+20010328
+ - OpenBSD CVS Sync
+ - markus@cvs.openbsd.org 2001/03/26 08:07:09
+ [authfile.c authfile.h ssh-add.c ssh-keygen.c ssh.c sshconnect.c
+ sshconnect.h sshconnect1.c sshconnect2.c sshd.c]
+ simpler key load/save interface, see authfile.h
+
20010327
- Attempt sync with sshlogin.c w/ OpenBSD (mainly CVS ID)
- Fix pointer issues in waitpid() and wait() replaces. Patch by Lutz
*/
#include "includes.h"
-RCSID("$OpenBSD: authfile.c,v 1.28 2001/02/21 09:05:54 deraadt Exp $");
+RCSID("$OpenBSD: authfile.c,v 1.29 2001/03/26 08:07:07 markus Exp $");
#include <openssl/err.h>
#include <openssl/evp.h>
#include "log.h"
#include "authfile.h"
-/* Version identification string for identity files. */
+/* Version identification string for SSH v1 identity files. */
static const char authfile_id_string[] =
"SSH PRIVATE KEY FILE FORMAT 1.1\n";
*/
int
-save_private_key_rsa1(const char *filename, const char *passphrase,
- RSA *key, const char *comment)
+key_save_private_rsa1(Key *key, const char *filename, const char *passphrase,
+ const char *comment)
{
Buffer buffer, encrypted;
char buf[100], *cp;
* will be stored in plain text, and storing them also in encrypted
* format would just give known plaintext).
*/
- buffer_put_bignum(&buffer, key->d);
- buffer_put_bignum(&buffer, key->iqmp);
- buffer_put_bignum(&buffer, key->q); /* reverse from SSL p */
- buffer_put_bignum(&buffer, key->p); /* reverse from SSL q */
+ buffer_put_bignum(&buffer, key->rsa->d);
+ buffer_put_bignum(&buffer, key->rsa->iqmp);
+ buffer_put_bignum(&buffer, key->rsa->q); /* reverse from SSL p */
+ buffer_put_bignum(&buffer, key->rsa->p); /* reverse from SSL q */
/* Pad the part to be encrypted until its size is a multiple of 8. */
while (buffer_len(&buffer) % 8 != 0)
buffer_put_int(&encrypted, 0); /* For future extension */
/* Store public key. This will be in plain text. */
- buffer_put_int(&encrypted, BN_num_bits(key->n));
- buffer_put_bignum(&encrypted, key->n);
- buffer_put_bignum(&encrypted, key->e);
+ buffer_put_int(&encrypted, BN_num_bits(key->rsa->n));
+ buffer_put_bignum(&encrypted, key->rsa->n);
+ buffer_put_bignum(&encrypted, key->rsa->e);
buffer_put_string(&encrypted, comment, strlen(comment));
/* Allocate space for the private part of the key in the buffer. */
return 1;
}
-/* save SSH2 key in OpenSSL PEM format */
+/* save SSH v2 key in OpenSSL PEM format */
int
-save_private_key_ssh2(const char *filename, const char *_passphrase,
- Key *key, const char *comment)
+key_save_private_pem(Key *key, const char *filename, const char *_passphrase,
+ const char *comment)
{
FILE *fp;
int fd;
}
int
-save_private_key(const char *filename, const char *passphrase, Key *key,
+key_save_private(Key *key, const char *filename, const char *passphrase,
const char *comment)
{
switch (key->type) {
case KEY_RSA1:
- return save_private_key_rsa1(filename, passphrase, key->rsa, comment);
+ return key_save_private_rsa1(key, filename, passphrase,
+ comment);
break;
case KEY_DSA:
case KEY_RSA:
- return save_private_key_ssh2(filename, passphrase, key, comment);
+ return key_save_private_pem(key, filename, passphrase,
+ comment);
break;
default:
break;
}
/*
- * Loads the public part of the key file. Returns 0 if an error was
- * encountered (the file does not exist or is not readable), and non-zero
+ * Loads the public part of the ssh v1 key file. Returns NULL if an error was
+ * encountered (the file does not exist or is not readable), and the key
* otherwise.
*/
-int
-load_public_key_rsa(const char *filename, RSA * pub, char **comment_return)
+Key *
+key_load_public_rsa1(int fd, const char *filename, char **commentp)
{
- int fd, i;
- off_t len;
Buffer buffer;
+ Key *pub;
char *cp;
+ int i;
+ off_t len;
- fd = open(filename, O_RDONLY);
- if (fd < 0)
- return 0;
len = lseek(fd, (off_t) 0, SEEK_END);
lseek(fd, (off_t) 0, SEEK_SET);
debug("Read from key file %.200s failed: %.100s", filename,
strerror(errno));
buffer_free(&buffer);
- close(fd);
- return 0;
+ return NULL;
}
- close(fd);
/* Check that it is at least big enough to contain the ID string. */
if (len < sizeof(authfile_id_string)) {
debug3("Bad RSA1 key file %.200s.", filename);
buffer_free(&buffer);
- return 0;
+ return NULL;
}
/*
* Make sure it begins with the id string. Consume the id string
if (buffer_get_char(&buffer) != authfile_id_string[i]) {
debug3("Bad RSA1 key file %.200s.", filename);
buffer_free(&buffer);
- return 0;
+ return NULL;
}
/* Skip cipher type and reserved data. */
(void) buffer_get_char(&buffer); /* cipher type */
/* Read the public key from the buffer. */
buffer_get_int(&buffer);
- /* XXX alloc */
- if (pub->n == NULL)
- pub->n = BN_new();
- buffer_get_bignum(&buffer, pub->n);
- /* XXX alloc */
- if (pub->e == NULL)
- pub->e = BN_new();
- buffer_get_bignum(&buffer, pub->e);
- if (comment_return)
- *comment_return = buffer_get_string(&buffer, NULL);
+ pub = key_new(KEY_RSA1);
+ buffer_get_bignum(&buffer, pub->rsa->n);
+ buffer_get_bignum(&buffer, pub->rsa->e);
+ if (commentp)
+ *commentp = buffer_get_string(&buffer, NULL);
/* The encrypted private part is not parsed by this function. */
buffer_free(&buffer);
-
- return 1;
+ return pub;
}
-/* load public key from private-key file */
-int
-load_public_key(const char *filename, Key * key, char **comment_return)
+/* load public key from private-key file, works only for SSH v1 */
+Key *
+key_load_public_type(int type, const char *filename, char **commentp)
{
- switch (key->type) {
- case KEY_RSA1:
- return load_public_key_rsa(filename, key->rsa, comment_return);
- break;
- case KEY_DSA:
- case KEY_RSA:
- default:
- break;
+ Key *pub;
+ int fd;
+
+ if (type == KEY_RSA1) {
+ fd = open(filename, O_RDONLY);
+ if (fd < 0)
+ return NULL;
+ pub = key_load_public_rsa1(fd, filename, commentp);
+ close(fd);
+ return pub;
}
- return 0;
+ return NULL;
}
/*
* Assumes we are called under uid of the owner of the file.
*/
-int
-load_private_key_rsa1(int fd, const char *filename,
- const char *passphrase, RSA * prv, char **comment_return)
+Key *
+key_load_private_rsa1(int fd, const char *filename, const char *passphrase,
+ char **commentp)
{
int i, check1, check2, cipher_type;
off_t len;
Cipher *cipher;
BN_CTX *ctx;
BIGNUM *aux;
+ Key *prv = NULL;
len = lseek(fd, (off_t) 0, SEEK_END);
lseek(fd, (off_t) 0, SEEK_SET);
strerror(errno));
buffer_free(&buffer);
close(fd);
- return 0;
+ return NULL;
}
/* Check that it is at least big enough to contain the ID string. */
debug3("Bad RSA1 key file %.200s.", filename);
buffer_free(&buffer);
close(fd);
- return 0;
+ return NULL;
}
/*
* Make sure it begins with the id string. Consume the id string
debug3("Bad RSA1 key file %.200s.", filename);
buffer_free(&buffer);
close(fd);
- return 0;
+ return NULL;
}
/* Read cipher type. */
/* Read the public key from the buffer. */
buffer_get_int(&buffer);
- prv->n = BN_new();
- buffer_get_bignum(&buffer, prv->n);
- prv->e = BN_new();
- buffer_get_bignum(&buffer, prv->e);
- if (comment_return)
- *comment_return = buffer_get_string(&buffer, NULL);
+ prv = key_new_private(KEY_RSA1);
+
+ buffer_get_bignum(&buffer, prv->rsa->n);
+ buffer_get_bignum(&buffer, prv->rsa->e);
+ if (commentp)
+ *commentp = buffer_get_string(&buffer, NULL);
else
xfree(buffer_get_string(&buffer, NULL));
if (check1 != buffer_get_char(&decrypted) ||
check2 != buffer_get_char(&decrypted)) {
if (strcmp(passphrase, "") != 0)
- debug("Bad passphrase supplied for key file %.200s.", filename);
+ debug("Bad passphrase supplied for key file %.200s.",
+ filename);
/* Bad passphrase. */
buffer_free(&decrypted);
-fail:
- BN_clear_free(prv->n);
- prv->n = NULL;
- BN_clear_free(prv->e);
- prv->e = NULL;
- if (comment_return)
- xfree(*comment_return);
- close(fd);
- return 0;
+ goto fail;
}
/* Read the rest of the private key. */
- prv->d = BN_new();
- buffer_get_bignum(&decrypted, prv->d);
- prv->iqmp = BN_new();
- buffer_get_bignum(&decrypted, prv->iqmp); /* u */
- /* in SSL and SSH p and q are exchanged */
- prv->q = BN_new();
- buffer_get_bignum(&decrypted, prv->q); /* p */
- prv->p = BN_new();
- buffer_get_bignum(&decrypted, prv->p); /* q */
+ buffer_get_bignum(&decrypted, prv->rsa->d);
+ buffer_get_bignum(&decrypted, prv->rsa->iqmp); /* u */
+ /* in SSL and SSH v1 p and q are exchanged */
+ buffer_get_bignum(&decrypted, prv->rsa->q); /* p */
+ buffer_get_bignum(&decrypted, prv->rsa->p); /* q */
+ /* calculate p-1 and q-1 */
ctx = BN_CTX_new();
aux = BN_new();
- BN_sub(aux, prv->q, BN_value_one());
- prv->dmq1 = BN_new();
- BN_mod(prv->dmq1, prv->d, aux, ctx);
+ BN_sub(aux, prv->rsa->q, BN_value_one());
+ BN_mod(prv->rsa->dmq1, prv->rsa->d, aux, ctx);
- BN_sub(aux, prv->p, BN_value_one());
- prv->dmp1 = BN_new();
- BN_mod(prv->dmp1, prv->d, aux, ctx);
+ BN_sub(aux, prv->rsa->p, BN_value_one());
+ BN_mod(prv->rsa->dmp1, prv->rsa->d, aux, ctx);
BN_clear_free(aux);
BN_CTX_free(ctx);
buffer_free(&decrypted);
close(fd);
- return 1;
+ return prv;
+
+fail:
+ if (commentp)
+ xfree(*commentp);
+ close(fd);
+ key_free(prv);
+ return NULL;
}
-int
-load_private_key_ssh2(int fd, const char *passphrase, Key *k, char **comment_return)
+Key *
+key_load_private_pem(int fd, int type, const char *passphrase,
+ char **commentp)
{
FILE *fp;
- int success = 0;
EVP_PKEY *pk = NULL;
+ Key *prv = NULL;
char *name = "<no key>";
fp = fdopen(fd, "r");
if (fp == NULL) {
error("fdopen failed");
close(fd);
- return 0;
+ return NULL;
}
pk = PEM_read_PrivateKey(fp, NULL, NULL, (char *)passphrase);
if (pk == NULL) {
debug("PEM_read_PrivateKey failed");
(void)ERR_get_error();
- } else if (pk->type == EVP_PKEY_RSA) {
- /* replace k->rsa with loaded key */
- if (k->type == KEY_RSA || k->type == KEY_UNSPEC) {
- if (k->rsa != NULL)
- RSA_free(k->rsa);
- k->rsa = EVP_PKEY_get1_RSA(pk);
- k->type = KEY_RSA;
- name = "rsa w/o comment";
- success = 1;
+ } else if (pk->type == EVP_PKEY_RSA &&
+ (type == KEY_UNSPEC||type==KEY_RSA)) {
+ prv = key_new(KEY_UNSPEC);
+ prv->rsa = EVP_PKEY_get1_RSA(pk);
+ prv->type = KEY_RSA;
+ name = "rsa w/o comment";
#ifdef DEBUG_PK
- RSA_print_fp(stderr, k->rsa, 8);
+ RSA_print_fp(stderr, prv->rsa, 8);
#endif
- }
- } else if (pk->type == EVP_PKEY_DSA) {
- /* replace k->dsa with loaded key */
- if (k->type == KEY_DSA || k->type == KEY_UNSPEC) {
- if (k->dsa != NULL)
- DSA_free(k->dsa);
- k->dsa = EVP_PKEY_get1_DSA(pk);
- k->type = KEY_DSA;
- name = "dsa w/o comment";
+ } else if (pk->type == EVP_PKEY_DSA &&
+ (type == KEY_UNSPEC||type==KEY_DSA)) {
+ prv = key_new(KEY_UNSPEC);
+ prv->dsa = EVP_PKEY_get1_DSA(pk);
+ prv->type = KEY_DSA;
+ name = "dsa w/o comment";
#ifdef DEBUG_PK
- DSA_print_fp(stderr, k->dsa, 8);
+ DSA_print_fp(stderr, prv->dsa, 8);
#endif
- success = 1;
- }
} else {
error("PEM_read_PrivateKey: mismatch or "
"unknown EVP_PKEY save_type %d", pk->save_type);
fclose(fp);
if (pk != NULL)
EVP_PKEY_free(pk);
- if (success && comment_return)
- *comment_return = xstrdup(name);
- debug("read SSH2 private key done: name %s success %d", name, success);
- return success;
+ if (prv != NULL && commentp)
+ *commentp = xstrdup(name);
+ debug("read PEM private key done: type %s",
+ prv ? key_type(prv) : "<unknown>");
+ return prv;
}
int
-load_private_key(const char *filename, const char *passphrase, Key *key,
- char **comment_return)
+key_perm_ok(int fd, const char *filename)
{
- int fd;
- int ret = 0;
struct stat st;
- fd = open(filename, O_RDONLY);
- if (fd < 0)
- return 0;
-
/* check owner and modes */
#ifdef HAVE_CYGWIN
if (check_ntsec(filename))
error("Bad ownership or mode(0%3.3o) for '%s'.",
st.st_mode & 0777, filename);
error("It is recommended that your private key files are NOT accessible by others.");
+ error("This private key will be ignored.");
return 0;
}
- switch (key->type) {
- case KEY_RSA1:
- if (key->rsa->e != NULL) {
- BN_clear_free(key->rsa->e);
- key->rsa->e = NULL;
- }
- if (key->rsa->n != NULL) {
- BN_clear_free(key->rsa->n);
- key->rsa->n = NULL;
- }
- ret = load_private_key_rsa1(fd, filename, passphrase,
- key->rsa, comment_return); /* closes fd */
+ return 1;
+}
+Key *
+key_load_private_type(int type, const char *filename, const char *passphrase,
+ char **commentp)
+{
+ int fd;
+
+ fd = open(filename, O_RDONLY);
+ if (fd < 0)
+ return NULL;
+ if (!key_perm_ok(fd, filename)) {
+ debug("bad permissions: ignore key: %s", filename);
+ close(fd);
+ return NULL;
+ }
+ switch (type) {
+ case KEY_RSA1:
+ return key_load_private_rsa1(fd, filename, passphrase,
+ commentp);
+ /* closes fd */
break;
case KEY_DSA:
case KEY_RSA:
case KEY_UNSPEC:
- ret = load_private_key_ssh2(fd, passphrase, key,
- comment_return); /* closes fd */
+ return key_load_private_pem(fd, type, passphrase, commentp);
+ /* closes fd */
break;
default:
close(fd);
break;
}
- return ret;
+ return NULL;
+}
+
+Key *
+key_load_private(const char *filename, const char *passphrase,
+ char **commentp)
+{
+ Key *pub;
+ int fd;
+
+ fd = open(filename, O_RDONLY);
+ if (fd < 0)
+ return NULL;
+ if (!key_perm_ok(fd, filename)) {
+ debug("bad permissions: ignore key: %s", filename);
+ close(fd);
+ return NULL;
+ }
+ pub = key_load_public_rsa1(fd, filename, commentp);
+ lseek(fd, (off_t) 0, SEEK_SET); /* rewind */
+ if (pub == NULL) {
+ /* closes fd */
+ return key_load_private_pem(fd, KEY_UNSPEC, passphrase, NULL);
+ } else {
+ /* it's a SSH v1 key if the public key part is readable */
+ key_free(pub);
+ /* closes fd */
+ return key_load_private_rsa1(fd, filename, passphrase, NULL);
+ }
}
int
-do_load_public_key(const char *filename, Key *k, char **commentp)
+key_try_load_public(Key *k, const char *filename, char **commentp)
{
FILE *f;
- char line[1024];
+ char line[4096];
char *cp;
f = fopen(filename, "r");
return 0;
}
-/* load public key from pubkey file */
-int
-try_load_public_key(const char *filename, Key *k, char **commentp)
+/* load public key from ssh v1 private or any pubkey file */
+Key *
+key_load_public(const char *filename, char **commentp)
{
- char pub[MAXPATHLEN];
-
- if (do_load_public_key(filename, k, commentp) == 1)
- return 1;
- if (strlcpy(pub, filename, sizeof pub) >= MAXPATHLEN)
- return 0;
- if (strlcat(pub, ".pub", sizeof pub) >= MAXPATHLEN)
- return 0;
- if (do_load_public_key(pub, k, commentp) == 1)
- return 1;
- return 0;
+ Key *pub;
+ char file[MAXPATHLEN];
+
+ pub = key_load_public_type(KEY_RSA1, filename, commentp);
+ if (pub != NULL)
+ return pub;
+ pub = key_new(KEY_UNSPEC);
+ if (key_try_load_public(pub, filename, commentp) == 1)
+ return pub;
+ if ((strlcpy(file, filename, sizeof file) < sizeof(file)) &&
+ (strlcat(file, ".pub", sizeof file) < sizeof(file)) &&
+ (key_try_load_public(pub, file, commentp) == 1))
+ return pub;
+ key_free(pub);
+ return NULL;
}
* Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
* All rights reserved
- * Functions to interface with the SSH_AUTHENTICATION_FD socket.
*
* As far as I am concerned, the code I have written for this software
* can be used freely for any purpose. Any derived versions of this
* called by a name other than "ssh" or "Secure Shell".
*/
-/* $OpenBSD: authfile.h,v 1.5 2000/10/16 09:38:44 djm Exp $ */
+/* $OpenBSD: authfile.h,v 1.6 2001/03/26 08:07:08 markus Exp $ */
#ifndef AUTHFILE_H
#define AUTHFILE_H
-
-/*
- * Saves the authentication (private) key in a file, encrypting it with
- * passphrase.
- * For RSA keys: The identification of the file (lowest 64 bits of n)
- * will precede the key to provide identification of the key without
- * needing a passphrase.
- */
int
-save_private_key(const char *filename, const char *passphrase,
- Key * private_key, const char *comment);
+key_save_private(Key *key, const char *filename, const char *passphrase,
+ const char *comment);
-/*
- * Loads the public part of the key file (public key and comment). Returns 0
- * if an error occurred; zero if the public key was successfully read. The
- * comment of the key is returned in comment_return if it is non-NULL; the
- * caller must free the value with xfree.
- */
-int load_public_key(const char *filename, Key * pub, char **comment_return);
-int try_load_public_key(const char *filename, Key * pub, char **comment_return);
+Key *
+key_load_public(const char *filename, char **commentp);
-/*
- * Loads the private key from the file. Returns 0 if an error is encountered
- * (file does not exist or is not readable, or passphrase is bad). This
- * initializes the private key. The comment of the key is returned in
- * comment_return if it is non-NULL; the caller must free the value with
- * xfree.
- */
-int
-load_private_key(const char *filename, const char *passphrase,
- Key * private_key, char **comment_return);
+Key *
+key_load_public_type(int type, const char *filename, char **commentp);
+
+Key *
+key_load_private(const char *filename, const char *passphrase,
+ char **commentp);
+
+Key *
+key_load_private_type(int type, const char *filename, const char *passphrase,
+ char **commentp);
#endif
*/
#include "includes.h"
-RCSID("$OpenBSD: ssh-add.c,v 1.30 2001/03/12 22:02:02 markus Exp $");
+RCSID("$OpenBSD: ssh-add.c,v 1.31 2001/03/26 08:07:08 markus Exp $");
#include <openssl/evp.h>
Key *public;
char *comment;
- public = key_new(KEY_RSA1);
- if (!load_public_key(filename, public, &comment)) {
- key_free(public);
- public = key_new(KEY_UNSPEC);
- if (!try_load_public_key(filename, public, &comment)) {
- printf("Bad key file %s\n", filename);
- return;
- }
+ public = key_load_public(filename, &comment);
+ if (public == NULL) {
+ printf("Bad key file %s\n", filename);
+ return;
}
if (ssh_remove_identity(ac, public))
fprintf(stderr, "Identity removed: %s (%s)\n", filename, comment);
add_file(AuthenticationConnection *ac, const char *filename)
{
struct stat st;
- Key *public;
Key *private;
- char *saved_comment, *comment, *askpass = NULL;
+ char *comment, *askpass = NULL, *pass;
char buf[1024], msg[1024];
- int success;
int interactive = isatty(STDIN_FILENO);
- int type = KEY_RSA1;
if (stat(filename, &st) < 0) {
perror(filename);
exit(1);
}
- /*
- * try to load the public key. right now this only works for RSA,
- * since DSA keys are fully encrypted
- */
- public = key_new(KEY_RSA1);
- if (!load_public_key(filename, public, &saved_comment)) {
- /* ok, so we will assume this is 'some' key */
- type = KEY_UNSPEC;
- saved_comment = xstrdup(filename);
- }
- key_free(public);
-
if (!interactive && getenv("DISPLAY")) {
if (getenv(SSH_ASKPASS_ENV))
askpass = getenv(SSH_ASKPASS_ENV);
}
/* At first, try empty passphrase */
- private = key_new(type);
- success = load_private_key(filename, "", private, &comment);
- if (!success) {
+ private = key_load_private(filename, "", &comment);
+ if (comment == NULL)
+ comment = xstrdup(filename);
+ if (private == NULL) {
printf("Need passphrase for %.200s\n", filename);
if (!interactive && askpass == NULL) {
- xfree(saved_comment);
+ xfree(comment);
return;
}
- snprintf(msg, sizeof msg, "Enter passphrase for %.200s", saved_comment);
+ snprintf(msg, sizeof msg, "Enter passphrase for %.200s", comment);
for (;;) {
- char *pass;
if (interactive) {
snprintf(buf, sizeof buf, "%s: ", msg);
pass = read_passphrase(buf, 1);
}
if (strcmp(pass, "") == 0) {
xfree(pass);
- xfree(saved_comment);
+ xfree(comment);
return;
}
- success = load_private_key(filename, pass, private, &comment);
+ private = key_load_private(filename, pass, &comment);
memset(pass, 0, strlen(pass));
xfree(pass);
- if (success)
+ if (private != NULL)
break;
strlcpy(msg, "Bad passphrase, try again", sizeof msg);
}
}
- xfree(comment);
- if (ssh_add_identity(ac, private, saved_comment))
- fprintf(stderr, "Identity added: %s (%s)\n", filename, saved_comment);
+ if (ssh_add_identity(ac, private, comment))
+ fprintf(stderr, "Identity added: %s (%s)\n", filename, comment);
else
fprintf(stderr, "Could not add identity: %s\n", filename);
+ xfree(comment);
key_free(private);
- xfree(saved_comment);
}
void
*/
#include "includes.h"
-RCSID("$OpenBSD: ssh-keygen.c,v 1.51 2001/03/21 14:20:45 jakob Exp $");
+RCSID("$OpenBSD: ssh-keygen.c,v 1.52 2001/03/26 08:07:09 markus Exp $");
#include <openssl/evp.h>
#include <openssl/pem.h>
have_identity = 1;
}
-int
-try_load_key(char *filename, Key *k)
+Key *
+try_load_pem_key(char *filename)
{
- int success = 1;
- if (!load_private_key(filename, "", k, NULL)) {
- char *pass = read_passphrase("Enter passphrase: ", 1);
- if (!load_private_key(filename, pass, k, NULL)) {
- success = 0;
- }
+ char *pass;
+ Key *prv;
+
+ prv = key_load_private(filename, "", NULL);
+ if (prv == NULL) {
+ pass = read_passphrase("Enter passphrase: ", 1);
+ prv = key_load_private(filename, pass, NULL);
memset(pass, 0, strlen(pass));
xfree(pass);
}
- return success;
+ return prv;
}
#define SSH_COM_PUBLIC_BEGIN "---- BEGIN SSH2 PUBLIC KEY ----"
void
do_convert_to_ssh2(struct passwd *pw)
{
- Key *k;
+ Key *prv;
int len;
u_char *blob;
struct stat st;
perror(identity_file);
exit(1);
}
- k = key_new(KEY_UNSPEC);
- if (!try_load_key(identity_file, k)) {
+ prv = try_load_pem_key(identity_file);
+ if (prv == NULL) {
fprintf(stderr, "load failed\n");
exit(1);
}
- key_to_blob(k, &blob, &len);
+ key_to_blob(prv, &blob, &len);
fprintf(stdout, "%s\n", SSH_COM_PUBLIC_BEGIN);
fprintf(stdout,
"Comment: \"%d-bit %s, converted from OpenSSH by %s@%s\"\n",
- key_size(k), key_type(k),
+ key_size(prv), key_type(prv),
pw->pw_name, hostname);
dump_base64(stdout, blob, len);
fprintf(stdout, "%s\n", SSH_COM_PUBLIC_END);
- key_free(k);
+ key_free(prv);
xfree(blob);
exit(0);
}
void
do_print_public(struct passwd *pw)
{
- Key *k;
+ Key *prv;
struct stat st;
if (!have_identity)
perror(identity_file);
exit(1);
}
- k = key_new(KEY_UNSPEC);
- if (!try_load_key(identity_file, k)) {
+ prv = try_load_pem_key(identity_file);
+ if (prv == NULL) {
fprintf(stderr, "load failed\n");
exit(1);
}
- if (!key_write(k, stdout))
+ if (!key_write(prv, stdout))
fprintf(stderr, "key_write failed");
- key_free(k);
+ key_free(prv);
fprintf(stdout, "\n");
exit(0);
}
FILE *f;
Key *public;
char *comment = NULL, *cp, *ep, line[16*1024], *fp;
- int i, skip = 0, num = 1, invalid = 1, success = 0, rep, type;
+ int i, skip = 0, num = 1, invalid = 1, rep, fptype;
struct stat st;
- type = print_bubblebabble ? SSH_FP_SHA1 : SSH_FP_MD5;
- rep = print_bubblebabble ? SSH_FP_BUBBLEBABBLE : SSH_FP_HEX;
+ fptype = print_bubblebabble ? SSH_FP_SHA1 : SSH_FP_MD5;
+ rep = print_bubblebabble ? SSH_FP_BUBBLEBABBLE : SSH_FP_HEX;
if (!have_identity)
ask_filename(pw, "Enter file in which the key is");
perror(identity_file);
exit(1);
}
- public = key_new(KEY_RSA1);
- if (load_public_key(identity_file, public, &comment)) {
- success = 1;
- } else {
- key_free(public);
- public = key_new(KEY_UNSPEC);
- if (try_load_public_key(identity_file, public, &comment))
- success = 1;
- else
- debug("try_load_public_key KEY_UNSPEC failed");
- }
- if (success) {
- fp = key_fingerprint(public, type, rep);
- printf("%d %s %s\n", key_size(public),
- fp, comment);
+ public = key_load_public(identity_file, &comment);
+ if (public != NULL) {
+ fp = key_fingerprint(public, fptype, rep);
+ printf("%d %s %s\n", key_size(public), fp, comment);
key_free(public);
xfree(comment);
xfree(fp);
exit(0);
}
+ if (comment)
+ xfree(comment);
f = fopen(identity_file, "r");
if (f != NULL) {
}
}
comment = *cp ? cp : comment;
- fp = key_fingerprint(public, type, rep);
+ fp = key_fingerprint(public, fptype, rep);
printf("%d %s %s\n", key_size(public), fp,
comment ? comment : "no comment");
xfree(fp);
+ key_free(public);
invalid = 0;
}
fclose(f);
}
- key_free(public);
if (invalid) {
printf("%s is not a valid key file.\n", identity_file);
exit(1);
char *old_passphrase, *passphrase1, *passphrase2;
struct stat st;
Key *private;
- Key *public;
- int type = KEY_RSA1;
if (!have_identity)
ask_filename(pw, "Enter file in which the key is");
perror(identity_file);
exit(1);
}
- public = key_new(type);
- if (!load_public_key(identity_file, public, NULL)) {
- type = KEY_UNSPEC;
- } else {
- /* Clear the public key since we are just about to load the whole file. */
- key_free(public);
- }
/* Try to load the file with empty passphrase. */
- private = key_new(type);
- if (!load_private_key(identity_file, "", private, &comment)) {
+ private = key_load_private(identity_file, "", &comment);
+ if (private == NULL) {
if (identity_passphrase)
old_passphrase = xstrdup(identity_passphrase);
else
old_passphrase = read_passphrase("Enter old passphrase: ", 1);
- if (!load_private_key(identity_file, old_passphrase, private, &comment)) {
- memset(old_passphrase, 0, strlen(old_passphrase));
- xfree(old_passphrase);
+ private = key_load_private(identity_file, old_passphrase , &comment);
+ memset(old_passphrase, 0, strlen(old_passphrase));
+ xfree(old_passphrase);
+ if (private == NULL) {
printf("Bad passphrase.\n");
exit(1);
}
- memset(old_passphrase, 0, strlen(old_passphrase));
- xfree(old_passphrase);
}
printf("Key has comment '%s'\n", comment);
}
/* Save the file using the new passphrase. */
- if (!save_private_key(identity_file, passphrase1, private, comment)) {
+ if (!key_save_private(private, identity_file, passphrase1, comment)) {
printf("Saving the key failed: %s: %s.\n",
identity_file, strerror(errno));
memset(passphrase1, 0, strlen(passphrase1));
do_change_comment(struct passwd *pw)
{
char new_comment[1024], *comment, *passphrase;
- Key *private, *public;
+ Key *private;
+ Key *public;
struct stat st;
FILE *f;
int fd;
perror(identity_file);
exit(1);
}
- /*
- * Try to load the public key from the file the verify that it is
- * readable and of the proper format.
- */
- public = key_new(KEY_RSA1);
- if (!load_public_key(identity_file, public, NULL)) {
- printf("%s is not a valid key file.\n", identity_file);
- printf("Comments are only supported in RSA1 keys\n");
- exit(1);
- }
-
- private = key_new(KEY_RSA1);
- if (load_private_key(identity_file, "", private, &comment))
- passphrase = xstrdup("");
- else {
+ private = key_load_private(identity_file, "", &comment);
+ if (private == NULL) {
if (identity_passphrase)
passphrase = xstrdup(identity_passphrase);
else if (identity_new_passphrase)
else
passphrase = read_passphrase("Enter passphrase: ", 1);
/* Try to load using the passphrase. */
- if (!load_private_key(identity_file, passphrase, private, &comment)) {
+ private = key_load_private(identity_file, passphrase, &comment);
+ if (private == NULL) {
memset(passphrase, 0, strlen(passphrase));
xfree(passphrase);
printf("Bad passphrase.\n");
exit(1);
}
+ } else {
+ passphrase = xstrdup("");
}
+ if (private->type != KEY_RSA1) {
+ fprintf(stderr, "Comments are only supported for RSA1 keys.\n");
+ key_free(private);
+ exit(1);
+ }
printf("Key now has comment '%s'\n", comment);
if (identity_comment) {
}
/* Save the file using the new passphrase. */
- if (!save_private_key(identity_file, passphrase, private, new_comment)) {
+ if (!key_save_private(private, identity_file, passphrase, new_comment)) {
printf("Saving the key failed: %s: %s.\n",
identity_file, strerror(errno));
memset(passphrase, 0, strlen(passphrase));
}
memset(passphrase, 0, strlen(passphrase));
xfree(passphrase);
+ public = key_from_private(private);
key_free(private);
strlcat(identity_file, ".pub", sizeof(identity_file));
}
/* Save the key with the given passphrase and comment. */
- if (!save_private_key(identity_file, passphrase1, private, comment)) {
+ if (!key_save_private(private, identity_file, passphrase1, comment)) {
printf("Saving the key failed: %s: %s.\n",
identity_file, strerror(errno));
memset(passphrase1, 0, strlen(passphrase1));
*/
#include "includes.h"
-RCSID("$OpenBSD: ssh.c,v 1.104 2001/03/08 21:42:32 markus Exp $");
+RCSID("$OpenBSD: ssh.c,v 1.105 2001/03/26 08:07:09 markus Exp $");
#include <openssl/evp.h>
#include <openssl/err.h>
*/
volatile int received_window_change_signal = 0;
-/* Flag indicating whether we have a valid host private key loaded. */
-int host_private_key_loaded = 0;
-
/* Host private key. */
-RSA *host_private_key = NULL;
+Key *host_private_key = NULL;
/* Original real UID. */
uid_t original_real_uid;
* privileges, because the file is only readable by root.
*/
if (ok && (options.protocol & SSH_PROTO_1)) {
- Key k;
- host_private_key = RSA_new();
- k.type = KEY_RSA1;
- k.rsa = host_private_key;
- if (load_private_key(_PATH_HOST_KEY_FILE, "", &k, NULL))
- host_private_key_loaded = 1;
+ host_private_key = key_load_private_type(KEY_RSA1,
+ _PATH_HOST_KEY_FILE, "", NULL);
}
/*
* Get rid of any extra privileges that we may have. We will no
tilde_expand_filename(options.user_hostfile2, original_real_uid);
/* Log into the remote system. This never returns if the login fails. */
- ssh_login(host_private_key_loaded, host_private_key,
- host, (struct sockaddr *)&hostaddr, original_real_uid);
+ ssh_login(host_private_key, host, (struct sockaddr *)&hostaddr,
+ original_real_uid);
/* We no longer need the host private key. Clear it now. */
- if (host_private_key_loaded)
- RSA_free(host_private_key); /* Destroys contents safely */
+ if (host_private_key != NULL)
+ key_free(host_private_key); /* Destroys contents safely */
exit_status = compat20 ? ssh_session2() : ssh_session();
packet_close();
return client_loop(tty_flag, tty_flag ? options.escape_char : -1, id);
}
-int
-guess_identity_file_type(const char *filename)
-{
- struct stat st;
- Key *public;
- int type = KEY_RSA1; /* default */
-
- if (stat(filename, &st) < 0) {
- /* ignore this key */
- return KEY_UNSPEC;
- }
- public = key_new(type);
- if (!load_public_key(filename, public, NULL)) {
- /* ok, so we will assume this is 'some' key */
- type = KEY_UNSPEC;
- }
- key_free(public);
- return type;
-}
-
void
load_public_identity_files(void)
{
for (i = 0; i < options.num_identity_files; i++) {
filename = tilde_expand_filename(options.identity_files[i],
original_real_uid);
- public = key_new(KEY_RSA1);
- if (!load_public_key(filename, public, NULL)) {
- key_free(public);
- public = key_new(KEY_UNSPEC);
- if (!try_load_public_key(filename, public, NULL)) {
- debug("unknown identity file %s", filename);
- key_free(public);
- public = NULL;
- }
- }
+ public = key_load_public(filename, NULL);
debug("identity file %s type %d", filename,
public ? public->type : -1);
xfree(options.identity_files[i]);
*/
#include "includes.h"
-RCSID("$OpenBSD: sshconnect.c,v 1.100 2001/03/12 22:02:02 markus Exp $");
+RCSID("$OpenBSD: sshconnect.c,v 1.101 2001/03/26 08:07:09 markus Exp $");
#include <openssl/bn.h>
* This function does not require super-user privileges.
*/
void
-ssh_login(int host_key_valid, RSA *own_host_key, const char *orighost,
+ssh_login(Key *own_host_key, const char *orighost,
struct sockaddr *hostaddr, uid_t original_real_uid)
{
struct passwd *pw;
ssh_userauth2(server_user, host);
} else {
ssh_kex(host, hostaddr);
- ssh_userauth(local_user, server_user, host, host_key_valid, own_host_key);
+ ssh_userauth(local_user, server_user, host, own_host_key);
}
}
-/* $OpenBSD: sshconnect.h,v 1.6 2001/02/15 23:19:59 markus Exp $ */
+/* $OpenBSD: sshconnect.h,v 1.7 2001/03/26 08:07:09 markus Exp $ */
/*
* Copyright (c) 2000 Markus Friedl. All rights reserved.
*/
void
-ssh_login(int host_key_valid, RSA * host_key, const char *host,
+ssh_login(Key *host_key, const char *host,
struct sockaddr * hostaddr, uid_t original_real_uid);
void ssh_kex(char *host, struct sockaddr *hostaddr);
void
ssh_userauth(const char * local_user, const char * server_user, char *host,
- int host_key_valid, RSA *own_host_key);
+ Key *own_host_key);
void ssh_kex2(char *host, struct sockaddr *hostaddr);
void ssh_userauth2(const char *server_user, char *host);
*/
#include "includes.h"
-RCSID("$OpenBSD: sshconnect1.c,v 1.28 2001/03/08 21:42:33 markus Exp $");
+RCSID("$OpenBSD: sshconnect1.c,v 1.29 2001/03/26 08:07:09 markus Exp $");
#include <openssl/bn.h>
#include <openssl/evp.h>
int plen, clen;
/* Try to load identification for the authentication key. */
- public = key_new(KEY_RSA1);
- if (!load_public_key(authfile, public, &comment)) {
- key_free(public);
+ /* XXKEYLOAD */
+ public = key_load_public_type(KEY_RSA1, authfile, &comment);
+ if (public == NULL) {
/* Could not load it. Fail. */
return 0;
}
debug("Received RSA challenge from server.");
- private = key_new(KEY_RSA1);
/*
* Load the private key. Try first with empty passphrase; if it
* fails, ask for a passphrase.
*/
- if (!load_private_key(authfile, "", private, NULL)) {
+ private = key_load_private_type(KEY_RSA1, authfile, "", NULL);
+ if (private == NULL) {
char buf[300];
snprintf(buf, sizeof buf, "Enter passphrase for RSA key '%.100s': ",
comment);
}
/* Load the authentication file using the pasphrase. */
- if (!load_private_key(authfile, passphrase, private, NULL)) {
+ private = key_load_private_type(KEY_RSA1, authfile, passphrase, NULL);
+ if (private == NULL) {
memset(passphrase, 0, strlen(passphrase));
xfree(passphrase);
error("Bad passphrase.");
/* Expect the server to reject it... */
packet_read_expect(&plen, SSH_SMSG_FAILURE);
xfree(comment);
- key_free(private);
BN_clear_free(challenge);
return 0;
}
* authentication and RSA host authentication.
*/
int
-try_rhosts_rsa_authentication(const char *local_user, RSA * host_key)
+try_rhosts_rsa_authentication(const char *local_user, Key * host_key)
{
int type;
BIGNUM *challenge;
/* Tell the server that we are willing to authenticate using this key. */
packet_start(SSH_CMSG_AUTH_RHOSTS_RSA);
packet_put_string(local_user, strlen(local_user));
- packet_put_int(BN_num_bits(host_key->n));
- packet_put_bignum(host_key->e);
- packet_put_bignum(host_key->n);
+ packet_put_int(BN_num_bits(host_key->rsa->n));
+ packet_put_bignum(host_key->rsa->e);
+ packet_put_bignum(host_key->rsa->n);
packet_send();
packet_write_wait();
debug("Received RSA challenge for host key from server.");
/* Compute a response to the challenge. */
- respond_to_rsa_challenge(challenge, host_key);
+ respond_to_rsa_challenge(challenge, host_key->rsa);
/* We no longer need the challenge. */
BN_clear_free(challenge);
const char *local_user,
const char *server_user,
char *host,
- int host_key_valid, RSA *own_host_key)
+ Key *own_host_key)
{
int i, type;
int payload_len;
* authentication.
*/
if ((supported_authentications & (1 << SSH_AUTH_RHOSTS_RSA)) &&
- options.rhosts_rsa_authentication && host_key_valid) {
+ options.rhosts_rsa_authentication && own_host_key != NULL) {
if (try_rhosts_rsa_authentication(local_user, own_host_key))
return;
}
*/
#include "includes.h"
-RCSID("$OpenBSD: sshconnect2.c,v 1.55 2001/03/23 11:04:07 djm Exp $");
+RCSID("$OpenBSD: sshconnect2.c,v 1.56 2001/03/26 08:07:09 markus Exp $");
#include <openssl/bn.h>
#include <openssl/md5.h>
{
Key *private;
char prompt[300], *passphrase;
- int success = 0, quit, i;
+ int quit, i;
struct stat st;
if (stat(filename, &st) < 0) {
debug3("no such identity: %s", filename);
return NULL;
}
- private = key_new(KEY_UNSPEC);
- if (!load_private_key(filename, "", private, NULL)) {
- if (options.batch_mode) {
- key_free(private);
+ private = key_load_private_type(KEY_UNSPEC, filename, "", NULL);
+ if (private == NULL) {
+ if (options.batch_mode)
return NULL;
- }
snprintf(prompt, sizeof prompt,
"Enter passphrase for key '%.100s': ", filename);
for (i = 0; i < options.number_of_password_prompts; i++) {
passphrase = read_passphrase(prompt, 0);
if (strcmp(passphrase, "") != 0) {
- success = load_private_key(filename,
- passphrase, private, NULL);
+ private = key_load_private_type(KEY_UNSPEC, filename,
+ passphrase, NULL);
quit = 0;
} else {
debug2("no passphrase given, try next key");
}
memset(passphrase, 0, strlen(passphrase));
xfree(passphrase);
- if (success || quit)
+ if (private != NULL || quit)
break;
debug2("bad passphrase given, try again...");
}
- if (!success) {
- key_free(private);
- return NULL;
- }
}
return private;
}
*/
#include "includes.h"
-RCSID("$OpenBSD: sshd.c,v 1.178 2001/03/23 14:28:32 markus Exp $");
+RCSID("$OpenBSD: sshd.c,v 1.179 2001/03/26 08:07:09 markus Exp $");
#include <openssl/dh.h>
#include <openssl/bn.h>
sensitive_data.ssh1_host_key = NULL;
memset(sensitive_data.ssh1_cookie, 0, SSH_SESSION_KEY_LENGTH);
}
-Key *
-load_private_key_autodetect(const char *filename)
-{
- struct stat st;
- int type;
- Key *public, *private;
-
- if (stat(filename, &st) < 0) {
- perror(filename);
- return NULL;
- }
- /*
- * try to load the public key. right now this only works for RSA1,
- * since SSH2 keys are fully encrypted
- */
- type = KEY_RSA1;
- public = key_new(type);
- if (!load_public_key(filename, public, NULL)) {
- /* ok, so we will assume this is 'some' key */
- type = KEY_UNSPEC;
- }
- key_free(public);
-
- /* Ok, try key with empty passphrase */
- private = key_new(type);
- if (load_private_key(filename, "", private, NULL)) {
- debug("load_private_key_autodetect: type %d %s",
- private->type, key_type(private));
- return private;
- }
- key_free(private);
- return NULL;
-}
char *
list_hostkey_types(void)
int listen_sock, maxfd;
int startup_p[2];
int startups = 0;
+ Key *key;
int ret, key_used = 0;
__progname = get_progname(av[0]);
sensitive_data.have_ssh2_key = 0;
for(i = 0; i < options.num_host_key_files; i++) {
- Key *key = load_private_key_autodetect(options.host_key_files[i]);
+ key = key_load_private(options.host_key_files[i], "", NULL);
+ sensitive_data.host_keys[i] = key;
if (key == NULL) {
error("Could not load host key: %.200s: %.100s",
options.host_key_files[i], strerror(errno));
+ sensitive_data.host_keys[i] = NULL;
continue;
}
switch(key->type){
sensitive_data.have_ssh2_key = 1;
break;
}
- sensitive_data.host_keys[i] = key;
+ debug("private host key: #%d type %d %s", i, key->type,
+ key_type(key));
}
if ((options.protocol & SSH_PROTO_1) && !sensitive_data.have_ssh1_key) {
log("Disabling protocol version 1. Could not load host key");
andersk / openssh.git / commitdiff
