dropbear: keyimport.c comparison

comparison keyimport.c @ 1914:f978a15194ba

Remove commented ssh.com code from keyimport

author	Matt Johnston <matt@ucc.asn.au>
date	Wed, 30 Mar 2022 10:10:15 +0800
parents	38c6fd7d7a82
children

comparison

equal deleted inserted replaced

-:38c6fd7d7a82
+:f978a15194ba
 /*
 * Based on PuTTY's import.c for importing/exporting OpenSSH and SSH.com
 * keyfiles.
 *
-* Modifications copyright 2003 Matt Johnston
+* Modifications copyright 2003-2022 Matt Johnston
 *
 * PuTTY is copyright 1997-2003 Simon Tatham.
 *
 * Portions copyright Robert de Bath, Joris van Rantwijk, Delian
 * Delchev, Andreas Schultz, Jeroen Massar, Wez Furlong, Nicolas Barry,
 		buf_burn_free(extrablob);
 	}
 	return ret;
 }
-#if 0
-/* XXX TODO ssh.com stuff isn't going yet */
-/* ----------------------------------------------------------------------
-* Code to read ssh.com private keys.
-*/
-/*
-* The format of the base64 blob is largely ssh2-packet-formatted,
-* except that mpints are a bit different: they're more like the
-* old ssh1 mpint. You have a 32-bit bit count N, followed by
-* (N+7)/8 bytes of data.
-*
-* So. The blob contains:
-*
-*  - uint32 0x3f6ff9eb	   (magic number)
-*  - uint32 size			 (total blob size)
-*  - string key-type		 (see below)
-*  - string cipher-type	  (tells you if key is encrypted)
-*  - string encrypted-blob
-*
-* (The first size field includes the size field itself and the
-* magic number before it. All other size fields are ordinary ssh2
-* strings, so the size field indicates how much data is to
-* _follow_.)
-*
-* The encrypted blob, once decrypted, contains a single string
-* which in turn contains the payload. (This allows padding to be
-* added after that string while still making it clear where the
-* real payload ends. Also it probably makes for a reasonable
-* decryption check.)
-*
-* The payload blob, for an RSA key, contains:
-*  - mpint e
-*  - mpint d
-*  - mpint n  (yes, the public and private stuff is intermixed)
-*  - mpint u  (presumably inverse of p mod q)
-*  - mpint p  (p is the smaller prime)
-*  - mpint q  (q is the larger)
-*
-* For a DSA key, the payload blob contains:
-*  - uint32 0
-*  - mpint p
-*  - mpint g
-*  - mpint q
-*  - mpint y
-*  - mpint x
-*
-* Alternatively, if the parameters are `predefined', that
-* (0,p,g,q) sequence can be replaced by a uint32 1 and a string
-* containing some predefined parameter specification. *shudder*,
-* but I doubt we'll encounter this in real life.
-*
-* The key type strings are ghastly. The RSA key I looked at had a
-* type string of
-*
-*   `if-modn{sign{rsa-pkcs1-sha1},encrypt{rsa-pkcs1v2-oaep}}'
-*
-* and the DSA key wasn't much better:
-*
-*   `dl-modp{sign{dsa-nist-sha1},dh{plain}}'
-*
-* It isn't clear that these will always be the same. I think it
-* might be wise just to look at the `if-modn{sign{rsa' and
-* `dl-modp{sign{dsa' prefixes.
-*
-* Finally, the encryption. The cipher-type string appears to be
-* either `none' or `3des-cbc'. Looks as if this is SSH2-style
-* 3des-cbc (i.e. outer cbc rather than inner). The key is created
-* from the passphrase by means of yet another hashing faff:
-*
-*  - first 16 bytes are MD5(passphrase)
-*  - next 16 bytes are MD5(passphrase || first 16 bytes)
-*  - if there were more, they'd be MD5(passphrase || first 32),
-*	and so on.
-*/
-#define SSHCOM_MAGIC_NUMBER 0x3f6ff9eb
-struct sshcom_key {
-	char comment[256];				 /* allowing any length is overkill */
-	unsigned char *keyblob;
-	int keyblob_len, keyblob_size;
-};
-static struct sshcom_key *load_sshcom_key(const char *filename)
-{
-	struct sshcom_key *ret;
-	FILE *fp;
-	char buffer[256];
-	int len;
-	char *errmsg, *p;
-	int headers_done;
-	char base64_bit[4];
-	int base64_chars = 0;
-	ret = snew(struct sshcom_key);
-	ret->comment[0] = '\0';
-	ret->keyblob = NULL;
-	ret->keyblob_len = ret->keyblob_size = 0;
-	fp = fopen(filename, "r");
-	if (!fp) {
-		errmsg = "Unable to open key file";
-		goto error;
-	}
-	if (!fgets(buffer, sizeof(buffer), fp) ||
-		0 != strcmp(buffer, "---- BEGIN SSH2 ENCRYPTED PRIVATE KEY ----\n")) {
-		errmsg = "File does not begin with ssh.com key header";
-		goto error;
-	}
-	headers_done = 0;
-	while (1) {
-		if (!fgets(buffer, sizeof(buffer), fp)) {
-			errmsg = "Unexpected end of file";
-			goto error;
-		}
-		if (!strcmp(buffer, "---- END SSH2 ENCRYPTED PRIVATE KEY ----\n"))
-			break;					 /* done */
-		if ((p = strchr(buffer, ':')) != NULL) {
-			if (headers_done) {
-				errmsg = "Header found in body of key data";
-				goto error;
-			}
-			*p++ = '\0';
-			while (*p && isspace((unsigned char)*p)) p++;
-			/*
-			 * Header lines can end in a trailing backslash for
-			 * continuation.
-			 */
-			while ((len = strlen(p)) > (int)(sizeof(buffer) - (p-buffer) -1) ||
-				   p[len-1] != '\n' || p[len-2] == '\\') {
-				if (len > (int)((p-buffer) + sizeof(buffer)-2)) {
-					errmsg = "Header line too long to deal with";
-					goto error;
-				}
-				if (!fgets(p+len-2, sizeof(buffer)-(p-buffer)-(len-2), fp)) {
-					errmsg = "Unexpected end of file";
-					goto error;
-				}
-			}
-			p[strcspn(p, "\n")] = '\0';
-			if (!strcmp(buffer, "Comment")) {
-				/* Strip quotes in comment if present. */
-				if (p[0] == '"' && p[strlen(p)-1] == '"') {
-					p++;
-					p[strlen(p)-1] = '\0';
-				}
-				strncpy(ret->comment, p, sizeof(ret->comment));
-				ret->comment[sizeof(ret->comment)-1] = '\0';
-			}
-		} else {
-			headers_done = 1;
-			p = buffer;
-			while (isbase64(*p)) {
-				base64_bit[base64_chars++] = *p;
-				if (base64_chars == 4) {
-					unsigned char out[3];
-					base64_chars = 0;
-					len = base64_decode_atom(base64_bit, out);
-					if (len <= 0) {
-						errmsg = "Invalid base64 encoding";
-						goto error;
-					}
-					if (ret->keyblob_len + len > ret->keyblob_size) {
-						ret->keyblob_size = ret->keyblob_len + len + 256;
-						ret->keyblob = sresize(ret->keyblob, ret->keyblob_size,
-											   unsigned char);
-					}
-					memcpy(ret->keyblob + ret->keyblob_len, out, len);
-					ret->keyblob_len += len;
-				}
-				p++;
-			}
-		}
-	}
-	if (ret->keyblob_len == 0 || !ret->keyblob) {
-		errmsg = "Key body not present";
-		goto error;
-	}
-	return ret;
-	error:
-	if (ret) {
-		if (ret->keyblob) {
-			memset(ret->keyblob, 0, ret->keyblob_size);
-			m_free(ret->keyblob);
-		}
-		memset(ret, 0, sizeof(*ret));
-		m_free(ret);
-	}
-	return NULL;
-}
-int sshcom_encrypted(const char *filename, char **comment)
-{
-	struct sshcom_key *key = load_sshcom_key(filename);
-	int pos, len, answer;
-	*comment = NULL;
-	if (!key)
-		return 0;
-	/*
-	 * Check magic number.
-	 */
-	if (GET_32BIT(key->keyblob) != 0x3f6ff9eb)
-		return 0;					  /* key is invalid */
-	/*
-	 * Find the cipher-type string.
-	 */
-	answer = 0;
-	pos = 8;
-	if (key->keyblob_len < pos+4)
-		goto done;					 /* key is far too short */
-	len = toint(GET_32BIT(key->keyblob + pos));
-	if (len < 0 || len > key->keyblob_len - pos - 4)
-		goto done;					 /* key is far too short */
-	pos += 4 + len;                    /* skip key type */
-	len = toint(GET_32BIT(key->keyblob + pos)); /* find cipher-type length */
-	if (len < 0 || len > key->keyblob_len - pos - 4)
-		goto done;					 /* cipher type string is incomplete */
-	if (len != 4 || 0 != memcmp(key->keyblob + pos + 4, "none", 4))
-		answer = 1;
-	done:
-	*comment = dupstr(key->comment);
-	memset(key->keyblob, 0, key->keyblob_size);
-	m_free(key->keyblob);
-	memset(key, 0, sizeof(*key));
-	m_free(key);
-	return answer;
-}
-static int sshcom_read_mpint(void *data, int len, struct mpint_pos *ret)
-{
-	unsigned bits, bytes;
-	unsigned char *d = (unsigned char *) data;
-	if (len < 4)
-		goto error;
-	bits = GET_32BIT(d);
-	bytes = (bits + 7) / 8;
-	if (len < 4+bytes)
-		goto error;
-	ret->start = d + 4;
-	ret->bytes = bytes;
-	return bytes+4;
-	error:
-	ret->start = NULL;
-	ret->bytes = -1;
-	return len;						/* ensure further calls fail as well */
-}
-static int sshcom_put_mpint(void *target, void *data, int len)
-{
-	unsigned char *d = (unsigned char *)target;
-	unsigned char *i = (unsigned char *)data;
-	int bits = len * 8 - 1;
-	while (bits > 0) {
-		if (*i & (1 << (bits & 7)))
-			break;
-		if (!(bits-- & 7))
-			i++, len--;
-	}
-	PUT_32BIT(d, bits+1);
-	memcpy(d+4, i, len);
-	return len+4;
-}
-sign_key *sshcom_read(const char *filename, char *passphrase)
-{
-	struct sshcom_key *key = load_sshcom_key(filename);
-	char *errmsg;
-	int pos, len;
-	const char prefix_rsa[] = "if-modn{sign{rsa";
-	const char prefix_dsa[] = "dl-modp{sign{dsa";
-	enum { RSA, DSA } type;
-	int encrypted;
-	char *ciphertext;
-	int cipherlen;
-	struct ssh2_userkey *ret = NULL, *retkey;
-	const struct ssh_signkey *alg;
-	unsigned char *blob = NULL;
-	int blobsize = 0, publen, privlen;
-	if (!key)
-		return NULL;
-	/*
-	 * Check magic number.
-	 */
-	if (GET_32BIT(key->keyblob) != SSHCOM_MAGIC_NUMBER) {
-		errmsg = "Key does not begin with magic number";
-		goto error;
-	}
-	/*
-	 * Determine the key type.
-	 */
-	pos = 8;
-	if (key->keyblob_len < pos+4 ||
-		(len = GET_32BIT(key->keyblob + pos)) > key->keyblob_len - pos - 4) {
-		errmsg = "Key blob does not contain a key type string";
-		goto error;
-	}
-	if (len > sizeof(prefix_rsa) - 1 &&
-		!memcmp(key->keyblob+pos+4, prefix_rsa, sizeof(prefix_rsa) - 1)) {
-		type = RSA;
-	} else if (len > sizeof(prefix_dsa) - 1 &&
-		!memcmp(key->keyblob+pos+4, prefix_dsa, sizeof(prefix_dsa) - 1)) {
-		type = DSA;
-	} else {
-		errmsg = "Key is of unknown type";
-		goto error;
-	}
-	pos += 4+len;
-	/*
-	 * Determine the cipher type.
-	 */
-	if (key->keyblob_len < pos+4 ||
-		(len = GET_32BIT(key->keyblob + pos)) > key->keyblob_len - pos - 4) {
-		errmsg = "Key blob does not contain a cipher type string";
-		goto error;
-	}
-	if (len == 4 && !memcmp(key->keyblob+pos+4, "none", 4))
-		encrypted = 0;
-	else if (len == 8 && !memcmp(key->keyblob+pos+4, "3des-cbc", 8))
-		encrypted = 1;
-	else {
-		errmsg = "Key encryption is of unknown type";
-		goto error;
-	}
-	pos += 4+len;
-	/*
-	 * Get hold of the encrypted part of the key.
-	 */
-	if (key->keyblob_len < pos+4 ||
-		(len = GET_32BIT(key->keyblob + pos)) > key->keyblob_len - pos - 4) {
-		errmsg = "Key blob does not contain actual key data";
-		goto error;
-	}
-	ciphertext = (char *)key->keyblob + pos + 4;
-	cipherlen = len;
-	if (cipherlen == 0) {
-		errmsg = "Length of key data is zero";
-		goto error;
-	}
-	/*
-	 * Decrypt it if necessary.
-	 */
-	if (encrypted) {
-		/*
-		 * Derive encryption key from passphrase and iv/salt:
-		 *
-		 *  - let block A equal MD5(passphrase)
-		 *  - let block B equal MD5(passphrase || A)
-		 *  - block C would be MD5(passphrase || A || B) and so on
-		 *  - encryption key is the first N bytes of A || B
-		 */
-		struct MD5Context md5c;
-		unsigned char keybuf[32], iv[8];
-		if (cipherlen % 8 != 0) {
-			errmsg = "Encrypted part of key is not a multiple of cipher block"
-				" size";
-			goto error;
-		}
-		MD5Init(&md5c);
-		MD5Update(&md5c, (unsigned char *)passphrase, strlen(passphrase));
-		MD5Final(keybuf, &md5c);
-		MD5Init(&md5c);
-		MD5Update(&md5c, (unsigned char *)passphrase, strlen(passphrase));
-		MD5Update(&md5c, keybuf, 16);
-		MD5Final(keybuf+16, &md5c);
-		/*
-		 * Now decrypt the key blob.
-		 */
-		memset(iv, 0, sizeof(iv));
-		des3_decrypt_pubkey_ossh(keybuf, iv, (unsigned char *)ciphertext,
-								 cipherlen);
-		memset(&md5c, 0, sizeof(md5c));
-		memset(keybuf, 0, sizeof(keybuf));
-		/*
-		 * Hereafter we return WRONG_PASSPHRASE for any parsing
-		 * error. (But only if we've just tried to decrypt it!
-		 * Returning WRONG_PASSPHRASE for an unencrypted key is
-		 * automatic doom.)
-		 */
-		if (encrypted)
-			ret = SSH2_WRONG_PASSPHRASE;
-	}
-	/*
-	 * Strip away the containing string to get to the real meat.
-	 */
-	len = toint(GET_32BIT(ciphertext));
-	if (len < 0 || len > cipherlen-4) {
-		errmsg = "containing string was ill-formed";
-		goto error;
-	}
-	ciphertext += 4;
-	cipherlen = len;
-	/*
-	 * Now we break down into RSA versus DSA. In either case we'll
-	 * construct public and private blobs in our own format, and
-	 * end up feeding them to alg->createkey().
-	 */
-	blobsize = cipherlen + 256;
-	blob = snewn(blobsize, unsigned char);
-	privlen = 0;
-	if (type == RSA) {
-		struct mpint_pos n, e, d, u, p, q;
-		int pos = 0;
-		pos += sshcom_read_mpint(ciphertext+pos, cipherlen-pos, &e);
-		pos += sshcom_read_mpint(ciphertext+pos, cipherlen-pos, &d);
-		pos += sshcom_read_mpint(ciphertext+pos, cipherlen-pos, &n);
-		pos += sshcom_read_mpint(ciphertext+pos, cipherlen-pos, &u);
-		pos += sshcom_read_mpint(ciphertext+pos, cipherlen-pos, &p);
-		pos += sshcom_read_mpint(ciphertext+pos, cipherlen-pos, &q);
-		if (!q.start) {
-			errmsg = "key data did not contain six integers";
-			goto error;
-		}
-		alg = &ssh_rsa;
-		pos = 0;
-		pos += put_string(blob+pos, "ssh-rsa", 7);
-		pos += put_mp(blob+pos, e.start, e.bytes);
-		pos += put_mp(blob+pos, n.start, n.bytes);
-		publen = pos;
-		pos += put_string(blob+pos, d.start, d.bytes);
-		pos += put_mp(blob+pos, q.start, q.bytes);
-		pos += put_mp(blob+pos, p.start, p.bytes);
-		pos += put_mp(blob+pos, u.start, u.bytes);
-		privlen = pos - publen;
-	} else if (type == DSA) {
-		struct mpint_pos p, q, g, x, y;
-		int pos = 4;
-		if (GET_32BIT(ciphertext) != 0) {
-			errmsg = "predefined DSA parameters not supported";
-			goto error;
-		}
-		pos += sshcom_read_mpint(ciphertext+pos, cipherlen-pos, &p);
-		pos += sshcom_read_mpint(ciphertext+pos, cipherlen-pos, &g);
-		pos += sshcom_read_mpint(ciphertext+pos, cipherlen-pos, &q);
-		pos += sshcom_read_mpint(ciphertext+pos, cipherlen-pos, &y);
-		pos += sshcom_read_mpint(ciphertext+pos, cipherlen-pos, &x);
-		if (!x.start) {
-			errmsg = "key data did not contain five integers";
-			goto error;
-		}
-		alg = &ssh_dss;
-		pos = 0;
-		pos += put_string(blob+pos, "ssh-dss", 7);
-		pos += put_mp(blob+pos, p.start, p.bytes);
-		pos += put_mp(blob+pos, q.start, q.bytes);
-		pos += put_mp(blob+pos, g.start, g.bytes);
-		pos += put_mp(blob+pos, y.start, y.bytes);
-		publen = pos;
-		pos += put_mp(blob+pos, x.start, x.bytes);
-		privlen = pos - publen;
-	} else
-		return NULL;
-	dropbear_assert(privlen > 0);			   /* should have bombed by now if not */
-	retkey = snew(struct ssh2_userkey);
-	retkey->alg = alg;
-	retkey->data = alg->createkey(blob, publen, blob+publen, privlen);
-	if (!retkey->data) {
-		m_free(retkey);
-		errmsg = "unable to create key data structure";
-		goto error;
-	}
-	retkey->comment = dupstr(key->comment);
-	errmsg = NULL; /* no error */
-	ret = retkey;
-	error:
-	if (blob) {
-		memset(blob, 0, blobsize);
-		m_free(blob);
-	}
-	memset(key->keyblob, 0, key->keyblob_size);
-	m_free(key->keyblob);
-	memset(key, 0, sizeof(*key));
-	m_free(key);
-	return ret;
-}
-int sshcom_write(const char *filename, sign_key *key,
-				 char *passphrase)
-{
-	unsigned char *pubblob, *privblob;
-	int publen, privlen;
-	unsigned char *outblob;
-	int outlen;
-	struct mpint_pos numbers[6];
-	int nnumbers, initial_zero, pos, lenpos, i;
-	char *type;
-	char *ciphertext;
-	int cipherlen;
-	int ret = 0;
-	FILE *fp;
-	/*
-	 * Fetch the key blobs.
-	 */
-	pubblob = key->alg->public_blob(key->data, &publen);
-	privblob = key->alg->private_blob(key->data, &privlen);
-	outblob = NULL;
-	/*
-	 * Find the sequence of integers to be encoded into the OpenSSH
-	 * key blob, and also decide on the header line.
-	 */
-	if (key->alg == &ssh_rsa) {
-		int pos;
-		struct mpint_pos n, e, d, p, q, iqmp;
-		pos = 4 + GET_32BIT(pubblob);
-		pos += ssh2_read_mpint(pubblob+pos, publen-pos, &e);
-		pos += ssh2_read_mpint(pubblob+pos, publen-pos, &n);
-		pos = 0;
-		pos += ssh2_read_mpint(privblob+pos, privlen-pos, &d);
-		pos += ssh2_read_mpint(privblob+pos, privlen-pos, &p);
-		pos += ssh2_read_mpint(privblob+pos, privlen-pos, &q);
-		pos += ssh2_read_mpint(privblob+pos, privlen-pos, &iqmp);
-		dropbear_assert(e.start && iqmp.start); /* can't go wrong */
-		numbers[0] = e;
-		numbers[1] = d;
-		numbers[2] = n;
-		numbers[3] = iqmp;
-		numbers[4] = q;
-		numbers[5] = p;
-		nnumbers = 6;
-		initial_zero = 0;
-		type = "if-modn{sign{rsa-pkcs1-sha1},encrypt{rsa-pkcs1v2-oaep}}";
-	} else if (key->alg == &ssh_dss) {
-		int pos;
-		struct mpint_pos p, q, g, y, x;
-		pos = 4 + GET_32BIT(pubblob);
-		pos += ssh2_read_mpint(pubblob+pos, publen-pos, &p);
-		pos += ssh2_read_mpint(pubblob+pos, publen-pos, &q);
-		pos += ssh2_read_mpint(pubblob+pos, publen-pos, &g);
-		pos += ssh2_read_mpint(pubblob+pos, publen-pos, &y);
-		pos = 0;
-		pos += ssh2_read_mpint(privblob+pos, privlen-pos, &x);
-		dropbear_assert(y.start && x.start); /* can't go wrong */
-		numbers[0] = p;
-		numbers[1] = g;
-		numbers[2] = q;
-		numbers[3] = y;
-		numbers[4] = x;
-		nnumbers = 5;
-		initial_zero = 1;
-		type = "dl-modp{sign{dsa-nist-sha1},dh{plain}}";
-	} else {
-		dropbear_assert(0);					 /* zoinks! */
-	}
-	/*
-	 * Total size of key blob will be somewhere under 512 plus
-	 * combined length of integers. We'll calculate the more
-	 * precise size as we construct the blob.
-	 */
-	outlen = 512;
-	for (i = 0; i < nnumbers; i++)
-		outlen += 4 + numbers[i].bytes;
-	outblob = snewn(outlen, unsigned char);
-	/*
-	 * Create the unencrypted key blob.
-	 */
-	pos = 0;
-	PUT_32BIT(outblob+pos, SSHCOM_MAGIC_NUMBER); pos += 4;
-	pos += 4;							   /* length field, fill in later */
-	pos += put_string(outblob+pos, type, strlen(type));
-	{
-		char *ciphertype = passphrase ? "3des-cbc" : "none";
-		pos += put_string(outblob+pos, ciphertype, strlen(ciphertype));
-	}
-	lenpos = pos;					   /* remember this position */
-	pos += 4;							   /* encrypted-blob size */
-	pos += 4;							   /* encrypted-payload size */
-	if (initial_zero) {
-		PUT_32BIT(outblob+pos, 0);
-		pos += 4;
-	}
-	for (i = 0; i < nnumbers; i++)
-		pos += sshcom_put_mpint(outblob+pos,
-								numbers[i].start, numbers[i].bytes);
-	/* Now wrap up the encrypted payload. */
-	PUT_32BIT(outblob+lenpos+4, pos - (lenpos+8));
-	/* Pad encrypted blob to a multiple of cipher block size. */
-	if (passphrase) {
-		int padding = -(pos - (lenpos+4)) & 7;
-		while (padding--)
-			outblob[pos++] = random_byte();
-	}
-	ciphertext = (char *)outblob+lenpos+4;
-	cipherlen = pos - (lenpos+4);
-	dropbear_assert(!passphrase || cipherlen % 8 == 0);
-	/* Wrap up the encrypted blob string. */
-	PUT_32BIT(outblob+lenpos, cipherlen);
-	/* And finally fill in the total length field. */
-	PUT_32BIT(outblob+4, pos);
-	dropbear_assert(pos < outlen);
-	/*
-	 * Encrypt the key.
-	 */
-	if (passphrase) {
-		/*
-		 * Derive encryption key from passphrase and iv/salt:
-		 *
-		 *  - let block A equal MD5(passphrase)
-		 *  - let block B equal MD5(passphrase || A)
-		 *  - block C would be MD5(passphrase || A || B) and so on
-		 *  - encryption key is the first N bytes of A || B
-		 */
-		struct MD5Context md5c;
-		unsigned char keybuf[32], iv[8];
-		MD5Init(&md5c);
-		MD5Update(&md5c, (unsigned char *)passphrase, strlen(passphrase));
-		MD5Final(keybuf, &md5c);
-		MD5Init(&md5c);
-		MD5Update(&md5c, (unsigned char *)passphrase, strlen(passphrase));
-		MD5Update(&md5c, keybuf, 16);
-		MD5Final(keybuf+16, &md5c);
-		/*
-		 * Now decrypt the key blob.
-		 */
-		memset(iv, 0, sizeof(iv));
-		des3_encrypt_pubkey_ossh(keybuf, iv, (unsigned char *)ciphertext,
-								 cipherlen);
-		memset(&md5c, 0, sizeof(md5c));
-		memset(keybuf, 0, sizeof(keybuf));
-	}
-	/*
-	 * And save it. We'll use Unix line endings just in case it's
-	 * subsequently transferred in binary mode.
-	 */
-	fp = fopen(filename, "wb");	  /* ensure Unix line endings */
-	if (!fp)
-		goto error;
-	fputs("---- BEGIN SSH2 ENCRYPTED PRIVATE KEY ----\n", fp);
-	fprintf(fp, "Comment: \"");
-	/*
-	 * Comment header is broken with backslash-newline if it goes
-	 * over 70 chars. Although it's surrounded by quotes, it
-	 * _doesn't_ escape backslashes or quotes within the string.
-	 * Don't ask me, I didn't design it.
-	 */
-	{
-		int slen = 60;					   /* starts at 60 due to "Comment: " */
-		char *c = key->comment;
-		while ((int)strlen(c) > slen) {
-			fprintf(fp, "%.*s\\\n", slen, c);
-			c += slen;
-			slen = 70;					   /* allow 70 chars on subsequent lines */
-		}
-		fprintf(fp, "%s\"\n", c);
-	}
-	base64_encode_fp(fp, outblob, pos, 70);
-	fputs("---- END SSH2 ENCRYPTED PRIVATE KEY ----\n", fp);
-	fclose(fp);
-	ret = 1;
-	error:
-	if (outblob) {
-		memset(outblob, 0, outlen);
-		m_free(outblob);
-	}
-	if (privblob) {
-		memset(privblob, 0, privlen);
-		m_free(privblob);
-	}
-	if (pubblob) {
-		memset(pubblob, 0, publen);
-		m_free(pubblob);
-	}
-	return ret;
-}
-#endif /* ssh.com stuff disabled */
 /* From PuTTY misc.c */
 static int toint(unsigned u)
 {
 	/*
 	 * Convert an unsigned to an int, without running into the

Mercurial > dropbear

comparison keyimport.c @ 1914:f978a15194ba