tyler.durden
/
openssh-portable
mirror of https://github.com/PowerShell/openssh-portable.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

- markus@cvs.openbsd.org 2001/03/26 08:07:09 

[authfile.c authfile.h ssh-add.c ssh-keygen.c ssh.c sshconnect.c
      sshconnect.h sshconnect1.c sshconnect2.c sshd.c]
     simpler key load/save interface, see authfile.h
This commit is contained in:
Ben Lindstrom 2001-03-26 13:44:06 +00:00
parent 7bfff36ca3
commit d0fca423fc
11 changed files with 322 additions and 423 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
ChangeLog
View File

@ -1,3 +1,10 @@
20010328
- OpenBSD CVS Sync
- markus@cvs.openbsd.org 2001/03/26 08:07:09
[authfile.c authfile.h ssh-add.c ssh-keygen.c ssh.c sshconnect.c
sshconnect.h sshconnect1.c sshconnect2.c sshd.c]
simpler key load/save interface, see authfile.h
20010327
- Attempt sync with sshlogin.c w/ OpenBSD (mainly CVS ID)
- Fix pointer issues in waitpid() and wait() replaces. Patch by Lutz
@ -4718,4 +4725,4 @@
- Wrote replacements for strlcpy and mkdtemp
- Released 1.0pre1
$Id: ChangeLog,v 1.1019 2001/03/26 05:45:53 mouring Exp $
$Id: ChangeLog,v 1.1020 2001/03/26 13:44:06 mouring Exp $

341
authfile.c
View File

@ -36,7 +36,7 @@
*/
#include "includes.h"
RCSID("$OpenBSD: authfile.c,v 1.28 2001/02/21 09:05:54 deraadt Exp $");
RCSID("$OpenBSD: authfile.c,v 1.29 2001/03/26 08:07:07 markus Exp $");
#include <openssl/err.h>
#include <openssl/evp.h>
@ -51,7 +51,7 @@ RCSID("$OpenBSD: authfile.c,v 1.28 2001/02/21 09:05:54 deraadt Exp $");
#include "log.h"
#include "authfile.h"
/* Version identification string for identity files. */
/* Version identification string for SSH v1 identity files. */
static const char authfile_id_string[] =
"SSH PRIVATE KEY FILE FORMAT 1.1\n";
@ -63,8 +63,8 @@ static const char authfile_id_string[] =
*/
int
save_private_key_rsa1(const char *filename, const char *passphrase,
RSA *key, const char *comment)
key_save_private_rsa1(Key *key, const char *filename, const char *passphrase,
const char *comment)
{
Buffer buffer, encrypted;
char buf[100], *cp;
@ -100,10 +100,10 @@ save_private_key_rsa1(const char *filename, const char *passphrase,
* will be stored in plain text, and storing them also in encrypted
* format would just give known plaintext).
*/
buffer_put_bignum(&buffer, key->d);
buffer_put_bignum(&buffer, key->iqmp);
buffer_put_bignum(&buffer, key->q); /* reverse from SSL p */
buffer_put_bignum(&buffer, key->p); /* reverse from SSL q */
buffer_put_bignum(&buffer, key->rsa->d);
buffer_put_bignum(&buffer, key->rsa->iqmp);
buffer_put_bignum(&buffer, key->rsa->q); /* reverse from SSL p */
buffer_put_bignum(&buffer, key->rsa->p); /* reverse from SSL q */
/* Pad the part to be encrypted until its size is a multiple of 8. */
while (buffer_len(&buffer) % 8 != 0)
@ -122,9 +122,9 @@ save_private_key_rsa1(const char *filename, const char *passphrase,
buffer_put_int(&encrypted, 0); /* For future extension */
/* Store public key. This will be in plain text. */
buffer_put_int(&encrypted, BN_num_bits(key->n));
buffer_put_bignum(&encrypted, key->n);
buffer_put_bignum(&encrypted, key->e);
buffer_put_int(&encrypted, BN_num_bits(key->rsa->n));
buffer_put_bignum(&encrypted, key->rsa->n);
buffer_put_bignum(&encrypted, key->rsa->e);
buffer_put_string(&encrypted, comment, strlen(comment));
/* Allocate space for the private part of the key in the buffer. */
@ -156,10 +156,10 @@ save_private_key_rsa1(const char *filename, const char *passphrase,
return 1;
}
/* save SSH2 key in OpenSSL PEM format */
/* save SSH v2 key in OpenSSL PEM format */
int
save_private_key_ssh2(const char *filename, const char *_passphrase,
Key *key, const char *comment)
key_save_private_pem(Key *key, const char *filename, const char *_passphrase,
const char *comment)
{
FILE *fp;
int fd;
@ -199,16 +199,18 @@ save_private_key_ssh2(const char *filename, const char *_passphrase,
}
int
save_private_key(const char *filename, const char *passphrase, Key *key,
key_save_private(Key *key, const char *filename, const char *passphrase,
const char *comment)
{
switch (key->type) {
case KEY_RSA1:
return save_private_key_rsa1(filename, passphrase, key->rsa, comment);
return key_save_private_rsa1(key, filename, passphrase,
comment);
break;
case KEY_DSA:
case KEY_RSA:
return save_private_key_ssh2(filename, passphrase, key, comment);
return key_save_private_pem(key, filename, passphrase,
comment);
break;
default:
break;
@ -217,22 +219,20 @@ save_private_key(const char *filename, const char *passphrase, Key *key,
}
/*
* Loads the public part of the key file. Returns 0 if an error was
* encountered (the file does not exist or is not readable), and non-zero
* Loads the public part of the ssh v1 key file. Returns NULL if an error was
* encountered (the file does not exist or is not readable), and the key
* otherwise.
*/
int
load_public_key_rsa(const char *filename, RSA * pub, char **comment_return)
Key *
key_load_public_rsa1(int fd, const char *filename, char **commentp)
{
int fd, i;
off_t len;
Buffer buffer;
Key *pub;
char *cp;
int i;
off_t len;
fd = open(filename, O_RDONLY);
if (fd < 0)
return 0;
len = lseek(fd, (off_t) 0, SEEK_END);
lseek(fd, (off_t) 0, SEEK_SET);
@ -243,16 +243,14 @@ load_public_key_rsa(const char *filename, RSA * pub, char **comment_return)
debug("Read from key file %.200s failed: %.100s", filename,
strerror(errno));
buffer_free(&buffer);
close(fd);
return 0;
return NULL;
}
close(fd);
/* Check that it is at least big enough to contain the ID string. */
if (len < sizeof(authfile_id_string)) {
debug3("Bad RSA1 key file %.200s.", filename);
buffer_free(&buffer);
return 0;
return NULL;
}
/*
* Make sure it begins with the id string. Consume the id string
@ -262,7 +260,7 @@ load_public_key_rsa(const char *filename, RSA * pub, char **comment_return)
if (buffer_get_char(&buffer) != authfile_id_string[i]) {
debug3("Bad RSA1 key file %.200s.", filename);
buffer_free(&buffer);
return 0;
return NULL;
}
/* Skip cipher type and reserved data. */
(void) buffer_get_char(&buffer); /* cipher type */
@ -270,37 +268,33 @@ load_public_key_rsa(const char *filename, RSA * pub, char **comment_return)
/* Read the public key from the buffer. */
buffer_get_int(&buffer);
/* XXX alloc */
if (pub->n == NULL)
pub->n = BN_new();
buffer_get_bignum(&buffer, pub->n);
/* XXX alloc */
if (pub->e == NULL)
pub->e = BN_new();
buffer_get_bignum(&buffer, pub->e);
if (comment_return)
*comment_return = buffer_get_string(&buffer, NULL);
pub = key_new(KEY_RSA1);
buffer_get_bignum(&buffer, pub->rsa->n);
buffer_get_bignum(&buffer, pub->rsa->e);
if (commentp)
*commentp = buffer_get_string(&buffer, NULL);
/* The encrypted private part is not parsed by this function. */
buffer_free(&buffer);
return 1;
return pub;
}
/* load public key from private-key file */
int
load_public_key(const char *filename, Key * key, char **comment_return)
/* load public key from private-key file, works only for SSH v1 */
Key *
key_load_public_type(int type, const char *filename, char **commentp)
{
switch (key->type) {
case KEY_RSA1:
return load_public_key_rsa(filename, key->rsa, comment_return);
break;
case KEY_DSA:
case KEY_RSA:
default:
break;
Key *pub;
int fd;
if (type == KEY_RSA1) {
fd = open(filename, O_RDONLY);
if (fd < 0)
return NULL;
pub = key_load_public_rsa1(fd, filename, commentp);
close(fd);
return pub;
}
return 0;
return NULL;
}
/*
@ -310,9 +304,9 @@ load_public_key(const char *filename, Key * key, char **comment_return)
* Assumes we are called under uid of the owner of the file.
*/
int
load_private_key_rsa1(int fd, const char *filename,
const char *passphrase, RSA * prv, char **comment_return)
Key *
key_load_private_rsa1(int fd, const char *filename, const char *passphrase,
char **commentp)
{
int i, check1, check2, cipher_type;
off_t len;
@ -322,6 +316,7 @@ load_private_key_rsa1(int fd, const char *filename,
Cipher *cipher;
BN_CTX *ctx;
BIGNUM *aux;
Key *prv = NULL;
len = lseek(fd, (off_t) 0, SEEK_END);
lseek(fd, (off_t) 0, SEEK_SET);
@ -334,7 +329,7 @@ load_private_key_rsa1(int fd, const char *filename,
strerror(errno));
buffer_free(&buffer);
close(fd);
return 0;
return NULL;
}
/* Check that it is at least big enough to contain the ID string. */
@ -342,7 +337,7 @@ load_private_key_rsa1(int fd, const char *filename,
debug3("Bad RSA1 key file %.200s.", filename);
buffer_free(&buffer);
close(fd);
return 0;
return NULL;
}
/*
* Make sure it begins with the id string. Consume the id string
@ -353,7 +348,7 @@ load_private_key_rsa1(int fd, const char *filename,
debug3("Bad RSA1 key file %.200s.", filename);
buffer_free(&buffer);
close(fd);
return 0;
return NULL;
}
/* Read cipher type. */
@ -362,12 +357,12 @@ load_private_key_rsa1(int fd, const char *filename,
/* Read the public key from the buffer. */
buffer_get_int(&buffer);
prv->n = BN_new();
buffer_get_bignum(&buffer, prv->n);
prv->e = BN_new();
buffer_get_bignum(&buffer, prv->e);
if (comment_return)
*comment_return = buffer_get_string(&buffer, NULL);
prv = key_new_private(KEY_RSA1);
buffer_get_bignum(&buffer, prv->rsa->n);
buffer_get_bignum(&buffer, prv->rsa->e);
if (commentp)
*commentp = buffer_get_string(&buffer, NULL);
else
xfree(buffer_get_string(&buffer, NULL));
@ -395,93 +390,81 @@ load_private_key_rsa1(int fd, const char *filename,
if (check1 != buffer_get_char(&decrypted) ||
check2 != buffer_get_char(&decrypted)) {
if (strcmp(passphrase, "") != 0)
debug("Bad passphrase supplied for key file %.200s.", filename);
debug("Bad passphrase supplied for key file %.200s.",
filename);
/* Bad passphrase. */
buffer_free(&decrypted);
fail:
BN_clear_free(prv->n);
prv->n = NULL;
BN_clear_free(prv->e);
prv->e = NULL;
if (comment_return)
xfree(*comment_return);
close(fd);
return 0;
goto fail;
}
/* Read the rest of the private key. */
prv->d = BN_new();
buffer_get_bignum(&decrypted, prv->d);
prv->iqmp = BN_new();
buffer_get_bignum(&decrypted, prv->iqmp); /* u */
/* in SSL and SSH p and q are exchanged */
prv->q = BN_new();
buffer_get_bignum(&decrypted, prv->q); /* p */
prv->p = BN_new();
buffer_get_bignum(&decrypted, prv->p); /* q */
buffer_get_bignum(&decrypted, prv->rsa->d);
buffer_get_bignum(&decrypted, prv->rsa->iqmp); /* u */
/* in SSL and SSH v1 p and q are exchanged */
buffer_get_bignum(&decrypted, prv->rsa->q); /* p */
buffer_get_bignum(&decrypted, prv->rsa->p); /* q */
/* calculate p-1 and q-1 */
ctx = BN_CTX_new();
aux = BN_new();
BN_sub(aux, prv->q, BN_value_one());
prv->dmq1 = BN_new();
BN_mod(prv->dmq1, prv->d, aux, ctx);
BN_sub(aux, prv->rsa->q, BN_value_one());
BN_mod(prv->rsa->dmq1, prv->rsa->d, aux, ctx);
BN_sub(aux, prv->p, BN_value_one());
prv->dmp1 = BN_new();
BN_mod(prv->dmp1, prv->d, aux, ctx);
BN_sub(aux, prv->rsa->p, BN_value_one());
BN_mod(prv->rsa->dmp1, prv->rsa->d, aux, ctx);
BN_clear_free(aux);
BN_CTX_free(ctx);
buffer_free(&decrypted);
close(fd);
return 1;
return prv;
fail:
if (commentp)
xfree(*commentp);
close(fd);
key_free(prv);
return NULL;
}
int
load_private_key_ssh2(int fd, const char *passphrase, Key *k, char **comment_return)
Key *
key_load_private_pem(int fd, int type, const char *passphrase,
char **commentp)
{
FILE *fp;
int success = 0;
EVP_PKEY *pk = NULL;
Key *prv = NULL;
char *name = "<no key>";
fp = fdopen(fd, "r");
if (fp == NULL) {
error("fdopen failed");
close(fd);
return 0;
return NULL;
}
pk = PEM_read_PrivateKey(fp, NULL, NULL, (char *)passphrase);
if (pk == NULL) {
debug("PEM_read_PrivateKey failed");
(void)ERR_get_error();
} else if (pk->type == EVP_PKEY_RSA) {
/* replace k->rsa with loaded key */
if (k->type == KEY_RSA || k->type == KEY_UNSPEC) {
if (k->rsa != NULL)
RSA_free(k->rsa);
k->rsa = EVP_PKEY_get1_RSA(pk);
k->type = KEY_RSA;
name = "rsa w/o comment";
success = 1;
} else if (pk->type == EVP_PKEY_RSA &&
(type == KEY_UNSPEC||type==KEY_RSA)) {
prv = key_new(KEY_UNSPEC);
prv->rsa = EVP_PKEY_get1_RSA(pk);
prv->type = KEY_RSA;
name = "rsa w/o comment";
#ifdef DEBUG_PK
RSA_print_fp(stderr, k->rsa, 8);
RSA_print_fp(stderr, prv->rsa, 8);
#endif
}
} else if (pk->type == EVP_PKEY_DSA) {
/* replace k->dsa with loaded key */
if (k->type == KEY_DSA || k->type == KEY_UNSPEC) {
if (k->dsa != NULL)
DSA_free(k->dsa);
k->dsa = EVP_PKEY_get1_DSA(pk);
k->type = KEY_DSA;
name = "dsa w/o comment";
} else if (pk->type == EVP_PKEY_DSA &&
(type == KEY_UNSPEC||type==KEY_DSA)) {
prv = key_new(KEY_UNSPEC);
prv->dsa = EVP_PKEY_get1_DSA(pk);
prv->type = KEY_DSA;
name = "dsa w/o comment";
#ifdef DEBUG_PK
DSA_print_fp(stderr, k->dsa, 8);
DSA_print_fp(stderr, prv->dsa, 8);
#endif
success = 1;
}
} else {
error("PEM_read_PrivateKey: mismatch or "
"unknown EVP_PKEY save_type %d", pk->save_type);
@ -489,24 +472,18 @@ load_private_key_ssh2(int fd, const char *passphrase, Key *k, char **comment_ret
fclose(fp);
if (pk != NULL)
EVP_PKEY_free(pk);
if (success && comment_return)
*comment_return = xstrdup(name);
debug("read SSH2 private key done: name %s success %d", name, success);
return success;
if (prv != NULL && commentp)
*commentp = xstrdup(name);
debug("read PEM private key done: type %s",
prv ? key_type(prv) : "<unknown>");
return prv;
}
int
load_private_key(const char *filename, const char *passphrase, Key *key,
char **comment_return)
key_perm_ok(int fd, const char *filename)
{
int fd;
int ret = 0;
struct stat st;
fd = open(filename, O_RDONLY);
if (fd < 0)
return 0;
/* check owner and modes */
#ifdef HAVE_CYGWIN
if (check_ntsec(filename))
@ -521,40 +498,78 @@ load_private_key(const char *filename, const char *passphrase, Key *key,
error("Bad ownership or mode(0%3.3o) for '%s'.",
st.st_mode & 0777, filename);
error("It is recommended that your private key files are NOT accessible by others.");
error("This private key will be ignored.");
return 0;
}
switch (key->type) {
case KEY_RSA1:
if (key->rsa->e != NULL) {
BN_clear_free(key->rsa->e);
key->rsa->e = NULL;
}
if (key->rsa->n != NULL) {
BN_clear_free(key->rsa->n);
key->rsa->n = NULL;
}
ret = load_private_key_rsa1(fd, filename, passphrase,
key->rsa, comment_return); /* closes fd */
return 1;
}
Key *
key_load_private_type(int type, const char *filename, const char *passphrase,
char **commentp)
{
int fd;
fd = open(filename, O_RDONLY);
if (fd < 0)
return NULL;
if (!key_perm_ok(fd, filename)) {
debug("bad permissions: ignore key: %s", filename);
close(fd);
return NULL;
}
switch (type) {
case KEY_RSA1:
return key_load_private_rsa1(fd, filename, passphrase,
commentp);
/* closes fd */
break;
case KEY_DSA:
case KEY_RSA:
case KEY_UNSPEC:
ret = load_private_key_ssh2(fd, passphrase, key,
comment_return); /* closes fd */
return key_load_private_pem(fd, type, passphrase, commentp);
/* closes fd */
break;
default:
close(fd);
break;
}
return ret;
return NULL;
}
Key *
key_load_private(const char *filename, const char *passphrase,
char **commentp)
{
Key *pub;
int fd;
fd = open(filename, O_RDONLY);
if (fd < 0)
return NULL;
if (!key_perm_ok(fd, filename)) {
debug("bad permissions: ignore key: %s", filename);
close(fd);
return NULL;
}
pub = key_load_public_rsa1(fd, filename, commentp);
lseek(fd, (off_t) 0, SEEK_SET); /* rewind */
if (pub == NULL) {
/* closes fd */
return key_load_private_pem(fd, KEY_UNSPEC, passphrase, NULL);
} else {
/* it's a SSH v1 key if the public key part is readable */
key_free(pub);
/* closes fd */
return key_load_private_rsa1(fd, filename, passphrase, NULL);
}
}
int
do_load_public_key(const char *filename, Key *k, char **commentp)
key_try_load_public(Key *k, const char *filename, char **commentp)
{
FILE *f;
char line[1024];
char line[4096];
char *cp;
f = fopen(filename, "r");
@ -585,19 +600,23 @@ do_load_public_key(const char *filename, Key *k, char **commentp)
return 0;
}
/* load public key from pubkey file */
int
try_load_public_key(const char *filename, Key *k, char **commentp)
/* load public key from ssh v1 private or any pubkey file */
Key *
key_load_public(const char *filename, char **commentp)
{
char pub[MAXPATHLEN];
Key *pub;
char file[MAXPATHLEN];
if (do_load_public_key(filename, k, commentp) == 1)
return 1;
if (strlcpy(pub, filename, sizeof pub) >= MAXPATHLEN)
return 0;
if (strlcat(pub, ".pub", sizeof pub) >= MAXPATHLEN)
return 0;
if (do_load_public_key(pub, k, commentp) == 1)
return 1;
return 0;
pub = key_load_public_type(KEY_RSA1, filename, commentp);
if (pub != NULL)
return pub;
pub = key_new(KEY_UNSPEC);
if (key_try_load_public(pub, filename, commentp) == 1)
return pub;
if ((strlcpy(file, filename, sizeof file) < sizeof(file)) &&
(strlcat(file, ".pub", sizeof file) < sizeof(file)) &&
(key_try_load_public(pub, file, commentp) == 1))
return pub;
key_free(pub);
return NULL;
}

45
authfile.h
View File

@ -2,7 +2,6 @@
* Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
* All rights reserved
* Functions to interface with the SSH_AUTHENTICATION_FD socket.
*
* As far as I am concerned, the code I have written for this software
* can be used freely for any purpose. Any derived versions of this
@ -11,41 +10,27 @@
* called by a name other than "ssh" or "Secure Shell".
*/
/* $OpenBSD: authfile.h,v 1.5 2000/10/16 09:38:44 djm Exp $ */
/* $OpenBSD: authfile.h,v 1.6 2001/03/26 08:07:08 markus Exp $ */
#ifndef AUTHFILE_H
#define AUTHFILE_H
/*
* Saves the authentication (private) key in a file, encrypting it with
* passphrase.
* For RSA keys: The identification of the file (lowest 64 bits of n)
* will precede the key to provide identification of the key without
* needing a passphrase.
*/
int
save_private_key(const char *filename, const char *passphrase,
Key * private_key, const char *comment);
key_save_private(Key *key, const char *filename, const char *passphrase,
const char *comment);
/*
* Loads the public part of the key file (public key and comment). Returns 0
* if an error occurred; zero if the public key was successfully read. The
* comment of the key is returned in comment_return if it is non-NULL; the
* caller must free the value with xfree.
*/
int load_public_key(const char *filename, Key * pub, char **comment_return);
int try_load_public_key(const char *filename, Key * pub, char **comment_return);
Key *
key_load_public(const char *filename, char **commentp);
/*
* Loads the private key from the file. Returns 0 if an error is encountered
* (file does not exist or is not readable, or passphrase is bad). This
* initializes the private key. The comment of the key is returned in
* comment_return if it is non-NULL; the caller must free the value with
* xfree.
*/
int
load_private_key(const char *filename, const char *passphrase,
Key * private_key, char **comment_return);
Key *
key_load_public_type(int type, const char *filename, char **commentp);
Key *
key_load_private(const char *filename, const char *passphrase,
char **commentp);
Key *
key_load_private_type(int type, const char *filename, const char *passphrase,
char **commentp);
#endif

56
ssh-add.c
View File

@ -35,7 +35,7 @@
*/
#include "includes.h"
RCSID("$OpenBSD: ssh-add.c,v 1.30 2001/03/12 22:02:02 markus Exp $");
RCSID("$OpenBSD: ssh-add.c,v 1.31 2001/03/26 08:07:08 markus Exp $");
#include <openssl/evp.h>
@ -61,14 +61,10 @@ delete_file(AuthenticationConnection *ac, const char *filename)
Key *public;
char *comment;
public = key_new(KEY_RSA1);
if (!load_public_key(filename, public, &comment)) {
key_free(public);
public = key_new(KEY_UNSPEC);
if (!try_load_public_key(filename, public, &comment)) {
printf("Bad key file %s\n", filename);
return;
}
public = key_load_public(filename, &comment);
if (public == NULL) {
printf("Bad key file %s\n", filename);
return;
}
if (ssh_remove_identity(ac, public))
fprintf(stderr, "Identity removed: %s (%s)\n", filename, comment);
@ -139,30 +135,15 @@ void
add_file(AuthenticationConnection *ac, const char *filename)
{
struct stat st;
Key *public;
Key *private;
char *saved_comment, *comment, *askpass = NULL;
char *comment, *askpass = NULL, *pass;
char buf[1024], msg[1024];
int success;
int interactive = isatty(STDIN_FILENO);
int type = KEY_RSA1;
if (stat(filename, &st) < 0) {
perror(filename);
exit(1);
}
/*
* try to load the public key. right now this only works for RSA,
* since DSA keys are fully encrypted
*/
public = key_new(KEY_RSA1);
if (!load_public_key(filename, public, &saved_comment)) {
/* ok, so we will assume this is 'some' key */
type = KEY_UNSPEC;
saved_comment = xstrdup(filename);
}
key_free(public);
if (!interactive && getenv("DISPLAY")) {
if (getenv(SSH_ASKPASS_ENV))
askpass = getenv(SSH_ASKPASS_ENV);
@ -171,17 +152,17 @@ add_file(AuthenticationConnection *ac, const char *filename)
}
/* At first, try empty passphrase */
private = key_new(type);
success = load_private_key(filename, "", private, &comment);
if (!success) {
private = key_load_private(filename, "", &comment);
if (comment == NULL)
comment = xstrdup(filename);
if (private == NULL) {
printf("Need passphrase for %.200s\n", filename);
if (!interactive && askpass == NULL) {
xfree(saved_comment);
xfree(comment);
return;
}
snprintf(msg, sizeof msg, "Enter passphrase for %.200s", saved_comment);
snprintf(msg, sizeof msg, "Enter passphrase for %.200s", comment);
for (;;) {
char *pass;
if (interactive) {
snprintf(buf, sizeof buf, "%s: ", msg);
pass = read_passphrase(buf, 1);
@ -190,24 +171,23 @@ add_file(AuthenticationConnection *ac, const char *filename)
}
if (strcmp(pass, "") == 0) {
xfree(pass);
xfree(saved_comment);
xfree(comment);
return;
}
success = load_private_key(filename, pass, private, &comment);
private = key_load_private(filename, pass, &comment);
memset(pass, 0, strlen(pass));
xfree(pass);
if (success)
if (private != NULL)
break;
strlcpy(msg, "Bad passphrase, try again", sizeof msg);
}
}
xfree(comment);
if (ssh_add_identity(ac, private, saved_comment))
fprintf(stderr, "Identity added: %s (%s)\n", filename, saved_comment);
if (ssh_add_identity(ac, private, comment))
fprintf(stderr, "Identity added: %s (%s)\n", filename, comment);
else
fprintf(stderr, "Could not add identity: %s\n", filename);
xfree(comment);
key_free(private);
xfree(saved_comment);
}
void

133
ssh-keygen.c
View File

@ -12,7 +12,7 @@
*/
#include "includes.h"
RCSID("$OpenBSD: ssh-keygen.c,v 1.51 2001/03/21 14:20:45 jakob Exp $");
RCSID("$OpenBSD: ssh-keygen.c,v 1.52 2001/03/26 08:07:09 markus Exp $");
#include <openssl/evp.h>
#include <openssl/pem.h>
@ -111,19 +111,20 @@ ask_filename(struct passwd *pw, const char *prompt)
have_identity = 1;
}
int
try_load_key(char *filename, Key *k)
Key *
try_load_pem_key(char *filename)
{
int success = 1;
if (!load_private_key(filename, "", k, NULL)) {
char *pass = read_passphrase("Enter passphrase: ", 1);
if (!load_private_key(filename, pass, k, NULL)) {
success = 0;
}
char *pass;
Key *prv;
prv = key_load_private(filename, "", NULL);
if (prv == NULL) {
pass = read_passphrase("Enter passphrase: ", 1);
prv = key_load_private(filename, pass, NULL);
memset(pass, 0, strlen(pass));
xfree(pass);
}
return success;
return prv;
}
#define SSH_COM_PUBLIC_BEGIN "---- BEGIN SSH2 PUBLIC KEY ----"
@ -134,7 +135,7 @@ try_load_key(char *filename, Key *k)
void
do_convert_to_ssh2(struct passwd *pw)
{
Key *k;
Key *prv;
int len;
u_char *blob;
struct stat st;
@ -145,20 +146,20 @@ do_convert_to_ssh2(struct passwd *pw)
perror(identity_file);
exit(1);
}
k = key_new(KEY_UNSPEC);
if (!try_load_key(identity_file, k)) {
prv = try_load_pem_key(identity_file);
if (prv == NULL) {
fprintf(stderr, "load failed\n");
exit(1);
}
key_to_blob(k, &blob, &len);
key_to_blob(prv, &blob, &len);
fprintf(stdout, "%s\n", SSH_COM_PUBLIC_BEGIN);
fprintf(stdout,
"Comment: \"%d-bit %s, converted from OpenSSH by %s@%s\"\n",
key_size(k), key_type(k),
key_size(prv), key_type(prv),
pw->pw_name, hostname);
dump_base64(stdout, blob, len);
fprintf(stdout, "%s\n", SSH_COM_PUBLIC_END);
key_free(k);
key_free(prv);
xfree(blob);
exit(0);
}
@ -302,7 +303,7 @@ do_convert_from_ssh2(struct passwd *pw)
void
do_print_public(struct passwd *pw)
{
Key *k;
Key *prv;
struct stat st;
if (!have_identity)
@ -311,14 +312,14 @@ do_print_public(struct passwd *pw)
perror(identity_file);
exit(1);
}
k = key_new(KEY_UNSPEC);
if (!try_load_key(identity_file, k)) {
prv = try_load_pem_key(identity_file);
if (prv == NULL) {
fprintf(stderr, "load failed\n");
exit(1);
}
if (!key_write(k, stdout))
if (!key_write(prv, stdout))
fprintf(stderr, "key_write failed");
key_free(k);
key_free(prv);
fprintf(stdout, "\n");
exit(0);
}
@ -329,11 +330,11 @@ do_fingerprint(struct passwd *pw)
FILE *f;
Key *public;
char *comment = NULL, *cp, *ep, line[16*1024], *fp;
int i, skip = 0, num = 1, invalid = 1, success = 0, rep, type;
int i, skip = 0, num = 1, invalid = 1, rep, fptype;
struct stat st;
type = print_bubblebabble ? SSH_FP_SHA1 : SSH_FP_MD5;
rep = print_bubblebabble ? SSH_FP_BUBBLEBABBLE : SSH_FP_HEX;
fptype = print_bubblebabble ? SSH_FP_SHA1 : SSH_FP_MD5;
rep = print_bubblebabble ? SSH_FP_BUBBLEBABBLE : SSH_FP_HEX;
if (!have_identity)
ask_filename(pw, "Enter file in which the key is");
@ -341,26 +342,17 @@ do_fingerprint(struct passwd *pw)
perror(identity_file);
exit(1);
}
public = key_new(KEY_RSA1);
if (load_public_key(identity_file, public, &comment)) {
success = 1;
} else {
key_free(public);
public = key_new(KEY_UNSPEC);
if (try_load_public_key(identity_file, public, &comment))
success = 1;
else
debug("try_load_public_key KEY_UNSPEC failed");
}
if (success) {
fp = key_fingerprint(public, type, rep);
printf("%d %s %s\n", key_size(public),
fp, comment);
public = key_load_public(identity_file, &comment);
if (public != NULL) {
fp = key_fingerprint(public, fptype, rep);
printf("%d %s %s\n", key_size(public), fp, comment);
key_free(public);
xfree(comment);
xfree(fp);
exit(0);
}
if (comment)
xfree(comment);
f = fopen(identity_file, "r");
if (f != NULL) {
@ -409,15 +401,15 @@ do_fingerprint(struct passwd *pw)
}
}
comment = *cp ? cp : comment;
fp = key_fingerprint(public, type, rep);
fp = key_fingerprint(public, fptype, rep);
printf("%d %s %s\n", key_size(public), fp,
comment ? comment : "no comment");
xfree(fp);
key_free(public);
invalid = 0;
}
fclose(f);
}
key_free(public);
if (invalid) {
printf("%s is not a valid key file.\n", identity_file);
exit(1);
@ -436,8 +428,6 @@ do_change_passphrase(struct passwd *pw)
char *old_passphrase, *passphrase1, *passphrase2;
struct stat st;
Key *private;
Key *public;
int type = KEY_RSA1;
if (!have_identity)
ask_filename(pw, "Enter file in which the key is");
@ -445,28 +435,20 @@ do_change_passphrase(struct passwd *pw)
perror(identity_file);
exit(1);
}
public = key_new(type);
if (!load_public_key(identity_file, public, NULL)) {
type = KEY_UNSPEC;
} else {
/* Clear the public key since we are just about to load the whole file. */
key_free(public);
}
/* Try to load the file with empty passphrase. */
private = key_new(type);
if (!load_private_key(identity_file, "", private, &comment)) {
private = key_load_private(identity_file, "", &comment);
if (private == NULL) {
if (identity_passphrase)
old_passphrase = xstrdup(identity_passphrase);
else
old_passphrase = read_passphrase("Enter old passphrase: ", 1);
if (!load_private_key(identity_file, old_passphrase, private, &comment)) {
memset(old_passphrase, 0, strlen(old_passphrase));
xfree(old_passphrase);
private = key_load_private(identity_file, old_passphrase , &comment);
memset(old_passphrase, 0, strlen(old_passphrase));
xfree(old_passphrase);
if (private == NULL) {
printf("Bad passphrase.\n");
exit(1);
}
memset(old_passphrase, 0, strlen(old_passphrase));
xfree(old_passphrase);
}
printf("Key has comment '%s'\n", comment);
@ -494,7 +476,7 @@ do_change_passphrase(struct passwd *pw)
}
/* Save the file using the new passphrase. */
if (!save_private_key(identity_file, passphrase1, private, comment)) {
if (!key_save_private(private, identity_file, passphrase1, comment)) {
printf("Saving the key failed: %s: %s.\n",
identity_file, strerror(errno));
memset(passphrase1, 0, strlen(passphrase1));
@ -520,7 +502,8 @@ void
do_change_comment(struct passwd *pw)
{
char new_comment[1024], *comment, *passphrase;
Key *private, *public;
Key *private;
Key *public;
struct stat st;
FILE *f;
int fd;
@ -531,21 +514,8 @@ do_change_comment(struct passwd *pw)
perror(identity_file);
exit(1);
}
/*
* Try to load the public key from the file the verify that it is
* readable and of the proper format.
*/
public = key_new(KEY_RSA1);
if (!load_public_key(identity_file, public, NULL)) {
printf("%s is not a valid key file.\n", identity_file);
printf("Comments are only supported in RSA1 keys\n");
exit(1);
}
private = key_new(KEY_RSA1);
if (load_private_key(identity_file, "", private, &comment))
passphrase = xstrdup("");
else {
private = key_load_private(identity_file, "", &comment);
if (private == NULL) {
if (identity_passphrase)
passphrase = xstrdup(identity_passphrase);
else if (identity_new_passphrase)
@ -553,13 +523,21 @@ do_change_comment(struct passwd *pw)
else
passphrase = read_passphrase("Enter passphrase: ", 1);
/* Try to load using the passphrase. */
if (!load_private_key(identity_file, passphrase, private, &comment)) {
private = key_load_private(identity_file, passphrase, &comment);
if (private == NULL) {
memset(passphrase, 0, strlen(passphrase));
xfree(passphrase);
printf("Bad passphrase.\n");
exit(1);
}
} else {
passphrase = xstrdup("");
}
if (private->type != KEY_RSA1) {
fprintf(stderr, "Comments are only supported for RSA1 keys.\n");
key_free(private);
exit(1);
}
printf("Key now has comment '%s'\n", comment);
if (identity_comment) {
@ -577,7 +555,7 @@ do_change_comment(struct passwd *pw)
}
/* Save the file using the new passphrase. */
if (!save_private_key(identity_file, passphrase, private, new_comment)) {
if (!key_save_private(private, identity_file, passphrase, new_comment)) {
printf("Saving the key failed: %s: %s.\n",
identity_file, strerror(errno));
memset(passphrase, 0, strlen(passphrase));
@ -588,6 +566,7 @@ do_change_comment(struct passwd *pw)
}
memset(passphrase, 0, strlen(passphrase));
xfree(passphrase);
public = key_from_private(private);
key_free(private);
strlcat(identity_file, ".pub", sizeof(identity_file));
@ -823,7 +802,7 @@ passphrase_again:
}
/* Save the key with the given passphrase and comment. */
if (!save_private_key(identity_file, passphrase1, private, comment)) {
if (!key_save_private(private, identity_file, passphrase1, comment)) {
printf("Saving the key failed: %s: %s.\n",
identity_file, strerror(errno));
memset(passphrase1, 0, strlen(passphrase1));

54
ssh.c
View File

@ -39,7 +39,7 @@
*/
#include "includes.h"
RCSID("$OpenBSD: ssh.c,v 1.104 2001/03/08 21:42:32 markus Exp $");
RCSID("$OpenBSD: ssh.c,v 1.105 2001/03/26 08:07:09 markus Exp $");
#include <openssl/evp.h>
#include <openssl/err.h>
@ -130,11 +130,8 @@ struct sockaddr_storage hostaddr;
*/
volatile int received_window_change_signal = 0;
/* Flag indicating whether we have a valid host private key loaded. */
int host_private_key_loaded = 0;
/* Host private key. */
RSA *host_private_key = NULL;
Key *host_private_key = NULL;
/* Original real UID. */
uid_t original_real_uid;
@ -631,12 +628,8 @@ main(int ac, char **av)
* privileges, because the file is only readable by root.
*/
if (ok && (options.protocol & SSH_PROTO_1)) {
Key k;
host_private_key = RSA_new();
k.type = KEY_RSA1;
k.rsa = host_private_key;
if (load_private_key(_PATH_HOST_KEY_FILE, "", &k, NULL))
host_private_key_loaded = 1;
host_private_key = key_load_private_type(KEY_RSA1,
_PATH_HOST_KEY_FILE, "", NULL);
}
/*
* Get rid of any extra privileges that we may have. We will no
@ -695,12 +688,12 @@ main(int ac, char **av)
tilde_expand_filename(options.user_hostfile2, original_real_uid);
/* Log into the remote system. This never returns if the login fails. */
ssh_login(host_private_key_loaded, host_private_key,
host, (struct sockaddr *)&hostaddr, original_real_uid);
ssh_login(host_private_key, host, (struct sockaddr *)&hostaddr,
original_real_uid);
/* We no longer need the host private key. Clear it now. */
if (host_private_key_loaded)
RSA_free(host_private_key); /* Destroys contents safely */
if (host_private_key != NULL)
key_free(host_private_key); /* Destroys contents safely */
exit_status = compat20 ? ssh_session2() : ssh_session();
packet_close();
@ -1074,26 +1067,6 @@ ssh_session2(void)
return client_loop(tty_flag, tty_flag ? options.escape_char : -1, id);
}
int
guess_identity_file_type(const char *filename)
{
struct stat st;
Key *public;
int type = KEY_RSA1; /* default */
if (stat(filename, &st) < 0) {
/* ignore this key */
return KEY_UNSPEC;
}
public = key_new(type);
if (!load_public_key(filename, public, NULL)) {
/* ok, so we will assume this is 'some' key */
type = KEY_UNSPEC;
}
key_free(public);
return type;
}
void
load_public_identity_files(void)
{
@ -1104,16 +1077,7 @@ load_public_identity_files(void)
for (i = 0; i < options.num_identity_files; i++) {
filename = tilde_expand_filename(options.identity_files[i],
original_real_uid);
public = key_new(KEY_RSA1);
if (!load_public_key(filename, public, NULL)) {
key_free(public);
public = key_new(KEY_UNSPEC);
if (!try_load_public_key(filename, public, NULL)) {
debug("unknown identity file %s", filename);
key_free(public);
public = NULL;
}
}
public = key_load_public(filename, NULL);
debug("identity file %s type %d", filename,
public ? public->type : -1);
xfree(options.identity_files[i]);

6
sshconnect.c
View File

@ -13,7 +13,7 @@
*/
#include "includes.h"
RCSID("$OpenBSD: sshconnect.c,v 1.100 2001/03/12 22:02:02 markus Exp $");
RCSID("$OpenBSD: sshconnect.c,v 1.101 2001/03/26 08:07:09 markus Exp $");
#include <openssl/bn.h>
@ -738,7 +738,7 @@ check_host_key(char *host, struct sockaddr *hostaddr, Key *host_key,
* This function does not require super-user privileges.
*/
void
ssh_login(int host_key_valid, RSA *own_host_key, const char *orighost,
ssh_login(Key *own_host_key, const char *orighost,
struct sockaddr *hostaddr, uid_t original_real_uid)
{
struct passwd *pw;
@ -771,7 +771,7 @@ ssh_login(int host_key_valid, RSA *own_host_key, const char *orighost,
ssh_userauth2(server_user, host);
} else {
ssh_kex(host, hostaddr);
ssh_userauth(local_user, server_user, host, host_key_valid, own_host_key);
ssh_userauth(local_user, server_user, host, own_host_key);
}
}

6
sshconnect.h
View File

@ -1,4 +1,4 @@
/* $OpenBSD: sshconnect.h,v 1.6 2001/02/15 23:19:59 markus Exp $ */
/* $OpenBSD: sshconnect.h,v 1.7 2001/03/26 08:07:09 markus Exp $ */
/*
* Copyright (c) 2000 Markus Friedl. All rights reserved.
@ -50,7 +50,7 @@ ssh_connect(const char *host, struct sockaddr_storage * hostaddr,
*/
void
ssh_login(int host_key_valid, RSA * host_key, const char *host,
ssh_login(Key *host_key, const char *host,
struct sockaddr * hostaddr, uid_t original_real_uid);
@ -61,7 +61,7 @@ check_host_key(char *host, struct sockaddr *hostaddr, Key *host_key,
void ssh_kex(char *host, struct sockaddr *hostaddr);
void
ssh_userauth(const char * local_user, const char * server_user, char *host,
int host_key_valid, RSA *own_host_key);
Key *own_host_key);
void ssh_kex2(char *host, struct sockaddr *hostaddr);
void ssh_userauth2(const char *server_user, char *host);

30
sshconnect1.c
View File

@ -13,7 +13,7 @@
*/
#include "includes.h"
RCSID("$OpenBSD: sshconnect1.c,v 1.28 2001/03/08 21:42:33 markus Exp $");
RCSID("$OpenBSD: sshconnect1.c,v 1.29 2001/03/26 08:07:09 markus Exp $");
#include <openssl/bn.h>
#include <openssl/evp.h>
@ -211,9 +211,9 @@ try_rsa_authentication(const char *authfile)
int plen, clen;
/* Try to load identification for the authentication key. */
public = key_new(KEY_RSA1);
if (!load_public_key(authfile, public, &comment)) {
key_free(public);
/* XXKEYLOAD */
public = key_load_public_type(KEY_RSA1, authfile, &comment);
if (public == NULL) {
/* Could not load it. Fail. */
return 0;
}
@ -252,12 +252,12 @@ try_rsa_authentication(const char *authfile)
debug("Received RSA challenge from server.");
private = key_new(KEY_RSA1);
/*
* Load the private key. Try first with empty passphrase; if it
* fails, ask for a passphrase.
*/
if (!load_private_key(authfile, "", private, NULL)) {
private = key_load_private_type(KEY_RSA1, authfile, "", NULL);
if (private == NULL) {
char buf[300];
snprintf(buf, sizeof buf, "Enter passphrase for RSA key '%.100s': ",
comment);
@ -270,7 +270,8 @@ try_rsa_authentication(const char *authfile)
}
/* Load the authentication file using the pasphrase. */
if (!load_private_key(authfile, passphrase, private, NULL)) {
private = key_load_private_type(KEY_RSA1, authfile, passphrase, NULL);
if (private == NULL) {
memset(passphrase, 0, strlen(passphrase));
xfree(passphrase);
error("Bad passphrase.");
@ -285,7 +286,6 @@ try_rsa_authentication(const char *authfile)
/* Expect the server to reject it... */
packet_read_expect(&plen, SSH_SMSG_FAILURE);
xfree(comment);
key_free(private);
BN_clear_free(challenge);
return 0;
}
@ -322,7 +322,7 @@ try_rsa_authentication(const char *authfile)
* authentication and RSA host authentication.
*/
int
try_rhosts_rsa_authentication(const char *local_user, RSA * host_key)
try_rhosts_rsa_authentication(const char *local_user, Key * host_key)
{
int type;
BIGNUM *challenge;
@ -333,9 +333,9 @@ try_rhosts_rsa_authentication(const char *local_user, RSA * host_key)
/* Tell the server that we are willing to authenticate using this key. */
packet_start(SSH_CMSG_AUTH_RHOSTS_RSA);
packet_put_string(local_user, strlen(local_user));
packet_put_int(BN_num_bits(host_key->n));
packet_put_bignum(host_key->e);
packet_put_bignum(host_key->n);
packet_put_int(BN_num_bits(host_key->rsa->n));
packet_put_bignum(host_key->rsa->e);
packet_put_bignum(host_key->rsa->n);
packet_send();
packet_write_wait();
@ -361,7 +361,7 @@ try_rhosts_rsa_authentication(const char *local_user, RSA * host_key)
debug("Received RSA challenge for host key from server.");
/* Compute a response to the challenge. */
respond_to_rsa_challenge(challenge, host_key);
respond_to_rsa_challenge(challenge, host_key->rsa);
/* We no longer need the challenge. */
BN_clear_free(challenge);
@ -915,7 +915,7 @@ ssh_userauth(
const char *local_user,
const char *server_user,
char *host,
int host_key_valid, RSA *own_host_key)
Key *own_host_key)
{
int i, type;
int payload_len;
@ -1000,7 +1000,7 @@ ssh_userauth(
* authentication.
*/
if ((supported_authentications & (1 << SSH_AUTH_RHOSTS_RSA)) &&
options.rhosts_rsa_authentication && host_key_valid) {
options.rhosts_rsa_authentication && own_host_key != NULL) {
if (try_rhosts_rsa_authentication(local_user, own_host_key))
return;
}

22
sshconnect2.c
View File

@ -23,7 +23,7 @@
*/
#include "includes.h"
RCSID("$OpenBSD: sshconnect2.c,v 1.55 2001/03/23 11:04:07 djm Exp $");
RCSID("$OpenBSD: sshconnect2.c,v 1.56 2001/03/26 08:07:09 markus Exp $");
#include <openssl/bn.h>
#include <openssl/md5.h>
@ -901,26 +901,24 @@ load_identity_file(char *filename)
{
Key *private;
char prompt[300], *passphrase;
int success = 0, quit, i;
int quit, i;
struct stat st;
if (stat(filename, &st) < 0) {
debug3("no such identity: %s", filename);
return NULL;
}
private = key_new(KEY_UNSPEC);
if (!load_private_key(filename, "", private, NULL)) {
if (options.batch_mode) {
key_free(private);
private = key_load_private_type(KEY_UNSPEC, filename, "", NULL);
if (private == NULL) {
if (options.batch_mode)
return NULL;
}
snprintf(prompt, sizeof prompt,
"Enter passphrase for key '%.100s': ", filename);
for (i = 0; i < options.number_of_password_prompts; i++) {
passphrase = read_passphrase(prompt, 0);
if (strcmp(passphrase, "") != 0) {
success = load_private_key(filename,
passphrase, private, NULL);
private = key_load_private_type(KEY_UNSPEC, filename,
passphrase, NULL);
quit = 0;
} else {
debug2("no passphrase given, try next key");
@ -928,14 +926,10 @@ load_identity_file(char *filename)
}
memset(passphrase, 0, strlen(passphrase));
xfree(passphrase);
if (success || quit)
if (private != NULL || quit)
break;
debug2("bad passphrase given, try again...");
}
if (!success) {
key_free(private);
return NULL;
}
}
return private;
}

43
sshd.c
View File

@ -40,7 +40,7 @@
*/
#include "includes.h"
RCSID("$OpenBSD: sshd.c,v 1.178 2001/03/23 14:28:32 markus Exp $");
RCSID("$OpenBSD: sshd.c,v 1.179 2001/03/26 08:07:09 markus Exp $");
#include <openssl/dh.h>
#include <openssl/bn.h>
@ -454,39 +454,6 @@ destroy_sensitive_data(void)
sensitive_data.ssh1_host_key = NULL;
memset(sensitive_data.ssh1_cookie, 0, SSH_SESSION_KEY_LENGTH);
}
Key *
load_private_key_autodetect(const char *filename)
{
struct stat st;
int type;
Key *public, *private;
if (stat(filename, &st) < 0) {
perror(filename);
return NULL;
}
/*
* try to load the public key. right now this only works for RSA1,
* since SSH2 keys are fully encrypted
*/
type = KEY_RSA1;
public = key_new(type);
if (!load_public_key(filename, public, NULL)) {
/* ok, so we will assume this is 'some' key */
type = KEY_UNSPEC;
}
key_free(public);
/* Ok, try key with empty passphrase */
private = key_new(type);
if (load_private_key(filename, "", private, NULL)) {
debug("load_private_key_autodetect: type %d %s",
private->type, key_type(private));
return private;
}
key_free(private);
return NULL;
}
char *
list_hostkey_types(void)
@ -579,6 +546,7 @@ main(int ac, char **av)
int listen_sock, maxfd;
int startup_p[2];
int startups = 0;
Key *key;
int ret, key_used = 0;
__progname = get_progname(av[0]);
@ -716,10 +684,12 @@ main(int ac, char **av)
sensitive_data.have_ssh2_key = 0;
for(i = 0; i < options.num_host_key_files; i++) {
Key *key = load_private_key_autodetect(options.host_key_files[i]);
key = key_load_private(options.host_key_files[i], "", NULL);
sensitive_data.host_keys[i] = key;
if (key == NULL) {
error("Could not load host key: %.200s: %.100s",
options.host_key_files[i], strerror(errno));
sensitive_data.host_keys[i] = NULL;
continue;
}
switch(key->type){
@ -732,7 +702,8 @@ main(int ac, char **av)
sensitive_data.have_ssh2_key = 1;
break;
}
sensitive_data.host_keys[i] = key;
debug("private host key: #%d type %d %s", i, key->type,
key_type(key));
}
if ((options.protocol & SSH_PROTO_1) && !sensitive_data.have_ssh1_key) {
log("Disabling protocol version 1. Could not load host key");