diff options
author | Aris Adamantiadis <aris@0xbadc0de.be> | 2014-02-01 16:35:13 +0100 |
---|---|---|
committer | Aris Adamantiadis <aris@0xbadc0de.be> | 2014-02-04 16:01:02 +0100 |
commit | 90d3768f0fb7f89c5b114e5e996edc6deb9123b8 (patch) | |
tree | 2c9ae46b4b5382e26f38599a3b79045dd8cdc0e9 | |
parent | 6f66032209cc5893ba942f5cf9201492ce8c4bb3 (diff) | |
download | libssh-90d3768f0fb7f89c5b114e5e996edc6deb9123b8.tar.gz libssh-90d3768f0fb7f89c5b114e5e996edc6deb9123b8.tar.xz libssh-90d3768f0fb7f89c5b114e5e996edc6deb9123b8.zip |
known_hosts: add ssh_knownhosts_algorithms()
Goal of that function is to test the preferred key exchange methods
based on what's available in the known_hosts file
Conflicts:
tests/client/torture_knownhosts.c
-rw-r--r-- | include/libssh/libssh.h | 1 | ||||
-rw-r--r-- | src/known_hosts.c | 77 | ||||
-rw-r--r-- | tests/client/torture_knownhosts.c | 132 |
3 files changed, 210 insertions, 0 deletions
diff --git a/include/libssh/libssh.h b/include/libssh/libssh.h index b3f6ae4b..7cb7cf36 100644 --- a/include/libssh/libssh.h +++ b/include/libssh/libssh.h @@ -503,6 +503,7 @@ LIBSSH_API int ssh_key_cmp(const ssh_key k1, const ssh_key k2, enum ssh_keycmp_e what); +LIBSSH_API int ssh_knownhosts_algorithms(ssh_session session); LIBSSH_API int ssh_pki_generate(enum ssh_keytypes_e type, int parameter, ssh_key *pkey); LIBSSH_API int ssh_pki_import_privkey_base64(const char *b64_key, diff --git a/src/known_hosts.c b/src/known_hosts.c index 631ead9d..f2b2fde8 100644 --- a/src/known_hosts.c +++ b/src/known_hosts.c @@ -647,6 +647,83 @@ int ssh_write_knownhost(ssh_session session) { return 0; } +/** + * @brief Check which kind of host keys should be preferred for connection + * by reading the known_hosts file. + * + * @param[in] session The SSH session to use. + * + * @returns Bitfield of supported SSH hostkey algorithms + * SSH_ERROR on error + */ +int ssh_knownhosts_algorithms(ssh_session session) { + FILE *file = NULL; + char **tokens; + char *host; + char *hostport; + const char *type; + int match; + int ret = 0; + + if (session->opts.knownhosts == NULL) { + if (ssh_options_apply(session) < 0) { + ssh_set_error(session, SSH_REQUEST_DENIED, + "Can't find a known_hosts file"); + return SSH_ERROR; + } + } + + if (session->opts.host == NULL) { + return 0; + } + + host = ssh_lowercase(session->opts.host); + hostport = ssh_hostport(host, session->opts.port); + if (host == NULL || hostport == NULL) { + ssh_set_error_oom(session); + SAFE_FREE(host); + SAFE_FREE(hostport); + + return SSH_ERROR; + } + + do { + tokens = ssh_get_knownhost_line(&file, + session->opts.knownhosts, &type); + + /* End of file, return the current state */ + if (tokens == NULL) { + break; + } + match = match_hashed_host(host, tokens[0]); + if (match == 0){ + match = match_hostname(hostport, tokens[0], strlen(tokens[0])); + } + if (match == 0) { + match = match_hostname(host, tokens[0], strlen(tokens[0])); + } + if (match == 0) { + match = match_hashed_host(hostport, tokens[0]); + } + if (match) { + /* We got a match. Now check the key type */ + SSH_LOG(SSH_LOG_DEBUG, "server %s:%d has %s in known_hosts", + host, session->opts.port, type); + ret |= 1 << ssh_key_type_from_name(type); + } + tokens_free(tokens); + } while (1); + + SAFE_FREE(host); + SAFE_FREE(hostport); + if (file != NULL) { + fclose(file); + } + + /* Return the current state at end of file */ + return ret; +} + /** @} */ /* vim: set ts=4 sw=4 et cindent: */ diff --git a/tests/client/torture_knownhosts.c b/tests/client/torture_knownhosts.c index fe827cbc..a0cd3ab6 100644 --- a/tests/client/torture_knownhosts.c +++ b/tests/client/torture_knownhosts.c @@ -93,10 +93,142 @@ static void torture_knownhosts_port(void **state) { assert_true(rc == SSH_SERVER_KNOWN_OK); } +static void torture_knownhosts_fail(void **state) { + ssh_session session = *state; + FILE *file; + int rc; + + rc = ssh_options_set(session, SSH_OPTIONS_HOST, "localhost"); + assert_true(rc == SSH_OK); + + rc = ssh_options_set(session, SSH_OPTIONS_KNOWNHOSTS, KNOWNHOSTFILES); + assert_true(rc == SSH_OK); + + rc = ssh_options_set(session, SSH_OPTIONS_HOSTKEYS, "ssh-rsa"); + assert_true(rc == SSH_OK); + + file = fopen(KNOWNHOSTFILES, "w"); + assert_true(file != NULL); + fprintf(file, "localhost ssh-rsa %s\n", BADRSA); + fclose(file); + + rc = ssh_connect(session); + assert_true(rc==SSH_OK); + + rc = ssh_is_server_known(session); + assert_true(rc == SSH_SERVER_KNOWN_CHANGED); +} + +static void torture_knownhosts_other(void **state) { + ssh_session session = *state; + FILE *file; + int rc; + + rc = ssh_options_set(session, SSH_OPTIONS_HOST, "localhost"); + assert_true(rc == SSH_OK); + + rc = ssh_options_set(session, SSH_OPTIONS_KNOWNHOSTS, KNOWNHOSTFILES); + assert_true(rc == SSH_OK); + + rc = ssh_options_set(session, SSH_OPTIONS_HOSTKEYS, "ssh-dss"); + assert_true(rc == SSH_OK); + + file = fopen(KNOWNHOSTFILES, "w"); + assert_true(file != NULL); + fprintf(file, "localhost ssh-rsa %s\n", BADRSA); + fclose(file); + + rc = ssh_connect(session); + assert_true(rc==SSH_OK); + + rc = ssh_is_server_known(session); + assert_true(rc == SSH_SERVER_FOUND_OTHER); +} + +static void torture_knownhosts_conflict(void **state) { + ssh_session session = *state; + FILE *file; + int rc; + + rc = ssh_options_set(session, SSH_OPTIONS_HOST, "localhost"); + assert_true(rc == SSH_OK); + + rc = ssh_options_set(session, SSH_OPTIONS_KNOWNHOSTS, KNOWNHOSTFILES); + assert_true(rc == SSH_OK); + + rc = ssh_options_set(session, SSH_OPTIONS_HOSTKEYS, "ssh-rsa"); + assert_true(rc == SSH_OK); + + file = fopen(KNOWNHOSTFILES, "w"); + assert_true(file != NULL); + fprintf(file, "localhost ssh-rsa %s\n", BADRSA); + fprintf(file, "localhost ssh-dss %s\n", BADDSA); + fclose(file); + + rc = ssh_connect(session); + assert_true(rc==SSH_OK); + + rc = ssh_is_server_known(session); + assert_true(rc == SSH_SERVER_KNOWN_CHANGED); + + rc = ssh_write_knownhost(session); + assert_true(rc==SSH_OK); + + ssh_disconnect(session); + ssh_free(session); + + /* connect again and check host key */ + *state = session = ssh_new(); + + ssh_options_set(session, SSH_OPTIONS_HOST, "localhost"); + ssh_options_set(session, SSH_OPTIONS_KNOWNHOSTS, KNOWNHOSTFILES); + rc = ssh_options_set(session, SSH_OPTIONS_HOSTKEYS, "ssh-rsa"); + assert_true(rc == SSH_OK); + + rc = ssh_connect(session); + assert_true(rc == SSH_OK); + + rc = ssh_is_server_known(session); + assert_true(rc == SSH_SERVER_KNOWN_OK); +} + +static void torture_knownhosts_precheck(void **state) { + ssh_session session = *state; + FILE *file; + int rc; + int dsa; + int rsa; + + rc = ssh_options_set(session, SSH_OPTIONS_HOST, "localhost"); + assert_true(rc == SSH_OK); + + rc = ssh_options_set(session, SSH_OPTIONS_KNOWNHOSTS, KNOWNHOSTFILES); + assert_true(rc == SSH_OK); + + file = fopen(KNOWNHOSTFILES, "w"); + assert_true(file != NULL); + fprintf(file, "localhost ssh-rsa %s\n", BADRSA); + fprintf(file, "localhost ssh-dss %s\n", BADDSA); + fclose(file); + + rc = ssh_knownhosts_algorithms(session); + assert_true(rc != SSH_ERROR); + dsa = 1 << SSH_KEYTYPE_DSS; + rsa = 1 << SSH_KEYTYPE_RSA; + assert_true(rc & dsa); + assert_true(rc & rsa); + /* nothing else than dsa and rsa */ + assert_true((rc & (dsa | rsa)) == rc); +} + int torture_run_tests(void) { int rc; const UnitTest tests[] = { unit_test_setup_teardown(torture_knownhosts_port, setup, teardown), + unit_test_setup_teardown(torture_knownhosts_fail, setup, teardown), + unit_test_setup_teardown(torture_knownhosts_other, setup, teardown), + unit_test_setup_teardown(torture_knownhosts_conflict, setup, teardown), + unit_test_setup_teardown(torture_knownhosts_precheck, setup, teardown) }; ssh_init(); |