1 /* $OpenBSD: canohost.c,v 1.71 2014/07/15 15:54:14 millert Exp $ */
3 * Author: Tatu Ylonen <ylo@cs.hut.fi>
4 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
6 * Functions for returning the canonical host name of the remote site.
8 * As far as I am concerned, the code I have written for this software
9 * can be used freely for any purpose. Any derived versions of this
10 * software must be clearly marked as such, and if the derived work is
11 * incompatible with the protocol description in the RFC file, it must be
12 * called by a name other than "ssh" or "Secure Shell".
17 #include <sys/types.h>
18 #include <sys/socket.h>
21 #include <netinet/in.h>
22 #include <arpa/inet.h>
38 static void check_ip_options(int, char *);
39 static char *canonical_host_ip
= NULL
;
40 static int cached_port
= -1;
43 * Return the canonical name of the host at the other end of the socket. The
44 * caller should free the returned string.
48 get_remote_hostname(int sock
, int use_dns
)
50 struct sockaddr_storage from
;
52 struct addrinfo hints
, *ai
, *aitop
;
53 char name
[NI_MAXHOST
], ntop
[NI_MAXHOST
], ntop2
[NI_MAXHOST
];
55 /* Get IP address of client. */
56 fromlen
= sizeof(from
);
57 memset(&from
, 0, sizeof(from
));
58 if (getpeername(sock
, (struct sockaddr
*)&from
, &fromlen
) < 0) {
59 debug("getpeername failed: %.100s", strerror(errno
));
63 if (from
.ss_family
== AF_INET
)
64 check_ip_options(sock
, ntop
);
66 ipv64_normalise_mapped(&from
, &fromlen
);
68 if (from
.ss_family
== AF_INET6
)
69 fromlen
= sizeof(struct sockaddr_in6
);
71 if (getnameinfo((struct sockaddr
*)&from
, fromlen
, ntop
, sizeof(ntop
),
72 NULL
, 0, NI_NUMERICHOST
) != 0)
73 fatal("get_remote_hostname: getnameinfo NI_NUMERICHOST failed");
78 debug3("Trying to reverse map address %.100s.", ntop
);
79 /* Map the IP address to a host name. */
80 if (getnameinfo((struct sockaddr
*)&from
, fromlen
, name
, sizeof(name
),
81 NULL
, 0, NI_NAMEREQD
) != 0) {
82 /* Host name not found. Use ip address. */
87 * if reverse lookup result looks like a numeric hostname,
88 * someone is trying to trick us by PTR record like following:
89 * 1.1.1.10.in-addr.arpa. IN PTR 2.3.4.5
91 memset(&hints
, 0, sizeof(hints
));
92 hints
.ai_socktype
= SOCK_DGRAM
; /*dummy*/
93 hints
.ai_flags
= AI_NUMERICHOST
;
94 if (getaddrinfo(name
, NULL
, &hints
, &ai
) == 0) {
95 logit("Nasty PTR record \"%s\" is set up for %s, ignoring",
101 /* Names are stores in lowercase. */
105 * Map it back to an IP address and check that the given
106 * address actually is an address of this host. This is
107 * necessary because anyone with access to a name server can
108 * define arbitrary names for an IP address. Mapping from
109 * name to IP address can be trusted better (but can still be
110 * fooled if the intruder has access to the name server of
113 memset(&hints
, 0, sizeof(hints
));
114 hints
.ai_family
= from
.ss_family
;
115 hints
.ai_socktype
= SOCK_STREAM
;
116 if (getaddrinfo(name
, NULL
, &hints
, &aitop
) != 0) {
117 logit("reverse mapping checking getaddrinfo for %.700s "
118 "[%s] failed - POSSIBLE BREAK-IN ATTEMPT!", name
, ntop
);
119 return xstrdup(ntop
);
121 /* Look for the address from the list of addresses. */
122 for (ai
= aitop
; ai
; ai
= ai
->ai_next
) {
123 if (getnameinfo(ai
->ai_addr
, ai
->ai_addrlen
, ntop2
,
124 sizeof(ntop2
), NULL
, 0, NI_NUMERICHOST
) == 0 &&
125 (strcmp(ntop
, ntop2
) == 0))
129 /* If we reached the end of the list, the address was not there. */
131 /* Address not found for the host name. */
132 logit("Address %.100s maps to %.600s, but this does not "
133 "map back to the address - POSSIBLE BREAK-IN ATTEMPT!",
135 return xstrdup(ntop
);
137 return xstrdup(name
);
141 * If IP options are supported, make sure there are none (log and
142 * disconnect them if any are found). Basically we are worried about
143 * source routing; it can be used to pretend you are somebody
144 * (ip-address) you are not. That itself may be "almost acceptable"
145 * under certain circumstances, but rhosts autentication is useless
146 * if source routing is accepted. Notice also that if we just dropped
147 * source routing here, the other side could use IP spoofing to do
148 * rest of the interaction and could still bypass security. So we
149 * exit here if we detect any IP options.
153 check_ip_options(int sock
, char *ipaddr
)
157 char text
[sizeof(options
) * 3 + 1];
158 socklen_t option_size
, i
;
162 if ((ip
= getprotobyname("ip")) != NULL
)
163 ipproto
= ip
->p_proto
;
165 ipproto
= IPPROTO_IP
;
166 option_size
= sizeof(options
);
167 if (getsockopt(sock
, ipproto
, IP_OPTIONS
, options
,
168 &option_size
) >= 0 && option_size
!= 0) {
170 for (i
= 0; i
< option_size
; i
++)
171 snprintf(text
+ i
*3, sizeof(text
) - i
*3,
172 " %2.2x", options
[i
]);
173 fatal("Connection from %.100s with IP options:%.800s",
176 #endif /* IP_OPTIONS */
180 ipv64_normalise_mapped(struct sockaddr_storage
*addr
, socklen_t
*len
)
182 struct sockaddr_in6
*a6
= (struct sockaddr_in6
*)addr
;
183 struct sockaddr_in
*a4
= (struct sockaddr_in
*)addr
;
184 struct in_addr inaddr
;
187 if (addr
->ss_family
!= AF_INET6
||
188 !IN6_IS_ADDR_V4MAPPED(&a6
->sin6_addr
))
191 debug3("Normalising mapped IPv4 in IPv6 address");
193 memcpy(&inaddr
, ((char *)&a6
->sin6_addr
) + 12, sizeof(inaddr
));
194 port
= a6
->sin6_port
;
196 memset(a4
, 0, sizeof(*a4
));
198 a4
->sin_family
= AF_INET
;
200 memcpy(&a4
->sin_addr
, &inaddr
, sizeof(inaddr
));
205 * Return the canonical name of the host in the other side of the current
206 * connection. The host name is cached, so it is efficient to call this
211 get_canonical_hostname(int use_dns
)
214 static char *canonical_host_name
= NULL
;
215 static char *remote_ip
= NULL
;
217 /* Check if we have previously retrieved name with same option. */
218 if (use_dns
&& canonical_host_name
!= NULL
)
219 return canonical_host_name
;
220 if (!use_dns
&& remote_ip
!= NULL
)
223 /* Get the real hostname if socket; otherwise return UNKNOWN. */
224 if (packet_connection_is_on_socket())
225 host
= get_remote_hostname(packet_get_connection_in(), use_dns
);
230 canonical_host_name
= host
;
237 * Returns the local/remote IP-address/hostname of socket as a string.
238 * The returned string must be freed.
241 get_socket_address(int sock
, int remote
, int flags
)
243 struct sockaddr_storage addr
;
245 char ntop
[NI_MAXHOST
];
248 /* Get IP address of client. */
249 addrlen
= sizeof(addr
);
250 memset(&addr
, 0, sizeof(addr
));
253 if (getpeername(sock
, (struct sockaddr
*)&addr
, &addrlen
)
257 if (getsockname(sock
, (struct sockaddr
*)&addr
, &addrlen
)
262 /* Work around Linux IPv6 weirdness */
263 if (addr
.ss_family
== AF_INET6
)
264 addrlen
= sizeof(struct sockaddr_in6
);
266 if (addr
.ss_family
== AF_UNIX
) {
267 /* Get the Unix domain socket path. */
268 return xstrdup(((struct sockaddr_un
*)&addr
)->sun_path
);
271 ipv64_normalise_mapped(&addr
, &addrlen
);
273 /* Get the address in ascii. */
274 if ((r
= getnameinfo((struct sockaddr
*)&addr
, addrlen
, ntop
,
275 sizeof(ntop
), NULL
, 0, flags
)) != 0) {
276 error("get_socket_address: getnameinfo %d failed: %s", flags
,
277 ssh_gai_strerror(r
));
280 return xstrdup(ntop
);
284 get_peer_ipaddr(int sock
)
288 if ((p
= get_socket_address(sock
, 1, NI_NUMERICHOST
)) != NULL
)
290 return xstrdup("UNKNOWN");
294 get_local_ipaddr(int sock
)
298 if ((p
= get_socket_address(sock
, 0, NI_NUMERICHOST
)) != NULL
)
300 return xstrdup("UNKNOWN");
304 get_local_name(int fd
)
306 char *host
, myname
[NI_MAXHOST
];
308 /* Assume we were passed a socket */
309 if ((host
= get_socket_address(fd
, 0, NI_NAMEREQD
)) != NULL
)
312 /* Handle the case where we were passed a pipe */
313 if (gethostname(myname
, sizeof(myname
)) == -1) {
314 verbose("get_local_name: gethostname: %s", strerror(errno
));
316 host
= xstrdup(myname
);
323 clear_cached_addr(void)
325 free(canonical_host_ip
);
326 canonical_host_ip
= NULL
;
331 * Returns the IP-address of the remote host as a string. The returned
332 * string must not be freed.
336 get_remote_ipaddr(void)
338 /* Check whether we have cached the ipaddr. */
339 if (canonical_host_ip
== NULL
) {
340 if (packet_connection_is_on_socket()) {
342 get_peer_ipaddr(packet_get_connection_in());
343 if (canonical_host_ip
== NULL
)
346 /* If not on socket, return UNKNOWN. */
347 canonical_host_ip
= xstrdup("UNKNOWN");
350 return canonical_host_ip
;
354 get_remote_name_or_ip(u_int utmp_len
, int use_dns
)
356 static const char *remote
= "";
358 remote
= get_canonical_hostname(use_dns
);
359 if (utmp_len
== 0 || strlen(remote
) > utmp_len
)
360 remote
= get_remote_ipaddr();
364 /* Returns the local/remote port for the socket. */
367 get_sock_port(int sock
, int local
)
369 struct sockaddr_storage from
;
371 char strport
[NI_MAXSERV
];
374 /* Get IP address of client. */
375 fromlen
= sizeof(from
);
376 memset(&from
, 0, sizeof(from
));
378 if (getsockname(sock
, (struct sockaddr
*)&from
, &fromlen
) < 0) {
379 error("getsockname failed: %.100s", strerror(errno
));
383 if (getpeername(sock
, (struct sockaddr
*)&from
, &fromlen
) < 0) {
384 debug("getpeername failed: %.100s", strerror(errno
));
389 /* Work around Linux IPv6 weirdness */
390 if (from
.ss_family
== AF_INET6
)
391 fromlen
= sizeof(struct sockaddr_in6
);
393 /* Unix domain sockets don't have a port number. */
394 if (from
.ss_family
== AF_UNIX
)
397 /* Return port number. */
398 if ((r
= getnameinfo((struct sockaddr
*)&from
, fromlen
, NULL
, 0,
399 strport
, sizeof(strport
), NI_NUMERICSERV
)) != 0)
400 fatal("get_sock_port: getnameinfo NI_NUMERICSERV failed: %s",
401 ssh_gai_strerror(r
));
402 return atoi(strport
);
405 /* Returns remote/local port number for the current connection. */
411 * If the connection is not a socket, return 65535. This is
412 * intentionally chosen to be an unprivileged port number.
414 if (!packet_connection_is_on_socket())
417 /* Get socket and return the port number. */
418 return get_sock_port(packet_get_connection_in(), local
);
422 get_peer_port(int sock
)
424 return get_sock_port(sock
, 0);
428 get_remote_port(void)
430 /* Cache to avoid getpeername() on a dead connection */
431 if (cached_port
== -1)
432 cached_port
= get_port(0);