Annotation of src/usr.bin/ssh/dns.c, Revision 1.15
1.15 ! stevesk 1: /* $OpenBSD: dns.c,v 1.14 2005/10/17 13:45:05 stevesk Exp $ */
1.1 jakob 2:
3: /*
4: * Copyright (c) 2003 Wesley Griffin. All rights reserved.
5: * Copyright (c) 2003 Jakob Schlyter. All rights reserved.
6: *
7: * Redistribution and use in source and binary forms, with or without
8: * modification, are permitted provided that the following conditions
9: * are met:
10: * 1. Redistributions of source code must retain the above copyright
11: * notice, this list of conditions and the following disclaimer.
12: * 2. Redistributions in binary form must reproduce the above copyright
13: * notice, this list of conditions and the following disclaimer in the
14: * documentation and/or other materials provided with the distribution.
15: *
16: * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
17: * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
18: * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
19: * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
20: * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
21: * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
22: * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
23: * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
24: * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
25: * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
26: */
27:
28:
29: #include "includes.h"
30:
31: #include <openssl/bn.h>
32: #include <netdb.h>
33:
34: #include "xmalloc.h"
35: #include "key.h"
36: #include "dns.h"
37: #include "log.h"
38:
1.15 ! stevesk 39: RCSID("$OpenBSD: dns.c,v 1.14 2005/10/17 13:45:05 stevesk Exp $");
1.1 jakob 40:
41: static const char *errset_text[] = {
42: "success", /* 0 ERRSET_SUCCESS */
43: "out of memory", /* 1 ERRSET_NOMEMORY */
44: "general failure", /* 2 ERRSET_FAIL */
45: "invalid parameter", /* 3 ERRSET_INVAL */
46: "name does not exist", /* 4 ERRSET_NONAME */
47: "data does not exist", /* 5 ERRSET_NODATA */
48: };
49:
50: static const char *
1.10 avsm 51: dns_result_totext(unsigned int res)
1.1 jakob 52: {
1.10 avsm 53: switch (res) {
1.1 jakob 54: case ERRSET_SUCCESS:
55: return errset_text[ERRSET_SUCCESS];
56: case ERRSET_NOMEMORY:
57: return errset_text[ERRSET_NOMEMORY];
58: case ERRSET_FAIL:
59: return errset_text[ERRSET_FAIL];
60: case ERRSET_INVAL:
61: return errset_text[ERRSET_INVAL];
62: case ERRSET_NONAME:
63: return errset_text[ERRSET_NONAME];
64: case ERRSET_NODATA:
65: return errset_text[ERRSET_NODATA];
66: default:
67: return "unknown error";
68: }
69: }
70:
71: /*
72: * Read SSHFP parameters from key buffer.
73: */
74: static int
75: dns_read_key(u_int8_t *algorithm, u_int8_t *digest_type,
1.8 jakob 76: u_char **digest, u_int *digest_len, const Key *key)
1.1 jakob 77: {
78: int success = 0;
79:
80: switch (key->type) {
81: case KEY_RSA:
1.3 jakob 82: *algorithm = SSHFP_KEY_RSA;
1.1 jakob 83: break;
84: case KEY_DSA:
1.3 jakob 85: *algorithm = SSHFP_KEY_DSA;
1.1 jakob 86: break;
87: default:
1.14 stevesk 88: *algorithm = SSHFP_KEY_RESERVED; /* 0 */
1.1 jakob 89: }
90:
91: if (*algorithm) {
1.3 jakob 92: *digest_type = SSHFP_HASH_SHA1;
1.1 jakob 93: *digest = key_fingerprint_raw(key, SSH_FP_SHA1, digest_len);
1.14 stevesk 94: if (*digest == NULL)
95: fatal("dns_read_key: null from key_fingerprint_raw()");
1.1 jakob 96: success = 1;
97: } else {
1.3 jakob 98: *digest_type = SSHFP_HASH_RESERVED;
1.1 jakob 99: *digest = NULL;
100: *digest_len = 0;
101: success = 0;
102: }
103:
104: return success;
105: }
106:
107: /*
108: * Read SSHFP parameters from rdata buffer.
109: */
110: static int
111: dns_read_rdata(u_int8_t *algorithm, u_int8_t *digest_type,
112: u_char **digest, u_int *digest_len, u_char *rdata, int rdata_len)
113: {
114: int success = 0;
115:
1.3 jakob 116: *algorithm = SSHFP_KEY_RESERVED;
117: *digest_type = SSHFP_HASH_RESERVED;
1.1 jakob 118:
119: if (rdata_len >= 2) {
120: *algorithm = rdata[0];
121: *digest_type = rdata[1];
122: *digest_len = rdata_len - 2;
123:
124: if (*digest_len > 0) {
125: *digest = (u_char *) xmalloc(*digest_len);
126: memcpy(*digest, rdata + 2, *digest_len);
127: } else {
1.14 stevesk 128: *digest = xstrdup("");
1.1 jakob 129: }
130:
131: success = 1;
132: }
133:
134: return success;
135: }
136:
1.11 jakob 137: /*
138: * Check if hostname is numerical.
139: * Returns -1 if hostname is numeric, 0 otherwise
140: */
141: static int
142: is_numeric_hostname(const char *hostname)
143: {
144: struct addrinfo hints, *ai;
145:
146: memset(&hints, 0, sizeof(hints));
147: hints.ai_socktype = SOCK_DGRAM;
148: hints.ai_flags = AI_NUMERICHOST;
149:
150: if (getaddrinfo(hostname, "0", &hints, &ai) == 0) {
151: freeaddrinfo(ai);
152: return -1;
153: }
154:
155: return 0;
156: }
1.1 jakob 157:
158: /*
159: * Verify the given hostname, address and host key using DNS.
1.9 djm 160: * Returns 0 if lookup succeeds, -1 otherwise
1.1 jakob 161: */
162: int
163: verify_host_key_dns(const char *hostname, struct sockaddr *address,
1.8 jakob 164: const Key *hostkey, int *flags)
1.1 jakob 165: {
1.12 djm 166: u_int counter;
1.1 jakob 167: int result;
1.4 jakob 168: struct rrsetinfo *fingerprints = NULL;
1.1 jakob 169:
170: u_int8_t hostkey_algorithm;
171: u_int8_t hostkey_digest_type;
172: u_char *hostkey_digest;
173: u_int hostkey_digest_len;
174:
175: u_int8_t dnskey_algorithm;
176: u_int8_t dnskey_digest_type;
177: u_char *dnskey_digest;
178: u_int dnskey_digest_len;
179:
1.8 jakob 180: *flags = 0;
1.1 jakob 181:
182: debug3("verify_hostkey_dns");
183: if (hostkey == NULL)
184: fatal("No key to look up!");
1.11 jakob 185:
186: if (is_numeric_hostname(hostname)) {
187: debug("skipped DNS lookup for numerical hostname");
188: return -1;
189: }
1.1 jakob 190:
191: result = getrrsetbyname(hostname, DNS_RDATACLASS_IN,
1.4 jakob 192: DNS_RDATATYPE_SSHFP, 0, &fingerprints);
1.1 jakob 193: if (result) {
194: verbose("DNS lookup error: %s", dns_result_totext(result));
1.8 jakob 195: return -1;
1.1 jakob 196: }
197:
1.8 jakob 198: if (fingerprints->rri_flags & RRSET_VALIDATED) {
199: *flags |= DNS_VERIFY_SECURE;
200: debug("found %d secure fingerprints in DNS",
201: fingerprints->rri_nrdatas);
202: } else {
203: debug("found %d insecure fingerprints in DNS",
204: fingerprints->rri_nrdatas);
1.1 jakob 205: }
206:
207: /* Initialize host key parameters */
208: if (!dns_read_key(&hostkey_algorithm, &hostkey_digest_type,
209: &hostkey_digest, &hostkey_digest_len, hostkey)) {
210: error("Error calculating host key fingerprint.");
1.5 jakob 211: freerrset(fingerprints);
1.8 jakob 212: return -1;
1.1 jakob 213: }
214:
1.8 jakob 215: if (fingerprints->rri_nrdatas)
216: *flags |= DNS_VERIFY_FOUND;
217:
1.13 stevesk 218: for (counter = 0; counter < fingerprints->rri_nrdatas; counter++) {
1.1 jakob 219: /*
220: * Extract the key from the answer. Ignore any badly
1.4 jakob 221: * formatted fingerprints.
1.1 jakob 222: */
223: if (!dns_read_rdata(&dnskey_algorithm, &dnskey_digest_type,
224: &dnskey_digest, &dnskey_digest_len,
1.4 jakob 225: fingerprints->rri_rdatas[counter].rdi_data,
226: fingerprints->rri_rdatas[counter].rdi_length)) {
1.1 jakob 227: verbose("Error parsing fingerprint from DNS.");
228: continue;
229: }
230:
231: /* Check if the current key is the same as the given key */
232: if (hostkey_algorithm == dnskey_algorithm &&
233: hostkey_digest_type == dnskey_digest_type) {
234:
235: if (hostkey_digest_len == dnskey_digest_len &&
236: memcmp(hostkey_digest, dnskey_digest,
237: hostkey_digest_len) == 0) {
238:
1.8 jakob 239: *flags |= DNS_VERIFY_MATCH;
1.1 jakob 240: }
241: }
1.14 stevesk 242: xfree(dnskey_digest);
1.1 jakob 243: }
244:
1.14 stevesk 245: xfree(hostkey_digest); /* from key_fingerprint_raw() */
1.4 jakob 246: freerrset(fingerprints);
1.1 jakob 247:
1.8 jakob 248: if (*flags & DNS_VERIFY_FOUND)
249: if (*flags & DNS_VERIFY_MATCH)
250: debug("matching host key fingerprint found in DNS");
251: else
252: debug("mismatching host key fingerprint found in DNS");
253: else
254: debug("no host key fingerprint found in DNS");
1.1 jakob 255:
1.8 jakob 256: return 0;
1.1 jakob 257: }
258:
259:
260: /*
261: * Export the fingerprint of a key as a DNS resource record
262: */
263: int
1.8 jakob 264: export_dns_rr(const char *hostname, const Key *key, FILE *f, int generic)
1.1 jakob 265: {
266: u_int8_t rdata_pubkey_algorithm = 0;
1.3 jakob 267: u_int8_t rdata_digest_type = SSHFP_HASH_SHA1;
1.1 jakob 268: u_char *rdata_digest;
269: u_int rdata_digest_len;
270:
1.12 djm 271: u_int i;
1.1 jakob 272: int success = 0;
273:
274: if (dns_read_key(&rdata_pubkey_algorithm, &rdata_digest_type,
275: &rdata_digest, &rdata_digest_len, key)) {
276:
277: if (generic)
278: fprintf(f, "%s IN TYPE%d \\# %d %02x %02x ", hostname,
279: DNS_RDATATYPE_SSHFP, 2 + rdata_digest_len,
280: rdata_pubkey_algorithm, rdata_digest_type);
281: else
282: fprintf(f, "%s IN SSHFP %d %d ", hostname,
283: rdata_pubkey_algorithm, rdata_digest_type);
284:
285: for (i = 0; i < rdata_digest_len; i++)
286: fprintf(f, "%02x", rdata_digest[i]);
287: fprintf(f, "\n");
1.14 stevesk 288: xfree(rdata_digest); /* from key_fingerprint_raw() */
1.1 jakob 289: success = 1;
290: } else {
291: error("dns_export_rr: unsupported algorithm");
292: }
293:
294: return success;
295: }
![[BACK]](/icons/back.gif){kind=icon}
Return to dns.c CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / src / usr.bin / ssh