KEYCHAIN_LDFLAGS=@KEYCHAIN_LDFLAGS@

KEYCHAINOBJS=keychain.o

$(KEYCHAINOBJS): Makefile.in config.h

/*

 * Adds identities using passphrases stored in the keychain.  This call is not

 * meant to be used by normal applications.

 */

int

ssh_add_from_keychain(AuthenticationConnection *auth)

{

	Buffer msg;

	int type;

	buffer_init(&msg);

	buffer_put_char(&msg, SSH_AGENTC_ADD_FROM_KEYCHAIN);

	if (ssh_request_reply(auth, &msg, &msg) == 0) {

		buffer_free(&msg);

		return 0;

	}

	type = buffer_get_char(&msg);

	buffer_free(&msg);

	return decode_reply(type);

}

/* keychain */

#define SSH_AGENTC_ADD_FROM_KEYCHAIN		27

KEYCHAIN_LDFLAGS

  --with-keychain=apple   Use Mac OS X Keychain

	KEYCHAIN="apple"

# Check whether --with-keychain was given.

if test "${with_keychain+set}" = set; then

  withval=$with_keychain;

		case "$withval" in

		apple|no)

			KEYCHAIN=$withval

			;;

		*)

			{ { echo "$as_me:$LINENO: error: invalid keychain type: $withval" >&5

echo "$as_me: error: invalid keychain type: $withval" >&2;}

   { (exit 1); exit 1; }; }

			;;

		esac

fi

if test ! -z "$KEYCHAIN" -a "$KEYCHAIN" != "no"; then

	case "$KEYCHAIN" in

	apple)

for ac_header in Security/Security.h

do

as_ac_Header=`echo "ac_cv_header_$ac_header" | $as_tr_sh`

if { as_var=$as_ac_Header; eval "test \"\${$as_var+set}\" = set"; }; then

  { echo "$as_me:$LINENO: checking for $ac_header" >&5

echo $ECHO_N "checking for $ac_header... $ECHO_C" >&6; }

if { as_var=$as_ac_Header; eval "test \"\${$as_var+set}\" = set"; }; then

  echo $ECHO_N "(cached) $ECHO_C" >&6

fi

ac_res=`eval echo '${'$as_ac_Header'}'`

	       { echo "$as_me:$LINENO: result: $ac_res" >&5

echo "${ECHO_T}$ac_res" >&6; }

else

  # Is the header compilable?

{ echo "$as_me:$LINENO: checking $ac_header usability" >&5

echo $ECHO_N "checking $ac_header usability... $ECHO_C" >&6; }

cat >conftest.$ac_ext <<_ACEOF

/* confdefs.h.  */

_ACEOF

cat confdefs.h >>conftest.$ac_ext

cat >>conftest.$ac_ext <<_ACEOF

/* end confdefs.h.  */

$ac_includes_default

#include <$ac_header>

_ACEOF

rm -f conftest.$ac_objext

if { (ac_try="$ac_compile"

case "(($ac_try" in

  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;

  *) ac_try_echo=$ac_try;;

esac

eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5

  (eval "$ac_compile") 2>conftest.er1

  ac_status=$?

  grep -v '^ *+' conftest.er1 >conftest.err

  rm -f conftest.er1

  cat conftest.err >&5

  echo "$as_me:$LINENO: \$? = $ac_status" >&5

  (exit $ac_status); } && {

	 test -z "$ac_c_werror_flag" ||

	 test ! -s conftest.err

       } && test -s conftest.$ac_objext; then

  ac_header_compiler=yes

else

  echo "$as_me: failed program was:" >&5

sed 's/^/| /' conftest.$ac_ext >&5

	ac_header_compiler=no

fi

rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext

{ echo "$as_me:$LINENO: result: $ac_header_compiler" >&5

echo "${ECHO_T}$ac_header_compiler" >&6; }

# Is the header present?

{ echo "$as_me:$LINENO: checking $ac_header presence" >&5

echo $ECHO_N "checking $ac_header presence... $ECHO_C" >&6; }

cat >conftest.$ac_ext <<_ACEOF

/* confdefs.h.  */

_ACEOF

cat confdefs.h >>conftest.$ac_ext

cat >>conftest.$ac_ext <<_ACEOF

/* end confdefs.h.  */

#include <$ac_header>

_ACEOF

if { (ac_try="$ac_cpp conftest.$ac_ext"

case "(($ac_try" in

  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;

  *) ac_try_echo=$ac_try;;

esac

eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5

  (eval "$ac_cpp conftest.$ac_ext") 2>conftest.er1

  ac_status=$?

  grep -v '^ *+' conftest.er1 >conftest.err

  rm -f conftest.er1

  cat conftest.err >&5

  echo "$as_me:$LINENO: \$? = $ac_status" >&5

  (exit $ac_status); } >/dev/null && {

	 test -z "$ac_c_preproc_warn_flag$ac_c_werror_flag" ||

	 test ! -s conftest.err

       }; then

  ac_header_preproc=yes

else

  echo "$as_me: failed program was:" >&5

sed 's/^/| /' conftest.$ac_ext >&5

  ac_header_preproc=no

fi

rm -f conftest.err conftest.$ac_ext

{ echo "$as_me:$LINENO: result: $ac_header_preproc" >&5

echo "${ECHO_T}$ac_header_preproc" >&6; }

# So?  What about this header?

case $ac_header_compiler:$ac_header_preproc:$ac_c_preproc_warn_flag in

  yes:no: )

    { echo "$as_me:$LINENO: WARNING: $ac_header: accepted by the compiler, rejected by the preprocessor!" >&5

echo "$as_me: WARNING: $ac_header: accepted by the compiler, rejected by the preprocessor!" >&2;}

    { echo "$as_me:$LINENO: WARNING: $ac_header: proceeding with the compiler's result" >&5

echo "$as_me: WARNING: $ac_header: proceeding with the compiler's result" >&2;}

    ac_header_preproc=yes

    ;;

  no:yes:* )

    { echo "$as_me:$LINENO: WARNING: $ac_header: present but cannot be compiled" >&5

echo "$as_me: WARNING: $ac_header: present but cannot be compiled" >&2;}

    { echo "$as_me:$LINENO: WARNING: $ac_header:     check for missing prerequisite headers?" >&5

echo "$as_me: WARNING: $ac_header:     check for missing prerequisite headers?" >&2;}

    { echo "$as_me:$LINENO: WARNING: $ac_header: see the Autoconf documentation" >&5

echo "$as_me: WARNING: $ac_header: see the Autoconf documentation" >&2;}

    { echo "$as_me:$LINENO: WARNING: $ac_header:     section \"Present But Cannot Be Compiled\"" >&5

echo "$as_me: WARNING: $ac_header:     section \"Present But Cannot Be Compiled\"" >&2;}

    { echo "$as_me:$LINENO: WARNING: $ac_header: proceeding with the preprocessor's result" >&5

echo "$as_me: WARNING: $ac_header: proceeding with the preprocessor's result" >&2;}

    { echo "$as_me:$LINENO: WARNING: $ac_header: in the future, the compiler will take precedence" >&5

echo "$as_me: WARNING: $ac_header: in the future, the compiler will take precedence" >&2;}

    ( cat <<\_ASBOX

## ------------------------------------------- ##

## Report this to openssh-unix-dev@mindrot.org ##

## ------------------------------------------- ##

_ASBOX

     ) | sed "s/^/$as_me: WARNING:     /" >&2

    ;;

esac

{ echo "$as_me:$LINENO: checking for $ac_header" >&5

echo $ECHO_N "checking for $ac_header... $ECHO_C" >&6; }

if { as_var=$as_ac_Header; eval "test \"\${$as_var+set}\" = set"; }; then

  echo $ECHO_N "(cached) $ECHO_C" >&6

else

  eval "$as_ac_Header=\$ac_header_preproc"

fi

ac_res=`eval echo '${'$as_ac_Header'}'`

	       { echo "$as_me:$LINENO: result: $ac_res" >&5

echo "${ECHO_T}$ac_res" >&6; }

fi

if test `eval echo '${'$as_ac_Header'}'` = yes; then

  cat >>confdefs.h <<_ACEOF

#define `echo "HAVE_$ac_header" | $as_tr_cpp` 1

_ACEOF

				CPPFLAGS="$CPPFLAGS -D__APPLE_KEYCHAIN__"

				KEYCHAIN_LDFLAGS="-framework Security -framework CoreFoundation"

else

  { echo "$as_me:$LINENO: WARNING: Security framework not found. Disabling Mac OS X Keychain support." >&5

echo "$as_me: WARNING: Security framework not found. Disabling Mac OS X Keychain support." >&2;}

fi

done

		;;

	esac

fi

KEYCHAIN_LDFLAGS!$KEYCHAIN_LDFLAGS$ac_delim

	KEYCHAIN="apple"

dnl Keychain support

AC_ARG_WITH(keychain,

	[  --with-keychain=apple   Use Mac OS X Keychain],

	[

		case "$withval" in

		apple|no)

			KEYCHAIN=$withval

			;;

		*)

			AC_MSG_ERROR(invalid keychain type: $withval)

			;;

		esac

	]

)

if test ! -z "$KEYCHAIN" -a "$KEYCHAIN" != "no"; then

	case "$KEYCHAIN" in

	apple)

		AC_CHECK_HEADERS(Security/Security.h, [

				CPPFLAGS="$CPPFLAGS -D__APPLE_KEYCHAIN__"

				KEYCHAIN_LDFLAGS="-framework Security -framework CoreFoundation"

				AC_SUBST(KEYCHAIN_LDFLAGS)

				],

				AC_MSG_WARN([Security framework not found. Disabling Mac OS X Keychain support.]))

		;;

	esac

fi

/*

 * Copyright (c) 2007 Apple Inc. All rights reserved.

 *

 * @APPLE_BSD_LICENSE_HEADER_START@

 * 

 * Redistribution and use in source and binary forms, with or without

 * modification, are permitted provided that the following conditions

 * are met:

 * 

 * 1.  Redistributions of source code must retain the above copyright

 *     notice, this list of conditions and the following disclaimer. 

 * 2.  Redistributions in binary form must reproduce the above copyright

 *     notice, this list of conditions and the following disclaimer in the

 *     documentation and/or other materials provided with the distribution. 

 * 3.  Neither the name of Apple Inc. ("Apple") nor the names of its

 *     contributors may be used to endorse or promote products derived from

 *     this software without specific prior written permission. 

 * 

 * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY

 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED

 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE

 * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY

 * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES

 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;

 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND

 * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF

 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

 * 

 * @APPLE_BSD_LICENSE_HEADER_END@

 */

#include "includes.h"

#include <stdio.h>

#include <string.h>

#include "xmalloc.h"

#include "key.h"

#include "authfd.h"

#if defined(__APPLE_KEYCHAIN__)

#include <CoreFoundation/CoreFoundation.h>

#include <Security/Security.h>

#include <Security/SecPassword.h>

#endif

/*

 * Platform-specific helper functions.

 */

#if defined(__APPLE_KEYCHAIN__)

static int get_boolean_preference(const char *key, int default_value,

    int foreground)

{

	int value = default_value;

	CFStringRef keyRef = NULL;

	CFPropertyListRef valueRef = NULL;

	keyRef = CFStringCreateWithCString(NULL, key, kCFStringEncodingUTF8);

	if (keyRef != NULL)

		valueRef = CFPreferencesCopyAppValue(keyRef,

		    CFSTR("org.openbsd.openssh"));

	if (valueRef != NULL)

		if (CFGetTypeID(valueRef) == CFBooleanGetTypeID())

			value = CFBooleanGetValue(valueRef);

		else if (foreground)

			fprintf(stderr, "Ignoring nonboolean %s preference.\n", key);

	if (keyRef)

		CFRelease(keyRef);

	if (valueRef)

		CFRelease(valueRef);

	return value;

}

#endif

/*

 * Store the passphrase for a given identity in the keychain.

 */

void

store_in_keychain(const char *filename, const char *passphrase)

{

#if defined(__APPLE_KEYCHAIN__)

	/*

	 * store_in_keychain

	 * Mac OS X implementation

	 */

	CFStringRef cfstr_relative_filename = NULL;

	CFURLRef cfurl_relative_filename = NULL, cfurl_filename = NULL;

	CFStringRef cfstr_filename;

	CFDataRef cfdata_filename = NULL;

	CFIndex filename_len;

	UInt8 *label = NULL;

	UInt8 *utf8_filename;

	OSStatus rv;

	SecKeychainItemRef itemRef = NULL;

	SecTrustedApplicationRef apps[] = {NULL, NULL, NULL};

	CFArrayRef trustedlist = NULL;

	SecAccessRef initialAccess = NULL;

	/* Bail out if KeychainIntegration preference is -bool NO */

	if (get_boolean_preference("KeychainIntegration", 1, 1) == 0) {

		fprintf(stderr, "Keychain integration is disabled.\n");

		goto err;

	}

	/* Interpret filename with the correct encoding. */

	if ((cfstr_relative_filename =

	    CFStringCreateWithFileSystemRepresentation(NULL, filename)) == NULL)

	    {

		fprintf(stderr, "CFStringCreateWithFileSystemRepresentation failed\n");

		goto err;

	}

	if ((cfurl_relative_filename = CFURLCreateWithFileSystemPath(NULL,

	    cfstr_relative_filename, kCFURLPOSIXPathStyle, false)) == NULL) {

		fprintf(stderr, "CFURLCreateWithFileSystemPath failed\n");

		goto err;

	}

	if ((cfurl_filename = CFURLCopyAbsoluteURL(cfurl_relative_filename)) ==

	    NULL) {

		fprintf(stderr, "CFURLCopyAbsoluteURL failed\n");

		goto err;

	}

	if ((cfstr_filename = CFURLCopyFileSystemPath(cfurl_filename,

	    kCFURLPOSIXPathStyle)) == NULL) {

		fprintf(stderr, "CFURLGetString failed\n");

		goto err;

	}

	if ((cfdata_filename = CFStringCreateExternalRepresentation(NULL,

	    cfstr_filename, kCFStringEncodingUTF8, 0)) == NULL) {

		fprintf(stderr, "CFStringCreateExternalRepresentation failed\n");

		goto err;

	}

	filename_len = CFDataGetLength(cfdata_filename);

	if ((label = xmalloc(filename_len + 5)) == NULL) {

		fprintf(stderr, "xmalloc failed\n");

		goto err;

	}

	memcpy(label, "SSH: ", 5);

	utf8_filename = label + 5;

	CFDataGetBytes(cfdata_filename, CFRangeMake(0, filename_len),

	    utf8_filename);

	/* Check if we already have this passphrase. */

	rv = SecKeychainFindGenericPassword(NULL, 3, "SSH", filename_len,

	    (char *)utf8_filename, NULL, NULL, &itemRef);

	if (rv == errSecItemNotFound) {

		/* Add a new keychain item. */

		SecKeychainAttribute attrs[] = {

			{kSecLabelItemAttr, filename_len + 5, label},

			{kSecServiceItemAttr, 3, "SSH"},

			{kSecAccountItemAttr, filename_len, utf8_filename}

		};

		SecKeychainAttributeList attrList =

		    {sizeof(attrs) / sizeof(attrs[0]), attrs};

		if (SecTrustedApplicationCreateFromPath("/usr/bin/ssh-agent",

		    &apps[0]) != noErr ||

		    SecTrustedApplicationCreateFromPath("/usr/bin/ssh-add",

		    &apps[1]) != noErr ||

		    SecTrustedApplicationCreateFromPath("/usr/bin/ssh",

		    &apps[2]) != noErr) {

			fprintf(stderr, "SecTrustedApplicationCreateFromPath failed\n");

			goto err;

		}

		if ((trustedlist = CFArrayCreate(NULL, (const void **)apps,

		    sizeof(apps) / sizeof(apps[0]), &kCFTypeArrayCallBacks)) ==

		    NULL) {

			fprintf(stderr, "CFArrayCreate failed\n");

			goto err;

		}

		if (SecAccessCreate(cfstr_filename, trustedlist,

		    &initialAccess) != noErr) {

			fprintf(stderr, "SecAccessCreate failed\n");

			goto err;

		}

		if (SecKeychainItemCreateFromContent(

		    kSecGenericPasswordItemClass, &attrList, strlen(passphrase),

		    passphrase, NULL, initialAccess, NULL) == noErr)

			fprintf(stderr, "Passphrase stored in keychain: %s\n", filename);

		else

			fprintf(stderr, "Could not create keychain item\n");

	} else if (rv == noErr) {

		/* Update an existing keychain item. */

		if (SecKeychainItemModifyAttributesAndData(itemRef, NULL,

		    strlen(passphrase), passphrase) == noErr)

			fprintf(stderr, "Passphrase updated in keychain: %s\n", filename);

		else

			fprintf(stderr, "Could not modify keychain item\n");

	} else

		fprintf(stderr, "Could not access keychain\n");

err:	/* Clean up. */

	if (cfstr_relative_filename)

		CFRelease(cfstr_relative_filename);

	if (cfurl_relative_filename)

		CFRelease(cfurl_relative_filename);

	if (cfurl_filename)

		CFRelease(cfurl_filename);

	if (cfdata_filename)

		CFRelease(cfdata_filename);

	if (label)

		xfree(label);

	if (itemRef)

		CFRelease(itemRef);

	if (apps[0])

		CFRelease(apps[0]);

	if (apps[1])

		CFRelease(apps[1]);

	if (apps[2])

		CFRelease(apps[2]);

	if (trustedlist)

		CFRelease(trustedlist);

	if (initialAccess)

		CFRelease(initialAccess);

#else

	/*

	 * store_in_keychain

	 * no keychain implementation

	 */

	fprintf(stderr, "Keychain is not available on this system\n");

#endif

}

/*

 * Remove the passphrase for a given identity from the keychain.

 */

void

remove_from_keychain(const char *filename)

{

#if defined(__APPLE_KEYCHAIN__)

	/*

	 * remove_from_keychain

	 * Mac OS X implementation

	 */

	CFStringRef cfstr_relative_filename = NULL;

	CFURLRef cfurl_relative_filename = NULL, cfurl_filename = NULL;

	CFStringRef cfstr_filename;

	CFDataRef cfdata_filename = NULL;

	CFIndex filename_len;

	const UInt8 *utf8_filename;

	OSStatus rv;

	SecKeychainItemRef itemRef = NULL;

	/* Bail out if KeychainIntegration preference is -bool NO */

	if (get_boolean_preference("KeychainIntegration", 1, 1) == 0) {

		fprintf(stderr, "Keychain integration is disabled.\n");

		goto err;

	}

	/* Interpret filename with the correct encoding. */

	if ((cfstr_relative_filename =

	    CFStringCreateWithFileSystemRepresentation(NULL, filename)) == NULL)

	    {

		fprintf(stderr, "CFStringCreateWithFileSystemRepresentation failed\n");

		goto err;

	}

	if ((cfurl_relative_filename = CFURLCreateWithFileSystemPath(NULL,

	    cfstr_relative_filename, kCFURLPOSIXPathStyle, false)) == NULL) {

		fprintf(stderr, "CFURLCreateWithFileSystemPath failed\n");

		goto err;

	}

	if ((cfurl_filename = CFURLCopyAbsoluteURL(cfurl_relative_filename)) ==

	    NULL) {

		fprintf(stderr, "CFURLCopyAbsoluteURL failed\n");

		goto err;

	}

	if ((cfstr_filename = CFURLCopyFileSystemPath(cfurl_filename,

	    kCFURLPOSIXPathStyle)) == NULL) {

		fprintf(stderr, "CFURLGetString failed\n");

		goto err;

	}

	if ((cfdata_filename = CFStringCreateExternalRepresentation(NULL,

	    cfstr_filename, kCFStringEncodingUTF8, 0)) == NULL) {

		fprintf(stderr, "CFStringCreateExternalRepresentation failed\n");

		goto err;

	}

	filename_len = CFDataGetLength(cfdata_filename);

	utf8_filename = CFDataGetBytePtr(cfdata_filename);

	/* Check if we already have this passphrase. */

	rv = SecKeychainFindGenericPassword(NULL, 3, "SSH", filename_len,

	    (const char *)utf8_filename, NULL, NULL, &itemRef);

	if (rv == noErr) {

		/* Remove the passphrase from the keychain. */

		if (SecKeychainItemDelete(itemRef) == noErr)

			fprintf(stderr, "Passphrase removed from keychain: %s\n", filename);

		else

			fprintf(stderr, "Could not remove keychain item\n");

	} else if (rv != errSecItemNotFound)

		fprintf(stderr, "Could not access keychain\n");

err:	/* Clean up. */

	if (cfstr_relative_filename)

		CFRelease(cfstr_relative_filename);

	if (cfurl_relative_filename)

		CFRelease(cfurl_relative_filename);

	if (cfurl_filename)

		CFRelease(cfurl_filename);

	if (cfdata_filename)

		CFRelease(cfdata_filename);

	if (itemRef)

		CFRelease(itemRef);

#else

	/*

	 * remove_from_keychain

	 * no keychain implementation

	 */

	fprintf(stderr, "Keychain is not available on this system\n");

#endif

}

/*

 * Add identities to ssh-agent using passphrases stored in the keychain.

 * Returns zero on success and nonzero on failure.

 * add_identity is a callback into ssh-agent.  It takes a filename and a

 * passphrase, and attempts to add the identity to the agent.  It returns

 * zero on success and nonzero on failure.

 */

int

add_identities_using_keychain(int (*add_identity)(const char *, const char *))

{

#if defined(__APPLE_KEYCHAIN__)

	/*

	 * add_identities_using_keychain

	 * Mac OS X implementation

	 */

	OSStatus rv;

	SecKeychainSearchRef searchRef;

	SecKeychainItemRef itemRef;

	UInt32 length;

	void *data;

	CFIndex maxsize;

	/* Bail out if KeychainIntegration preference is -bool NO */

	if (get_boolean_preference("KeychainIntegration", 1, 0) == 0)

		return 0;

	/* Search for SSH passphrases in the keychain */

	SecKeychainAttribute attrs[] = {

		{kSecServiceItemAttr, 3, "SSH"}

	};

	SecKeychainAttributeList attrList =

	    {sizeof(attrs) / sizeof(attrs[0]), attrs};

	if ((rv = SecKeychainSearchCreateFromAttributes(NULL,

	    kSecGenericPasswordItemClass, &attrList, &searchRef)) != noErr)

		return 0;

	/* Iterate through the search results. */

	while ((rv = SecKeychainSearchCopyNext(searchRef, &itemRef)) == noErr) {

		UInt32 tag = kSecAccountItemAttr;

		UInt32 format = kSecFormatUnknown;

		SecKeychainAttributeInfo info = {1, &tag, &format};

		SecKeychainAttributeList *itemAttrList = NULL;

		CFStringRef cfstr_filename = NULL;

		char *filename = NULL;

		char *passphrase = NULL;

		/* Retrieve filename and passphrase. */

		if ((rv = SecKeychainItemCopyAttributesAndData(itemRef, &info,

		    NULL, &itemAttrList, &length, &data)) != noErr)

			goto err;

		if (itemAttrList->count != 1)

			goto err;

		cfstr_filename = CFStringCreateWithBytes(NULL,

		    itemAttrList->attr->data, itemAttrList->attr->length,

		    kCFStringEncodingUTF8, true);

		maxsize = CFStringGetMaximumSizeOfFileSystemRepresentation(

		    cfstr_filename);

		if ((filename = xmalloc(maxsize)) == NULL)

			goto err;

		if (CFStringGetFileSystemRepresentation(cfstr_filename,

		    filename, maxsize) == false)

			goto err;

		if ((passphrase = xmalloc(length + 1)) == NULL)

			goto err;

		memcpy(passphrase, data, length);

		passphrase[length] = '\0';

		/* Add the identity. */

		add_identity(filename, passphrase);

err:		/* Clean up. */

		if (itemRef)

			CFRelease(itemRef);

		if (cfstr_filename)

			CFRelease(cfstr_filename);

		if (filename)

			xfree(filename);

		if (passphrase)

			xfree(passphrase);

		if (itemAttrList)

			SecKeychainItemFreeAttributesAndData(itemAttrList,

			    data);

	}

	CFRelease(searchRef);

	return 0;

#else

	/*

	 * add_identities_using_keychain

	 * no implementation

	 */

	return 1;

#endif

}

/*

 * Prompt the user for a key's passphrase.  The user will be offered the option

 * of storing the passphrase in their keychain.  Returns the passphrase

 * (which the caller is responsible for xfreeing), or NULL if this function

 * fails or is not implemented.  If this function is not implemented, ssh will

 * fall back on the standard read_passphrase function, and the user will need

 * to use ssh-add -K to add their keys to the keychain.

 */

char *

keychain_read_passphrase(const char *filename)

{

#if defined(__APPLE_KEYCHAIN__)

	/*

	 * keychain_read_passphrase

	 * Mac OS X implementation

	 */

	CFStringRef cfstr_relative_filename = NULL;

	CFURLRef cfurl_relative_filename = NULL, cfurl_filename = NULL;

	CFStringRef cfstr_filename;

	CFDataRef cfdata_filename = NULL;

	CFIndex filename_len;

	UInt8 *label = NULL;

	UInt8 *utf8_filename;

	SecPasswordRef passRef = NULL;

	SecTrustedApplicationRef apps[] = {NULL, NULL, NULL};

	CFArrayRef trustedlist = NULL;

	SecAccessRef initialAccess = NULL;

	CFURLRef path = NULL;

	CFStringRef pathFinal = NULL;

	CFURLRef bundle_url = NULL;

	CFBundleRef bundle = NULL;

	CFStringRef promptTemplate = NULL, prompt = NULL;

	UInt32 length;

	const void *data;

	AuthenticationConnection *ac = NULL;

	char *result = NULL;

	/* Bail out if KeychainIntegration preference is -bool NO */

	if (get_boolean_preference("KeychainIntegration", 1, 1) == 0)

		goto err;

	/* Bail out if the user set AskPassGUI preference to -bool NO */

	if (get_boolean_preference("AskPassGUI", 1, 1) == 0)

		goto err;

	/* Bail out if we can't communicate with ssh-agent */

	if ((ac = ssh_get_authentication_connection()) == NULL)

		goto err;

	/* Interpret filename with the correct encoding. */

	if ((cfstr_relative_filename =

	    CFStringCreateWithFileSystemRepresentation(NULL, filename)) == NULL)

	    {

		fprintf(stderr, "CFStringCreateWithFileSystemRepresentation failed\n");

		goto err;

	}

	if ((cfurl_relative_filename = CFURLCreateWithFileSystemPath(NULL,

	    cfstr_relative_filename, kCFURLPOSIXPathStyle, false)) == NULL) {

		fprintf(stderr, "CFURLCreateWithFileSystemPath failed\n");

		goto err;

	}

	if ((cfurl_filename = CFURLCopyAbsoluteURL(cfurl_relative_filename)) ==

	    NULL) {

		fprintf(stderr, "CFURLCopyAbsoluteURL failed\n");

		goto err;

	}

	if ((cfstr_filename = CFURLCopyFileSystemPath(cfurl_filename,

	    kCFURLPOSIXPathStyle)) == NULL) {

		fprintf(stderr, "CFURLGetString failed\n");

		goto err;

	}

	if ((cfdata_filename = CFStringCreateExternalRepresentation(NULL,

	    cfstr_filename, kCFStringEncodingUTF8, 0)) == NULL) {

		fprintf(stderr, "CFStringCreateExternalRepresentation failed\n");

		goto err;

	}

	filename_len = CFDataGetLength(cfdata_filename);

	if ((label = xmalloc(filename_len + 5)) == NULL) {

		fprintf(stderr, "xmalloc failed\n");

		goto err;

	}

	memcpy(label, "SSH: ", 5);

	utf8_filename = label + 5;

	CFDataGetBytes(cfdata_filename, CFRangeMake(0, filename_len),

	    utf8_filename);

	/* Build a SecPasswordRef. */

	SecKeychainAttribute searchAttrs[] = {

		{kSecServiceItemAttr, 3, "SSH"},

		{kSecAccountItemAttr, filename_len, utf8_filename}

	};

	SecKeychainAttributeList searchAttrList =

	    {sizeof(searchAttrs) / sizeof(searchAttrs[0]), searchAttrs};

	SecKeychainAttribute attrs[] = {

		{kSecLabelItemAttr, filename_len + 5, label},

		{kSecServiceItemAttr, 3, "SSH"},

		{kSecAccountItemAttr, filename_len, utf8_filename}

	};

	SecKeychainAttributeList attrList =

	    {sizeof(attrs) / sizeof(attrs[0]), attrs};

	if (SecGenericPasswordCreate(&searchAttrList, &attrList, &passRef) !=

	    noErr) {

		fprintf(stderr, "SecGenericPasswordCreate failed\n");

		goto err;

	}

	if (SecTrustedApplicationCreateFromPath("/usr/bin/ssh-agent", &apps[0])

	    != noErr ||

	    SecTrustedApplicationCreateFromPath("/usr/bin/ssh-add", &apps[1])

	    != noErr ||

	    SecTrustedApplicationCreateFromPath("/usr/bin/ssh", &apps[2])

	    != noErr) {

		fprintf(stderr, "SecTrustedApplicationCreateFromPath failed\n");

		goto err;

	}

	if ((trustedlist = CFArrayCreate(NULL, (const void **)apps,

	    sizeof(apps) / sizeof(apps[0]), &kCFTypeArrayCallBacks)) == NULL) {

		fprintf(stderr, "CFArrayCreate failed\n");

		goto err;

	}

	if (SecAccessCreate(cfstr_filename, trustedlist, &initialAccess)

	    != noErr) {

		fprintf(stderr, "SecAccessCreate failed\n");

		goto err;

	}

	if (SecPasswordSetInitialAccess(passRef, initialAccess) != noErr) {

		fprintf(stderr, "SecPasswordSetInitialAccess failed\n");

		goto err;

	}

	/* Request the passphrase from the user. */

	path = CFURLCreateFromFileSystemRepresentation(NULL, (UInt8 *)filename,

	    strlen(filename), false);

	pathFinal = CFURLCopyLastPathComponent(path);

	if (!((bundle_url = CFURLCreateWithFileSystemPath(NULL,

	    CFSTR("/System/Library/CoreServices/"), kCFURLPOSIXPathStyle, true))

	    != NULL && (bundle = CFBundleCreate(NULL, bundle_url)) != NULL &&

	    (promptTemplate = CFCopyLocalizedStringFromTableInBundle(

	    CFSTR("Enter your password for the SSH key \"%@\"."),

	    CFSTR("OpenSSH"), bundle, "Text of the dialog asking the user for"

	    "their passphrase.  The %@ will be replaced with the filename of a"

	    "specific key.")) != NULL) &&

	    (promptTemplate = CFStringCreateCopy(NULL,

	    CFSTR("Enter your password for the SSH key \"%@\"."))) == NULL) {

		fprintf(stderr, "CFStringCreateCopy failed\n");

		goto err;

	}

	prompt = CFStringCreateWithFormat(NULL, NULL, promptTemplate,

	    pathFinal);

	switch (SecPasswordAction(passRef, prompt,

	    kSecPasswordGet|kSecPasswordFail, &length, &data)) {

	case noErr:

		result = xmalloc(length + 1);

		memcpy(result, data, length);

		result[length] = '\0';

		/* Save password in keychain if requested. */

		if (SecPasswordAction(passRef, CFSTR(""), kSecPasswordSet,

		    &length, &data) == noErr)

			ssh_add_from_keychain(ac);

		break;

	case errAuthorizationCanceled:

		result = xmalloc(1);

		*result = '\0';

		break;

	default:

		goto err;

	}

err:	/* Clean up. */

	if (cfstr_relative_filename)

		CFRelease(cfstr_relative_filename);

	if (cfurl_relative_filename)

		CFRelease(cfurl_relative_filename);

	if (cfurl_filename)

		CFRelease(cfurl_filename);

	if (cfdata_filename)

		CFRelease(cfdata_filename);

	if (label)

		xfree(label);

	if (passRef)

		CFRelease(passRef);

	if (apps[0])

		CFRelease(apps[0]);

	if (apps[1])

		CFRelease(apps[1]);

	if (apps[2])

		CFRelease(apps[2]);

	if (trustedlist)

		CFRelease(trustedlist);

	if (initialAccess)

		CFRelease(initialAccess);

	if (path)

		CFRelease(path);

	if (pathFinal)

		CFRelease(pathFinal);

	if (bundle_url)

		CFRelease(bundle_url);

	if (bundle)

		CFRelease(bundle);

	if (promptTemplate)

		CFRelease(promptTemplate);

	if (prompt)

		CFRelease(prompt);

	if (ac)

		ssh_close_authentication_connection(ac);

	return result;

#else

	/*

	 * keychain_read_passphrase

	 * no implementation

	 */

	return NULL;

#endif

}

/*

 * Copyright (c) 2007 Apple Inc. All rights reserved.

 *

 * @APPLE_BSD_LICENSE_HEADER_START@

 * 

 * Redistribution and use in source and binary forms, with or without

 * modification, are permitted provided that the following conditions

 * are met:

 * 

 * 1.  Redistributions of source code must retain the above copyright

 *     notice, this list of conditions and the following disclaimer. 

 * 2.  Redistributions in binary form must reproduce the above copyright

 *     notice, this list of conditions and the following disclaimer in the

 *     documentation and/or other materials provided with the distribution. 

 * 3.  Neither the name of Apple Inc. ("Apple") nor the names of its

 *     contributors may be used to endorse or promote products derived from

 *     this software without specific prior written permission. 

 * 

 * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY

 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED

 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE

 * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY

 * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES

 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;

 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND

 * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF

 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

 * 

 * @APPLE_BSD_LICENSE_HEADER_END@

 */

/*

 * KEYCHAIN indicates that keychain functionality is present.

 * KEYCHAIN_* indicates the implementation to use, and implies KEYCHAIN.

 */

#if defined(__APPLE_KEYCHAIN__)

#define KEYCHAIN

#endif

void	 store_in_keychain(const char *filename, const char *passphrase);

void	 remove_from_keychain(const char *filename);

int	 add_identities_using_keychain(

	     int (*add_identity)(const char *, const char *));

char	*keychain_read_passphrase(const char *filename);

     -K      When adding identities, each passphrase will also be stored in

             your keychain.  When removing identities with -d, each passphrase

             will be removed from your keychain.

     -k      Add identities to the agent using any passphrases stored in your

             keychain.

.It Fl K

When adding identities, each passphrase will also be stored in your

keychain.  When removing identities with -d, each passphrase will be

removed from your keychain.

.It Fl k

Add identities to the agent using any passphrases stored in your keychain.

#include "keychain.h"

	if (keychain)

		remove_from_keychain(filename);

	if (keychain && private != NULL)

		store_in_keychain(filename, "");

		if (keychain && private != NULL)

			store_in_keychain(filename, pass);

	}

			}

#ifdef KEYCHAIN

	fprintf(stderr, "  -k          Add all identities stored in your keychain.\n");

	fprintf(stderr, "  -K          Store passphrases in your keychain.\n");

	fprintf(stderr, "              With -d, remove passphrases from your keychain.\n");

#endif

	int keychain = 0;

		case 'k':

			if (add_from_keychain(ac) == -1)

				ret = 1;

			goto done;

		case 'K':

			keychain = 1;

			break;

#include "authfile.h"

#include "keychain.h"

static int

add_identity_callback(const char *filename, const char *passphrase)

{

	Key *k;

	int version;

	Idtab *tab;

	if ((k = key_load_private(filename, passphrase, NULL)) == NULL)

		return 1;

	switch (k->type) {

	case KEY_RSA:

	case KEY_RSA1:

		if (RSA_blinding_on(k->rsa, NULL) != 1) {

			key_free(k);

			return 1;

		}

		break;

	}

	version = k->type == KEY_RSA1 ? 1 : 2;

	tab = idtab_lookup(version);

	if (lookup_identity(k, version) == NULL) {

		Identity *id = xmalloc(sizeof(Identity));

		id->key = k;

		id->comment = xstrdup(filename);

		if (id->comment == NULL) {

			key_free(k);

			return 1;

		}

		id->death = 0;

		id->confirm = 0;

		TAILQ_INSERT_TAIL(&tab->idlist, id, next);

		tab->nentries++;

	} else {

		key_free(k);

		return 1;

	}

	return 0;

}

static void

process_add_from_keychain(SocketEntry *e)

{

	int result;

	result = add_identities_using_keychain(&add_identity_callback);

	/* e will be NULL when ssh-agent adds keys on its own at startup */

	if (e) {

		buffer_put_int(&e->output, 1);

		buffer_put_char(&e->output,

		    result ? SSH_AGENT_FAILURE : SSH_AGENT_SUCCESS);

	}

}

	case SSH_AGENTC_ADD_FROM_KEYCHAIN:

		process_add_from_keychain(e);

		break;

#ifdef KEYCHAIN

	process_add_from_keychain(NULL);

#endif

#include "keychain.h"

#include "keychain.h"