--- /dev/null
+typedef unsigned int __u_int;
+typedef unsigned long int __u_long;
+__extension__ typedef unsigned int __uid_t;
+__extension__ typedef long int __time_t;
+__extension__ typedef int __ssize_t;
+typedef __u_int u_int;
+typedef __u_long u_long;
+typedef __ssize_t ssize_t;
+typedef __time_t time_t;
+typedef unsigned int size_t;
+typedef unsigned int u_int32_t __attribute__ ((__mode__(__SI__)));
+typedef unsigned int u_int64_t __attribute__ ((__mode__(__DI__)));
+struct stat {
+};
+extern int *__errno_location(void) __attribute__ ((__nothrow__, __leaf__))
+ __attribute__ ((__const__));
+struct passwd {
+ char *pw_name;
+ __uid_t pw_uid;
+ char *pw_dir;
+};
+typedef struct _IO_FILE FILE;
+extern struct _IO_FILE *stdin;
+extern struct _IO_FILE *stdout;
+extern struct _IO_FILE *stderr;
+typedef struct {
+} Buffer;
+typedef struct bignum_st BIGNUM;
+extern ssize_t write(int __fd, const void *__buf, size_t __n)
+ __attribute__ ((__warn_unused_result__));
+typedef struct Key Key;
+enum types {
+ KEY_RSA1, KEY_RSA, KEY_DSA, KEY_ECDSA, KEY_ED25519, KEY_RSA_CERT,
+ KEY_DSA_CERT, KEY_ECDSA_CERT, KEY_ED25519_CERT, KEY_RSA_CERT_V00,
+ KEY_DSA_CERT_V00, KEY_UNSPEC
+};
+enum fp_type {
+ SSH_FP_SHA1, SSH_FP_MD5, SSH_FP_SHA256
+};
+enum fp_rep {
+ SSH_FP_HEX, SSH_FP_BUBBLEBABBLE, SSH_FP_RANDOMART
+};
+struct KeyCert {
+ u_int64_t serial;
+ char *key_id;
+ u_int nprincipals;
+ char **principals;
+ u_int64_t valid_after, valid_before;
+ Buffer critical;
+ Buffer extensions;
+ Key *signature_key;
+};
+struct Key {
+ int type;
+ struct KeyCert *cert;
+};
+typedef enum {
+ SYSLOG_FACILITY_DAEMON, SYSLOG_FACILITY_USER, SYSLOG_FACILITY_AUTH,
+ SYSLOG_FACILITY_LOCAL0, SYSLOG_FACILITY_LOCAL1,
+ SYSLOG_FACILITY_LOCAL2, SYSLOG_FACILITY_LOCAL3,
+ SYSLOG_FACILITY_LOCAL4, SYSLOG_FACILITY_LOCAL5,
+ SYSLOG_FACILITY_LOCAL6, SYSLOG_FACILITY_LOCAL7,
+ SYSLOG_FACILITY_NOT_SET = -1
+} SyslogFacility;
+typedef enum {
+ SYSLOG_LEVEL_QUIET, SYSLOG_LEVEL_FATAL, SYSLOG_LEVEL_ERROR,
+ SYSLOG_LEVEL_INFO, SYSLOG_LEVEL_VERBOSE, SYSLOG_LEVEL_DEBUG1,
+ SYSLOG_LEVEL_DEBUG2, SYSLOG_LEVEL_DEBUG3, SYSLOG_LEVEL_NOT_SET = -1
+} LogLevel;
+u_int32_t bits = 0;
+int change_passphrase = 0;
+int change_comment = 0;
+int quiet = 0;
+int log_level = SYSLOG_LEVEL_INFO;
+int hash_hosts = 0;
+int find_host = 0;
+int delete_host = 0;
+int show_cert = 0;
+int print_fingerprint = 0;
+int print_bubblebabble = 0;
+char identity_file[1024];
+int have_identity = 0;
+char *identity_passphrase = ((void *)0);
+char *identity_new_passphrase = ((void *)0);
+char *identity_comment = ((void *)0);
+char *ca_key_path = ((void *)0);
+unsigned long long cert_serial = 0;
+u_int cert_key_type = 1;
+char *cert_key_id = ((void *)0);
+char *cert_principals = ((void *)0);
+u_int32_t certflags_flags = ((1) | (1 << 1) | (1 << 2) | (1 << 3) | (1 << 4));
+int convert_to = 0;
+int convert_from = 0;
+enum {
+ FMT_RFC4716, FMT_PKCS8, FMT_PEM
+} convert_format = FMT_RFC4716;
+int print_public = 0;
+int print_generic = 0;
+char *key_type_name = ((void *)0);
+char *pkcs11provider = ((void *)0);
+int use_new_format = 0;
+char *new_format_cipher = ((void *)0);
+int rounds = 0;
+extern char *__progname;
+char hostname[64];
+static void do_download(struct passwd *pw)
+{
+ Key **keys = ((void *)0);
+ int i, nkeys;
+ enum fp_rep rep;
+ enum fp_type fptype;
+ char *fp, *ra;
+ fptype = print_bubblebabble ? SSH_FP_SHA1 : SSH_FP_MD5;
+ rep = print_bubblebabble ? SSH_FP_BUBBLEBABBLE : SSH_FP_HEX;
+ pkcs11_init(0);
+ nkeys = pkcs11_add_provider(pkcs11provider, ((void *)0), &keys);
+ if (nkeys <= 0)
+ fatal("cannot read public key from pkcs11");
+ for (i = 0; i < nkeys; i++) {
+ if (print_fingerprint) {
+ fp = key_fingerprint(keys[i], fptype, rep);
+ ra = key_fingerprint(keys[i], SSH_FP_MD5,
+ SSH_FP_RANDOMART);
+ printf("%u %s %s (PKCS11 key)\n", key_size(keys[i]), fp,
+ key_type(keys[i]));
+ if (log_level >= SYSLOG_LEVEL_VERBOSE)
+ printf("%s\n", ra);
+ free(ra);
+ free(fp);
+ key_write(keys[i], stdout);
+ fprintf(stdout, "\n");
+ }
+ key_free(keys[i]);
+ }
+ free(keys);
+ exit(0);
+}
+
+static void do_fingerprint(struct passwd *pw)
+{
+ FILE *f;
+ Key *public;
+ char *comment = ((void *)0), *cp, *ep, line[16 * 1024], *fp, *ra;
+ int i, skip = 0, num = 0, invalid = 1;
+ enum fp_rep rep;
+ enum fp_type fptype;
+ struct stat st;
+ fptype = print_bubblebabble ? SSH_FP_SHA1 : SSH_FP_MD5;
+ rep = print_bubblebabble ? SSH_FP_BUBBLEBABBLE : SSH_FP_HEX;
+ if (!have_identity)
+ ask_filename(pw, "Enter file in which the key is");
+ if (stat(identity_file, &st) < 0) {
+ perror(identity_file);
+ exit(1);
+ }
+ public = key_load_public(identity_file, &comment);
+ if (public != ((void *)0)) {
+ fp = key_fingerprint(public, fptype, rep);
+ ra = key_fingerprint(public, SSH_FP_MD5, SSH_FP_RANDOMART);
+ printf("%u %s %s (%s)\n", key_size(public), fp, comment,
+ key_type(public));
+ if (log_level >= SYSLOG_LEVEL_VERBOSE)
+ printf("%s\n", ra);
+ key_free(public);
+ free(comment);
+ free(ra);
+ free(fp);
+ exit(0);
+ }
+ if (comment) {
+ free(comment);
+ }
+ if ((f = fopen(identity_file, "r")) == ((void *)0))
+ fatal("%s: %s: %s", __progname, identity_file,
+ strerror((*__errno_location())));
+ while (fgets(line, sizeof(line), f)) {
+ if ((cp =
+ (__extension__
+ (__builtin_constant_p('\n') && !__builtin_constant_p(line)
+ && ('\n') == '\0' ? (char *)__rawmemchr(line,
+ '\n') :
+ __builtin_strchr(line, '\n')))) == ((void *)0)) {
+ error("line %d too long: %.40s...", num + 1, line);
+ skip = 1;
+ }
+ num++;
+ if (skip) {
+ continue;
+ }
+ *cp = '\0';
+ for (cp = line; *cp == ' ' || *cp == '\t'; cp++) ;
+ if (!*cp || *cp == '\n' || *cp == '#')
+ continue;
+ i = strtol(cp, &ep, 10);
+ if (i == 0 || ep == ((void *)0) || (*ep != ' ' && *ep != '\t')) {
+ int quoted = 0;
+ comment = cp;
+ for (;
+ *cp && (quoted || (*cp != ' ' && *cp != '\t'));
+ cp++) {
+ if (*cp == '\\' && cp[1] == '"')
+ cp++;
+ else if (*cp == '"')
+ quoted = !quoted;
+ }
+ if (!*cp)
+ continue;
+ *cp++ = '\0';
+ }
+ ep = cp;
+ public = key_new(KEY_RSA1);
+ if (key_read(public, &cp) != 1) {
+ cp = ep;
+ key_free(public);
+ public = key_new(KEY_UNSPEC);
+ if (key_read(public, &cp) != 1) {
+ key_free(public);
+ }
+ }
+ comment = *cp ? cp : comment;
+ fp = key_fingerprint(public, fptype, rep);
+ ra = key_fingerprint(public, SSH_FP_MD5, SSH_FP_RANDOMART);
+ printf("%u %s %s (%s)\n", key_size(public), fp,
+ comment ? comment : "no comment", key_type(public));
+ if (log_level >= SYSLOG_LEVEL_VERBOSE)
+ printf("%s\n", ra);
+ free(ra);
+ free(fp);
+ key_free(public);
+ invalid = 0;
+ }
+ fclose(f);
+ if (invalid) {
+ printf("%s is not a public key file.\n", identity_file);
+ exit(1);
+ }
+}
+
+static void do_gen_all_hostkeys(struct passwd *pw)
+{
+ struct {
+ char *key_type;
+ char *key_type_display;
+ char *path;
+ } key_types[] = {
+ {
+ "rsa1", "RSA1", "/etc/ssh" "/ssh_host_key"}
+ , {
+ "rsa", "RSA", "/etc/ssh" "/ssh_host_rsa_key"}
+ , {
+ ((void *)0), ((void *)0), ((void *)0)}
+ };
+ int first = 0;
+ struct stat st;
+ Key *private, *public;
+ char comment[1024];
+ int i, type, fd;
+ FILE *f;
+ for (i = 0; key_types[i].key_type; i++) {
+ if (stat(key_types[i].path, &st) == 0)
+ continue;
+ if ((*__errno_location()) != 2) {
+ printf("Could not stat %s: %s", key_types[i].path,
+ strerror((*__errno_location())));
+ }
+ if (first == 0) {
+ first = 1;
+ printf("%s: generating new host keys: ", __progname);
+ }
+ printf("%s ", key_types[i].key_type_display);
+ fflush(stdout);
+ type = key_type_from_name(key_types[i].key_type);
+ strlcpy(identity_file, key_types[i].path,
+ sizeof(identity_file));
+ bits = 0;
+ type_bits_valid(type, &bits);
+ private = key_generate(type, bits);
+ if (private == ((void *)0)) {
+ fprintf(stderr, "key_generate failed\n");
+ }
+ public = key_from_private(private);
+ snprintf(comment, sizeof comment, "%s@%s", pw->pw_name,
+ hostname);
+ if (!key_save_private
+ (private, identity_file, "", comment, use_new_format,
+ new_format_cipher, rounds)) {
+ printf("Saving the key failed: %s.\n", identity_file);
+ key_free(private);
+ key_free(public);
+ }
+ key_free(private);
+ strlcat(identity_file, ".pub", sizeof(identity_file));
+ fd = open(identity_file, 01 | 00000400 | 01000, 0644);
+ if (fd == -1) {
+ printf("Could not save your public key in %s\n",
+ identity_file);
+ key_free(public);
+ }
+ f = fdopen(fd, "w");
+ if (f == ((void *)0)) {
+ printf("fdopen %s failed\n", identity_file);
+ key_free(public);
+ }
+ if (!key_write(public, f)) {
+ fprintf(stderr, "write key failed\n");
+ key_free(public);
+ }
+ fprintf(f, " %s\n", comment);
+ fclose(f);
+ key_free(public);
+ }
+ if (first != 0)
+ printf("\n");
+}
+
+static void do_known_hosts(struct passwd *pw, const char *name)
+{
+ FILE *in, *out = stdout;
+ Key *pub;
+ char *cp, *cp2, *kp, *kp2;
+ char line[16 * 1024], tmp[4096], old[4096];
+ int c, skip = 0, inplace = 0, num = 0, invalid = 0, has_unhashed = 0;
+ int ca;
+ int found_key = 0;
+ if (!have_identity) {
+ cp = tilde_expand_filename("~/" ".ssh" "/known_hosts",
+ pw->pw_uid);
+ if (strlcpy(identity_file, cp, sizeof(identity_file)) >=
+ sizeof(identity_file))
+ fatal("Specified known hosts path too long");
+ free(cp);
+ }
+ if ((in = fopen(identity_file, "r")) == ((void *)0))
+ fatal("%s: %s: %s", __progname, identity_file,
+ strerror((*__errno_location())));
+ if (!find_host && (hash_hosts || delete_host)) {
+ if (strlcpy(tmp, identity_file, sizeof(tmp)) >= sizeof(tmp)
+ || strlcat(tmp, ".XXXXXXXXXX", sizeof(tmp)) >= sizeof(tmp)
+ || strlcpy(old, identity_file, sizeof(old)) >= sizeof(old)
+ || strlcat(old, ".old", sizeof(old)) >= sizeof(old))
+ fatal("known_hosts path too long");
+ umask(077);
+ if ((c = mkstemp(tmp)) == -1)
+ fatal("mkstemp: %s", strerror((*__errno_location())));
+ if ((out = fdopen(c, "w")) == ((void *)0)) {
+ c = (*__errno_location());
+ unlink(tmp);
+ fatal("fdopen: %s", strerror(c));
+ }
+ inplace = 1;
+ }
+ while (fgets(line, sizeof(line), in)) {
+ if ((cp =
+ (__extension__
+ (__builtin_constant_p('\n') && !__builtin_constant_p(line)
+ && ('\n') == '\0' ? (char *)__rawmemchr(line,
+ '\n') :
+ __builtin_strchr(line, '\n')))) == ((void *)0)) {
+ error("line %d too long: %.40s...", num + 1, line);
+ skip = 1;
+ invalid = 1;
+ continue;
+ }
+ num++;
+ if (skip) {
+ continue;
+ }
+ for (cp = line; *cp == ' ' || *cp == '\t'; cp++) ;
+ if (!*cp || *cp == '\n' || *cp == '#') {
+ if (inplace)
+ fprintf(out, "%s\n", cp);
+ }
+ if (strncasecmp
+ (cp, "@cert-authority", sizeof("@cert-authority") - 1) == 0
+ && (cp[sizeof("@cert-authority") - 1] == ' '
+ || cp[sizeof("@cert-authority") - 1] == '\t')) {
+ ca = 1;
+ cp += sizeof("@cert-authority");
+ } else
+ ca = 0;
+ for (kp = cp; *kp && *kp != ' ' && *kp != '\t'; kp++) ;
+ if (*kp == '\0' || *(kp + 1) == '\0') {
+ error("line %d missing key: %.40s...", num, line);
+ }
+ *kp++ = '\0';
+ pub = key_new(KEY_RSA1);
+ if (key_read(pub, &kp) != 1) {
+ kp = kp2;
+ key_free(pub);
+ pub = key_new(KEY_UNSPEC);
+ if (key_read(pub, &kp) != 1) {
+ error("line %d invalid key: %.40s...", num,
+ line);
+ key_free(pub);
+ }
+ }
+ if (*cp == '|') {
+ if (find_host || delete_host) {
+ cp2 = host_hash(name, cp, strlen(cp));
+ if (cp2 == ((void *)0)) {
+ error("line %d: invalid hashed "
+ "name: %.64s...", num, line);
+ }
+ c = (__extension__( {
+ size_t __s1_len, __s2_len;
+ (__builtin_constant_p(cp2)
+ && __builtin_constant_p(cp)
+ && (__s1_len =
+ strlen(cp2), __s2_len =
+ strlen(cp),
+ (!((size_t)
+ (const void *)((cp2)
+ + 1) -
+ (size_t) (const void
+ *)(cp2) ==
+ 1) || __s1_len >= 4)
+ &&
+ (!((size_t)
+ (const void *)((cp) +
+ 1) -
+ (size_t) (const void
+ *)(cp) ==
+ 1)
+ || __s2_len >=
+ 4)) ?
+ __builtin_strcmp(cp2,
+ cp)
+ : (__builtin_constant_p(cp2)
+ &&
+ ((size_t) (const void *)
+ ((cp2) + 1) -
+ (size_t) (const void
+ *)(cp2) == 1)
+ && (__s1_len =
+ strlen(cp2),
+ __s1_len <
+ 4)
+ ? (__builtin_constant_p
+ (cp)
+ &&
+ ((size_t)
+ (const void *)((cp) +
+ 1) -
+ (size_t) (const void
+ *)(cp) ==
+ 1) ?
+ __builtin_strcmp(cp2,
+ cp)
+ : (__extension__( {
+ const
+ unsigned
+ char
+ *__s2
+ =
+ (const
+ unsigned
+ char
+ *)
+ (const
+ char
+ *)
+ (cp);
+ register
+ int
+ __result
+ =
+ (((const unsigned char *)(const char *)(cp2))[0] - __s2[0]); if (__s1_len > 0 && __result == 0) {
+ }
+ __result;}
+ ))):
+ (__builtin_constant_p(cp)
+ &&
+ ((size_t) (const void *)
+ ((cp) + 1) -
+ (size_t) (const void
+ *)(cp) == 1)
+ && (__s2_len =
+ strlen(cp),
+ __s2_len <
+ 4)
+ ? (__builtin_constant_p
+ (cp2)
+ &&
+ ((size_t)
+ (const void *)((cp2)
+ +
+ 1) -
+ (size_t) (const void
+ *)(cp2) ==
+ 1) ?
+ __builtin_strcmp(cp2,
+ cp)
+ : (__extension__( {
+ const
+ unsigned
+ char
+ *__s1
+ =
+ (const
+ unsigned
+ char
+ *)
+ (const
+ char
+ *)
+ (cp2);
+ register
+ int
+ __result
+ =
+ __s1
+ [0]
+ -
+ ((const unsigned char *)(const char *)(cp))[0]; __result;}
+ ))):
+ __builtin_strcmp(cp2,
+ cp))));}
+ ) == 0) ;
+ if (find_host && c) {
+ if (!quiet)
+ printf("# Host %s found: "
+ "line %d type %s%s\n",
+ name, num, key_type(pub),
+ ca ? " (CA key)" : "");
+ printhost(out, cp, pub, ca, 0);
+ found_key = 1;
+ }
+ if (delete_host) {
+ if (!c && !ca)
+ printhost(out, cp, pub, ca, 0);
+ else
+ printf("# Host %s found: "
+ "line %d type %s\n",
+ name, num,
+ key_type(pub));
+ }
+ } else if (hash_hosts)
+ printhost(out, cp, pub, ca, 0);
+ if (find_host || delete_host) {
+ c = (match_hostname(name, cp, strlen(cp)) == 1);
+ if (find_host && c) {
+ if (!quiet)
+ printf("# Host %s found: "
+ "line %d type %s%s\n",
+ name, num, key_type(pub),
+ ca ? " (CA key)" : "");
+ printhost(out, name, pub, ca, hash_hosts
+ && !ca);
+ }
+ if (delete_host) {
+ if (!c && !ca)
+ printhost(out, cp, pub, ca, 0);
+ else
+ printf("# Host %s found: "
+ "line %d type %s\n",
+ name, num,
+ key_type(pub));
+ }
+ } else if (hash_hosts) {
+ for (cp2 = __extension__( {
+ char __r0, __r1, __r2;
+ (__builtin_constant_p
+ (",")
+ &&
+ ((size_t)
+ (const void *)((",")
+ + 1) -
+ (size_t) (const void
+ *)(",") ==
+ 1)
+ && (__r0 =
+ ((const char
+ *)(","))[0],
+ ((const char
+ *)(","))[0] !=
+ '\0') ? ((__r1 =
+ ((const
+ char
+ *)
+ (","))
+ [1],
+ ((const
+ char
+ *)
+ (","))
+ [1] ==
+ '\0') ?
+ __strsep_1c
+ (&cp,
+ __r0)
+ : ((__r2
+ =
+ ((const char *)(","))[2], __r2 == '\0') ? __strsep_2c(&cp, __r0, __r1) : (((const char *)(","))[3] == '\0' ? __strsep_3c(&cp, __r0, __r1, __r2) : __strsep_g(&cp, ",")))) : __strsep_g(&cp, ","));}
+ ); cp2 != ((void *)0) && *cp2 != '\0';
+ cp2 = __extension__( {
+ char __r0, __r1, __r2;
+ (__builtin_constant_p
+ (",")
+ &&
+ ((size_t)
+ (const void *)((",")
+ + 1) -
+ (size_t) (const void
+ *)(",") ==
+ 1)
+ && (__r0 =
+ ((const char
+ *)(","))[0],
+ ((const char
+ *)(","))[0] !=
+ '\0') ? ((__r1 =
+ ((const
+ char
+ *)
+ (","))
+ [1],
+ ((const
+ char
+ *)
+ (","))
+ [1] ==
+ '\0') ?
+ __strsep_1c
+ (&cp,
+ __r0)
+ : ((__r2
+ =
+ ((const char *)(","))[2], __r2 == '\0') ? __strsep_2c(&cp, __r0, __r1) : (((const char *)(","))[3] == '\0' ? __strsep_3c(&cp, __r0, __r1, __r2) : __strsep_g(&cp, ",")))) : __strsep_g(&cp, ","));}
+ )) {
+ if (ca) {
+ fprintf(stderr,
+ "Warning: "
+ "ignoring CA key for host: "
+ "%.64s\n", cp2);
+ printhost(out, cp2, pub, ca, 0);
+ } else if (__extension__( {
+ char __r0,
+ __r1, __r2;
+ (__builtin_constant_p
+ ("*?!")
+ &&
+ ((size_t)
+ (const void
+ *)(("*?!") +
+ 1) -
+ (size_t)
+ (const void
+ *)("*?!") ==
+ 1)
+ ? ((__builtin_constant_p(cp2) && ((size_t) (const void *)((cp2) + 1) - (size_t) (const void *)(cp2) == 1)) ? __builtin_strcspn(cp2, "*?!") : ((__r0 = ((const char *)("*?!"))[0], __r0 == '\0') ? strlen(cp2) : ((__r1 = ((const char *)("*?!"))[1], __r1 == '\0') ? __strcspn_c1(cp2, __r0) : ((__r2 = ((const char *)("*?!"))[2], __r2 == '\0') ? __strcspn_c2(cp2, __r0, __r1) : (((const char *)("*?!"))[3] == '\0' ? __strcspn_c3(cp2, __r0, __r1, __r2) : __builtin_strcspn(cp2, "*?!")))))) : __builtin_strcspn(cp2, "*?!"));}
+ ) != strlen(cp2)) {
+ fprintf(stderr,
+ "Warning: "
+ "ignoring host name with "
+ "metacharacters: %.64s\n",
+ cp2);
+ printhost(out, cp2, pub, ca, 0);
+ } else
+ printhost(out, cp2, pub, ca, 1);
+ }
+ has_unhashed = 1;
+ }
+ }
+ key_free(pub);
+ }
+ fclose(in);
+ if (invalid) {
+ fprintf(stderr, "%s is not a valid known_hosts file.\n",
+ identity_file);
+ if (inplace) {
+ fprintf(stderr,
+ "Not replacing existing known_hosts "
+ "file because of errors\n");
+ fclose(out);
+ unlink(tmp);
+ }
+ exit(1);
+ }
+ if (inplace) {
+ fclose(out);
+ if (unlink(old) == -1 && (*__errno_location()) != 2)
+ fatal("unlink %.100s: %s", old,
+ strerror((*__errno_location())));
+ if (link(identity_file, old) == -1)
+ fatal("link %.100s to %.100s: %s", identity_file, old,
+ strerror((*__errno_location())));
+ if (rename(tmp, identity_file) == -1) {
+ error("rename\"%s\" to \"%s\": %s", tmp, identity_file,
+ strerror((*__errno_location())));
+ unlink(tmp);
+ unlink(old);
+ exit(1);
+ }
+ fprintf(stderr, "%s updated.\n", identity_file);
+ fprintf(stderr, "Original contents retained as %s\n", old);
+ if (has_unhashed) {
+ fprintf(stderr,
+ "WARNING: %s contains unhashed " "entries\n",
+ old);
+ fprintf(stderr,
+ "Delete this file to ensure privacy "
+ "of hostnames\n");
+ }
+ }
+ exit(find_host && !found_key);
+}
+
+static void do_change_passphrase(struct passwd *pw)
+{
+ char *comment;
+ char *old_passphrase, *passphrase1, *passphrase2;
+ struct stat st;
+ Key *private;
+ if (!have_identity)
+ ask_filename(pw, "Enter file in which the key is");
+ if (stat(identity_file, &st) < 0) {
+ perror(identity_file);
+ exit(1);
+ }
+ private = key_load_private(identity_file, "", &comment);
+ if (private == ((void *)0)) {
+ if (identity_passphrase)
+ old_passphrase = xstrdup(identity_passphrase);
+ else
+ old_passphrase =
+ read_passphrase("Enter old passphrase: ", 0x0002);
+ private =
+ key_load_private(identity_file, old_passphrase, &comment);
+ explicit_bzero(old_passphrase, strlen(old_passphrase));
+ free(old_passphrase);
+ if (private == ((void *)0)) {
+ printf("Bad passphrase.\n");
+ exit(1);
+ }
+ }
+ printf("Key has comment '%s'\n", comment);
+ if (identity_new_passphrase) {
+ passphrase1 = xstrdup(identity_new_passphrase);
+ } else {
+ passphrase1 =
+ read_passphrase("Enter new passphrase (empty for no "
+ "passphrase): ", 0x0002);
+ passphrase2 =
+ read_passphrase("Enter same passphrase again: ", 0x0002);
+ if (__extension__( {
+ size_t __s1_len, __s2_len;
+ (__builtin_constant_p(passphrase1)
+ && __builtin_constant_p(passphrase2)
+ && (__s1_len =
+ strlen(passphrase1), __s2_len =
+ strlen(passphrase2),
+ (!((size_t) (const void *)
+ ((passphrase1) + 1) -
+ (size_t) (const void *)(passphrase1)
+ == 1) || __s1_len >= 4)
+ &&
+ (!((size_t) (const void *)
+ ((passphrase2) + 1) -
+ (size_t) (const void *)(passphrase2)
+ == 1)
+ || __s2_len >=
+ 4)) ? __builtin_strcmp(passphrase1,
+ passphrase2)
+ : (__builtin_constant_p(passphrase1)
+ &&
+ ((size_t) (const void *)
+ ((passphrase1) + 1) -
+ (size_t) (const void *)(passphrase1) ==
+ 1)
+ && (__s1_len =
+ strlen(passphrase1),
+ __s1_len <
+ 4)
+ ? (__builtin_constant_p(passphrase2)
+ &&
+ ((size_t) (const void *)
+ ((passphrase2) + 1) -
+ (size_t) (const void *)(passphrase2)
+ == 1) ? __builtin_strcmp(passphrase1,
+ passphrase2)
+ : (__extension__( {
+ const unsigned char
+ *__s2 =
+ (const unsigned char
+ *)(const char
+ *)(passphrase2);
+ register int __result
+ =
+ (((const unsigned char
+ *)(const char
+ *)(passphrase1))
+ [0] - __s2[0]);
+ __result;}
+ ))): (__builtin_constant_p(passphrase2)
+ &&
+ ((size_t) (const void *)
+ ((passphrase2) + 1) -
+ (size_t) (const void
+ *)(passphrase2) == 1)
+ && (__s2_len =
+ strlen(passphrase2),
+ __s2_len <
+ 4)
+ ? (__builtin_constant_p
+ (passphrase1)
+ &&
+ ((size_t) (const void *)
+ ((passphrase1) + 1) -
+ (size_t) (const void
+ *)(passphrase1) ==
+ 1) ?
+ __builtin_strcmp(passphrase1,
+ passphrase2)
+ : (__extension__( {
+ const unsigned
+ char *__s1 =
+ (const unsigned
+ char *)(const
+ char
+ *)
+ (passphrase1);
+ register int
+ __result =
+ __s1[0] -
+ ((const
+ unsigned char
+ *)(const char
+ *)
+ (passphrase2))
+ [0];
+ if (__s2_len >
+ 0
+ && __result
+ == 0) {
+ }
+ __result;}
+ ))): __builtin_strcmp(passphrase1,
+ passphrase2))));}
+ ) != 0) {
+ explicit_bzero(passphrase1, strlen(passphrase1));
+ explicit_bzero(passphrase2, strlen(passphrase2));
+ free(passphrase1);
+ free(passphrase2);
+ printf("Pass phrases do not match. Try again.\n");
+ exit(1);
+ }
+ explicit_bzero(passphrase2, strlen(passphrase2));
+ free(passphrase2);
+ }
+ if (!key_save_private
+ (private, identity_file, passphrase1, comment, use_new_format,
+ new_format_cipher, rounds)) {
+ printf("Saving the key failed: %s.\n", identity_file);
+ explicit_bzero(passphrase1, strlen(passphrase1));
+ free(passphrase1);
+ key_free(private);
+ free(comment);
+ exit(1);
+ }
+ explicit_bzero(passphrase1, strlen(passphrase1));
+ free(passphrase1);
+ key_free(private);
+ free(comment);
+ printf("Your identification has been saved with the new passphrase.\n");
+ exit(0);
+}
+
+static void do_change_comment(struct passwd *pw)
+{
+ char new_comment[1024], *comment, *passphrase;
+ Key *private;
+ Key *public;
+ struct stat st;
+ FILE *f;
+ int fd;
+ if (!have_identity)
+ ask_filename(pw, "Enter file in which the key is");
+ if (stat(identity_file, &st) < 0) {
+ perror(identity_file);
+ exit(1);
+ }
+ private = key_load_private(identity_file, "", &comment);
+ if (private == ((void *)0)) {
+ if (identity_passphrase)
+ passphrase = xstrdup(identity_passphrase);
+ else if (identity_new_passphrase)
+ passphrase = xstrdup(identity_new_passphrase);
+ else
+ passphrase =
+ read_passphrase("Enter passphrase: ", 0x0002);
+ private = key_load_private(identity_file, passphrase, &comment);
+ if (private == ((void *)0)) {
+ explicit_bzero(passphrase, strlen(passphrase));
+ free(passphrase);
+ printf("Bad passphrase.\n");
+ exit(1);
+ }
+ passphrase = xstrdup("");
+ }
+ if (private->type != KEY_RSA1) {
+ fprintf(stderr, "Comments are only supported for RSA1 keys.\n");
+ key_free(private);
+ exit(1);
+ }
+ printf("Key now has comment '%s'\n", comment);
+ if (identity_comment) {
+ strlcpy(new_comment, identity_comment, sizeof(new_comment));
+ printf("Enter new comment: ");
+ fflush(stdout);
+ if (!fgets(new_comment, sizeof(new_comment), stdin)) {
+ explicit_bzero(passphrase, strlen(passphrase));
+ key_free(private);
+ exit(1);
+ }
+ new_comment[__extension__( {
+ char __r0, __r1, __r2;
+ (__builtin_constant_p("\n")
+ &&
+ ((size_t) (const void *)(("\n") + 1)
+ - (size_t) (const void *)("\n") ==
+ 1)
+ ? ((__builtin_constant_p(new_comment)
+ &&
+ ((size_t) (const void *)
+ ((new_comment) + 1) -
+ (size_t) (const void
+ *)(new_comment) ==
+ 1)) ?
+ __builtin_strcspn(new_comment,
+ "\n") : ((__r0 =
+ ((const char *)("\n"))[0], __r0 == '\0') ? strlen(new_comment) : ((__r1 = ((const char *)("\n"))[1], __r1 == '\0') ? __strcspn_c1(new_comment, __r0) : ((__r2 = ((const char *)("\n"))[2], __r2 == '\0') ? __strcspn_c2(new_comment, __r0, __r1) : (((const char *)("\n"))[3] == '\0' ? __strcspn_c3(new_comment, __r0, __r1, __r2) : __builtin_strcspn(new_comment, "\n")))))) : __builtin_strcspn(new_comment, "\n"));}
+ )] = '\0';
+ }
+ if (!key_save_private
+ (private, identity_file, passphrase, new_comment, use_new_format,
+ new_format_cipher, rounds)) {
+ printf("Saving the key failed: %s.\n", identity_file);
+ explicit_bzero(passphrase, strlen(passphrase));
+ free(passphrase);
+ key_free(private);
+ free(comment);
+ exit(1);
+ }
+ explicit_bzero(passphrase, strlen(passphrase));
+ free(passphrase);
+ public = key_from_private(private);
+ key_free(private);
+ strlcat(identity_file, ".pub", sizeof(identity_file));
+ fd = open(identity_file, 01 | 00000400 | 01000, 0644);
+ if (fd == -1) {
+ printf("Could not save your public key in %s\n", identity_file);
+ exit(1);
+ }
+ f = fdopen(fd, "w");
+ if (f == ((void *)0)) {
+ printf("fdopen %s failed\n", identity_file);
+ exit(1);
+ }
+ if (!key_write(public, f))
+ fprintf(stderr, "write key failed\n");
+ key_free(public);
+ fprintf(f, " %s\n", new_comment);
+ fclose(f);
+ free(comment);
+ printf("The comment in your key file has been changed.\n");
+ exit(0);
+}
+
+static const char *fmt_validity(u_int64_t valid_from, u_int64_t valid_to)
+{
+ char from[32], to[32];
+ static char ret[64];
+ time_t tt;
+ struct tm *tm;
+ *from = *to = '\0';
+ if (valid_from == 0 && valid_to == 0xffffffffffffffffULL)
+ return "forever";
+ if (valid_from != 0) {
+ tt = valid_from > 2147483647 ? 2147483647 : valid_from;
+ tm = localtime(&tt);
+ strftime(from, sizeof(from), "%Y-%m-%dT%H:%M:%S", tm);
+ }
+ if (valid_to != 0xffffffffffffffffULL) {
+ tt = valid_to > 2147483647 ? 2147483647 : valid_to;
+ tm = localtime(&tt);
+ strftime(to, sizeof(to), "%Y-%m-%dT%H:%M:%S", tm);
+ }
+ if (valid_from == 0) {
+ snprintf(ret, sizeof(ret), "before %s", to);
+ }
+ if (valid_to == 0xffffffffffffffffULL) {
+ snprintf(ret, sizeof(ret), "after %s", from);
+ }
+ snprintf(ret, sizeof(ret), "from %s to %s", from, to);
+}
+
+static void do_show_cert(struct passwd *pw)
+{
+ Key *key;
+ struct stat st;
+ char *key_fp, *ca_fp;
+ u_int i, v00;
+ if (!have_identity)
+ ask_filename(pw, "Enter file in which the key is");
+ if (stat(identity_file, &st) < 0)
+ fatal("%s: %s: %s", __progname, identity_file,
+ strerror((*__errno_location())));
+ if ((key = key_load_public(identity_file, ((void *)0))) == ((void *)0))
+ fatal("%s is not a public key", identity_file);
+ if (!key_is_cert(key))
+ fatal("%s is not a certificate", identity_file);
+ v00 = key->type == KEY_RSA_CERT_V00 || key->type == KEY_DSA_CERT_V00;
+ key_fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
+ ca_fp =
+ key_fingerprint(key->cert->signature_key, SSH_FP_MD5, SSH_FP_HEX);
+ printf("%s:\n", identity_file);
+ printf(" Type: %s %s certificate\n", key_ssh_name(key),
+ key_cert_type(key));
+ printf(" Public key: %s %s\n", key_type(key), key_fp);
+ printf(" Signing CA: %s %s\n",
+ key_type(key->cert->signature_key), ca_fp);
+ printf(" Key ID: \"%s\"\n", key->cert->key_id);
+ if (!v00) {
+ printf(" Serial: %llu\n",
+ (unsigned long long)key->cert->serial);
+ }
+ printf(" Valid: %s\n",
+ fmt_validity(key->cert->valid_after, key->cert->valid_before));
+ printf(" Principals: ");
+ if (key->cert->nprincipals == 0)
+ printf("(none)\n");
+ else {
+ for (i = 0; i < key->cert->nprincipals; i++)
+ printf("\n %s",
+ key->cert->principals[i]);
+ printf("\n");
+ }
+ printf(" Critical Options: ");
+ if (buffer_len(&key->cert->critical) == 0)
+ printf("(none)\n");
+ else {
+ printf("\n");
+ show_options(&key->cert->critical, v00, 1);
+ }
+ if (!v00) {
+ printf(" Extensions: ");
+ if (buffer_len(&key->cert->extensions) == 0)
+ printf("(none)\n");
+ else {
+ printf("\n");
+ show_options(&key->cert->extensions, v00, 0);
+ }
+ }
+ exit(0);
+}
+
+static void do_gen_krl(struct passwd *pw, int updating, int argc, char **argv)
+{
+ struct ssh_krl *krl;
+ struct stat sb;
+ Key *ca = ((void *)0);
+ int fd, i;
+ char *tmp;
+ Buffer kbuf;
+ if (*identity_file == '\0')
+ fatal("KRL generation requires an output file");
+ if (stat(identity_file, &sb) == -1) {
+ if ((*__errno_location()) != 2)
+ fatal("Cannot access KRL \"%s\": %s", identity_file,
+ strerror((*__errno_location())));
+ if (updating)
+ fatal("KRL \"%s\" does not exist", identity_file);
+ }
+ if (ca_key_path != ((void *)0)) {
+ tmp = tilde_expand_filename(ca_key_path, pw->pw_uid);
+ if ((ca = key_load_public(tmp, ((void *)0))) == ((void *)0))
+ fatal("Cannot load CA public key %s", tmp);
+ free(tmp);
+ }
+ if (updating)
+ load_krl(identity_file, &krl);
+ else if ((krl = ssh_krl_init()) == ((void *)0))
+ fatal("couldn't create KRL");
+ if (cert_serial != 0)
+ ssh_krl_set_version(krl, cert_serial);
+ if (identity_comment != ((void *)0))
+ ssh_krl_set_comment(krl, identity_comment);
+ for (i = 0; i < argc; i++)
+ update_krl_from_file(pw, argv[i], ca, krl);
+ buffer_init(&kbuf);
+ if (ssh_krl_to_blob(krl, &kbuf, ((void *)0), 0) != 0)
+ fatal("Couldn't generate KRL");
+ if ((fd = open(identity_file, 01 | 00000400 | 01000, 0644)) == -1)
+ fatal("open %s: %s", identity_file,
+ strerror((*__errno_location())));
+ if (atomicio
+ ((ssize_t(*)(int, void *, size_t))write, fd, buffer_ptr(&kbuf),
+ buffer_len(&kbuf)) != buffer_len(&kbuf))
+ fatal("write %s: %s", identity_file,
+ strerror((*__errno_location())));
+ close(fd);
+ buffer_free(&kbuf);
+ ssh_krl_free(krl);
+ if (ca != ((void *)0))
+ key_free(ca);
+}
+
+static void usage(void)
+{
+ exit(1);
+}
+
+int main(int argc, char **argv)
+{
+ char dotsshdir[4096], comment[1024], *passphrase1, *passphrase2;
+ char *checkpoint = ((void *)0);
+ char out_file[4096], *ep, *rr_hostname = ((void *)0);
+ Key *private, *public;
+ struct passwd *pw;
+ struct stat st;
+ int opt, type, fd;
+ u_int32_t memory = 0, generator_wanted = 0;
+ int do_gen_candidates = 0, do_screen_candidates = 0;
+ int gen_all_hostkeys = 0, gen_krl = 0, update_krl = 0, check_krl = 0;
+ unsigned long start_lineno = 0, lines_to_process = 0;
+ BIGNUM *start = ((void *)0);
+ FILE *f;
+ const char *errstr;
+ extern char *BSDoptarg;
+ sanitise_stdfd();
+ __progname = ssh_get_progname(argv[0]);
+ ssh_OpenSSL_add_all_algorithms();
+ log_init(argv[0], SYSLOG_LEVEL_INFO, SYSLOG_FACILITY_USER, 1);
+ seed_rng();
+ pw = getpwuid(getuid());
+ if (!pw) {
+ printf("No user exists for uid %lu\n", (u_long) getuid());
+ exit(1);
+ }
+ if (gethostname(hostname, sizeof(hostname)) < 0) {
+ perror("gethostname");
+ exit(1);
+ }
+ while ((opt =
+ BSDgetopt(argc, argv,
+ "ABHLQXceghiklopquvxy"
+ "C:D:F:G:I:J:K:M:N:O:P:R:S:T:V:W:Z:a:b:f:g:j:m:n:r:s:t:z:"))
+ != -1) {
+ switch (opt) {
+ case 'A':
+ gen_all_hostkeys = 1;
+ case 'b':
+ bits =
+ (u_int32_t) strtonum(BSDoptarg, 256, 32768,
+ &errstr);
+ if (errstr)
+ fatal("Bits has bad value %s (%s)", BSDoptarg,
+ errstr);
+ case 'F':
+ find_host = 1;
+ rr_hostname = BSDoptarg;
+ break;
+ case 'H':
+ hash_hosts = 1;
+ case 'I':
+ cert_key_id = BSDoptarg;
+ case 'J':
+ lines_to_process = strtoul(BSDoptarg, ((void *)0), 10);
+ case 'j':
+ start_lineno = strtoul(BSDoptarg, ((void *)0), 10);
+ case 'R':
+ delete_host = 1;
+ rr_hostname = BSDoptarg;
+ break;
+ case 'L':
+ show_cert = 1;
+ case 'l':
+ print_fingerprint = 1;
+ case 'B':
+ print_bubblebabble = 1;
+ case 'm':
+ if (strcasecmp(BSDoptarg, "RFC4716") == 0
+ || strcasecmp(BSDoptarg, "ssh2") == 0) {
+ convert_format = FMT_RFC4716;
+ }
+ if (strcasecmp(BSDoptarg, "PKCS8") == 0) {
+ convert_format = FMT_PKCS8;
+ }
+ if (strcasecmp(BSDoptarg, "PEM") == 0) {
+ convert_format = FMT_PEM;
+ }
+ fatal("Unsupported conversion format \"%s\"",
+ BSDoptarg);
+ case 'n':
+ cert_principals = BSDoptarg;
+ case 'o':
+ use_new_format = 1;
+ case 'p':
+ change_passphrase = 1;
+ case 'c':
+ change_comment = 1;
+ case 'f':
+ if (strlcpy
+ (identity_file, BSDoptarg,
+ sizeof(identity_file)) >= sizeof(identity_file))
+ fatal("Identity filename too long");
+ have_identity = 1;
+ case 'g':
+ print_generic = 1;
+ case 'P':
+ identity_passphrase = BSDoptarg;
+ case 'N':
+ identity_new_passphrase = BSDoptarg;
+ case 'Q':
+ check_krl = 1;
+ case 'O':
+ add_cert_option(BSDoptarg);
+ case 'Z':
+ new_format_cipher = BSDoptarg;
+ case 'C':
+ identity_comment = BSDoptarg;
+ case 'q':
+ quiet = 1;
+ case 'e':
+ case 'x':
+ convert_to = 1;
+ case 'h':
+ cert_key_type = 2;
+ certflags_flags = 0;
+ case 'k':
+ gen_krl = 1;
+ case 'i':
+ case 'X':
+ convert_from = 1;
+ case 'y':
+ print_public = 1;
+ case 's':
+ ca_key_path = BSDoptarg;
+ case 't':
+ key_type_name = BSDoptarg;
+ case 'D':
+ pkcs11provider = BSDoptarg;
+ case 'u':
+ update_krl = 1;
+ case 'v':
+ if (log_level == SYSLOG_LEVEL_INFO)
+ log_level = SYSLOG_LEVEL_DEBUG1;
+ else {
+ if (log_level >= SYSLOG_LEVEL_DEBUG1
+ && log_level < SYSLOG_LEVEL_DEBUG3)
+ log_level++;
+ }
+ case 'r':
+ rr_hostname = BSDoptarg;
+ case 'W':
+ generator_wanted =
+ (u_int32_t) strtonum(BSDoptarg, 1,
+ (2147483647 * 2U + 1U),
+ &errstr);
+ if (errstr)
+ fatal
+ ("Desired generator has bad value: %s (%s)",
+ BSDoptarg, errstr);
+ case 'a':
+ rounds =
+ (int)strtonum(BSDoptarg, 1, 2147483647, &errstr);
+ if (errstr)
+ fatal("Invalid number: %s (%s)", BSDoptarg,
+ errstr);
+ case 'M':
+ memory =
+ (u_int32_t) strtonum(BSDoptarg, 1,
+ (2147483647 * 2U + 1U),
+ &errstr);
+ if (errstr)
+ fatal("Memory limit is %s: %s", errstr,
+ BSDoptarg);
+ case 'G':
+ do_gen_candidates = 1;
+ if (strlcpy(out_file, BSDoptarg, sizeof(out_file)) >=
+ sizeof(out_file))
+ fatal("Output filename too long");
+ case 'T':
+ do_screen_candidates = 1;
+ if (strlcpy(out_file, BSDoptarg, sizeof(out_file)) >=
+ sizeof(out_file))
+ fatal("Output filename too long");
+ case 'K':
+ if (strlen(BSDoptarg) >= 4096)
+ fatal("Checkpoint filename too long");
+ checkpoint = xstrdup(BSDoptarg);
+ break;
+ case 'S':
+ if (BN_hex2bn(&start, BSDoptarg) == 0)
+ fatal("Invalid start point.");
+ case 'V':
+ parse_cert_times(BSDoptarg);
+ case 'z':
+ (*__errno_location()) = 0;
+ cert_serial = strtoull(BSDoptarg, &ep, 10);
+ if (*BSDoptarg < '0' || *BSDoptarg > '9' || *ep != '\0'
+ || ((*__errno_location()) == 34
+ && cert_serial ==
+ (9223372036854775807LL * 2ULL + 1)))
+ fatal("Invalid serial number \"%s\"",
+ BSDoptarg);
+ case '?':
+ default:
+ usage();
+ }
+ }
+ log_init(argv[0], log_level, SYSLOG_FACILITY_USER, 1);
+ if (ca_key_path != ((void *)0)) {
+ if (argc < 1 && !gen_krl) {
+ printf("Too few arguments.\n");
+ usage();
+ }
+ } else if (argc > 0 && !gen_krl && !check_krl) {
+ printf("Too many arguments.\n");
+ }
+ if (change_passphrase && change_comment) {
+ printf("Can only have one of -p and -c.\n");
+ usage();
+ }
+ if (print_fingerprint && (delete_host || hash_hosts)) {
+ printf("Cannot use -l with -H or -R.\n");
+ usage();
+ }
+ if (gen_krl) {
+ do_gen_krl(pw, update_krl, argc, argv);
+ return (0);
+ }
+ if (check_krl) {
+ do_check_krl(pw, argc, argv);
+ }
+ if (ca_key_path != ((void *)0)) {
+ if (cert_key_id == ((void *)0))
+ fatal("Must specify key id (-I) when certifying");
+ do_ca_sign(pw, argc, argv);
+ }
+ if (show_cert)
+ do_show_cert(pw);
+ if (delete_host || hash_hosts || find_host)
+ do_known_hosts(pw, rr_hostname);
+ if (pkcs11provider != ((void *)0))
+ do_download(pw);
+ if (print_fingerprint || print_bubblebabble)
+ do_fingerprint(pw);
+ if (change_passphrase)
+ do_change_passphrase(pw);
+ if (change_comment)
+ do_change_comment(pw);
+ if (convert_to)
+ do_convert_to(pw);
+ if (convert_from)
+ do_convert_from(pw);
+ if (print_public)
+ do_print_public(pw);
+ if (rr_hostname != ((void *)0)) {
+ unsigned int n = 0;
+ if (have_identity) {
+ n = do_print_resource_record(pw, identity_file,
+ rr_hostname);
+ if (n == 0) {
+ perror(identity_file);
+ exit(1);
+ }
+ exit(0);
+ } else {
+ n += do_print_resource_record(pw,
+ "/etc/ssh"
+ "/ssh_host_rsa_key",
+ rr_hostname);
+ n += do_print_resource_record(pw,
+ "/etc/ssh"
+ "/ssh_host_dsa_key",
+ rr_hostname);
+ n += do_print_resource_record(pw,
+ "/etc/ssh"
+ "/ssh_host_ecdsa_key",
+ rr_hostname);
+ if (n == 0)
+ fatal("no keys found.");
+ exit(0);
+ }
+ }
+ if (do_gen_candidates) {
+ FILE *out = fopen(out_file, "w");
+ if (out == ((void *)0)) {
+ error("Couldn't open modulus candidate file \"%s\": %s",
+ out_file, strerror((*__errno_location())));
+ }
+ if (bits == 0)
+ bits = 2048;
+ if (gen_candidates(out, memory, bits, start) != 0)
+ fatal("modulus candidate generation failed");
+ }
+ if (do_screen_candidates) {
+ FILE *in;
+ FILE *out = fopen(out_file, "a");
+ if (have_identity && __extension__( {
+ size_t __s1_len, __s2_len;
+ (__builtin_constant_p
+ (identity_file)
+ && __builtin_constant_p("-")
+ && (__s1_len =
+ strlen(identity_file),
+ __s2_len =
+ strlen("-"),
+ (!((size_t)
+ (const void
+ *)((identity_file) +
+ 1) -
+ (size_t) (const void
+ *)
+ (identity_file) == 1)
+ || __s1_len >= 4)
+ &&
+ (!((size_t)
+ (const void *)(("-")
+ + 1) -
+ (size_t) (const void
+ *)("-") ==
+ 1)
+ || __s2_len >=
+ 4)) ?
+ __builtin_strcmp
+ (identity_file,
+ "-")
+ : (__builtin_constant_p
+ (identity_file)
+ &&
+ ((size_t) (const void *)
+ ((identity_file) + 1) -
+ (size_t) (const void
+ *)
+ (identity_file) == 1)
+ && (__s1_len =
+ strlen
+ (identity_file),
+ __s1_len <
+ 4)
+ ? (__builtin_constant_p
+ ("-")
+ &&
+ ((size_t)
+ (const void *)(("-")
+ + 1) -
+ (size_t) (const void
+ *)("-") ==
+ 1) ?
+ __builtin_strcmp
+ (identity_file,
+ "-")
+ : (__extension__( {
+ const
+ unsigned
+ char
+ *__s2
+ =
+ (const
+ unsigned
+ char
+ *)
+ (const
+ char
+ *)
+ ("-");
+ register
+ int
+ __result
+ =
+ (((const unsigned char *)(const char *)(identity_file))[0] - __s2[0]); __result;}
+ ))):
+ (__builtin_constant_p
+ ("-")
+ &&
+ ((size_t) (const void *)
+ (("-") + 1) -
+ (size_t) (const void
+ *)("-") == 1)
+ && (__s2_len =
+ strlen("-"),
+ __s2_len <
+ 4)
+ ? (__builtin_constant_p
+ (identity_file)
+ &&
+ ((size_t)
+ (const void
+ *)((identity_file)
+ + 1) -
+ (size_t) (const void
+ *)
+ (identity_file) ==
+ 1) ?
+ __builtin_strcmp
+ (identity_file,
+ "-")
+ : (__extension__( {
+ const
+ unsigned
+ char
+ *__s1
+ =
+ (const
+ unsigned
+ char
+ *)
+ (const
+ char
+ *)
+ (identity_file);
+ register
+ int
+ __result
+ =
+ __s1
+ [0]
+ -
+ ((const unsigned char *)(const char *)("-"))[0]; if (__s2_len > 0 && __result == 0) {
+ __result
+ =
+ (__s1
+ [1]
+ -
+ ((const unsigned char *)(const char *)("-"))[1]);}
+ __result;}
+ ))):
+ __builtin_strcmp
+ (identity_file,
+ "-"))));}
+ ) != 0) {
+ if ((in = fopen(identity_file, "r")) == ((void *)0)) {
+ fatal("Couldn't open modulus candidate "
+ "file \"%s\": %s", identity_file,
+ strerror((*__errno_location())));
+ }
+ } else
+ in = stdin;
+ if (out == ((void *)0)) {
+ fatal("Couldn't open moduli file \"%s\": %s", out_file,
+ strerror((*__errno_location())));
+ }
+ if (prime_test
+ (in, out, rounds == 0 ? 100 : rounds, generator_wanted,
+ checkpoint, start_lineno, lines_to_process) != 0)
+ fatal("modulus screening failed");
+ }
+ if (gen_all_hostkeys) {
+ do_gen_all_hostkeys(pw);
+ }
+ if (key_type_name == ((void *)0))
+ key_type_name = "rsa";
+ type = key_type_from_name(key_type_name);
+ type_bits_valid(type, &bits);
+ if (!quiet)
+ printf("Generating public/private %s key pair.\n",
+ key_type_name);
+ private = key_generate(type, bits);
+ if (private == ((void *)0)) {
+ fprintf(stderr, "key_generate failed\n");
+ exit(1);
+ }
+ public = key_from_private(private);
+ if (!have_identity)
+ ask_filename(pw, "Enter file in which to save the key");
+ snprintf(dotsshdir, sizeof dotsshdir, "%s/%s", pw->pw_dir, ".ssh");
+ if (strstr(identity_file, dotsshdir) != ((void *)0)) {
+ if (stat(dotsshdir, &st) < 0) {
+ if ((*__errno_location()) != 2) {
+ error("Could not stat %s: %s", dotsshdir,
+ strerror((*__errno_location())));
+ } else if (mkdir(dotsshdir, 0700) < 0) {
+ error("Could not create directory '%s': %s",
+ dotsshdir,
+ strerror((*__errno_location())));
+ } else if (!quiet)
+ printf("Created directory '%s'.\n", dotsshdir);
+ }
+ }
+ if (stat(identity_file, &st) >= 0) {
+ char yesno[3];
+ printf("%s already exists.\n", identity_file);
+ printf("Overwrite (y/n)? ");
+ fflush(stdout);
+ if (fgets(yesno, sizeof(yesno), stdin) == ((void *)0))
+ exit(1);
+ if (yesno[0] != 'y' && yesno[0] != 'Y')
+ exit(1);
+ }
+ if (identity_passphrase)
+ passphrase1 = xstrdup(identity_passphrase);
+ else if (identity_new_passphrase)
+ passphrase1 = xstrdup(identity_new_passphrase);
+ else {
+ passphrase_again:passphrase1 =
+ read_passphrase("Enter passphrase (empty for no "
+ "passphrase): ", 0x0002);
+ passphrase2 =
+ read_passphrase("Enter same passphrase again: ", 0x0002);
+ if (__extension__( {
+ size_t __s1_len, __s2_len;
+ (__builtin_constant_p(passphrase1)
+ && __builtin_constant_p(passphrase2)
+ && (__s1_len =
+ strlen(passphrase1), __s2_len =
+ strlen(passphrase2),
+ (!((size_t) (const void *)
+ ((passphrase1) + 1) -
+ (size_t) (const void *)(passphrase1)
+ == 1) || __s1_len >= 4)
+ &&
+ (!((size_t) (const void *)
+ ((passphrase2) + 1) -
+ (size_t) (const void *)(passphrase2)
+ == 1)
+ || __s2_len >=
+ 4)) ? __builtin_strcmp(passphrase1,
+ passphrase2)
+ : (__builtin_constant_p(passphrase1)
+ &&
+ ((size_t) (const void *)
+ ((passphrase1) + 1) -
+ (size_t) (const void *)(passphrase1) ==
+ 1)
+ && (__s1_len =
+ strlen(passphrase1),
+ __s1_len <
+ 4)
+ ? (__builtin_constant_p(passphrase2)
+ &&
+ ((size_t) (const void *)
+ ((passphrase2) + 1) -
+ (size_t) (const void *)(passphrase2)
+ == 1) ? __builtin_strcmp(passphrase1,
+ passphrase2)
+ : (__extension__( {
+ const unsigned char
+ *__s2 =
+ (const unsigned char
+ *)(const char
+ *)(passphrase2);
+ register int __result
+ =
+ (((const unsigned char
+ *)(const char
+ *)(passphrase1))
+ [0] - __s2[0]);
+ __result;}
+ ))): (__builtin_constant_p(passphrase2)
+ &&
+ ((size_t) (const void *)
+ ((passphrase2) + 1) -
+ (size_t) (const void
+ *)(passphrase2) == 1)
+ && (__s2_len =
+ strlen(passphrase2),
+ __s2_len <
+ 4)
+ ? (__builtin_constant_p
+ (passphrase1)
+ &&
+ ((size_t) (const void *)
+ ((passphrase1) + 1) -
+ (size_t) (const void
+ *)(passphrase1) ==
+ 1) ?
+ __builtin_strcmp(passphrase1,
+ passphrase2)
+ : (__extension__( {
+ const unsigned
+ char *__s1 =
+ (const unsigned
+ char *)(const
+ char
+ *)
+ (passphrase1);
+ register int
+ __result =
+ __s1[0] -
+ ((const
+ unsigned char
+ *)(const char
+ *)
+ (passphrase2))
+ [0]; __result;}
+ ))): __builtin_strcmp(passphrase1,
+ passphrase2))));}
+ ) != 0) {
+ explicit_bzero(passphrase1, strlen(passphrase1));
+ explicit_bzero(passphrase2, strlen(passphrase2));
+ free(passphrase1);
+ free(passphrase2);
+ printf("Passphrases do not match. Try again.\n");
+ }
+ explicit_bzero(passphrase2, strlen(passphrase2));
+ free(passphrase2);
+ }
+ if (identity_comment) {
+ strlcpy(comment, identity_comment, sizeof(comment));
+ snprintf(comment, sizeof comment, "%s@%s", pw->pw_name,
+ hostname);
+ }
+ if (!key_save_private
+ (private, identity_file, passphrase1, comment, use_new_format,
+ new_format_cipher, rounds)) {
+ printf("Saving the key failed: %s.\n", identity_file);
+ explicit_bzero(passphrase1, strlen(passphrase1));
+ free(passphrase1);
+ exit(1);
+ }
+ explicit_bzero(passphrase1, strlen(passphrase1));
+ free(passphrase1);
+ if (!quiet)
+ printf("Your identification has been saved in %s.\n",
+ identity_file);
+ strlcat(identity_file, ".pub", sizeof(identity_file));
+ if (!key_write(public, f))
+ fprintf(stderr, "write key failed\n");
+ fprintf(f, " %s\n", comment);
+ fclose(f);
+ if (!quiet) {
+ char *fp = key_fingerprint(public, SSH_FP_MD5, SSH_FP_HEX);
+ char *ra =
+ key_fingerprint(public, SSH_FP_MD5, SSH_FP_RANDOMART);
+ printf("Your public key has been saved in %s.\n",
+ identity_file);
+ printf("The key fingerprint is:\n");
+ printf("%s %s\n", fp, comment);
+ printf("The key's randomart image is:\n");
+ printf("%s\n", ra);
+ free(ra);
+ free(fp);
+ }
+}
git.wh0rd.org / ICEs.git / blobdiff