crypto/openssh/ssh-keygen.c

   1 /* $OpenBSD: ssh-keygen.c,v 1.299 2017/03/10 04:26:06 djm Exp $ */
   2 /*
   3  * Author: Tatu Ylonen <ylo@cs.hut.fi>
   4  * Copyright (c) 1994 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
   5  *                    All rights reserved
   6  * Identity and host key generation and maintenance.
   7  *
   8  * As far as I am concerned, the code I have written for this software
   9  * can be used freely for any purpose.  Any derived versions of this
  10  * software must be clearly marked as such, and if the derived work is
  11  * incompatible with the protocol description in the RFC file, it must be
  12  * called by a name other than "ssh" or "Secure Shell".
  13  */
  14
  15 #include "includes.h"
  16
  17 #include <sys/types.h>
  18 #include <sys/socket.h>
  19 #include <sys/stat.h>
  20
  21 #ifdef WITH_OPENSSL
  22 #include <openssl/evp.h>
  23 #include <openssl/pem.h>
  24 #include "openbsd-compat/openssl-compat.h"
  25 #endif
  26
  27 #include <errno.h>
  28 #include <fcntl.h>
  29 #include <netdb.h>
  30 #ifdef HAVE_PATHS_H
  31 # include <paths.h>
  32 #endif
  33 #include <pwd.h>
  34 #include <stdarg.h>
  35 #include <stdio.h>
  36 #include <stdlib.h>
  37 #include <string.h>
  38 #include <unistd.h>
  39 #include <limits.h>
  40 #include <locale.h>
  41
  42 #include "xmalloc.h"
  43 #include "sshkey.h"
  44 #include "rsa.h"
  45 #include "authfile.h"
  46 #include "uuencode.h"
  47 #include "sshbuf.h"
  48 #include "pathnames.h"
  49 #include "log.h"
  50 #include "misc.h"
  51 #include "match.h"
  52 #include "hostfile.h"
  53 #include "dns.h"
  54 #include "ssh.h"
  55 #include "ssh2.h"
  56 #include "ssherr.h"
  57 #include "ssh-pkcs11.h"
  58 #include "atomicio.h"
  59 #include "krl.h"
  60 #include "digest.h"
  61 #include "utf8.h"
  62
  63 #ifdef WITH_OPENSSL
  64 # define DEFAULT_KEY_TYPE_NAME "rsa"
  65 #else
  66 # define DEFAULT_KEY_TYPE_NAME "ed25519"
  67 #endif
  68
  69 /* Number of bits in the RSA/DSA key.  This value can be set on the command line. */
  70 #define DEFAULT_BITS            2048
  71 #define DEFAULT_BITS_DSA        1024
  72 #define DEFAULT_BITS_ECDSA      256
  73 u_int32_t bits = 0;
  74
  75 /*
  76  * Flag indicating that we just want to change the passphrase.  This can be
  77  * set on the command line.
  78  */
  79 int change_passphrase = 0;
  80
  81 /*
  82  * Flag indicating that we just want to change the comment.  This can be set
  83  * on the command line.
  84  */
  85 int change_comment = 0;
  86
  87 int quiet = 0;
  88
  89 int log_level = SYSLOG_LEVEL_INFO;
  90
  91 /* Flag indicating that we want to hash a known_hosts file */
  92 int hash_hosts = 0;
  93 /* Flag indicating that we want lookup a host in known_hosts file */
  94 int find_host = 0;
  95 /* Flag indicating that we want to delete a host from a known_hosts file */
  96 int delete_host = 0;
  97
  98 /* Flag indicating that we want to show the contents of a certificate */
  99 int show_cert = 0;
 100
 101 /* Flag indicating that we just want to see the key fingerprint */
 102 int print_fingerprint = 0;
 103 int print_bubblebabble = 0;
 104
 105 /* Hash algorithm to use for fingerprints. */
 106 int fingerprint_hash = SSH_FP_HASH_DEFAULT;
 107
 108 /* The identity file name, given on the command line or entered by the user. */
 109 char identity_file[1024];
 110 int have_identity = 0;
 111
 112 /* This is set to the passphrase if given on the command line. */
 113 char *identity_passphrase = NULL;
 114
 115 /* This is set to the new passphrase if given on the command line. */
 116 char *identity_new_passphrase = NULL;
 117
 118 /* This is set to the new comment if given on the command line. */
 119 char *identity_comment = NULL;
 120
 121 /* Path to CA key when certifying keys. */
 122 char *ca_key_path = NULL;
 123
 124 /* Certificate serial number */
 125 unsigned long long cert_serial = 0;
 126
 127 /* Key type when certifying */
 128 u_int cert_key_type = SSH2_CERT_TYPE_USER;
 129
 130 /* "key ID" of signed key */
 131 char *cert_key_id = NULL;
 132
 133 /* Comma-separated list of principal names for certifying keys */
 134 char *cert_principals = NULL;
 135
 136 /* Validity period for certificates */
 137 u_int64_t cert_valid_from = 0;
 138 u_int64_t cert_valid_to = ~0ULL;
 139
 140 /* Certificate options */
 141 #define CERTOPT_X_FWD   (1)
 142 #define CERTOPT_AGENT_FWD       (1<<1)
 143 #define CERTOPT_PORT_FWD        (1<<2)
 144 #define CERTOPT_PTY             (1<<3)
 145 #define CERTOPT_USER_RC (1<<4)
 146 #define CERTOPT_DEFAULT (CERTOPT_X_FWD|CERTOPT_AGENT_FWD| \
 147                          CERTOPT_PORT_FWD|CERTOPT_PTY|CERTOPT_USER_RC)
 148 u_int32_t certflags_flags = CERTOPT_DEFAULT;
 149 char *certflags_command = NULL;
 150 char *certflags_src_addr = NULL;
 151
 152 /* Conversion to/from various formats */
 153 int convert_to = 0;
 154 int convert_from = 0;
 155 enum {
 156         FMT_RFC4716,
 157         FMT_PKCS8,
 158         FMT_PEM
 159 } convert_format = FMT_RFC4716;
 160 int print_public = 0;
 161 int print_generic = 0;
 162
 163 char *key_type_name = NULL;
 164
 165 /* Load key from this PKCS#11 provider */
 166 char *pkcs11provider = NULL;
 167
 168 /* Use new OpenSSH private key format when writing SSH2 keys instead of PEM */
 169 int use_new_format = 0;
 170
 171 /* Cipher for new-format private keys */
 172 char *new_format_cipher = NULL;
 173
 174 /*
 175  * Number of KDF rounds to derive new format keys /
 176  * number of primality trials when screening moduli.
 177  */
 178 int rounds = 0;
 179
 180 /* argv0 */
 181 extern char *__progname;
 182
 183 char hostname[NI_MAXHOST];
 184
 185 #ifdef WITH_OPENSSL
 186 /* moduli.c */
 187 int gen_candidates(FILE *, u_int32_t, u_int32_t, BIGNUM *);
 188 int prime_test(FILE *, FILE *, u_int32_t, u_int32_t, char *, unsigned long,
 189     unsigned long);
 190 #endif
 191
 192 static void
 193 type_bits_valid(int type, const char *name, u_int32_t *bitsp)
 194 {
 195 #ifdef WITH_OPENSSL
 196         u_int maxbits, nid;
 197 #endif
 198
 199         if (type == KEY_UNSPEC)
 200                 fatal("unknown key type %s", key_type_name);
 201         if (*bitsp == 0) {
 202 #ifdef WITH_OPENSSL
 203                 if (type == KEY_DSA)
 204                         *bitsp = DEFAULT_BITS_DSA;
 205                 else if (type == KEY_ECDSA) {
 206                         if (name != NULL &&
 207                             (nid = sshkey_ecdsa_nid_from_name(name)) > 0)
 208                                 *bitsp = sshkey_curve_nid_to_bits(nid);
 209                         if (*bitsp == 0)
 210                                 *bitsp = DEFAULT_BITS_ECDSA;
 211                 } else
 212 #endif
 213                         *bitsp = DEFAULT_BITS;
 214         }
 215 #ifdef WITH_OPENSSL
 216         maxbits = (type == KEY_DSA) ?
 217             OPENSSL_DSA_MAX_MODULUS_BITS : OPENSSL_RSA_MAX_MODULUS_BITS;
 218         if (*bitsp > maxbits)
 219                 fatal("key bits exceeds maximum %d", maxbits);
 220         if (type == KEY_DSA && *bitsp != 1024)
 221                 fatal("DSA keys must be 1024 bits");
 222         else if (type != KEY_ECDSA && type != KEY_ED25519 && *bitsp < 1024)
 223                 fatal("Key must at least be 1024 bits");
 224         else if (type == KEY_ECDSA && sshkey_ecdsa_bits_to_nid(*bitsp) == -1)
 225                 fatal("Invalid ECDSA key length - valid lengths are "
 226                     "256, 384 or 521 bits");
 227 #endif
 228 }
 229
 230 static void
 231 ask_filename(struct passwd *pw, const char *prompt)
 232 {
 233         char buf[1024];
 234         char *name = NULL;
 235
 236         if (key_type_name == NULL)
 237                 name = _PATH_SSH_CLIENT_ID_RSA;
 238         else {
 239                 switch (sshkey_type_from_name(key_type_name)) {
 240                 case KEY_RSA1:
 241                         name = _PATH_SSH_CLIENT_IDENTITY;
 242                         break;
 243                 case KEY_DSA_CERT:
 244                 case KEY_DSA:
 245                         name = _PATH_SSH_CLIENT_ID_DSA;
 246                         break;
 247 #ifdef OPENSSL_HAS_ECC
 248                 case KEY_ECDSA_CERT:
 249                 case KEY_ECDSA:
 250                         name = _PATH_SSH_CLIENT_ID_ECDSA;
 251                         break;
 252 #endif
 253                 case KEY_RSA_CERT:
 254                 case KEY_RSA:
 255                         name = _PATH_SSH_CLIENT_ID_RSA;
 256                         break;
 257                 case KEY_ED25519:
 258                 case KEY_ED25519_CERT:
 259                         name = _PATH_SSH_CLIENT_ID_ED25519;
 260                         break;
 261                 default:
 262                         fatal("bad key type");
 263                 }
 264         }
 265         snprintf(identity_file, sizeof(identity_file),
 266             "%s/%s", pw->pw_dir, name);
 267         printf("%s (%s): ", prompt, identity_file);
 268         fflush(stdout);
 269         if (fgets(buf, sizeof(buf), stdin) == NULL)
 270                 exit(1);
 271         buf[strcspn(buf, "\n")] = '\0';
 272         if (strcmp(buf, "") != 0)
 273                 strlcpy(identity_file, buf, sizeof(identity_file));
 274         have_identity = 1;
 275 }
 276
 277 static struct sshkey *
 278 load_identity(char *filename)
 279 {
 280         char *pass;
 281         struct sshkey *prv;
 282         int r;
 283
 284         if ((r = sshkey_load_private(filename, "", &prv, NULL)) == 0)
 285                 return prv;
 286         if (r != SSH_ERR_KEY_WRONG_PASSPHRASE)
 287                 fatal("Load key \"%s\": %s", filename, ssh_err(r));
 288         if (identity_passphrase)
 289                 pass = xstrdup(identity_passphrase);
 290         else
 291                 pass = read_passphrase("Enter passphrase: ", RP_ALLOW_STDIN);
 292         r = sshkey_load_private(filename, pass, &prv, NULL);
 293         explicit_bzero(pass, strlen(pass));
 294         free(pass);
 295         if (r != 0)
 296                 fatal("Load key \"%s\": %s", filename, ssh_err(r));
 297         return prv;
 298 }
 299
 300 #define SSH_COM_PUBLIC_BEGIN            "---- BEGIN SSH2 PUBLIC KEY ----"
 301 #define SSH_COM_PUBLIC_END              "---- END SSH2 PUBLIC KEY ----"
 302 #define SSH_COM_PRIVATE_BEGIN           "---- BEGIN SSH2 ENCRYPTED PRIVATE KEY ----"
 303 #define SSH_COM_PRIVATE_KEY_MAGIC       0x3f6ff9eb
 304
 305 #ifdef WITH_OPENSSL
 306 static void
 307 do_convert_to_ssh2(struct passwd *pw, struct sshkey *k)
 308 {
 309         size_t len;
 310         u_char *blob;
 311         char comment[61];
 312         int r;
 313
 314         if (k->type == KEY_RSA1)
 315                 fatal("version 1 keys are not supported");
 316         if ((r = sshkey_to_blob(k, &blob, &len)) != 0)
 317                 fatal("key_to_blob failed: %s", ssh_err(r));
 318         /* Comment + surrounds must fit into 72 chars (RFC 4716 sec 3.3) */
 319         snprintf(comment, sizeof(comment),
 320             "%u-bit %s, converted by %s@%s from OpenSSH",
 321             sshkey_size(k), sshkey_type(k),
 322             pw->pw_name, hostname);
 323
 324         fprintf(stdout, "%s\n", SSH_COM_PUBLIC_BEGIN);
 325         fprintf(stdout, "Comment: \"%s\"\n", comment);
 326         dump_base64(stdout, blob, len);
 327         fprintf(stdout, "%s\n", SSH_COM_PUBLIC_END);
 328         sshkey_free(k);
 329         free(blob);
 330         exit(0);
 331 }
 332
 333 static void
 334 do_convert_to_pkcs8(struct sshkey *k)
 335 {
 336         switch (sshkey_type_plain(k->type)) {
 337         case KEY_RSA1:
 338         case KEY_RSA:
 339                 if (!PEM_write_RSA_PUBKEY(stdout, k->rsa))
 340                         fatal("PEM_write_RSA_PUBKEY failed");
 341                 break;
 342         case KEY_DSA:
 343                 if (!PEM_write_DSA_PUBKEY(stdout, k->dsa))
 344                         fatal("PEM_write_DSA_PUBKEY failed");
 345                 break;
 346 #ifdef OPENSSL_HAS_ECC
 347         case KEY_ECDSA:
 348                 if (!PEM_write_EC_PUBKEY(stdout, k->ecdsa))
 349                         fatal("PEM_write_EC_PUBKEY failed");
 350                 break;
 351 #endif
 352         default:
 353                 fatal("%s: unsupported key type %s", __func__, sshkey_type(k));
 354         }
 355         exit(0);
 356 }
 357
 358 static void
 359 do_convert_to_pem(struct sshkey *k)
 360 {
 361         switch (sshkey_type_plain(k->type)) {
 362         case KEY_RSA1:
 363         case KEY_RSA:
 364                 if (!PEM_write_RSAPublicKey(stdout, k->rsa))
 365                         fatal("PEM_write_RSAPublicKey failed");
 366                 break;
 367 #if notyet /* OpenSSH 0.9.8 lacks this function */
 368         case KEY_DSA:
 369                 if (!PEM_write_DSAPublicKey(stdout, k->dsa))
 370                         fatal("PEM_write_DSAPublicKey failed");
 371                 break;
 372 #endif
 373         /* XXX ECDSA? */
 374         default:
 375                 fatal("%s: unsupported key type %s", __func__, sshkey_type(k));
 376         }
 377         exit(0);
 378 }
 379
 380 static void
 381 do_convert_to(struct passwd *pw)
 382 {
 383         struct sshkey *k;
 384         struct stat st;
 385         int r;
 386
 387         if (!have_identity)
 388                 ask_filename(pw, "Enter file in which the key is");
 389         if (stat(identity_file, &st) < 0)
 390                 fatal("%s: %s: %s", __progname, identity_file, strerror(errno));
 391         if ((r = sshkey_load_public(identity_file, &k, NULL)) != 0)
 392                 k = load_identity(identity_file);
 393         switch (convert_format) {
 394         case FMT_RFC4716:
 395                 do_convert_to_ssh2(pw, k);
 396                 break;
 397         case FMT_PKCS8:
 398                 do_convert_to_pkcs8(k);
 399                 break;
 400         case FMT_PEM:
 401                 do_convert_to_pem(k);
 402                 break;
 403         default:
 404                 fatal("%s: unknown key format %d", __func__, convert_format);
 405         }
 406         exit(0);
 407 }
 408
 409 /*
 410  * This is almost exactly the bignum1 encoding, but with 32 bit for length
 411  * instead of 16.
 412  */
 413 static void
 414 buffer_get_bignum_bits(struct sshbuf *b, BIGNUM *value)
 415 {
 416         u_int bytes, bignum_bits;
 417         int r;
 418
 419         if ((r = sshbuf_get_u32(b, &bignum_bits)) != 0)
 420                 fatal("%s: buffer error: %s", __func__, ssh_err(r));
 421         bytes = (bignum_bits + 7) / 8;
 422         if (sshbuf_len(b) < bytes)
 423                 fatal("%s: input buffer too small: need %d have %zu",
 424                     __func__, bytes, sshbuf_len(b));
 425         if (BN_bin2bn(sshbuf_ptr(b), bytes, value) == NULL)
 426                 fatal("%s: BN_bin2bn failed", __func__);
 427         if ((r = sshbuf_consume(b, bytes)) != 0)
 428                 fatal("%s: buffer error: %s", __func__, ssh_err(r));
 429 }
 430
 431 static struct sshkey *
 432 do_convert_private_ssh2_from_blob(u_char *blob, u_int blen)
 433 {
 434         struct sshbuf *b;
 435         struct sshkey *key = NULL;
 436         char *type, *cipher;
 437         u_char e1, e2, e3, *sig = NULL, data[] = "abcde12345";
 438         int r, rlen, ktype;
 439         u_int magic, i1, i2, i3, i4;
 440         size_t slen;
 441         u_long e;
 442
 443         if ((b = sshbuf_from(blob, blen)) == NULL)
 444                 fatal("%s: sshbuf_from failed", __func__);
 445         if ((r = sshbuf_get_u32(b, &magic)) != 0)
 446                 fatal("%s: buffer error: %s", __func__, ssh_err(r));
 447
 448         if (magic != SSH_COM_PRIVATE_KEY_MAGIC) {
 449                 error("bad magic 0x%x != 0x%x", magic,
 450                     SSH_COM_PRIVATE_KEY_MAGIC);
 451                 sshbuf_free(b);
 452                 return NULL;
 453         }
 454         if ((r = sshbuf_get_u32(b, &i1)) != 0 ||
 455             (r = sshbuf_get_cstring(b, &type, NULL)) != 0 ||
 456             (r = sshbuf_get_cstring(b, &cipher, NULL)) != 0 ||
 457             (r = sshbuf_get_u32(b, &i2)) != 0 ||
 458             (r = sshbuf_get_u32(b, &i3)) != 0 ||
 459             (r = sshbuf_get_u32(b, &i4)) != 0)
 460                 fatal("%s: buffer error: %s", __func__, ssh_err(r));
 461         debug("ignore (%d %d %d %d)", i1, i2, i3, i4);
 462         if (strcmp(cipher, "none") != 0) {
 463                 error("unsupported cipher %s", cipher);
 464                 free(cipher);
 465                 sshbuf_free(b);
 466                 free(type);
 467                 return NULL;
 468         }
 469         free(cipher);
 470
 471         if (strstr(type, "dsa")) {
 472                 ktype = KEY_DSA;
 473         } else if (strstr(type, "rsa")) {
 474                 ktype = KEY_RSA;
 475         } else {
 476                 sshbuf_free(b);
 477                 free(type);
 478                 return NULL;
 479         }
 480         if ((key = sshkey_new_private(ktype)) == NULL)
 481                 fatal("key_new_private failed");
 482         free(type);
 483
 484         switch (key->type) {
 485         case KEY_DSA:
 486                 buffer_get_bignum_bits(b, key->dsa->p);
 487                 buffer_get_bignum_bits(b, key->dsa->g);
 488                 buffer_get_bignum_bits(b, key->dsa->q);
 489                 buffer_get_bignum_bits(b, key->dsa->pub_key);
 490                 buffer_get_bignum_bits(b, key->dsa->priv_key);
 491                 break;
 492         case KEY_RSA:
 493                 if ((r = sshbuf_get_u8(b, &e1)) != 0 ||
 494                     (e1 < 30 && (r = sshbuf_get_u8(b, &e2)) != 0) ||
 495                     (e1 < 30 && (r = sshbuf_get_u8(b, &e3)) != 0))
 496                         fatal("%s: buffer error: %s", __func__, ssh_err(r));
 497                 e = e1;
 498                 debug("e %lx", e);
 499                 if (e < 30) {
 500                         e <<= 8;
 501                         e += e2;
 502                         debug("e %lx", e);
 503                         e <<= 8;
 504                         e += e3;
 505                         debug("e %lx", e);
 506                 }
 507                 if (!BN_set_word(key->rsa->e, e)) {
 508                         sshbuf_free(b);
 509                         sshkey_free(key);
 510                         return NULL;
 511                 }
 512                 buffer_get_bignum_bits(b, key->rsa->d);
 513                 buffer_get_bignum_bits(b, key->rsa->n);
 514                 buffer_get_bignum_bits(b, key->rsa->iqmp);
 515                 buffer_get_bignum_bits(b, key->rsa->q);
 516                 buffer_get_bignum_bits(b, key->rsa->p);
 517                 if ((r = rsa_generate_additional_parameters(key->rsa)) != 0)
 518                         fatal("generate RSA parameters failed: %s", ssh_err(r));
 519                 break;
 520         }
 521         rlen = sshbuf_len(b);
 522         if (rlen != 0)
 523                 error("do_convert_private_ssh2_from_blob: "
 524                     "remaining bytes in key blob %d", rlen);
 525         sshbuf_free(b);
 526
 527         /* try the key */
 528         if (sshkey_sign(key, &sig, &slen, data, sizeof(data), NULL, 0) != 0 ||
 529             sshkey_verify(key, sig, slen, data, sizeof(data), 0) != 0) {
 530                 sshkey_free(key);
 531                 free(sig);
 532                 return NULL;
 533         }
 534         free(sig);
 535         return key;
 536 }
 537
 538 static int
 539 get_line(FILE *fp, char *line, size_t len)
 540 {
 541         int c;
 542         size_t pos = 0;
 543
 544         line[0] = '\0';
 545         while ((c = fgetc(fp)) != EOF) {
 546                 if (pos >= len - 1)
 547                         fatal("input line too long.");
 548                 switch (c) {
 549                 case '\r':
 550                         c = fgetc(fp);
 551                         if (c != EOF && c != '\n' && ungetc(c, fp) == EOF)
 552                                 fatal("unget: %s", strerror(errno));
 553                         return pos;
 554                 case '\n':
 555                         return pos;
 556                 }
 557                 line[pos++] = c;
 558                 line[pos] = '\0';
 559         }
 560         /* We reached EOF */
 561         return -1;
 562 }
 563
 564 static void
 565 do_convert_from_ssh2(struct passwd *pw, struct sshkey **k, int *private)
 566 {
 567         int r, blen, escaped = 0;
 568         u_int len;
 569         char line[1024];
 570         u_char blob[8096];
 571         char encoded[8096];
 572         FILE *fp;
 573
 574         if ((fp = fopen(identity_file, "r")) == NULL)
 575                 fatal("%s: %s: %s", __progname, identity_file, strerror(errno));
 576         encoded[0] = '\0';
 577         while ((blen = get_line(fp, line, sizeof(line))) != -1) {
 578                 if (blen > 0 && line[blen - 1] == '\\')
 579                         escaped++;
 580                 if (strncmp(line, "----", 4) == 0 ||
 581                     strstr(line, ": ") != NULL) {
 582                         if (strstr(line, SSH_COM_PRIVATE_BEGIN) != NULL)
 583                                 *private = 1;
 584                         if (strstr(line, " END ") != NULL) {
 585                                 break;
 586                         }
 587                         /* fprintf(stderr, "ignore: %s", line); */
 588                         continue;
 589                 }
 590                 if (escaped) {
 591                         escaped--;
 592                         /* fprintf(stderr, "escaped: %s", line); */
 593                         continue;
 594                 }
 595                 strlcat(encoded, line, sizeof(encoded));
 596         }
 597         len = strlen(encoded);
 598         if (((len % 4) == 3) &&
 599             (encoded[len-1] == '=') &&
 600             (encoded[len-2] == '=') &&
 601             (encoded[len-3] == '='))
 602                 encoded[len-3] = '\0';
 603         blen = uudecode(encoded, blob, sizeof(blob));
 604         if (blen < 0)
 605                 fatal("uudecode failed.");
 606         if (*private)
 607                 *k = do_convert_private_ssh2_from_blob(blob, blen);
 608         else if ((r = sshkey_from_blob(blob, blen, k)) != 0)
 609                 fatal("decode blob failed: %s", ssh_err(r));
 610         fclose(fp);
 611 }
 612
 613 static void
 614 do_convert_from_pkcs8(struct sshkey **k, int *private)
 615 {
 616         EVP_PKEY *pubkey;
 617         FILE *fp;
 618
 619         if ((fp = fopen(identity_file, "r")) == NULL)
 620                 fatal("%s: %s: %s", __progname, identity_file, strerror(errno));
 621         if ((pubkey = PEM_read_PUBKEY(fp, NULL, NULL, NULL)) == NULL) {
 622                 fatal("%s: %s is not a recognised public key format", __func__,
 623                     identity_file);
 624         }
 625         fclose(fp);
 626         switch (EVP_PKEY_type(pubkey->type)) {
 627         case EVP_PKEY_RSA:
 628                 if ((*k = sshkey_new(KEY_UNSPEC)) == NULL)
 629                         fatal("sshkey_new failed");
 630                 (*k)->type = KEY_RSA;
 631                 (*k)->rsa = EVP_PKEY_get1_RSA(pubkey);
 632                 break;
 633         case EVP_PKEY_DSA:
 634                 if ((*k = sshkey_new(KEY_UNSPEC)) == NULL)
 635                         fatal("sshkey_new failed");
 636                 (*k)->type = KEY_DSA;
 637                 (*k)->dsa = EVP_PKEY_get1_DSA(pubkey);
 638                 break;
 639 #ifdef OPENSSL_HAS_ECC
 640         case EVP_PKEY_EC:
 641                 if ((*k = sshkey_new(KEY_UNSPEC)) == NULL)
 642                         fatal("sshkey_new failed");
 643                 (*k)->type = KEY_ECDSA;
 644                 (*k)->ecdsa = EVP_PKEY_get1_EC_KEY(pubkey);
 645                 (*k)->ecdsa_nid = sshkey_ecdsa_key_to_nid((*k)->ecdsa);
 646                 break;
 647 #endif
 648         default:
 649                 fatal("%s: unsupported pubkey type %d", __func__,
 650                     EVP_PKEY_type(pubkey->type));
 651         }
 652         EVP_PKEY_free(pubkey);
 653         return;
 654 }
 655
 656 static void
 657 do_convert_from_pem(struct sshkey **k, int *private)
 658 {
 659         FILE *fp;
 660         RSA *rsa;
 661 #ifdef notyet
 662         DSA *dsa;
 663 #endif
 664
 665         if ((fp = fopen(identity_file, "r")) == NULL)
 666                 fatal("%s: %s: %s", __progname, identity_file, strerror(errno));
 667         if ((rsa = PEM_read_RSAPublicKey(fp, NULL, NULL, NULL)) != NULL) {
 668                 if ((*k = sshkey_new(KEY_UNSPEC)) == NULL)
 669                         fatal("sshkey_new failed");
 670                 (*k)->type = KEY_RSA;
 671                 (*k)->rsa = rsa;
 672                 fclose(fp);
 673                 return;
 674         }
 675 #if notyet /* OpenSSH 0.9.8 lacks this function */
 676         rewind(fp);
 677         if ((dsa = PEM_read_DSAPublicKey(fp, NULL, NULL, NULL)) != NULL) {
 678                 if ((*k = sshkey_new(KEY_UNSPEC)) == NULL)
 679                         fatal("sshkey_new failed");
 680                 (*k)->type = KEY_DSA;
 681                 (*k)->dsa = dsa;
 682                 fclose(fp);
 683                 return;
 684         }
 685         /* XXX ECDSA */
 686 #endif
 687         fatal("%s: unrecognised raw private key format", __func__);
 688 }
 689
 690 static void
 691 do_convert_from(struct passwd *pw)
 692 {
 693         struct sshkey *k = NULL;
 694         int r, private = 0, ok = 0;
 695         struct stat st;
 696
 697         if (!have_identity)
 698                 ask_filename(pw, "Enter file in which the key is");
 699         if (stat(identity_file, &st) < 0)
 700                 fatal("%s: %s: %s", __progname, identity_file, strerror(errno));
 701
 702         switch (convert_format) {
 703         case FMT_RFC4716:
 704                 do_convert_from_ssh2(pw, &k, &private);
 705                 break;
 706         case FMT_PKCS8:
 707                 do_convert_from_pkcs8(&k, &private);
 708                 break;
 709         case FMT_PEM:
 710                 do_convert_from_pem(&k, &private);
 711                 break;
 712         default:
 713                 fatal("%s: unknown key format %d", __func__, convert_format);
 714         }
 715
 716         if (!private) {
 717                 if ((r = sshkey_write(k, stdout)) == 0)
 718                         ok = 1;
 719                 if (ok)
 720                         fprintf(stdout, "\n");
 721         } else {
 722                 switch (k->type) {
 723                 case KEY_DSA:
 724                         ok = PEM_write_DSAPrivateKey(stdout, k->dsa, NULL,
 725                             NULL, 0, NULL, NULL);
 726                         break;
 727 #ifdef OPENSSL_HAS_ECC
 728                 case KEY_ECDSA:
 729                         ok = PEM_write_ECPrivateKey(stdout, k->ecdsa, NULL,
 730                             NULL, 0, NULL, NULL);
 731                         break;
 732 #endif
 733                 case KEY_RSA:
 734                         ok = PEM_write_RSAPrivateKey(stdout, k->rsa, NULL,
 735                             NULL, 0, NULL, NULL);
 736                         break;
 737                 default:
 738                         fatal("%s: unsupported key type %s", __func__,
 739                             sshkey_type(k));
 740                 }
 741         }
 742
 743         if (!ok)
 744                 fatal("key write failed");
 745         sshkey_free(k);
 746         exit(0);
 747 }
 748 #endif
 749
 750 static void
 751 do_print_public(struct passwd *pw)
 752 {
 753         struct sshkey *prv;
 754         struct stat st;
 755         int r;
 756
 757         if (!have_identity)
 758                 ask_filename(pw, "Enter file in which the key is");
 759         if (stat(identity_file, &st) < 0)
 760                 fatal("%s: %s", identity_file, strerror(errno));
 761         prv = load_identity(identity_file);
 762         if ((r = sshkey_write(prv, stdout)) != 0)
 763                 error("key_write failed: %s", ssh_err(r));
 764         sshkey_free(prv);
 765         fprintf(stdout, "\n");
 766         exit(0);
 767 }
 768
 769 static void
 770 do_download(struct passwd *pw)
 771 {
 772 #ifdef ENABLE_PKCS11
 773         struct sshkey **keys = NULL;
 774         int i, nkeys;
 775         enum sshkey_fp_rep rep;
 776         int fptype;
 777         char *fp, *ra;
 778
 779         fptype = print_bubblebabble ? SSH_DIGEST_SHA1 : fingerprint_hash;
 780         rep =    print_bubblebabble ? SSH_FP_BUBBLEBABBLE : SSH_FP_DEFAULT;
 781
 782         pkcs11_init(0);
 783         nkeys = pkcs11_add_provider(pkcs11provider, NULL, &keys);
 784         if (nkeys <= 0)
 785                 fatal("cannot read public key from pkcs11");
 786         for (i = 0; i < nkeys; i++) {
 787                 if (print_fingerprint) {
 788                         fp = sshkey_fingerprint(keys[i], fptype, rep);
 789                         ra = sshkey_fingerprint(keys[i], fingerprint_hash,
 790                             SSH_FP_RANDOMART);
 791                         if (fp == NULL || ra == NULL)
 792                                 fatal("%s: sshkey_fingerprint fail", __func__);
 793                         printf("%u %s %s (PKCS11 key)\n", sshkey_size(keys[i]),
 794                             fp, sshkey_type(keys[i]));
 795                         if (log_level >= SYSLOG_LEVEL_VERBOSE)
 796                                 printf("%s\n", ra);
 797                         free(ra);
 798                         free(fp);
 799                 } else {
 800                         (void) sshkey_write(keys[i], stdout); /* XXX check */
 801                         fprintf(stdout, "\n");
 802                 }
 803                 sshkey_free(keys[i]);
 804         }
 805         free(keys);
 806         pkcs11_terminate();
 807         exit(0);
 808 #else
 809         fatal("no pkcs11 support");
 810 #endif /* ENABLE_PKCS11 */
 811 }
 812
 813 static struct sshkey *
 814 try_read_key(char **cpp)
 815 {
 816         struct sshkey *ret;
 817         int r;
 818
 819         if ((ret = sshkey_new(KEY_RSA1)) == NULL)
 820                 fatal("sshkey_new failed");
 821         /* Try RSA1 */
 822         if ((r = sshkey_read(ret, cpp)) == 0)
 823                 return ret;
 824         /* Try modern */
 825         sshkey_free(ret);
 826         if ((ret = sshkey_new(KEY_UNSPEC)) == NULL)
 827                 fatal("sshkey_new failed");
 828         if ((r = sshkey_read(ret, cpp)) == 0)
 829                 return ret;
 830         /* Not a key */
 831         sshkey_free(ret);
 832         return NULL;
 833 }
 834
 835 static void
 836 fingerprint_one_key(const struct sshkey *public, const char *comment)
 837 {
 838         char *fp = NULL, *ra = NULL;
 839         enum sshkey_fp_rep rep;
 840         int fptype;
 841
 842         fptype = print_bubblebabble ? SSH_DIGEST_SHA1 : fingerprint_hash;
 843         rep =    print_bubblebabble ? SSH_FP_BUBBLEBABBLE : SSH_FP_DEFAULT;
 844         fp = sshkey_fingerprint(public, fptype, rep);
 845         ra = sshkey_fingerprint(public, fingerprint_hash, SSH_FP_RANDOMART);
 846         if (fp == NULL || ra == NULL)
 847                 fatal("%s: sshkey_fingerprint failed", __func__);
 848         mprintf("%u %s %s (%s)\n", sshkey_size(public), fp,
 849             comment ? comment : "no comment", sshkey_type(public));
 850         if (log_level >= SYSLOG_LEVEL_VERBOSE)
 851                 printf("%s\n", ra);
 852         free(ra);
 853         free(fp);
 854 }
 855
 856 static void
 857 fingerprint_private(const char *path)
 858 {
 859         struct stat st;
 860         char *comment = NULL;
 861         struct sshkey *public = NULL;
 862         int r;
 863
 864         if (stat(identity_file, &st) < 0)
 865                 fatal("%s: %s", path, strerror(errno));
 866         if ((r = sshkey_load_public(path, &public, &comment)) != 0) {
 867                 debug("load public \"%s\": %s", path, ssh_err(r));
 868                 if ((r = sshkey_load_private(path, NULL,
 869                     &public, &comment)) != 0) {
 870                         debug("load private \"%s\": %s", path, ssh_err(r));
 871                         fatal("%s is not a key file.", path);
 872                 }
 873         }
 874
 875         fingerprint_one_key(public, comment);
 876         sshkey_free(public);
 877         free(comment);
 878 }
 879
 880 static void
 881 do_fingerprint(struct passwd *pw)
 882 {
 883         FILE *f;
 884         struct sshkey *public = NULL;
 885         char *comment = NULL, *cp, *ep, line[SSH_MAX_PUBKEY_BYTES];
 886         int i, invalid = 1;
 887         const char *path;
 888         u_long lnum = 0;
 889
 890         if (!have_identity)
 891                 ask_filename(pw, "Enter file in which the key is");
 892         path = identity_file;
 893
 894         if (strcmp(identity_file, "-") == 0) {
 895                 f = stdin;
 896                 path = "(stdin)";
 897         } else if ((f = fopen(path, "r")) == NULL)
 898                 fatal("%s: %s: %s", __progname, path, strerror(errno));
 899
 900         while (read_keyfile_line(f, path, line, sizeof(line), &lnum) == 0) {
 901                 cp = line;
 902                 cp[strcspn(cp, "\n")] = '\0';
 903                 /* Trim leading space and comments */
 904                 cp = line + strspn(line, " \t");
 905                 if (*cp == '#' || *cp == '\0')
 906                         continue;
 907
 908                 /*
 909                  * Input may be plain keys, private keys, authorized_keys
 910                  * or known_hosts.
 911                  */
 912
 913                 /*
 914                  * Try private keys first. Assume a key is private if
 915                  * "SSH PRIVATE KEY" appears on the first line and we're
 916                  * not reading from stdin (XXX support private keys on stdin).
 917                  */
 918                 if (lnum == 1 && strcmp(identity_file, "-") != 0 &&
 919                     strstr(cp, "PRIVATE KEY") != NULL) {
 920                         fclose(f);
 921                         fingerprint_private(path);
 922                         exit(0);
 923                 }
 924
 925                 /*
 926                  * If it's not a private key, then this must be prepared to
 927                  * accept a public key prefixed with a hostname or options.
 928                  * Try a bare key first, otherwise skip the leading stuff.
 929                  */
 930                 if ((public = try_read_key(&cp)) == NULL) {
 931                         i = strtol(cp, &ep, 10);
 932                         if (i == 0 || ep == NULL ||
 933                             (*ep != ' ' && *ep != '\t')) {
 934                                 int quoted = 0;
 935
 936                                 comment = cp;
 937                                 for (; *cp && (quoted || (*cp != ' ' &&
 938                                     *cp != '\t')); cp++) {
 939                                         if (*cp == '\\' && cp[1] == '"')
 940                                                 cp++;   /* Skip both */
 941                                         else if (*cp == '"')
 942                                                 quoted = !quoted;
 943                                 }
 944                                 if (!*cp)
 945                                         continue;
 946                                 *cp++ = '\0';
 947                         }
 948                 }
 949                 /* Retry after parsing leading hostname/key options */
 950                 if (public == NULL && (public = try_read_key(&cp)) == NULL) {
 951                         debug("%s:%lu: not a public key", path, lnum);
 952                         continue;
 953                 }
 954
 955                 /* Find trailing comment, if any */
 956                 for (; *cp == ' ' || *cp == '\t'; cp++)
 957                         ;
 958                 if (*cp != '\0' && *cp != '#')
 959                         comment = cp;
 960
 961                 fingerprint_one_key(public, comment);
 962                 sshkey_free(public);
 963                 invalid = 0; /* One good key in the file is sufficient */
 964         }
 965         fclose(f);
 966
 967         if (invalid)
 968                 fatal("%s is not a public key file.", path);
 969         exit(0);
 970 }
 971
 972 static void
 973 do_gen_all_hostkeys(struct passwd *pw)
 974 {
 975         struct {
 976                 char *key_type;
 977                 char *key_type_display;
 978                 char *path;
 979         } key_types[] = {
 980 #ifdef WITH_OPENSSL
 981 #ifdef WITH_SSH1
 982                 { "rsa1", "RSA1", _PATH_HOST_KEY_FILE },
 983 #endif /* WITH_SSH1 */
 984                 { "rsa", "RSA" ,_PATH_HOST_RSA_KEY_FILE },
 985                 { "dsa", "DSA", _PATH_HOST_DSA_KEY_FILE },
 986 #ifdef OPENSSL_HAS_ECC
 987                 { "ecdsa", "ECDSA",_PATH_HOST_ECDSA_KEY_FILE },
 988 #endif /* OPENSSL_HAS_ECC */
 989 #endif /* WITH_OPENSSL */
 990                 { "ed25519", "ED25519",_PATH_HOST_ED25519_KEY_FILE },
 991                 { NULL, NULL, NULL }
 992         };
 993
 994         int first = 0;
 995         struct stat st;
 996         struct sshkey *private, *public;
 997         char comment[1024];
 998         int i, type, fd, r;
 999         FILE *f;
1000
1001         for (i = 0; key_types[i].key_type; i++) {
1002                 if (stat(key_types[i].path, &st) == 0)
1003                         continue;
1004                 if (errno != ENOENT) {
1005                         error("Could not stat %s: %s", key_types[i].path,
1006                             strerror(errno));
1007                         first = 0;
1008                         continue;
1009                 }
1010
1011                 if (first == 0) {
1012                         first = 1;
1013                         printf("%s: generating new host keys: ", __progname);
1014                 }
1015                 printf("%s ", key_types[i].key_type_display);
1016                 fflush(stdout);
1017                 type = sshkey_type_from_name(key_types[i].key_type);
1018                 strlcpy(identity_file, key_types[i].path, sizeof(identity_file));
1019                 bits = 0;
1020                 type_bits_valid(type, NULL, &bits);
1021                 if ((r = sshkey_generate(type, bits, &private)) != 0) {
1022                         error("key_generate failed: %s", ssh_err(r));
1023                         first = 0;
1024                         continue;
1025                 }
1026                 if ((r = sshkey_from_private(private, &public)) != 0)
1027                         fatal("sshkey_from_private failed: %s", ssh_err(r));
1028                 snprintf(comment, sizeof comment, "%s@%s", pw->pw_name,
1029                     hostname);
1030                 if ((r = sshkey_save_private(private, identity_file, "",
1031                     comment, use_new_format, new_format_cipher, rounds)) != 0) {
1032                         error("Saving key \"%s\" failed: %s",
1033                             identity_file, ssh_err(r));
1034                         sshkey_free(private);
1035                         sshkey_free(public);
1036                         first = 0;
1037                         continue;
1038                 }
1039                 sshkey_free(private);
1040                 strlcat(identity_file, ".pub", sizeof(identity_file));
1041                 fd = open(identity_file, O_WRONLY | O_CREAT | O_TRUNC, 0644);
1042                 if (fd == -1) {
1043                         error("Could not save your public key in %s",
1044                             identity_file);
1045                         sshkey_free(public);
1046                         first = 0;
1047                         continue;
1048                 }
1049                 f = fdopen(fd, "w");
1050                 if (f == NULL) {
1051                         error("fdopen %s failed", identity_file);
1052                         close(fd);
1053                         sshkey_free(public);
1054                         first = 0;
1055                         continue;
1056                 }
1057                 if ((r = sshkey_write(public, f)) != 0) {
1058                         error("write key failed: %s", ssh_err(r));
1059                         fclose(f);
1060                         sshkey_free(public);
1061                         first = 0;
1062                         continue;
1063                 }
1064                 fprintf(f, " %s\n", comment);
1065                 fclose(f);
1066                 sshkey_free(public);
1067
1068         }
1069         if (first != 0)
1070                 printf("\n");
1071 }
1072
1073 struct known_hosts_ctx {
1074         const char *host;       /* Hostname searched for in find/delete case */
1075         FILE *out;              /* Output file, stdout for find_hosts case */
1076         int has_unhashed;       /* When hashing, original had unhashed hosts */
1077         int found_key;          /* For find/delete, host was found */
1078         int invalid;            /* File contained invalid items; don't delete */
1079 };
1080
1081 static int
1082 known_hosts_hash(struct hostkey_foreach_line *l, void *_ctx)
1083 {
1084         struct known_hosts_ctx *ctx = (struct known_hosts_ctx *)_ctx;
1085         char *hashed, *cp, *hosts, *ohosts;
1086         int has_wild = l->hosts && strcspn(l->hosts, "*?!") != strlen(l->hosts);
1087         int was_hashed = l->hosts && l->hosts[0] == HASH_DELIM;
1088
1089         switch (l->status) {
1090         case HKF_STATUS_OK:
1091         case HKF_STATUS_MATCHED:
1092                 /*
1093                  * Don't hash hosts already already hashed, with wildcard
1094                  * characters or a CA/revocation marker.
1095                  */
1096                 if (was_hashed || has_wild || l->marker != MRK_NONE) {
1097                         fprintf(ctx->out, "%s\n", l->line);
1098                         if (has_wild && !find_host) {
1099                                 logit("%s:%lu: ignoring host name "
1100                                     "with wildcard: %.64s", l->path,
1101                                     l->linenum, l->hosts);
1102                         }
1103                         return 0;
1104                 }
1105                 /*
1106                  * Split any comma-separated hostnames from the host list,
1107                  * hash and store separately.
1108                  */
1109                 ohosts = hosts = xstrdup(l->hosts);
1110                 while ((cp = strsep(&hosts, ",")) != NULL && *cp != '\0') {
1111                         lowercase(cp);
1112                         if ((hashed = host_hash(cp, NULL, 0)) == NULL)
1113                                 fatal("hash_host failed");
1114                         fprintf(ctx->out, "%s %s\n", hashed, l->rawkey);
1115                         ctx->has_unhashed = 1;
1116                 }
1117                 free(ohosts);
1118                 return 0;
1119         case HKF_STATUS_INVALID:
1120                 /* Retain invalid lines, but mark file as invalid. */
1121                 ctx->invalid = 1;
1122                 logit("%s:%lu: invalid line", l->path, l->linenum);
1123                 /* FALLTHROUGH */
1124         default:
1125                 fprintf(ctx->out, "%s\n", l->line);
1126                 return 0;
1127         }
1128         /* NOTREACHED */
1129         return -1;
1130 }
1131
1132 static int
1133 known_hosts_find_delete(struct hostkey_foreach_line *l, void *_ctx)
1134 {
1135         struct known_hosts_ctx *ctx = (struct known_hosts_ctx *)_ctx;
1136         enum sshkey_fp_rep rep;
1137         int fptype;
1138         char *fp;
1139
1140         fptype = print_bubblebabble ? SSH_DIGEST_SHA1 : fingerprint_hash;
1141         rep =    print_bubblebabble ? SSH_FP_BUBBLEBABBLE : SSH_FP_DEFAULT;
1142
1143         if (l->status == HKF_STATUS_MATCHED) {
1144                 if (delete_host) {
1145                         if (l->marker != MRK_NONE) {
1146                                 /* Don't remove CA and revocation lines */
1147                                 fprintf(ctx->out, "%s\n", l->line);
1148                         } else {
1149                                 /*
1150                                  * Hostname matches and has no CA/revoke
1151                                  * marker, delete it by *not* writing the
1152                                  * line to ctx->out.
1153                                  */
1154                                 ctx->found_key = 1;
1155                                 if (!quiet)
1156                                         printf("# Host %s found: line %lu\n",
1157                                             ctx->host, l->linenum);
1158                         }
1159                         return 0;
1160                 } else if (find_host) {
1161                         ctx->found_key = 1;
1162                         if (!quiet) {
1163                                 printf("# Host %s found: line %lu %s\n",
1164                                     ctx->host,
1165                                     l->linenum, l->marker == MRK_CA ? "CA" :
1166                                     (l->marker == MRK_REVOKE ? "REVOKED" : ""));
1167                         }
1168                         if (hash_hosts)
1169                                 known_hosts_hash(l, ctx);
1170                         else if (print_fingerprint) {
1171                                 fp = sshkey_fingerprint(l->key, fptype, rep);
1172                                 mprintf("%s %s %s %s\n", ctx->host,
1173                                     sshkey_type(l->key), fp, l->comment);
1174                                 free(fp);
1175                         } else
1176                                 fprintf(ctx->out, "%s\n", l->line);
1177                         return 0;
1178                 }
1179         } else if (delete_host) {
1180                 /* Retain non-matching hosts when deleting */
1181                 if (l->status == HKF_STATUS_INVALID) {
1182                         ctx->invalid = 1;
1183                         logit("%s:%lu: invalid line", l->path, l->linenum);
1184                 }
1185                 fprintf(ctx->out, "%s\n", l->line);
1186         }
1187         return 0;
1188 }
1189
1190 static void
1191 do_known_hosts(struct passwd *pw, const char *name)
1192 {
1193         char *cp, tmp[PATH_MAX], old[PATH_MAX];
1194         int r, fd, oerrno, inplace = 0;
1195         struct known_hosts_ctx ctx;
1196         u_int foreach_options;
1197
1198         if (!have_identity) {
1199                 cp = tilde_expand_filename(_PATH_SSH_USER_HOSTFILE, pw->pw_uid);
1200                 if (strlcpy(identity_file, cp, sizeof(identity_file)) >=
1201                     sizeof(identity_file))
1202                         fatal("Specified known hosts path too long");
1203                 free(cp);
1204                 have_identity = 1;
1205         }
1206
1207         memset(&ctx, 0, sizeof(ctx));
1208         ctx.out = stdout;
1209         ctx.host = name;
1210
1211         /*
1212          * Find hosts goes to stdout, hash and deletions happen in-place
1213          * A corner case is ssh-keygen -HF foo, which should go to stdout
1214          */
1215         if (!find_host && (hash_hosts || delete_host)) {
1216                 if (strlcpy(tmp, identity_file, sizeof(tmp)) >= sizeof(tmp) ||
1217                     strlcat(tmp, ".XXXXXXXXXX", sizeof(tmp)) >= sizeof(tmp) ||
1218                     strlcpy(old, identity_file, sizeof(old)) >= sizeof(old) ||
1219                     strlcat(old, ".old", sizeof(old)) >= sizeof(old))
1220                         fatal("known_hosts path too long");
1221                 umask(077);
1222                 if ((fd = mkstemp(tmp)) == -1)
1223                         fatal("mkstemp: %s", strerror(errno));
1224                 if ((ctx.out = fdopen(fd, "w")) == NULL) {
1225                         oerrno = errno;
1226                         unlink(tmp);
1227                         fatal("fdopen: %s", strerror(oerrno));
1228                 }
1229                 inplace = 1;
1230         }
1231
1232         /* XXX support identity_file == "-" for stdin */
1233         foreach_options = find_host ? HKF_WANT_MATCH : 0;
1234         foreach_options |= print_fingerprint ? HKF_WANT_PARSE_KEY : 0;
1235         if ((r = hostkeys_foreach(identity_file,
1236             hash_hosts ? known_hosts_hash : known_hosts_find_delete, &ctx,
1237             name, NULL, foreach_options)) != 0) {
1238                 if (inplace)
1239                         unlink(tmp);
1240                 fatal("%s: hostkeys_foreach failed: %s", __func__, ssh_err(r));
1241         }
1242
1243         if (inplace)
1244                 fclose(ctx.out);
1245
1246         if (ctx.invalid) {
1247                 error("%s is not a valid known_hosts file.", identity_file);
1248                 if (inplace) {
1249                         error("Not replacing existing known_hosts "
1250                             "file because of errors");
1251                         unlink(tmp);
1252                 }
1253                 exit(1);
1254         } else if (delete_host && !ctx.found_key) {
1255                 logit("Host %s not found in %s", name, identity_file);
1256                 if (inplace)
1257                         unlink(tmp);
1258         } else if (inplace) {
1259                 /* Backup existing file */
1260                 if (unlink(old) == -1 && errno != ENOENT)
1261                         fatal("unlink %.100s: %s", old, strerror(errno));
1262                 if (link(identity_file, old) == -1)
1263                         fatal("link %.100s to %.100s: %s", identity_file, old,
1264                             strerror(errno));
1265                 /* Move new one into place */
1266                 if (rename(tmp, identity_file) == -1) {
1267                         error("rename\"%s\" to \"%s\": %s", tmp, identity_file,
1268                             strerror(errno));
1269                         unlink(tmp);
1270                         unlink(old);
1271                         exit(1);
1272                 }
1273
1274                 printf("%s updated.\n", identity_file);
1275                 printf("Original contents retained as %s\n", old);
1276                 if (ctx.has_unhashed) {
1277                         logit("WARNING: %s contains unhashed entries", old);
1278                         logit("Delete this file to ensure privacy "
1279                             "of hostnames");
1280                 }
1281         }
1282
1283         exit (find_host && !ctx.found_key);
1284 }
1285
1286 /*
1287  * Perform changing a passphrase.  The argument is the passwd structure
1288  * for the current user.
1289  */
1290 static void
1291 do_change_passphrase(struct passwd *pw)
1292 {
1293         char *comment;
1294         char *old_passphrase, *passphrase1, *passphrase2;
1295         struct stat st;
1296         struct sshkey *private;
1297         int r;
1298
1299         if (!have_identity)
1300                 ask_filename(pw, "Enter file in which the key is");
1301         if (stat(identity_file, &st) < 0)
1302                 fatal("%s: %s", identity_file, strerror(errno));
1303         /* Try to load the file with empty passphrase. */
1304         r = sshkey_load_private(identity_file, "", &private, &comment);
1305         if (r == SSH_ERR_KEY_WRONG_PASSPHRASE) {
1306                 if (identity_passphrase)
1307                         old_passphrase = xstrdup(identity_passphrase);
1308                 else
1309                         old_passphrase =
1310                             read_passphrase("Enter old passphrase: ",
1311                             RP_ALLOW_STDIN);
1312                 r = sshkey_load_private(identity_file, old_passphrase,
1313                     &private, &comment);
1314                 explicit_bzero(old_passphrase, strlen(old_passphrase));
1315                 free(old_passphrase);
1316                 if (r != 0)
1317                         goto badkey;
1318         } else if (r != 0) {
1319  badkey:
1320                 fatal("Failed to load key %s: %s", identity_file, ssh_err(r));
1321         }
1322         if (comment)
1323                 mprintf("Key has comment '%s'\n", comment);
1324
1325         /* Ask the new passphrase (twice). */
1326         if (identity_new_passphrase) {
1327                 passphrase1 = xstrdup(identity_new_passphrase);
1328                 passphrase2 = NULL;
1329         } else {
1330                 passphrase1 =
1331                         read_passphrase("Enter new passphrase (empty for no "
1332                             "passphrase): ", RP_ALLOW_STDIN);
1333                 passphrase2 = read_passphrase("Enter same passphrase again: ",
1334                     RP_ALLOW_STDIN);
1335
1336                 /* Verify that they are the same. */
1337                 if (strcmp(passphrase1, passphrase2) != 0) {
1338                         explicit_bzero(passphrase1, strlen(passphrase1));
1339                         explicit_bzero(passphrase2, strlen(passphrase2));
1340                         free(passphrase1);
1341                         free(passphrase2);
1342                         printf("Pass phrases do not match.  Try again.\n");
1343                         exit(1);
1344                 }
1345                 /* Destroy the other copy. */
1346                 explicit_bzero(passphrase2, strlen(passphrase2));
1347                 free(passphrase2);
1348         }
1349
1350         /* Save the file using the new passphrase. */
1351         if ((r = sshkey_save_private(private, identity_file, passphrase1,
1352             comment, use_new_format, new_format_cipher, rounds)) != 0) {
1353                 error("Saving key \"%s\" failed: %s.",
1354                     identity_file, ssh_err(r));
1355                 explicit_bzero(passphrase1, strlen(passphrase1));
1356                 free(passphrase1);
1357                 sshkey_free(private);
1358                 free(comment);
1359                 exit(1);
1360         }
1361         /* Destroy the passphrase and the copy of the key in memory. */
1362         explicit_bzero(passphrase1, strlen(passphrase1));
1363         free(passphrase1);
1364         sshkey_free(private);            /* Destroys contents */
1365         free(comment);
1366
1367         printf("Your identification has been saved with the new passphrase.\n");
1368         exit(0);
1369 }
1370
1371 /*
1372  * Print the SSHFP RR.
1373  */
1374 static int
1375 do_print_resource_record(struct passwd *pw, char *fname, char *hname)
1376 {
1377         struct sshkey *public;
1378         char *comment = NULL;
1379         struct stat st;
1380         int r;
1381
1382         if (fname == NULL)
1383                 fatal("%s: no filename", __func__);
1384         if (stat(fname, &st) < 0) {
1385                 if (errno == ENOENT)
1386                         return 0;
1387                 fatal("%s: %s", fname, strerror(errno));
1388         }
1389         if ((r = sshkey_load_public(fname, &public, &comment)) != 0)
1390                 fatal("Failed to read v2 public key from \"%s\": %s.",
1391                     fname, ssh_err(r));
1392         export_dns_rr(hname, public, stdout, print_generic);
1393         sshkey_free(public);
1394         free(comment);
1395         return 1;
1396 }
1397
1398 /*
1399  * Change the comment of a private key file.
1400  */
1401 static void
1402 do_change_comment(struct passwd *pw)
1403 {
1404         char new_comment[1024], *comment, *passphrase;
1405         struct sshkey *private;
1406         struct sshkey *public;
1407         struct stat st;
1408         FILE *f;
1409         int r, fd;
1410
1411         if (!have_identity)
1412                 ask_filename(pw, "Enter file in which the key is");
1413         if (stat(identity_file, &st) < 0)
1414                 fatal("%s: %s", identity_file, strerror(errno));
1415         if ((r = sshkey_load_private(identity_file, "",
1416             &private, &comment)) == 0)
1417                 passphrase = xstrdup("");
1418         else if (r != SSH_ERR_KEY_WRONG_PASSPHRASE)
1419                 fatal("Cannot load private key \"%s\": %s.",
1420                     identity_file, ssh_err(r));
1421         else {
1422                 if (identity_passphrase)
1423                         passphrase = xstrdup(identity_passphrase);
1424                 else if (identity_new_passphrase)
1425                         passphrase = xstrdup(identity_new_passphrase);
1426                 else
1427                         passphrase = read_passphrase("Enter passphrase: ",
1428                             RP_ALLOW_STDIN);
1429                 /* Try to load using the passphrase. */
1430                 if ((r = sshkey_load_private(identity_file, passphrase,
1431                     &private, &comment)) != 0) {
1432                         explicit_bzero(passphrase, strlen(passphrase));
1433                         free(passphrase);
1434                         fatal("Cannot load private key \"%s\": %s.",
1435                             identity_file, ssh_err(r));
1436                 }
1437         }
1438
1439         if (private->type != KEY_RSA1 && private->type != KEY_ED25519 &&
1440             !use_new_format) {
1441                 error("Comments are only supported for RSA1 or keys stored in "
1442                     "the new format (-o).");
1443                 explicit_bzero(passphrase, strlen(passphrase));
1444                 sshkey_free(private);
1445                 exit(1);
1446         }
1447         if (comment)
1448                 printf("Key now has comment '%s'\n", comment);
1449         else
1450                 printf("Key now has no comment\n");
1451
1452         if (identity_comment) {
1453                 strlcpy(new_comment, identity_comment, sizeof(new_comment));
1454         } else {
1455                 printf("Enter new comment: ");
1456                 fflush(stdout);
1457                 if (!fgets(new_comment, sizeof(new_comment), stdin)) {
1458                         explicit_bzero(passphrase, strlen(passphrase));
1459                         sshkey_free(private);
1460                         exit(1);
1461                 }
1462                 new_comment[strcspn(new_comment, "\n")] = '\0';
1463         }
1464
1465         /* Save the file using the new passphrase. */
1466         if ((r = sshkey_save_private(private, identity_file, passphrase,
1467             new_comment, use_new_format, new_format_cipher, rounds)) != 0) {
1468                 error("Saving key \"%s\" failed: %s",
1469                     identity_file, ssh_err(r));
1470                 explicit_bzero(passphrase, strlen(passphrase));
1471                 free(passphrase);
1472                 sshkey_free(private);
1473                 free(comment);
1474                 exit(1);
1475         }
1476         explicit_bzero(passphrase, strlen(passphrase));
1477         free(passphrase);
1478         if ((r = sshkey_from_private(private, &public)) != 0)
1479                 fatal("key_from_private failed: %s", ssh_err(r));
1480         sshkey_free(private);
1481
1482         strlcat(identity_file, ".pub", sizeof(identity_file));
1483         fd = open(identity_file, O_WRONLY | O_CREAT | O_TRUNC, 0644);
1484         if (fd == -1)
1485                 fatal("Could not save your public key in %s", identity_file);
1486         f = fdopen(fd, "w");
1487         if (f == NULL)
1488                 fatal("fdopen %s failed: %s", identity_file, strerror(errno));
1489         if ((r = sshkey_write(public, f)) != 0)
1490                 fatal("write key failed: %s", ssh_err(r));
1491         sshkey_free(public);
1492         fprintf(f, " %s\n", new_comment);
1493         fclose(f);
1494
1495         free(comment);
1496
1497         printf("The comment in your key file has been changed.\n");
1498         exit(0);
1499 }
1500
1501 static void
1502 add_flag_option(struct sshbuf *c, const char *name)
1503 {
1504         int r;
1505
1506         debug3("%s: %s", __func__, name);
1507         if ((r = sshbuf_put_cstring(c, name)) != 0 ||
1508             (r = sshbuf_put_string(c, NULL, 0)) != 0)
1509                 fatal("%s: buffer error: %s", __func__, ssh_err(r));
1510 }
1511
1512 static void
1513 add_string_option(struct sshbuf *c, const char *name, const char *value)
1514 {
1515         struct sshbuf *b;
1516         int r;
1517
1518         debug3("%s: %s=%s", __func__, name, value);
1519         if ((b = sshbuf_new()) == NULL)
1520                 fatal("%s: sshbuf_new failed", __func__);
1521         if ((r = sshbuf_put_cstring(b, value)) != 0 ||
1522             (r = sshbuf_put_cstring(c, name)) != 0 ||
1523             (r = sshbuf_put_stringb(c, b)) != 0)
1524                 fatal("%s: buffer error: %s", __func__, ssh_err(r));
1525
1526         sshbuf_free(b);
1527 }
1528
1529 #define OPTIONS_CRITICAL        1
1530 #define OPTIONS_EXTENSIONS      2
1531 static void
1532 prepare_options_buf(struct sshbuf *c, int which)
1533 {
1534         sshbuf_reset(c);
1535         if ((which & OPTIONS_CRITICAL) != 0 &&
1536             certflags_command != NULL)
1537                 add_string_option(c, "force-command", certflags_command);
1538         if ((which & OPTIONS_EXTENSIONS) != 0 &&
1539             (certflags_flags & CERTOPT_X_FWD) != 0)
1540                 add_flag_option(c, "permit-X11-forwarding");
1541         if ((which & OPTIONS_EXTENSIONS) != 0 &&
1542             (certflags_flags & CERTOPT_AGENT_FWD) != 0)
1543                 add_flag_option(c, "permit-agent-forwarding");
1544         if ((which & OPTIONS_EXTENSIONS) != 0 &&
1545             (certflags_flags & CERTOPT_PORT_FWD) != 0)
1546                 add_flag_option(c, "permit-port-forwarding");
1547         if ((which & OPTIONS_EXTENSIONS) != 0 &&
1548             (certflags_flags & CERTOPT_PTY) != 0)
1549                 add_flag_option(c, "permit-pty");
1550         if ((which & OPTIONS_EXTENSIONS) != 0 &&
1551             (certflags_flags & CERTOPT_USER_RC) != 0)
1552                 add_flag_option(c, "permit-user-rc");
1553         if ((which & OPTIONS_CRITICAL) != 0 &&
1554             certflags_src_addr != NULL)
1555                 add_string_option(c, "source-address", certflags_src_addr);
1556 }
1557
1558 static struct sshkey *
1559 load_pkcs11_key(char *path)
1560 {
1561 #ifdef ENABLE_PKCS11
1562         struct sshkey **keys = NULL, *public, *private = NULL;
1563         int r, i, nkeys;
1564
1565         if ((r = sshkey_load_public(path, &public, NULL)) != 0)
1566                 fatal("Couldn't load CA public key \"%s\": %s",
1567                     path, ssh_err(r));
1568
1569         nkeys = pkcs11_add_provider(pkcs11provider, identity_passphrase, &keys);
1570         debug3("%s: %d keys", __func__, nkeys);
1571         if (nkeys <= 0)
1572                 fatal("cannot read public key from pkcs11");
1573         for (i = 0; i < nkeys; i++) {
1574                 if (sshkey_equal_public(public, keys[i])) {
1575                         private = keys[i];
1576                         continue;
1577                 }
1578                 sshkey_free(keys[i]);
1579         }
1580         free(keys);
1581         sshkey_free(public);
1582         return private;
1583 #else
1584         fatal("no pkcs11 support");
1585 #endif /* ENABLE_PKCS11 */
1586 }
1587
1588 static void
1589 do_ca_sign(struct passwd *pw, int argc, char **argv)
1590 {
1591         int r, i, fd;
1592         u_int n;
1593         struct sshkey *ca, *public;
1594         char valid[64], *otmp, *tmp, *cp, *out, *comment, **plist = NULL;
1595         FILE *f;
1596
1597 #ifdef ENABLE_PKCS11
1598         pkcs11_init(1);
1599 #endif
1600         tmp = tilde_expand_filename(ca_key_path, pw->pw_uid);
1601         if (pkcs11provider != NULL) {
1602                 if ((ca = load_pkcs11_key(tmp)) == NULL)
1603                         fatal("No PKCS#11 key matching %s found", ca_key_path);
1604         } else
1605                 ca = load_identity(tmp);
1606         free(tmp);
1607
1608         if (key_type_name != NULL &&
1609             sshkey_type_from_name(key_type_name) != ca->type)  {
1610                 fatal("CA key type %s doesn't match specified %s",
1611                     sshkey_ssh_name(ca), key_type_name);
1612         }
1613
1614         for (i = 0; i < argc; i++) {
1615                 /* Split list of principals */
1616                 n = 0;
1617                 if (cert_principals != NULL) {
1618                         otmp = tmp = xstrdup(cert_principals);
1619                         plist = NULL;
1620                         for (; (cp = strsep(&tmp, ",")) != NULL; n++) {
1621                                 plist = xreallocarray(plist, n + 1, sizeof(*plist));
1622                                 if (*(plist[n] = xstrdup(cp)) == '\0')
1623                                         fatal("Empty principal name");
1624                         }
1625                         free(otmp);
1626                 }
1627
1628                 tmp = tilde_expand_filename(argv[i], pw->pw_uid);
1629                 if ((r = sshkey_load_public(tmp, &public, &comment)) != 0)
1630                         fatal("%s: unable to open \"%s\": %s",
1631                             __func__, tmp, ssh_err(r));
1632                 if (public->type != KEY_RSA && public->type != KEY_DSA &&
1633                     public->type != KEY_ECDSA && public->type != KEY_ED25519)
1634                         fatal("%s: key \"%s\" type %s cannot be certified",
1635                             __func__, tmp, sshkey_type(public));
1636
1637                 /* Prepare certificate to sign */
1638                 if ((r = sshkey_to_certified(public)) != 0)
1639                         fatal("Could not upgrade key %s to certificate: %s",
1640                             tmp, ssh_err(r));
1641                 public->cert->type = cert_key_type;
1642                 public->cert->serial = (u_int64_t)cert_serial;
1643                 public->cert->key_id = xstrdup(cert_key_id);
1644                 public->cert->nprincipals = n;
1645                 public->cert->principals = plist;
1646                 public->cert->valid_after = cert_valid_from;
1647                 public->cert->valid_before = cert_valid_to;
1648                 prepare_options_buf(public->cert->critical, OPTIONS_CRITICAL);
1649                 prepare_options_buf(public->cert->extensions,
1650                     OPTIONS_EXTENSIONS);
1651                 if ((r = sshkey_from_private(ca,
1652                     &public->cert->signature_key)) != 0)
1653                         fatal("key_from_private (ca key): %s", ssh_err(r));
1654
1655                 if ((r = sshkey_certify(public, ca, key_type_name)) != 0)
1656                         fatal("Couldn't certify key %s: %s", tmp, ssh_err(r));
1657
1658                 if ((cp = strrchr(tmp, '.')) != NULL && strcmp(cp, ".pub") == 0)
1659                         *cp = '\0';
1660                 xasprintf(&out, "%s-cert.pub", tmp);
1661                 free(tmp);
1662
1663                 if ((fd = open(out, O_WRONLY|O_CREAT|O_TRUNC, 0644)) == -1)
1664                         fatal("Could not open \"%s\" for writing: %s", out,
1665                             strerror(errno));
1666                 if ((f = fdopen(fd, "w")) == NULL)
1667                         fatal("%s: fdopen: %s", __func__, strerror(errno));
1668                 if ((r = sshkey_write(public, f)) != 0)
1669                         fatal("Could not write certified key to %s: %s",
1670                             out, ssh_err(r));
1671                 fprintf(f, " %s\n", comment);
1672                 fclose(f);
1673
1674                 if (!quiet) {
1675                         sshkey_format_cert_validity(public->cert,
1676                             valid, sizeof(valid));
1677                         logit("Signed %s key %s: id \"%s\" serial %llu%s%s "
1678                             "valid %s", sshkey_cert_type(public),
1679                             out, public->cert->key_id,
1680                             (unsigned long long)public->cert->serial,
1681                             cert_principals != NULL ? " for " : "",
1682                             cert_principals != NULL ? cert_principals : "",
1683                             valid);
1684                 }
1685
1686                 sshkey_free(public);
1687                 free(out);
1688         }
1689 #ifdef ENABLE_PKCS11
1690         pkcs11_terminate();
1691 #endif
1692         exit(0);
1693 }
1694
1695 static u_int64_t
1696 parse_relative_time(const char *s, time_t now)
1697 {
1698         int64_t mul, secs;
1699
1700         mul = *s == '-' ? -1 : 1;
1701
1702         if ((secs = convtime(s + 1)) == -1)
1703                 fatal("Invalid relative certificate time %s", s);
1704         if (mul == -1 && secs > now)
1705                 fatal("Certificate time %s cannot be represented", s);
1706         return now + (u_int64_t)(secs * mul);
1707 }
1708
1709 static u_int64_t
1710 parse_absolute_time(const char *s)
1711 {
1712         struct tm tm;
1713         time_t tt;
1714         char buf[32], *fmt;
1715
1716         /*
1717          * POSIX strptime says "The application shall ensure that there
1718          * is white-space or other non-alphanumeric characters between
1719          * any two conversion specifications" so arrange things this way.
1720          */
1721         switch (strlen(s)) {
1722         case 8:
1723                 fmt = "%Y-%m-%d";
1724                 snprintf(buf, sizeof(buf), "%.4s-%.2s-%.2s", s, s + 4, s + 6);
1725                 break;
1726         case 14:
1727                 fmt = "%Y-%m-%dT%H:%M:%S";
1728                 snprintf(buf, sizeof(buf), "%.4s-%.2s-%.2sT%.2s:%.2s:%.2s",
1729                     s, s + 4, s + 6, s + 8, s + 10, s + 12);
1730                 break;
1731         default:
1732                 fatal("Invalid certificate time format %s", s);
1733         }
1734
1735         memset(&tm, 0, sizeof(tm));
1736         if (strptime(buf, fmt, &tm) == NULL)
1737                 fatal("Invalid certificate time %s", s);
1738         if ((tt = mktime(&tm)) < 0)
1739                 fatal("Certificate time %s cannot be represented", s);
1740         return (u_int64_t)tt;
1741 }
1742
1743 static void
1744 parse_cert_times(char *timespec)
1745 {
1746         char *from, *to;
1747         time_t now = time(NULL);
1748         int64_t secs;
1749
1750         /* +timespec relative to now */
1751         if (*timespec == '+' && strchr(timespec, ':') == NULL) {
1752                 if ((secs = convtime(timespec + 1)) == -1)
1753                         fatal("Invalid relative certificate life %s", timespec);
1754                 cert_valid_to = now + secs;
1755                 /*
1756                  * Backdate certificate one minute to avoid problems on hosts
1757                  * with poorly-synchronised clocks.
1758                  */
1759                 cert_valid_from = ((now - 59)/ 60) * 60;
1760                 return;
1761         }
1762
1763         /*
1764          * from:to, where
1765          * from := [+-]timespec | YYYYMMDD | YYYYMMDDHHMMSS
1766          *   to := [+-]timespec | YYYYMMDD | YYYYMMDDHHMMSS
1767          */
1768         from = xstrdup(timespec);
1769         to = strchr(from, ':');
1770         if (to == NULL || from == to || *(to + 1) == '\0')
1771                 fatal("Invalid certificate life specification %s", timespec);
1772         *to++ = '\0';
1773
1774         if (*from == '-' || *from == '+')
1775                 cert_valid_from = parse_relative_time(from, now);
1776         else
1777                 cert_valid_from = parse_absolute_time(from);
1778
1779         if (*to == '-' || *to == '+')
1780                 cert_valid_to = parse_relative_time(to, now);
1781         else
1782                 cert_valid_to = parse_absolute_time(to);
1783
1784         if (cert_valid_to <= cert_valid_from)
1785                 fatal("Empty certificate validity interval");
1786         free(from);
1787 }
1788
1789 static void
1790 add_cert_option(char *opt)
1791 {
1792         char *val;
1793
1794         if (strcasecmp(opt, "clear") == 0)
1795                 certflags_flags = 0;
1796         else if (strcasecmp(opt, "no-x11-forwarding") == 0)
1797                 certflags_flags &= ~CERTOPT_X_FWD;
1798         else if (strcasecmp(opt, "permit-x11-forwarding") == 0)
1799                 certflags_flags |= CERTOPT_X_FWD;
1800         else if (strcasecmp(opt, "no-agent-forwarding") == 0)
1801                 certflags_flags &= ~CERTOPT_AGENT_FWD;
1802         else if (strcasecmp(opt, "permit-agent-forwarding") == 0)
1803                 certflags_flags |= CERTOPT_AGENT_FWD;
1804         else if (strcasecmp(opt, "no-port-forwarding") == 0)
1805                 certflags_flags &= ~CERTOPT_PORT_FWD;
1806         else if (strcasecmp(opt, "permit-port-forwarding") == 0)
1807                 certflags_flags |= CERTOPT_PORT_FWD;
1808         else if (strcasecmp(opt, "no-pty") == 0)
1809                 certflags_flags &= ~CERTOPT_PTY;
1810         else if (strcasecmp(opt, "permit-pty") == 0)
1811                 certflags_flags |= CERTOPT_PTY;
1812         else if (strcasecmp(opt, "no-user-rc") == 0)
1813                 certflags_flags &= ~CERTOPT_USER_RC;
1814         else if (strcasecmp(opt, "permit-user-rc") == 0)
1815                 certflags_flags |= CERTOPT_USER_RC;
1816         else if (strncasecmp(opt, "force-command=", 14) == 0) {
1817                 val = opt + 14;
1818                 if (*val == '\0')
1819                         fatal("Empty force-command option");
1820                 if (certflags_command != NULL)
1821                         fatal("force-command already specified");
1822                 certflags_command = xstrdup(val);
1823         } else if (strncasecmp(opt, "source-address=", 15) == 0) {
1824                 val = opt + 15;
1825                 if (*val == '\0')
1826                         fatal("Empty source-address option");
1827                 if (certflags_src_addr != NULL)
1828                         fatal("source-address already specified");
1829                 if (addr_match_cidr_list(NULL, val) != 0)
1830                         fatal("Invalid source-address list");
1831                 certflags_src_addr = xstrdup(val);
1832         } else
1833                 fatal("Unsupported certificate option \"%s\"", opt);
1834 }
1835
1836 static void
1837 show_options(struct sshbuf *optbuf, int in_critical)
1838 {
1839         char *name, *arg;
1840         struct sshbuf *options, *option = NULL;
1841         int r;
1842
1843         if ((options = sshbuf_fromb(optbuf)) == NULL)
1844                 fatal("%s: sshbuf_fromb failed", __func__);
1845         while (sshbuf_len(options) != 0) {
1846                 sshbuf_free(option);
1847                 option = NULL;
1848                 if ((r = sshbuf_get_cstring(options, &name, NULL)) != 0 ||
1849                     (r = sshbuf_froms(options, &option)) != 0)
1850                         fatal("%s: buffer error: %s", __func__, ssh_err(r));
1851                 printf("                %s", name);
1852                 if (!in_critical &&
1853                     (strcmp(name, "permit-X11-forwarding") == 0 ||
1854                     strcmp(name, "permit-agent-forwarding") == 0 ||
1855                     strcmp(name, "permit-port-forwarding") == 0 ||
1856                     strcmp(name, "permit-pty") == 0 ||
1857                     strcmp(name, "permit-user-rc") == 0))
1858                         printf("\n");
1859                 else if (in_critical &&
1860                     (strcmp(name, "force-command") == 0 ||
1861                     strcmp(name, "source-address") == 0)) {
1862                         if ((r = sshbuf_get_cstring(option, &arg, NULL)) != 0)
1863                                 fatal("%s: buffer error: %s",
1864                                     __func__, ssh_err(r));
1865                         printf(" %s\n", arg);
1866                         free(arg);
1867                 } else {
1868                         printf(" UNKNOWN OPTION (len %zu)\n",
1869                             sshbuf_len(option));
1870                         sshbuf_reset(option);
1871                 }
1872                 free(name);
1873                 if (sshbuf_len(option) != 0)
1874                         fatal("Option corrupt: extra data at end");
1875         }
1876         sshbuf_free(option);
1877         sshbuf_free(options);
1878 }
1879
1880 static void
1881 print_cert(struct sshkey *key)
1882 {
1883         char valid[64], *key_fp, *ca_fp;
1884         u_int i;
1885
1886         key_fp = sshkey_fingerprint(key, fingerprint_hash, SSH_FP_DEFAULT);
1887         ca_fp = sshkey_fingerprint(key->cert->signature_key,
1888             fingerprint_hash, SSH_FP_DEFAULT);
1889         if (key_fp == NULL || ca_fp == NULL)
1890                 fatal("%s: sshkey_fingerprint fail", __func__);
1891         sshkey_format_cert_validity(key->cert, valid, sizeof(valid));
1892
1893         printf("        Type: %s %s certificate\n", sshkey_ssh_name(key),
1894             sshkey_cert_type(key));
1895         printf("        Public key: %s %s\n", sshkey_type(key), key_fp);
1896         printf("        Signing CA: %s %s\n",
1897             sshkey_type(key->cert->signature_key), ca_fp);
1898         printf("        Key ID: \"%s\"\n", key->cert->key_id);
1899         printf("        Serial: %llu\n", (unsigned long long)key->cert->serial);
1900         printf("        Valid: %s\n", valid);
1901         printf("        Principals: ");
1902         if (key->cert->nprincipals == 0)
1903                 printf("(none)\n");
1904         else {
1905                 for (i = 0; i < key->cert->nprincipals; i++)
1906                         printf("\n                %s",
1907                             key->cert->principals[i]);
1908                 printf("\n");
1909         }
1910         printf("        Critical Options: ");
1911         if (sshbuf_len(key->cert->critical) == 0)
1912                 printf("(none)\n");
1913         else {
1914                 printf("\n");
1915                 show_options(key->cert->critical, 1);
1916         }
1917         printf("        Extensions: ");
1918         if (sshbuf_len(key->cert->extensions) == 0)
1919                 printf("(none)\n");
1920         else {
1921                 printf("\n");
1922                 show_options(key->cert->extensions, 0);
1923         }
1924 }
1925
1926 static void
1927 do_show_cert(struct passwd *pw)
1928 {
1929         struct sshkey *key = NULL;
1930         struct stat st;
1931         int r, is_stdin = 0, ok = 0;
1932         FILE *f;
1933         char *cp, line[SSH_MAX_PUBKEY_BYTES];
1934         const char *path;
1935         u_long lnum = 0;
1936
1937         if (!have_identity)
1938                 ask_filename(pw, "Enter file in which the key is");
1939         if (strcmp(identity_file, "-") != 0 && stat(identity_file, &st) < 0)
1940                 fatal("%s: %s: %s", __progname, identity_file, strerror(errno));
1941
1942         path = identity_file;
1943         if (strcmp(path, "-") == 0) {
1944                 f = stdin;
1945                 path = "(stdin)";
1946                 is_stdin = 1;
1947         } else if ((f = fopen(identity_file, "r")) == NULL)
1948                 fatal("fopen %s: %s", identity_file, strerror(errno));
1949
1950         while (read_keyfile_line(f, path, line, sizeof(line), &lnum) == 0) {
1951                 sshkey_free(key);
1952                 key = NULL;
1953                 /* Trim leading space and comments */
1954                 cp = line + strspn(line, " \t");
1955                 if (*cp == '#' || *cp == '\0')
1956                         continue;
1957                 if ((key = sshkey_new(KEY_UNSPEC)) == NULL)
1958                         fatal("key_new");
1959                 if ((r = sshkey_read(key, &cp)) != 0) {
1960                         error("%s:%lu: invalid key: %s", path,
1961                             lnum, ssh_err(r));
1962                         continue;
1963                 }
1964                 if (!sshkey_is_cert(key)) {
1965                         error("%s:%lu is not a certificate", path, lnum);
1966                         continue;
1967                 }
1968                 ok = 1;
1969                 if (!is_stdin && lnum == 1)
1970                         printf("%s:\n", path);
1971                 else
1972                         printf("%s:%lu:\n", path, lnum);
1973                 print_cert(key);
1974         }
1975         sshkey_free(key);
1976         fclose(f);
1977         exit(ok ? 0 : 1);
1978 }
1979
1980 static void
1981 load_krl(const char *path, struct ssh_krl **krlp)
1982 {
1983         struct sshbuf *krlbuf;
1984         int r, fd;
1985
1986         if ((krlbuf = sshbuf_new()) == NULL)
1987                 fatal("sshbuf_new failed");
1988         if ((fd = open(path, O_RDONLY)) == -1)
1989                 fatal("open %s: %s", path, strerror(errno));
1990         if ((r = sshkey_load_file(fd, krlbuf)) != 0)
1991                 fatal("Unable to load KRL: %s", ssh_err(r));
1992         close(fd);
1993         /* XXX check sigs */
1994         if ((r = ssh_krl_from_blob(krlbuf, krlp, NULL, 0)) != 0 ||
1995             *krlp == NULL)
1996                 fatal("Invalid KRL file: %s", ssh_err(r));
1997         sshbuf_free(krlbuf);
1998 }
1999
2000 static void
2001 update_krl_from_file(struct passwd *pw, const char *file, int wild_ca,
2002     const struct sshkey *ca, struct ssh_krl *krl)
2003 {
2004         struct sshkey *key = NULL;
2005         u_long lnum = 0;
2006         char *path, *cp, *ep, line[SSH_MAX_PUBKEY_BYTES];
2007         unsigned long long serial, serial2;
2008         int i, was_explicit_key, was_sha1, r;
2009         FILE *krl_spec;
2010
2011         path = tilde_expand_filename(file, pw->pw_uid);
2012         if (strcmp(path, "-") == 0) {
2013                 krl_spec = stdin;
2014                 free(path);
2015                 path = xstrdup("(standard input)");
2016         } else if ((krl_spec = fopen(path, "r")) == NULL)
2017                 fatal("fopen %s: %s", path, strerror(errno));
2018
2019         if (!quiet)
2020                 printf("Revoking from %s\n", path);
2021         while (read_keyfile_line(krl_spec, path, line, sizeof(line),
2022             &lnum) == 0) {
2023                 was_explicit_key = was_sha1 = 0;
2024                 cp = line + strspn(line, " \t");
2025                 /* Trim trailing space, comments and strip \n */
2026                 for (i = 0, r = -1; cp[i] != '\0'; i++) {
2027                         if (cp[i] == '#' || cp[i] == '\n') {
2028                                 cp[i] = '\0';
2029                                 break;
2030                         }
2031                         if (cp[i] == ' ' || cp[i] == '\t') {
2032                                 /* Remember the start of a span of whitespace */
2033                                 if (r == -1)
2034                                         r = i;
2035                         } else
2036                                 r = -1;
2037                 }
2038                 if (r != -1)
2039                         cp[r] = '\0';
2040                 if (*cp == '\0')
2041                         continue;
2042                 if (strncasecmp(cp, "serial:", 7) == 0) {
2043                         if (ca == NULL && !wild_ca) {
2044                                 fatal("revoking certificates by serial number "
2045                                     "requires specification of a CA key");
2046                         }
2047                         cp += 7;
2048                         cp = cp + strspn(cp, " \t");
2049                         errno = 0;
2050                         serial = strtoull(cp, &ep, 0);
2051                         if (*cp == '\0' || (*ep != '\0' && *ep != '-'))
2052                                 fatal("%s:%lu: invalid serial \"%s\"",
2053                                     path, lnum, cp);
2054                         if (errno == ERANGE && serial == ULLONG_MAX)
2055                                 fatal("%s:%lu: serial out of range",
2056                                     path, lnum);
2057                         serial2 = serial;
2058                         if (*ep == '-') {
2059                                 cp = ep + 1;
2060                                 errno = 0;
2061                                 serial2 = strtoull(cp, &ep, 0);
2062                                 if (*cp == '\0' || *ep != '\0')
2063                                         fatal("%s:%lu: invalid serial \"%s\"",
2064                                             path, lnum, cp);
2065                                 if (errno == ERANGE && serial2 == ULLONG_MAX)
2066                                         fatal("%s:%lu: serial out of range",
2067                                             path, lnum);
2068                                 if (serial2 <= serial)
2069                                         fatal("%s:%lu: invalid serial range "
2070                                             "%llu:%llu", path, lnum,
2071                                             (unsigned long long)serial,
2072                                             (unsigned long long)serial2);
2073                         }
2074                         if (ssh_krl_revoke_cert_by_serial_range(krl,
2075                             ca, serial, serial2) != 0) {
2076                                 fatal("%s: revoke serial failed",
2077                                     __func__);
2078                         }
2079                 } else if (strncasecmp(cp, "id:", 3) == 0) {
2080                         if (ca == NULL && !wild_ca) {
2081                                 fatal("revoking certificates by key ID "
2082                                     "requires specification of a CA key");
2083                         }
2084                         cp += 3;
2085                         cp = cp + strspn(cp, " \t");
2086                         if (ssh_krl_revoke_cert_by_key_id(krl, ca, cp) != 0)
2087                                 fatal("%s: revoke key ID failed", __func__);
2088                 } else {
2089                         if (strncasecmp(cp, "key:", 4) == 0) {
2090                                 cp += 4;
2091                                 cp = cp + strspn(cp, " \t");
2092                                 was_explicit_key = 1;
2093                         } else if (strncasecmp(cp, "sha1:", 5) == 0) {
2094                                 cp += 5;
2095                                 cp = cp + strspn(cp, " \t");
2096                                 was_sha1 = 1;
2097                         } else {
2098                                 /*
2099                                  * Just try to process the line as a key.
2100                                  * Parsing will fail if it isn't.
2101                                  */
2102                         }
2103                         if ((key = sshkey_new(KEY_UNSPEC)) == NULL)
2104                                 fatal("key_new");
2105                         if ((r = sshkey_read(key, &cp)) != 0)
2106                                 fatal("%s:%lu: invalid key: %s",
2107                                     path, lnum, ssh_err(r));
2108                         if (was_explicit_key)
2109                                 r = ssh_krl_revoke_key_explicit(krl, key);
2110                         else if (was_sha1)
2111                                 r = ssh_krl_revoke_key_sha1(krl, key);
2112                         else
2113                                 r = ssh_krl_revoke_key(krl, key);
2114                         if (r != 0)
2115                                 fatal("%s: revoke key failed: %s",
2116                                     __func__, ssh_err(r));
2117                         sshkey_free(key);
2118                 }
2119         }
2120         if (strcmp(path, "-") != 0)
2121                 fclose(krl_spec);
2122         free(path);
2123 }
2124
2125 static void
2126 do_gen_krl(struct passwd *pw, int updating, int argc, char **argv)
2127 {
2128         struct ssh_krl *krl;
2129         struct stat sb;
2130         struct sshkey *ca = NULL;
2131         int fd, i, r, wild_ca = 0;
2132         char *tmp;
2133         struct sshbuf *kbuf;
2134
2135         if (*identity_file == '\0')
2136                 fatal("KRL generation requires an output file");
2137         if (stat(identity_file, &sb) == -1) {
2138                 if (errno != ENOENT)
2139                         fatal("Cannot access KRL \"%s\": %s",
2140                             identity_file, strerror(errno));
2141                 if (updating)
2142                         fatal("KRL \"%s\" does not exist", identity_file);
2143         }
2144         if (ca_key_path != NULL) {
2145                 if (strcasecmp(ca_key_path, "none") == 0)
2146                         wild_ca = 1;
2147                 else {
2148                         tmp = tilde_expand_filename(ca_key_path, pw->pw_uid);
2149                         if ((r = sshkey_load_public(tmp, &ca, NULL)) != 0)
2150                                 fatal("Cannot load CA public key %s: %s",
2151                                     tmp, ssh_err(r));
2152                         free(tmp);
2153                 }
2154         }
2155
2156         if (updating)
2157                 load_krl(identity_file, &krl);
2158         else if ((krl = ssh_krl_init()) == NULL)
2159                 fatal("couldn't create KRL");
2160
2161         if (cert_serial != 0)
2162                 ssh_krl_set_version(krl, cert_serial);
2163         if (identity_comment != NULL)
2164                 ssh_krl_set_comment(krl, identity_comment);
2165
2166         for (i = 0; i < argc; i++)
2167                 update_krl_from_file(pw, argv[i], wild_ca, ca, krl);
2168
2169         if ((kbuf = sshbuf_new()) == NULL)
2170                 fatal("sshbuf_new failed");
2171         if (ssh_krl_to_blob(krl, kbuf, NULL, 0) != 0)
2172                 fatal("Couldn't generate KRL");
2173         if ((fd = open(identity_file, O_WRONLY|O_CREAT|O_TRUNC, 0644)) == -1)
2174                 fatal("open %s: %s", identity_file, strerror(errno));
2175         if (atomicio(vwrite, fd, (void *)sshbuf_ptr(kbuf), sshbuf_len(kbuf)) !=
2176             sshbuf_len(kbuf))
2177                 fatal("write %s: %s", identity_file, strerror(errno));
2178         close(fd);
2179         sshbuf_free(kbuf);
2180         ssh_krl_free(krl);
2181         sshkey_free(ca);
2182 }
2183
2184 static void
2185 do_check_krl(struct passwd *pw, int argc, char **argv)
2186 {
2187         int i, r, ret = 0;
2188         char *comment;
2189         struct ssh_krl *krl;
2190         struct sshkey *k;
2191
2192         if (*identity_file == '\0')
2193                 fatal("KRL checking requires an input file");
2194         load_krl(identity_file, &krl);
2195         for (i = 0; i < argc; i++) {
2196                 if ((r = sshkey_load_public(argv[i], &k, &comment)) != 0)
2197                         fatal("Cannot load public key %s: %s",
2198                             argv[i], ssh_err(r));
2199                 r = ssh_krl_check_key(krl, k);
2200                 printf("%s%s%s%s: %s\n", argv[i],
2201                     *comment ? " (" : "", comment, *comment ? ")" : "",
2202                     r == 0 ? "ok" : "REVOKED");
2203                 if (r != 0)
2204                         ret = 1;
2205                 sshkey_free(k);
2206                 free(comment);
2207         }
2208         ssh_krl_free(krl);
2209         exit(ret);
2210 }
2211
2212 #ifdef WITH_SSH1
2213 # define RSA1_USAGE " | rsa1"
2214 #else
2215 # define RSA1_USAGE ""
2216 #endif
2217
2218 static void
2219 usage(void)
2220 {
2221         fprintf(stderr,
2222             "usage: ssh-keygen [-q] [-b bits] [-t dsa | ecdsa | ed25519 | rsa%s]\n"
2223             "                  [-N new_passphrase] [-C comment] [-f output_keyfile]\n"
2224             "       ssh-keygen -p [-P old_passphrase] [-N new_passphrase] [-f keyfile]\n"
2225             "       ssh-keygen -i [-m key_format] [-f input_keyfile]\n"
2226             "       ssh-keygen -e [-m key_format] [-f input_keyfile]\n"
2227             "       ssh-keygen -y [-f input_keyfile]\n"
2228             "       ssh-keygen -c [-P passphrase] [-C comment] [-f keyfile]\n"
2229             "       ssh-keygen -l [-v] [-E fingerprint_hash] [-f input_keyfile]\n"
2230             "       ssh-keygen -B [-f input_keyfile]\n", RSA1_USAGE);
2231 #ifdef ENABLE_PKCS11
2232         fprintf(stderr,
2233             "       ssh-keygen -D pkcs11\n");
2234 #endif
2235         fprintf(stderr,
2236             "       ssh-keygen -F hostname [-f known_hosts_file] [-l]\n"
2237             "       ssh-keygen -H [-f known_hosts_file]\n"
2238             "       ssh-keygen -R hostname [-f known_hosts_file]\n"
2239             "       ssh-keygen -r hostname [-f input_keyfile] [-g]\n"
2240 #ifdef WITH_OPENSSL
2241             "       ssh-keygen -G output_file [-v] [-b bits] [-M memory] [-S start_point]\n"
2242             "       ssh-keygen -T output_file -f input_file [-v] [-a rounds] [-J num_lines]\n"
2243             "                  [-j start_line] [-K checkpt] [-W generator]\n"
2244 #endif
2245             "       ssh-keygen -s ca_key -I certificate_identity [-h] [-n principals]\n"
2246             "                  [-O option] [-V validity_interval] [-z serial_number] file ...\n"
2247             "       ssh-keygen -L [-f input_keyfile]\n"
2248             "       ssh-keygen -A\n"
2249             "       ssh-keygen -k -f krl_file [-u] [-s ca_public] [-z version_number]\n"
2250             "                  file ...\n"
2251             "       ssh-keygen -Q -f krl_file file ...\n");
2252         exit(1);
2253 }
2254
2255 /*
2256  * Main program for key management.
2257  */
2258 int
2259 main(int argc, char **argv)
2260 {
2261         char dotsshdir[PATH_MAX], comment[1024], *passphrase1, *passphrase2;
2262         char *rr_hostname = NULL, *ep, *fp, *ra;
2263         struct sshkey *private, *public;
2264         struct passwd *pw;
2265         struct stat st;
2266         int r, opt, type, fd;
2267         int gen_all_hostkeys = 0, gen_krl = 0, update_krl = 0, check_krl = 0;
2268         FILE *f;
2269         const char *errstr;
2270 #ifdef WITH_OPENSSL
2271         /* Moduli generation/screening */
2272         char out_file[PATH_MAX], *checkpoint = NULL;
2273         u_int32_t memory = 0, generator_wanted = 0;
2274         int do_gen_candidates = 0, do_screen_candidates = 0;
2275         unsigned long start_lineno = 0, lines_to_process = 0;
2276         BIGNUM *start = NULL;
2277 #endif
2278
2279         extern int optind;
2280         extern char *optarg;
2281
2282         ssh_malloc_init();      /* must be called before any mallocs */
2283         /* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */
2284         sanitise_stdfd();
2285
2286         __progname = ssh_get_progname(argv[0]);
2287
2288 #ifdef WITH_OPENSSL
2289         OpenSSL_add_all_algorithms();
2290 #endif
2291         log_init(argv[0], SYSLOG_LEVEL_INFO, SYSLOG_FACILITY_USER, 1);
2292
2293         seed_rng();
2294
2295         msetlocale();
2296
2297         /* we need this for the home * directory.  */
2298         pw = getpwuid(getuid());
2299         if (!pw)
2300                 fatal("No user exists for uid %lu", (u_long)getuid());
2301         if (gethostname(hostname, sizeof(hostname)) < 0)
2302                 fatal("gethostname: %s", strerror(errno));
2303
2304         /* Remaining characters: UYdw */
2305         while ((opt = getopt(argc, argv, "ABHLQXceghiklopquvxy"
2306             "C:D:E:F:G:I:J:K:M:N:O:P:R:S:T:V:W:Z:"
2307             "a:b:f:g:j:m:n:r:s:t:z:")) != -1) {
2308                 switch (opt) {
2309                 case 'A':
2310                         gen_all_hostkeys = 1;
2311                         break;
2312                 case 'b':
2313                         bits = (u_int32_t)strtonum(optarg, 256, 32768, &errstr);
2314                         if (errstr)
2315                                 fatal("Bits has bad value %s (%s)",
2316                                         optarg, errstr);
2317                         break;
2318                 case 'E':
2319                         fingerprint_hash = ssh_digest_alg_by_name(optarg);
2320                         if (fingerprint_hash == -1)
2321                                 fatal("Invalid hash algorithm \"%s\"", optarg);
2322                         break;
2323                 case 'F':
2324                         find_host = 1;
2325                         rr_hostname = optarg;
2326                         break;
2327                 case 'H':
2328                         hash_hosts = 1;
2329                         break;
2330                 case 'I':
2331                         cert_key_id = optarg;
2332                         break;
2333                 case 'R':
2334                         delete_host = 1;
2335                         rr_hostname = optarg;
2336                         break;
2337                 case 'L':
2338                         show_cert = 1;
2339                         break;
2340                 case 'l':
2341                         print_fingerprint = 1;
2342                         break;
2343                 case 'B':
2344                         print_bubblebabble = 1;
2345                         break;
2346                 case 'm':
2347                         if (strcasecmp(optarg, "RFC4716") == 0 ||
2348                             strcasecmp(optarg, "ssh2") == 0) {
2349                                 convert_format = FMT_RFC4716;
2350                                 break;
2351                         }
2352                         if (strcasecmp(optarg, "PKCS8") == 0) {
2353                                 convert_format = FMT_PKCS8;
2354                                 break;
2355                         }
2356                         if (strcasecmp(optarg, "PEM") == 0) {
2357                                 convert_format = FMT_PEM;
2358                                 break;
2359                         }
2360                         fatal("Unsupported conversion format \"%s\"", optarg);
2361                 case 'n':
2362                         cert_principals = optarg;
2363                         break;
2364                 case 'o':
2365                         use_new_format = 1;
2366                         break;
2367                 case 'p':
2368                         change_passphrase = 1;
2369                         break;
2370                 case 'c':
2371                         change_comment = 1;
2372                         break;
2373                 case 'f':
2374                         if (strlcpy(identity_file, optarg,
2375                             sizeof(identity_file)) >= sizeof(identity_file))
2376                                 fatal("Identity filename too long");
2377                         have_identity = 1;
2378                         break;
2379                 case 'g':
2380                         print_generic = 1;
2381                         break;
2382                 case 'P':
2383                         identity_passphrase = optarg;
2384                         break;
2385                 case 'N':
2386                         identity_new_passphrase = optarg;
2387                         break;
2388                 case 'Q':
2389                         check_krl = 1;
2390                         break;
2391                 case 'O':
2392                         add_cert_option(optarg);
2393                         break;
2394                 case 'Z':
2395                         new_format_cipher = optarg;
2396                         break;
2397                 case 'C':
2398                         identity_comment = optarg;
2399                         break;
2400                 case 'q':
2401                         quiet = 1;
2402                         break;
2403                 case 'e':
2404                 case 'x':
2405                         /* export key */
2406                         convert_to = 1;
2407                         break;
2408                 case 'h':
2409                         cert_key_type = SSH2_CERT_TYPE_HOST;
2410                         certflags_flags = 0;
2411                         break;
2412                 case 'k':
2413                         gen_krl = 1;
2414                         break;
2415                 case 'i':
2416                 case 'X':
2417                         /* import key */
2418                         convert_from = 1;
2419                         break;
2420                 case 'y':
2421                         print_public = 1;
2422                         break;
2423                 case 's':
2424                         ca_key_path = optarg;
2425                         break;
2426                 case 't':
2427                         key_type_name = optarg;
2428                         break;
2429                 case 'D':
2430                         pkcs11provider = optarg;
2431                         break;
2432                 case 'u':
2433                         update_krl = 1;
2434                         break;
2435                 case 'v':
2436                         if (log_level == SYSLOG_LEVEL_INFO)
2437                                 log_level = SYSLOG_LEVEL_DEBUG1;
2438                         else {
2439                                 if (log_level >= SYSLOG_LEVEL_DEBUG1 &&
2440                                     log_level < SYSLOG_LEVEL_DEBUG3)
2441                                         log_level++;
2442                         }
2443                         break;
2444                 case 'r':
2445                         rr_hostname = optarg;
2446                         break;
2447                 case 'a':
2448                         rounds = (int)strtonum(optarg, 1, INT_MAX, &errstr);
2449                         if (errstr)
2450                                 fatal("Invalid number: %s (%s)",
2451                                         optarg, errstr);
2452                         break;
2453                 case 'V':
2454                         parse_cert_times(optarg);
2455                         break;
2456                 case 'z':
2457                         errno = 0;
2458                         cert_serial = strtoull(optarg, &ep, 10);
2459                         if (*optarg < '0' || *optarg > '9' || *ep != '\0' ||
2460                             (errno == ERANGE && cert_serial == ULLONG_MAX))
2461                                 fatal("Invalid serial number \"%s\"", optarg);
2462                         break;
2463 #ifdef WITH_OPENSSL
2464                 /* Moduli generation/screening */
2465                 case 'G':
2466                         do_gen_candidates = 1;
2467                         if (strlcpy(out_file, optarg, sizeof(out_file)) >=
2468                             sizeof(out_file))
2469                                 fatal("Output filename too long");
2470                         break;
2471                 case 'J':
2472                         lines_to_process = strtoul(optarg, NULL, 10);
2473                         break;
2474                 case 'j':
2475                         start_lineno = strtoul(optarg, NULL, 10);
2476                         break;
2477                 case 'K':
2478                         if (strlen(optarg) >= PATH_MAX)
2479                                 fatal("Checkpoint filename too long");
2480                         checkpoint = xstrdup(optarg);
2481                         break;
2482                 case 'M':
2483                         memory = (u_int32_t)strtonum(optarg, 1, UINT_MAX,
2484                             &errstr);
2485                         if (errstr)
2486                                 fatal("Memory limit is %s: %s", errstr, optarg);
2487                         break;
2488                 case 'S':
2489                         /* XXX - also compare length against bits */
2490                         if (BN_hex2bn(&start, optarg) == 0)
2491                                 fatal("Invalid start point.");
2492                         break;
2493                 case 'T':
2494                         do_screen_candidates = 1;
2495                         if (strlcpy(out_file, optarg, sizeof(out_file)) >=
2496                             sizeof(out_file))
2497                                 fatal("Output filename too long");
2498                         break;
2499                 case 'W':
2500                         generator_wanted = (u_int32_t)strtonum(optarg, 1,
2501                             UINT_MAX, &errstr);
2502                         if (errstr != NULL)
2503                                 fatal("Desired generator invalid: %s (%s)",
2504                                     optarg, errstr);
2505                         break;
2506 #endif /* WITH_OPENSSL */
2507                 case '?':
2508                 default:
2509                         usage();
2510                 }
2511         }
2512
2513         /* reinit */
2514         log_init(argv[0], log_level, SYSLOG_FACILITY_USER, 1);
2515
2516         argv += optind;
2517         argc -= optind;
2518
2519         if (ca_key_path != NULL) {
2520                 if (argc < 1 && !gen_krl) {
2521                         error("Too few arguments.");
2522                         usage();
2523                 }
2524         } else if (argc > 0 && !gen_krl && !check_krl) {
2525                 error("Too many arguments.");
2526                 usage();
2527         }
2528         if (change_passphrase && change_comment) {
2529                 error("Can only have one of -p and -c.");
2530                 usage();
2531         }
2532         if (print_fingerprint && (delete_host || hash_hosts)) {
2533                 error("Cannot use -l with -H or -R.");
2534                 usage();
2535         }
2536         if (gen_krl) {
2537                 do_gen_krl(pw, update_krl, argc, argv);
2538                 return (0);
2539         }
2540         if (check_krl) {
2541                 do_check_krl(pw, argc, argv);
2542                 return (0);
2543         }
2544         if (ca_key_path != NULL) {
2545                 if (cert_key_id == NULL)
2546                         fatal("Must specify key id (-I) when certifying");
2547                 do_ca_sign(pw, argc, argv);
2548         }
2549         if (show_cert)
2550                 do_show_cert(pw);
2551         if (delete_host || hash_hosts || find_host)
2552                 do_known_hosts(pw, rr_hostname);
2553         if (pkcs11provider != NULL)
2554                 do_download(pw);
2555         if (print_fingerprint || print_bubblebabble)
2556                 do_fingerprint(pw);
2557         if (change_passphrase)
2558                 do_change_passphrase(pw);
2559         if (change_comment)
2560                 do_change_comment(pw);
2561 #ifdef WITH_OPENSSL
2562         if (convert_to)
2563                 do_convert_to(pw);
2564         if (convert_from)
2565                 do_convert_from(pw);
2566 #endif
2567         if (print_public)
2568                 do_print_public(pw);
2569         if (rr_hostname != NULL) {
2570                 unsigned int n = 0;
2571
2572                 if (have_identity) {
2573                         n = do_print_resource_record(pw,
2574                             identity_file, rr_hostname);
2575                         if (n == 0)
2576                                 fatal("%s: %s", identity_file, strerror(errno));
2577                         exit(0);
2578                 } else {
2579
2580                         n += do_print_resource_record(pw,
2581                             _PATH_HOST_RSA_KEY_FILE, rr_hostname);
2582                         n += do_print_resource_record(pw,
2583                             _PATH_HOST_DSA_KEY_FILE, rr_hostname);
2584                         n += do_print_resource_record(pw,
2585                             _PATH_HOST_ECDSA_KEY_FILE, rr_hostname);
2586                         n += do_print_resource_record(pw,
2587                             _PATH_HOST_ED25519_KEY_FILE, rr_hostname);
2588                         if (n == 0)
2589                                 fatal("no keys found.");
2590                         exit(0);
2591                 }
2592         }
2593
2594 #ifdef WITH_OPENSSL
2595         if (do_gen_candidates) {
2596                 FILE *out = fopen(out_file, "w");
2597
2598                 if (out == NULL) {
2599                         error("Couldn't open modulus candidate file \"%s\": %s",
2600                             out_file, strerror(errno));
2601                         return (1);
2602                 }
2603                 if (bits == 0)
2604                         bits = DEFAULT_BITS;
2605                 if (gen_candidates(out, memory, bits, start) != 0)
2606                         fatal("modulus candidate generation failed");
2607
2608                 return (0);
2609         }
2610
2611         if (do_screen_candidates) {
2612                 FILE *in;
2613                 FILE *out = fopen(out_file, "a");
2614
2615                 if (have_identity && strcmp(identity_file, "-") != 0) {
2616                         if ((in = fopen(identity_file, "r")) == NULL) {
2617                                 fatal("Couldn't open modulus candidate "
2618                                     "file \"%s\": %s", identity_file,
2619                                     strerror(errno));
2620                         }
2621                 } else
2622                         in = stdin;
2623
2624                 if (out == NULL) {
2625                         fatal("Couldn't open moduli file \"%s\": %s",
2626                             out_file, strerror(errno));
2627                 }
2628                 if (prime_test(in, out, rounds == 0 ? 100 : rounds,
2629                     generator_wanted, checkpoint,
2630                     start_lineno, lines_to_process) != 0)
2631                         fatal("modulus screening failed");
2632                 return (0);
2633         }
2634 #endif
2635
2636         if (gen_all_hostkeys) {
2637                 do_gen_all_hostkeys(pw);
2638                 return (0);
2639         }
2640
2641         if (key_type_name == NULL)
2642                 key_type_name = DEFAULT_KEY_TYPE_NAME;
2643
2644         type = sshkey_type_from_name(key_type_name);
2645         type_bits_valid(type, key_type_name, &bits);
2646
2647         if (!quiet)
2648                 printf("Generating public/private %s key pair.\n",
2649                     key_type_name);
2650         if ((r = sshkey_generate(type, bits, &private)) != 0)
2651                 fatal("key_generate failed");
2652         if ((r = sshkey_from_private(private, &public)) != 0)
2653                 fatal("key_from_private failed: %s\n", ssh_err(r));
2654
2655         if (!have_identity)
2656                 ask_filename(pw, "Enter file in which to save the key");
2657
2658         /* Create ~/.ssh directory if it doesn't already exist. */
2659         snprintf(dotsshdir, sizeof dotsshdir, "%s/%s",
2660             pw->pw_dir, _PATH_SSH_USER_DIR);
2661         if (strstr(identity_file, dotsshdir) != NULL) {
2662                 if (stat(dotsshdir, &st) < 0) {
2663                         if (errno != ENOENT) {
2664                                 error("Could not stat %s: %s", dotsshdir,
2665                                     strerror(errno));
2666                         } else if (mkdir(dotsshdir, 0700) < 0) {
2667                                 error("Could not create directory '%s': %s",
2668                                     dotsshdir, strerror(errno));
2669                         } else if (!quiet)
2670                                 printf("Created directory '%s'.\n", dotsshdir);
2671                 }
2672         }
2673         /* If the file already exists, ask the user to confirm. */
2674         if (stat(identity_file, &st) >= 0) {
2675                 char yesno[3];
2676                 printf("%s already exists.\n", identity_file);
2677                 printf("Overwrite (y/n)? ");
2678                 fflush(stdout);
2679                 if (fgets(yesno, sizeof(yesno), stdin) == NULL)
2680                         exit(1);
2681                 if (yesno[0] != 'y' && yesno[0] != 'Y')
2682                         exit(1);
2683         }
2684         /* Ask for a passphrase (twice). */
2685         if (identity_passphrase)
2686                 passphrase1 = xstrdup(identity_passphrase);
2687         else if (identity_new_passphrase)
2688                 passphrase1 = xstrdup(identity_new_passphrase);
2689         else {
2690 passphrase_again:
2691                 passphrase1 =
2692                         read_passphrase("Enter passphrase (empty for no "
2693                             "passphrase): ", RP_ALLOW_STDIN);
2694                 passphrase2 = read_passphrase("Enter same passphrase again: ",
2695                     RP_ALLOW_STDIN);
2696                 if (strcmp(passphrase1, passphrase2) != 0) {
2697                         /*
2698                          * The passphrases do not match.  Clear them and
2699                          * retry.
2700                          */
2701                         explicit_bzero(passphrase1, strlen(passphrase1));
2702                         explicit_bzero(passphrase2, strlen(passphrase2));
2703                         free(passphrase1);
2704                         free(passphrase2);
2705                         printf("Passphrases do not match.  Try again.\n");
2706                         goto passphrase_again;
2707                 }
2708                 /* Clear the other copy of the passphrase. */
2709                 explicit_bzero(passphrase2, strlen(passphrase2));
2710                 free(passphrase2);
2711         }
2712
2713         if (identity_comment) {
2714                 strlcpy(comment, identity_comment, sizeof(comment));
2715         } else {
2716                 /* Create default comment field for the passphrase. */
2717                 snprintf(comment, sizeof comment, "%s@%s", pw->pw_name, hostname);
2718         }
2719
2720         /* Save the key with the given passphrase and comment. */
2721         if ((r = sshkey_save_private(private, identity_file, passphrase1,
2722             comment, use_new_format, new_format_cipher, rounds)) != 0) {
2723                 error("Saving key \"%s\" failed: %s",
2724                     identity_file, ssh_err(r));
2725                 explicit_bzero(passphrase1, strlen(passphrase1));
2726                 free(passphrase1);
2727                 exit(1);
2728         }
2729         /* Clear the passphrase. */
2730         explicit_bzero(passphrase1, strlen(passphrase1));
2731         free(passphrase1);
2732
2733         /* Clear the private key and the random number generator. */
2734         sshkey_free(private);
2735
2736         if (!quiet)
2737                 printf("Your identification has been saved in %s.\n", identity_file);
2738
2739         strlcat(identity_file, ".pub", sizeof(identity_file));
2740         if ((fd = open(identity_file, O_WRONLY|O_CREAT|O_TRUNC, 0644)) == -1)
2741                 fatal("Unable to save public key to %s: %s",
2742                     identity_file, strerror(errno));
2743         if ((f = fdopen(fd, "w")) == NULL)
2744                 fatal("fdopen %s failed: %s", identity_file, strerror(errno));
2745         if ((r = sshkey_write(public, f)) != 0)
2746                 error("write key failed: %s", ssh_err(r));
2747         fprintf(f, " %s\n", comment);
2748         fclose(f);
2749
2750         if (!quiet) {
2751                 fp = sshkey_fingerprint(public, fingerprint_hash,
2752                     SSH_FP_DEFAULT);
2753                 ra = sshkey_fingerprint(public, fingerprint_hash,
2754                     SSH_FP_RANDOMART);
2755                 if (fp == NULL || ra == NULL)
2756                         fatal("sshkey_fingerprint failed");
2757                 printf("Your public key has been saved in %s.\n",
2758                     identity_file);
2759                 printf("The key fingerprint is:\n");
2760                 printf("%s %s\n", fp, comment);
2761                 printf("The key's randomart image is:\n");
2762                 printf("%s\n", ra);
2763                 free(ra);
2764                 free(fp);
2765         }
2766
2767         sshkey_free(public);
2768         exit(0);
2769 }