1*0Sstevel@tonic-gate /* 2*0Sstevel@tonic-gate * Copyright 2004 Sun Microsystems, Inc. All rights reserved. 3*0Sstevel@tonic-gate * Use is subject to license terms. 4*0Sstevel@tonic-gate */ 5*0Sstevel@tonic-gate /* 6*0Sstevel@tonic-gate * Author: Tatu Ylonen <ylo@cs.hut.fi> 7*0Sstevel@tonic-gate * Copyright (c) 1994 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 8*0Sstevel@tonic-gate * All rights reserved 9*0Sstevel@tonic-gate * Identity and host key generation and maintenance. 10*0Sstevel@tonic-gate * 11*0Sstevel@tonic-gate * As far as I am concerned, the code I have written for this software 12*0Sstevel@tonic-gate * can be used freely for any purpose. Any derived versions of this 13*0Sstevel@tonic-gate * software must be clearly marked as such, and if the derived work is 14*0Sstevel@tonic-gate * incompatible with the protocol description in the RFC file, it must be 15*0Sstevel@tonic-gate * called by a name other than "ssh" or "Secure Shell". 16*0Sstevel@tonic-gate */ 17*0Sstevel@tonic-gate 18*0Sstevel@tonic-gate #include "includes.h" 19*0Sstevel@tonic-gate RCSID("$OpenBSD: ssh-keygen.c,v 1.101 2002/06/23 09:39:55 deraadt Exp $"); 20*0Sstevel@tonic-gate 21*0Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI" 22*0Sstevel@tonic-gate 23*0Sstevel@tonic-gate #include <openssl/evp.h> 24*0Sstevel@tonic-gate #include <openssl/pem.h> 25*0Sstevel@tonic-gate 26*0Sstevel@tonic-gate #include "xmalloc.h" 27*0Sstevel@tonic-gate #include "key.h" 28*0Sstevel@tonic-gate #include "rsa.h" 29*0Sstevel@tonic-gate #include "authfile.h" 30*0Sstevel@tonic-gate #include "uuencode.h" 31*0Sstevel@tonic-gate #include "buffer.h" 32*0Sstevel@tonic-gate #include "bufaux.h" 33*0Sstevel@tonic-gate #include "pathnames.h" 34*0Sstevel@tonic-gate #include "log.h" 35*0Sstevel@tonic-gate #include "readpass.h" 36*0Sstevel@tonic-gate #include <langinfo.h> 37*0Sstevel@tonic-gate 38*0Sstevel@tonic-gate #ifdef SMARTCARD 39*0Sstevel@tonic-gate #include "scard.h" 40*0Sstevel@tonic-gate #endif 41*0Sstevel@tonic-gate 42*0Sstevel@tonic-gate /* Number of bits in the RSA/DSA key. This value can be changed on the command line. */ 43*0Sstevel@tonic-gate int bits = 1024; 44*0Sstevel@tonic-gate 45*0Sstevel@tonic-gate /* 46*0Sstevel@tonic-gate * Flag indicating that we just want to change the passphrase. This can be 47*0Sstevel@tonic-gate * set on the command line. 48*0Sstevel@tonic-gate */ 49*0Sstevel@tonic-gate int change_passphrase = 0; 50*0Sstevel@tonic-gate 51*0Sstevel@tonic-gate /* 52*0Sstevel@tonic-gate * Flag indicating that we just want to change the comment. This can be set 53*0Sstevel@tonic-gate * on the command line. 54*0Sstevel@tonic-gate */ 55*0Sstevel@tonic-gate int change_comment = 0; 56*0Sstevel@tonic-gate 57*0Sstevel@tonic-gate int quiet = 0; 58*0Sstevel@tonic-gate 59*0Sstevel@tonic-gate /* Flag indicating that we just want to see the key fingerprint */ 60*0Sstevel@tonic-gate int print_fingerprint = 0; 61*0Sstevel@tonic-gate int print_bubblebabble = 0; 62*0Sstevel@tonic-gate 63*0Sstevel@tonic-gate /* The identity file name, given on the command line or entered by the user. */ 64*0Sstevel@tonic-gate char identity_file[1024]; 65*0Sstevel@tonic-gate int have_identity = 0; 66*0Sstevel@tonic-gate 67*0Sstevel@tonic-gate /* This is set to the passphrase if given on the command line. */ 68*0Sstevel@tonic-gate char *identity_passphrase = NULL; 69*0Sstevel@tonic-gate 70*0Sstevel@tonic-gate /* This is set to the new passphrase if given on the command line. */ 71*0Sstevel@tonic-gate char *identity_new_passphrase = NULL; 72*0Sstevel@tonic-gate 73*0Sstevel@tonic-gate /* This is set to the new comment if given on the command line. */ 74*0Sstevel@tonic-gate char *identity_comment = NULL; 75*0Sstevel@tonic-gate 76*0Sstevel@tonic-gate /* Dump public key file in format used by real and the original SSH 2 */ 77*0Sstevel@tonic-gate int convert_to_ssh2 = 0; 78*0Sstevel@tonic-gate int convert_from_ssh2 = 0; 79*0Sstevel@tonic-gate int print_public = 0; 80*0Sstevel@tonic-gate 81*0Sstevel@tonic-gate char *key_type_name = NULL; 82*0Sstevel@tonic-gate 83*0Sstevel@tonic-gate /* argv0 */ 84*0Sstevel@tonic-gate #ifdef HAVE___PROGNAME 85*0Sstevel@tonic-gate extern char *__progname; 86*0Sstevel@tonic-gate #else 87*0Sstevel@tonic-gate char *__progname; 88*0Sstevel@tonic-gate #endif 89*0Sstevel@tonic-gate 90*0Sstevel@tonic-gate char hostname[MAXHOSTNAMELEN]; 91*0Sstevel@tonic-gate 92*0Sstevel@tonic-gate static void 93*0Sstevel@tonic-gate ask_filename(struct passwd *pw, const char *prompt) 94*0Sstevel@tonic-gate { 95*0Sstevel@tonic-gate char buf[1024]; 96*0Sstevel@tonic-gate char *name = NULL; 97*0Sstevel@tonic-gate 98*0Sstevel@tonic-gate if (key_type_name == NULL) 99*0Sstevel@tonic-gate name = _PATH_SSH_CLIENT_ID_RSA; 100*0Sstevel@tonic-gate else 101*0Sstevel@tonic-gate switch (key_type_from_name(key_type_name)) { 102*0Sstevel@tonic-gate case KEY_RSA1: 103*0Sstevel@tonic-gate name = _PATH_SSH_CLIENT_IDENTITY; 104*0Sstevel@tonic-gate break; 105*0Sstevel@tonic-gate case KEY_DSA: 106*0Sstevel@tonic-gate name = _PATH_SSH_CLIENT_ID_DSA; 107*0Sstevel@tonic-gate break; 108*0Sstevel@tonic-gate case KEY_RSA: 109*0Sstevel@tonic-gate name = _PATH_SSH_CLIENT_ID_RSA; 110*0Sstevel@tonic-gate break; 111*0Sstevel@tonic-gate default: 112*0Sstevel@tonic-gate (void) fprintf(stderr, gettext("bad key type")); 113*0Sstevel@tonic-gate exit(1); 114*0Sstevel@tonic-gate break; 115*0Sstevel@tonic-gate } 116*0Sstevel@tonic-gate 117*0Sstevel@tonic-gate (void) snprintf(identity_file, sizeof(identity_file), "%s/%s", pw->pw_dir, name); 118*0Sstevel@tonic-gate (void) fprintf(stderr, "%s (%s): ", gettext(prompt), identity_file); 119*0Sstevel@tonic-gate (void) fflush(stderr); 120*0Sstevel@tonic-gate if (fgets(buf, sizeof(buf), stdin) == NULL) 121*0Sstevel@tonic-gate exit(1); 122*0Sstevel@tonic-gate if (strchr(buf, '\n')) 123*0Sstevel@tonic-gate *strchr(buf, '\n') = 0; 124*0Sstevel@tonic-gate if (strcmp(buf, "") != 0) 125*0Sstevel@tonic-gate (void) strlcpy(identity_file, buf, sizeof(identity_file)); 126*0Sstevel@tonic-gate have_identity = 1; 127*0Sstevel@tonic-gate } 128*0Sstevel@tonic-gate 129*0Sstevel@tonic-gate static Key * 130*0Sstevel@tonic-gate load_identity(char *filename) 131*0Sstevel@tonic-gate { 132*0Sstevel@tonic-gate char *pass; 133*0Sstevel@tonic-gate Key *prv; 134*0Sstevel@tonic-gate 135*0Sstevel@tonic-gate prv = key_load_private(filename, "", NULL); 136*0Sstevel@tonic-gate if (prv == NULL) { 137*0Sstevel@tonic-gate if (identity_passphrase) 138*0Sstevel@tonic-gate pass = xstrdup(identity_passphrase); 139*0Sstevel@tonic-gate else 140*0Sstevel@tonic-gate pass = read_passphrase(gettext("Enter passphrase: "), 141*0Sstevel@tonic-gate RP_ALLOW_STDIN); 142*0Sstevel@tonic-gate prv = key_load_private(filename, pass, NULL); 143*0Sstevel@tonic-gate (void) memset(pass, 0, strlen(pass)); 144*0Sstevel@tonic-gate xfree(pass); 145*0Sstevel@tonic-gate } 146*0Sstevel@tonic-gate return prv; 147*0Sstevel@tonic-gate } 148*0Sstevel@tonic-gate 149*0Sstevel@tonic-gate #define SSH_COM_PUBLIC_BEGIN "---- BEGIN SSH2 PUBLIC KEY ----" 150*0Sstevel@tonic-gate #define SSH_COM_PUBLIC_END "---- END SSH2 PUBLIC KEY ----" 151*0Sstevel@tonic-gate #define SSH_COM_PRIVATE_BEGIN "---- BEGIN SSH2 ENCRYPTED PRIVATE KEY ----" 152*0Sstevel@tonic-gate #define SSH_COM_PRIVATE_KEY_MAGIC 0x3f6ff9eb 153*0Sstevel@tonic-gate 154*0Sstevel@tonic-gate static void 155*0Sstevel@tonic-gate do_convert_to_ssh2(struct passwd *pw) 156*0Sstevel@tonic-gate { 157*0Sstevel@tonic-gate Key *k; 158*0Sstevel@tonic-gate u_int len; 159*0Sstevel@tonic-gate u_char *blob; 160*0Sstevel@tonic-gate struct stat st; 161*0Sstevel@tonic-gate 162*0Sstevel@tonic-gate if (!have_identity) 163*0Sstevel@tonic-gate ask_filename(pw, gettext("Enter file in which the key is")); 164*0Sstevel@tonic-gate if (stat(identity_file, &st) < 0) { 165*0Sstevel@tonic-gate perror(identity_file); 166*0Sstevel@tonic-gate exit(1); 167*0Sstevel@tonic-gate } 168*0Sstevel@tonic-gate if ((k = key_load_public(identity_file, NULL)) == NULL) { 169*0Sstevel@tonic-gate if ((k = load_identity(identity_file)) == NULL) { 170*0Sstevel@tonic-gate (void) fprintf(stderr, gettext("load failed\n")); 171*0Sstevel@tonic-gate exit(1); 172*0Sstevel@tonic-gate } 173*0Sstevel@tonic-gate } 174*0Sstevel@tonic-gate if (key_to_blob(k, &blob, &len) <= 0) { 175*0Sstevel@tonic-gate (void) fprintf(stderr, gettext("key_to_blob failed\n")); 176*0Sstevel@tonic-gate exit(1); 177*0Sstevel@tonic-gate } 178*0Sstevel@tonic-gate (void) fprintf(stdout, "%s\n", SSH_COM_PUBLIC_BEGIN); 179*0Sstevel@tonic-gate (void) fprintf(stdout, gettext( 180*0Sstevel@tonic-gate "Comment: \"%u-bit %s, converted from OpenSSH by %s@%s\"\n"), 181*0Sstevel@tonic-gate key_size(k), key_type(k), 182*0Sstevel@tonic-gate pw->pw_name, hostname); 183*0Sstevel@tonic-gate dump_base64(stdout, blob, len); 184*0Sstevel@tonic-gate (void) fprintf(stdout, "%s\n", SSH_COM_PUBLIC_END); 185*0Sstevel@tonic-gate key_free(k); 186*0Sstevel@tonic-gate xfree(blob); 187*0Sstevel@tonic-gate exit(0); 188*0Sstevel@tonic-gate } 189*0Sstevel@tonic-gate 190*0Sstevel@tonic-gate static void 191*0Sstevel@tonic-gate buffer_get_bignum_bits(Buffer *b, BIGNUM *value) 192*0Sstevel@tonic-gate { 193*0Sstevel@tonic-gate int bits = buffer_get_int(b); 194*0Sstevel@tonic-gate int bytes = (bits + 7) / 8; 195*0Sstevel@tonic-gate 196*0Sstevel@tonic-gate if (buffer_len(b) < bytes) 197*0Sstevel@tonic-gate fatal("buffer_get_bignum_bits: input buffer too small: " 198*0Sstevel@tonic-gate "need %d have %d", bytes, buffer_len(b)); 199*0Sstevel@tonic-gate (void) BN_bin2bn(buffer_ptr(b), bytes, value); 200*0Sstevel@tonic-gate buffer_consume(b, bytes); 201*0Sstevel@tonic-gate } 202*0Sstevel@tonic-gate 203*0Sstevel@tonic-gate static Key * 204*0Sstevel@tonic-gate do_convert_private_ssh2_from_blob(u_char *blob, u_int blen) 205*0Sstevel@tonic-gate { 206*0Sstevel@tonic-gate Buffer b; 207*0Sstevel@tonic-gate Key *key = NULL; 208*0Sstevel@tonic-gate char *type, *cipher; 209*0Sstevel@tonic-gate u_char *sig, data[] = "abcde12345"; 210*0Sstevel@tonic-gate int magic, rlen, ktype, i1, i2, i3, i4; 211*0Sstevel@tonic-gate u_int slen; 212*0Sstevel@tonic-gate u_long e; 213*0Sstevel@tonic-gate 214*0Sstevel@tonic-gate buffer_init(&b); 215*0Sstevel@tonic-gate buffer_append(&b, blob, blen); 216*0Sstevel@tonic-gate 217*0Sstevel@tonic-gate magic = buffer_get_int(&b); 218*0Sstevel@tonic-gate if (magic != SSH_COM_PRIVATE_KEY_MAGIC) { 219*0Sstevel@tonic-gate error("bad magic 0x%x != 0x%x", magic, SSH_COM_PRIVATE_KEY_MAGIC); 220*0Sstevel@tonic-gate buffer_free(&b); 221*0Sstevel@tonic-gate return NULL; 222*0Sstevel@tonic-gate } 223*0Sstevel@tonic-gate i1 = buffer_get_int(&b); 224*0Sstevel@tonic-gate type = buffer_get_string(&b, NULL); 225*0Sstevel@tonic-gate cipher = buffer_get_string(&b, NULL); 226*0Sstevel@tonic-gate i2 = buffer_get_int(&b); 227*0Sstevel@tonic-gate i3 = buffer_get_int(&b); 228*0Sstevel@tonic-gate i4 = buffer_get_int(&b); 229*0Sstevel@tonic-gate debug("ignore (%d %d %d %d)", i1,i2,i3,i4); 230*0Sstevel@tonic-gate if (strcmp(cipher, "none") != 0) { 231*0Sstevel@tonic-gate error("unsupported cipher %s", cipher); 232*0Sstevel@tonic-gate xfree(cipher); 233*0Sstevel@tonic-gate buffer_free(&b); 234*0Sstevel@tonic-gate xfree(type); 235*0Sstevel@tonic-gate return NULL; 236*0Sstevel@tonic-gate } 237*0Sstevel@tonic-gate xfree(cipher); 238*0Sstevel@tonic-gate 239*0Sstevel@tonic-gate if (strstr(type, "dsa")) { 240*0Sstevel@tonic-gate ktype = KEY_DSA; 241*0Sstevel@tonic-gate } else if (strstr(type, "rsa")) { 242*0Sstevel@tonic-gate ktype = KEY_RSA; 243*0Sstevel@tonic-gate } else { 244*0Sstevel@tonic-gate xfree(type); 245*0Sstevel@tonic-gate return NULL; 246*0Sstevel@tonic-gate } 247*0Sstevel@tonic-gate key = key_new_private(ktype); 248*0Sstevel@tonic-gate xfree(type); 249*0Sstevel@tonic-gate 250*0Sstevel@tonic-gate switch (key->type) { 251*0Sstevel@tonic-gate case KEY_DSA: 252*0Sstevel@tonic-gate buffer_get_bignum_bits(&b, key->dsa->p); 253*0Sstevel@tonic-gate buffer_get_bignum_bits(&b, key->dsa->g); 254*0Sstevel@tonic-gate buffer_get_bignum_bits(&b, key->dsa->q); 255*0Sstevel@tonic-gate buffer_get_bignum_bits(&b, key->dsa->pub_key); 256*0Sstevel@tonic-gate buffer_get_bignum_bits(&b, key->dsa->priv_key); 257*0Sstevel@tonic-gate break; 258*0Sstevel@tonic-gate case KEY_RSA: 259*0Sstevel@tonic-gate e = buffer_get_char(&b); 260*0Sstevel@tonic-gate debug("e %lx", e); 261*0Sstevel@tonic-gate if (e < 30) { 262*0Sstevel@tonic-gate e <<= 8; 263*0Sstevel@tonic-gate e += buffer_get_char(&b); 264*0Sstevel@tonic-gate debug("e %lx", e); 265*0Sstevel@tonic-gate e <<= 8; 266*0Sstevel@tonic-gate e += buffer_get_char(&b); 267*0Sstevel@tonic-gate debug("e %lx", e); 268*0Sstevel@tonic-gate } 269*0Sstevel@tonic-gate if (!BN_set_word(key->rsa->e, e)) { 270*0Sstevel@tonic-gate buffer_free(&b); 271*0Sstevel@tonic-gate key_free(key); 272*0Sstevel@tonic-gate return NULL; 273*0Sstevel@tonic-gate } 274*0Sstevel@tonic-gate buffer_get_bignum_bits(&b, key->rsa->d); 275*0Sstevel@tonic-gate buffer_get_bignum_bits(&b, key->rsa->n); 276*0Sstevel@tonic-gate buffer_get_bignum_bits(&b, key->rsa->iqmp); 277*0Sstevel@tonic-gate buffer_get_bignum_bits(&b, key->rsa->q); 278*0Sstevel@tonic-gate buffer_get_bignum_bits(&b, key->rsa->p); 279*0Sstevel@tonic-gate rsa_generate_additional_parameters(key->rsa); 280*0Sstevel@tonic-gate break; 281*0Sstevel@tonic-gate } 282*0Sstevel@tonic-gate rlen = buffer_len(&b); 283*0Sstevel@tonic-gate if (rlen != 0) 284*0Sstevel@tonic-gate error("do_convert_private_ssh2_from_blob: " 285*0Sstevel@tonic-gate "remaining bytes in key blob %d", rlen); 286*0Sstevel@tonic-gate buffer_free(&b); 287*0Sstevel@tonic-gate 288*0Sstevel@tonic-gate /* try the key */ 289*0Sstevel@tonic-gate (void) key_sign(key, &sig, &slen, data, sizeof(data)); 290*0Sstevel@tonic-gate key_verify(key, sig, slen, data, sizeof(data)); 291*0Sstevel@tonic-gate xfree(sig); 292*0Sstevel@tonic-gate return key; 293*0Sstevel@tonic-gate } 294*0Sstevel@tonic-gate 295*0Sstevel@tonic-gate static void 296*0Sstevel@tonic-gate do_convert_from_ssh2(struct passwd *pw) 297*0Sstevel@tonic-gate { 298*0Sstevel@tonic-gate Key *k; 299*0Sstevel@tonic-gate int blen; 300*0Sstevel@tonic-gate u_int len; 301*0Sstevel@tonic-gate char line[1024], *p; 302*0Sstevel@tonic-gate u_char blob[8096]; 303*0Sstevel@tonic-gate char encoded[8096]; 304*0Sstevel@tonic-gate struct stat st; 305*0Sstevel@tonic-gate int escaped = 0, private = 0, ok; 306*0Sstevel@tonic-gate FILE *fp; 307*0Sstevel@tonic-gate 308*0Sstevel@tonic-gate if (!have_identity) 309*0Sstevel@tonic-gate ask_filename(pw, gettext("Enter file in which the key is")); 310*0Sstevel@tonic-gate if (stat(identity_file, &st) < 0) { 311*0Sstevel@tonic-gate perror(identity_file); 312*0Sstevel@tonic-gate exit(1); 313*0Sstevel@tonic-gate } 314*0Sstevel@tonic-gate fp = fopen(identity_file, "r"); 315*0Sstevel@tonic-gate if (fp == NULL) { 316*0Sstevel@tonic-gate perror(identity_file); 317*0Sstevel@tonic-gate exit(1); 318*0Sstevel@tonic-gate } 319*0Sstevel@tonic-gate encoded[0] = '\0'; 320*0Sstevel@tonic-gate while (fgets(line, sizeof(line), fp)) { 321*0Sstevel@tonic-gate if (!(p = strchr(line, '\n'))) { 322*0Sstevel@tonic-gate (void) fprintf(stderr, gettext("input line too long.\n")); 323*0Sstevel@tonic-gate exit(1); 324*0Sstevel@tonic-gate } 325*0Sstevel@tonic-gate if (p > line && p[-1] == '\\') 326*0Sstevel@tonic-gate escaped++; 327*0Sstevel@tonic-gate if (strncmp(line, "----", 4) == 0 || 328*0Sstevel@tonic-gate strstr(line, ": ") != NULL) { 329*0Sstevel@tonic-gate if (strstr(line, SSH_COM_PRIVATE_BEGIN) != NULL) 330*0Sstevel@tonic-gate private = 1; 331*0Sstevel@tonic-gate if (strstr(line, " END ") != NULL) { 332*0Sstevel@tonic-gate break; 333*0Sstevel@tonic-gate } 334*0Sstevel@tonic-gate /* fprintf(stderr, "ignore: %s", line); */ 335*0Sstevel@tonic-gate continue; 336*0Sstevel@tonic-gate } 337*0Sstevel@tonic-gate if (escaped) { 338*0Sstevel@tonic-gate escaped--; 339*0Sstevel@tonic-gate /* fprintf(stderr, "escaped: %s", line); */ 340*0Sstevel@tonic-gate continue; 341*0Sstevel@tonic-gate } 342*0Sstevel@tonic-gate *p = '\0'; 343*0Sstevel@tonic-gate (void) strlcat(encoded, line, sizeof(encoded)); 344*0Sstevel@tonic-gate } 345*0Sstevel@tonic-gate len = strlen(encoded); 346*0Sstevel@tonic-gate if (((len % 4) == 3) && 347*0Sstevel@tonic-gate (encoded[len-1] == '=') && 348*0Sstevel@tonic-gate (encoded[len-2] == '=') && 349*0Sstevel@tonic-gate (encoded[len-3] == '=')) 350*0Sstevel@tonic-gate encoded[len-3] = '\0'; 351*0Sstevel@tonic-gate blen = uudecode(encoded, blob, sizeof(blob)); 352*0Sstevel@tonic-gate if (blen < 0) { 353*0Sstevel@tonic-gate (void) fprintf(stderr, gettext("uudecode failed.\n")); 354*0Sstevel@tonic-gate exit(1); 355*0Sstevel@tonic-gate } 356*0Sstevel@tonic-gate k = private ? 357*0Sstevel@tonic-gate do_convert_private_ssh2_from_blob(blob, blen) : 358*0Sstevel@tonic-gate key_from_blob(blob, blen); 359*0Sstevel@tonic-gate if (k == NULL) { 360*0Sstevel@tonic-gate (void) fprintf(stderr, gettext("decode blob failed.\n")); 361*0Sstevel@tonic-gate exit(1); 362*0Sstevel@tonic-gate } 363*0Sstevel@tonic-gate ok = private ? 364*0Sstevel@tonic-gate (k->type == KEY_DSA ? 365*0Sstevel@tonic-gate PEM_write_DSAPrivateKey(stdout, k->dsa, NULL, NULL, 0, NULL, NULL) : 366*0Sstevel@tonic-gate PEM_write_RSAPrivateKey(stdout, k->rsa, NULL, NULL, 0, NULL, NULL)) : 367*0Sstevel@tonic-gate key_write(k, stdout); 368*0Sstevel@tonic-gate if (!ok) { 369*0Sstevel@tonic-gate (void) fprintf(stderr, gettext("key write failed")); 370*0Sstevel@tonic-gate exit(1); 371*0Sstevel@tonic-gate } 372*0Sstevel@tonic-gate key_free(k); 373*0Sstevel@tonic-gate if (!private) 374*0Sstevel@tonic-gate (void) fprintf(stdout, "\n"); 375*0Sstevel@tonic-gate (void) fclose(fp); 376*0Sstevel@tonic-gate exit(0); 377*0Sstevel@tonic-gate } 378*0Sstevel@tonic-gate 379*0Sstevel@tonic-gate static void 380*0Sstevel@tonic-gate do_print_public(struct passwd *pw) 381*0Sstevel@tonic-gate { 382*0Sstevel@tonic-gate Key *prv; 383*0Sstevel@tonic-gate struct stat st; 384*0Sstevel@tonic-gate 385*0Sstevel@tonic-gate if (!have_identity) 386*0Sstevel@tonic-gate ask_filename(pw, gettext("Enter file in which the key is")); 387*0Sstevel@tonic-gate if (stat(identity_file, &st) < 0) { 388*0Sstevel@tonic-gate perror(identity_file); 389*0Sstevel@tonic-gate exit(1); 390*0Sstevel@tonic-gate } 391*0Sstevel@tonic-gate prv = load_identity(identity_file); 392*0Sstevel@tonic-gate if (prv == NULL) { 393*0Sstevel@tonic-gate (void) fprintf(stderr, gettext("load failed\n")); 394*0Sstevel@tonic-gate exit(1); 395*0Sstevel@tonic-gate } 396*0Sstevel@tonic-gate if (!key_write(prv, stdout)) 397*0Sstevel@tonic-gate (void) fprintf(stderr, gettext("key_write failed")); 398*0Sstevel@tonic-gate key_free(prv); 399*0Sstevel@tonic-gate (void) fprintf(stdout, "\n"); 400*0Sstevel@tonic-gate exit(0); 401*0Sstevel@tonic-gate } 402*0Sstevel@tonic-gate 403*0Sstevel@tonic-gate #ifdef SMARTCARD 404*0Sstevel@tonic-gate static void 405*0Sstevel@tonic-gate do_upload(struct passwd *pw, const char *sc_reader_id) 406*0Sstevel@tonic-gate { 407*0Sstevel@tonic-gate Key *prv = NULL; 408*0Sstevel@tonic-gate struct stat st; 409*0Sstevel@tonic-gate int ret; 410*0Sstevel@tonic-gate 411*0Sstevel@tonic-gate if (!have_identity) 412*0Sstevel@tonic-gate ask_filename(pw, gettext("Enter file in which the key is")); 413*0Sstevel@tonic-gate if (stat(identity_file, &st) < 0) { 414*0Sstevel@tonic-gate perror(identity_file); 415*0Sstevel@tonic-gate exit(1); 416*0Sstevel@tonic-gate } 417*0Sstevel@tonic-gate prv = load_identity(identity_file); 418*0Sstevel@tonic-gate if (prv == NULL) { 419*0Sstevel@tonic-gate error("load failed"); 420*0Sstevel@tonic-gate exit(1); 421*0Sstevel@tonic-gate } 422*0Sstevel@tonic-gate ret = sc_put_key(prv, sc_reader_id); 423*0Sstevel@tonic-gate key_free(prv); 424*0Sstevel@tonic-gate if (ret < 0) 425*0Sstevel@tonic-gate exit(1); 426*0Sstevel@tonic-gate log("loading key done"); 427*0Sstevel@tonic-gate exit(0); 428*0Sstevel@tonic-gate } 429*0Sstevel@tonic-gate 430*0Sstevel@tonic-gate static void 431*0Sstevel@tonic-gate do_download(struct passwd *pw, const char *sc_reader_id) 432*0Sstevel@tonic-gate { 433*0Sstevel@tonic-gate Key **keys = NULL; 434*0Sstevel@tonic-gate int i; 435*0Sstevel@tonic-gate 436*0Sstevel@tonic-gate keys = sc_get_keys(sc_reader_id, NULL); 437*0Sstevel@tonic-gate if (keys == NULL) 438*0Sstevel@tonic-gate fatal("cannot read public key from smartcard"); 439*0Sstevel@tonic-gate for (i = 0; keys[i]; i++) { 440*0Sstevel@tonic-gate key_write(keys[i], stdout); 441*0Sstevel@tonic-gate key_free(keys[i]); 442*0Sstevel@tonic-gate (void) fprintf(stdout, "\n"); 443*0Sstevel@tonic-gate } 444*0Sstevel@tonic-gate xfree(keys); 445*0Sstevel@tonic-gate exit(0); 446*0Sstevel@tonic-gate } 447*0Sstevel@tonic-gate #endif /* SMARTCARD */ 448*0Sstevel@tonic-gate 449*0Sstevel@tonic-gate static void 450*0Sstevel@tonic-gate do_fingerprint(struct passwd *pw) 451*0Sstevel@tonic-gate { 452*0Sstevel@tonic-gate FILE *f; 453*0Sstevel@tonic-gate Key *public; 454*0Sstevel@tonic-gate char *comment = NULL, *cp, *ep, line[16*1024], *fp; 455*0Sstevel@tonic-gate int i, skip = 0, num = 1, invalid = 1; 456*0Sstevel@tonic-gate enum fp_rep rep; 457*0Sstevel@tonic-gate enum fp_type fptype; 458*0Sstevel@tonic-gate struct stat st; 459*0Sstevel@tonic-gate 460*0Sstevel@tonic-gate fptype = print_bubblebabble ? SSH_FP_SHA1 : SSH_FP_MD5; 461*0Sstevel@tonic-gate rep = print_bubblebabble ? SSH_FP_BUBBLEBABBLE : SSH_FP_HEX; 462*0Sstevel@tonic-gate 463*0Sstevel@tonic-gate if (!have_identity) 464*0Sstevel@tonic-gate ask_filename(pw, gettext("Enter file in which the key is")); 465*0Sstevel@tonic-gate if (stat(identity_file, &st) < 0) { 466*0Sstevel@tonic-gate perror(identity_file); 467*0Sstevel@tonic-gate exit(1); 468*0Sstevel@tonic-gate } 469*0Sstevel@tonic-gate public = key_load_public(identity_file, &comment); 470*0Sstevel@tonic-gate if (public != NULL) { 471*0Sstevel@tonic-gate fp = key_fingerprint(public, fptype, rep); 472*0Sstevel@tonic-gate (void) printf("%u %s %s\n", key_size(public), fp, comment); 473*0Sstevel@tonic-gate key_free(public); 474*0Sstevel@tonic-gate xfree(comment); 475*0Sstevel@tonic-gate xfree(fp); 476*0Sstevel@tonic-gate exit(0); 477*0Sstevel@tonic-gate } 478*0Sstevel@tonic-gate if (comment) 479*0Sstevel@tonic-gate xfree(comment); 480*0Sstevel@tonic-gate 481*0Sstevel@tonic-gate f = fopen(identity_file, "r"); 482*0Sstevel@tonic-gate if (f != NULL) { 483*0Sstevel@tonic-gate while (fgets(line, sizeof(line), f)) { 484*0Sstevel@tonic-gate i = strlen(line) - 1; 485*0Sstevel@tonic-gate if (line[i] != '\n') { 486*0Sstevel@tonic-gate error("line %d too long: %.40s...", num, line); 487*0Sstevel@tonic-gate skip = 1; 488*0Sstevel@tonic-gate continue; 489*0Sstevel@tonic-gate } 490*0Sstevel@tonic-gate num++; 491*0Sstevel@tonic-gate if (skip) { 492*0Sstevel@tonic-gate skip = 0; 493*0Sstevel@tonic-gate continue; 494*0Sstevel@tonic-gate } 495*0Sstevel@tonic-gate line[i] = '\0'; 496*0Sstevel@tonic-gate 497*0Sstevel@tonic-gate /* Skip leading whitespace, empty and comment lines. */ 498*0Sstevel@tonic-gate for (cp = line; *cp == ' ' || *cp == '\t'; cp++) 499*0Sstevel@tonic-gate ; 500*0Sstevel@tonic-gate if (!*cp || *cp == '\n' || *cp == '#') 501*0Sstevel@tonic-gate continue ; 502*0Sstevel@tonic-gate i = strtol(cp, &ep, 10); 503*0Sstevel@tonic-gate if (i == 0 || ep == NULL || (*ep != ' ' && *ep != '\t')) { 504*0Sstevel@tonic-gate int quoted = 0; 505*0Sstevel@tonic-gate comment = cp; 506*0Sstevel@tonic-gate for (; *cp && (quoted || (*cp != ' ' && 507*0Sstevel@tonic-gate *cp != '\t')); cp++) { 508*0Sstevel@tonic-gate if (*cp == '\\' && cp[1] == '"') 509*0Sstevel@tonic-gate cp++; /* Skip both */ 510*0Sstevel@tonic-gate else if (*cp == '"') 511*0Sstevel@tonic-gate quoted = !quoted; 512*0Sstevel@tonic-gate } 513*0Sstevel@tonic-gate if (!*cp) 514*0Sstevel@tonic-gate continue; 515*0Sstevel@tonic-gate *cp++ = '\0'; 516*0Sstevel@tonic-gate } 517*0Sstevel@tonic-gate ep = cp; 518*0Sstevel@tonic-gate public = key_new(KEY_RSA1); 519*0Sstevel@tonic-gate if (key_read(public, &cp) != 1) { 520*0Sstevel@tonic-gate cp = ep; 521*0Sstevel@tonic-gate key_free(public); 522*0Sstevel@tonic-gate public = key_new(KEY_UNSPEC); 523*0Sstevel@tonic-gate if (key_read(public, &cp) != 1) { 524*0Sstevel@tonic-gate key_free(public); 525*0Sstevel@tonic-gate continue; 526*0Sstevel@tonic-gate } 527*0Sstevel@tonic-gate } 528*0Sstevel@tonic-gate comment = *cp ? cp : comment; 529*0Sstevel@tonic-gate fp = key_fingerprint(public, fptype, rep); 530*0Sstevel@tonic-gate (void) printf("%u %s %s\n", key_size(public), fp, 531*0Sstevel@tonic-gate comment ? comment : gettext("no comment")); 532*0Sstevel@tonic-gate xfree(fp); 533*0Sstevel@tonic-gate key_free(public); 534*0Sstevel@tonic-gate invalid = 0; 535*0Sstevel@tonic-gate } 536*0Sstevel@tonic-gate (void) fclose(f); 537*0Sstevel@tonic-gate } 538*0Sstevel@tonic-gate if (invalid) { 539*0Sstevel@tonic-gate (void) printf(gettext("%s is not a public key file.\n"), 540*0Sstevel@tonic-gate identity_file); 541*0Sstevel@tonic-gate exit(1); 542*0Sstevel@tonic-gate } 543*0Sstevel@tonic-gate exit(0); 544*0Sstevel@tonic-gate } 545*0Sstevel@tonic-gate 546*0Sstevel@tonic-gate /* 547*0Sstevel@tonic-gate * Perform changing a passphrase. The argument is the passwd structure 548*0Sstevel@tonic-gate * for the current user. 549*0Sstevel@tonic-gate */ 550*0Sstevel@tonic-gate static void 551*0Sstevel@tonic-gate do_change_passphrase(struct passwd *pw) 552*0Sstevel@tonic-gate { 553*0Sstevel@tonic-gate char *comment; 554*0Sstevel@tonic-gate char *old_passphrase, *passphrase1, *passphrase2; 555*0Sstevel@tonic-gate struct stat st; 556*0Sstevel@tonic-gate Key *private; 557*0Sstevel@tonic-gate 558*0Sstevel@tonic-gate if (!have_identity) 559*0Sstevel@tonic-gate ask_filename(pw, gettext("Enter file in which the key is")); 560*0Sstevel@tonic-gate if (stat(identity_file, &st) < 0) { 561*0Sstevel@tonic-gate perror(identity_file); 562*0Sstevel@tonic-gate exit(1); 563*0Sstevel@tonic-gate } 564*0Sstevel@tonic-gate /* Try to load the file with empty passphrase. */ 565*0Sstevel@tonic-gate private = key_load_private(identity_file, "", &comment); 566*0Sstevel@tonic-gate if (private == NULL) { 567*0Sstevel@tonic-gate if (identity_passphrase) 568*0Sstevel@tonic-gate old_passphrase = xstrdup(identity_passphrase); 569*0Sstevel@tonic-gate else 570*0Sstevel@tonic-gate old_passphrase = 571*0Sstevel@tonic-gate read_passphrase(gettext("Enter old passphrase: "), 572*0Sstevel@tonic-gate RP_ALLOW_STDIN); 573*0Sstevel@tonic-gate private = key_load_private(identity_file, old_passphrase, 574*0Sstevel@tonic-gate &comment); 575*0Sstevel@tonic-gate (void) memset(old_passphrase, 0, strlen(old_passphrase)); 576*0Sstevel@tonic-gate xfree(old_passphrase); 577*0Sstevel@tonic-gate if (private == NULL) { 578*0Sstevel@tonic-gate (void) printf(gettext("Bad passphrase.\n")); 579*0Sstevel@tonic-gate exit(1); 580*0Sstevel@tonic-gate } 581*0Sstevel@tonic-gate } 582*0Sstevel@tonic-gate (void) printf(gettext("Key has comment '%s'\n"), comment); 583*0Sstevel@tonic-gate 584*0Sstevel@tonic-gate /* Ask the new passphrase (twice). */ 585*0Sstevel@tonic-gate if (identity_new_passphrase) { 586*0Sstevel@tonic-gate passphrase1 = xstrdup(identity_new_passphrase); 587*0Sstevel@tonic-gate passphrase2 = NULL; 588*0Sstevel@tonic-gate } else { 589*0Sstevel@tonic-gate passphrase1 = 590*0Sstevel@tonic-gate read_passphrase(gettext("Enter new passphrase (empty" 591*0Sstevel@tonic-gate " for no passphrase): "), RP_ALLOW_STDIN); 592*0Sstevel@tonic-gate passphrase2 = read_passphrase(gettext("Enter same " 593*0Sstevel@tonic-gate "passphrase again: "), RP_ALLOW_STDIN); 594*0Sstevel@tonic-gate 595*0Sstevel@tonic-gate /* Verify that they are the same. */ 596*0Sstevel@tonic-gate if (strcmp(passphrase1, passphrase2) != 0) { 597*0Sstevel@tonic-gate (void) memset(passphrase1, 0, strlen(passphrase1)); 598*0Sstevel@tonic-gate (void) memset(passphrase2, 0, strlen(passphrase2)); 599*0Sstevel@tonic-gate xfree(passphrase1); 600*0Sstevel@tonic-gate xfree(passphrase2); 601*0Sstevel@tonic-gate (void) printf(gettext("Pass phrases do not match. Try " 602*0Sstevel@tonic-gate "again.\n")); 603*0Sstevel@tonic-gate exit(1); 604*0Sstevel@tonic-gate } 605*0Sstevel@tonic-gate /* Destroy the other copy. */ 606*0Sstevel@tonic-gate (void) memset(passphrase2, 0, strlen(passphrase2)); 607*0Sstevel@tonic-gate xfree(passphrase2); 608*0Sstevel@tonic-gate } 609*0Sstevel@tonic-gate 610*0Sstevel@tonic-gate /* Save the file using the new passphrase. */ 611*0Sstevel@tonic-gate if (!key_save_private(private, identity_file, passphrase1, comment)) { 612*0Sstevel@tonic-gate (void) printf(gettext("Saving the key failed: %s.\n"), identity_file); 613*0Sstevel@tonic-gate (void) memset(passphrase1, 0, strlen(passphrase1)); 614*0Sstevel@tonic-gate xfree(passphrase1); 615*0Sstevel@tonic-gate key_free(private); 616*0Sstevel@tonic-gate xfree(comment); 617*0Sstevel@tonic-gate exit(1); 618*0Sstevel@tonic-gate } 619*0Sstevel@tonic-gate /* Destroy the passphrase and the copy of the key in memory. */ 620*0Sstevel@tonic-gate (void) memset(passphrase1, 0, strlen(passphrase1)); 621*0Sstevel@tonic-gate xfree(passphrase1); 622*0Sstevel@tonic-gate key_free(private); /* Destroys contents */ 623*0Sstevel@tonic-gate xfree(comment); 624*0Sstevel@tonic-gate 625*0Sstevel@tonic-gate (void) printf(gettext("Your identification has been saved with the new " 626*0Sstevel@tonic-gate "passphrase.\n")); 627*0Sstevel@tonic-gate exit(0); 628*0Sstevel@tonic-gate } 629*0Sstevel@tonic-gate 630*0Sstevel@tonic-gate /* 631*0Sstevel@tonic-gate * Change the comment of a private key file. 632*0Sstevel@tonic-gate */ 633*0Sstevel@tonic-gate static void 634*0Sstevel@tonic-gate do_change_comment(struct passwd *pw) 635*0Sstevel@tonic-gate { 636*0Sstevel@tonic-gate char new_comment[1024], *comment, *passphrase; 637*0Sstevel@tonic-gate Key *private; 638*0Sstevel@tonic-gate Key *public; 639*0Sstevel@tonic-gate struct stat st; 640*0Sstevel@tonic-gate FILE *f; 641*0Sstevel@tonic-gate int fd; 642*0Sstevel@tonic-gate 643*0Sstevel@tonic-gate if (!have_identity) 644*0Sstevel@tonic-gate ask_filename(pw, gettext("Enter file in which the key is")); 645*0Sstevel@tonic-gate if (stat(identity_file, &st) < 0) { 646*0Sstevel@tonic-gate perror(identity_file); 647*0Sstevel@tonic-gate exit(1); 648*0Sstevel@tonic-gate } 649*0Sstevel@tonic-gate private = key_load_private(identity_file, "", &comment); 650*0Sstevel@tonic-gate if (private == NULL) { 651*0Sstevel@tonic-gate if (identity_passphrase) 652*0Sstevel@tonic-gate passphrase = xstrdup(identity_passphrase); 653*0Sstevel@tonic-gate else if (identity_new_passphrase) 654*0Sstevel@tonic-gate passphrase = xstrdup(identity_new_passphrase); 655*0Sstevel@tonic-gate else 656*0Sstevel@tonic-gate passphrase = 657*0Sstevel@tonic-gate read_passphrase(gettext("Enter passphrase: "), 658*0Sstevel@tonic-gate RP_ALLOW_STDIN); 659*0Sstevel@tonic-gate /* Try to load using the passphrase. */ 660*0Sstevel@tonic-gate private = key_load_private(identity_file, passphrase, &comment); 661*0Sstevel@tonic-gate if (private == NULL) { 662*0Sstevel@tonic-gate (void) memset(passphrase, 0, strlen(passphrase)); 663*0Sstevel@tonic-gate xfree(passphrase); 664*0Sstevel@tonic-gate (void) printf(gettext("Bad passphrase.\n")); 665*0Sstevel@tonic-gate exit(1); 666*0Sstevel@tonic-gate } 667*0Sstevel@tonic-gate } else { 668*0Sstevel@tonic-gate passphrase = xstrdup(""); 669*0Sstevel@tonic-gate } 670*0Sstevel@tonic-gate if (private->type != KEY_RSA1) { 671*0Sstevel@tonic-gate (void) fprintf(stderr, gettext("Comments are only supported for " 672*0Sstevel@tonic-gate "RSA1 keys.\n")); 673*0Sstevel@tonic-gate key_free(private); 674*0Sstevel@tonic-gate exit(1); 675*0Sstevel@tonic-gate } 676*0Sstevel@tonic-gate (void) printf(gettext("Key now has comment '%s'\n"), comment); 677*0Sstevel@tonic-gate 678*0Sstevel@tonic-gate if (identity_comment) { 679*0Sstevel@tonic-gate (void) strlcpy(new_comment, identity_comment, sizeof(new_comment)); 680*0Sstevel@tonic-gate } else { 681*0Sstevel@tonic-gate (void) printf(gettext("Enter new comment: ")); 682*0Sstevel@tonic-gate (void) fflush(stdout); 683*0Sstevel@tonic-gate if (!fgets(new_comment, sizeof(new_comment), stdin)) { 684*0Sstevel@tonic-gate (void) memset(passphrase, 0, strlen(passphrase)); 685*0Sstevel@tonic-gate key_free(private); 686*0Sstevel@tonic-gate exit(1); 687*0Sstevel@tonic-gate } 688*0Sstevel@tonic-gate if (strchr(new_comment, '\n')) 689*0Sstevel@tonic-gate *strchr(new_comment, '\n') = 0; 690*0Sstevel@tonic-gate } 691*0Sstevel@tonic-gate 692*0Sstevel@tonic-gate /* Save the file using the new passphrase. */ 693*0Sstevel@tonic-gate if (!key_save_private(private, identity_file, passphrase, new_comment)) { 694*0Sstevel@tonic-gate (void) printf(gettext("Saving the key failed: %s.\n"), identity_file); 695*0Sstevel@tonic-gate (void) memset(passphrase, 0, strlen(passphrase)); 696*0Sstevel@tonic-gate xfree(passphrase); 697*0Sstevel@tonic-gate key_free(private); 698*0Sstevel@tonic-gate xfree(comment); 699*0Sstevel@tonic-gate exit(1); 700*0Sstevel@tonic-gate } 701*0Sstevel@tonic-gate (void) memset(passphrase, 0, strlen(passphrase)); 702*0Sstevel@tonic-gate xfree(passphrase); 703*0Sstevel@tonic-gate public = key_from_private(private); 704*0Sstevel@tonic-gate key_free(private); 705*0Sstevel@tonic-gate 706*0Sstevel@tonic-gate (void) strlcat(identity_file, ".pub", sizeof(identity_file)); 707*0Sstevel@tonic-gate fd = open(identity_file, O_WRONLY | O_CREAT | O_TRUNC, 0644); 708*0Sstevel@tonic-gate if (fd == -1) { 709*0Sstevel@tonic-gate (void) printf(gettext("Could not save your public key in %s\n"), 710*0Sstevel@tonic-gate identity_file); 711*0Sstevel@tonic-gate exit(1); 712*0Sstevel@tonic-gate } 713*0Sstevel@tonic-gate f = fdopen(fd, "w"); 714*0Sstevel@tonic-gate if (f == NULL) { 715*0Sstevel@tonic-gate (void) printf(gettext("fdopen %s failed"), identity_file); 716*0Sstevel@tonic-gate exit(1); 717*0Sstevel@tonic-gate } 718*0Sstevel@tonic-gate if (!key_write(public, f)) 719*0Sstevel@tonic-gate (void) fprintf(stderr, gettext("write key failed")); 720*0Sstevel@tonic-gate key_free(public); 721*0Sstevel@tonic-gate (void) fprintf(f, " %s\n", new_comment); 722*0Sstevel@tonic-gate (void) fclose(f); 723*0Sstevel@tonic-gate 724*0Sstevel@tonic-gate xfree(comment); 725*0Sstevel@tonic-gate 726*0Sstevel@tonic-gate (void) printf(gettext("The comment in your key file has been changed.\n")); 727*0Sstevel@tonic-gate exit(0); 728*0Sstevel@tonic-gate } 729*0Sstevel@tonic-gate 730*0Sstevel@tonic-gate static void 731*0Sstevel@tonic-gate usage(void) 732*0Sstevel@tonic-gate { 733*0Sstevel@tonic-gate (void) fprintf(stderr, gettext( 734*0Sstevel@tonic-gate "Usage: %s [options]\n" 735*0Sstevel@tonic-gate "Options:\n" 736*0Sstevel@tonic-gate " -b bits Number of bits in the key to create.\n" 737*0Sstevel@tonic-gate " -c Change comment in private and public key files.\n" 738*0Sstevel@tonic-gate " -e Convert OpenSSH to IETF SECSH key file.\n" 739*0Sstevel@tonic-gate " -f filename Filename of the key file.\n" 740*0Sstevel@tonic-gate " -i Convert IETF SECSH to OpenSSH key file.\n" 741*0Sstevel@tonic-gate " -l Show fingerprint of key file.\n" 742*0Sstevel@tonic-gate " -p Change passphrase of private key file.\n" 743*0Sstevel@tonic-gate " -q Quiet.\n" 744*0Sstevel@tonic-gate " -y Read private key file and print public key.\n" 745*0Sstevel@tonic-gate " -t type Specify type of key to create.\n" 746*0Sstevel@tonic-gate " -B Show bubblebabble digest of key file.\n" 747*0Sstevel@tonic-gate " -C comment Provide new comment.\n" 748*0Sstevel@tonic-gate " -N phrase Provide new passphrase.\n" 749*0Sstevel@tonic-gate " -P phrase Provide old passphrase.\n" 750*0Sstevel@tonic-gate #ifdef SMARTCARD 751*0Sstevel@tonic-gate " -D reader Download public key from smartcard.\n" 752*0Sstevel@tonic-gate " -U reader Upload private key to smartcard.\n" 753*0Sstevel@tonic-gate #endif /* SMARTCARD */ 754*0Sstevel@tonic-gate ), __progname); 755*0Sstevel@tonic-gate 756*0Sstevel@tonic-gate exit(1); 757*0Sstevel@tonic-gate } 758*0Sstevel@tonic-gate 759*0Sstevel@tonic-gate /* 760*0Sstevel@tonic-gate * Main program for key management. 761*0Sstevel@tonic-gate */ 762*0Sstevel@tonic-gate int 763*0Sstevel@tonic-gate main(int ac, char **av) 764*0Sstevel@tonic-gate { 765*0Sstevel@tonic-gate char dotsshdir[MAXPATHLEN], comment[1024], *passphrase1, *passphrase2; 766*0Sstevel@tonic-gate char *reader_id = NULL; 767*0Sstevel@tonic-gate Key *private, *public; 768*0Sstevel@tonic-gate struct passwd *pw; 769*0Sstevel@tonic-gate struct stat st; 770*0Sstevel@tonic-gate int opt, type, fd; 771*0Sstevel@tonic-gate #ifdef SMARTCARD 772*0Sstevel@tonic-gate int download = 0; 773*0Sstevel@tonic-gate #endif /* SMARTCARD */ 774*0Sstevel@tonic-gate FILE *f; 775*0Sstevel@tonic-gate 776*0Sstevel@tonic-gate extern int optind; 777*0Sstevel@tonic-gate extern char *optarg; 778*0Sstevel@tonic-gate 779*0Sstevel@tonic-gate __progname = get_progname(av[0]); 780*0Sstevel@tonic-gate 781*0Sstevel@tonic-gate (void) g11n_setlocale(LC_ALL, ""); 782*0Sstevel@tonic-gate 783*0Sstevel@tonic-gate SSLeay_add_all_algorithms(); 784*0Sstevel@tonic-gate init_rng(); 785*0Sstevel@tonic-gate seed_rng(); 786*0Sstevel@tonic-gate 787*0Sstevel@tonic-gate /* we need this for the home * directory. */ 788*0Sstevel@tonic-gate pw = getpwuid(getuid()); 789*0Sstevel@tonic-gate if (!pw) { 790*0Sstevel@tonic-gate (void) printf(gettext("You don't exist, go away!\n")); 791*0Sstevel@tonic-gate exit(1); 792*0Sstevel@tonic-gate } 793*0Sstevel@tonic-gate if (gethostname(hostname, sizeof(hostname)) < 0) { 794*0Sstevel@tonic-gate perror("gethostname"); 795*0Sstevel@tonic-gate exit(1); 796*0Sstevel@tonic-gate } 797*0Sstevel@tonic-gate 798*0Sstevel@tonic-gate #ifdef SMARTCARD 799*0Sstevel@tonic-gate #define GETOPT_ARGS "deiqpclBRxXyb:f:t:U:D:P:N:C:" 800*0Sstevel@tonic-gate #else 801*0Sstevel@tonic-gate #define GETOPT_ARGS "deiqpclBRxXyb:f:t:P:N:C:" 802*0Sstevel@tonic-gate #endif /* SMARTCARD */ 803*0Sstevel@tonic-gate while ((opt = getopt(ac, av, GETOPT_ARGS)) != -1) { 804*0Sstevel@tonic-gate switch (opt) { 805*0Sstevel@tonic-gate case 'b': 806*0Sstevel@tonic-gate bits = atoi(optarg); 807*0Sstevel@tonic-gate if (bits < 512 || bits > 32768) { 808*0Sstevel@tonic-gate (void) printf(gettext("Bits has bad value.\n")); 809*0Sstevel@tonic-gate exit(1); 810*0Sstevel@tonic-gate } 811*0Sstevel@tonic-gate break; 812*0Sstevel@tonic-gate case 'l': 813*0Sstevel@tonic-gate print_fingerprint = 1; 814*0Sstevel@tonic-gate break; 815*0Sstevel@tonic-gate case 'B': 816*0Sstevel@tonic-gate print_bubblebabble = 1; 817*0Sstevel@tonic-gate break; 818*0Sstevel@tonic-gate case 'p': 819*0Sstevel@tonic-gate change_passphrase = 1; 820*0Sstevel@tonic-gate break; 821*0Sstevel@tonic-gate case 'c': 822*0Sstevel@tonic-gate change_comment = 1; 823*0Sstevel@tonic-gate break; 824*0Sstevel@tonic-gate case 'f': 825*0Sstevel@tonic-gate (void) strlcpy(identity_file, optarg, sizeof(identity_file)); 826*0Sstevel@tonic-gate have_identity = 1; 827*0Sstevel@tonic-gate break; 828*0Sstevel@tonic-gate case 'P': 829*0Sstevel@tonic-gate identity_passphrase = optarg; 830*0Sstevel@tonic-gate break; 831*0Sstevel@tonic-gate case 'N': 832*0Sstevel@tonic-gate identity_new_passphrase = optarg; 833*0Sstevel@tonic-gate break; 834*0Sstevel@tonic-gate case 'C': 835*0Sstevel@tonic-gate identity_comment = optarg; 836*0Sstevel@tonic-gate break; 837*0Sstevel@tonic-gate case 'q': 838*0Sstevel@tonic-gate quiet = 1; 839*0Sstevel@tonic-gate break; 840*0Sstevel@tonic-gate case 'R': 841*0Sstevel@tonic-gate /* unused */ 842*0Sstevel@tonic-gate exit(0); 843*0Sstevel@tonic-gate break; 844*0Sstevel@tonic-gate case 'e': 845*0Sstevel@tonic-gate case 'x': 846*0Sstevel@tonic-gate /* export key */ 847*0Sstevel@tonic-gate convert_to_ssh2 = 1; 848*0Sstevel@tonic-gate break; 849*0Sstevel@tonic-gate case 'i': 850*0Sstevel@tonic-gate case 'X': 851*0Sstevel@tonic-gate /* import key */ 852*0Sstevel@tonic-gate convert_from_ssh2 = 1; 853*0Sstevel@tonic-gate break; 854*0Sstevel@tonic-gate case 'y': 855*0Sstevel@tonic-gate print_public = 1; 856*0Sstevel@tonic-gate break; 857*0Sstevel@tonic-gate case 'd': 858*0Sstevel@tonic-gate key_type_name = "dsa"; 859*0Sstevel@tonic-gate break; 860*0Sstevel@tonic-gate case 't': 861*0Sstevel@tonic-gate key_type_name = optarg; 862*0Sstevel@tonic-gate break; 863*0Sstevel@tonic-gate #ifdef SMARTCARD 864*0Sstevel@tonic-gate case 'D': 865*0Sstevel@tonic-gate download = 1; 866*0Sstevel@tonic-gate case 'U': 867*0Sstevel@tonic-gate reader_id = optarg; 868*0Sstevel@tonic-gate break; 869*0Sstevel@tonic-gate #endif 870*0Sstevel@tonic-gate case '?': 871*0Sstevel@tonic-gate default: 872*0Sstevel@tonic-gate usage(); 873*0Sstevel@tonic-gate } 874*0Sstevel@tonic-gate } 875*0Sstevel@tonic-gate if (optind < ac) { 876*0Sstevel@tonic-gate (void) printf(gettext("Too many arguments.\n")); 877*0Sstevel@tonic-gate usage(); 878*0Sstevel@tonic-gate } 879*0Sstevel@tonic-gate if (change_passphrase && change_comment) { 880*0Sstevel@tonic-gate (void) printf(gettext("Can only have one of -p and -c.\n")); 881*0Sstevel@tonic-gate usage(); 882*0Sstevel@tonic-gate } 883*0Sstevel@tonic-gate if (print_fingerprint || print_bubblebabble) 884*0Sstevel@tonic-gate do_fingerprint(pw); 885*0Sstevel@tonic-gate if (change_passphrase) 886*0Sstevel@tonic-gate do_change_passphrase(pw); 887*0Sstevel@tonic-gate if (change_comment) 888*0Sstevel@tonic-gate do_change_comment(pw); 889*0Sstevel@tonic-gate if (convert_to_ssh2) 890*0Sstevel@tonic-gate do_convert_to_ssh2(pw); 891*0Sstevel@tonic-gate if (convert_from_ssh2) 892*0Sstevel@tonic-gate do_convert_from_ssh2(pw); 893*0Sstevel@tonic-gate if (print_public) 894*0Sstevel@tonic-gate do_print_public(pw); 895*0Sstevel@tonic-gate if (reader_id != NULL) { 896*0Sstevel@tonic-gate #ifdef SMARTCARD 897*0Sstevel@tonic-gate if (download) 898*0Sstevel@tonic-gate do_download(pw, reader_id); 899*0Sstevel@tonic-gate else 900*0Sstevel@tonic-gate do_upload(pw, reader_id); 901*0Sstevel@tonic-gate #else /* SMARTCARD */ 902*0Sstevel@tonic-gate fatal("no support for smartcards."); 903*0Sstevel@tonic-gate #endif /* SMARTCARD */ 904*0Sstevel@tonic-gate } 905*0Sstevel@tonic-gate 906*0Sstevel@tonic-gate arc4random_stir(); 907*0Sstevel@tonic-gate 908*0Sstevel@tonic-gate if (key_type_name == NULL) { 909*0Sstevel@tonic-gate (void) printf(gettext("You must specify a key type (-t).\n")); 910*0Sstevel@tonic-gate usage(); 911*0Sstevel@tonic-gate } 912*0Sstevel@tonic-gate type = key_type_from_name(key_type_name); 913*0Sstevel@tonic-gate if (type == KEY_UNSPEC) { 914*0Sstevel@tonic-gate (void) fprintf(stderr, gettext("unknown key type %s\n"), 915*0Sstevel@tonic-gate key_type_name); 916*0Sstevel@tonic-gate exit(1); 917*0Sstevel@tonic-gate } 918*0Sstevel@tonic-gate if (!quiet) 919*0Sstevel@tonic-gate (void) printf(gettext("Generating public/private %s key pair.\n"), 920*0Sstevel@tonic-gate key_type_name); 921*0Sstevel@tonic-gate private = key_generate(type, bits); 922*0Sstevel@tonic-gate if (private == NULL) { 923*0Sstevel@tonic-gate (void) fprintf(stderr, gettext("key_generate failed")); 924*0Sstevel@tonic-gate exit(1); 925*0Sstevel@tonic-gate } 926*0Sstevel@tonic-gate public = key_from_private(private); 927*0Sstevel@tonic-gate 928*0Sstevel@tonic-gate if (!have_identity) 929*0Sstevel@tonic-gate ask_filename(pw, gettext("Enter file in which to save the key")); 930*0Sstevel@tonic-gate 931*0Sstevel@tonic-gate /* Create ~/.ssh directory if it doesn\'t already exist. */ 932*0Sstevel@tonic-gate (void) snprintf(dotsshdir, sizeof dotsshdir, "%s/%s", pw->pw_dir, _PATH_SSH_USER_DIR); 933*0Sstevel@tonic-gate if (strstr(identity_file, dotsshdir) != NULL && 934*0Sstevel@tonic-gate stat(dotsshdir, &st) < 0) { 935*0Sstevel@tonic-gate if (mkdir(dotsshdir, 0700) < 0) 936*0Sstevel@tonic-gate error("Could not create directory '%s'.", dotsshdir); 937*0Sstevel@tonic-gate else if (!quiet) 938*0Sstevel@tonic-gate (void) printf(gettext("Created directory '%s'.\n"), dotsshdir); 939*0Sstevel@tonic-gate } 940*0Sstevel@tonic-gate /* If the file already exists, ask the user to confirm. */ 941*0Sstevel@tonic-gate if (stat(identity_file, &st) >= 0) { 942*0Sstevel@tonic-gate char yesno[128]; 943*0Sstevel@tonic-gate (void) printf(gettext("%s already exists.\n"), identity_file); 944*0Sstevel@tonic-gate (void) printf(gettext("Overwrite (%s/%s)? "), 945*0Sstevel@tonic-gate nl_langinfo(YESSTR), nl_langinfo(NOSTR)); 946*0Sstevel@tonic-gate (void) fflush(stdout); 947*0Sstevel@tonic-gate if (fgets(yesno, sizeof(yesno), stdin) == NULL) 948*0Sstevel@tonic-gate exit(1); 949*0Sstevel@tonic-gate if (strcasecmp(yesno, nl_langinfo(YESSTR)) != 0) 950*0Sstevel@tonic-gate exit(1); 951*0Sstevel@tonic-gate } 952*0Sstevel@tonic-gate /* Ask for a passphrase (twice). */ 953*0Sstevel@tonic-gate if (identity_passphrase) 954*0Sstevel@tonic-gate passphrase1 = xstrdup(identity_passphrase); 955*0Sstevel@tonic-gate else if (identity_new_passphrase) 956*0Sstevel@tonic-gate passphrase1 = xstrdup(identity_new_passphrase); 957*0Sstevel@tonic-gate else { 958*0Sstevel@tonic-gate passphrase_again: 959*0Sstevel@tonic-gate passphrase1 = 960*0Sstevel@tonic-gate read_passphrase(gettext("Enter passphrase (empty " 961*0Sstevel@tonic-gate "for no passphrase): "), RP_ALLOW_STDIN); 962*0Sstevel@tonic-gate passphrase2 = read_passphrase(gettext("Enter same " 963*0Sstevel@tonic-gate "passphrase again: "), RP_ALLOW_STDIN); 964*0Sstevel@tonic-gate if (strcmp(passphrase1, passphrase2) != 0) { 965*0Sstevel@tonic-gate /* 966*0Sstevel@tonic-gate * The passphrases do not match. Clear them and 967*0Sstevel@tonic-gate * retry. 968*0Sstevel@tonic-gate */ 969*0Sstevel@tonic-gate (void) memset(passphrase1, 0, strlen(passphrase1)); 970*0Sstevel@tonic-gate (void) memset(passphrase2, 0, strlen(passphrase2)); 971*0Sstevel@tonic-gate xfree(passphrase1); 972*0Sstevel@tonic-gate xfree(passphrase2); 973*0Sstevel@tonic-gate (void) printf(gettext("Passphrases do not match. Try " 974*0Sstevel@tonic-gate "again.\n")); 975*0Sstevel@tonic-gate goto passphrase_again; 976*0Sstevel@tonic-gate } 977*0Sstevel@tonic-gate /* Clear the other copy of the passphrase. */ 978*0Sstevel@tonic-gate (void) memset(passphrase2, 0, strlen(passphrase2)); 979*0Sstevel@tonic-gate xfree(passphrase2); 980*0Sstevel@tonic-gate } 981*0Sstevel@tonic-gate 982*0Sstevel@tonic-gate if (identity_comment) { 983*0Sstevel@tonic-gate (void) strlcpy(comment, identity_comment, sizeof(comment)); 984*0Sstevel@tonic-gate } else { 985*0Sstevel@tonic-gate /* Create default commend field for the passphrase. */ 986*0Sstevel@tonic-gate (void) snprintf(comment, sizeof comment, "%s@%s", pw->pw_name, hostname); 987*0Sstevel@tonic-gate } 988*0Sstevel@tonic-gate 989*0Sstevel@tonic-gate /* Save the key with the given passphrase and comment. */ 990*0Sstevel@tonic-gate if (!key_save_private(private, identity_file, passphrase1, comment)) { 991*0Sstevel@tonic-gate (void) printf(gettext("Saving the key failed: %s.\n"), identity_file); 992*0Sstevel@tonic-gate (void) memset(passphrase1, 0, strlen(passphrase1)); 993*0Sstevel@tonic-gate xfree(passphrase1); 994*0Sstevel@tonic-gate exit(1); 995*0Sstevel@tonic-gate } 996*0Sstevel@tonic-gate /* Clear the passphrase. */ 997*0Sstevel@tonic-gate (void) memset(passphrase1, 0, strlen(passphrase1)); 998*0Sstevel@tonic-gate xfree(passphrase1); 999*0Sstevel@tonic-gate 1000*0Sstevel@tonic-gate /* Clear the private key and the random number generator. */ 1001*0Sstevel@tonic-gate key_free(private); 1002*0Sstevel@tonic-gate arc4random_stir(); 1003*0Sstevel@tonic-gate 1004*0Sstevel@tonic-gate if (!quiet) 1005*0Sstevel@tonic-gate (void) printf(gettext("Your identification has been saved in %s.\n"), 1006*0Sstevel@tonic-gate identity_file); 1007*0Sstevel@tonic-gate 1008*0Sstevel@tonic-gate (void) strlcat(identity_file, ".pub", sizeof(identity_file)); 1009*0Sstevel@tonic-gate fd = open(identity_file, O_WRONLY | O_CREAT | O_TRUNC, 0644); 1010*0Sstevel@tonic-gate if (fd == -1) { 1011*0Sstevel@tonic-gate (void) printf(gettext("Could not save your public key in %s\n"), 1012*0Sstevel@tonic-gate identity_file); 1013*0Sstevel@tonic-gate exit(1); 1014*0Sstevel@tonic-gate } 1015*0Sstevel@tonic-gate f = fdopen(fd, "w"); 1016*0Sstevel@tonic-gate if (f == NULL) { 1017*0Sstevel@tonic-gate (void) printf(gettext("fdopen %s failed"), identity_file); 1018*0Sstevel@tonic-gate exit(1); 1019*0Sstevel@tonic-gate } 1020*0Sstevel@tonic-gate if (!key_write(public, f)) 1021*0Sstevel@tonic-gate (void) fprintf(stderr, gettext("write key failed")); 1022*0Sstevel@tonic-gate (void) fprintf(f, " %s\n", comment); 1023*0Sstevel@tonic-gate (void) fclose(f); 1024*0Sstevel@tonic-gate 1025*0Sstevel@tonic-gate if (!quiet) { 1026*0Sstevel@tonic-gate char *fp = key_fingerprint(public, SSH_FP_MD5, SSH_FP_HEX); 1027*0Sstevel@tonic-gate (void) printf(gettext("Your public key has been saved in %s.\n"), 1028*0Sstevel@tonic-gate identity_file); 1029*0Sstevel@tonic-gate (void) printf(gettext("The key fingerprint is:\n")); 1030*0Sstevel@tonic-gate (void) printf("%s %s\n", fp, comment); 1031*0Sstevel@tonic-gate xfree(fp); 1032*0Sstevel@tonic-gate } 1033*0Sstevel@tonic-gate 1034*0Sstevel@tonic-gate key_free(public); 1035*0Sstevel@tonic-gate return(0); 1036*0Sstevel@tonic-gate /* NOTREACHED */ 1037*0Sstevel@tonic-gate } 1038