[openssh.git] / ssh-add.c

/*
 * Author: Tatu Ylonen <ylo@cs.hut.fi>
 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
 *                    All rights reserved
 * Adds an identity to the authentication server, or removes an identity.
 *
 * As far as I am concerned, the code I have written for this software
 * can be used freely for any purpose.  Any derived versions of this
 * software must be clearly marked as such, and if the derived work is
 * incompatible with the protocol description in the RFC file, it must be
 * called by a name other than "ssh" or "Secure Shell".
 *
 * SSH2 implementation,
 * Copyright (c) 2000 Markus Friedl. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */

#include "includes.h"
RCSID("$OpenBSD: ssh-add.c,v 1.22 2000/09/07 20:27:54 deraadt Exp $");

#include <openssl/evp.h>
#include <openssl/rsa.h>
#include <openssl/dsa.h>

#include "rsa.h"
#include "ssh.h"
#include "xmalloc.h"
#include "key.h"
#include "authfd.h"
#include "authfile.h"

#ifdef HAVE___PROGNAME
extern char *__progname;
#else /* HAVE___PROGNAME */
static const char *__progname = "ssh-add";
#endif /* HAVE___PROGNAME */

void
delete_file(AuthenticationConnection *ac, const char *filename)
{
	Key *public;
	char *comment;

	public = key_new(KEY_RSA);
	if (!load_public_key(filename, public, &comment)) {
		key_free(public);
		public = key_new(KEY_DSA);
		if (!try_load_public_key(filename, public, &comment)) {
			printf("Bad key file %s\n", filename);
			return;
		}
	}
	if (ssh_remove_identity(ac, public))
		fprintf(stderr, "Identity removed: %s (%s)\n", filename, comment);
	else
		fprintf(stderr, "Could not remove identity: %s\n", filename);
	key_free(public);
	xfree(comment);
}

/* Send a request to remove all identities. */
void
delete_all(AuthenticationConnection *ac)
{
	int success = 1;

	if (!ssh_remove_all_identities(ac, 1))
		success = 0;
	/* ignore error-code for ssh2 */
	ssh_remove_all_identities(ac, 2);

	if (success)
		fprintf(stderr, "All identities removed.\n");
	else
		fprintf(stderr, "Failed to remove all identitities.\n");
}

char *
ssh_askpass(char *askpass, char *msg)
{
	pid_t pid;
	size_t len;
	char *nl, *pass;
	int p[2], status;
	char buf[1024];

	if (askpass == NULL)
		fatal("internal error: askpass undefined");
	if (pipe(p) < 0)
		fatal("ssh_askpass: pipe: %s", strerror(errno));
	if ((pid = fork()) < 0)
		fatal("ssh_askpass: fork: %s", strerror(errno));
	if (pid == 0) {
		close(p[0]);
		if (dup2(p[1], STDOUT_FILENO) < 0)
			fatal("ssh_askpass: dup2: %s", strerror(errno));
		execlp(askpass, askpass, msg, (char *) 0);
		fatal("ssh_askpass: exec(%s): %s", askpass, strerror(errno));
	}
	close(p[1]);
	buf[0] = '\0';
	atomicio(read, p[0], buf, sizeof buf);
	len = strlen(buf);
	close(p[0]);
	while (waitpid(pid, &status, 0) < 0)
		if (errno != EINTR)
			break;
	if (len <= 1)
		return xstrdup("");
	nl = strchr(buf, '\n');
	if (nl)
		*nl = '\0';
	pass = xstrdup(buf);
	memset(buf, 0, sizeof(buf));
	return pass;
}

void
add_file(AuthenticationConnection *ac, const char *filename)
{
	struct stat st;
	Key *public;
	Key *private;
	char *saved_comment, *comment, *askpass = NULL;
	char buf[1024], msg[1024];
	int success;
	int interactive = isatty(STDIN_FILENO);
	int type = KEY_RSA;

	if (stat(filename, &st) < 0) {
		perror(filename);
		exit(1);
	}
	/*
	 * try to load the public key. right now this only works for RSA,
	 * since DSA keys are fully encrypted
	 */
	public = key_new(KEY_RSA);
	if (!load_public_key(filename, public, &saved_comment)) {
		/* ok, so we will asume this is a DSA key */
		type = KEY_DSA;
		saved_comment = xstrdup(filename);
	}
	key_free(public);

	if (!interactive && getenv("DISPLAY")) {
		if (getenv(SSH_ASKPASS_ENV))
			askpass = getenv(SSH_ASKPASS_ENV);
		else
			askpass = SSH_ASKPASS_DEFAULT;
	}

	/* At first, try empty passphrase */
	private = key_new(type);
	success = load_private_key(filename, "", private, &comment);
	if (!success) {
		printf("Need passphrase for %.200s\n", filename);
		if (!interactive && askpass == NULL) {
			xfree(saved_comment);
			return;
		}
		snprintf(msg, sizeof msg, "Enter passphrase for %.200s", saved_comment);
		for (;;) {
			char *pass;
			if (interactive) {
				snprintf(buf, sizeof buf, "%s: ", msg);
				pass = read_passphrase(buf, 1);
			} else {
				pass = ssh_askpass(askpass, msg);
			}
			if (strcmp(pass, "") == 0) {
				xfree(pass);
				xfree(saved_comment);
				return;
			}
			success = load_private_key(filename, pass, private, &comment);
			memset(pass, 0, strlen(pass));
			xfree(pass);
			if (success)
				break;
			strlcpy(msg, "Bad passphrase, try again", sizeof msg);
		}
	}
	xfree(comment);
	if (ssh_add_identity(ac, private, saved_comment))
		fprintf(stderr, "Identity added: %s (%s)\n", filename, saved_comment);
	else
		fprintf(stderr, "Could not add identity: %s\n", filename);
	key_free(private);
	xfree(saved_comment);
}

void
list_identities(AuthenticationConnection *ac, int fp)
{
	Key *key;
	char *comment;
	int had_identities = 0;
	int version;

	for (version = 1; version <= 2; version++) {
		for (key = ssh_get_first_identity(ac, &comment, version);
		     key != NULL;
		     key = ssh_get_next_identity(ac, &comment, version)) {
			had_identities = 1;
			if (fp) {
				printf("%d %s %s\n",
				    key_size(key), key_fingerprint(key), comment);
			} else {
				if (!key_write(key, stdout))
					fprintf(stderr, "key_write failed");
				fprintf(stdout, " %s\n", comment);
			}
			key_free(key);
			xfree(comment);
		}
	}
	if (!had_identities)
		printf("The agent has no identities.\n");
}

int
main(int argc, char **argv)
{
	AuthenticationConnection *ac = NULL;
	struct passwd *pw;
	char buf[1024];
	int no_files = 1;
	int i;
	int deleting = 0;

	init_rng();

	/* check if RSA support exists */
	if (rsa_alive() == 0) {
		fprintf(stderr,
			"%s: no RSA support in libssl and libcrypto.  See ssl(8).\n",
			__progname);
		exit(1);
	}
        SSLeay_add_all_algorithms();

	/* At first, get a connection to the authentication agent. */
	ac = ssh_get_authentication_connection();
	if (ac == NULL) {
		fprintf(stderr, "Could not open a connection to your authentication agent.\n");
		exit(1);
	}
	for (i = 1; i < argc; i++) {
		if ((strcmp(argv[i], "-l") == 0) ||
		    (strcmp(argv[i], "-L") == 0)) {
			list_identities(ac, argv[i][1] == 'l' ? 1 : 0);
			/* Don't default-add/delete if -l. */
			no_files = 0;
			continue;
		}
		if (strcmp(argv[i], "-d") == 0) {
			deleting = 1;
			continue;
		}
		if (strcmp(argv[i], "-D") == 0) {
			delete_all(ac);
			no_files = 0;
			continue;
		}
		no_files = 0;
		if (deleting)
			delete_file(ac, argv[i]);
		else
			add_file(ac, argv[i]);
	}
	if (no_files) {
		pw = getpwuid(getuid());
		if (!pw) {
			fprintf(stderr, "No user found with uid %u\n",
			    (u_int)getuid());
			ssh_close_authentication_connection(ac);
			exit(1);
		}
		snprintf(buf, sizeof buf, "%s/%s", pw->pw_dir, SSH_CLIENT_IDENTITY);
		if (deleting)
			delete_file(ac, buf);
		else
			add_file(ac, buf);
	}
	ssh_close_authentication_connection(ac);
	exit(0);
}
Commit	Line	Data
8efc0c15	1	/*
5260325f	2	* Author: Tatu Ylonen <ylo@cs.hut.fi>
	3	* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
	4	* All rights reserved
5260325f	5	* Adds an identity to the authentication server, or removes an identity.
2e73a022	6	*
bcbf86ec	7	* As far as I am concerned, the code I have written for this software
	8	* can be used freely for any purpose. Any derived versions of this
	9	* software must be clearly marked as such, and if the derived work is
	10	* incompatible with the protocol description in the RFC file, it must be
	11	* called by a name other than "ssh" or "Secure Shell".
	12	*
2e73a022	13	* SSH2 implementation,
2e73a022	14	* Copyright (c) 2000 Markus Friedl. All rights reserved.
bcbf86ec	15	*
	16	* Redistribution and use in source and binary forms, with or without
	17	* modification, are permitted provided that the following conditions
	18	* are met:
	19	* 1. Redistributions of source code must retain the above copyright
	20	* notice, this list of conditions and the following disclaimer.
	21	* 2. Redistributions in binary form must reproduce the above copyright
	22	* notice, this list of conditions and the following disclaimer in the
	23	* documentation and/or other materials provided with the distribution.
	24	*
	25	* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
	26	* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
	27	* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
	28	* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
	29	* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
	30	* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
	31	* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
	32	* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
	33	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
	34	* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
5260325f	35	*/
8efc0c15	36
8efc0c15	37	#include "includes.h"
bcbf86ec	38	RCSID("$OpenBSD: ssh-add.c,v 1.22 2000/09/07 20:27:54 deraadt Exp $");
8efc0c15	39
2e73a022	40	#include <openssl/evp.h>
a306f2dd	41	#include <openssl/rsa.h>
	42	#include <openssl/dsa.h>
	43
8efc0c15	44	#include "rsa.h"
	45	#include "ssh.h"
	46	#include "xmalloc.h"
a306f2dd	47	#include "key.h"
4c8722d9	48	#include "authfd.h"
a306f2dd	49	#include "authfile.h"
8efc0c15	50
f601d847	51	#ifdef HAVE___PROGNAME
	52	extern char *__progname;
	53	#else /* HAVE___PROGNAME */
3fd95d9a	54	static const char *__progname = "ssh-add";
f601d847	55	#endif /* HAVE___PROGNAME */
f601d847	56
8efc0c15	57	void
5068f573	58	delete_file(AuthenticationConnection ac, const char filename)
8efc0c15	59	{
a306f2dd	60	Key *public;
5260325f	61	char *comment;
5260325f	62
a306f2dd	63	public = key_new(KEY_RSA);
a306f2dd	64	if (!load_public_key(filename, public, &comment)) {
bcbf86ec	65	key_free(public);
	66	public = key_new(KEY_DSA);
	67	if (!try_load_public_key(filename, public, &comment)) {
	68	printf("Bad key file %s\n", filename);
	69	return;
	70	}
5260325f	71	}
2e73a022	72	if (ssh_remove_identity(ac, public))
5260325f	73	fprintf(stderr, "Identity removed: %s (%s)\n", filename, comment);
	74	else
	75	fprintf(stderr, "Could not remove identity: %s\n", filename);
a306f2dd	76	key_free(public);
5260325f	77	xfree(comment);
8efc0c15	78	}
8efc0c15	79
2e73a022	80	/* Send a request to remove all identities. */
8efc0c15	81	void
5068f573	82	delete_all(AuthenticationConnection *ac)
8efc0c15	83	{
2e73a022	84	int success = 1;
	85
	86	if (!ssh_remove_all_identities(ac, 1))
	87	success = 0;
	88	/* ignore error-code for ssh2 */
	89	ssh_remove_all_identities(ac, 2);
	90
	91	if (success)
5260325f	92	fprintf(stderr, "All identities removed.\n");
	93	else
	94	fprintf(stderr, "Failed to remove all identitities.\n");
8efc0c15	95	}
8efc0c15	96
aa3378df	97	char *
	98	ssh_askpass(char askpass, char msg)
	99	{
	100	pid_t pid;
	101	size_t len;
	102	char nl, pass;
	103	int p[2], status;
	104	char buf[1024];
	105
	106	if (askpass == NULL)
	107	fatal("internal error: askpass undefined");
	108	if (pipe(p) < 0)
	109	fatal("ssh_askpass: pipe: %s", strerror(errno));
	110	if ((pid = fork()) < 0)
	111	fatal("ssh_askpass: fork: %s", strerror(errno));
	112	if (pid == 0) {
	113	close(p[0]);
	114	if (dup2(p[1], STDOUT_FILENO) < 0)
	115	fatal("ssh_askpass: dup2: %s", strerror(errno));
	116	execlp(askpass, askpass, msg, (char *) 0);
	117	fatal("ssh_askpass: exec(%s): %s", askpass, strerror(errno));
	118	}
	119	close(p[1]);
ba7a3f40	120	buf[0] = '\0';
	121	atomicio(read, p[0], buf, sizeof buf);
	122	len = strlen(buf);
aa3378df	123	close(p[0]);
	124	while (waitpid(pid, &status, 0) < 0)
	125	if (errno != EINTR)
	126	break;
	127	if (len <= 1)
	128	return xstrdup("");
	129	nl = strchr(buf, '\n');
	130	if (nl)
	131	*nl = '\0';
	132	pass = xstrdup(buf);
	133	memset(buf, 0, sizeof(buf));
	134	return pass;
	135	}
	136
8efc0c15	137	void
5068f573	138	add_file(AuthenticationConnection ac, const char filename)
8efc0c15	139	{
2e73a022	140	struct stat st;
a306f2dd	141	Key *public;
a306f2dd	142	Key *private;
aa3378df	143	char saved_comment, comment, *askpass = NULL;
aa3378df	144	char buf[1024], msg[1024];
5260325f	145	int success;
aa3378df	146	int interactive = isatty(STDIN_FILENO);
4c8722d9	147	int type = KEY_RSA;
5260325f	148
2e73a022	149	if (stat(filename, &st) < 0) {
	150	perror(filename);
	151	exit(1);
	152	}
4c8722d9	153	/*
	154	* try to load the public key. right now this only works for RSA,
	155	* since DSA keys are fully encrypted
	156	*/
a306f2dd	157	public = key_new(KEY_RSA);
a306f2dd	158	if (!load_public_key(filename, public, &saved_comment)) {
4c8722d9	159	/* ok, so we will asume this is a DSA key */
	160	type = KEY_DSA;
	161	saved_comment = xstrdup(filename);
5260325f	162	}
a306f2dd	163	key_free(public);
dad9a31e	164
57112b5a	165	if (!interactive && getenv("DISPLAY")) {
	166	if (getenv(SSH_ASKPASS_ENV))
	167	askpass = getenv(SSH_ASKPASS_ENV);
	168	else
	169	askpass = SSH_ASKPASS_DEFAULT;
	170	}
aa3378df	171
5260325f	172	/* At first, try empty passphrase */
4c8722d9	173	private = key_new(type);
a306f2dd	174	success = load_private_key(filename, "", private, &comment);
5260325f	175	if (!success) {
aa3378df	176	printf("Need passphrase for %.200s\n", filename);
	177	if (!interactive && askpass == NULL) {
	178	xfree(saved_comment);
	179	return;
5260325f	180	}
aa3378df	181	snprintf(msg, sizeof msg, "Enter passphrase for %.200s", saved_comment);
	182	for (;;) {
	183	char *pass;
	184	if (interactive) {
	185	snprintf(buf, sizeof buf, "%s: ", msg);
	186	pass = read_passphrase(buf, 1);
	187	} else {
	188	pass = ssh_askpass(askpass, msg);
	189	}
5260325f	190	if (strcmp(pass, "") == 0) {
	191	xfree(pass);
	192	xfree(saved_comment);
	193	return;
	194	}
a306f2dd	195	success = load_private_key(filename, pass, private, &comment);
5260325f	196	memset(pass, 0, strlen(pass));
	197	xfree(pass);
	198	if (success)
	199	break;
aa3378df	200	strlcpy(msg, "Bad passphrase, try again", sizeof msg);
5260325f	201	}
5260325f	202	}
2e73a022	203	xfree(comment);
	204	if (ssh_add_identity(ac, private, saved_comment))
	205	fprintf(stderr, "Identity added: %s (%s)\n", filename, saved_comment);
5260325f	206	else
5260325f	207	fprintf(stderr, "Could not add identity: %s\n", filename);
a306f2dd	208	key_free(private);
2e73a022	209	xfree(saved_comment);
8efc0c15	210	}
	211
	212	void
f095fcc7	213	list_identities(AuthenticationConnection *ac, int fp)
8efc0c15	214	{
2e73a022	215	Key *key;
5260325f	216	char *comment;
2e73a022	217	int had_identities = 0;
	218	int version;
	219
	220	for (version = 1; version <= 2; version++) {
	221	for (key = ssh_get_first_identity(ac, &comment, version);
	222	key != NULL;
	223	key = ssh_get_next_identity(ac, &comment, version)) {
	224	had_identities = 1;
	225	if (fp) {
	226	printf("%d %s %s\n",
	227	key_size(key), key_fingerprint(key), comment);
5260325f	228	} else {
2e73a022	229	if (!key_write(key, stdout))
	230	fprintf(stderr, "key_write failed");
	231	fprintf(stdout, " %s\n", comment);
5260325f	232	}
2e73a022	233	key_free(key);
2e73a022	234	xfree(comment);
5260325f	235	}
f095fcc7	236	}
5260325f	237	if (!had_identities)
5260325f	238	printf("The agent has no identities.\n");
8efc0c15	239	}
	240
	241	int
5068f573	242	main(int argc, char **argv)
8efc0c15	243	{
5260325f	244	AuthenticationConnection *ac = NULL;
	245	struct passwd *pw;
	246	char buf[1024];
	247	int no_files = 1;
	248	int i;
	249	int deleting = 0;
	250
264dce47	251	init_rng();
264dce47	252
5260325f	253	/* check if RSA support exists */
5260325f	254	if (rsa_alive() == 0) {
5260325f	255	fprintf(stderr,
	256	"%s: no RSA support in libssl and libcrypto. See ssl(8).\n",
	257	__progname);
	258	exit(1);
8efc0c15	259	}
2e73a022	260	SSLeay_add_all_algorithms();
2e73a022	261
5260325f	262	/* At first, get a connection to the authentication agent. */
	263	ac = ssh_get_authentication_connection();
	264	if (ac == NULL) {
	265	fprintf(stderr, "Could not open a connection to your authentication agent.\n");
	266	exit(1);
8efc0c15	267	}
5260325f	268	for (i = 1; i < argc; i++) {
	269	if ((strcmp(argv[i], "-l") == 0) \|\|
	270	(strcmp(argv[i], "-L") == 0)) {
	271	list_identities(ac, argv[i][1] == 'l' ? 1 : 0);
	272	/* Don't default-add/delete if -l. */
	273	no_files = 0;
	274	continue;
	275	}
	276	if (strcmp(argv[i], "-d") == 0) {
	277	deleting = 1;
	278	continue;
	279	}
	280	if (strcmp(argv[i], "-D") == 0) {
	281	delete_all(ac);
	282	no_files = 0;
	283	continue;
	284	}
	285	no_files = 0;
	286	if (deleting)
	287	delete_file(ac, argv[i]);
	288	else
	289	add_file(ac, argv[i]);
8efc0c15	290	}
5260325f	291	if (no_files) {
	292	pw = getpwuid(getuid());
	293	if (!pw) {
14a9a859	294	fprintf(stderr, "No user found with uid %u\n",
14a9a859	295	(u_int)getuid());
5260325f	296	ssh_close_authentication_connection(ac);
	297	exit(1);
	298	}
	299	snprintf(buf, sizeof buf, "%s/%s", pw->pw_dir, SSH_CLIENT_IDENTITY);
	300	if (deleting)
	301	delete_file(ac, buf);
	302	else
	303	add_file(ac, buf);
8efc0c15	304	}
5260325f	305	ssh_close_authentication_connection(ac);
5260325f	306	exit(0);
8efc0c15	307	}