+static char *askpass(const char *comment)
+{
+ if (have_controlling_tty()) {
+ int ret;
+ prompts_t *p = new_prompts(NULL);
+ p->to_server = FALSE;
+ p->name = dupstr("Pageant passphrase prompt");
+ add_prompt(p,
+ dupprintf("Enter passphrase to load key '%s': ", comment),
+ FALSE);
+ ret = console_get_userpass_input(p, NULL, 0);
+ assert(ret >= 0);
+
+ if (!ret) {
+ perror("pageant: unable to read passphrase");
+ free_prompts(p);
+ return NULL;
+ } else {
+ char *passphrase = dupstr(p->prompts[0]->result);
+ free_prompts(p);
+ return passphrase;
+ }
+ } else if (display) {
+ char *prompt, *passphrase;
+ int success;
+
+ /* in gtkask.c */
+ char *gtk_askpass_main(const char *display, const char *wintitle,
+ const char *prompt, int *success);
+
+ prompt = dupprintf("Enter passphrase to load key '%s': ", comment);
+ passphrase = gtk_askpass_main(display,
+ "Pageant passphrase prompt",
+ prompt, &success);
+ sfree(prompt);
+ if (!success) {
+ /* return value is error message */
+ fprintf(stderr, "%s\n", passphrase);
+ sfree(passphrase);
+ passphrase = NULL;
+ }
+ return passphrase;
+ } else {
+ fprintf(stderr, "no way to read a passphrase without tty or "
+ "X display\n");
+ return NULL;
+ }
+}
+
+static int unix_add_keyfile(const char *filename_str)
+{
+ Filename *filename = filename_from_str(filename_str);
+ int status, ret;
+ char *err;
+
+ ret = TRUE;
+
+ /*
+ * Try without a passphrase.
+ */
+ status = pageant_add_keyfile(filename, NULL, &err);
+ if (status == PAGEANT_ACTION_OK) {
+ goto cleanup;
+ } else if (status == PAGEANT_ACTION_FAILURE) {
+ fprintf(stderr, "pageant: %s: %s\n", filename_str, err);
+ ret = FALSE;
+ goto cleanup;
+ }
+
+ /*
+ * And now try prompting for a passphrase.
+ */
+ while (1) {
+ char *passphrase = askpass(err);
+ sfree(err);
+ err = NULL;
+ if (!passphrase)
+ break;
+
+ status = pageant_add_keyfile(filename, passphrase, &err);
+
+ smemclr(passphrase, strlen(passphrase));
+ sfree(passphrase);
+ passphrase = NULL;
+
+ if (status == PAGEANT_ACTION_OK) {
+ goto cleanup;
+ } else if (status == PAGEANT_ACTION_FAILURE) {
+ fprintf(stderr, "pageant: %s: %s\n", filename_str, err);
+ ret = FALSE;
+ goto cleanup;
+ }
+ }
+
+ cleanup:
+ sfree(err);
+ filename_free(filename);
+ return ret;
+}
+
+void key_list_callback(void *ctx, const char *fingerprint,
+ const char *comment, struct pageant_pubkey *key)
+{
+ printf("%s %s\n", fingerprint, comment);
+}
+
+struct key_find_ctx {
+ const char *string;
+ int match_fp, match_comment;
+ struct pageant_pubkey *found;
+ int nfound;
+};
+
+int match_fingerprint_string(const char *string, const char *fingerprint)
+{
+ const char *hash;
+
+ /* Find the hash in the fingerprint string. It'll be the word at the end. */
+ hash = strrchr(fingerprint, ' ');
+ assert(hash);
+ hash++;
+
+ /* Now see if the search string is a prefix of the full hash,
+ * neglecting colons and case differences. */
+ while (1) {
+ while (*string == ':') string++;
+ while (*hash == ':') hash++;
+ if (!*string)
+ return TRUE;
+ if (tolower((unsigned char)*string) != tolower((unsigned char)*hash))
+ return FALSE;
+ string++;
+ hash++;
+ }
+}
+
+void key_find_callback(void *vctx, const char *fingerprint,
+ const char *comment, struct pageant_pubkey *key)
+{
+ struct key_find_ctx *ctx = (struct key_find_ctx *)vctx;
+
+ if ((ctx->match_comment && !strcmp(ctx->string, comment)) ||
+ (ctx->match_fp && match_fingerprint_string(ctx->string, fingerprint)))
+ {
+ if (!ctx->found)
+ ctx->found = pageant_pubkey_copy(key);
+ ctx->nfound++;
+ }
+}
+
+struct pageant_pubkey *find_key(const char *string, char **retstr)
+{
+ struct key_find_ctx actx, *ctx = &actx;
+ struct pageant_pubkey key_in, *key_ret;
+ int try_file = TRUE, try_fp = TRUE, try_comment = TRUE;
+ int file_errors = FALSE;
+
+ /*
+ * Trim off disambiguating prefixes telling us how to interpret
+ * the provided string.
+ */
+ if (!strncmp(string, "file:", 5)) {
+ string += 5;
+ try_fp = try_comment = FALSE;
+ file_errors = TRUE; /* also report failure to load the file */
+ } else if (!strncmp(string, "comment:", 8)) {
+ string += 8;
+ try_file = try_fp = FALSE;
+ } else if (!strncmp(string, "fp:", 3)) {
+ string += 3;
+ try_file = try_comment = FALSE;
+ } else if (!strncmp(string, "fingerprint:", 12)) {
+ string += 12;
+ try_file = try_comment = FALSE;
+ }
+
+ /*
+ * Try interpreting the string as a key file name.
+ */
+ if (try_file) {
+ Filename *fn = filename_from_str(string);
+ int keytype = key_type(fn);
+ if (keytype == SSH_KEYTYPE_SSH1 ||
+ keytype == SSH_KEYTYPE_SSH1_PUBLIC) {
+ const char *error;
+
+ if (!rsakey_pubblob(fn, &key_in.blob, &key_in.bloblen,
+ NULL, &error)) {
+ if (file_errors) {
+ *retstr = dupprintf("unable to load file '%s': %s",
+ string, error);
+ filename_free(fn);
+ return NULL;
+ }
+ }
+
+ /*
+ * If we've successfully loaded the file, stop here - we
+ * already have a key blob and need not go to the agent to
+ * list things.
+ */
+ key_in.ssh_version = 1;
+ key_ret = pageant_pubkey_copy(&key_in);
+ sfree(key_in.blob);
+ filename_free(fn);
+ return key_ret;
+ } else if (keytype == SSH_KEYTYPE_SSH2 ||
+ keytype == SSH_KEYTYPE_SSH2_PUBLIC_RFC4716 ||
+ keytype == SSH_KEYTYPE_SSH2_PUBLIC_OPENSSH) {
+ const char *error;
+
+ if ((key_in.blob = ssh2_userkey_loadpub(fn, NULL,
+ &key_in.bloblen,
+ NULL, &error)) == NULL) {
+ if (file_errors) {
+ *retstr = dupprintf("unable to load file '%s': %s",
+ string, error);
+ filename_free(fn);
+ return NULL;
+ }
+ }
+
+ /*
+ * If we've successfully loaded the file, stop here - we
+ * already have a key blob and need not go to the agent to
+ * list things.
+ */
+ key_in.ssh_version = 2;
+ key_ret = pageant_pubkey_copy(&key_in);
+ sfree(key_in.blob);
+ filename_free(fn);
+ return key_ret;
+ } else {
+ if (file_errors) {
+ *retstr = dupprintf("unable to load key file '%s': %s",
+ string, key_type_to_str(keytype));
+ filename_free(fn);
+ return NULL;
+ }
+ }
+ filename_free(fn);
+ }
+
+ /*
+ * Failing that, go through the keys in the agent, and match
+ * against fingerprints and comments as appropriate.
+ */
+ ctx->string = string;
+ ctx->match_fp = try_fp;
+ ctx->match_comment = try_comment;
+ ctx->found = NULL;
+ ctx->nfound = 0;
+ if (pageant_enum_keys(key_find_callback, ctx, retstr) ==
+ PAGEANT_ACTION_FAILURE)
+ return NULL;
+
+ if (ctx->nfound == 0) {
+ *retstr = dupstr("no key matched");
+ assert(!ctx->found);
+ return NULL;
+ } else if (ctx->nfound > 1) {
+ *retstr = dupstr("multiple keys matched");
+ assert(ctx->found);
+ pageant_pubkey_free(ctx->found);
+ return NULL;
+ }
+
+ assert(ctx->found);
+ return ctx->found;
+}
+