1 /* $OpenBSD: ssh-keyscan.c,v 1.115 2017/06/30 04:17:23 dtucker Exp $ */
3 * Copyright 1995, 1996 by David Mazieres <dm@lcs.mit.edu>.
5 * Modification and redistribution in source and binary forms is
6 * permitted provided that due credit is given to the author and the
7 * OpenBSD project by leaving this copyright notice intact.
12 #include <sys/types.h>
13 #include "openbsd-compat/sys-queue.h"
14 #include <sys/resource.h>
15 #ifdef HAVE_SYS_TIME_H
16 # include <sys/time.h>
19 #include <netinet/in.h>
20 #include <arpa/inet.h>
22 #include <openssl/bn.h>
40 #include "myproposal.h"
50 /* Flag indicating whether IPv4 or IPv6. This can be set on the command line.
51 Default value is AF_UNSPEC means both IPv4 and IPv6. */
52 int IPv4or6
= AF_UNSPEC
;
54 int ssh_port
= SSH_DEFAULT_PORT
;
58 #define KT_ECDSA (1<<2)
59 #define KT_ED25519 (1<<3)
62 #define KT_MAX KT_ED25519
65 int get_keytypes
= KT_RSA
|KT_ECDSA
|KT_ED25519
;
67 int hash_hosts
= 0; /* Hash hostname on output */
71 /* The number of seconds after which to give up on a TCP connection */
75 #define MAXCON (maxfd - 10)
77 extern char *__progname
;
79 size_t read_wait_nfdset
;
82 struct ssh
*active_state
= NULL
; /* XXX needed for linking */
85 * Keep a connection structure for each file descriptor. The state
86 * associated with file descriptor n is held in fdcon[n].
88 typedef struct Connection
{
89 u_char c_status
; /* State of connection on this file desc. */
90 #define CS_UNUSED 0 /* File descriptor unused */
91 #define CS_CON 1 /* Waiting to connect/read greeting */
92 #define CS_SIZE 2 /* Waiting to read initial packet size */
93 #define CS_KEYS 3 /* Waiting to read public key packet */
94 int c_fd
; /* Quick lookup: c->c_fd == c - fdcon */
95 int c_plen
; /* Packet length field for ssh packet */
96 int c_len
; /* Total bytes which must be read. */
97 int c_off
; /* Length of data read so far. */
98 int c_keytype
; /* Only one of KT_* */
99 sig_atomic_t c_done
; /* SSH2 done */
100 char *c_namebase
; /* Address to free for c_name and c_namelist */
101 char *c_name
; /* Hostname of connection for errors */
102 char *c_namelist
; /* Pointer to other possible addresses */
103 char *c_output_name
; /* Hostname of connection for output */
104 char *c_data
; /* Data read from this fd */
105 struct ssh
*c_ssh
; /* SSH-connection */
106 struct timeval c_tv
; /* Time at which connection gets aborted */
107 TAILQ_ENTRY(Connection
) c_link
; /* List of connections in timeout order. */
110 TAILQ_HEAD(conlist
, Connection
) tq
; /* Timeout Queue */
113 static void keyprint(con
*c
, struct sshkey
*key
);
118 #if defined(HAVE_GETRLIMIT) && defined(RLIMIT_NOFILE)
121 if (getrlimit(RLIMIT_NOFILE
, &rlfd
) < 0)
123 if ((hard
? rlfd
.rlim_max
: rlfd
.rlim_cur
) == RLIM_INFINITY
)
126 return hard
? rlfd
.rlim_max
: rlfd
.rlim_cur
;
135 #if defined(HAVE_SETRLIMIT) && defined(RLIMIT_NOFILE)
141 #if defined(HAVE_SETRLIMIT) && defined(RLIMIT_NOFILE)
142 if (getrlimit(RLIMIT_NOFILE
, &rlfd
) < 0)
145 if (setrlimit(RLIMIT_NOFILE
, &rlfd
) < 0)
147 #elif defined (HAVE_SETDTABLESIZE)
154 * This is an strsep function that returns a null field for adjacent
155 * separators. This is the same as the 4.4BSD strsep, but different from the
156 * one in the GNU libc.
159 xstrsep(char **str
, const char *delim
)
167 e
= s
+ strcspn(s
, delim
);
177 * Get the next non-null token (like GNU strsep). Strsep() will return a
178 * null token for two adjacent separators, so we may have to loop.
181 strnnsep(char **stringp
, char *delim
)
186 tok
= xstrsep(stringp
, delim
);
187 } while (tok
&& *tok
== '\0');
193 key_print_wrapper(struct sshkey
*hostkey
, struct ssh
*ssh
)
197 if ((c
= ssh_get_app_data(ssh
)) != NULL
)
198 keyprint(c
, hostkey
);
199 /* always abort key exchange */
204 ssh2_capable(int remote_major
, int remote_minor
)
206 switch (remote_major
) {
208 if (remote_minor
== 99)
222 char *myproposal
[PROPOSAL_MAX
] = { KEX_CLIENT
};
225 switch (c
->c_keytype
) {
227 myproposal
[PROPOSAL_SERVER_HOST_KEY_ALGS
] = get_cert
?
228 "ssh-dss-cert-v01@openssh.com" : "ssh-dss";
231 myproposal
[PROPOSAL_SERVER_HOST_KEY_ALGS
] = get_cert
?
232 "ssh-rsa-cert-v01@openssh.com" : "ssh-rsa";
235 myproposal
[PROPOSAL_SERVER_HOST_KEY_ALGS
] = get_cert
?
236 "ssh-ed25519-cert-v01@openssh.com" : "ssh-ed25519";
239 myproposal
[PROPOSAL_SERVER_HOST_KEY_ALGS
] = get_cert
?
240 "ecdsa-sha2-nistp256-cert-v01@openssh.com,"
241 "ecdsa-sha2-nistp384-cert-v01@openssh.com,"
242 "ecdsa-sha2-nistp521-cert-v01@openssh.com" :
243 "ecdsa-sha2-nistp256,"
244 "ecdsa-sha2-nistp384,"
245 "ecdsa-sha2-nistp521";
248 fatal("unknown key type %d", c
->c_keytype
);
251 if ((r
= kex_setup(c
->c_ssh
, myproposal
)) != 0) {
253 fprintf(stderr
, "kex_setup: %s\n", ssh_err(r
));
257 c
->c_ssh
->kex
->kex
[KEX_DH_GRP1_SHA1
] = kexdh_client
;
258 c
->c_ssh
->kex
->kex
[KEX_DH_GRP14_SHA1
] = kexdh_client
;
259 c
->c_ssh
->kex
->kex
[KEX_DH_GRP14_SHA256
] = kexdh_client
;
260 c
->c_ssh
->kex
->kex
[KEX_DH_GRP16_SHA512
] = kexdh_client
;
261 c
->c_ssh
->kex
->kex
[KEX_DH_GRP18_SHA512
] = kexdh_client
;
262 c
->c_ssh
->kex
->kex
[KEX_DH_GEX_SHA1
] = kexgex_client
;
263 c
->c_ssh
->kex
->kex
[KEX_DH_GEX_SHA256
] = kexgex_client
;
264 # ifdef OPENSSL_HAS_ECC
265 c
->c_ssh
->kex
->kex
[KEX_ECDH_SHA2
] = kexecdh_client
;
268 c
->c_ssh
->kex
->kex
[KEX_C25519_SHA256
] = kexc25519_client
;
269 ssh_set_verify_host_key_callback(c
->c_ssh
, key_print_wrapper
);
271 * do the key-exchange until an error occurs or until
272 * the key_print_wrapper() callback sets c_done.
274 ssh_dispatch_run(c
->c_ssh
, DISPATCH_BLOCK
, &c
->c_done
);
278 keyprint_one(const char *host
, struct sshkey
*key
)
281 const char *known_host
, *hashed
;
283 hostport
= put_host_port(host
, ssh_port
);
285 if (hash_hosts
&& (hashed
= host_hash(host
, NULL
, 0)) == NULL
)
286 fatal("host_hash failed");
287 known_host
= hash_hosts
? hashed
: hostport
;
289 fprintf(stdout
, "%s ", known_host
);
290 sshkey_write(key
, stdout
);
296 keyprint(con
*c
, struct sshkey
*key
)
298 char *hosts
= c
->c_output_name
? c
->c_output_name
: c
->c_name
;
303 if (get_cert
|| (!hash_hosts
&& ssh_port
== SSH_DEFAULT_PORT
)) {
304 keyprint_one(hosts
, key
);
307 ohosts
= hosts
= xstrdup(hosts
);
308 while ((host
= strsep(&hosts
, ",")) != NULL
)
309 keyprint_one(host
, key
);
314 tcpconnect(char *host
)
316 struct addrinfo hints
, *ai
, *aitop
;
317 char strport
[NI_MAXSERV
];
320 snprintf(strport
, sizeof strport
, "%d", ssh_port
);
321 memset(&hints
, 0, sizeof(hints
));
322 hints
.ai_family
= IPv4or6
;
323 hints
.ai_socktype
= SOCK_STREAM
;
324 if ((gaierr
= getaddrinfo(host
, strport
, &hints
, &aitop
)) != 0) {
325 error("getaddrinfo %s: %s", host
, ssh_gai_strerror(gaierr
));
328 for (ai
= aitop
; ai
; ai
= ai
->ai_next
) {
329 s
= socket(ai
->ai_family
, ai
->ai_socktype
, ai
->ai_protocol
);
331 error("socket: %s", strerror(errno
));
334 if (set_nonblock(s
) == -1)
335 fatal("%s: set_nonblock(%d)", __func__
, s
);
336 if (connect(s
, ai
->ai_addr
, ai
->ai_addrlen
) < 0 &&
337 errno
!= EINPROGRESS
)
338 error("connect (`%s'): %s", host
, strerror(errno
));
349 conalloc(char *iname
, char *oname
, int keytype
)
351 char *namebase
, *name
, *namelist
;
354 namebase
= namelist
= xstrdup(iname
);
357 name
= xstrsep(&namelist
, ",");
362 } while ((s
= tcpconnect(name
)) < 0);
365 fatal("conalloc: fdno %d too high", s
);
366 if (fdcon
[s
].c_status
)
367 fatal("conalloc: attempt to reuse fdno %d", s
);
369 debug3("%s: oname %s kt %d", __func__
, oname
, keytype
);
371 fdcon
[s
].c_status
= CS_CON
;
372 fdcon
[s
].c_namebase
= namebase
;
373 fdcon
[s
].c_name
= name
;
374 fdcon
[s
].c_namelist
= namelist
;
375 fdcon
[s
].c_output_name
= xstrdup(oname
);
376 fdcon
[s
].c_data
= (char *) &fdcon
[s
].c_plen
;
379 fdcon
[s
].c_keytype
= keytype
;
380 gettimeofday(&fdcon
[s
].c_tv
, NULL
);
381 fdcon
[s
].c_tv
.tv_sec
+= timeout
;
382 TAILQ_INSERT_TAIL(&tq
, &fdcon
[s
], c_link
);
383 FD_SET(s
, read_wait
);
391 if (s
>= maxfd
|| fdcon
[s
].c_status
== CS_UNUSED
)
392 fatal("confree: attempt to free bad fdno %d", s
);
393 free(fdcon
[s
].c_namebase
);
394 free(fdcon
[s
].c_output_name
);
395 if (fdcon
[s
].c_status
== CS_KEYS
)
396 free(fdcon
[s
].c_data
);
397 fdcon
[s
].c_status
= CS_UNUSED
;
398 fdcon
[s
].c_keytype
= 0;
399 if (fdcon
[s
].c_ssh
) {
400 ssh_packet_close(fdcon
[s
].c_ssh
);
401 free(fdcon
[s
].c_ssh
);
402 fdcon
[s
].c_ssh
= NULL
;
405 TAILQ_REMOVE(&tq
, &fdcon
[s
], c_link
);
406 FD_CLR(s
, read_wait
);
413 TAILQ_REMOVE(&tq
, &fdcon
[s
], c_link
);
414 gettimeofday(&fdcon
[s
].c_tv
, NULL
);
415 fdcon
[s
].c_tv
.tv_sec
+= timeout
;
416 TAILQ_INSERT_TAIL(&tq
, &fdcon
[s
], c_link
);
425 ret
= conalloc(c
->c_namelist
, c
->c_output_name
, c
->c_keytype
);
433 int n
= 0, remote_major
= 0, remote_minor
= 0;
435 char remote_version
[sizeof buf
];
439 /* send client banner */
440 n
= snprintf(buf
, sizeof buf
, "SSH-%d.%d-OpenSSH-keyscan\r\n",
441 PROTOCOL_MAJOR_2
, PROTOCOL_MINOR_2
);
442 if (n
< 0 || (size_t)n
>= sizeof(buf
)) {
443 error("snprintf: buffer too small");
447 if (atomicio(vwrite
, s
, buf
, n
) != (size_t)n
) {
448 error("write (%s): %s", c
->c_name
, strerror(errno
));
454 memset(buf
, '\0', sizeof(buf
));
455 bufsiz
= sizeof(buf
);
458 (n
= atomicio(read
, s
, cp
, 1)) == 1 && *cp
!= '\n') {
463 if (n
!= 1 || strncmp(buf
, "SSH-", 4) == 0)
469 error("%s: Connection closed by remote host", c
->c_name
);
474 error("read (%s): %s", c
->c_name
, strerror(errno
));
480 if (*cp
!= '\n' && *cp
!= '\r') {
481 error("%s: bad greeting", c
->c_name
);
486 if ((c
->c_ssh
= ssh_packet_set_connection(NULL
, s
, s
)) == NULL
)
487 fatal("ssh_packet_set_connection failed");
488 ssh_packet_set_timeout(c
->c_ssh
, timeout
, 1);
489 ssh_set_app_data(c
->c_ssh
, c
); /* back link */
490 if (sscanf(buf
, "SSH-%d.%d-%[^\n]\n",
491 &remote_major
, &remote_minor
, remote_version
) == 3)
492 c
->c_ssh
->compat
= compat_datafellows(remote_version
);
494 c
->c_ssh
->compat
= 0;
495 if (!ssh2_capable(remote_major
, remote_minor
)) {
496 debug("%s doesn't support ssh2", c
->c_name
);
500 fprintf(stderr
, "# %s:%d %s\n", c
->c_name
, ssh_port
, chop(buf
));
511 if (c
->c_status
== CS_CON
) {
515 n
= atomicio(read
, s
, c
->c_data
+ c
->c_off
, c
->c_len
- c
->c_off
);
517 error("read (%s): %s", c
->c_name
, strerror(errno
));
523 if (c
->c_off
== c
->c_len
)
524 switch (c
->c_status
) {
526 c
->c_plen
= htonl(c
->c_plen
);
527 c
->c_len
= c
->c_plen
+ 8 - (c
->c_plen
& 7);
529 c
->c_data
= xmalloc(c
->c_len
);
530 c
->c_status
= CS_KEYS
;
533 fatal("conread: invalid status %d", c
->c_status
);
543 struct timeval seltime
, now
;
548 gettimeofday(&now
, NULL
);
549 c
= TAILQ_FIRST(&tq
);
551 if (c
&& (c
->c_tv
.tv_sec
> now
.tv_sec
||
552 (c
->c_tv
.tv_sec
== now
.tv_sec
&& c
->c_tv
.tv_usec
> now
.tv_usec
))) {
554 seltime
.tv_sec
-= now
.tv_sec
;
555 seltime
.tv_usec
-= now
.tv_usec
;
556 if (seltime
.tv_usec
< 0) {
557 seltime
.tv_usec
+= 1000000;
561 timerclear(&seltime
);
563 r
= xcalloc(read_wait_nfdset
, sizeof(fd_mask
));
564 e
= xcalloc(read_wait_nfdset
, sizeof(fd_mask
));
565 memcpy(r
, read_wait
, read_wait_nfdset
* sizeof(fd_mask
));
566 memcpy(e
, read_wait
, read_wait_nfdset
* sizeof(fd_mask
));
568 while (select(maxfd
, r
, NULL
, e
, &seltime
) == -1 &&
569 (errno
== EAGAIN
|| errno
== EINTR
|| errno
== EWOULDBLOCK
))
572 for (i
= 0; i
< maxfd
; i
++) {
573 if (FD_ISSET(i
, e
)) {
574 error("%s: exception!", fdcon
[i
].c_name
);
576 } else if (FD_ISSET(i
, r
))
582 c
= TAILQ_FIRST(&tq
);
583 while (c
&& (c
->c_tv
.tv_sec
< now
.tv_sec
||
584 (c
->c_tv
.tv_sec
== now
.tv_sec
&& c
->c_tv
.tv_usec
< now
.tv_usec
))) {
587 c
= TAILQ_NEXT(c
, c_link
);
595 char *name
= strnnsep(&host
, " \t\n");
600 for (j
= KT_MIN
; j
<= KT_MAX
; j
*= 2) {
601 if (get_keytypes
& j
) {
602 while (ncon
>= MAXCON
)
604 conalloc(name
, *host
? host
: name
, j
);
610 fatal(const char *fmt
,...)
615 do_log(SYSLOG_LEVEL_FATAL
, fmt
, args
);
624 "usage: %s [-46cHv] [-f file] [-p port] [-T timeout] [-t type]\n"
625 "\t\t [host | addrlist namelist] ...\n",
631 main(int argc
, char **argv
)
633 int debug_flag
= 0, log_level
= SYSLOG_LEVEL_INFO
;
634 int opt
, fopt_count
= 0, j
;
635 char *tname
, *cp
, line
[NI_MAXHOST
];
642 ssh_malloc_init(); /* must be called before any mallocs */
643 __progname
= ssh_get_progname(argv
[0]);
647 /* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */
653 while ((opt
= getopt(argc
, argv
, "cHv46p:T:t:f:")) != -1) {
662 ssh_port
= a2port(optarg
);
664 fprintf(stderr
, "Bad port '%s'\n", optarg
);
669 timeout
= convtime(optarg
);
670 if (timeout
== -1 || timeout
== 0) {
671 fprintf(stderr
, "Bad timeout '%s'\n", optarg
);
678 log_level
= SYSLOG_LEVEL_DEBUG1
;
680 else if (log_level
< SYSLOG_LEVEL_DEBUG3
)
683 fatal("Too high debugging level.");
686 if (strcmp(optarg
, "-") == 0)
688 argv
[fopt_count
++] = optarg
;
692 tname
= strtok(optarg
, ",");
694 int type
= sshkey_type_from_name(tname
);
698 get_keytypes
|= KT_DSA
;
701 get_keytypes
|= KT_ECDSA
;
704 get_keytypes
|= KT_RSA
;
707 get_keytypes
|= KT_ED25519
;
711 fatal("Unknown key type \"%s\"", tname
);
713 tname
= strtok(NULL
, ",");
727 if (optind
== argc
&& !fopt_count
)
730 log_init("ssh-keyscan", log_level
, SYSLOG_FACILITY_USER
, 1);
732 maxfd
= fdlim_get(1);
734 fatal("%s: fdlim_get: bad value", __progname
);
735 if (maxfd
> MAXMAXFD
)
738 fatal("%s: not enough file descriptors", __progname
);
739 if (maxfd
> fdlim_get(0))
741 fdcon
= xcalloc(maxfd
, sizeof(con
));
743 read_wait_nfdset
= howmany(maxfd
, NFDBITS
);
744 read_wait
= xcalloc(read_wait_nfdset
, sizeof(fd_mask
));
746 for (j
= 0; j
< fopt_count
; j
++) {
749 else if ((fp
= fopen(argv
[j
], "r")) == NULL
)
750 fatal("%s: %s: %s", __progname
, argv
[j
],
754 while (read_keyfile_line(fp
,
755 argv
[j
] == NULL
? "(stdin)" : argv
[j
], line
, sizeof(line
),
757 /* Chomp off trailing whitespace and comments */
758 if ((cp
= strchr(line
, '#')) == NULL
)
759 cp
= line
+ strlen(line
) - 1;
761 if (*cp
== ' ' || *cp
== '\t' ||
762 *cp
== '\n' || *cp
== '#')
768 /* Skip empty lines */
776 fatal("%s: %s: %s", __progname
, argv
[j
],
782 while (optind
< argc
)
783 do_host(argv
[optind
++]);