case 1:		key = key_new(KEY_RSA1);		bits = buffer_get_int(&auth->identities);		buffer_get_bignum(&auth->identities, key->rsa->e);		buffer_get_bignum(&auth->identities, key->rsa->n);		*comment = buffer_get_string(&auth->identities, NULL);		if (bits != BN_num_bits(key->rsa->n))			log("Warning: identity keysize mismatch: actual %d, announced %u",			    BN_num_bits(key->rsa->n), bits);		break;	case 2:		blob = buffer_get_string(&auth->identities, &blen);		*comment = buffer_get_string(&auth->identities, NULL);		key = key_from_blob(blob, blen);		xfree(blob);		break;	default:		return NULL;		break;	}	/* Decrement the number of remaining entries. */	auth->howmany--;	return key;}/* * Generates a random challenge, sends it to the agent, and waits for * response from the agent.  Returns true (non-zero) if the agent gave the * correct answer, zero otherwise.  Response type selects the style of * response desired, with 0 corresponding to protocol version 1.0 (no longer * supported) and 1 corresponding to protocol version 1.1. */intssh_decrypt_challenge(AuthenticationConnection *auth,    Key* key, BIGNUM *challenge,    u_char session_id[16],    u_int response_type,    u_char response[16]){	Buffer buffer;	int success = 0;	int i;	int type;	if (key->type != KEY_RSA1)		return 0;	if (response_type == 0) {		log("Compatibility with ssh protocol version 1.0 no longer supported.");		return 0;	}	buffer_init(&buffer);	buffer_put_char(&buffer, SSH_AGENTC_RSA_CHALLENGE);	buffer_put_int(&buffer, BN_num_bits(key->rsa->n));	buffer_put_bignum(&buffer, key->rsa->e);	buffer_put_bignum(&buffer, key->rsa->n);	buffer_put_bignum(&buffer, challenge);	buffer_append(&buffer, session_id, 16);	buffer_put_int(&buffer, response_type);	if (ssh_request_reply(auth, &buffer, &buffer) == 0) {		buffer_free(&buffer);		return 0;	}	type = buffer_get_char(&buffer);	if (agent_failed(type)) {		log("Agent admitted failure to authenticate using the key.");	} else if (type != SSH_AGENT_RSA_RESPONSE) {		fatal("Bad authentication response: %d", type);	} else {		success = 1;		/*		 * Get the response from the packet.  This will abort with a		 * fatal error if the packet is corrupt.		 */		for (i = 0; i < 16; i++)			response[i] = buffer_get_char(&buffer);	}	buffer_free(&buffer);	return success;}/* ask agent to sign data, returns -1 on error, 0 on success */intssh_agent_sign(AuthenticationConnection *auth,    Key *key,    u_char **sigp, u_int *lenp,    u_char *data, u_int datalen){	extern int datafellows;	Buffer msg;	u_char *blob;	u_int blen;	int type, flags = 0;	int ret = -1;	if (key_to_blob(key, &blob, &blen) == 0)		return -1;	if (datafellows & SSH_BUG_SIGBLOB)		flags = SSH_AGENT_OLD_SIGNATURE;	buffer_init(&msg);	buffer_put_char(&msg, SSH2_AGENTC_SIGN_REQUEST);	buffer_put_string(&msg, blob, blen);	buffer_put_string(&msg, data, datalen);	buffer_put_int(&msg, flags);	xfree(blob);	if (ssh_request_reply(auth, &msg, &msg) == 0) {		buffer_free(&msg);		return -1;	}	type = buffer_get_char(&msg);	if (agent_failed(type)) {		log("Agent admitted failure to sign using the key.");	} else if (type != SSH2_AGENT_SIGN_RESPONSE) {		fatal("Bad authentication response: %d", type);	} else {		ret = 0;		*sigp = buffer_get_string(&msg, lenp);	}	buffer_free(&msg);	return ret;}/* Encode key for a message to the agent. */static voidssh_encode_identity_rsa1(Buffer *b, RSA *key, const char *comment){	buffer_put_int(b, BN_num_bits(key->n));	buffer_put_bignum(b, key->n);	buffer_put_bignum(b, key->e);	buffer_put_bignum(b, key->d);	/* To keep within the protocol: p < q for ssh. in SSL p > q */	buffer_put_bignum(b, key->iqmp);	/* ssh key->u */	buffer_put_bignum(b, key->q);	/* ssh key->p, SSL key->q */	buffer_put_bignum(b, key->p);	/* ssh key->q, SSL key->p */	buffer_put_cstring(b, comment);}static voidssh_encode_identity_ssh2(Buffer *b, Key *key, const char *comment){	buffer_put_cstring(b, key_ssh_name(key));	switch (key->type) {	case KEY_RSA:		buffer_put_bignum2(b, key->rsa->n);		buffer_put_bignum2(b, key->rsa->e);		buffer_put_bignum2(b, key->rsa->d);		buffer_put_bignum2(b, key->rsa->iqmp);		buffer_put_bignum2(b, key->rsa->p);		buffer_put_bignum2(b, key->rsa->q);		break;	case KEY_DSA:		buffer_put_bignum2(b, key->dsa->p);		buffer_put_bignum2(b, key->dsa->q);		buffer_put_bignum2(b, key->dsa->g);		buffer_put_bignum2(b, key->dsa->pub_key);		buffer_put_bignum2(b, key->dsa->priv_key);		break;	}	buffer_put_cstring(b, comment);}/* * Adds an identity to the authentication server.  This call is not meant to * be used by normal applications. */intssh_add_identity_constrained(AuthenticationConnection *auth, Key *key,    const char *comment, u_int life, u_int confirm){	Buffer msg;	int type, constrained = (life || confirm);	buffer_init(&msg);	switch (key->type) {	case KEY_RSA1:		type = constrained ?		    SSH_AGENTC_ADD_RSA_ID_CONSTRAINED :		    SSH_AGENTC_ADD_RSA_IDENTITY;		buffer_put_char(&msg, type);		ssh_encode_identity_rsa1(&msg, key->rsa, comment);		break;	case KEY_RSA:	case KEY_DSA:		type = constrained ?		    SSH2_AGENTC_ADD_ID_CONSTRAINED :		    SSH2_AGENTC_ADD_IDENTITY;		buffer_put_char(&msg, type);		ssh_encode_identity_ssh2(&msg, key, comment);		break;	default:		buffer_free(&msg);		return 0;		break;	}	if (constrained) {		if (life != 0) {			buffer_put_char(&msg, SSH_AGENT_CONSTRAIN_LIFETIME);			buffer_put_int(&msg, life);		}		if (confirm != 0)			buffer_put_char(&msg, SSH_AGENT_CONSTRAIN_CONFIRM);	}	if (ssh_request_reply(auth, &msg, &msg) == 0) {		buffer_free(&msg);		return 0;	}	type = buffer_get_char(&msg);	buffer_free(&msg);	return decode_reply(type);}intssh_add_identity(AuthenticationConnection *auth, Key *key, const char *comment){	return ssh_add_identity_constrained(auth, key, comment, 0, 0);}/* * Removes an identity from the authentication server.  This call is not * meant to be used by normal applications. */intssh_remove_identity(AuthenticationConnection *auth, Key *key){	Buffer msg;	int type;	u_char *blob;	u_int blen;	buffer_init(&msg);	if (key->type == KEY_RSA1) {		buffer_put_char(&msg, SSH_AGENTC_REMOVE_RSA_IDENTITY);		buffer_put_int(&msg, BN_num_bits(key->rsa->n));		buffer_put_bignum(&msg, key->rsa->e);		buffer_put_bignum(&msg, key->rsa->n);	} else if (key->type == KEY_DSA || key->type == KEY_RSA) {		key_to_blob(key, &blob, &blen);		buffer_put_char(&msg, SSH2_AGENTC_REMOVE_IDENTITY);		buffer_put_string(&msg, blob, blen);		xfree(blob);	} else {		buffer_free(&msg);		return 0;	}	if (ssh_request_reply(auth, &msg, &msg) == 0) {		buffer_free(&msg);		return 0;	}	type = buffer_get_char(&msg);	buffer_free(&msg);	return decode_reply(type);}intssh_update_card(AuthenticationConnection *auth, int add, const char *reader_id, const char *pin){	Buffer msg;	int type;	buffer_init(&msg);	buffer_put_char(&msg, add ? SSH_AGENTC_ADD_SMARTCARD_KEY :	    SSH_AGENTC_REMOVE_SMARTCARD_KEY);	buffer_put_cstring(&msg, reader_id);	buffer_put_cstring(&msg, pin);	if (ssh_request_reply(auth, &msg, &msg) == 0) {		buffer_free(&msg);		return 0;	}	type = buffer_get_char(&msg);	buffer_free(&msg);	return decode_reply(type);}/* * Removes all identities from the agent.  This call is not meant to be used * by normal applications. */intssh_remove_all_identities(AuthenticationConnection *auth, int version){	Buffer msg;	int type;	int code = (version==1) ?		SSH_AGENTC_REMOVE_ALL_RSA_IDENTITIES :		SSH2_AGENTC_REMOVE_ALL_IDENTITIES;	buffer_init(&msg);	buffer_put_char(&msg, code);	if (ssh_request_reply(auth, &msg, &msg) == 0) {		buffer_free(&msg);		return 0;	}	type = buffer_get_char(&msg);	buffer_free(&msg);	return decode_reply(type);}intdecode_reply(int type){	switch (type) {	case SSH_AGENT_FAILURE:	case SSH_COM_AGENT2_FAILURE:	case SSH2_AGENT_FAILURE:		log("SSH_AGENT_FAILURE");		return 0;	case SSH_AGENT_SUCCESS:		return 1;	default:		fatal("Bad response from authentication agent: %d", type);	}	/* NOTREACHED */	return 0;}