1*0Sstevel@tonic-gate /* 2*0Sstevel@tonic-gate * read_bignum(): 3*0Sstevel@tonic-gate * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 4*0Sstevel@tonic-gate * 5*0Sstevel@tonic-gate * As far as I am concerned, the code I have written for this software 6*0Sstevel@tonic-gate * can be used freely for any purpose. Any derived versions of this 7*0Sstevel@tonic-gate * software must be clearly marked as such, and if the derived work is 8*0Sstevel@tonic-gate * incompatible with the protocol description in the RFC file, it must be 9*0Sstevel@tonic-gate * called by a name other than "ssh" or "Secure Shell". 10*0Sstevel@tonic-gate * 11*0Sstevel@tonic-gate * 12*0Sstevel@tonic-gate * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved. 13*0Sstevel@tonic-gate * 14*0Sstevel@tonic-gate * Redistribution and use in source and binary forms, with or without 15*0Sstevel@tonic-gate * modification, are permitted provided that the following conditions 16*0Sstevel@tonic-gate * are met: 17*0Sstevel@tonic-gate * 1. Redistributions of source code must retain the above copyright 18*0Sstevel@tonic-gate * notice, this list of conditions and the following disclaimer. 19*0Sstevel@tonic-gate * 2. Redistributions in binary form must reproduce the above copyright 20*0Sstevel@tonic-gate * notice, this list of conditions and the following disclaimer in the 21*0Sstevel@tonic-gate * documentation and/or other materials provided with the distribution. 22*0Sstevel@tonic-gate * 23*0Sstevel@tonic-gate * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 24*0Sstevel@tonic-gate * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 25*0Sstevel@tonic-gate * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 26*0Sstevel@tonic-gate * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 27*0Sstevel@tonic-gate * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 28*0Sstevel@tonic-gate * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 29*0Sstevel@tonic-gate * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 30*0Sstevel@tonic-gate * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 31*0Sstevel@tonic-gate * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 32*0Sstevel@tonic-gate * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 33*0Sstevel@tonic-gate */ 34*0Sstevel@tonic-gate #include "includes.h" 35*0Sstevel@tonic-gate RCSID("$OpenBSD: key.c,v 1.49 2002/09/09 14:54:14 markus Exp $"); 36*0Sstevel@tonic-gate 37*0Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI" 38*0Sstevel@tonic-gate 39*0Sstevel@tonic-gate #include <openssl/evp.h> 40*0Sstevel@tonic-gate 41*0Sstevel@tonic-gate #include "xmalloc.h" 42*0Sstevel@tonic-gate #include "key.h" 43*0Sstevel@tonic-gate #include "rsa.h" 44*0Sstevel@tonic-gate #include "ssh-dss.h" 45*0Sstevel@tonic-gate #include "ssh-rsa.h" 46*0Sstevel@tonic-gate #include "uuencode.h" 47*0Sstevel@tonic-gate #include "buffer.h" 48*0Sstevel@tonic-gate #include "bufaux.h" 49*0Sstevel@tonic-gate #include "log.h" 50*0Sstevel@tonic-gate 51*0Sstevel@tonic-gate Key * 52*0Sstevel@tonic-gate key_new(int type) 53*0Sstevel@tonic-gate { 54*0Sstevel@tonic-gate Key *k; 55*0Sstevel@tonic-gate RSA *rsa; 56*0Sstevel@tonic-gate DSA *dsa; 57*0Sstevel@tonic-gate k = xmalloc(sizeof(*k)); 58*0Sstevel@tonic-gate k->type = type; 59*0Sstevel@tonic-gate k->flags = 0; 60*0Sstevel@tonic-gate k->dsa = NULL; 61*0Sstevel@tonic-gate k->rsa = NULL; 62*0Sstevel@tonic-gate switch (k->type) { 63*0Sstevel@tonic-gate case KEY_RSA1: 64*0Sstevel@tonic-gate case KEY_RSA: 65*0Sstevel@tonic-gate if ((rsa = RSA_new()) == NULL) 66*0Sstevel@tonic-gate fatal("key_new: RSA_new failed"); 67*0Sstevel@tonic-gate if ((rsa->n = BN_new()) == NULL) 68*0Sstevel@tonic-gate fatal("key_new: BN_new failed"); 69*0Sstevel@tonic-gate if ((rsa->e = BN_new()) == NULL) 70*0Sstevel@tonic-gate fatal("key_new: BN_new failed"); 71*0Sstevel@tonic-gate k->rsa = rsa; 72*0Sstevel@tonic-gate break; 73*0Sstevel@tonic-gate case KEY_DSA: 74*0Sstevel@tonic-gate if ((dsa = DSA_new()) == NULL) 75*0Sstevel@tonic-gate fatal("key_new: DSA_new failed"); 76*0Sstevel@tonic-gate if ((dsa->p = BN_new()) == NULL) 77*0Sstevel@tonic-gate fatal("key_new: BN_new failed"); 78*0Sstevel@tonic-gate if ((dsa->q = BN_new()) == NULL) 79*0Sstevel@tonic-gate fatal("key_new: BN_new failed"); 80*0Sstevel@tonic-gate if ((dsa->g = BN_new()) == NULL) 81*0Sstevel@tonic-gate fatal("key_new: BN_new failed"); 82*0Sstevel@tonic-gate if ((dsa->pub_key = BN_new()) == NULL) 83*0Sstevel@tonic-gate fatal("key_new: BN_new failed"); 84*0Sstevel@tonic-gate k->dsa = dsa; 85*0Sstevel@tonic-gate break; 86*0Sstevel@tonic-gate case KEY_UNSPEC: 87*0Sstevel@tonic-gate break; 88*0Sstevel@tonic-gate default: 89*0Sstevel@tonic-gate fatal("key_new: bad key type %d", k->type); 90*0Sstevel@tonic-gate break; 91*0Sstevel@tonic-gate } 92*0Sstevel@tonic-gate return k; 93*0Sstevel@tonic-gate } 94*0Sstevel@tonic-gate 95*0Sstevel@tonic-gate Key * 96*0Sstevel@tonic-gate key_new_private(int type) 97*0Sstevel@tonic-gate { 98*0Sstevel@tonic-gate Key *k = key_new(type); 99*0Sstevel@tonic-gate switch (k->type) { 100*0Sstevel@tonic-gate case KEY_RSA1: 101*0Sstevel@tonic-gate case KEY_RSA: 102*0Sstevel@tonic-gate if ((k->rsa->d = BN_new()) == NULL) 103*0Sstevel@tonic-gate fatal("key_new_private: BN_new failed"); 104*0Sstevel@tonic-gate if ((k->rsa->iqmp = BN_new()) == NULL) 105*0Sstevel@tonic-gate fatal("key_new_private: BN_new failed"); 106*0Sstevel@tonic-gate if ((k->rsa->q = BN_new()) == NULL) 107*0Sstevel@tonic-gate fatal("key_new_private: BN_new failed"); 108*0Sstevel@tonic-gate if ((k->rsa->p = BN_new()) == NULL) 109*0Sstevel@tonic-gate fatal("key_new_private: BN_new failed"); 110*0Sstevel@tonic-gate if ((k->rsa->dmq1 = BN_new()) == NULL) 111*0Sstevel@tonic-gate fatal("key_new_private: BN_new failed"); 112*0Sstevel@tonic-gate if ((k->rsa->dmp1 = BN_new()) == NULL) 113*0Sstevel@tonic-gate fatal("key_new_private: BN_new failed"); 114*0Sstevel@tonic-gate break; 115*0Sstevel@tonic-gate case KEY_DSA: 116*0Sstevel@tonic-gate if ((k->dsa->priv_key = BN_new()) == NULL) 117*0Sstevel@tonic-gate fatal("key_new_private: BN_new failed"); 118*0Sstevel@tonic-gate break; 119*0Sstevel@tonic-gate case KEY_UNSPEC: 120*0Sstevel@tonic-gate break; 121*0Sstevel@tonic-gate default: 122*0Sstevel@tonic-gate break; 123*0Sstevel@tonic-gate } 124*0Sstevel@tonic-gate return k; 125*0Sstevel@tonic-gate } 126*0Sstevel@tonic-gate 127*0Sstevel@tonic-gate void 128*0Sstevel@tonic-gate key_free(Key *k) 129*0Sstevel@tonic-gate { 130*0Sstevel@tonic-gate switch (k->type) { 131*0Sstevel@tonic-gate case KEY_RSA1: 132*0Sstevel@tonic-gate case KEY_RSA: 133*0Sstevel@tonic-gate if (k->rsa != NULL) 134*0Sstevel@tonic-gate RSA_free(k->rsa); 135*0Sstevel@tonic-gate k->rsa = NULL; 136*0Sstevel@tonic-gate break; 137*0Sstevel@tonic-gate case KEY_DSA: 138*0Sstevel@tonic-gate if (k->dsa != NULL) 139*0Sstevel@tonic-gate DSA_free(k->dsa); 140*0Sstevel@tonic-gate k->dsa = NULL; 141*0Sstevel@tonic-gate break; 142*0Sstevel@tonic-gate case KEY_UNSPEC: 143*0Sstevel@tonic-gate break; 144*0Sstevel@tonic-gate default: 145*0Sstevel@tonic-gate fatal("key_free: bad key type %d", k->type); 146*0Sstevel@tonic-gate break; 147*0Sstevel@tonic-gate } 148*0Sstevel@tonic-gate xfree(k); 149*0Sstevel@tonic-gate } 150*0Sstevel@tonic-gate int 151*0Sstevel@tonic-gate key_equal(Key *a, Key *b) 152*0Sstevel@tonic-gate { 153*0Sstevel@tonic-gate if (a == NULL || b == NULL || a->type != b->type) 154*0Sstevel@tonic-gate return 0; 155*0Sstevel@tonic-gate switch (a->type) { 156*0Sstevel@tonic-gate case KEY_RSA1: 157*0Sstevel@tonic-gate case KEY_RSA: 158*0Sstevel@tonic-gate return a->rsa != NULL && b->rsa != NULL && 159*0Sstevel@tonic-gate BN_cmp(a->rsa->e, b->rsa->e) == 0 && 160*0Sstevel@tonic-gate BN_cmp(a->rsa->n, b->rsa->n) == 0; 161*0Sstevel@tonic-gate break; 162*0Sstevel@tonic-gate case KEY_DSA: 163*0Sstevel@tonic-gate return a->dsa != NULL && b->dsa != NULL && 164*0Sstevel@tonic-gate BN_cmp(a->dsa->p, b->dsa->p) == 0 && 165*0Sstevel@tonic-gate BN_cmp(a->dsa->q, b->dsa->q) == 0 && 166*0Sstevel@tonic-gate BN_cmp(a->dsa->g, b->dsa->g) == 0 && 167*0Sstevel@tonic-gate BN_cmp(a->dsa->pub_key, b->dsa->pub_key) == 0; 168*0Sstevel@tonic-gate break; 169*0Sstevel@tonic-gate default: 170*0Sstevel@tonic-gate fatal("key_equal: bad key type %d", a->type); 171*0Sstevel@tonic-gate break; 172*0Sstevel@tonic-gate } 173*0Sstevel@tonic-gate return 0; 174*0Sstevel@tonic-gate } 175*0Sstevel@tonic-gate 176*0Sstevel@tonic-gate static u_char * 177*0Sstevel@tonic-gate key_fingerprint_raw(Key *k, enum fp_type dgst_type, u_int *dgst_raw_length) 178*0Sstevel@tonic-gate { 179*0Sstevel@tonic-gate const EVP_MD *md = NULL; 180*0Sstevel@tonic-gate EVP_MD_CTX ctx; 181*0Sstevel@tonic-gate u_char *blob = NULL; 182*0Sstevel@tonic-gate u_char *retval = NULL; 183*0Sstevel@tonic-gate u_int len = 0; 184*0Sstevel@tonic-gate int nlen, elen; 185*0Sstevel@tonic-gate 186*0Sstevel@tonic-gate *dgst_raw_length = 0; 187*0Sstevel@tonic-gate 188*0Sstevel@tonic-gate switch (dgst_type) { 189*0Sstevel@tonic-gate case SSH_FP_MD5: 190*0Sstevel@tonic-gate md = EVP_md5(); 191*0Sstevel@tonic-gate break; 192*0Sstevel@tonic-gate case SSH_FP_SHA1: 193*0Sstevel@tonic-gate md = EVP_sha1(); 194*0Sstevel@tonic-gate break; 195*0Sstevel@tonic-gate default: 196*0Sstevel@tonic-gate fatal("key_fingerprint_raw: bad digest type %d", 197*0Sstevel@tonic-gate dgst_type); 198*0Sstevel@tonic-gate } 199*0Sstevel@tonic-gate switch (k->type) { 200*0Sstevel@tonic-gate case KEY_RSA1: 201*0Sstevel@tonic-gate nlen = BN_num_bytes(k->rsa->n); 202*0Sstevel@tonic-gate elen = BN_num_bytes(k->rsa->e); 203*0Sstevel@tonic-gate len = nlen + elen; 204*0Sstevel@tonic-gate blob = xmalloc(len); 205*0Sstevel@tonic-gate BN_bn2bin(k->rsa->n, blob); 206*0Sstevel@tonic-gate BN_bn2bin(k->rsa->e, blob + nlen); 207*0Sstevel@tonic-gate break; 208*0Sstevel@tonic-gate case KEY_DSA: 209*0Sstevel@tonic-gate case KEY_RSA: 210*0Sstevel@tonic-gate key_to_blob(k, &blob, &len); 211*0Sstevel@tonic-gate break; 212*0Sstevel@tonic-gate case KEY_UNSPEC: 213*0Sstevel@tonic-gate return retval; 214*0Sstevel@tonic-gate break; 215*0Sstevel@tonic-gate default: 216*0Sstevel@tonic-gate fatal("key_fingerprint_raw: bad key type %d", k->type); 217*0Sstevel@tonic-gate break; 218*0Sstevel@tonic-gate } 219*0Sstevel@tonic-gate if (blob != NULL) { 220*0Sstevel@tonic-gate retval = xmalloc(EVP_MAX_MD_SIZE); 221*0Sstevel@tonic-gate EVP_DigestInit(&ctx, md); 222*0Sstevel@tonic-gate EVP_DigestUpdate(&ctx, blob, len); 223*0Sstevel@tonic-gate EVP_DigestFinal(&ctx, retval, dgst_raw_length); 224*0Sstevel@tonic-gate memset(blob, 0, len); 225*0Sstevel@tonic-gate xfree(blob); 226*0Sstevel@tonic-gate } else { 227*0Sstevel@tonic-gate fatal("key_fingerprint_raw: blob is null"); 228*0Sstevel@tonic-gate } 229*0Sstevel@tonic-gate return retval; 230*0Sstevel@tonic-gate } 231*0Sstevel@tonic-gate 232*0Sstevel@tonic-gate static char * 233*0Sstevel@tonic-gate key_fingerprint_hex(u_char *dgst_raw, u_int dgst_raw_len) 234*0Sstevel@tonic-gate { 235*0Sstevel@tonic-gate char *retval; 236*0Sstevel@tonic-gate int i; 237*0Sstevel@tonic-gate 238*0Sstevel@tonic-gate retval = xmalloc(dgst_raw_len * 3 + 1); 239*0Sstevel@tonic-gate retval[0] = '\0'; 240*0Sstevel@tonic-gate for (i = 0; i < dgst_raw_len; i++) { 241*0Sstevel@tonic-gate char hex[4]; 242*0Sstevel@tonic-gate snprintf(hex, sizeof(hex), "%02x:", dgst_raw[i]); 243*0Sstevel@tonic-gate strlcat(retval, hex, dgst_raw_len * 3); 244*0Sstevel@tonic-gate } 245*0Sstevel@tonic-gate retval[(dgst_raw_len * 3) - 1] = '\0'; 246*0Sstevel@tonic-gate return retval; 247*0Sstevel@tonic-gate } 248*0Sstevel@tonic-gate 249*0Sstevel@tonic-gate static char * 250*0Sstevel@tonic-gate key_fingerprint_bubblebabble(u_char *dgst_raw, u_int dgst_raw_len) 251*0Sstevel@tonic-gate { 252*0Sstevel@tonic-gate char vowels[] = { 'a', 'e', 'i', 'o', 'u', 'y' }; 253*0Sstevel@tonic-gate char consonants[] = { 'b', 'c', 'd', 'f', 'g', 'h', 'k', 'l', 'm', 254*0Sstevel@tonic-gate 'n', 'p', 'r', 's', 't', 'v', 'z', 'x' }; 255*0Sstevel@tonic-gate u_int i, j = 0, rounds, seed = 1; 256*0Sstevel@tonic-gate char *retval; 257*0Sstevel@tonic-gate 258*0Sstevel@tonic-gate rounds = (dgst_raw_len / 2) + 1; 259*0Sstevel@tonic-gate retval = xmalloc(sizeof(char) * (rounds*6)); 260*0Sstevel@tonic-gate retval[j++] = 'x'; 261*0Sstevel@tonic-gate for (i = 0; i < rounds; i++) { 262*0Sstevel@tonic-gate u_int idx0, idx1, idx2, idx3, idx4; 263*0Sstevel@tonic-gate if ((i + 1 < rounds) || (dgst_raw_len % 2 != 0)) { 264*0Sstevel@tonic-gate idx0 = (((((u_int)(dgst_raw[2 * i])) >> 6) & 3) + 265*0Sstevel@tonic-gate seed) % 6; 266*0Sstevel@tonic-gate idx1 = (((u_int)(dgst_raw[2 * i])) >> 2) & 15; 267*0Sstevel@tonic-gate idx2 = ((((u_int)(dgst_raw[2 * i])) & 3) + 268*0Sstevel@tonic-gate (seed / 6)) % 6; 269*0Sstevel@tonic-gate retval[j++] = vowels[idx0]; 270*0Sstevel@tonic-gate retval[j++] = consonants[idx1]; 271*0Sstevel@tonic-gate retval[j++] = vowels[idx2]; 272*0Sstevel@tonic-gate if ((i + 1) < rounds) { 273*0Sstevel@tonic-gate idx3 = (((u_int)(dgst_raw[(2 * i) + 1])) >> 4) & 15; 274*0Sstevel@tonic-gate idx4 = (((u_int)(dgst_raw[(2 * i) + 1]))) & 15; 275*0Sstevel@tonic-gate retval[j++] = consonants[idx3]; 276*0Sstevel@tonic-gate retval[j++] = '-'; 277*0Sstevel@tonic-gate retval[j++] = consonants[idx4]; 278*0Sstevel@tonic-gate seed = ((seed * 5) + 279*0Sstevel@tonic-gate ((((u_int)(dgst_raw[2 * i])) * 7) + 280*0Sstevel@tonic-gate ((u_int)(dgst_raw[(2 * i) + 1])))) % 36; 281*0Sstevel@tonic-gate } 282*0Sstevel@tonic-gate } else { 283*0Sstevel@tonic-gate idx0 = seed % 6; 284*0Sstevel@tonic-gate idx1 = 16; 285*0Sstevel@tonic-gate idx2 = seed / 6; 286*0Sstevel@tonic-gate retval[j++] = vowels[idx0]; 287*0Sstevel@tonic-gate retval[j++] = consonants[idx1]; 288*0Sstevel@tonic-gate retval[j++] = vowels[idx2]; 289*0Sstevel@tonic-gate } 290*0Sstevel@tonic-gate } 291*0Sstevel@tonic-gate retval[j++] = 'x'; 292*0Sstevel@tonic-gate retval[j++] = '\0'; 293*0Sstevel@tonic-gate return retval; 294*0Sstevel@tonic-gate } 295*0Sstevel@tonic-gate 296*0Sstevel@tonic-gate char * 297*0Sstevel@tonic-gate key_fingerprint(Key *k, enum fp_type dgst_type, enum fp_rep dgst_rep) 298*0Sstevel@tonic-gate { 299*0Sstevel@tonic-gate char *retval = NULL; 300*0Sstevel@tonic-gate u_char *dgst_raw; 301*0Sstevel@tonic-gate u_int dgst_raw_len; 302*0Sstevel@tonic-gate 303*0Sstevel@tonic-gate dgst_raw = key_fingerprint_raw(k, dgst_type, &dgst_raw_len); 304*0Sstevel@tonic-gate if (!dgst_raw) 305*0Sstevel@tonic-gate fatal("key_fingerprint: null from key_fingerprint_raw()"); 306*0Sstevel@tonic-gate switch (dgst_rep) { 307*0Sstevel@tonic-gate case SSH_FP_HEX: 308*0Sstevel@tonic-gate retval = key_fingerprint_hex(dgst_raw, dgst_raw_len); 309*0Sstevel@tonic-gate break; 310*0Sstevel@tonic-gate case SSH_FP_BUBBLEBABBLE: 311*0Sstevel@tonic-gate retval = key_fingerprint_bubblebabble(dgst_raw, dgst_raw_len); 312*0Sstevel@tonic-gate break; 313*0Sstevel@tonic-gate default: 314*0Sstevel@tonic-gate fatal("key_fingerprint_ex: bad digest representation %d", 315*0Sstevel@tonic-gate dgst_rep); 316*0Sstevel@tonic-gate break; 317*0Sstevel@tonic-gate } 318*0Sstevel@tonic-gate memset(dgst_raw, 0, dgst_raw_len); 319*0Sstevel@tonic-gate xfree(dgst_raw); 320*0Sstevel@tonic-gate return retval; 321*0Sstevel@tonic-gate } 322*0Sstevel@tonic-gate 323*0Sstevel@tonic-gate /* 324*0Sstevel@tonic-gate * Reads a multiple-precision integer in decimal from the buffer, and advances 325*0Sstevel@tonic-gate * the pointer. The integer must already be initialized. This function is 326*0Sstevel@tonic-gate * permitted to modify the buffer. This leaves *cpp to point just beyond the 327*0Sstevel@tonic-gate * last processed (and maybe modified) character. Note that this may modify 328*0Sstevel@tonic-gate * the buffer containing the number. 329*0Sstevel@tonic-gate */ 330*0Sstevel@tonic-gate static int 331*0Sstevel@tonic-gate read_bignum(char **cpp, BIGNUM * value) 332*0Sstevel@tonic-gate { 333*0Sstevel@tonic-gate char *cp = *cpp; 334*0Sstevel@tonic-gate int old; 335*0Sstevel@tonic-gate 336*0Sstevel@tonic-gate /* Skip any leading whitespace. */ 337*0Sstevel@tonic-gate for (; *cp == ' ' || *cp == '\t'; cp++) 338*0Sstevel@tonic-gate ; 339*0Sstevel@tonic-gate 340*0Sstevel@tonic-gate /* Check that it begins with a decimal digit. */ 341*0Sstevel@tonic-gate if (*cp < '0' || *cp > '9') 342*0Sstevel@tonic-gate return 0; 343*0Sstevel@tonic-gate 344*0Sstevel@tonic-gate /* Save starting position. */ 345*0Sstevel@tonic-gate *cpp = cp; 346*0Sstevel@tonic-gate 347*0Sstevel@tonic-gate /* Move forward until all decimal digits skipped. */ 348*0Sstevel@tonic-gate for (; *cp >= '0' && *cp <= '9'; cp++) 349*0Sstevel@tonic-gate ; 350*0Sstevel@tonic-gate 351*0Sstevel@tonic-gate /* Save the old terminating character, and replace it by \0. */ 352*0Sstevel@tonic-gate old = *cp; 353*0Sstevel@tonic-gate *cp = 0; 354*0Sstevel@tonic-gate 355*0Sstevel@tonic-gate /* Parse the number. */ 356*0Sstevel@tonic-gate if (BN_dec2bn(&value, *cpp) == 0) 357*0Sstevel@tonic-gate return 0; 358*0Sstevel@tonic-gate 359*0Sstevel@tonic-gate /* Restore old terminating character. */ 360*0Sstevel@tonic-gate *cp = old; 361*0Sstevel@tonic-gate 362*0Sstevel@tonic-gate /* Move beyond the number and return success. */ 363*0Sstevel@tonic-gate *cpp = cp; 364*0Sstevel@tonic-gate return 1; 365*0Sstevel@tonic-gate } 366*0Sstevel@tonic-gate 367*0Sstevel@tonic-gate static int 368*0Sstevel@tonic-gate write_bignum(FILE *f, BIGNUM *num) 369*0Sstevel@tonic-gate { 370*0Sstevel@tonic-gate char *buf = BN_bn2dec(num); 371*0Sstevel@tonic-gate if (buf == NULL) { 372*0Sstevel@tonic-gate error("write_bignum: BN_bn2dec() failed"); 373*0Sstevel@tonic-gate return 0; 374*0Sstevel@tonic-gate } 375*0Sstevel@tonic-gate fprintf(f, " %s", buf); 376*0Sstevel@tonic-gate OPENSSL_free(buf); 377*0Sstevel@tonic-gate return 1; 378*0Sstevel@tonic-gate } 379*0Sstevel@tonic-gate 380*0Sstevel@tonic-gate /* returns 1 ok, -1 error */ 381*0Sstevel@tonic-gate int 382*0Sstevel@tonic-gate key_read(Key *ret, char **cpp) 383*0Sstevel@tonic-gate { 384*0Sstevel@tonic-gate Key *k; 385*0Sstevel@tonic-gate int success = -1; 386*0Sstevel@tonic-gate char *cp, *space; 387*0Sstevel@tonic-gate int len, n, type; 388*0Sstevel@tonic-gate u_int bits; 389*0Sstevel@tonic-gate u_char *blob; 390*0Sstevel@tonic-gate 391*0Sstevel@tonic-gate cp = *cpp; 392*0Sstevel@tonic-gate 393*0Sstevel@tonic-gate switch (ret->type) { 394*0Sstevel@tonic-gate case KEY_RSA1: 395*0Sstevel@tonic-gate /* Get number of bits. */ 396*0Sstevel@tonic-gate if (*cp < '0' || *cp > '9') 397*0Sstevel@tonic-gate return -1; /* Bad bit count... */ 398*0Sstevel@tonic-gate for (bits = 0; *cp >= '0' && *cp <= '9'; cp++) 399*0Sstevel@tonic-gate bits = 10 * bits + *cp - '0'; 400*0Sstevel@tonic-gate if (bits == 0) 401*0Sstevel@tonic-gate return -1; 402*0Sstevel@tonic-gate *cpp = cp; 403*0Sstevel@tonic-gate /* Get public exponent, public modulus. */ 404*0Sstevel@tonic-gate if (!read_bignum(cpp, ret->rsa->e)) 405*0Sstevel@tonic-gate return -1; 406*0Sstevel@tonic-gate if (!read_bignum(cpp, ret->rsa->n)) 407*0Sstevel@tonic-gate return -1; 408*0Sstevel@tonic-gate success = 1; 409*0Sstevel@tonic-gate break; 410*0Sstevel@tonic-gate case KEY_UNSPEC: 411*0Sstevel@tonic-gate case KEY_RSA: 412*0Sstevel@tonic-gate case KEY_DSA: 413*0Sstevel@tonic-gate space = strchr(cp, ' '); 414*0Sstevel@tonic-gate if (space == NULL) { 415*0Sstevel@tonic-gate debug3("key_read: no space"); 416*0Sstevel@tonic-gate return -1; 417*0Sstevel@tonic-gate } 418*0Sstevel@tonic-gate *space = '\0'; 419*0Sstevel@tonic-gate type = key_type_from_name(cp); 420*0Sstevel@tonic-gate *space = ' '; 421*0Sstevel@tonic-gate if (type == KEY_UNSPEC) { 422*0Sstevel@tonic-gate debug3("key_read: no key found"); 423*0Sstevel@tonic-gate return -1; 424*0Sstevel@tonic-gate } 425*0Sstevel@tonic-gate cp = space+1; 426*0Sstevel@tonic-gate if (*cp == '\0') { 427*0Sstevel@tonic-gate debug3("key_read: short string"); 428*0Sstevel@tonic-gate return -1; 429*0Sstevel@tonic-gate } 430*0Sstevel@tonic-gate if (ret->type == KEY_UNSPEC) { 431*0Sstevel@tonic-gate ret->type = type; 432*0Sstevel@tonic-gate } else if (ret->type != type) { 433*0Sstevel@tonic-gate /* is a key, but different type */ 434*0Sstevel@tonic-gate debug3("key_read: type mismatch"); 435*0Sstevel@tonic-gate return -1; 436*0Sstevel@tonic-gate } 437*0Sstevel@tonic-gate len = 2*strlen(cp); 438*0Sstevel@tonic-gate blob = xmalloc(len); 439*0Sstevel@tonic-gate n = uudecode(cp, blob, len); 440*0Sstevel@tonic-gate if (n < 0) { 441*0Sstevel@tonic-gate error("key_read: uudecode %s failed", cp); 442*0Sstevel@tonic-gate xfree(blob); 443*0Sstevel@tonic-gate return -1; 444*0Sstevel@tonic-gate } 445*0Sstevel@tonic-gate k = key_from_blob(blob, n); 446*0Sstevel@tonic-gate xfree(blob); 447*0Sstevel@tonic-gate if (k == NULL) { 448*0Sstevel@tonic-gate error("key_read: key_from_blob %s failed", cp); 449*0Sstevel@tonic-gate return -1; 450*0Sstevel@tonic-gate } 451*0Sstevel@tonic-gate if (k->type != type) { 452*0Sstevel@tonic-gate error("key_read: type mismatch: encoding error"); 453*0Sstevel@tonic-gate key_free(k); 454*0Sstevel@tonic-gate return -1; 455*0Sstevel@tonic-gate } 456*0Sstevel@tonic-gate /*XXXX*/ 457*0Sstevel@tonic-gate if (ret->type == KEY_RSA) { 458*0Sstevel@tonic-gate if (ret->rsa != NULL) 459*0Sstevel@tonic-gate RSA_free(ret->rsa); 460*0Sstevel@tonic-gate ret->rsa = k->rsa; 461*0Sstevel@tonic-gate k->rsa = NULL; 462*0Sstevel@tonic-gate success = 1; 463*0Sstevel@tonic-gate #ifdef DEBUG_PK 464*0Sstevel@tonic-gate RSA_print_fp(stderr, ret->rsa, 8); 465*0Sstevel@tonic-gate #endif 466*0Sstevel@tonic-gate } else { 467*0Sstevel@tonic-gate if (ret->dsa != NULL) 468*0Sstevel@tonic-gate DSA_free(ret->dsa); 469*0Sstevel@tonic-gate ret->dsa = k->dsa; 470*0Sstevel@tonic-gate k->dsa = NULL; 471*0Sstevel@tonic-gate success = 1; 472*0Sstevel@tonic-gate #ifdef DEBUG_PK 473*0Sstevel@tonic-gate DSA_print_fp(stderr, ret->dsa, 8); 474*0Sstevel@tonic-gate #endif 475*0Sstevel@tonic-gate } 476*0Sstevel@tonic-gate /*XXXX*/ 477*0Sstevel@tonic-gate key_free(k); 478*0Sstevel@tonic-gate if (success != 1) 479*0Sstevel@tonic-gate break; 480*0Sstevel@tonic-gate /* advance cp: skip whitespace and data */ 481*0Sstevel@tonic-gate while (*cp == ' ' || *cp == '\t') 482*0Sstevel@tonic-gate cp++; 483*0Sstevel@tonic-gate while (*cp != '\0' && *cp != ' ' && *cp != '\t') 484*0Sstevel@tonic-gate cp++; 485*0Sstevel@tonic-gate *cpp = cp; 486*0Sstevel@tonic-gate break; 487*0Sstevel@tonic-gate default: 488*0Sstevel@tonic-gate fatal("key_read: bad key type: %d", ret->type); 489*0Sstevel@tonic-gate break; 490*0Sstevel@tonic-gate } 491*0Sstevel@tonic-gate return success; 492*0Sstevel@tonic-gate } 493*0Sstevel@tonic-gate 494*0Sstevel@tonic-gate int 495*0Sstevel@tonic-gate key_write(Key *key, FILE *f) 496*0Sstevel@tonic-gate { 497*0Sstevel@tonic-gate int n, success = 0; 498*0Sstevel@tonic-gate u_int len, bits = 0; 499*0Sstevel@tonic-gate u_char *blob; 500*0Sstevel@tonic-gate char *uu; 501*0Sstevel@tonic-gate 502*0Sstevel@tonic-gate if (key->type == KEY_RSA1 && key->rsa != NULL) { 503*0Sstevel@tonic-gate /* size of modulus 'n' */ 504*0Sstevel@tonic-gate bits = BN_num_bits(key->rsa->n); 505*0Sstevel@tonic-gate fprintf(f, "%u", bits); 506*0Sstevel@tonic-gate if (write_bignum(f, key->rsa->e) && 507*0Sstevel@tonic-gate write_bignum(f, key->rsa->n)) { 508*0Sstevel@tonic-gate success = 1; 509*0Sstevel@tonic-gate } else { 510*0Sstevel@tonic-gate error("key_write: failed for RSA key"); 511*0Sstevel@tonic-gate } 512*0Sstevel@tonic-gate } else if ((key->type == KEY_DSA && key->dsa != NULL) || 513*0Sstevel@tonic-gate (key->type == KEY_RSA && key->rsa != NULL)) { 514*0Sstevel@tonic-gate key_to_blob(key, &blob, &len); 515*0Sstevel@tonic-gate uu = xmalloc(2*len); 516*0Sstevel@tonic-gate n = uuencode(blob, len, uu, 2*len); 517*0Sstevel@tonic-gate if (n > 0) { 518*0Sstevel@tonic-gate fprintf(f, "%s %s", key_ssh_name(key), uu); 519*0Sstevel@tonic-gate success = 1; 520*0Sstevel@tonic-gate } 521*0Sstevel@tonic-gate xfree(blob); 522*0Sstevel@tonic-gate xfree(uu); 523*0Sstevel@tonic-gate } 524*0Sstevel@tonic-gate return success; 525*0Sstevel@tonic-gate } 526*0Sstevel@tonic-gate 527*0Sstevel@tonic-gate char * 528*0Sstevel@tonic-gate key_type(Key *k) 529*0Sstevel@tonic-gate { 530*0Sstevel@tonic-gate switch (k->type) { 531*0Sstevel@tonic-gate case KEY_RSA1: 532*0Sstevel@tonic-gate return "RSA1"; 533*0Sstevel@tonic-gate break; 534*0Sstevel@tonic-gate case KEY_RSA: 535*0Sstevel@tonic-gate return "RSA"; 536*0Sstevel@tonic-gate break; 537*0Sstevel@tonic-gate case KEY_DSA: 538*0Sstevel@tonic-gate return "DSA"; 539*0Sstevel@tonic-gate break; 540*0Sstevel@tonic-gate } 541*0Sstevel@tonic-gate return "unknown"; 542*0Sstevel@tonic-gate } 543*0Sstevel@tonic-gate 544*0Sstevel@tonic-gate char * 545*0Sstevel@tonic-gate key_ssh_name(Key *k) 546*0Sstevel@tonic-gate { 547*0Sstevel@tonic-gate switch (k->type) { 548*0Sstevel@tonic-gate case KEY_RSA: 549*0Sstevel@tonic-gate return "ssh-rsa"; 550*0Sstevel@tonic-gate break; 551*0Sstevel@tonic-gate case KEY_DSA: 552*0Sstevel@tonic-gate return "ssh-dss"; 553*0Sstevel@tonic-gate break; 554*0Sstevel@tonic-gate } 555*0Sstevel@tonic-gate return "ssh-unknown"; 556*0Sstevel@tonic-gate } 557*0Sstevel@tonic-gate 558*0Sstevel@tonic-gate u_int 559*0Sstevel@tonic-gate key_size(Key *k) 560*0Sstevel@tonic-gate { 561*0Sstevel@tonic-gate switch (k->type) { 562*0Sstevel@tonic-gate case KEY_RSA1: 563*0Sstevel@tonic-gate case KEY_RSA: 564*0Sstevel@tonic-gate return BN_num_bits(k->rsa->n); 565*0Sstevel@tonic-gate break; 566*0Sstevel@tonic-gate case KEY_DSA: 567*0Sstevel@tonic-gate return BN_num_bits(k->dsa->p); 568*0Sstevel@tonic-gate break; 569*0Sstevel@tonic-gate } 570*0Sstevel@tonic-gate return 0; 571*0Sstevel@tonic-gate } 572*0Sstevel@tonic-gate 573*0Sstevel@tonic-gate static RSA * 574*0Sstevel@tonic-gate rsa_generate_private_key(u_int bits) 575*0Sstevel@tonic-gate { 576*0Sstevel@tonic-gate RSA *private; 577*0Sstevel@tonic-gate private = RSA_generate_key(bits, 35, NULL, NULL); 578*0Sstevel@tonic-gate if (private == NULL) 579*0Sstevel@tonic-gate fatal("rsa_generate_private_key: key generation failed."); 580*0Sstevel@tonic-gate return private; 581*0Sstevel@tonic-gate } 582*0Sstevel@tonic-gate 583*0Sstevel@tonic-gate static DSA* 584*0Sstevel@tonic-gate dsa_generate_private_key(u_int bits) 585*0Sstevel@tonic-gate { 586*0Sstevel@tonic-gate DSA *private = DSA_generate_parameters(bits, NULL, 0, NULL, NULL, NULL, NULL); 587*0Sstevel@tonic-gate if (private == NULL) 588*0Sstevel@tonic-gate fatal("dsa_generate_private_key: DSA_generate_parameters failed"); 589*0Sstevel@tonic-gate if (!DSA_generate_key(private)) 590*0Sstevel@tonic-gate fatal("dsa_generate_private_key: DSA_generate_key failed."); 591*0Sstevel@tonic-gate if (private == NULL) 592*0Sstevel@tonic-gate fatal("dsa_generate_private_key: NULL."); 593*0Sstevel@tonic-gate return private; 594*0Sstevel@tonic-gate } 595*0Sstevel@tonic-gate 596*0Sstevel@tonic-gate Key * 597*0Sstevel@tonic-gate key_generate(int type, u_int bits) 598*0Sstevel@tonic-gate { 599*0Sstevel@tonic-gate Key *k = key_new(KEY_UNSPEC); 600*0Sstevel@tonic-gate switch (type) { 601*0Sstevel@tonic-gate case KEY_DSA: 602*0Sstevel@tonic-gate k->dsa = dsa_generate_private_key(bits); 603*0Sstevel@tonic-gate break; 604*0Sstevel@tonic-gate case KEY_RSA: 605*0Sstevel@tonic-gate case KEY_RSA1: 606*0Sstevel@tonic-gate k->rsa = rsa_generate_private_key(bits); 607*0Sstevel@tonic-gate break; 608*0Sstevel@tonic-gate default: 609*0Sstevel@tonic-gate fatal("key_generate: unknown type %d", type); 610*0Sstevel@tonic-gate } 611*0Sstevel@tonic-gate k->type = type; 612*0Sstevel@tonic-gate return k; 613*0Sstevel@tonic-gate } 614*0Sstevel@tonic-gate 615*0Sstevel@tonic-gate Key * 616*0Sstevel@tonic-gate key_from_private(Key *k) 617*0Sstevel@tonic-gate { 618*0Sstevel@tonic-gate Key *n = NULL; 619*0Sstevel@tonic-gate switch (k->type) { 620*0Sstevel@tonic-gate case KEY_DSA: 621*0Sstevel@tonic-gate n = key_new(k->type); 622*0Sstevel@tonic-gate BN_copy(n->dsa->p, k->dsa->p); 623*0Sstevel@tonic-gate BN_copy(n->dsa->q, k->dsa->q); 624*0Sstevel@tonic-gate BN_copy(n->dsa->g, k->dsa->g); 625*0Sstevel@tonic-gate BN_copy(n->dsa->pub_key, k->dsa->pub_key); 626*0Sstevel@tonic-gate break; 627*0Sstevel@tonic-gate case KEY_RSA: 628*0Sstevel@tonic-gate case KEY_RSA1: 629*0Sstevel@tonic-gate n = key_new(k->type); 630*0Sstevel@tonic-gate BN_copy(n->rsa->n, k->rsa->n); 631*0Sstevel@tonic-gate BN_copy(n->rsa->e, k->rsa->e); 632*0Sstevel@tonic-gate break; 633*0Sstevel@tonic-gate default: 634*0Sstevel@tonic-gate fatal("key_from_private: unknown type %d", k->type); 635*0Sstevel@tonic-gate break; 636*0Sstevel@tonic-gate } 637*0Sstevel@tonic-gate return n; 638*0Sstevel@tonic-gate } 639*0Sstevel@tonic-gate 640*0Sstevel@tonic-gate int 641*0Sstevel@tonic-gate key_type_from_name(char *name) 642*0Sstevel@tonic-gate { 643*0Sstevel@tonic-gate if (strcmp(name, "rsa1") == 0) { 644*0Sstevel@tonic-gate return KEY_RSA1; 645*0Sstevel@tonic-gate } else if (strcmp(name, "rsa") == 0) { 646*0Sstevel@tonic-gate return KEY_RSA; 647*0Sstevel@tonic-gate } else if (strcmp(name, "dsa") == 0) { 648*0Sstevel@tonic-gate return KEY_DSA; 649*0Sstevel@tonic-gate } else if (strcmp(name, "ssh-rsa") == 0) { 650*0Sstevel@tonic-gate return KEY_RSA; 651*0Sstevel@tonic-gate } else if (strcmp(name, "ssh-dss") == 0) { 652*0Sstevel@tonic-gate return KEY_DSA; 653*0Sstevel@tonic-gate } else if (strcmp(name, "null") == 0){ 654*0Sstevel@tonic-gate return KEY_NULL; 655*0Sstevel@tonic-gate } 656*0Sstevel@tonic-gate debug2("key_type_from_name: unknown key type '%s'", name); 657*0Sstevel@tonic-gate return KEY_UNSPEC; 658*0Sstevel@tonic-gate } 659*0Sstevel@tonic-gate 660*0Sstevel@tonic-gate int 661*0Sstevel@tonic-gate key_names_valid2(const char *names) 662*0Sstevel@tonic-gate { 663*0Sstevel@tonic-gate char *s, *cp, *p; 664*0Sstevel@tonic-gate 665*0Sstevel@tonic-gate if (names == NULL || strcmp(names, "") == 0) 666*0Sstevel@tonic-gate return 0; 667*0Sstevel@tonic-gate s = cp = xstrdup(names); 668*0Sstevel@tonic-gate for ((p = strsep(&cp, ",")); p && *p != '\0'; 669*0Sstevel@tonic-gate (p = strsep(&cp, ","))) { 670*0Sstevel@tonic-gate switch (key_type_from_name(p)) { 671*0Sstevel@tonic-gate case KEY_RSA1: 672*0Sstevel@tonic-gate case KEY_UNSPEC: 673*0Sstevel@tonic-gate xfree(s); 674*0Sstevel@tonic-gate return 0; 675*0Sstevel@tonic-gate } 676*0Sstevel@tonic-gate } 677*0Sstevel@tonic-gate debug3("key names ok: [%s]", names); 678*0Sstevel@tonic-gate xfree(s); 679*0Sstevel@tonic-gate return 1; 680*0Sstevel@tonic-gate } 681*0Sstevel@tonic-gate 682*0Sstevel@tonic-gate Key * 683*0Sstevel@tonic-gate key_from_blob(u_char *blob, int blen) 684*0Sstevel@tonic-gate { 685*0Sstevel@tonic-gate Buffer b; 686*0Sstevel@tonic-gate char *ktype; 687*0Sstevel@tonic-gate int rlen, type; 688*0Sstevel@tonic-gate Key *key = NULL; 689*0Sstevel@tonic-gate 690*0Sstevel@tonic-gate #ifdef DEBUG_PK 691*0Sstevel@tonic-gate dump_base64(stderr, blob, blen); 692*0Sstevel@tonic-gate #endif 693*0Sstevel@tonic-gate buffer_init(&b); 694*0Sstevel@tonic-gate buffer_append(&b, blob, blen); 695*0Sstevel@tonic-gate ktype = buffer_get_string(&b, NULL); 696*0Sstevel@tonic-gate type = key_type_from_name(ktype); 697*0Sstevel@tonic-gate 698*0Sstevel@tonic-gate switch (type) { 699*0Sstevel@tonic-gate case KEY_RSA: 700*0Sstevel@tonic-gate key = key_new(type); 701*0Sstevel@tonic-gate buffer_get_bignum2(&b, key->rsa->e); 702*0Sstevel@tonic-gate buffer_get_bignum2(&b, key->rsa->n); 703*0Sstevel@tonic-gate #ifdef DEBUG_PK 704*0Sstevel@tonic-gate RSA_print_fp(stderr, key->rsa, 8); 705*0Sstevel@tonic-gate #endif 706*0Sstevel@tonic-gate break; 707*0Sstevel@tonic-gate case KEY_DSA: 708*0Sstevel@tonic-gate key = key_new(type); 709*0Sstevel@tonic-gate buffer_get_bignum2(&b, key->dsa->p); 710*0Sstevel@tonic-gate buffer_get_bignum2(&b, key->dsa->q); 711*0Sstevel@tonic-gate buffer_get_bignum2(&b, key->dsa->g); 712*0Sstevel@tonic-gate buffer_get_bignum2(&b, key->dsa->pub_key); 713*0Sstevel@tonic-gate #ifdef DEBUG_PK 714*0Sstevel@tonic-gate DSA_print_fp(stderr, key->dsa, 8); 715*0Sstevel@tonic-gate #endif 716*0Sstevel@tonic-gate break; 717*0Sstevel@tonic-gate case KEY_UNSPEC: 718*0Sstevel@tonic-gate key = key_new(type); 719*0Sstevel@tonic-gate break; 720*0Sstevel@tonic-gate default: 721*0Sstevel@tonic-gate error("key_from_blob: cannot handle type %s", ktype); 722*0Sstevel@tonic-gate break; 723*0Sstevel@tonic-gate } 724*0Sstevel@tonic-gate rlen = buffer_len(&b); 725*0Sstevel@tonic-gate if (key != NULL && rlen != 0) 726*0Sstevel@tonic-gate error("key_from_blob: remaining bytes in key blob %d", rlen); 727*0Sstevel@tonic-gate xfree(ktype); 728*0Sstevel@tonic-gate buffer_free(&b); 729*0Sstevel@tonic-gate return key; 730*0Sstevel@tonic-gate } 731*0Sstevel@tonic-gate 732*0Sstevel@tonic-gate int 733*0Sstevel@tonic-gate key_to_blob(Key *key, u_char **blobp, u_int *lenp) 734*0Sstevel@tonic-gate { 735*0Sstevel@tonic-gate Buffer b; 736*0Sstevel@tonic-gate int len; 737*0Sstevel@tonic-gate 738*0Sstevel@tonic-gate if (key == NULL) { 739*0Sstevel@tonic-gate error("key_to_blob: key == NULL"); 740*0Sstevel@tonic-gate return 0; 741*0Sstevel@tonic-gate } 742*0Sstevel@tonic-gate buffer_init(&b); 743*0Sstevel@tonic-gate switch (key->type) { 744*0Sstevel@tonic-gate case KEY_DSA: 745*0Sstevel@tonic-gate buffer_put_cstring(&b, key_ssh_name(key)); 746*0Sstevel@tonic-gate buffer_put_bignum2(&b, key->dsa->p); 747*0Sstevel@tonic-gate buffer_put_bignum2(&b, key->dsa->q); 748*0Sstevel@tonic-gate buffer_put_bignum2(&b, key->dsa->g); 749*0Sstevel@tonic-gate buffer_put_bignum2(&b, key->dsa->pub_key); 750*0Sstevel@tonic-gate break; 751*0Sstevel@tonic-gate case KEY_RSA: 752*0Sstevel@tonic-gate buffer_put_cstring(&b, key_ssh_name(key)); 753*0Sstevel@tonic-gate buffer_put_bignum2(&b, key->rsa->e); 754*0Sstevel@tonic-gate buffer_put_bignum2(&b, key->rsa->n); 755*0Sstevel@tonic-gate break; 756*0Sstevel@tonic-gate default: 757*0Sstevel@tonic-gate error("key_to_blob: unsupported key type %d", key->type); 758*0Sstevel@tonic-gate buffer_free(&b); 759*0Sstevel@tonic-gate return 0; 760*0Sstevel@tonic-gate } 761*0Sstevel@tonic-gate len = buffer_len(&b); 762*0Sstevel@tonic-gate if (lenp != NULL) 763*0Sstevel@tonic-gate *lenp = len; 764*0Sstevel@tonic-gate if (blobp != NULL) { 765*0Sstevel@tonic-gate *blobp = xmalloc(len); 766*0Sstevel@tonic-gate memcpy(*blobp, buffer_ptr(&b), len); 767*0Sstevel@tonic-gate } 768*0Sstevel@tonic-gate memset(buffer_ptr(&b), 0, len); 769*0Sstevel@tonic-gate buffer_free(&b); 770*0Sstevel@tonic-gate return len; 771*0Sstevel@tonic-gate } 772*0Sstevel@tonic-gate 773*0Sstevel@tonic-gate int 774*0Sstevel@tonic-gate key_sign( 775*0Sstevel@tonic-gate Key *key, 776*0Sstevel@tonic-gate u_char **sigp, u_int *lenp, 777*0Sstevel@tonic-gate u_char *data, u_int datalen) 778*0Sstevel@tonic-gate { 779*0Sstevel@tonic-gate switch (key->type) { 780*0Sstevel@tonic-gate case KEY_DSA: 781*0Sstevel@tonic-gate return ssh_dss_sign(key, sigp, lenp, data, datalen); 782*0Sstevel@tonic-gate break; 783*0Sstevel@tonic-gate case KEY_RSA: 784*0Sstevel@tonic-gate return ssh_rsa_sign(key, sigp, lenp, data, datalen); 785*0Sstevel@tonic-gate break; 786*0Sstevel@tonic-gate default: 787*0Sstevel@tonic-gate error("key_sign: illegal key type %d", key->type); 788*0Sstevel@tonic-gate return -1; 789*0Sstevel@tonic-gate break; 790*0Sstevel@tonic-gate } 791*0Sstevel@tonic-gate } 792*0Sstevel@tonic-gate 793*0Sstevel@tonic-gate /* 794*0Sstevel@tonic-gate * key_verify returns 1 for a correct signature, 0 for an incorrect signature 795*0Sstevel@tonic-gate * and -1 on error. 796*0Sstevel@tonic-gate */ 797*0Sstevel@tonic-gate int 798*0Sstevel@tonic-gate key_verify( 799*0Sstevel@tonic-gate Key *key, 800*0Sstevel@tonic-gate u_char *signature, u_int signaturelen, 801*0Sstevel@tonic-gate u_char *data, u_int datalen) 802*0Sstevel@tonic-gate { 803*0Sstevel@tonic-gate if (signaturelen == 0) 804*0Sstevel@tonic-gate return -1; 805*0Sstevel@tonic-gate 806*0Sstevel@tonic-gate switch (key->type) { 807*0Sstevel@tonic-gate case KEY_DSA: 808*0Sstevel@tonic-gate return ssh_dss_verify(key, signature, signaturelen, data, datalen); 809*0Sstevel@tonic-gate break; 810*0Sstevel@tonic-gate case KEY_RSA: 811*0Sstevel@tonic-gate return ssh_rsa_verify(key, signature, signaturelen, data, datalen); 812*0Sstevel@tonic-gate break; 813*0Sstevel@tonic-gate default: 814*0Sstevel@tonic-gate error("key_verify: illegal key type %d", key->type); 815*0Sstevel@tonic-gate return -1; 816*0Sstevel@tonic-gate break; 817*0Sstevel@tonic-gate } 818*0Sstevel@tonic-gate } 819*0Sstevel@tonic-gate 820*0Sstevel@tonic-gate /* Converts a private to a public key */ 821*0Sstevel@tonic-gate Key * 822*0Sstevel@tonic-gate key_demote(Key *k) 823*0Sstevel@tonic-gate { 824*0Sstevel@tonic-gate Key *pk; 825*0Sstevel@tonic-gate 826*0Sstevel@tonic-gate pk = xmalloc(sizeof(*pk)); 827*0Sstevel@tonic-gate pk->type = k->type; 828*0Sstevel@tonic-gate pk->flags = k->flags; 829*0Sstevel@tonic-gate pk->dsa = NULL; 830*0Sstevel@tonic-gate pk->rsa = NULL; 831*0Sstevel@tonic-gate 832*0Sstevel@tonic-gate switch (k->type) { 833*0Sstevel@tonic-gate case KEY_RSA1: 834*0Sstevel@tonic-gate case KEY_RSA: 835*0Sstevel@tonic-gate if ((pk->rsa = RSA_new()) == NULL) 836*0Sstevel@tonic-gate fatal("key_demote: RSA_new failed"); 837*0Sstevel@tonic-gate if ((pk->rsa->e = BN_dup(k->rsa->e)) == NULL) 838*0Sstevel@tonic-gate fatal("key_demote: BN_dup failed"); 839*0Sstevel@tonic-gate if ((pk->rsa->n = BN_dup(k->rsa->n)) == NULL) 840*0Sstevel@tonic-gate fatal("key_demote: BN_dup failed"); 841*0Sstevel@tonic-gate break; 842*0Sstevel@tonic-gate case KEY_DSA: 843*0Sstevel@tonic-gate if ((pk->dsa = DSA_new()) == NULL) 844*0Sstevel@tonic-gate fatal("key_demote: DSA_new failed"); 845*0Sstevel@tonic-gate if ((pk->dsa->p = BN_dup(k->dsa->p)) == NULL) 846*0Sstevel@tonic-gate fatal("key_demote: BN_dup failed"); 847*0Sstevel@tonic-gate if ((pk->dsa->q = BN_dup(k->dsa->q)) == NULL) 848*0Sstevel@tonic-gate fatal("key_demote: BN_dup failed"); 849*0Sstevel@tonic-gate if ((pk->dsa->g = BN_dup(k->dsa->g)) == NULL) 850*0Sstevel@tonic-gate fatal("key_demote: BN_dup failed"); 851*0Sstevel@tonic-gate if ((pk->dsa->pub_key = BN_dup(k->dsa->pub_key)) == NULL) 852*0Sstevel@tonic-gate fatal("key_demote: BN_dup failed"); 853*0Sstevel@tonic-gate break; 854*0Sstevel@tonic-gate default: 855*0Sstevel@tonic-gate fatal("key_free: bad key type %d", k->type); 856*0Sstevel@tonic-gate break; 857*0Sstevel@tonic-gate } 858*0Sstevel@tonic-gate 859*0Sstevel@tonic-gate return (pk); 860*0Sstevel@tonic-gate } 861