1 /* $OpenBSD: ssh-keyscan.c,v 1.92 2014/04/29 18:01:49 markus Exp $ */
3 * Copyright 1995, 1996 by David Mazieres <dm@lcs.mit.edu>.
5 * Modification and redistribution in source and binary forms is
6 * permitted provided that due credit is given to the author and the
7 * OpenBSD project by leaving this copyright notice intact.
12 #include "openbsd-compat/sys-queue.h"
13 #include <sys/resource.h>
14 #ifdef HAVE_SYS_TIME_H
15 # include <sys/time.h>
18 #include <netinet/in.h>
19 #include <arpa/inet.h>
21 #include <openssl/bn.h>
41 #include "myproposal.h"
49 /* Flag indicating whether IPv4 or IPv6. This can be set on the command line.
50 Default value is AF_UNSPEC means both IPv4 and IPv6. */
51 int IPv4or6
= AF_UNSPEC
;
53 int ssh_port
= SSH_DEFAULT_PORT
;
61 int get_keytypes
= KT_RSA
|KT_ECDSA
|KT_ED25519
;
63 int hash_hosts
= 0; /* Hash hostname on output */
67 /* The number of seconds after which to give up on a TCP connection */
71 #define MAXCON (maxfd - 10)
73 extern char *__progname
;
75 size_t read_wait_nfdset
;
77 int nonfatal_fatal
= 0;
82 * Keep a connection structure for each file descriptor. The state
83 * associated with file descriptor n is held in fdcon[n].
85 typedef struct Connection
{
86 u_char c_status
; /* State of connection on this file desc. */
87 #define CS_UNUSED 0 /* File descriptor unused */
88 #define CS_CON 1 /* Waiting to connect/read greeting */
89 #define CS_SIZE 2 /* Waiting to read initial packet size */
90 #define CS_KEYS 3 /* Waiting to read public key packet */
91 int c_fd
; /* Quick lookup: c->c_fd == c - fdcon */
92 int c_plen
; /* Packet length field for ssh packet */
93 int c_len
; /* Total bytes which must be read. */
94 int c_off
; /* Length of data read so far. */
95 int c_keytype
; /* Only one of KT_RSA1, KT_DSA, or KT_RSA */
96 char *c_namebase
; /* Address to free for c_name and c_namelist */
97 char *c_name
; /* Hostname of connection for errors */
98 char *c_namelist
; /* Pointer to other possible addresses */
99 char *c_output_name
; /* Hostname of connection for output */
100 char *c_data
; /* Data read from this fd */
101 Kex
*c_kex
; /* The key-exchange struct for ssh2 */
102 struct timeval c_tv
; /* Time at which connection gets aborted */
103 TAILQ_ENTRY(Connection
) c_link
; /* List of connections in timeout order. */
106 TAILQ_HEAD(conlist
, Connection
) tq
; /* Timeout Queue */
112 #if defined(HAVE_GETRLIMIT) && defined(RLIMIT_NOFILE)
115 if (getrlimit(RLIMIT_NOFILE
, &rlfd
) < 0)
117 if ((hard
? rlfd
.rlim_max
: rlfd
.rlim_cur
) == RLIM_INFINITY
)
120 return hard
? rlfd
.rlim_max
: rlfd
.rlim_cur
;
129 #if defined(HAVE_SETRLIMIT) && defined(RLIMIT_NOFILE)
135 #if defined(HAVE_SETRLIMIT) && defined(RLIMIT_NOFILE)
136 if (getrlimit(RLIMIT_NOFILE
, &rlfd
) < 0)
139 if (setrlimit(RLIMIT_NOFILE
, &rlfd
) < 0)
141 #elif defined (HAVE_SETDTABLESIZE)
148 * This is an strsep function that returns a null field for adjacent
149 * separators. This is the same as the 4.4BSD strsep, but different from the
150 * one in the GNU libc.
153 xstrsep(char **str
, const char *delim
)
161 e
= s
+ strcspn(s
, delim
);
171 * Get the next non-null token (like GNU strsep). Strsep() will return a
172 * null token for two adjacent separators, so we may have to loop.
175 strnnsep(char **stringp
, char *delim
)
180 tok
= xstrsep(stringp
, delim
);
181 } while (tok
&& *tok
== '\0');
194 rsa
= key_new(KEY_RSA1
);
196 buffer_append(&msg
, c
->c_data
, c
->c_plen
);
197 buffer_consume(&msg
, 8 - (c
->c_plen
& 7)); /* padding */
198 if (buffer_get_char(&msg
) != (int) SSH_SMSG_PUBLIC_KEY
) {
199 error("%s: invalid packet type", c
->c_name
);
203 buffer_consume(&msg
, 8); /* cookie */
206 (void) buffer_get_int(&msg
);
207 buffer_get_bignum(&msg
, rsa
->rsa
->e
);
208 buffer_get_bignum(&msg
, rsa
->rsa
->n
);
211 (void) buffer_get_int(&msg
);
212 buffer_get_bignum(&msg
, rsa
->rsa
->e
);
213 buffer_get_bignum(&msg
, rsa
->rsa
->n
);
222 hostjump(Key
*hostkey
)
224 kexjmp_key
= hostkey
;
229 ssh2_capable(int remote_major
, int remote_minor
)
231 switch (remote_major
) {
233 if (remote_minor
== 99)
247 char *myproposal
[PROPOSAL_MAX
] = { KEX_CLIENT
};
250 packet_set_connection(c
->c_fd
, c
->c_fd
);
252 myproposal
[PROPOSAL_SERVER_HOST_KEY_ALGS
] =
253 c
->c_keytype
== KT_DSA
? "ssh-dss" :
254 (c
->c_keytype
== KT_RSA
? "ssh-rsa" :
255 (c
->c_keytype
== KT_ED25519
? "ssh-ed25519" :
256 "ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521"));
257 c
->c_kex
= kex_setup(myproposal
);
259 c
->c_kex
->kex
[KEX_DH_GRP1_SHA1
] = kexdh_client
;
260 c
->c_kex
->kex
[KEX_DH_GRP14_SHA1
] = kexdh_client
;
261 c
->c_kex
->kex
[KEX_DH_GEX_SHA1
] = kexgex_client
;
262 c
->c_kex
->kex
[KEX_DH_GEX_SHA256
] = kexgex_client
;
263 c
->c_kex
->kex
[KEX_ECDH_SHA2
] = kexecdh_client
;
265 c
->c_kex
->kex
[KEX_C25519_SHA256
] = kexc25519_client
;
266 c
->c_kex
->verify_host_key
= hostjump
;
268 if (!(j
= setjmp(kexjmp
))) {
270 dispatch_run(DISPATCH_BLOCK
, &c
->c_kex
->done
, c
->c_kex
);
271 fprintf(stderr
, "Impossible! dispatch_run() returned!\n");
279 return j
< 0? NULL
: kexjmp_key
;
283 keyprint(con
*c
, Key
*key
)
285 char *host
= c
->c_output_name
? c
->c_output_name
: c
->c_name
;
289 if (hash_hosts
&& (host
= host_hash(host
, NULL
, 0)) == NULL
)
290 fatal("host_hash failed");
292 fprintf(stdout
, "%s ", host
);
293 key_write(key
, stdout
);
298 tcpconnect(char *host
)
300 struct addrinfo hints
, *ai
, *aitop
;
301 char strport
[NI_MAXSERV
];
304 snprintf(strport
, sizeof strport
, "%d", ssh_port
);
305 memset(&hints
, 0, sizeof(hints
));
306 hints
.ai_family
= IPv4or6
;
307 hints
.ai_socktype
= SOCK_STREAM
;
308 if ((gaierr
= getaddrinfo(host
, strport
, &hints
, &aitop
)) != 0)
309 fatal("getaddrinfo %s: %s", host
, ssh_gai_strerror(gaierr
));
310 for (ai
= aitop
; ai
; ai
= ai
->ai_next
) {
311 s
= socket(ai
->ai_family
, ai
->ai_socktype
, ai
->ai_protocol
);
313 error("socket: %s", strerror(errno
));
316 if (set_nonblock(s
) == -1)
317 fatal("%s: set_nonblock(%d)", __func__
, s
);
318 if (connect(s
, ai
->ai_addr
, ai
->ai_addrlen
) < 0 &&
319 errno
!= EINPROGRESS
)
320 error("connect (`%s'): %s", host
, strerror(errno
));
331 conalloc(char *iname
, char *oname
, int keytype
)
333 char *namebase
, *name
, *namelist
;
336 namebase
= namelist
= xstrdup(iname
);
339 name
= xstrsep(&namelist
, ",");
344 } while ((s
= tcpconnect(name
)) < 0);
347 fatal("conalloc: fdno %d too high", s
);
348 if (fdcon
[s
].c_status
)
349 fatal("conalloc: attempt to reuse fdno %d", s
);
352 fdcon
[s
].c_status
= CS_CON
;
353 fdcon
[s
].c_namebase
= namebase
;
354 fdcon
[s
].c_name
= name
;
355 fdcon
[s
].c_namelist
= namelist
;
356 fdcon
[s
].c_output_name
= xstrdup(oname
);
357 fdcon
[s
].c_data
= (char *) &fdcon
[s
].c_plen
;
360 fdcon
[s
].c_keytype
= keytype
;
361 gettimeofday(&fdcon
[s
].c_tv
, NULL
);
362 fdcon
[s
].c_tv
.tv_sec
+= timeout
;
363 TAILQ_INSERT_TAIL(&tq
, &fdcon
[s
], c_link
);
364 FD_SET(s
, read_wait
);
372 if (s
>= maxfd
|| fdcon
[s
].c_status
== CS_UNUSED
)
373 fatal("confree: attempt to free bad fdno %d", s
);
375 free(fdcon
[s
].c_namebase
);
376 free(fdcon
[s
].c_output_name
);
377 if (fdcon
[s
].c_status
== CS_KEYS
)
378 free(fdcon
[s
].c_data
);
379 fdcon
[s
].c_status
= CS_UNUSED
;
380 fdcon
[s
].c_keytype
= 0;
381 TAILQ_REMOVE(&tq
, &fdcon
[s
], c_link
);
382 FD_CLR(s
, read_wait
);
389 TAILQ_REMOVE(&tq
, &fdcon
[s
], c_link
);
390 gettimeofday(&fdcon
[s
].c_tv
, NULL
);
391 fdcon
[s
].c_tv
.tv_sec
+= timeout
;
392 TAILQ_INSERT_TAIL(&tq
, &fdcon
[s
], c_link
);
401 ret
= conalloc(c
->c_namelist
, c
->c_output_name
, c
->c_keytype
);
409 int n
= 0, remote_major
= 0, remote_minor
= 0;
411 char remote_version
[sizeof buf
];
416 memset(buf
, '\0', sizeof(buf
));
417 bufsiz
= sizeof(buf
);
420 (n
= atomicio(read
, s
, cp
, 1)) == 1 && *cp
!= '\n') {
425 if (n
!= 1 || strncmp(buf
, "SSH-", 4) == 0)
431 error("%s: Connection closed by remote host", c
->c_name
);
436 error("read (%s): %s", c
->c_name
, strerror(errno
));
442 if (*cp
!= '\n' && *cp
!= '\r') {
443 error("%s: bad greeting", c
->c_name
);
448 if (sscanf(buf
, "SSH-%d.%d-%[^\n]\n",
449 &remote_major
, &remote_minor
, remote_version
) == 3)
450 compat_datafellows(remote_version
);
453 if (c
->c_keytype
!= KT_RSA1
) {
454 if (!ssh2_capable(remote_major
, remote_minor
)) {
455 debug("%s doesn't support ssh2", c
->c_name
);
459 } else if (remote_major
!= 1) {
460 debug("%s doesn't support ssh1", c
->c_name
);
464 fprintf(stderr
, "# %s %s\n", c
->c_name
, chop(buf
));
465 n
= snprintf(buf
, sizeof buf
, "SSH-%d.%d-OpenSSH-keyscan\r\n",
466 c
->c_keytype
== KT_RSA1
? PROTOCOL_MAJOR_1
: PROTOCOL_MAJOR_2
,
467 c
->c_keytype
== KT_RSA1
? PROTOCOL_MINOR_1
: PROTOCOL_MINOR_2
);
468 if (n
< 0 || (size_t)n
>= sizeof(buf
)) {
469 error("snprintf: buffer too small");
473 if (atomicio(vwrite
, s
, buf
, n
) != (size_t)n
) {
474 error("write (%s): %s", c
->c_name
, strerror(errno
));
478 if (c
->c_keytype
!= KT_RSA1
) {
479 keyprint(c
, keygrab_ssh2(c
));
483 c
->c_status
= CS_SIZE
;
493 if (c
->c_status
== CS_CON
) {
497 n
= atomicio(read
, s
, c
->c_data
+ c
->c_off
, c
->c_len
- c
->c_off
);
499 error("read (%s): %s", c
->c_name
, strerror(errno
));
505 if (c
->c_off
== c
->c_len
)
506 switch (c
->c_status
) {
508 c
->c_plen
= htonl(c
->c_plen
);
509 c
->c_len
= c
->c_plen
+ 8 - (c
->c_plen
& 7);
511 c
->c_data
= xmalloc(c
->c_len
);
512 c
->c_status
= CS_KEYS
;
516 keyprint(c
, keygrab_ssh1(c
));
521 fatal("conread: invalid status %d", c
->c_status
);
531 struct timeval seltime
, now
;
536 gettimeofday(&now
, NULL
);
537 c
= TAILQ_FIRST(&tq
);
539 if (c
&& (c
->c_tv
.tv_sec
> now
.tv_sec
||
540 (c
->c_tv
.tv_sec
== now
.tv_sec
&& c
->c_tv
.tv_usec
> now
.tv_usec
))) {
542 seltime
.tv_sec
-= now
.tv_sec
;
543 seltime
.tv_usec
-= now
.tv_usec
;
544 if (seltime
.tv_usec
< 0) {
545 seltime
.tv_usec
+= 1000000;
549 timerclear(&seltime
);
551 r
= xcalloc(read_wait_nfdset
, sizeof(fd_mask
));
552 e
= xcalloc(read_wait_nfdset
, sizeof(fd_mask
));
553 memcpy(r
, read_wait
, read_wait_nfdset
* sizeof(fd_mask
));
554 memcpy(e
, read_wait
, read_wait_nfdset
* sizeof(fd_mask
));
556 while (select(maxfd
, r
, NULL
, e
, &seltime
) == -1 &&
557 (errno
== EAGAIN
|| errno
== EINTR
|| errno
== EWOULDBLOCK
))
560 for (i
= 0; i
< maxfd
; i
++) {
561 if (FD_ISSET(i
, e
)) {
562 error("%s: exception!", fdcon
[i
].c_name
);
564 } else if (FD_ISSET(i
, r
))
570 c
= TAILQ_FIRST(&tq
);
571 while (c
&& (c
->c_tv
.tv_sec
< now
.tv_sec
||
572 (c
->c_tv
.tv_sec
== now
.tv_sec
&& c
->c_tv
.tv_usec
< now
.tv_usec
))) {
575 c
= TAILQ_NEXT(c
, c_link
);
583 char *name
= strnnsep(&host
, " \t\n");
588 for (j
= KT_RSA1
; j
<= KT_ED25519
; j
*= 2) {
589 if (get_keytypes
& j
) {
590 while (ncon
>= MAXCON
)
592 conalloc(name
, *host
? host
: name
, j
);
598 fatal(const char *fmt
,...)
603 do_log(SYSLOG_LEVEL_FATAL
, fmt
, args
);
615 "usage: %s [-46Hv] [-f file] [-p port] [-T timeout] [-t type]\n"
616 "\t\t [host | addrlist namelist] ...\n",
622 main(int argc
, char **argv
)
624 int debug_flag
= 0, log_level
= SYSLOG_LEVEL_INFO
;
625 int opt
, fopt_count
= 0, j
;
626 char *tname
, *cp
, line
[NI_MAXHOST
];
633 __progname
= ssh_get_progname(argv
[0]);
637 /* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */
643 while ((opt
= getopt(argc
, argv
, "Hv46p:T:t:f:")) != -1) {
649 ssh_port
= a2port(optarg
);
651 fprintf(stderr
, "Bad port '%s'\n", optarg
);
656 timeout
= convtime(optarg
);
657 if (timeout
== -1 || timeout
== 0) {
658 fprintf(stderr
, "Bad timeout '%s'\n", optarg
);
665 log_level
= SYSLOG_LEVEL_DEBUG1
;
667 else if (log_level
< SYSLOG_LEVEL_DEBUG3
)
670 fatal("Too high debugging level.");
673 if (strcmp(optarg
, "-") == 0)
675 argv
[fopt_count
++] = optarg
;
679 tname
= strtok(optarg
, ",");
681 int type
= key_type_from_name(tname
);
684 get_keytypes
|= KT_RSA1
;
687 get_keytypes
|= KT_DSA
;
690 get_keytypes
|= KT_ECDSA
;
693 get_keytypes
|= KT_RSA
;
696 get_keytypes
|= KT_ED25519
;
699 fatal("unknown key type %s", tname
);
701 tname
= strtok(NULL
, ",");
715 if (optind
== argc
&& !fopt_count
)
718 log_init("ssh-keyscan", log_level
, SYSLOG_FACILITY_USER
, 1);
720 maxfd
= fdlim_get(1);
722 fatal("%s: fdlim_get: bad value", __progname
);
723 if (maxfd
> MAXMAXFD
)
726 fatal("%s: not enough file descriptors", __progname
);
727 if (maxfd
> fdlim_get(0))
729 fdcon
= xcalloc(maxfd
, sizeof(con
));
731 read_wait_nfdset
= howmany(maxfd
, NFDBITS
);
732 read_wait
= xcalloc(read_wait_nfdset
, sizeof(fd_mask
));
734 for (j
= 0; j
< fopt_count
; j
++) {
737 else if ((fp
= fopen(argv
[j
], "r")) == NULL
)
738 fatal("%s: %s: %s", __progname
, argv
[j
],
742 while (read_keyfile_line(fp
,
743 argv
[j
] == NULL
? "(stdin)" : argv
[j
], line
, sizeof(line
),
745 /* Chomp off trailing whitespace and comments */
746 if ((cp
= strchr(line
, '#')) == NULL
)
747 cp
= line
+ strlen(line
) - 1;
749 if (*cp
== ' ' || *cp
== '\t' ||
750 *cp
== '\n' || *cp
== '#')
756 /* Skip empty lines */
764 fatal("%s: %s: %s", __progname
, argv
[j
],
770 while (optind
< argc
)
771 do_host(argv
[optind
++]);