tyler.durden
/
openssh-portable
mirror of https://github.com/PowerShell/openssh-portable.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

- markus@cvs.openbsd.org 2001/03/26 08:07:09 

[authfile.c authfile.h ssh-add.c ssh-keygen.c ssh.c sshconnect.c
      sshconnect.h sshconnect1.c sshconnect2.c sshd.c]
     simpler key load/save interface, see authfile.h
This commit is contained in:
Ben Lindstrom 2001-03-26 13:44:06 +00:00
parent 7bfff36ca3
commit d0fca423fc
11 changed files with 322 additions and 423 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
ChangeLog
View File

@ -1,3 +1,10 @@
20010328
- OpenBSD CVS Sync
- markus@cvs.openbsd.org 2001/03/26 08:07:09
[authfile.c authfile.h ssh-add.c ssh-keygen.c ssh.c sshconnect.c
sshconnect.h sshconnect1.c sshconnect2.c sshd.c]
simpler key load/save interface, see authfile.h
20010327 20010327
- Attempt sync with sshlogin.c w/ OpenBSD (mainly CVS ID) - Attempt sync with sshlogin.c w/ OpenBSD (mainly CVS ID)
- Fix pointer issues in waitpid() and wait() replaces. Patch by Lutz - Fix pointer issues in waitpid() and wait() replaces. Patch by Lutz
@ -4718,4 +4725,4 @@
- Wrote replacements for strlcpy and mkdtemp - Wrote replacements for strlcpy and mkdtemp
- Released 1.0pre1 - Released 1.0pre1
$Id: ChangeLog,v 1.1019 2001/03/26 05:45:53 mouring Exp $ $Id: ChangeLog,v 1.1020 2001/03/26 13:44:06 mouring Exp $

341
authfile.c
View File

@ -36,7 +36,7 @@
*/ */
#include "includes.h" #include "includes.h"
RCSID("$OpenBSD: authfile.c,v 1.28 2001/02/21 09:05:54 deraadt Exp $"); RCSID("$OpenBSD: authfile.c,v 1.29 2001/03/26 08:07:07 markus Exp $");
#include <openssl/err.h> #include <openssl/err.h>
#include <openssl/evp.h> #include <openssl/evp.h>
@ -51,7 +51,7 @@ RCSID("$OpenBSD: authfile.c,v 1.28 2001/02/21 09:05:54 deraadt Exp $");
#include "log.h" #include "log.h"
#include "authfile.h" #include "authfile.h"
/* Version identification string for identity files. */ /* Version identification string for SSH v1 identity files. */
static const char authfile_id_string[] = static const char authfile_id_string[] =
"SSH PRIVATE KEY FILE FORMAT 1.1\n"; "SSH PRIVATE KEY FILE FORMAT 1.1\n";
@ -63,8 +63,8 @@ static const char authfile_id_string[] =
*/ */
int int
save_private_key_rsa1(const char *filename, const char *passphrase, key_save_private_rsa1(Key *key, const char *filename, const char *passphrase,
RSA *key, const char *comment) const char *comment)
{ {
Buffer buffer, encrypted; Buffer buffer, encrypted;
char buf[100], *cp; char buf[100], *cp;
@ -100,10 +100,10 @@ save_private_key_rsa1(const char *filename, const char *passphrase,
* will be stored in plain text, and storing them also in encrypted * will be stored in plain text, and storing them also in encrypted
* format would just give known plaintext). * format would just give known plaintext).
*/ */
buffer_put_bignum(&buffer, key->d); buffer_put_bignum(&buffer, key->rsa->d);
buffer_put_bignum(&buffer, key->iqmp); buffer_put_bignum(&buffer, key->rsa->iqmp);
buffer_put_bignum(&buffer, key->q); /* reverse from SSL p */ buffer_put_bignum(&buffer, key->rsa->q); /* reverse from SSL p */
buffer_put_bignum(&buffer, key->p); /* reverse from SSL q */ buffer_put_bignum(&buffer, key->rsa->p); /* reverse from SSL q */
/* Pad the part to be encrypted until its size is a multiple of 8. */ /* Pad the part to be encrypted until its size is a multiple of 8. */
while (buffer_len(&buffer) % 8 != 0) while (buffer_len(&buffer) % 8 != 0)
@ -122,9 +122,9 @@ save_private_key_rsa1(const char *filename, const char *passphrase,
buffer_put_int(&encrypted, 0); /* For future extension */ buffer_put_int(&encrypted, 0); /* For future extension */
/* Store public key. This will be in plain text. */ /* Store public key. This will be in plain text. */
buffer_put_int(&encrypted, BN_num_bits(key->n)); buffer_put_int(&encrypted, BN_num_bits(key->rsa->n));
buffer_put_bignum(&encrypted, key->n); buffer_put_bignum(&encrypted, key->rsa->n);
buffer_put_bignum(&encrypted, key->e); buffer_put_bignum(&encrypted, key->rsa->e);
buffer_put_string(&encrypted, comment, strlen(comment)); buffer_put_string(&encrypted, comment, strlen(comment));
/* Allocate space for the private part of the key in the buffer. */ /* Allocate space for the private part of the key in the buffer. */
@ -156,10 +156,10 @@ save_private_key_rsa1(const char *filename, const char *passphrase,
return 1; return 1;
} }
/* save SSH2 key in OpenSSL PEM format */ /* save SSH v2 key in OpenSSL PEM format */
int int
save_private_key_ssh2(const char *filename, const char *_passphrase, key_save_private_pem(Key *key, const char *filename, const char *_passphrase,
Key *key, const char *comment) const char *comment)
{ {
FILE *fp; FILE *fp;
int fd; int fd;
@ -199,16 +199,18 @@ save_private_key_ssh2(const char *filename, const char *_passphrase,
} }
int int
save_private_key(const char *filename, const char *passphrase, Key *key, key_save_private(Key *key, const char *filename, const char *passphrase,
const char *comment) const char *comment)
{ {
switch (key->type) { switch (key->type) {
case KEY_RSA1: case KEY_RSA1:
return save_private_key_rsa1(filename, passphrase, key->rsa, comment); return key_save_private_rsa1(key, filename, passphrase,
comment);
break; break;
case KEY_DSA: case KEY_DSA:
case KEY_RSA: case KEY_RSA:
return save_private_key_ssh2(filename, passphrase, key, comment); return key_save_private_pem(key, filename, passphrase,
comment);
break; break;
default: default:
break; break;
@ -217,22 +219,20 @@ save_private_key(const char *filename, const char *passphrase, Key *key,
} }
/* /*
* Loads the public part of the key file. Returns 0 if an error was * Loads the public part of the ssh v1 key file. Returns NULL if an error was
* encountered (the file does not exist or is not readable), and non-zero * encountered (the file does not exist or is not readable), and the key
* otherwise. * otherwise.
*/ */
int Key *
load_public_key_rsa(const char *filename, RSA * pub, char **comment_return) key_load_public_rsa1(int fd, const char *filename, char **commentp)
{ {
int fd, i;
off_t len;
Buffer buffer; Buffer buffer;
Key *pub;
char *cp; char *cp;
int i;
off_t len;
fd = open(filename, O_RDONLY);
if (fd < 0)
return 0;
len = lseek(fd, (off_t) 0, SEEK_END); len = lseek(fd, (off_t) 0, SEEK_END);
lseek(fd, (off_t) 0, SEEK_SET); lseek(fd, (off_t) 0, SEEK_SET);
@ -243,16 +243,14 @@ load_public_key_rsa(const char *filename, RSA * pub, char **comment_return)
debug("Read from key file %.200s failed: %.100s", filename, debug("Read from key file %.200s failed: %.100s", filename,
strerror(errno)); strerror(errno));
buffer_free(&buffer); buffer_free(&buffer);
close(fd); return NULL;
return 0;
} }
close(fd);
/* Check that it is at least big enough to contain the ID string. */ /* Check that it is at least big enough to contain the ID string. */
if (len < sizeof(authfile_id_string)) { if (len < sizeof(authfile_id_string)) {
debug3("Bad RSA1 key file %.200s.", filename); debug3("Bad RSA1 key file %.200s.", filename);
buffer_free(&buffer); buffer_free(&buffer);
return 0; return NULL;
} }
/* /*
* Make sure it begins with the id string. Consume the id string * Make sure it begins with the id string. Consume the id string
@ -262,7 +260,7 @@ load_public_key_rsa(const char *filename, RSA * pub, char **comment_return)
if (buffer_get_char(&buffer) != authfile_id_string[i]) { if (buffer_get_char(&buffer) != authfile_id_string[i]) {
debug3("Bad RSA1 key file %.200s.", filename); debug3("Bad RSA1 key file %.200s.", filename);
buffer_free(&buffer); buffer_free(&buffer);
return 0; return NULL;
} }
/* Skip cipher type and reserved data. */ /* Skip cipher type and reserved data. */
(void) buffer_get_char(&buffer); /* cipher type */ (void) buffer_get_char(&buffer); /* cipher type */
@ -270,37 +268,33 @@ load_public_key_rsa(const char *filename, RSA * pub, char **comment_return)
/* Read the public key from the buffer. */ /* Read the public key from the buffer. */
buffer_get_int(&buffer); buffer_get_int(&buffer);
/* XXX alloc */ pub = key_new(KEY_RSA1);
if (pub->n == NULL) buffer_get_bignum(&buffer, pub->rsa->n);
pub->n = BN_new(); buffer_get_bignum(&buffer, pub->rsa->e);
buffer_get_bignum(&buffer, pub->n); if (commentp)
/* XXX alloc */ *commentp = buffer_get_string(&buffer, NULL);
if (pub->e == NULL)
pub->e = BN_new();
buffer_get_bignum(&buffer, pub->e);
if (comment_return)
*comment_return = buffer_get_string(&buffer, NULL);
/* The encrypted private part is not parsed by this function. */ /* The encrypted private part is not parsed by this function. */
buffer_free(&buffer); buffer_free(&buffer);
return pub;
return 1;
} }
/* load public key from private-key file */ /* load public key from private-key file, works only for SSH v1 */
int Key *
load_public_key(const char *filename, Key * key, char **comment_return) key_load_public_type(int type, const char *filename, char **commentp)
{ {
switch (key->type) { Key *pub;
case KEY_RSA1: int fd;
return load_public_key_rsa(filename, key->rsa, comment_return);
break; if (type == KEY_RSA1) {
case KEY_DSA: fd = open(filename, O_RDONLY);
case KEY_RSA: if (fd < 0)
default: return NULL;
break; pub = key_load_public_rsa1(fd, filename, commentp);
close(fd);
return pub;
} }
return 0; return NULL;
} }
/* /*
@ -310,9 +304,9 @@ load_public_key(const char *filename, Key * key, char **comment_return)
* Assumes we are called under uid of the owner of the file. * Assumes we are called under uid of the owner of the file.
*/ */
int Key *
load_private_key_rsa1(int fd, const char *filename, key_load_private_rsa1(int fd, const char *filename, const char *passphrase,
const char *passphrase, RSA * prv, char **comment_return) char **commentp)
{ {
int i, check1, check2, cipher_type; int i, check1, check2, cipher_type;
off_t len; off_t len;
@ -322,6 +316,7 @@ load_private_key_rsa1(int fd, const char *filename,
Cipher *cipher; Cipher *cipher;
BN_CTX *ctx; BN_CTX *ctx;
BIGNUM *aux; BIGNUM *aux;
Key *prv = NULL;
len = lseek(fd, (off_t) 0, SEEK_END); len = lseek(fd, (off_t) 0, SEEK_END);
lseek(fd, (off_t) 0, SEEK_SET); lseek(fd, (off_t) 0, SEEK_SET);
@ -334,7 +329,7 @@ load_private_key_rsa1(int fd, const char *filename,
strerror(errno)); strerror(errno));
buffer_free(&buffer); buffer_free(&buffer);
close(fd); close(fd);
return 0; return NULL;
} }
/* Check that it is at least big enough to contain the ID string. */ /* Check that it is at least big enough to contain the ID string. */
@ -342,7 +337,7 @@ load_private_key_rsa1(int fd, const char *filename,
debug3("Bad RSA1 key file %.200s.", filename); debug3("Bad RSA1 key file %.200s.", filename);
buffer_free(&buffer); buffer_free(&buffer);
close(fd); close(fd);
return 0; return NULL;
} }
/* /*
* Make sure it begins with the id string. Consume the id string * Make sure it begins with the id string. Consume the id string
@ -353,7 +348,7 @@ load_private_key_rsa1(int fd, const char *filename,
debug3("Bad RSA1 key file %.200s.", filename); debug3("Bad RSA1 key file %.200s.", filename);
buffer_free(&buffer); buffer_free(&buffer);
close(fd); close(fd);
return 0; return NULL;
} }
/* Read cipher type. */ /* Read cipher type. */
@ -362,12 +357,12 @@ load_private_key_rsa1(int fd, const char *filename,
/* Read the public key from the buffer. */ /* Read the public key from the buffer. */
buffer_get_int(&buffer); buffer_get_int(&buffer);
prv->n = BN_new(); prv = key_new_private(KEY_RSA1);
buffer_get_bignum(&buffer, prv->n);
prv->e = BN_new(); buffer_get_bignum(&buffer, prv->rsa->n);
buffer_get_bignum(&buffer, prv->e); buffer_get_bignum(&buffer, prv->rsa->e);
if (comment_return) if (commentp)
*comment_return = buffer_get_string(&buffer, NULL); *commentp = buffer_get_string(&buffer, NULL);
else else
xfree(buffer_get_string(&buffer, NULL)); xfree(buffer_get_string(&buffer, NULL));
@ -395,93 +390,81 @@ load_private_key_rsa1(int fd, const char *filename,
if (check1 != buffer_get_char(&decrypted) || if (check1 != buffer_get_char(&decrypted) ||
check2 != buffer_get_char(&decrypted)) { check2 != buffer_get_char(&decrypted)) {
if (strcmp(passphrase, "") != 0) if (strcmp(passphrase, "") != 0)
debug("Bad passphrase supplied for key file %.200s.", filename); debug("Bad passphrase supplied for key file %.200s.",
filename);
/* Bad passphrase. */ /* Bad passphrase. */
buffer_free(&decrypted); buffer_free(&decrypted);
fail: goto fail;
BN_clear_free(prv->n);
prv->n = NULL;
BN_clear_free(prv->e);
prv->e = NULL;
if (comment_return)
xfree(*comment_return);
close(fd);
return 0;
} }
/* Read the rest of the private key. */ /* Read the rest of the private key. */
prv->d = BN_new(); buffer_get_bignum(&decrypted, prv->rsa->d);
buffer_get_bignum(&decrypted, prv->d); buffer_get_bignum(&decrypted, prv->rsa->iqmp); /* u */
prv->iqmp = BN_new(); /* in SSL and SSH v1 p and q are exchanged */
buffer_get_bignum(&decrypted, prv->iqmp); /* u */ buffer_get_bignum(&decrypted, prv->rsa->q); /* p */
/* in SSL and SSH p and q are exchanged */ buffer_get_bignum(&decrypted, prv->rsa->p); /* q */
prv->q = BN_new();
buffer_get_bignum(&decrypted, prv->q); /* p */
prv->p = BN_new();
buffer_get_bignum(&decrypted, prv->p); /* q */
/* calculate p-1 and q-1 */
ctx = BN_CTX_new(); ctx = BN_CTX_new();
aux = BN_new(); aux = BN_new();
BN_sub(aux, prv->q, BN_value_one()); BN_sub(aux, prv->rsa->q, BN_value_one());
prv->dmq1 = BN_new(); BN_mod(prv->rsa->dmq1, prv->rsa->d, aux, ctx);
BN_mod(prv->dmq1, prv->d, aux, ctx);
BN_sub(aux, prv->p, BN_value_one()); BN_sub(aux, prv->rsa->p, BN_value_one());
prv->dmp1 = BN_new(); BN_mod(prv->rsa->dmp1, prv->rsa->d, aux, ctx);
BN_mod(prv->dmp1, prv->d, aux, ctx);
BN_clear_free(aux); BN_clear_free(aux);
BN_CTX_free(ctx); BN_CTX_free(ctx);
buffer_free(&decrypted); buffer_free(&decrypted);
close(fd); close(fd);
return 1; return prv;
fail:
if (commentp)
xfree(*commentp);
close(fd);
key_free(prv);
return NULL;
} }
int Key *
load_private_key_ssh2(int fd, const char *passphrase, Key *k, char **comment_return) key_load_private_pem(int fd, int type, const char *passphrase,
char **commentp)
{ {
FILE *fp; FILE *fp;
int success = 0;
EVP_PKEY *pk = NULL; EVP_PKEY *pk = NULL;
Key *prv = NULL;
char *name = "<no key>"; char *name = "<no key>";
fp = fdopen(fd, "r"); fp = fdopen(fd, "r");
if (fp == NULL) { if (fp == NULL) {
error("fdopen failed"); error("fdopen failed");
close(fd); close(fd);
return 0; return NULL;
} }
pk = PEM_read_PrivateKey(fp, NULL, NULL, (char *)passphrase); pk = PEM_read_PrivateKey(fp, NULL, NULL, (char *)passphrase);
if (pk == NULL) { if (pk == NULL) {
debug("PEM_read_PrivateKey failed"); debug("PEM_read_PrivateKey failed");
(void)ERR_get_error(); (void)ERR_get_error();
} else if (pk->type == EVP_PKEY_RSA) { } else if (pk->type == EVP_PKEY_RSA &&
/* replace k->rsa with loaded key */ (type == KEY_UNSPEC||type==KEY_RSA)) {
if (k->type == KEY_RSA || k->type == KEY_UNSPEC) { prv = key_new(KEY_UNSPEC);
if (k->rsa != NULL) prv->rsa = EVP_PKEY_get1_RSA(pk);
RSA_free(k->rsa); prv->type = KEY_RSA;
k->rsa = EVP_PKEY_get1_RSA(pk); name = "rsa w/o comment";
k->type = KEY_RSA;
name = "rsa w/o comment";
success = 1;
#ifdef DEBUG_PK #ifdef DEBUG_PK
RSA_print_fp(stderr, k->rsa, 8); RSA_print_fp(stderr, prv->rsa, 8);
#endif #endif
} } else if (pk->type == EVP_PKEY_DSA &&
} else if (pk->type == EVP_PKEY_DSA) { (type == KEY_UNSPEC||type==KEY_DSA)) {
/* replace k->dsa with loaded key */ prv = key_new(KEY_UNSPEC);
if (k->type == KEY_DSA || k->type == KEY_UNSPEC) { prv->dsa = EVP_PKEY_get1_DSA(pk);
if (k->dsa != NULL) prv->type = KEY_DSA;
DSA_free(k->dsa); name = "dsa w/o comment";
k->dsa = EVP_PKEY_get1_DSA(pk);
k->type = KEY_DSA;
name = "dsa w/o comment";
#ifdef DEBUG_PK #ifdef DEBUG_PK
DSA_print_fp(stderr, k->dsa, 8); DSA_print_fp(stderr, prv->dsa, 8);
#endif #endif
success = 1;
}
} else { } else {
error("PEM_read_PrivateKey: mismatch or " error("PEM_read_PrivateKey: mismatch or "
"unknown EVP_PKEY save_type %d", pk->save_type); "unknown EVP_PKEY save_type %d", pk->save_type);
@ -489,24 +472,18 @@ load_private_key_ssh2(int fd, const char *passphrase, Key *k, char **comment_ret
fclose(fp); fclose(fp);
if (pk != NULL) if (pk != NULL)
EVP_PKEY_free(pk); EVP_PKEY_free(pk);
if (success && comment_return) if (prv != NULL && commentp)
*comment_return = xstrdup(name); *commentp = xstrdup(name);
debug("read SSH2 private key done: name %s success %d", name, success); debug("read PEM private key done: type %s",
return success; prv ? key_type(prv) : "<unknown>");
return prv;
} }
int int
load_private_key(const char *filename, const char *passphrase, Key *key, key_perm_ok(int fd, const char *filename)
char **comment_return)
{ {
int fd;
int ret = 0;
struct stat st; struct stat st;
fd = open(filename, O_RDONLY);
if (fd < 0)
return 0;
/* check owner and modes */ /* check owner and modes */
#ifdef HAVE_CYGWIN #ifdef HAVE_CYGWIN
if (check_ntsec(filename)) if (check_ntsec(filename))
@ -521,40 +498,78 @@ load_private_key(const char *filename, const char *passphrase, Key *key,
error("Bad ownership or mode(0%3.3o) for '%s'.", error("Bad ownership or mode(0%3.3o) for '%s'.",
st.st_mode & 0777, filename); st.st_mode & 0777, filename);
error("It is recommended that your private key files are NOT accessible by others."); error("It is recommended that your private key files are NOT accessible by others.");
error("This private key will be ignored.");
return 0; return 0;
} }
switch (key->type) { return 1;
case KEY_RSA1: }
if (key->rsa->e != NULL) {
BN_clear_free(key->rsa->e);
key->rsa->e = NULL;
}
if (key->rsa->n != NULL) {
BN_clear_free(key->rsa->n);
key->rsa->n = NULL;
}
ret = load_private_key_rsa1(fd, filename, passphrase,
key->rsa, comment_return); /* closes fd */
Key *
key_load_private_type(int type, const char *filename, const char *passphrase,
char **commentp)
{
int fd;
fd = open(filename, O_RDONLY);
if (fd < 0)
return NULL;
if (!key_perm_ok(fd, filename)) {
debug("bad permissions: ignore key: %s", filename);
close(fd);
return NULL;
}
switch (type) {
case KEY_RSA1:
return key_load_private_rsa1(fd, filename, passphrase,
commentp);
/* closes fd */
break; break;
case KEY_DSA: case KEY_DSA:
case KEY_RSA: case KEY_RSA:
case KEY_UNSPEC: case KEY_UNSPEC:
ret = load_private_key_ssh2(fd, passphrase, key, return key_load_private_pem(fd, type, passphrase, commentp);
comment_return); /* closes fd */ /* closes fd */
break; break;
default: default:
close(fd); close(fd);
break; break;
} }
return ret; return NULL;
}
Key *
key_load_private(const char *filename, const char *passphrase,
char **commentp)
{
Key *pub;
int fd;
fd = open(filename, O_RDONLY);
if (fd < 0)
return NULL;
if (!key_perm_ok(fd, filename)) {
debug("bad permissions: ignore key: %s", filename);
close(fd);
return NULL;
}
pub = key_load_public_rsa1(fd, filename, commentp);
lseek(fd, (off_t) 0, SEEK_SET); /* rewind */
if (pub == NULL) {
/* closes fd */
return key_load_private_pem(fd, KEY_UNSPEC, passphrase, NULL);
} else {
/* it's a SSH v1 key if the public key part is readable */
key_free(pub);
/* closes fd */
return key_load_private_rsa1(fd, filename, passphrase, NULL);
}
} }
int int
do_load_public_key(const char *filename, Key *k, char **commentp) key_try_load_public(Key *k, const char *filename, char **commentp)
{ {
FILE *f; FILE *f;
char line[1024]; char line[4096];
char *cp; char *cp;
f = fopen(filename, "r"); f = fopen(filename, "r");
@ -585,19 +600,23 @@ do_load_public_key(const char *filename, Key *k, char **commentp)
return 0; return 0;
} }
/* load public key from pubkey file */ /* load public key from ssh v1 private or any pubkey file */
int Key *
try_load_public_key(const char *filename, Key *k, char **commentp) key_load_public(const char *filename, char **commentp)
{ {
char pub[MAXPATHLEN]; Key *pub;
char file[MAXPATHLEN];
if (do_load_public_key(filename, k, commentp) == 1) pub = key_load_public_type(KEY_RSA1, filename, commentp);
return 1; if (pub != NULL)
if (strlcpy(pub, filename, sizeof pub) >= MAXPATHLEN) return pub;
return 0; pub = key_new(KEY_UNSPEC);
if (strlcat(pub, ".pub", sizeof pub) >= MAXPATHLEN) if (key_try_load_public(pub, filename, commentp) == 1)
return 0; return pub;
if (do_load_public_key(pub, k, commentp) == 1) if ((strlcpy(file, filename, sizeof file) < sizeof(file)) &&
return 1; (strlcat(file, ".pub", sizeof file) < sizeof(file)) &&
return 0; (key_try_load_public(pub, file, commentp) == 1))
return pub;
key_free(pub);
return NULL;
} }

45
authfile.h
View File

@ -2,7 +2,6 @@
* Author: Tatu Ylonen <ylo@cs.hut.fi> * Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
* All rights reserved * All rights reserved
* Functions to interface with the SSH_AUTHENTICATION_FD socket.
* *
* As far as I am concerned, the code I have written for this software * As far as I am concerned, the code I have written for this software
* can be used freely for any purpose. Any derived versions of this * can be used freely for any purpose. Any derived versions of this
@ -11,41 +10,27 @@
* called by a name other than "ssh" or "Secure Shell". * called by a name other than "ssh" or "Secure Shell".
*/ */
/* $OpenBSD: authfile.h,v 1.5 2000/10/16 09:38:44 djm Exp $ */ /* $OpenBSD: authfile.h,v 1.6 2001/03/26 08:07:08 markus Exp $ */
#ifndef AUTHFILE_H #ifndef AUTHFILE_H
#define AUTHFILE_H #define AUTHFILE_H
/*
* Saves the authentication (private) key in a file, encrypting it with
* passphrase.
* For RSA keys: The identification of the file (lowest 64 bits of n)
* will precede the key to provide identification of the key without
* needing a passphrase.
*/
int int
save_private_key(const char *filename, const char *passphrase, key_save_private(Key *key, const char *filename, const char *passphrase,
Key * private_key, const char *comment); const char *comment);
/* Key *
* Loads the public part of the key file (public key and comment). Returns 0 key_load_public(const char *filename, char **commentp);
* if an error occurred; zero if the public key was successfully read. The
* comment of the key is returned in comment_return if it is non-NULL; the
* caller must free the value with xfree.
*/
int load_public_key(const char *filename, Key * pub, char **comment_return);
int try_load_public_key(const char *filename, Key * pub, char **comment_return);
/* Key *
* Loads the private key from the file. Returns 0 if an error is encountered key_load_public_type(int type, const char *filename, char **commentp);
* (file does not exist or is not readable, or passphrase is bad). This
* initializes the private key. The comment of the key is returned in Key *
* comment_return if it is non-NULL; the caller must free the value with key_load_private(const char *filename, const char *passphrase,
* xfree. char **commentp);
*/
int Key *
load_private_key(const char *filename, const char *passphrase, key_load_private_type(int type, const char *filename, const char *passphrase,
Key * private_key, char **comment_return); char **commentp);
#endif #endif

56
ssh-add.c
View File

@ -35,7 +35,7 @@
*/ */
#include "includes.h" #include "includes.h"
RCSID("$OpenBSD: ssh-add.c,v 1.30 2001/03/12 22:02:02 markus Exp $"); RCSID("$OpenBSD: ssh-add.c,v 1.31 2001/03/26 08:07:08 markus Exp $");
#include <openssl/evp.h> #include <openssl/evp.h>
@ -61,14 +61,10 @@ delete_file(AuthenticationConnection *ac, const char *filename)
Key *public; Key *public;
char *comment; char *comment;
public = key_new(KEY_RSA1); public = key_load_public(filename, &comment);
if (!load_public_key(filename, public, &comment)) { if (public == NULL) {
key_free(public); printf("Bad key file %s\n", filename);
public = key_new(KEY_UNSPEC); return;
if (!try_load_public_key(filename, public, &comment)) {
printf("Bad key file %s\n", filename);
return;
}
} }
if (ssh_remove_identity(ac, public)) if (ssh_remove_identity(ac, public))
fprintf(stderr, "Identity removed: %s (%s)\n", filename, comment); fprintf(stderr, "Identity removed: %s (%s)\n", filename, comment);
@ -139,30 +135,15 @@ void
add_file(AuthenticationConnection *ac, const char *filename) add_file(AuthenticationConnection *ac, const char *filename)
{ {
struct stat st; struct stat st;
Key *public;
Key *private; Key *private;
char *saved_comment, *comment, *askpass = NULL; char *comment, *askpass = NULL, *pass;
char buf[1024], msg[1024]; char buf[1024], msg[1024];
int success;
int interactive = isatty(STDIN_FILENO); int interactive = isatty(STDIN_FILENO);
int type = KEY_RSA1;
if (stat(filename, &st) < 0) { if (stat(filename, &st) < 0) {
perror(filename); perror(filename);
exit(1); exit(1);
} }
/*
* try to load the public key. right now this only works for RSA,
* since DSA keys are fully encrypted
*/
public = key_new(KEY_RSA1);
if (!load_public_key(filename, public, &saved_comment)) {
/* ok, so we will assume this is 'some' key */
type = KEY_UNSPEC;
saved_comment = xstrdup(filename);
}
key_free(public);
if (!interactive && getenv("DISPLAY")) { if (!interactive && getenv("DISPLAY")) {
if (getenv(SSH_ASKPASS_ENV)) if (getenv(SSH_ASKPASS_ENV))
askpass = getenv(SSH_ASKPASS_ENV); askpass = getenv(SSH_ASKPASS_ENV);
@ -171,17 +152,17 @@ add_file(AuthenticationConnection *ac, const char *filename)
} }
/* At first, try empty passphrase */ /* At first, try empty passphrase */
private = key_new(type); private = key_load_private(filename, "", &comment);
success = load_private_key(filename, "", private, &comment); if (comment == NULL)
if (!success) { comment = xstrdup(filename);
if (private == NULL) {
printf("Need passphrase for %.200s\n", filename); printf("Need passphrase for %.200s\n", filename);
if (!interactive && askpass == NULL) { if (!interactive && askpass == NULL) {
xfree(saved_comment); xfree(comment);
return; return;
} }
snprintf(msg, sizeof msg, "Enter passphrase for %.200s", saved_comment); snprintf(msg, sizeof msg, "Enter passphrase for %.200s", comment);
for (;;) { for (;;) {
char *pass;
if (interactive) { if (interactive) {
snprintf(buf, sizeof buf, "%s: ", msg); snprintf(buf, sizeof buf, "%s: ", msg);
pass = read_passphrase(buf, 1); pass = read_passphrase(buf, 1);
@ -190,24 +171,23 @@ add_file(AuthenticationConnection *ac, const char *filename)
} }
if (strcmp(pass, "") == 0) { if (strcmp(pass, "") == 0) {
xfree(pass); xfree(pass);
xfree(saved_comment); xfree(comment);
return; return;
} }
success = load_private_key(filename, pass, private, &comment); private = key_load_private(filename, pass, &comment);
memset(pass, 0, strlen(pass)); memset(pass, 0, strlen(pass));
xfree(pass); xfree(pass);
if (success) if (private != NULL)
break; break;
strlcpy(msg, "Bad passphrase, try again", sizeof msg); strlcpy(msg, "Bad passphrase, try again", sizeof msg);
} }
} }
xfree(comment); if (ssh_add_identity(ac, private, comment))
if (ssh_add_identity(ac, private, saved_comment)) fprintf(stderr, "Identity added: %s (%s)\n", filename, comment);
fprintf(stderr, "Identity added: %s (%s)\n", filename, saved_comment);
else else
fprintf(stderr, "Could not add identity: %s\n", filename); fprintf(stderr, "Could not add identity: %s\n", filename);
xfree(comment);
key_free(private); key_free(private);
xfree(saved_comment);
} }
void void

133
ssh-keygen.c
View File

@ -12,7 +12,7 @@
*/ */
#include "includes.h" #include "includes.h"
RCSID("$OpenBSD: ssh-keygen.c,v 1.51 2001/03/21 14:20:45 jakob Exp $"); RCSID("$OpenBSD: ssh-keygen.c,v 1.52 2001/03/26 08:07:09 markus Exp $");
#include <openssl/evp.h> #include <openssl/evp.h>
#include <openssl/pem.h> #include <openssl/pem.h>
@ -111,19 +111,20 @@ ask_filename(struct passwd *pw, const char *prompt)
have_identity = 1; have_identity = 1;
} }
int Key *
try_load_key(char *filename, Key *k) try_load_pem_key(char *filename)
{ {
int success = 1; char *pass;
if (!load_private_key(filename, "", k, NULL)) { Key *prv;
char *pass = read_passphrase("Enter passphrase: ", 1);
if (!load_private_key(filename, pass, k, NULL)) { prv = key_load_private(filename, "", NULL);
success = 0; if (prv == NULL) {
} pass = read_passphrase("Enter passphrase: ", 1);
prv = key_load_private(filename, pass, NULL);
memset(pass, 0, strlen(pass)); memset(pass, 0, strlen(pass));
xfree(pass); xfree(pass);
} }
return success; return prv;
} }
#define SSH_COM_PUBLIC_BEGIN "---- BEGIN SSH2 PUBLIC KEY ----" #define SSH_COM_PUBLIC_BEGIN "---- BEGIN SSH2 PUBLIC KEY ----"
@ -134,7 +135,7 @@ try_load_key(char *filename, Key *k)
void void
do_convert_to_ssh2(struct passwd *pw) do_convert_to_ssh2(struct passwd *pw)
{ {
Key *k; Key *prv;
int len; int len;
u_char *blob; u_char *blob;
struct stat st; struct stat st;
@ -145,20 +146,20 @@ do_convert_to_ssh2(struct passwd *pw)
perror(identity_file); perror(identity_file);
exit(1); exit(1);
} }
k = key_new(KEY_UNSPEC); prv = try_load_pem_key(identity_file);
if (!try_load_key(identity_file, k)) { if (prv == NULL) {
fprintf(stderr, "load failed\n"); fprintf(stderr, "load failed\n");
exit(1); exit(1);
} }
key_to_blob(k, &blob, &len); key_to_blob(prv, &blob, &len);
fprintf(stdout, "%s\n", SSH_COM_PUBLIC_BEGIN); fprintf(stdout, "%s\n", SSH_COM_PUBLIC_BEGIN);
fprintf(stdout, fprintf(stdout,
"Comment: \"%d-bit %s, converted from OpenSSH by %s@%s\"\n", "Comment: \"%d-bit %s, converted from OpenSSH by %s@%s\"\n",
key_size(k), key_type(k), key_size(prv), key_type(prv),
pw->pw_name, hostname); pw->pw_name, hostname);
dump_base64(stdout, blob, len); dump_base64(stdout, blob, len);
fprintf(stdout, "%s\n", SSH_COM_PUBLIC_END); fprintf(stdout, "%s\n", SSH_COM_PUBLIC_END);
key_free(k); key_free(prv);
xfree(blob); xfree(blob);
exit(0); exit(0);
} }
@ -302,7 +303,7 @@ do_convert_from_ssh2(struct passwd *pw)
void void
do_print_public(struct passwd *pw) do_print_public(struct passwd *pw)
{ {
Key *k; Key *prv;
struct stat st; struct stat st;
if (!have_identity) if (!have_identity)
@ -311,14 +312,14 @@ do_print_public(struct passwd *pw)
perror(identity_file); perror(identity_file);
exit(1); exit(1);
} }
k = key_new(KEY_UNSPEC); prv = try_load_pem_key(identity_file);
if (!try_load_key(identity_file, k)) { if (prv == NULL) {
fprintf(stderr, "load failed\n"); fprintf(stderr, "load failed\n");
exit(1); exit(1);
} }
if (!key_write(k, stdout)) if (!key_write(prv, stdout))
fprintf(stderr, "key_write failed"); fprintf(stderr, "key_write failed");
key_free(k); key_free(prv);
fprintf(stdout, "\n"); fprintf(stdout, "\n");
exit(0); exit(0);
} }
@ -329,11 +330,11 @@ do_fingerprint(struct passwd *pw)
FILE *f; FILE *f;
Key *public; Key *public;
char *comment = NULL, *cp, *ep, line[16*1024], *fp; char *comment = NULL, *cp, *ep, line[16*1024], *fp;
int i, skip = 0, num = 1, invalid = 1, success = 0, rep, type; int i, skip = 0, num = 1, invalid = 1, rep, fptype;
struct stat st; struct stat st;
type = print_bubblebabble ? SSH_FP_SHA1 : SSH_FP_MD5; fptype = print_bubblebabble ? SSH_FP_SHA1 : SSH_FP_MD5;
rep = print_bubblebabble ? SSH_FP_BUBBLEBABBLE : SSH_FP_HEX; rep = print_bubblebabble ? SSH_FP_BUBBLEBABBLE : SSH_FP_HEX;
if (!have_identity) if (!have_identity)
ask_filename(pw, "Enter file in which the key is"); ask_filename(pw, "Enter file in which the key is");
@ -341,26 +342,17 @@ do_fingerprint(struct passwd *pw)
perror(identity_file); perror(identity_file);
exit(1); exit(1);
} }
public = key_new(KEY_RSA1); public = key_load_public(identity_file, &comment);
if (load_public_key(identity_file, public, &comment)) { if (public != NULL) {
success = 1; fp = key_fingerprint(public, fptype, rep);
} else { printf("%d %s %s\n", key_size(public), fp, comment);
key_free(public);
public = key_new(KEY_UNSPEC);
if (try_load_public_key(identity_file, public, &comment))
success = 1;
else
debug("try_load_public_key KEY_UNSPEC failed");
}
if (success) {
fp = key_fingerprint(public, type, rep);
printf("%d %s %s\n", key_size(public),
fp, comment);
key_free(public); key_free(public);
xfree(comment); xfree(comment);
xfree(fp); xfree(fp);
exit(0); exit(0);
} }
if (comment)
xfree(comment);
f = fopen(identity_file, "r"); f = fopen(identity_file, "r");
if (f != NULL) { if (f != NULL) {
@ -409,15 +401,15 @@ do_fingerprint(struct passwd *pw)
} }
} }
comment = *cp ? cp : comment; comment = *cp ? cp : comment;
fp = key_fingerprint(public, type, rep); fp = key_fingerprint(public, fptype, rep);
printf("%d %s %s\n", key_size(public), fp, printf("%d %s %s\n", key_size(public), fp,
comment ? comment : "no comment"); comment ? comment : "no comment");
xfree(fp); xfree(fp);
key_free(public);
invalid = 0; invalid = 0;
} }
fclose(f); fclose(f);
} }
key_free(public);
if (invalid) { if (invalid) {
printf("%s is not a valid key file.\n", identity_file); printf("%s is not a valid key file.\n", identity_file);
exit(1); exit(1);
@ -436,8 +428,6 @@ do_change_passphrase(struct passwd *pw)
char *old_passphrase, *passphrase1, *passphrase2; char *old_passphrase, *passphrase1, *passphrase2;
struct stat st; struct stat st;
Key *private; Key *private;
Key *public;
int type = KEY_RSA1;
if (!have_identity) if (!have_identity)
ask_filename(pw, "Enter file in which the key is"); ask_filename(pw, "Enter file in which the key is");
@ -445,28 +435,20 @@ do_change_passphrase(struct passwd *pw)
perror(identity_file); perror(identity_file);
exit(1); exit(1);
} }
public = key_new(type);
if (!load_public_key(identity_file, public, NULL)) {
type = KEY_UNSPEC;
} else {
/* Clear the public key since we are just about to load the whole file. */
key_free(public);
}
/* Try to load the file with empty passphrase. */ /* Try to load the file with empty passphrase. */
private = key_new(type); private = key_load_private(identity_file, "", &comment);
if (!load_private_key(identity_file, "", private, &comment)) { if (private == NULL) {
if (identity_passphrase) if (identity_passphrase)
old_passphrase = xstrdup(identity_passphrase); old_passphrase = xstrdup(identity_passphrase);
else else
old_passphrase = read_passphrase("Enter old passphrase: ", 1); old_passphrase = read_passphrase("Enter old passphrase: ", 1);
if (!load_private_key(identity_file, old_passphrase, private, &comment)) { private = key_load_private(identity_file, old_passphrase , &comment);
memset(old_passphrase, 0, strlen(old_passphrase)); memset(old_passphrase, 0, strlen(old_passphrase));
xfree(old_passphrase); xfree(old_passphrase);
if (private == NULL) {
printf("Bad passphrase.\n"); printf("Bad passphrase.\n");
exit(1); exit(1);
} }
memset(old_passphrase, 0, strlen(old_passphrase));
xfree(old_passphrase);
} }
printf("Key has comment '%s'\n", comment); printf("Key has comment '%s'\n", comment);
@ -494,7 +476,7 @@ do_change_passphrase(struct passwd *pw)
} }
/* Save the file using the new passphrase. */ /* Save the file using the new passphrase. */
if (!save_private_key(identity_file, passphrase1, private, comment)) { if (!key_save_private(private, identity_file, passphrase1, comment)) {
printf("Saving the key failed: %s: %s.\n", printf("Saving the key failed: %s: %s.\n",
identity_file, strerror(errno)); identity_file, strerror(errno));
memset(passphrase1, 0, strlen(passphrase1)); memset(passphrase1, 0, strlen(passphrase1));
@ -520,7 +502,8 @@ void
do_change_comment(struct passwd *pw) do_change_comment(struct passwd *pw)
{ {
char new_comment[1024], *comment, *passphrase; char new_comment[1024], *comment, *passphrase;
Key *private, *public; Key *private;
Key *public;
struct stat st; struct stat st;
FILE *f; FILE *f;
int fd; int fd;
@ -531,21 +514,8 @@ do_change_comment(struct passwd *pw)
perror(identity_file); perror(identity_file);
exit(1); exit(1);
} }
/* private = key_load_private(identity_file, "", &comment);
* Try to load the public key from the file the verify that it is if (private == NULL) {
* readable and of the proper format.
*/
public = key_new(KEY_RSA1);
if (!load_public_key(identity_file, public, NULL)) {
printf("%s is not a valid key file.\n", identity_file);
printf("Comments are only supported in RSA1 keys\n");
exit(1);
}
private = key_new(KEY_RSA1);
if (load_private_key(identity_file, "", private, &comment))
passphrase = xstrdup("");
else {
if (identity_passphrase) if (identity_passphrase)
passphrase = xstrdup(identity_passphrase); passphrase = xstrdup(identity_passphrase);
else if (identity_new_passphrase) else if (identity_new_passphrase)
@ -553,13 +523,21 @@ do_change_comment(struct passwd *pw)
else else
passphrase = read_passphrase("Enter passphrase: ", 1); passphrase = read_passphrase("Enter passphrase: ", 1);
/* Try to load using the passphrase. */ /* Try to load using the passphrase. */
if (!load_private_key(identity_file, passphrase, private, &comment)) { private = key_load_private(identity_file, passphrase, &comment);
if (private == NULL) {
memset(passphrase, 0, strlen(passphrase)); memset(passphrase, 0, strlen(passphrase));
xfree(passphrase); xfree(passphrase);
printf("Bad passphrase.\n"); printf("Bad passphrase.\n");
exit(1); exit(1);
} }
} else {
passphrase = xstrdup("");
} }
if (private->type != KEY_RSA1) {
fprintf(stderr, "Comments are only supported for RSA1 keys.\n");
key_free(private);
exit(1);
}
printf("Key now has comment '%s'\n", comment); printf("Key now has comment '%s'\n", comment);
if (identity_comment) { if (identity_comment) {
@ -577,7 +555,7 @@ do_change_comment(struct passwd *pw)
} }
/* Save the file using the new passphrase. */ /* Save the file using the new passphrase. */
if (!save_private_key(identity_file, passphrase, private, new_comment)) { if (!key_save_private(private, identity_file, passphrase, new_comment)) {
printf("Saving the key failed: %s: %s.\n", printf("Saving the key failed: %s: %s.\n",
identity_file, strerror(errno)); identity_file, strerror(errno));
memset(passphrase, 0, strlen(passphrase)); memset(passphrase, 0, strlen(passphrase));
@ -588,6 +566,7 @@ do_change_comment(struct passwd *pw)
} }
memset(passphrase, 0, strlen(passphrase)); memset(passphrase, 0, strlen(passphrase));
xfree(passphrase); xfree(passphrase);
public = key_from_private(private);
key_free(private); key_free(private);
strlcat(identity_file, ".pub", sizeof(identity_file)); strlcat(identity_file, ".pub", sizeof(identity_file));
@ -823,7 +802,7 @@ passphrase_again:
} }
/* Save the key with the given passphrase and comment. */ /* Save the key with the given passphrase and comment. */
if (!save_private_key(identity_file, passphrase1, private, comment)) { if (!key_save_private(private, identity_file, passphrase1, comment)) {
printf("Saving the key failed: %s: %s.\n", printf("Saving the key failed: %s: %s.\n",
identity_file, strerror(errno)); identity_file, strerror(errno));
memset(passphrase1, 0, strlen(passphrase1)); memset(passphrase1, 0, strlen(passphrase1));

54
ssh.c
View File

@ -39,7 +39,7 @@
*/ */
#include "includes.h" #include "includes.h"
RCSID("$OpenBSD: ssh.c,v 1.104 2001/03/08 21:42:32 markus Exp $"); RCSID("$OpenBSD: ssh.c,v 1.105 2001/03/26 08:07:09 markus Exp $");
#include <openssl/evp.h> #include <openssl/evp.h>
#include <openssl/err.h> #include <openssl/err.h>
@ -130,11 +130,8 @@ struct sockaddr_storage hostaddr;
*/ */
volatile int received_window_change_signal = 0; volatile int received_window_change_signal = 0;
/* Flag indicating whether we have a valid host private key loaded. */
int host_private_key_loaded = 0;
/* Host private key. */ /* Host private key. */
RSA *host_private_key = NULL; Key *host_private_key = NULL;
/* Original real UID. */ /* Original real UID. */
uid_t original_real_uid; uid_t original_real_uid;
@ -631,12 +628,8 @@ main(int ac, char **av)
* privileges, because the file is only readable by root. * privileges, because the file is only readable by root.
*/ */
if (ok && (options.protocol & SSH_PROTO_1)) { if (ok && (options.protocol & SSH_PROTO_1)) {
Key k; host_private_key = key_load_private_type(KEY_RSA1,
host_private_key = RSA_new(); _PATH_HOST_KEY_FILE, "", NULL);
k.type = KEY_RSA1;
k.rsa = host_private_key;
if (load_private_key(_PATH_HOST_KEY_FILE, "", &k, NULL))
host_private_key_loaded = 1;
} }
/* /*
* Get rid of any extra privileges that we may have. We will no * Get rid of any extra privileges that we may have. We will no
@ -695,12 +688,12 @@ main(int ac, char **av)
tilde_expand_filename(options.user_hostfile2, original_real_uid); tilde_expand_filename(options.user_hostfile2, original_real_uid);
/* Log into the remote system. This never returns if the login fails. */ /* Log into the remote system. This never returns if the login fails. */
ssh_login(host_private_key_loaded, host_private_key, ssh_login(host_private_key, host, (struct sockaddr *)&hostaddr,
host, (struct sockaddr *)&hostaddr, original_real_uid); original_real_uid);
/* We no longer need the host private key. Clear it now. */ /* We no longer need the host private key. Clear it now. */
if (host_private_key_loaded) if (host_private_key != NULL)
RSA_free(host_private_key); /* Destroys contents safely */ key_free(host_private_key); /* Destroys contents safely */
exit_status = compat20 ? ssh_session2() : ssh_session(); exit_status = compat20 ? ssh_session2() : ssh_session();
packet_close(); packet_close();
@ -1074,26 +1067,6 @@ ssh_session2(void)
return client_loop(tty_flag, tty_flag ? options.escape_char : -1, id); return client_loop(tty_flag, tty_flag ? options.escape_char : -1, id);
} }
int
guess_identity_file_type(const char *filename)
{
struct stat st;
Key *public;
int type = KEY_RSA1; /* default */
if (stat(filename, &st) < 0) {
/* ignore this key */
return KEY_UNSPEC;
}
public = key_new(type);
if (!load_public_key(filename, public, NULL)) {
/* ok, so we will assume this is 'some' key */
type = KEY_UNSPEC;
}
key_free(public);
return type;
}
void void
load_public_identity_files(void) load_public_identity_files(void)
{ {
@ -1104,16 +1077,7 @@ load_public_identity_files(void)
for (i = 0; i < options.num_identity_files; i++) { for (i = 0; i < options.num_identity_files; i++) {
filename = tilde_expand_filename(options.identity_files[i], filename = tilde_expand_filename(options.identity_files[i],
original_real_uid); original_real_uid);
public = key_new(KEY_RSA1); public = key_load_public(filename, NULL);
if (!load_public_key(filename, public, NULL)) {
key_free(public);
public = key_new(KEY_UNSPEC);
if (!try_load_public_key(filename, public, NULL)) {
debug("unknown identity file %s", filename);
key_free(public);
public = NULL;
}
}
debug("identity file %s type %d", filename, debug("identity file %s type %d", filename,
public ? public->type : -1); public ? public->type : -1);
xfree(options.identity_files[i]); xfree(options.identity_files[i]);

6
sshconnect.c
View File

@ -13,7 +13,7 @@
*/ */
#include "includes.h" #include "includes.h"
RCSID("$OpenBSD: sshconnect.c,v 1.100 2001/03/12 22:02:02 markus Exp $"); RCSID("$OpenBSD: sshconnect.c,v 1.101 2001/03/26 08:07:09 markus Exp $");
#include <openssl/bn.h> #include <openssl/bn.h>
@ -738,7 +738,7 @@ check_host_key(char *host, struct sockaddr *hostaddr, Key *host_key,
* This function does not require super-user privileges. * This function does not require super-user privileges.
*/ */
void void
ssh_login(int host_key_valid, RSA *own_host_key, const char *orighost, ssh_login(Key *own_host_key, const char *orighost,
struct sockaddr *hostaddr, uid_t original_real_uid) struct sockaddr *hostaddr, uid_t original_real_uid)
{ {
struct passwd *pw; struct passwd *pw;
@ -771,7 +771,7 @@ ssh_login(int host_key_valid, RSA *own_host_key, const char *orighost,
ssh_userauth2(server_user, host); ssh_userauth2(server_user, host);
} else { } else {
ssh_kex(host, hostaddr); ssh_kex(host, hostaddr);
ssh_userauth(local_user, server_user, host, host_key_valid, own_host_key); ssh_userauth(local_user, server_user, host, own_host_key);
} }
} }

6
sshconnect.h
View File

@ -1,4 +1,4 @@
/* $OpenBSD: sshconnect.h,v 1.6 2001/02/15 23:19:59 markus Exp $ */ /* $OpenBSD: sshconnect.h,v 1.7 2001/03/26 08:07:09 markus Exp $ */
/* /*
* Copyright (c) 2000 Markus Friedl. All rights reserved. * Copyright (c) 2000 Markus Friedl. All rights reserved.
@ -50,7 +50,7 @@ ssh_connect(const char *host, struct sockaddr_storage * hostaddr,
*/ */
void void
ssh_login(int host_key_valid, RSA * host_key, const char *host, ssh_login(Key *host_key, const char *host,
struct sockaddr * hostaddr, uid_t original_real_uid); struct sockaddr * hostaddr, uid_t original_real_uid);
@ -61,7 +61,7 @@ check_host_key(char *host, struct sockaddr *hostaddr, Key *host_key,
void ssh_kex(char *host, struct sockaddr *hostaddr); void ssh_kex(char *host, struct sockaddr *hostaddr);
void void
ssh_userauth(const char * local_user, const char * server_user, char *host, ssh_userauth(const char * local_user, const char * server_user, char *host,
int host_key_valid, RSA *own_host_key); Key *own_host_key);
void ssh_kex2(char *host, struct sockaddr *hostaddr); void ssh_kex2(char *host, struct sockaddr *hostaddr);
void ssh_userauth2(const char *server_user, char *host); void ssh_userauth2(const char *server_user, char *host);

30
sshconnect1.c
View File

@ -13,7 +13,7 @@
*/ */
#include "includes.h" #include "includes.h"
RCSID("$OpenBSD: sshconnect1.c,v 1.28 2001/03/08 21:42:33 markus Exp $"); RCSID("$OpenBSD: sshconnect1.c,v 1.29 2001/03/26 08:07:09 markus Exp $");
#include <openssl/bn.h> #include <openssl/bn.h>
#include <openssl/evp.h> #include <openssl/evp.h>
@ -211,9 +211,9 @@ try_rsa_authentication(const char *authfile)
int plen, clen; int plen, clen;
/* Try to load identification for the authentication key. */ /* Try to load identification for the authentication key. */
public = key_new(KEY_RSA1); /* XXKEYLOAD */
if (!load_public_key(authfile, public, &comment)) { public = key_load_public_type(KEY_RSA1, authfile, &comment);
key_free(public); if (public == NULL) {
/* Could not load it. Fail. */ /* Could not load it. Fail. */
return 0; return 0;
} }
@ -252,12 +252,12 @@ try_rsa_authentication(const char *authfile)
debug("Received RSA challenge from server."); debug("Received RSA challenge from server.");
private = key_new(KEY_RSA1);
/* /*
* Load the private key. Try first with empty passphrase; if it * Load the private key. Try first with empty passphrase; if it
* fails, ask for a passphrase. * fails, ask for a passphrase.
*/ */
if (!load_private_key(authfile, "", private, NULL)) { private = key_load_private_type(KEY_RSA1, authfile, "", NULL);
if (private == NULL) {
char buf[300]; char buf[300];
snprintf(buf, sizeof buf, "Enter passphrase for RSA key '%.100s': ", snprintf(buf, sizeof buf, "Enter passphrase for RSA key '%.100s': ",
comment); comment);
@ -270,7 +270,8 @@ try_rsa_authentication(const char *authfile)
} }
/* Load the authentication file using the pasphrase. */ /* Load the authentication file using the pasphrase. */
if (!load_private_key(authfile, passphrase, private, NULL)) { private = key_load_private_type(KEY_RSA1, authfile, passphrase, NULL);
if (private == NULL) {
memset(passphrase, 0, strlen(passphrase)); memset(passphrase, 0, strlen(passphrase));
xfree(passphrase); xfree(passphrase);
error("Bad passphrase."); error("Bad passphrase.");
@ -285,7 +286,6 @@ try_rsa_authentication(const char *authfile)
/* Expect the server to reject it... */ /* Expect the server to reject it... */
packet_read_expect(&plen, SSH_SMSG_FAILURE); packet_read_expect(&plen, SSH_SMSG_FAILURE);
xfree(comment); xfree(comment);
key_free(private);
BN_clear_free(challenge); BN_clear_free(challenge);
return 0; return 0;
} }
@ -322,7 +322,7 @@ try_rsa_authentication(const char *authfile)
* authentication and RSA host authentication. * authentication and RSA host authentication.
*/ */
int int
try_rhosts_rsa_authentication(const char *local_user, RSA * host_key) try_rhosts_rsa_authentication(const char *local_user, Key * host_key)
{ {
int type; int type;
BIGNUM *challenge; BIGNUM *challenge;
@ -333,9 +333,9 @@ try_rhosts_rsa_authentication(const char *local_user, RSA * host_key)
/* Tell the server that we are willing to authenticate using this key. */ /* Tell the server that we are willing to authenticate using this key. */
packet_start(SSH_CMSG_AUTH_RHOSTS_RSA); packet_start(SSH_CMSG_AUTH_RHOSTS_RSA);
packet_put_string(local_user, strlen(local_user)); packet_put_string(local_user, strlen(local_user));
packet_put_int(BN_num_bits(host_key->n)); packet_put_int(BN_num_bits(host_key->rsa->n));
packet_put_bignum(host_key->e); packet_put_bignum(host_key->rsa->e);
packet_put_bignum(host_key->n); packet_put_bignum(host_key->rsa->n);
packet_send(); packet_send();
packet_write_wait(); packet_write_wait();
@ -361,7 +361,7 @@ try_rhosts_rsa_authentication(const char *local_user, RSA * host_key)
debug("Received RSA challenge for host key from server."); debug("Received RSA challenge for host key from server.");
/* Compute a response to the challenge. */ /* Compute a response to the challenge. */
respond_to_rsa_challenge(challenge, host_key); respond_to_rsa_challenge(challenge, host_key->rsa);
/* We no longer need the challenge. */ /* We no longer need the challenge. */
BN_clear_free(challenge); BN_clear_free(challenge);
@ -915,7 +915,7 @@ ssh_userauth(
const char *local_user, const char *local_user,
const char *server_user, const char *server_user,
char *host, char *host,
int host_key_valid, RSA *own_host_key) Key *own_host_key)
{ {
int i, type; int i, type;
int payload_len; int payload_len;
@ -1000,7 +1000,7 @@ ssh_userauth(
* authentication. * authentication.
*/ */
if ((supported_authentications & (1 << SSH_AUTH_RHOSTS_RSA)) && if ((supported_authentications & (1 << SSH_AUTH_RHOSTS_RSA)) &&
options.rhosts_rsa_authentication && host_key_valid) { options.rhosts_rsa_authentication && own_host_key != NULL) {
if (try_rhosts_rsa_authentication(local_user, own_host_key)) if (try_rhosts_rsa_authentication(local_user, own_host_key))
return; return;
} }

22
sshconnect2.c
View File

@ -23,7 +23,7 @@
*/ */
#include "includes.h" #include "includes.h"
RCSID("$OpenBSD: sshconnect2.c,v 1.55 2001/03/23 11:04:07 djm Exp $"); RCSID("$OpenBSD: sshconnect2.c,v 1.56 2001/03/26 08:07:09 markus Exp $");
#include <openssl/bn.h> #include <openssl/bn.h>
#include <openssl/md5.h> #include <openssl/md5.h>
@ -901,26 +901,24 @@ load_identity_file(char *filename)
{ {
Key *private; Key *private;
char prompt[300], *passphrase; char prompt[300], *passphrase;
int success = 0, quit, i; int quit, i;
struct stat st; struct stat st;
if (stat(filename, &st) < 0) { if (stat(filename, &st) < 0) {
debug3("no such identity: %s", filename); debug3("no such identity: %s", filename);
return NULL; return NULL;
} }
private = key_new(KEY_UNSPEC); private = key_load_private_type(KEY_UNSPEC, filename, "", NULL);
if (!load_private_key(filename, "", private, NULL)) { if (private == NULL) {
if (options.batch_mode) { if (options.batch_mode)
key_free(private);
return NULL; return NULL;
}
snprintf(prompt, sizeof prompt, snprintf(prompt, sizeof prompt,
"Enter passphrase for key '%.100s': ", filename); "Enter passphrase for key '%.100s': ", filename);
for (i = 0; i < options.number_of_password_prompts; i++) { for (i = 0; i < options.number_of_password_prompts; i++) {
passphrase = read_passphrase(prompt, 0); passphrase = read_passphrase(prompt, 0);
if (strcmp(passphrase, "") != 0) { if (strcmp(passphrase, "") != 0) {
success = load_private_key(filename, private = key_load_private_type(KEY_UNSPEC, filename,
passphrase, private, NULL); passphrase, NULL);
quit = 0; quit = 0;
} else { } else {
debug2("no passphrase given, try next key"); debug2("no passphrase given, try next key");
@ -928,14 +926,10 @@ load_identity_file(char *filename)
} }
memset(passphrase, 0, strlen(passphrase)); memset(passphrase, 0, strlen(passphrase));
xfree(passphrase); xfree(passphrase);
if (success || quit) if (private != NULL || quit)
break; break;
debug2("bad passphrase given, try again..."); debug2("bad passphrase given, try again...");
} }
if (!success) {
key_free(private);
return NULL;
}
} }
return private; return private;
} }

43
sshd.c
View File

@ -40,7 +40,7 @@
*/ */
#include "includes.h" #include "includes.h"
RCSID("$OpenBSD: sshd.c,v 1.178 2001/03/23 14:28:32 markus Exp $"); RCSID("$OpenBSD: sshd.c,v 1.179 2001/03/26 08:07:09 markus Exp $");
#include <openssl/dh.h> #include <openssl/dh.h>
#include <openssl/bn.h> #include <openssl/bn.h>
@ -454,39 +454,6 @@ destroy_sensitive_data(void)
sensitive_data.ssh1_host_key = NULL; sensitive_data.ssh1_host_key = NULL;
memset(sensitive_data.ssh1_cookie, 0, SSH_SESSION_KEY_LENGTH); memset(sensitive_data.ssh1_cookie, 0, SSH_SESSION_KEY_LENGTH);
} }
Key *
load_private_key_autodetect(const char *filename)
{
struct stat st;
int type;
Key *public, *private;
if (stat(filename, &st) < 0) {
perror(filename);
return NULL;
}
/*
* try to load the public key. right now this only works for RSA1,
* since SSH2 keys are fully encrypted
*/
type = KEY_RSA1;
public = key_new(type);
if (!load_public_key(filename, public, NULL)) {
/* ok, so we will assume this is 'some' key */
type = KEY_UNSPEC;
}
key_free(public);
/* Ok, try key with empty passphrase */
private = key_new(type);
if (load_private_key(filename, "", private, NULL)) {
debug("load_private_key_autodetect: type %d %s",
private->type, key_type(private));
return private;
}
key_free(private);
return NULL;
}
char * char *
list_hostkey_types(void) list_hostkey_types(void)
@ -579,6 +546,7 @@ main(int ac, char **av)
int listen_sock, maxfd; int listen_sock, maxfd;
int startup_p[2]; int startup_p[2];
int startups = 0; int startups = 0;
Key *key;
int ret, key_used = 0; int ret, key_used = 0;
__progname = get_progname(av[0]); __progname = get_progname(av[0]);
@ -716,10 +684,12 @@ main(int ac, char **av)
sensitive_data.have_ssh2_key = 0; sensitive_data.have_ssh2_key = 0;
for(i = 0; i < options.num_host_key_files; i++) { for(i = 0; i < options.num_host_key_files; i++) {
Key *key = load_private_key_autodetect(options.host_key_files[i]); key = key_load_private(options.host_key_files[i], "", NULL);
sensitive_data.host_keys[i] = key;
if (key == NULL) { if (key == NULL) {
error("Could not load host key: %.200s: %.100s", error("Could not load host key: %.200s: %.100s",
options.host_key_files[i], strerror(errno)); options.host_key_files[i], strerror(errno));
sensitive_data.host_keys[i] = NULL;
continue; continue;
} }
switch(key->type){ switch(key->type){
@ -732,7 +702,8 @@ main(int ac, char **av)
sensitive_data.have_ssh2_key = 1; sensitive_data.have_ssh2_key = 1;
break; break;
} }
sensitive_data.host_keys[i] = key; debug("private host key: #%d type %d %s", i, key->type,
key_type(key));
} }
if ((options.protocol & SSH_PROTO_1) && !sensitive_data.have_ssh1_key) { if ((options.protocol & SSH_PROTO_1) && !sensitive_data.have_ssh1_key) {
log("Disabling protocol version 1. Could not load host key"); log("Disabling protocol version 1. Could not load host key");