+static Key *
+load_identity(char *filename)
+{
+ char *pass;
+ Key *prv;
+
+ prv = key_load_private(filename, "", NULL);
+ if (prv == NULL) {
+ if (identity_passphrase)
+ pass = xstrdup(identity_passphrase);
+ else
+ pass = read_passphrase("Enter passphrase: ",
+ RP_ALLOW_STDIN);
+ prv = key_load_private(filename, pass, NULL);
+ memset(pass, 0, strlen(pass));
+ xfree(pass);
+ }
+ return prv;
+}
+
+#define SSH_COM_PUBLIC_BEGIN "---- BEGIN SSH2 PUBLIC KEY ----"
+#define SSH_COM_PUBLIC_END "---- END SSH2 PUBLIC KEY ----"
+#define SSH_COM_PRIVATE_BEGIN "---- BEGIN SSH2 ENCRYPTED PRIVATE KEY ----"
+#define SSH_COM_PRIVATE_KEY_MAGIC 0x3f6ff9eb
+
+static void
+do_convert_to_ssh2(struct passwd *pw)
+{
+ Key *k;
+ u_int len;
+ u_char *blob;
+ struct stat st;
+
+ if (!have_identity)
+ ask_filename(pw, "Enter file in which the key is");
+ if (stat(identity_file, &st) < 0) {
+ perror(identity_file);
+ exit(1);
+ }
+ if ((k = key_load_public(identity_file, NULL)) == NULL) {
+ if ((k = load_identity(identity_file)) == NULL) {
+ fprintf(stderr, "load failed\n");
+ exit(1);
+ }
+ }
+ if (key_to_blob(k, &blob, &len) <= 0) {
+ fprintf(stderr, "key_to_blob failed\n");
+ exit(1);
+ }
+ fprintf(stdout, "%s\n", SSH_COM_PUBLIC_BEGIN);
+ fprintf(stdout,
+ "Comment: \"%u-bit %s, converted from OpenSSH by %s@%s\"\n",
+ key_size(k), key_type(k),
+ pw->pw_name, hostname);
+ dump_base64(stdout, blob, len);
+ fprintf(stdout, "%s\n", SSH_COM_PUBLIC_END);
+ key_free(k);
+ xfree(blob);
+ exit(0);
+}
+
+static void
+buffer_get_bignum_bits(Buffer *b, BIGNUM *value)
+{
+ int bits = buffer_get_int(b);
+ int bytes = (bits + 7) / 8;
+
+ if (buffer_len(b) < bytes)
+ fatal("buffer_get_bignum_bits: input buffer too small: "
+ "need %d have %d", bytes, buffer_len(b));
+ BN_bin2bn(buffer_ptr(b), bytes, value);
+ buffer_consume(b, bytes);
+}
+
+static Key *
+do_convert_private_ssh2_from_blob(u_char *blob, u_int blen)
+{
+ Buffer b;
+ Key *key = NULL;
+ char *type, *cipher;
+ u_char *sig, data[] = "abcde12345";
+ int magic, rlen, ktype, i1, i2, i3, i4;
+ u_int slen;
+ u_long e;
+
+ buffer_init(&b);
+ buffer_append(&b, blob, blen);
+
+ magic = buffer_get_int(&b);
+ if (magic != SSH_COM_PRIVATE_KEY_MAGIC) {
+ error("bad magic 0x%x != 0x%x", magic, SSH_COM_PRIVATE_KEY_MAGIC);
+ buffer_free(&b);
+ return NULL;
+ }
+ i1 = buffer_get_int(&b);
+ type = buffer_get_string(&b, NULL);
+ cipher = buffer_get_string(&b, NULL);
+ i2 = buffer_get_int(&b);
+ i3 = buffer_get_int(&b);
+ i4 = buffer_get_int(&b);
+ debug("ignore (%d %d %d %d)", i1,i2,i3,i4);
+ if (strcmp(cipher, "none") != 0) {
+ error("unsupported cipher %s", cipher);
+ xfree(cipher);
+ buffer_free(&b);
+ xfree(type);
+ return NULL;
+ }
+ xfree(cipher);
+
+ if (strstr(type, "dsa")) {
+ ktype = KEY_DSA;
+ } else if (strstr(type, "rsa")) {
+ ktype = KEY_RSA;
+ } else {
+ xfree(type);
+ return NULL;
+ }
+ key = key_new_private(ktype);
+ xfree(type);
+
+ switch (key->type) {
+ case KEY_DSA:
+ buffer_get_bignum_bits(&b, key->dsa->p);
+ buffer_get_bignum_bits(&b, key->dsa->g);
+ buffer_get_bignum_bits(&b, key->dsa->q);
+ buffer_get_bignum_bits(&b, key->dsa->pub_key);
+ buffer_get_bignum_bits(&b, key->dsa->priv_key);
+ break;
+ case KEY_RSA:
+ e = buffer_get_char(&b);
+ debug("e %lx", e);
+ if (e < 30) {
+ e <<= 8;
+ e += buffer_get_char(&b);
+ debug("e %lx", e);
+ e <<= 8;
+ e += buffer_get_char(&b);
+ debug("e %lx", e);
+ }
+ if (!BN_set_word(key->rsa->e, e)) {
+ buffer_free(&b);
+ key_free(key);
+ return NULL;
+ }
+ buffer_get_bignum_bits(&b, key->rsa->d);
+ buffer_get_bignum_bits(&b, key->rsa->n);
+ buffer_get_bignum_bits(&b, key->rsa->iqmp);
+ buffer_get_bignum_bits(&b, key->rsa->q);
+ buffer_get_bignum_bits(&b, key->rsa->p);
+ rsa_generate_additional_parameters(key->rsa);
+ break;
+ }
+ rlen = buffer_len(&b);
+ if (rlen != 0)
+ error("do_convert_private_ssh2_from_blob: "
+ "remaining bytes in key blob %d", rlen);
+ buffer_free(&b);
+
+ /* try the key */
+ key_sign(key, &sig, &slen, data, sizeof(data));
+ key_verify(key, sig, slen, data, sizeof(data));
+ xfree(sig);
+ return key;
+}
+
+static void
+do_convert_from_ssh2(struct passwd *pw)
+{
+ Key *k;
+ int blen;
+ u_int len;
+ char line[1024], *p;
+ u_char blob[8096];
+ char encoded[8096];
+ struct stat st;
+ int escaped = 0, private = 0, ok;
+ FILE *fp;
+
+ if (!have_identity)
+ ask_filename(pw, "Enter file in which the key is");
+ if (stat(identity_file, &st) < 0) {
+ perror(identity_file);
+ exit(1);
+ }
+ fp = fopen(identity_file, "r");
+ if (fp == NULL) {
+ perror(identity_file);
+ exit(1);
+ }
+ encoded[0] = '\0';
+ while (fgets(line, sizeof(line), fp)) {
+ if (!(p = strchr(line, '\n'))) {
+ fprintf(stderr, "input line too long.\n");
+ exit(1);
+ }
+ if (p > line && p[-1] == '\\')
+ escaped++;
+ if (strncmp(line, "----", 4) == 0 ||
+ strstr(line, ": ") != NULL) {
+ if (strstr(line, SSH_COM_PRIVATE_BEGIN) != NULL)
+ private = 1;
+ if (strstr(line, " END ") != NULL) {
+ break;
+ }
+ /* fprintf(stderr, "ignore: %s", line); */
+ continue;
+ }
+ if (escaped) {
+ escaped--;
+ /* fprintf(stderr, "escaped: %s", line); */
+ continue;
+ }
+ *p = '\0';
+ strlcat(encoded, line, sizeof(encoded));
+ }
+ len = strlen(encoded);
+ if (((len % 4) == 3) &&
+ (encoded[len-1] == '=') &&
+ (encoded[len-2] == '=') &&
+ (encoded[len-3] == '='))
+ encoded[len-3] = '\0';
+ blen = uudecode(encoded, blob, sizeof(blob));
+ if (blen < 0) {
+ fprintf(stderr, "uudecode failed.\n");
+ exit(1);
+ }
+ k = private ?
+ do_convert_private_ssh2_from_blob(blob, blen) :
+ key_from_blob(blob, blen);
+ if (k == NULL) {
+ fprintf(stderr, "decode blob failed.\n");
+ exit(1);
+ }
+ ok = private ?
+ (k->type == KEY_DSA ?
+ PEM_write_DSAPrivateKey(stdout, k->dsa, NULL, NULL, 0, NULL, NULL) :
+ PEM_write_RSAPrivateKey(stdout, k->rsa, NULL, NULL, 0, NULL, NULL)) :
+ key_write(k, stdout);
+ if (!ok) {
+ fprintf(stderr, "key write failed");
+ exit(1);
+ }
+ key_free(k);
+ if (!private)
+ fprintf(stdout, "\n");
+ fclose(fp);
+ exit(0);
+}
+
+static void
+do_print_public(struct passwd *pw)
+{
+ Key *prv;
+ struct stat st;
+
+ if (!have_identity)
+ ask_filename(pw, "Enter file in which the key is");
+ if (stat(identity_file, &st) < 0) {
+ perror(identity_file);
+ exit(1);
+ }
+ prv = load_identity(identity_file);
+ if (prv == NULL) {
+ fprintf(stderr, "load failed\n");
+ exit(1);
+ }
+ if (!key_write(prv, stdout))
+ fprintf(stderr, "key_write failed");
+ key_free(prv);
+ fprintf(stdout, "\n");
+ exit(0);
+}
+
+#ifdef SMARTCARD
+static void
+do_upload(struct passwd *pw, const char *sc_reader_id)
+{
+ Key *prv = NULL;
+ struct stat st;
+ int ret;
+
+ if (!have_identity)
+ ask_filename(pw, "Enter file in which the key is");
+ if (stat(identity_file, &st) < 0) {
+ perror(identity_file);
+ exit(1);
+ }
+ prv = load_identity(identity_file);
+ if (prv == NULL) {
+ error("load failed");
+ exit(1);
+ }
+ ret = sc_put_key(prv, sc_reader_id);
+ key_free(prv);
+ if (ret < 0)
+ exit(1);
+ log("loading key done");
+ exit(0);
+}
+
+static void
+do_download(struct passwd *pw, const char *sc_reader_id)
+{
+ Key **keys = NULL;
+ int i;
+
+ keys = sc_get_keys(sc_reader_id, NULL);
+ if (keys == NULL)
+ fatal("cannot read public key from smartcard");
+ for (i = 0; keys[i]; i++) {
+ key_write(keys[i], stdout);
+ key_free(keys[i]);
+ fprintf(stdout, "\n");
+ }
+ xfree(keys);
+ exit(0);
+}
+#endif /* SMARTCARD */
+
+static void