Mercurial > dropbear
annotate cli-kex.c @ 1158:ef67b57fe438
fix default build when getpass() is unavailable
if the system doesn't support getpass, we still default on the options
that require it which causes a build failure. instead, only default
enable these when getpass is available.
| author | Mike Frysinger <vapier@gentoo.org> |
|---|---|
| date | Wed, 21 Oct 2015 22:48:15 +0800 |
| parents | 6aeadee3f16b |
| children | 7fd1211a1f63 |
| rev | line source |
|---|---|
| 26 | 1 /* |
| 2 * Dropbear - a SSH2 server | |
| 3 * | |
|
74
e3adf4cf5465
License boilerplate etc, add Mihnea as an author to some of the files
Matt Johnston <matt@ucc.asn.au>
parents:
59
diff
changeset
|
4 * Copyright (c) 2002-2004 Matt Johnston |
|
e3adf4cf5465
License boilerplate etc, add Mihnea as an author to some of the files
Matt Johnston <matt@ucc.asn.au>
parents:
59
diff
changeset
|
5 * Copyright (c) 2004 by Mihnea Stoenescu |
| 26 | 6 * All rights reserved. |
| 7 * | |
| 8 * Permission is hereby granted, free of charge, to any person obtaining a copy | |
| 9 * of this software and associated documentation files (the "Software"), to deal | |
| 10 * in the Software without restriction, including without limitation the rights | |
| 11 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell | |
| 12 * copies of the Software, and to permit persons to whom the Software is | |
| 13 * furnished to do so, subject to the following conditions: | |
| 14 * | |
| 15 * The above copyright notice and this permission notice shall be included in | |
| 16 * all copies or substantial portions of the Software. | |
| 17 * | |
| 18 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR | |
| 19 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, | |
| 20 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE | |
| 21 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER | |
| 22 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, | |
| 23 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE | |
| 24 * SOFTWARE. */ | |
| 25 | |
| 26 #include "includes.h" | |
| 27 #include "session.h" | |
| 28 #include "dbutil.h" | |
| 29 #include "algo.h" | |
| 30 #include "buffer.h" | |
| 31 #include "session.h" | |
| 32 #include "kex.h" | |
| 33 #include "ssh.h" | |
| 34 #include "packet.h" | |
| 35 #include "bignum.h" | |
|
858
220f55d540ae
rename random.h to dbrandom.h since some OSes have a system random.h
Matt Johnston <matt@ucc.asn.au>
parents:
850
diff
changeset
|
36 #include "dbrandom.h" |
| 26 | 37 #include "runopts.h" |
| 33 | 38 #include "signkey.h" |
|
761
ac2158e3e403
ecc kind of works, needs fixing/testing
Matt Johnston <matt@ucc.asn.au>
parents:
759
diff
changeset
|
39 #include "ecc.h" |
| 26 | 40 |
| 41 | |
|
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
42 static void checkhostkey(unsigned char* keyblob, unsigned int keybloblen); |
|
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
43 #define MAX_KNOWNHOSTS_LINE 4500 |
| 26 | 44 |
| 45 void send_msg_kexdh_init() { | |
|
739
d44325108d0e
first_kex_packet_follows working, needs tidying
Matt Johnston <matt@ucc.asn.au>
parents:
723
diff
changeset
|
46 TRACE(("send_msg_kexdh_init()")) |
| 26 | 47 |
| 48 CHECKCLEARTOWRITE(); | |
| 49 buf_putbyte(ses.writepayload, SSH_MSG_KEXDH_INIT); | |
| 848 | 50 switch (ses.newkeys->algo_kex->mode) { |
| 51 case DROPBEAR_KEX_NORMAL_DH: | |
| 52 if (ses.newkeys->algo_kex != cli_ses.param_kex_algo | |
| 53 || !cli_ses.dh_param) { | |
| 54 if (cli_ses.dh_param) { | |
| 55 free_kexdh_param(cli_ses.dh_param); | |
| 56 } | |
| 57 cli_ses.dh_param = gen_kexdh_param(); | |
| 801 | 58 } |
| 848 | 59 buf_putmpint(ses.writepayload, &cli_ses.dh_param->pub); |
| 60 break; | |
| 61 case DROPBEAR_KEX_ECDH: | |
|
755
b07eb3dc23ec
refactor kexdh code a bit, start working on ecdh etc
Matt Johnston <matt@ucc.asn.au>
parents:
723
diff
changeset
|
62 #ifdef DROPBEAR_ECDH |
| 848 | 63 if (ses.newkeys->algo_kex != cli_ses.param_kex_algo |
| 64 || !cli_ses.ecdh_param) { | |
| 65 if (cli_ses.ecdh_param) { | |
| 66 free_kexecdh_param(cli_ses.ecdh_param); | |
| 67 } | |
| 68 cli_ses.ecdh_param = gen_kexecdh_param(); | |
| 801 | 69 } |
| 848 | 70 buf_put_ecc_raw_pubkey_string(ses.writepayload, &cli_ses.ecdh_param->key); |
|
755
b07eb3dc23ec
refactor kexdh code a bit, start working on ecdh etc
Matt Johnston <matt@ucc.asn.au>
parents:
723
diff
changeset
|
71 #endif |
| 848 | 72 break; |
| 73 #ifdef DROPBEAR_CURVE25519 | |
| 74 case DROPBEAR_KEX_CURVE25519: | |
| 75 if (ses.newkeys->algo_kex != cli_ses.param_kex_algo | |
| 76 || !cli_ses.curve25519_param) { | |
| 77 if (cli_ses.curve25519_param) { | |
| 78 free_kexcurve25519_param(cli_ses.curve25519_param); | |
| 79 } | |
| 80 cli_ses.curve25519_param = gen_kexcurve25519_param(); | |
| 81 } | |
|
1122
aaf576b27a10
Merge pull request #13 from gazoo74/fix-warnings
Matt Johnston <matt@ucc.asn.au>
parents:
1094
diff
changeset
|
82 buf_putstring(ses.writepayload, (const char*)cli_ses.curve25519_param->pub, CURVE25519_LEN); |
| 848 | 83 #endif |
| 84 break; | |
|
755
b07eb3dc23ec
refactor kexdh code a bit, start working on ecdh etc
Matt Johnston <matt@ucc.asn.au>
parents:
723
diff
changeset
|
85 } |
| 848 | 86 |
| 801 | 87 cli_ses.param_kex_algo = ses.newkeys->algo_kex; |
| 26 | 88 encrypt_packet(); |
| 89 } | |
| 90 | |
| 91 /* Handle a diffie-hellman key exchange reply. */ | |
| 92 void recv_msg_kexdh_reply() { | |
| 93 | |
| 94 sign_key *hostkey = NULL; | |
|
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
95 unsigned int type, keybloblen; |
|
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
96 unsigned char* keyblob = NULL; |
|
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
97 |
|
165
0cfba3034be5
Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place
Matt Johnston <matt@ucc.asn.au>
parents:
106
diff
changeset
|
98 TRACE(("enter recv_msg_kexdh_reply")) |
|
84
29a5c7c62350
default initialisers for mp_ints
Matt Johnston <matt@ucc.asn.au>
parents:
80
diff
changeset
|
99 |
|
29a5c7c62350
default initialisers for mp_ints
Matt Johnston <matt@ucc.asn.au>
parents:
80
diff
changeset
|
100 if (cli_ses.kex_state != KEXDH_INIT_SENT) { |
|
29a5c7c62350
default initialisers for mp_ints
Matt Johnston <matt@ucc.asn.au>
parents:
80
diff
changeset
|
101 dropbear_exit("Received out-of-order kexdhreply"); |
|
29a5c7c62350
default initialisers for mp_ints
Matt Johnston <matt@ucc.asn.au>
parents:
80
diff
changeset
|
102 } |
| 26 | 103 type = ses.newkeys->algo_hostkey; |
|
165
0cfba3034be5
Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place
Matt Johnston <matt@ucc.asn.au>
parents:
106
diff
changeset
|
104 TRACE(("type is %d", type)) |
| 26 | 105 |
| 106 hostkey = new_sign_key(); | |
|
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
107 keybloblen = buf_getint(ses.payload); |
|
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
108 |
|
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
109 keyblob = buf_getptr(ses.payload, keybloblen); |
|
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
110 if (!ses.kexstate.donefirstkex) { |
|
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
111 /* Only makes sense the first time */ |
|
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
112 checkhostkey(keyblob, keybloblen); |
|
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
113 } |
|
34
e2a1eaa19f22
Client mostly works up to password auth
Matt Johnston <matt@ucc.asn.au>
parents:
33
diff
changeset
|
114 |
| 26 | 115 if (buf_get_pub_key(ses.payload, hostkey, &type) != DROPBEAR_SUCCESS) { |
|
165
0cfba3034be5
Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place
Matt Johnston <matt@ucc.asn.au>
parents:
106
diff
changeset
|
116 TRACE(("failed getting pubkey")) |
| 26 | 117 dropbear_exit("Bad KEX packet"); |
| 118 } | |
| 119 | |
| 848 | 120 switch (ses.newkeys->algo_kex->mode) { |
| 121 case DROPBEAR_KEX_NORMAL_DH: | |
| 122 { | |
| 123 DEF_MP_INT(dh_f); | |
| 124 m_mp_init(&dh_f); | |
| 125 if (buf_getmpint(ses.payload, &dh_f) != DROPBEAR_SUCCESS) { | |
| 126 TRACE(("failed getting mpint")) | |
| 127 dropbear_exit("Bad KEX packet"); | |
| 128 } | |
| 26 | 129 |
| 848 | 130 kexdh_comb_key(cli_ses.dh_param, &dh_f, hostkey); |
| 131 mp_clear(&dh_f); | |
| 132 } | |
| 133 break; | |
| 134 case DROPBEAR_KEX_ECDH: | |
|
755
b07eb3dc23ec
refactor kexdh code a bit, start working on ecdh etc
Matt Johnston <matt@ucc.asn.au>
parents:
723
diff
changeset
|
135 #ifdef DROPBEAR_ECDH |
| 848 | 136 { |
| 137 buffer *ecdh_qs = buf_getstringbuf(ses.payload); | |
| 138 kexecdh_comb_key(cli_ses.ecdh_param, ecdh_qs, hostkey); | |
| 139 buf_free(ecdh_qs); | |
| 140 } | |
|
755
b07eb3dc23ec
refactor kexdh code a bit, start working on ecdh etc
Matt Johnston <matt@ucc.asn.au>
parents:
723
diff
changeset
|
141 #endif |
| 848 | 142 break; |
| 143 #ifdef DROPBEAR_CURVE25519 | |
| 144 case DROPBEAR_KEX_CURVE25519: | |
| 145 { | |
| 146 buffer *ecdh_qs = buf_getstringbuf(ses.payload); | |
| 147 kexcurve25519_comb_key(cli_ses.curve25519_param, ecdh_qs, hostkey); | |
| 148 buf_free(ecdh_qs); | |
| 149 } | |
| 150 #endif | |
| 151 break; | |
| 26 | 152 } |
| 153 | |
| 801 | 154 if (cli_ses.dh_param) { |
| 155 free_kexdh_param(cli_ses.dh_param); | |
| 156 cli_ses.dh_param = NULL; | |
| 157 } | |
| 158 #ifdef DROPBEAR_ECDH | |
| 159 if (cli_ses.ecdh_param) { | |
| 160 free_kexecdh_param(cli_ses.ecdh_param); | |
| 161 cli_ses.ecdh_param = NULL; | |
| 162 } | |
| 163 #endif | |
| 848 | 164 #ifdef DROPBEAR_CURVE25519 |
| 165 if (cli_ses.curve25519_param) { | |
| 166 free_kexcurve25519_param(cli_ses.curve25519_param); | |
| 167 cli_ses.curve25519_param = NULL; | |
| 168 } | |
| 169 #endif | |
| 26 | 170 |
| 801 | 171 cli_ses.param_kex_algo = NULL; |
| 172 if (buf_verify(ses.payload, hostkey, ses.hash) != DROPBEAR_SUCCESS) { | |
| 26 | 173 dropbear_exit("Bad hostkey signature"); |
| 174 } | |
| 175 | |
| 176 sign_key_free(hostkey); | |
| 177 hostkey = NULL; | |
| 178 | |
| 179 send_msg_newkeys(); | |
|
886
cbc73a5aefb0
requirenext doesn't need two values
Matt Johnston <matt@ucc.asn.au>
parents:
885
diff
changeset
|
180 ses.requirenext = SSH_MSG_NEWKEYS; |
|
165
0cfba3034be5
Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place
Matt Johnston <matt@ucc.asn.au>
parents:
106
diff
changeset
|
181 TRACE(("leave recv_msg_kexdh_init")) |
| 26 | 182 } |
|
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
183 |
|
847
f4bb964c8678
Add '-R' for delayed hostkey option
Matt Johnston <matt@ucc.asn.au>
parents:
801
diff
changeset
|
184 static void ask_to_confirm(unsigned char* keyblob, unsigned int keybloblen, |
|
f4bb964c8678
Add '-R' for delayed hostkey option
Matt Johnston <matt@ucc.asn.au>
parents:
801
diff
changeset
|
185 const char* algoname) { |
|
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
186 |
|
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
187 char* fp = NULL; |
|
170
a62cb364f615
Read "y/n" response for fingerprints from /dev/tty directly so that dbclient
Matt Johnston <matt@ucc.asn.au>
parents:
165
diff
changeset
|
188 FILE *tty = NULL; |
|
a62cb364f615
Read "y/n" response for fingerprints from /dev/tty directly so that dbclient
Matt Johnston <matt@ucc.asn.au>
parents:
165
diff
changeset
|
189 char response = 'z'; |
|
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
190 |
|
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
191 fp = sign_key_fingerprint(keyblob, keybloblen); |
|
418
ab57ba0cb667
Add '-y' option to dbclient to accept the host key without checking
Matt Johnston <matt@ucc.asn.au>
parents:
340
diff
changeset
|
192 if (cli_opts.always_accept_key) { |
|
847
f4bb964c8678
Add '-R' for delayed hostkey option
Matt Johnston <matt@ucc.asn.au>
parents:
801
diff
changeset
|
193 fprintf(stderr, "\nHost '%s' key accepted unconditionally.\n(%s fingerprint %s)\n", |
|
418
ab57ba0cb667
Add '-y' option to dbclient to accept the host key without checking
Matt Johnston <matt@ucc.asn.au>
parents:
340
diff
changeset
|
194 cli_opts.remotehost, |
|
847
f4bb964c8678
Add '-R' for delayed hostkey option
Matt Johnston <matt@ucc.asn.au>
parents:
801
diff
changeset
|
195 algoname, |
|
418
ab57ba0cb667
Add '-y' option to dbclient to accept the host key without checking
Matt Johnston <matt@ucc.asn.au>
parents:
340
diff
changeset
|
196 fp); |
|
ab57ba0cb667
Add '-y' option to dbclient to accept the host key without checking
Matt Johnston <matt@ucc.asn.au>
parents:
340
diff
changeset
|
197 m_free(fp); |
|
ab57ba0cb667
Add '-y' option to dbclient to accept the host key without checking
Matt Johnston <matt@ucc.asn.au>
parents:
340
diff
changeset
|
198 return; |
|
ab57ba0cb667
Add '-y' option to dbclient to accept the host key without checking
Matt Johnston <matt@ucc.asn.au>
parents:
340
diff
changeset
|
199 } |
|
847
f4bb964c8678
Add '-R' for delayed hostkey option
Matt Johnston <matt@ucc.asn.au>
parents:
801
diff
changeset
|
200 fprintf(stderr, "\nHost '%s' is not in the trusted hosts file.\n(%s fingerprint %s)\nDo you want to continue connecting? (y/n) ", |
|
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
201 cli_opts.remotehost, |
|
847
f4bb964c8678
Add '-R' for delayed hostkey option
Matt Johnston <matt@ucc.asn.au>
parents:
801
diff
changeset
|
202 algoname, |
|
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
203 fp); |
| 340 | 204 m_free(fp); |
|
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
205 |
|
170
a62cb364f615
Read "y/n" response for fingerprints from /dev/tty directly so that dbclient
Matt Johnston <matt@ucc.asn.au>
parents:
165
diff
changeset
|
206 tty = fopen(_PATH_TTY, "r"); |
|
a62cb364f615
Read "y/n" response for fingerprints from /dev/tty directly so that dbclient
Matt Johnston <matt@ucc.asn.au>
parents:
165
diff
changeset
|
207 if (tty) { |
|
a62cb364f615
Read "y/n" response for fingerprints from /dev/tty directly so that dbclient
Matt Johnston <matt@ucc.asn.au>
parents:
165
diff
changeset
|
208 response = getc(tty); |
|
a62cb364f615
Read "y/n" response for fingerprints from /dev/tty directly so that dbclient
Matt Johnston <matt@ucc.asn.au>
parents:
165
diff
changeset
|
209 fclose(tty); |
|
a62cb364f615
Read "y/n" response for fingerprints from /dev/tty directly so that dbclient
Matt Johnston <matt@ucc.asn.au>
parents:
165
diff
changeset
|
210 } else { |
|
a62cb364f615
Read "y/n" response for fingerprints from /dev/tty directly so that dbclient
Matt Johnston <matt@ucc.asn.au>
parents:
165
diff
changeset
|
211 response = getc(stdin); |
|
a62cb364f615
Read "y/n" response for fingerprints from /dev/tty directly so that dbclient
Matt Johnston <matt@ucc.asn.au>
parents:
165
diff
changeset
|
212 } |
|
a62cb364f615
Read "y/n" response for fingerprints from /dev/tty directly so that dbclient
Matt Johnston <matt@ucc.asn.au>
parents:
165
diff
changeset
|
213 |
|
a62cb364f615
Read "y/n" response for fingerprints from /dev/tty directly so that dbclient
Matt Johnston <matt@ucc.asn.au>
parents:
165
diff
changeset
|
214 if (response == 'y') { |
|
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
215 return; |
|
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
216 } |
|
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
217 |
|
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
218 dropbear_exit("Didn't validate host key"); |
|
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
219 } |
|
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
220 |
|
436
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
221 static FILE* open_known_hosts_file(int * readonly) |
|
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
222 { |
|
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
223 FILE * hostsfile = NULL; |
|
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
224 char * filename = NULL; |
|
318
9916350d7d8b
don't fail fatally if the client can't get homedir from getpwuid(), fallback
Matt Johnston <matt@ucc.asn.au>
parents:
170
diff
changeset
|
225 char * homedir = NULL; |
|
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
226 |
|
322
84aa4e60bd3c
Look at HOME before /etc/passwd when looking for ~/.ssh/known_hosts
Matt Johnston <matt@ucc.asn.au>
parents:
318
diff
changeset
|
227 homedir = getenv("HOME"); |
|
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
228 |
|
322
84aa4e60bd3c
Look at HOME before /etc/passwd when looking for ~/.ssh/known_hosts
Matt Johnston <matt@ucc.asn.au>
parents:
318
diff
changeset
|
229 if (!homedir) { |
|
436
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
230 struct passwd * pw = NULL; |
|
322
84aa4e60bd3c
Look at HOME before /etc/passwd when looking for ~/.ssh/known_hosts
Matt Johnston <matt@ucc.asn.au>
parents:
318
diff
changeset
|
231 pw = getpwuid(getuid()); |
|
84aa4e60bd3c
Look at HOME before /etc/passwd when looking for ~/.ssh/known_hosts
Matt Johnston <matt@ucc.asn.au>
parents:
318
diff
changeset
|
232 if (pw) { |
|
84aa4e60bd3c
Look at HOME before /etc/passwd when looking for ~/.ssh/known_hosts
Matt Johnston <matt@ucc.asn.au>
parents:
318
diff
changeset
|
233 homedir = pw->pw_dir; |
|
84aa4e60bd3c
Look at HOME before /etc/passwd when looking for ~/.ssh/known_hosts
Matt Johnston <matt@ucc.asn.au>
parents:
318
diff
changeset
|
234 } |
|
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
235 } |
|
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
236 |
|
318
9916350d7d8b
don't fail fatally if the client can't get homedir from getpwuid(), fallback
Matt Johnston <matt@ucc.asn.au>
parents:
170
diff
changeset
|
237 if (homedir) { |
|
436
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
238 unsigned int len; |
|
318
9916350d7d8b
don't fail fatally if the client can't get homedir from getpwuid(), fallback
Matt Johnston <matt@ucc.asn.au>
parents:
170
diff
changeset
|
239 len = strlen(homedir); |
|
9916350d7d8b
don't fail fatally if the client can't get homedir from getpwuid(), fallback
Matt Johnston <matt@ucc.asn.au>
parents:
170
diff
changeset
|
240 filename = m_malloc(len + 18); /* "/.ssh/known_hosts" and null-terminator*/ |
|
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
241 |
|
318
9916350d7d8b
don't fail fatally if the client can't get homedir from getpwuid(), fallback
Matt Johnston <matt@ucc.asn.au>
parents:
170
diff
changeset
|
242 snprintf(filename, len+18, "%s/.ssh", homedir); |
|
9916350d7d8b
don't fail fatally if the client can't get homedir from getpwuid(), fallback
Matt Johnston <matt@ucc.asn.au>
parents:
170
diff
changeset
|
243 /* Check that ~/.ssh exists - easiest way is just to mkdir */ |
|
9916350d7d8b
don't fail fatally if the client can't get homedir from getpwuid(), fallback
Matt Johnston <matt@ucc.asn.au>
parents:
170
diff
changeset
|
244 if (mkdir(filename, S_IRWXU) != 0) { |
|
9916350d7d8b
don't fail fatally if the client can't get homedir from getpwuid(), fallback
Matt Johnston <matt@ucc.asn.au>
parents:
170
diff
changeset
|
245 if (errno != EEXIST) { |
|
322
84aa4e60bd3c
Look at HOME before /etc/passwd when looking for ~/.ssh/known_hosts
Matt Johnston <matt@ucc.asn.au>
parents:
318
diff
changeset
|
246 dropbear_log(LOG_INFO, "Warning: failed creating %s/.ssh: %s", |
|
84aa4e60bd3c
Look at HOME before /etc/passwd when looking for ~/.ssh/known_hosts
Matt Johnston <matt@ucc.asn.au>
parents:
318
diff
changeset
|
247 homedir, strerror(errno)); |
|
318
9916350d7d8b
don't fail fatally if the client can't get homedir from getpwuid(), fallback
Matt Johnston <matt@ucc.asn.au>
parents:
170
diff
changeset
|
248 TRACE(("mkdir didn't work: %s", strerror(errno))) |
|
436
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
249 goto out; |
|
318
9916350d7d8b
don't fail fatally if the client can't get homedir from getpwuid(), fallback
Matt Johnston <matt@ucc.asn.au>
parents:
170
diff
changeset
|
250 } |
|
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
251 } |
|
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
252 |
|
318
9916350d7d8b
don't fail fatally if the client can't get homedir from getpwuid(), fallback
Matt Johnston <matt@ucc.asn.au>
parents:
170
diff
changeset
|
253 snprintf(filename, len+18, "%s/.ssh/known_hosts", homedir); |
|
9916350d7d8b
don't fail fatally if the client can't get homedir from getpwuid(), fallback
Matt Johnston <matt@ucc.asn.au>
parents:
170
diff
changeset
|
254 hostsfile = fopen(filename, "a+"); |
|
9916350d7d8b
don't fail fatally if the client can't get homedir from getpwuid(), fallback
Matt Johnston <matt@ucc.asn.au>
parents:
170
diff
changeset
|
255 |
|
9916350d7d8b
don't fail fatally if the client can't get homedir from getpwuid(), fallback
Matt Johnston <matt@ucc.asn.au>
parents:
170
diff
changeset
|
256 if (hostsfile != NULL) { |
|
436
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
257 *readonly = 0; |
|
318
9916350d7d8b
don't fail fatally if the client can't get homedir from getpwuid(), fallback
Matt Johnston <matt@ucc.asn.au>
parents:
170
diff
changeset
|
258 fseek(hostsfile, 0, SEEK_SET); |
|
9916350d7d8b
don't fail fatally if the client can't get homedir from getpwuid(), fallback
Matt Johnston <matt@ucc.asn.au>
parents:
170
diff
changeset
|
259 } else { |
|
9916350d7d8b
don't fail fatally if the client can't get homedir from getpwuid(), fallback
Matt Johnston <matt@ucc.asn.au>
parents:
170
diff
changeset
|
260 /* We mightn't have been able to open it if it was read-only */ |
|
9916350d7d8b
don't fail fatally if the client can't get homedir from getpwuid(), fallback
Matt Johnston <matt@ucc.asn.au>
parents:
170
diff
changeset
|
261 if (errno == EACCES || errno == EROFS) { |
|
9916350d7d8b
don't fail fatally if the client can't get homedir from getpwuid(), fallback
Matt Johnston <matt@ucc.asn.au>
parents:
170
diff
changeset
|
262 TRACE(("trying readonly: %s", strerror(errno))) |
|
436
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
263 *readonly = 1; |
|
318
9916350d7d8b
don't fail fatally if the client can't get homedir from getpwuid(), fallback
Matt Johnston <matt@ucc.asn.au>
parents:
170
diff
changeset
|
264 hostsfile = fopen(filename, "r"); |
|
9916350d7d8b
don't fail fatally if the client can't get homedir from getpwuid(), fallback
Matt Johnston <matt@ucc.asn.au>
parents:
170
diff
changeset
|
265 } |
|
106
e13f8a712a1c
Fix if the first write fails
Matt Johnston <matt@ucc.asn.au>
parents:
84
diff
changeset
|
266 } |
|
59
bdc97a5719f4
add new entries to known_hosts
Matt Johnston <matt@ucc.asn.au>
parents:
51
diff
changeset
|
267 } |
|
bdc97a5719f4
add new entries to known_hosts
Matt Johnston <matt@ucc.asn.au>
parents:
51
diff
changeset
|
268 |
|
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
269 if (hostsfile == NULL) { |
|
165
0cfba3034be5
Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place
Matt Johnston <matt@ucc.asn.au>
parents:
106
diff
changeset
|
270 TRACE(("hostsfile didn't open: %s", strerror(errno))) |
|
322
84aa4e60bd3c
Look at HOME before /etc/passwd when looking for ~/.ssh/known_hosts
Matt Johnston <matt@ucc.asn.au>
parents:
318
diff
changeset
|
271 dropbear_log(LOG_WARNING, "Failed to open %s/.ssh/known_hosts", |
|
84aa4e60bd3c
Look at HOME before /etc/passwd when looking for ~/.ssh/known_hosts
Matt Johnston <matt@ucc.asn.au>
parents:
318
diff
changeset
|
272 homedir); |
|
436
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
273 goto out; |
|
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
274 } |
|
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
275 |
|
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
276 out: |
|
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
277 m_free(filename); |
|
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
278 return hostsfile; |
|
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
279 } |
|
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
280 |
|
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
281 static void checkhostkey(unsigned char* keyblob, unsigned int keybloblen) { |
|
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
282 |
|
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
283 FILE *hostsfile = NULL; |
|
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
284 int readonly = 0; |
|
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
285 unsigned int hostlen, algolen; |
|
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
286 unsigned long len; |
|
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
287 const char *algoname = NULL; |
|
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
288 char * fingerprint = NULL; |
|
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
289 buffer * line = NULL; |
|
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
290 int ret; |
|
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
291 |
|
772
7fc0aeada79c
-y -y to disable hostkey checking
Matt Johnston <matt@ucc.asn.au>
parents:
568
diff
changeset
|
292 if (cli_opts.no_hostkey_check) { |
|
7fc0aeada79c
-y -y to disable hostkey checking
Matt Johnston <matt@ucc.asn.au>
parents:
568
diff
changeset
|
293 fprintf(stderr, "Caution, skipping hostkey check for %s\n", cli_opts.remotehost); |
|
7fc0aeada79c
-y -y to disable hostkey checking
Matt Johnston <matt@ucc.asn.au>
parents:
568
diff
changeset
|
294 return; |
|
7fc0aeada79c
-y -y to disable hostkey checking
Matt Johnston <matt@ucc.asn.au>
parents:
568
diff
changeset
|
295 } |
|
7fc0aeada79c
-y -y to disable hostkey checking
Matt Johnston <matt@ucc.asn.au>
parents:
568
diff
changeset
|
296 |
|
847
f4bb964c8678
Add '-R' for delayed hostkey option
Matt Johnston <matt@ucc.asn.au>
parents:
801
diff
changeset
|
297 algoname = signkey_name_from_type(ses.newkeys->algo_hostkey, &algolen); |
|
f4bb964c8678
Add '-R' for delayed hostkey option
Matt Johnston <matt@ucc.asn.au>
parents:
801
diff
changeset
|
298 |
|
436
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
299 hostsfile = open_known_hosts_file(&readonly); |
|
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
300 if (!hostsfile) { |
|
847
f4bb964c8678
Add '-R' for delayed hostkey option
Matt Johnston <matt@ucc.asn.au>
parents:
801
diff
changeset
|
301 ask_to_confirm(keyblob, keybloblen, algoname); |
|
436
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
302 /* ask_to_confirm will exit upon failure */ |
|
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
303 return; |
|
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
304 } |
|
436
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
305 |
|
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
306 line = buf_new(MAX_KNOWNHOSTS_LINE); |
|
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
307 hostlen = strlen(cli_opts.remotehost); |
|
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
308 |
|
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
309 do { |
|
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
310 if (buf_getline(line, hostsfile) == DROPBEAR_FAILURE) { |
|
165
0cfba3034be5
Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place
Matt Johnston <matt@ucc.asn.au>
parents:
106
diff
changeset
|
311 TRACE(("failed reading line: prob EOF")) |
|
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
312 break; |
|
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
313 } |
|
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
314 |
|
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
315 /* The line is too short to be sensible */ |
|
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
316 /* "30" is 'enough to hold ssh-dss plus the spaces, ie so we don't |
|
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
317 * buf_getfoo() past the end and die horribly - the base64 parsing |
|
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
318 * code is what tiptoes up to the end nicely */ |
|
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
319 if (line->len < (hostlen+30) ) { |
|
165
0cfba3034be5
Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place
Matt Johnston <matt@ucc.asn.au>
parents:
106
diff
changeset
|
320 TRACE(("line is too short to be sensible")) |
|
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
321 continue; |
|
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
322 } |
|
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
323 |
|
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
324 /* Compare hostnames */ |
|
1094
c45d65392c1a
Fix pointer differ in signess warnings [-Werror=pointer-sign]
Gaël PORTAY <gael.portay@gmail.com>
parents:
886
diff
changeset
|
325 if (strncmp(cli_opts.remotehost, (const char *) buf_getptr(line, hostlen), |
|
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
326 hostlen) != 0) { |
|
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
327 continue; |
|
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
328 } |
|
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
329 |
|
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
330 buf_incrpos(line, hostlen); |
|
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
331 if (buf_getbyte(line) != ' ') { |
|
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
332 /* there wasn't a space after the hostname, something dodgy */ |
|
165
0cfba3034be5
Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place
Matt Johnston <matt@ucc.asn.au>
parents:
106
diff
changeset
|
333 TRACE(("missing space afte matching hostname")) |
|
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
334 continue; |
|
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
335 } |
|
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
336 |
|
1094
c45d65392c1a
Fix pointer differ in signess warnings [-Werror=pointer-sign]
Gaël PORTAY <gael.portay@gmail.com>
parents:
886
diff
changeset
|
337 if (strncmp((const char *) buf_getptr(line, algolen), algoname, algolen) != 0) { |
|
165
0cfba3034be5
Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place
Matt Johnston <matt@ucc.asn.au>
parents:
106
diff
changeset
|
338 TRACE(("algo doesn't match")) |
|
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
339 continue; |
|
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
340 } |
|
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
341 |
|
59
bdc97a5719f4
add new entries to known_hosts
Matt Johnston <matt@ucc.asn.au>
parents:
51
diff
changeset
|
342 buf_incrpos(line, algolen); |
|
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
343 if (buf_getbyte(line) != ' ') { |
|
165
0cfba3034be5
Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place
Matt Johnston <matt@ucc.asn.au>
parents:
106
diff
changeset
|
344 TRACE(("missing space after algo")) |
|
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
345 continue; |
|
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
346 } |
|
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
347 |
|
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
348 /* Now we're at the interesting hostkey */ |
|
1094
c45d65392c1a
Fix pointer differ in signess warnings [-Werror=pointer-sign]
Gaël PORTAY <gael.portay@gmail.com>
parents:
886
diff
changeset
|
349 ret = cmp_base64_key(keyblob, keybloblen, (const unsigned char *) algoname, algolen, |
|
436
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
350 line, &fingerprint); |
|
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
351 |
|
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
352 if (ret == DROPBEAR_SUCCESS) { |
|
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
353 /* Good matching key */ |
|
165
0cfba3034be5
Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place
Matt Johnston <matt@ucc.asn.au>
parents:
106
diff
changeset
|
354 TRACE(("good matching key")) |
|
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
355 goto out; |
|
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
356 } |
|
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
357 |
|
436
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
358 /* The keys didn't match. eep. Note that we're "leaking" |
|
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
359 the fingerprint strings here, but we're exiting anyway */ |
|
847
f4bb964c8678
Add '-R' for delayed hostkey option
Matt Johnston <matt@ucc.asn.au>
parents:
801
diff
changeset
|
360 dropbear_exit("\n\n%s host key mismatch for %s !\n" |
|
436
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
361 "Fingerprint is %s\n" |
|
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
362 "Expected %s\n" |
|
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
363 "If you know that the host key is correct you can\nremove the bad entry from ~/.ssh/known_hosts", |
|
847
f4bb964c8678
Add '-R' for delayed hostkey option
Matt Johnston <matt@ucc.asn.au>
parents:
801
diff
changeset
|
364 algoname, |
|
436
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
365 cli_opts.remotehost, |
|
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
366 sign_key_fingerprint(keyblob, keybloblen), |
|
7282370416a0
Improve known_hosts checking.
Matt Johnston <matt@ucc.asn.au>
parents:
418
diff
changeset
|
367 fingerprint ? fingerprint : "UNKNOWN"); |
|
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
368 } while (1); /* keep going 'til something happens */ |
|
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
369 |
|
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
370 /* Key doesn't exist yet */ |
|
847
f4bb964c8678
Add '-R' for delayed hostkey option
Matt Johnston <matt@ucc.asn.au>
parents:
801
diff
changeset
|
371 ask_to_confirm(keyblob, keybloblen, algoname); |
|
59
bdc97a5719f4
add new entries to known_hosts
Matt Johnston <matt@ucc.asn.au>
parents:
51
diff
changeset
|
372 |
|
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
373 /* If we get here, they said yes */ |
|
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
374 |
|
59
bdc97a5719f4
add new entries to known_hosts
Matt Johnston <matt@ucc.asn.au>
parents:
51
diff
changeset
|
375 if (readonly) { |
|
165
0cfba3034be5
Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place
Matt Johnston <matt@ucc.asn.au>
parents:
106
diff
changeset
|
376 TRACE(("readonly")) |
|
59
bdc97a5719f4
add new entries to known_hosts
Matt Johnston <matt@ucc.asn.au>
parents:
51
diff
changeset
|
377 goto out; |
|
bdc97a5719f4
add new entries to known_hosts
Matt Johnston <matt@ucc.asn.au>
parents:
51
diff
changeset
|
378 } |
|
bdc97a5719f4
add new entries to known_hosts
Matt Johnston <matt@ucc.asn.au>
parents:
51
diff
changeset
|
379 |
|
418
ab57ba0cb667
Add '-y' option to dbclient to accept the host key without checking
Matt Johnston <matt@ucc.asn.au>
parents:
340
diff
changeset
|
380 if (!cli_opts.always_accept_key) { |
|
ab57ba0cb667
Add '-y' option to dbclient to accept the host key without checking
Matt Johnston <matt@ucc.asn.au>
parents:
340
diff
changeset
|
381 /* put the new entry in the file */ |
|
ab57ba0cb667
Add '-y' option to dbclient to accept the host key without checking
Matt Johnston <matt@ucc.asn.au>
parents:
340
diff
changeset
|
382 fseek(hostsfile, 0, SEEK_END); /* In case it wasn't opened append */ |
|
ab57ba0cb667
Add '-y' option to dbclient to accept the host key without checking
Matt Johnston <matt@ucc.asn.au>
parents:
340
diff
changeset
|
383 buf_setpos(line, 0); |
|
ab57ba0cb667
Add '-y' option to dbclient to accept the host key without checking
Matt Johnston <matt@ucc.asn.au>
parents:
340
diff
changeset
|
384 buf_setlen(line, 0); |
|
1094
c45d65392c1a
Fix pointer differ in signess warnings [-Werror=pointer-sign]
Gaël PORTAY <gael.portay@gmail.com>
parents:
886
diff
changeset
|
385 buf_putbytes(line, (const unsigned char *) cli_opts.remotehost, hostlen); |
|
418
ab57ba0cb667
Add '-y' option to dbclient to accept the host key without checking
Matt Johnston <matt@ucc.asn.au>
parents:
340
diff
changeset
|
386 buf_putbyte(line, ' '); |
|
1094
c45d65392c1a
Fix pointer differ in signess warnings [-Werror=pointer-sign]
Gaël PORTAY <gael.portay@gmail.com>
parents:
886
diff
changeset
|
387 buf_putbytes(line, (const unsigned char *) algoname, algolen); |
|
418
ab57ba0cb667
Add '-y' option to dbclient to accept the host key without checking
Matt Johnston <matt@ucc.asn.au>
parents:
340
diff
changeset
|
388 buf_putbyte(line, ' '); |
|
ab57ba0cb667
Add '-y' option to dbclient to accept the host key without checking
Matt Johnston <matt@ucc.asn.au>
parents:
340
diff
changeset
|
389 len = line->size - line->pos; |
|
ab57ba0cb667
Add '-y' option to dbclient to accept the host key without checking
Matt Johnston <matt@ucc.asn.au>
parents:
340
diff
changeset
|
390 /* The only failure with base64 is buffer_overflow, but buf_getwriteptr |
|
ab57ba0cb667
Add '-y' option to dbclient to accept the host key without checking
Matt Johnston <matt@ucc.asn.au>
parents:
340
diff
changeset
|
391 * will die horribly in the case anyway */ |
|
ab57ba0cb667
Add '-y' option to dbclient to accept the host key without checking
Matt Johnston <matt@ucc.asn.au>
parents:
340
diff
changeset
|
392 base64_encode(keyblob, keybloblen, buf_getwriteptr(line, len), &len); |
|
ab57ba0cb667
Add '-y' option to dbclient to accept the host key without checking
Matt Johnston <matt@ucc.asn.au>
parents:
340
diff
changeset
|
393 buf_incrwritepos(line, len); |
|
ab57ba0cb667
Add '-y' option to dbclient to accept the host key without checking
Matt Johnston <matt@ucc.asn.au>
parents:
340
diff
changeset
|
394 buf_putbyte(line, '\n'); |
|
ab57ba0cb667
Add '-y' option to dbclient to accept the host key without checking
Matt Johnston <matt@ucc.asn.au>
parents:
340
diff
changeset
|
395 buf_setpos(line, 0); |
|
ab57ba0cb667
Add '-y' option to dbclient to accept the host key without checking
Matt Johnston <matt@ucc.asn.au>
parents:
340
diff
changeset
|
396 fwrite(buf_getptr(line, line->len), line->len, 1, hostsfile); |
|
ab57ba0cb667
Add '-y' option to dbclient to accept the host key without checking
Matt Johnston <matt@ucc.asn.au>
parents:
340
diff
changeset
|
397 /* We ignore errors, since there's not much we can do about them */ |
|
ab57ba0cb667
Add '-y' option to dbclient to accept the host key without checking
Matt Johnston <matt@ucc.asn.au>
parents:
340
diff
changeset
|
398 } |
|
59
bdc97a5719f4
add new entries to known_hosts
Matt Johnston <matt@ucc.asn.au>
parents:
51
diff
changeset
|
399 |
|
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
400 out: |
|
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
401 if (hostsfile != NULL) { |
|
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
402 fclose(hostsfile); |
|
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
403 } |
|
79
5a55bd66707f
- don't crash when trying to add to known_hosts if it doesn't exist
Matt Johnston <matt@ucc.asn.au>
parents:
74
diff
changeset
|
404 if (line != NULL) { |
|
5a55bd66707f
- don't crash when trying to add to known_hosts if it doesn't exist
Matt Johnston <matt@ucc.asn.au>
parents:
74
diff
changeset
|
405 buf_free(line); |
|
5a55bd66707f
- don't crash when trying to add to known_hosts if it doesn't exist
Matt Johnston <matt@ucc.asn.au>
parents:
74
diff
changeset
|
406 } |
|
544
9e51707cd6f2
- Make -i and -W pass through multihop arguments
Matt Johnston <matt@ucc.asn.au>
parents:
440
diff
changeset
|
407 m_free(fingerprint); |
|
51
095d689fed16
- Hostkey checking is mostly there, just aren't appending yet.
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
408 } |