summaryrefslogtreecommitdiff
path: root/usr/src
diff options
context:
space:
mode:
Diffstat (limited to 'usr/src')
-rw-r--r--usr/src/cmd/ssh/include/config.h9
-rw-r--r--usr/src/cmd/ssh/libssh/Makefile.com2
-rw-r--r--usr/src/cmd/ssh/libssh/common/authfd.c21
-rw-r--r--usr/src/cmd/ssh/libssh/common/scard-opensc.c464
-rw-r--r--usr/src/cmd/ssh/libssh/common/scard.c559
-rw-r--r--usr/src/cmd/ssh/ssh-add/ssh-add.c49
-rw-r--r--usr/src/cmd/ssh/ssh-agent/ssh-agent.c100
-rw-r--r--usr/src/cmd/ssh/ssh-keygen/ssh-keygen.c84
-rw-r--r--usr/src/cmd/ssh/ssh/ssh.c35
9 files changed, 4 insertions, 1319 deletions
diff --git a/usr/src/cmd/ssh/include/config.h b/usr/src/cmd/ssh/include/config.h
index a39e446859..c5f9f49eab 100644
--- a/usr/src/cmd/ssh/include/config.h
+++ b/usr/src/cmd/ssh/include/config.h
@@ -406,18 +406,9 @@ extern "C" {
/* Define on *nto-qnx systems */
/* #undef MISSING_FD_MASK */
-/* Define if you want smartcard support */
-/* #undef SMARTCARD */
-
-/* Define if you want smartcard support using sectok */
-/* #undef USE_SECTOK */
-
/* Use libedit for sftp */
#undef USE_LIBEDIT
-/* Define if you want smartcard support using OpenSC */
-/* #undef USE_OPENSC */
-
/* Define if you want to use OpenSSL's internally seeded PRNG only */
#define OPENSSL_PRNG_ONLY 1
diff --git a/usr/src/cmd/ssh/libssh/Makefile.com b/usr/src/cmd/ssh/libssh/Makefile.com
index ebae4e0bcb..ad8e0c8676 100644
--- a/usr/src/cmd/ssh/libssh/Makefile.com
+++ b/usr/src/cmd/ssh/libssh/Makefile.com
@@ -70,8 +70,6 @@ OBJECTS = \
entropy.o \
readpass.o \
rsa.o \
- scard.o \
- scard-opensc.o \
ssh-dss.o \
ssh-gss.o \
ssh-rsa.o \
diff --git a/usr/src/cmd/ssh/libssh/common/authfd.c b/usr/src/cmd/ssh/libssh/common/authfd.c
index 71df5cf0e7..0239ec4d67 100644
--- a/usr/src/cmd/ssh/libssh/common/authfd.c
+++ b/usr/src/cmd/ssh/libssh/common/authfd.c
@@ -37,8 +37,6 @@
#include "includes.h"
RCSID("$OpenBSD: authfd.c,v 1.57 2002/09/11 18:27:26 stevesk Exp $");
-#pragma ident "%Z%%M% %I% %E% SMI"
-
#include <openssl/evp.h>
#include "ssh.h"
@@ -588,25 +586,6 @@ ssh_remove_identity(AuthenticationConnection *auth, Key *key)
return decode_reply(type);
}
-int
-ssh_update_card(AuthenticationConnection *auth, int add, const char *reader_id, const char *pin)
-{
- Buffer msg;
- int type;
-
- buffer_init(&msg);
- buffer_put_char(&msg, add ? SSH_AGENTC_ADD_SMARTCARD_KEY :
- SSH_AGENTC_REMOVE_SMARTCARD_KEY);
- buffer_put_cstring(&msg, reader_id);
- buffer_put_cstring(&msg, pin);
- if (ssh_request_reply(auth, &msg, &msg) == 0) {
- buffer_free(&msg);
- return 0;
- }
- type = buffer_get_char(&msg);
- buffer_free(&msg);
- return decode_reply(type);
-}
/*
* Removes all identities from the agent. This call is not meant to be used
diff --git a/usr/src/cmd/ssh/libssh/common/scard-opensc.c b/usr/src/cmd/ssh/libssh/common/scard-opensc.c
deleted file mode 100644
index 2aa04e126f..0000000000
--- a/usr/src/cmd/ssh/libssh/common/scard-opensc.c
+++ /dev/null
@@ -1,464 +0,0 @@
-/*
- * Copyright (c) 2002 Juha Yrjölä. All rights reserved.
- * Copyright (c) 2001 Markus Friedl.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-#if defined(SMARTCARD) && defined(USE_OPENSC)
-
-#include <openssl/evp.h>
-#include <openssl/x509.h>
-
-#include <opensc/opensc.h>
-#include <opensc/pkcs15.h>
-
-#include "key.h"
-#include "log.h"
-#include "xmalloc.h"
-#include "readpass.h"
-#include "scard.h"
-
-#if OPENSSL_VERSION_NUMBER < 0x00907000L && defined(CRYPTO_LOCK_ENGINE)
-#define USE_ENGINE
-#define RSA_get_default_method RSA_get_default_openssl_method
-#else
-#endif
-
-#ifdef USE_ENGINE
-#include <openssl/engine.h>
-#define sc_get_rsa sc_get_engine
-#else
-#define sc_get_rsa sc_get_rsa_method
-#endif
-
-static int sc_reader_id;
-static sc_context_t *ctx = NULL;
-static sc_card_t *card = NULL;
-static sc_pkcs15_card_t *p15card = NULL;
-
-static char *sc_pin = NULL;
-
-struct sc_priv_data
-{
- struct sc_pkcs15_id cert_id;
- int ref_count;
-};
-
-void
-sc_close(void)
-{
- if (p15card) {
- sc_pkcs15_unbind(p15card);
- p15card = NULL;
- }
- if (card) {
- sc_disconnect_card(card, 0);
- card = NULL;
- }
- if (ctx) {
- sc_release_context(ctx);
- ctx = NULL;
- }
-}
-
-static int
-sc_init(void)
-{
- int r;
-
- r = sc_establish_context(&ctx, "openssh");
- if (r)
- goto err;
- r = sc_connect_card(ctx->reader[sc_reader_id], 0, &card);
- if (r)
- goto err;
- r = sc_pkcs15_bind(card, &p15card);
- if (r)
- goto err;
- return 0;
-err:
- sc_close();
- return r;
-}
-
-/* private key operations */
-
-static int
-sc_prkey_op_init(RSA *rsa, struct sc_pkcs15_object **key_obj_out)
-{
- int r;
- struct sc_priv_data *priv;
- struct sc_pkcs15_object *key_obj;
- struct sc_pkcs15_prkey_info *key;
- struct sc_pkcs15_object *pin_obj;
- struct sc_pkcs15_pin_info *pin;
-
- priv = (struct sc_priv_data *) RSA_get_app_data(rsa);
- if (priv == NULL)
- return -1;
- if (p15card == NULL) {
- sc_close();
- r = sc_init();
- if (r) {
- error("SmartCard init failed: %s", sc_strerror(r));
- goto err;
- }
- }
- r = sc_pkcs15_find_prkey_by_id(p15card, &priv->cert_id, &key_obj);
- if (r) {
- error("Unable to find private key from SmartCard: %s",
- sc_strerror(r));
- goto err;
- }
- key = key_obj->data;
- r = sc_pkcs15_find_pin_by_auth_id(p15card, &key_obj->auth_id,
- &pin_obj);
- if (r) {
- error("Unable to find PIN object from SmartCard: %s",
- sc_strerror(r));
- goto err;
- }
- pin = pin_obj->data;
- r = sc_lock(card);
- if (r) {
- error("Unable to lock smartcard: %s", sc_strerror(r));
- goto err;
- }
- if (sc_pin != NULL) {
- r = sc_pkcs15_verify_pin(p15card, pin, sc_pin,
- strlen(sc_pin));
- if (r) {
- sc_unlock(card);
- error("PIN code verification failed: %s",
- sc_strerror(r));
- goto err;
- }
- }
- *key_obj_out = key_obj;
- return 0;
-err:
- sc_close();
- return -1;
-}
-
-static int
-sc_private_decrypt(int flen, u_char *from, u_char *to, RSA *rsa,
- int padding)
-{
- struct sc_pkcs15_object *key_obj;
- int r;
-
- if (padding != RSA_PKCS1_PADDING)
- return -1;
- r = sc_prkey_op_init(rsa, &key_obj);
- if (r)
- return -1;
- r = sc_pkcs15_decipher(p15card, key_obj, 0, from, flen, to, flen);
- sc_unlock(card);
- if (r < 0) {
- error("sc_pkcs15_decipher() failed: %s", sc_strerror(r));
- goto err;
- }
- return r;
-err:
- sc_close();
- return -1;
-}
-
-static int
-sc_sign(int type, u_char *m, unsigned int m_len,
- unsigned char *sigret, unsigned int *siglen, RSA *rsa)
-{
- struct sc_pkcs15_object *key_obj;
- int r;
- unsigned long flags = 0;
-
- r = sc_prkey_op_init(rsa, &key_obj);
- if (r)
- return -1;
- /* FIXME: length of sigret correct? */
- /* FIXME: check 'type' and modify flags accordingly */
- flags = SC_ALGORITHM_RSA_PAD_PKCS1 | SC_ALGORITHM_RSA_HASH_SHA1;
- r = sc_pkcs15_compute_signature(p15card, key_obj, flags,
- m, m_len, sigret, RSA_size(rsa));
- sc_unlock(card);
- if (r < 0) {
- error("sc_pkcs15_compute_signature() failed: %s",
- sc_strerror(r));
- goto err;
- }
- *siglen = r;
- return 1;
-err:
- sc_close();
- return 0;
-}
-
-static int
-sc_private_encrypt(int flen, u_char *from, u_char *to, RSA *rsa,
- int padding)
-{
- error("Private key encryption not supported");
- return -1;
-}
-
-/* called on free */
-
-static int (*orig_finish)(RSA *rsa) = NULL;
-
-static int
-sc_finish(RSA *rsa)
-{
- struct sc_priv_data *priv;
-
- priv = RSA_get_app_data(rsa);
- priv->ref_count--;
- if (priv->ref_count == 0) {
- free(priv);
- sc_close();
- }
- if (orig_finish)
- orig_finish(rsa);
- return 1;
-}
-
-/* engine for overloading private key operations */
-
-static RSA_METHOD *
-sc_get_rsa_method(void)
-{
- static RSA_METHOD smart_rsa;
- const RSA_METHOD *def = RSA_get_default_method();
-
- /* use the OpenSSL version */
- memcpy(&smart_rsa, def, sizeof(smart_rsa));
-
- smart_rsa.name = "opensc";
-
- /* overload */
- smart_rsa.rsa_priv_enc = sc_private_encrypt;
- smart_rsa.rsa_priv_dec = sc_private_decrypt;
- smart_rsa.rsa_sign = sc_sign;
-
- /* save original */
- orig_finish = def->finish;
- smart_rsa.finish = sc_finish;
-
- return &smart_rsa;
-}
-
-#ifdef USE_ENGINE
-static ENGINE *
-sc_get_engine(void)
-{
- static ENGINE *smart_engine = NULL;
-
- if ((smart_engine = ENGINE_new()) == NULL)
- fatal("ENGINE_new failed");
-
- ENGINE_set_id(smart_engine, "opensc");
- ENGINE_set_name(smart_engine, "OpenSC");
-
- ENGINE_set_RSA(smart_engine, sc_get_rsa_method());
- ENGINE_set_DSA(smart_engine, DSA_get_default_openssl_method());
- ENGINE_set_DH(smart_engine, DH_get_default_openssl_method());
- ENGINE_set_RAND(smart_engine, RAND_SSLeay());
- ENGINE_set_BN_mod_exp(smart_engine, BN_mod_exp);
-
- return smart_engine;
-}
-#endif
-
-static void
-convert_rsa_to_rsa1(Key * in, Key * out)
-{
- struct sc_priv_data *priv;
-
- out->rsa->flags = in->rsa->flags;
- out->flags = in->flags;
- RSA_set_method(out->rsa, RSA_get_method(in->rsa));
- BN_copy(out->rsa->n, in->rsa->n);
- BN_copy(out->rsa->e, in->rsa->e);
- priv = RSA_get_app_data(in->rsa);
- priv->ref_count++;
- RSA_set_app_data(out->rsa, priv);
- return;
-}
-
-static int
-sc_read_pubkey(Key * k, const struct sc_pkcs15_object *cert_obj)
-{
- int r;
- sc_pkcs15_cert_t *cert = NULL;
- struct sc_priv_data *priv = NULL;
- sc_pkcs15_cert_info_t *cinfo = cert_obj->data;
-
- X509 *x509 = NULL;
- EVP_PKEY *pubkey = NULL;
- u8 *p;
- char *tmp;
-
- debug("sc_read_pubkey() with cert id %02X", cinfo->id.value[0]);
- r = sc_pkcs15_read_certificate(p15card, cinfo, &cert);
- if (r) {
- log("Certificate read failed: %s", sc_strerror(r));
- goto err;
- }
- x509 = X509_new();
- if (x509 == NULL) {
- r = -1;
- goto err;
- }
- p = cert->data;
- if (!d2i_X509(&x509, &p, cert->data_len)) {
- log("Unable to parse X.509 certificate");
- r = -1;
- goto err;
- }
- sc_pkcs15_free_certificate(cert);
- cert = NULL;
- pubkey = X509_get_pubkey(x509);
- X509_free(x509);
- x509 = NULL;
- if (pubkey->type != EVP_PKEY_RSA) {
- log("Public key is of unknown type");
- r = -1;
- goto err;
- }
- k->rsa = EVP_PKEY_get1_RSA(pubkey);
- EVP_PKEY_free(pubkey);
-
- k->rsa->flags |= RSA_FLAG_SIGN_VER;
- RSA_set_method(k->rsa, sc_get_rsa_method());
- priv = xmalloc(sizeof(struct sc_priv_data));
- priv->cert_id = cinfo->id;
- priv->ref_count = 1;
- RSA_set_app_data(k->rsa, priv);
-
- k->flags = KEY_FLAG_EXT;
- tmp = key_fingerprint(k, SSH_FP_MD5, SSH_FP_HEX);
- debug("fingerprint %d %s", key_size(k), tmp);
- xfree(tmp);
-
- return 0;
-err:
- if (cert)
- sc_pkcs15_free_certificate(cert);
- if (pubkey)
- EVP_PKEY_free(pubkey);
- if (x509)
- X509_free(x509);
- return r;
-}
-
-Key **
-sc_get_keys(const char *id, const char *pin)
-{
- Key *k, **keys;
- int i, r, real_count = 0, key_count;
- sc_pkcs15_id_t cert_id;
- sc_pkcs15_object_t *certs[32];
- char *buf = xstrdup(id), *p;
-
- debug("sc_get_keys called: id = %s", id);
-
- if (sc_pin != NULL)
- xfree(sc_pin);
- sc_pin = (pin == NULL) ? NULL : xstrdup(pin);
-
- cert_id.len = 0;
- if ((p = strchr(buf, ':')) != NULL) {
- *p = 0;
- p++;
- sc_pkcs15_hex_string_to_id(p, &cert_id);
- }
- r = sscanf(buf, "%d", &sc_reader_id);
- xfree(buf);
- if (r != 1)
- goto err;
- if (p15card == NULL) {
- sc_close();
- r = sc_init();
- if (r) {
- error("Smartcard init failed: %s", sc_strerror(r));
- goto err;
- }
- }
- if (cert_id.len) {
- r = sc_pkcs15_find_cert_by_id(p15card, &cert_id, &certs[0]);
- if (r < 0)
- goto err;
- key_count = 1;
- } else {
- r = sc_pkcs15_get_objects(p15card, SC_PKCS15_TYPE_CERT_X509,
- certs, 32);
- if (r == 0) {
- log("No certificates found on smartcard");
- r = -1;
- goto err;
- } else if (r < 0) {
- error("Certificate enumeration failed: %s",
- sc_strerror(r));
- goto err;
- }
- key_count = r;
- }
- /* FIXME: only keep entries with a corresponding private key */
- keys = xmalloc(sizeof(Key *) * (key_count*2+1));
- for (i = 0; i < key_count; i++) {
- k = key_new(KEY_RSA);
- if (k == NULL)
- break;
- r = sc_read_pubkey(k, certs[i]);
- if (r) {
- error("sc_read_pubkey failed: %s", sc_strerror(r));
- key_free(k);
- continue;
- }
- keys[real_count] = k;
- real_count++;
- k = key_new(KEY_RSA1);
- if (k == NULL)
- break;
- convert_rsa_to_rsa1(keys[real_count-1], k);
- keys[real_count] = k;
- real_count++;
- }
- keys[real_count] = NULL;
-
- return keys;
-err:
- sc_close();
- return NULL;
-}
-
-int
-sc_put_key(Key *prv, const char *id)
-{
- error("key uploading not yet supported");
- return -1;
-}
-
-#endif /* SMARTCARD */
-
-#pragma ident "%Z%%M% %I% %E% SMI"
diff --git a/usr/src/cmd/ssh/libssh/common/scard.c b/usr/src/cmd/ssh/libssh/common/scard.c
deleted file mode 100644
index fbce861733..0000000000
--- a/usr/src/cmd/ssh/libssh/common/scard.c
+++ /dev/null
@@ -1,559 +0,0 @@
-/*
- * Copyright (c) 2001 Markus Friedl. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-#if defined(SMARTCARD) && defined(USE_SECTOK)
-RCSID("$OpenBSD: scard.c,v 1.26 2002/06/23 03:30:17 deraadt Exp $");
-
-#pragma ident "%Z%%M% %I% %E% SMI"
-
-#include <openssl/evp.h>
-#include <sectok.h>
-
-#include "key.h"
-#include "log.h"
-#include "xmalloc.h"
-#include "readpass.h"
-#include "scard.h"
-
-#if OPENSSL_VERSION_NUMBER < 0x00907000L
-#define USE_ENGINE
-#define RSA_get_default_method RSA_get_default_openssl_method
-#else
-#endif
-
-#ifdef USE_ENGINE
-#include <openssl/engine.h>
-#define sc_get_rsa sc_get_engine
-#else
-#define sc_get_rsa sc_get_rsa_method
-#endif
-
-#define CLA_SSH 0x05
-#define INS_DECRYPT 0x10
-#define INS_GET_KEYLENGTH 0x20
-#define INS_GET_PUBKEY 0x30
-#define INS_GET_RESPONSE 0xc0
-
-#define MAX_BUF_SIZE 256
-
-u_char DEFAUT0[] = {0xad, 0x9f, 0x61, 0xfe, 0xfa, 0x20, 0xce, 0x63};
-
-static int sc_fd = -1;
-static char *sc_reader_id = NULL;
-static char *sc_pin = NULL;
-static int cla = 0x00; /* class */
-
-static void sc_mk_digest(const char *pin, u_char *digest);
-static int get_AUT0(u_char *aut0);
-static int try_AUT0(void);
-
-/* interface to libsectok */
-
-static int
-sc_open(void)
-{
- int sw;
-
- if (sc_fd >= 0)
- return sc_fd;
-
- sc_fd = sectok_friendly_open(sc_reader_id, STONOWAIT, &sw);
- if (sc_fd < 0) {
- error("sectok_open failed: %s", sectok_get_sw(sw));
- return SCARD_ERROR_FAIL;
- }
- if (! sectok_cardpresent(sc_fd)) {
- debug("smartcard in reader %s not present, skipping",
- sc_reader_id);
- sc_close();
- return SCARD_ERROR_NOCARD;
- }
- if (sectok_reset(sc_fd, 0, NULL, &sw) <= 0) {
- error("sectok_reset failed: %s", sectok_get_sw(sw));
- sc_fd = -1;
- return SCARD_ERROR_FAIL;
- }
- if ((cla = cyberflex_inq_class(sc_fd)) < 0)
- cla = 0;
-
- debug("sc_open ok %d", sc_fd);
- return sc_fd;
-}
-
-static int
-sc_enable_applet(void)
-{
- static u_char aid[] = {0xfc, 0x53, 0x73, 0x68, 0x2e, 0x62, 0x69, 0x6e};
- int sw = 0;
-
- /* select applet id */
- sectok_apdu(sc_fd, cla, 0xa4, 0x04, 0, sizeof aid, aid, 0, NULL, &sw);
- if (!sectok_swOK(sw)) {
- error("sectok_apdu failed: %s", sectok_get_sw(sw));
- sc_close();
- return -1;
- }
- return 0;
-}
-
-static int
-sc_init(void)
-{
- int status;
-
- status = sc_open();
- if (status == SCARD_ERROR_NOCARD) {
- return SCARD_ERROR_NOCARD;
- }
- if (status < 0 ) {
- error("sc_open failed");
- return status;
- }
- if (sc_enable_applet() < 0) {
- error("sc_enable_applet failed");
- return SCARD_ERROR_APPLET;
- }
- return 0;
-}
-
-static int
-sc_read_pubkey(Key * k)
-{
- u_char buf[2], *n;
- char *p;
- int len, sw, status = -1;
-
- len = sw = 0;
- n = NULL;
-
- if (sc_fd < 0) {
- if (sc_init() < 0)
- goto err;
- }
-
- /* get key size */
- sectok_apdu(sc_fd, CLA_SSH, INS_GET_KEYLENGTH, 0, 0, 0, NULL,
- sizeof(buf), buf, &sw);
- if (!sectok_swOK(sw)) {
- error("could not obtain key length: %s", sectok_get_sw(sw));
- goto err;
- }
- len = (buf[0] << 8) | buf[1];
- len /= 8;
- debug("INS_GET_KEYLENGTH: len %d sw %s", len, sectok_get_sw(sw));
-
- n = xmalloc(len);
- /* get n */
- sectok_apdu(sc_fd, CLA_SSH, INS_GET_PUBKEY, 0, 0, 0, NULL, len, n, &sw);
-
- if (sw == 0x6982) {
- if (try_AUT0() < 0)
- goto err;
- sectok_apdu(sc_fd, CLA_SSH, INS_GET_PUBKEY, 0, 0, 0, NULL, len, n, &sw);
- }
- if (!sectok_swOK(sw)) {
- error("could not obtain public key: %s", sectok_get_sw(sw));
- goto err;
- }
-
- debug("INS_GET_KEYLENGTH: sw %s", sectok_get_sw(sw));
-
- if (BN_bin2bn(n, len, k->rsa->n) == NULL) {
- error("c_read_pubkey: BN_bin2bn failed");
- goto err;
- }
-
- /* currently the java applet just stores 'n' */
- if (!BN_set_word(k->rsa->e, 35)) {
- error("c_read_pubkey: BN_set_word(e, 35) failed");
- goto err;
- }
-
- status = 0;
- p = key_fingerprint(k, SSH_FP_MD5, SSH_FP_HEX);
- debug("fingerprint %u %s", key_size(k), p);
- xfree(p);
-
-err:
- if (n != NULL)
- xfree(n);
- sc_close();
- return status;
-}
-
-/* private key operations */
-
-static int
-sc_private_decrypt(int flen, u_char *from, u_char *to, RSA *rsa,
- int padding)
-{
- u_char *padded = NULL;
- int sw, len, olen, status = -1;
-
- debug("sc_private_decrypt called");
-
- olen = len = sw = 0;
- if (sc_fd < 0) {
- status = sc_init();
- if (status < 0 )
- goto err;
- }
- if (padding != RSA_PKCS1_PADDING)
- goto err;
-
- len = BN_num_bytes(rsa->n);
- padded = xmalloc(len);
-
- sectok_apdu(sc_fd, CLA_SSH, INS_DECRYPT, 0, 0, len, from, len, padded, &sw);
-
- if (sw == 0x6982) {
- if (try_AUT0() < 0)
- goto err;
- sectok_apdu(sc_fd, CLA_SSH, INS_DECRYPT, 0, 0, len, from, len, padded, &sw);
- }
- if (!sectok_swOK(sw)) {
- error("sc_private_decrypt: INS_DECRYPT failed: %s",
- sectok_get_sw(sw));
- goto err;
- }
- olen = RSA_padding_check_PKCS1_type_2(to, len, padded + 1, len - 1,
- len);
-err:
- if (padded)
- xfree(padded);
- sc_close();
- return (olen >= 0 ? olen : status);
-}
-
-static int
-sc_private_encrypt(int flen, u_char *from, u_char *to, RSA *rsa,
- int padding)
-{
- u_char *padded = NULL;
- int sw, len, status = -1;
-
- len = sw = 0;
- if (sc_fd < 0) {
- status = sc_init();
- if (status < 0 )
- goto err;
- }
- if (padding != RSA_PKCS1_PADDING)
- goto err;
-
- debug("sc_private_encrypt called");
- len = BN_num_bytes(rsa->n);
- padded = xmalloc(len);
-
- if (RSA_padding_add_PKCS1_type_1(padded, len, (u_char *)from, flen) <= 0) {
- error("RSA_padding_add_PKCS1_type_1 failed");
- goto err;
- }
- sectok_apdu(sc_fd, CLA_SSH, INS_DECRYPT, 0, 0, len, padded, len, to, &sw);
- if (sw == 0x6982) {
- if (try_AUT0() < 0)
- goto err;
- sectok_apdu(sc_fd, CLA_SSH, INS_DECRYPT, 0, 0, len, padded, len, to, &sw);
- }
- if (!sectok_swOK(sw)) {
- error("sc_private_encrypt: INS_DECRYPT failed: %s",
- sectok_get_sw(sw));
- goto err;
- }
-err:
- if (padded)
- xfree(padded);
- sc_close();
- return (len >= 0 ? len : status);
-}
-
-/* called on free */
-
-static int (*orig_finish)(RSA *rsa) = NULL;
-
-static int
-sc_finish(RSA *rsa)
-{
- if (orig_finish)
- orig_finish(rsa);
- sc_close();
- return 1;
-}
-
-/* engine for overloading private key operations */
-
-static RSA_METHOD *
-sc_get_rsa_method(void)
-{
- static RSA_METHOD smart_rsa;
- const RSA_METHOD *def = RSA_get_default_method();
-
- /* use the OpenSSL version */
- memcpy(&smart_rsa, def, sizeof(smart_rsa));
-
- smart_rsa.name = "sectok";
-
- /* overload */
- smart_rsa.rsa_priv_enc = sc_private_encrypt;
- smart_rsa.rsa_priv_dec = sc_private_decrypt;
-
- /* save original */
- orig_finish = def->finish;
- smart_rsa.finish = sc_finish;
-
- return &smart_rsa;
-}
-
-#ifdef USE_ENGINE
-static ENGINE *
-sc_get_engine(void)
-{
- static ENGINE *smart_engine = NULL;
-
- if ((smart_engine = ENGINE_new()) == NULL)
- fatal("ENGINE_new failed");
-
- ENGINE_set_id(smart_engine, "sectok");
- ENGINE_set_name(smart_engine, "libsectok");
-
- ENGINE_set_RSA(smart_engine, sc_get_rsa_method());
- ENGINE_set_DSA(smart_engine, DSA_get_default_openssl_method());
- ENGINE_set_DH(smart_engine, DH_get_default_openssl_method());
- ENGINE_set_RAND(smart_engine, RAND_SSLeay());
- ENGINE_set_BN_mod_exp(smart_engine, BN_mod_exp);
-
- return smart_engine;
-}
-#endif
-
-void
-sc_close(void)
-{
- if (sc_fd >= 0) {
- sectok_close(sc_fd);
- sc_fd = -1;
- }
-}
-
-Key **
-sc_get_keys(const char *id, const char *pin)
-{
- Key *k, *n, **keys;
- int status, nkeys = 2;
-
- if (sc_reader_id != NULL)
- xfree(sc_reader_id);
- sc_reader_id = xstrdup(id);
-
- if (sc_pin != NULL)
- xfree(sc_pin);
- sc_pin = (pin == NULL) ? NULL : xstrdup(pin);
-
- k = key_new(KEY_RSA);
- if (k == NULL) {
- return NULL;
- }
- status = sc_read_pubkey(k);
- if (status == SCARD_ERROR_NOCARD) {
- key_free(k);
- return NULL;
- }
- if (status < 0 ) {
- error("sc_read_pubkey failed");
- key_free(k);
- return NULL;
- }
- keys = xmalloc((nkeys+1) * sizeof(Key *));
-
- n = key_new(KEY_RSA1);
- BN_copy(n->rsa->n, k->rsa->n);
- BN_copy(n->rsa->e, k->rsa->e);
- RSA_set_method(n->rsa, sc_get_rsa());
- n->flags |= KEY_FLAG_EXT;
- keys[0] = n;
-
- n = key_new(KEY_RSA);
- BN_copy(n->rsa->n, k->rsa->n);
- BN_copy(n->rsa->e, k->rsa->e);
- RSA_set_method(n->rsa, sc_get_rsa());
- n->flags |= KEY_FLAG_EXT;
- keys[1] = n;
-
- keys[2] = NULL;
-
- key_free(k);
- return keys;
-}
-
-#define NUM_RSA_KEY_ELEMENTS 5+1
-#define COPY_RSA_KEY(x, i) \
- do { \
- len = BN_num_bytes(prv->rsa->x); \
- elements[i] = xmalloc(len); \
- debug("#bytes %d", len); \
- if (BN_bn2bin(prv->rsa->x, elements[i]) < 0) \
- goto done; \
- } while (0)
-
-static void
-sc_mk_digest(const char *pin, u_char *digest)
-{
- const EVP_MD *evp_md = EVP_sha1();
- EVP_MD_CTX md;
-
- EVP_DigestInit(&md, evp_md);
- EVP_DigestUpdate(&md, pin, strlen(pin));
- EVP_DigestFinal(&md, digest, NULL);
-}
-
-static int
-get_AUT0(u_char *aut0)
-{
- char *pass;
-
- pass = read_passphrase("Enter passphrase for smartcard: ", RP_ALLOW_STDIN);
- if (pass == NULL)
- return -1;
- if (!strcmp(pass, "-")) {
- memcpy(aut0, DEFAUT0, sizeof DEFAUT0);
- return 0;
- }
- sc_mk_digest(pass, aut0);
- memset(pass, 0, strlen(pass));
- xfree(pass);
- return 0;
-}
-
-static int
-try_AUT0(void)
-{
- u_char aut0[EVP_MAX_MD_SIZE];
-
- /* permission denied; try PIN if provided */
- if (sc_pin && strlen(sc_pin) > 0) {
- sc_mk_digest(sc_pin, aut0);
- if (cyberflex_verify_AUT0(sc_fd, cla, aut0, 8) < 0) {
- error("smartcard passphrase incorrect");
- return (-1);
- }
- } else {
- /* try default AUT0 key */
- if (cyberflex_verify_AUT0(sc_fd, cla, DEFAUT0, 8) < 0) {
- /* default AUT0 key failed; prompt for passphrase */
- if (get_AUT0(aut0) < 0 ||
- cyberflex_verify_AUT0(sc_fd, cla, aut0, 8) < 0) {
- error("smartcard passphrase incorrect");
- return (-1);
- }
- }
- }
- return (0);
-}
-
-int
-sc_put_key(Key *prv, const char *id)
-{
- u_char *elements[NUM_RSA_KEY_ELEMENTS];
- u_char key_fid[2];
- u_char AUT0[EVP_MAX_MD_SIZE];
- int len, status = -1, i, fd = -1, ret;
- int sw = 0, cla = 0x00;
-
- for (i = 0; i < NUM_RSA_KEY_ELEMENTS; i++)
- elements[i] = NULL;
-
- COPY_RSA_KEY(q, 0);
- COPY_RSA_KEY(p, 1);
- COPY_RSA_KEY(iqmp, 2);
- COPY_RSA_KEY(dmq1, 3);
- COPY_RSA_KEY(dmp1, 4);
- COPY_RSA_KEY(n, 5);
- len = BN_num_bytes(prv->rsa->n);
- fd = sectok_friendly_open(id, STONOWAIT, &sw);
- if (fd < 0) {
- error("sectok_open failed: %s", sectok_get_sw(sw));
- goto done;
- }
- if (! sectok_cardpresent(fd)) {
- error("smartcard in reader %s not present", id);
- goto done;
- }
- ret = sectok_reset(fd, 0, NULL, &sw);
- if (ret <= 0) {
- error("sectok_reset failed: %s", sectok_get_sw(sw));
- goto done;
- }
- if ((cla = cyberflex_inq_class(fd)) < 0) {
- error("cyberflex_inq_class failed");
- goto done;
- }
- memcpy(AUT0, DEFAUT0, sizeof(DEFAUT0));
- if (cyberflex_verify_AUT0(fd, cla, AUT0, sizeof(DEFAUT0)) < 0) {
- if (get_AUT0(AUT0) < 0 ||
- cyberflex_verify_AUT0(fd, cla, AUT0, sizeof(DEFAUT0)) < 0) {
- memset(AUT0, 0, sizeof(DEFAUT0));
- error("smartcard passphrase incorrect");
- goto done;
- }
- }
- memset(AUT0, 0, sizeof(DEFAUT0));
- key_fid[0] = 0x00;
- key_fid[1] = 0x12;
- if (cyberflex_load_rsa_priv(fd, cla, key_fid, 5, 8*len, elements,
- &sw) < 0) {
- error("cyberflex_load_rsa_priv failed: %s", sectok_get_sw(sw));
- goto done;
- }
- if (!sectok_swOK(sw))
- goto done;
- log("cyberflex_load_rsa_priv done");
- key_fid[0] = 0x73;
- key_fid[1] = 0x68;
- if (cyberflex_load_rsa_pub(fd, cla, key_fid, len, elements[5],
- &sw) < 0) {
- error("cyberflex_load_rsa_pub failed: %s", sectok_get_sw(sw));
- goto done;
- }
- if (!sectok_swOK(sw))
- goto done;
- log("cyberflex_load_rsa_pub done");
- status = 0;
-
-done:
- memset(elements[0], '\0', BN_num_bytes(prv->rsa->q));
- memset(elements[1], '\0', BN_num_bytes(prv->rsa->p));
- memset(elements[2], '\0', BN_num_bytes(prv->rsa->iqmp));
- memset(elements[3], '\0', BN_num_bytes(prv->rsa->dmq1));
- memset(elements[4], '\0', BN_num_bytes(prv->rsa->dmp1));
- memset(elements[5], '\0', BN_num_bytes(prv->rsa->n));
-
- for (i = 0; i < NUM_RSA_KEY_ELEMENTS; i++)
- if (elements[i])
- xfree(elements[i]);
- if (fd != -1)
- sectok_close(fd);
- return (status);
-}
-#endif /* SMARTCARD && USE_SECTOK */
diff --git a/usr/src/cmd/ssh/ssh-add/ssh-add.c b/usr/src/cmd/ssh/ssh-add/ssh-add.c
index d6b9d532ce..cfa1ce320e 100644
--- a/usr/src/cmd/ssh/ssh-add/ssh-add.c
+++ b/usr/src/cmd/ssh/ssh-add/ssh-add.c
@@ -1,5 +1,5 @@
/*
- * Copyright 2004 Sun Microsystems, Inc. All rights reserved.
+ * Copyright 2008 Sun Microsystems, Inc. All rights reserved.
* Use is subject to license terms.
*/
/*
@@ -41,8 +41,6 @@
#include "includes.h"
RCSID("$OpenBSD: ssh-add.c,v 1.63 2002/09/19 15:51:23 markus Exp $");
-#pragma ident "%Z%%M% %I% %E% SMI"
-
#include <openssl/evp.h>
#include "ssh.h"
@@ -196,28 +194,6 @@ add_file(AuthenticationConnection *ac, const char *filename)
return ret;
}
-#ifdef SMARTCARD
-static int
-update_card(AuthenticationConnection *ac, int add, const char *id)
-{
- char *pin;
-
- pin = read_passphrase("Enter passphrase for smartcard: ", RP_ALLOW_STDIN);
- if (pin == NULL)
- return -1;
-
- if (ssh_update_card(ac, add, id, pin)) {
- fprintf(stderr, "Card %s: %s\n",
- add ? "added" : "removed", id);
- return 0;
- } else {
- fprintf(stderr, "Could not %s card: %s\n",
- add ? "add" : "remove", id);
- return -1;
- }
-}
-#endif /* SMARTCARD */
-
static int
list_identities(AuthenticationConnection *ac, int do_fp)
{
@@ -315,10 +291,6 @@ usage(void)
" -x Lock agent.\n"
" -X Unlock agent.\n"
" -t life Set lifetime (seconds) when adding identities.\n"
-#ifdef SMARTCARD
- " -s reader Add key in smartcard reader.\n"
- " -e reader Remove key in smartcard reader.\n"
-#endif /* SMARTCARD */
), __progname);
}
@@ -328,9 +300,6 @@ main(int argc, char **argv)
extern char *optarg;
extern int optind;
AuthenticationConnection *ac = NULL;
-#ifdef SMARTCARD
- char *sc_reader_id = NULL;
-#endif /* SMARTCARD */
int i, ch, deleting = 0, ret = 0;
__progname = get_progname(argv[0]);
@@ -371,15 +340,6 @@ main(int argc, char **argv)
ret = 1;
goto done;
break;
-#ifdef SMARTCARD
- case 's':
- sc_reader_id = optarg;
- break;
- case 'e':
- deleting = 1;
- sc_reader_id = optarg;
- break;
-#endif /* SMARTCARD */
case 't':
if ((lifetime = convtime(optarg)) == -1) {
fprintf(stderr, gettext("Invalid lifetime\n"));
@@ -395,13 +355,6 @@ main(int argc, char **argv)
}
argc -= optind;
argv += optind;
-#ifdef SMARTCARD
- if (sc_reader_id != NULL) {
- if (update_card(ac, !deleting, sc_reader_id) == -1)
- ret = 1;
- goto done;
- }
-#endif /* SMARTCARD */
if (argc == 0) {
char buf[MAXPATHLEN];
struct passwd *pw;
diff --git a/usr/src/cmd/ssh/ssh-agent/ssh-agent.c b/usr/src/cmd/ssh/ssh-agent/ssh-agent.c
index ae398f9b8e..883b88022b 100644
--- a/usr/src/cmd/ssh/ssh-agent/ssh-agent.c
+++ b/usr/src/cmd/ssh/ssh-agent/ssh-agent.c
@@ -1,5 +1,5 @@
/*
- * Copyright 2004 Sun Microsystems, Inc. All rights reserved.
+ * Copyright 2008 Sun Microsystems, Inc. All rights reserved.
* Use is subject to license terms.
*/
@@ -42,8 +42,6 @@
#include "sys-queue.h"
RCSID("$OpenBSD: ssh-agent.c,v 1.105 2002/10/01 20:34:12 markus Exp $");
-#pragma ident "%Z%%M% %I% %E% SMI"
-
#ifdef HAVE_SOLARIS_PRIVILEGE
#include <priv.h>
#endif /* HAVE_SOLARIS_PRIVILEGE */
@@ -62,10 +60,6 @@ RCSID("$OpenBSD: ssh-agent.c,v 1.105 2002/10/01 20:34:12 markus Exp $");
#include "compat.h"
#include "log.h"
-#ifdef SMARTCARD
-#include "scard.h"
-#endif
-
typedef enum {
AUTH_UNUSED,
AUTH_SOCKET,
@@ -539,90 +533,6 @@ no_identities(SocketEntry *e, u_int type)
buffer_free(&msg);
}
-#ifdef SMARTCARD
-static void
-process_add_smartcard_key (SocketEntry *e)
-{
- char *sc_reader_id = NULL, *pin;
- int i, version, success = 0;
- Key **keys, *k;
- Identity *id;
- Idtab *tab;
-
- sc_reader_id = buffer_get_string(&e->request, NULL);
- pin = buffer_get_string(&e->request, NULL);
- keys = sc_get_keys(sc_reader_id, pin);
- xfree(sc_reader_id);
- xfree(pin);
-
- if (keys == NULL || keys[0] == NULL) {
- error("sc_get_keys failed");
- goto send;
- }
- for (i = 0; keys[i] != NULL; i++) {
- k = keys[i];
- version = k->type == KEY_RSA1 ? 1 : 2;
- tab = idtab_lookup(version);
- if (lookup_identity(k, version) == NULL) {
- id = xmalloc(sizeof(Identity));
- id->key = k;
- id->comment = xstrdup("smartcard key");
- id->death = 0;
- TAILQ_INSERT_TAIL(&tab->idlist, id, next);
- tab->nentries++;
- success = 1;
- } else {
- key_free(k);
- }
- keys[i] = NULL;
- }
- xfree(keys);
-send:
- buffer_put_int(&e->output, 1);
- buffer_put_char(&e->output,
- success ? SSH_AGENT_SUCCESS : SSH_AGENT_FAILURE);
-}
-
-static void
-process_remove_smartcard_key(SocketEntry *e)
-{
- char *sc_reader_id = NULL, *pin;
- int i, version, success = 0;
- Key **keys, *k = NULL;
- Identity *id;
- Idtab *tab;
-
- sc_reader_id = buffer_get_string(&e->request, NULL);
- pin = buffer_get_string(&e->request, NULL);
- keys = sc_get_keys(sc_reader_id, pin);
- xfree(sc_reader_id);
- xfree(pin);
-
- if (keys == NULL || keys[0] == NULL) {
- error("sc_get_keys failed");
- goto send;
- }
- for (i = 0; keys[i] != NULL; i++) {
- k = keys[i];
- version = k->type == KEY_RSA1 ? 1 : 2;
- if ((id = lookup_identity(k, version)) != NULL) {
- tab = idtab_lookup(version);
- TAILQ_REMOVE(&tab->idlist, id, next);
- tab->nentries--;
- free_identity(id);
- success = 1;
- }
- key_free(k);
- keys[i] = NULL;
- }
- xfree(keys);
-send:
- buffer_put_int(&e->output, 1);
- buffer_put_char(&e->output,
- success ? SSH_AGENT_SUCCESS : SSH_AGENT_FAILURE);
-}
-#endif /* SMARTCARD */
-
/* dispatch incoming messages */
static void
@@ -709,14 +619,6 @@ process_message(SocketEntry *e)
case SSH2_AGENTC_REMOVE_ALL_IDENTITIES:
process_remove_all_identities(e, 2);
break;
-#ifdef SMARTCARD
- case SSH_AGENTC_ADD_SMARTCARD_KEY:
- process_add_smartcard_key(e);
- break;
- case SSH_AGENTC_REMOVE_SMARTCARD_KEY:
- process_remove_smartcard_key(e);
- break;
-#endif /* SMARTCARD */
default:
/* Unknown message. Respond with failure. */
error("Unknown message %d", type);
diff --git a/usr/src/cmd/ssh/ssh-keygen/ssh-keygen.c b/usr/src/cmd/ssh/ssh-keygen/ssh-keygen.c
index 29b47a0ecd..5d49c7fceb 100644
--- a/usr/src/cmd/ssh/ssh-keygen/ssh-keygen.c
+++ b/usr/src/cmd/ssh/ssh-keygen/ssh-keygen.c
@@ -13,8 +13,6 @@
/* $OpenBSD: ssh-keygen.c,v 1.160 2007/01/21 01:41:54 stevesk Exp $ */
-#pragma ident "%Z%%M% %I% %E% SMI"
-
#include "includes.h"
#include <openssl/evp.h>
#include <openssl/pem.h>
@@ -35,10 +33,6 @@
#include "hostfile.h"
#include "tildexpand.h"
-#ifdef SMARTCARD
-#include "scard.h"
-#endif
-
/* Number of bits in the RSA/DSA key. This value can be set on the command line. */
u_int32_t bits = 1024;
@@ -433,52 +427,6 @@ do_print_public(struct passwd *pw)
exit(0);
}
-#ifdef SMARTCARD
-static void
-do_upload(struct passwd *pw, const char *sc_reader_id)
-{
- Key *prv = NULL;
- struct stat st;
- int ret;
-
- if (!have_identity)
- ask_filename(pw, gettext("Enter file in which the key is"));
- if (stat(identity_file, &st) < 0) {
- perror(identity_file);
- exit(1);
- }
- prv = load_identity(identity_file);
- if (prv == NULL) {
- error("load failed");
- exit(1);
- }
- ret = sc_put_key(prv, sc_reader_id);
- key_free(prv);
- if (ret < 0)
- exit(1);
- log("loading key done");
- exit(0);
-}
-
-static void
-do_download(struct passwd *pw, const char *sc_reader_id)
-{
- Key **keys = NULL;
- int i;
-
- keys = sc_get_keys(sc_reader_id, NULL);
- if (keys == NULL)
- fatal("cannot read public key from smartcard");
- for (i = 0; keys[i]; i++) {
- key_write(keys[i], stdout);
- key_free(keys[i]);
- fprintf(stdout, "\n");
- }
- xfree(keys);
- exit(0);
-}
-#endif /* SMARTCARD */
-
static void
do_fingerprint(struct passwd *pw)
{
@@ -967,9 +915,6 @@ usage(void)
" -B Show bubblebabble digest of key file.\n"
" -c Change comment in private and public key files.\n"
" -C comment Provide new comment.\n"
-#ifdef SMARTCARD
- " -D reader Download public key from smartcard.\n"
-#endif /* SMARTCARD */
" -e Convert OpenSSH to IETF SECSH key file.\n"
" -f filename Filename of the key file.\n"
" -F hostname Find hostname in known hosts file.\n"
@@ -982,9 +927,6 @@ usage(void)
" -q Quiet.\n"
" -R hostname Remove host from known_hosts file.\n"
" -t type Specify type of key to create.\n"
-#ifdef SMARTCARD
- " -U reader Upload private key to smartcard.\n"
-#endif /* SMARTCARD */
" -y Read private key file and print public key.\n"
), __progname);
@@ -998,15 +940,11 @@ int
main(int argc, char **argv)
{
char dotsshdir[MAXPATHLEN], comment[1024], *passphrase1, *passphrase2;
- char *reader_id = NULL;
char *rr_hostname = NULL;
Key *private, *public;
struct passwd *pw;
struct stat st;
int opt, type, fd;
-#ifdef SMARTCARD
- int download = 0;
-#endif /* SMARTCARD */
FILE *f;
extern int optind;
@@ -1034,11 +972,8 @@ main(int argc, char **argv)
exit(1);
}
-#ifdef SMARTCARD
-#define GETOPT_ARGS "deiqpclBHRxXyb:f:F:t:U:D:P:N:C:"
-#else
#define GETOPT_ARGS "BcdeHilpqxXyb:C:f:F:N:P:R:t:"
-#endif /* SMARTCARD */
+
while ((opt = getopt(argc, argv, GETOPT_ARGS)) != -1) {
switch (opt) {
case 'b':
@@ -1106,13 +1041,6 @@ main(int argc, char **argv)
case 't':
key_type_name = optarg;
break;
-#ifdef SMARTCARD
- case 'D':
- download = 1;
- case 'U':
- reader_id = optarg;
- break;
-#endif
case '?':
default:
usage();
@@ -1140,16 +1068,6 @@ main(int argc, char **argv)
do_convert_from_ssh2(pw);
if (print_public)
do_print_public(pw);
- if (reader_id != NULL) {
-#ifdef SMARTCARD
- if (download)
- do_download(pw, reader_id);
- else
- do_upload(pw, reader_id);
-#else /* SMARTCARD */
- fatal("no support for smartcards.");
-#endif /* SMARTCARD */
- }
arc4random_stir();
diff --git a/usr/src/cmd/ssh/ssh/ssh.c b/usr/src/cmd/ssh/ssh/ssh.c
index 2d594250d9..f951618428 100644
--- a/usr/src/cmd/ssh/ssh/ssh.c
+++ b/usr/src/cmd/ssh/ssh/ssh.c
@@ -74,10 +74,6 @@ RCSID("$OpenBSD: ssh.c,v 1.186 2002/09/19 01:58:18 djm Exp $");
#include "g11n.h"
-#ifdef SMARTCARD
-#include "scard.h"
-#endif
-
#ifdef HAVE___PROGNAME
extern char *__progname;
#else
@@ -176,9 +172,6 @@ usage(void)
" -x Disable X11 connection forwarding (default).\n"
" -i file Identity for public key authentication "
"(default: ~/.ssh/identity)\n"
-#ifdef SMARTCARD
- " -I reader Set smartcard reader.\n"
-#endif
" -t Tty; allocate a tty even if command is given.\n"
" -T Do not allocate a tty.\n"
" -v Verbose; display verbose debugging messages.\n"
@@ -356,11 +349,7 @@ again:
xstrdup(optarg);
break;
case 'I':
-#ifdef SMARTCARD
- options.smartcard_device = xstrdup(optarg);
-#else
fprintf(stderr, "no support for smartcards.\n");
-#endif
break;
case 't':
if (tty_flag)
@@ -1178,29 +1167,7 @@ load_public_identity_files(void)
char *filename;
int i = 0;
Key *public;
-#ifdef SMARTCARD
- Key **keys;
-
- if (options.smartcard_device != NULL &&
- options.num_identity_files < SSH_MAX_IDENTITY_FILES &&
- (keys = sc_get_keys(options.smartcard_device, NULL)) != NULL ) {
- int count = 0;
- for (i = 0; keys[i] != NULL; i++) {
- count++;
- memmove(&options.identity_files[1], &options.identity_files[0],
- sizeof(char *) * (SSH_MAX_IDENTITY_FILES - 1));
- memmove(&options.identity_keys[1], &options.identity_keys[0],
- sizeof(Key *) * (SSH_MAX_IDENTITY_FILES - 1));
- options.num_identity_files++;
- options.identity_keys[0] = keys[i];
- options.identity_files[0] = xstrdup("smartcard key");;
- }
- if (options.num_identity_files > SSH_MAX_IDENTITY_FILES)
- options.num_identity_files = SSH_MAX_IDENTITY_FILES;
- i = count;
- xfree(keys);
- }
-#endif /* SMARTCARD */
+
for (; i < options.num_identity_files; i++) {
filename = tilde_expand_filename(options.identity_files[i],
original_real_uid);
generated by cgit v1.2.3 (git 2.39.1) at 2025-05-19 07:01:37 +0000