aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--include/libssh/libssh.h3
-rw-r--r--src/knownhosts.c89
-rw-r--r--tests/client/CMakeLists.txt1
-rw-r--r--tests/client/torture_knownhosts_verify.c121
4 files changed, 214 insertions, 0 deletions
diff --git a/include/libssh/libssh.h b/include/libssh/libssh.h
index 0c65547c..92ca5938 100644
--- a/include/libssh/libssh.h
+++ b/include/libssh/libssh.h
@@ -538,6 +538,9 @@ LIBSSH_API int ssh_known_hosts_parse_line(const char *host,
struct ssh_knownhosts_entry **entry);
LIBSSH_API enum ssh_known_hosts_e ssh_session_has_known_hosts_entry(ssh_session session);
+LIBSSH_API int ssh_session_export_known_hosts_entry(ssh_session session,
+ char **pentry_string);
+
/* LOGGING */
LIBSSH_API int ssh_set_log_level(int level);
LIBSSH_API int ssh_get_log_level(void);
diff --git a/src/knownhosts.c b/src/knownhosts.c
index 7c49470c..da96102d 100644
--- a/src/knownhosts.c
+++ b/src/knownhosts.c
@@ -36,6 +36,7 @@
#include "libssh/options.h"
#include "libssh/misc.h"
#include "libssh/pki.h"
+#include "libssh/dh.h"
static int hash_hostname(const char *name,
unsigned char *salt,
@@ -471,3 +472,91 @@ enum ssh_known_hosts_e ssh_session_has_known_hosts_entry(ssh_session session)
return SSH_KNOWN_HOSTS_OK;
}
+
+/**
+ * @brief Export the current session information to a known_hosts string.
+ *
+ * This exports the current information of a session which is connected so a
+ * ssh server into an entry line which can be added to a known_hosts file.
+ *
+ * @param[in] session The session with information to export.
+ *
+ * @param[in] pentry_string A pointer to a string to store the alloocated
+ * line of the entry. The user must free it using
+ * ssh_string_free_char().
+ *
+ * @return SSH_OK on succcess, SSH_ERROR otherwise.
+ */
+int ssh_session_export_known_hosts_entry(ssh_session session,
+ char **pentry_string)
+{
+ ssh_key server_pubkey = NULL;
+ char *host = NULL;
+ char entry_buf[4096] = {0};
+ int rc;
+
+ if (pentry_string == NULL) {
+ ssh_set_error_invalid(session);
+ return SSH_ERROR;
+ }
+
+ if (session->opts.host == NULL) {
+ ssh_set_error(session, SSH_FATAL,
+ "Can't create known_hosts entry - hostname unknown");
+ return SSH_ERROR;
+ }
+
+ host = ssh_session_get_host_port(session);
+ if (host == NULL) {
+ return SSH_ERROR;
+ }
+
+ if (session->current_crypto == NULL) {
+ ssh_set_error(session, SSH_FATAL,
+ "No current crypto context, please connnect first");
+ SAFE_FREE(host);
+ return SSH_ERROR;
+ }
+
+ server_pubkey = ssh_dh_get_current_server_publickey(session);
+ if (server_pubkey == NULL){
+ ssh_set_error(session, SSH_FATAL, "No public key present");
+ SAFE_FREE(host);
+ return SSH_ERROR;
+ }
+
+ if (ssh_key_type(server_pubkey) == SSH_KEYTYPE_RSA1) {
+ rc = ssh_pki_export_pubkey_rsa1(server_pubkey,
+ host,
+ entry_buf,
+ sizeof(entry_buf));
+ SAFE_FREE(host);
+ if (rc < 0) {
+ return SSH_ERROR;
+ }
+ } else {
+ char *b64_key = NULL;
+
+ rc = ssh_pki_export_pubkey_base64(server_pubkey, &b64_key);
+ if (rc < 0) {
+ SAFE_FREE(host);
+ return SSH_ERROR;
+ }
+
+ snprintf(entry_buf, sizeof(entry_buf),
+ "%s %s %s\n",
+ host,
+ server_pubkey->type_c,
+ b64_key);
+
+ SAFE_FREE(host);
+ SAFE_FREE(b64_key);
+ }
+
+ *pentry_string = strdup(entry_buf);
+ if (*pentry_string == NULL) {
+ return SSH_ERROR;
+ }
+
+ return SSH_OK;
+}
diff --git a/tests/client/CMakeLists.txt b/tests/client/CMakeLists.txt
index 80be7740..ca41eeec 100644
--- a/tests/client/CMakeLists.txt
+++ b/tests/client/CMakeLists.txt
@@ -8,6 +8,7 @@ set(LIBSSH_CLIENT_TESTS
torture_auth
torture_forward
torture_knownhosts
+ torture_knownhosts_verify
torture_proxycommand
torture_session
torture_request_env)
diff --git a/tests/client/torture_knownhosts_verify.c b/tests/client/torture_knownhosts_verify.c
new file mode 100644
index 00000000..a266e92a
--- /dev/null
+++ b/tests/client/torture_knownhosts_verify.c
@@ -0,0 +1,121 @@
+/*
+ * This file is part of the SSH Library
+ *
+ * Copyright (c) 2018 by Andreas Schneider
+ *
+ * The SSH Library is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation; either version 2.1 of the License, or (at your
+ * option) any later version.
+ *
+ * The SSH Library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public
+ * License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with the SSH Library; see the file COPYING. If not, write to
+ * the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
+ * MA 02111-1307, USA.
+ */
+
+#include "config.h"
+
+#define LIBSSH_STATIC
+
+#include "torture.h"
+
+#include <sys/types.h>
+#include <pwd.h>
+
+#include "knownhosts.c"
+
+#define TORTURE_KNOWN_HOSTS_FILE "libssh_torture_knownhosts"
+
+static int sshd_group_setup(void **state)
+{
+ torture_setup_sshd_server(state);
+
+ return 0;
+}
+
+static int sshd_group_teardown(void **state) {
+ torture_teardown_sshd_server(state);
+
+ return 0;
+}
+
+static int session_setup(void **state)
+{
+ struct torture_state *s = *state;
+ int verbosity = torture_libssh_verbosity();
+ struct passwd *pwd;
+
+ pwd = getpwnam("bob");
+ assert_non_null(pwd);
+ setuid(pwd->pw_uid);
+
+ s->ssh.session = ssh_new();
+ assert_non_null(s->ssh.session);
+
+ ssh_options_set(s->ssh.session, SSH_OPTIONS_LOG_VERBOSITY, &verbosity);
+ ssh_options_set(s->ssh.session, SSH_OPTIONS_HOST, TORTURE_SSH_SERVER);
+
+ ssh_options_set(s->ssh.session, SSH_OPTIONS_USER, TORTURE_SSH_USER_ALICE);
+
+ return 0;
+}
+
+static int session_teardown(void **state)
+{
+ struct torture_state *s = *state;
+ char known_hosts_file[1024];
+
+ snprintf(known_hosts_file,
+ sizeof(known_hosts_file),
+ "%s/%s",
+ s->socket_dir,
+ TORTURE_KNOWN_HOSTS_FILE);
+
+ ssh_disconnect(s->ssh.session);
+ ssh_free(s->ssh.session);
+
+ unlink(known_hosts_file);
+
+ return 0;
+}
+
+#define KNOWN_HOST_ENTRY "127.0.0.10 ecdsa-sha2-nistp521 AAAAE2VjZHNhLXNoYTItbmlzdHA1MjEAAAAIbmlzdHA1MjEAAACFBAHOg+9vHW2kJB50j7c7WkcCcOtwgZdeXMpAeEl17sFnTTrT8wYo1FCzE07wV262vIC+AE3fXUJ7sJ/CkFIdk/8/gQEY1jyoXB3Bsee16VwhJGsMzGGh1FJ0XXhRJjUbG18qbH9JiSgE1N4fIM0zJG68fAyUxRxCI1wUobOOB7EmFZd18g==\n"
+static void torture_knownhosts_export(void **state)
+{
+ struct torture_state *s = *state;
+ ssh_session session = s->ssh.session;
+ char *entry = NULL;
+ int rc;
+
+ rc = ssh_connect(session);
+ assert_int_equal(rc, SSH_OK);
+
+ rc = ssh_session_export_known_hosts_entry(session, &entry);
+ assert_int_equal(rc, SSH_OK);
+
+ assert_string_equal(entry, KNOWN_HOST_ENTRY);
+ SAFE_FREE(entry);
+}
+
+int torture_run_tests(void) {
+ int rc;
+ struct CMUnitTest tests[] = {
+ cmocka_unit_test_setup_teardown(torture_knownhosts_export,
+ session_setup,
+ session_teardown),
+ };
+
+ ssh_init();
+
+ torture_filter_tests(tests);
+ rc = cmocka_run_group_tests(tests, sshd_group_setup, sshd_group_teardown);
+
+ ssh_finalize();
+ return rc;
+}