diff options
author | Andreas Schneider <asn@cryptomilk.org> | 2018-02-04 18:33:19 +0100 |
---|---|---|
committer | Andreas Schneider <asn@cryptomilk.org> | 2018-06-04 11:20:28 +0200 |
commit | 974e1831a0ecc09a56135892c2f272781eafc3b7 (patch) | |
tree | b0a5a8059cdbcfee6ce79f362fc32ad1aa9b5fef | |
parent | 963c46e4fbce513558c941de51e073fc07ad37ae (diff) | |
download | libssh-974e1831a0ecc09a56135892c2f272781eafc3b7.tar.gz libssh-974e1831a0ecc09a56135892c2f272781eafc3b7.tar.xz libssh-974e1831a0ecc09a56135892c2f272781eafc3b7.zip |
knownhosts: Add ssh_session_export_known_hosts_entry()
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
-rw-r--r-- | include/libssh/libssh.h | 3 | ||||
-rw-r--r-- | src/knownhosts.c | 89 | ||||
-rw-r--r-- | tests/client/CMakeLists.txt | 1 | ||||
-rw-r--r-- | tests/client/torture_knownhosts_verify.c | 121 |
4 files changed, 214 insertions, 0 deletions
diff --git a/include/libssh/libssh.h b/include/libssh/libssh.h index 0c65547c..92ca5938 100644 --- a/include/libssh/libssh.h +++ b/include/libssh/libssh.h @@ -538,6 +538,9 @@ LIBSSH_API int ssh_known_hosts_parse_line(const char *host, struct ssh_knownhosts_entry **entry); LIBSSH_API enum ssh_known_hosts_e ssh_session_has_known_hosts_entry(ssh_session session); +LIBSSH_API int ssh_session_export_known_hosts_entry(ssh_session session, + char **pentry_string); + /* LOGGING */ LIBSSH_API int ssh_set_log_level(int level); LIBSSH_API int ssh_get_log_level(void); diff --git a/src/knownhosts.c b/src/knownhosts.c index 7c49470c..da96102d 100644 --- a/src/knownhosts.c +++ b/src/knownhosts.c @@ -36,6 +36,7 @@ #include "libssh/options.h" #include "libssh/misc.h" #include "libssh/pki.h" +#include "libssh/dh.h" static int hash_hostname(const char *name, unsigned char *salt, @@ -471,3 +472,91 @@ enum ssh_known_hosts_e ssh_session_has_known_hosts_entry(ssh_session session) return SSH_KNOWN_HOSTS_OK; } + +/** + * @brief Export the current session information to a known_hosts string. + * + * This exports the current information of a session which is connected so a + * ssh server into an entry line which can be added to a known_hosts file. + * + * @param[in] session The session with information to export. + * + * @param[in] pentry_string A pointer to a string to store the alloocated + * line of the entry. The user must free it using + * ssh_string_free_char(). + * + * @return SSH_OK on succcess, SSH_ERROR otherwise. + */ +int ssh_session_export_known_hosts_entry(ssh_session session, + char **pentry_string) +{ + ssh_key server_pubkey = NULL; + char *host = NULL; + char entry_buf[4096] = {0}; + int rc; + + if (pentry_string == NULL) { + ssh_set_error_invalid(session); + return SSH_ERROR; + } + + if (session->opts.host == NULL) { + ssh_set_error(session, SSH_FATAL, + "Can't create known_hosts entry - hostname unknown"); + return SSH_ERROR; + } + + host = ssh_session_get_host_port(session); + if (host == NULL) { + return SSH_ERROR; + } + + if (session->current_crypto == NULL) { + ssh_set_error(session, SSH_FATAL, + "No current crypto context, please connnect first"); + SAFE_FREE(host); + return SSH_ERROR; + } + + server_pubkey = ssh_dh_get_current_server_publickey(session); + if (server_pubkey == NULL){ + ssh_set_error(session, SSH_FATAL, "No public key present"); + SAFE_FREE(host); + return SSH_ERROR; + } + + if (ssh_key_type(server_pubkey) == SSH_KEYTYPE_RSA1) { + rc = ssh_pki_export_pubkey_rsa1(server_pubkey, + host, + entry_buf, + sizeof(entry_buf)); + SAFE_FREE(host); + if (rc < 0) { + return SSH_ERROR; + } + } else { + char *b64_key = NULL; + + rc = ssh_pki_export_pubkey_base64(server_pubkey, &b64_key); + if (rc < 0) { + SAFE_FREE(host); + return SSH_ERROR; + } + + snprintf(entry_buf, sizeof(entry_buf), + "%s %s %s\n", + host, + server_pubkey->type_c, + b64_key); + + SAFE_FREE(host); + SAFE_FREE(b64_key); + } + + *pentry_string = strdup(entry_buf); + if (*pentry_string == NULL) { + return SSH_ERROR; + } + + return SSH_OK; +} diff --git a/tests/client/CMakeLists.txt b/tests/client/CMakeLists.txt index 80be7740..ca41eeec 100644 --- a/tests/client/CMakeLists.txt +++ b/tests/client/CMakeLists.txt @@ -8,6 +8,7 @@ set(LIBSSH_CLIENT_TESTS torture_auth torture_forward torture_knownhosts + torture_knownhosts_verify torture_proxycommand torture_session torture_request_env) diff --git a/tests/client/torture_knownhosts_verify.c b/tests/client/torture_knownhosts_verify.c new file mode 100644 index 00000000..a266e92a --- /dev/null +++ b/tests/client/torture_knownhosts_verify.c @@ -0,0 +1,121 @@ +/* + * This file is part of the SSH Library + * + * Copyright (c) 2018 by Andreas Schneider + * + * The SSH Library is free software; you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by + * the Free Software Foundation; either version 2.1 of the License, or (at your + * option) any later version. + * + * The SSH Library is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public + * License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with the SSH Library; see the file COPYING. If not, write to + * the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, + * MA 02111-1307, USA. + */ + +#include "config.h" + +#define LIBSSH_STATIC + +#include "torture.h" + +#include <sys/types.h> +#include <pwd.h> + +#include "knownhosts.c" + +#define TORTURE_KNOWN_HOSTS_FILE "libssh_torture_knownhosts" + +static int sshd_group_setup(void **state) +{ + torture_setup_sshd_server(state); + + return 0; +} + +static int sshd_group_teardown(void **state) { + torture_teardown_sshd_server(state); + + return 0; +} + +static int session_setup(void **state) +{ + struct torture_state *s = *state; + int verbosity = torture_libssh_verbosity(); + struct passwd *pwd; + + pwd = getpwnam("bob"); + assert_non_null(pwd); + setuid(pwd->pw_uid); + + s->ssh.session = ssh_new(); + assert_non_null(s->ssh.session); + + ssh_options_set(s->ssh.session, SSH_OPTIONS_LOG_VERBOSITY, &verbosity); + ssh_options_set(s->ssh.session, SSH_OPTIONS_HOST, TORTURE_SSH_SERVER); + + ssh_options_set(s->ssh.session, SSH_OPTIONS_USER, TORTURE_SSH_USER_ALICE); + + return 0; +} + +static int session_teardown(void **state) +{ + struct torture_state *s = *state; + char known_hosts_file[1024]; + + snprintf(known_hosts_file, + sizeof(known_hosts_file), + "%s/%s", + s->socket_dir, + TORTURE_KNOWN_HOSTS_FILE); + + ssh_disconnect(s->ssh.session); + ssh_free(s->ssh.session); + + unlink(known_hosts_file); + + return 0; +} + +#define KNOWN_HOST_ENTRY "127.0.0.10 ecdsa-sha2-nistp521 AAAAE2VjZHNhLXNoYTItbmlzdHA1MjEAAAAIbmlzdHA1MjEAAACFBAHOg+9vHW2kJB50j7c7WkcCcOtwgZdeXMpAeEl17sFnTTrT8wYo1FCzE07wV262vIC+AE3fXUJ7sJ/CkFIdk/8/gQEY1jyoXB3Bsee16VwhJGsMzGGh1FJ0XXhRJjUbG18qbH9JiSgE1N4fIM0zJG68fAyUxRxCI1wUobOOB7EmFZd18g==\n" +static void torture_knownhosts_export(void **state) +{ + struct torture_state *s = *state; + ssh_session session = s->ssh.session; + char *entry = NULL; + int rc; + + rc = ssh_connect(session); + assert_int_equal(rc, SSH_OK); + + rc = ssh_session_export_known_hosts_entry(session, &entry); + assert_int_equal(rc, SSH_OK); + + assert_string_equal(entry, KNOWN_HOST_ENTRY); + SAFE_FREE(entry); +} + +int torture_run_tests(void) { + int rc; + struct CMUnitTest tests[] = { + cmocka_unit_test_setup_teardown(torture_knownhosts_export, + session_setup, + session_teardown), + }; + + ssh_init(); + + torture_filter_tests(tests); + rc = cmocka_run_group_tests(tests, sshd_group_setup, sshd_group_teardown); + + ssh_finalize(); + return rc; +} |