Mercurial > dropbear
annotate cli-kex.c @ 941:5daedffd0769
Set tcp priority as follows:
if (connecting || ptys || x11) tos = LOWDELAY;
else if (tcp_forwards) tos = 0;
else tos = BULK;
TCP forwards could be either lowdelay or bulk, hence the default priority.
author | Matt Johnston <matt@ucc.asn.au> |
---|---|
date | Wed, 16 Jul 2014 22:53:32 +0800 |
parents | cbc73a5aefb0 |
children | c45d65392c1a |
rev | line source |
---|---|
26 | 1 /* |
2 * Dropbear - a SSH2 server | |
3 * | |
74
e3adf4cf5465
License boilerplate etc, add Mihnea as an author to some of the files
Matt Johnston <matt@ucc.asn.au>
parents:
59
diff
changeset
|
4 * Copyright (c) 2002-2004 Matt Johnston |
e3adf4cf5465
License boilerplate etc, add Mihnea as an author to some of the files
Matt Johnston <matt@ucc.asn.au>
parents:
59
diff
changeset
|
5 * Copyright (c) 2004 by Mihnea Stoenescu |
26 | 6 * All rights reserved. |
7 * | |
8 * Permission is hereby granted, free of charge, to any person obtaining a copy | |
9 * of this software and associated documentation files (the "Software"), to deal | |
10 * in the Software without restriction, including without limitation the rights | |
11 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell | |
12 * copies of the Software, and to permit persons to whom the Software is | |
13 * furnished to do so, subject to the following conditions: | |
14 * | |
15 * The above copyright notice and this permission notice shall be included in | |
16 * all copies or substantial portions of the Software. | |
17 * | |
18 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR | |
19 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, | |
20 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE | |
21 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER | |
22 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, | |
23 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE | |
24 * SOFTWARE. */ | |
25 | |
26 #include "includes.h" | |
27 #include "session.h" | |
28 #include "dbutil.h" | |
29 #include "algo.h" | |
30 #include "buffer.h" | |
31 #include "session.h" | |
32 #include "kex.h" | |
33 #include "ssh.h" | |
34 #include "packet.h" | |
35 #include "bignum.h" | |
858
220f55d540ae
rename random.h to dbrandom.h since some OSes have a system random.h
Matt Johnston <matt@ucc.asn.au>
parents:
850
diff
changeset
|
36 #include "dbrandom.h" |
26 | 37 #include "runopts.h" |
33 | 38 #include "signkey.h" |
761
ac2158e3e403
ecc kind of works, needs fixing/testing
Matt Johnston <matt@ucc.asn.au>
parents:
759
diff
changeset
|
39 #include "ecc.h" |
26 | 40 |
41 | |
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
42 static void checkhostkey(unsigned char* keyblob, unsigned int keybloblen); |
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
43 #define MAX_KNOWNHOSTS_LINE 4500 |
26 | 44 |
45 void send_msg_kexdh_init() { | |
739
d44325108d0e
first_kex_packet_follows working, needs tidying
Matt Johnston <matt@ucc.asn.au>
parents:
723
diff
changeset
|
46 TRACE(("send_msg_kexdh_init()")) |
26 | 47 |
48 CHECKCLEARTOWRITE(); | |
49 buf_putbyte(ses.writepayload, SSH_MSG_KEXDH_INIT); | |
848 | 50 switch (ses.newkeys->algo_kex->mode) { |
51 case DROPBEAR_KEX_NORMAL_DH: | |
52 if (ses.newkeys->algo_kex != cli_ses.param_kex_algo | |
53 || !cli_ses.dh_param) { | |
54 if (cli_ses.dh_param) { | |
55 free_kexdh_param(cli_ses.dh_param); | |
56 } | |
57 cli_ses.dh_param = gen_kexdh_param(); | |
801 | 58 } |
848 | 59 buf_putmpint(ses.writepayload, &cli_ses.dh_param->pub); |
60 break; | |
61 case DROPBEAR_KEX_ECDH: | |
755
b07eb3dc23ec
refactor kexdh code a bit, start working on ecdh etc
Matt Johnston <matt@ucc.asn.au>
parents:
723
diff
changeset
|
62 #ifdef DROPBEAR_ECDH |
848 | 63 if (ses.newkeys->algo_kex != cli_ses.param_kex_algo |
64 || !cli_ses.ecdh_param) { | |
65 if (cli_ses.ecdh_param) { | |
66 free_kexecdh_param(cli_ses.ecdh_param); | |
67 } | |
68 cli_ses.ecdh_param = gen_kexecdh_param(); | |
801 | 69 } |
848 | 70 buf_put_ecc_raw_pubkey_string(ses.writepayload, &cli_ses.ecdh_param->key); |
755
b07eb3dc23ec
refactor kexdh code a bit, start working on ecdh etc
Matt Johnston <matt@ucc.asn.au>
parents:
723
diff
changeset
|
71 #endif |
848 | 72 break; |
73 #ifdef DROPBEAR_CURVE25519 | |
74 case DROPBEAR_KEX_CURVE25519: | |
75 if (ses.newkeys->algo_kex != cli_ses.param_kex_algo | |
76 || !cli_ses.curve25519_param) { | |
77 if (cli_ses.curve25519_param) { | |
78 free_kexcurve25519_param(cli_ses.curve25519_param); | |
79 } | |
80 cli_ses.curve25519_param = gen_kexcurve25519_param(); | |
81 } | |
850
7507b174bba0
- Make curve25519 work after fixing a typo, interoperates with OpenSSH
Matt Johnston <matt@ucc.asn.au>
parents:
849
diff
changeset
|
82 buf_putstring(ses.writepayload, cli_ses.curve25519_param->pub, CURVE25519_LEN); |
848 | 83 #endif |
84 break; | |
755
b07eb3dc23ec
refactor kexdh code a bit, start working on ecdh etc
Matt Johnston <matt@ucc.asn.au>
parents:
723
diff
changeset
|
85 } |
848 | 86 |
801 | 87 cli_ses.param_kex_algo = ses.newkeys->algo_kex; |
26 | 88 encrypt_packet(); |
89 } | |
90 | |
91 /* Handle a diffie-hellman key exchange reply. */ | |
92 void recv_msg_kexdh_reply() { | |
93 | |
94 sign_key *hostkey = NULL; | |
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
95 unsigned int type, keybloblen; |
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
96 unsigned char* keyblob = NULL; |
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
97 |
165
0cfba3034be5
Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place
Matt Johnston <matt@ucc.asn.au>
parents:
106
diff
changeset
|
98 TRACE(("enter recv_msg_kexdh_reply")) |
84
29a5c7c62350
default initialisers for mp_ints
Matt Johnston <matt@ucc.asn.au>
parents:
80
diff
changeset
|
99 |
29a5c7c62350
default initialisers for mp_ints
Matt Johnston <matt@ucc.asn.au>
parents:
80
diff
changeset
|
100 if (cli_ses.kex_state != KEXDH_INIT_SENT) { |
29a5c7c62350
default initialisers for mp_ints
Matt Johnston <matt@ucc.asn.au>
parents:
80
diff
changeset
|
101 dropbear_exit("Received out-of-order kexdhreply"); |
29a5c7c62350
default initialisers for mp_ints
Matt Johnston <matt@ucc.asn.au>
parents:
80
diff
changeset
|
102 } |
26 | 103 type = ses.newkeys->algo_hostkey; |
165
0cfba3034be5
Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place
Matt Johnston <matt@ucc.asn.au>
parents:
106
diff
changeset
|
104 TRACE(("type is %d", type)) |
26 | 105 |
106 hostkey = new_sign_key(); | |
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
107 keybloblen = buf_getint(ses.payload); |
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
108 |
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
109 keyblob = buf_getptr(ses.payload, keybloblen); |
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
110 if (!ses.kexstate.donefirstkex) { |
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
111 /* Only makes sense the first time */ |
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
112 checkhostkey(keyblob, keybloblen); |
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
113 } |
34
e2a1eaa19f22
Client mostly works up to password auth
Matt Johnston <matt@ucc.asn.au>
parents:
33
diff
changeset
|
114 |
26 | 115 if (buf_get_pub_key(ses.payload, hostkey, &type) != DROPBEAR_SUCCESS) { |
165
0cfba3034be5
Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place
Matt Johnston <matt@ucc.asn.au>
parents:
106
diff
changeset
|
116 TRACE(("failed getting pubkey")) |
26 | 117 dropbear_exit("Bad KEX packet"); |
118 } | |
119 | |
848 | 120 switch (ses.newkeys->algo_kex->mode) { |
121 case DROPBEAR_KEX_NORMAL_DH: | |
122 { | |
123 DEF_MP_INT(dh_f); | |
124 m_mp_init(&dh_f); | |
125 if (buf_getmpint(ses.payload, &dh_f) != DROPBEAR_SUCCESS) { | |
126 TRACE(("failed getting mpint")) | |
127 dropbear_exit("Bad KEX packet"); | |
128 } | |
26 | 129 |
848 | 130 kexdh_comb_key(cli_ses.dh_param, &dh_f, hostkey); |
131 mp_clear(&dh_f); | |
132 } | |
133 break; | |
134 case DROPBEAR_KEX_ECDH: | |
755
b07eb3dc23ec
refactor kexdh code a bit, start working on ecdh etc
Matt Johnston <matt@ucc.asn.au>
parents:
723
diff
changeset
|
135 #ifdef DROPBEAR_ECDH |
848 | 136 { |
137 buffer *ecdh_qs = buf_getstringbuf(ses.payload); | |
138 kexecdh_comb_key(cli_ses.ecdh_param, ecdh_qs, hostkey); | |
139 buf_free(ecdh_qs); | |
140 } | |
755
b07eb3dc23ec
refactor kexdh code a bit, start working on ecdh etc
Matt Johnston <matt@ucc.asn.au>
parents:
723
diff
changeset
|
141 #endif |
848 | 142 break; |
143 #ifdef DROPBEAR_CURVE25519 | |
144 case DROPBEAR_KEX_CURVE25519: | |
145 { | |
146 buffer *ecdh_qs = buf_getstringbuf(ses.payload); | |
147 kexcurve25519_comb_key(cli_ses.curve25519_param, ecdh_qs, hostkey); | |
148 buf_free(ecdh_qs); | |
149 } | |
150 #endif | |
151 break; | |
26 | 152 } |
153 | |
801 | 154 if (cli_ses.dh_param) { |
155 free_kexdh_param(cli_ses.dh_param); | |
156 cli_ses.dh_param = NULL; | |
157 } | |
158 #ifdef DROPBEAR_ECDH | |
159 if (cli_ses.ecdh_param) { | |
160 free_kexecdh_param(cli_ses.ecdh_param); | |
161 cli_ses.ecdh_param = NULL; | |
162 } | |
163 #endif | |
848 | 164 #ifdef DROPBEAR_CURVE25519 |
165 if (cli_ses.curve25519_param) { | |
166 free_kexcurve25519_param(cli_ses.curve25519_param); | |
167 cli_ses.curve25519_param = NULL; | |
168 } | |
169 #endif | |
26 | 170 |
801 | 171 cli_ses.param_kex_algo = NULL; |
172 if (buf_verify(ses.payload, hostkey, ses.hash) != DROPBEAR_SUCCESS) { | |
26 | 173 dropbear_exit("Bad hostkey signature"); |
174 } | |
175 | |
176 sign_key_free(hostkey); | |
177 hostkey = NULL; | |
178 | |
179 send_msg_newkeys(); | |
886
cbc73a5aefb0
requirenext doesn't need two values
Matt Johnston <matt@ucc.asn.au>
parents:
885
diff
changeset
|
180 ses.requirenext = SSH_MSG_NEWKEYS; |
165
0cfba3034be5
Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place
Matt Johnston <matt@ucc.asn.au>
parents:
106
diff
changeset
|
181 TRACE(("leave recv_msg_kexdh_init")) |
26 | 182 } |
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
183 |
847
f4bb964c8678
Add '-R' for delayed hostkey option
Matt Johnston <matt@ucc.asn.au>
parents:
801
diff
changeset
|
184 static void ask_to_confirm(unsigned char* keyblob, unsigned int keybloblen, |
f4bb964c8678
Add '-R' for delayed hostkey option
Matt Johnston <matt@ucc.asn.au>
parents:
801
diff
changeset
|
185 const char* algoname) { |
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
186 |
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
187 char* fp = NULL; |
170
a62cb364f615
Read "y/n" response for fingerprints from /dev/tty directly so that dbclient
Matt Johnston <matt@ucc.asn.au>
parents:
165
diff
changeset
|
188 FILE *tty = NULL; |
a62cb364f615
Read "y/n" response for fingerprints from /dev/tty directly so that dbclient
Matt Johnston <matt@ucc.asn.au>
parents:
165
diff
changeset
|
189 char response = 'z'; |
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
190 |
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
191 fp = sign_key_fingerprint(keyblob, keybloblen); |
418
ab57ba0cb667
Add '-y' option to dbclient to accept the host key without checking
Matt Johnston <matt@ucc.asn.au>
parents:
340
diff
changeset
|
192 if (cli_opts.always_accept_key) { |
847
f4bb964c8678
Add '-R' for delayed hostkey option
Matt Johnston <matt@ucc.asn.au>
parents:
801
diff
changeset
|
193 fprintf(stderr, "\nHost '%s' key accepted unconditionally.\n(%s fingerprint %s)\n", |
418
ab57ba0cb667
Add '-y' option to dbclient to accept the host key without checking
Matt Johnston <matt@ucc.asn.au>
parents:
340
diff
changeset
|
194 cli_opts.remotehost, |
847
f4bb964c8678
Add '-R' for delayed hostkey option
Matt Johnston <matt@ucc.asn.au>
parents:
801
diff
changeset
|
195 algoname, |
418
ab57ba0cb667
Add '-y' option to dbclient to accept the host key without checking
Matt Johnston <matt@ucc.asn.au>
parents:
340
diff
changeset
|
196 fp); |
ab57ba0cb667
Add '-y' option to dbclient to accept the host key without checking
Matt Johnston <matt@ucc.asn.au>
parents:
340
diff
changeset
|
197 m_free(fp); |
ab57ba0cb667
Add '-y' option to dbclient to accept the host key without checking
Matt Johnston <matt@ucc.asn.au>
parents:
340
diff
changeset
|
198 return; |
ab57ba0cb667
Add '-y' option to dbclient to accept the host key without checking
Matt Johnston <matt@ucc.asn.au>
parents:
340
diff
changeset
|
199 } |
847
f4bb964c8678
Add '-R' for delayed hostkey option
Matt Johnston <matt@ucc.asn.au>
parents:
801
diff
changeset
|
200 fprintf(stderr, "\nHost '%s' is not in the trusted hosts file.\n(%s fingerprint %s)\nDo you want to continue connecting? (y/n) ", |
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
201 cli_opts.remotehost, |
847
f4bb964c8678
Add '-R' for delayed hostkey option
Matt Johnston <matt@ucc.asn.au>
parents:
801
diff
changeset
|
202 algoname, |
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
203 fp); |
340 | 204 m_free(fp); |
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
205 |
170
a62cb364f615
Read "y/n" response for fingerprints from /dev/tty directly so that dbclient
Matt Johnston <matt@ucc.asn.au>
parents:
165
diff
changeset
|
206 tty = fopen(_PATH_TTY, "r"); |
a62cb364f615
Read "y/n" response for fingerprints from /dev/tty directly so that dbclient
Matt Johnston <matt@ucc.asn.au>
parents:
165
diff
changeset
|
207 if (tty) { |
a62cb364f615
Read "y/n" response for fingerprints from /dev/tty directly so that dbclient
Matt Johnston <matt@ucc.asn.au>
parents:
165
diff
changeset
|
208 response = getc(tty); |
a62cb364f615
Read "y/n" response for fingerprints from /dev/tty directly so that dbclient
Matt Johnston <matt@ucc.asn.au>
parents:
165
diff
changeset
|
209 fclose(tty); |
a62cb364f615
Read "y/n" response for fingerprints from /dev/tty directly so that dbclient
Matt Johnston <matt@ucc.asn.au>
parents:
165
diff
changeset
|
210 } else { |
a62cb364f615
Read "y/n" response for fingerprints from /dev/tty directly so that dbclient
Matt Johnston <matt@ucc.asn.au>
parents:
165
diff
changeset
|
211 response = getc(stdin); |
a62cb364f615
Read "y/n" response for fingerprints from /dev/tty directly so that dbclient
Matt Johnston <matt@ucc.asn.au>
parents:
165
diff
changeset
|
212 } |
a62cb364f615
Read "y/n" response for fingerprints from /dev/tty directly so that dbclient
Matt Johnston <matt@ucc.asn.au>
parents:
165
diff
changeset
|
213 |
a62cb364f615
Read "y/n" response for fingerprints from /dev/tty directly so that dbclient
Matt Johnston <matt@ucc.asn.au>
parents:
165
diff
changeset
|
214 if (response == 'y') { |
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
215 return; |
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
216 } |
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
217 |
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
218 dropbear_exit("Didn't validate host key"); |
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
219 } |
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
220 |
436
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
221 static FILE* open_known_hosts_file(int * readonly) |
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
222 { |
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
223 FILE * hostsfile = NULL; |
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
224 char * filename = NULL; |
318
9916350d7d8b
don't fail fatally if the client can't get homedir from getpwuid(), fallback
Matt Johnston <matt@ucc.asn.au>
parents:
170
diff
changeset
|
225 char * homedir = NULL; |
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
226 |
322
84aa4e60bd3c
Look at HOME before /etc/passwd when looking for ~/.ssh/known_hosts
Matt Johnston <matt@ucc.asn.au>
parents:
318
diff
changeset
|
227 homedir = getenv("HOME"); |
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
228 |
322
84aa4e60bd3c
Look at HOME before /etc/passwd when looking for ~/.ssh/known_hosts
Matt Johnston <matt@ucc.asn.au>
parents:
318
diff
changeset
|
229 if (!homedir) { |
436
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
230 struct passwd * pw = NULL; |
322
84aa4e60bd3c
Look at HOME before /etc/passwd when looking for ~/.ssh/known_hosts
Matt Johnston <matt@ucc.asn.au>
parents:
318
diff
changeset
|
231 pw = getpwuid(getuid()); |
84aa4e60bd3c
Look at HOME before /etc/passwd when looking for ~/.ssh/known_hosts
Matt Johnston <matt@ucc.asn.au>
parents:
318
diff
changeset
|
232 if (pw) { |
84aa4e60bd3c
Look at HOME before /etc/passwd when looking for ~/.ssh/known_hosts
Matt Johnston <matt@ucc.asn.au>
parents:
318
diff
changeset
|
233 homedir = pw->pw_dir; |
84aa4e60bd3c
Look at HOME before /etc/passwd when looking for ~/.ssh/known_hosts
Matt Johnston <matt@ucc.asn.au>
parents:
318
diff
changeset
|
234 } |
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
235 } |
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
236 |
318
9916350d7d8b
don't fail fatally if the client can't get homedir from getpwuid(), fallback
Matt Johnston <matt@ucc.asn.au>
parents:
170
diff
changeset
|
237 if (homedir) { |
436
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
238 unsigned int len; |
318
9916350d7d8b
don't fail fatally if the client can't get homedir from getpwuid(), fallback
Matt Johnston <matt@ucc.asn.au>
parents:
170
diff
changeset
|
239 len = strlen(homedir); |
9916350d7d8b
don't fail fatally if the client can't get homedir from getpwuid(), fallback
Matt Johnston <matt@ucc.asn.au>
parents:
170
diff
changeset
|
240 filename = m_malloc(len + 18); /* "/.ssh/known_hosts" and null-terminator*/ |
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
241 |
318
9916350d7d8b
don't fail fatally if the client can't get homedir from getpwuid(), fallback
Matt Johnston <matt@ucc.asn.au>
parents:
170
diff
changeset
|
242 snprintf(filename, len+18, "%s/.ssh", homedir); |
9916350d7d8b
don't fail fatally if the client can't get homedir from getpwuid(), fallback
Matt Johnston <matt@ucc.asn.au>
parents:
170
diff
changeset
|
243 /* Check that ~/.ssh exists - easiest way is just to mkdir */ |
9916350d7d8b
don't fail fatally if the client can't get homedir from getpwuid(), fallback
Matt Johnston <matt@ucc.asn.au>
parents:
170
diff
changeset
|
244 if (mkdir(filename, S_IRWXU) != 0) { |
9916350d7d8b
don't fail fatally if the client can't get homedir from getpwuid(), fallback
Matt Johnston <matt@ucc.asn.au>
parents:
170
diff
changeset
|
245 if (errno != EEXIST) { |
322
84aa4e60bd3c
Look at HOME before /etc/passwd when looking for ~/.ssh/known_hosts
Matt Johnston <matt@ucc.asn.au>
parents:
318
diff
changeset
|
246 dropbear_log(LOG_INFO, "Warning: failed creating %s/.ssh: %s", |
84aa4e60bd3c
Look at HOME before /etc/passwd when looking for ~/.ssh/known_hosts
Matt Johnston <matt@ucc.asn.au>
parents:
318
diff
changeset
|
247 homedir, strerror(errno)); |
318
9916350d7d8b
don't fail fatally if the client can't get homedir from getpwuid(), fallback
Matt Johnston <matt@ucc.asn.au>
parents:
170
diff
changeset
|
248 TRACE(("mkdir didn't work: %s", strerror(errno))) |
436
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
249 goto out; |
318
9916350d7d8b
don't fail fatally if the client can't get homedir from getpwuid(), fallback
Matt Johnston <matt@ucc.asn.au>
parents:
170
diff
changeset
|
250 } |
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
251 } |
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
252 |
318
9916350d7d8b
don't fail fatally if the client can't get homedir from getpwuid(), fallback
Matt Johnston <matt@ucc.asn.au>
parents:
170
diff
changeset
|
253 snprintf(filename, len+18, "%s/.ssh/known_hosts", homedir); |
9916350d7d8b
don't fail fatally if the client can't get homedir from getpwuid(), fallback
Matt Johnston <matt@ucc.asn.au>
parents:
170
diff
changeset
|
254 hostsfile = fopen(filename, "a+"); |
9916350d7d8b
don't fail fatally if the client can't get homedir from getpwuid(), fallback
Matt Johnston <matt@ucc.asn.au>
parents:
170
diff
changeset
|
255 |
9916350d7d8b
don't fail fatally if the client can't get homedir from getpwuid(), fallback
Matt Johnston <matt@ucc.asn.au>
parents:
170
diff
changeset
|
256 if (hostsfile != NULL) { |
436
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
257 *readonly = 0; |
318
9916350d7d8b
don't fail fatally if the client can't get homedir from getpwuid(), fallback
Matt Johnston <matt@ucc.asn.au>
parents:
170
diff
changeset
|
258 fseek(hostsfile, 0, SEEK_SET); |
9916350d7d8b
don't fail fatally if the client can't get homedir from getpwuid(), fallback
Matt Johnston <matt@ucc.asn.au>
parents:
170
diff
changeset
|
259 } else { |
9916350d7d8b
don't fail fatally if the client can't get homedir from getpwuid(), fallback
Matt Johnston <matt@ucc.asn.au>
parents:
170
diff
changeset
|
260 /* We mightn't have been able to open it if it was read-only */ |
9916350d7d8b
don't fail fatally if the client can't get homedir from getpwuid(), fallback
Matt Johnston <matt@ucc.asn.au>
parents:
170
diff
changeset
|
261 if (errno == EACCES || errno == EROFS) { |
9916350d7d8b
don't fail fatally if the client can't get homedir from getpwuid(), fallback
Matt Johnston <matt@ucc.asn.au>
parents:
170
diff
changeset
|
262 TRACE(("trying readonly: %s", strerror(errno))) |
436
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
263 *readonly = 1; |
318
9916350d7d8b
don't fail fatally if the client can't get homedir from getpwuid(), fallback
Matt Johnston <matt@ucc.asn.au>
parents:
170
diff
changeset
|
264 hostsfile = fopen(filename, "r"); |
9916350d7d8b
don't fail fatally if the client can't get homedir from getpwuid(), fallback
Matt Johnston <matt@ucc.asn.au>
parents:
170
diff
changeset
|
265 } |
106
e13f8a712a1c
Fix if the first write fails
Matt Johnston <matt@ucc.asn.au>
parents:
84
diff
changeset
|
266 } |
59
bdc97a5719f4
add new entries to known_hosts
Matt Johnston <matt@ucc.asn.au>
parents:
51
diff
changeset
|
267 } |
bdc97a5719f4
add new entries to known_hosts
Matt Johnston <matt@ucc.asn.au>
parents:
51
diff
changeset
|
268 |
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
269 if (hostsfile == NULL) { |
165
0cfba3034be5
Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place
Matt Johnston <matt@ucc.asn.au>
parents:
106
diff
changeset
|
270 TRACE(("hostsfile didn't open: %s", strerror(errno))) |
322
84aa4e60bd3c
Look at HOME before /etc/passwd when looking for ~/.ssh/known_hosts
Matt Johnston <matt@ucc.asn.au>
parents:
318
diff
changeset
|
271 dropbear_log(LOG_WARNING, "Failed to open %s/.ssh/known_hosts", |
84aa4e60bd3c
Look at HOME before /etc/passwd when looking for ~/.ssh/known_hosts
Matt Johnston <matt@ucc.asn.au>
parents:
318
diff
changeset
|
272 homedir); |
436
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
273 goto out; |
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
274 } |
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
275 |
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
276 out: |
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
277 m_free(filename); |
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
278 return hostsfile; |
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
279 } |
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
280 |
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
281 static void checkhostkey(unsigned char* keyblob, unsigned int keybloblen) { |
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
282 |
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
283 FILE *hostsfile = NULL; |
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
284 int readonly = 0; |
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
285 unsigned int hostlen, algolen; |
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
286 unsigned long len; |
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
287 const char *algoname = NULL; |
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
288 char * fingerprint = NULL; |
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
289 buffer * line = NULL; |
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
290 int ret; |
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
291 |
772
7fc0aeada79c
-y -y to disable hostkey checking
Matt Johnston <matt@ucc.asn.au>
parents:
568
diff
changeset
|
292 if (cli_opts.no_hostkey_check) { |
7fc0aeada79c
-y -y to disable hostkey checking
Matt Johnston <matt@ucc.asn.au>
parents:
568
diff
changeset
|
293 fprintf(stderr, "Caution, skipping hostkey check for %s\n", cli_opts.remotehost); |
7fc0aeada79c
-y -y to disable hostkey checking
Matt Johnston <matt@ucc.asn.au>
parents:
568
diff
changeset
|
294 return; |
7fc0aeada79c
-y -y to disable hostkey checking
Matt Johnston <matt@ucc.asn.au>
parents:
568
diff
changeset
|
295 } |
7fc0aeada79c
-y -y to disable hostkey checking
Matt Johnston <matt@ucc.asn.au>
parents:
568
diff
changeset
|
296 |
847
f4bb964c8678
Add '-R' for delayed hostkey option
Matt Johnston <matt@ucc.asn.au>
parents:
801
diff
changeset
|
297 algoname = signkey_name_from_type(ses.newkeys->algo_hostkey, &algolen); |
f4bb964c8678
Add '-R' for delayed hostkey option
Matt Johnston <matt@ucc.asn.au>
parents:
801
diff
changeset
|
298 |
436
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
299 hostsfile = open_known_hosts_file(&readonly); |
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
300 if (!hostsfile) { |
847
f4bb964c8678
Add '-R' for delayed hostkey option
Matt Johnston <matt@ucc.asn.au>
parents:
801
diff
changeset
|
301 ask_to_confirm(keyblob, keybloblen, algoname); |
436
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
302 /* ask_to_confirm will exit upon failure */ |
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
303 return; |
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
304 } |
436
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
305 |
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
306 line = buf_new(MAX_KNOWNHOSTS_LINE); |
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
307 hostlen = strlen(cli_opts.remotehost); |
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
308 |
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
309 do { |
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
310 if (buf_getline(line, hostsfile) == DROPBEAR_FAILURE) { |
165
0cfba3034be5
Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place
Matt Johnston <matt@ucc.asn.au>
parents:
106
diff
changeset
|
311 TRACE(("failed reading line: prob EOF")) |
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
312 break; |
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
313 } |
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
314 |
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
315 /* The line is too short to be sensible */ |
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
316 /* "30" is 'enough to hold ssh-dss plus the spaces, ie so we don't |
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
317 * buf_getfoo() past the end and die horribly - the base64 parsing |
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
318 * code is what tiptoes up to the end nicely */ |
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
319 if (line->len < (hostlen+30) ) { |
165
0cfba3034be5
Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place
Matt Johnston <matt@ucc.asn.au>
parents:
106
diff
changeset
|
320 TRACE(("line is too short to be sensible")) |
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
321 continue; |
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
322 } |
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
323 |
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
324 /* Compare hostnames */ |
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
325 if (strncmp(cli_opts.remotehost, buf_getptr(line, hostlen), |
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
326 hostlen) != 0) { |
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
327 continue; |
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
328 } |
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
329 |
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
330 buf_incrpos(line, hostlen); |
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
331 if (buf_getbyte(line) != ' ') { |
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
332 /* there wasn't a space after the hostname, something dodgy */ |
165
0cfba3034be5
Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place
Matt Johnston <matt@ucc.asn.au>
parents:
106
diff
changeset
|
333 TRACE(("missing space afte matching hostname")) |
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
334 continue; |
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
335 } |
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
336 |
436
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
337 if (strncmp(buf_getptr(line, algolen), algoname, algolen) != 0) { |
165
0cfba3034be5
Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place
Matt Johnston <matt@ucc.asn.au>
parents:
106
diff
changeset
|
338 TRACE(("algo doesn't match")) |
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
339 continue; |
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
340 } |
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
341 |
59
bdc97a5719f4
add new entries to known_hosts
Matt Johnston <matt@ucc.asn.au>
parents:
51
diff
changeset
|
342 buf_incrpos(line, algolen); |
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
343 if (buf_getbyte(line) != ' ') { |
165
0cfba3034be5
Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place
Matt Johnston <matt@ucc.asn.au>
parents:
106
diff
changeset
|
344 TRACE(("missing space after algo")) |
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
345 continue; |
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
346 } |
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
347 |
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
348 /* Now we're at the interesting hostkey */ |
436
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
349 ret = cmp_base64_key(keyblob, keybloblen, algoname, algolen, |
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
350 line, &fingerprint); |
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
351 |
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
352 if (ret == DROPBEAR_SUCCESS) { |
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
353 /* Good matching key */ |
165
0cfba3034be5
Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place
Matt Johnston <matt@ucc.asn.au>
parents:
106
diff
changeset
|
354 TRACE(("good matching key")) |
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
355 goto out; |
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
356 } |
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
357 |
436
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
358 /* The keys didn't match. eep. Note that we're "leaking" |
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
359 the fingerprint strings here, but we're exiting anyway */ |
847
f4bb964c8678
Add '-R' for delayed hostkey option
Matt Johnston <matt@ucc.asn.au>
parents:
801
diff
changeset
|
360 dropbear_exit("\n\n%s host key mismatch for %s !\n" |
436
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
361 "Fingerprint is %s\n" |
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
362 "Expected %s\n" |
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
363 "If you know that the host key is correct you can\nremove the bad entry from ~/.ssh/known_hosts", |
847
f4bb964c8678
Add '-R' for delayed hostkey option
Matt Johnston <matt@ucc.asn.au>
parents:
801
diff
changeset
|
364 algoname, |
436
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
365 cli_opts.remotehost, |
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
366 sign_key_fingerprint(keyblob, keybloblen), |
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
367 fingerprint ? fingerprint : "UNKNOWN"); |
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
368 } while (1); /* keep going 'til something happens */ |
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
369 |
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
370 /* Key doesn't exist yet */ |
847
f4bb964c8678
Add '-R' for delayed hostkey option
Matt Johnston <matt@ucc.asn.au>
parents:
801
diff
changeset
|
371 ask_to_confirm(keyblob, keybloblen, algoname); |
59
bdc97a5719f4
add new entries to known_hosts
Matt Johnston <matt@ucc.asn.au>
parents:
51
diff
changeset
|
372 |
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
373 /* If we get here, they said yes */ |
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
374 |
59
bdc97a5719f4
add new entries to known_hosts
Matt Johnston <matt@ucc.asn.au>
parents:
51
diff
changeset
|
375 if (readonly) { |
165
0cfba3034be5
Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place
Matt Johnston <matt@ucc.asn.au>
parents:
106
diff
changeset
|
376 TRACE(("readonly")) |
59
bdc97a5719f4
add new entries to known_hosts
Matt Johnston <matt@ucc.asn.au>
parents:
51
diff
changeset
|
377 goto out; |
bdc97a5719f4
add new entries to known_hosts
Matt Johnston <matt@ucc.asn.au>
parents:
51
diff
changeset
|
378 } |
bdc97a5719f4
add new entries to known_hosts
Matt Johnston <matt@ucc.asn.au>
parents:
51
diff
changeset
|
379 |
418
ab57ba0cb667
Add '-y' option to dbclient to accept the host key without checking
Matt Johnston <matt@ucc.asn.au>
parents:
340
diff
changeset
|
380 if (!cli_opts.always_accept_key) { |
ab57ba0cb667
Add '-y' option to dbclient to accept the host key without checking
Matt Johnston <matt@ucc.asn.au>
parents:
340
diff
changeset
|
381 /* put the new entry in the file */ |
ab57ba0cb667
Add '-y' option to dbclient to accept the host key without checking
Matt Johnston <matt@ucc.asn.au>
parents:
340
diff
changeset
|
382 fseek(hostsfile, 0, SEEK_END); /* In case it wasn't opened append */ |
ab57ba0cb667
Add '-y' option to dbclient to accept the host key without checking
Matt Johnston <matt@ucc.asn.au>
parents:
340
diff
changeset
|
383 buf_setpos(line, 0); |
ab57ba0cb667
Add '-y' option to dbclient to accept the host key without checking
Matt Johnston <matt@ucc.asn.au>
parents:
340
diff
changeset
|
384 buf_setlen(line, 0); |
568
005530560594
Rearrange getaddrstring() etc
Matt Johnston <matt@ucc.asn.au>
parents:
544
diff
changeset
|
385 buf_putbytes(line, cli_opts.remotehost, hostlen); |
418
ab57ba0cb667
Add '-y' option to dbclient to accept the host key without checking
Matt Johnston <matt@ucc.asn.au>
parents:
340
diff
changeset
|
386 buf_putbyte(line, ' '); |
ab57ba0cb667
Add '-y' option to dbclient to accept the host key without checking
Matt Johnston <matt@ucc.asn.au>
parents:
340
diff
changeset
|
387 buf_putbytes(line, algoname, algolen); |
ab57ba0cb667
Add '-y' option to dbclient to accept the host key without checking
Matt Johnston <matt@ucc.asn.au>
parents:
340
diff
changeset
|
388 buf_putbyte(line, ' '); |
ab57ba0cb667
Add '-y' option to dbclient to accept the host key without checking
Matt Johnston <matt@ucc.asn.au>
parents:
340
diff
changeset
|
389 len = line->size - line->pos; |
ab57ba0cb667
Add '-y' option to dbclient to accept the host key without checking
Matt Johnston <matt@ucc.asn.au>
parents:
340
diff
changeset
|
390 /* The only failure with base64 is buffer_overflow, but buf_getwriteptr |
ab57ba0cb667
Add '-y' option to dbclient to accept the host key without checking
Matt Johnston <matt@ucc.asn.au>
parents:
340
diff
changeset
|
391 * will die horribly in the case anyway */ |
ab57ba0cb667
Add '-y' option to dbclient to accept the host key without checking
Matt Johnston <matt@ucc.asn.au>
parents:
340
diff
changeset
|
392 base64_encode(keyblob, keybloblen, buf_getwriteptr(line, len), &len); |
ab57ba0cb667
Add '-y' option to dbclient to accept the host key without checking
Matt Johnston <matt@ucc.asn.au>
parents:
340
diff
changeset
|
393 buf_incrwritepos(line, len); |
ab57ba0cb667
Add '-y' option to dbclient to accept the host key without checking
Matt Johnston <matt@ucc.asn.au>
parents:
340
diff
changeset
|
394 buf_putbyte(line, '\n'); |
ab57ba0cb667
Add '-y' option to dbclient to accept the host key without checking
Matt Johnston <matt@ucc.asn.au>
parents:
340
diff
changeset
|
395 buf_setpos(line, 0); |
ab57ba0cb667
Add '-y' option to dbclient to accept the host key without checking
Matt Johnston <matt@ucc.asn.au>
parents:
340
diff
changeset
|
396 fwrite(buf_getptr(line, line->len), line->len, 1, hostsfile); |
ab57ba0cb667
Add '-y' option to dbclient to accept the host key without checking
Matt Johnston <matt@ucc.asn.au>
parents:
340
diff
changeset
|
397 /* We ignore errors, since there's not much we can do about them */ |
ab57ba0cb667
Add '-y' option to dbclient to accept the host key without checking
Matt Johnston <matt@ucc.asn.au>
parents:
340
diff
changeset
|
398 } |
59
bdc97a5719f4
add new entries to known_hosts
Matt Johnston <matt@ucc.asn.au>
parents:
51
diff
changeset
|
399 |
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
400 out: |
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
401 if (hostsfile != NULL) { |
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
402 fclose(hostsfile); |
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
403 } |
79
5a55bd66707f
- don't crash when trying to add to known_hosts if it doesn't exist
Matt Johnston <matt@ucc.asn.au>
parents:
74
diff
changeset
|
404 if (line != NULL) { |
5a55bd66707f
- don't crash when trying to add to known_hosts if it doesn't exist
Matt Johnston <matt@ucc.asn.au>
parents:
74
diff
changeset
|
405 buf_free(line); |
5a55bd66707f
- don't crash when trying to add to known_hosts if it doesn't exist
Matt Johnston <matt@ucc.asn.au>
parents:
74
diff
changeset
|
406 } |
544
9e51707cd6f2
- Make -i and -W pass through multihop arguments
Matt Johnston <matt@ucc.asn.au>
parents:
440
diff
changeset
|
407 m_free(fingerprint); |
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
408 } |