tyler.durden
/
openssh-portable
mirror of https://github.com/PowerShell/openssh-portable.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

upstream commit 

Allow fingerprinting from standard input "ssh-keygen -lf
 -"

Support fingerprinting multiple plain keys in a file and authorized_keys
files too (bz#1319)

ok markus@

Upstream-ID: 903f8b4502929d6ccf53509e4e07eae084574b77
This commit is contained in:
djm@openbsd.org 2015-11-16 22:53:07 +00:00 committed by Damien Miller
parent 5b4010d9b9
commit c56a255162
1 changed files with 131 additions and 92 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

199
ssh-keygen.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: ssh-keygen.c,v 1.278 2015/11/13 04:34:15 djm Exp $ */ /* $OpenBSD: ssh-keygen.c,v 1.279 2015/11/16 22:53:07 djm Exp $ */
/* /*
* Author: Tatu Ylonen <ylo@cs.hut.fi> * Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1994 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland * Copyright (c) 1994 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@ -808,72 +808,122 @@ do_download(struct passwd *pw)
#endif /* ENABLE_PKCS11 */ #endif /* ENABLE_PKCS11 */
} }
static struct sshkey *
try_read_key(char **cpp)
{
struct sshkey *ret;
int r;
if ((ret = sshkey_new(KEY_RSA1)) == NULL)
fatal("sshkey_new failed");
/* Try RSA1 */
if ((r = sshkey_read(ret, cpp)) == 0)
return ret;
/* Try modern */
sshkey_free(ret);
if ((ret = sshkey_new(KEY_UNSPEC)) == NULL)
fatal("sshkey_new failed");
if ((r = sshkey_read(ret, cpp)) == 0)
return ret;
/* Not a key */
sshkey_free(ret);
return NULL;
}
static void
fingerprint_one_key(const struct sshkey *public, const char *comment)
{
char *fp = NULL, *ra = NULL;
enum sshkey_fp_rep rep;
int fptype;
fptype = print_bubblebabble ? SSH_DIGEST_SHA1 : fingerprint_hash;
rep = print_bubblebabble ? SSH_FP_BUBBLEBABBLE : SSH_FP_DEFAULT;
fp = sshkey_fingerprint(public, fptype, rep);
ra = sshkey_fingerprint(public, fingerprint_hash, SSH_FP_RANDOMART);
if (fp == NULL || ra == NULL)
fatal("%s: sshkey_fingerprint failed", __func__);
printf("%u %s %s (%s)\n", sshkey_size(public), fp,
comment ? comment : "no comment", sshkey_type(public));
if (log_level >= SYSLOG_LEVEL_VERBOSE)
printf("%s\n", ra);
free(ra);
free(fp);
}
static void
fingerprint_private(const char *path)
{
struct stat st;
char *comment = NULL;
struct sshkey *public = NULL;
int r;
if (stat(identity_file, &st) < 0)
fatal("%s: %s", path, strerror(errno));
if ((r = sshkey_load_public(path, &public, &comment)) != 0)
fatal("Error loading public key \"%s\": %s", path, ssh_err(r));
fingerprint_one_key(public, comment);
sshkey_free(public);
free(comment);
}
static void static void
do_fingerprint(struct passwd *pw) do_fingerprint(struct passwd *pw)
{ {
FILE *f; FILE *f;
struct sshkey *public; struct sshkey *public = NULL;
char *comment = NULL, *cp, *ep, line[16*1024], *fp, *ra; char *comment = NULL, *cp, *ep, line[16*1024];
int r, i, skip = 0, num = 0, invalid = 1; int i, invalid = 1;
enum sshkey_fp_rep rep; const char *path;
int fptype; long int lnum = 0;
struct stat st;
fptype = print_bubblebabble ? SSH_DIGEST_SHA1 : fingerprint_hash;
rep = print_bubblebabble ? SSH_FP_BUBBLEBABBLE : SSH_FP_DEFAULT;
if (!have_identity) if (!have_identity)
ask_filename(pw, "Enter file in which the key is"); ask_filename(pw, "Enter file in which the key is");
if (stat(identity_file, &st) < 0) path = identity_file;
fatal("%s: %s", identity_file, strerror(errno));
if ((r = sshkey_load_public(identity_file, &public, &comment)) != 0) if (strcmp(identity_file, "-") == 0) {
debug2("Error loading public key \"%s\": %s", f = stdin;
identity_file, ssh_err(r)); path = "(stdin)";
else { } else if ((f = fopen(path, "r")) == NULL)
fp = sshkey_fingerprint(public, fptype, rep); fatal("%s: %s: %s", __progname, path, strerror(errno));
ra = sshkey_fingerprint(public, fingerprint_hash,
SSH_FP_RANDOMART); while (read_keyfile_line(f, path, line, sizeof(line), &lnum) == 0) {
if (fp == NULL || ra == NULL) cp = line;
fatal("%s: sshkey_fingerprint fail", __func__); cp[strcspn(cp, "\n")] = '\0';
printf("%u %s %s (%s)\n", sshkey_size(public), fp, comment, /* Trim leading space and comments */
sshkey_type(public)); cp = line + strspn(line, " \t");
if (log_level >= SYSLOG_LEVEL_VERBOSE) if (*cp == '#' || *cp == '\0')
printf("%s\n", ra); continue;
sshkey_free(public);
free(comment); /*
free(ra); * Input may be plain keys, private keys, authorized_keys
free(fp); * or known_hosts.
*/
/*
* Try private keys first. Assume a key is private if
* "SSH PRIVATE KEY" appears on the first line and we're
* not reading from stdin (XXX support private keys on stdin).
*/
if (lnum == 1 && strcmp(identity_file, "-") != 0 &&
strstr(cp, "SSH PRIVATE KEY") != NULL) {
fclose(f);
fingerprint_private(path);
exit(0); exit(0);
} }
if (comment) {
free(comment);
comment = NULL;
}
if ((f = fopen(identity_file, "r")) == NULL) /*
fatal("%s: %s: %s", __progname, identity_file, strerror(errno)); * If it's not a private key, then this must be prepared to
* accept a public key prefixed with a hostname or options.
while (fgets(line, sizeof(line), f)) { * Try a bare key first, otherwise skip the leading stuff.
if ((cp = strchr(line, '\n')) == NULL) { */
error("line %d too long: %.40s...", if ((public = try_read_key(&cp)) == NULL) {
num + 1, line);
skip = 1;
continue;
}
num++;
if (skip) {
skip = 0;
continue;
}
*cp = '\0';
/* Skip leading whitespace, empty and comment lines. */
for (cp = line; *cp == ' ' || *cp == '\t'; cp++)
;
if (!*cp || *cp == '\n' || *cp == '#')
continue;
i = strtol(cp, &ep, 10); i = strtol(cp, &ep, 10);
if (i == 0 || ep == NULL || (*ep != ' ' && *ep != '\t')) { if (i == 0 || ep == NULL ||
(*ep != ' ' && *ep != '\t')) {
int quoted = 0; int quoted = 0;
comment = cp; comment = cp;
for (; *cp && (quoted || (*cp != ' ' && for (; *cp && (quoted || (*cp != ' ' &&
*cp != '\t')); cp++) { *cp != '\t')); cp++) {
@ -886,38 +936,27 @@ do_fingerprint(struct passwd *pw)
continue; continue;
*cp++ = '\0'; *cp++ = '\0';
} }
ep = cp; }
if ((public = sshkey_new(KEY_RSA1)) == NULL) /* Retry after parsing leading hostname/key options */
fatal("sshkey_new failed"); if (public == NULL && (public = try_read_key(&cp)) == NULL) {
if ((r = sshkey_read(public, &cp)) != 0) { debug("%s:%ld: not a public key", path, lnum);
cp = ep;
sshkey_free(public);
if ((public = sshkey_new(KEY_UNSPEC)) == NULL)
fatal("sshkey_new failed");
if ((r = sshkey_read(public, &cp)) != 0) {
sshkey_free(public);
continue; continue;
} }
}
comment = *cp ? cp : comment; /* Find trailing comment, if any */
fp = sshkey_fingerprint(public, fptype, rep); for (; *cp == ' ' || *cp == '\t'; cp++)
ra = sshkey_fingerprint(public, fingerprint_hash, ;
SSH_FP_RANDOMART); if (*cp != '\0' && *cp != '#')
if (fp == NULL || ra == NULL) comment = cp;
fatal("%s: sshkey_fingerprint fail", __func__);
printf("%u %s %s (%s)\n", sshkey_size(public), fp, fingerprint_one_key(public, comment);
comment ? comment : "no comment", sshkey_type(public));
if (log_level >= SYSLOG_LEVEL_VERBOSE)
printf("%s\n", ra);
free(ra);
free(fp);
sshkey_free(public); sshkey_free(public);
invalid = 0; invalid = 0; /* One good key in the file is sufficient */
} }
fclose(f); fclose(f);
if (invalid) if (invalid)
fatal("%s is not a public key file.", identity_file); fatal("%s is not a public key file.", path);
exit(0); exit(0);
} }