blob: e8e2a2aa0cfabffcb578b8e253290d9eb331f421 [file] [log] [blame]
jsing@openbsd.org94ec2b62018-02-07 05:15:49 +00001/* $OpenBSD: ssh-keygen.c,v 1.310 2018/02/07 05:15:49 jsing Exp $ */
Damien Millerd4a8b7e1999-10-27 13:42:43 +10002/*
Damien Miller95def091999-11-25 00:26:21 +11003 * Author: Tatu Ylonen <ylo@cs.hut.fi>
4 * Copyright (c) 1994 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
5 * All rights reserved
Damien Miller95def091999-11-25 00:26:21 +11006 * Identity and host key generation and maintenance.
Damien Millere4340be2000-09-16 13:29:08 +11007 *
8 * As far as I am concerned, the code I have written for this software
9 * can be used freely for any purpose. Any derived versions of this
10 * software must be clearly marked as such, and if the derived work is
11 * incompatible with the protocol description in the RFC file, it must be
12 * called by a name other than "ssh" or "Secure Shell".
Damien Miller95def091999-11-25 00:26:21 +110013 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +100014
15#include "includes.h"
Damien Millerf17883e2006-03-15 11:45:54 +110016
17#include <sys/types.h>
Damien Millere3b60b52006-07-10 21:08:03 +100018#include <sys/socket.h>
Damien Millerf17883e2006-03-15 11:45:54 +110019#include <sys/stat.h>
Damien Millerd4a8b7e1999-10-27 13:42:43 +100020
Damien Miller72ef7c12015-01-15 02:21:31 +110021#ifdef WITH_OPENSSL
Damien Millereba71ba2000-04-29 23:57:08 +100022#include <openssl/evp.h>
23#include <openssl/pem.h>
Darren Tuckerbfaaf962008-02-28 19:13:52 +110024#include "openbsd-compat/openssl-compat.h"
Damien Miller72ef7c12015-01-15 02:21:31 +110025#endif
Damien Millereba71ba2000-04-29 23:57:08 +100026
Darren Tucker39972492006-07-12 22:22:46 +100027#include <errno.h>
Damien Miller57cf6382006-07-10 21:13:46 +100028#include <fcntl.h>
Damien Millerb8fe89c2006-07-24 14:51:00 +100029#include <netdb.h>
Darren Tucker2ee50c52006-07-11 18:55:05 +100030#ifdef HAVE_PATHS_H
31# include <paths.h>
32#endif
Damien Miller9f2abc42006-07-10 20:53:08 +100033#include <pwd.h>
Damien Millerded319c2006-09-01 15:38:36 +100034#include <stdarg.h>
Damien Millera7a73ee2006-08-05 11:37:59 +100035#include <stdio.h>
Damien Millere7a1e5c2006-08-05 11:34:19 +100036#include <stdlib.h>
Damien Millere3476ed2006-07-24 14:13:33 +100037#include <string.h>
Damien Millere6b3b612006-07-24 14:01:23 +100038#include <unistd.h>
deraadt@openbsd.org2ae4f332015-01-16 06:40:12 +000039#include <limits.h>
djm@openbsd.orga287c5a2017-02-10 03:36:40 +000040#include <locale.h>
Damien Miller9f2abc42006-07-10 20:53:08 +100041
Damien Millerd4a8b7e1999-10-27 13:42:43 +100042#include "xmalloc.h"
djm@openbsd.org1129dcf2015-01-15 09:40:00 +000043#include "sshkey.h"
Damien Millereba71ba2000-04-29 23:57:08 +100044#include "authfile.h"
45#include "uuencode.h"
djm@openbsd.org1129dcf2015-01-15 09:40:00 +000046#include "sshbuf.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +000047#include "pathnames.h"
48#include "log.h"
Darren Tuckere608ca22004-05-13 16:15:47 +100049#include "misc.h"
Damien Miller4b42d7f2005-03-01 21:48:35 +110050#include "match.h"
51#include "hostfile.h"
Damien Miller69996102006-07-10 20:53:31 +100052#include "dns.h"
Damien Millerf3747bf2013-01-18 11:44:04 +110053#include "ssh.h"
Damien Miller0a80ca12010-02-27 07:55:05 +110054#include "ssh2.h"
djm@openbsd.org1129dcf2015-01-15 09:40:00 +000055#include "ssherr.h"
Damien Miller7ea845e2010-02-12 09:21:02 +110056#include "ssh-pkcs11.h"
Damien Millerf3747bf2013-01-18 11:44:04 +110057#include "atomicio.h"
58#include "krl.h"
djm@openbsd.org56d1c832014-12-21 22:27:55 +000059#include "digest.h"
djm@openbsd.orga287c5a2017-02-10 03:36:40 +000060#include "utf8.h"
djm@openbsd.orga98339e2017-06-28 01:09:22 +000061#include "authfd.h"
Ben Lindstromcd392282001-07-04 03:44:03 +000062
djm@openbsd.orgd1958792015-05-28 04:40:13 +000063#ifdef WITH_OPENSSL
64# define DEFAULT_KEY_TYPE_NAME "rsa"
65#else
66# define DEFAULT_KEY_TYPE_NAME "ed25519"
67#endif
68
Damien Miller3f54a9f2005-11-05 14:52:18 +110069/* Number of bits in the RSA/DSA key. This value can be set on the command line. */
70#define DEFAULT_BITS 2048
71#define DEFAULT_BITS_DSA 1024
Damien Miller6e9f6802010-09-10 11:17:38 +100072#define DEFAULT_BITS_ECDSA 256
Damien Miller3f54a9f2005-11-05 14:52:18 +110073u_int32_t bits = 0;
Damien Millerd4a8b7e1999-10-27 13:42:43 +100074
Damien Miller5428f641999-11-25 11:54:57 +110075/*
76 * Flag indicating that we just want to change the passphrase. This can be
77 * set on the command line.
78 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +100079int change_passphrase = 0;
80
Damien Miller5428f641999-11-25 11:54:57 +110081/*
82 * Flag indicating that we just want to change the comment. This can be set
83 * on the command line.
84 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +100085int change_comment = 0;
86
87int quiet = 0;
88
Darren Tucker35c45532008-06-13 04:43:15 +100089int log_level = SYSLOG_LEVEL_INFO;
90
Damien Miller4b42d7f2005-03-01 21:48:35 +110091/* Flag indicating that we want to hash a known_hosts file */
92int hash_hosts = 0;
93/* Flag indicating that we want lookup a host in known_hosts file */
94int find_host = 0;
95/* Flag indicating that we want to delete a host from a known_hosts file */
96int delete_host = 0;
97
Damien Millerf2b70ca2010-03-05 07:39:35 +110098/* Flag indicating that we want to show the contents of a certificate */
99int show_cert = 0;
100
Damien Miller10f6f6b1999-11-17 17:29:08 +1100101/* Flag indicating that we just want to see the key fingerprint */
102int print_fingerprint = 0;
Ben Lindstrom8fd372b2001-03-12 03:02:17 +0000103int print_bubblebabble = 0;
Damien Miller10f6f6b1999-11-17 17:29:08 +1100104
djm@openbsd.org56d1c832014-12-21 22:27:55 +0000105/* Hash algorithm to use for fingerprints. */
106int fingerprint_hash = SSH_FP_HASH_DEFAULT;
107
Damien Miller431f66b1999-11-21 18:31:57 +1100108/* The identity file name, given on the command line or entered by the user. */
109char identity_file[1024];
110int have_identity = 0;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000111
112/* This is set to the passphrase if given on the command line. */
113char *identity_passphrase = NULL;
114
115/* This is set to the new passphrase if given on the command line. */
116char *identity_new_passphrase = NULL;
117
118/* This is set to the new comment if given on the command line. */
119char *identity_comment = NULL;
120
Damien Miller0a80ca12010-02-27 07:55:05 +1100121/* Path to CA key when certifying keys. */
122char *ca_key_path = NULL;
123
djm@openbsd.orga98339e2017-06-28 01:09:22 +0000124/* Prefer to use agent keys for CA signing */
125int prefer_agent = 0;
126
Damien Miller4e270b02010-04-16 15:56:21 +1000127/* Certificate serial number */
Damien Miller55aca022012-12-03 11:25:30 +1100128unsigned long long cert_serial = 0;
Damien Miller4e270b02010-04-16 15:56:21 +1000129
Damien Miller0a80ca12010-02-27 07:55:05 +1100130/* Key type when certifying */
131u_int cert_key_type = SSH2_CERT_TYPE_USER;
132
133/* "key ID" of signed key */
134char *cert_key_id = NULL;
135
136/* Comma-separated list of principal names for certifying keys */
137char *cert_principals = NULL;
138
139/* Validity period for certificates */
140u_int64_t cert_valid_from = 0;
141u_int64_t cert_valid_to = ~0ULL;
142
Damien Miller4e270b02010-04-16 15:56:21 +1000143/* Certificate options */
Damien Millerd0e4a8e2010-05-21 14:58:32 +1000144#define CERTOPT_X_FWD (1)
145#define CERTOPT_AGENT_FWD (1<<1)
146#define CERTOPT_PORT_FWD (1<<2)
147#define CERTOPT_PTY (1<<3)
148#define CERTOPT_USER_RC (1<<4)
149#define CERTOPT_DEFAULT (CERTOPT_X_FWD|CERTOPT_AGENT_FWD| \
150 CERTOPT_PORT_FWD|CERTOPT_PTY|CERTOPT_USER_RC)
151u_int32_t certflags_flags = CERTOPT_DEFAULT;
152char *certflags_command = NULL;
153char *certflags_src_addr = NULL;
Damien Miller0a80ca12010-02-27 07:55:05 +1100154
djm@openbsd.org249516e2017-04-29 04:12:25 +0000155/* Arbitrary extensions specified by user */
156struct cert_userext {
157 char *key;
158 char *val;
159 int crit;
160};
161struct cert_userext *cert_userext;
162size_t ncert_userext;
163
Damien Miller44b25042010-07-02 13:35:01 +1000164/* Conversion to/from various formats */
165int convert_to = 0;
166int convert_from = 0;
167enum {
168 FMT_RFC4716,
169 FMT_PKCS8,
170 FMT_PEM
171} convert_format = FMT_RFC4716;
Damien Millereba71ba2000-04-29 23:57:08 +1000172int print_public = 0;
Damien Miller37876e92003-05-15 10:19:46 +1000173int print_generic = 0;
Damien Miller0bc1bd82000-11-13 22:57:25 +1100174
Damien Millera41c8b12002-01-22 23:05:08 +1100175char *key_type_name = NULL;
Damien Millereba71ba2000-04-29 23:57:08 +1000176
Damien Miller757f34e2010-08-05 13:05:31 +1000177/* Load key from this PKCS#11 provider */
178char *pkcs11provider = NULL;
Damien Miller44b25042010-07-02 13:35:01 +1000179
Damien Millerbcd00ab2013-12-07 10:41:55 +1100180/* Use new OpenSSH private key format when writing SSH2 keys instead of PEM */
181int use_new_format = 0;
182
183/* Cipher for new-format private keys */
184char *new_format_cipher = NULL;
185
186/*
187 * Number of KDF rounds to derive new format keys /
188 * number of primality trials when screening moduli.
189 */
190int rounds = 0;
191
Damien Miller431f66b1999-11-21 18:31:57 +1100192/* argv0 */
193extern char *__progname;
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000194
Damien Millere5c0d522014-07-03 21:24:19 +1000195char hostname[NI_MAXHOST];
Damien Millereba71ba2000-04-29 23:57:08 +1000196
djm@openbsd.org1d9a2e22015-05-28 07:37:31 +0000197#ifdef WITH_OPENSSL
Darren Tucker770fc012004-05-13 16:24:32 +1000198/* moduli.c */
Damien Millerb089fb52005-05-26 12:16:18 +1000199int gen_candidates(FILE *, u_int32_t, u_int32_t, BIGNUM *);
Damien Millerdfceafe2012-07-06 13:44:19 +1000200int prime_test(FILE *, FILE *, u_int32_t, u_int32_t, char *, unsigned long,
201 unsigned long);
djm@openbsd.org1d9a2e22015-05-28 07:37:31 +0000202#endif
Darren Tucker770fc012004-05-13 16:24:32 +1000203
Ben Lindstrombba81212001-06-25 05:01:22 +0000204static void
djm@openbsd.org7efb4552015-01-18 13:22:28 +0000205type_bits_valid(int type, const char *name, u_int32_t *bitsp)
Damien Miller58f1baf2011-05-05 14:06:15 +1000206{
Damien Miller72ef7c12015-01-15 02:21:31 +1100207#ifdef WITH_OPENSSL
djm@openbsd.org1d9a2e22015-05-28 07:37:31 +0000208 u_int maxbits, nid;
Damien Miller72ef7c12015-01-15 02:21:31 +1100209#endif
Damien Miller58f1baf2011-05-05 14:06:15 +1000210
djm@openbsd.org3038a192015-04-17 13:19:22 +0000211 if (type == KEY_UNSPEC)
212 fatal("unknown key type %s", key_type_name);
Damien Miller884b63a2011-05-05 14:14:52 +1000213 if (*bitsp == 0) {
Damien Miller773dda22015-01-30 23:10:17 +1100214#ifdef WITH_OPENSSL
Damien Miller58f1baf2011-05-05 14:06:15 +1000215 if (type == KEY_DSA)
Damien Miller884b63a2011-05-05 14:14:52 +1000216 *bitsp = DEFAULT_BITS_DSA;
djm@openbsd.org7efb4552015-01-18 13:22:28 +0000217 else if (type == KEY_ECDSA) {
218 if (name != NULL &&
219 (nid = sshkey_ecdsa_nid_from_name(name)) > 0)
220 *bitsp = sshkey_curve_nid_to_bits(nid);
221 if (*bitsp == 0)
222 *bitsp = DEFAULT_BITS_ECDSA;
Damien Miller773dda22015-01-30 23:10:17 +1100223 } else
224#endif
Damien Miller884b63a2011-05-05 14:14:52 +1000225 *bitsp = DEFAULT_BITS;
Damien Miller58f1baf2011-05-05 14:06:15 +1000226 }
Damien Miller72ef7c12015-01-15 02:21:31 +1100227#ifdef WITH_OPENSSL
Damien Miller58f1baf2011-05-05 14:06:15 +1000228 maxbits = (type == KEY_DSA) ?
229 OPENSSL_DSA_MAX_MODULUS_BITS : OPENSSL_RSA_MAX_MODULUS_BITS;
djm@openbsd.org3038a192015-04-17 13:19:22 +0000230 if (*bitsp > maxbits)
231 fatal("key bits exceeds maximum %d", maxbits);
djm@openbsd.orgbd636f42017-05-07 23:15:59 +0000232 switch (type) {
233 case KEY_DSA:
234 if (*bitsp != 1024)
235 fatal("Invalid DSA key length: must be 1024 bits");
236 break;
237 case KEY_RSA:
238 if (*bitsp < SSH_RSA_MINIMUM_MODULUS_SIZE)
239 fatal("Invalid RSA key length: minimum is %d bits",
240 SSH_RSA_MINIMUM_MODULUS_SIZE);
241 break;
242 case KEY_ECDSA:
243 if (sshkey_ecdsa_bits_to_nid(*bitsp) == -1)
244 fatal("Invalid ECDSA key length: valid lengths are "
245 "256, 384 or 521 bits");
246 }
Damien Miller1f0311c2014-05-15 14:24:09 +1000247#endif
Damien Miller58f1baf2011-05-05 14:06:15 +1000248}
249
250static void
Damien Miller431f66b1999-11-21 18:31:57 +1100251ask_filename(struct passwd *pw, const char *prompt)
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000252{
Damien Miller95def091999-11-25 00:26:21 +1100253 char buf[1024];
Damien Millere39cacc2000-11-29 12:18:44 +1100254 char *name = NULL;
255
Damien Miller993dd552002-02-19 15:22:47 +1100256 if (key_type_name == NULL)
Ben Lindstrom226cfa02001-01-22 05:34:40 +0000257 name = _PATH_SSH_CLIENT_ID_RSA;
Damien Miller90967402006-03-26 14:07:26 +1100258 else {
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000259 switch (sshkey_type_from_name(key_type_name)) {
Damien Miller4e270b02010-04-16 15:56:21 +1000260 case KEY_DSA_CERT:
Damien Miller993dd552002-02-19 15:22:47 +1100261 case KEY_DSA:
262 name = _PATH_SSH_CLIENT_ID_DSA;
263 break;
Damien Millerdd190dd2010-11-11 14:17:02 +1100264#ifdef OPENSSL_HAS_ECC
Damien Millereb8b60e2010-08-31 22:41:14 +1000265 case KEY_ECDSA_CERT:
266 case KEY_ECDSA:
267 name = _PATH_SSH_CLIENT_ID_ECDSA;
268 break;
Damien Millerdd190dd2010-11-11 14:17:02 +1100269#endif
Damien Miller4e270b02010-04-16 15:56:21 +1000270 case KEY_RSA_CERT:
Damien Miller993dd552002-02-19 15:22:47 +1100271 case KEY_RSA:
272 name = _PATH_SSH_CLIENT_ID_RSA;
273 break;
Damien Miller5be9d9e2013-12-07 11:24:01 +1100274 case KEY_ED25519:
275 case KEY_ED25519_CERT:
276 name = _PATH_SSH_CLIENT_ID_ED25519;
277 break;
Damien Miller993dd552002-02-19 15:22:47 +1100278 default:
djm@openbsd.org3038a192015-04-17 13:19:22 +0000279 fatal("bad key type");
Damien Miller993dd552002-02-19 15:22:47 +1100280 }
Damien Miller90967402006-03-26 14:07:26 +1100281 }
djm@openbsd.org3038a192015-04-17 13:19:22 +0000282 snprintf(identity_file, sizeof(identity_file),
283 "%s/%s", pw->pw_dir, name);
284 printf("%s (%s): ", prompt, identity_file);
285 fflush(stdout);
Damien Miller95def091999-11-25 00:26:21 +1100286 if (fgets(buf, sizeof(buf), stdin) == NULL)
287 exit(1);
Damien Miller14b017d2007-09-17 16:09:15 +1000288 buf[strcspn(buf, "\n")] = '\0';
Damien Miller95def091999-11-25 00:26:21 +1100289 if (strcmp(buf, "") != 0)
290 strlcpy(identity_file, buf, sizeof(identity_file));
291 have_identity = 1;
Damien Miller10f6f6b1999-11-17 17:29:08 +1100292}
Damien Millerd4a8b7e1999-10-27 13:42:43 +1000293
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000294static struct sshkey *
Ben Lindstromd78ae762001-06-05 20:35:09 +0000295load_identity(char *filename)
Damien Millereba71ba2000-04-29 23:57:08 +1000296{
Ben Lindstromd0fca422001-03-26 13:44:06 +0000297 char *pass;
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000298 struct sshkey *prv;
299 int r;
Ben Lindstromd0fca422001-03-26 13:44:06 +0000300
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000301 if ((r = sshkey_load_private(filename, "", &prv, NULL)) == 0)
302 return prv;
303 if (r != SSH_ERR_KEY_WRONG_PASSPHRASE)
304 fatal("Load key \"%s\": %s", filename, ssh_err(r));
305 if (identity_passphrase)
306 pass = xstrdup(identity_passphrase);
307 else
308 pass = read_passphrase("Enter passphrase: ", RP_ALLOW_STDIN);
309 r = sshkey_load_private(filename, pass, &prv, NULL);
310 explicit_bzero(pass, strlen(pass));
311 free(pass);
312 if (r != 0)
313 fatal("Load key \"%s\": %s", filename, ssh_err(r));
Ben Lindstromd0fca422001-03-26 13:44:06 +0000314 return prv;
Damien Millereba71ba2000-04-29 23:57:08 +1000315}
316
Damien Miller874d77b2000-10-14 16:23:11 +1100317#define SSH_COM_PUBLIC_BEGIN "---- BEGIN SSH2 PUBLIC KEY ----"
Ben Lindstromcb72e4f2002-06-21 00:41:51 +0000318#define SSH_COM_PUBLIC_END "---- END SSH2 PUBLIC KEY ----"
Damien Miller874d77b2000-10-14 16:23:11 +1100319#define SSH_COM_PRIVATE_BEGIN "---- BEGIN SSH2 ENCRYPTED PRIVATE KEY ----"
Kevin Stevesef4eea92001-02-05 12:42:17 +0000320#define SSH_COM_PRIVATE_KEY_MAGIC 0x3f6ff9eb
Damien Millereba71ba2000-04-29 23:57:08 +1000321
Damien Miller1f0311c2014-05-15 14:24:09 +1000322#ifdef WITH_OPENSSL
Ben Lindstrombba81212001-06-25 05:01:22 +0000323static void
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000324do_convert_to_ssh2(struct passwd *pw, struct sshkey *k)
Damien Millereba71ba2000-04-29 23:57:08 +1000325{
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000326 size_t len;
Ben Lindstrom46c16222000-12-22 01:43:59 +0000327 u_char *blob;
Darren Tuckerd04758d2010-01-12 19:41:57 +1100328 char comment[61];
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000329 int r;
Damien Millereba71ba2000-04-29 23:57:08 +1000330
djm@openbsd.org3038a192015-04-17 13:19:22 +0000331 if ((r = sshkey_to_blob(k, &blob, &len)) != 0)
332 fatal("key_to_blob failed: %s", ssh_err(r));
Darren Tuckerd04758d2010-01-12 19:41:57 +1100333 /* Comment + surrounds must fit into 72 chars (RFC 4716 sec 3.3) */
334 snprintf(comment, sizeof(comment),
335 "%u-bit %s, converted by %s@%s from OpenSSH",
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000336 sshkey_size(k), sshkey_type(k),
Damien Millereba71ba2000-04-29 23:57:08 +1000337 pw->pw_name, hostname);
Darren Tuckerd04758d2010-01-12 19:41:57 +1100338
339 fprintf(stdout, "%s\n", SSH_COM_PUBLIC_BEGIN);
340 fprintf(stdout, "Comment: \"%s\"\n", comment);
Damien Millereba71ba2000-04-29 23:57:08 +1000341 dump_base64(stdout, blob, len);
Damien Miller874d77b2000-10-14 16:23:11 +1100342 fprintf(stdout, "%s\n", SSH_COM_PUBLIC_END);
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000343 sshkey_free(k);
Darren Tuckera627d422013-06-02 07:31:17 +1000344 free(blob);
Damien Millereba71ba2000-04-29 23:57:08 +1000345 exit(0);
346}
347
Ben Lindstrombba81212001-06-25 05:01:22 +0000348static void
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000349do_convert_to_pkcs8(struct sshkey *k)
Damien Miller44b25042010-07-02 13:35:01 +1000350{
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000351 switch (sshkey_type_plain(k->type)) {
Damien Miller44b25042010-07-02 13:35:01 +1000352 case KEY_RSA:
353 if (!PEM_write_RSA_PUBKEY(stdout, k->rsa))
354 fatal("PEM_write_RSA_PUBKEY failed");
355 break;
356 case KEY_DSA:
357 if (!PEM_write_DSA_PUBKEY(stdout, k->dsa))
358 fatal("PEM_write_DSA_PUBKEY failed");
359 break;
Damien Miller6af914a2010-09-10 11:39:26 +1000360#ifdef OPENSSL_HAS_ECC
Damien Millereb8b60e2010-08-31 22:41:14 +1000361 case KEY_ECDSA:
362 if (!PEM_write_EC_PUBKEY(stdout, k->ecdsa))
363 fatal("PEM_write_EC_PUBKEY failed");
364 break;
Damien Miller6af914a2010-09-10 11:39:26 +1000365#endif
Damien Miller44b25042010-07-02 13:35:01 +1000366 default:
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000367 fatal("%s: unsupported key type %s", __func__, sshkey_type(k));
Damien Miller44b25042010-07-02 13:35:01 +1000368 }
369 exit(0);
370}
371
372static void
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000373do_convert_to_pem(struct sshkey *k)
Damien Miller44b25042010-07-02 13:35:01 +1000374{
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000375 switch (sshkey_type_plain(k->type)) {
Damien Miller44b25042010-07-02 13:35:01 +1000376 case KEY_RSA:
377 if (!PEM_write_RSAPublicKey(stdout, k->rsa))
378 fatal("PEM_write_RSAPublicKey failed");
379 break;
Damien Miller44b25042010-07-02 13:35:01 +1000380 default:
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000381 fatal("%s: unsupported key type %s", __func__, sshkey_type(k));
Damien Miller44b25042010-07-02 13:35:01 +1000382 }
383 exit(0);
384}
385
386static void
387do_convert_to(struct passwd *pw)
388{
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000389 struct sshkey *k;
Damien Miller44b25042010-07-02 13:35:01 +1000390 struct stat st;
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000391 int r;
Damien Miller44b25042010-07-02 13:35:01 +1000392
393 if (!have_identity)
394 ask_filename(pw, "Enter file in which the key is");
395 if (stat(identity_file, &st) < 0)
396 fatal("%s: %s: %s", __progname, identity_file, strerror(errno));
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000397 if ((r = sshkey_load_public(identity_file, &k, NULL)) != 0)
398 k = load_identity(identity_file);
Damien Miller44b25042010-07-02 13:35:01 +1000399 switch (convert_format) {
400 case FMT_RFC4716:
401 do_convert_to_ssh2(pw, k);
402 break;
403 case FMT_PKCS8:
404 do_convert_to_pkcs8(k);
405 break;
406 case FMT_PEM:
407 do_convert_to_pem(k);
408 break;
409 default:
410 fatal("%s: unknown key format %d", __func__, convert_format);
411 }
412 exit(0);
413}
414
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000415/*
416 * This is almost exactly the bignum1 encoding, but with 32 bit for length
417 * instead of 16.
418 */
Damien Miller44b25042010-07-02 13:35:01 +1000419static void
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000420buffer_get_bignum_bits(struct sshbuf *b, BIGNUM *value)
Damien Miller874d77b2000-10-14 16:23:11 +1100421{
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000422 u_int bytes, bignum_bits;
423 int r;
Ben Lindstromd09fcf52001-03-29 00:29:54 +0000424
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000425 if ((r = sshbuf_get_u32(b, &bignum_bits)) != 0)
426 fatal("%s: buffer error: %s", __func__, ssh_err(r));
427 bytes = (bignum_bits + 7) / 8;
428 if (sshbuf_len(b) < bytes)
429 fatal("%s: input buffer too small: need %d have %zu",
430 __func__, bytes, sshbuf_len(b));
431 if (BN_bin2bn(sshbuf_ptr(b), bytes, value) == NULL)
432 fatal("%s: BN_bin2bn failed", __func__);
433 if ((r = sshbuf_consume(b, bytes)) != 0)
434 fatal("%s: buffer error: %s", __func__, ssh_err(r));
Damien Miller874d77b2000-10-14 16:23:11 +1100435}
436
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000437static struct sshkey *
Ben Lindstrom90fd8142002-02-26 18:09:42 +0000438do_convert_private_ssh2_from_blob(u_char *blob, u_int blen)
Damien Miller874d77b2000-10-14 16:23:11 +1100439{
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000440 struct sshbuf *b;
441 struct sshkey *key = NULL;
Damien Miller874d77b2000-10-14 16:23:11 +1100442 char *type, *cipher;
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000443 u_char e1, e2, e3, *sig = NULL, data[] = "abcde12345";
444 int r, rlen, ktype;
445 u_int magic, i1, i2, i3, i4;
446 size_t slen;
Ben Lindstrome586c4c2001-06-25 05:04:58 +0000447 u_long e;
Damien Miller874d77b2000-10-14 16:23:11 +1100448
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000449 if ((b = sshbuf_from(blob, blen)) == NULL)
450 fatal("%s: sshbuf_from failed", __func__);
451 if ((r = sshbuf_get_u32(b, &magic)) != 0)
452 fatal("%s: buffer error: %s", __func__, ssh_err(r));
Damien Miller874d77b2000-10-14 16:23:11 +1100453
Damien Miller874d77b2000-10-14 16:23:11 +1100454 if (magic != SSH_COM_PRIVATE_KEY_MAGIC) {
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000455 error("bad magic 0x%x != 0x%x", magic,
456 SSH_COM_PRIVATE_KEY_MAGIC);
457 sshbuf_free(b);
Damien Miller874d77b2000-10-14 16:23:11 +1100458 return NULL;
459 }
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000460 if ((r = sshbuf_get_u32(b, &i1)) != 0 ||
461 (r = sshbuf_get_cstring(b, &type, NULL)) != 0 ||
462 (r = sshbuf_get_cstring(b, &cipher, NULL)) != 0 ||
463 (r = sshbuf_get_u32(b, &i2)) != 0 ||
464 (r = sshbuf_get_u32(b, &i3)) != 0 ||
465 (r = sshbuf_get_u32(b, &i4)) != 0)
466 fatal("%s: buffer error: %s", __func__, ssh_err(r));
Damien Miller80163902007-01-05 16:30:16 +1100467 debug("ignore (%d %d %d %d)", i1, i2, i3, i4);
Damien Miller874d77b2000-10-14 16:23:11 +1100468 if (strcmp(cipher, "none") != 0) {
469 error("unsupported cipher %s", cipher);
Darren Tuckera627d422013-06-02 07:31:17 +1000470 free(cipher);
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000471 sshbuf_free(b);
Darren Tuckera627d422013-06-02 07:31:17 +1000472 free(type);
Damien Miller874d77b2000-10-14 16:23:11 +1100473 return NULL;
474 }
Darren Tuckera627d422013-06-02 07:31:17 +1000475 free(cipher);
Damien Miller874d77b2000-10-14 16:23:11 +1100476
Ben Lindstromd09fcf52001-03-29 00:29:54 +0000477 if (strstr(type, "dsa")) {
478 ktype = KEY_DSA;
479 } else if (strstr(type, "rsa")) {
480 ktype = KEY_RSA;
481 } else {
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000482 sshbuf_free(b);
Darren Tuckera627d422013-06-02 07:31:17 +1000483 free(type);
Damien Miller874d77b2000-10-14 16:23:11 +1100484 return NULL;
485 }
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000486 if ((key = sshkey_new_private(ktype)) == NULL)
markus@openbsd.org7da5df12017-05-30 14:16:41 +0000487 fatal("sshkey_new_private failed");
Darren Tuckera627d422013-06-02 07:31:17 +1000488 free(type);
Ben Lindstromd09fcf52001-03-29 00:29:54 +0000489
490 switch (key->type) {
491 case KEY_DSA:
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000492 buffer_get_bignum_bits(b, key->dsa->p);
493 buffer_get_bignum_bits(b, key->dsa->g);
494 buffer_get_bignum_bits(b, key->dsa->q);
495 buffer_get_bignum_bits(b, key->dsa->pub_key);
496 buffer_get_bignum_bits(b, key->dsa->priv_key);
Ben Lindstromd09fcf52001-03-29 00:29:54 +0000497 break;
498 case KEY_RSA:
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000499 if ((r = sshbuf_get_u8(b, &e1)) != 0 ||
500 (e1 < 30 && (r = sshbuf_get_u8(b, &e2)) != 0) ||
501 (e1 < 30 && (r = sshbuf_get_u8(b, &e3)) != 0))
502 fatal("%s: buffer error: %s", __func__, ssh_err(r));
503 e = e1;
Ben Lindstrom34f91882001-06-25 04:47:54 +0000504 debug("e %lx", e);
505 if (e < 30) {
506 e <<= 8;
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000507 e += e2;
Ben Lindstrom34f91882001-06-25 04:47:54 +0000508 debug("e %lx", e);
509 e <<= 8;
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000510 e += e3;
Ben Lindstrom34f91882001-06-25 04:47:54 +0000511 debug("e %lx", e);
512 }
513 if (!BN_set_word(key->rsa->e, e)) {
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000514 sshbuf_free(b);
515 sshkey_free(key);
Ben Lindstromd09fcf52001-03-29 00:29:54 +0000516 return NULL;
517 }
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000518 buffer_get_bignum_bits(b, key->rsa->d);
519 buffer_get_bignum_bits(b, key->rsa->n);
520 buffer_get_bignum_bits(b, key->rsa->iqmp);
521 buffer_get_bignum_bits(b, key->rsa->q);
522 buffer_get_bignum_bits(b, key->rsa->p);
djm@openbsd.org83fa3a02017-07-01 13:50:45 +0000523 if ((r = ssh_rsa_generate_additional_parameters(key)) != 0)
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000524 fatal("generate RSA parameters failed: %s", ssh_err(r));
Ben Lindstromd09fcf52001-03-29 00:29:54 +0000525 break;
526 }
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000527 rlen = sshbuf_len(b);
Ben Lindstrom1c37c6a2001-12-06 18:00:18 +0000528 if (rlen != 0)
Ben Lindstromd09fcf52001-03-29 00:29:54 +0000529 error("do_convert_private_ssh2_from_blob: "
530 "remaining bytes in key blob %d", rlen);
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000531 sshbuf_free(b);
Ben Lindstromd09fcf52001-03-29 00:29:54 +0000532
Ben Lindstrome586c4c2001-06-25 05:04:58 +0000533 /* try the key */
markus@openbsd.org76c9fbb2015-12-04 16:41:28 +0000534 if (sshkey_sign(key, &sig, &slen, data, sizeof(data), NULL, 0) != 0 ||
djm@openbsd.org04c7e282017-12-18 02:25:15 +0000535 sshkey_verify(key, sig, slen, data, sizeof(data), NULL, 0) != 0) {
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000536 sshkey_free(key);
537 free(sig);
538 return NULL;
539 }
Darren Tuckera627d422013-06-02 07:31:17 +1000540 free(sig);
Damien Miller874d77b2000-10-14 16:23:11 +1100541 return key;
542}
543
Damien Miller8056a9d2006-03-15 12:05:40 +1100544static int
545get_line(FILE *fp, char *line, size_t len)
546{
547 int c;
548 size_t pos = 0;
549
550 line[0] = '\0';
551 while ((c = fgetc(fp)) != EOF) {
djm@openbsd.org3038a192015-04-17 13:19:22 +0000552 if (pos >= len - 1)
553 fatal("input line too long.");
Damien Miller90967402006-03-26 14:07:26 +1100554 switch (c) {
Damien Miller8056a9d2006-03-15 12:05:40 +1100555 case '\r':
556 c = fgetc(fp);
djm@openbsd.org3038a192015-04-17 13:19:22 +0000557 if (c != EOF && c != '\n' && ungetc(c, fp) == EOF)
558 fatal("unget: %s", strerror(errno));
Damien Miller8056a9d2006-03-15 12:05:40 +1100559 return pos;
560 case '\n':
561 return pos;
562 }
563 line[pos++] = c;
564 line[pos] = '\0';
565 }
Damien Miller6c7439f2007-01-05 16:29:55 +1100566 /* We reached EOF */
567 return -1;
Damien Miller8056a9d2006-03-15 12:05:40 +1100568}
569
Ben Lindstrombba81212001-06-25 05:01:22 +0000570static void
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000571do_convert_from_ssh2(struct passwd *pw, struct sshkey **k, int *private)
Damien Millereba71ba2000-04-29 23:57:08 +1000572{
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000573 int r, blen, escaped = 0;
Ben Lindstrom155b9812002-04-02 20:26:26 +0000574 u_int len;
Damien Miller8056a9d2006-03-15 12:05:40 +1100575 char line[1024];
Ben Lindstrom9e0ddd42001-09-18 05:41:19 +0000576 u_char blob[8096];
Damien Millereba71ba2000-04-29 23:57:08 +1000577 char encoded[8096];
Damien Millereba71ba2000-04-29 23:57:08 +1000578 FILE *fp;
579
Damien Millerba3420a2010-06-26 09:39:07 +1000580 if ((fp = fopen(identity_file, "r")) == NULL)
581 fatal("%s: %s: %s", __progname, identity_file, strerror(errno));
Damien Millereba71ba2000-04-29 23:57:08 +1000582 encoded[0] = '\0';
Damien Miller8056a9d2006-03-15 12:05:40 +1100583 while ((blen = get_line(fp, line, sizeof(line))) != -1) {
Damien Miller746d1a62013-07-18 16:13:02 +1000584 if (blen > 0 && line[blen - 1] == '\\')
Damien Miller30c3d422000-05-09 11:02:59 +1000585 escaped++;
Damien Millereba71ba2000-04-29 23:57:08 +1000586 if (strncmp(line, "----", 4) == 0 ||
587 strstr(line, ": ") != NULL) {
Damien Miller874d77b2000-10-14 16:23:11 +1100588 if (strstr(line, SSH_COM_PRIVATE_BEGIN) != NULL)
Damien Miller44b25042010-07-02 13:35:01 +1000589 *private = 1;
Ben Lindstrome586c4c2001-06-25 05:04:58 +0000590 if (strstr(line, " END ") != NULL) {
591 break;
592 }
Ben Lindstrom30358602001-04-24 16:59:28 +0000593 /* fprintf(stderr, "ignore: %s", line); */
Damien Millereba71ba2000-04-29 23:57:08 +1000594 continue;
595 }
Damien Miller30c3d422000-05-09 11:02:59 +1000596 if (escaped) {
597 escaped--;
Ben Lindstrom30358602001-04-24 16:59:28 +0000598 /* fprintf(stderr, "escaped: %s", line); */
Damien Miller30c3d422000-05-09 11:02:59 +1000599 continue;
Damien Millereba71ba2000-04-29 23:57:08 +1000600 }
Damien Millereba71ba2000-04-29 23:57:08 +1000601 strlcat(encoded, line, sizeof(encoded));
602 }
Ben Lindstrom155b9812002-04-02 20:26:26 +0000603 len = strlen(encoded);
604 if (((len % 4) == 3) &&
605 (encoded[len-1] == '=') &&
606 (encoded[len-2] == '=') &&
607 (encoded[len-3] == '='))
608 encoded[len-3] = '\0';
Damien Miller4a8ed542002-01-22 23:33:31 +1100609 blen = uudecode(encoded, blob, sizeof(blob));
djm@openbsd.org3038a192015-04-17 13:19:22 +0000610 if (blen < 0)
611 fatal("uudecode failed.");
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000612 if (*private)
613 *k = do_convert_private_ssh2_from_blob(blob, blen);
djm@openbsd.org3038a192015-04-17 13:19:22 +0000614 else if ((r = sshkey_from_blob(blob, blen, k)) != 0)
615 fatal("decode blob failed: %s", ssh_err(r));
Damien Miller44b25042010-07-02 13:35:01 +1000616 fclose(fp);
617}
618
619static void
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000620do_convert_from_pkcs8(struct sshkey **k, int *private)
Damien Miller44b25042010-07-02 13:35:01 +1000621{
622 EVP_PKEY *pubkey;
623 FILE *fp;
624
625 if ((fp = fopen(identity_file, "r")) == NULL)
626 fatal("%s: %s: %s", __progname, identity_file, strerror(errno));
627 if ((pubkey = PEM_read_PUBKEY(fp, NULL, NULL, NULL)) == NULL) {
628 fatal("%s: %s is not a recognised public key format", __func__,
629 identity_file);
630 }
631 fclose(fp);
632 switch (EVP_PKEY_type(pubkey->type)) {
633 case EVP_PKEY_RSA:
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000634 if ((*k = sshkey_new(KEY_UNSPEC)) == NULL)
635 fatal("sshkey_new failed");
Damien Miller44b25042010-07-02 13:35:01 +1000636 (*k)->type = KEY_RSA;
637 (*k)->rsa = EVP_PKEY_get1_RSA(pubkey);
638 break;
639 case EVP_PKEY_DSA:
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000640 if ((*k = sshkey_new(KEY_UNSPEC)) == NULL)
641 fatal("sshkey_new failed");
Damien Miller44b25042010-07-02 13:35:01 +1000642 (*k)->type = KEY_DSA;
643 (*k)->dsa = EVP_PKEY_get1_DSA(pubkey);
644 break;
Damien Miller6af914a2010-09-10 11:39:26 +1000645#ifdef OPENSSL_HAS_ECC
Damien Millereb8b60e2010-08-31 22:41:14 +1000646 case EVP_PKEY_EC:
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000647 if ((*k = sshkey_new(KEY_UNSPEC)) == NULL)
648 fatal("sshkey_new failed");
Damien Millereb8b60e2010-08-31 22:41:14 +1000649 (*k)->type = KEY_ECDSA;
650 (*k)->ecdsa = EVP_PKEY_get1_EC_KEY(pubkey);
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000651 (*k)->ecdsa_nid = sshkey_ecdsa_key_to_nid((*k)->ecdsa);
Damien Millereb8b60e2010-08-31 22:41:14 +1000652 break;
Damien Miller6af914a2010-09-10 11:39:26 +1000653#endif
Damien Miller44b25042010-07-02 13:35:01 +1000654 default:
655 fatal("%s: unsupported pubkey type %d", __func__,
656 EVP_PKEY_type(pubkey->type));
657 }
658 EVP_PKEY_free(pubkey);
659 return;
660}
661
662static void
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000663do_convert_from_pem(struct sshkey **k, int *private)
Damien Miller44b25042010-07-02 13:35:01 +1000664{
665 FILE *fp;
666 RSA *rsa;
Damien Miller44b25042010-07-02 13:35:01 +1000667
668 if ((fp = fopen(identity_file, "r")) == NULL)
669 fatal("%s: %s: %s", __progname, identity_file, strerror(errno));
670 if ((rsa = PEM_read_RSAPublicKey(fp, NULL, NULL, NULL)) != NULL) {
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000671 if ((*k = sshkey_new(KEY_UNSPEC)) == NULL)
672 fatal("sshkey_new failed");
Damien Miller44b25042010-07-02 13:35:01 +1000673 (*k)->type = KEY_RSA;
674 (*k)->rsa = rsa;
675 fclose(fp);
676 return;
677 }
Damien Miller44b25042010-07-02 13:35:01 +1000678 fatal("%s: unrecognised raw private key format", __func__);
679}
680
681static void
682do_convert_from(struct passwd *pw)
683{
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000684 struct sshkey *k = NULL;
685 int r, private = 0, ok = 0;
Damien Miller44b25042010-07-02 13:35:01 +1000686 struct stat st;
687
688 if (!have_identity)
689 ask_filename(pw, "Enter file in which the key is");
690 if (stat(identity_file, &st) < 0)
691 fatal("%s: %s: %s", __progname, identity_file, strerror(errno));
692
693 switch (convert_format) {
694 case FMT_RFC4716:
695 do_convert_from_ssh2(pw, &k, &private);
696 break;
697 case FMT_PKCS8:
698 do_convert_from_pkcs8(&k, &private);
699 break;
700 case FMT_PEM:
701 do_convert_from_pem(&k, &private);
702 break;
703 default:
704 fatal("%s: unknown key format %d", __func__, convert_format);
705 }
706
djm@openbsd.org7a2c3682015-01-30 00:59:19 +0000707 if (!private) {
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000708 if ((r = sshkey_write(k, stdout)) == 0)
709 ok = 1;
Damien Miller44b25042010-07-02 13:35:01 +1000710 if (ok)
711 fprintf(stdout, "\n");
djm@openbsd.org7a2c3682015-01-30 00:59:19 +0000712 } else {
Damien Miller44b25042010-07-02 13:35:01 +1000713 switch (k->type) {
714 case KEY_DSA:
715 ok = PEM_write_DSAPrivateKey(stdout, k->dsa, NULL,
716 NULL, 0, NULL, NULL);
717 break;
Damien Miller6af914a2010-09-10 11:39:26 +1000718#ifdef OPENSSL_HAS_ECC
Damien Millereb8b60e2010-08-31 22:41:14 +1000719 case KEY_ECDSA:
720 ok = PEM_write_ECPrivateKey(stdout, k->ecdsa, NULL,
721 NULL, 0, NULL, NULL);
722 break;
Damien Miller6af914a2010-09-10 11:39:26 +1000723#endif
Damien Miller44b25042010-07-02 13:35:01 +1000724 case KEY_RSA:
725 ok = PEM_write_RSAPrivateKey(stdout, k->rsa, NULL,
726 NULL, 0, NULL, NULL);
727 break;
728 default:
729 fatal("%s: unsupported key type %s", __func__,
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000730 sshkey_type(k));
Damien Miller44b25042010-07-02 13:35:01 +1000731 }
732 }
733
djm@openbsd.org3038a192015-04-17 13:19:22 +0000734 if (!ok)
735 fatal("key write failed");
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000736 sshkey_free(k);
Damien Millereba71ba2000-04-29 23:57:08 +1000737 exit(0);
738}
Damien Miller1f0311c2014-05-15 14:24:09 +1000739#endif
Damien Millereba71ba2000-04-29 23:57:08 +1000740
Ben Lindstrombba81212001-06-25 05:01:22 +0000741static void
Damien Millereba71ba2000-04-29 23:57:08 +1000742do_print_public(struct passwd *pw)
743{
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000744 struct sshkey *prv;
Damien Millereba71ba2000-04-29 23:57:08 +1000745 struct stat st;
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000746 int r;
Damien Millereba71ba2000-04-29 23:57:08 +1000747
748 if (!have_identity)
749 ask_filename(pw, "Enter file in which the key is");
djm@openbsd.org3038a192015-04-17 13:19:22 +0000750 if (stat(identity_file, &st) < 0)
751 fatal("%s: %s", identity_file, strerror(errno));
Ben Lindstromd78ae762001-06-05 20:35:09 +0000752 prv = load_identity(identity_file);
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000753 if ((r = sshkey_write(prv, stdout)) != 0)
markus@openbsd.org7da5df12017-05-30 14:16:41 +0000754 error("sshkey_write failed: %s", ssh_err(r));
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000755 sshkey_free(prv);
Damien Millereba71ba2000-04-29 23:57:08 +1000756 fprintf(stdout, "\n");
757 exit(0);
758}
759
Ben Lindstromcd392282001-07-04 03:44:03 +0000760static void
Damien Miller757f34e2010-08-05 13:05:31 +1000761do_download(struct passwd *pw)
Ben Lindstromcd392282001-07-04 03:44:03 +0000762{
Damien Miller7ea845e2010-02-12 09:21:02 +1100763#ifdef ENABLE_PKCS11
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000764 struct sshkey **keys = NULL;
Damien Miller7ea845e2010-02-12 09:21:02 +1100765 int i, nkeys;
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000766 enum sshkey_fp_rep rep;
djm@openbsd.org56d1c832014-12-21 22:27:55 +0000767 int fptype;
Damien Millerec77c952013-01-09 15:58:00 +1100768 char *fp, *ra;
Ben Lindstrom8282d6a2001-08-06 21:44:05 +0000769
djm@openbsd.org56d1c832014-12-21 22:27:55 +0000770 fptype = print_bubblebabble ? SSH_DIGEST_SHA1 : fingerprint_hash;
771 rep = print_bubblebabble ? SSH_FP_BUBBLEBABBLE : SSH_FP_DEFAULT;
Damien Miller1422c082013-01-09 16:44:54 +1100772
Damien Miller7ea845e2010-02-12 09:21:02 +1100773 pkcs11_init(0);
774 nkeys = pkcs11_add_provider(pkcs11provider, NULL, &keys);
775 if (nkeys <= 0)
776 fatal("cannot read public key from pkcs11");
777 for (i = 0; i < nkeys; i++) {
Damien Millerec77c952013-01-09 15:58:00 +1100778 if (print_fingerprint) {
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000779 fp = sshkey_fingerprint(keys[i], fptype, rep);
780 ra = sshkey_fingerprint(keys[i], fingerprint_hash,
Damien Millerec77c952013-01-09 15:58:00 +1100781 SSH_FP_RANDOMART);
djm@openbsd.org9ce86c92015-01-28 22:36:00 +0000782 if (fp == NULL || ra == NULL)
783 fatal("%s: sshkey_fingerprint fail", __func__);
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000784 printf("%u %s %s (PKCS11 key)\n", sshkey_size(keys[i]),
785 fp, sshkey_type(keys[i]));
Damien Millerec77c952013-01-09 15:58:00 +1100786 if (log_level >= SYSLOG_LEVEL_VERBOSE)
787 printf("%s\n", ra);
Darren Tuckera627d422013-06-02 07:31:17 +1000788 free(ra);
789 free(fp);
Damien Millerec77c952013-01-09 15:58:00 +1100790 } else {
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000791 (void) sshkey_write(keys[i], stdout); /* XXX check */
Damien Millerec77c952013-01-09 15:58:00 +1100792 fprintf(stdout, "\n");
793 }
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000794 sshkey_free(keys[i]);
Ben Lindstrom0936a5b2002-03-26 03:17:42 +0000795 }
Darren Tuckera627d422013-06-02 07:31:17 +1000796 free(keys);
Damien Miller7ea845e2010-02-12 09:21:02 +1100797 pkcs11_terminate();
Ben Lindstrom8282d6a2001-08-06 21:44:05 +0000798 exit(0);
Damien Miller7ea845e2010-02-12 09:21:02 +1100799#else
800 fatal("no pkcs11 support");
801#endif /* ENABLE_PKCS11 */
Ben Lindstrom8282d6a2001-08-06 21:44:05 +0000802}
Ben Lindstromcd392282001-07-04 03:44:03 +0000803
djm@openbsd.orgc56a2552015-11-16 22:53:07 +0000804static struct sshkey *
805try_read_key(char **cpp)
806{
807 struct sshkey *ret;
808 int r;
809
djm@openbsd.orgc56a2552015-11-16 22:53:07 +0000810 if ((ret = sshkey_new(KEY_UNSPEC)) == NULL)
811 fatal("sshkey_new failed");
812 if ((r = sshkey_read(ret, cpp)) == 0)
813 return ret;
814 /* Not a key */
815 sshkey_free(ret);
816 return NULL;
817}
818
819static void
820fingerprint_one_key(const struct sshkey *public, const char *comment)
821{
822 char *fp = NULL, *ra = NULL;
823 enum sshkey_fp_rep rep;
824 int fptype;
825
826 fptype = print_bubblebabble ? SSH_DIGEST_SHA1 : fingerprint_hash;
827 rep = print_bubblebabble ? SSH_FP_BUBBLEBABBLE : SSH_FP_DEFAULT;
828 fp = sshkey_fingerprint(public, fptype, rep);
829 ra = sshkey_fingerprint(public, fingerprint_hash, SSH_FP_RANDOMART);
830 if (fp == NULL || ra == NULL)
831 fatal("%s: sshkey_fingerprint failed", __func__);
djm@openbsd.orga287c5a2017-02-10 03:36:40 +0000832 mprintf("%u %s %s (%s)\n", sshkey_size(public), fp,
djm@openbsd.orgc56a2552015-11-16 22:53:07 +0000833 comment ? comment : "no comment", sshkey_type(public));
834 if (log_level >= SYSLOG_LEVEL_VERBOSE)
835 printf("%s\n", ra);
836 free(ra);
837 free(fp);
838}
839
840static void
841fingerprint_private(const char *path)
842{
843 struct stat st;
844 char *comment = NULL;
845 struct sshkey *public = NULL;
846 int r;
847
848 if (stat(identity_file, &st) < 0)
849 fatal("%s: %s", path, strerror(errno));
djm@openbsd.orgbcb7bc72015-11-18 08:37:28 +0000850 if ((r = sshkey_load_public(path, &public, &comment)) != 0) {
851 debug("load public \"%s\": %s", path, ssh_err(r));
852 if ((r = sshkey_load_private(path, NULL,
853 &public, &comment)) != 0) {
854 debug("load private \"%s\": %s", path, ssh_err(r));
855 fatal("%s is not a key file.", path);
856 }
857 }
858
djm@openbsd.orgc56a2552015-11-16 22:53:07 +0000859 fingerprint_one_key(public, comment);
860 sshkey_free(public);
861 free(comment);
862}
863
Ben Lindstrombba81212001-06-25 05:01:22 +0000864static void
Damien Miller10f6f6b1999-11-17 17:29:08 +1100865do_fingerprint(struct passwd *pw)
866{
Damien Miller98c7ad62000-03-09 21:27:49 +1100867 FILE *f;
djm@openbsd.orgc56a2552015-11-16 22:53:07 +0000868 struct sshkey *public = NULL;
djm@openbsd.orgcce6a362015-12-11 03:19:09 +0000869 char *comment = NULL, *cp, *ep, line[SSH_MAX_PUBKEY_BYTES];
djm@openbsd.orgc56a2552015-11-16 22:53:07 +0000870 int i, invalid = 1;
871 const char *path;
djm@openbsd.org1a31d022016-05-02 08:49:03 +0000872 u_long lnum = 0;
Damien Miller10f6f6b1999-11-17 17:29:08 +1100873
Damien Miller95def091999-11-25 00:26:21 +1100874 if (!have_identity)
875 ask_filename(pw, "Enter file in which the key is");
djm@openbsd.orgc56a2552015-11-16 22:53:07 +0000876 path = identity_file;
Damien Miller98c7ad62000-03-09 21:27:49 +1100877
djm@openbsd.orgc56a2552015-11-16 22:53:07 +0000878 if (strcmp(identity_file, "-") == 0) {
879 f = stdin;
880 path = "(stdin)";
881 } else if ((f = fopen(path, "r")) == NULL)
882 fatal("%s: %s: %s", __progname, path, strerror(errno));
Damien Miller98c7ad62000-03-09 21:27:49 +1100883
djm@openbsd.orgc56a2552015-11-16 22:53:07 +0000884 while (read_keyfile_line(f, path, line, sizeof(line), &lnum) == 0) {
885 cp = line;
886 cp[strcspn(cp, "\n")] = '\0';
887 /* Trim leading space and comments */
888 cp = line + strspn(line, " \t");
889 if (*cp == '#' || *cp == '\0')
890 continue;
891
892 /*
893 * Input may be plain keys, private keys, authorized_keys
894 * or known_hosts.
895 */
896
897 /*
898 * Try private keys first. Assume a key is private if
899 * "SSH PRIVATE KEY" appears on the first line and we're
900 * not reading from stdin (XXX support private keys on stdin).
901 */
902 if (lnum == 1 && strcmp(identity_file, "-") != 0 &&
djm@openbsd.orgbcb7bc72015-11-18 08:37:28 +0000903 strstr(cp, "PRIVATE KEY") != NULL) {
djm@openbsd.orgc56a2552015-11-16 22:53:07 +0000904 fclose(f);
905 fingerprint_private(path);
906 exit(0);
907 }
908
909 /*
910 * If it's not a private key, then this must be prepared to
911 * accept a public key prefixed with a hostname or options.
912 * Try a bare key first, otherwise skip the leading stuff.
913 */
914 if ((public = try_read_key(&cp)) == NULL) {
915 i = strtol(cp, &ep, 10);
916 if (i == 0 || ep == NULL ||
917 (*ep != ' ' && *ep != '\t')) {
918 int quoted = 0;
919
920 comment = cp;
921 for (; *cp && (quoted || (*cp != ' ' &&
922 *cp != '\t')); cp++) {
923 if (*cp == '\\' && cp[1] == '"')
924 cp++; /* Skip both */
925 else if (*cp == '"')
926 quoted = !quoted;
927 }
928 if (!*cp)
929 continue;
930 *cp++ = '\0';
931 }
932 }
933 /* Retry after parsing leading hostname/key options */
934 if (public == NULL && (public = try_read_key(&cp)) == NULL) {
djm@openbsd.org1a31d022016-05-02 08:49:03 +0000935 debug("%s:%lu: not a public key", path, lnum);
Damien Millerba3420a2010-06-26 09:39:07 +1000936 continue;
Damien Miller95def091999-11-25 00:26:21 +1100937 }
Damien Millerba3420a2010-06-26 09:39:07 +1000938
djm@openbsd.orgc56a2552015-11-16 22:53:07 +0000939 /* Find trailing comment, if any */
940 for (; *cp == ' ' || *cp == '\t'; cp++)
Damien Millerba3420a2010-06-26 09:39:07 +1000941 ;
djm@openbsd.orgc56a2552015-11-16 22:53:07 +0000942 if (*cp != '\0' && *cp != '#')
Damien Millerba3420a2010-06-26 09:39:07 +1000943 comment = cp;
djm@openbsd.orgc56a2552015-11-16 22:53:07 +0000944
945 fingerprint_one_key(public, comment);
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000946 sshkey_free(public);
djm@openbsd.orgc56a2552015-11-16 22:53:07 +0000947 invalid = 0; /* One good key in the file is sufficient */
Damien Miller95def091999-11-25 00:26:21 +1100948 }
Damien Millerba3420a2010-06-26 09:39:07 +1000949 fclose(f);
950
djm@openbsd.org3038a192015-04-17 13:19:22 +0000951 if (invalid)
djm@openbsd.orgc56a2552015-11-16 22:53:07 +0000952 fatal("%s is not a public key file.", path);
Damien Miller95def091999-11-25 00:26:21 +1100953 exit(0);
Damien Miller10f6f6b1999-11-17 17:29:08 +1100954}
955
Damien Miller4b42d7f2005-03-01 21:48:35 +1100956static void
Damien Miller58f1baf2011-05-05 14:06:15 +1000957do_gen_all_hostkeys(struct passwd *pw)
958{
959 struct {
960 char *key_type;
961 char *key_type_display;
962 char *path;
963 } key_types[] = {
djm@openbsd.org5c27e3b2015-03-23 06:06:38 +0000964#ifdef WITH_OPENSSL
Damien Miller58f1baf2011-05-05 14:06:15 +1000965 { "rsa", "RSA" ,_PATH_HOST_RSA_KEY_FILE },
966 { "dsa", "DSA", _PATH_HOST_DSA_KEY_FILE },
Damien Millerb56e4932012-02-06 07:41:27 +1100967#ifdef OPENSSL_HAS_ECC
Damien Miller58f1baf2011-05-05 14:06:15 +1000968 { "ecdsa", "ECDSA",_PATH_HOST_ECDSA_KEY_FILE },
djm@openbsd.org5c27e3b2015-03-23 06:06:38 +0000969#endif /* OPENSSL_HAS_ECC */
970#endif /* WITH_OPENSSL */
Damien Miller5be9d9e2013-12-07 11:24:01 +1100971 { "ed25519", "ED25519",_PATH_HOST_ED25519_KEY_FILE },
Damien Miller58f1baf2011-05-05 14:06:15 +1000972 { NULL, NULL, NULL }
973 };
974
975 int first = 0;
976 struct stat st;
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000977 struct sshkey *private, *public;
djm@openbsd.org853edbe2017-07-07 03:53:12 +0000978 char comment[1024], *prv_tmp, *pub_tmp, *prv_file, *pub_file;
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000979 int i, type, fd, r;
Damien Miller58f1baf2011-05-05 14:06:15 +1000980 FILE *f;
981
982 for (i = 0; key_types[i].key_type; i++) {
djm@openbsd.org853edbe2017-07-07 03:53:12 +0000983 public = private = NULL;
984 prv_tmp = pub_tmp = prv_file = pub_file = NULL;
985
986 xasprintf(&prv_file, "%s%s",
987 identity_file, key_types[i].path);
988
989 /* Check whether private key exists and is not zero-length */
990 if (stat(prv_file, &st) == 0) {
991 if (st.st_size != 0)
992 goto next;
993 } else if (errno != ENOENT) {
djm@openbsd.org3038a192015-04-17 13:19:22 +0000994 error("Could not stat %s: %s", key_types[i].path,
Damien Miller58f1baf2011-05-05 14:06:15 +1000995 strerror(errno));
djm@openbsd.org853edbe2017-07-07 03:53:12 +0000996 goto failnext;
Damien Miller58f1baf2011-05-05 14:06:15 +1000997 }
998
djm@openbsd.org853edbe2017-07-07 03:53:12 +0000999 /*
1000 * Private key doesn't exist or is invalid; proceed with
1001 * key generation.
1002 */
1003 xasprintf(&prv_tmp, "%s%s.XXXXXXXXXX",
1004 identity_file, key_types[i].path);
1005 xasprintf(&pub_tmp, "%s%s.pub.XXXXXXXXXX",
1006 identity_file, key_types[i].path);
1007 xasprintf(&pub_file, "%s%s.pub",
1008 identity_file, key_types[i].path);
1009
Damien Miller58f1baf2011-05-05 14:06:15 +10001010 if (first == 0) {
1011 first = 1;
1012 printf("%s: generating new host keys: ", __progname);
1013 }
1014 printf("%s ", key_types[i].key_type_display);
1015 fflush(stdout);
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00001016 type = sshkey_type_from_name(key_types[i].key_type);
djm@openbsd.org853edbe2017-07-07 03:53:12 +00001017 if ((fd = mkstemp(prv_tmp)) == -1) {
1018 error("Could not save your public key in %s: %s",
1019 prv_tmp, strerror(errno));
1020 goto failnext;
1021 }
1022 close(fd); /* just using mkstemp() to generate/reserve a name */
Damien Miller58f1baf2011-05-05 14:06:15 +10001023 bits = 0;
djm@openbsd.org7efb4552015-01-18 13:22:28 +00001024 type_bits_valid(type, NULL, &bits);
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00001025 if ((r = sshkey_generate(type, bits, &private)) != 0) {
markus@openbsd.org7da5df12017-05-30 14:16:41 +00001026 error("sshkey_generate failed: %s", ssh_err(r));
djm@openbsd.org853edbe2017-07-07 03:53:12 +00001027 goto failnext;
Damien Miller58f1baf2011-05-05 14:06:15 +10001028 }
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00001029 if ((r = sshkey_from_private(private, &public)) != 0)
1030 fatal("sshkey_from_private failed: %s", ssh_err(r));
Damien Miller58f1baf2011-05-05 14:06:15 +10001031 snprintf(comment, sizeof comment, "%s@%s", pw->pw_name,
1032 hostname);
djm@openbsd.org853edbe2017-07-07 03:53:12 +00001033 if ((r = sshkey_save_private(private, prv_tmp, "",
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00001034 comment, use_new_format, new_format_cipher, rounds)) != 0) {
djm@openbsd.org3038a192015-04-17 13:19:22 +00001035 error("Saving key \"%s\" failed: %s",
djm@openbsd.org853edbe2017-07-07 03:53:12 +00001036 prv_tmp, ssh_err(r));
1037 goto failnext;
Damien Miller58f1baf2011-05-05 14:06:15 +10001038 }
djm@openbsd.org853edbe2017-07-07 03:53:12 +00001039 if ((fd = mkstemp(pub_tmp)) == -1) {
1040 error("Could not save your public key in %s: %s",
1041 pub_tmp, strerror(errno));
1042 goto failnext;
Damien Miller58f1baf2011-05-05 14:06:15 +10001043 }
djm@openbsd.org853edbe2017-07-07 03:53:12 +00001044 (void)fchmod(fd, 0644);
Damien Miller58f1baf2011-05-05 14:06:15 +10001045 f = fdopen(fd, "w");
1046 if (f == NULL) {
djm@openbsd.org853edbe2017-07-07 03:53:12 +00001047 error("fdopen %s failed: %s", pub_tmp, strerror(errno));
doug@openbsd.org7df88182014-08-21 01:08:52 +00001048 close(fd);
djm@openbsd.org853edbe2017-07-07 03:53:12 +00001049 goto failnext;
Damien Miller58f1baf2011-05-05 14:06:15 +10001050 }
djm@openbsd.orgbb8b4422015-01-16 15:55:07 +00001051 if ((r = sshkey_write(public, f)) != 0) {
djm@openbsd.org3038a192015-04-17 13:19:22 +00001052 error("write key failed: %s", ssh_err(r));
doug@openbsd.org7df88182014-08-21 01:08:52 +00001053 fclose(f);
djm@openbsd.org853edbe2017-07-07 03:53:12 +00001054 goto failnext;
Damien Miller58f1baf2011-05-05 14:06:15 +10001055 }
1056 fprintf(f, " %s\n", comment);
djm@openbsd.org853edbe2017-07-07 03:53:12 +00001057 if (ferror(f) != 0) {
1058 error("write key failed: %s", strerror(errno));
1059 fclose(f);
1060 goto failnext;
1061 }
1062 if (fclose(f) != 0) {
1063 error("key close failed: %s", strerror(errno));
1064 goto failnext;
1065 }
Damien Miller58f1baf2011-05-05 14:06:15 +10001066
djm@openbsd.org853edbe2017-07-07 03:53:12 +00001067 /* Rename temporary files to their permanent locations. */
1068 if (rename(pub_tmp, pub_file) != 0) {
1069 error("Unable to move %s into position: %s",
1070 pub_file, strerror(errno));
1071 goto failnext;
1072 }
1073 if (rename(prv_tmp, prv_file) != 0) {
1074 error("Unable to move %s into position: %s",
1075 key_types[i].path, strerror(errno));
1076 failnext:
1077 first = 0;
1078 goto next;
1079 }
1080 next:
1081 sshkey_free(private);
1082 sshkey_free(public);
1083 free(prv_tmp);
1084 free(pub_tmp);
1085 free(prv_file);
1086 free(pub_file);
Damien Miller58f1baf2011-05-05 14:06:15 +10001087 }
1088 if (first != 0)
1089 printf("\n");
1090}
1091
djm@openbsd.orgcecb30b2015-01-18 21:49:42 +00001092struct known_hosts_ctx {
djm@openbsd.org2b3c3c72015-01-18 21:51:19 +00001093 const char *host; /* Hostname searched for in find/delete case */
1094 FILE *out; /* Output file, stdout for find_hosts case */
1095 int has_unhashed; /* When hashing, original had unhashed hosts */
1096 int found_key; /* For find/delete, host was found */
1097 int invalid; /* File contained invalid items; don't delete */
djm@openbsd.orgcecb30b2015-01-18 21:49:42 +00001098};
1099
1100static int
1101known_hosts_hash(struct hostkey_foreach_line *l, void *_ctx)
Damien Miller4b42d7f2005-03-01 21:48:35 +11001102{
djm@openbsd.orgcecb30b2015-01-18 21:49:42 +00001103 struct known_hosts_ctx *ctx = (struct known_hosts_ctx *)_ctx;
1104 char *hashed, *cp, *hosts, *ohosts;
1105 int has_wild = l->hosts && strcspn(l->hosts, "*?!") != strlen(l->hosts);
dtucker@openbsd.org18501152017-03-06 02:03:20 +00001106 int was_hashed = l->hosts && l->hosts[0] == HASH_DELIM;
Darren Tucker0f7e9102008-06-08 12:54:29 +10001107
djm@openbsd.org6c5c9492015-02-16 22:08:57 +00001108 switch (l->status) {
1109 case HKF_STATUS_OK:
1110 case HKF_STATUS_MATCHED:
1111 /*
1112 * Don't hash hosts already already hashed, with wildcard
1113 * characters or a CA/revocation marker.
1114 */
djm@openbsd.org12d37672017-03-03 06:13:11 +00001115 if (was_hashed || has_wild || l->marker != MRK_NONE) {
djm@openbsd.org6c5c9492015-02-16 22:08:57 +00001116 fprintf(ctx->out, "%s\n", l->line);
1117 if (has_wild && !find_host) {
dtucker@openbsd.orgd0723702017-03-06 00:44:51 +00001118 logit("%s:%lu: ignoring host name "
djm@openbsd.org3038a192015-04-17 13:19:22 +00001119 "with wildcard: %.64s", l->path,
djm@openbsd.org6c5c9492015-02-16 22:08:57 +00001120 l->linenum, l->hosts);
1121 }
1122 return 0;
1123 }
1124 /*
1125 * Split any comma-separated hostnames from the host list,
1126 * hash and store separately.
1127 */
1128 ohosts = hosts = xstrdup(l->hosts);
1129 while ((cp = strsep(&hosts, ",")) != NULL && *cp != '\0') {
djm@openbsd.orgdb259722017-03-10 04:26:06 +00001130 lowercase(cp);
djm@openbsd.org6c5c9492015-02-16 22:08:57 +00001131 if ((hashed = host_hash(cp, NULL, 0)) == NULL)
1132 fatal("hash_host failed");
1133 fprintf(ctx->out, "%s %s\n", hashed, l->rawkey);
1134 ctx->has_unhashed = 1;
1135 }
1136 free(ohosts);
1137 return 0;
1138 case HKF_STATUS_INVALID:
1139 /* Retain invalid lines, but mark file as invalid. */
djm@openbsd.orgcecb30b2015-01-18 21:49:42 +00001140 ctx->invalid = 1;
dtucker@openbsd.orgd0723702017-03-06 00:44:51 +00001141 logit("%s:%lu: invalid line", l->path, l->linenum);
djm@openbsd.org6c5c9492015-02-16 22:08:57 +00001142 /* FALLTHROUGH */
1143 default:
djm@openbsd.orgcecb30b2015-01-18 21:49:42 +00001144 fprintf(ctx->out, "%s\n", l->line);
1145 return 0;
Darren Tucker0f7e9102008-06-08 12:54:29 +10001146 }
djm@openbsd.org6c5c9492015-02-16 22:08:57 +00001147 /* NOTREACHED */
1148 return -1;
djm@openbsd.orgcecb30b2015-01-18 21:49:42 +00001149}
1150
1151static int
1152known_hosts_find_delete(struct hostkey_foreach_line *l, void *_ctx)
1153{
1154 struct known_hosts_ctx *ctx = (struct known_hosts_ctx *)_ctx;
djm@openbsd.org4739e8d2015-05-21 12:01:19 +00001155 enum sshkey_fp_rep rep;
1156 int fptype;
1157 char *fp;
1158
1159 fptype = print_bubblebabble ? SSH_DIGEST_SHA1 : fingerprint_hash;
1160 rep = print_bubblebabble ? SSH_FP_BUBBLEBABBLE : SSH_FP_DEFAULT;
djm@openbsd.orgcecb30b2015-01-18 21:49:42 +00001161
djm@openbsd.org6c5c9492015-02-16 22:08:57 +00001162 if (l->status == HKF_STATUS_MATCHED) {
djm@openbsd.orgcecb30b2015-01-18 21:49:42 +00001163 if (delete_host) {
1164 if (l->marker != MRK_NONE) {
1165 /* Don't remove CA and revocation lines */
1166 fprintf(ctx->out, "%s\n", l->line);
1167 } else {
1168 /*
1169 * Hostname matches and has no CA/revoke
1170 * marker, delete it by *not* writing the
1171 * line to ctx->out.
1172 */
1173 ctx->found_key = 1;
1174 if (!quiet)
dtucker@openbsd.orgd0723702017-03-06 00:44:51 +00001175 printf("# Host %s found: line %lu\n",
djm@openbsd.orgcecb30b2015-01-18 21:49:42 +00001176 ctx->host, l->linenum);
1177 }
1178 return 0;
1179 } else if (find_host) {
1180 ctx->found_key = 1;
1181 if (!quiet) {
dtucker@openbsd.orgd0723702017-03-06 00:44:51 +00001182 printf("# Host %s found: line %lu %s\n",
djm@openbsd.orgcecb30b2015-01-18 21:49:42 +00001183 ctx->host,
1184 l->linenum, l->marker == MRK_CA ? "CA" :
1185 (l->marker == MRK_REVOKE ? "REVOKED" : ""));
1186 }
1187 if (hash_hosts)
1188 known_hosts_hash(l, ctx);
djm@openbsd.org4739e8d2015-05-21 12:01:19 +00001189 else if (print_fingerprint) {
1190 fp = sshkey_fingerprint(l->key, fptype, rep);
djm@openbsd.orga287c5a2017-02-10 03:36:40 +00001191 mprintf("%s %s %s %s\n", ctx->host,
djm@openbsd.org4739e8d2015-05-21 12:01:19 +00001192 sshkey_type(l->key), fp, l->comment);
1193 free(fp);
1194 } else
djm@openbsd.orgcecb30b2015-01-18 21:49:42 +00001195 fprintf(ctx->out, "%s\n", l->line);
1196 return 0;
1197 }
1198 } else if (delete_host) {
1199 /* Retain non-matching hosts when deleting */
1200 if (l->status == HKF_STATUS_INVALID) {
1201 ctx->invalid = 1;
dtucker@openbsd.orgd0723702017-03-06 00:44:51 +00001202 logit("%s:%lu: invalid line", l->path, l->linenum);
djm@openbsd.orgcecb30b2015-01-18 21:49:42 +00001203 }
1204 fprintf(ctx->out, "%s\n", l->line);
1205 }
1206 return 0;
Damien Miller4b42d7f2005-03-01 21:48:35 +11001207}
1208
1209static void
1210do_known_hosts(struct passwd *pw, const char *name)
1211{
deraadt@openbsd.orgd2099de2015-01-19 00:32:54 +00001212 char *cp, tmp[PATH_MAX], old[PATH_MAX];
djm@openbsd.org2b3c3c72015-01-18 21:51:19 +00001213 int r, fd, oerrno, inplace = 0;
djm@openbsd.orgcecb30b2015-01-18 21:49:42 +00001214 struct known_hosts_ctx ctx;
djm@openbsd.org4739e8d2015-05-21 12:01:19 +00001215 u_int foreach_options;
Damien Miller4b42d7f2005-03-01 21:48:35 +11001216
1217 if (!have_identity) {
1218 cp = tilde_expand_filename(_PATH_SSH_USER_HOSTFILE, pw->pw_uid);
1219 if (strlcpy(identity_file, cp, sizeof(identity_file)) >=
1220 sizeof(identity_file))
1221 fatal("Specified known hosts path too long");
Darren Tuckera627d422013-06-02 07:31:17 +10001222 free(cp);
Damien Miller4b42d7f2005-03-01 21:48:35 +11001223 have_identity = 1;
1224 }
Damien Miller4b42d7f2005-03-01 21:48:35 +11001225
djm@openbsd.orgcecb30b2015-01-18 21:49:42 +00001226 memset(&ctx, 0, sizeof(ctx));
1227 ctx.out = stdout;
1228 ctx.host = name;
1229
Damien Miller4b42d7f2005-03-01 21:48:35 +11001230 /*
1231 * Find hosts goes to stdout, hash and deletions happen in-place
1232 * A corner case is ssh-keygen -HF foo, which should go to stdout
1233 */
1234 if (!find_host && (hash_hosts || delete_host)) {
1235 if (strlcpy(tmp, identity_file, sizeof(tmp)) >= sizeof(tmp) ||
1236 strlcat(tmp, ".XXXXXXXXXX", sizeof(tmp)) >= sizeof(tmp) ||
1237 strlcpy(old, identity_file, sizeof(old)) >= sizeof(old) ||
1238 strlcat(old, ".old", sizeof(old)) >= sizeof(old))
1239 fatal("known_hosts path too long");
1240 umask(077);
djm@openbsd.orgcecb30b2015-01-18 21:49:42 +00001241 if ((fd = mkstemp(tmp)) == -1)
Damien Miller4b42d7f2005-03-01 21:48:35 +11001242 fatal("mkstemp: %s", strerror(errno));
djm@openbsd.orgcecb30b2015-01-18 21:49:42 +00001243 if ((ctx.out = fdopen(fd, "w")) == NULL) {
1244 oerrno = errno;
Damien Miller4b42d7f2005-03-01 21:48:35 +11001245 unlink(tmp);
djm@openbsd.orgcecb30b2015-01-18 21:49:42 +00001246 fatal("fdopen: %s", strerror(oerrno));
Damien Miller4b42d7f2005-03-01 21:48:35 +11001247 }
djm@openbsd.org2b3c3c72015-01-18 21:51:19 +00001248 inplace = 1;
Damien Miller4b42d7f2005-03-01 21:48:35 +11001249 }
1250
djm@openbsd.orgcecb30b2015-01-18 21:49:42 +00001251 /* XXX support identity_file == "-" for stdin */
djm@openbsd.org4739e8d2015-05-21 12:01:19 +00001252 foreach_options = find_host ? HKF_WANT_MATCH : 0;
1253 foreach_options |= print_fingerprint ? HKF_WANT_PARSE_KEY : 0;
djm@openbsd.orgcecb30b2015-01-18 21:49:42 +00001254 if ((r = hostkeys_foreach(identity_file,
1255 hash_hosts ? known_hosts_hash : known_hosts_find_delete, &ctx,
deraadt@openbsd.org6da413c2015-11-28 06:50:52 +00001256 name, NULL, foreach_options)) != 0) {
1257 if (inplace)
1258 unlink(tmp);
djm@openbsd.orgcecb30b2015-01-18 21:49:42 +00001259 fatal("%s: hostkeys_foreach failed: %s", __func__, ssh_err(r));
deraadt@openbsd.org6da413c2015-11-28 06:50:52 +00001260 }
Damien Miller4b42d7f2005-03-01 21:48:35 +11001261
djm@openbsd.org2b3c3c72015-01-18 21:51:19 +00001262 if (inplace)
djm@openbsd.orgcecb30b2015-01-18 21:49:42 +00001263 fclose(ctx.out);
Damien Miller0a80ca12010-02-27 07:55:05 +11001264
djm@openbsd.orgcecb30b2015-01-18 21:49:42 +00001265 if (ctx.invalid) {
djm@openbsd.org3038a192015-04-17 13:19:22 +00001266 error("%s is not a valid known_hosts file.", identity_file);
djm@openbsd.org2b3c3c72015-01-18 21:51:19 +00001267 if (inplace) {
djm@openbsd.org3038a192015-04-17 13:19:22 +00001268 error("Not replacing existing known_hosts "
1269 "file because of errors");
Damien Miller4b42d7f2005-03-01 21:48:35 +11001270 unlink(tmp);
1271 }
1272 exit(1);
djm@openbsd.orgcecb30b2015-01-18 21:49:42 +00001273 } else if (delete_host && !ctx.found_key) {
djm@openbsd.org3038a192015-04-17 13:19:22 +00001274 logit("Host %s not found in %s", name, identity_file);
djm@openbsd.orgc8376432015-08-19 23:17:51 +00001275 if (inplace)
1276 unlink(tmp);
djm@openbsd.org2b3c3c72015-01-18 21:51:19 +00001277 } else if (inplace) {
Damien Miller4b42d7f2005-03-01 21:48:35 +11001278 /* Backup existing file */
1279 if (unlink(old) == -1 && errno != ENOENT)
1280 fatal("unlink %.100s: %s", old, strerror(errno));
1281 if (link(identity_file, old) == -1)
1282 fatal("link %.100s to %.100s: %s", identity_file, old,
1283 strerror(errno));
1284 /* Move new one into place */
1285 if (rename(tmp, identity_file) == -1) {
1286 error("rename\"%s\" to \"%s\": %s", tmp, identity_file,
1287 strerror(errno));
1288 unlink(tmp);
1289 unlink(old);
1290 exit(1);
1291 }
1292
djm@openbsd.org3038a192015-04-17 13:19:22 +00001293 printf("%s updated.\n", identity_file);
1294 printf("Original contents retained as %s\n", old);
djm@openbsd.orgcecb30b2015-01-18 21:49:42 +00001295 if (ctx.has_unhashed) {
djm@openbsd.org3038a192015-04-17 13:19:22 +00001296 logit("WARNING: %s contains unhashed entries", old);
1297 logit("Delete this file to ensure privacy "
1298 "of hostnames");
Damien Miller4b42d7f2005-03-01 21:48:35 +11001299 }
1300 }
1301
djm@openbsd.orgcecb30b2015-01-18 21:49:42 +00001302 exit (find_host && !ctx.found_key);
Damien Miller4b42d7f2005-03-01 21:48:35 +11001303}
1304
Damien Miller95def091999-11-25 00:26:21 +11001305/*
1306 * Perform changing a passphrase. The argument is the passwd structure
1307 * for the current user.
1308 */
Ben Lindstrombba81212001-06-25 05:01:22 +00001309static void
Damien Miller10f6f6b1999-11-17 17:29:08 +11001310do_change_passphrase(struct passwd *pw)
1311{
Damien Miller95def091999-11-25 00:26:21 +11001312 char *comment;
1313 char *old_passphrase, *passphrase1, *passphrase2;
1314 struct stat st;
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00001315 struct sshkey *private;
1316 int r;
Damien Miller10f6f6b1999-11-17 17:29:08 +11001317
Damien Miller95def091999-11-25 00:26:21 +11001318 if (!have_identity)
1319 ask_filename(pw, "Enter file in which the key is");
djm@openbsd.org3038a192015-04-17 13:19:22 +00001320 if (stat(identity_file, &st) < 0)
1321 fatal("%s: %s", identity_file, strerror(errno));
Damien Miller95def091999-11-25 00:26:21 +11001322 /* Try to load the file with empty passphrase. */
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00001323 r = sshkey_load_private(identity_file, "", &private, &comment);
1324 if (r == SSH_ERR_KEY_WRONG_PASSPHRASE) {
Damien Miller95def091999-11-25 00:26:21 +11001325 if (identity_passphrase)
1326 old_passphrase = xstrdup(identity_passphrase);
1327 else
Ben Lindstrom949974b2001-06-25 05:20:31 +00001328 old_passphrase =
1329 read_passphrase("Enter old passphrase: ",
1330 RP_ALLOW_STDIN);
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00001331 r = sshkey_load_private(identity_file, old_passphrase,
1332 &private, &comment);
Damien Millera5103f42014-02-04 11:20:14 +11001333 explicit_bzero(old_passphrase, strlen(old_passphrase));
Darren Tuckera627d422013-06-02 07:31:17 +10001334 free(old_passphrase);
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00001335 if (r != 0)
1336 goto badkey;
1337 } else if (r != 0) {
1338 badkey:
djm@openbsd.org3038a192015-04-17 13:19:22 +00001339 fatal("Failed to load key %s: %s", identity_file, ssh_err(r));
Damien Miller95def091999-11-25 00:26:21 +11001340 }
djm@openbsd.orgf43d1722015-02-26 20:45:47 +00001341 if (comment)
djm@openbsd.orga287c5a2017-02-10 03:36:40 +00001342 mprintf("Key has comment '%s'\n", comment);
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001343
Damien Miller95def091999-11-25 00:26:21 +11001344 /* Ask the new passphrase (twice). */
1345 if (identity_new_passphrase) {
1346 passphrase1 = xstrdup(identity_new_passphrase);
1347 passphrase2 = NULL;
1348 } else {
1349 passphrase1 =
Ben Lindstrom949974b2001-06-25 05:20:31 +00001350 read_passphrase("Enter new passphrase (empty for no "
1351 "passphrase): ", RP_ALLOW_STDIN);
1352 passphrase2 = read_passphrase("Enter same passphrase again: ",
Damien Miller9f0f5c62001-12-21 14:45:46 +11001353 RP_ALLOW_STDIN);
Damien Miller95def091999-11-25 00:26:21 +11001354
1355 /* Verify that they are the same. */
1356 if (strcmp(passphrase1, passphrase2) != 0) {
Damien Millera5103f42014-02-04 11:20:14 +11001357 explicit_bzero(passphrase1, strlen(passphrase1));
1358 explicit_bzero(passphrase2, strlen(passphrase2));
Darren Tuckera627d422013-06-02 07:31:17 +10001359 free(passphrase1);
1360 free(passphrase2);
Damien Miller95def091999-11-25 00:26:21 +11001361 printf("Pass phrases do not match. Try again.\n");
1362 exit(1);
1363 }
1364 /* Destroy the other copy. */
Damien Millera5103f42014-02-04 11:20:14 +11001365 explicit_bzero(passphrase2, strlen(passphrase2));
Darren Tuckera627d422013-06-02 07:31:17 +10001366 free(passphrase2);
Damien Miller95def091999-11-25 00:26:21 +11001367 }
1368
1369 /* Save the file using the new passphrase. */
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00001370 if ((r = sshkey_save_private(private, identity_file, passphrase1,
1371 comment, use_new_format, new_format_cipher, rounds)) != 0) {
djm@openbsd.org3038a192015-04-17 13:19:22 +00001372 error("Saving key \"%s\" failed: %s.",
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00001373 identity_file, ssh_err(r));
Damien Millera5103f42014-02-04 11:20:14 +11001374 explicit_bzero(passphrase1, strlen(passphrase1));
Darren Tuckera627d422013-06-02 07:31:17 +10001375 free(passphrase1);
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00001376 sshkey_free(private);
Darren Tuckera627d422013-06-02 07:31:17 +10001377 free(comment);
Damien Miller95def091999-11-25 00:26:21 +11001378 exit(1);
1379 }
1380 /* Destroy the passphrase and the copy of the key in memory. */
Damien Millera5103f42014-02-04 11:20:14 +11001381 explicit_bzero(passphrase1, strlen(passphrase1));
Darren Tuckera627d422013-06-02 07:31:17 +10001382 free(passphrase1);
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00001383 sshkey_free(private); /* Destroys contents */
Darren Tuckera627d422013-06-02 07:31:17 +10001384 free(comment);
Damien Miller95def091999-11-25 00:26:21 +11001385
1386 printf("Your identification has been saved with the new passphrase.\n");
1387 exit(0);
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001388}
1389
Damien Miller37876e92003-05-15 10:19:46 +10001390/*
1391 * Print the SSHFP RR.
1392 */
Damien Millercb314822006-03-26 13:48:01 +11001393static int
1394do_print_resource_record(struct passwd *pw, char *fname, char *hname)
Damien Miller37876e92003-05-15 10:19:46 +10001395{
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00001396 struct sshkey *public;
Damien Miller37876e92003-05-15 10:19:46 +10001397 char *comment = NULL;
1398 struct stat st;
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00001399 int r;
Damien Miller37876e92003-05-15 10:19:46 +10001400
Damien Millercb314822006-03-26 13:48:01 +11001401 if (fname == NULL)
Damien Miller5bb88332013-07-18 16:13:37 +10001402 fatal("%s: no filename", __func__);
Damien Millercb314822006-03-26 13:48:01 +11001403 if (stat(fname, &st) < 0) {
1404 if (errno == ENOENT)
1405 return 0;
djm@openbsd.org3038a192015-04-17 13:19:22 +00001406 fatal("%s: %s", fname, strerror(errno));
Damien Miller37876e92003-05-15 10:19:46 +10001407 }
djm@openbsd.org3038a192015-04-17 13:19:22 +00001408 if ((r = sshkey_load_public(fname, &public, &comment)) != 0)
1409 fatal("Failed to read v2 public key from \"%s\": %s.",
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00001410 fname, ssh_err(r));
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00001411 export_dns_rr(hname, public, stdout, print_generic);
1412 sshkey_free(public);
1413 free(comment);
1414 return 1;
Damien Miller37876e92003-05-15 10:19:46 +10001415}
Damien Miller37876e92003-05-15 10:19:46 +10001416
Damien Miller95def091999-11-25 00:26:21 +11001417/*
1418 * Change the comment of a private key file.
1419 */
Ben Lindstrombba81212001-06-25 05:01:22 +00001420static void
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001421do_change_comment(struct passwd *pw)
1422{
Ben Lindstrom5fc62702001-03-09 18:19:24 +00001423 char new_comment[1024], *comment, *passphrase;
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00001424 struct sshkey *private;
1425 struct sshkey *public;
Damien Miller95def091999-11-25 00:26:21 +11001426 struct stat st;
1427 FILE *f;
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00001428 int r, fd;
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001429
Damien Miller95def091999-11-25 00:26:21 +11001430 if (!have_identity)
1431 ask_filename(pw, "Enter file in which the key is");
djm@openbsd.org3038a192015-04-17 13:19:22 +00001432 if (stat(identity_file, &st) < 0)
1433 fatal("%s: %s", identity_file, strerror(errno));
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00001434 if ((r = sshkey_load_private(identity_file, "",
1435 &private, &comment)) == 0)
1436 passphrase = xstrdup("");
djm@openbsd.org3038a192015-04-17 13:19:22 +00001437 else if (r != SSH_ERR_KEY_WRONG_PASSPHRASE)
1438 fatal("Cannot load private key \"%s\": %s.",
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00001439 identity_file, ssh_err(r));
djm@openbsd.org3038a192015-04-17 13:19:22 +00001440 else {
Damien Miller95def091999-11-25 00:26:21 +11001441 if (identity_passphrase)
1442 passphrase = xstrdup(identity_passphrase);
1443 else if (identity_new_passphrase)
1444 passphrase = xstrdup(identity_new_passphrase);
1445 else
Ben Lindstrom949974b2001-06-25 05:20:31 +00001446 passphrase = read_passphrase("Enter passphrase: ",
1447 RP_ALLOW_STDIN);
Damien Miller95def091999-11-25 00:26:21 +11001448 /* Try to load using the passphrase. */
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00001449 if ((r = sshkey_load_private(identity_file, passphrase,
1450 &private, &comment)) != 0) {
Damien Millera5103f42014-02-04 11:20:14 +11001451 explicit_bzero(passphrase, strlen(passphrase));
Darren Tuckera627d422013-06-02 07:31:17 +10001452 free(passphrase);
djm@openbsd.org3038a192015-04-17 13:19:22 +00001453 fatal("Cannot load private key \"%s\": %s.",
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00001454 identity_file, ssh_err(r));
Damien Miller95def091999-11-25 00:26:21 +11001455 }
1456 }
halex@openbsd.org4d906252015-11-20 23:04:01 +00001457
djm@openbsd.org873d3e72017-04-30 23:18:44 +00001458 if (private->type != KEY_ED25519 && !use_new_format) {
1459 error("Comments are only supported for keys stored in "
halex@openbsd.org4d906252015-11-20 23:04:01 +00001460 "the new format (-o).");
tobias@openbsd.org704d8c82015-03-31 11:06:49 +00001461 explicit_bzero(passphrase, strlen(passphrase));
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00001462 sshkey_free(private);
Ben Lindstromd0fca422001-03-26 13:44:06 +00001463 exit(1);
Damien Miller9f0f5c62001-12-21 14:45:46 +11001464 }
millert@openbsd.orge40269b2017-02-08 20:32:43 +00001465 if (comment)
1466 printf("Key now has comment '%s'\n", comment);
1467 else
1468 printf("Key now has no comment\n");
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001469
Damien Miller95def091999-11-25 00:26:21 +11001470 if (identity_comment) {
1471 strlcpy(new_comment, identity_comment, sizeof(new_comment));
1472 } else {
1473 printf("Enter new comment: ");
1474 fflush(stdout);
1475 if (!fgets(new_comment, sizeof(new_comment), stdin)) {
Damien Millera5103f42014-02-04 11:20:14 +11001476 explicit_bzero(passphrase, strlen(passphrase));
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00001477 sshkey_free(private);
Damien Miller95def091999-11-25 00:26:21 +11001478 exit(1);
1479 }
Damien Miller14b017d2007-09-17 16:09:15 +10001480 new_comment[strcspn(new_comment, "\n")] = '\0';
Damien Miller95def091999-11-25 00:26:21 +11001481 }
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001482
Damien Miller95def091999-11-25 00:26:21 +11001483 /* Save the file using the new passphrase. */
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00001484 if ((r = sshkey_save_private(private, identity_file, passphrase,
1485 new_comment, use_new_format, new_format_cipher, rounds)) != 0) {
djm@openbsd.org3038a192015-04-17 13:19:22 +00001486 error("Saving key \"%s\" failed: %s",
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00001487 identity_file, ssh_err(r));
Damien Millera5103f42014-02-04 11:20:14 +11001488 explicit_bzero(passphrase, strlen(passphrase));
Darren Tuckera627d422013-06-02 07:31:17 +10001489 free(passphrase);
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00001490 sshkey_free(private);
Darren Tuckera627d422013-06-02 07:31:17 +10001491 free(comment);
Damien Miller95def091999-11-25 00:26:21 +11001492 exit(1);
1493 }
Damien Millera5103f42014-02-04 11:20:14 +11001494 explicit_bzero(passphrase, strlen(passphrase));
Darren Tuckera627d422013-06-02 07:31:17 +10001495 free(passphrase);
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00001496 if ((r = sshkey_from_private(private, &public)) != 0)
markus@openbsd.org7da5df12017-05-30 14:16:41 +00001497 fatal("sshkey_from_private failed: %s", ssh_err(r));
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00001498 sshkey_free(private);
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001499
Damien Miller95def091999-11-25 00:26:21 +11001500 strlcat(identity_file, ".pub", sizeof(identity_file));
Ben Lindstrom5fc62702001-03-09 18:19:24 +00001501 fd = open(identity_file, O_WRONLY | O_CREAT | O_TRUNC, 0644);
djm@openbsd.org3038a192015-04-17 13:19:22 +00001502 if (fd == -1)
1503 fatal("Could not save your public key in %s", identity_file);
Ben Lindstrom5fc62702001-03-09 18:19:24 +00001504 f = fdopen(fd, "w");
djm@openbsd.org3038a192015-04-17 13:19:22 +00001505 if (f == NULL)
1506 fatal("fdopen %s failed: %s", identity_file, strerror(errno));
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00001507 if ((r = sshkey_write(public, f)) != 0)
djm@openbsd.org3038a192015-04-17 13:19:22 +00001508 fatal("write key failed: %s", ssh_err(r));
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00001509 sshkey_free(public);
Damien Millereba71ba2000-04-29 23:57:08 +10001510 fprintf(f, " %s\n", new_comment);
Damien Miller95def091999-11-25 00:26:21 +11001511 fclose(f);
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001512
Darren Tuckera627d422013-06-02 07:31:17 +10001513 free(comment);
Damien Miller95def091999-11-25 00:26:21 +11001514
1515 printf("The comment in your key file has been changed.\n");
1516 exit(0);
Damien Millerd4a8b7e1999-10-27 13:42:43 +10001517}
1518
Damien Miller0a80ca12010-02-27 07:55:05 +11001519static void
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00001520add_flag_option(struct sshbuf *c, const char *name)
Damien Miller0a80ca12010-02-27 07:55:05 +11001521{
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00001522 int r;
1523
Damien Miller0a80ca12010-02-27 07:55:05 +11001524 debug3("%s: %s", __func__, name);
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00001525 if ((r = sshbuf_put_cstring(c, name)) != 0 ||
1526 (r = sshbuf_put_string(c, NULL, 0)) != 0)
1527 fatal("%s: buffer error: %s", __func__, ssh_err(r));
Damien Miller0a80ca12010-02-27 07:55:05 +11001528}
1529
1530static void
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00001531add_string_option(struct sshbuf *c, const char *name, const char *value)
Damien Miller0a80ca12010-02-27 07:55:05 +11001532{
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00001533 struct sshbuf *b;
1534 int r;
Damien Miller0a80ca12010-02-27 07:55:05 +11001535
1536 debug3("%s: %s=%s", __func__, name, value);
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00001537 if ((b = sshbuf_new()) == NULL)
1538 fatal("%s: sshbuf_new failed", __func__);
1539 if ((r = sshbuf_put_cstring(b, value)) != 0 ||
1540 (r = sshbuf_put_cstring(c, name)) != 0 ||
1541 (r = sshbuf_put_stringb(c, b)) != 0)
1542 fatal("%s: buffer error: %s", __func__, ssh_err(r));
Damien Miller0a80ca12010-02-27 07:55:05 +11001543
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00001544 sshbuf_free(b);
Damien Miller0a80ca12010-02-27 07:55:05 +11001545}
1546
Damien Millerd0e4a8e2010-05-21 14:58:32 +10001547#define OPTIONS_CRITICAL 1
1548#define OPTIONS_EXTENSIONS 2
Damien Miller0a80ca12010-02-27 07:55:05 +11001549static void
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00001550prepare_options_buf(struct sshbuf *c, int which)
Damien Miller0a80ca12010-02-27 07:55:05 +11001551{
djm@openbsd.org249516e2017-04-29 04:12:25 +00001552 size_t i;
1553
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00001554 sshbuf_reset(c);
Damien Miller1da63882010-08-05 13:03:51 +10001555 if ((which & OPTIONS_CRITICAL) != 0 &&
1556 certflags_command != NULL)
1557 add_string_option(c, "force-command", certflags_command);
Damien Millerd0e4a8e2010-05-21 14:58:32 +10001558 if ((which & OPTIONS_EXTENSIONS) != 0 &&
Damien Miller2ce12ef2011-05-05 14:17:18 +10001559 (certflags_flags & CERTOPT_X_FWD) != 0)
1560 add_flag_option(c, "permit-X11-forwarding");
1561 if ((which & OPTIONS_EXTENSIONS) != 0 &&
Damien Millerd0e4a8e2010-05-21 14:58:32 +10001562 (certflags_flags & CERTOPT_AGENT_FWD) != 0)
Damien Miller4e270b02010-04-16 15:56:21 +10001563 add_flag_option(c, "permit-agent-forwarding");
Damien Millerd0e4a8e2010-05-21 14:58:32 +10001564 if ((which & OPTIONS_EXTENSIONS) != 0 &&
1565 (certflags_flags & CERTOPT_PORT_FWD) != 0)
Damien Miller4e270b02010-04-16 15:56:21 +10001566 add_flag_option(c, "permit-port-forwarding");
Damien Millerd0e4a8e2010-05-21 14:58:32 +10001567 if ((which & OPTIONS_EXTENSIONS) != 0 &&
1568 (certflags_flags & CERTOPT_PTY) != 0)
Damien Miller4e270b02010-04-16 15:56:21 +10001569 add_flag_option(c, "permit-pty");
Damien Millerd0e4a8e2010-05-21 14:58:32 +10001570 if ((which & OPTIONS_EXTENSIONS) != 0 &&
1571 (certflags_flags & CERTOPT_USER_RC) != 0)
Damien Miller4e270b02010-04-16 15:56:21 +10001572 add_flag_option(c, "permit-user-rc");
Damien Millerd0e4a8e2010-05-21 14:58:32 +10001573 if ((which & OPTIONS_CRITICAL) != 0 &&
1574 certflags_src_addr != NULL)
1575 add_string_option(c, "source-address", certflags_src_addr);
djm@openbsd.org249516e2017-04-29 04:12:25 +00001576 for (i = 0; i < ncert_userext; i++) {
1577 if ((cert_userext[i].crit && (which & OPTIONS_EXTENSIONS)) ||
1578 (!cert_userext[i].crit && (which & OPTIONS_CRITICAL)))
1579 continue;
1580 if (cert_userext[i].val == NULL)
1581 add_flag_option(c, cert_userext[i].key);
1582 else {
1583 add_string_option(c, cert_userext[i].key,
1584 cert_userext[i].val);
1585 }
1586 }
Damien Miller0a80ca12010-02-27 07:55:05 +11001587}
1588
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00001589static struct sshkey *
Damien Miller757f34e2010-08-05 13:05:31 +10001590load_pkcs11_key(char *path)
1591{
1592#ifdef ENABLE_PKCS11
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00001593 struct sshkey **keys = NULL, *public, *private = NULL;
1594 int r, i, nkeys;
Damien Miller757f34e2010-08-05 13:05:31 +10001595
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00001596 if ((r = sshkey_load_public(path, &public, NULL)) != 0)
1597 fatal("Couldn't load CA public key \"%s\": %s",
1598 path, ssh_err(r));
Damien Miller757f34e2010-08-05 13:05:31 +10001599
1600 nkeys = pkcs11_add_provider(pkcs11provider, identity_passphrase, &keys);
1601 debug3("%s: %d keys", __func__, nkeys);
1602 if (nkeys <= 0)
1603 fatal("cannot read public key from pkcs11");
1604 for (i = 0; i < nkeys; i++) {
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00001605 if (sshkey_equal_public(public, keys[i])) {
Damien Miller757f34e2010-08-05 13:05:31 +10001606 private = keys[i];
1607 continue;
1608 }
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00001609 sshkey_free(keys[i]);
Damien Miller757f34e2010-08-05 13:05:31 +10001610 }
Darren Tuckera627d422013-06-02 07:31:17 +10001611 free(keys);
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00001612 sshkey_free(public);
Damien Miller757f34e2010-08-05 13:05:31 +10001613 return private;
1614#else
1615 fatal("no pkcs11 support");
1616#endif /* ENABLE_PKCS11 */
1617}
1618
djm@openbsd.orga98339e2017-06-28 01:09:22 +00001619/* Signer for sshkey_certify_custom that uses the agent */
1620static int
1621agent_signer(const struct sshkey *key, u_char **sigp, size_t *lenp,
1622 const u_char *data, size_t datalen,
1623 const char *alg, u_int compat, void *ctx)
1624{
1625 int *agent_fdp = (int *)ctx;
1626
1627 return ssh_agent_sign(*agent_fdp, key, sigp, lenp,
1628 data, datalen, alg, compat);
1629}
1630
Damien Miller0a80ca12010-02-27 07:55:05 +11001631static void
1632do_ca_sign(struct passwd *pw, int argc, char **argv)
1633{
djm@openbsd.orga98339e2017-06-28 01:09:22 +00001634 int r, i, fd, found, agent_fd = -1;
Damien Miller0a80ca12010-02-27 07:55:05 +11001635 u_int n;
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00001636 struct sshkey *ca, *public;
djm@openbsd.org499cf362015-11-19 01:08:55 +00001637 char valid[64], *otmp, *tmp, *cp, *out, *comment, **plist = NULL;
Damien Miller0a80ca12010-02-27 07:55:05 +11001638 FILE *f;
djm@openbsd.orga98339e2017-06-28 01:09:22 +00001639 struct ssh_identitylist *agent_ids;
1640 size_t j;
Damien Miller4e270b02010-04-16 15:56:21 +10001641
Damien Miller1f0311c2014-05-15 14:24:09 +10001642#ifdef ENABLE_PKCS11
Damien Miller757f34e2010-08-05 13:05:31 +10001643 pkcs11_init(1);
Damien Miller1f0311c2014-05-15 14:24:09 +10001644#endif
Damien Miller757f34e2010-08-05 13:05:31 +10001645 tmp = tilde_expand_filename(ca_key_path, pw->pw_uid);
1646 if (pkcs11provider != NULL) {
djm@openbsd.orga98339e2017-06-28 01:09:22 +00001647 /* If a PKCS#11 token was specified then try to use it */
Damien Miller757f34e2010-08-05 13:05:31 +10001648 if ((ca = load_pkcs11_key(tmp)) == NULL)
1649 fatal("No PKCS#11 key matching %s found", ca_key_path);
djm@openbsd.orga98339e2017-06-28 01:09:22 +00001650 } else if (prefer_agent) {
1651 /*
1652 * Agent signature requested. Try to use agent after making
1653 * sure the public key specified is actually present in the
1654 * agent.
1655 */
1656 if ((r = sshkey_load_public(tmp, &ca, NULL)) != 0)
1657 fatal("Cannot load CA public key %s: %s",
1658 tmp, ssh_err(r));
1659 if ((r = ssh_get_authentication_socket(&agent_fd)) != 0)
1660 fatal("Cannot use public key for CA signature: %s",
1661 ssh_err(r));
1662 if ((r = ssh_fetch_identitylist(agent_fd, &agent_ids)) != 0)
1663 fatal("Retrieve agent key list: %s", ssh_err(r));
1664 found = 0;
1665 for (j = 0; j < agent_ids->nkeys; j++) {
1666 if (sshkey_equal(ca, agent_ids->keys[j])) {
1667 found = 1;
1668 break;
1669 }
1670 }
1671 if (!found)
1672 fatal("CA key %s not found in agent", tmp);
1673 ssh_free_identitylist(agent_ids);
1674 ca->flags |= SSHKEY_FLAG_EXT;
1675 } else {
1676 /* CA key is assumed to be a private key on the filesystem */
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00001677 ca = load_identity(tmp);
djm@openbsd.orga98339e2017-06-28 01:09:22 +00001678 }
Darren Tuckera627d422013-06-02 07:31:17 +10001679 free(tmp);
Damien Miller757f34e2010-08-05 13:05:31 +10001680
djm@openbsd.org57464e32016-05-02 09:36:42 +00001681 if (key_type_name != NULL &&
1682 sshkey_type_from_name(key_type_name) != ca->type) {
1683 fatal("CA key type %s doesn't match specified %s",
1684 sshkey_ssh_name(ca), key_type_name);
1685 }
1686
Damien Miller0a80ca12010-02-27 07:55:05 +11001687 for (i = 0; i < argc; i++) {
1688 /* Split list of principals */
1689 n = 0;
1690 if (cert_principals != NULL) {
1691 otmp = tmp = xstrdup(cert_principals);
1692 plist = NULL;
1693 for (; (cp = strsep(&tmp, ",")) != NULL; n++) {
deraadt@openbsd.org657a5fb2015-04-24 01:36:00 +00001694 plist = xreallocarray(plist, n + 1, sizeof(*plist));
Damien Miller0a80ca12010-02-27 07:55:05 +11001695 if (*(plist[n] = xstrdup(cp)) == '\0')
1696 fatal("Empty principal name");
1697 }
Darren Tuckera627d422013-06-02 07:31:17 +10001698 free(otmp);
Damien Miller0a80ca12010-02-27 07:55:05 +11001699 }
1700
1701 tmp = tilde_expand_filename(argv[i], pw->pw_uid);
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00001702 if ((r = sshkey_load_public(tmp, &public, &comment)) != 0)
1703 fatal("%s: unable to open \"%s\": %s",
1704 __func__, tmp, ssh_err(r));
Damien Millereb8b60e2010-08-31 22:41:14 +10001705 if (public->type != KEY_RSA && public->type != KEY_DSA &&
Damien Miller5be9d9e2013-12-07 11:24:01 +11001706 public->type != KEY_ECDSA && public->type != KEY_ED25519)
Damien Miller0a80ca12010-02-27 07:55:05 +11001707 fatal("%s: key \"%s\" type %s cannot be certified",
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00001708 __func__, tmp, sshkey_type(public));
Damien Miller0a80ca12010-02-27 07:55:05 +11001709
1710 /* Prepare certificate to sign */
djm@openbsd.orgc28fc622015-07-03 03:43:18 +00001711 if ((r = sshkey_to_certified(public)) != 0)
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00001712 fatal("Could not upgrade key %s to certificate: %s",
1713 tmp, ssh_err(r));
Damien Miller0a80ca12010-02-27 07:55:05 +11001714 public->cert->type = cert_key_type;
Damien Miller4e270b02010-04-16 15:56:21 +10001715 public->cert->serial = (u_int64_t)cert_serial;
Damien Miller0a80ca12010-02-27 07:55:05 +11001716 public->cert->key_id = xstrdup(cert_key_id);
1717 public->cert->nprincipals = n;
1718 public->cert->principals = plist;
1719 public->cert->valid_after = cert_valid_from;
1720 public->cert->valid_before = cert_valid_to;
djm@openbsd.orgc28fc622015-07-03 03:43:18 +00001721 prepare_options_buf(public->cert->critical, OPTIONS_CRITICAL);
1722 prepare_options_buf(public->cert->extensions,
1723 OPTIONS_EXTENSIONS);
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00001724 if ((r = sshkey_from_private(ca,
1725 &public->cert->signature_key)) != 0)
markus@openbsd.org7da5df12017-05-30 14:16:41 +00001726 fatal("sshkey_from_private (ca key): %s", ssh_err(r));
Damien Miller0a80ca12010-02-27 07:55:05 +11001727
djm@openbsd.orga98339e2017-06-28 01:09:22 +00001728 if (agent_fd != -1 && (ca->flags & SSHKEY_FLAG_EXT) != 0) {
1729 if ((r = sshkey_certify_custom(public, ca,
1730 key_type_name, agent_signer, &agent_fd)) != 0)
1731 fatal("Couldn't certify key %s via agent: %s",
1732 tmp, ssh_err(r));
1733 } else {
1734 if ((sshkey_certify(public, ca, key_type_name)) != 0)
1735 fatal("Couldn't certify key %s: %s",
1736 tmp, ssh_err(r));
1737 }
Damien Miller0a80ca12010-02-27 07:55:05 +11001738
1739 if ((cp = strrchr(tmp, '.')) != NULL && strcmp(cp, ".pub") == 0)
1740 *cp = '\0';
1741 xasprintf(&out, "%s-cert.pub", tmp);
Darren Tuckera627d422013-06-02 07:31:17 +10001742 free(tmp);
Damien Miller0a80ca12010-02-27 07:55:05 +11001743
1744 if ((fd = open(out, O_WRONLY|O_CREAT|O_TRUNC, 0644)) == -1)
1745 fatal("Could not open \"%s\" for writing: %s", out,
1746 strerror(errno));
1747 if ((f = fdopen(fd, "w")) == NULL)
1748 fatal("%s: fdopen: %s", __func__, strerror(errno));
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00001749 if ((r = sshkey_write(public, f)) != 0)
1750 fatal("Could not write certified key to %s: %s",
1751 out, ssh_err(r));
Damien Miller0a80ca12010-02-27 07:55:05 +11001752 fprintf(f, " %s\n", comment);
1753 fclose(f);
1754
Damien Miller4e270b02010-04-16 15:56:21 +10001755 if (!quiet) {
djm@openbsd.org964ab3e2015-11-19 01:12:32 +00001756 sshkey_format_cert_validity(public->cert,
djm@openbsd.org499cf362015-11-19 01:08:55 +00001757 valid, sizeof(valid));
Damien Miller4e270b02010-04-16 15:56:21 +10001758 logit("Signed %s key %s: id \"%s\" serial %llu%s%s "
djm@openbsd.org964ab3e2015-11-19 01:12:32 +00001759 "valid %s", sshkey_cert_type(public),
Damien Miller821de0a2011-01-11 17:20:29 +11001760 out, public->cert->key_id,
1761 (unsigned long long)public->cert->serial,
Damien Miller0a80ca12010-02-27 07:55:05 +11001762 cert_principals != NULL ? " for " : "",
1763 cert_principals != NULL ? cert_principals : "",
djm@openbsd.org499cf362015-11-19 01:08:55 +00001764 valid);
Damien Miller4e270b02010-04-16 15:56:21 +10001765 }
Damien Miller0a80ca12010-02-27 07:55:05 +11001766
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00001767 sshkey_free(public);
Darren Tuckera627d422013-06-02 07:31:17 +10001768 free(out);
Damien Miller0a80ca12010-02-27 07:55:05 +11001769 }
Damien Miller1f0311c2014-05-15 14:24:09 +10001770#ifdef ENABLE_PKCS11
Damien Miller757f34e2010-08-05 13:05:31 +10001771 pkcs11_terminate();
Damien Miller1f0311c2014-05-15 14:24:09 +10001772#endif
Damien Miller0a80ca12010-02-27 07:55:05 +11001773 exit(0);
1774}
1775
1776static u_int64_t
1777parse_relative_time(const char *s, time_t now)
1778{
1779 int64_t mul, secs;
1780
1781 mul = *s == '-' ? -1 : 1;
1782
1783 if ((secs = convtime(s + 1)) == -1)
1784 fatal("Invalid relative certificate time %s", s);
1785 if (mul == -1 && secs > now)
1786 fatal("Certificate time %s cannot be represented", s);
1787 return now + (u_int64_t)(secs * mul);
1788}
1789
1790static u_int64_t
1791parse_absolute_time(const char *s)
1792{
1793 struct tm tm;
1794 time_t tt;
Damien Miller2ca342b2010-03-03 12:14:15 +11001795 char buf[32], *fmt;
Damien Miller0a80ca12010-02-27 07:55:05 +11001796
Damien Miller2ca342b2010-03-03 12:14:15 +11001797 /*
djm@openbsd.org964ab3e2015-11-19 01:12:32 +00001798 * POSIX strptime says "The application shall ensure that there
Damien Miller2ca342b2010-03-03 12:14:15 +11001799 * is white-space or other non-alphanumeric characters between
1800 * any two conversion specifications" so arrange things this way.
1801 */
1802 switch (strlen(s)) {
1803 case 8:
Damien Miller3e1ee492010-03-08 09:24:11 +11001804 fmt = "%Y-%m-%d";
1805 snprintf(buf, sizeof(buf), "%.4s-%.2s-%.2s", s, s + 4, s + 6);
Damien Miller2ca342b2010-03-03 12:14:15 +11001806 break;
1807 case 14:
Damien Miller3e1ee492010-03-08 09:24:11 +11001808 fmt = "%Y-%m-%dT%H:%M:%S";
1809 snprintf(buf, sizeof(buf), "%.4s-%.2s-%.2sT%.2s:%.2s:%.2s",
Damien Miller2ca342b2010-03-03 12:14:15 +11001810 s, s + 4, s + 6, s + 8, s + 10, s + 12);
1811 break;
1812 default:
djm@openbsd.org@openbsd.orgd52131a2017-11-03 05:14:04 +00001813 fatal("Invalid certificate time format \"%s\"", s);
Damien Miller2ca342b2010-03-03 12:14:15 +11001814 }
Damien Miller0a80ca12010-02-27 07:55:05 +11001815
Damien Miller1d2c4562014-02-04 11:18:20 +11001816 memset(&tm, 0, sizeof(tm));
Damien Miller2ca342b2010-03-03 12:14:15 +11001817 if (strptime(buf, fmt, &tm) == NULL)
Damien Miller0a80ca12010-02-27 07:55:05 +11001818 fatal("Invalid certificate time %s", s);
1819 if ((tt = mktime(&tm)) < 0)
1820 fatal("Certificate time %s cannot be represented", s);
1821 return (u_int64_t)tt;
1822}
1823
1824static void
1825parse_cert_times(char *timespec)
1826{
1827 char *from, *to;
1828 time_t now = time(NULL);
1829 int64_t secs;
1830
1831 /* +timespec relative to now */
1832 if (*timespec == '+' && strchr(timespec, ':') == NULL) {
1833 if ((secs = convtime(timespec + 1)) == -1)
1834 fatal("Invalid relative certificate life %s", timespec);
1835 cert_valid_to = now + secs;
1836 /*
1837 * Backdate certificate one minute to avoid problems on hosts
1838 * with poorly-synchronised clocks.
1839 */
1840 cert_valid_from = ((now - 59)/ 60) * 60;
1841 return;
1842 }
1843
1844 /*
1845 * from:to, where
djm@openbsd.org@openbsd.orgd52131a2017-11-03 05:14:04 +00001846 * from := [+-]timespec | YYYYMMDD | YYYYMMDDHHMMSS | "always"
1847 * to := [+-]timespec | YYYYMMDD | YYYYMMDDHHMMSS | "forever"
Damien Miller0a80ca12010-02-27 07:55:05 +11001848 */
1849 from = xstrdup(timespec);
1850 to = strchr(from, ':');
1851 if (to == NULL || from == to || *(to + 1) == '\0')
Damien Miller910f2092010-03-04 14:17:22 +11001852 fatal("Invalid certificate life specification %s", timespec);
Damien Miller0a80ca12010-02-27 07:55:05 +11001853 *to++ = '\0';
1854
1855 if (*from == '-' || *from == '+')
1856 cert_valid_from = parse_relative_time(from, now);
djm@openbsd.org@openbsd.orgd52131a2017-11-03 05:14:04 +00001857 else if (strcmp(from, "always") == 0)
1858 cert_valid_from = 0;
Damien Miller0a80ca12010-02-27 07:55:05 +11001859 else
1860 cert_valid_from = parse_absolute_time(from);
1861
1862 if (*to == '-' || *to == '+')
Damien Miller5b01b0d2013-10-23 16:31:31 +11001863 cert_valid_to = parse_relative_time(to, now);
djm@openbsd.org@openbsd.orgd52131a2017-11-03 05:14:04 +00001864 else if (strcmp(to, "forever") == 0)
1865 cert_valid_to = ~(u_int64_t)0;
Damien Miller0a80ca12010-02-27 07:55:05 +11001866 else
1867 cert_valid_to = parse_absolute_time(to);
1868
1869 if (cert_valid_to <= cert_valid_from)
1870 fatal("Empty certificate validity interval");
Darren Tuckera627d422013-06-02 07:31:17 +10001871 free(from);
Damien Miller0a80ca12010-02-27 07:55:05 +11001872}
1873
1874static void
Damien Miller4e270b02010-04-16 15:56:21 +10001875add_cert_option(char *opt)
Damien Miller0a80ca12010-02-27 07:55:05 +11001876{
djm@openbsd.org249516e2017-04-29 04:12:25 +00001877 char *val, *cp;
1878 int iscrit = 0;
Damien Miller0a80ca12010-02-27 07:55:05 +11001879
Damien Miller044f4a62011-05-05 14:14:08 +10001880 if (strcasecmp(opt, "clear") == 0)
Damien Millerd0e4a8e2010-05-21 14:58:32 +10001881 certflags_flags = 0;
Damien Miller0a80ca12010-02-27 07:55:05 +11001882 else if (strcasecmp(opt, "no-x11-forwarding") == 0)
Damien Millerd0e4a8e2010-05-21 14:58:32 +10001883 certflags_flags &= ~CERTOPT_X_FWD;
Damien Miller0a80ca12010-02-27 07:55:05 +11001884 else if (strcasecmp(opt, "permit-x11-forwarding") == 0)
Damien Millerd0e4a8e2010-05-21 14:58:32 +10001885 certflags_flags |= CERTOPT_X_FWD;
Damien Miller0a80ca12010-02-27 07:55:05 +11001886 else if (strcasecmp(opt, "no-agent-forwarding") == 0)
Damien Millerd0e4a8e2010-05-21 14:58:32 +10001887 certflags_flags &= ~CERTOPT_AGENT_FWD;
Damien Miller0a80ca12010-02-27 07:55:05 +11001888 else if (strcasecmp(opt, "permit-agent-forwarding") == 0)
Damien Millerd0e4a8e2010-05-21 14:58:32 +10001889 certflags_flags |= CERTOPT_AGENT_FWD;
Damien Miller0a80ca12010-02-27 07:55:05 +11001890 else if (strcasecmp(opt, "no-port-forwarding") == 0)
Damien Millerd0e4a8e2010-05-21 14:58:32 +10001891 certflags_flags &= ~CERTOPT_PORT_FWD;
Damien Miller0a80ca12010-02-27 07:55:05 +11001892 else if (strcasecmp(opt, "permit-port-forwarding") == 0)
Damien Millerd0e4a8e2010-05-21 14:58:32 +10001893 certflags_flags |= CERTOPT_PORT_FWD;
Damien Miller0a80ca12010-02-27 07:55:05 +11001894 else if (strcasecmp(opt, "no-pty") == 0)
Damien Millerd0e4a8e2010-05-21 14:58:32 +10001895 certflags_flags &= ~CERTOPT_PTY;
Damien Miller0a80ca12010-02-27 07:55:05 +11001896 else if (strcasecmp(opt, "permit-pty") == 0)
Damien Millerd0e4a8e2010-05-21 14:58:32 +10001897 certflags_flags |= CERTOPT_PTY;
Damien Miller0a80ca12010-02-27 07:55:05 +11001898 else if (strcasecmp(opt, "no-user-rc") == 0)
Damien Millerd0e4a8e2010-05-21 14:58:32 +10001899 certflags_flags &= ~CERTOPT_USER_RC;
Damien Miller0a80ca12010-02-27 07:55:05 +11001900 else if (strcasecmp(opt, "permit-user-rc") == 0)
Damien Millerd0e4a8e2010-05-21 14:58:32 +10001901 certflags_flags |= CERTOPT_USER_RC;
Damien Miller0a80ca12010-02-27 07:55:05 +11001902 else if (strncasecmp(opt, "force-command=", 14) == 0) {
1903 val = opt + 14;
1904 if (*val == '\0')
Damien Miller4e270b02010-04-16 15:56:21 +10001905 fatal("Empty force-command option");
Damien Millerd0e4a8e2010-05-21 14:58:32 +10001906 if (certflags_command != NULL)
Damien Miller0a80ca12010-02-27 07:55:05 +11001907 fatal("force-command already specified");
Damien Millerd0e4a8e2010-05-21 14:58:32 +10001908 certflags_command = xstrdup(val);
Damien Miller0a80ca12010-02-27 07:55:05 +11001909 } else if (strncasecmp(opt, "source-address=", 15) == 0) {
1910 val = opt + 15;
1911 if (*val == '\0')
Damien Miller4e270b02010-04-16 15:56:21 +10001912 fatal("Empty source-address option");
Damien Millerd0e4a8e2010-05-21 14:58:32 +10001913 if (certflags_src_addr != NULL)
Damien Miller0a80ca12010-02-27 07:55:05 +11001914 fatal("source-address already specified");
1915 if (addr_match_cidr_list(NULL, val) != 0)
1916 fatal("Invalid source-address list");
Damien Millerd0e4a8e2010-05-21 14:58:32 +10001917 certflags_src_addr = xstrdup(val);
djm@openbsd.org249516e2017-04-29 04:12:25 +00001918 } else if (strncasecmp(opt, "extension:", 10) == 0 ||
1919 (iscrit = (strncasecmp(opt, "critical:", 9) == 0))) {
1920 val = xstrdup(strchr(opt, ':') + 1);
1921 if ((cp = strchr(val, '=')) != NULL)
1922 *cp++ = '\0';
1923 cert_userext = xreallocarray(cert_userext, ncert_userext + 1,
1924 sizeof(*cert_userext));
1925 cert_userext[ncert_userext].key = val;
1926 cert_userext[ncert_userext].val = cp == NULL ?
1927 NULL : xstrdup(cp);
1928 cert_userext[ncert_userext].crit = iscrit;
1929 ncert_userext++;
Damien Miller0a80ca12010-02-27 07:55:05 +11001930 } else
Damien Miller4e270b02010-04-16 15:56:21 +10001931 fatal("Unsupported certificate option \"%s\"", opt);
Damien Miller0a80ca12010-02-27 07:55:05 +11001932}
1933
Ben Lindstrombba81212001-06-25 05:01:22 +00001934static void
djm@openbsd.orgc28fc622015-07-03 03:43:18 +00001935show_options(struct sshbuf *optbuf, int in_critical)
Damien Millerd834d352010-06-26 09:48:02 +10001936{
Damien Miller633de332014-05-15 13:48:26 +10001937 char *name, *arg;
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00001938 struct sshbuf *options, *option = NULL;
1939 int r;
Damien Millerd834d352010-06-26 09:48:02 +10001940
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00001941 if ((options = sshbuf_fromb(optbuf)) == NULL)
1942 fatal("%s: sshbuf_fromb failed", __func__);
1943 while (sshbuf_len(options) != 0) {
1944 sshbuf_free(option);
1945 option = NULL;
1946 if ((r = sshbuf_get_cstring(options, &name, NULL)) != 0 ||
1947 (r = sshbuf_froms(options, &option)) != 0)
1948 fatal("%s: buffer error: %s", __func__, ssh_err(r));
Damien Millerd834d352010-06-26 09:48:02 +10001949 printf(" %s", name);
djm@openbsd.orgc28fc622015-07-03 03:43:18 +00001950 if (!in_critical &&
Damien Millerd834d352010-06-26 09:48:02 +10001951 (strcmp(name, "permit-X11-forwarding") == 0 ||
1952 strcmp(name, "permit-agent-forwarding") == 0 ||
1953 strcmp(name, "permit-port-forwarding") == 0 ||
1954 strcmp(name, "permit-pty") == 0 ||
1955 strcmp(name, "permit-user-rc") == 0))
1956 printf("\n");
djm@openbsd.orgc28fc622015-07-03 03:43:18 +00001957 else if (in_critical &&
Damien Millerd834d352010-06-26 09:48:02 +10001958 (strcmp(name, "force-command") == 0 ||
1959 strcmp(name, "source-address") == 0)) {
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00001960 if ((r = sshbuf_get_cstring(option, &arg, NULL)) != 0)
1961 fatal("%s: buffer error: %s",
1962 __func__, ssh_err(r));
Damien Miller633de332014-05-15 13:48:26 +10001963 printf(" %s\n", arg);
1964 free(arg);
Damien Millerd834d352010-06-26 09:48:02 +10001965 } else {
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00001966 printf(" UNKNOWN OPTION (len %zu)\n",
1967 sshbuf_len(option));
1968 sshbuf_reset(option);
Damien Millerd834d352010-06-26 09:48:02 +10001969 }
Darren Tuckera627d422013-06-02 07:31:17 +10001970 free(name);
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00001971 if (sshbuf_len(option) != 0)
Damien Millerd834d352010-06-26 09:48:02 +10001972 fatal("Option corrupt: extra data at end");
1973 }
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00001974 sshbuf_free(option);
1975 sshbuf_free(options);
Damien Millerd834d352010-06-26 09:48:02 +10001976}
1977
1978static void
djm@openbsd.org94bc0b72015-11-13 04:34:15 +00001979print_cert(struct sshkey *key)
Damien Millerf2b70ca2010-03-05 07:39:35 +11001980{
djm@openbsd.org499cf362015-11-19 01:08:55 +00001981 char valid[64], *key_fp, *ca_fp;
djm@openbsd.orgc28fc622015-07-03 03:43:18 +00001982 u_int i;
Damien Miller4e270b02010-04-16 15:56:21 +10001983
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00001984 key_fp = sshkey_fingerprint(key, fingerprint_hash, SSH_FP_DEFAULT);
1985 ca_fp = sshkey_fingerprint(key->cert->signature_key,
djm@openbsd.org56d1c832014-12-21 22:27:55 +00001986 fingerprint_hash, SSH_FP_DEFAULT);
djm@openbsd.org9ce86c92015-01-28 22:36:00 +00001987 if (key_fp == NULL || ca_fp == NULL)
1988 fatal("%s: sshkey_fingerprint fail", __func__);
djm@openbsd.org499cf362015-11-19 01:08:55 +00001989 sshkey_format_cert_validity(key->cert, valid, sizeof(valid));
Damien Millerf2b70ca2010-03-05 07:39:35 +11001990
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00001991 printf(" Type: %s %s certificate\n", sshkey_ssh_name(key),
1992 sshkey_cert_type(key));
1993 printf(" Public key: %s %s\n", sshkey_type(key), key_fp);
Damien Miller4e270b02010-04-16 15:56:21 +10001994 printf(" Signing CA: %s %s\n",
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00001995 sshkey_type(key->cert->signature_key), ca_fp);
Damien Miller4e270b02010-04-16 15:56:21 +10001996 printf(" Key ID: \"%s\"\n", key->cert->key_id);
djm@openbsd.orgc28fc622015-07-03 03:43:18 +00001997 printf(" Serial: %llu\n", (unsigned long long)key->cert->serial);
djm@openbsd.org499cf362015-11-19 01:08:55 +00001998 printf(" Valid: %s\n", valid);
Damien Millerf2b70ca2010-03-05 07:39:35 +11001999 printf(" Principals: ");
2000 if (key->cert->nprincipals == 0)
2001 printf("(none)\n");
2002 else {
2003 for (i = 0; i < key->cert->nprincipals; i++)
2004 printf("\n %s",
2005 key->cert->principals[i]);
2006 printf("\n");
2007 }
Damien Miller4e270b02010-04-16 15:56:21 +10002008 printf(" Critical Options: ");
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00002009 if (sshbuf_len(key->cert->critical) == 0)
Damien Millerf2b70ca2010-03-05 07:39:35 +11002010 printf("(none)\n");
2011 else {
2012 printf("\n");
djm@openbsd.orgc28fc622015-07-03 03:43:18 +00002013 show_options(key->cert->critical, 1);
Damien Millerf2b70ca2010-03-05 07:39:35 +11002014 }
djm@openbsd.orgc28fc622015-07-03 03:43:18 +00002015 printf(" Extensions: ");
2016 if (sshbuf_len(key->cert->extensions) == 0)
2017 printf("(none)\n");
2018 else {
2019 printf("\n");
2020 show_options(key->cert->extensions, 0);
Damien Miller4e270b02010-04-16 15:56:21 +10002021 }
djm@openbsd.org94bc0b72015-11-13 04:34:15 +00002022}
2023
2024static void
2025do_show_cert(struct passwd *pw)
2026{
2027 struct sshkey *key = NULL;
2028 struct stat st;
2029 int r, is_stdin = 0, ok = 0;
2030 FILE *f;
djm@openbsd.orgcce6a362015-12-11 03:19:09 +00002031 char *cp, line[SSH_MAX_PUBKEY_BYTES];
djm@openbsd.org94bc0b72015-11-13 04:34:15 +00002032 const char *path;
djm@openbsd.org1a31d022016-05-02 08:49:03 +00002033 u_long lnum = 0;
djm@openbsd.org94bc0b72015-11-13 04:34:15 +00002034
2035 if (!have_identity)
2036 ask_filename(pw, "Enter file in which the key is");
2037 if (strcmp(identity_file, "-") != 0 && stat(identity_file, &st) < 0)
2038 fatal("%s: %s: %s", __progname, identity_file, strerror(errno));
2039
2040 path = identity_file;
2041 if (strcmp(path, "-") == 0) {
2042 f = stdin;
2043 path = "(stdin)";
2044 is_stdin = 1;
2045 } else if ((f = fopen(identity_file, "r")) == NULL)
2046 fatal("fopen %s: %s", identity_file, strerror(errno));
2047
2048 while (read_keyfile_line(f, path, line, sizeof(line), &lnum) == 0) {
2049 sshkey_free(key);
2050 key = NULL;
2051 /* Trim leading space and comments */
2052 cp = line + strspn(line, " \t");
2053 if (*cp == '#' || *cp == '\0')
2054 continue;
2055 if ((key = sshkey_new(KEY_UNSPEC)) == NULL)
markus@openbsd.org7da5df12017-05-30 14:16:41 +00002056 fatal("sshkey_new");
djm@openbsd.org94bc0b72015-11-13 04:34:15 +00002057 if ((r = sshkey_read(key, &cp)) != 0) {
2058 error("%s:%lu: invalid key: %s", path,
2059 lnum, ssh_err(r));
2060 continue;
2061 }
2062 if (!sshkey_is_cert(key)) {
2063 error("%s:%lu is not a certificate", path, lnum);
2064 continue;
2065 }
2066 ok = 1;
2067 if (!is_stdin && lnum == 1)
2068 printf("%s:\n", path);
2069 else
2070 printf("%s:%lu:\n", path, lnum);
2071 print_cert(key);
2072 }
2073 sshkey_free(key);
2074 fclose(f);
2075 exit(ok ? 0 : 1);
Damien Millerf2b70ca2010-03-05 07:39:35 +11002076}
2077
2078static void
Damien Millerf3747bf2013-01-18 11:44:04 +11002079load_krl(const char *path, struct ssh_krl **krlp)
2080{
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00002081 struct sshbuf *krlbuf;
2082 int r, fd;
Damien Millerf3747bf2013-01-18 11:44:04 +11002083
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00002084 if ((krlbuf = sshbuf_new()) == NULL)
2085 fatal("sshbuf_new failed");
Damien Millerf3747bf2013-01-18 11:44:04 +11002086 if ((fd = open(path, O_RDONLY)) == -1)
2087 fatal("open %s: %s", path, strerror(errno));
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00002088 if ((r = sshkey_load_file(fd, krlbuf)) != 0)
2089 fatal("Unable to load KRL: %s", ssh_err(r));
Damien Millerf3747bf2013-01-18 11:44:04 +11002090 close(fd);
2091 /* XXX check sigs */
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00002092 if ((r = ssh_krl_from_blob(krlbuf, krlp, NULL, 0)) != 0 ||
Damien Millerf3747bf2013-01-18 11:44:04 +11002093 *krlp == NULL)
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00002094 fatal("Invalid KRL file: %s", ssh_err(r));
2095 sshbuf_free(krlbuf);
Damien Millerf3747bf2013-01-18 11:44:04 +11002096}
2097
2098static void
djm@openbsd.org669aee92015-01-30 01:10:33 +00002099update_krl_from_file(struct passwd *pw, const char *file, int wild_ca,
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00002100 const struct sshkey *ca, struct ssh_krl *krl)
Damien Millerf3747bf2013-01-18 11:44:04 +11002101{
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00002102 struct sshkey *key = NULL;
Damien Millerf3747bf2013-01-18 11:44:04 +11002103 u_long lnum = 0;
2104 char *path, *cp, *ep, line[SSH_MAX_PUBKEY_BYTES];
2105 unsigned long long serial, serial2;
2106 int i, was_explicit_key, was_sha1, r;
2107 FILE *krl_spec;
2108
2109 path = tilde_expand_filename(file, pw->pw_uid);
2110 if (strcmp(path, "-") == 0) {
2111 krl_spec = stdin;
2112 free(path);
2113 path = xstrdup("(standard input)");
2114 } else if ((krl_spec = fopen(path, "r")) == NULL)
2115 fatal("fopen %s: %s", path, strerror(errno));
2116
2117 if (!quiet)
2118 printf("Revoking from %s\n", path);
2119 while (read_keyfile_line(krl_spec, path, line, sizeof(line),
2120 &lnum) == 0) {
2121 was_explicit_key = was_sha1 = 0;
2122 cp = line + strspn(line, " \t");
2123 /* Trim trailing space, comments and strip \n */
2124 for (i = 0, r = -1; cp[i] != '\0'; i++) {
2125 if (cp[i] == '#' || cp[i] == '\n') {
2126 cp[i] = '\0';
2127 break;
2128 }
2129 if (cp[i] == ' ' || cp[i] == '\t') {
2130 /* Remember the start of a span of whitespace */
2131 if (r == -1)
2132 r = i;
2133 } else
2134 r = -1;
2135 }
2136 if (r != -1)
2137 cp[r] = '\0';
2138 if (*cp == '\0')
2139 continue;
2140 if (strncasecmp(cp, "serial:", 7) == 0) {
djm@openbsd.org669aee92015-01-30 01:10:33 +00002141 if (ca == NULL && !wild_ca) {
Damien Millerd234afb2013-08-21 02:42:58 +10002142 fatal("revoking certificates by serial number "
Damien Millerf3747bf2013-01-18 11:44:04 +11002143 "requires specification of a CA key");
2144 }
2145 cp += 7;
2146 cp = cp + strspn(cp, " \t");
2147 errno = 0;
2148 serial = strtoull(cp, &ep, 0);
2149 if (*cp == '\0' || (*ep != '\0' && *ep != '-'))
2150 fatal("%s:%lu: invalid serial \"%s\"",
2151 path, lnum, cp);
2152 if (errno == ERANGE && serial == ULLONG_MAX)
2153 fatal("%s:%lu: serial out of range",
2154 path, lnum);
2155 serial2 = serial;
2156 if (*ep == '-') {
2157 cp = ep + 1;
2158 errno = 0;
2159 serial2 = strtoull(cp, &ep, 0);
2160 if (*cp == '\0' || *ep != '\0')
2161 fatal("%s:%lu: invalid serial \"%s\"",
2162 path, lnum, cp);
2163 if (errno == ERANGE && serial2 == ULLONG_MAX)
2164 fatal("%s:%lu: serial out of range",
2165 path, lnum);
2166 if (serial2 <= serial)
2167 fatal("%s:%lu: invalid serial range "
2168 "%llu:%llu", path, lnum,
2169 (unsigned long long)serial,
2170 (unsigned long long)serial2);
2171 }
2172 if (ssh_krl_revoke_cert_by_serial_range(krl,
2173 ca, serial, serial2) != 0) {
2174 fatal("%s: revoke serial failed",
2175 __func__);
2176 }
2177 } else if (strncasecmp(cp, "id:", 3) == 0) {
djm@openbsd.org669aee92015-01-30 01:10:33 +00002178 if (ca == NULL && !wild_ca) {
Damien Millerd5d9d7b2013-08-21 02:43:27 +10002179 fatal("revoking certificates by key ID "
Damien Millerf3747bf2013-01-18 11:44:04 +11002180 "requires specification of a CA key");
2181 }
2182 cp += 3;
2183 cp = cp + strspn(cp, " \t");
2184 if (ssh_krl_revoke_cert_by_key_id(krl, ca, cp) != 0)
2185 fatal("%s: revoke key ID failed", __func__);
2186 } else {
2187 if (strncasecmp(cp, "key:", 4) == 0) {
2188 cp += 4;
2189 cp = cp + strspn(cp, " \t");
2190 was_explicit_key = 1;
2191 } else if (strncasecmp(cp, "sha1:", 5) == 0) {
2192 cp += 5;
2193 cp = cp + strspn(cp, " \t");
2194 was_sha1 = 1;
2195 } else {
2196 /*
2197 * Just try to process the line as a key.
2198 * Parsing will fail if it isn't.
2199 */
2200 }
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00002201 if ((key = sshkey_new(KEY_UNSPEC)) == NULL)
markus@openbsd.org7da5df12017-05-30 14:16:41 +00002202 fatal("sshkey_new");
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00002203 if ((r = sshkey_read(key, &cp)) != 0)
2204 fatal("%s:%lu: invalid key: %s",
2205 path, lnum, ssh_err(r));
Damien Millerf3747bf2013-01-18 11:44:04 +11002206 if (was_explicit_key)
2207 r = ssh_krl_revoke_key_explicit(krl, key);
2208 else if (was_sha1)
2209 r = ssh_krl_revoke_key_sha1(krl, key);
2210 else
2211 r = ssh_krl_revoke_key(krl, key);
2212 if (r != 0)
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00002213 fatal("%s: revoke key failed: %s",
2214 __func__, ssh_err(r));
2215 sshkey_free(key);
Damien Millerf3747bf2013-01-18 11:44:04 +11002216 }
2217 }
2218 if (strcmp(path, "-") != 0)
2219 fclose(krl_spec);
Damien Miller0d6771b2013-04-23 15:23:24 +10002220 free(path);
Damien Millerf3747bf2013-01-18 11:44:04 +11002221}
2222
2223static void
2224do_gen_krl(struct passwd *pw, int updating, int argc, char **argv)
2225{
2226 struct ssh_krl *krl;
2227 struct stat sb;
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00002228 struct sshkey *ca = NULL;
djm@openbsd.org669aee92015-01-30 01:10:33 +00002229 int fd, i, r, wild_ca = 0;
Damien Millerf3747bf2013-01-18 11:44:04 +11002230 char *tmp;
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00002231 struct sshbuf *kbuf;
Damien Millerf3747bf2013-01-18 11:44:04 +11002232
2233 if (*identity_file == '\0')
2234 fatal("KRL generation requires an output file");
2235 if (stat(identity_file, &sb) == -1) {
2236 if (errno != ENOENT)
2237 fatal("Cannot access KRL \"%s\": %s",
2238 identity_file, strerror(errno));
2239 if (updating)
2240 fatal("KRL \"%s\" does not exist", identity_file);
2241 }
2242 if (ca_key_path != NULL) {
djm@openbsd.org669aee92015-01-30 01:10:33 +00002243 if (strcasecmp(ca_key_path, "none") == 0)
2244 wild_ca = 1;
2245 else {
2246 tmp = tilde_expand_filename(ca_key_path, pw->pw_uid);
2247 if ((r = sshkey_load_public(tmp, &ca, NULL)) != 0)
2248 fatal("Cannot load CA public key %s: %s",
2249 tmp, ssh_err(r));
2250 free(tmp);
2251 }
Damien Millerf3747bf2013-01-18 11:44:04 +11002252 }
2253
2254 if (updating)
2255 load_krl(identity_file, &krl);
2256 else if ((krl = ssh_krl_init()) == NULL)
2257 fatal("couldn't create KRL");
2258
2259 if (cert_serial != 0)
2260 ssh_krl_set_version(krl, cert_serial);
2261 if (identity_comment != NULL)
2262 ssh_krl_set_comment(krl, identity_comment);
2263
2264 for (i = 0; i < argc; i++)
djm@openbsd.org669aee92015-01-30 01:10:33 +00002265 update_krl_from_file(pw, argv[i], wild_ca, ca, krl);
Damien Millerf3747bf2013-01-18 11:44:04 +11002266
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00002267 if ((kbuf = sshbuf_new()) == NULL)
2268 fatal("sshbuf_new failed");
2269 if (ssh_krl_to_blob(krl, kbuf, NULL, 0) != 0)
Damien Millerf3747bf2013-01-18 11:44:04 +11002270 fatal("Couldn't generate KRL");
2271 if ((fd = open(identity_file, O_WRONLY|O_CREAT|O_TRUNC, 0644)) == -1)
2272 fatal("open %s: %s", identity_file, strerror(errno));
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00002273 if (atomicio(vwrite, fd, (void *)sshbuf_ptr(kbuf), sshbuf_len(kbuf)) !=
2274 sshbuf_len(kbuf))
Damien Millerf3747bf2013-01-18 11:44:04 +11002275 fatal("write %s: %s", identity_file, strerror(errno));
2276 close(fd);
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00002277 sshbuf_free(kbuf);
Damien Millerf3747bf2013-01-18 11:44:04 +11002278 ssh_krl_free(krl);
mmcc@openbsd.org89540b62015-12-11 02:31:47 +00002279 sshkey_free(ca);
Damien Millerf3747bf2013-01-18 11:44:04 +11002280}
2281
2282static void
2283do_check_krl(struct passwd *pw, int argc, char **argv)
2284{
2285 int i, r, ret = 0;
2286 char *comment;
2287 struct ssh_krl *krl;
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00002288 struct sshkey *k;
Damien Millerf3747bf2013-01-18 11:44:04 +11002289
2290 if (*identity_file == '\0')
2291 fatal("KRL checking requires an input file");
2292 load_krl(identity_file, &krl);
2293 for (i = 0; i < argc; i++) {
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00002294 if ((r = sshkey_load_public(argv[i], &k, &comment)) != 0)
2295 fatal("Cannot load public key %s: %s",
2296 argv[i], ssh_err(r));
Damien Millerf3747bf2013-01-18 11:44:04 +11002297 r = ssh_krl_check_key(krl, k);
2298 printf("%s%s%s%s: %s\n", argv[i],
2299 *comment ? " (" : "", comment, *comment ? ")" : "",
2300 r == 0 ? "ok" : "REVOKED");
2301 if (r != 0)
2302 ret = 1;
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00002303 sshkey_free(k);
Damien Millerf3747bf2013-01-18 11:44:04 +11002304 free(comment);
2305 }
2306 ssh_krl_free(krl);
2307 exit(ret);
2308}
2309
2310static void
Damien Miller431f66b1999-11-21 18:31:57 +11002311usage(void)
2312{
Damien Millerf0858de2014-04-20 13:01:30 +10002313 fprintf(stderr,
djm@openbsd.org873d3e72017-04-30 23:18:44 +00002314 "usage: ssh-keygen [-q] [-b bits] [-t dsa | ecdsa | ed25519 | rsa]\n"
Damien Millerf0858de2014-04-20 13:01:30 +10002315 " [-N new_passphrase] [-C comment] [-f output_keyfile]\n"
2316 " ssh-keygen -p [-P old_passphrase] [-N new_passphrase] [-f keyfile]\n"
2317 " ssh-keygen -i [-m key_format] [-f input_keyfile]\n"
2318 " ssh-keygen -e [-m key_format] [-f input_keyfile]\n"
2319 " ssh-keygen -y [-f input_keyfile]\n"
2320 " ssh-keygen -c [-P passphrase] [-C comment] [-f keyfile]\n"
naddy@openbsd.org6288e3a2015-02-24 15:24:05 +00002321 " ssh-keygen -l [-v] [-E fingerprint_hash] [-f input_keyfile]\n"
djm@openbsd.org873d3e72017-04-30 23:18:44 +00002322 " ssh-keygen -B [-f input_keyfile]\n");
Damien Miller7ea845e2010-02-12 09:21:02 +11002323#ifdef ENABLE_PKCS11
Damien Millerf0858de2014-04-20 13:01:30 +10002324 fprintf(stderr,
2325 " ssh-keygen -D pkcs11\n");
Damien Miller7ea845e2010-02-12 09:21:02 +11002326#endif
Damien Millerf0858de2014-04-20 13:01:30 +10002327 fprintf(stderr,
2328 " ssh-keygen -F hostname [-f known_hosts_file] [-l]\n"
2329 " ssh-keygen -H [-f known_hosts_file]\n"
2330 " ssh-keygen -R hostname [-f known_hosts_file]\n"
2331 " ssh-keygen -r hostname [-f input_keyfile] [-g]\n"
djm@openbsd.org1d9a2e22015-05-28 07:37:31 +00002332#ifdef WITH_OPENSSL
Damien Millerf0858de2014-04-20 13:01:30 +10002333 " ssh-keygen -G output_file [-v] [-b bits] [-M memory] [-S start_point]\n"
2334 " ssh-keygen -T output_file -f input_file [-v] [-a rounds] [-J num_lines]\n"
2335 " [-j start_line] [-K checkpt] [-W generator]\n"
djm@openbsd.org1d9a2e22015-05-28 07:37:31 +00002336#endif
djm@openbsd.orga98339e2017-06-28 01:09:22 +00002337 " ssh-keygen -s ca_key -I certificate_identity [-h] [-U]\n"
2338 " [-D pkcs11_provider] [-n principals] [-O option]\n"
2339 " [-V validity_interval] [-z serial_number] file ...\n"
Damien Millerf0858de2014-04-20 13:01:30 +10002340 " ssh-keygen -L [-f input_keyfile]\n"
2341 " ssh-keygen -A\n"
2342 " ssh-keygen -k -f krl_file [-u] [-s ca_public] [-z version_number]\n"
2343 " file ...\n"
2344 " ssh-keygen -Q -f krl_file file ...\n");
Damien Miller95def091999-11-25 00:26:21 +11002345 exit(1);
Damien Miller431f66b1999-11-21 18:31:57 +11002346}
2347
Damien Miller95def091999-11-25 00:26:21 +11002348/*
2349 * Main program for key management.
2350 */
Damien Millerd4a8b7e1999-10-27 13:42:43 +10002351int
Damien Millerdf8b7db2007-01-05 16:22:57 +11002352main(int argc, char **argv)
Damien Millerd4a8b7e1999-10-27 13:42:43 +10002353{
deraadt@openbsd.org2ae4f332015-01-16 06:40:12 +00002354 char dotsshdir[PATH_MAX], comment[1024], *passphrase1, *passphrase2;
djm@openbsd.org1d9a2e22015-05-28 07:37:31 +00002355 char *rr_hostname = NULL, *ep, *fp, *ra;
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00002356 struct sshkey *private, *public;
Damien Miller95def091999-11-25 00:26:21 +11002357 struct passwd *pw;
Damien Miller95def091999-11-25 00:26:21 +11002358 struct stat st;
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00002359 int r, opt, type, fd;
Damien Millerf3747bf2013-01-18 11:44:04 +11002360 int gen_all_hostkeys = 0, gen_krl = 0, update_krl = 0, check_krl = 0;
Damien Miller95def091999-11-25 00:26:21 +11002361 FILE *f;
Damien Miller02e754f2005-05-26 12:19:39 +10002362 const char *errstr;
djm@openbsd.org1d9a2e22015-05-28 07:37:31 +00002363#ifdef WITH_OPENSSL
2364 /* Moduli generation/screening */
2365 char out_file[PATH_MAX], *checkpoint = NULL;
2366 u_int32_t memory = 0, generator_wanted = 0;
2367 int do_gen_candidates = 0, do_screen_candidates = 0;
2368 unsigned long start_lineno = 0, lines_to_process = 0;
2369 BIGNUM *start = NULL;
2370#endif
Damien Miller0bc1bd82000-11-13 22:57:25 +11002371
Damien Miller95def091999-11-25 00:26:21 +11002372 extern int optind;
2373 extern char *optarg;
Damien Millerd4a8b7e1999-10-27 13:42:43 +10002374
dtucker@openbsd.orgffb1e7e2016-02-15 09:47:49 +00002375 ssh_malloc_init(); /* must be called before any mallocs */
Darren Tuckerce321d82005-10-03 18:11:24 +10002376 /* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */
2377 sanitise_stdfd();
2378
Darren Tucker9ac56e92007-01-14 10:19:59 +11002379 __progname = ssh_get_progname(argv[0]);
Damien Millerf9b625c2000-07-09 22:42:32 +10002380
Damien Miller72ef7c12015-01-15 02:21:31 +11002381#ifdef WITH_OPENSSL
Damien Miller4314c2b2010-09-10 11:12:09 +10002382 OpenSSL_add_all_algorithms();
Damien Miller72ef7c12015-01-15 02:21:31 +11002383#endif
Damien Millerdf8b7db2007-01-05 16:22:57 +11002384 log_init(argv[0], SYSLOG_LEVEL_INFO, SYSLOG_FACILITY_USER, 1);
Darren Tucker019cefe2003-08-02 22:40:07 +10002385
Kevin Steves3a881912002-07-20 19:05:40 +00002386 seed_rng();
Damien Millereba71ba2000-04-29 23:57:08 +10002387
djm@openbsd.orga287c5a2017-02-10 03:36:40 +00002388 msetlocale();
2389
Damien Miller5428f641999-11-25 11:54:57 +11002390 /* we need this for the home * directory. */
Damien Miller95def091999-11-25 00:26:21 +11002391 pw = getpwuid(getuid());
djm@openbsd.org3038a192015-04-17 13:19:22 +00002392 if (!pw)
2393 fatal("No user exists for uid %lu", (u_long)getuid());
2394 if (gethostname(hostname, sizeof(hostname)) < 0)
2395 fatal("gethostname: %s", strerror(errno));
Damien Miller5428f641999-11-25 11:54:57 +11002396
djm@openbsd.orga98339e2017-06-28 01:09:22 +00002397 /* Remaining characters: Ydw */
2398 while ((opt = getopt(argc, argv, "ABHLQUXceghiklopquvxy"
djm@openbsd.org56d1c832014-12-21 22:27:55 +00002399 "C:D:E:F:G:I:J:K:M:N:O:P:R:S:T:V:W:Z:"
2400 "a:b:f:g:j:m:n:r:s:t:z:")) != -1) {
Damien Miller95def091999-11-25 00:26:21 +11002401 switch (opt) {
Damien Miller58f1baf2011-05-05 14:06:15 +10002402 case 'A':
2403 gen_all_hostkeys = 1;
2404 break;
Damien Miller95def091999-11-25 00:26:21 +11002405 case 'b':
Damien Miller57737942010-09-10 11:16:37 +10002406 bits = (u_int32_t)strtonum(optarg, 256, 32768, &errstr);
Damien Miller02e754f2005-05-26 12:19:39 +10002407 if (errstr)
2408 fatal("Bits has bad value %s (%s)",
2409 optarg, errstr);
Damien Miller95def091999-11-25 00:26:21 +11002410 break;
djm@openbsd.org56d1c832014-12-21 22:27:55 +00002411 case 'E':
2412 fingerprint_hash = ssh_digest_alg_by_name(optarg);
2413 if (fingerprint_hash == -1)
2414 fatal("Invalid hash algorithm \"%s\"", optarg);
2415 break;
Damien Miller4b42d7f2005-03-01 21:48:35 +11002416 case 'F':
2417 find_host = 1;
2418 rr_hostname = optarg;
2419 break;
2420 case 'H':
2421 hash_hosts = 1;
2422 break;
Damien Miller0a80ca12010-02-27 07:55:05 +11002423 case 'I':
2424 cert_key_id = optarg;
2425 break;
Damien Miller4b42d7f2005-03-01 21:48:35 +11002426 case 'R':
2427 delete_host = 1;
2428 rr_hostname = optarg;
2429 break;
Damien Millerf2b70ca2010-03-05 07:39:35 +11002430 case 'L':
2431 show_cert = 1;
2432 break;
Damien Miller95def091999-11-25 00:26:21 +11002433 case 'l':
2434 print_fingerprint = 1;
2435 break;
Ben Lindstrom8fd372b2001-03-12 03:02:17 +00002436 case 'B':
2437 print_bubblebabble = 1;
2438 break;
Damien Miller44b25042010-07-02 13:35:01 +10002439 case 'm':
2440 if (strcasecmp(optarg, "RFC4716") == 0 ||
2441 strcasecmp(optarg, "ssh2") == 0) {
2442 convert_format = FMT_RFC4716;
2443 break;
2444 }
2445 if (strcasecmp(optarg, "PKCS8") == 0) {
2446 convert_format = FMT_PKCS8;
2447 break;
2448 }
2449 if (strcasecmp(optarg, "PEM") == 0) {
2450 convert_format = FMT_PEM;
2451 break;
2452 }
2453 fatal("Unsupported conversion format \"%s\"", optarg);
Damien Miller0a80ca12010-02-27 07:55:05 +11002454 case 'n':
2455 cert_principals = optarg;
2456 break;
Damien Millerbcd00ab2013-12-07 10:41:55 +11002457 case 'o':
2458 use_new_format = 1;
2459 break;
Damien Miller95def091999-11-25 00:26:21 +11002460 case 'p':
2461 change_passphrase = 1;
2462 break;
Damien Miller95def091999-11-25 00:26:21 +11002463 case 'c':
2464 change_comment = 1;
2465 break;
Damien Miller95def091999-11-25 00:26:21 +11002466 case 'f':
djm@openbsd.org1d9a2e22015-05-28 07:37:31 +00002467 if (strlcpy(identity_file, optarg,
2468 sizeof(identity_file)) >= sizeof(identity_file))
Damien Millerb089fb52005-05-26 12:16:18 +10002469 fatal("Identity filename too long");
Damien Miller95def091999-11-25 00:26:21 +11002470 have_identity = 1;
2471 break;
Damien Miller37876e92003-05-15 10:19:46 +10002472 case 'g':
2473 print_generic = 1;
2474 break;
Damien Miller95def091999-11-25 00:26:21 +11002475 case 'P':
2476 identity_passphrase = optarg;
2477 break;
Damien Miller95def091999-11-25 00:26:21 +11002478 case 'N':
2479 identity_new_passphrase = optarg;
2480 break;
Damien Millerf3747bf2013-01-18 11:44:04 +11002481 case 'Q':
2482 check_krl = 1;
2483 break;
Damien Miller0a80ca12010-02-27 07:55:05 +11002484 case 'O':
Damien Miller4e270b02010-04-16 15:56:21 +10002485 add_cert_option(optarg);
Damien Miller0a80ca12010-02-27 07:55:05 +11002486 break;
Damien Millerbcd00ab2013-12-07 10:41:55 +11002487 case 'Z':
2488 new_format_cipher = optarg;
2489 break;
Damien Miller95def091999-11-25 00:26:21 +11002490 case 'C':
2491 identity_comment = optarg;
2492 break;
Damien Miller95def091999-11-25 00:26:21 +11002493 case 'q':
2494 quiet = 1;
2495 break;
Ben Lindstrom5a707822001-04-22 17:15:46 +00002496 case 'e':
Damien Millereba71ba2000-04-29 23:57:08 +10002497 case 'x':
Ben Lindstrom5a707822001-04-22 17:15:46 +00002498 /* export key */
Damien Miller44b25042010-07-02 13:35:01 +10002499 convert_to = 1;
Damien Millereba71ba2000-04-29 23:57:08 +10002500 break;
Damien Miller0a80ca12010-02-27 07:55:05 +11002501 case 'h':
2502 cert_key_type = SSH2_CERT_TYPE_HOST;
Damien Millerd0e4a8e2010-05-21 14:58:32 +10002503 certflags_flags = 0;
Damien Miller0a80ca12010-02-27 07:55:05 +11002504 break;
Damien Millerf3747bf2013-01-18 11:44:04 +11002505 case 'k':
2506 gen_krl = 1;
2507 break;
Ben Lindstrom5a707822001-04-22 17:15:46 +00002508 case 'i':
Damien Millereba71ba2000-04-29 23:57:08 +10002509 case 'X':
Ben Lindstrom5a707822001-04-22 17:15:46 +00002510 /* import key */
Damien Miller44b25042010-07-02 13:35:01 +10002511 convert_from = 1;
Damien Millereba71ba2000-04-29 23:57:08 +10002512 break;
Damien Millereba71ba2000-04-29 23:57:08 +10002513 case 'y':
2514 print_public = 1;
2515 break;
Damien Miller0a80ca12010-02-27 07:55:05 +11002516 case 's':
2517 ca_key_path = optarg;
2518 break;
Damien Miller0bc1bd82000-11-13 22:57:25 +11002519 case 't':
2520 key_type_name = optarg;
Damien Miller0bc1bd82000-11-13 22:57:25 +11002521 break;
Ben Lindstrom8282d6a2001-08-06 21:44:05 +00002522 case 'D':
Damien Miller7ea845e2010-02-12 09:21:02 +11002523 pkcs11provider = optarg;
Ben Lindstromcd392282001-07-04 03:44:03 +00002524 break;
djm@openbsd.orga98339e2017-06-28 01:09:22 +00002525 case 'U':
2526 prefer_agent = 1;
2527 break;
Damien Millerf3747bf2013-01-18 11:44:04 +11002528 case 'u':
2529 update_krl = 1;
2530 break;
Darren Tucker06930c72003-12-31 11:34:51 +11002531 case 'v':
2532 if (log_level == SYSLOG_LEVEL_INFO)
2533 log_level = SYSLOG_LEVEL_DEBUG1;
2534 else {
Darren Tuckerfc959702004-07-17 16:12:08 +10002535 if (log_level >= SYSLOG_LEVEL_DEBUG1 &&
Darren Tucker06930c72003-12-31 11:34:51 +11002536 log_level < SYSLOG_LEVEL_DEBUG3)
2537 log_level++;
2538 }
2539 break;
Damien Miller37876e92003-05-15 10:19:46 +10002540 case 'r':
Damien Miller4b42d7f2005-03-01 21:48:35 +11002541 rr_hostname = optarg;
Damien Miller37876e92003-05-15 10:19:46 +10002542 break;
djm@openbsd.org1d9a2e22015-05-28 07:37:31 +00002543 case 'a':
2544 rounds = (int)strtonum(optarg, 1, INT_MAX, &errstr);
2545 if (errstr)
2546 fatal("Invalid number: %s (%s)",
2547 optarg, errstr);
2548 break;
2549 case 'V':
2550 parse_cert_times(optarg);
2551 break;
2552 case 'z':
2553 errno = 0;
2554 cert_serial = strtoull(optarg, &ep, 10);
2555 if (*optarg < '0' || *optarg > '9' || *ep != '\0' ||
2556 (errno == ERANGE && cert_serial == ULLONG_MAX))
2557 fatal("Invalid serial number \"%s\"", optarg);
2558 break;
2559#ifdef WITH_OPENSSL
2560 /* Moduli generation/screening */
Darren Tucker019cefe2003-08-02 22:40:07 +10002561 case 'G':
2562 do_gen_candidates = 1;
Damien Millerb089fb52005-05-26 12:16:18 +10002563 if (strlcpy(out_file, optarg, sizeof(out_file)) >=
2564 sizeof(out_file))
2565 fatal("Output filename too long");
Darren Tucker019cefe2003-08-02 22:40:07 +10002566 break;
Darren Tucker0bb29802016-09-12 11:07:00 +10002567 case 'J':
2568 lines_to_process = strtoul(optarg, NULL, 10);
dtucker@openbsd.org7b63cf62016-09-12 03:29:16 +00002569 break;
Darren Tucker0bb29802016-09-12 11:07:00 +10002570 case 'j':
2571 start_lineno = strtoul(optarg, NULL, 10);
dtucker@openbsd.org7b63cf62016-09-12 03:29:16 +00002572 break;
Damien Miller390d0562011-10-18 16:05:19 +11002573 case 'K':
deraadt@openbsd.org2ae4f332015-01-16 06:40:12 +00002574 if (strlen(optarg) >= PATH_MAX)
Damien Miller390d0562011-10-18 16:05:19 +11002575 fatal("Checkpoint filename too long");
2576 checkpoint = xstrdup(optarg);
2577 break;
Darren Tuckerd8c3cfb2016-09-12 13:30:50 +10002578 case 'M':
2579 memory = (u_int32_t)strtonum(optarg, 1, UINT_MAX,
2580 &errstr);
2581 if (errstr)
2582 fatal("Memory limit is %s: %s", errstr, optarg);
2583 break;
Darren Tucker019cefe2003-08-02 22:40:07 +10002584 case 'S':
2585 /* XXX - also compare length against bits */
2586 if (BN_hex2bn(&start, optarg) == 0)
2587 fatal("Invalid start point.");
2588 break;
Darren Tuckeraf48d542016-09-12 13:52:17 +10002589 case 'T':
2590 do_screen_candidates = 1;
2591 if (strlcpy(out_file, optarg, sizeof(out_file)) >=
2592 sizeof(out_file))
2593 fatal("Output filename too long");
2594 break;
Darren Tucker43cceff2016-09-12 13:55:37 +10002595 case 'W':
2596 generator_wanted = (u_int32_t)strtonum(optarg, 1,
2597 UINT_MAX, &errstr);
Darren Tucker70508962016-09-12 13:57:28 +10002598 if (errstr != NULL)
2599 fatal("Desired generator invalid: %s (%s)",
2600 optarg, errstr);
Darren Tucker43cceff2016-09-12 13:55:37 +10002601 break;
Damien Miller72ef7c12015-01-15 02:21:31 +11002602#endif /* WITH_OPENSSL */
Damien Miller95def091999-11-25 00:26:21 +11002603 case '?':
2604 default:
2605 usage();
2606 }
2607 }
Darren Tucker06930c72003-12-31 11:34:51 +11002608
2609 /* reinit */
Damien Millerdf8b7db2007-01-05 16:22:57 +11002610 log_init(argv[0], log_level, SYSLOG_FACILITY_USER, 1);
Darren Tucker06930c72003-12-31 11:34:51 +11002611
Damien Miller0a80ca12010-02-27 07:55:05 +11002612 argv += optind;
2613 argc -= optind;
2614
2615 if (ca_key_path != NULL) {
Damien Millerf3747bf2013-01-18 11:44:04 +11002616 if (argc < 1 && !gen_krl) {
djm@openbsd.org3038a192015-04-17 13:19:22 +00002617 error("Too few arguments.");
Damien Miller0a80ca12010-02-27 07:55:05 +11002618 usage();
2619 }
Damien Millerf3747bf2013-01-18 11:44:04 +11002620 } else if (argc > 0 && !gen_krl && !check_krl) {
djm@openbsd.org3038a192015-04-17 13:19:22 +00002621 error("Too many arguments.");
Damien Miller95def091999-11-25 00:26:21 +11002622 usage();
2623 }
2624 if (change_passphrase && change_comment) {
djm@openbsd.org3038a192015-04-17 13:19:22 +00002625 error("Can only have one of -p and -c.");
Damien Miller95def091999-11-25 00:26:21 +11002626 usage();
2627 }
Darren Tucker0f7e9102008-06-08 12:54:29 +10002628 if (print_fingerprint && (delete_host || hash_hosts)) {
djm@openbsd.org3038a192015-04-17 13:19:22 +00002629 error("Cannot use -l with -H or -R.");
Darren Tucker0f7e9102008-06-08 12:54:29 +10002630 usage();
2631 }
Damien Millerf3747bf2013-01-18 11:44:04 +11002632 if (gen_krl) {
2633 do_gen_krl(pw, update_krl, argc, argv);
2634 return (0);
2635 }
2636 if (check_krl) {
2637 do_check_krl(pw, argc, argv);
2638 return (0);
2639 }
Damien Miller0a80ca12010-02-27 07:55:05 +11002640 if (ca_key_path != NULL) {
2641 if (cert_key_id == NULL)
2642 fatal("Must specify key id (-I) when certifying");
2643 do_ca_sign(pw, argc, argv);
2644 }
Damien Millerf2b70ca2010-03-05 07:39:35 +11002645 if (show_cert)
2646 do_show_cert(pw);
Damien Miller4b42d7f2005-03-01 21:48:35 +11002647 if (delete_host || hash_hosts || find_host)
2648 do_known_hosts(pw, rr_hostname);
Damien Millerec77c952013-01-09 15:58:00 +11002649 if (pkcs11provider != NULL)
2650 do_download(pw);
Ben Lindstrom8fd372b2001-03-12 03:02:17 +00002651 if (print_fingerprint || print_bubblebabble)
Damien Miller95def091999-11-25 00:26:21 +11002652 do_fingerprint(pw);
Damien Miller95def091999-11-25 00:26:21 +11002653 if (change_passphrase)
2654 do_change_passphrase(pw);
Damien Miller4a10d2e2002-03-11 22:53:29 +11002655 if (change_comment)
2656 do_change_comment(pw);
Damien Miller1f0311c2014-05-15 14:24:09 +10002657#ifdef WITH_OPENSSL
Damien Miller44b25042010-07-02 13:35:01 +10002658 if (convert_to)
2659 do_convert_to(pw);
2660 if (convert_from)
2661 do_convert_from(pw);
Damien Miller1f0311c2014-05-15 14:24:09 +10002662#endif
Damien Millereba71ba2000-04-29 23:57:08 +10002663 if (print_public)
2664 do_print_public(pw);
Damien Miller4b42d7f2005-03-01 21:48:35 +11002665 if (rr_hostname != NULL) {
Damien Millercb314822006-03-26 13:48:01 +11002666 unsigned int n = 0;
2667
2668 if (have_identity) {
2669 n = do_print_resource_record(pw,
2670 identity_file, rr_hostname);
djm@openbsd.org3038a192015-04-17 13:19:22 +00002671 if (n == 0)
2672 fatal("%s: %s", identity_file, strerror(errno));
Damien Millercb314822006-03-26 13:48:01 +11002673 exit(0);
2674 } else {
2675
2676 n += do_print_resource_record(pw,
2677 _PATH_HOST_RSA_KEY_FILE, rr_hostname);
2678 n += do_print_resource_record(pw,
2679 _PATH_HOST_DSA_KEY_FILE, rr_hostname);
Damien Miller3bde12a2012-06-20 21:51:11 +10002680 n += do_print_resource_record(pw,
2681 _PATH_HOST_ECDSA_KEY_FILE, rr_hostname);
Damien Miller16cd3922014-05-15 13:45:58 +10002682 n += do_print_resource_record(pw,
2683 _PATH_HOST_ED25519_KEY_FILE, rr_hostname);
Damien Millercb314822006-03-26 13:48:01 +11002684 if (n == 0)
2685 fatal("no keys found.");
2686 exit(0);
2687 }
Damien Miller37876e92003-05-15 10:19:46 +10002688 }
Damien Miller95def091999-11-25 00:26:21 +11002689
djm@openbsd.org1d9a2e22015-05-28 07:37:31 +00002690#ifdef WITH_OPENSSL
Darren Tucker019cefe2003-08-02 22:40:07 +10002691 if (do_gen_candidates) {
2692 FILE *out = fopen(out_file, "w");
Damien Miller787b2ec2003-11-21 23:56:47 +11002693
Darren Tucker019cefe2003-08-02 22:40:07 +10002694 if (out == NULL) {
2695 error("Couldn't open modulus candidate file \"%s\": %s",
2696 out_file, strerror(errno));
2697 return (1);
2698 }
Damien Miller3f54a9f2005-11-05 14:52:18 +11002699 if (bits == 0)
2700 bits = DEFAULT_BITS;
Darren Tucker019cefe2003-08-02 22:40:07 +10002701 if (gen_candidates(out, memory, bits, start) != 0)
Damien Miller15d72a02005-11-05 15:07:33 +11002702 fatal("modulus candidate generation failed");
Darren Tucker019cefe2003-08-02 22:40:07 +10002703
2704 return (0);
2705 }
2706
2707 if (do_screen_candidates) {
2708 FILE *in;
Damien Miller78d22712013-02-12 11:03:36 +11002709 FILE *out = fopen(out_file, "a");
Darren Tucker019cefe2003-08-02 22:40:07 +10002710
2711 if (have_identity && strcmp(identity_file, "-") != 0) {
2712 if ((in = fopen(identity_file, "r")) == NULL) {
2713 fatal("Couldn't open modulus candidate "
Damien Millera8e06ce2003-11-21 23:48:55 +11002714 "file \"%s\": %s", identity_file,
Darren Tucker019cefe2003-08-02 22:40:07 +10002715 strerror(errno));
2716 }
2717 } else
2718 in = stdin;
2719
2720 if (out == NULL) {
2721 fatal("Couldn't open moduli file \"%s\": %s",
2722 out_file, strerror(errno));
2723 }
Damien Millerbcd00ab2013-12-07 10:41:55 +11002724 if (prime_test(in, out, rounds == 0 ? 100 : rounds,
2725 generator_wanted, checkpoint,
Damien Millerdfceafe2012-07-06 13:44:19 +10002726 start_lineno, lines_to_process) != 0)
Damien Miller15d72a02005-11-05 15:07:33 +11002727 fatal("modulus screening failed");
Darren Tuckerf4220e62003-08-21 16:44:07 +10002728 return (0);
Darren Tucker019cefe2003-08-02 22:40:07 +10002729 }
djm@openbsd.org1d9a2e22015-05-28 07:37:31 +00002730#endif
Darren Tucker019cefe2003-08-02 22:40:07 +10002731
Damien Miller58f1baf2011-05-05 14:06:15 +10002732 if (gen_all_hostkeys) {
2733 do_gen_all_hostkeys(pw);
2734 return (0);
2735 }
2736
Damien Millerf14be5c2005-11-05 15:15:49 +11002737 if (key_type_name == NULL)
djm@openbsd.orgd1958792015-05-28 04:40:13 +00002738 key_type_name = DEFAULT_KEY_TYPE_NAME;
Damien Millerf14be5c2005-11-05 15:15:49 +11002739
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00002740 type = sshkey_type_from_name(key_type_name);
djm@openbsd.org7efb4552015-01-18 13:22:28 +00002741 type_bits_valid(type, key_type_name, &bits);
Damien Miller58f1baf2011-05-05 14:06:15 +10002742
Darren Tucker3af2ac52005-11-29 13:10:24 +11002743 if (!quiet)
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00002744 printf("Generating public/private %s key pair.\n",
2745 key_type_name);
djm@openbsd.org3038a192015-04-17 13:19:22 +00002746 if ((r = sshkey_generate(type, bits, &private)) != 0)
markus@openbsd.org7da5df12017-05-30 14:16:41 +00002747 fatal("sshkey_generate failed");
djm@openbsd.org3038a192015-04-17 13:19:22 +00002748 if ((r = sshkey_from_private(private, &public)) != 0)
markus@openbsd.org7da5df12017-05-30 14:16:41 +00002749 fatal("sshkey_from_private failed: %s\n", ssh_err(r));
Damien Miller95def091999-11-25 00:26:21 +11002750
2751 if (!have_identity)
2752 ask_filename(pw, "Enter file in which to save the key");
2753
Damien Miller788f2122005-11-05 15:14:59 +11002754 /* Create ~/.ssh directory if it doesn't already exist. */
Damien Miller50af79b2010-05-10 11:52:00 +10002755 snprintf(dotsshdir, sizeof dotsshdir, "%s/%s",
2756 pw->pw_dir, _PATH_SSH_USER_DIR);
2757 if (strstr(identity_file, dotsshdir) != NULL) {
2758 if (stat(dotsshdir, &st) < 0) {
2759 if (errno != ENOENT) {
2760 error("Could not stat %s: %s", dotsshdir,
2761 strerror(errno));
2762 } else if (mkdir(dotsshdir, 0700) < 0) {
2763 error("Could not create directory '%s': %s",
2764 dotsshdir, strerror(errno));
2765 } else if (!quiet)
2766 printf("Created directory '%s'.\n", dotsshdir);
2767 }
Damien Miller95def091999-11-25 00:26:21 +11002768 }
2769 /* If the file already exists, ask the user to confirm. */
2770 if (stat(identity_file, &st) >= 0) {
2771 char yesno[3];
2772 printf("%s already exists.\n", identity_file);
2773 printf("Overwrite (y/n)? ");
2774 fflush(stdout);
2775 if (fgets(yesno, sizeof(yesno), stdin) == NULL)
2776 exit(1);
2777 if (yesno[0] != 'y' && yesno[0] != 'Y')
2778 exit(1);
2779 }
2780 /* Ask for a passphrase (twice). */
2781 if (identity_passphrase)
2782 passphrase1 = xstrdup(identity_passphrase);
2783 else if (identity_new_passphrase)
2784 passphrase1 = xstrdup(identity_new_passphrase);
2785 else {
2786passphrase_again:
2787 passphrase1 =
Ben Lindstrom949974b2001-06-25 05:20:31 +00002788 read_passphrase("Enter passphrase (empty for no "
2789 "passphrase): ", RP_ALLOW_STDIN);
2790 passphrase2 = read_passphrase("Enter same passphrase again: ",
2791 RP_ALLOW_STDIN);
Damien Miller95def091999-11-25 00:26:21 +11002792 if (strcmp(passphrase1, passphrase2) != 0) {
Ben Lindstrom949974b2001-06-25 05:20:31 +00002793 /*
2794 * The passphrases do not match. Clear them and
2795 * retry.
2796 */
Damien Millera5103f42014-02-04 11:20:14 +11002797 explicit_bzero(passphrase1, strlen(passphrase1));
2798 explicit_bzero(passphrase2, strlen(passphrase2));
Darren Tuckera627d422013-06-02 07:31:17 +10002799 free(passphrase1);
2800 free(passphrase2);
Damien Miller95def091999-11-25 00:26:21 +11002801 printf("Passphrases do not match. Try again.\n");
2802 goto passphrase_again;
2803 }
2804 /* Clear the other copy of the passphrase. */
Damien Millera5103f42014-02-04 11:20:14 +11002805 explicit_bzero(passphrase2, strlen(passphrase2));
Darren Tuckera627d422013-06-02 07:31:17 +10002806 free(passphrase2);
Damien Miller95def091999-11-25 00:26:21 +11002807 }
2808
Damien Miller95def091999-11-25 00:26:21 +11002809 if (identity_comment) {
2810 strlcpy(comment, identity_comment, sizeof(comment));
2811 } else {
Darren Tuckere15fb092008-11-11 16:31:43 +11002812 /* Create default comment field for the passphrase. */
Damien Miller95def091999-11-25 00:26:21 +11002813 snprintf(comment, sizeof comment, "%s@%s", pw->pw_name, hostname);
2814 }
2815
2816 /* Save the key with the given passphrase and comment. */
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00002817 if ((r = sshkey_save_private(private, identity_file, passphrase1,
2818 comment, use_new_format, new_format_cipher, rounds)) != 0) {
djm@openbsd.org3038a192015-04-17 13:19:22 +00002819 error("Saving key \"%s\" failed: %s",
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00002820 identity_file, ssh_err(r));
Damien Millera5103f42014-02-04 11:20:14 +11002821 explicit_bzero(passphrase1, strlen(passphrase1));
Darren Tuckera627d422013-06-02 07:31:17 +10002822 free(passphrase1);
Damien Miller95def091999-11-25 00:26:21 +11002823 exit(1);
2824 }
2825 /* Clear the passphrase. */
Damien Millera5103f42014-02-04 11:20:14 +11002826 explicit_bzero(passphrase1, strlen(passphrase1));
Darren Tuckera627d422013-06-02 07:31:17 +10002827 free(passphrase1);
Damien Miller95def091999-11-25 00:26:21 +11002828
2829 /* Clear the private key and the random number generator. */
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00002830 sshkey_free(private);
Damien Miller95def091999-11-25 00:26:21 +11002831
2832 if (!quiet)
2833 printf("Your identification has been saved in %s.\n", identity_file);
2834
Damien Miller95def091999-11-25 00:26:21 +11002835 strlcat(identity_file, ".pub", sizeof(identity_file));
djm@openbsd.org3038a192015-04-17 13:19:22 +00002836 if ((fd = open(identity_file, O_WRONLY|O_CREAT|O_TRUNC, 0644)) == -1)
2837 fatal("Unable to save public key to %s: %s",
2838 identity_file, strerror(errno));
2839 if ((f = fdopen(fd, "w")) == NULL)
2840 fatal("fdopen %s failed: %s", identity_file, strerror(errno));
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00002841 if ((r = sshkey_write(public, f)) != 0)
djm@openbsd.org3038a192015-04-17 13:19:22 +00002842 error("write key failed: %s", ssh_err(r));
Damien Millereba71ba2000-04-29 23:57:08 +10002843 fprintf(f, " %s\n", comment);
Damien Miller95def091999-11-25 00:26:21 +11002844 fclose(f);
2845
2846 if (!quiet) {
djm@openbsd.org9ce86c92015-01-28 22:36:00 +00002847 fp = sshkey_fingerprint(public, fingerprint_hash,
djm@openbsd.org56d1c832014-12-21 22:27:55 +00002848 SSH_FP_DEFAULT);
djm@openbsd.org9ce86c92015-01-28 22:36:00 +00002849 ra = sshkey_fingerprint(public, fingerprint_hash,
Darren Tucker9c16ac92008-06-13 04:40:35 +10002850 SSH_FP_RANDOMART);
djm@openbsd.org9ce86c92015-01-28 22:36:00 +00002851 if (fp == NULL || ra == NULL)
2852 fatal("sshkey_fingerprint failed");
Damien Millereba71ba2000-04-29 23:57:08 +10002853 printf("Your public key has been saved in %s.\n",
2854 identity_file);
Damien Miller95def091999-11-25 00:26:21 +11002855 printf("The key fingerprint is:\n");
Ben Lindstromcfccef92001-03-13 04:57:58 +00002856 printf("%s %s\n", fp, comment);
Darren Tucker9c16ac92008-06-13 04:40:35 +10002857 printf("The key's randomart image is:\n");
2858 printf("%s\n", ra);
Darren Tuckera627d422013-06-02 07:31:17 +10002859 free(ra);
2860 free(fp);
Damien Miller95def091999-11-25 00:26:21 +11002861 }
Damien Millereba71ba2000-04-29 23:57:08 +10002862
djm@openbsd.org1129dcf2015-01-15 09:40:00 +00002863 sshkey_free(public);
Damien Miller95def091999-11-25 00:26:21 +11002864 exit(0);
Damien Millerd4a8b7e1999-10-27 13:42:43 +10002865}