mirror of
https://github.com/clearml/dropbear
synced 2025-03-04 19:20:32 +00:00
Remove commented ssh.com code from keyimport
This commit is contained in:
Matt Johnston
parent
6ac92cf606
commit
9d36e94deb
729
keyimport.c
729
keyimport.c
@ -2,7 +2,7 @@
|
|||||||
* Based on PuTTY's import.c for importing/exporting OpenSSH and SSH.com
|
* Based on PuTTY's import.c for importing/exporting OpenSSH and SSH.com
|
||||||
* keyfiles.
|
* keyfiles.
|
||||||
*
|
*
|
||||||
* Modifications copyright 2003 Matt Johnston
|
* Modifications copyright 2003-2022 Matt Johnston
|
||||||
*
|
*
|
||||||
* PuTTY is copyright 1997-2003 Simon Tatham.
|
* PuTTY is copyright 1997-2003 Simon Tatham.
|
||||||
*
|
*
|
||||||
@ -1121,733 +1121,6 @@ static int openssh_write(const char *filename, sign_key *key,
|
|||||||
return ret;
|
return ret;
|
||||||
}
|
}
|
||||||
|
|
||||||
#if 0
|
|
||||||
/* XXX TODO ssh.com stuff isn't going yet */
|
|
||||||
|
|
||||||
/* ----------------------------------------------------------------------
|
|
||||||
* Code to read ssh.com private keys.
|
|
||||||
*/
|
|
||||||
|
|
||||||
/*
|
|
||||||
* The format of the base64 blob is largely ssh2-packet-formatted,
|
|
||||||
* except that mpints are a bit different: they're more like the
|
|
||||||
* old ssh1 mpint. You have a 32-bit bit count N, followed by
|
|
||||||
* (N+7)/8 bytes of data.
|
|
||||||
*
|
|
||||||
* So. The blob contains:
|
|
||||||
*
|
|
||||||
* - uint32 0x3f6ff9eb (magic number)
|
|
||||||
* - uint32 size (total blob size)
|
|
||||||
* - string key-type (see below)
|
|
||||||
* - string cipher-type (tells you if key is encrypted)
|
|
||||||
* - string encrypted-blob
|
|
||||||
*
|
|
||||||
* (The first size field includes the size field itself and the
|
|
||||||
* magic number before it. All other size fields are ordinary ssh2
|
|
||||||
* strings, so the size field indicates how much data is to
|
|
||||||
* _follow_.)
|
|
||||||
*
|
|
||||||
* The encrypted blob, once decrypted, contains a single string
|
|
||||||
* which in turn contains the payload. (This allows padding to be
|
|
||||||
* added after that string while still making it clear where the
|
|
||||||
* real payload ends. Also it probably makes for a reasonable
|
|
||||||
* decryption check.)
|
|
||||||
*
|
|
||||||
* The payload blob, for an RSA key, contains:
|
|
||||||
* - mpint e
|
|
||||||
* - mpint d
|
|
||||||
* - mpint n (yes, the public and private stuff is intermixed)
|
|
||||||
* - mpint u (presumably inverse of p mod q)
|
|
||||||
* - mpint p (p is the smaller prime)
|
|
||||||
* - mpint q (q is the larger)
|
|
||||||
*
|
|
||||||
* For a DSA key, the payload blob contains:
|
|
||||||
* - uint32 0
|
|
||||||
* - mpint p
|
|
||||||
* - mpint g
|
|
||||||
* - mpint q
|
|
||||||
* - mpint y
|
|
||||||
* - mpint x
|
|
||||||
*
|
|
||||||
* Alternatively, if the parameters are `predefined', that
|
|
||||||
* (0,p,g,q) sequence can be replaced by a uint32 1 and a string
|
|
||||||
* containing some predefined parameter specification. *shudder*,
|
|
||||||
* but I doubt we'll encounter this in real life.
|
|
||||||
*
|
|
||||||
* The key type strings are ghastly. The RSA key I looked at had a
|
|
||||||
* type string of
|
|
||||||
*
|
|
||||||
* `if-modn{sign{rsa-pkcs1-sha1},encrypt{rsa-pkcs1v2-oaep}}'
|
|
||||||
*
|
|
||||||
* and the DSA key wasn't much better:
|
|
||||||
*
|
|
||||||
* `dl-modp{sign{dsa-nist-sha1},dh{plain}}'
|
|
||||||
*
|
|
||||||
* It isn't clear that these will always be the same. I think it
|
|
||||||
* might be wise just to look at the `if-modn{sign{rsa' and
|
|
||||||
* `dl-modp{sign{dsa' prefixes.
|
|
||||||
*
|
|
||||||
* Finally, the encryption. The cipher-type string appears to be
|
|
||||||
* either `none' or `3des-cbc'. Looks as if this is SSH2-style
|
|
||||||
* 3des-cbc (i.e. outer cbc rather than inner). The key is created
|
|
||||||
* from the passphrase by means of yet another hashing faff:
|
|
||||||
*
|
|
||||||
* - first 16 bytes are MD5(passphrase)
|
|
||||||
* - next 16 bytes are MD5(passphrase || first 16 bytes)
|
|
||||||
* - if there were more, they'd be MD5(passphrase || first 32),
|
|
||||||
* and so on.
|
|
||||||
*/
|
|
||||||
|
|
||||||
#define SSHCOM_MAGIC_NUMBER 0x3f6ff9eb
|
|
||||||
|
|
||||||
struct sshcom_key {
|
|
||||||
char comment[256]; /* allowing any length is overkill */
|
|
||||||
unsigned char *keyblob;
|
|
||||||
int keyblob_len, keyblob_size;
|
|
||||||
};
|
|
||||||
|
|
||||||
static struct sshcom_key *load_sshcom_key(const char *filename)
|
|
||||||
{
|
|
||||||
struct sshcom_key *ret;
|
|
||||||
FILE *fp;
|
|
||||||
char buffer[256];
|
|
||||||
int len;
|
|
||||||
char *errmsg, *p;
|
|
||||||
int headers_done;
|
|
||||||
char base64_bit[4];
|
|
||||||
int base64_chars = 0;
|
|
||||||
|
|
||||||
ret = snew(struct sshcom_key);
|
|
||||||
ret->comment[0] = '\0';
|
|
||||||
ret->keyblob = NULL;
|
|
||||||
ret->keyblob_len = ret->keyblob_size = 0;
|
|
||||||
|
|
||||||
fp = fopen(filename, "r");
|
|
||||||
if (!fp) {
|
|
||||||
errmsg = "Unable to open key file";
|
|
||||||
goto error;
|
|
||||||
}
|
|
||||||
if (!fgets(buffer, sizeof(buffer), fp) ||
|
|
||||||
0 != strcmp(buffer, "---- BEGIN SSH2 ENCRYPTED PRIVATE KEY ----\n")) {
|
|
||||||
errmsg = "File does not begin with ssh.com key header";
|
|
||||||
goto error;
|
|
||||||
}
|
|
||||||
|
|
||||||
headers_done = 0;
|
|
||||||
while (1) {
|
|
||||||
if (!fgets(buffer, sizeof(buffer), fp)) {
|
|
||||||
errmsg = "Unexpected end of file";
|
|
||||||
goto error;
|
|
||||||
}
|
|
||||||
if (!strcmp(buffer, "---- END SSH2 ENCRYPTED PRIVATE KEY ----\n"))
|
|
||||||
break; /* done */
|
|
||||||
if ((p = strchr(buffer, ':')) != NULL) {
|
|
||||||
if (headers_done) {
|
|
||||||
errmsg = "Header found in body of key data";
|
|
||||||
goto error;
|
|
||||||
}
|
|
||||||
*p++ = '\0';
|
|
||||||
while (*p && isspace((unsigned char)*p)) p++;
|
|
||||||
/*
|
|
||||||
* Header lines can end in a trailing backslash for
|
|
||||||
* continuation.
|
|
||||||
*/
|
|
||||||
while ((len = strlen(p)) > (int)(sizeof(buffer) - (p-buffer) -1) ||
|
|
||||||
p[len-1] != '\n' || p[len-2] == '\\') {
|
|
||||||
if (len > (int)((p-buffer) + sizeof(buffer)-2)) {
|
|
||||||
errmsg = "Header line too long to deal with";
|
|
||||||
goto error;
|
|
||||||
}
|
|
||||||
if (!fgets(p+len-2, sizeof(buffer)-(p-buffer)-(len-2), fp)) {
|
|
||||||
errmsg = "Unexpected end of file";
|
|
||||||
goto error;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
p[strcspn(p, "\n")] = '\0';
|
|
||||||
if (!strcmp(buffer, "Comment")) {
|
|
||||||
/* Strip quotes in comment if present. */
|
|
||||||
if (p[0] == '"' && p[strlen(p)-1] == '"') {
|
|
||||||
p++;
|
|
||||||
p[strlen(p)-1] = '\0';
|
|
||||||
}
|
|
||||||
strncpy(ret->comment, p, sizeof(ret->comment));
|
|
||||||
ret->comment[sizeof(ret->comment)-1] = '\0';
|
|
||||||
}
|
|
||||||
} else {
|
|
||||||
headers_done = 1;
|
|
||||||
|
|
||||||
p = buffer;
|
|
||||||
while (isbase64(*p)) {
|
|
||||||
base64_bit[base64_chars++] = *p;
|
|
||||||
if (base64_chars == 4) {
|
|
||||||
unsigned char out[3];
|
|
||||||
|
|
||||||
base64_chars = 0;
|
|
||||||
|
|
||||||
len = base64_decode_atom(base64_bit, out);
|
|
||||||
|
|
||||||
if (len <= 0) {
|
|
||||||
errmsg = "Invalid base64 encoding";
|
|
||||||
goto error;
|
|
||||||
}
|
|
||||||
|
|
||||||
if (ret->keyblob_len + len > ret->keyblob_size) {
|
|
||||||
ret->keyblob_size = ret->keyblob_len + len + 256;
|
|
||||||
ret->keyblob = sresize(ret->keyblob, ret->keyblob_size,
|
|
||||||
unsigned char);
|
|
||||||
}
|
|
||||||
|
|
||||||
memcpy(ret->keyblob + ret->keyblob_len, out, len);
|
|
||||||
ret->keyblob_len += len;
|
|
||||||
}
|
|
||||||
|
|
||||||
p++;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
if (ret->keyblob_len == 0 || !ret->keyblob) {
|
|
||||||
errmsg = "Key body not present";
|
|
||||||
goto error;
|
|
||||||
}
|
|
||||||
|
|
||||||
return ret;
|
|
||||||
|
|
||||||
error:
|
|
||||||
if (ret) {
|
|
||||||
if (ret->keyblob) {
|
|
||||||
memset(ret->keyblob, 0, ret->keyblob_size);
|
|
||||||
m_free(ret->keyblob);
|
|
||||||
}
|
|
||||||
memset(ret, 0, sizeof(*ret));
|
|
||||||
m_free(ret);
|
|
||||||
}
|
|
||||||
return NULL;
|
|
||||||
}
|
|
||||||
|
|
||||||
int sshcom_encrypted(const char *filename, char **comment)
|
|
||||||
{
|
|
||||||
struct sshcom_key *key = load_sshcom_key(filename);
|
|
||||||
int pos, len, answer;
|
|
||||||
|
|
||||||
*comment = NULL;
|
|
||||||
if (!key)
|
|
||||||
return 0;
|
|
||||||
|
|
||||||
/*
|
|
||||||
* Check magic number.
|
|
||||||
*/
|
|
||||||
if (GET_32BIT(key->keyblob) != 0x3f6ff9eb)
|
|
||||||
return 0; /* key is invalid */
|
|
||||||
|
|
||||||
/*
|
|
||||||
* Find the cipher-type string.
|
|
||||||
*/
|
|
||||||
answer = 0;
|
|
||||||
pos = 8;
|
|
||||||
if (key->keyblob_len < pos+4)
|
|
||||||
goto done; /* key is far too short */
|
|
||||||
len = toint(GET_32BIT(key->keyblob + pos));
|
|
||||||
if (len < 0 || len > key->keyblob_len - pos - 4)
|
|
||||||
goto done; /* key is far too short */
|
|
||||||
pos += 4 + len; /* skip key type */
|
|
||||||
len = toint(GET_32BIT(key->keyblob + pos)); /* find cipher-type length */
|
|
||||||
if (len < 0 || len > key->keyblob_len - pos - 4)
|
|
||||||
goto done; /* cipher type string is incomplete */
|
|
||||||
if (len != 4 || 0 != memcmp(key->keyblob + pos + 4, "none", 4))
|
|
||||||
answer = 1;
|
|
||||||
|
|
||||||
done:
|
|
||||||
*comment = dupstr(key->comment);
|
|
||||||
memset(key->keyblob, 0, key->keyblob_size);
|
|
||||||
m_free(key->keyblob);
|
|
||||||
memset(key, 0, sizeof(*key));
|
|
||||||
m_free(key);
|
|
||||||
return answer;
|
|
||||||
}
|
|
||||||
|
|
||||||
static int sshcom_read_mpint(void *data, int len, struct mpint_pos *ret)
|
|
||||||
{
|
|
||||||
unsigned bits, bytes;
|
|
||||||
unsigned char *d = (unsigned char *) data;
|
|
||||||
|
|
||||||
if (len < 4)
|
|
||||||
goto error;
|
|
||||||
bits = GET_32BIT(d);
|
|
||||||
|
|
||||||
bytes = (bits + 7) / 8;
|
|
||||||
if (len < 4+bytes)
|
|
||||||
goto error;
|
|
||||||
|
|
||||||
ret->start = d + 4;
|
|
||||||
ret->bytes = bytes;
|
|
||||||
return bytes+4;
|
|
||||||
|
|
||||||
error:
|
|
||||||
ret->start = NULL;
|
|
||||||
ret->bytes = -1;
|
|
||||||
return len; /* ensure further calls fail as well */
|
|
||||||
}
|
|
||||||
|
|
||||||
static int sshcom_put_mpint(void *target, void *data, int len)
|
|
||||||
{
|
|
||||||
unsigned char *d = (unsigned char *)target;
|
|
||||||
unsigned char *i = (unsigned char *)data;
|
|
||||||
int bits = len * 8 - 1;
|
|
||||||
|
|
||||||
while (bits > 0) {
|
|
||||||
if (*i & (1 << (bits & 7)))
|
|
||||||
break;
|
|
||||||
if (!(bits-- & 7))
|
|
||||||
i++, len--;
|
|
||||||
}
|
|
||||||
|
|
||||||
PUT_32BIT(d, bits+1);
|
|
||||||
memcpy(d+4, i, len);
|
|
||||||
return len+4;
|
|
||||||
}
|
|
||||||
|
|
||||||
sign_key *sshcom_read(const char *filename, char *passphrase)
|
|
||||||
{
|
|
||||||
struct sshcom_key *key = load_sshcom_key(filename);
|
|
||||||
char *errmsg;
|
|
||||||
int pos, len;
|
|
||||||
const char prefix_rsa[] = "if-modn{sign{rsa";
|
|
||||||
const char prefix_dsa[] = "dl-modp{sign{dsa";
|
|
||||||
enum { RSA, DSA } type;
|
|
||||||
int encrypted;
|
|
||||||
char *ciphertext;
|
|
||||||
int cipherlen;
|
|
||||||
struct ssh2_userkey *ret = NULL, *retkey;
|
|
||||||
const struct ssh_signkey *alg;
|
|
||||||
unsigned char *blob = NULL;
|
|
||||||
int blobsize = 0, publen, privlen;
|
|
||||||
|
|
||||||
if (!key)
|
|
||||||
return NULL;
|
|
||||||
|
|
||||||
/*
|
|
||||||
* Check magic number.
|
|
||||||
*/
|
|
||||||
if (GET_32BIT(key->keyblob) != SSHCOM_MAGIC_NUMBER) {
|
|
||||||
errmsg = "Key does not begin with magic number";
|
|
||||||
goto error;
|
|
||||||
}
|
|
||||||
|
|
||||||
/*
|
|
||||||
* Determine the key type.
|
|
||||||
*/
|
|
||||||
pos = 8;
|
|
||||||
if (key->keyblob_len < pos+4 ||
|
|
||||||
(len = GET_32BIT(key->keyblob + pos)) > key->keyblob_len - pos - 4) {
|
|
||||||
errmsg = "Key blob does not contain a key type string";
|
|
||||||
goto error;
|
|
||||||
}
|
|
||||||
if (len > sizeof(prefix_rsa) - 1 &&
|
|
||||||
!memcmp(key->keyblob+pos+4, prefix_rsa, sizeof(prefix_rsa) - 1)) {
|
|
||||||
type = RSA;
|
|
||||||
} else if (len > sizeof(prefix_dsa) - 1 &&
|
|
||||||
!memcmp(key->keyblob+pos+4, prefix_dsa, sizeof(prefix_dsa) - 1)) {
|
|
||||||
type = DSA;
|
|
||||||
} else {
|
|
||||||
errmsg = "Key is of unknown type";
|
|
||||||
goto error;
|
|
||||||
}
|
|
||||||
pos += 4+len;
|
|
||||||
|
|
||||||
/*
|
|
||||||
* Determine the cipher type.
|
|
||||||
*/
|
|
||||||
if (key->keyblob_len < pos+4 ||
|
|
||||||
(len = GET_32BIT(key->keyblob + pos)) > key->keyblob_len - pos - 4) {
|
|
||||||
errmsg = "Key blob does not contain a cipher type string";
|
|
||||||
goto error;
|
|
||||||
}
|
|
||||||
if (len == 4 && !memcmp(key->keyblob+pos+4, "none", 4))
|
|
||||||
encrypted = 0;
|
|
||||||
else if (len == 8 && !memcmp(key->keyblob+pos+4, "3des-cbc", 8))
|
|
||||||
encrypted = 1;
|
|
||||||
else {
|
|
||||||
errmsg = "Key encryption is of unknown type";
|
|
||||||
goto error;
|
|
||||||
}
|
|
||||||
pos += 4+len;
|
|
||||||
|
|
||||||
/*
|
|
||||||
* Get hold of the encrypted part of the key.
|
|
||||||
*/
|
|
||||||
if (key->keyblob_len < pos+4 ||
|
|
||||||
(len = GET_32BIT(key->keyblob + pos)) > key->keyblob_len - pos - 4) {
|
|
||||||
errmsg = "Key blob does not contain actual key data";
|
|
||||||
goto error;
|
|
||||||
}
|
|
||||||
ciphertext = (char *)key->keyblob + pos + 4;
|
|
||||||
cipherlen = len;
|
|
||||||
if (cipherlen == 0) {
|
|
||||||
errmsg = "Length of key data is zero";
|
|
||||||
goto error;
|
|
||||||
}
|
|
||||||
|
|
||||||
/*
|
|
||||||
* Decrypt it if necessary.
|
|
||||||
*/
|
|
||||||
if (encrypted) {
|
|
||||||
/*
|
|
||||||
* Derive encryption key from passphrase and iv/salt:
|
|
||||||
*
|
|
||||||
* - let block A equal MD5(passphrase)
|
|
||||||
* - let block B equal MD5(passphrase || A)
|
|
||||||
* - block C would be MD5(passphrase || A || B) and so on
|
|
||||||
* - encryption key is the first N bytes of A || B
|
|
||||||
*/
|
|
||||||
struct MD5Context md5c;
|
|
||||||
unsigned char keybuf[32], iv[8];
|
|
||||||
|
|
||||||
if (cipherlen % 8 != 0) {
|
|
||||||
errmsg = "Encrypted part of key is not a multiple of cipher block"
|
|
||||||
" size";
|
|
||||||
goto error;
|
|
||||||
}
|
|
||||||
|
|
||||||
MD5Init(&md5c);
|
|
||||||
MD5Update(&md5c, (unsigned char *)passphrase, strlen(passphrase));
|
|
||||||
MD5Final(keybuf, &md5c);
|
|
||||||
|
|
||||||
MD5Init(&md5c);
|
|
||||||
MD5Update(&md5c, (unsigned char *)passphrase, strlen(passphrase));
|
|
||||||
MD5Update(&md5c, keybuf, 16);
|
|
||||||
MD5Final(keybuf+16, &md5c);
|
|
||||||
|
|
||||||
/*
|
|
||||||
* Now decrypt the key blob.
|
|
||||||
*/
|
|
||||||
memset(iv, 0, sizeof(iv));
|
|
||||||
des3_decrypt_pubkey_ossh(keybuf, iv, (unsigned char *)ciphertext,
|
|
||||||
cipherlen);
|
|
||||||
|
|
||||||
memset(&md5c, 0, sizeof(md5c));
|
|
||||||
memset(keybuf, 0, sizeof(keybuf));
|
|
||||||
|
|
||||||
/*
|
|
||||||
* Hereafter we return WRONG_PASSPHRASE for any parsing
|
|
||||||
* error. (But only if we've just tried to decrypt it!
|
|
||||||
* Returning WRONG_PASSPHRASE for an unencrypted key is
|
|
||||||
* automatic doom.)
|
|
||||||
*/
|
|
||||||
if (encrypted)
|
|
||||||
ret = SSH2_WRONG_PASSPHRASE;
|
|
||||||
}
|
|
||||||
|
|
||||||
/*
|
|
||||||
* Strip away the containing string to get to the real meat.
|
|
||||||
*/
|
|
||||||
len = toint(GET_32BIT(ciphertext));
|
|
||||||
if (len < 0 || len > cipherlen-4) {
|
|
||||||
errmsg = "containing string was ill-formed";
|
|
||||||
goto error;
|
|
||||||
}
|
|
||||||
ciphertext += 4;
|
|
||||||
cipherlen = len;
|
|
||||||
|
|
||||||
/*
|
|
||||||
* Now we break down into RSA versus DSA. In either case we'll
|
|
||||||
* construct public and private blobs in our own format, and
|
|
||||||
* end up feeding them to alg->createkey().
|
|
||||||
*/
|
|
||||||
blobsize = cipherlen + 256;
|
|
||||||
blob = snewn(blobsize, unsigned char);
|
|
||||||
privlen = 0;
|
|
||||||
if (type == RSA) {
|
|
||||||
struct mpint_pos n, e, d, u, p, q;
|
|
||||||
int pos = 0;
|
|
||||||
pos += sshcom_read_mpint(ciphertext+pos, cipherlen-pos, &e);
|
|
||||||
pos += sshcom_read_mpint(ciphertext+pos, cipherlen-pos, &d);
|
|
||||||
pos += sshcom_read_mpint(ciphertext+pos, cipherlen-pos, &n);
|
|
||||||
pos += sshcom_read_mpint(ciphertext+pos, cipherlen-pos, &u);
|
|
||||||
pos += sshcom_read_mpint(ciphertext+pos, cipherlen-pos, &p);
|
|
||||||
pos += sshcom_read_mpint(ciphertext+pos, cipherlen-pos, &q);
|
|
||||||
if (!q.start) {
|
|
||||||
errmsg = "key data did not contain six integers";
|
|
||||||
goto error;
|
|
||||||
}
|
|
||||||
|
|
||||||
alg = &ssh_rsa;
|
|
||||||
pos = 0;
|
|
||||||
pos += put_string(blob+pos, "ssh-rsa", 7);
|
|
||||||
pos += put_mp(blob+pos, e.start, e.bytes);
|
|
||||||
pos += put_mp(blob+pos, n.start, n.bytes);
|
|
||||||
publen = pos;
|
|
||||||
pos += put_string(blob+pos, d.start, d.bytes);
|
|
||||||
pos += put_mp(blob+pos, q.start, q.bytes);
|
|
||||||
pos += put_mp(blob+pos, p.start, p.bytes);
|
|
||||||
pos += put_mp(blob+pos, u.start, u.bytes);
|
|
||||||
privlen = pos - publen;
|
|
||||||
} else if (type == DSA) {
|
|
||||||
struct mpint_pos p, q, g, x, y;
|
|
||||||
int pos = 4;
|
|
||||||
if (GET_32BIT(ciphertext) != 0) {
|
|
||||||
errmsg = "predefined DSA parameters not supported";
|
|
||||||
goto error;
|
|
||||||
}
|
|
||||||
pos += sshcom_read_mpint(ciphertext+pos, cipherlen-pos, &p);
|
|
||||||
pos += sshcom_read_mpint(ciphertext+pos, cipherlen-pos, &g);
|
|
||||||
pos += sshcom_read_mpint(ciphertext+pos, cipherlen-pos, &q);
|
|
||||||
pos += sshcom_read_mpint(ciphertext+pos, cipherlen-pos, &y);
|
|
||||||
pos += sshcom_read_mpint(ciphertext+pos, cipherlen-pos, &x);
|
|
||||||
if (!x.start) {
|
|
||||||
errmsg = "key data did not contain five integers";
|
|
||||||
goto error;
|
|
||||||
}
|
|
||||||
|
|
||||||
alg = &ssh_dss;
|
|
||||||
pos = 0;
|
|
||||||
pos += put_string(blob+pos, "ssh-dss", 7);
|
|
||||||
pos += put_mp(blob+pos, p.start, p.bytes);
|
|
||||||
pos += put_mp(blob+pos, q.start, q.bytes);
|
|
||||||
pos += put_mp(blob+pos, g.start, g.bytes);
|
|
||||||
pos += put_mp(blob+pos, y.start, y.bytes);
|
|
||||||
publen = pos;
|
|
||||||
pos += put_mp(blob+pos, x.start, x.bytes);
|
|
||||||
privlen = pos - publen;
|
|
||||||
} else
|
|
||||||
return NULL;
|
|
||||||
|
|
||||||
dropbear_assert(privlen > 0); /* should have bombed by now if not */
|
|
||||||
|
|
||||||
retkey = snew(struct ssh2_userkey);
|
|
||||||
retkey->alg = alg;
|
|
||||||
retkey->data = alg->createkey(blob, publen, blob+publen, privlen);
|
|
||||||
if (!retkey->data) {
|
|
||||||
m_free(retkey);
|
|
||||||
errmsg = "unable to create key data structure";
|
|
||||||
goto error;
|
|
||||||
}
|
|
||||||
retkey->comment = dupstr(key->comment);
|
|
||||||
|
|
||||||
errmsg = NULL; /* no error */
|
|
||||||
ret = retkey;
|
|
||||||
|
|
||||||
error:
|
|
||||||
if (blob) {
|
|
||||||
memset(blob, 0, blobsize);
|
|
||||||
m_free(blob);
|
|
||||||
}
|
|
||||||
memset(key->keyblob, 0, key->keyblob_size);
|
|
||||||
m_free(key->keyblob);
|
|
||||||
memset(key, 0, sizeof(*key));
|
|
||||||
m_free(key);
|
|
||||||
return ret;
|
|
||||||
}
|
|
||||||
|
|
||||||
int sshcom_write(const char *filename, sign_key *key,
|
|
||||||
char *passphrase)
|
|
||||||
{
|
|
||||||
unsigned char *pubblob, *privblob;
|
|
||||||
int publen, privlen;
|
|
||||||
unsigned char *outblob;
|
|
||||||
int outlen;
|
|
||||||
struct mpint_pos numbers[6];
|
|
||||||
int nnumbers, initial_zero, pos, lenpos, i;
|
|
||||||
char *type;
|
|
||||||
char *ciphertext;
|
|
||||||
int cipherlen;
|
|
||||||
int ret = 0;
|
|
||||||
FILE *fp;
|
|
||||||
|
|
||||||
/*
|
|
||||||
* Fetch the key blobs.
|
|
||||||
*/
|
|
||||||
pubblob = key->alg->public_blob(key->data, &publen);
|
|
||||||
privblob = key->alg->private_blob(key->data, &privlen);
|
|
||||||
outblob = NULL;
|
|
||||||
|
|
||||||
/*
|
|
||||||
* Find the sequence of integers to be encoded into the OpenSSH
|
|
||||||
* key blob, and also decide on the header line.
|
|
||||||
*/
|
|
||||||
if (key->alg == &ssh_rsa) {
|
|
||||||
int pos;
|
|
||||||
struct mpint_pos n, e, d, p, q, iqmp;
|
|
||||||
|
|
||||||
pos = 4 + GET_32BIT(pubblob);
|
|
||||||
pos += ssh2_read_mpint(pubblob+pos, publen-pos, &e);
|
|
||||||
pos += ssh2_read_mpint(pubblob+pos, publen-pos, &n);
|
|
||||||
pos = 0;
|
|
||||||
pos += ssh2_read_mpint(privblob+pos, privlen-pos, &d);
|
|
||||||
pos += ssh2_read_mpint(privblob+pos, privlen-pos, &p);
|
|
||||||
pos += ssh2_read_mpint(privblob+pos, privlen-pos, &q);
|
|
||||||
pos += ssh2_read_mpint(privblob+pos, privlen-pos, &iqmp);
|
|
||||||
|
|
||||||
dropbear_assert(e.start && iqmp.start); /* can't go wrong */
|
|
||||||
|
|
||||||
numbers[0] = e;
|
|
||||||
numbers[1] = d;
|
|
||||||
numbers[2] = n;
|
|
||||||
numbers[3] = iqmp;
|
|
||||||
numbers[4] = q;
|
|
||||||
numbers[5] = p;
|
|
||||||
|
|
||||||
nnumbers = 6;
|
|
||||||
initial_zero = 0;
|
|
||||||
type = "if-modn{sign{rsa-pkcs1-sha1},encrypt{rsa-pkcs1v2-oaep}}";
|
|
||||||
} else if (key->alg == &ssh_dss) {
|
|
||||||
int pos;
|
|
||||||
struct mpint_pos p, q, g, y, x;
|
|
||||||
|
|
||||||
pos = 4 + GET_32BIT(pubblob);
|
|
||||||
pos += ssh2_read_mpint(pubblob+pos, publen-pos, &p);
|
|
||||||
pos += ssh2_read_mpint(pubblob+pos, publen-pos, &q);
|
|
||||||
pos += ssh2_read_mpint(pubblob+pos, publen-pos, &g);
|
|
||||||
pos += ssh2_read_mpint(pubblob+pos, publen-pos, &y);
|
|
||||||
pos = 0;
|
|
||||||
pos += ssh2_read_mpint(privblob+pos, privlen-pos, &x);
|
|
||||||
|
|
||||||
dropbear_assert(y.start && x.start); /* can't go wrong */
|
|
||||||
|
|
||||||
numbers[0] = p;
|
|
||||||
numbers[1] = g;
|
|
||||||
numbers[2] = q;
|
|
||||||
numbers[3] = y;
|
|
||||||
numbers[4] = x;
|
|
||||||
|
|
||||||
nnumbers = 5;
|
|
||||||
initial_zero = 1;
|
|
||||||
type = "dl-modp{sign{dsa-nist-sha1},dh{plain}}";
|
|
||||||
} else {
|
|
||||||
dropbear_assert(0); /* zoinks! */
|
|
||||||
}
|
|
||||||
|
|
||||||
/*
|
|
||||||
* Total size of key blob will be somewhere under 512 plus
|
|
||||||
* combined length of integers. We'll calculate the more
|
|
||||||
* precise size as we construct the blob.
|
|
||||||
*/
|
|
||||||
outlen = 512;
|
|
||||||
for (i = 0; i < nnumbers; i++)
|
|
||||||
outlen += 4 + numbers[i].bytes;
|
|
||||||
outblob = snewn(outlen, unsigned char);
|
|
||||||
|
|
||||||
/*
|
|
||||||
* Create the unencrypted key blob.
|
|
||||||
*/
|
|
||||||
pos = 0;
|
|
||||||
PUT_32BIT(outblob+pos, SSHCOM_MAGIC_NUMBER); pos += 4;
|
|
||||||
pos += 4; /* length field, fill in later */
|
|
||||||
pos += put_string(outblob+pos, type, strlen(type));
|
|
||||||
{
|
|
||||||
char *ciphertype = passphrase ? "3des-cbc" : "none";
|
|
||||||
pos += put_string(outblob+pos, ciphertype, strlen(ciphertype));
|
|
||||||
}
|
|
||||||
lenpos = pos; /* remember this position */
|
|
||||||
pos += 4; /* encrypted-blob size */
|
|
||||||
pos += 4; /* encrypted-payload size */
|
|
||||||
if (initial_zero) {
|
|
||||||
PUT_32BIT(outblob+pos, 0);
|
|
||||||
pos += 4;
|
|
||||||
}
|
|
||||||
for (i = 0; i < nnumbers; i++)
|
|
||||||
pos += sshcom_put_mpint(outblob+pos,
|
|
||||||
numbers[i].start, numbers[i].bytes);
|
|
||||||
/* Now wrap up the encrypted payload. */
|
|
||||||
PUT_32BIT(outblob+lenpos+4, pos - (lenpos+8));
|
|
||||||
/* Pad encrypted blob to a multiple of cipher block size. */
|
|
||||||
if (passphrase) {
|
|
||||||
int padding = -(pos - (lenpos+4)) & 7;
|
|
||||||
while (padding--)
|
|
||||||
outblob[pos++] = random_byte();
|
|
||||||
}
|
|
||||||
ciphertext = (char *)outblob+lenpos+4;
|
|
||||||
cipherlen = pos - (lenpos+4);
|
|
||||||
dropbear_assert(!passphrase || cipherlen % 8 == 0);
|
|
||||||
/* Wrap up the encrypted blob string. */
|
|
||||||
PUT_32BIT(outblob+lenpos, cipherlen);
|
|
||||||
/* And finally fill in the total length field. */
|
|
||||||
PUT_32BIT(outblob+4, pos);
|
|
||||||
|
|
||||||
dropbear_assert(pos < outlen);
|
|
||||||
|
|
||||||
/*
|
|
||||||
* Encrypt the key.
|
|
||||||
*/
|
|
||||||
if (passphrase) {
|
|
||||||
/*
|
|
||||||
* Derive encryption key from passphrase and iv/salt:
|
|
||||||
*
|
|
||||||
* - let block A equal MD5(passphrase)
|
|
||||||
* - let block B equal MD5(passphrase || A)
|
|
||||||
* - block C would be MD5(passphrase || A || B) and so on
|
|
||||||
* - encryption key is the first N bytes of A || B
|
|
||||||
*/
|
|
||||||
struct MD5Context md5c;
|
|
||||||
unsigned char keybuf[32], iv[8];
|
|
||||||
|
|
||||||
MD5Init(&md5c);
|
|
||||||
MD5Update(&md5c, (unsigned char *)passphrase, strlen(passphrase));
|
|
||||||
MD5Final(keybuf, &md5c);
|
|
||||||
|
|
||||||
MD5Init(&md5c);
|
|
||||||
MD5Update(&md5c, (unsigned char *)passphrase, strlen(passphrase));
|
|
||||||
MD5Update(&md5c, keybuf, 16);
|
|
||||||
MD5Final(keybuf+16, &md5c);
|
|
||||||
|
|
||||||
/*
|
|
||||||
* Now decrypt the key blob.
|
|
||||||
*/
|
|
||||||
memset(iv, 0, sizeof(iv));
|
|
||||||
des3_encrypt_pubkey_ossh(keybuf, iv, (unsigned char *)ciphertext,
|
|
||||||
cipherlen);
|
|
||||||
|
|
||||||
memset(&md5c, 0, sizeof(md5c));
|
|
||||||
memset(keybuf, 0, sizeof(keybuf));
|
|
||||||
}
|
|
||||||
|
|
||||||
/*
|
|
||||||
* And save it. We'll use Unix line endings just in case it's
|
|
||||||
* subsequently transferred in binary mode.
|
|
||||||
*/
|
|
||||||
fp = fopen(filename, "wb"); /* ensure Unix line endings */
|
|
||||||
if (!fp)
|
|
||||||
goto error;
|
|
||||||
fputs("---- BEGIN SSH2 ENCRYPTED PRIVATE KEY ----\n", fp);
|
|
||||||
fprintf(fp, "Comment: \"");
|
|
||||||
/*
|
|
||||||
* Comment header is broken with backslash-newline if it goes
|
|
||||||
* over 70 chars. Although it's surrounded by quotes, it
|
|
||||||
* _doesn't_ escape backslashes or quotes within the string.
|
|
||||||
* Don't ask me, I didn't design it.
|
|
||||||
*/
|
|
||||||
{
|
|
||||||
int slen = 60; /* starts at 60 due to "Comment: " */
|
|
||||||
char *c = key->comment;
|
|
||||||
while ((int)strlen(c) > slen) {
|
|
||||||
fprintf(fp, "%.*s\\\n", slen, c);
|
|
||||||
c += slen;
|
|
||||||
slen = 70; /* allow 70 chars on subsequent lines */
|
|
||||||
}
|
|
||||||
fprintf(fp, "%s\"\n", c);
|
|
||||||
}
|
|
||||||
base64_encode_fp(fp, outblob, pos, 70);
|
|
||||||
fputs("---- END SSH2 ENCRYPTED PRIVATE KEY ----\n", fp);
|
|
||||||
fclose(fp);
|
|
||||||
ret = 1;
|
|
||||||
|
|
||||||
error:
|
|
||||||
if (outblob) {
|
|
||||||
memset(outblob, 0, outlen);
|
|
||||||
m_free(outblob);
|
|
||||||
}
|
|
||||||
if (privblob) {
|
|
||||||
memset(privblob, 0, privlen);
|
|
||||||
m_free(privblob);
|
|
||||||
}
|
|
||||||
if (pubblob) {
|
|
||||||
memset(pubblob, 0, publen);
|
|
||||||
m_free(pubblob);
|
|
||||||
}
|
|
||||||
return ret;
|
|
||||||
}
|
|
||||||
#endif /* ssh.com stuff disabled */
|
|
||||||
|
|
||||||
/* From PuTTY misc.c */
|
/* From PuTTY misc.c */
|
||||||
static int toint(unsigned u)
|
static int toint(unsigned u)
|
||||||
{
|
{
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user