[openssh.git] / ssh-add.c

/*
 * Author: Tatu Ylonen <ylo@cs.hut.fi>
 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
 *                    All rights reserved
 * Created: Thu Apr  6 00:52:24 1995 ylo
 * Adds an identity to the authentication server, or removes an identity.
 */

#include "includes.h"
RCSID("$OpenBSD: ssh-add.c,v 1.18 2000/07/16 08:27:21 markus Exp $");

#include <openssl/rsa.h>
#include <openssl/dsa.h>

#include "rsa.h"
#include "ssh.h"
#include "xmalloc.h"
#include "fingerprint.h"
#include "key.h"
#include "authfd.h"
#include "authfile.h"

#ifdef HAVE___PROGNAME
extern char *__progname;
#else /* HAVE___PROGNAME */
static const char *__progname = "ssh-add";
#endif /* HAVE___PROGNAME */

void
delete_file(AuthenticationConnection *ac, const char *filename)
{
	Key *public;
	char *comment;

	public = key_new(KEY_RSA);
	if (!load_public_key(filename, public, &comment)) {
		printf("Bad key file %s: %s\n", filename, strerror(errno));
		return;
	}
	if (ssh_remove_identity(ac, public->rsa))
		fprintf(stderr, "Identity removed: %s (%s)\n", filename, comment);
	else
		fprintf(stderr, "Could not remove identity: %s\n", filename);
	key_free(public);
	xfree(comment);
}

void
delete_all(AuthenticationConnection *ac)
{
	/* Send a request to remove all identities. */
	if (ssh_remove_all_identities(ac))
		fprintf(stderr, "All identities removed.\n");
	else
		fprintf(stderr, "Failed to remove all identitities.\n");
}

char *
ssh_askpass(char *askpass, char *msg)
{
	pid_t pid;
	size_t len;
	char *nl, *pass;
	int p[2], status;
	char buf[1024];

	if (askpass == NULL)
		fatal("internal error: askpass undefined");
	if (pipe(p) < 0)
		fatal("ssh_askpass: pipe: %s", strerror(errno));
	if ((pid = fork()) < 0)
		fatal("ssh_askpass: fork: %s", strerror(errno));
	if (pid == 0) {
		close(p[0]);
		if (dup2(p[1], STDOUT_FILENO) < 0)
			fatal("ssh_askpass: dup2: %s", strerror(errno));
		execlp(askpass, askpass, msg, (char *) 0);
		fatal("ssh_askpass: exec(%s): %s", askpass, strerror(errno));
	}
	close(p[1]);
	len = read(p[0], buf, sizeof buf);
	close(p[0]);
	while (waitpid(pid, &status, 0) < 0)
		if (errno != EINTR)
			break;
	if (len <= 1)
		return xstrdup("");
	nl = strchr(buf, '\n');
	if (nl)
		*nl = '\0';
	pass = xstrdup(buf);
	memset(buf, 0, sizeof(buf));
	return pass;
}

void
add_file(AuthenticationConnection *ac, const char *filename)
{
	Key *public;
	Key *private;
	char *saved_comment, *comment, *askpass = NULL;
	char buf[1024], msg[1024];
	int success;
	int interactive = isatty(STDIN_FILENO);
	int type = KEY_RSA;

	/*
	 * try to load the public key. right now this only works for RSA,
	 * since DSA keys are fully encrypted
	 */
	public = key_new(KEY_RSA);
	if (!load_public_key(filename, public, &saved_comment)) {
		/* ok, so we will asume this is a DSA key */
		type = KEY_DSA;
		saved_comment = xstrdup(filename);
	}
	key_free(public);

	if (!interactive && getenv("DISPLAY")) {
		if (getenv(SSH_ASKPASS_ENV))
			askpass = getenv(SSH_ASKPASS_ENV);
		else
			askpass = SSH_ASKPASS_DEFAULT;
	}

	/* At first, try empty passphrase */
	private = key_new(type);
	success = load_private_key(filename, "", private, &comment);
	if (!success) {
		printf("Need passphrase for %.200s\n", filename);
		if (!interactive && askpass == NULL) {
			xfree(saved_comment);
			return;
		}
		snprintf(msg, sizeof msg, "Enter passphrase for %.200s", saved_comment);
		for (;;) {
			char *pass;
			if (interactive) {
				snprintf(buf, sizeof buf, "%s: ", msg);
				pass = read_passphrase(buf, 1);
			} else {
				pass = ssh_askpass(askpass, msg);
			}
			if (strcmp(pass, "") == 0) {
				xfree(pass);
				xfree(saved_comment);
				return;
			}
			success = load_private_key(filename, pass, private, &comment);
			memset(pass, 0, strlen(pass));
			xfree(pass);
			if (success)
				break;
			strlcpy(msg, "Bad passphrase, try again", sizeof msg);
		}
	}
	xfree(saved_comment);

	if (ssh_add_identity(ac, private, comment))
		fprintf(stderr, "Identity added: %s (%s)\n", filename, comment);
	else
		fprintf(stderr, "Could not add identity: %s\n", filename);
	key_free(private);
	xfree(comment);
}

void
list_identities(AuthenticationConnection *ac, int fp)
{
	BIGNUM *e, *n;
	int status;
	char *comment;
	int had_identities;

	e = BN_new();
	n = BN_new();
	had_identities = 0;
	for (status = ssh_get_first_identity(ac, e, n, &comment);
	     status;
	     status = ssh_get_next_identity(ac, e, n, &comment)) {
		unsigned int bits = BN_num_bits(n);
		had_identities = 1;
		if (fp) {
			printf("%d %s %s\n", bits, fingerprint(e, n), comment);
		} else {
			char *ebuf, *nbuf;
			ebuf = BN_bn2dec(e);
			if (ebuf == NULL) {
				error("list_identities: BN_bn2dec(e) failed.");
			} else {
				nbuf = BN_bn2dec(n);
				if (nbuf == NULL) {
					error("list_identities: BN_bn2dec(n) failed.");
				} else {
					printf("%d %s %s %s\n", bits, ebuf, nbuf, comment);
					free(nbuf);
				}
				free(ebuf);
			}
		}
		xfree(comment);
	}
	BN_clear_free(e);
	BN_clear_free(n);
	if (!had_identities)
		printf("The agent has no identities.\n");
}

int
main(int argc, char **argv)
{
	AuthenticationConnection *ac = NULL;
	struct passwd *pw;
	char buf[1024];
	int no_files = 1;
	int i;
	int deleting = 0;

	init_rng();

	/* check if RSA support exists */
	if (rsa_alive() == 0) {
		fprintf(stderr,
			"%s: no RSA support in libssl and libcrypto.  See ssl(8).\n",
			__progname);
		exit(1);
	}
	/* At first, get a connection to the authentication agent. */
	ac = ssh_get_authentication_connection();
	if (ac == NULL) {
		fprintf(stderr, "Could not open a connection to your authentication agent.\n");
		exit(1);
	}
	for (i = 1; i < argc; i++) {
		if ((strcmp(argv[i], "-l") == 0) ||
		    (strcmp(argv[i], "-L") == 0)) {
			list_identities(ac, argv[i][1] == 'l' ? 1 : 0);
			/* Don't default-add/delete if -l. */
			no_files = 0;
			continue;
		}
		if (strcmp(argv[i], "-d") == 0) {
			deleting = 1;
			continue;
		}
		if (strcmp(argv[i], "-D") == 0) {
			delete_all(ac);
			no_files = 0;
			continue;
		}
		no_files = 0;
		if (deleting)
			delete_file(ac, argv[i]);
		else
			add_file(ac, argv[i]);
	}
	if (no_files) {
		pw = getpwuid(getuid());
		if (!pw) {
			fprintf(stderr, "No user found with uid %d\n", (int) getuid());
			ssh_close_authentication_connection(ac);
			exit(1);
		}
		snprintf(buf, sizeof buf, "%s/%s", pw->pw_dir, SSH_CLIENT_IDENTITY);
		if (deleting)
			delete_file(ac, buf);
		else
			add_file(ac, buf);
	}
	ssh_close_authentication_connection(ac);
	exit(0);
}
Commit	Line	Data
8efc0c15	1	/*
5260325f	2	* Author: Tatu Ylonen <ylo@cs.hut.fi>
	3	* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
	4	* All rights reserved
	5	* Created: Thu Apr 6 00:52:24 1995 ylo
	6	* Adds an identity to the authentication server, or removes an identity.
	7	*/
8efc0c15	8
8efc0c15	9	#include "includes.h"
4c8722d9	10	RCSID("$OpenBSD: ssh-add.c,v 1.18 2000/07/16 08:27:21 markus Exp $");
8efc0c15	11
a306f2dd	12	#include <openssl/rsa.h>
	13	#include <openssl/dsa.h>
	14
8efc0c15	15	#include "rsa.h"
	16	#include "ssh.h"
	17	#include "xmalloc.h"
f095fcc7	18	#include "fingerprint.h"
a306f2dd	19	#include "key.h"
4c8722d9	20	#include "authfd.h"
a306f2dd	21	#include "authfile.h"
8efc0c15	22
f601d847	23	#ifdef HAVE___PROGNAME
	24	extern char *__progname;
	25	#else /* HAVE___PROGNAME */
3fd95d9a	26	static const char *__progname = "ssh-add";
f601d847	27	#endif /* HAVE___PROGNAME */
f601d847	28
8efc0c15	29	void
5068f573	30	delete_file(AuthenticationConnection ac, const char filename)
8efc0c15	31	{
a306f2dd	32	Key *public;
5260325f	33	char *comment;
5260325f	34
a306f2dd	35	public = key_new(KEY_RSA);
a306f2dd	36	if (!load_public_key(filename, public, &comment)) {
5260325f	37	printf("Bad key file %s: %s\n", filename, strerror(errno));
	38	return;
	39	}
a306f2dd	40	if (ssh_remove_identity(ac, public->rsa))
5260325f	41	fprintf(stderr, "Identity removed: %s (%s)\n", filename, comment);
	42	else
	43	fprintf(stderr, "Could not remove identity: %s\n", filename);
a306f2dd	44	key_free(public);
5260325f	45	xfree(comment);
8efc0c15	46	}
	47
	48	void
5068f573	49	delete_all(AuthenticationConnection *ac)
8efc0c15	50	{
5260325f	51	/* Send a request to remove all identities. */
	52	if (ssh_remove_all_identities(ac))
	53	fprintf(stderr, "All identities removed.\n");
	54	else
	55	fprintf(stderr, "Failed to remove all identitities.\n");
8efc0c15	56	}
8efc0c15	57
aa3378df	58	char *
	59	ssh_askpass(char askpass, char msg)
	60	{
	61	pid_t pid;
	62	size_t len;
	63	char nl, pass;
	64	int p[2], status;
	65	char buf[1024];
	66
	67	if (askpass == NULL)
	68	fatal("internal error: askpass undefined");
	69	if (pipe(p) < 0)
	70	fatal("ssh_askpass: pipe: %s", strerror(errno));
	71	if ((pid = fork()) < 0)
	72	fatal("ssh_askpass: fork: %s", strerror(errno));
	73	if (pid == 0) {
	74	close(p[0]);
	75	if (dup2(p[1], STDOUT_FILENO) < 0)
	76	fatal("ssh_askpass: dup2: %s", strerror(errno));
	77	execlp(askpass, askpass, msg, (char *) 0);
	78	fatal("ssh_askpass: exec(%s): %s", askpass, strerror(errno));
	79	}
	80	close(p[1]);
	81	len = read(p[0], buf, sizeof buf);
	82	close(p[0]);
	83	while (waitpid(pid, &status, 0) < 0)
	84	if (errno != EINTR)
	85	break;
	86	if (len <= 1)
	87	return xstrdup("");
	88	nl = strchr(buf, '\n');
	89	if (nl)
	90	*nl = '\0';
	91	pass = xstrdup(buf);
	92	memset(buf, 0, sizeof(buf));
	93	return pass;
	94	}
	95
8efc0c15	96	void
5068f573	97	add_file(AuthenticationConnection ac, const char filename)
8efc0c15	98	{
a306f2dd	99	Key *public;
a306f2dd	100	Key *private;
aa3378df	101	char saved_comment, comment, *askpass = NULL;
aa3378df	102	char buf[1024], msg[1024];
5260325f	103	int success;
aa3378df	104	int interactive = isatty(STDIN_FILENO);
4c8722d9	105	int type = KEY_RSA;
5260325f	106
4c8722d9	107	/*
	108	* try to load the public key. right now this only works for RSA,
	109	* since DSA keys are fully encrypted
	110	*/
a306f2dd	111	public = key_new(KEY_RSA);
a306f2dd	112	if (!load_public_key(filename, public, &saved_comment)) {
4c8722d9	113	/* ok, so we will asume this is a DSA key */
	114	type = KEY_DSA;
	115	saved_comment = xstrdup(filename);
5260325f	116	}
a306f2dd	117	key_free(public);
dad9a31e	118
57112b5a	119	if (!interactive && getenv("DISPLAY")) {
	120	if (getenv(SSH_ASKPASS_ENV))
	121	askpass = getenv(SSH_ASKPASS_ENV);
	122	else
	123	askpass = SSH_ASKPASS_DEFAULT;
	124	}
aa3378df	125
5260325f	126	/* At first, try empty passphrase */
4c8722d9	127	private = key_new(type);
a306f2dd	128	success = load_private_key(filename, "", private, &comment);
5260325f	129	if (!success) {
aa3378df	130	printf("Need passphrase for %.200s\n", filename);
	131	if (!interactive && askpass == NULL) {
	132	xfree(saved_comment);
	133	return;
5260325f	134	}
aa3378df	135	snprintf(msg, sizeof msg, "Enter passphrase for %.200s", saved_comment);
	136	for (;;) {
	137	char *pass;
	138	if (interactive) {
	139	snprintf(buf, sizeof buf, "%s: ", msg);
	140	pass = read_passphrase(buf, 1);
	141	} else {
	142	pass = ssh_askpass(askpass, msg);
	143	}
5260325f	144	if (strcmp(pass, "") == 0) {
	145	xfree(pass);
	146	xfree(saved_comment);
	147	return;
	148	}
a306f2dd	149	success = load_private_key(filename, pass, private, &comment);
5260325f	150	memset(pass, 0, strlen(pass));
	151	xfree(pass);
	152	if (success)
	153	break;
aa3378df	154	strlcpy(msg, "Bad passphrase, try again", sizeof msg);
5260325f	155	}
	156	}
	157	xfree(saved_comment);
	158
4c8722d9	159	if (ssh_add_identity(ac, private, comment))
5260325f	160	fprintf(stderr, "Identity added: %s (%s)\n", filename, comment);
	161	else
	162	fprintf(stderr, "Could not add identity: %s\n", filename);
a306f2dd	163	key_free(private);
5260325f	164	xfree(comment);
8efc0c15	165	}
	166
	167	void
f095fcc7	168	list_identities(AuthenticationConnection *ac, int fp)
8efc0c15	169	{
5260325f	170	BIGNUM e, n;
	171	int status;
	172	char *comment;
	173	int had_identities;
	174
	175	e = BN_new();
	176	n = BN_new();
	177	had_identities = 0;
	178	for (status = ssh_get_first_identity(ac, e, n, &comment);
	179	status;
	180	status = ssh_get_next_identity(ac, e, n, &comment)) {
	181	unsigned int bits = BN_num_bits(n);
	182	had_identities = 1;
	183	if (fp) {
	184	printf("%d %s %s\n", bits, fingerprint(e, n), comment);
	185	} else {
	186	char ebuf, nbuf;
	187	ebuf = BN_bn2dec(e);
	188	if (ebuf == NULL) {
	189	error("list_identities: BN_bn2dec(e) failed.");
	190	} else {
	191	nbuf = BN_bn2dec(n);
	192	if (nbuf == NULL) {
	193	error("list_identities: BN_bn2dec(n) failed.");
	194	} else {
	195	printf("%d %s %s %s\n", bits, ebuf, nbuf, comment);
	196	free(nbuf);
	197	}
	198	free(ebuf);
	199	}
	200	}
	201	xfree(comment);
f095fcc7	202	}
5260325f	203	BN_clear_free(e);
	204	BN_clear_free(n);
	205	if (!had_identities)
	206	printf("The agent has no identities.\n");
8efc0c15	207	}
	208
	209	int
5068f573	210	main(int argc, char **argv)
8efc0c15	211	{
5260325f	212	AuthenticationConnection *ac = NULL;
	213	struct passwd *pw;
	214	char buf[1024];
	215	int no_files = 1;
	216	int i;
	217	int deleting = 0;
	218
264dce47	219	init_rng();
264dce47	220
5260325f	221	/* check if RSA support exists */
5260325f	222	if (rsa_alive() == 0) {
5260325f	223	fprintf(stderr,
	224	"%s: no RSA support in libssl and libcrypto. See ssl(8).\n",
	225	__progname);
	226	exit(1);
8efc0c15	227	}
5260325f	228	/* At first, get a connection to the authentication agent. */
	229	ac = ssh_get_authentication_connection();
	230	if (ac == NULL) {
	231	fprintf(stderr, "Could not open a connection to your authentication agent.\n");
	232	exit(1);
8efc0c15	233	}
5260325f	234	for (i = 1; i < argc; i++) {
	235	if ((strcmp(argv[i], "-l") == 0) \|\|
	236	(strcmp(argv[i], "-L") == 0)) {
	237	list_identities(ac, argv[i][1] == 'l' ? 1 : 0);
	238	/* Don't default-add/delete if -l. */
	239	no_files = 0;
	240	continue;
	241	}
	242	if (strcmp(argv[i], "-d") == 0) {
	243	deleting = 1;
	244	continue;
	245	}
	246	if (strcmp(argv[i], "-D") == 0) {
	247	delete_all(ac);
	248	no_files = 0;
	249	continue;
	250	}
	251	no_files = 0;
	252	if (deleting)
	253	delete_file(ac, argv[i]);
	254	else
	255	add_file(ac, argv[i]);
8efc0c15	256	}
5260325f	257	if (no_files) {
	258	pw = getpwuid(getuid());
	259	if (!pw) {
	260	fprintf(stderr, "No user found with uid %d\n", (int) getuid());
	261	ssh_close_authentication_connection(ac);
	262	exit(1);
	263	}
	264	snprintf(buf, sizeof buf, "%s/%s", pw->pw_dir, SSH_CLIENT_IDENTITY);
	265	if (deleting)
	266	delete_file(ac, buf);
	267	else
	268	add_file(ac, buf);
8efc0c15	269	}
5260325f	270	ssh_close_authentication_connection(ac);
5260325f	271	exit(0);
8efc0c15	272	}