Annotation of src/usr.bin/ssh/ssh-keyscan.c, Revision 1.18
1.1 markus 1: /*
2: * Copyright 1995, 1996 by David Mazieres <dm@lcs.mit.edu>.
3: *
4: * Modification and redistribution in source and binary forms is
5: * permitted provided that due credit is given to the author and the
6: * OpenBSD project (for instance by leaving this copyright notice
7: * intact).
8: */
9:
10: #include "includes.h"
1.18 ! deraadt 11: RCSID("$OpenBSD: ssh-keyscan.c,v 1.17 2001/02/21 07:37:04 deraadt Exp $");
1.1 markus 12:
13: #include <sys/queue.h>
14: #include <errno.h>
15:
1.5 markus 16: #include <openssl/bn.h>
1.1 markus 17:
18: #include "xmalloc.h"
19: #include "ssh.h"
1.10 markus 20: #include "ssh1.h"
1.1 markus 21: #include "key.h"
22: #include "buffer.h"
23: #include "bufaux.h"
1.11 markus 24: #include "log.h"
1.18 ! deraadt 25: #include "atomicio.h"
1.1 markus 26:
27: static int argno = 1; /* Number of argument currently being parsed */
28:
29: int family = AF_UNSPEC; /* IPv4, IPv6 or both */
30:
31: #define MAXMAXFD 256
32:
33: /* The number of seconds after which to give up on a TCP connection */
34: int timeout = 5;
35:
36: int maxfd;
1.18 ! deraadt 37: #define MAXCON (maxfd - 10)
1.1 markus 38:
1.3 markus 39: extern char *__progname;
1.1 markus 40: fd_set read_wait;
41: int ncon;
42:
43: /*
44: * Keep a connection structure for each file descriptor. The state
45: * associated with file descriptor n is held in fdcon[n].
46: */
47: typedef struct Connection {
1.6 markus 48: u_char c_status; /* State of connection on this file desc. */
1.1 markus 49: #define CS_UNUSED 0 /* File descriptor unused */
50: #define CS_CON 1 /* Waiting to connect/read greeting */
51: #define CS_SIZE 2 /* Waiting to read initial packet size */
52: #define CS_KEYS 3 /* Waiting to read public key packet */
53: int c_fd; /* Quick lookup: c->c_fd == c - fdcon */
54: int c_plen; /* Packet length field for ssh packet */
55: int c_len; /* Total bytes which must be read. */
56: int c_off; /* Length of data read so far. */
57: char *c_namebase; /* Address to free for c_name and c_namelist */
58: char *c_name; /* Hostname of connection for errors */
59: char *c_namelist; /* Pointer to other possible addresses */
60: char *c_output_name; /* Hostname of connection for output */
61: char *c_data; /* Data read from this fd */
62: struct timeval c_tv; /* Time at which connection gets aborted */
63: TAILQ_ENTRY(Connection) c_link; /* List of connections in timeout order. */
64: } con;
65:
66: TAILQ_HEAD(conlist, Connection) tq; /* Timeout Queue */
67: con *fdcon;
68:
69: /*
70: * This is just a wrapper around fgets() to make it usable.
71: */
72:
73: /* Stress-test. Increase this later. */
74: #define LINEBUF_SIZE 16
75:
76: typedef struct {
77: char *buf;
1.6 markus 78: u_int size;
1.1 markus 79: int lineno;
80: const char *filename;
81: FILE *stream;
82: void (*errfun) (const char *,...);
83: } Linebuf;
84:
1.17 deraadt 85: static __inline__ Linebuf *
1.1 markus 86: Linebuf_alloc(const char *filename, void (*errfun) (const char *,...))
87: {
88: Linebuf *lb;
89:
90: if (!(lb = malloc(sizeof(*lb)))) {
91: if (errfun)
92: (*errfun) ("linebuf (%s): malloc failed\n", lb->filename);
93: return (NULL);
94: }
95: if (filename) {
96: lb->filename = filename;
97: if (!(lb->stream = fopen(filename, "r"))) {
1.9 markus 98: xfree(lb);
1.1 markus 99: if (errfun)
100: (*errfun) ("%s: %s\n", filename, strerror(errno));
101: return (NULL);
102: }
103: } else {
104: lb->filename = "(stdin)";
105: lb->stream = stdin;
106: }
107:
108: if (!(lb->buf = malloc(lb->size = LINEBUF_SIZE))) {
109: if (errfun)
110: (*errfun) ("linebuf (%s): malloc failed\n", lb->filename);
1.9 markus 111: xfree(lb);
1.1 markus 112: return (NULL);
113: }
114: lb->errfun = errfun;
115: lb->lineno = 0;
116: return (lb);
117: }
118:
1.17 deraadt 119: static __inline__ void
1.1 markus 120: Linebuf_free(Linebuf * lb)
121: {
122: fclose(lb->stream);
1.9 markus 123: xfree(lb->buf);
124: xfree(lb);
1.1 markus 125: }
126:
1.17 deraadt 127: static __inline__ void
1.1 markus 128: Linebuf_restart(Linebuf * lb)
129: {
130: clearerr(lb->stream);
131: rewind(lb->stream);
132: lb->lineno = 0;
133: }
134:
1.17 deraadt 135: static __inline__ int
1.1 markus 136: Linebuf_lineno(Linebuf * lb)
137: {
138: return (lb->lineno);
139: }
140:
1.17 deraadt 141: static __inline__ char *
1.14 markus 142: Linebuf_getline(Linebuf * lb)
1.1 markus 143: {
144: int n = 0;
145:
146: lb->lineno++;
147: for (;;) {
148: /* Read a line */
149: if (!fgets(&lb->buf[n], lb->size - n, lb->stream)) {
150: if (ferror(lb->stream) && lb->errfun)
1.17 deraadt 151: (*lb->errfun) ("%s: %s\n", lb->filename,
152: strerror(errno));
1.1 markus 153: return (NULL);
154: }
155: n = strlen(lb->buf);
156:
157: /* Return it or an error if it fits */
158: if (n > 0 && lb->buf[n - 1] == '\n') {
159: lb->buf[n - 1] = '\0';
160: return (lb->buf);
161: }
162: if (n != lb->size - 1) {
163: if (lb->errfun)
1.17 deraadt 164: (*lb->errfun) ("%s: skipping incomplete last line\n",
165: lb->filename);
1.1 markus 166: return (NULL);
167: }
168: /* Double the buffer if we need more space */
169: if (!(lb->buf = realloc(lb->buf, (lb->size *= 2)))) {
170: if (lb->errfun)
1.17 deraadt 171: (*lb->errfun) ("linebuf (%s): realloc failed\n",
172: lb->filename);
1.1 markus 173: return (NULL);
174: }
175: }
176: }
177:
178: static int
179: fdlim_get(int hard)
180: {
181: struct rlimit rlfd;
1.17 deraadt 182:
1.1 markus 183: if (getrlimit(RLIMIT_NOFILE, &rlfd) < 0)
184: return (-1);
185: if ((hard ? rlfd.rlim_max : rlfd.rlim_cur) == RLIM_INFINITY)
186: return 10000;
187: else
188: return hard ? rlfd.rlim_max : rlfd.rlim_cur;
189: }
190:
191: static int
192: fdlim_set(int lim)
193: {
194: struct rlimit rlfd;
195: if (lim <= 0)
196: return (-1);
197: if (getrlimit(RLIMIT_NOFILE, &rlfd) < 0)
198: return (-1);
199: rlfd.rlim_cur = lim;
200: if (setrlimit(RLIMIT_NOFILE, &rlfd) < 0)
201: return (-1);
202: return (0);
203: }
204:
205: /*
206: * This is an strsep function that returns a null field for adjacent
207: * separators. This is the same as the 4.4BSD strsep, but different from the
208: * one in the GNU libc.
209: */
1.17 deraadt 210: static __inline__ char *
1.1 markus 211: xstrsep(char **str, const char *delim)
212: {
213: char *s, *e;
214:
215: if (!**str)
216: return (NULL);
217:
218: s = *str;
219: e = s + strcspn(s, delim);
220:
221: if (*e != '\0')
222: *e++ = '\0';
223: *str = e;
224:
225: return (s);
226: }
227:
228: /*
229: * Get the next non-null token (like GNU strsep). Strsep() will return a
230: * null token for two adjacent separators, so we may have to loop.
231: */
232: char *
233: strnnsep(char **stringp, char *delim)
234: {
235: char *tok;
236:
237: do {
238: tok = xstrsep(stringp, delim);
239: } while (tok && *tok == '\0');
240: return (tok);
241: }
242:
243: void
244: keyprint(char *host, char *output_name, char *kd, int len)
245: {
246: static Key *rsa;
247: static Buffer msg;
248:
249: if (rsa == NULL) {
250: buffer_init(&msg);
251: rsa = key_new(KEY_RSA1);
252: }
253: buffer_append(&msg, kd, len);
254: buffer_consume(&msg, 8 - (len & 7)); /* padding */
255: if (buffer_get_char(&msg) != (int) SSH_SMSG_PUBLIC_KEY) {
256: error("%s: invalid packet type", host);
257: buffer_clear(&msg);
258: return;
259: }
260: buffer_consume(&msg, 8); /* cookie */
261:
262: /* server key */
263: (void) buffer_get_int(&msg);
264: buffer_get_bignum(&msg, rsa->rsa->e);
265: buffer_get_bignum(&msg, rsa->rsa->n);
266:
267: /* host key */
268: (void) buffer_get_int(&msg);
269: buffer_get_bignum(&msg, rsa->rsa->e);
270: buffer_get_bignum(&msg, rsa->rsa->n);
271: buffer_clear(&msg);
272:
273: fprintf(stdout, "%s ", output_name ? output_name : host);
274: key_write(rsa, stdout);
275: fputs("\n", stdout);
276: }
277:
278: int
279: tcpconnect(char *host)
280: {
281: struct addrinfo hints, *ai, *aitop;
282: char strport[NI_MAXSERV];
283: int gaierr, s = -1;
284:
1.8 markus 285: snprintf(strport, sizeof strport, "%d", SSH_DEFAULT_PORT);
1.1 markus 286: memset(&hints, 0, sizeof(hints));
287: hints.ai_family = family;
288: hints.ai_socktype = SOCK_STREAM;
289: if ((gaierr = getaddrinfo(host, strport, &hints, &aitop)) != 0)
290: fatal("getaddrinfo %s: %s", host, gai_strerror(gaierr));
291: for (ai = aitop; ai; ai = ai->ai_next) {
292: s = socket(ai->ai_family, SOCK_STREAM, 0);
293: if (s < 0) {
294: error("socket: %s", strerror(errno));
295: continue;
296: }
1.7 markus 297: if (fcntl(s, F_SETFL, O_NONBLOCK) < 0)
1.1 markus 298: fatal("F_SETFL: %s", strerror(errno));
299: if (connect(s, ai->ai_addr, ai->ai_addrlen) < 0 &&
300: errno != EINPROGRESS)
301: error("connect (`%s'): %s", host, strerror(errno));
302: else
303: break;
304: close(s);
305: s = -1;
306: }
307: freeaddrinfo(aitop);
308: return s;
309: }
310:
311: int
312: conalloc(char *iname, char *oname)
313: {
314: int s;
315: char *namebase, *name, *namelist;
316:
317: namebase = namelist = xstrdup(iname);
318:
319: do {
320: name = xstrsep(&namelist, ",");
321: if (!name) {
1.9 markus 322: xfree(namebase);
1.1 markus 323: return (-1);
324: }
325: } while ((s = tcpconnect(name)) < 0);
326:
327: if (s >= maxfd)
1.4 markus 328: fatal("conalloc: fdno %d too high", s);
1.1 markus 329: if (fdcon[s].c_status)
1.4 markus 330: fatal("conalloc: attempt to reuse fdno %d", s);
1.1 markus 331:
332: fdcon[s].c_fd = s;
333: fdcon[s].c_status = CS_CON;
334: fdcon[s].c_namebase = namebase;
335: fdcon[s].c_name = name;
336: fdcon[s].c_namelist = namelist;
337: fdcon[s].c_output_name = xstrdup(oname);
338: fdcon[s].c_data = (char *) &fdcon[s].c_plen;
339: fdcon[s].c_len = 4;
340: fdcon[s].c_off = 0;
341: gettimeofday(&fdcon[s].c_tv, NULL);
342: fdcon[s].c_tv.tv_sec += timeout;
343: TAILQ_INSERT_TAIL(&tq, &fdcon[s], c_link);
344: FD_SET(s, &read_wait);
345: ncon++;
346: return (s);
347: }
348:
349: void
350: confree(int s)
351: {
352: if (s >= maxfd || fdcon[s].c_status == CS_UNUSED)
1.4 markus 353: fatal("confree: attempt to free bad fdno %d", s);
1.18 ! deraadt 354: close(s);
1.9 markus 355: xfree(fdcon[s].c_namebase);
356: xfree(fdcon[s].c_output_name);
1.1 markus 357: if (fdcon[s].c_status == CS_KEYS)
1.9 markus 358: xfree(fdcon[s].c_data);
1.1 markus 359: fdcon[s].c_status = CS_UNUSED;
360: TAILQ_REMOVE(&tq, &fdcon[s], c_link);
361: FD_CLR(s, &read_wait);
362: ncon--;
363: }
364:
365: void
366: contouch(int s)
367: {
368: TAILQ_REMOVE(&tq, &fdcon[s], c_link);
369: gettimeofday(&fdcon[s].c_tv, NULL);
370: fdcon[s].c_tv.tv_sec += timeout;
371: TAILQ_INSERT_TAIL(&tq, &fdcon[s], c_link);
372: }
373:
374: int
375: conrecycle(int s)
376: {
377: int ret;
378: con *c = &fdcon[s];
379: char *iname, *oname;
380:
381: iname = xstrdup(c->c_namelist);
1.9 markus 382: oname = xstrdup(c->c_output_name);
1.1 markus 383: confree(s);
384: ret = conalloc(iname, oname);
1.9 markus 385: xfree(iname);
386: xfree(oname);
1.1 markus 387: return (ret);
388: }
389:
390: void
391: congreet(int s)
392: {
393: char buf[80];
394: int n;
395: con *c = &fdcon[s];
396:
397: n = read(s, buf, sizeof(buf));
398: if (n < 0) {
399: if (errno != ECONNREFUSED)
400: error("read (%s): %s", c->c_name, strerror(errno));
401: conrecycle(s);
402: return;
403: }
404: if (buf[n - 1] != '\n') {
405: error("%s: bad greeting", c->c_name);
406: confree(s);
407: return;
408: }
409: buf[n - 1] = '\0';
410: fprintf(stderr, "# %s %s\n", c->c_name, buf);
411: n = snprintf(buf, sizeof buf, "SSH-1.5-OpenSSH-keyscan\r\n");
1.18 ! deraadt 412: if (atomicio(write, s, buf, n) != n) {
1.1 markus 413: error("write (%s): %s", c->c_name, strerror(errno));
414: confree(s);
415: return;
416: }
417: c->c_status = CS_SIZE;
418: contouch(s);
419: }
420:
421: void
422: conread(int s)
423: {
424: int n;
425: con *c = &fdcon[s];
426:
427: if (c->c_status == CS_CON) {
428: congreet(s);
429: return;
430: }
431: n = read(s, c->c_data + c->c_off, c->c_len - c->c_off);
432: if (n < 0) {
433: error("read (%s): %s", c->c_name, strerror(errno));
434: confree(s);
435: return;
436: }
437: c->c_off += n;
438:
439: if (c->c_off == c->c_len)
440: switch (c->c_status) {
441: case CS_SIZE:
442: c->c_plen = htonl(c->c_plen);
443: c->c_len = c->c_plen + 8 - (c->c_plen & 7);
444: c->c_off = 0;
445: c->c_data = xmalloc(c->c_len);
446: c->c_status = CS_KEYS;
447: break;
448: case CS_KEYS:
449: keyprint(c->c_name, c->c_output_name, c->c_data, c->c_plen);
450: confree(s);
451: return;
452: break;
453: default:
1.4 markus 454: fatal("conread: invalid status %d", c->c_status);
1.1 markus 455: break;
456: }
457:
458: contouch(s);
459: }
460:
461: void
462: conloop(void)
463: {
464: fd_set r, e;
465: struct timeval seltime, now;
466: int i;
467: con *c;
468:
469: gettimeofday(&now, NULL);
470: c = tq.tqh_first;
471:
1.18 ! deraadt 472: if (c && (c->c_tv.tv_sec > now.tv_sec ||
! 473: (c->c_tv.tv_sec == now.tv_sec && c->c_tv.tv_usec > now.tv_usec))) {
1.1 markus 474: seltime = c->c_tv;
475: seltime.tv_sec -= now.tv_sec;
476: seltime.tv_usec -= now.tv_usec;
1.13 itojun 477: if (seltime.tv_usec < 0) {
1.1 markus 478: seltime.tv_usec += 1000000;
479: seltime.tv_sec--;
480: }
481: } else
482: seltime.tv_sec = seltime.tv_usec = 0;
483:
484: r = e = read_wait;
1.16 deraadt 485: while (select(maxfd, &r, NULL, &e, &seltime) == -1 &&
486: (errno == EAGAIN || errno == EINTR))
487: ;
488:
1.18 ! deraadt 489: for (i = 0; i < maxfd; i++) {
1.1 markus 490: if (FD_ISSET(i, &e)) {
491: error("%s: exception!", fdcon[i].c_name);
492: confree(i);
493: } else if (FD_ISSET(i, &r))
494: conread(i);
1.18 ! deraadt 495: }
1.1 markus 496:
497: c = tq.tqh_first;
1.18 ! deraadt 498: while (c && (c->c_tv.tv_sec < now.tv_sec ||
! 499: (c->c_tv.tv_sec == now.tv_sec && c->c_tv.tv_usec < now.tv_usec))) {
1.1 markus 500: int s = c->c_fd;
1.18 ! deraadt 501:
1.1 markus 502: c = c->c_link.tqe_next;
503: conrecycle(s);
504: }
505: }
506:
507: char *
508: nexthost(int argc, char **argv)
509: {
510: static Linebuf *lb;
511:
512: for (;;) {
513: if (!lb) {
514: if (argno >= argc)
515: return (NULL);
516: if (argv[argno][0] != '-')
517: return (argv[argno++]);
518: if (!strcmp(argv[argno], "--")) {
519: if (++argno >= argc)
520: return (NULL);
521: return (argv[argno++]);
522: } else if (!strncmp(argv[argno], "-f", 2)) {
523: char *fname;
1.18 ! deraadt 524:
1.1 markus 525: if (argv[argno][2])
526: fname = &argv[argno++][2];
527: else if (++argno >= argc) {
528: error("missing filename for `-f'");
529: return (NULL);
530: } else
531: fname = argv[argno++];
532: if (!strcmp(fname, "-"))
533: fname = NULL;
1.2 markus 534: lb = Linebuf_alloc(fname, error);
1.1 markus 535: } else
1.18 ! deraadt 536: error("ignoring invalid/misplaced option `%s'",
! 537: argv[argno++]);
1.1 markus 538: } else {
539: char *line;
1.18 ! deraadt 540:
1.14 markus 541: line = Linebuf_getline(lb);
1.1 markus 542: if (line)
543: return (line);
544: Linebuf_free(lb);
545: lb = NULL;
546: }
547: }
548: }
549:
550: static void
551: usage(void)
552: {
1.4 markus 553: fatal("usage: %s [-t timeout] { [--] host | -f file } ...", __progname);
1.1 markus 554: return;
555: }
556:
557: int
558: main(int argc, char **argv)
559: {
560: char *host = NULL;
561:
562: TAILQ_INIT(&tq);
563:
564: if (argc <= argno)
565: usage();
566:
567: if (argv[1][0] == '-' && argv[1][1] == 't') {
568: argno++;
569: if (argv[1][2])
570: timeout = atoi(&argv[1][2]);
571: else {
572: if (argno >= argc)
573: usage();
574: timeout = atoi(argv[argno++]);
575: }
576: if (timeout <= 0)
577: usage();
578: }
579: if (argc <= argno)
580: usage();
581:
582: maxfd = fdlim_get(1);
583: if (maxfd < 0)
1.4 markus 584: fatal("%s: fdlim_get: bad value", __progname);
1.1 markus 585: if (maxfd > MAXMAXFD)
586: maxfd = MAXMAXFD;
1.18 ! deraadt 587: if (MAXCON <= 0)
1.4 markus 588: fatal("%s: not enough file descriptors", __progname);
1.1 markus 589: if (maxfd > fdlim_get(0))
590: fdlim_set(maxfd);
591: fdcon = xmalloc(maxfd * sizeof(con));
1.15 itojun 592: memset(fdcon, 0, maxfd * sizeof(con));
1.1 markus 593:
594: do {
1.18 ! deraadt 595: while (ncon < MAXCON) {
1.1 markus 596: char *name;
597:
598: host = nexthost(argc, argv);
599: if (host == NULL)
600: break;
601: name = strnnsep(&host, " \t\n");
602: conalloc(name, *host ? host : name);
603: }
604: conloop();
605: } while (host);
606: while (ncon > 0)
607: conloop();
608:
609: return (0);
610: }