File size: 4,970 Bytes
bc20498 |
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 |
// Copyright 2018 Joyent, Inc.
module.exports = {
read: read,
write: write
};
var assert = require('assert-plus');
var Buffer = require('safer-buffer').Buffer;
var rfc4253 = require('./rfc4253');
var Key = require('../key');
var SSHBuffer = require('../ssh-buffer');
var crypto = require('crypto');
var PrivateKey = require('../private-key');
var errors = require('../errors');
// https://tartarus.org/~simon/putty-prerel-snapshots/htmldoc/AppendixC.html
function read(buf, options) {
var lines = buf.toString('ascii').split(/[\r\n]+/);
var found = false;
var parts;
var si = 0;
var formatVersion;
while (si < lines.length) {
parts = splitHeader(lines[si++]);
if (parts) {
formatVersion = {
'putty-user-key-file-2': 2,
'putty-user-key-file-3': 3
}[parts[0].toLowerCase()];
if (formatVersion) {
found = true;
break;
}
}
}
if (!found) {
throw (new Error('No PuTTY format first line found'));
}
var alg = parts[1];
parts = splitHeader(lines[si++]);
assert.equal(parts[0].toLowerCase(), 'encryption');
var encryption = parts[1];
parts = splitHeader(lines[si++]);
assert.equal(parts[0].toLowerCase(), 'comment');
var comment = parts[1];
parts = splitHeader(lines[si++]);
assert.equal(parts[0].toLowerCase(), 'public-lines');
var publicLines = parseInt(parts[1], 10);
if (!isFinite(publicLines) || publicLines < 0 ||
publicLines > lines.length) {
throw (new Error('Invalid public-lines count'));
}
var publicBuf = Buffer.from(
lines.slice(si, si + publicLines).join(''), 'base64');
var keyType = rfc4253.algToKeyType(alg);
var key = rfc4253.read(publicBuf);
if (key.type !== keyType) {
throw (new Error('Outer key algorithm mismatch'));
}
si += publicLines;
if (lines[si]) {
parts = splitHeader(lines[si++]);
assert.equal(parts[0].toLowerCase(), 'private-lines');
var privateLines = parseInt(parts[1], 10);
if (!isFinite(privateLines) || privateLines < 0 ||
privateLines > lines.length) {
throw (new Error('Invalid private-lines count'));
}
var privateBuf = Buffer.from(
lines.slice(si, si + privateLines).join(''), 'base64');
if (encryption !== 'none' && formatVersion === 3) {
throw new Error('Encrypted keys arenot supported for' +
' PuTTY format version 3');
}
if (encryption === 'aes256-cbc') {
if (!options.passphrase) {
throw (new errors.KeyEncryptedError(
options.filename, 'PEM'));
}
var iv = Buffer.alloc(16, 0);
var decipher = crypto.createDecipheriv(
'aes-256-cbc',
derivePPK2EncryptionKey(options.passphrase),
iv);
decipher.setAutoPadding(false);
privateBuf = Buffer.concat([
decipher.update(privateBuf), decipher.final()]);
}
key = new PrivateKey(key);
if (key.type !== keyType) {
throw (new Error('Outer key algorithm mismatch'));
}
var sshbuf = new SSHBuffer({buffer: privateBuf});
var privateKeyParts;
if (alg === 'ssh-dss') {
privateKeyParts = [ {
name: 'x',
data: sshbuf.readBuffer()
}];
} else if (alg === 'ssh-rsa') {
privateKeyParts = [
{ name: 'd', data: sshbuf.readBuffer() },
{ name: 'p', data: sshbuf.readBuffer() },
{ name: 'q', data: sshbuf.readBuffer() },
{ name: 'iqmp', data: sshbuf.readBuffer() }
];
} else if (alg.match(/^ecdsa-sha2-nistp/)) {
privateKeyParts = [ {
name: 'd', data: sshbuf.readBuffer()
} ];
} else if (alg === 'ssh-ed25519') {
privateKeyParts = [ {
name: 'k', data: sshbuf.readBuffer()
} ];
} else {
throw new Error('Unsupported PPK key type: ' + alg);
}
key = new PrivateKey({
type: key.type,
parts: key.parts.concat(privateKeyParts)
});
}
key.comment = comment;
return (key);
}
function derivePPK2EncryptionKey(passphrase) {
var hash1 = crypto.createHash('sha1').update(Buffer.concat([
Buffer.from([0, 0, 0, 0]),
Buffer.from(passphrase)
])).digest();
var hash2 = crypto.createHash('sha1').update(Buffer.concat([
Buffer.from([0, 0, 0, 1]),
Buffer.from(passphrase)
])).digest();
return (Buffer.concat([hash1, hash2]).slice(0, 32));
}
function splitHeader(line) {
var idx = line.indexOf(':');
if (idx === -1)
return (null);
var header = line.slice(0, idx);
++idx;
while (line[idx] === ' ')
++idx;
var rest = line.slice(idx);
return ([header, rest]);
}
function write(key, options) {
assert.object(key);
if (!Key.isKey(key))
throw (new Error('Must be a public key'));
var alg = rfc4253.keyTypeToAlg(key);
var buf = rfc4253.write(key);
var comment = key.comment || '';
var b64 = buf.toString('base64');
var lines = wrap(b64, 64);
lines.unshift('Public-Lines: ' + lines.length);
lines.unshift('Comment: ' + comment);
lines.unshift('Encryption: none');
lines.unshift('PuTTY-User-Key-File-2: ' + alg);
return (Buffer.from(lines.join('\n') + '\n'));
}
function wrap(txt, len) {
var lines = [];
var pos = 0;
while (pos < txt.length) {
lines.push(txt.slice(pos, pos + 64));
pos += 64;
}
return (lines);
}
|