1 files changed, 60 insertions, 6 deletions

diff --git a/ssh-add.c b/ssh-add.c
index 627c02983..ac9c808dd 100644
--- a/ssh-add.c
+++ b/ssh-add.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-add.c,v 1.136 2018/09/19 02:03:02 djm Exp $ */
+/* $OpenBSD: ssh-add.c,v 1.138 2019/01/21 12:53:35 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -418,6 +418,40 @@ update_card(int agent_fd, int add, const char *id, int qflag)
 }
 
 static int
+test_key(int agent_fd, const char *filename)
+{
+        struct sshkey *key = NULL;
+        u_char *sig = NULL;
+        size_t slen = 0;
+        int r, ret = -1;
+        char data[1024];
+
+        if ((r = sshkey_load_public(filename, &key, NULL)) != 0) {
+                error("Couldn't read public key %s: %s", filename, ssh_err(r));
+                return -1;
+        }
+        arc4random_buf(data, sizeof(data));
+        if ((r = ssh_agent_sign(agent_fd, key, &sig, &slen, data, sizeof(data),
+            NULL, 0)) != 0) {
+                error("Agent signature failed for %s: %s",
+                    filename, ssh_err(r));
+                goto done;
+        }
+        if ((r = sshkey_verify(key, sig, slen, data, sizeof(data),
+            NULL, 0)) != 0) {
+                error("Signature verification failed for %s: %s",
+                    filename, ssh_err(r));
+                goto done;
+        }
+        /* success */
+        ret = 0;
+ done:
+        free(sig);
+        sshkey_free(key);
+        return ret;
+}
+
+static int
 list_identities(int agent_fd, int do_fp)
 {
         char *fp;
@@ -524,7 +558,9 @@ usage(void)
         fprintf(stderr, "  -X          Unlock agent.\n");
         fprintf(stderr, "  -s pkcs11   Add keys from PKCS#11 provider.\n");
         fprintf(stderr, "  -e pkcs11   Remove keys provided by PKCS#11 provider.\n");
+        fprintf(stderr, "  -T pubkey   Test if ssh-agent can access matching private key.\n");
         fprintf(stderr, "  -q          Be quiet after a successful operation.\n");
+        fprintf(stderr, "  -v          Be more verbose.\n");
 }
 
 int
@@ -535,7 +571,9 @@ main(int argc, char **argv)
         int agent_fd;
         char *pkcs11provider = NULL;
         int r, i, ch, deleting = 0, ret = 0, key_only = 0;
-        int xflag = 0, lflag = 0, Dflag = 0, qflag = 0;
+        int xflag = 0, lflag = 0, Dflag = 0, qflag = 0, Tflag = 0;
+        SyslogFacility log_facility = SYSLOG_FACILITY_AUTH;
+        LogLevel log_level = SYSLOG_LEVEL_INFO;
 
         ssh_malloc_init();      /* must be called before any mallocs */
         /* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */
@@ -544,9 +582,7 @@ main(int argc, char **argv)
         __progname = ssh_get_progname(argv[0]);
         seed_rng();
 
-#ifdef WITH_OPENSSL
-        OpenSSL_add_all_algorithms();
-#endif
+        log_init(__progname, log_level, log_facility, 1);
 
         setvbuf(stdout, NULL, _IOLBF, 0);
 
@@ -563,8 +599,14 @@ main(int argc, char **argv)
                 exit(2);
         }
 
-        while ((ch = getopt(argc, argv, "klLcdDxXE:e:M:m:qs:t:")) != -1) {
+        while ((ch = getopt(argc, argv, "vklLcdDTxXE:e:M:m:qs:t:")) != -1) {
                 switch (ch) {
+                case 'v':
+                        if (log_level == SYSLOG_LEVEL_INFO)
+                                log_level = SYSLOG_LEVEL_DEBUG1;
+                        else if (log_level < SYSLOG_LEVEL_DEBUG3)
+                                log_level++;
+                        break;
                 case 'E':
                         fingerprint_hash = ssh_digest_alg_by_name(optarg);
                         if (fingerprint_hash == -1)
@@ -627,12 +669,16 @@ main(int argc, char **argv)
                 case 'q':
                         qflag = 1;
                         break;
+                case 'T':
+                        Tflag = 1;
+                        break;
                 default:
                         usage();
                         ret = 1;
                         goto done;
                 }
         }
+        log_init(__progname, log_level, log_facility, 1);
 
         if ((xflag != 0) + (lflag != 0) + (Dflag != 0) > 1)
                 fatal("Invalid combination of actions");
@@ -652,6 +698,14 @@ main(int argc, char **argv)
 
         argc -= optind;
         argv += optind;
+        if (Tflag) {
+                if (argc <= 0)
+                        fatal("no keys to test");
+                for (r = i = 0; i < argc; i++)
+                        r |= test_key(agent_fd, argv[i]);
+                ret = r == 0 ? 0 : 1;
+                goto done;
+        }
         if (pkcs11provider != NULL) {
                 if (update_card(agent_fd, !deleting, pkcs11provider,
                     qflag) == -1)