blob: 358a1e3539c4def5f4dade1fffa0a599018dad09 [file] [log] [blame]
Ben Lindstromb6434ae2000-12-05 01:15:09 +00001/*
2 * Copyright 1995, 1996 by David Mazieres <dm@lcs.mit.edu>.
3 *
4 * Modification and redistribution in source and binary forms is
5 * permitted provided that due credit is given to the author and the
Ben Lindstroma238f6e2001-06-09 01:30:39 +00006 * OpenBSD project by leaving this copyright notice intact.
Ben Lindstromb6434ae2000-12-05 01:15:09 +00007 */
8
9#include "includes.h"
Darren Tucker9f63f222003-07-03 13:46:56 +100010RCSID("$OpenBSD: ssh-keyscan.c,v 1.44 2003/06/28 16:23:06 deraadt Exp $");
Ben Lindstromb6434ae2000-12-05 01:15:09 +000011
Damien Miller9b481512002-09-12 10:43:29 +100012#include "openbsd-compat/sys-queue.h"
Ben Lindstromb6434ae2000-12-05 01:15:09 +000013
14#include <openssl/bn.h>
Ben Lindstromb6434ae2000-12-05 01:15:09 +000015
Ben Lindstrom325e70c2001-08-06 22:41:30 +000016#include <setjmp.h>
Ben Lindstromb6434ae2000-12-05 01:15:09 +000017#include "xmalloc.h"
18#include "ssh.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +000019#include "ssh1.h"
Ben Lindstromb6434ae2000-12-05 01:15:09 +000020#include "key.h"
Ben Lindstrom325e70c2001-08-06 22:41:30 +000021#include "kex.h"
22#include "compat.h"
23#include "myproposal.h"
24#include "packet.h"
25#include "dispatch.h"
Ben Lindstromb6434ae2000-12-05 01:15:09 +000026#include "buffer.h"
27#include "bufaux.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +000028#include "log.h"
Ben Lindstromd20b8552001-03-05 07:01:18 +000029#include "atomicio.h"
Ben Lindstrom325e70c2001-08-06 22:41:30 +000030#include "misc.h"
Ben Lindstromb6434ae2000-12-05 01:15:09 +000031
Ben Lindstrom325e70c2001-08-06 22:41:30 +000032/* Flag indicating whether IPv4 or IPv6. This can be set on the command line.
33 Default value is AF_UNSPEC means both IPv4 and IPv6. */
Ben Lindstrom325e70c2001-08-06 22:41:30 +000034int IPv4or6 = AF_UNSPEC;
Ben Lindstromb6434ae2000-12-05 01:15:09 +000035
Ben Lindstrom325e70c2001-08-06 22:41:30 +000036int ssh_port = SSH_DEFAULT_PORT;
Kevin Steves76e7d9b2001-09-20 20:30:09 +000037
38#define KT_RSA1 1
39#define KT_DSA 2
40#define KT_RSA 4
41
42int get_keytypes = KT_RSA1; /* Get only RSA1 keys by default */
Ben Lindstromb6434ae2000-12-05 01:15:09 +000043
Ben Lindstromb6434ae2000-12-05 01:15:09 +000044#define MAXMAXFD 256
45
46/* The number of seconds after which to give up on a TCP connection */
47int timeout = 5;
48
49int maxfd;
Ben Lindstromd20b8552001-03-05 07:01:18 +000050#define MAXCON (maxfd - 10)
Ben Lindstromb6434ae2000-12-05 01:15:09 +000051
Kevin Stevesec84dc12000-12-13 17:45:15 +000052#ifdef HAVE___PROGNAME
53extern char *__progname;
54#else
55char *__progname;
56#endif
Ben Lindstromc1e04212001-03-05 07:04:38 +000057fd_set *read_wait;
58size_t read_wait_size;
Ben Lindstromb6434ae2000-12-05 01:15:09 +000059int ncon;
Ben Lindstrom325e70c2001-08-06 22:41:30 +000060int nonfatal_fatal = 0;
61jmp_buf kexjmp;
Ben Lindstrom520b55c2001-09-12 18:05:05 +000062Key *kexjmp_key;
Ben Lindstromb6434ae2000-12-05 01:15:09 +000063
64/*
65 * Keep a connection structure for each file descriptor. The state
66 * associated with file descriptor n is held in fdcon[n].
67 */
68typedef struct Connection {
Ben Lindstrom46c16222000-12-22 01:43:59 +000069 u_char c_status; /* State of connection on this file desc. */
Ben Lindstromb6434ae2000-12-05 01:15:09 +000070#define CS_UNUSED 0 /* File descriptor unused */
71#define CS_CON 1 /* Waiting to connect/read greeting */
72#define CS_SIZE 2 /* Waiting to read initial packet size */
73#define CS_KEYS 3 /* Waiting to read public key packet */
74 int c_fd; /* Quick lookup: c->c_fd == c - fdcon */
75 int c_plen; /* Packet length field for ssh packet */
76 int c_len; /* Total bytes which must be read. */
77 int c_off; /* Length of data read so far. */
Ben Lindstrom325e70c2001-08-06 22:41:30 +000078 int c_keytype; /* Only one of KT_RSA1, KT_DSA, or KT_RSA */
Ben Lindstromb6434ae2000-12-05 01:15:09 +000079 char *c_namebase; /* Address to free for c_name and c_namelist */
80 char *c_name; /* Hostname of connection for errors */
81 char *c_namelist; /* Pointer to other possible addresses */
82 char *c_output_name; /* Hostname of connection for output */
83 char *c_data; /* Data read from this fd */
Ben Lindstrom325e70c2001-08-06 22:41:30 +000084 Kex *c_kex; /* The key-exchange struct for ssh2 */
Ben Lindstromb6434ae2000-12-05 01:15:09 +000085 struct timeval c_tv; /* Time at which connection gets aborted */
86 TAILQ_ENTRY(Connection) c_link; /* List of connections in timeout order. */
87} con;
88
89TAILQ_HEAD(conlist, Connection) tq; /* Timeout Queue */
90con *fdcon;
91
92/*
93 * This is just a wrapper around fgets() to make it usable.
94 */
95
96/* Stress-test. Increase this later. */
97#define LINEBUF_SIZE 16
98
99typedef struct {
100 char *buf;
Ben Lindstrom46c16222000-12-22 01:43:59 +0000101 u_int size;
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000102 int lineno;
103 const char *filename;
104 FILE *stream;
105 void (*errfun) (const char *,...);
106} Linebuf;
107
Ben Lindstrombba81212001-06-25 05:01:22 +0000108static Linebuf *
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000109Linebuf_alloc(const char *filename, void (*errfun) (const char *,...))
110{
111 Linebuf *lb;
112
113 if (!(lb = malloc(sizeof(*lb)))) {
114 if (errfun)
Ben Lindstrom04f9af72002-07-04 00:03:56 +0000115 (*errfun) ("linebuf (%s): malloc failed\n",
116 filename ? filename : "(stdin)");
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000117 return (NULL);
118 }
119 if (filename) {
120 lb->filename = filename;
121 if (!(lb->stream = fopen(filename, "r"))) {
Ben Lindstrombf555ba2001-01-18 02:04:35 +0000122 xfree(lb);
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000123 if (errfun)
124 (*errfun) ("%s: %s\n", filename, strerror(errno));
125 return (NULL);
126 }
127 } else {
128 lb->filename = "(stdin)";
129 lb->stream = stdin;
130 }
131
132 if (!(lb->buf = malloc(lb->size = LINEBUF_SIZE))) {
133 if (errfun)
134 (*errfun) ("linebuf (%s): malloc failed\n", lb->filename);
Ben Lindstrombf555ba2001-01-18 02:04:35 +0000135 xfree(lb);
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000136 return (NULL);
137 }
138 lb->errfun = errfun;
139 lb->lineno = 0;
140 return (lb);
141}
142
Ben Lindstrombba81212001-06-25 05:01:22 +0000143static void
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000144Linebuf_free(Linebuf * lb)
145{
146 fclose(lb->stream);
Ben Lindstrombf555ba2001-01-18 02:04:35 +0000147 xfree(lb->buf);
148 xfree(lb);
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000149}
150
Ben Lindstrombba81212001-06-25 05:01:22 +0000151#if 0
152static void
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000153Linebuf_restart(Linebuf * lb)
154{
155 clearerr(lb->stream);
156 rewind(lb->stream);
157 lb->lineno = 0;
158}
159
Ben Lindstrombba81212001-06-25 05:01:22 +0000160static int
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000161Linebuf_lineno(Linebuf * lb)
162{
163 return (lb->lineno);
164}
Ben Lindstrombba81212001-06-25 05:01:22 +0000165#endif
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000166
Ben Lindstrombba81212001-06-25 05:01:22 +0000167static char *
Ben Lindstromc791beb2001-02-10 23:18:11 +0000168Linebuf_getline(Linebuf * lb)
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000169{
170 int n = 0;
Ben Lindstrom965710f2002-07-07 22:17:22 +0000171 void *p;
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000172
173 lb->lineno++;
174 for (;;) {
175 /* Read a line */
176 if (!fgets(&lb->buf[n], lb->size - n, lb->stream)) {
177 if (ferror(lb->stream) && lb->errfun)
Ben Lindstrom965710f2002-07-07 22:17:22 +0000178 (*lb->errfun)("%s: %s\n", lb->filename,
Ben Lindstromb0a4cd82001-03-05 04:54:49 +0000179 strerror(errno));
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000180 return (NULL);
181 }
182 n = strlen(lb->buf);
183
184 /* Return it or an error if it fits */
185 if (n > 0 && lb->buf[n - 1] == '\n') {
186 lb->buf[n - 1] = '\0';
187 return (lb->buf);
188 }
189 if (n != lb->size - 1) {
190 if (lb->errfun)
Ben Lindstrom965710f2002-07-07 22:17:22 +0000191 (*lb->errfun)("%s: skipping incomplete last line\n",
Ben Lindstromb0a4cd82001-03-05 04:54:49 +0000192 lb->filename);
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000193 return (NULL);
194 }
195 /* Double the buffer if we need more space */
Ben Lindstrom965710f2002-07-07 22:17:22 +0000196 lb->size *= 2;
197 if ((p = realloc(lb->buf, lb->size)) == NULL) {
198 lb->size /= 2;
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000199 if (lb->errfun)
Ben Lindstrom965710f2002-07-07 22:17:22 +0000200 (*lb->errfun)("linebuf (%s): realloc failed\n",
Ben Lindstromb0a4cd82001-03-05 04:54:49 +0000201 lb->filename);
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000202 return (NULL);
203 }
Ben Lindstrom965710f2002-07-07 22:17:22 +0000204 lb->buf = p;
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000205 }
206}
207
Ben Lindstrombba81212001-06-25 05:01:22 +0000208static int
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000209fdlim_get(int hard)
210{
Ben Lindstrom5adbad22000-12-27 07:06:21 +0000211#if defined(HAVE_GETRLIMIT) && defined(RLIMIT_NOFILE)
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000212 struct rlimit rlfd;
Ben Lindstromb0a4cd82001-03-05 04:54:49 +0000213
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000214 if (getrlimit(RLIMIT_NOFILE, &rlfd) < 0)
215 return (-1);
216 if ((hard ? rlfd.rlim_max : rlfd.rlim_cur) == RLIM_INFINITY)
217 return 10000;
218 else
219 return hard ? rlfd.rlim_max : rlfd.rlim_cur;
Ben Lindstrom2c467a22000-12-27 04:57:41 +0000220#elif defined (HAVE_SYSCONF)
221 return sysconf (_SC_OPEN_MAX);
222#else
223 return 10000;
224#endif
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000225}
226
Ben Lindstrombba81212001-06-25 05:01:22 +0000227static int
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000228fdlim_set(int lim)
229{
Ben Lindstrom5adbad22000-12-27 07:06:21 +0000230#if defined(HAVE_SETRLIMIT) && defined(RLIMIT_NOFILE)
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000231 struct rlimit rlfd;
Ben Lindstrom2c467a22000-12-27 04:57:41 +0000232#endif
Ben Lindstrom5c98db52002-07-07 22:25:29 +0000233
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000234 if (lim <= 0)
235 return (-1);
Ben Lindstrom5adbad22000-12-27 07:06:21 +0000236#if defined(HAVE_SETRLIMIT) && defined(RLIMIT_NOFILE)
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000237 if (getrlimit(RLIMIT_NOFILE, &rlfd) < 0)
238 return (-1);
239 rlfd.rlim_cur = lim;
240 if (setrlimit(RLIMIT_NOFILE, &rlfd) < 0)
241 return (-1);
Ben Lindstrom2c467a22000-12-27 04:57:41 +0000242#elif defined (HAVE_SETDTABLESIZE)
Kevin Steves28a7f262001-02-05 15:43:59 +0000243 setdtablesize(lim);
Ben Lindstrom2c467a22000-12-27 04:57:41 +0000244#endif
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000245 return (0);
246}
247
248/*
249 * This is an strsep function that returns a null field for adjacent
250 * separators. This is the same as the 4.4BSD strsep, but different from the
251 * one in the GNU libc.
252 */
Ben Lindstrombba81212001-06-25 05:01:22 +0000253static char *
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000254xstrsep(char **str, const char *delim)
255{
256 char *s, *e;
257
258 if (!**str)
259 return (NULL);
260
261 s = *str;
262 e = s + strcspn(s, delim);
263
264 if (*e != '\0')
265 *e++ = '\0';
266 *str = e;
267
268 return (s);
269}
270
271/*
272 * Get the next non-null token (like GNU strsep). Strsep() will return a
273 * null token for two adjacent separators, so we may have to loop.
274 */
Ben Lindstrombba81212001-06-25 05:01:22 +0000275static char *
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000276strnnsep(char **stringp, char *delim)
277{
278 char *tok;
279
280 do {
281 tok = xstrsep(stringp, delim);
282 } while (tok && *tok == '\0');
283 return (tok);
284}
285
Ben Lindstrom325e70c2001-08-06 22:41:30 +0000286static Key *
287keygrab_ssh1(con *c)
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000288{
289 static Key *rsa;
290 static Buffer msg;
291
292 if (rsa == NULL) {
293 buffer_init(&msg);
294 rsa = key_new(KEY_RSA1);
295 }
Ben Lindstrom325e70c2001-08-06 22:41:30 +0000296 buffer_append(&msg, c->c_data, c->c_plen);
297 buffer_consume(&msg, 8 - (c->c_plen & 7)); /* padding */
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000298 if (buffer_get_char(&msg) != (int) SSH_SMSG_PUBLIC_KEY) {
Ben Lindstrom325e70c2001-08-06 22:41:30 +0000299 error("%s: invalid packet type", c->c_name);
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000300 buffer_clear(&msg);
Ben Lindstrom325e70c2001-08-06 22:41:30 +0000301 return NULL;
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000302 }
303 buffer_consume(&msg, 8); /* cookie */
304
305 /* server key */
306 (void) buffer_get_int(&msg);
307 buffer_get_bignum(&msg, rsa->rsa->e);
308 buffer_get_bignum(&msg, rsa->rsa->n);
309
310 /* host key */
311 (void) buffer_get_int(&msg);
312 buffer_get_bignum(&msg, rsa->rsa->e);
313 buffer_get_bignum(&msg, rsa->rsa->n);
Ben Lindstrom325e70c2001-08-06 22:41:30 +0000314
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000315 buffer_clear(&msg);
316
Ben Lindstrom325e70c2001-08-06 22:41:30 +0000317 return (rsa);
318}
319
320static int
321hostjump(Key *hostkey)
322{
Ben Lindstrom520b55c2001-09-12 18:05:05 +0000323 kexjmp_key = hostkey;
324 longjmp(kexjmp, 1);
Ben Lindstrom325e70c2001-08-06 22:41:30 +0000325}
326
327static int
328ssh2_capable(int remote_major, int remote_minor)
329{
330 switch (remote_major) {
331 case 1:
332 if (remote_minor == 99)
333 return 1;
334 break;
335 case 2:
336 return 1;
337 default:
338 break;
339 }
340 return 0;
341}
342
343static Key *
344keygrab_ssh2(con *c)
345{
346 int j;
347
348 packet_set_connection(c->c_fd, c->c_fd);
349 enable_compat20();
350 myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = c->c_keytype == KT_DSA?
351 "ssh-dss": "ssh-rsa";
352 c->c_kex = kex_setup(myproposal);
Damien Miller8e7fb332003-02-24 12:03:03 +1100353 c->c_kex->kex[KEX_DH_GRP1_SHA1] = kexdh_client;
354 c->c_kex->kex[KEX_DH_GEX_SHA1] = kexgex_client;
Ben Lindstrom325e70c2001-08-06 22:41:30 +0000355 c->c_kex->verify_host_key = hostjump;
356
357 if (!(j = setjmp(kexjmp))) {
358 nonfatal_fatal = 1;
359 dispatch_run(DISPATCH_BLOCK, &c->c_kex->done, c->c_kex);
360 fprintf(stderr, "Impossible! dispatch_run() returned!\n");
361 exit(1);
362 }
363 nonfatal_fatal = 0;
364 xfree(c->c_kex);
365 c->c_kex = NULL;
366 packet_close();
Ben Lindstrom325e70c2001-08-06 22:41:30 +0000367
Ben Lindstrom520b55c2001-09-12 18:05:05 +0000368 return j < 0? NULL : kexjmp_key;
Ben Lindstrom325e70c2001-08-06 22:41:30 +0000369}
370
371static void
372keyprint(con *c, Key *key)
373{
374 if (!key)
375 return;
376
377 fprintf(stdout, "%s ", c->c_output_name ? c->c_output_name : c->c_name);
378 key_write(key, stdout);
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000379 fputs("\n", stdout);
380}
381
Ben Lindstrombba81212001-06-25 05:01:22 +0000382static int
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000383tcpconnect(char *host)
384{
385 struct addrinfo hints, *ai, *aitop;
386 char strport[NI_MAXSERV];
387 int gaierr, s = -1;
388
Ben Lindstrom325e70c2001-08-06 22:41:30 +0000389 snprintf(strport, sizeof strport, "%d", ssh_port);
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000390 memset(&hints, 0, sizeof(hints));
Ben Lindstrom325e70c2001-08-06 22:41:30 +0000391 hints.ai_family = IPv4or6;
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000392 hints.ai_socktype = SOCK_STREAM;
393 if ((gaierr = getaddrinfo(host, strport, &hints, &aitop)) != 0)
394 fatal("getaddrinfo %s: %s", host, gai_strerror(gaierr));
395 for (ai = aitop; ai; ai = ai->ai_next) {
Damien Miller2372ace2003-05-14 13:42:23 +1000396 s = socket(ai->ai_family, ai->ai_socktype, ai->ai_protocol);
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000397 if (s < 0) {
398 error("socket: %s", strerror(errno));
399 continue;
400 }
Ben Lindstrom48bd7c12001-01-09 00:35:42 +0000401 if (fcntl(s, F_SETFL, O_NONBLOCK) < 0)
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000402 fatal("F_SETFL: %s", strerror(errno));
403 if (connect(s, ai->ai_addr, ai->ai_addrlen) < 0 &&
404 errno != EINPROGRESS)
405 error("connect (`%s'): %s", host, strerror(errno));
406 else
407 break;
408 close(s);
409 s = -1;
410 }
411 freeaddrinfo(aitop);
412 return s;
413}
414
Ben Lindstrombba81212001-06-25 05:01:22 +0000415static int
Ben Lindstrom325e70c2001-08-06 22:41:30 +0000416conalloc(char *iname, char *oname, int keytype)
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000417{
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000418 char *namebase, *name, *namelist;
Ben Lindstrom965710f2002-07-07 22:17:22 +0000419 int s;
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000420
421 namebase = namelist = xstrdup(iname);
422
423 do {
424 name = xstrsep(&namelist, ",");
425 if (!name) {
Ben Lindstrombf555ba2001-01-18 02:04:35 +0000426 xfree(namebase);
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000427 return (-1);
428 }
429 } while ((s = tcpconnect(name)) < 0);
430
431 if (s >= maxfd)
Kevin Stevesfa72dda2000-12-15 18:39:12 +0000432 fatal("conalloc: fdno %d too high", s);
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000433 if (fdcon[s].c_status)
Kevin Stevesfa72dda2000-12-15 18:39:12 +0000434 fatal("conalloc: attempt to reuse fdno %d", s);
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000435
436 fdcon[s].c_fd = s;
437 fdcon[s].c_status = CS_CON;
438 fdcon[s].c_namebase = namebase;
439 fdcon[s].c_name = name;
440 fdcon[s].c_namelist = namelist;
441 fdcon[s].c_output_name = xstrdup(oname);
442 fdcon[s].c_data = (char *) &fdcon[s].c_plen;
443 fdcon[s].c_len = 4;
444 fdcon[s].c_off = 0;
Ben Lindstrom325e70c2001-08-06 22:41:30 +0000445 fdcon[s].c_keytype = keytype;
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000446 gettimeofday(&fdcon[s].c_tv, NULL);
447 fdcon[s].c_tv.tv_sec += timeout;
448 TAILQ_INSERT_TAIL(&tq, &fdcon[s], c_link);
Ben Lindstromc1e04212001-03-05 07:04:38 +0000449 FD_SET(s, read_wait);
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000450 ncon++;
451 return (s);
452}
453
Ben Lindstrombba81212001-06-25 05:01:22 +0000454static void
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000455confree(int s)
456{
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000457 if (s >= maxfd || fdcon[s].c_status == CS_UNUSED)
Kevin Stevesfa72dda2000-12-15 18:39:12 +0000458 fatal("confree: attempt to free bad fdno %d", s);
Ben Lindstromd20b8552001-03-05 07:01:18 +0000459 close(s);
Ben Lindstrombf555ba2001-01-18 02:04:35 +0000460 xfree(fdcon[s].c_namebase);
461 xfree(fdcon[s].c_output_name);
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000462 if (fdcon[s].c_status == CS_KEYS)
Ben Lindstrombf555ba2001-01-18 02:04:35 +0000463 xfree(fdcon[s].c_data);
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000464 fdcon[s].c_status = CS_UNUSED;
Ben Lindstrom325e70c2001-08-06 22:41:30 +0000465 fdcon[s].c_keytype = 0;
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000466 TAILQ_REMOVE(&tq, &fdcon[s], c_link);
Ben Lindstromc1e04212001-03-05 07:04:38 +0000467 FD_CLR(s, read_wait);
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000468 ncon--;
469}
470
Ben Lindstrombba81212001-06-25 05:01:22 +0000471static void
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000472contouch(int s)
473{
474 TAILQ_REMOVE(&tq, &fdcon[s], c_link);
475 gettimeofday(&fdcon[s].c_tv, NULL);
476 fdcon[s].c_tv.tv_sec += timeout;
477 TAILQ_INSERT_TAIL(&tq, &fdcon[s], c_link);
478}
479
Ben Lindstrombba81212001-06-25 05:01:22 +0000480static int
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000481conrecycle(int s)
482{
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000483 con *c = &fdcon[s];
Ben Lindstrom965710f2002-07-07 22:17:22 +0000484 int ret;
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000485
Ben Lindstrom325e70c2001-08-06 22:41:30 +0000486 ret = conalloc(c->c_namelist, c->c_output_name, c->c_keytype);
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000487 confree(s);
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000488 return (ret);
489}
490
Ben Lindstrombba81212001-06-25 05:01:22 +0000491static void
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000492congreet(int s)
493{
Ben Lindstrom965710f2002-07-07 22:17:22 +0000494 int remote_major, remote_minor, n = 0;
Ben Lindstrom325e70c2001-08-06 22:41:30 +0000495 char buf[256], *cp;
Damien Miller83c02ef2001-12-21 12:45:43 +1100496 char remote_version[sizeof buf];
Ben Lindstrom884a4ac2001-03-06 03:33:04 +0000497 size_t bufsiz;
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000498 con *c = &fdcon[s];
499
Ben Lindstrom884a4ac2001-03-06 03:33:04 +0000500 bufsiz = sizeof(buf);
501 cp = buf;
Ben Lindstromde8fc6f2001-08-06 22:43:50 +0000502 while (bufsiz-- && (n = read(s, cp, 1)) == 1 && *cp != '\n') {
503 if (*cp == '\r')
504 *cp = '\n';
Ben Lindstrom884a4ac2001-03-06 03:33:04 +0000505 cp++;
Ben Lindstromde8fc6f2001-08-06 22:43:50 +0000506 }
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000507 if (n < 0) {
508 if (errno != ECONNREFUSED)
509 error("read (%s): %s", c->c_name, strerror(errno));
510 conrecycle(s);
511 return;
512 }
Ben Lindstrom6b28c352002-03-05 01:54:52 +0000513 if (n == 0) {
514 error("%s: Connection closed by remote host", c->c_name);
515 conrecycle(s);
516 return;
517 }
Ben Lindstrom884a4ac2001-03-06 03:33:04 +0000518 if (*cp != '\n' && *cp != '\r') {
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000519 error("%s: bad greeting", c->c_name);
520 confree(s);
521 return;
522 }
Ben Lindstrom884a4ac2001-03-06 03:33:04 +0000523 *cp = '\0';
Damien Miller83c02ef2001-12-21 12:45:43 +1100524 if (sscanf(buf, "SSH-%d.%d-%[^\n]\n",
525 &remote_major, &remote_minor, remote_version) == 3)
526 compat_datafellows(remote_version);
527 else
528 datafellows = 0;
Ben Lindstrom325e70c2001-08-06 22:41:30 +0000529 if (c->c_keytype != KT_RSA1) {
Ben Lindstrom325e70c2001-08-06 22:41:30 +0000530 if (!ssh2_capable(remote_major, remote_minor)) {
531 debug("%s doesn't support ssh2", c->c_name);
532 confree(s);
533 return;
534 }
Damien Miller83c02ef2001-12-21 12:45:43 +1100535 } else if (remote_major != 1) {
536 debug("%s doesn't support ssh1", c->c_name);
537 confree(s);
538 return;
Ben Lindstrom325e70c2001-08-06 22:41:30 +0000539 }
Ben Lindstromde8fc6f2001-08-06 22:43:50 +0000540 fprintf(stderr, "# %s %s\n", c->c_name, chop(buf));
Ben Lindstrom325e70c2001-08-06 22:41:30 +0000541 n = snprintf(buf, sizeof buf, "SSH-%d.%d-OpenSSH-keyscan\r\n",
542 c->c_keytype == KT_RSA1? PROTOCOL_MAJOR_1 : PROTOCOL_MAJOR_2,
543 c->c_keytype == KT_RSA1? PROTOCOL_MINOR_1 : PROTOCOL_MINOR_2);
Darren Tucker9f63f222003-07-03 13:46:56 +1000544 if (atomicio(vwrite, s, buf, n) != n) {
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000545 error("write (%s): %s", c->c_name, strerror(errno));
546 confree(s);
547 return;
548 }
Ben Lindstrom325e70c2001-08-06 22:41:30 +0000549 if (c->c_keytype != KT_RSA1) {
550 keyprint(c, keygrab_ssh2(c));
551 confree(s);
552 return;
553 }
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000554 c->c_status = CS_SIZE;
555 contouch(s);
556}
557
Ben Lindstrombba81212001-06-25 05:01:22 +0000558static void
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000559conread(int s)
560{
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000561 con *c = &fdcon[s];
Ben Lindstrom965710f2002-07-07 22:17:22 +0000562 int n;
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000563
564 if (c->c_status == CS_CON) {
565 congreet(s);
566 return;
567 }
568 n = read(s, c->c_data + c->c_off, c->c_len - c->c_off);
569 if (n < 0) {
570 error("read (%s): %s", c->c_name, strerror(errno));
571 confree(s);
572 return;
573 }
574 c->c_off += n;
575
576 if (c->c_off == c->c_len)
577 switch (c->c_status) {
578 case CS_SIZE:
579 c->c_plen = htonl(c->c_plen);
580 c->c_len = c->c_plen + 8 - (c->c_plen & 7);
581 c->c_off = 0;
582 c->c_data = xmalloc(c->c_len);
583 c->c_status = CS_KEYS;
584 break;
585 case CS_KEYS:
Ben Lindstrom325e70c2001-08-06 22:41:30 +0000586 keyprint(c, keygrab_ssh1(c));
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000587 confree(s);
588 return;
589 break;
590 default:
Kevin Stevesfa72dda2000-12-15 18:39:12 +0000591 fatal("conread: invalid status %d", c->c_status);
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000592 break;
593 }
594
595 contouch(s);
596}
597
Ben Lindstrombba81212001-06-25 05:01:22 +0000598static void
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000599conloop(void)
600{
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000601 struct timeval seltime, now;
Ben Lindstrom965710f2002-07-07 22:17:22 +0000602 fd_set *r, *e;
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000603 con *c;
Ben Lindstrom965710f2002-07-07 22:17:22 +0000604 int i;
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000605
606 gettimeofday(&now, NULL);
Ben Lindstrom61c183b2002-06-21 00:09:54 +0000607 c = TAILQ_FIRST(&tq);
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000608
Ben Lindstromd20b8552001-03-05 07:01:18 +0000609 if (c && (c->c_tv.tv_sec > now.tv_sec ||
610 (c->c_tv.tv_sec == now.tv_sec && c->c_tv.tv_usec > now.tv_usec))) {
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000611 seltime = c->c_tv;
612 seltime.tv_sec -= now.tv_sec;
613 seltime.tv_usec -= now.tv_usec;
Ben Lindstromc791beb2001-02-10 23:18:11 +0000614 if (seltime.tv_usec < 0) {
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000615 seltime.tv_usec += 1000000;
616 seltime.tv_sec--;
617 }
618 } else
619 seltime.tv_sec = seltime.tv_usec = 0;
620
Ben Lindstromc1e04212001-03-05 07:04:38 +0000621 r = xmalloc(read_wait_size);
622 memcpy(r, read_wait, read_wait_size);
623 e = xmalloc(read_wait_size);
624 memcpy(e, read_wait, read_wait_size);
625
626 while (select(maxfd, r, NULL, e, &seltime) == -1 &&
Ben Lindstromf9452512001-02-15 03:12:08 +0000627 (errno == EAGAIN || errno == EINTR))
628 ;
629
Ben Lindstromd20b8552001-03-05 07:01:18 +0000630 for (i = 0; i < maxfd; i++) {
Ben Lindstromc1e04212001-03-05 07:04:38 +0000631 if (FD_ISSET(i, e)) {
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000632 error("%s: exception!", fdcon[i].c_name);
633 confree(i);
Ben Lindstromc1e04212001-03-05 07:04:38 +0000634 } else if (FD_ISSET(i, r))
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000635 conread(i);
Ben Lindstromd20b8552001-03-05 07:01:18 +0000636 }
Ben Lindstromc1e04212001-03-05 07:04:38 +0000637 xfree(r);
638 xfree(e);
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000639
Ben Lindstrom61c183b2002-06-21 00:09:54 +0000640 c = TAILQ_FIRST(&tq);
Ben Lindstromd20b8552001-03-05 07:01:18 +0000641 while (c && (c->c_tv.tv_sec < now.tv_sec ||
642 (c->c_tv.tv_sec == now.tv_sec && c->c_tv.tv_usec < now.tv_usec))) {
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000643 int s = c->c_fd;
Ben Lindstromd20b8552001-03-05 07:01:18 +0000644
Ben Lindstrom61c183b2002-06-21 00:09:54 +0000645 c = TAILQ_NEXT(c, c_link);
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000646 conrecycle(s);
647 }
648}
649
Ben Lindstrom325e70c2001-08-06 22:41:30 +0000650static void
651do_host(char *host)
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000652{
Ben Lindstrom325e70c2001-08-06 22:41:30 +0000653 char *name = strnnsep(&host, " \t\n");
654 int j;
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000655
Ben Lindstromeaffb9d2001-12-06 16:28:19 +0000656 if (name == NULL)
657 return;
Ben Lindstrom325e70c2001-08-06 22:41:30 +0000658 for (j = KT_RSA1; j <= KT_RSA; j *= 2) {
659 if (get_keytypes & j) {
660 while (ncon >= MAXCON)
661 conloop();
662 conalloc(name, *host ? host : name, j);
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000663 }
664 }
665}
666
Ben Lindstrom9c8edc92002-02-26 17:52:14 +0000667void
668fatal(const char *fmt,...)
Ben Lindstrom325e70c2001-08-06 22:41:30 +0000669{
Ben Lindstrom9c8edc92002-02-26 17:52:14 +0000670 va_list args;
Ben Lindstrom965710f2002-07-07 22:17:22 +0000671
Ben Lindstrom9c8edc92002-02-26 17:52:14 +0000672 va_start(args, fmt);
673 do_log(SYSLOG_LEVEL_FATAL, fmt, args);
674 va_end(args);
Ben Lindstrom325e70c2001-08-06 22:41:30 +0000675 if (nonfatal_fatal)
676 longjmp(kexjmp, -1);
Ben Lindstrom9c8edc92002-02-26 17:52:14 +0000677 else
678 fatal_cleanup();
Ben Lindstrom325e70c2001-08-06 22:41:30 +0000679}
680
681static void
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000682usage(void)
683{
Damien Millerea5ade22003-05-14 13:43:53 +1000684 fprintf(stderr, "usage: %s [-v46] [-p port] [-T timeout] [-t type] [-f file]\n"
Ben Lindstrom965710f2002-07-07 22:17:22 +0000685 "\t\t [host | addrlist namelist] [...]\n",
Ben Lindstromddfb1e32001-08-06 22:06:35 +0000686 __progname);
Ben Lindstromddfb1e32001-08-06 22:06:35 +0000687 exit(1);
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000688}
689
690int
691main(int argc, char **argv)
692{
Ben Lindstrom325e70c2001-08-06 22:41:30 +0000693 int debug_flag = 0, log_level = SYSLOG_LEVEL_INFO;
694 int opt, fopt_count = 0;
695 char *tname;
Kevin Steves76e7d9b2001-09-20 20:30:09 +0000696
Ben Lindstrom325e70c2001-08-06 22:41:30 +0000697 extern int optind;
698 extern char *optarg;
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000699
Kevin Stevesec84dc12000-12-13 17:45:15 +0000700 __progname = get_progname(argv[0]);
Ben Lindstrom4e088e42001-10-10 20:45:43 +0000701 init_rng();
702 seed_rng();
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000703 TAILQ_INIT(&tq);
704
Ben Lindstrom325e70c2001-08-06 22:41:30 +0000705 if (argc <= 1)
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000706 usage();
707
Ben Lindstrom325e70c2001-08-06 22:41:30 +0000708 while ((opt = getopt(argc, argv, "v46p:T:t:f:")) != -1) {
709 switch (opt) {
710 case 'p':
711 ssh_port = a2port(optarg);
712 if (ssh_port == 0) {
713 fprintf(stderr, "Bad port '%s'\n", optarg);
714 exit(1);
715 }
716 break;
717 case 'T':
Ben Lindstromedd098b2002-07-04 00:07:13 +0000718 timeout = convtime(optarg);
719 if (timeout == -1 || timeout == 0) {
720 fprintf(stderr, "Bad timeout '%s'\n", optarg);
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000721 usage();
Ben Lindstromedd098b2002-07-04 00:07:13 +0000722 }
Ben Lindstrom325e70c2001-08-06 22:41:30 +0000723 break;
724 case 'v':
725 if (!debug_flag) {
726 debug_flag = 1;
727 log_level = SYSLOG_LEVEL_DEBUG1;
728 }
729 else if (log_level < SYSLOG_LEVEL_DEBUG3)
730 log_level++;
731 else
732 fatal("Too high debugging level.");
733 break;
Kevin Steves76e7d9b2001-09-20 20:30:09 +0000734 case 'f':
Ben Lindstrom325e70c2001-08-06 22:41:30 +0000735 if (strcmp(optarg, "-") == 0)
736 optarg = NULL;
737 argv[fopt_count++] = optarg;
738 break;
739 case 't':
740 get_keytypes = 0;
741 tname = strtok(optarg, ",");
742 while (tname) {
743 int type = key_type_from_name(tname);
744 switch (type) {
745 case KEY_RSA1:
746 get_keytypes |= KT_RSA1;
747 break;
748 case KEY_DSA:
749 get_keytypes |= KT_DSA;
750 break;
751 case KEY_RSA:
752 get_keytypes |= KT_RSA;
753 break;
754 case KEY_UNSPEC:
Ben Lindstrom28c603b2001-12-06 16:45:10 +0000755 fatal("unknown key type %s", tname);
Ben Lindstrom325e70c2001-08-06 22:41:30 +0000756 }
757 tname = strtok(NULL, ",");
758 }
759 break;
760 case '4':
761 IPv4or6 = AF_INET;
762 break;
763 case '6':
764 IPv4or6 = AF_INET6;
765 break;
766 case '?':
767 default:
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000768 usage();
Ben Lindstrom325e70c2001-08-06 22:41:30 +0000769 }
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000770 }
Ben Lindstrom325e70c2001-08-06 22:41:30 +0000771 if (optind == argc && !fopt_count)
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000772 usage();
773
Ben Lindstrom325e70c2001-08-06 22:41:30 +0000774 log_init("ssh-keyscan", log_level, SYSLOG_FACILITY_USER, 1);
Ben Lindstrom325e70c2001-08-06 22:41:30 +0000775
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000776 maxfd = fdlim_get(1);
777 if (maxfd < 0)
Kevin Stevesfa72dda2000-12-15 18:39:12 +0000778 fatal("%s: fdlim_get: bad value", __progname);
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000779 if (maxfd > MAXMAXFD)
780 maxfd = MAXMAXFD;
Ben Lindstromd20b8552001-03-05 07:01:18 +0000781 if (MAXCON <= 0)
Kevin Stevesfa72dda2000-12-15 18:39:12 +0000782 fatal("%s: not enough file descriptors", __progname);
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000783 if (maxfd > fdlim_get(0))
784 fdlim_set(maxfd);
785 fdcon = xmalloc(maxfd * sizeof(con));
Ben Lindstromc791beb2001-02-10 23:18:11 +0000786 memset(fdcon, 0, maxfd * sizeof(con));
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000787
Ben Lindstromc1e04212001-03-05 07:04:38 +0000788 read_wait_size = howmany(maxfd, NFDBITS) * sizeof(fd_mask);
789 read_wait = xmalloc(read_wait_size);
790 memset(read_wait, 0, read_wait_size);
791
Ben Lindstrom325e70c2001-08-06 22:41:30 +0000792 if (fopt_count) {
793 Linebuf *lb;
794 char *line;
795 int j;
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000796
Ben Lindstrom325e70c2001-08-06 22:41:30 +0000797 for (j = 0; j < fopt_count; j++) {
798 lb = Linebuf_alloc(argv[j], error);
Ben Lindstrom78bbd9e2001-09-12 17:10:40 +0000799 if (!lb)
800 continue;
Ben Lindstrom325e70c2001-08-06 22:41:30 +0000801 while ((line = Linebuf_getline(lb)) != NULL)
802 do_host(line);
803 Linebuf_free(lb);
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000804 }
Ben Lindstrom325e70c2001-08-06 22:41:30 +0000805 }
806
807 while (optind < argc)
808 do_host(argv[optind++]);
809
Ben Lindstromb6434ae2000-12-05 01:15:09 +0000810 while (ncon > 0)
811 conloop();
812
813 return (0);
814}