Annotation of src/usr.bin/ssh/dns.c, Revision 1.21
1.21 ! stevesk 1: /* $OpenBSD: dns.c,v 1.20 2006/07/08 21:47:12 stevesk Exp $ */
1.1 jakob 2:
3: /*
4: * Copyright (c) 2003 Wesley Griffin. All rights reserved.
5: * Copyright (c) 2003 Jakob Schlyter. All rights reserved.
6: *
7: * Redistribution and use in source and binary forms, with or without
8: * modification, are permitted provided that the following conditions
9: * are met:
10: * 1. Redistributions of source code must retain the above copyright
11: * notice, this list of conditions and the following disclaimer.
12: * 2. Redistributions in binary form must reproduce the above copyright
13: * notice, this list of conditions and the following disclaimer in the
14: * documentation and/or other materials provided with the distribution.
15: *
16: * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
17: * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
18: * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
19: * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
20: * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
21: * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
22: * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
23: * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
24: * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
25: * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
26: */
27:
28: #include "includes.h"
1.20 stevesk 29:
30: #include <sys/types.h>
31: #include <sys/socket.h>
1.1 jakob 32:
33: #include <netdb.h>
1.21 ! stevesk 34: #include <string.h>
1.1 jakob 35:
36: #include "xmalloc.h"
37: #include "key.h"
38: #include "dns.h"
39: #include "log.h"
40:
41: static const char *errset_text[] = {
42: "success", /* 0 ERRSET_SUCCESS */
43: "out of memory", /* 1 ERRSET_NOMEMORY */
44: "general failure", /* 2 ERRSET_FAIL */
45: "invalid parameter", /* 3 ERRSET_INVAL */
46: "name does not exist", /* 4 ERRSET_NONAME */
47: "data does not exist", /* 5 ERRSET_NODATA */
48: };
49:
50: static const char *
1.10 avsm 51: dns_result_totext(unsigned int res)
1.1 jakob 52: {
1.10 avsm 53: switch (res) {
1.1 jakob 54: case ERRSET_SUCCESS:
55: return errset_text[ERRSET_SUCCESS];
56: case ERRSET_NOMEMORY:
57: return errset_text[ERRSET_NOMEMORY];
58: case ERRSET_FAIL:
59: return errset_text[ERRSET_FAIL];
60: case ERRSET_INVAL:
61: return errset_text[ERRSET_INVAL];
62: case ERRSET_NONAME:
63: return errset_text[ERRSET_NONAME];
64: case ERRSET_NODATA:
65: return errset_text[ERRSET_NODATA];
66: default:
67: return "unknown error";
68: }
69: }
70:
71: /*
72: * Read SSHFP parameters from key buffer.
73: */
74: static int
75: dns_read_key(u_int8_t *algorithm, u_int8_t *digest_type,
1.8 jakob 76: u_char **digest, u_int *digest_len, const Key *key)
1.1 jakob 77: {
78: int success = 0;
79:
80: switch (key->type) {
81: case KEY_RSA:
1.3 jakob 82: *algorithm = SSHFP_KEY_RSA;
1.1 jakob 83: break;
84: case KEY_DSA:
1.3 jakob 85: *algorithm = SSHFP_KEY_DSA;
1.1 jakob 86: break;
87: default:
1.14 stevesk 88: *algorithm = SSHFP_KEY_RESERVED; /* 0 */
1.1 jakob 89: }
90:
91: if (*algorithm) {
1.3 jakob 92: *digest_type = SSHFP_HASH_SHA1;
1.1 jakob 93: *digest = key_fingerprint_raw(key, SSH_FP_SHA1, digest_len);
1.14 stevesk 94: if (*digest == NULL)
95: fatal("dns_read_key: null from key_fingerprint_raw()");
1.1 jakob 96: success = 1;
97: } else {
1.3 jakob 98: *digest_type = SSHFP_HASH_RESERVED;
1.1 jakob 99: *digest = NULL;
100: *digest_len = 0;
101: success = 0;
102: }
103:
104: return success;
105: }
106:
107: /*
108: * Read SSHFP parameters from rdata buffer.
109: */
110: static int
111: dns_read_rdata(u_int8_t *algorithm, u_int8_t *digest_type,
112: u_char **digest, u_int *digest_len, u_char *rdata, int rdata_len)
113: {
114: int success = 0;
115:
1.3 jakob 116: *algorithm = SSHFP_KEY_RESERVED;
117: *digest_type = SSHFP_HASH_RESERVED;
1.1 jakob 118:
119: if (rdata_len >= 2) {
120: *algorithm = rdata[0];
121: *digest_type = rdata[1];
122: *digest_len = rdata_len - 2;
123:
124: if (*digest_len > 0) {
125: *digest = (u_char *) xmalloc(*digest_len);
126: memcpy(*digest, rdata + 2, *digest_len);
127: } else {
1.18 deraadt 128: *digest = (u_char *)xstrdup("");
1.1 jakob 129: }
130:
131: success = 1;
132: }
133:
134: return success;
135: }
136:
1.11 jakob 137: /*
138: * Check if hostname is numerical.
139: * Returns -1 if hostname is numeric, 0 otherwise
140: */
141: static int
142: is_numeric_hostname(const char *hostname)
143: {
144: struct addrinfo hints, *ai;
145:
146: memset(&hints, 0, sizeof(hints));
147: hints.ai_socktype = SOCK_DGRAM;
148: hints.ai_flags = AI_NUMERICHOST;
149:
150: if (getaddrinfo(hostname, "0", &hints, &ai) == 0) {
151: freeaddrinfo(ai);
152: return -1;
153: }
154:
155: return 0;
156: }
1.1 jakob 157:
158: /*
159: * Verify the given hostname, address and host key using DNS.
1.9 djm 160: * Returns 0 if lookup succeeds, -1 otherwise
1.1 jakob 161: */
162: int
163: verify_host_key_dns(const char *hostname, struct sockaddr *address,
1.8 jakob 164: const Key *hostkey, int *flags)
1.1 jakob 165: {
1.12 djm 166: u_int counter;
1.1 jakob 167: int result;
1.4 jakob 168: struct rrsetinfo *fingerprints = NULL;
1.1 jakob 169:
170: u_int8_t hostkey_algorithm;
171: u_int8_t hostkey_digest_type;
172: u_char *hostkey_digest;
173: u_int hostkey_digest_len;
174:
175: u_int8_t dnskey_algorithm;
176: u_int8_t dnskey_digest_type;
177: u_char *dnskey_digest;
178: u_int dnskey_digest_len;
179:
1.8 jakob 180: *flags = 0;
1.1 jakob 181:
1.16 stevesk 182: debug3("verify_host_key_dns");
1.1 jakob 183: if (hostkey == NULL)
184: fatal("No key to look up!");
1.11 jakob 185:
186: if (is_numeric_hostname(hostname)) {
187: debug("skipped DNS lookup for numerical hostname");
188: return -1;
189: }
1.1 jakob 190:
191: result = getrrsetbyname(hostname, DNS_RDATACLASS_IN,
1.4 jakob 192: DNS_RDATATYPE_SSHFP, 0, &fingerprints);
1.1 jakob 193: if (result) {
194: verbose("DNS lookup error: %s", dns_result_totext(result));
1.8 jakob 195: return -1;
1.1 jakob 196: }
197:
1.8 jakob 198: if (fingerprints->rri_flags & RRSET_VALIDATED) {
199: *flags |= DNS_VERIFY_SECURE;
200: debug("found %d secure fingerprints in DNS",
201: fingerprints->rri_nrdatas);
202: } else {
203: debug("found %d insecure fingerprints in DNS",
204: fingerprints->rri_nrdatas);
1.1 jakob 205: }
206:
207: /* Initialize host key parameters */
208: if (!dns_read_key(&hostkey_algorithm, &hostkey_digest_type,
209: &hostkey_digest, &hostkey_digest_len, hostkey)) {
210: error("Error calculating host key fingerprint.");
1.5 jakob 211: freerrset(fingerprints);
1.8 jakob 212: return -1;
1.1 jakob 213: }
214:
1.8 jakob 215: if (fingerprints->rri_nrdatas)
216: *flags |= DNS_VERIFY_FOUND;
217:
1.13 stevesk 218: for (counter = 0; counter < fingerprints->rri_nrdatas; counter++) {
1.1 jakob 219: /*
220: * Extract the key from the answer. Ignore any badly
1.4 jakob 221: * formatted fingerprints.
1.1 jakob 222: */
223: if (!dns_read_rdata(&dnskey_algorithm, &dnskey_digest_type,
224: &dnskey_digest, &dnskey_digest_len,
1.4 jakob 225: fingerprints->rri_rdatas[counter].rdi_data,
226: fingerprints->rri_rdatas[counter].rdi_length)) {
1.1 jakob 227: verbose("Error parsing fingerprint from DNS.");
228: continue;
229: }
230:
231: /* Check if the current key is the same as the given key */
232: if (hostkey_algorithm == dnskey_algorithm &&
233: hostkey_digest_type == dnskey_digest_type) {
234:
235: if (hostkey_digest_len == dnskey_digest_len &&
236: memcmp(hostkey_digest, dnskey_digest,
237: hostkey_digest_len) == 0) {
238:
1.8 jakob 239: *flags |= DNS_VERIFY_MATCH;
1.1 jakob 240: }
241: }
1.14 stevesk 242: xfree(dnskey_digest);
1.1 jakob 243: }
244:
1.14 stevesk 245: xfree(hostkey_digest); /* from key_fingerprint_raw() */
1.4 jakob 246: freerrset(fingerprints);
1.1 jakob 247:
1.8 jakob 248: if (*flags & DNS_VERIFY_FOUND)
249: if (*flags & DNS_VERIFY_MATCH)
250: debug("matching host key fingerprint found in DNS");
251: else
252: debug("mismatching host key fingerprint found in DNS");
253: else
254: debug("no host key fingerprint found in DNS");
1.1 jakob 255:
1.8 jakob 256: return 0;
1.1 jakob 257: }
258:
259: /*
260: * Export the fingerprint of a key as a DNS resource record
261: */
262: int
1.8 jakob 263: export_dns_rr(const char *hostname, const Key *key, FILE *f, int generic)
1.1 jakob 264: {
265: u_int8_t rdata_pubkey_algorithm = 0;
1.3 jakob 266: u_int8_t rdata_digest_type = SSHFP_HASH_SHA1;
1.1 jakob 267: u_char *rdata_digest;
268: u_int rdata_digest_len;
269:
1.12 djm 270: u_int i;
1.1 jakob 271: int success = 0;
272:
273: if (dns_read_key(&rdata_pubkey_algorithm, &rdata_digest_type,
1.16 stevesk 274: &rdata_digest, &rdata_digest_len, key)) {
1.1 jakob 275:
276: if (generic)
277: fprintf(f, "%s IN TYPE%d \\# %d %02x %02x ", hostname,
278: DNS_RDATATYPE_SSHFP, 2 + rdata_digest_len,
279: rdata_pubkey_algorithm, rdata_digest_type);
280: else
281: fprintf(f, "%s IN SSHFP %d %d ", hostname,
282: rdata_pubkey_algorithm, rdata_digest_type);
283:
284: for (i = 0; i < rdata_digest_len; i++)
285: fprintf(f, "%02x", rdata_digest[i]);
286: fprintf(f, "\n");
1.14 stevesk 287: xfree(rdata_digest); /* from key_fingerprint_raw() */
1.1 jakob 288: success = 1;
289: } else {
1.16 stevesk 290: error("export_dns_rr: unsupported algorithm");
1.1 jakob 291: }
292:
293: return success;
294: }