+static void
+do_convert_from_ssh2(struct passwd *pw)
+{
+ Key *k;
+ int blen;
+ char line[1024], *p;
+ char blob[8096];
+ char encoded[8096];
+ struct stat st;
+ int escaped = 0, private = 0, ok;
+ FILE *fp;
+
+ if (!have_identity)
+ ask_filename(pw, "Enter file in which the key is");
+ if (stat(identity_file, &st) < 0) {
+ perror(identity_file);
+ exit(1);
+ }
+ fp = fopen(identity_file, "r");
+ if (fp == NULL) {
+ perror(identity_file);
+ exit(1);
+ }
+ encoded[0] = '\0';
+ while (fgets(line, sizeof(line), fp)) {
+ if (!(p = strchr(line, '\n'))) {
+ fprintf(stderr, "input line too long.\n");
+ exit(1);
+ }
+ if (p > line && p[-1] == '\\')
+ escaped++;
+ if (strncmp(line, "----", 4) == 0 ||
+ strstr(line, ": ") != NULL) {
+ if (strstr(line, SSH_COM_PRIVATE_BEGIN) != NULL)
+ private = 1;
+ if (strstr(line, " END ") != NULL) {
+ break;
+ }
+ /* fprintf(stderr, "ignore: %s", line); */
+ continue;
+ }
+ if (escaped) {
+ escaped--;
+ /* fprintf(stderr, "escaped: %s", line); */
+ continue;
+ }
+ *p = '\0';
+ strlcat(encoded, line, sizeof(encoded));
+ }
+ blen = uudecode(encoded, (u_char *)blob, sizeof(blob));
+ if (blen < 0) {
+ fprintf(stderr, "uudecode failed.\n");
+ exit(1);
+ }
+ k = private ?
+ do_convert_private_ssh2_from_blob(blob, blen) :
+ key_from_blob(blob, blen);
+ if (k == NULL) {
+ fprintf(stderr, "decode blob failed.\n");
+ exit(1);
+ }
+ ok = private ?
+ (k->type == KEY_DSA ?
+ PEM_write_DSAPrivateKey(stdout, k->dsa, NULL, NULL, 0, NULL, NULL) :
+ PEM_write_RSAPrivateKey(stdout, k->rsa, NULL, NULL, 0, NULL, NULL)) :
+ key_write(k, stdout);
+ if (!ok) {
+ fprintf(stderr, "key write failed");
+ exit(1);
+ }
+ key_free(k);
+ fprintf(stdout, "\n");
+ fclose(fp);
+ exit(0);
+}
+
+static void
+do_print_public(struct passwd *pw)
+{
+ Key *prv;
+ struct stat st;
+
+ if (!have_identity)
+ ask_filename(pw, "Enter file in which the key is");
+ if (stat(identity_file, &st) < 0) {
+ perror(identity_file);
+ exit(1);
+ }
+ prv = load_identity(identity_file);
+ if (prv == NULL) {
+ fprintf(stderr, "load failed\n");
+ exit(1);
+ }
+ if (!key_write(prv, stdout))
+ fprintf(stderr, "key_write failed");
+ key_free(prv);
+ fprintf(stdout, "\n");
+ exit(0);
+}
+
+#define NUM_RSA_KEY_ELEMENTS 5+1
+#define COPY_RSA_KEY(x, i) \
+ do { \
+ len = BN_num_bytes(prv->rsa->x); \
+ elements[i] = xmalloc(len); \
+ debug("#bytes %d", len); \
+ if (BN_bn2bin(prv->rsa->x, elements[i]) < 0) \
+ goto done; \
+ } while(0)
+
+static void
+do_upload(struct passwd *pw, int reader)
+{
+#ifndef SMARTCARD
+ fatal("no support for smartcards.");
+#else
+ Key *prv = NULL;
+ struct stat st;
+ u_char *elements[NUM_RSA_KEY_ELEMENTS];
+ u_char key_fid[2];
+ u_char AUT0[] = {0xad, 0x9f, 0x61, 0xfe, 0xfa, 0x20, 0xce, 0x63};
+ int len, status = 1, i, fd = -1, ret;
+ int sw = 0, cla = 0x00;
+
+ for (i = 0; i < NUM_RSA_KEY_ELEMENTS; i++)
+ elements[i] = NULL;
+ if (!have_identity)
+ ask_filename(pw, "Enter file in which the key is");
+ if (stat(identity_file, &st) < 0) {
+ perror(identity_file);
+ goto done;
+ }
+ prv = load_identity(identity_file);
+ if (prv == NULL) {
+ error("load failed");
+ goto done;
+ }
+ COPY_RSA_KEY(q, 0);
+ COPY_RSA_KEY(p, 1);
+ COPY_RSA_KEY(iqmp, 2);
+ COPY_RSA_KEY(dmq1, 3);
+ COPY_RSA_KEY(dmp1, 4);
+ COPY_RSA_KEY(n, 5);
+ len = BN_num_bytes(prv->rsa->n);
+ fd = sectok_open(reader, 0, &sw);
+ if (fd < 0) {
+ error("sectok_open failed");
+ goto done;
+ }
+ ret = sectok_reset(fd, 0, NULL, &sw);
+ if (ret <= 0) {
+ error("sectok_reset failed");
+ goto done;
+ }
+ if ((cla = cyberflex_inq_class(fd)) < 0) {
+ error("cyberflex_inq_class failed");
+ goto done;
+ }
+ if (cyberflex_verify_AUT0(fd, cla, AUT0, sizeof(AUT0)) < 0) {
+ error("cyberflex_verify_AUT0 failed");
+ goto done;
+ }
+ key_fid[0] = 0x00;
+ key_fid[1] = 0x12;
+ if (cyberflex_load_rsa_priv(fd, cla, key_fid, 5, 8*len, elements,
+ &sw) < 0) {
+ error("cyberflex_load_rsa_priv failed: %s", sectok_get_sw(sw));
+ goto done;
+ }
+ if (!sectok_swOK(sw))
+ goto done;
+ log("cyberflex_load_rsa_priv done");
+ key_fid[0] = 0x73;
+ key_fid[1] = 0x68;
+ if (cyberflex_load_rsa_pub(fd, cla, key_fid, len, elements[5],
+ &sw) < 0) {
+ error("cyberflex_load_rsa_pub failed: %s", sectok_get_sw(sw));
+ goto done;
+ }
+ if (!sectok_swOK(sw))
+ goto done;
+ log("cyberflex_load_rsa_pub done");
+ status = 0;
+ log("loading key done");
+done:
+ if (prv)
+ key_free(prv);
+ for (i = 0; i < NUM_RSA_KEY_ELEMENTS; i++)
+ if (elements[i])
+ xfree(elements[i]);
+ if (fd != -1)
+ sectok_close(fd);
+ exit(status);
+#endif
+}
+
+static void
+do_fingerprint(struct passwd *pw)
+{
+ FILE *f;
+ Key *public;
+ char *comment = NULL, *cp, *ep, line[16*1024], *fp;
+ int i, skip = 0, num = 1, invalid = 1, rep, fptype;
+ struct stat st;
+
+ fptype = print_bubblebabble ? SSH_FP_SHA1 : SSH_FP_MD5;
+ rep = print_bubblebabble ? SSH_FP_BUBBLEBABBLE : SSH_FP_HEX;
+
+ if (!have_identity)
+ ask_filename(pw, "Enter file in which the key is");
+ if (stat(identity_file, &st) < 0) {
+ perror(identity_file);
+ exit(1);
+ }
+ public = key_load_public(identity_file, &comment);
+ if (public != NULL) {
+ fp = key_fingerprint(public, fptype, rep);
+ printf("%d %s %s\n", key_size(public), fp, comment);
+ key_free(public);
+ xfree(comment);
+ xfree(fp);
+ exit(0);
+ }
+ if (comment)
+ xfree(comment);
+
+ f = fopen(identity_file, "r");
+ if (f != NULL) {
+ while (fgets(line, sizeof(line), f)) {
+ i = strlen(line) - 1;
+ if (line[i] != '\n') {
+ error("line %d too long: %.40s...", num, line);
+ skip = 1;
+ continue;
+ }
+ num++;
+ if (skip) {
+ skip = 0;
+ continue;
+ }
+ line[i] = '\0';
+
+ /* Skip leading whitespace, empty and comment lines. */
+ for (cp = line; *cp == ' ' || *cp == '\t'; cp++)
+ ;
+ if (!*cp || *cp == '\n' || *cp == '#')
+ continue ;
+ i = strtol(cp, &ep, 10);
+ if (i == 0 || ep == NULL || (*ep != ' ' && *ep != '\t')) {
+ int quoted = 0;
+ comment = cp;
+ for (; *cp && (quoted || (*cp != ' ' && *cp != '\t')); cp++) {
+ if (*cp == '\\' && cp[1] == '"')
+ cp++; /* Skip both */
+ else if (*cp == '"')
+ quoted = !quoted;
+ }
+ if (!*cp)
+ continue;
+ *cp++ = '\0';
+ }
+ ep = cp;
+ public = key_new(KEY_RSA1);
+ if (key_read(public, &cp) != 1) {
+ cp = ep;
+ key_free(public);
+ public = key_new(KEY_UNSPEC);
+ if (key_read(public, &cp) != 1) {
+ key_free(public);
+ continue;
+ }
+ }
+ comment = *cp ? cp : comment;
+ fp = key_fingerprint(public, fptype, rep);
+ printf("%d %s %s\n", key_size(public), fp,
+ comment ? comment : "no comment");
+ xfree(fp);
+ key_free(public);
+ invalid = 0;
+ }
+ fclose(f);
+ }
+ if (invalid) {
+ printf("%s is not a valid key file.\n", identity_file);
+ exit(1);
+ }
+ exit(0);
+}
+
+/*
+ * Perform changing a passphrase. The argument is the passwd structure
+ * for the current user.
+ */
+static void
+do_change_passphrase(struct passwd *pw)
+{
+ char *comment;
+ char *old_passphrase, *passphrase1, *passphrase2;
+ struct stat st;
+ Key *private;
+
+ if (!have_identity)
+ ask_filename(pw, "Enter file in which the key is");
+ if (stat(identity_file, &st) < 0) {
+ perror(identity_file);
+ exit(1);
+ }
+ /* Try to load the file with empty passphrase. */
+ private = key_load_private(identity_file, "", &comment);
+ if (private == NULL) {
+ if (identity_passphrase)
+ old_passphrase = xstrdup(identity_passphrase);
+ else
+ old_passphrase =
+ read_passphrase("Enter old passphrase: ",
+ RP_ALLOW_STDIN);
+ private = key_load_private(identity_file, old_passphrase,
+ &comment);
+ memset(old_passphrase, 0, strlen(old_passphrase));
+ xfree(old_passphrase);
+ if (private == NULL) {
+ printf("Bad passphrase.\n");
+ exit(1);
+ }
+ }
+ printf("Key has comment '%s'\n", comment);
+
+ /* Ask the new passphrase (twice). */
+ if (identity_new_passphrase) {
+ passphrase1 = xstrdup(identity_new_passphrase);
+ passphrase2 = NULL;
+ } else {
+ passphrase1 =
+ read_passphrase("Enter new passphrase (empty for no "
+ "passphrase): ", RP_ALLOW_STDIN);
+ passphrase2 = read_passphrase("Enter same passphrase again: ",
+ RP_ALLOW_STDIN);
+
+ /* Verify that they are the same. */
+ if (strcmp(passphrase1, passphrase2) != 0) {
+ memset(passphrase1, 0, strlen(passphrase1));
+ memset(passphrase2, 0, strlen(passphrase2));
+ xfree(passphrase1);
+ xfree(passphrase2);
+ printf("Pass phrases do not match. Try again.\n");
+ exit(1);
+ }
+ /* Destroy the other copy. */
+ memset(passphrase2, 0, strlen(passphrase2));
+ xfree(passphrase2);
+ }
+
+ /* Save the file using the new passphrase. */
+ if (!key_save_private(private, identity_file, passphrase1, comment)) {
+ printf("Saving the key failed: %s.\n", identity_file);
+ memset(passphrase1, 0, strlen(passphrase1));
+ xfree(passphrase1);
+ key_free(private);
+ xfree(comment);
+ exit(1);
+ }
+ /* Destroy the passphrase and the copy of the key in memory. */
+ memset(passphrase1, 0, strlen(passphrase1));
+ xfree(passphrase1);
+ key_free(private); /* Destroys contents */
+ xfree(comment);
+
+ printf("Your identification has been saved with the new passphrase.\n");
+ exit(0);
+}
+
+/*
+ * Change the comment of a private key file.
+ */
+static void