version 1.1.1.17, 2016/12/25 00:00:14 |
version 1.1.1.18, 2017/04/18 18:39:18 |
|
|
/* $OpenBSD: ssh-keygen.c,v 1.292 2016/09/12 03:29:16 dtucker Exp $ */ |
/* $OpenBSD: ssh-keygen.c,v 1.299 2017/03/10 04:26:06 djm Exp $ */ |
/* |
/* |
* Author: Tatu Ylonen <ylo@cs.hut.fi> |
* Author: Tatu Ylonen <ylo@cs.hut.fi> |
* Copyright (c) 1994 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland |
* Copyright (c) 1994 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland |
|
|
#include <string.h> |
#include <string.h> |
#include <unistd.h> |
#include <unistd.h> |
#include <limits.h> |
#include <limits.h> |
|
#include <locale.h> |
|
|
#include "xmalloc.h" |
#include "xmalloc.h" |
#include "sshkey.h" |
#include "sshkey.h" |
|
|
#include "atomicio.h" |
#include "atomicio.h" |
#include "krl.h" |
#include "krl.h" |
#include "digest.h" |
#include "digest.h" |
|
#include "utf8.h" |
|
|
#ifdef ENABLE_PKCS11 |
#ifdef ENABLE_PKCS11 |
#include "ssh-pkcs11.h" |
#include "ssh-pkcs11.h" |
Line 829 fingerprint_one_key(const struct sshkey |
|
Line 831 fingerprint_one_key(const struct sshkey |
|
ra = sshkey_fingerprint(public, fingerprint_hash, SSH_FP_RANDOMART); |
ra = sshkey_fingerprint(public, fingerprint_hash, SSH_FP_RANDOMART); |
if (fp == NULL || ra == NULL) |
if (fp == NULL || ra == NULL) |
fatal("%s: sshkey_fingerprint failed", __func__); |
fatal("%s: sshkey_fingerprint failed", __func__); |
printf("%u %s %s (%s)\n", sshkey_size(public), fp, |
mprintf("%u %s %s (%s)\n", sshkey_size(public), fp, |
comment ? comment : "no comment", sshkey_type(public)); |
comment ? comment : "no comment", sshkey_type(public)); |
if (log_level >= SYSLOG_LEVEL_VERBOSE) |
if (log_level >= SYSLOG_LEVEL_VERBOSE) |
printf("%s\n", ra); |
printf("%s\n", ra); |
Line 1066 known_hosts_hash(struct hostkey_foreach_ |
|
Line 1068 known_hosts_hash(struct hostkey_foreach_ |
|
struct known_hosts_ctx *ctx = (struct known_hosts_ctx *)_ctx; |
struct known_hosts_ctx *ctx = (struct known_hosts_ctx *)_ctx; |
char *hashed, *cp, *hosts, *ohosts; |
char *hashed, *cp, *hosts, *ohosts; |
int has_wild = l->hosts && strcspn(l->hosts, "*?!") != strlen(l->hosts); |
int has_wild = l->hosts && strcspn(l->hosts, "*?!") != strlen(l->hosts); |
|
int was_hashed = l->hosts && l->hosts[0] == HASH_DELIM; |
|
|
switch (l->status) { |
switch (l->status) { |
case HKF_STATUS_OK: |
case HKF_STATUS_OK: |
Line 1074 known_hosts_hash(struct hostkey_foreach_ |
|
Line 1077 known_hosts_hash(struct hostkey_foreach_ |
|
* Don't hash hosts already already hashed, with wildcard |
* Don't hash hosts already already hashed, with wildcard |
* characters or a CA/revocation marker. |
* characters or a CA/revocation marker. |
*/ |
*/ |
if ((l->match & HKF_MATCH_HOST_HASHED) != 0 || |
if (was_hashed || has_wild || l->marker != MRK_NONE) { |
has_wild || l->marker != MRK_NONE) { |
|
fprintf(ctx->out, "%s\n", l->line); |
fprintf(ctx->out, "%s\n", l->line); |
if (has_wild && !find_host) { |
if (has_wild && !find_host) { |
logit("%s:%ld: ignoring host name " |
logit("%s:%lu: ignoring host name " |
"with wildcard: %.64s", l->path, |
"with wildcard: %.64s", l->path, |
l->linenum, l->hosts); |
l->linenum, l->hosts); |
} |
} |
Line 1090 known_hosts_hash(struct hostkey_foreach_ |
|
Line 1092 known_hosts_hash(struct hostkey_foreach_ |
|
*/ |
*/ |
ohosts = hosts = xstrdup(l->hosts); |
ohosts = hosts = xstrdup(l->hosts); |
while ((cp = strsep(&hosts, ",")) != NULL && *cp != '\0') { |
while ((cp = strsep(&hosts, ",")) != NULL && *cp != '\0') { |
|
lowercase(cp); |
if ((hashed = host_hash(cp, NULL, 0)) == NULL) |
if ((hashed = host_hash(cp, NULL, 0)) == NULL) |
fatal("hash_host failed"); |
fatal("hash_host failed"); |
fprintf(ctx->out, "%s %s\n", hashed, l->rawkey); |
fprintf(ctx->out, "%s %s\n", hashed, l->rawkey); |
Line 1100 known_hosts_hash(struct hostkey_foreach_ |
|
Line 1103 known_hosts_hash(struct hostkey_foreach_ |
|
case HKF_STATUS_INVALID: |
case HKF_STATUS_INVALID: |
/* Retain invalid lines, but mark file as invalid. */ |
/* Retain invalid lines, but mark file as invalid. */ |
ctx->invalid = 1; |
ctx->invalid = 1; |
logit("%s:%ld: invalid line", l->path, l->linenum); |
logit("%s:%lu: invalid line", l->path, l->linenum); |
/* FALLTHROUGH */ |
/* FALLTHROUGH */ |
default: |
default: |
fprintf(ctx->out, "%s\n", l->line); |
fprintf(ctx->out, "%s\n", l->line); |
Line 1134 known_hosts_find_delete(struct hostkey_f |
|
Line 1137 known_hosts_find_delete(struct hostkey_f |
|
*/ |
*/ |
ctx->found_key = 1; |
ctx->found_key = 1; |
if (!quiet) |
if (!quiet) |
printf("# Host %s found: line %ld\n", |
printf("# Host %s found: line %lu\n", |
ctx->host, l->linenum); |
ctx->host, l->linenum); |
} |
} |
return 0; |
return 0; |
} else if (find_host) { |
} else if (find_host) { |
ctx->found_key = 1; |
ctx->found_key = 1; |
if (!quiet) { |
if (!quiet) { |
printf("# Host %s found: line %ld %s\n", |
printf("# Host %s found: line %lu %s\n", |
ctx->host, |
ctx->host, |
l->linenum, l->marker == MRK_CA ? "CA" : |
l->linenum, l->marker == MRK_CA ? "CA" : |
(l->marker == MRK_REVOKE ? "REVOKED" : "")); |
(l->marker == MRK_REVOKE ? "REVOKED" : "")); |
Line 1150 known_hosts_find_delete(struct hostkey_f |
|
Line 1153 known_hosts_find_delete(struct hostkey_f |
|
known_hosts_hash(l, ctx); |
known_hosts_hash(l, ctx); |
else if (print_fingerprint) { |
else if (print_fingerprint) { |
fp = sshkey_fingerprint(l->key, fptype, rep); |
fp = sshkey_fingerprint(l->key, fptype, rep); |
printf("%s %s %s %s\n", ctx->host, |
mprintf("%s %s %s %s\n", ctx->host, |
sshkey_type(l->key), fp, l->comment); |
sshkey_type(l->key), fp, l->comment); |
free(fp); |
free(fp); |
} else |
} else |
Line 1161 known_hosts_find_delete(struct hostkey_f |
|
Line 1164 known_hosts_find_delete(struct hostkey_f |
|
/* Retain non-matching hosts when deleting */ |
/* Retain non-matching hosts when deleting */ |
if (l->status == HKF_STATUS_INVALID) { |
if (l->status == HKF_STATUS_INVALID) { |
ctx->invalid = 1; |
ctx->invalid = 1; |
logit("%s:%ld: invalid line", l->path, l->linenum); |
logit("%s:%lu: invalid line", l->path, l->linenum); |
} |
} |
fprintf(ctx->out, "%s\n", l->line); |
fprintf(ctx->out, "%s\n", l->line); |
} |
} |
Line 1301 do_change_passphrase(struct passwd *pw) |
|
Line 1304 do_change_passphrase(struct passwd *pw) |
|
fatal("Failed to load key %s: %s", identity_file, ssh_err(r)); |
fatal("Failed to load key %s: %s", identity_file, ssh_err(r)); |
} |
} |
if (comment) |
if (comment) |
printf("Key has comment '%s'\n", comment); |
mprintf("Key has comment '%s'\n", comment); |
|
|
/* Ask the new passphrase (twice). */ |
/* Ask the new passphrase (twice). */ |
if (identity_new_passphrase) { |
if (identity_new_passphrase) { |
Line 1425 do_change_comment(struct passwd *pw) |
|
Line 1428 do_change_comment(struct passwd *pw) |
|
sshkey_free(private); |
sshkey_free(private); |
exit(1); |
exit(1); |
} |
} |
printf("Key now has comment '%s'\n", comment); |
if (comment) |
|
printf("Key now has comment '%s'\n", comment); |
|
else |
|
printf("Key now has no comment\n"); |
|
|
if (identity_comment) { |
if (identity_comment) { |
strlcpy(new_comment, identity_comment, sizeof(new_comment)); |
strlcpy(new_comment, identity_comment, sizeof(new_comment)); |
Line 2189 do_check_krl(struct passwd *pw, int argc |
|
Line 2195 do_check_krl(struct passwd *pw, int argc |
|
} |
} |
#endif |
#endif |
|
|
|
#ifdef WITH_SSH1 |
|
# define RSA1_USAGE " | rsa1" |
|
#else |
|
# define RSA1_USAGE "" |
|
#endif |
|
|
static void |
static void |
usage(void) |
usage(void) |
{ |
{ |
fprintf(stderr, |
fprintf(stderr, |
"usage: ssh-keygen [-q] [-b bits] [-t dsa | ecdsa | ed25519 | rsa | rsa1]\n" |
"usage: ssh-keygen [-q] [-b bits] [-t dsa | ecdsa | ed25519 | rsa%s]\n" |
" [-N new_passphrase] [-C comment] [-f output_keyfile]\n" |
" [-N new_passphrase] [-C comment] [-f output_keyfile]\n" |
" ssh-keygen -p [-P old_passphrase] [-N new_passphrase] [-f keyfile]\n" |
" ssh-keygen -p [-P old_passphrase] [-N new_passphrase] [-f keyfile]\n" |
" ssh-keygen -i [-m key_format] [-f input_keyfile]\n" |
" ssh-keygen -i [-m key_format] [-f input_keyfile]\n" |
|
|
" ssh-keygen -y [-f input_keyfile]\n" |
" ssh-keygen -y [-f input_keyfile]\n" |
" ssh-keygen -c [-P passphrase] [-C comment] [-f keyfile]\n" |
" ssh-keygen -c [-P passphrase] [-C comment] [-f keyfile]\n" |
" ssh-keygen -l [-v] [-E fingerprint_hash] [-f input_keyfile]\n" |
" ssh-keygen -l [-v] [-E fingerprint_hash] [-f input_keyfile]\n" |
" ssh-keygen -B [-f input_keyfile]\n"); |
" ssh-keygen -B [-f input_keyfile]\n", RSA1_USAGE); |
#ifdef ENABLE_PKCS11 |
#ifdef ENABLE_PKCS11 |
fprintf(stderr, |
fprintf(stderr, |
" ssh-keygen -D pkcs11\n"); |
" ssh-keygen -D pkcs11\n"); |
Line 2260 main(int argc, char **argv) |
|
Line 2272 main(int argc, char **argv) |
|
OpenSSL_add_all_algorithms(); |
OpenSSL_add_all_algorithms(); |
log_init(argv[0], SYSLOG_LEVEL_INFO, SYSLOG_FACILITY_USER, 1); |
log_init(argv[0], SYSLOG_LEVEL_INFO, SYSLOG_FACILITY_USER, 1); |
|
|
|
setlocale(LC_CTYPE, ""); |
|
|
/* we need this for the home * directory. */ |
/* we need this for the home * directory. */ |
pw = getpwuid(getuid()); |
pw = getpwuid(getuid()); |
if (!pw) |
if (!pw) |