- djm@cvs.openbsd.org 2001/12/21 10:06:43

[openssh.git] / ssh-keygen.c

diff --git a/ssh-keygen.c b/ssh-keygen.c
index 096908f3b6f5566d1d70c0f6a6df2c693e7b23bf..9e3a12a54f2cf49bd1fddce325f59c9e21712d2d 100644 (file)
--- a/ssh-keygen.c
+++ b/ssh-keygen.c
@@ -12,7 +12,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: ssh-keygen.c,v 1.75 2001/08/02 00:10:17 markus Exp $");
+RCSID("$OpenBSD: ssh-keygen.c,v 1.87 2001/12/21 08:52:22 djm Exp $");
 
 #include <openssl/evp.h>
 #include <openssl/pem.h>
@@ -73,8 +73,7 @@ int convert_to_ssh2 = 0;
 int convert_from_ssh2 = 0;
 int print_public = 0;
 
-/* default to RSA for SSH-1 */
-char *key_type_name = "rsa1";
+char *key_type_name = NULL;
 
 /* argv0 */
 #ifdef HAVE___PROGNAME
@@ -163,7 +162,10 @@ do_convert_to_ssh2(struct passwd *pw)
                        exit(1);
                }
        }
-       key_to_blob(k, &blob, &len);
+       if (key_to_blob(k, &blob, &len) <= 0) {
+               fprintf(stderr, "key_to_blob failed\n");
+               exit(1);
+       }
        fprintf(stdout, "%s\n", SSH_COM_PUBLIC_BEGIN);
        fprintf(stdout,
            "Comment: \"%d-bit %s, converted from OpenSSH by %s@%s\"\n",
@@ -190,7 +192,7 @@ buffer_get_bignum_bits(Buffer *b, BIGNUM *value)
 }
 
 static Key *
-do_convert_private_ssh2_from_blob(char *blob, int blen)
+do_convert_private_ssh2_from_blob(u_char *blob, int blen)
 {
        Buffer b;
        Key *key = NULL;
@@ -269,7 +271,7 @@ do_convert_private_ssh2_from_blob(char *blob, int blen)
                break;
        }
        rlen = buffer_len(&b);
-       if(rlen != 0)
+       if (rlen != 0)
                error("do_convert_private_ssh2_from_blob: "
                    "remaining bytes in key blob %d", rlen);
        buffer_free(&b);
@@ -287,7 +289,7 @@ do_convert_from_ssh2(struct passwd *pw)
        Key *k;
        int blen;
        char line[1024], *p;
-       char blob[8096];
+       u_char blob[8096];
        char encoded[8096];
        struct stat st;
        int escaped = 0, private = 0, ok;
@@ -390,7 +392,7 @@ do_print_public(struct passwd *pw)
                debug("#bytes %d", len); \
                if (BN_bn2bin(prv->rsa->x, elements[i]) < 0) \
                        goto done; \
-       } while(0)
+       } while (0)
 
 static int
 get_AUT0(char *aut0)
@@ -492,6 +494,14 @@ do_upload(struct passwd *pw, const char *sc_reader_id)
        status = 0;
        log("loading key done");
 done:
+
+       memset(elements[0], '\0', BN_num_bytes(prv->rsa->q));
+       memset(elements[1], '\0', BN_num_bytes(prv->rsa->p));
+       memset(elements[2], '\0', BN_num_bytes(prv->rsa->iqmp));
+       memset(elements[3], '\0', BN_num_bytes(prv->rsa->dmq1));
+       memset(elements[4], '\0', BN_num_bytes(prv->rsa->dmp1));
+       memset(elements[5], '\0', BN_num_bytes(prv->rsa->n));
+
        if (prv)
                key_free(prv);
        for (i = 0; i < NUM_RSA_KEY_ELEMENTS; i++)
@@ -515,7 +525,7 @@ do_download(struct passwd *pw, const char *sc_reader_id)
        fprintf(stdout, "\n");
        exit(0);
 }
-#endif
+#endif /* SMARTCARD */
 
 static void
 do_fingerprint(struct passwd *pw)
@@ -523,7 +533,9 @@ do_fingerprint(struct passwd *pw)
        FILE *f;
        Key *public;
        char *comment = NULL, *cp, *ep, line[16*1024], *fp;
-       int i, skip = 0, num = 1, invalid = 1, rep, fptype;
+       int i, skip = 0, num = 1, invalid = 1;
+       enum fp_rep rep;
+       enum fp_type fptype;
        struct stat st;
 
        fptype = print_bubblebabble ? SSH_FP_SHA1 : SSH_FP_MD5;
@@ -604,7 +616,7 @@ do_fingerprint(struct passwd *pw)
                fclose(f);
        }
        if (invalid) {
-               printf("%s is not a valid key file.\n", identity_file);
+               printf("%s is not a public key file.\n", identity_file);
                exit(1);
        }
        exit(0);
@@ -657,7 +669,7 @@ do_change_passphrase(struct passwd *pw)
                        read_passphrase("Enter new passphrase (empty for no "
                            "passphrase): ", RP_ALLOW_STDIN);
                passphrase2 = read_passphrase("Enter same passphrase again: ",
-                    RP_ALLOW_STDIN);
+                   RP_ALLOW_STDIN);
 
                /* Verify that they are the same. */
                if (strcmp(passphrase1, passphrase2) != 0) {
@@ -735,7 +747,7 @@ do_change_comment(struct passwd *pw)
                fprintf(stderr, "Comments are only supported for RSA1 keys.\n");
                key_free(private);
                exit(1);
-       }       
+       }
        printf("Key now has comment '%s'\n", comment);
 
        if (identity_comment) {
@@ -792,8 +804,27 @@ do_change_comment(struct passwd *pw)
 static void
 usage(void)
 {
-       printf("Usage: %s [-ceilpqyB] [-t type] [-b bits] [-f file] [-C comment] "
-           "[-N new-pass] [-P pass]\n", __progname);
+       fprintf(stderr, "Usage: %s [options]\n", __progname);
+       fprintf(stderr, "Options:\n");
+       fprintf(stderr, "  -b bits     Number of bits in the key to create.\n");
+       fprintf(stderr, "  -c          Change comment in private and public key files.\n");
+       fprintf(stderr, "  -e          Convert OpenSSH to IETF SECSH key file.\n");
+       fprintf(stderr, "  -f filename Filename of the key file.\n");
+       fprintf(stderr, "  -i          Convert IETF SECSH to OpenSSH key file.\n");
+       fprintf(stderr, "  -l          Show fingerprint of key file.\n");
+       fprintf(stderr, "  -p          Change passphrase of private key file.\n");
+       fprintf(stderr, "  -q          Quiet.\n");
+       fprintf(stderr, "  -y          Read private key file and print public key.\n");
+       fprintf(stderr, "  -t type     Specify type of key to create.\n");
+       fprintf(stderr, "  -B          Show bubblebabble digest of key file.\n");
+       fprintf(stderr, "  -C comment  Provide new comment.\n");
+       fprintf(stderr, "  -N phrase   Provide new passphrase.\n");
+       fprintf(stderr, "  -P phrase   Provide old passphrase.\n");
+#ifdef SMARTCARD
+       fprintf(stderr, "  -D reader   Download public key from smartcard.\n");
+       fprintf(stderr, "  -U reader   Upload private key to smartcard.\n");
+#endif /* SMARTCARD */
+
        exit(1);
 }
 
@@ -803,7 +834,7 @@ usage(void)
 int
 main(int ac, char **av)
 {
-       char dotsshdir[16 * 1024], comment[1024], *passphrase1, *passphrase2;
+       char dotsshdir[MAXPATHLEN], comment[1024], *passphrase1, *passphrase2;
        char *reader_id = NULL;
        Key *private, *public;
        struct passwd *pw;
@@ -831,7 +862,7 @@ main(int ac, char **av)
                exit(1);
        }
 
-       while ((opt = getopt(ac, av, "deiqpclBRxXyb:f:t:u:D:P:N:C:")) != -1) {
+       while ((opt = getopt(ac, av, "deiqpclBRxXyb:f:t:U:D:P:N:C:")) != -1) {
                switch (opt) {
                case 'b':
                        bits = atoi(optarg);
@@ -893,7 +924,7 @@ main(int ac, char **av)
                        break;
                case 'D':
                        download = 1;
-               case 'u':
+               case 'U':
                        reader_id = optarg;
                        break;
                case '?':
@@ -905,6 +936,10 @@ main(int ac, char **av)
                printf("Too many arguments.\n");
                usage();
        }
+       if (key_type_name == NULL) {
+               printf("You must specify a key type (-t).\n");
+               usage();
+       }
        if (change_passphrase && change_comment) {
                printf("Can only have one of -p and -c.\n");
                usage();
@@ -927,9 +962,9 @@ main(int ac, char **av)
                        do_download(pw, reader_id);
                else
                        do_upload(pw, reader_id);
-#else
+#else /* SMARTCARD */
                fatal("no support for smartcards.");
-#endif
+#endif /* SMARTCARD */
        }
 
        arc4random_stir();