4 files changed, 140 insertions, 121 deletions

diff --git a/ChangeLog b/ChangeLog
index eceef2214..9edeb08cf 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -118,6 +118,12 @@
    - markus@cvs.openbsd.org 2002/03/21 16:38:06
      [scard.c]
      make compile w/ openssl 0.9.7
+   - markus@cvs.openbsd.org 2002/03/21 16:54:53
+     [scard.c scard.h ssh-keygen.c]
+     move key upload to scard.[ch]
+   - markus@cvs.openbsd.org 2002/03/21 16:57:15
+     [scard.c]
+     remove const
 
 20020317
  - (tim) [configure.ac] Assume path given with --with-pid-dir=PATH is wanted,
@@ -7964,4 +7970,4 @@
  - Wrote replacements for strlcpy and mkdtemp
  - Released 1.0pre1
 
-$Id: ChangeLog,v 1.1958 2002/03/22 03:28:11 mouring Exp $
+$Id: ChangeLog,v 1.1959 2002/03/22 03:33:43 mouring Exp $
diff --git a/scard.c b/scard.c
index 1d54df86f..7bd72d8ec 100644
--- a/scard.c
+++ b/scard.c
@@ -24,15 +24,16 @@
 
 #include "includes.h"
 #ifdef SMARTCARD
-RCSID("$OpenBSD: scard.c,v 1.18 2002/03/21 16:38:06 markus Exp $");
-
+RCSID("$OpenBSD: scard.c,v 1.20 2002/03/21 16:57:15 markus Exp $");
 #include <openssl/engine.h>
+#include <openssl/evp.h>
 #include <sectok.h>
 
 #include "key.h"
 #include "log.h"
 #include "xmalloc.h"
 #include "scard.h"
+#include "readpass.h"
 
 #ifdef OPENSSL_VERSION_NUMBER
 #if OPENSSL_VERSION_NUMBER >= 0x00907000L
@@ -187,7 +188,7 @@ err:
 /* private key operations */
 
 static int
-sc_private_decrypt(int flen, const u_char *from, u_char *to, RSA *rsa,
+sc_private_decrypt(int flen, u_char *from, u_char *to, RSA *rsa,
     int padding)
 {
         u_char *padded = NULL;
@@ -231,7 +232,7 @@ err:
 }
 
 static int
-sc_private_encrypt(int flen, const u_char *from, u_char *to, RSA *rsa,
+sc_private_encrypt(int flen, u_char *from, u_char *to, RSA *rsa,
     int padding)
 {
         u_char *padded = NULL;
@@ -363,4 +364,117 @@ sc_get_key(const char *id)
         }
         return k;
 }
+
+#define NUM_RSA_KEY_ELEMENTS 5+1
+#define COPY_RSA_KEY(x, i) \
+        do { \
+                len = BN_num_bytes(prv->rsa->x); \
+                elements[i] = xmalloc(len); \
+                debug("#bytes %d", len); \
+                if (BN_bn2bin(prv->rsa->x, elements[i]) < 0) \
+                        goto done; \
+        } while (0)
+
+static int
+get_AUT0(char *aut0)
+{
+        const EVP_MD *evp_md = EVP_sha1();
+        EVP_MD_CTX md;
+        char *pass;
+
+        pass = read_passphrase("Enter passphrase for smartcard: ", RP_ALLOW_STDIN);
+        if (pass == NULL)
+                return -1;
+        EVP_DigestInit(&md, evp_md);
+        EVP_DigestUpdate(&md, pass, strlen(pass));
+        EVP_DigestFinal(&md, aut0, NULL);
+        memset(pass, 0, strlen(pass));
+        xfree(pass);
+        return 0;
+}
+
+int
+sc_put_key(Key *prv, const char *id)
+{
+        u_char *elements[NUM_RSA_KEY_ELEMENTS];
+        u_char key_fid[2];
+        u_char DEFAUT0[] = {0xad, 0x9f, 0x61, 0xfe, 0xfa, 0x20, 0xce, 0x63};
+        u_char AUT0[EVP_MAX_MD_SIZE];
+        int len, status = -1, i, fd = -1, ret;
+        int sw = 0, cla = 0x00;
+
+        for (i = 0; i < NUM_RSA_KEY_ELEMENTS; i++)
+                elements[i] = NULL;
+
+        COPY_RSA_KEY(q, 0);
+        COPY_RSA_KEY(p, 1);
+        COPY_RSA_KEY(iqmp, 2);
+        COPY_RSA_KEY(dmq1, 3);
+        COPY_RSA_KEY(dmp1, 4);
+        COPY_RSA_KEY(n, 5);
+        len = BN_num_bytes(prv->rsa->n);
+        fd = sectok_friendly_open(sc_reader_id, STONOWAIT, &sw);
+        if (fd < 0) {
+                error("sectok_open failed: %s", sectok_get_sw(sw));
+                goto done;
+        }
+        if (! sectok_cardpresent(fd)) {
+                error("smartcard in reader %s not present",
+                    sc_reader_id);
+                goto done;
+        }
+        ret = sectok_reset(fd, 0, NULL, &sw);
+        if (ret <= 0) {
+                error("sectok_reset failed: %s", sectok_get_sw(sw));
+                goto done;
+        }
+        if ((cla = cyberflex_inq_class(fd)) < 0) {
+                error("cyberflex_inq_class failed");
+                goto done;
+        }
+        memcpy(AUT0, DEFAUT0, sizeof(DEFAUT0));
+        if (cyberflex_verify_AUT0(fd, cla, AUT0, sizeof(DEFAUT0)) < 0) {
+                if (get_AUT0(AUT0) < 0 ||
+                    cyberflex_verify_AUT0(fd, cla, AUT0, sizeof(DEFAUT0)) < 0) {
+                        error("cyberflex_verify_AUT0 failed");
+                        goto done;
+                }
+        }
+        key_fid[0] = 0x00;
+        key_fid[1] = 0x12;
+        if (cyberflex_load_rsa_priv(fd, cla, key_fid, 5, 8*len, elements,
+            &sw) < 0) {
+                error("cyberflex_load_rsa_priv failed: %s", sectok_get_sw(sw));
+                goto done;
+        }
+        if (!sectok_swOK(sw))
+                goto done;
+        log("cyberflex_load_rsa_priv done");
+        key_fid[0] = 0x73;
+        key_fid[1] = 0x68;
+        if (cyberflex_load_rsa_pub(fd, cla, key_fid, len, elements[5],
+            &sw) < 0) {
+                error("cyberflex_load_rsa_pub failed: %s", sectok_get_sw(sw));
+                goto done;
+        }
+        if (!sectok_swOK(sw))
+                goto done;
+        log("cyberflex_load_rsa_pub done");
+        status = 0;
+
+done:
+        memset(elements[0], '\0', BN_num_bytes(prv->rsa->q));
+        memset(elements[1], '\0', BN_num_bytes(prv->rsa->p));
+        memset(elements[2], '\0', BN_num_bytes(prv->rsa->iqmp));
+        memset(elements[3], '\0', BN_num_bytes(prv->rsa->dmq1));
+        memset(elements[4], '\0', BN_num_bytes(prv->rsa->dmp1));
+        memset(elements[5], '\0', BN_num_bytes(prv->rsa->n));
+
+        for (i = 0; i < NUM_RSA_KEY_ELEMENTS; i++)
+                if (elements[i])
+                        xfree(elements[i]);
+        if (fd != -1)
+                sectok_close(fd);
+        return (status);
+}
 #endif /* SMARTCARD */
diff --git a/scard.h b/scard.h
index 6ca99169b..c46eae1be 100644
--- a/scard.h
+++ b/scard.h
@@ -1,4 +1,4 @@
-/*      $OpenBSD: scard.h,v 1.7 2002/03/04 17:27:39 stevesk Exp $       */
+/*      $OpenBSD: scard.h,v 1.8 2002/03/21 16:54:53 markus Exp $        */
 
 /*
  * Copyright (c) 2001 Markus Friedl.  All rights reserved.
@@ -29,6 +29,8 @@
 #ifndef SCARD_H
 #define SCARD_H
 
+#include "key.h"
+
 #define SCARD_ERROR_FAIL        -1
 #define SCARD_ERROR_NOCARD      -2
 #define SCARD_ERROR_APPLET      -3
@@ -36,5 +38,6 @@
 Key     *sc_get_key(const char*);
 ENGINE  *sc_get_engine(void);
 void     sc_close(void);
+int      sc_put_key(Key *, const char*);
 
 #endif
diff --git a/ssh-keygen.c b/ssh-keygen.c
index 2de87167e..d14c99004 100644
--- a/ssh-keygen.c
+++ b/ssh-keygen.c
@@ -12,7 +12,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: ssh-keygen.c,v 1.94 2002/02/25 16:33:27 markus Exp $");
+RCSID("$OpenBSD: ssh-keygen.c,v 1.95 2002/03/21 16:54:53 markus Exp $");
 
 #include <openssl/evp.h>
 #include <openssl/pem.h>
@@ -29,8 +29,6 @@ RCSID("$OpenBSD: ssh-keygen.c,v 1.94 2002/02/25 16:33:27 markus Exp $");
 #include "readpass.h"
 
 #ifdef SMARTCARD
-#include <sectok.h>
-#include <openssl/engine.h>
 #include "scard.h"
 #endif
 
@@ -389,132 +387,30 @@ do_print_public(struct passwd *pw)
 }
 
 #ifdef SMARTCARD
-#define NUM_RSA_KEY_ELEMENTS 5+1
-#define COPY_RSA_KEY(x, i) \
-        do { \
-                len = BN_num_bytes(prv->rsa->x); \
-                elements[i] = xmalloc(len); \
-                debug("#bytes %d", len); \
-                if (BN_bn2bin(prv->rsa->x, elements[i]) < 0) \
-                        goto done; \
-        } while (0)
-
-static int
-get_AUT0(char *aut0)
-{
-        EVP_MD *evp_md = EVP_sha1();
-        EVP_MD_CTX md;
-        char *pass;
-
-        pass = read_passphrase("Enter passphrase for smartcard: ", RP_ALLOW_STDIN);
-        if (pass == NULL)
-                return -1;
-        EVP_DigestInit(&md, evp_md);
-        EVP_DigestUpdate(&md, pass, strlen(pass));
-        EVP_DigestFinal(&md, aut0, NULL);
-        memset(pass, 0, strlen(pass));
-        xfree(pass);
-        return 0;
-}
-
 static void
 do_upload(struct passwd *pw, const char *sc_reader_id)
 {
         Key *prv = NULL;
         struct stat st;
-        u_char *elements[NUM_RSA_KEY_ELEMENTS];
-        u_char key_fid[2];
-        u_char DEFAUT0[] = {0xad, 0x9f, 0x61, 0xfe, 0xfa, 0x20, 0xce, 0x63};
-        u_char AUT0[EVP_MAX_MD_SIZE];
-        int len, status = 1, i, fd = -1, ret;
-        int sw = 0, cla = 0x00;
-
-        for (i = 0; i < NUM_RSA_KEY_ELEMENTS; i++)
-                elements[i] = NULL;
+        int ret;
+
         if (!have_identity)
                 ask_filename(pw, "Enter file in which the key is");
         if (stat(identity_file, &st) < 0) {
                 perror(identity_file);
-                goto done;
+                exit(1);
         }
         prv = load_identity(identity_file);
         if (prv == NULL) {
                 error("load failed");
-                goto done;
-        }
-        COPY_RSA_KEY(q, 0);
-        COPY_RSA_KEY(p, 1);
-        COPY_RSA_KEY(iqmp, 2);
-        COPY_RSA_KEY(dmq1, 3);
-        COPY_RSA_KEY(dmp1, 4);
-        COPY_RSA_KEY(n, 5);
-        len = BN_num_bytes(prv->rsa->n);
-        fd = sectok_friendly_open(sc_reader_id, STONOWAIT, &sw);
-        if (fd < 0) {
-                error("sectok_open failed: %s", sectok_get_sw(sw));
-                goto done;
-        }
-        if (! sectok_cardpresent(fd)) {
-                error("smartcard in reader %s not present",
-                    sc_reader_id);
-                goto done;
-        }
-        ret = sectok_reset(fd, 0, NULL, &sw);
-        if (ret <= 0) {
-                error("sectok_reset failed: %s", sectok_get_sw(sw));
-                goto done;
-        }
-        if ((cla = cyberflex_inq_class(fd)) < 0) {
-                error("cyberflex_inq_class failed");
-                goto done;
-        }
-        memcpy(AUT0, DEFAUT0, sizeof(DEFAUT0));
-        if (cyberflex_verify_AUT0(fd, cla, AUT0, sizeof(DEFAUT0)) < 0) {
-                if (get_AUT0(AUT0) < 0 ||
-                    cyberflex_verify_AUT0(fd, cla, AUT0, sizeof(DEFAUT0)) < 0) {
-                        error("cyberflex_verify_AUT0 failed");
-                        goto done;
-                }
-        }
-        key_fid[0] = 0x00;
-        key_fid[1] = 0x12;
-        if (cyberflex_load_rsa_priv(fd, cla, key_fid, 5, 8*len, elements,
-            &sw) < 0) {
-                error("cyberflex_load_rsa_priv failed: %s", sectok_get_sw(sw));
-                goto done;
-        }
-        if (!sectok_swOK(sw))
-                goto done;
-        log("cyberflex_load_rsa_priv done");
-        key_fid[0] = 0x73;
-        key_fid[1] = 0x68;
-        if (cyberflex_load_rsa_pub(fd, cla, key_fid, len, elements[5],
-            &sw) < 0) {
-                error("cyberflex_load_rsa_pub failed: %s", sectok_get_sw(sw));
-                goto done;
+                exit(1);
         }
-        if (!sectok_swOK(sw))
-                goto done;
-        log("cyberflex_load_rsa_pub done");
-        status = 0;
-        log("loading key done");
-done:
-
-        memset(elements[0], '\0', BN_num_bytes(prv->rsa->q));
-        memset(elements[1], '\0', BN_num_bytes(prv->rsa->p));
-        memset(elements[2], '\0', BN_num_bytes(prv->rsa->iqmp));
-        memset(elements[3], '\0', BN_num_bytes(prv->rsa->dmq1));
-        memset(elements[4], '\0', BN_num_bytes(prv->rsa->dmp1));
-        memset(elements[5], '\0', BN_num_bytes(prv->rsa->n));
-
-        if (prv)
-                key_free(prv);
-        for (i = 0; i < NUM_RSA_KEY_ELEMENTS; i++)
-                if (elements[i])
-                        xfree(elements[i]);
-        if (fd != -1)
-                sectok_close(fd);
-        exit(status);
+        ret = sc_put_key(prv, sc_reader_id);
+        key_free(prv);
+        if (ret < 0)
+                exit(1);
+        log("loading key done");
+        exit(0);
 }
 
 static void