aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAris Adamantiadis <aris@0xbadc0de.be>2014-02-01 16:35:13 +0100
committerAris Adamantiadis <aris@0xbadc0de.be>2014-02-04 16:01:02 +0100
commit90d3768f0fb7f89c5b114e5e996edc6deb9123b8 (patch)
tree2c9ae46b4b5382e26f38599a3b79045dd8cdc0e9
parent6f66032209cc5893ba942f5cf9201492ce8c4bb3 (diff)
downloadlibssh-90d3768f0fb7f89c5b114e5e996edc6deb9123b8.tar.gz
libssh-90d3768f0fb7f89c5b114e5e996edc6deb9123b8.tar.xz
libssh-90d3768f0fb7f89c5b114e5e996edc6deb9123b8.zip
known_hosts: add ssh_knownhosts_algorithms()
Goal of that function is to test the preferred key exchange methods based on what's available in the known_hosts file Conflicts: tests/client/torture_knownhosts.c
-rw-r--r--include/libssh/libssh.h1
-rw-r--r--src/known_hosts.c77
-rw-r--r--tests/client/torture_knownhosts.c132
3 files changed, 210 insertions, 0 deletions
diff --git a/include/libssh/libssh.h b/include/libssh/libssh.h
index b3f6ae4b..7cb7cf36 100644
--- a/include/libssh/libssh.h
+++ b/include/libssh/libssh.h
@@ -503,6 +503,7 @@ LIBSSH_API int ssh_key_cmp(const ssh_key k1,
const ssh_key k2,
enum ssh_keycmp_e what);
+LIBSSH_API int ssh_knownhosts_algorithms(ssh_session session);
LIBSSH_API int ssh_pki_generate(enum ssh_keytypes_e type, int parameter,
ssh_key *pkey);
LIBSSH_API int ssh_pki_import_privkey_base64(const char *b64_key,
diff --git a/src/known_hosts.c b/src/known_hosts.c
index 631ead9d..f2b2fde8 100644
--- a/src/known_hosts.c
+++ b/src/known_hosts.c
@@ -647,6 +647,83 @@ int ssh_write_knownhost(ssh_session session) {
return 0;
}
+/**
+ * @brief Check which kind of host keys should be preferred for connection
+ * by reading the known_hosts file.
+ *
+ * @param[in] session The SSH session to use.
+ *
+ * @returns Bitfield of supported SSH hostkey algorithms
+ * SSH_ERROR on error
+ */
+int ssh_knownhosts_algorithms(ssh_session session) {
+ FILE *file = NULL;
+ char **tokens;
+ char *host;
+ char *hostport;
+ const char *type;
+ int match;
+ int ret = 0;
+
+ if (session->opts.knownhosts == NULL) {
+ if (ssh_options_apply(session) < 0) {
+ ssh_set_error(session, SSH_REQUEST_DENIED,
+ "Can't find a known_hosts file");
+ return SSH_ERROR;
+ }
+ }
+
+ if (session->opts.host == NULL) {
+ return 0;
+ }
+
+ host = ssh_lowercase(session->opts.host);
+ hostport = ssh_hostport(host, session->opts.port);
+ if (host == NULL || hostport == NULL) {
+ ssh_set_error_oom(session);
+ SAFE_FREE(host);
+ SAFE_FREE(hostport);
+
+ return SSH_ERROR;
+ }
+
+ do {
+ tokens = ssh_get_knownhost_line(&file,
+ session->opts.knownhosts, &type);
+
+ /* End of file, return the current state */
+ if (tokens == NULL) {
+ break;
+ }
+ match = match_hashed_host(host, tokens[0]);
+ if (match == 0){
+ match = match_hostname(hostport, tokens[0], strlen(tokens[0]));
+ }
+ if (match == 0) {
+ match = match_hostname(host, tokens[0], strlen(tokens[0]));
+ }
+ if (match == 0) {
+ match = match_hashed_host(hostport, tokens[0]);
+ }
+ if (match) {
+ /* We got a match. Now check the key type */
+ SSH_LOG(SSH_LOG_DEBUG, "server %s:%d has %s in known_hosts",
+ host, session->opts.port, type);
+ ret |= 1 << ssh_key_type_from_name(type);
+ }
+ tokens_free(tokens);
+ } while (1);
+
+ SAFE_FREE(host);
+ SAFE_FREE(hostport);
+ if (file != NULL) {
+ fclose(file);
+ }
+
+ /* Return the current state at end of file */
+ return ret;
+}
+
/** @} */
/* vim: set ts=4 sw=4 et cindent: */
diff --git a/tests/client/torture_knownhosts.c b/tests/client/torture_knownhosts.c
index fe827cbc..a0cd3ab6 100644
--- a/tests/client/torture_knownhosts.c
+++ b/tests/client/torture_knownhosts.c
@@ -93,10 +93,142 @@ static void torture_knownhosts_port(void **state) {
assert_true(rc == SSH_SERVER_KNOWN_OK);
}
+static void torture_knownhosts_fail(void **state) {
+ ssh_session session = *state;
+ FILE *file;
+ int rc;
+
+ rc = ssh_options_set(session, SSH_OPTIONS_HOST, "localhost");
+ assert_true(rc == SSH_OK);
+
+ rc = ssh_options_set(session, SSH_OPTIONS_KNOWNHOSTS, KNOWNHOSTFILES);
+ assert_true(rc == SSH_OK);
+
+ rc = ssh_options_set(session, SSH_OPTIONS_HOSTKEYS, "ssh-rsa");
+ assert_true(rc == SSH_OK);
+
+ file = fopen(KNOWNHOSTFILES, "w");
+ assert_true(file != NULL);
+ fprintf(file, "localhost ssh-rsa %s\n", BADRSA);
+ fclose(file);
+
+ rc = ssh_connect(session);
+ assert_true(rc==SSH_OK);
+
+ rc = ssh_is_server_known(session);
+ assert_true(rc == SSH_SERVER_KNOWN_CHANGED);
+}
+
+static void torture_knownhosts_other(void **state) {
+ ssh_session session = *state;
+ FILE *file;
+ int rc;
+
+ rc = ssh_options_set(session, SSH_OPTIONS_HOST, "localhost");
+ assert_true(rc == SSH_OK);
+
+ rc = ssh_options_set(session, SSH_OPTIONS_KNOWNHOSTS, KNOWNHOSTFILES);
+ assert_true(rc == SSH_OK);
+
+ rc = ssh_options_set(session, SSH_OPTIONS_HOSTKEYS, "ssh-dss");
+ assert_true(rc == SSH_OK);
+
+ file = fopen(KNOWNHOSTFILES, "w");
+ assert_true(file != NULL);
+ fprintf(file, "localhost ssh-rsa %s\n", BADRSA);
+ fclose(file);
+
+ rc = ssh_connect(session);
+ assert_true(rc==SSH_OK);
+
+ rc = ssh_is_server_known(session);
+ assert_true(rc == SSH_SERVER_FOUND_OTHER);
+}
+
+static void torture_knownhosts_conflict(void **state) {
+ ssh_session session = *state;
+ FILE *file;
+ int rc;
+
+ rc = ssh_options_set(session, SSH_OPTIONS_HOST, "localhost");
+ assert_true(rc == SSH_OK);
+
+ rc = ssh_options_set(session, SSH_OPTIONS_KNOWNHOSTS, KNOWNHOSTFILES);
+ assert_true(rc == SSH_OK);
+
+ rc = ssh_options_set(session, SSH_OPTIONS_HOSTKEYS, "ssh-rsa");
+ assert_true(rc == SSH_OK);
+
+ file = fopen(KNOWNHOSTFILES, "w");
+ assert_true(file != NULL);
+ fprintf(file, "localhost ssh-rsa %s\n", BADRSA);
+ fprintf(file, "localhost ssh-dss %s\n", BADDSA);
+ fclose(file);
+
+ rc = ssh_connect(session);
+ assert_true(rc==SSH_OK);
+
+ rc = ssh_is_server_known(session);
+ assert_true(rc == SSH_SERVER_KNOWN_CHANGED);
+
+ rc = ssh_write_knownhost(session);
+ assert_true(rc==SSH_OK);
+
+ ssh_disconnect(session);
+ ssh_free(session);
+
+ /* connect again and check host key */
+ *state = session = ssh_new();
+
+ ssh_options_set(session, SSH_OPTIONS_HOST, "localhost");
+ ssh_options_set(session, SSH_OPTIONS_KNOWNHOSTS, KNOWNHOSTFILES);
+ rc = ssh_options_set(session, SSH_OPTIONS_HOSTKEYS, "ssh-rsa");
+ assert_true(rc == SSH_OK);
+
+ rc = ssh_connect(session);
+ assert_true(rc == SSH_OK);
+
+ rc = ssh_is_server_known(session);
+ assert_true(rc == SSH_SERVER_KNOWN_OK);
+}
+
+static void torture_knownhosts_precheck(void **state) {
+ ssh_session session = *state;
+ FILE *file;
+ int rc;
+ int dsa;
+ int rsa;
+
+ rc = ssh_options_set(session, SSH_OPTIONS_HOST, "localhost");
+ assert_true(rc == SSH_OK);
+
+ rc = ssh_options_set(session, SSH_OPTIONS_KNOWNHOSTS, KNOWNHOSTFILES);
+ assert_true(rc == SSH_OK);
+
+ file = fopen(KNOWNHOSTFILES, "w");
+ assert_true(file != NULL);
+ fprintf(file, "localhost ssh-rsa %s\n", BADRSA);
+ fprintf(file, "localhost ssh-dss %s\n", BADDSA);
+ fclose(file);
+
+ rc = ssh_knownhosts_algorithms(session);
+ assert_true(rc != SSH_ERROR);
+ dsa = 1 << SSH_KEYTYPE_DSS;
+ rsa = 1 << SSH_KEYTYPE_RSA;
+ assert_true(rc & dsa);
+ assert_true(rc & rsa);
+ /* nothing else than dsa and rsa */
+ assert_true((rc & (dsa | rsa)) == rc);
+}
+
int torture_run_tests(void) {
int rc;
const UnitTest tests[] = {
unit_test_setup_teardown(torture_knownhosts_port, setup, teardown),
+ unit_test_setup_teardown(torture_knownhosts_fail, setup, teardown),
+ unit_test_setup_teardown(torture_knownhosts_other, setup, teardown),
+ unit_test_setup_teardown(torture_knownhosts_conflict, setup, teardown),
+ unit_test_setup_teardown(torture_knownhosts_precheck, setup, teardown)
};
ssh_init();