X-Git-Url: http://andersk.mit.edu/gitweb/gssapi-openssh.git/blobdiff_plain/dec6d9fee6cd20c9de205028fc8975c7df46147c..HEAD:/openssh/ssh-keygen.c

diff --git a/openssh/ssh-keygen.c b/openssh/ssh-keygen.c
index 9288550..6d50997 100644
--- a/openssh/ssh-keygen.c
+++ b/openssh/ssh-keygen.c
@@ -12,7 +12,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: ssh-keygen.c,v 1.122 2005/03/11 14:59:06 markus Exp $");
+RCSID("$OpenBSD: ssh-keygen.c,v 1.83 2001/10/25 21:14:32 markus Exp $");
 
 #include <openssl/evp.h>
 #include <openssl/pem.h>
@@ -26,14 +26,13 @@ RCSID("$OpenBSD: ssh-keygen.c,v 1.122 2005/03/11 14:59:06 markus Exp $");
 #include "bufaux.h"
 #include "pathnames.h"
 #include "log.h"
-#include "misc.h"
-#include "match.h"
-#include "hostfile.h"
+#include "readpass.h"
 
 #ifdef SMARTCARD
+#include <sectok.h>
+#include <openssl/engine.h>
 #include "scard.h"
 #endif
-#include "dns.h"
 
 /* Number of bits in the RSA/DSA key.  This value can be changed on the command line. */
 int bits = 1024;
@@ -52,13 +51,6 @@ int change_comment = 0;
 
 int quiet = 0;
 
-/* Flag indicating that we want to hash a known_hosts file */
-int hash_hosts = 0;
-/* Flag indicating that we want lookup a host in known_hosts file */
-int find_host = 0;
-/* Flag indicating that we want to delete a host from a known_hosts file */
-int delete_host = 0;
-
 /* Flag indicating that we just want to see the key fingerprint */
 int print_fingerprint = 0;
 int print_bubblebabble = 0;
@@ -80,46 +72,43 @@ char *identity_comment = NULL;
 int convert_to_ssh2 = 0;
 int convert_from_ssh2 = 0;
 int print_public = 0;
-int print_generic = 0;
 
-char *key_type_name = NULL;
+/* default to RSA for SSH-1 */
+char *key_type_name = "rsa1";
 
 /* argv0 */
+#ifdef HAVE___PROGNAME
 extern char *__progname;
+#else
+char *__progname;
+#endif
 
 char hostname[MAXHOSTNAMELEN];
 
-/* moduli.c */
-int gen_candidates(FILE *, int, int, BIGNUM *);
-int prime_test(FILE *, FILE *, u_int32_t, u_int32_t);
-
 static void
 ask_filename(struct passwd *pw, const char *prompt)
 {
 	char buf[1024];
 	char *name = NULL;
 
-	if (key_type_name == NULL)
+	switch (key_type_from_name(key_type_name)) {
+	case KEY_RSA1:
+		name = _PATH_SSH_CLIENT_IDENTITY;
+		break;
+	case KEY_DSA:
+		name = _PATH_SSH_CLIENT_ID_DSA;
+		break;
+	case KEY_RSA:
 		name = _PATH_SSH_CLIENT_ID_RSA;
-	else
-		switch (key_type_from_name(key_type_name)) {
-		case KEY_RSA1:
-			name = _PATH_SSH_CLIENT_IDENTITY;
-			break;
-		case KEY_DSA:
-			name = _PATH_SSH_CLIENT_ID_DSA;
-			break;
-		case KEY_RSA:
-			name = _PATH_SSH_CLIENT_ID_RSA;
-			break;
-		default:
-			fprintf(stderr, "bad key type");
-			exit(1);
-			break;
-		}
-
+		break;
+	default:
+		fprintf(stderr, "bad key type");
+		exit(1);
+		break;
+	}
 	snprintf(identity_file, sizeof(identity_file), "%s/%s", pw->pw_dir, name);
 	fprintf(stderr, "%s (%s): ", prompt, identity_file);
+	fflush(stderr);
 	if (fgets(buf, sizeof(buf), stdin) == NULL)
 		exit(1);
 	if (strchr(buf, '\n'))
@@ -150,7 +139,7 @@ load_identity(char *filename)
 }
 
 #define SSH_COM_PUBLIC_BEGIN		"---- BEGIN SSH2 PUBLIC KEY ----"
-#define SSH_COM_PUBLIC_END		"---- END SSH2 PUBLIC KEY ----"
+#define SSH_COM_PUBLIC_END  		"---- END SSH2 PUBLIC KEY ----"
 #define SSH_COM_PRIVATE_BEGIN		"---- BEGIN SSH2 ENCRYPTED PRIVATE KEY ----"
 #define	SSH_COM_PRIVATE_KEY_MAGIC	0x3f6ff9eb
 
@@ -158,7 +147,7 @@ static void
 do_convert_to_ssh2(struct passwd *pw)
 {
 	Key *k;
-	u_int len;
+	int len;
 	u_char *blob;
 	struct stat st;
 
@@ -174,17 +163,13 @@ do_convert_to_ssh2(struct passwd *pw)
 			exit(1);
 		}
 	}
-	if (k->type == KEY_RSA1) {
-		fprintf(stderr, "version 1 keys are not supported\n");
-		exit(1);
-	}
 	if (key_to_blob(k, &blob, &len) <= 0) {
 		fprintf(stderr, "key_to_blob failed\n");
 		exit(1);
 	}
 	fprintf(stdout, "%s\n", SSH_COM_PUBLIC_BEGIN);
 	fprintf(stdout,
-	    "Comment: \"%u-bit %s, converted from OpenSSH by %s@%s\"\n",
+	    "Comment: \"%d-bit %s, converted from OpenSSH by %s@%s\"\n",
 	    key_size(k), key_type(k),
 	    pw->pw_name, hostname);
 	dump_base64(stdout, blob, len);
@@ -197,18 +182,18 @@ do_convert_to_ssh2(struct passwd *pw)
 static void
 buffer_get_bignum_bits(Buffer *b, BIGNUM *value)
 {
-	u_int bignum_bits = buffer_get_int(b);
-	u_int bytes = (bignum_bits + 7) / 8;
+	int bits = buffer_get_int(b);
+	int bytes = (bits + 7) / 8;
 
 	if (buffer_len(b) < bytes)
 		fatal("buffer_get_bignum_bits: input buffer too small: "
 		    "need %d have %d", bytes, buffer_len(b));
-	BN_bin2bn(buffer_ptr(b), bytes, value);
+	BN_bin2bn((u_char *)buffer_ptr(b), bytes, value);
 	buffer_consume(b, bytes);
 }
 
 static Key *
-do_convert_private_ssh2_from_blob(u_char *blob, u_int blen)
+do_convert_private_ssh2_from_blob(u_char *blob, int blen)
 {
 	Buffer b;
 	Key *key = NULL;
@@ -248,7 +233,6 @@ do_convert_private_ssh2_from_blob(u_char *blob, u_int blen)
 	} else if (strstr(type, "rsa")) {
 		ktype = KEY_RSA;
 	} else {
-		buffer_free(&b);
 		xfree(type);
 		return NULL;
 	}
@@ -288,7 +272,7 @@ do_convert_private_ssh2_from_blob(u_char *blob, u_int blen)
 		break;
 	}
 	rlen = buffer_len(&b);
-	if (rlen != 0)
+	if(rlen != 0)
 		error("do_convert_private_ssh2_from_blob: "
 		    "remaining bytes in key blob %d", rlen);
 	buffer_free(&b);
@@ -305,7 +289,6 @@ do_convert_from_ssh2(struct passwd *pw)
 {
 	Key *k;
 	int blen;
-	u_int len;
 	char line[1024], *p;
 	u_char blob[8096];
 	char encoded[8096];
@@ -350,13 +333,7 @@ do_convert_from_ssh2(struct passwd *pw)
 		*p = '\0';
 		strlcat(encoded, line, sizeof(encoded));
 	}
-	len = strlen(encoded);
-	if (((len % 4) == 3) &&
-	    (encoded[len-1] == '=') &&
-	    (encoded[len-2] == '=') &&
-	    (encoded[len-3] == '='))
-		encoded[len-3] = '\0';
-	blen = uudecode(encoded, blob, sizeof(blob));
+	blen = uudecode(encoded, (u_char *)blob, sizeof(blob));
 	if (blen < 0) {
 		fprintf(stderr, "uudecode failed.\n");
 		exit(1);
@@ -378,8 +355,7 @@ do_convert_from_ssh2(struct passwd *pw)
 		exit(1);
 	}
 	key_free(k);
-	if (!private)
-		fprintf(stdout, "\n");
+	fprintf(stdout, "\n");
 	fclose(fp);
 	exit(0);
 }
@@ -409,47 +385,145 @@ do_print_public(struct passwd *pw)
 }
 
 #ifdef SMARTCARD
+#define NUM_RSA_KEY_ELEMENTS 5+1
+#define COPY_RSA_KEY(x, i) \
+	do { \
+		len = BN_num_bytes(prv->rsa->x); \
+		elements[i] = xmalloc(len); \
+		debug("#bytes %d", len); \
+		if (BN_bn2bin(prv->rsa->x, elements[i]) < 0) \
+			goto done; \
+	} while(0)
+
+static int
+get_AUT0(char *aut0)
+{
+	EVP_MD *evp_md = EVP_sha1();
+	EVP_MD_CTX md;
+	char *pass;
+
+	pass = read_passphrase("Enter passphrase for smartcard: ", RP_ALLOW_STDIN);
+	if (pass == NULL)
+		return -1;
+	EVP_DigestInit(&md, evp_md);
+	EVP_DigestUpdate(&md, pass, strlen(pass));
+	EVP_DigestFinal(&md, aut0, NULL);
+	memset(pass, 0, strlen(pass));
+	xfree(pass);
+	return 0;
+}
+
 static void
 do_upload(struct passwd *pw, const char *sc_reader_id)
 {
 	Key *prv = NULL;
 	struct stat st;
-	int ret;
-
+	u_char *elements[NUM_RSA_KEY_ELEMENTS];
+	u_char key_fid[2];
+	u_char DEFAUT0[] = {0xad, 0x9f, 0x61, 0xfe, 0xfa, 0x20, 0xce, 0x63};
+	u_char AUT0[EVP_MAX_MD_SIZE];
+	int len, status = 1, i, fd = -1, ret;
+	int sw = 0, cla = 0x00;
+
+	for (i = 0; i < NUM_RSA_KEY_ELEMENTS; i++)
+		elements[i] = NULL;
 	if (!have_identity)
 		ask_filename(pw, "Enter file in which the key is");
 	if (stat(identity_file, &st) < 0) {
 		perror(identity_file);
-		exit(1);
+		goto done;
 	}
 	prv = load_identity(identity_file);
 	if (prv == NULL) {
 		error("load failed");
-		exit(1);
+		goto done;
 	}
-	ret = sc_put_key(prv, sc_reader_id);
-	key_free(prv);
-	if (ret < 0)
-		exit(1);
-	logit("loading key done");
-	exit(0);
+	COPY_RSA_KEY(q, 0);
+	COPY_RSA_KEY(p, 1);
+	COPY_RSA_KEY(iqmp, 2);
+	COPY_RSA_KEY(dmq1, 3);
+	COPY_RSA_KEY(dmp1, 4);
+	COPY_RSA_KEY(n, 5);
+	len = BN_num_bytes(prv->rsa->n);
+	fd = sectok_friendly_open(sc_reader_id, STONOWAIT, &sw);
+	if (fd < 0) {
+		error("sectok_open failed: %s", sectok_get_sw(sw));
+		goto done;
+	}
+	if (! sectok_cardpresent(fd)) {
+		error("smartcard in reader %s not present",
+		    sc_reader_id);
+		goto done;
+	}
+	ret = sectok_reset(fd, 0, NULL, &sw);
+	if (ret <= 0) {
+		error("sectok_reset failed: %s", sectok_get_sw(sw));
+		goto done;
+	}
+	if ((cla = cyberflex_inq_class(fd)) < 0) {
+		error("cyberflex_inq_class failed");
+		goto done;
+	}
+	memcpy(AUT0, DEFAUT0, sizeof(DEFAUT0));
+	if (cyberflex_verify_AUT0(fd, cla, AUT0, sizeof(DEFAUT0)) < 0) {
+		if (get_AUT0(AUT0) < 0 ||
+		    cyberflex_verify_AUT0(fd, cla, AUT0, sizeof(DEFAUT0)) < 0) {
+			error("cyberflex_verify_AUT0 failed");
+			goto done;
+		}
+	}
+	key_fid[0] = 0x00;
+	key_fid[1] = 0x12;
+	if (cyberflex_load_rsa_priv(fd, cla, key_fid, 5, 8*len, elements,
+	    &sw) < 0) {
+		error("cyberflex_load_rsa_priv failed: %s", sectok_get_sw(sw));
+		goto done;
+	}
+	if (!sectok_swOK(sw))
+		goto done;
+	log("cyberflex_load_rsa_priv done");
+	key_fid[0] = 0x73;
+	key_fid[1] = 0x68;
+	if (cyberflex_load_rsa_pub(fd, cla, key_fid, len, elements[5],
+	    &sw) < 0) {
+		error("cyberflex_load_rsa_pub failed: %s", sectok_get_sw(sw));
+		goto done;
+	}
+	if (!sectok_swOK(sw))
+		goto done;
+	log("cyberflex_load_rsa_pub done");
+	status = 0;
+	log("loading key done");
+done:
+
+	memset(elements[0], '\0', BN_num_bytes(prv->rsa->q));
+	memset(elements[1], '\0', BN_num_bytes(prv->rsa->p));
+	memset(elements[2], '\0', BN_num_bytes(prv->rsa->iqmp));
+	memset(elements[3], '\0', BN_num_bytes(prv->rsa->dmq1));
+	memset(elements[4], '\0', BN_num_bytes(prv->rsa->dmp1));
+	memset(elements[5], '\0', BN_num_bytes(prv->rsa->n));
+
+	if (prv)
+		key_free(prv);
+	for (i = 0; i < NUM_RSA_KEY_ELEMENTS; i++)
+		if (elements[i])
+			xfree(elements[i]);
+	if (fd != -1)
+		sectok_close(fd);
+	exit(status);
 }
 
 static void
 do_download(struct passwd *pw, const char *sc_reader_id)
 {
-	Key **keys = NULL;
-	int i;
+	Key *pub = NULL;
 
-	keys = sc_get_keys(sc_reader_id, NULL);
-	if (keys == NULL)
+	pub = sc_get_key(sc_reader_id);
+	if (pub == NULL)
 		fatal("cannot read public key from smartcard");
-	for (i = 0; keys[i]; i++) {
-		key_write(keys[i], stdout);
-		key_free(keys[i]);
-		fprintf(stdout, "\n");
-	}
-	xfree(keys);
+	key_write(pub, stdout);
+	key_free(pub);
+	fprintf(stdout, "\n");
 	exit(0);
 }
 #endif /* SMARTCARD */
@@ -460,9 +534,7 @@ do_fingerprint(struct passwd *pw)
 	FILE *f;
 	Key *public;
 	char *comment = NULL, *cp, *ep, line[16*1024], *fp;
-	int i, skip = 0, num = 1, invalid = 1;
-	enum fp_rep rep;
-	enum fp_type fptype;
+	int i, skip = 0, num = 1, invalid = 1, rep, fptype;
 	struct stat st;
 
 	fptype = print_bubblebabble ? SSH_FP_SHA1 : SSH_FP_MD5;
@@ -477,7 +549,7 @@ do_fingerprint(struct passwd *pw)
 	public = key_load_public(identity_file, &comment);
 	if (public != NULL) {
 		fp = key_fingerprint(public, fptype, rep);
-		printf("%u %s %s\n", key_size(public), fp, comment);
+		printf("%d %s %s\n", key_size(public), fp, comment);
 		key_free(public);
 		xfree(comment);
 		xfree(fp);
@@ -511,8 +583,7 @@ do_fingerprint(struct passwd *pw)
 			if (i == 0 || ep == NULL || (*ep != ' ' && *ep != '\t')) {
 				int quoted = 0;
 				comment = cp;
-				for (; *cp && (quoted || (*cp != ' ' &&
-				    *cp != '\t')); cp++) {
+				for (; *cp && (quoted || (*cp != ' ' && *cp != '\t')); cp++) {
 					if (*cp == '\\' && cp[1] == '"')
 						cp++;	/* Skip both */
 					else if (*cp == '"')
@@ -535,7 +606,7 @@ do_fingerprint(struct passwd *pw)
 			}
 			comment = *cp ? cp : comment;
 			fp = key_fingerprint(public, fptype, rep);
-			printf("%u %s %s\n", key_size(public), fp,
+			printf("%d %s %s\n", key_size(public), fp,
 			    comment ? comment : "no comment");
 			xfree(fp);
 			key_free(public);
@@ -550,201 +621,6 @@ do_fingerprint(struct passwd *pw)
 	exit(0);
 }
 
-static void
-print_host(FILE *f, char *name, Key *public, int hash)
-{
-	if (hash && (name = host_hash(name, NULL, 0)) == NULL)
-		fatal("hash_host failed");
-	fprintf(f, "%s ", name);
-	if (!key_write(public, f))
-		fatal("key_write failed");
-	fprintf(f, "\n");
-}
-
-static void
-do_known_hosts(struct passwd *pw, const char *name)
-{
-	FILE *in, *out = stdout;
-	Key *public;
-	char *cp, *cp2, *kp, *kp2;
-	char line[16*1024], tmp[MAXPATHLEN], old[MAXPATHLEN];
-	int c, i, skip = 0, inplace = 0, num = 0, invalid = 0, has_unhashed = 0;
-
-	if (!have_identity) {
-		cp = tilde_expand_filename(_PATH_SSH_USER_HOSTFILE, pw->pw_uid);
-		if (strlcpy(identity_file, cp, sizeof(identity_file)) >=
-		    sizeof(identity_file))
-			fatal("Specified known hosts path too long");
-		xfree(cp);
-		have_identity = 1;
-	}
-	if ((in = fopen(identity_file, "r")) == NULL)
-		fatal("fopen: %s", strerror(errno));
-
-	/*
-	 * Find hosts goes to stdout, hash and deletions happen in-place
-	 * A corner case is ssh-keygen -HF foo, which should go to stdout
-	 */
-	if (!find_host && (hash_hosts || delete_host)) {
-		if (strlcpy(tmp, identity_file, sizeof(tmp)) >= sizeof(tmp) ||
-		    strlcat(tmp, ".XXXXXXXXXX", sizeof(tmp)) >= sizeof(tmp) ||
-		    strlcpy(old, identity_file, sizeof(old)) >= sizeof(old) ||
-		    strlcat(old, ".old", sizeof(old)) >= sizeof(old))
-			fatal("known_hosts path too long");
-		umask(077);
-		if ((c = mkstemp(tmp)) == -1)
-			fatal("mkstemp: %s", strerror(errno));
-		if ((out = fdopen(c, "w")) == NULL) {
-			c = errno;
-			unlink(tmp);
-			fatal("fdopen: %s", strerror(c));
-		}
-		inplace = 1;
-	}
-
-	while (fgets(line, sizeof(line), in)) {
-		num++;
-		i = strlen(line) - 1;
-		if (line[i] != '\n') {
-			error("line %d too long: %.40s...", num, line);
-			skip = 1;
-			invalid = 1;
-			continue;
-		}
-		if (skip) {
-			skip = 0;
-			continue;
-		}
-		line[i] = '\0';
-
-		/* Skip leading whitespace, empty and comment lines. */
-		for (cp = line; *cp == ' ' || *cp == '\t'; cp++)
-			;
-		if (!*cp || *cp == '\n' || *cp == '#') {
-			if (inplace)
-				fprintf(out, "%s\n", cp);
-			continue;
-		}
-		/* Find the end of the host name portion. */
-		for (kp = cp; *kp && *kp != ' ' && *kp != '\t'; kp++)
-			;
-		if (*kp == '\0' || *(kp + 1) == '\0') {
-			error("line %d missing key: %.40s...",
-			    num, line);
-			invalid = 1;
-			continue;
-		}
-		*kp++ = '\0';
-		kp2 = kp;
-
-		public = key_new(KEY_RSA1);
-		if (key_read(public, &kp) != 1) {
-			kp = kp2;
-			key_free(public);
-			public = key_new(KEY_UNSPEC);
-			if (key_read(public, &kp) != 1) {
-				error("line %d invalid key: %.40s...",
-				    num, line);
-				key_free(public);
-				invalid = 1;
-				continue;
-			}
-		}
-
-		if (*cp == HASH_DELIM) {
-			if (find_host || delete_host) {
-				cp2 = host_hash(name, cp, strlen(cp));
-				if (cp2 == NULL) {
-					error("line %d: invalid hashed "
-					    "name: %.64s...", num, line);
-					invalid = 1;
-					continue;
-				}
-				c = (strcmp(cp2, cp) == 0);
-				if (find_host && c) {
-					printf("# Host %s found: "
-					    "line %d type %s\n", name,
-					    num, key_type(public));
-					print_host(out, cp, public, 0);
-				}
-				if (delete_host && !c)
-					print_host(out, cp, public, 0);
-			} else if (hash_hosts)
-				print_host(out, cp, public, 0);
-		} else {
-			if (find_host || delete_host) {
-				c = (match_hostname(name, cp,
-				    strlen(cp)) == 1);
-				if (find_host && c) {
-					printf("# Host %s found: "
-					    "line %d type %s\n", name,
-					    num, key_type(public));
-					print_host(out, cp, public, hash_hosts);
-				}
-				if (delete_host && !c)
-					print_host(out, cp, public, 0);
-			} else if (hash_hosts) {
-				for (cp2 = strsep(&cp, ",");
-				    cp2 != NULL && *cp2 != '\0';
-				    cp2 = strsep(&cp, ",")) {
-					if (strcspn(cp2, "*?!") != strlen(cp2))
-						fprintf(stderr, "Warning: "
-						    "ignoring host name with "
-						    "metacharacters: %.64s\n",
-						    cp2);
-					else
-						print_host(out, cp2, public, 1);
-				}
-				has_unhashed = 1;
-			}
-		}
-		key_free(public);
-	}
-	fclose(in);
-
-	if (invalid) {
-		fprintf(stderr, "%s is not a valid known_host file.\n",
-		    identity_file);
-		if (inplace) {
-			fprintf(stderr, "Not replacing existing known_hosts "
-			    "file because of errors\n");
-			fclose(out);
-			unlink(tmp);
-		}
-		exit(1);
-	}
-
-	if (inplace) {
-		fclose(out);
-
-		/* Backup existing file */
-		if (unlink(old) == -1 && errno != ENOENT)
-			fatal("unlink %.100s: %s", old, strerror(errno));
-		if (link(identity_file, old) == -1)
-			fatal("link %.100s to %.100s: %s", identity_file, old,
-			    strerror(errno));
-		/* Move new one into place */
-		if (rename(tmp, identity_file) == -1) {
-			error("rename\"%s\" to \"%s\": %s", tmp, identity_file,
-			    strerror(errno));
-			unlink(tmp);
-			unlink(old);
-			exit(1);
-		}
-
-		fprintf(stderr, "%s updated.\n", identity_file);
-		fprintf(stderr, "Original contents retained as %s\n", old);
-		if (has_unhashed) {
-			fprintf(stderr, "WARNING: %s contains unhashed "
-			    "entries\n", old);
-			fprintf(stderr, "Delete this file to ensure privacy "
-			     "of hostnames\n");
-		}
-	}
-
-	exit(0);
-}
-
 /*
  * Perform changing a passphrase.  The argument is the passwd structure
  * for the current user.
@@ -792,7 +668,7 @@ do_change_passphrase(struct passwd *pw)
 			read_passphrase("Enter new passphrase (empty for no "
 			    "passphrase): ", RP_ALLOW_STDIN);
 		passphrase2 = read_passphrase("Enter same passphrase again: ",
-		    RP_ALLOW_STDIN);
+		     RP_ALLOW_STDIN);
 
 		/* Verify that they are the same. */
 		if (strcmp(passphrase1, passphrase2) != 0) {
@@ -827,36 +703,6 @@ do_change_passphrase(struct passwd *pw)
 	exit(0);
 }
 
-/*
- * Print the SSHFP RR.
- */
-static void
-do_print_resource_record(struct passwd *pw, char *hname)
-{
-	Key *public;
-	char *comment = NULL;
-	struct stat st;
-
-	if (!have_identity)
-		ask_filename(pw, "Enter file in which the key is");
-	if (stat(identity_file, &st) < 0) {
-		perror(identity_file);
-		exit(1);
-	}
-	public = key_load_public(identity_file, &comment);
-	if (public != NULL) {
-		export_dns_rr(hname, public, stdout, print_generic);
-		key_free(public);
-		xfree(comment);
-		exit(0);
-	}
-	if (comment)
-		xfree(comment);
-
-	printf("failed to read v2 public key from %s.\n", identity_file);
-	exit(1);
-}
-
 /*
  * Change the comment of a private key file.
  */
@@ -900,7 +746,7 @@ do_change_comment(struct passwd *pw)
 		fprintf(stderr, "Comments are only supported for RSA1 keys.\n");
 		key_free(private);
 		exit(1);
-	}
+	}	
 	printf("Key now has comment '%s'\n", comment);
 
 	if (identity_comment) {
@@ -963,7 +809,6 @@ usage(void)
 	fprintf(stderr, "  -c          Change comment in private and public key files.\n");
 	fprintf(stderr, "  -e          Convert OpenSSH to IETF SECSH key file.\n");
 	fprintf(stderr, "  -f filename Filename of the key file.\n");
-	fprintf(stderr, "  -g          Use generic DNS resource record format.\n");
 	fprintf(stderr, "  -i          Convert IETF SECSH to OpenSSH key file.\n");
 	fprintf(stderr, "  -l          Show fingerprint of key file.\n");
 	fprintf(stderr, "  -p          Change passphrase of private key file.\n");
@@ -971,20 +816,14 @@ usage(void)
 	fprintf(stderr, "  -y          Read private key file and print public key.\n");
 	fprintf(stderr, "  -t type     Specify type of key to create.\n");
 	fprintf(stderr, "  -B          Show bubblebabble digest of key file.\n");
-	fprintf(stderr, "  -H          Hash names in known_hosts file\n");
-	fprintf(stderr, "  -F hostname Find hostname in known hosts file\n");
 	fprintf(stderr, "  -C comment  Provide new comment.\n");
 	fprintf(stderr, "  -N phrase   Provide new passphrase.\n");
 	fprintf(stderr, "  -P phrase   Provide old passphrase.\n");
-	fprintf(stderr, "  -r hostname Print DNS resource record.\n");
 #ifdef SMARTCARD
 	fprintf(stderr, "  -D reader   Download public key from smartcard.\n");
 	fprintf(stderr, "  -U reader   Upload private key to smartcard.\n");
 #endif /* SMARTCARD */
 
-	fprintf(stderr, "  -G file     Generate candidates for DH-GEX moduli\n");
-	fprintf(stderr, "  -T file     Screen candidates for DH-GEX moduli\n");
-
 	exit(1);
 }
 
@@ -994,30 +833,23 @@ usage(void)
 int
 main(int ac, char **av)
 {
-	char dotsshdir[MAXPATHLEN], comment[1024], *passphrase1, *passphrase2;
-	char out_file[MAXPATHLEN], *reader_id = NULL;
-	char *rr_hostname = NULL;
+	char dotsshdir[16 * 1024], comment[1024], *passphrase1, *passphrase2;
+	char *reader_id = NULL;
 	Key *private, *public;
 	struct passwd *pw;
 	struct stat st;
-	int opt, type, fd, download = 0, memory = 0;
-	int generator_wanted = 0, trials = 100;
-	int do_gen_candidates = 0, do_screen_candidates = 0;
-	int log_level = SYSLOG_LEVEL_INFO;
-	BIGNUM *start = NULL;
+	int opt, type, fd, download = 0;
 	FILE *f;
 
 	extern int optind;
 	extern char *optarg;
 
-	__progname = ssh_get_progname(av[0]);
-
-	SSLeay_add_all_algorithms();
-	log_init(av[0], SYSLOG_LEVEL_INFO, SYSLOG_FACILITY_USER, 1);
-
+	__progname = get_progname(av[0]);
 	init_rng();
 	seed_rng();
 
+	SSLeay_add_all_algorithms();
+
 	/* we need this for the home * directory.  */
 	pw = getpwuid(getuid());
 	if (!pw) {
@@ -1029,8 +861,7 @@ main(int ac, char **av)
 		exit(1);
 	}
 
-	while ((opt = getopt(ac, av,
-	    "degiqpclBHvxXyF:b:f:t:U:D:P:N:C:r:g:R:T:G:M:S:a:W:")) != -1) {
+	while ((opt = getopt(ac, av, "deiqpclBRxXyb:f:t:U:D:P:N:C:")) != -1) {
 		switch (opt) {
 		case 'b':
 			bits = atoi(optarg);
@@ -1039,17 +870,6 @@ main(int ac, char **av)
 				exit(1);
 			}
 			break;
-		case 'F':
-			find_host = 1;
-			rr_hostname = optarg;
-			break;
-		case 'H':
-			hash_hosts = 1;
-			break;
-		case 'R':
-			delete_host = 1;
-			rr_hostname = optarg;
-			break;
 		case 'l':
 			print_fingerprint = 1;
 			break;
@@ -1066,9 +886,6 @@ main(int ac, char **av)
 			strlcpy(identity_file, optarg, sizeof(identity_file));
 			have_identity = 1;
 			break;
-		case 'g':
-			print_generic = 1;
-			break;
 		case 'P':
 			identity_passphrase = optarg;
 			break;
@@ -1081,6 +898,10 @@ main(int ac, char **av)
 		case 'q':
 			quiet = 1;
 			break;
+		case 'R':
+			/* unused */
+			exit(0);
+			break;
 		case 'e':
 		case 'x':
 			/* export key */
@@ -1105,51 +926,11 @@ main(int ac, char **av)
 		case 'U':
 			reader_id = optarg;
 			break;
-		case 'v':
-			if (log_level == SYSLOG_LEVEL_INFO)
-				log_level = SYSLOG_LEVEL_DEBUG1;
-			else {
-				if (log_level >= SYSLOG_LEVEL_DEBUG1 &&
-				    log_level < SYSLOG_LEVEL_DEBUG3)
-					log_level++;
-			}
-			break;
-		case 'r':
-			rr_hostname = optarg;
-			break;
-		case 'W':
-			generator_wanted = atoi(optarg);
-			if (generator_wanted < 1)
-				fatal("Desired generator has bad value.");
-			break;
-		case 'a':
-			trials = atoi(optarg);
-			break;
-		case 'M':
-			memory = atoi(optarg);
-			break;
-		case 'G':
-			do_gen_candidates = 1;
-			strlcpy(out_file, optarg, sizeof(out_file));
-			break;
-		case 'T':
-			do_screen_candidates = 1;
-			strlcpy(out_file, optarg, sizeof(out_file));
-			break;
-		case 'S':
-			/* XXX - also compare length against bits */
-			if (BN_hex2bn(&start, optarg) == 0)
-				fatal("Invalid start point.");
-			break;
 		case '?':
 		default:
 			usage();
 		}
 	}
-
-	/* reinit */
-	log_init(av[0], log_level, SYSLOG_FACILITY_USER, 1);
-
 	if (optind < ac) {
 		printf("Too many arguments.\n");
 		usage();
@@ -1158,8 +939,6 @@ main(int ac, char **av)
 		printf("Can only have one of -p and -c.\n");
 		usage();
 	}
-	if (delete_host || hash_hosts || find_host)
-		do_known_hosts(pw, rr_hostname);
 	if (print_fingerprint || print_bubblebabble)
 		do_fingerprint(pw);
 	if (change_passphrase)
@@ -1172,9 +951,6 @@ main(int ac, char **av)
 		do_convert_from_ssh2(pw);
 	if (print_public)
 		do_print_public(pw);
-	if (rr_hostname != NULL) {
-		do_print_resource_record(pw, rr_hostname);
-	}
 	if (reader_id != NULL) {
 #ifdef SMARTCARD
 		if (download)
@@ -1186,48 +962,8 @@ main(int ac, char **av)
 #endif /* SMARTCARD */
 	}
 
-	if (do_gen_candidates) {
-		FILE *out = fopen(out_file, "w");
-
-		if (out == NULL) {
-			error("Couldn't open modulus candidate file \"%s\": %s",
-			    out_file, strerror(errno));
-			return (1);
-		}
-		if (gen_candidates(out, memory, bits, start) != 0)
-			fatal("modulus candidate generation failed\n");
-
-		return (0);
-	}
-
-	if (do_screen_candidates) {
-		FILE *in;
-		FILE *out = fopen(out_file, "w");
-
-		if (have_identity && strcmp(identity_file, "-") != 0) {
-			if ((in = fopen(identity_file, "r")) == NULL) {
-				fatal("Couldn't open modulus candidate "
-				    "file \"%s\": %s", identity_file,
-				    strerror(errno));
-			}
-		} else
-			in = stdin;
-
-		if (out == NULL) {
-			fatal("Couldn't open moduli file \"%s\": %s",
-			    out_file, strerror(errno));
-		}
-		if (prime_test(in, out, trials, generator_wanted) != 0)
-			fatal("modulus screening failed\n");
-		return (0);
-	}
-
 	arc4random_stir();
 
-	if (key_type_name == NULL) {
-		printf("You must specify a key type (-t).\n");
-		usage();
-	}
 	type = key_type_from_name(key_type_name);
 	if (type == KEY_UNSPEC) {
 		fprintf(stderr, "unknown key type %s\n", key_type_name);