blob: ff1a2c41c29dd0ff02c62120502e169de1c50e06 [file] [log] [blame]
markus@openbsd.org1b11ea72018-02-23 15:58:37 +00001/* $OpenBSD: dns.c,v 1.38 2018/02/23 15:58:37 markus Exp $ */
Damien Miller37876e92003-05-15 10:19:46 +10002
3/*
4 * Copyright (c) 2003 Wesley Griffin. All rights reserved.
5 * Copyright (c) 2003 Jakob Schlyter. All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
17 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
18 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
19 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
21 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
22 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
23 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
24 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
25 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
26 */
27
Damien Miller37876e92003-05-15 10:19:46 +100028#include "includes.h"
29
Damien Millere3b60b52006-07-10 21:08:03 +100030#include <sys/types.h>
31#include <sys/socket.h>
32
Damien Millerb8fe89c2006-07-24 14:51:00 +100033#include <netdb.h>
Damien Millerded319c2006-09-01 15:38:36 +100034#include <stdarg.h>
Damien Millera7a73ee2006-08-05 11:37:59 +100035#include <stdio.h>
Damien Millere3476ed2006-07-24 14:13:33 +100036#include <string.h>
Damien Miller86687062014-07-02 15:28:02 +100037#include <stdarg.h>
38#include <stdlib.h>
Damien Miller37876e92003-05-15 10:19:46 +100039
40#include "xmalloc.h"
djm@openbsd.org1129dcf2015-01-15 09:40:00 +000041#include "sshkey.h"
42#include "ssherr.h"
Damien Miller37876e92003-05-15 10:19:46 +100043#include "dns.h"
44#include "log.h"
djm@openbsd.org56d1c832014-12-21 22:27:55 +000045#include "digest.h"
Damien Miller37876e92003-05-15 10:19:46 +100046
Damien Miller37876e92003-05-15 10:19:46 +100047static const char *errset_text[] = {
48 "success", /* 0 ERRSET_SUCCESS */
49 "out of memory", /* 1 ERRSET_NOMEMORY */
50 "general failure", /* 2 ERRSET_FAIL */
51 "invalid parameter", /* 3 ERRSET_INVAL */
52 "name does not exist", /* 4 ERRSET_NONAME */
53 "data does not exist", /* 5 ERRSET_NODATA */
54};
55
56static const char *
Darren Tucker3f9fdc72004-06-22 12:56:01 +100057dns_result_totext(unsigned int res)
Damien Miller37876e92003-05-15 10:19:46 +100058{
Darren Tucker3f9fdc72004-06-22 12:56:01 +100059 switch (res) {
Damien Miller37876e92003-05-15 10:19:46 +100060 case ERRSET_SUCCESS:
61 return errset_text[ERRSET_SUCCESS];
62 case ERRSET_NOMEMORY:
63 return errset_text[ERRSET_NOMEMORY];
64 case ERRSET_FAIL:
65 return errset_text[ERRSET_FAIL];
66 case ERRSET_INVAL:
67 return errset_text[ERRSET_INVAL];
68 case ERRSET_NONAME:
69 return errset_text[ERRSET_NONAME];
70 case ERRSET_NODATA:
71 return errset_text[ERRSET_NODATA];
72 default:
73 return "unknown error";
74 }
75}
Damien Miller37876e92003-05-15 10:19:46 +100076
77/*
78 * Read SSHFP parameters from key buffer.
79 */
80static int
81dns_read_key(u_int8_t *algorithm, u_int8_t *digest_type,
djm@openbsd.org1129dcf2015-01-15 09:40:00 +000082 u_char **digest, size_t *digest_len, struct sshkey *key)
Damien Miller37876e92003-05-15 10:19:46 +100083{
djm@openbsd.org1129dcf2015-01-15 09:40:00 +000084 int r, success = 0;
djm@openbsd.org56d1c832014-12-21 22:27:55 +000085 int fp_alg = -1;
Damien Miller37876e92003-05-15 10:19:46 +100086
87 switch (key->type) {
88 case KEY_RSA:
89 *algorithm = SSHFP_KEY_RSA;
Damien Miller3bde12a2012-06-20 21:51:11 +100090 if (!*digest_type)
91 *digest_type = SSHFP_HASH_SHA1;
Damien Miller37876e92003-05-15 10:19:46 +100092 break;
93 case KEY_DSA:
94 *algorithm = SSHFP_KEY_DSA;
Damien Miller3bde12a2012-06-20 21:51:11 +100095 if (!*digest_type)
96 *digest_type = SSHFP_HASH_SHA1;
Damien Miller37876e92003-05-15 10:19:46 +100097 break;
Damien Miller3bde12a2012-06-20 21:51:11 +100098 case KEY_ECDSA:
99 *algorithm = SSHFP_KEY_ECDSA;
100 if (!*digest_type)
101 *digest_type = SSHFP_HASH_SHA256;
102 break;
Damien Miller16cd3922014-05-15 13:45:58 +1000103 case KEY_ED25519:
104 *algorithm = SSHFP_KEY_ED25519;
105 if (!*digest_type)
106 *digest_type = SSHFP_HASH_SHA256;
107 break;
markus@openbsd.org1b11ea72018-02-23 15:58:37 +0000108 case KEY_XMSS:
109 *algorithm = SSHFP_KEY_XMSS;
110 if (!*digest_type)
111 *digest_type = SSHFP_HASH_SHA256;
112 break;
Damien Miller37876e92003-05-15 10:19:46 +1000113 default:
Damien Miller65712492005-11-05 15:09:27 +1100114 *algorithm = SSHFP_KEY_RESERVED; /* 0 */
Damien Miller3bde12a2012-06-20 21:51:11 +1000115 *digest_type = SSHFP_HASH_RESERVED; /* 0 */
Damien Miller37876e92003-05-15 10:19:46 +1000116 }
117
Damien Miller3bde12a2012-06-20 21:51:11 +1000118 switch (*digest_type) {
119 case SSHFP_HASH_SHA1:
djm@openbsd.org56d1c832014-12-21 22:27:55 +0000120 fp_alg = SSH_DIGEST_SHA1;
Damien Miller3bde12a2012-06-20 21:51:11 +1000121 break;
122 case SSHFP_HASH_SHA256:
djm@openbsd.org56d1c832014-12-21 22:27:55 +0000123 fp_alg = SSH_DIGEST_SHA256;
Damien Miller3bde12a2012-06-20 21:51:11 +1000124 break;
125 default:
126 *digest_type = SSHFP_HASH_RESERVED; /* 0 */
127 }
128
129 if (*algorithm && *digest_type) {
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000130 if ((r = sshkey_fingerprint_raw(key, fp_alg, digest,
131 digest_len)) != 0)
132 fatal("%s: sshkey_fingerprint_raw: %s", __func__,
133 ssh_err(r));
Damien Miller37876e92003-05-15 10:19:46 +1000134 success = 1;
135 } else {
Damien Miller37876e92003-05-15 10:19:46 +1000136 *digest = NULL;
137 *digest_len = 0;
138 success = 0;
139 }
140
141 return success;
142}
143
144/*
145 * Read SSHFP parameters from rdata buffer.
146 */
147static int
148dns_read_rdata(u_int8_t *algorithm, u_int8_t *digest_type,
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000149 u_char **digest, size_t *digest_len, u_char *rdata, int rdata_len)
Damien Miller37876e92003-05-15 10:19:46 +1000150{
151 int success = 0;
152
153 *algorithm = SSHFP_KEY_RESERVED;
154 *digest_type = SSHFP_HASH_RESERVED;
155
156 if (rdata_len >= 2) {
157 *algorithm = rdata[0];
158 *digest_type = rdata[1];
159 *digest_len = rdata_len - 2;
160
161 if (*digest_len > 0) {
deraadt@openbsd.orgce445b02015-08-20 22:32:42 +0000162 *digest = xmalloc(*digest_len);
Damien Miller37876e92003-05-15 10:19:46 +1000163 memcpy(*digest, rdata + 2, *digest_len);
164 } else {
Damien Miller59962942006-03-26 00:06:48 +1100165 *digest = (u_char *)xstrdup("");
Damien Miller37876e92003-05-15 10:19:46 +1000166 }
167
168 success = 1;
169 }
170
171 return success;
172}
173
Damien Millera31c9292005-05-26 12:03:31 +1000174/*
175 * Check if hostname is numerical.
176 * Returns -1 if hostname is numeric, 0 otherwise
177 */
178static int
179is_numeric_hostname(const char *hostname)
180{
181 struct addrinfo hints, *ai;
182
Darren Tucker30ac73b2008-06-13 04:46:45 +1000183 /*
184 * We shouldn't ever get a null host but if we do then log an error
185 * and return -1 which stops DNS key fingerprint processing.
186 */
187 if (hostname == NULL) {
188 error("is_numeric_hostname called with NULL hostname");
189 return -1;
190 }
191
Damien Millera31c9292005-05-26 12:03:31 +1000192 memset(&hints, 0, sizeof(hints));
193 hints.ai_socktype = SOCK_DGRAM;
194 hints.ai_flags = AI_NUMERICHOST;
195
Darren Tucker30ac73b2008-06-13 04:46:45 +1000196 if (getaddrinfo(hostname, NULL, &hints, &ai) == 0) {
Damien Millera31c9292005-05-26 12:03:31 +1000197 freeaddrinfo(ai);
198 return -1;
199 }
200
201 return 0;
202}
Damien Miller37876e92003-05-15 10:19:46 +1000203
204/*
205 * Verify the given hostname, address and host key using DNS.
Damien Millera8e06ce2003-11-21 23:48:55 +1100206 * Returns 0 if lookup succeeds, -1 otherwise
Damien Miller37876e92003-05-15 10:19:46 +1000207 */
208int
209verify_host_key_dns(const char *hostname, struct sockaddr *address,
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000210 struct sshkey *hostkey, int *flags)
Damien Miller37876e92003-05-15 10:19:46 +1000211{
Damien Millereccb9de2005-06-17 12:59:34 +1000212 u_int counter;
Damien Miller37876e92003-05-15 10:19:46 +1000213 int result;
214 struct rrsetinfo *fingerprints = NULL;
Damien Miller37876e92003-05-15 10:19:46 +1000215
216 u_int8_t hostkey_algorithm;
Damien Miller3bde12a2012-06-20 21:51:11 +1000217 u_int8_t hostkey_digest_type = SSHFP_HASH_RESERVED;
Damien Miller37876e92003-05-15 10:19:46 +1000218 u_char *hostkey_digest;
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000219 size_t hostkey_digest_len;
Damien Miller37876e92003-05-15 10:19:46 +1000220
221 u_int8_t dnskey_algorithm;
222 u_int8_t dnskey_digest_type;
223 u_char *dnskey_digest;
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000224 size_t dnskey_digest_len;
Damien Miller37876e92003-05-15 10:19:46 +1000225
Damien Miller150b5572003-11-17 21:19:29 +1100226 *flags = 0;
Damien Miller37876e92003-05-15 10:19:46 +1000227
Damien Miller319550a2005-11-05 15:11:15 +1100228 debug3("verify_host_key_dns");
Damien Miller37876e92003-05-15 10:19:46 +1000229 if (hostkey == NULL)
230 fatal("No key to look up!");
231
Damien Millera31c9292005-05-26 12:03:31 +1000232 if (is_numeric_hostname(hostname)) {
233 debug("skipped DNS lookup for numerical hostname");
234 return -1;
235 }
236
Damien Miller37876e92003-05-15 10:19:46 +1000237 result = getrrsetbyname(hostname, DNS_RDATACLASS_IN,
238 DNS_RDATATYPE_SSHFP, 0, &fingerprints);
239 if (result) {
240 verbose("DNS lookup error: %s", dns_result_totext(result));
Damien Miller150b5572003-11-17 21:19:29 +1100241 return -1;
Damien Miller37876e92003-05-15 10:19:46 +1000242 }
243
Damien Miller150b5572003-11-17 21:19:29 +1100244 if (fingerprints->rri_flags & RRSET_VALIDATED) {
245 *flags |= DNS_VERIFY_SECURE;
246 debug("found %d secure fingerprints in DNS",
247 fingerprints->rri_nrdatas);
248 } else {
249 debug("found %d insecure fingerprints in DNS",
250 fingerprints->rri_nrdatas);
Damien Miller37876e92003-05-15 10:19:46 +1000251 }
Damien Miller37876e92003-05-15 10:19:46 +1000252
Damien Miller3bde12a2012-06-20 21:51:11 +1000253 /* Initialize default host key parameters */
Damien Miller37876e92003-05-15 10:19:46 +1000254 if (!dns_read_key(&hostkey_algorithm, &hostkey_digest_type,
255 &hostkey_digest, &hostkey_digest_len, hostkey)) {
256 error("Error calculating host key fingerprint.");
Damien Millerb0622652003-05-15 13:27:28 +1000257 freerrset(fingerprints);
Damien Miller150b5572003-11-17 21:19:29 +1100258 return -1;
Damien Miller37876e92003-05-15 10:19:46 +1000259 }
260
Damien Miller150b5572003-11-17 21:19:29 +1100261 if (fingerprints->rri_nrdatas)
262 *flags |= DNS_VERIFY_FOUND;
263
Damien Miller80163902007-01-05 16:30:16 +1100264 for (counter = 0; counter < fingerprints->rri_nrdatas; counter++) {
Damien Miller37876e92003-05-15 10:19:46 +1000265 /*
266 * Extract the key from the answer. Ignore any badly
267 * formatted fingerprints.
268 */
269 if (!dns_read_rdata(&dnskey_algorithm, &dnskey_digest_type,
270 &dnskey_digest, &dnskey_digest_len,
271 fingerprints->rri_rdatas[counter].rdi_data,
272 fingerprints->rri_rdatas[counter].rdi_length)) {
273 verbose("Error parsing fingerprint from DNS.");
274 continue;
275 }
276
Damien Miller3bde12a2012-06-20 21:51:11 +1000277 if (hostkey_digest_type != dnskey_digest_type) {
278 hostkey_digest_type = dnskey_digest_type;
Darren Tuckera627d422013-06-02 07:31:17 +1000279 free(hostkey_digest);
Damien Miller3bde12a2012-06-20 21:51:11 +1000280
281 /* Initialize host key parameters */
282 if (!dns_read_key(&hostkey_algorithm,
283 &hostkey_digest_type, &hostkey_digest,
284 &hostkey_digest_len, hostkey)) {
285 error("Error calculating key fingerprint.");
286 freerrset(fingerprints);
287 return -1;
288 }
289 }
290
Damien Miller37876e92003-05-15 10:19:46 +1000291 /* Check if the current key is the same as the given key */
292 if (hostkey_algorithm == dnskey_algorithm &&
293 hostkey_digest_type == dnskey_digest_type) {
Damien Miller37876e92003-05-15 10:19:46 +1000294 if (hostkey_digest_len == dnskey_digest_len &&
Damien Miller3bde12a2012-06-20 21:51:11 +1000295 timingsafe_bcmp(hostkey_digest, dnskey_digest,
296 hostkey_digest_len) == 0)
Damien Miller150b5572003-11-17 21:19:29 +1100297 *flags |= DNS_VERIFY_MATCH;
Damien Miller37876e92003-05-15 10:19:46 +1000298 }
Darren Tuckera627d422013-06-02 07:31:17 +1000299 free(dnskey_digest);
Damien Miller37876e92003-05-15 10:19:46 +1000300 }
301
djm@openbsd.orgb8286052017-09-01 05:53:56 +0000302 free(hostkey_digest); /* from sshkey_fingerprint_raw() */
303 freerrset(fingerprints);
304
djm@openbsd.orgaea59a02017-09-14 04:32:21 +0000305 if (*flags & DNS_VERIFY_FOUND)
306 if (*flags & DNS_VERIFY_MATCH)
307 debug("matching host key fingerprint found in DNS");
308 else
309 debug("mismatching host key fingerprint found in DNS");
310 else
311 debug("no host key fingerprint found in DNS");
312
Damien Miller150b5572003-11-17 21:19:29 +1100313 return 0;
Damien Miller37876e92003-05-15 10:19:46 +1000314}
315
Damien Miller37876e92003-05-15 10:19:46 +1000316/*
317 * Export the fingerprint of a key as a DNS resource record
318 */
319int
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000320export_dns_rr(const char *hostname, struct sshkey *key, FILE *f, int generic)
Damien Miller37876e92003-05-15 10:19:46 +1000321{
322 u_int8_t rdata_pubkey_algorithm = 0;
Damien Miller3bde12a2012-06-20 21:51:11 +1000323 u_int8_t rdata_digest_type = SSHFP_HASH_RESERVED;
324 u_int8_t dtype;
Damien Miller37876e92003-05-15 10:19:46 +1000325 u_char *rdata_digest;
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000326 size_t i, rdata_digest_len;
Damien Miller37876e92003-05-15 10:19:46 +1000327 int success = 0;
328
Damien Miller3bde12a2012-06-20 21:51:11 +1000329 for (dtype = SSHFP_HASH_SHA1; dtype < SSHFP_HASH_MAX; dtype++) {
330 rdata_digest_type = dtype;
331 if (dns_read_key(&rdata_pubkey_algorithm, &rdata_digest_type,
332 &rdata_digest, &rdata_digest_len, key)) {
333 if (generic) {
djm@openbsd.org1129dcf2015-01-15 09:40:00 +0000334 fprintf(f, "%s IN TYPE%d \\# %zu %02x %02x ",
Damien Miller3bde12a2012-06-20 21:51:11 +1000335 hostname, DNS_RDATATYPE_SSHFP,
336 2 + rdata_digest_len,
337 rdata_pubkey_algorithm, rdata_digest_type);
338 } else {
339 fprintf(f, "%s IN SSHFP %d %d ", hostname,
340 rdata_pubkey_algorithm, rdata_digest_type);
341 }
342 for (i = 0; i < rdata_digest_len; i++)
343 fprintf(f, "%02x", rdata_digest[i]);
344 fprintf(f, "\n");
djm@openbsd.org9ce86c92015-01-28 22:36:00 +0000345 free(rdata_digest); /* from sshkey_fingerprint_raw() */
Damien Miller3bde12a2012-06-20 21:51:11 +1000346 success = 1;
347 }
348 }
Damien Miller37876e92003-05-15 10:19:46 +1000349
Damien Miller3bde12a2012-06-20 21:51:11 +1000350 /* No SSHFP record was generated at all */
351 if (success == 0) {
352 error("%s: unsupported algorithm and/or digest_type", __func__);
Damien Miller37876e92003-05-15 10:19:46 +1000353 }
354
355 return success;
356}