- char *comment;
- char *old_passphrase, *passphrase1, *passphrase2;
- struct stat st;
- RSA *private_key;
-
- if (!have_identity)
- ask_filename(pw, "Enter file in which the key is");
- /* Check if the file exists. */
- if (stat(identity_file, &st) < 0)
- {
- perror(identity_file);
- exit(1);
- }
-
- /* Try to load the public key from the file the verify that it is
- readable and of the proper format. */
- public_key = RSA_new();
- if (!load_public_key(identity_file, public_key, NULL))
- {
- printf("%s is not a valid key file.\n", identity_file);
- exit(1);
- }
- /* Clear the public key since we are just about to load the whole file. */
- RSA_free(public_key);
-
- /* Try to load the file with empty passphrase. */
- private_key = RSA_new();
- if (!load_private_key(identity_file, "", private_key, &comment)) {
- /* Read passphrase from the user. */
- if (identity_passphrase)
- old_passphrase = xstrdup(identity_passphrase);
- else
- old_passphrase = read_passphrase("Enter old passphrase: ", 1);
- /* Try to load using the passphrase. */
- if (!load_private_key(identity_file, old_passphrase, private_key, &comment))
- {
- memset(old_passphrase, 0, strlen(old_passphrase));
- xfree(old_passphrase);
- printf("Bad passphrase.\n");
- exit(1);
- }
- /* Destroy the passphrase. */
- memset(old_passphrase, 0, strlen(old_passphrase));
- xfree(old_passphrase);
- }
- printf("Key has comment '%s'\n", comment);
-
- /* Ask the new passphrase (twice). */
- if (identity_new_passphrase)
- {
- passphrase1 = xstrdup(identity_new_passphrase);
- passphrase2 = NULL;
- }
- else
- {
- passphrase1 =
- read_passphrase("Enter new passphrase (empty for no passphrase): ", 1);
- passphrase2 = read_passphrase("Enter same passphrase again: ", 1);
-
- /* Verify that they are the same. */
- if (strcmp(passphrase1, passphrase2) != 0)
- {
- memset(passphrase1, 0, strlen(passphrase1));
- memset(passphrase2, 0, strlen(passphrase2));
- xfree(passphrase1);
- xfree(passphrase2);
- printf("Pass phrases do not match. Try again.\n");
- exit(1);
- }
- /* Destroy the other copy. */
- memset(passphrase2, 0, strlen(passphrase2));
- xfree(passphrase2);
- }
-
- /* Save the file using the new passphrase. */
- if (!save_private_key(identity_file, passphrase1, private_key, comment))
- {
- printf("Saving the key failed: %s: %s.\n",
- identity_file, strerror(errno));
- memset(passphrase1, 0, strlen(passphrase1));
- xfree(passphrase1);
- RSA_free(private_key);
- xfree(comment);
- exit(1);
- }
- /* Destroy the passphrase and the copy of the key in memory. */
- memset(passphrase1, 0, strlen(passphrase1));
- xfree(passphrase1);
- RSA_free(private_key); /* Destroys contents */
- xfree(comment);
-
- printf("Your identification has been saved with the new passphrase.\n");
- exit(0);
+ Key *k;
+ u_int len;
+ u_char *blob;
+ struct stat st;
+
+ if (!have_identity)
+ ask_filename(pw, "Enter file in which the key is");
+ if (stat(identity_file, &st) < 0) {
+ perror(identity_file);
+ exit(1);
+ }
+ if ((k = key_load_public(identity_file, NULL)) == NULL) {
+ if ((k = load_identity(identity_file)) == NULL) {
+ fprintf(stderr, "load failed\n");
+ exit(1);
+ }
+ }
+ if (key_to_blob(k, &blob, &len) <= 0) {
+ fprintf(stderr, "key_to_blob failed\n");
+ exit(1);
+ }
+ fprintf(stdout, "%s\n", SSH_COM_PUBLIC_BEGIN);
+ fprintf(stdout,
+ "Comment: \"%d-bit %s, converted from OpenSSH by %s@%s\"\n",
+ key_size(k), key_type(k),
+ pw->pw_name, hostname);
+ dump_base64(stdout, blob, len);
+ fprintf(stdout, "%s\n", SSH_COM_PUBLIC_END);
+ key_free(k);
+ xfree(blob);
+ exit(0);
+}
+
+static void
+buffer_get_bignum_bits(Buffer *b, BIGNUM *value)
+{
+ int bits = buffer_get_int(b);
+ int bytes = (bits + 7) / 8;
+
+ if (buffer_len(b) < bytes)
+ fatal("buffer_get_bignum_bits: input buffer too small: "
+ "need %d have %d", bytes, buffer_len(b));
+ BN_bin2bn(buffer_ptr(b), bytes, value);
+ buffer_consume(b, bytes);
+}
+
+static Key *
+do_convert_private_ssh2_from_blob(u_char *blob, u_int blen)
+{
+ Buffer b;
+ Key *key = NULL;
+ char *type, *cipher;
+ u_char *sig, data[] = "abcde12345";
+ int magic, rlen, ktype, i1, i2, i3, i4;
+ u_int slen;
+ u_long e;
+
+ buffer_init(&b);
+ buffer_append(&b, blob, blen);
+
+ magic = buffer_get_int(&b);
+ if (magic != SSH_COM_PRIVATE_KEY_MAGIC) {
+ error("bad magic 0x%x != 0x%x", magic, SSH_COM_PRIVATE_KEY_MAGIC);
+ buffer_free(&b);
+ return NULL;
+ }
+ i1 = buffer_get_int(&b);
+ type = buffer_get_string(&b, NULL);
+ cipher = buffer_get_string(&b, NULL);
+ i2 = buffer_get_int(&b);
+ i3 = buffer_get_int(&b);
+ i4 = buffer_get_int(&b);
+ debug("ignore (%d %d %d %d)", i1,i2,i3,i4);
+ if (strcmp(cipher, "none") != 0) {
+ error("unsupported cipher %s", cipher);
+ xfree(cipher);
+ buffer_free(&b);
+ xfree(type);
+ return NULL;
+ }
+ xfree(cipher);
+
+ if (strstr(type, "dsa")) {
+ ktype = KEY_DSA;
+ } else if (strstr(type, "rsa")) {
+ ktype = KEY_RSA;
+ } else {
+ xfree(type);
+ return NULL;
+ }
+ key = key_new_private(ktype);
+ xfree(type);
+
+ switch (key->type) {
+ case KEY_DSA:
+ buffer_get_bignum_bits(&b, key->dsa->p);
+ buffer_get_bignum_bits(&b, key->dsa->g);
+ buffer_get_bignum_bits(&b, key->dsa->q);
+ buffer_get_bignum_bits(&b, key->dsa->pub_key);
+ buffer_get_bignum_bits(&b, key->dsa->priv_key);
+ break;
+ case KEY_RSA:
+ e = buffer_get_char(&b);
+ debug("e %lx", e);
+ if (e < 30) {
+ e <<= 8;
+ e += buffer_get_char(&b);
+ debug("e %lx", e);
+ e <<= 8;
+ e += buffer_get_char(&b);
+ debug("e %lx", e);
+ }
+ if (!BN_set_word(key->rsa->e, e)) {
+ buffer_free(&b);
+ key_free(key);
+ return NULL;
+ }
+ buffer_get_bignum_bits(&b, key->rsa->d);
+ buffer_get_bignum_bits(&b, key->rsa->n);
+ buffer_get_bignum_bits(&b, key->rsa->iqmp);
+ buffer_get_bignum_bits(&b, key->rsa->q);
+ buffer_get_bignum_bits(&b, key->rsa->p);
+ rsa_generate_additional_parameters(key->rsa);
+ break;
+ }
+ rlen = buffer_len(&b);
+ if (rlen != 0)
+ error("do_convert_private_ssh2_from_blob: "
+ "remaining bytes in key blob %d", rlen);
+ buffer_free(&b);
+
+ /* try the key */
+ key_sign(key, &sig, &slen, data, sizeof(data));
+ key_verify(key, sig, slen, data, sizeof(data));
+ xfree(sig);
+ return key;
+}
+
+static void
+do_convert_from_ssh2(struct passwd *pw)
+{
+ Key *k;
+ int blen;
+ u_int len;
+ char line[1024], *p;
+ u_char blob[8096];
+ char encoded[8096];
+ struct stat st;
+ int escaped = 0, private = 0, ok;
+ FILE *fp;
+
+ if (!have_identity)
+ ask_filename(pw, "Enter file in which the key is");
+ if (stat(identity_file, &st) < 0) {
+ perror(identity_file);
+ exit(1);
+ }
+ fp = fopen(identity_file, "r");
+ if (fp == NULL) {
+ perror(identity_file);
+ exit(1);
+ }
+ encoded[0] = '\0';
+ while (fgets(line, sizeof(line), fp)) {
+ if (!(p = strchr(line, '\n'))) {
+ fprintf(stderr, "input line too long.\n");
+ exit(1);
+ }
+ if (p > line && p[-1] == '\\')
+ escaped++;
+ if (strncmp(line, "----", 4) == 0 ||
+ strstr(line, ": ") != NULL) {
+ if (strstr(line, SSH_COM_PRIVATE_BEGIN) != NULL)
+ private = 1;
+ if (strstr(line, " END ") != NULL) {
+ break;
+ }
+ /* fprintf(stderr, "ignore: %s", line); */
+ continue;
+ }
+ if (escaped) {
+ escaped--;
+ /* fprintf(stderr, "escaped: %s", line); */
+ continue;
+ }
+ *p = '\0';
+ strlcat(encoded, line, sizeof(encoded));
+ }
+ len = strlen(encoded);
+ if (((len % 4) == 3) &&
+ (encoded[len-1] == '=') &&
+ (encoded[len-2] == '=') &&
+ (encoded[len-3] == '='))
+ encoded[len-3] = '\0';
+ blen = uudecode(encoded, blob, sizeof(blob));
+ if (blen < 0) {
+ fprintf(stderr, "uudecode failed.\n");
+ exit(1);
+ }
+ k = private ?
+ do_convert_private_ssh2_from_blob(blob, blen) :
+ key_from_blob(blob, blen);
+ if (k == NULL) {
+ fprintf(stderr, "decode blob failed.\n");
+ exit(1);
+ }
+ ok = private ?
+ (k->type == KEY_DSA ?
+ PEM_write_DSAPrivateKey(stdout, k->dsa, NULL, NULL, 0, NULL, NULL) :
+ PEM_write_RSAPrivateKey(stdout, k->rsa, NULL, NULL, 0, NULL, NULL)) :
+ key_write(k, stdout);
+ if (!ok) {
+ fprintf(stderr, "key write failed");
+ exit(1);
+ }
+ key_free(k);
+ if (!private)
+ fprintf(stdout, "\n");
+ fclose(fp);
+ exit(0);
+}
+
+static void
+do_print_public(struct passwd *pw)
+{
+ Key *prv;
+ struct stat st;
+
+ if (!have_identity)
+ ask_filename(pw, "Enter file in which the key is");
+ if (stat(identity_file, &st) < 0) {
+ perror(identity_file);
+ exit(1);
+ }
+ prv = load_identity(identity_file);
+ if (prv == NULL) {
+ fprintf(stderr, "load failed\n");
+ exit(1);
+ }
+ if (!key_write(prv, stdout))
+ fprintf(stderr, "key_write failed");
+ key_free(prv);
+ fprintf(stdout, "\n");
+ exit(0);
+}
+
+#ifdef SMARTCARD
+static void
+do_upload(struct passwd *pw, const char *sc_reader_id)
+{
+ Key *prv = NULL;
+ struct stat st;
+ int ret;
+
+ if (!have_identity)
+ ask_filename(pw, "Enter file in which the key is");
+ if (stat(identity_file, &st) < 0) {
+ perror(identity_file);
+ exit(1);
+ }
+ prv = load_identity(identity_file);
+ if (prv == NULL) {
+ error("load failed");
+ exit(1);
+ }
+ ret = sc_put_key(prv, sc_reader_id);
+ key_free(prv);
+ if (ret < 0)
+ exit(1);
+ log("loading key done");
+ exit(0);
+}
+
+static void
+do_download(struct passwd *pw, const char *sc_reader_id)
+{
+ Key **keys = NULL;
+ int i;
+
+ keys = sc_get_keys(sc_reader_id, NULL);
+ if (keys == NULL)
+ fatal("cannot read public key from smartcard");
+ for (i = 0; keys[i]; i++) {
+ key_write(keys[i], stdout);
+ key_free(keys[i]);
+ fprintf(stdout, "\n");
+ }
+ xfree(keys);
+ exit(0);
+}
+#endif /* SMARTCARD */
+
+static void
+do_fingerprint(struct passwd *pw)
+{
+ FILE *f;
+ Key *public;
+ char *comment = NULL, *cp, *ep, line[16*1024], *fp;
+ int i, skip = 0, num = 1, invalid = 1;
+ enum fp_rep rep;
+ enum fp_type fptype;
+ struct stat st;
+
+ fptype = print_bubblebabble ? SSH_FP_SHA1 : SSH_FP_MD5;
+ rep = print_bubblebabble ? SSH_FP_BUBBLEBABBLE : SSH_FP_HEX;
+
+ if (!have_identity)
+ ask_filename(pw, "Enter file in which the key is");
+ if (stat(identity_file, &st) < 0) {
+ perror(identity_file);
+ exit(1);
+ }
+ public = key_load_public(identity_file, &comment);
+ if (public != NULL) {
+ fp = key_fingerprint(public, fptype, rep);
+ printf("%d %s %s\n", key_size(public), fp, comment);
+ key_free(public);
+ xfree(comment);
+ xfree(fp);
+ exit(0);
+ }
+ if (comment)
+ xfree(comment);
+
+ f = fopen(identity_file, "r");
+ if (f != NULL) {
+ while (fgets(line, sizeof(line), f)) {
+ i = strlen(line) - 1;
+ if (line[i] != '\n') {
+ error("line %d too long: %.40s...", num, line);
+ skip = 1;
+ continue;
+ }
+ num++;
+ if (skip) {
+ skip = 0;
+ continue;
+ }
+ line[i] = '\0';
+
+ /* Skip leading whitespace, empty and comment lines. */
+ for (cp = line; *cp == ' ' || *cp == '\t'; cp++)
+ ;
+ if (!*cp || *cp == '\n' || *cp == '#')
+ continue ;
+ i = strtol(cp, &ep, 10);
+ if (i == 0 || ep == NULL || (*ep != ' ' && *ep != '\t')) {
+ int quoted = 0;
+ comment = cp;
+ for (; *cp && (quoted || (*cp != ' ' && *cp != '\t')); cp++) {
+ if (*cp == '\\' && cp[1] == '"')
+ cp++; /* Skip both */
+ else if (*cp == '"')
+ quoted = !quoted;
+ }
+ if (!*cp)
+ continue;
+ *cp++ = '\0';
+ }
+ ep = cp;
+ public = key_new(KEY_RSA1);
+ if (key_read(public, &cp) != 1) {
+ cp = ep;
+ key_free(public);
+ public = key_new(KEY_UNSPEC);
+ if (key_read(public, &cp) != 1) {
+ key_free(public);
+ continue;
+ }
+ }
+ comment = *cp ? cp : comment;
+ fp = key_fingerprint(public, fptype, rep);
+ printf("%d %s %s\n", key_size(public), fp,
+ comment ? comment : "no comment");
+ xfree(fp);
+ key_free(public);
+ invalid = 0;
+ }
+ fclose(f);
+ }
+ if (invalid) {
+ printf("%s is not a public key file.\n", identity_file);
+ exit(1);
+ }
+ exit(0);