 @@ -1,14 +1,14 @@
-/*	$NetBSD: pam_ssh.c,v 1.25 2018/04/07 19:28:32 christos Exp $	*/
+/*	$NetBSD: pam_ssh.c,v 1.26 2018/08/26 08:54:03 christos Exp $	*/
 /*-
  * Copyright (c) 2003 Networks Associates Technology, Inc.
  * All rights reserved.
+ *
  * This software was developed for the FreeBSD Project by ThinkSec AS and
  * NAI Labs, the Security Research Division of Network Associates, Inc.
  * under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the
  * DARPA CHATS research program.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
 @@ -28,62 +28,62 @@
  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  */
 #include <sys/cdefs.h>
 #ifdef __FreeBSD__
 __FBSDID("$FreeBSD: src/lib/libpam/modules/pam_ssh/pam_ssh.c,v 1.40 2004/02/10 10:13:21 des Exp $");
 #else
-__RCSID("$NetBSD: pam_ssh.c,v 1.25 2018/04/07 19:28:32 christos Exp $");
+__RCSID("$NetBSD: pam_ssh.c,v 1.26 2018/08/26 08:54:03 christos Exp $");
 #endif
 #include <sys/param.h>
 #include <sys/wait.h>
 #include <errno.h>
 #include <fcntl.h>
 #include <paths.h>
 #include <pwd.h>
 #include <signal.h>
 #include <stdio.h>
 #include <string.h>
 #include <unistd.h>
 #define PAM_SM_AUTH
 #define PAM_SM_SESSION
 #include <security/pam_appl.h>
 #include <security/pam_modules.h>
 #include <security/openpam.h>
 #include <openssl/evp.h>
-#include "key.h"
+#include "sshkey.h"
-#include "buffer.h"
+#include "sshbuf.h"
 #include "authfd.h"
 #include "authfile.h"
 #define ssh_add_identity(auth, key, comment) \
 	ssh_add_identity_constrained(auth, key, comment, 0, 0, 0)
 extern char **environ;
 struct pam_ssh_key {
-	Key	*key;
+	struct sshkey	*key;
 	char	*comment;
 };
 static const char *pam_ssh_prompt = "SSH passphrase: ";
 static const char *pam_ssh_have_keys = "pam_ssh_have_keys";
 static const char *pam_ssh_keyfiles[] = {
 	".ssh/identity",	/* SSH1 RSA key */
 	".ssh/id_rsa",		/* SSH2 RSA key */
 	".ssh/id_dsa",		/* SSH2 DSA key */
 	".ssh/id_ecdsa", 	/* SSH2 ECDSA key */
 	NULL
 };
 @@ -93,77 +93,78 @@ static const char *const pam_ssh_agent_a
 static const char *const pam_ssh_agent_envp[] = { NULL };
 /*
  * Attempts to load a private key from the specified file in the specified
  * directory, using the specified passphrase.  If successful, returns a
  * struct pam_ssh_key containing the key and its comment.
  */
 static struct pam_ssh_key *
 pam_ssh_load_key(const char *dir, const char *kfn, const char *passphrase,
     int nullok)
+{
 	struct pam_ssh_key *psk;
 	char fn[PATH_MAX];
 	int r;
 	char *comment;
-	Key *key;
+	struct sshkey *key;
 	if (snprintf(fn, sizeof(fn), "%s/%s", dir, kfn) > (int)sizeof(fn))
 		return (NULL);
 	comment = NULL;
 	/*
 	 * If the key is unencrypted, OpenSSL ignores the passphrase, so
 	 * it will seem like the user typed in the right one.  This allows
 	 * a user to circumvent nullok by providing a dummy passphrase.
 	 * Verify that the key really *is* encrypted by trying to load it
 	 * with an empty passphrase, and if the key is not encrypted,
 	 * accept only an empty passphrase.
 	 */
-	key = key_load_private(fn, "", &comment);
+	r = sshkey_load_private(fn, "", &key, &comment);
-	if (key != NULL && !(*passphrase == '\0' && nullok)) {
+	if (r && !(*passphrase == '\0' && nullok)) {
-		key_free(key);
+		sshkey_free(key);
 		free(comment);
 		return (NULL);
+	}
-	if (key == NULL)
+	if (r)
-		key = key_load_private(fn, passphrase, &comment);
+		sshkey_load_private(fn, passphrase, &key, &comment);
-	if (key == NULL) {
+	if (r) {
 		openpam_log(PAM_LOG_DEBUG, "failed to load key from %s", fn);
 		if (comment != NULL)
 			free(comment);
 		return (NULL);
+	}
 	openpam_log(PAM_LOG_DEBUG, "loaded '%s' from %s", comment, fn);
 	if ((psk = malloc(sizeof(*psk))) == NULL) {
-		key_free(key);
+		sshkey_free(key);
 		free(comment);
 		return (NULL);
+	}
 	psk->key = key;
 	psk->comment = comment;
 	return (psk);
+}
 /*
  * Wipes a private key and frees the associated resources.
  */
 static void
 pam_ssh_free_key(pam_handle_t *pamh __unused,
     void *data, int pam_err __unused)
+{
 	struct pam_ssh_key *psk;
 	psk = data;
-	key_free(psk->key);
+	sshkey_free(psk->key);
 	free(psk->comment);
 	free(psk);
+}
 PAM_EXTERN int
 pam_sm_authenticate(pam_handle_t *pamh, int flags __unused,
     int argc __unused, const char *argv[] __unused)
+{
 	const char **kfn, *passphrase, *user;
 	const void *item;
 	struct passwd *pwd, pwres;
 	struct pam_ssh_key *psk;
 	int nkeys, nullok, pam_err, pass;