562009-02-22 08:47:02 +1100692 fprintf(stderr, "key write failed\n");
Damien Miller874d77b2000-10-14 16:23:11 +1100693 exit(1);
694 }
Damien Millereba71ba2000-04-29 23:57:08 +1000695 key_free(k);
Damien Millereba71ba2000-04-29 23:57:08 +1000696 exit(0);
697}
698
Ben Lindstrombba81212001-06-25 05:01:22 +0000699static void
Damien Millereba71ba2000-04-29 23:57:08 +1000700do_print_public(struct passwd *pw)
701{
Ben Lindstromd0fca422001-03-26 13:44:06 +0000702 Key *prv;
Damien Millereba71ba2000-04-29 23:57:08 +1000703 struct stat st;
704
705 if (!have_identity)
706 ask_filename(pw, "Enter file in which the key is");
707 if (stat(identity_file, &st) < 0) {
708 perror(identity_file);
709 exit(1);
710 }
Ben Lindstromd78ae762001-06-05 20:35:09 +0000711 prv = load_identity(identity_file);
Ben Lindstromd0fca422001-03-26 13:44:06 +0000712 if (prv == NULL) {
Damien Millereba71ba2000-04-29 23:57:08 +1000713 fprintf(stderr, "load failed\n");
714 exit(1);
715 }
Ben Lindstromd0fca422001-03-26 13:44:06 +0000716 if (!key_write(prv, stdout))
Damien Millereba71ba2000-04-29 23:57:08 +1000717 fprintf(stderr, "key_write failed");
Ben Lindstromd0fca422001-03-26 13:44:06 +0000718 key_free(prv);
Damien Millereba71ba2000-04-29 23:57:08 +1000719 fprintf(stdout, "\n");
720 exit(0);
721}
722
Ben Lindstromcd392282001-07-04 03:44:03 +0000723static void
Damien Miller757f34e2010-08-05 13:05:31 +1000724do_download(struct passwd *pw)
Ben Lindstromcd392282001-07-04 03:44:03 +0000725{
Damien Miller7ea845e2010-02-12 09:21:02 +1100726#ifdef ENABLE_PKCS11
Ben Lindstrom0936a5b2002-03-26 03:17:42 +0000727 Key **keys = NULL;
Damien Miller7ea845e2010-02-12 09:21:02 +1100728 int i, nkeys;
Damien Millerec77c952013-01-09 15:58:00 +1100729 enum fp_rep rep;
730 enum fp_type fptype;
731 char *fp, *ra;
Ben Lindstrom8282d6a2001-08-06 21:44:05 +0000732
Damien Miller1422c082013-01-09 16:44:54 +1100733 fptype = print_bubblebabble ? SSH_FP_SHA1 : SSH_FP_MD5;
734 rep = print_bubblebabble ? SSH_FP_BUBBLEBABBLE : SSH_FP_HEX;
735
Damien Miller7ea845e2010-02-12 09:21:02 +1100736 pkcs11_init(0);
737 nkeys = pkcs11_add_provider(pkcs11provider, NULL, &keys);
738 if (nkeys <= 0)
739 fatal("cannot read public key from pkcs11");
740 for (i = 0; i < nkeys; i++) {
Damien Millerec77c952013-01-09 15:58:00 +1100741 if (print_fingerprint) {
742 fp = key_fingerprint(keys[i], fptype, rep);
743 ra = key_fingerprint(keys[i], SSH_FP_MD5,
744 SSH_FP_RANDOMART);
745 printf("%u %s %s (PKCS11 key)\n", key_size(keys[i]),
746 fp, key_type(keys[i]));
747 if (log_level >= SYSLOG_LEVEL_VERBOSE)
748 printf("%s\n", ra);
Darren Tuckera627d422013-06-02 07:31:17 +1000749 free(ra);
750 free(fp);
Damien Millerec77c952013-01-09 15:58:00 +1100751 } else {
752 key_write(keys[i], stdout);
753 fprintf(stdout, "\n");
754 }
Ben Lindstrom0936a5b2002-03-26 03:17:42 +0000755 key_free(keys[i]);
Ben Lindstrom0936a5b2002-03-26 03:17:42 +0000756 }
Darren Tuckera627d422013-06-02 07:31:17 +1000757 free(keys);
Damien Miller7ea845e2010-02-12 09:21:02 +1100758 pkcs11_terminate();
Ben Lindstrom8282d6a2001-08-06 21:44:05 +0000759 exit(0);
Damien Miller7ea845e2010-02-12 09:21:02 +1100760#else
761 fatal("no pkcs11 support");
762#endif /* ENABLE_PKCS11 */
Ben Lindstrom8282d6a2001-08-06 21:44:05 +0000763}
Ben Lindstromcd392282001-07-04 03:44:03 +0000764
Ben Lindstrombba81212001-06-25 05:01:22 +0000765static void
Damien Miller10f6f6b1999-11-17 17:29:08 +1100766do_fingerprint(struct passwd *pw)
767{
Damien Miller98c7ad62000-03-09 21:27:49 +1100768 FILE *f;
Damien Millereba71ba2000-04-29 23:57:08 +1000769 Key *public;
Darren Tucker9c16ac92008-06-13 04:40:35 +1000770 char *comment = NULL, *cp, *ep, line[16*1024], *fp, *ra;
Damien Millercb2fbb22008-02-10 22:24:55 +1100771 int i, skip = 0, num = 0, invalid = 1;
Ben Lindstrom65366a82001-12-06 16:32:47 +0000772 enum fp_rep rep;
773 enum fp_type fptype;
Damien Miller95def091999-11-25 00:26:21 +1100774 struct stat st;
Damien Miller10f6f6b1999-11-17 17:29:08 +1100775
Ben Lindstromd0fca422001-03-26 13:44:06 +0000776 fptype = print_bubblebabble ? SSH_FP_SHA1 : SSH_FP_MD5;
777 rep = print_bubblebabble ? SSH_FP_BUBBLEBABBLE : SSH_FP_HEX;
Ben Lindstrom8fd372b2001-03-12 03:02:17 +0000778
Damien Miller95def091999-11-25 00:26:21 +1100779 if (!have_identity)
780 ask_filename(pw, "Enter file in which the key is");
781 if (stat(identity_file, &st) < 0) {
782 perror(identity_file);
783 exit(1);
784 }
Ben Lindstromd0fca422001-03-26 13:44:06 +0000785 public = key_load_public(identity_file, &comment);
786 if (public != NULL) {
787 fp = key_fingerprint(public, fptype, rep);
Darren Tucker9bcd25b2009-10-07 08:45:48 +1100788 ra = key_fingerprint(public, SSH_FP_MD5, SSH_FP_RANDOMART);
Darren Tuckerb68fb4a2008-06-13 08:57:27 +1000789 printf("%u %s %s (%s)\n", key_size(public), fp, comment,
790 key_type(public));
Darren Tucker35c45532008-06-13 04:43:15 +1000791 if (log_level >= SYSLOG_LEVEL_VERBOSE)
792 printf("%s\n", ra);
Damien Miller0bc1bd82000-11-13 22:57:25 +1100793 key_free(public);
Darren Tuckera627d422013-06-02 07:31:17 +1000794 free(comment);
795 free(ra);
796 free(fp);
Damien Miller98c7ad62000-03-09 21:27:49 +1100797 exit(0);
798 }
Damien Miller40b59852006-06-13 13:00:25 +1000799 if (comment) {
Darren Tuckera627d422013-06-02 07:31:17 +1000800 free(comment);
Damien Miller40b59852006-06-13 13:00:25 +1000801 comment = NULL;
802 }
Damien Miller98c7ad62000-03-09 21:27:49 +1100803
Damien Millerba3420a2010-06-26 09:39:07 +1000804 if ((f = fopen(identity_file, "r")) == NULL)
805 fatal("%s: %s: %s", __progname, identity_file, strerror(errno));
Damien Miller98c7ad62000-03-09 21:27:49 +1100806
Damien Millerba3420a2010-06-26 09:39:07 +1000807 while (fgets(line, sizeof(line), f)) {
808 if ((cp = strchr(line, '\n')) == NULL) {
809 error("line %d too long: %.40s...",
810 num + 1, line);
811 skip = 1;
812 continue;
Damien Miller95def091999-11-25 00:26:21 +1100813 }
Damien Millerba3420a2010-06-26 09:39:07 +1000814 num++;
815 if (skip) {
816 skip = 0;
817 continue;
818 }
819 *cp = '\0';
820
821 /* Skip leading whitespace, empty and comment lines. */
822 for (cp = line; *cp == ' ' || *cp == '\t'; cp++)
823 ;
824 if (!*cp || *cp == '\n' || *cp == '#')
825 continue;
826 i = strtol(cp, &ep, 10);
827 if (i == 0 || ep == NULL || (*ep != ' ' && *ep != '\t')) {
828 int quoted = 0;
829 comment = cp;
830 for (; *cp && (quoted || (*cp != ' ' &&
831 *cp != '\t')); cp++) {
832 if (*cp == '\\' && cp[1] == '"')
833 cp++; /* Skip both */
834 else if (*cp == '"')
835 quoted = !quoted;
836 }
837 if (!*cp)
838 continue;
839 *cp++ = '\0';
840 }
841 ep = cp;
842 public = key_new(KEY_RSA1);
843 if (key_read(public, &cp) != 1) {
844 cp = ep;
845 key_free(public);
846 public = key_new(KEY_UNSPEC);
847 if (key_read(public, &cp) != 1) {
848 key_free(public);
849 continue;
850 }
851 }
852 comment = *cp ? cp : comment;
853 fp = key_fingerprint(public, fptype, rep);
854 ra = key_fingerprint(public, SSH_FP_MD5, SSH_FP_RANDOMART);
855 printf("%u %s %s (%s)\n", key_size(public), fp,
856 comment ? comment : "no comment", key_type(public));
857 if (log_level >= SYSLOG_LEVEL_VERBOSE)
858 printf("%s\n", ra);
Darren Tuckera627d422013-06-02 07:31:17 +1000859 free(ra);
860 free(fp);
Damien Millerba3420a2010-06-26 09:39:07 +1000861 key_free(public);
862 invalid = 0;
Damien Miller95def091999-11-25 00:26:21 +1100863 }
Damien Millerba3420a2010-06-26 09:39:07 +1000864 fclose(f);
865
Damien Miller98c7ad62000-03-09 21:27:49 +1100866 if (invalid) {
Damien Millereb5fec62001-11-12 10:52:44 +1100867 printf("%s is not a public key file.\n", identity_file);
Damien Miller98c7ad62000-03-09 21:27:49 +1100868 exit(1);
869 }
Damien Miller95def091999-11-25 00:26:21 +1100870 exit(0);
Damien Miller10f6f6b1999-11-17 17:29:08 +1100871}
872
Damien Miller4b42d7f2005-03-01 21:48:35 +1100873static void
Damien Miller58f1baf2011-05-05 14:06:15 +1000874do_gen_all_hostkeys(struct passwd *pw)
875{
876 struct {
877 char *key_type;
878 char *key_type_display;
879 char *path;
880 } key_types[] = {
881 { "rsa1", "RSA1", _PATH_HOST_KEY_FILE },
882 { "rsa", "RSA" ,_PATH_HOST_RSA_KEY_FILE },
883 { "dsa", "DSA", _PATH_HOST_DSA_KEY_FILE },
Damien Millerb56e4932012-02-06 07:41:27 +1100884#ifdef OPENSSL_HAS_ECC
Damien Miller58f1baf2011-05-05 14:06:15 +1000885 { "ecdsa", "ECDSA",_PATH_HOST_ECDSA_KEY_FILE },
Damien Millerb56e4932012-02-06 07:41:27 +1100886#endif
Damien Miller58f1baf2011-05-05 14:06:15 +1000887 { NULL, NULL, NULL }
888 };
889
890 int first = 0;
891 struct stat st;
892 Key *private, *public;
893 char comment[1024];
894 int i, type, fd;
895 FILE *f;
896
897 for (i = 0; key_types[i].key_type; i++) {
898 if (stat(key_types[i].path, &st) == 0)
899 continue;
900 if (errno != ENOENT) {
901 printf("Could not stat %s: %s", key_types[i].path,
902 strerror(errno));
903 first = 0;
904 continue;
905 }
906
907 if (first == 0) {
908 first = 1;
909 printf("%s: generating new host keys: ", __progname);
910 }
911 printf("%s ", key_types[i].key_type_display);
912 fflush(stdout);
Damien Miller58f1baf2011-05-05 14:06:15 +1000913 type = key_type_from_name(key_types[i].key_type);
914 strlcpy(identity_file, key_types[i].path, sizeof(identity_file));
915 bits = 0;
916 type_bits_valid(type, &bits);
917 private = key_generate(type, bits);
918 if (private == NULL) {
919 fprintf(stderr, "key_generate failed\n");
920 first = 0;
921 continue;
922 }
923 public = key_from_private(private);
924 snprintf(comment, sizeof comment, "%s@%s", pw->pw_name,
925 hostname);
926 if (!key_save_private(private, identity_file, "", comment)) {
927 printf("Saving the key failed: %s.\n", identity_file);
928 key_free(private);
929 key_free(public);
930 first = 0;
931 continue;
932 }
933 key_free(private);
Damien Miller58f1baf2011-05-05 14:06:15 +1000934 strlcat(identity_file, ".pub", sizeof(identity_file));
935 fd = open(identity_file, O_WRONLY | O_CREAT | O_TRUNC, 0644);
936 if (fd == -1) {
937 printf("Could not save your public key in %s\n",
938 identity_file);
939 key_free(public);
940 first = 0;
941 continue;
942 }
943 f = fdopen(fd, "w");
944 if (f == NULL) {
945 printf("fdopen %s failed\n", identity_file);
946 key_free(public);
947 first = 0;
948 continue;
949 }
950 if (!key_write(public, f)) {
951 fprintf(stderr, "write key failed\n");
952 key_free(public);
953 first = 0;
954 continue;
955 }
956 fprintf(f, " %s\n", comment);
957 fclose(f);
958 key_free(public);
959
960 }
961 if (first != 0)
962 printf("\n");
963}
964
965static void
Damien Miller0a80ca12010-02-27 07:55:05 +1100966printhost(FILE *f, const char *name, Key *public, int ca, int hash)
Damien Miller4b42d7f2005-03-01 21:48:35 +1100967{
Darren Tucker0f7e9102008-06-08 12:54:29 +1000968 if (print_fingerprint) {
969 enum fp_rep rep;
970 enum fp_type fptype;
Darren Tucker9c16ac92008-06-13 04:40:35 +1000971 char *fp, *ra;
Darren Tucker0f7e9102008-06-08 12:54:29 +1000972
973 fptype = print_bubblebabble ? SSH_FP_SHA1 : SSH_FP_MD5;
974 rep = print_bubblebabble ? SSH_FP_BUBBLEBABBLE : SSH_FP_HEX;
975 fp = key_fingerprint(public, fptype, rep);
Darren Tucker9bcd25b2009-10-07 08:45:48 +1100976 ra = key_fingerprint(public, SSH_FP_MD5, SSH_FP_RANDOMART);
Damien Miller81dec052008-07-14 11:28:29 +1000977 printf("%u %s %s (%s)\n", key_size(public), fp, name,
978 key_type(public));
979 if (log_level >= SYSLOG_LEVEL_VERBOSE)
980 printf("%s\n", ra);
Darren Tuckera627d422013-06-02 07:31:17 +1000981 free(ra);
982 free(fp);
Darren Tucker0f7e9102008-06-08 12:54:29 +1000983 } else {
984 if (hash && (name = host_hash(name, NULL, 0)) == NULL)
985 fatal("hash_host failed");
Damien Miller0a80ca12010-02-27 07:55:05 +1100986 fprintf(f, "%s%s%s ", ca ? CA_MARKER : "", ca ? " " : "", name);
Darren Tucker0f7e9102008-06-08 12:54:29 +1000987 if (!key_write(public, f))
988 fatal("key_write failed");
989 fprintf(f, "\n");
990 }
Damien Miller4b42d7f2005-03-01 21:48:35 +1100991}
992
993static void
994do_known_hosts(struct passwd *pw, const char *name)
995{
996 FILE *in, *out = stdout;
Damien Miller0a80ca12010-02-27 07:55:05 +1100997 Key *pub;
Damien Miller4b42d7f2005-03-01 21:48:35 +1100998 char *cp, *cp2, *kp, *kp2;
999 char line[16*1024], tmp[MAXPATHLEN], old[MAXPATHLEN];
Damien Millercb2fbb22008-02-10 22:24:55 +11001000 int c, skip = 0, inplace = 0, num = 0, invalid = 0, has_unhashed = 0;
Damien Miller0a80ca12010-02-27 07:55:05 +11001001 int ca;
Damien Miller66085482013-09-14 09:45:03 +10001002 int found_key = 0;
Damien Miller4b42d7f2005-03-01 21:48:35 +11001003
1004 if (!have_identity) {
1005 cp = tilde_expand_filename(_PATH_SSH_USER_HOSTFILE, pw->pw_uid);
1006 if (strlcpy(identity_file, cp, sizeof(identity_file)) >=
1007 sizeof(identity_file))
1008 fatal("Specified known hosts path too long");
Darren Tuckera627d422013-06-02 07:31:17 +10001009 free(cp);
Damien Miller4b42d7f2005-03-01 21:48:35 +11001010 have_identity = 1;
1011 }
1012 if ((in = fopen(identity_file, "r")) == NULL)
Damien Millerba3420a2010-06-26 09:39:07 +10001013 fatal("%s: %s: %s", __progname, identity_file, strerror(errno));
Damien Miller4b42d7f2005-03-01 21:48:35 +11001014
1015 /*
1016 * Find hosts goes to stdout, hash and deletions happen in-place
1017 * A corner case is ssh-keygen -HF foo, which should go to stdout
1018 */
1019 if (!find_host && (hash_hosts || delete_host)) {
1020 if (strlcpy(tmp, identity_file, sizeof(tmp)) >= sizeof(tmp) ||
1021 strlcat(tmp, ".XXXXXXXXXX", sizeof(tmp)) >= sizeof(tmp) ||
1022 strlcpy(old, identity_file, sizeof(old)) >= sizeof(old) ||
1023 strlcat(old, ".old", sizeof(old)) >= sizeof(old))
1024 fatal("known_hosts path too long");
1025 umask(077);
1026 if ((c = mkstemp(tmp)) == -1)
1027 fatal("mkstemp: %s", strerror(errno));
1028 if ((out = fdopen(c, "w")) == NULL) {
1029 c = errno;
1030 unlink(tmp);
1031 fatal("fdopen: %s", strerror(c));
1032 }
1033 inplace = 1;
1034 }
1035
1036 while (fgets(line, sizeof(line), in)) {
Damien Miller0f4ed692007-10-26 14:26:32 +10001037 if ((cp = strchr(line, '\n')) == NULL) {
Damien Millercb2fbb22008-02-10 22:24:55 +11001038 error("line %d too long: %.40s...", num + 1, line);
Damien Miller4b42d7f2005-03-01 21:48:35 +11001039 skip = 1;
1040 invalid = 1;
1041 continue;
1042 }
Damien Miller0f4ed692007-10-26 14:26:32 +10001043 num++;
Damien Miller4b42d7f2005-03-01 21:48:35 +11001044 if (skip) {
1045 skip = 0;
1046 continue;
1047 }
Damien Miller0f4ed692007-10-26 14:26:32 +10001048 *cp = '\0';
Damien Miller4b42d7f2005-03-01 21:48:35 +11001049
1050 /* Skip leading whitespace, empty and comment lines. */
1051 for (cp = line; *cp == ' ' || *cp == '\t'; cp++)
1052 ;
1053 if (!*cp || *cp == '\n' || *cp == '#') {
1054 if (inplace)
1055 fprintf(out, "%s\n", cp);
1056 continue;
1057 }
Damien Miller0a80ca12010-02-27 07:55:05 +11001058 /* Check whether this is a CA key */
1059 if (strncasecmp(cp, CA_MARKER, sizeof(CA_MARKER) - 1) == 0 &&
1060 (cp[sizeof(CA_MARKER) - 1] == ' ' ||
1061 cp[sizeof(CA_MARKER) - 1] == '\t')) {
1062 ca = 1;
1063 cp += sizeof(CA_MARKER);
1064 } else
1065 ca = 0;
1066
Damien Miller4b42d7f2005-03-01 21:48:35 +11001067 /* Find the end of the host name portion. */
1068 for (kp = cp; *kp && *kp != ' ' && *kp != '\t'; kp++)
1069 ;
Damien Miller0a80ca12010-02-27 07:55:05 +11001070
Damien Miller4b42d7f2005-03-01 21:48:35 +11001071 if (*kp == '\0' || *(kp + 1) == '\0') {
1072 error("line %d missing key: %.40s...",
1073 num, line);
1074 invalid = 1;
1075 continue;
1076 }
1077 *kp++ = '\0';
1078 kp2 = kp;
1079
Damien Miller0a80ca12010-02-27 07:55:05 +11001080 pub = key_new(KEY_RSA1);
1081 if (key_read(pub, &kp) != 1) {
Damien Miller4b42d7f2005-03-01 21:48:35 +11001082 kp = kp2;
Damien Miller0a80ca12010-02-27 07:55:05 +11001083 key_free(pub);
1084 pub = key_new(KEY_UNSPEC);
1085 if (key_read(pub, &kp) != 1) {
Damien Miller4b42d7f2005-03-01 21:48:35 +11001086 error("line %d invalid key: %.40s...",
1087 num, line);
Damien Miller0a80ca12010-02-27 07:55:05 +11001088 key_free(pub);
Damien Miller4b42d7f2005-03-01 21:48:35 +11001089 invalid = 1;
1090 continue;
1091 }
1092 }
1093
1094 if (*cp == HASH_DELIM) {
1095 if (find_host || delete_host) {
1096 cp2 = host_hash(name, cp, strlen(cp));
1097 if (cp2 == NULL) {
1098 error("line %d: invalid hashed "
1099 "name: %.64s...", num, line);
1100 invalid = 1;
1101 continue;
1102 }
1103 c = (strcmp(cp2, cp) == 0);
1104 if (find_host && c) {
Damien Miller66085482013-09-14 09:45:03 +10001105 if (!quiet)
1106 printf("# Host %s found: "
1107 "line %d type %s%s\n", name,
1108 num, key_type(pub),
1109 ca ? " (CA key)" : "");
Damien Miller0a80ca12010-02-27 07:55:05 +11001110 printhost(out, cp, pub, ca, 0);
Damien Miller66085482013-09-14 09:45:03 +10001111 found_key = 1;
Damien Miller4b42d7f2005-03-01 21:48:35 +11001112 }
Darren Tuckerf09a8a62012-09-06 21:20:39 +10001113 if (delete_host) {
1114 if (!c && !ca)
1115 printhost(out, cp, pub, ca, 0);
1116 else
1117 printf("# Host %s found: "
1118 "line %d type %s\n", name,
1119 num, key_type(pub));
1120 }
Damien Miller4b42d7f2005-03-01 21:48:35 +11001121 } else if (hash_hosts)
Damien Miller0a80ca12010-02-27 07:55:05 +11001122 printhost(out, cp, pub, ca, 0);
Damien Miller4b42d7f2005-03-01 21:48:35 +11001123 } else {
1124 if (find_host || delete_host) {
1125 c = (match_hostname(name, cp,
1126 strlen(cp)) == 1);
1127 if (find_host && c) {
Damien Miller66085482013-09-14 09:45:03 +10001128 if (!quiet)
1129 printf("# Host %s found: "
1130 "line %d type %s%s\n", name,
1131 num, key_type(pub),
1132 ca ? " (CA key)" : "");
Damien Miller0a80ca12010-02-27 07:55:05 +11001133 printhost(out, name, pub,
1134 ca, hash_hosts && !ca);
Damien Miller66085482013-09-14 09:45:03 +10001135 found_key = 1;
Damien Miller4b42d7f2005-03-01 21:48:35 +11001136 }
Darren Tuckerf09a8a62012-09-06 21:20:39 +10001137 if (delete_host) {
1138 if (!c && !ca)
1139 printhost(out, cp, pub, ca, 0);
1140 else
1141 printf("# Host %s found: "
1142 "line %d type %s\n", name,
1143 num, key_type(pub));
1144 }
Damien Miller4b42d7f2005-03-01 21:48:35 +11001145 } else if (hash_hosts) {
Darren Tucker47eede72005-03-14 23:08:12 +11001146 for (cp2 = strsep(&cp, ",");
Damien Miller4b42d7f2005-03-01 21:48:35 +11001147 cp2 != NULL && *cp2 != '\0';
Damien Miller89eac802005-03-02 12:33:04 +11001148 cp2 = strsep(&cp, ",")) {
Damien Miller0a80ca12010-02-27 07:55:05 +11001149 if (ca) {
1150 fprintf(stderr, "Warning: "
1151 "ignoring CA key for host: "
1152 "%.64s\n", cp2);
1153 printhost(out, cp2, pub, ca, 0);
1154 } else if (strcspn(cp2, "*?!") !=
1155 strlen(cp2)) {
Damien Miller89eac802005-03-02 12:33:04 +11001156 fprintf(stderr, "Warning: "
1157 "ignoring host name with "
1158 "metacharacters: %.64s\n",
1159 cp2);
Damien Miller0a80ca12010-02-27 07:55:05 +11001160 printhost(out, cp2, pub, ca, 0);
1161 } else
1162 printhost(out, cp2, pub, ca, 1);
Damien Miller89eac802005-03-02 12:33:04 +11001163 }
Damien Miller4b42d7f2005-03-01 21:48:35 +11001164 has_unhashed = 1;
1165 }
1166 }
Damien Miller0a80ca12010-02-27 07:55:05 +11001167 key_free(pub);
Damien Miller4b42d7f2005-03-01 21:48:35 +11001168 }
1169 fclose(in);
1170
1171 if (invalid) {
Damien Millercb2fbb22008-02-10 22:24:55 +11001172 fprintf(stderr, "%s is not a valid known_hosts file.\n",
Damien Miller4b42d7f2005-03-01 21:48:35 +11001173 identity_file);
1174 if (inplace) {
1175 fprintf(stderr, "Not replacing existing known_hosts "
Darren Tucker9f438a92005-03-14 23:09:18 +11001176 "file because of errors\n");
Damien Miller4b42d7f2005-03-01 21:48:35 +11001177 fclose(out);
1178 unlink(tmp);
1179 }
1180 exit(1);
1181 }
1182
1183 if (inplace) {
1184 fclose(out);
1185
1186 /* Backup existing file */
1187 if (unlink(old) == -1 && errno != ENOENT)
1188 fatal("unlink %.100s: %s", old, strerror(errno));
1189 if (link(identity_file, old) == -1)
1190 fatal("link %.100s to %.100s: %s", identity_file, old,
1191 strerror(errno));
1192 /* Move new one into place */
1193 if (rename(tmp, identity_file) == -1) {
1194 error("rename\"%s\" to \"%s\": %s", tmp, identity_file,
1195 strerror(errno));
1196 unlink(tmp);
1197 unlink(old);
1198 exit(1);
1199 }
1200
1201 fprintf(stderr, "%s updated.\n", identity_file);
1202 fprintf(stderr, "Original contents retained as %s\n", old);
1203 if (has_unhashed) {
1204 fprintf(stderr, "WARNING: %s contains unhashed "
1205 "entries\n", old);
1206 fprintf(stderr, "Delete this file to ensure privacy "
Damien Miller0dc1bef2005-07-17 17:22:45 +10001207 "of hostnames\n");
Damien Miller4b42d7f2005-03-01 21:48:35 +11001208 }
1209 }
1210
Damien Miller66085482013-09-14 09:45:03 +10001211 exit (find_host && !found_key);
Damien Miller4b42d7f2005-03-01 21:48:35 +11001212}
1213
Damien Miller95def091999-11-25 00:26:21 +11001214/*
1215 * Perform changing a passphrase. The argument is the passwd structure
1216 * for the current user.
1217 */
Ben Lindstrombba81212001-06-25 05:01:22 +00001218static void
Damien Miller10f6f6b1999-11-17 17:29:08 +11001219do_change_passphrase(struct passwd *pw)
1220{
Damien Miller95def091999-11-25 00:26:21 +11001221 char *comment;
1222 char *old_passphrase, *passphrase1, *passphrase2;
1223 struct stat st;
Damien Millereba71ba2000-04-29 23:57:08 +10001224 Key *private;
Damien Miller10f6f6b1999-11-17 17:29:08 +11001225
Damien Miller95def091999-11-25 00:26:21 +11001226 if (!have_identity)
1227 ask_filename(pw, "Enter file in which the key is");
Damien Miller95def091999-11-25 00:26:21 +11001228 if (stat(identity_file, &st) < 0) {
1229 perror(identity_file);
1230 exit(1);
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001231 }
Damien Miller95def091999-11-25 00:26:21 +11001232 /* Try to load the file with empty passphrase. */
Ben Lindstromd0fca422001-03-26 13:44:06 +00001233 private = key_load_private(identity_file, "", &comment);
1234 if (private == NULL) {
Damien Miller95def091999-11-25 00:26:21 +11001235 if (identity_passphrase)
1236 old_passphrase = xstrdup(identity_passphrase);
1237 else
Ben Lindstrom949974b2001-06-25 05:20:31 +00001238 old_passphrase =
1239 read_passphrase("Enter old passphrase: ",
1240 RP_ALLOW_STDIN);
1241 private = key_load_private(identity_file, old_passphrase,
1242 &comment);
Ben Lindstromd0fca422001-03-26 13:44:06 +00001243 memset(old_passphrase, 0, strlen(old_passphrase));
Darren Tuckera627d422013-06-02 07:31:17 +10001244 free(old_passphrase);
Ben Lindstromd0fca422001-03-26 13:44:06 +00001245 if (private == NULL) {
Damien Miller95def091999-11-25 00:26:21 +11001246 printf("Bad passphrase.\n");
1247 exit(1);
1248 }
Damien Miller95def091999-11-25 00:26:21 +11001249 }
1250 printf("Key has comment '%s'\n", comment);
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001251
Damien Miller95def091999-11-25 00:26:21 +11001252 /* Ask the new passphrase (twice). */
1253 if (identity_new_passphrase) {
1254 passphrase1 = xstrdup(identity_new_passphrase);
1255 passphrase2 = NULL;
1256 } else {
1257 passphrase1 =
Ben Lindstrom949974b2001-06-25 05:20:31 +00001258 read_passphrase("Enter new passphrase (empty for no "
1259 "passphrase): ", RP_ALLOW_STDIN);
1260 passphrase2 = read_passphrase("Enter same passphrase again: ",
Damien Miller9f0f5c62001-12-21 14:45:46 +11001261 RP_ALLOW_STDIN);
Damien Miller95def091999-11-25 00:26:21 +11001262
1263 /* Verify that they are the same. */
1264 if (strcmp(passphrase1, passphrase2) != 0) {
1265 memset(passphrase1, 0, strlen(passphrase1));
1266 memset(passphrase2, 0, strlen(passphrase2));
Darren Tuckera627d422013-06-02 07:31:17 +10001267 free(passphrase1);
1268 free(passphrase2);
Damien Miller95def091999-11-25 00:26:21 +11001269 printf("Pass phrases do not match. Try again.\n");
1270 exit(1);
1271 }
1272 /* Destroy the other copy. */
1273 memset(passphrase2, 0, strlen(passphrase2));
Darren Tuckera627d422013-06-02 07:31:17 +10001274 free(passphrase2);
Damien Miller95def091999-11-25 00:26:21 +11001275 }
1276
1277 /* Save the file using the new passphrase. */
Ben Lindstromd0fca422001-03-26 13:44:06 +00001278 if (!key_save_private(private, identity_file, passphrase1, comment)) {
Ben Lindstrom15f33862001-04-16 02:00:02 +00001279 printf("Saving the key failed: %s.\n", identity_file);
Damien Miller95def091999-11-25 00:26:21 +11001280 memset(passphrase1, 0, strlen(passphrase1));
Darren Tuckera627d422013-06-02 07:31:17 +10001281 free(passphrase1);
Damien Millereba71ba2000-04-29 23:57:08 +10001282 key_free(private);
Darren Tuckera627d422013-06-02 07:31:17 +10001283 free(comment);
Damien Miller95def091999-11-25 00:26:21 +11001284 exit(1);
1285 }
1286 /* Destroy the passphrase and the copy of the key in memory. */
1287 memset(passphrase1, 0, strlen(passphrase1));
Darren Tuckera627d422013-06-02 07:31:17 +10001288 free(passphrase1);
Damien Millereba71ba2000-04-29 23:57:08 +10001289 key_free(private); /* Destroys contents */
Darren Tuckera627d422013-06-02 07:31:17 +10001290 free(comment);
Damien Miller95def091999-11-25 00:26:21 +11001291
1292 printf("Your identification has been saved with the new passphrase.\n");
1293 exit(0);
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001294}
1295
Damien Miller37876e92003-05-15 10:19:46 +10001296/*
1297 * Print the SSHFP RR.
1298 */
Damien Millercb314822006-03-26 13:48:01 +11001299static int
1300do_print_resource_record(struct passwd *pw, char *fname, char *hname)
Damien Miller37876e92003-05-15 10:19:46 +10001301{
1302 Key *public;
1303 char *comment = NULL;
1304 struct stat st;
1305
Damien Millercb314822006-03-26 13:48:01 +11001306 if (fname == NULL)
Damien Miller5bb88332013-07-18 16:13:37 +10001307 fatal("%s: no filename", __func__);
Damien Millercb314822006-03-26 13:48:01 +11001308 if (stat(fname, &st) < 0) {
1309 if (errno == ENOENT)
1310 return 0;
1311 perror(fname);
Damien Miller37876e92003-05-15 10:19:46 +10001312 exit(1);
1313 }
Damien Millercb314822006-03-26 13:48:01 +11001314 public = key_load_public(fname, &comment);
Damien Miller37876e92003-05-15 10:19:46 +10001315 if (public != NULL) {
Darren Tucker3f9fdc72004-06-22 12:56:01 +10001316 export_dns_rr(hname, public, stdout, print_generic);
Damien Miller37876e92003-05-15 10:19:46 +10001317 key_free(public);
Darren Tuckera627d422013-06-02 07:31:17 +10001318 free(comment);
Damien Millercb314822006-03-26 13:48:01 +11001319 return 1;
Damien Miller37876e92003-05-15 10:19:46 +10001320 }
1321 if (comment)
Darren Tuckera627d422013-06-02 07:31:17 +10001322 free(comment);
Damien Miller37876e92003-05-15 10:19:46 +10001323
Damien Millercb314822006-03-26 13:48:01 +11001324 printf("failed to read v2 public key from %s.\n", fname);
Damien Miller37876e92003-05-15 10:19:46 +10001325 exit(1);
1326}
Damien Miller37876e92003-05-15 10:19:46 +10001327
Damien Miller95def091999-11-25 00:26:21 +11001328/*
1329 * Change the comment of a private key file.
1330 */
Ben Lindstrombba81212001-06-25 05:01:22 +00001331static void
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001332do_change_comment(struct passwd *pw)
1333{
Ben Lindstrom5fc62702001-03-09 18:19:24 +00001334 char new_comment[1024], *comment, *passphrase;
Ben Lindstromd0fca422001-03-26 13:44:06 +00001335 Key *private;
1336 Key *public;
Damien Miller95def091999-11-25 00:26:21 +11001337 struct stat st;
1338 FILE *f;
Ben Lindstrom5fc62702001-03-09 18:19:24 +00001339 int fd;
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001340
Damien Miller95def091999-11-25 00:26:21 +11001341 if (!have_identity)
1342 ask_filename(pw, "Enter file in which the key is");
Damien Miller95def091999-11-25 00:26:21 +11001343 if (stat(identity_file, &st) < 0) {
1344 perror(identity_file);
1345 exit(1);
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001346 }
Ben Lindstromd0fca422001-03-26 13:44:06 +00001347 private = key_load_private(identity_file, "", &comment);
1348 if (private == NULL) {
Damien Miller95def091999-11-25 00:26:21 +11001349 if (identity_passphrase)
1350 passphrase = xstrdup(identity_passphrase);
1351 else if (identity_new_passphrase)
1352 passphrase = xstrdup(identity_new_passphrase);
1353 else
Ben Lindstrom949974b2001-06-25 05:20:31 +00001354 passphrase = read_passphrase("Enter passphrase: ",
1355 RP_ALLOW_STDIN);
Damien Miller95def091999-11-25 00:26:21 +11001356 /* Try to load using the passphrase. */
Ben Lindstromd0fca422001-03-26 13:44:06 +00001357 private = key_load_private(identity_file, passphrase, &comment);
1358 if (private == NULL) {
Damien Miller95def091999-11-25 00:26:21 +11001359 memset(passphrase, 0, strlen(passphrase));
Darren Tuckera627d422013-06-02 07:31:17 +10001360 free(passphrase);
Damien Miller95def091999-11-25 00:26:21 +11001361 printf("Bad passphrase.\n");
1362 exit(1);
1363 }
Ben Lindstromd0fca422001-03-26 13:44:06 +00001364 } else {
1365 passphrase = xstrdup("");
Damien Miller95def091999-11-25 00:26:21 +11001366 }
Ben Lindstromd0fca422001-03-26 13:44:06 +00001367 if (private->type != KEY_RSA1) {
1368 fprintf(stderr, "Comments are only supported for RSA1 keys.\n");
1369 key_free(private);
1370 exit(1);
Damien Miller9f0f5c62001-12-21 14:45:46 +11001371 }
Damien Miller95def091999-11-25 00:26:21 +11001372 printf("Key now has comment '%s'\n", comment);
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001373
Damien Miller95def091999-11-25 00:26:21 +11001374 if (identity_comment) {
1375 strlcpy(new_comment, identity_comment, sizeof(new_comment));
1376 } else {
1377 printf("Enter new comment: ");
1378 fflush(stdout);
1379 if (!fgets(new_comment, sizeof(new_comment), stdin)) {
1380 memset(passphrase, 0, strlen(passphrase));
Damien Millereba71ba2000-04-29 23:57:08 +10001381 key_free(private);
Damien Miller95def091999-11-25 00:26:21 +11001382 exit(1);
1383 }
Damien Miller14b017d2007-09-17 16:09:15 +10001384 new_comment[strcspn(new_comment, "\n")] = '\0';
Damien Miller95def091999-11-25 00:26:21 +11001385 }
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001386
Damien Miller95def091999-11-25 00:26:21 +11001387 /* Save the file using the new passphrase. */
Ben Lindstromd0fca422001-03-26 13:44:06 +00001388 if (!key_save_private(private, identity_file, passphrase, new_comment)) {
Ben Lindstrom15f33862001-04-16 02:00:02 +00001389 printf("Saving the key failed: %s.\n", identity_file);
Damien Miller95def091999-11-25 00:26:21 +11001390 memset(passphrase, 0, strlen(passphrase));
Darren Tuckera627d422013-06-02 07:31:17 +10001391 free(passphrase);
Damien Millereba71ba2000-04-29 23:57:08 +10001392 key_free(private);
Darren Tuckera627d422013-06-02 07:31:17 +10001393 free(comment);
Damien Miller95def091999-11-25 00:26:21 +11001394 exit(1);
1395 }
Damien Miller95def091999-11-25 00:26:21 +11001396 memset(passphrase, 0, strlen(passphrase));
Darren Tuckera627d422013-06-02 07:31:17 +10001397 free(passphrase);
Ben Lindstromd0fca422001-03-26 13:44:06 +00001398 public = key_from_private(private);
Damien Millereba71ba2000-04-29 23:57:08 +10001399 key_free(private);
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001400
Damien Miller95def091999-11-25 00:26:21 +11001401 strlcat(identity_file, ".pub", sizeof(identity_file));
Ben Lindstrom5fc62702001-03-09 18:19:24 +00001402 fd = open(identity_file, O_WRONLY | O_CREAT | O_TRUNC, 0644);
1403 if (fd == -1) {
Damien Miller95def091999-11-25 00:26:21 +11001404 printf("Could not save your public key in %s\n", identity_file);
1405 exit(1);
1406 }
Ben Lindstrom5fc62702001-03-09 18:19:24 +00001407 f = fdopen(fd, "w");
1408 if (f == NULL) {
Damien Miller9eab9562009-02-22 08:47:02 +11001409 printf("fdopen %s failed\n", identity_file);
Ben Lindstrom5fc62702001-03-09 18:19:24 +00001410 exit(1);
1411 }
Damien Millereba71ba2000-04-29 23:57:08 +10001412 if (!key_write(public, f))
Damien Miller9eab9562009-02-22 08:47:02 +11001413 fprintf(stderr, "write key failed\n");
Damien Millereba71ba2000-04-29 23:57:08 +10001414 key_free(public);
1415 fprintf(f, " %s\n", new_comment);
Damien Miller95def091999-11-25 00:26:21 +11001416 fclose(f);
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001417
Darren Tuckera627d422013-06-02 07:31:17 +10001418 free(comment);
Damien Miller95def091999-11-25 00:26:21 +11001419
1420 printf("The comment in your key file has been changed.\n");
1421 exit(0);
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001422}
1423
Damien Miller0a80ca12010-02-27 07:55:05 +11001424static const char *
Damien Millerf2b70ca2010-03-05 07:39:35 +11001425fmt_validity(u_int64_t valid_from, u_int64_t valid_to)
Damien Miller0a80ca12010-02-27 07:55:05 +11001426{
1427 char from[32], to[32];
1428 static char ret[64];
1429 time_t tt;
1430 struct tm *tm;
1431
1432 *from = *to = '\0';
Damien Millerf2b70ca2010-03-05 07:39:35 +11001433 if (valid_from == 0 && valid_to == 0xffffffffffffffffULL)
Damien Miller0a80ca12010-02-27 07:55:05 +11001434 return "forever";
1435
Damien Millerf2b70ca2010-03-05 07:39:35 +11001436 if (valid_from != 0) {
Damien Miller0a80ca12010-02-27 07:55:05 +11001437 /* XXX revisit INT_MAX in 2038 :) */
Damien Millerf2b70ca2010-03-05 07:39:35 +11001438 tt = valid_from > INT_MAX ? INT_MAX : valid_from;
Damien Miller0a80ca12010-02-27 07:55:05 +11001439 tm = localtime(&tt);
1440 strftime(from, sizeof(from), "%Y-%m-%dT%H:%M:%S", tm);
1441 }
Damien Millerf2b70ca2010-03-05 07:39:35 +11001442 if (valid_to != 0xffffffffffffffffULL) {
Damien Miller0a80ca12010-02-27 07:55:05 +11001443 /* XXX revisit INT_MAX in 2038 :) */
Damien Millerf2b70ca2010-03-05 07:39:35 +11001444 tt = valid_to > INT_MAX ? INT_MAX : valid_to;
Damien Miller0a80ca12010-02-27 07:55:05 +11001445 tm = localtime(&tt);
1446 strftime(to, sizeof(to), "%Y-%m-%dT%H:%M:%S", tm);
1447 }
1448
Damien Millerf2b70ca2010-03-05 07:39:35 +11001449 if (valid_from == 0) {
Damien Miller0a80ca12010-02-27 07:55:05 +11001450 snprintf(ret, sizeof(ret), "before %s", to);
1451 return ret;
1452 }
Damien Millerf2b70ca2010-03-05 07:39:35 +11001453 if (valid_to == 0xffffffffffffffffULL) {
Damien Miller0a80ca12010-02-27 07:55:05 +11001454 snprintf(ret, sizeof(ret), "after %s", from);
1455 return ret;
1456 }
1457
1458 snprintf(ret, sizeof(ret), "from %s to %s", from, to);
1459 return ret;
1460}
1461
1462static void
Damien Miller4e270b02010-04-16 15:56:21 +10001463add_flag_option(Buffer *c, const char *name)
Damien Miller0a80ca12010-02-27 07:55:05 +11001464{
1465 debug3("%s: %s", __func__, name);
1466 buffer_put_cstring(c, name);
1467 buffer_put_string(c, NULL, 0);
1468}
1469
1470static void
Damien Miller4e270b02010-04-16 15:56:21 +10001471add_string_option(Buffer *c, const char *name, const char *value)
Damien Miller0a80ca12010-02-27 07:55:05 +11001472{
1473 Buffer b;
1474
1475 debug3("%s: %s=%s", __func__, name, value);
1476 buffer_init(&b);
1477 buffer_put_cstring(&b, value);
1478
1479 buffer_put_cstring(c, name);
1480 buffer_put_string(c, buffer_ptr(&b), buffer_len(&b));
1481
1482 buffer_free(&b);
1483}
1484
Damien Millerd0e4a8e2010-05-21 14:58:32 +10001485#define OPTIONS_CRITICAL 1
1486#define OPTIONS_EXTENSIONS 2
Damien Miller0a80ca12010-02-27 07:55:05 +11001487static void
Damien Millerd0e4a8e2010-05-21 14:58:32 +10001488prepare_options_buf(Buffer *c, int which)
Damien Miller0a80ca12010-02-27 07:55:05 +11001489{
Damien Miller0a80ca12010-02-27 07:55:05 +11001490 buffer_clear(c);
Damien Miller1da63882010-08-05 13:03:51 +10001491 if ((which & OPTIONS_CRITICAL) != 0 &&
1492 certflags_command != NULL)
1493 add_string_option(c, "force-command", certflags_command);
Damien Millerd0e4a8e2010-05-21 14:58:32 +10001494 if ((which & OPTIONS_EXTENSIONS) != 0 &&
Damien Miller2ce12ef2011-05-05 14:17:18 +10001495 (certflags_flags & CERTOPT_X_FWD) != 0)
1496 add_flag_option(c, "permit-X11-forwarding");
1497 if ((which & OPTIONS_EXTENSIONS) != 0 &&
Damien Millerd0e4a8e2010-05-21 14:58:32 +10001498 (certflags_flags & CERTOPT_AGENT_FWD) != 0)
Damien Miller4e270b02010-04-16 15:56:21 +10001499 add_flag_option(c, "permit-agent-forwarding");
Damien Millerd0e4a8e2010-05-21 14:58:32 +10001500 if ((which & OPTIONS_EXTENSIONS) != 0 &&
1501 (certflags_flags & CERTOPT_PORT_FWD) != 0)
Damien Miller4e270b02010-04-16 15:56:21 +10001502 add_flag_option(c, "permit-port-forwarding");
Damien Millerd0e4a8e2010-05-21 14:58:32 +10001503 if ((which & OPTIONS_EXTENSIONS) != 0 &&
1504 (certflags_flags & CERTOPT_PTY) != 0)
Damien Miller4e270b02010-04-16 15:56:21 +10001505 add_flag_option(c, "permit-pty");
Damien Millerd0e4a8e2010-05-21 14:58:32 +10001506 if ((which & OPTIONS_EXTENSIONS) != 0 &&
1507 (certflags_flags & CERTOPT_USER_RC) != 0)
Damien Miller4e270b02010-04-16 15:56:21 +10001508 add_flag_option(c, "permit-user-rc");
Damien Millerd0e4a8e2010-05-21 14:58:32 +10001509 if ((which & OPTIONS_CRITICAL) != 0 &&
1510 certflags_src_addr != NULL)
1511 add_string_option(c, "source-address", certflags_src_addr);
Damien Miller0a80ca12010-02-27 07:55:05 +11001512}
1513
Damien Miller757f34e2010-08-05 13:05:31 +10001514static Key *
1515load_pkcs11_key(char *path)
1516{
1517#ifdef ENABLE_PKCS11
1518 Key **keys = NULL, *public, *private = NULL;
1519 int i, nkeys;
1520
1521 if ((public = key_load_public(path, NULL)) == NULL)
1522 fatal("Couldn't load CA public key \"%s\"", path);
1523
1524 nkeys = pkcs11_add_provider(pkcs11provider, identity_passphrase, &keys);
1525 debug3("%s: %d keys", __func__, nkeys);
1526 if (nkeys <= 0)
1527 fatal("cannot read public key from pkcs11");
1528 for (i = 0; i < nkeys; i++) {
1529 if (key_equal_public(public, keys[i])) {
1530 private = keys[i];
1531 continue;
1532 }
1533 key_free(keys[i]);
1534 }
Darren Tuckera627d422013-06-02 07:31:17 +10001535 free(keys);
Damien Miller757f34e2010-08-05 13:05:31 +10001536 key_free(public);
1537 return private;
1538#else
1539 fatal("no pkcs11 support");
1540#endif /* ENABLE_PKCS11 */
1541}
1542
Damien Miller0a80ca12010-02-27 07:55:05 +11001543static void
1544do_ca_sign(struct passwd *pw, int argc, char **argv)
1545{
1546 int i, fd;
1547 u_int n;
1548 Key *ca, *public;
1549 char *otmp, *tmp, *cp, *out, *comment, **plist = NULL;
1550 FILE *f;
Damien Miller4e270b02010-04-16 15:56:21 +10001551 int v00 = 0; /* legacy keys */
Damien Miller0a80ca12010-02-27 07:55:05 +11001552
Damien Miller4e270b02010-04-16 15:56:21 +10001553 if (key_type_name != NULL) {
1554 switch (key_type_from_name(key_type_name)) {
1555 case KEY_RSA_CERT_V00:
1556 case KEY_DSA_CERT_V00:
1557 v00 = 1;
1558 break;
1559 case KEY_UNSPEC:
1560 if (strcasecmp(key_type_name, "v00") == 0) {
1561 v00 = 1;
1562 break;
1563 } else if (strcasecmp(key_type_name, "v01") == 0)
1564 break;
1565 /* FALLTHROUGH */
1566 default:
1567 fprintf(stderr, "unknown key type %s\n", key_type_name);
1568 exit(1);
1569 }
1570 }
1571
Damien Miller757f34e2010-08-05 13:05:31 +10001572 pkcs11_init(1);
1573 tmp = tilde_expand_filename(ca_key_path, pw->pw_uid);
1574 if (pkcs11provider != NULL) {
1575 if ((ca = load_pkcs11_key(tmp)) == NULL)
1576 fatal("No PKCS#11 key matching %s found", ca_key_path);
1577 } else if ((ca = load_identity(tmp)) == NULL)
1578 fatal("Couldn't load CA key \"%s\"", tmp);
Darren Tuckera627d422013-06-02 07:31:17 +10001579 free(tmp);
Damien Miller757f34e2010-08-05 13:05:31 +10001580
Damien Miller0a80ca12010-02-27 07:55:05 +11001581 for (i = 0; i < argc; i++) {
1582 /* Split list of principals */
1583 n = 0;
1584 if (cert_principals != NULL) {
1585 otmp = tmp = xstrdup(cert_principals);
1586 plist = NULL;
1587 for (; (cp = strsep(&tmp, ",")) != NULL; n++) {
1588 plist = xrealloc(plist, n + 1, sizeof(*plist));
1589 if (*(plist[n] = xstrdup(cp)) == '\0')
1590 fatal("Empty principal name");
1591 }
Darren Tuckera627d422013-06-02 07:31:17 +10001592 free(otmp);
Damien Miller0a80ca12010-02-27 07:55:05 +11001593 }
1594
1595 tmp = tilde_expand_filename(argv[i], pw->pw_uid);
1596 if ((public = key_load_public(tmp, &comment)) == NULL)
1597 fatal("%s: unable to open \"%s\"", __func__, tmp);
Damien Millereb8b60e2010-08-31 22:41:14 +10001598 if (public->type != KEY_RSA && public->type != KEY_DSA &&
1599 public->type != KEY_ECDSA)
Damien Miller0a80ca12010-02-27 07:55:05 +11001600 fatal("%s: key \"%s\" type %s cannot be certified",
1601 __func__, tmp, key_type(public));
1602
1603 /* Prepare certificate to sign */
Damien Miller4e270b02010-04-16 15:56:21 +10001604 if (key_to_certified(public, v00) != 0)
Damien Miller0a80ca12010-02-27 07:55:05 +11001605 fatal("Could not upgrade key %s to certificate", tmp);
1606 public->cert->type = cert_key_type;
Damien Miller4e270b02010-04-16 15:56:21 +10001607 public->cert->serial = (u_int64_t)cert_serial;
Damien Miller0a80ca12010-02-27 07:55:05 +11001608 public->cert->key_id = xstrdup(cert_key_id);
1609 public->cert->nprincipals = n;
1610 public->cert->principals = plist;
1611 public->cert->valid_after = cert_valid_from;
1612 public->cert->valid_before = cert_valid_to;
Damien Millerd0e4a8e2010-05-21 14:58:32 +10001613 if (v00) {
1614 prepare_options_buf(&public->cert->critical,
1615 OPTIONS_CRITICAL|OPTIONS_EXTENSIONS);
1616 } else {
1617 prepare_options_buf(&public->cert->critical,
1618 OPTIONS_CRITICAL);
1619 prepare_options_buf(&public->cert->extensions,
1620 OPTIONS_EXTENSIONS);
1621 }
Damien Miller0a80ca12010-02-27 07:55:05 +11001622 public->cert->signature_key = key_from_private(ca);
1623
1624 if (key_certify(public, ca) != 0)
1625 fatal("Couldn't not certify key %s", tmp);
1626
1627 if ((cp = strrchr(tmp, '.')) != NULL && strcmp(cp, ".pub") == 0)
1628 *cp = '\0';
1629 xasprintf(&out, "%s-cert.pub", tmp);
Darren Tuckera627d422013-06-02 07:31:17 +10001630 free(tmp);
Damien Miller0a80ca12010-02-27 07:55:05 +11001631
1632 if ((fd = open(out, O_WRONLY|O_CREAT|O_TRUNC, 0644)) == -1)
1633 fatal("Could not open \"%s\" for writing: %s", out,
1634 strerror(errno));
1635 if ((f = fdopen(fd, "w")) == NULL)
1636 fatal("%s: fdopen: %s", __func__, strerror(errno));
1637 if (!key_write(public, f))
1638 fatal("Could not write certified key to %s", out);
1639 fprintf(f, " %s\n", comment);
1640 fclose(f);
1641
Damien Miller4e270b02010-04-16 15:56:21 +10001642 if (!quiet) {
1643 logit("Signed %s key %s: id \"%s\" serial %llu%s%s "
1644 "valid %s", key_cert_type(public),
Damien Miller821de0a2011-01-11 17:20:29 +11001645 out, public->cert->key_id,
1646 (unsigned long long)public->cert->serial,
Damien Miller0a80ca12010-02-27 07:55:05 +11001647 cert_principals != NULL ? " for " : "",
1648 cert_principals != NULL ? cert_principals : "",
Damien Millerf2b70ca2010-03-05 07:39:35 +11001649 fmt_validity(cert_valid_from, cert_valid_to));
Damien Miller4e270b02010-04-16 15:56:21 +10001650 }
Damien Miller0a80ca12010-02-27 07:55:05 +11001651
1652 key_free(public);
Darren Tuckera627d422013-06-02 07:31:17 +10001653 free(out);
Damien Miller0a80ca12010-02-27 07:55:05 +11001654 }
Damien Miller757f34e2010-08-05 13:05:31 +10001655 pkcs11_terminate();
Damien Miller0a80ca12010-02-27 07:55:05 +11001656 exit(0);
1657}
1658
1659static u_int64_t
1660parse_relative_time(const char *s, time_t now)
1661{
1662 int64_t mul, secs;
1663
1664 mul = *s == '-' ? -1 : 1;
1665
1666 if ((secs = convtime(s + 1)) == -1)
1667 fatal("Invalid relative certificate time %s", s);
1668 if (mul == -1 && secs > now)
1669 fatal("Certificate time %s cannot be represented", s);
1670 return now + (u_int64_t)(secs * mul);
1671}
1672
1673static u_int64_t
1674parse_absolute_time(const char *s)
1675{
1676 struct tm tm;
1677 time_t tt;
Damien Miller2ca342b2010-03-03 12:14:15 +11001678 char buf[32], *fmt;
Damien Miller0a80ca12010-02-27 07:55:05 +11001679
Damien Miller2ca342b2010-03-03 12:14:15 +11001680 /*
1681 * POSIX strptime says "The application shall ensure that there
1682 * is white-space or other non-alphanumeric characters between
1683 * any two conversion specifications" so arrange things this way.
1684 */
1685 switch (strlen(s)) {
1686 case 8:
Damien Miller3e1ee492010-03-08 09:24:11 +11001687 fmt = "%Y-%m-%d";
1688 snprintf(buf, sizeof(buf), "%.4s-%.2s-%.2s", s, s + 4, s + 6);
Damien Miller2ca342b2010-03-03 12:14:15 +11001689 break;
1690 case 14:
Damien Miller3e1ee492010-03-08 09:24:11 +11001691 fmt = "%Y-%m-%dT%H:%M:%S";
1692 snprintf(buf, sizeof(buf), "%.4s-%.2s-%.2sT%.2s:%.2s:%.2s",
Damien Miller2ca342b2010-03-03 12:14:15 +11001693 s, s + 4, s + 6, s + 8, s + 10, s + 12);
1694 break;
1695 default:
Damien Miller0a80ca12010-02-27 07:55:05 +11001696 fatal("Invalid certificate time format %s", s);
Damien Miller2ca342b2010-03-03 12:14:15 +11001697 }
Damien Miller0a80ca12010-02-27 07:55:05 +11001698
1699 bzero(&tm, sizeof(tm));
Damien Miller2ca342b2010-03-03 12:14:15 +11001700 if (strptime(buf, fmt, &tm) == NULL)
Damien Miller0a80ca12010-02-27 07:55:05 +11001701 fatal("Invalid certificate time %s", s);
1702 if ((tt = mktime(&tm)) < 0)
1703 fatal("Certificate time %s cannot be represented", s);
1704 return (u_int64_t)tt;
1705}
1706
1707static void
1708parse_cert_times(char *timespec)
1709{
1710 char *from, *to;
1711 time_t now = time(NULL);
1712 int64_t secs;
1713
1714 /* +timespec relative to now */
1715 if (*timespec == '+' && strchr(timespec, ':') == NULL) {
1716 if ((secs = convtime(timespec + 1)) == -1)
1717 fatal("Invalid relative certificate life %s", timespec);
1718 cert_valid_to = now + secs;
1719 /*
1720 * Backdate certificate one minute to avoid problems on hosts
1721 * with poorly-synchronised clocks.
1722 */
1723 cert_valid_from = ((now - 59)/ 60) * 60;
1724 return;
1725 }
1726
1727 /*
1728 * from:to, where
1729 * from := [+-]timespec | YYYYMMDD | YYYYMMDDHHMMSS
1730 * to := [+-]timespec | YYYYMMDD | YYYYMMDDHHMMSS
1731 */
1732 from = xstrdup(timespec);
1733 to = strchr(from, ':');
1734 if (to == NULL || from == to || *(to + 1) == '\0')
Damien Miller910f2092010-03-04 14:17:22 +11001735 fatal("Invalid certificate life specification %s", timespec);
Damien Miller0a80ca12010-02-27 07:55:05 +11001736 *to++ = '\0';
1737
1738 if (*from == '-' || *from == '+')
1739 cert_valid_from = parse_relative_time(from, now);
1740 else
1741 cert_valid_from = parse_absolute_time(from);
1742
1743 if (*to == '-' || *to == '+')
Damien Miller5b01b0d2013-10-23 16:31:31 +11001744 cert_valid_to = parse_relative_time(to, now);
Damien Miller0a80ca12010-02-27 07:55:05 +11001745 else
1746 cert_valid_to = parse_absolute_time(to);
1747
1748 if (cert_valid_to <= cert_valid_from)
1749 fatal("Empty certificate validity interval");
Darren Tuckera627d422013-06-02 07:31:17 +10001750 free(from);
Damien Miller0a80ca12010-02-27 07:55:05 +11001751}
1752
1753static void
Damien Miller4e270b02010-04-16 15:56:21 +10001754add_cert_option(char *opt)
Damien Miller0a80ca12010-02-27 07:55:05 +11001755{
1756 char *val;
1757
Damien Miller044f4a62011-05-05 14:14:08 +10001758 if (strcasecmp(opt, "clear") == 0)
Damien Millerd0e4a8e2010-05-21 14:58:32 +10001759 certflags_flags = 0;
Damien Miller0a80ca12010-02-27 07:55:05 +11001760 else if (strcasecmp(opt, "no-x11-forwarding") == 0)
Damien Millerd0e4a8e2010-05-21 14:58:32 +10001761 certflags_flags &= ~CERTOPT_X_FWD;
Damien Miller0a80ca12010-02-27 07:55:05 +11001762 else if (strcasecmp(opt, "permit-x11-forwarding") == 0)
Damien Millerd0e4a8e2010-05-21 14:58:32 +10001763 certflags_flags |= CERTOPT_X_FWD;
Damien Miller0a80ca12010-02-27 07:55:05 +11001764 else if (strcasecmp(opt, "no-agent-forwarding") == 0)
Damien Millerd0e4a8e2010-05-21 14:58:32 +10001765 certflags_flags &= ~CERTOPT_AGENT_FWD;
Damien Miller0a80ca12010-02-27 07:55:05 +11001766 else if (strcasecmp(opt, "permit-agent-forwarding") == 0)
Damien Millerd0e4a8e2010-05-21 14:58:32 +10001767 certflags_flags |= CERTOPT_AGENT_FWD;
Damien Miller0a80ca12010-02-27 07:55:05 +11001768 else if (strcasecmp(opt, "no-port-forwarding") == 0)
Damien Millerd0e4a8e2010-05-21 14:58:32 +10001769 certflags_flags &= ~CERTOPT_PORT_FWD;
Damien Miller0a80ca12010-02-27 07:55:05 +11001770 else if (strcasecmp(opt, "permit-port-forwarding") == 0)
Damien Millerd0e4a8e2010-05-21 14:58:32 +10001771 certflags_flags |= CERTOPT_PORT_FWD;
Damien Miller0a80ca12010-02-27 07:55:05 +11001772 else if (strcasecmp(opt, "no-pty") == 0)
Damien Millerd0e4a8e2010-05-21 14:58:32 +10001773 certflags_flags &= ~CERTOPT_PTY;
Damien Miller0a80ca12010-02-27 07:55:05 +11001774 else if (strcasecmp(opt, "permit-pty") == 0)
Damien Millerd0e4a8e2010-05-21 14:58:32 +10001775 certflags_flags |= CERTOPT_PTY;
Damien Miller0a80ca12010-02-27 07:55:05 +11001776 else if (strcasecmp(opt, "no-user-rc") == 0)
Damien Millerd0e4a8e2010-05-21 14:58:32 +10001777 certflags_flags &= ~CERTOPT_USER_RC;
Damien Miller0a80ca12010-02-27 07:55:05 +11001778 else if (strcasecmp(opt, "permit-user-rc") == 0)
Damien Millerd0e4a8e2010-05-21 14:58:32 +10001779 certflags_flags |= CERTOPT_USER_RC;
Damien Miller0a80ca12010-02-27 07:55:05 +11001780 else if (strncasecmp(opt, "force-command=", 14) == 0) {
1781 val = opt + 14;
1782 if (*val == '\0')
Damien Miller4e270b02010-04-16 15:56:21 +10001783 fatal("Empty force-command option");
Damien Millerd0e4a8e2010-05-21 14:58:32 +10001784 if (certflags_command != NULL)
Damien Miller0a80ca12010-02-27 07:55:05 +11001785 fatal("force-command already specified");
Damien Millerd0e4a8e2010-05-21 14:58:32 +10001786 certflags_command = xstrdup(val);
Damien Miller0a80ca12010-02-27 07:55:05 +11001787 } else if (strncasecmp(opt, "source-address=", 15) == 0) {
1788 val = opt + 15;
1789 if (*val == '\0')
Damien Miller4e270b02010-04-16 15:56:21 +10001790 fatal("Empty source-address option");
Damien Millerd0e4a8e2010-05-21 14:58:32 +10001791 if (certflags_src_addr != NULL)
Damien Miller0a80ca12010-02-27 07:55:05 +11001792 fatal("source-address already specified");
1793 if (addr_match_cidr_list(NULL, val) != 0)
1794 fatal("Invalid source-address list");
Damien Millerd0e4a8e2010-05-21 14:58:32 +10001795 certflags_src_addr = xstrdup(val);
Damien Miller0a80ca12010-02-27 07:55:05 +11001796 } else
Damien Miller4e270b02010-04-16 15:56:21 +10001797 fatal("Unsupported certificate option \"%s\"", opt);
Damien Miller0a80ca12010-02-27 07:55:05 +11001798}
1799
Ben Lindstrombba81212001-06-25 05:01:22 +00001800static void
Damien Millerd834d352010-06-26 09:48:02 +10001801show_options(const Buffer *optbuf, int v00, int in_critical)
1802{
Damien Miller746d1a62013-07-18 16:13:02 +10001803 char *name;
1804 u_char *data;
Damien Millerd834d352010-06-26 09:48:02 +10001805 u_int dlen;
1806 Buffer options, option;
1807
1808 buffer_init(&options);
1809 buffer_append(&options, buffer_ptr(optbuf), buffer_len(optbuf));
1810
1811 buffer_init(&option);
1812 while (buffer_len(&options) != 0) {
1813 name = buffer_get_string(&options, NULL);
1814 data = buffer_get_string_ptr(&options, &dlen);
1815 buffer_append(&option, data, dlen);
1816 printf(" %s", name);
1817 if ((v00 || !in_critical) &&
1818 (strcmp(name, "permit-X11-forwarding") == 0 ||
1819 strcmp(name, "permit-agent-forwarding") == 0 ||
1820 strcmp(name, "permit-port-forwarding") == 0 ||
1821 strcmp(name, "permit-pty") == 0 ||
1822 strcmp(name, "permit-user-rc") == 0))
1823 printf("\n");
1824 else if ((v00 || in_critical) &&
1825 (strcmp(name, "force-command") == 0 ||
1826 strcmp(name, "source-address") == 0)) {
1827 data = buffer_get_string(&option, NULL);
1828 printf(" %s\n", data);
Darren Tuckera627d422013-06-02 07:31:17 +10001829 free(data);
Damien Millerd834d352010-06-26 09:48:02 +10001830 } else {
1831 printf(" UNKNOWN OPTION (len %u)\n",
1832 buffer_len(&option));
1833 buffer_clear(&option);
1834 }
Darren Tuckera627d422013-06-02 07:31:17 +10001835 free(name);
Damien Millerd834d352010-06-26 09:48:02 +10001836 if (buffer_len(&option) != 0)
1837 fatal("Option corrupt: extra data at end");
1838 }
1839 buffer_free(&option);
1840 buffer_free(&options);
1841}
1842
1843static void
Damien Millerf2b70ca2010-03-05 07:39:35 +11001844do_show_cert(struct passwd *pw)
1845{
1846 Key *key;
1847 struct stat st;
1848 char *key_fp, *ca_fp;
Damien Millerd834d352010-06-26 09:48:02 +10001849 u_int i, v00;
Damien Millerf2b70ca2010-03-05 07:39:35 +11001850
1851 if (!have_identity)
1852 ask_filename(pw, "Enter file in which the key is");
Damien Millerba3420a2010-06-26 09:39:07 +10001853 if (stat(identity_file, &st) < 0)
1854 fatal("%s: %s: %s", __progname, identity_file, strerror(errno));
Damien Millerf2b70ca2010-03-05 07:39:35 +11001855 if ((key = key_load_public(identity_file, NULL)) == NULL)
1856 fatal("%s is not a public key", identity_file);
1857 if (!key_is_cert(key))
1858 fatal("%s is not a certificate", identity_file);
Damien Miller4e270b02010-04-16 15:56:21 +10001859 v00 = key->type == KEY_RSA_CERT_V00 || key->type == KEY_DSA_CERT_V00;
1860
Damien Millerf2b70ca2010-03-05 07:39:35 +11001861 key_fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
1862 ca_fp = key_fingerprint(key->cert->signature_key,
1863 SSH_FP_MD5, SSH_FP_HEX);
1864
1865 printf("%s:\n", identity_file);
Damien Miller4e270b02010-04-16 15:56:21 +10001866 printf(" Type: %s %s certificate\n", key_ssh_name(key),
1867 key_cert_type(key));
1868 printf(" Public key: %s %s\n", key_type(key), key_fp);
1869 printf(" Signing CA: %s %s\n",
Damien Millerf2b70ca2010-03-05 07:39:35 +11001870 key_type(key->cert->signature_key), ca_fp);
Damien Miller4e270b02010-04-16 15:56:21 +10001871 printf(" Key ID: \"%s\"\n", key->cert->key_id);
Damien Miller821de0a2011-01-11 17:20:29 +11001872 if (!v00) {
1873 printf(" Serial: %llu\n",
1874 (unsigned long long)key->cert->serial);
1875 }
Damien Millerf2b70ca2010-03-05 07:39:35 +11001876 printf(" Valid: %s\n",
1877 fmt_validity(key->cert->valid_after, key->cert->valid_before));
1878 printf(" Principals: ");
1879 if (key->cert->nprincipals == 0)
1880 printf("(none)\n");
1881 else {
1882 for (i = 0; i < key->cert->nprincipals; i++)
1883 printf("\n %s",
1884 key->cert->principals[i]);
1885 printf("\n");
1886 }
Damien Miller4e270b02010-04-16 15:56:21 +10001887 printf(" Critical Options: ");
1888 if (buffer_len(&key->cert->critical) == 0)
Damien Millerf2b70ca2010-03-05 07:39:35 +11001889 printf("(none)\n");
1890 else {
1891 printf("\n");
Damien Millerd834d352010-06-26 09:48:02 +10001892 show_options(&key->cert->critical, v00, 1);
Damien Millerf2b70ca2010-03-05 07:39:35 +11001893 }
Damien Miller4e270b02010-04-16 15:56:21 +10001894 if (!v00) {
1895 printf(" Extensions: ");
1896 if (buffer_len(&key->cert->extensions) == 0)
1897 printf("(none)\n");
1898 else {
1899 printf("\n");
Damien Millerd834d352010-06-26 09:48:02 +10001900 show_options(&key->cert->extensions, v00, 0);
Damien Miller4e270b02010-04-16 15:56:21 +10001901 }
1902 }
Damien Millerf2b70ca2010-03-05 07:39:35 +11001903 exit(0);
1904}
1905
1906static void
Damien Millerf3747bf2013-01-18 11:44:04 +11001907load_krl(const char *path, struct ssh_krl **krlp)
1908{
1909 Buffer krlbuf;
1910 int fd;
1911
1912 buffer_init(&krlbuf);
1913 if ((fd = open(path, O_RDONLY)) == -1)
1914 fatal("open %s: %s", path, strerror(errno));
1915 if (!key_load_file(fd, path, &krlbuf))
1916 fatal("Unable to load KRL");
1917 close(fd);
1918 /* XXX check sigs */
1919 if (ssh_krl_from_blob(&krlbuf, krlp, NULL, 0) != 0 ||
1920 *krlp == NULL)
1921 fatal("Invalid KRL file");
1922 buffer_free(&krlbuf);
1923}
1924
1925static void
1926update_krl_from_file(struct passwd *pw, const char *file, const Key *ca,
1927 struct ssh_krl *krl)
1928{
1929 Key *key = NULL;
1930 u_long lnum = 0;
1931 char *path, *cp, *ep, line[SSH_MAX_PUBKEY_BYTES];
1932 unsigned long long serial, serial2;
1933 int i, was_explicit_key, was_sha1, r;
1934 FILE *krl_spec;
1935
1936 path = tilde_expand_filename(file, pw->pw_uid);
1937 if (strcmp(path, "-") == 0) {
1938 krl_spec = stdin;
1939 free(path);
1940 path = xstrdup("(standard input)");
1941 } else if ((krl_spec = fopen(path, "r")) == NULL)
1942 fatal("fopen %s: %s", path, strerror(errno));
1943
1944 if (!quiet)
1945 printf("Revoking from %s\n", path);
1946 while (read_keyfile_line(krl_spec, path, line, sizeof(line),
1947 &lnum) == 0) {
1948 was_explicit_key = was_sha1 = 0;
1949 cp = line + strspn(line, " \t");
1950 /* Trim trailing space, comments and strip \n */
1951 for (i = 0, r = -1; cp[i] != '\0'; i++) {
1952 if (cp[i] == '#' || cp[i] == '\n') {
1953 cp[i] = '\0';
1954 break;
1955 }
1956 if (cp[i] == ' ' || cp[i] == '\t') {
1957 /* Remember the start of a span of whitespace */
1958 if (r == -1)
1959 r = i;
1960 } else
1961 r = -1;
1962 }
1963 if (r != -1)
1964 cp[r] = '\0';
1965 if (*cp == '\0')
1966 continue;
1967 if (strncasecmp(cp, "serial:", 7) == 0) {
1968 if (ca == NULL) {
Damien Millerd234afb2013-08-21 02:42:58 +10001969 fatal("revoking certificates by serial number "
Damien Millerf3747bf2013-01-18 11:44:04 +11001970 "requires specification of a CA key");
1971 }
1972 cp += 7;
1973 cp = cp + strspn(cp, " \t");
1974 errno = 0;
1975 serial = strtoull(cp, &ep, 0);
1976 if (*cp == '\0' || (*ep != '\0' && *ep != '-'))
1977 fatal("%s:%lu: invalid serial \"%s\"",
1978 path, lnum, cp);
1979 if (errno == ERANGE && serial == ULLONG_MAX)
1980 fatal("%s:%lu: serial out of range",
1981 path, lnum);
1982 serial2 = serial;
1983 if (*ep == '-') {
1984 cp = ep + 1;
1985 errno = 0;
1986 serial2 = strtoull(cp, &ep, 0);
1987 if (*cp == '\0' || *ep != '\0')
1988 fatal("%s:%lu: invalid serial \"%s\"",
1989 path, lnum, cp);
1990 if (errno == ERANGE && serial2 == ULLONG_MAX)
1991 fatal("%s:%lu: serial out of range",
1992 path, lnum);
1993 if (serial2 <= serial)
1994 fatal("%s:%lu: invalid serial range "
1995 "%llu:%llu", path, lnum,
1996 (unsigned long long)serial,
1997 (unsigned long long)serial2);
1998 }
1999 if (ssh_krl_revoke_cert_by_serial_range(krl,
2000 ca, serial, serial2) != 0) {
2001 fatal("%s: revoke serial failed",
2002 __func__);
2003 }
2004 } else if (strncasecmp(cp, "id:", 3) == 0) {
2005 if (ca == NULL) {
Damien Millerd5d9d7b2013-08-21 02:43:27 +10002006 fatal("revoking certificates by key ID "
Damien Millerf3747bf2013-01-18 11:44:04 +11002007 "requires specification of a CA key");
2008 }
2009 cp += 3;
2010 cp = cp + strspn(cp, " \t");
2011 if (ssh_krl_revoke_cert_by_key_id(krl, ca, cp) != 0)
2012 fatal("%s: revoke key ID failed", __func__);
2013 } else {
2014 if (strncasecmp(cp, "key:", 4) == 0) {
2015 cp += 4;
2016 cp = cp + strspn(cp, " \t");
2017 was_explicit_key = 1;
2018 } else if (strncasecmp(cp, "sha1:", 5) == 0) {
2019 cp += 5;
2020 cp = cp + strspn(cp, " \t");
2021 was_sha1 = 1;
2022 } else {
2023 /*
2024 * Just try to process the line as a key.
2025 * Parsing will fail if it isn't.
2026 */
2027 }
2028 if ((key = key_new(KEY_UNSPEC)) == NULL)
2029 fatal("key_new");
2030 if (key_read(key, &cp) != 1)
2031 fatal("%s:%lu: invalid key", path, lnum);
2032 if (was_explicit_key)
2033 r = ssh_krl_revoke_key_explicit(krl, key);
2034 else if (was_sha1)
2035 r = ssh_krl_revoke_key_sha1(krl, key);
2036 else
2037 r = ssh_krl_revoke_key(krl, key);
2038 if (r != 0)
2039 fatal("%s: revoke key failed", __func__);
2040 key_free(key);
2041 }
2042 }
2043 if (strcmp(path, "-") != 0)
2044 fclose(krl_spec);
Damien Miller0d6771b2013-04-23 15:23:24 +10002045 free(path);
Damien Millerf3747bf2013-01-18 11:44:04 +11002046}
2047
2048static void
2049do_gen_krl(struct passwd *pw, int updating, int argc, char **argv)
2050{
2051 struct ssh_krl *krl;
2052 struct stat sb;
2053 Key *ca = NULL;
2054 int fd, i;
2055 char *tmp;
2056 Buffer kbuf;
2057
2058 if (*identity_file == '\0')
2059 fatal("KRL generation requires an output file");
2060 if (stat(identity_file, &sb) == -1) {
2061 if (errno != ENOENT)
2062 fatal("Cannot access KRL \"%s\": %s",
2063 identity_file, strerror(errno));
2064 if (updating)
2065 fatal("KRL \"%s\" does not exist", identity_file);
2066 }
2067 if (ca_key_path != NULL) {
2068 tmp = tilde_expand_filename(ca_key_path, pw->pw_uid);
2069 if ((ca = key_load_public(tmp, NULL)) == NULL)
2070 fatal("Cannot load CA public key %s", tmp);
Darren Tuckera627d422013-06-02 07:31:17 +10002071 free(tmp);
Damien Millerf3747bf2013-01-18 11:44:04 +11002072 }
2073
2074 if (updating)
2075 load_krl(identity_file, &krl);
2076 else if ((krl = ssh_krl_init()) == NULL)
2077 fatal("couldn't create KRL");
2078
2079 if (cert_serial != 0)
2080 ssh_krl_set_version(krl, cert_serial);
2081 if (identity_comment != NULL)
2082 ssh_krl_set_comment(krl, identity_comment);
2083
2084 for (i = 0; i < argc; i++)
2085 update_krl_from_file(pw, argv[i], ca, krl);
2086
2087 buffer_init(&kbuf);
2088 if (ssh_krl_to_blob(krl, &kbuf, NULL, 0) != 0)
2089 fatal("Couldn't generate KRL");
2090 if ((fd = open(identity_file, O_WRONLY|O_CREAT|O_TRUNC, 0644)) == -1)
2091 fatal("open %s: %s", identity_file, strerror(errno));
2092 if (atomicio(vwrite, fd, buffer_ptr(&kbuf), buffer_len(&kbuf)) !=
2093 buffer_len(&kbuf))
2094 fatal("write %s: %s", identity_file, strerror(errno));
2095 close(fd);
2096 buffer_free(&kbuf);
2097 ssh_krl_free(krl);
Damien Miller0d6771b2013-04-23 15:23:24 +10002098 if (ca != NULL)
2099 key_free(ca);
Damien Millerf3747bf2013-01-18 11:44:04 +11002100}
2101
2102static void
2103do_check_krl(struct passwd *pw, int argc, char **argv)
2104{
2105 int i, r, ret = 0;
2106 char *comment;
2107 struct ssh_krl *krl;
2108 Key *k;
2109
2110 if (*identity_file == '\0')
2111 fatal("KRL checking requires an input file");
2112 load_krl(identity_file, &krl);
2113 for (i = 0; i < argc; i++) {
2114 if ((k = key_load_public(argv[i], &comment)) == NULL)
2115 fatal("Cannot load public key %s", argv[i]);
2116 r = ssh_krl_check_key(krl, k);
2117 printf("%s%s%s%s: %s\n", argv[i],
2118 *comment ? " (" : "", comment, *comment ? ")" : "",
2119 r == 0 ? "ok" : "REVOKED");
2120 if (r != 0)
2121 ret = 1;
2122 key_free(k);
2123 free(comment);
2124 }
2125 ssh_krl_free(krl);
2126 exit(ret);
2127}
2128
2129static void
Damien Miller431f66b1999-11-21 18:31:57 +11002130usage(void)
2131{
Damien Miller5cbe7ca2007-09-17 16:05:50 +10002132 fprintf(stderr, "usage: %s [options]\n", __progname);
Ben Lindstrom97be31e2001-08-06 21:49:06 +00002133 fprintf(stderr, "Options:\n");
Damien Miller58f1baf2011-05-05 14:06:15 +10002134 fprintf(stderr, " -A Generate non-existent host keys for all key types.\n");
Damien Miller9278ffa2005-05-26 11:59:06 +10002135 fprintf(stderr, " -a trials Number of trials for screening DH-GEX moduli.\n");
Ben Lindstrom97be31e2001-08-06 21:49:06 +00002136 fprintf(stderr, " -B Show bubblebabble digest of key file.\n");
Damien Miller9278ffa2005-05-26 11:59:06 +10002137 fprintf(stderr, " -b bits Number of bits in the key to create.\n");
Ben Lindstrom97be31e2001-08-06 21:49:06 +00002138 fprintf(stderr, " -C comment Provide new comment.\n");
Damien Miller9278ffa2005-05-26 11:59:06 +10002139 fprintf(stderr, " -c Change comment in private and public key files.\n");
Damien Miller7ea845e2010-02-12 09:21:02 +11002140#ifdef ENABLE_PKCS11
2141 fprintf(stderr, " -D pkcs11 Download public key from pkcs11 token.\n");
2142#endif
Damien Miller44b25042010-07-02 13:35:01 +10002143 fprintf(stderr, " -e Export OpenSSH to foreign format key file.\n");
Damien Miller9278ffa2005-05-26 11:59:06 +10002144 fprintf(stderr, " -F hostname Find hostname in known hosts file.\n");
2145 fprintf(stderr, " -f filename Filename of the key file.\n");
2146 fprintf(stderr, " -G file Generate candidates for DH-GEX moduli.\n");
2147 fprintf(stderr, " -g Use generic DNS resource record format.\n");
2148 fprintf(stderr, " -H Hash names in known_hosts file.\n");
Damien Miller0a80ca12010-02-27 07:55:05 +11002149 fprintf(stderr, " -h Generate host certificate instead of a user certificate.\n");
2150 fprintf(stderr, " -I key_id Key identifier to include in certificate.\n");
Damien Miller44b25042010-07-02 13:35:01 +10002151 fprintf(stderr, " -i Import foreign format to OpenSSH key file.\n");
Damien Miller709a1e92012-07-31 12:20:43 +10002152 fprintf(stderr, " -J number Screen this number of moduli lines.\n");
Damien Millerdfceafe2012-07-06 13:44:19 +10002153 fprintf(stderr, " -j number Start screening moduli at specified line.\n");
Damien Miller927d82b2011-10-18 16:05:38 +11002154 fprintf(stderr, " -K checkpt Write checkpoints to this file.\n");
Damien Millerf3747bf2013-01-18 11:44:04 +11002155 fprintf(stderr, " -k Generate a KRL file.\n");
Damien Millerf2b70ca2010-03-05 07:39:35 +11002156 fprintf(stderr, " -L Print the contents of a certificate.\n");
Damien Miller9278ffa2005-05-26 11:59:06 +10002157 fprintf(stderr, " -l Show fingerprint of key file.\n");
2158 fprintf(stderr, " -M memory Amount of memory (MB) to use for generating DH-GEX moduli.\n");
Damien Miller6022f582010-07-02 13:37:01 +10002159 fprintf(stderr, " -m key_fmt Conversion format for -e/-i (PEM|PKCS8|RFC4716).\n");
Damien Miller9278ffa2005-05-26 11:59:06 +10002160 fprintf(stderr, " -N phrase Provide new passphrase.\n");
Damien Miller6022f582010-07-02 13:37:01 +10002161 fprintf(stderr, " -n name,... User/host principal names to include in certificate\n");
Damien Miller1f181422010-04-18 08:08:03 +10002162 fprintf(stderr, " -O option Specify a certificate option.\n");
Damien Miller9278ffa2005-05-26 11:59:06 +10002163 fprintf(stderr, " -P phrase Provide old passphrase.\n");
2164 fprintf(stderr, " -p Change passphrase of private key file.\n");
Damien Millerf3747bf2013-01-18 11:44:04 +11002165 fprintf(stderr, " -Q Test whether key(s) are revoked in KRL.\n");
Damien Miller9278ffa2005-05-26 11:59:06 +10002166 fprintf(stderr, " -q Quiet.\n");
2167 fprintf(stderr, " -R hostname Remove host from known_hosts file.\n");
2168 fprintf(stderr, " -r hostname Print DNS resource record.\n");
2169 fprintf(stderr, " -S start Start point (hex) for generating DH-GEX moduli.\n");
Damien Miller6022f582010-07-02 13:37:01 +10002170 fprintf(stderr, " -s ca_key Certify keys with CA key.\n");
Damien Miller9278ffa2005-05-26 11:59:06 +10002171 fprintf(stderr, " -T file Screen candidates for DH-GEX moduli.\n");
2172 fprintf(stderr, " -t type Specify type of key to create.\n");
Damien Millerf3747bf2013-01-18 11:44:04 +11002173 fprintf(stderr, " -u Update KRL rather than creating a new one.\n");
Damien Miller3d6d68b2013-01-20 22:33:23 +11002174 fprintf(stderr, " -V from:to Specify certificate validity interval.\n");
Damien Miller9278ffa2005-05-26 11:59:06 +10002175 fprintf(stderr, " -v Verbose.\n");
2176 fprintf(stderr, " -W gen Generator to use for generating DH-GEX moduli.\n");
2177 fprintf(stderr, " -y Read private key file and print public key.\n");
Damien Miller1f181422010-04-18 08:08:03 +10002178 fprintf(stderr, " -z serial Specify a serial number.\n");
Darren Tucker019cefe2003-08-02 22:40:07 +10002179
Damien Miller95def091999-11-25 00:26:21 +11002180 exit(1);
Damien Miller431f66b1999-11-21 18:31:57 +11002181}
2182
Damien Miller95def091999-11-25 00:26:21 +11002183/*
2184 * Main program for key management.
2185 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +10002186int
Damien Millerdf8b7db2007-01-05 16:22:57 +11002187main(int argc, char **argv)
Damien Millerd4a8b7e1999-10-27 13:42:43 +10002188{
Damien Millera41c8b12002-01-22 23:05:08 +11002189 char dotsshdir[MAXPATHLEN], comment[1024], *passphrase1, *passphrase2;
Damien Miller390d0562011-10-18 16:05:19 +11002190 char *checkpoint = NULL;
Damien Millerf3747bf2013-01-18 11:44:04 +11002191 char out_file[MAXPATHLEN], *ep, *rr_hostname = NULL;
Ben Lindstrom5fc62702001-03-09 18:19:24 +00002192 Key *private, *public;
Damien Miller95def091999-11-25 00:26:21 +11002193 struct passwd *pw;
Damien Miller95def091999-11-25 00:26:21 +11002194 struct stat st;
Damien Miller7ea845e2010-02-12 09:21:02 +11002195 int opt, type, fd;
Darren Tucker2db8ae62005-06-01 23:02:25 +10002196 u_int32_t memory = 0, generator_wanted = 0, trials = 100;
Darren Tucker019cefe2003-08-02 22:40:07 +10002197 int do_gen_candidates = 0, do_screen_candidates = 0;
Damien Millerf3747bf2013-01-18 11:44:04 +11002198 int gen_all_hostkeys = 0, gen_krl = 0, update_krl = 0, check_krl = 0;
Damien Millerdfceafe2012-07-06 13:44:19 +10002199 unsigned long start_lineno = 0, lines_to_process = 0;
Darren Tucker019cefe2003-08-02 22:40:07 +10002200 BIGNUM *start = NULL;
Damien Miller95def091999-11-25 00:26:21 +11002201 FILE *f;
Damien Miller02e754f2005-05-26 12:19:39 +10002202 const char *errstr;
Damien Miller0bc1bd82000-11-13 22:57:25 +11002203
Damien Miller95def091999-11-25 00:26:21 +11002204 extern int optind;
2205 extern char *optarg;
Damien Millerd4a8b7e1999-10-27 13:42:43 +10002206
Darren Tuckerce321d82005-10-03 18:11:24 +10002207 /* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */
2208 sanitise_stdfd();
2209
Darren Tucker9ac56e92007-01-14 10:19:59 +11002210 __progname = ssh_get_progname(argv[0]);
Damien Millerf9b625c2000-07-09 22:42:32 +10002211
Damien Miller4314c2b2010-09-10 11:12:09 +10002212 OpenSSL_add_all_algorithms();
Damien Millerdf8b7db2007-01-05 16:22:57 +11002213 log_init(argv[0], SYSLOG_LEVEL_INFO, SYSLOG_FACILITY_USER, 1);
Darren Tucker019cefe2003-08-02 22:40:07 +10002214
Kevin Steves3a881912002-07-20 19:05:40 +00002215 seed_rng();
Damien Millereba71ba2000-04-29 23:57:08 +10002216
Damien Miller5428f641999-11-25 11:54:57 +11002217 /* we need this for the home * directory. */
Damien Miller95def091999-11-25 00:26:21 +11002218 pw = getpwuid(getuid());
2219 if (!pw) {
Damien Miller3009d3c2013-07-20 13:22:31 +10002220 printf("No user exists for uid %lu\n", (u_long)getuid());
Damien Miller95def091999-11-25 00:26:21 +11002221 exit(1);
Damien Millerd4a8b7e1999-10-27 13:42:43 +10002222 }
Damien Millereba71ba2000-04-29 23:57:08 +10002223 if (gethostname(hostname, sizeof(hostname)) < 0) {
2224 perror("gethostname");
2225 exit(1);
2226 }
Damien Miller5428f641999-11-25 11:54:57 +11002227
Damien Millerf3747bf2013-01-18 11:44:04 +11002228 while ((opt = getopt(argc, argv, "ABHLQXceghiklpquvxy"
2229 "C:D:F:G:I:J:K:M:N:O:P:R:S:T:V:W:a:b:f:g:j:m:n:r:s:t:z:")) != -1) {
Damien Miller95def091999-11-25 00:26:21 +11002230 switch (opt) {
Damien Miller58f1baf2011-05-05 14:06:15 +10002231 case 'A':
2232 gen_all_hostkeys = 1;
2233 break;
Damien Miller95def091999-11-25 00:26:21 +11002234 case 'b':
Damien Miller57737942010-09-10 11:16:37 +10002235 bits = (u_int32_t)strtonum(optarg, 256, 32768, &errstr);
Damien Miller02e754f2005-05-26 12:19:39 +10002236 if (errstr)
2237 fatal("Bits has bad value %s (%s)",
2238 optarg, errstr);
Damien Miller95def091999-11-25 00:26:21 +11002239 break;
Damien Miller4b42d7f2005-03-01 21:48:35 +11002240 case 'F':
2241 find_host = 1;
2242 rr_hostname = optarg;
2243 break;
2244 case 'H':
2245 hash_hosts = 1;
2246 break;
Damien Miller0a80ca12010-02-27 07:55:05 +11002247 case 'I':
2248 cert_key_id = optarg;
2249 break;
Damien Millerdfceafe2012-07-06 13:44:19 +10002250 case 'J':
2251 lines_to_process = strtoul(optarg, NULL, 10);
2252 break;
2253 case 'j':
2254 start_lineno = strtoul(optarg, NULL, 10);
2255 break;
Damien Miller4b42d7f2005-03-01 21:48:35 +11002256 case 'R':
2257 delete_host = 1;
2258 rr_hostname = optarg;
2259 break;
Damien Millerf2b70ca2010-03-05 07:39:35 +11002260 case 'L':
2261 show_cert = 1;
2262 break;
Damien Miller95def091999-11-25 00:26:21 +11002263 case 'l':
2264 print_fingerprint = 1;
2265 break;
Ben Lindstrom8fd372b2001-03-12 03:02:17 +00002266 case 'B':
2267 print_bubblebabble = 1;
2268 break;
Damien Miller44b25042010-07-02 13:35:01 +10002269 case 'm':
2270 if (strcasecmp(optarg, "RFC4716") == 0 ||
2271 strcasecmp(optarg, "ssh2") == 0) {
2272 convert_format = FMT_RFC4716;
2273 break;
2274 }
2275 if (strcasecmp(optarg, "PKCS8") == 0) {
2276 convert_format = FMT_PKCS8;
2277 break;
2278 }
2279 if (strcasecmp(optarg, "PEM") == 0) {
2280 convert_format = FMT_PEM;
2281 break;
2282 }
2283 fatal("Unsupported conversion format \"%s\"", optarg);
Damien Miller0a80ca12010-02-27 07:55:05 +11002284 case 'n':
2285 cert_principals = optarg;
2286 break;
Damien Miller95def091999-11-25 00:26:21 +11002287 case 'p':
2288 change_passphrase = 1;
2289 break;
Damien Miller95def091999-11-25 00:26:21 +11002290 case 'c':
2291 change_comment = 1;
2292 break;
Damien Miller95def091999-11-25 00:26:21 +11002293 case 'f':
Damien Millerb089fb52005-05-26 12:16:18 +10002294 if (strlcpy(identity_file, optarg, sizeof(identity_file)) >=
2295 sizeof(identity_file))
2296 fatal("Identity filename too long");
Damien Miller95def091999-11-25 00:26:21 +11002297 have_identity = 1;
2298 break;
Damien Miller37876e92003-05-15 10:19:46 +10002299 case 'g':
2300 print_generic = 1;
2301 break;
Damien Miller95def091999-11-25 00:26:21 +11002302 case 'P':
2303 identity_passphrase = optarg;
2304 break;
Damien Miller95def091999-11-25 00:26:21 +11002305 case 'N':
2306 identity_new_passphrase = optarg;
2307 break;
Damien Millerf3747bf2013-01-18 11:44:04 +11002308 case 'Q':
2309 check_krl = 1;
2310 break;
Damien Miller0a80ca12010-02-27 07:55:05 +11002311 case 'O':
Damien Miller4e270b02010-04-16 15:56:21 +10002312 add_cert_option(optarg);
Damien Miller0a80ca12010-02-27 07:55:05 +11002313 break;
Damien Miller95def091999-11-25 00:26:21 +11002314 case 'C':
2315 identity_comment = optarg;
2316 break;
Damien Miller95def091999-11-25 00:26:21 +11002317 case 'q':
2318 quiet = 1;
2319 break;
Ben Lindstrom5a707822001-04-22 17:15:46 +00002320 case 'e':
Damien Millereba71ba2000-04-29 23:57:08 +10002321 case 'x':
Ben Lindstrom5a707822001-04-22 17:15:46 +00002322 /* export key */
Damien Miller44b25042010-07-02 13:35:01 +10002323 convert_to = 1;
Damien Millereba71ba2000-04-29 23:57:08 +10002324 break;
Damien Miller0a80ca12010-02-27 07:55:05 +11002325 case 'h':
2326 cert_key_type = SSH2_CERT_TYPE_HOST;
Damien Millerd0e4a8e2010-05-21 14:58:32 +10002327 certflags_flags = 0;
Damien Miller0a80ca12010-02-27 07:55:05 +11002328 break;
Damien Millerf3747bf2013-01-18 11:44:04 +11002329 case 'k':
2330 gen_krl = 1;
2331 break;
Ben Lindstrom5a707822001-04-22 17:15:46 +00002332 case 'i':
Damien Millereba71ba2000-04-29 23:57:08 +10002333 case 'X':
Ben Lindstrom5a707822001-04-22 17:15:46 +00002334 /* import key */
Damien Miller44b25042010-07-02 13:35:01 +10002335 convert_from = 1;
Damien Millereba71ba2000-04-29 23:57:08 +10002336 break;
Damien Millereba71ba2000-04-29 23:57:08 +10002337 case 'y':
2338 print_public = 1;
2339 break;
Damien Miller0a80ca12010-02-27 07:55:05 +11002340 case 's':
2341 ca_key_path = optarg;
2342 break;
Damien Miller0bc1bd82000-11-13 22:57:25 +11002343 case 't':
2344 key_type_name = optarg;
Damien Miller0bc1bd82000-11-13 22:57:25 +11002345 break;
Ben Lindstrom8282d6a2001-08-06 21:44:05 +00002346 case 'D':
Damien Miller7ea845e2010-02-12 09:21:02 +11002347 pkcs11provider = optarg;
Ben Lindstromcd392282001-07-04 03:44:03 +00002348 break;
Damien Millerf3747bf2013-01-18 11:44:04 +11002349 case 'u':
2350 update_krl = 1;
2351 break;
Darren Tucker06930c72003-12-31 11:34:51 +11002352 case 'v':
2353 if (log_level == SYSLOG_LEVEL_INFO)
2354 log_level = SYSLOG_LEVEL_DEBUG1;
2355 else {
Darren Tuckerfc959702004-07-17 16:12:08 +10002356 if (log_level >= SYSLOG_LEVEL_DEBUG1 &&
Darren Tucker06930c72003-12-31 11:34:51 +11002357 log_level < SYSLOG_LEVEL_DEBUG3)
2358 log_level++;
2359 }
2360 break;
Damien Miller37876e92003-05-15 10:19:46 +10002361 case 'r':
Damien Miller4b42d7f2005-03-01 21:48:35 +11002362 rr_hostname = optarg;
Damien Miller37876e92003-05-15 10:19:46 +10002363 break;
Darren Tucker019cefe2003-08-02 22:40:07 +10002364 case 'W':
Damien Miller5f340062006-03-26 14:27:57 +11002365 generator_wanted = (u_int32_t)strtonum(optarg, 1,
2366 UINT_MAX, &errstr);
Damien Millerb089fb52005-05-26 12:16:18 +10002367 if (errstr)
2368 fatal("Desired generator has bad value: %s (%s)",
2369 optarg, errstr);
Darren Tucker019cefe2003-08-02 22:40:07 +10002370 break;
2371 case 'a':
Damien Miller5f340062006-03-26 14:27:57 +11002372 trials = (u_int32_t)strtonum(optarg, 1, UINT_MAX, &errstr);
Damien Millerb089fb52005-05-26 12:16:18 +10002373 if (errstr)
2374 fatal("Invalid number of trials: %s (%s)",
2375 optarg, errstr);
Darren Tucker019cefe2003-08-02 22:40:07 +10002376 break;
2377 case 'M':
Damien Miller5f340062006-03-26 14:27:57 +11002378 memory = (u_int32_t)strtonum(optarg, 1, UINT_MAX, &errstr);
Damien Miller4e270b02010-04-16 15:56:21 +10002379 if (errstr)
Damien Millerb089fb52005-05-26 12:16:18 +10002380 fatal("Memory limit is %s: %s", errstr, optarg);
Darren Tucker019cefe2003-08-02 22:40:07 +10002381 break;
2382 case 'G':
2383 do_gen_candidates = 1;
Damien Millerb089fb52005-05-26 12:16:18 +10002384 if (strlcpy(out_file, optarg, sizeof(out_file)) >=
2385 sizeof(out_file))
2386 fatal("Output filename too long");
Darren Tucker019cefe2003-08-02 22:40:07 +10002387 break;
2388 case 'T':
2389 do_screen_candidates = 1;
Damien Millerb089fb52005-05-26 12:16:18 +10002390 if (strlcpy(out_file, optarg, sizeof(out_file)) >=
2391 sizeof(out_file))
2392 fatal("Output filename too long");
Darren Tucker019cefe2003-08-02 22:40:07 +10002393 break;
Damien Miller390d0562011-10-18 16:05:19 +11002394 case 'K':
2395 if (strlen(optarg) >= MAXPATHLEN)
2396 fatal("Checkpoint filename too long");
2397 checkpoint = xstrdup(optarg);
2398 break;
Darren Tucker019cefe2003-08-02 22:40:07 +10002399 case 'S':
2400 /* XXX - also compare length against bits */
2401 if (BN_hex2bn(&start, optarg) == 0)
2402 fatal("Invalid start point.");
2403 break;
Damien Miller0a80ca12010-02-27 07:55:05 +11002404 case 'V':
2405 parse_cert_times(optarg);
2406 break;
Damien Miller4e270b02010-04-16 15:56:21 +10002407 case 'z':
Damien Miller6f3b3622012-11-14 19:04:33 +11002408 errno = 0;
2409 cert_serial = strtoull(optarg, &ep, 10);
2410 if (*optarg < '0' || *optarg > '9' || *ep != '\0' ||
2411 (errno == ERANGE && cert_serial == ULLONG_MAX))
2412 fatal("Invalid serial number \"%s\"", optarg);
Damien Miller4e270b02010-04-16 15:56:21 +10002413 break;
Damien Miller95def091999-11-25 00:26:21 +11002414 case '?':
2415 default:
2416 usage();
2417 }
2418 }
Darren Tucker06930c72003-12-31 11:34:51 +11002419
2420 /* reinit */
Damien Millerdf8b7db2007-01-05 16:22:57 +11002421 log_init(argv[0], log_level, SYSLOG_FACILITY_USER, 1);
Darren Tucker06930c72003-12-31 11:34:51 +11002422
Damien Miller0a80ca12010-02-27 07:55:05 +11002423 argv += optind;
2424 argc -= optind;
2425
2426 if (ca_key_path != NULL) {
Damien Millerf3747bf2013-01-18 11:44:04 +11002427 if (argc < 1 && !gen_krl) {
Damien Miller0a80ca12010-02-27 07:55:05 +11002428 printf("Too few arguments.\n");
2429 usage();
2430 }
Damien Millerf3747bf2013-01-18 11:44:04 +11002431 } else if (argc > 0 && !gen_krl && !check_krl) {
Damien Miller95def091999-11-25 00:26:21 +11002432 printf("Too many arguments.\n");
2433 usage();
2434 }
2435 if (change_passphrase && change_comment) {
2436 printf("Can only have one of -p and -c.\n");
2437 usage();
2438 }
Darren Tucker0f7e9102008-06-08 12:54:29 +10002439 if (print_fingerprint && (delete_host || hash_hosts)) {
Damien Millerec77c952013-01-09 15:58:00 +11002440 printf("Cannot use -l with -H or -R.\n");
Darren Tucker0f7e9102008-06-08 12:54:29 +10002441 usage();
2442 }
Damien Millerf3747bf2013-01-18 11:44:04 +11002443 if (gen_krl) {
2444 do_gen_krl(pw, update_krl, argc, argv);
2445 return (0);
2446 }
2447 if (check_krl) {
2448 do_check_krl(pw, argc, argv);
2449 return (0);
2450 }
Damien Miller0a80ca12010-02-27 07:55:05 +11002451 if (ca_key_path != NULL) {
2452 if (cert_key_id == NULL)
2453 fatal("Must specify key id (-I) when certifying");
2454 do_ca_sign(pw, argc, argv);
2455 }
Damien Millerf2b70ca2010-03-05 07:39:35 +11002456 if (show_cert)
2457 do_show_cert(pw);
Damien Miller4b42d7f2005-03-01 21:48:35 +11002458 if (delete_host || hash_hosts || find_host)
2459 do_known_hosts(pw, rr_hostname);
Damien Millerec77c952013-01-09 15:58:00 +11002460 if (pkcs11provider != NULL)
2461 do_download(pw);
Ben Lindstrom8fd372b2001-03-12 03:02:17 +00002462 if (print_fingerprint || print_bubblebabble)
Damien Miller95def091999-11-25 00:26:21 +11002463 do_fingerprint(pw);
Damien Miller95def091999-11-25 00:26:21 +11002464 if (change_passphrase)
2465 do_change_passphrase(pw);
Damien Miller4a10d2e2002-03-11 22:53:29 +11002466 if (change_comment)
2467 do_change_comment(pw);
Damien Miller44b25042010-07-02 13:35:01 +10002468 if (convert_to)
2469 do_convert_to(pw);
2470 if (convert_from)
2471 do_convert_from(pw);
Damien Millereba71ba2000-04-29 23:57:08 +10002472 if (print_public)
2473 do_print_public(pw);
Damien Miller4b42d7f2005-03-01 21:48:35 +11002474 if (rr_hostname != NULL) {
Damien Millercb314822006-03-26 13:48:01 +11002475 unsigned int n = 0;
2476
2477 if (have_identity) {
2478 n = do_print_resource_record(pw,
2479 identity_file, rr_hostname);
2480 if (n == 0) {
2481 perror(identity_file);
2482 exit(1);
2483 }
2484 exit(0);
2485 } else {
2486
2487 n += do_print_resource_record(pw,
2488 _PATH_HOST_RSA_KEY_FILE, rr_hostname);
2489 n += do_print_resource_record(pw,
2490 _PATH_HOST_DSA_KEY_FILE, rr_hostname);
Damien Miller3bde12a2012-06-20 21:51:11 +10002491 n += do_print_resource_record(pw,
2492 _PATH_HOST_ECDSA_KEY_FILE, rr_hostname);
Damien Millercb314822006-03-26 13:48:01 +11002493
2494 if (n == 0)
2495 fatal("no keys found.");
2496 exit(0);
2497 }
Damien Miller37876e92003-05-15 10:19:46 +10002498 }
Damien Miller95def091999-11-25 00:26:21 +11002499
Darren Tucker019cefe2003-08-02 22:40:07 +10002500 if (do_gen_candidates) {
2501 FILE *out = fopen(out_file, "w");
Damien Miller787b2ec2003-11-21 23:56:47 +11002502
Darren Tucker019cefe2003-08-02 22:40:07 +10002503 if (out == NULL) {
2504 error("Couldn't open modulus candidate file \"%s\": %s",
2505 out_file, strerror(errno));
2506 return (1);
2507 }
Damien Miller3f54a9f2005-11-05 14:52:18 +11002508 if (bits == 0)
2509 bits = DEFAULT_BITS;
Darren Tucker019cefe2003-08-02 22:40:07 +10002510 if (gen_candidates(out, memory, bits, start) != 0)
Damien Miller15d72a02005-11-05 15:07:33 +11002511 fatal("modulus candidate generation failed");
Darren Tucker019cefe2003-08-02 22:40:07 +10002512
2513 return (0);
2514 }
2515
2516 if (do_screen_candidates) {
2517 FILE *in;
Damien Miller78d22712013-02-12 11:03:36 +11002518 FILE *out = fopen(out_file, "a");
Darren Tucker019cefe2003-08-02 22:40:07 +10002519
2520 if (have_identity && strcmp(identity_file, "-") != 0) {
2521 if ((in = fopen(identity_file, "r")) == NULL) {
2522 fatal("Couldn't open modulus candidate "
Damien Millera8e06ce2003-11-21 23:48:55 +11002523 "file \"%s\": %s", identity_file,
Darren Tucker019cefe2003-08-02 22:40:07 +10002524 strerror(errno));
2525 }
2526 } else
2527 in = stdin;
2528
2529 if (out == NULL) {
2530 fatal("Couldn't open moduli file \"%s\": %s",
2531 out_file, strerror(errno));
2532 }
Damien Millerdfceafe2012-07-06 13:44:19 +10002533 if (prime_test(in, out, trials, generator_wanted, checkpoint,
2534 start_lineno, lines_to_process) != 0)
Damien Miller15d72a02005-11-05 15:07:33 +11002535 fatal("modulus screening failed");
Darren Tuckerf4220e62003-08-21 16:44:07 +10002536 return (0);
Darren Tucker019cefe2003-08-02 22:40:07 +10002537 }
2538
Damien Miller58f1baf2011-05-05 14:06:15 +10002539 if (gen_all_hostkeys) {
2540 do_gen_all_hostkeys(pw);
2541 return (0);
2542 }
2543
Damien Millerf14be5c2005-11-05 15:15:49 +11002544 if (key_type_name == NULL)
2545 key_type_name = "rsa";
2546
Damien Millere39cacc2000-11-29 12:18:44 +11002547 type = key_type_from_name(key_type_name);
Damien Miller58f1baf2011-05-05 14:06:15 +10002548 type_bits_valid(type, &bits);
2549
Darren Tucker3af2ac52005-11-29 13:10:24 +11002550 if (!quiet)
2551 printf("Generating public/private %s key pair.\n", key_type_name);
Damien Miller0bc1bd82000-11-13 22:57:25 +11002552 private = key_generate(type, bits);
2553 if (private == NULL) {
Damien Miller9eab9562009-02-22 08:47:02 +11002554 fprintf(stderr, "key_generate failed\n");
Damien Miller0bc1bd82000-11-13 22:57:25 +11002555 exit(1);
2556 }
2557 public = key_from_private(private);
Damien Miller95def091999-11-25 00:26:21 +11002558
2559 if (!have_identity)
2560 ask_filename(pw, "Enter file in which to save the key");
2561
Damien Miller788f2122005-11-05 15:14:59 +11002562 /* Create ~/.ssh directory if it doesn't already exist. */
Damien Miller50af79b2010-05-10 11:52:00 +10002563 snprintf(dotsshdir, sizeof dotsshdir, "%s/%s",
2564 pw->pw_dir, _PATH_SSH_USER_DIR);
2565 if (strstr(identity_file, dotsshdir) != NULL) {
2566 if (stat(dotsshdir, &st) < 0) {
2567 if (errno != ENOENT) {
2568 error("Could not stat %s: %s", dotsshdir,
2569 strerror(errno));
2570 } else if (mkdir(dotsshdir, 0700) < 0) {
2571 error("Could not create directory '%s': %s",
2572 dotsshdir, strerror(errno));
2573 } else if (!quiet)
2574 printf("Created directory '%s'.\n", dotsshdir);
2575 }
Damien Miller95def091999-11-25 00:26:21 +11002576 }
2577 /* If the file already exists, ask the user to confirm. */
2578 if (stat(identity_file, &st) >= 0) {
2579 char yesno[3];
2580 printf("%s already exists.\n", identity_file);
2581 printf("Overwrite (y/n)? ");
2582 fflush(stdout);
2583 if (fgets(yesno, sizeof(yesno), stdin) == NULL)
2584 exit(1);
2585 if (yesno[0] != 'y' && yesno[0] != 'Y')
2586 exit(1);
2587 }
2588 /* Ask for a passphrase (twice). */
2589 if (identity_passphrase)
2590 passphrase1 = xstrdup(identity_passphrase);
2591 else if (identity_new_passphrase)
2592 passphrase1 = xstrdup(identity_new_passphrase);
2593 else {
2594passphrase_again:
2595 passphrase1 =
Ben Lindstrom949974b2001-06-25 05:20:31 +00002596 read_passphrase("Enter passphrase (empty for no "
2597 "passphrase): ", RP_ALLOW_STDIN);
2598 passphrase2 = read_passphrase("Enter same passphrase again: ",
2599 RP_ALLOW_STDIN);
Damien Miller95def091999-11-25 00:26:21 +11002600 if (strcmp(passphrase1, passphrase2) != 0) {
Ben Lindstrom949974b2001-06-25 05:20:31 +00002601 /*
2602 * The passphrases do not match. Clear them and
2603 * retry.
2604 */
Damien Miller95def091999-11-25 00:26:21 +11002605 memset(passphrase1, 0, strlen(passphrase1));
2606 memset(passphrase2, 0, strlen(passphrase2));
Darren Tuckera627d422013-06-02 07:31:17 +10002607 free(passphrase1);
2608 free(passphrase2);
Damien Miller95def091999-11-25 00:26:21 +11002609 printf("Passphrases do not match. Try again.\n");
2610 goto passphrase_again;
2611 }
2612 /* Clear the other copy of the passphrase. */
2613 memset(passphrase2, 0, strlen(passphrase2));
Darren Tuckera627d422013-06-02 07:31:17 +10002614 free(passphrase2);
Damien Miller95def091999-11-25 00:26:21 +11002615 }
2616
Damien Miller95def091999-11-25 00:26:21 +11002617 if (identity_comment) {
2618 strlcpy(comment, identity_comment, sizeof(comment));
2619 } else {
Darren Tuckere15fb092008-11-11 16:31:43 +11002620 /* Create default comment field for the passphrase. */
Damien Miller95def091999-11-25 00:26:21 +11002621 snprintf(comment, sizeof comment, "%s@%s", pw->pw_name, hostname);
2622 }
2623
2624 /* Save the key with the given passphrase and comment. */
Ben Lindstromd0fca422001-03-26 13:44:06 +00002625 if (!key_save_private(private, identity_file, passphrase1, comment)) {
Ben Lindstrom15f33862001-04-16 02:00:02 +00002626 printf("Saving the key failed: %s.\n", identity_file);
Damien Miller95def091999-11-25 00:26:21 +11002627 memset(passphrase1, 0, strlen(passphrase1));
Darren Tuckera627d422013-06-02 07:31:17 +10002628 free(passphrase1);
Damien Miller95def091999-11-25 00:26:21 +11002629 exit(1);
2630 }
2631 /* Clear the passphrase. */
2632 memset(passphrase1, 0, strlen(passphrase1));
Darren Tuckera627d422013-06-02 07:31:17 +10002633 free(passphrase1);
Damien Miller95def091999-11-25 00:26:21 +11002634
2635 /* Clear the private key and the random number generator. */
Damien Miller0bc1bd82000-11-13 22:57:25 +11002636 key_free(private);
Damien Miller95def091999-11-25 00:26:21 +11002637
2638 if (!quiet)
2639 printf("Your identification has been saved in %s.\n", identity_file);
2640
Damien Miller95def091999-11-25 00:26:21 +11002641 strlcat(identity_file, ".pub", sizeof(identity_file));
Ben Lindstrom5fc62702001-03-09 18:19:24 +00002642 fd = open(identity_file, O_WRONLY | O_CREAT | O_TRUNC, 0644);
2643 if (fd == -1) {
Damien Miller95def091999-11-25 00:26:21 +11002644 printf("Could not save your public key in %s\n", identity_file);
2645 exit(1);
2646 }
Ben Lindstrom5fc62702001-03-09 18:19:24 +00002647 f = fdopen(fd, "w");
2648 if (f == NULL) {
Damien Miller9eab9562009-02-22 08:47:02 +11002649 printf("fdopen %s failed\n", identity_file);
Ben Lindstrom5fc62702001-03-09 18:19:24 +00002650 exit(1);
2651 }
Damien Millereba71ba2000-04-29 23:57:08 +10002652 if (!key_write(public, f))
Damien Miller9eab9562009-02-22 08:47:02 +11002653 fprintf(stderr, "write key failed\n");
Damien Millereba71ba2000-04-29 23:57:08 +10002654 fprintf(f, " %s\n", comment);
Damien Miller95def091999-11-25 00:26:21 +11002655 fclose(f);
2656
2657 if (!quiet) {
Ben Lindstromcfccef92001-03-13 04:57:58 +00002658 char *fp = key_fingerprint(public, SSH_FP_MD5, SSH_FP_HEX);
Darren Tucker9c16ac92008-06-13 04:40:35 +10002659 char *ra = key_fingerprint(public, SSH_FP_MD5,
2660 SSH_FP_RANDOMART);
Damien Millereba71ba2000-04-29 23:57:08 +10002661 printf("Your public key has been saved in %s.\n",
2662 identity_file);
Damien Miller95def091999-11-25 00:26:21 +11002663 printf("The key fingerprint is:\n");
Ben Lindstromcfccef92001-03-13 04:57:58 +00002664 printf("%s %s\n", fp, comment);
Darren Tucker9c16ac92008-06-13 04:40:35 +10002665 printf("The key's randomart image is:\n");
2666 printf("%s\n", ra);
Darren Tuckera627d422013-06-02 07:31:17 +10002667 free(ra);
2668 free(fp);
Damien Miller95def091999-11-25 00:26:21 +11002669 }
Damien Millereba71ba2000-04-29 23:57:08 +10002670
2671 key_free(public);
Damien Miller95def091999-11-25 00:26:21 +11002672 exit(0);
Damien Millerd4a8b7e1999-10-27 13:42:43 +10002673}