tyler.durden
/
openssh-portable
mirror of https://github.com/PowerShell/openssh-portable.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

upstream commit 

Refactor hostkeys_foreach() and dependent code Deal with
 IP addresses (i.e. CheckHostIP) Don't clobber known_hosts when nothing
 changed ok markus@ as part of larger commit
This commit is contained in:
djm@openbsd.org 2015-02-16 22:08:57 +00:00 committed by Damien Miller
parent 51b082ccbe
commit 6c5c949782
4 changed files with 218 additions and 125 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
clientloop.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: clientloop.c,v 1.267 2015/01/26 03:04:45 djm Exp $ */ /* $OpenBSD: clientloop.c,v 1.268 2015/02/16 22:08:57 djm Exp $ */
/* /*
* Author: Tatu Ylonen <ylo@cs.hut.fi> * Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@ -2102,8 +2102,9 @@ client_input_hostkeys(void)
struct sshbuf *buf = NULL; struct sshbuf *buf = NULL;
struct sshkey *key = NULL, **tmp, **keys = NULL; struct sshkey *key = NULL, **tmp, **keys = NULL;
int r, success = 1; int r, success = 1;
char *fp, *host_str = NULL; char *fp, *host_str = NULL, *ip_str = NULL;
static int hostkeys_seen = 0; /* XXX use struct ssh */ static int hostkeys_seen = 0; /* XXX use struct ssh */
extern struct sockaddr_storage hostaddr; /* XXX from ssh.c */
/* /*
* NB. Return success for all cases other than protocol error. The * NB. Return success for all cases other than protocol error. The
@ -2148,16 +2149,24 @@ client_input_hostkeys(void)
key = NULL; key = NULL;
} }
debug3("%s: received %u keys from server", __func__, nkeys);
if (nkeys == 0) { if (nkeys == 0) {
error("%s: server sent no hostkeys", __func__); error("%s: server sent no hostkeys", __func__);
goto out; goto out;
} }
get_hostfile_hostname_ipaddr(host, NULL, options.port, &host_str, NULL); get_hostfile_hostname_ipaddr(host,
options.check_host_ip ? (struct sockaddr *)&hostaddr : NULL,
options.port, &host_str, options.check_host_ip ? &ip_str : NULL);
if ((r = hostfile_replace_entries(options.user_hostfiles[0], host_str, debug3("%s: update known hosts for %s%s%s with %u keys from server",
keys, nkeys, options.hash_known_hosts, 1)) != 0) { __func__, host_str,
options.check_host_ip ? " " : "",
options.check_host_ip ? ip_str : "", nkeys);
if ((r = hostfile_replace_entries(options.user_hostfiles[0],
host_str, options.check_host_ip ? ip_str : NULL,
keys, nkeys, options.hash_known_hosts, 0,
options.fingerprint_hash)) != 0) {
error("%s: hostfile_replace_entries failed: %s", error("%s: hostfile_replace_entries failed: %s",
__func__, ssh_err(r)); __func__, ssh_err(r));
goto out; goto out;
@ -2166,6 +2175,7 @@ client_input_hostkeys(void)
/* Success */ /* Success */
out: out:
free(host_str); free(host_str);
free(ip_str);
sshkey_free(key); sshkey_free(key);
for (i = 0; i < nkeys; i++) for (i = 0; i < nkeys; i++)
sshkey_free(keys[i]); sshkey_free(keys[i]);

185
hostfile.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: hostfile.c,v 1.63 2015/01/26 13:36:53 djm Exp $ */ /* $OpenBSD: hostfile.c,v 1.64 2015/02/16 22:08:57 djm Exp $ */
/* /*
* Author: Tatu Ylonen <ylo@cs.hut.fi> * Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@ -184,24 +184,6 @@ hostfile_read_key(char **cpp, u_int *bitsp, struct sshkey *ret)
return 1; return 1;
} }
static int
hostfile_check_key(int bits, const struct sshkey *key, const char *host,
const char *filename, u_long linenum)
{
#ifdef WITH_SSH1
if (key == NULL || key->type != KEY_RSA1 || key->rsa == NULL)
return 1;
if (bits != BN_num_bits(key->rsa->n)) {
logit("Warning: %s, line %lu: keysize mismatch for host %s: "
"actual %d vs. announced %d.",
filename, linenum, host, BN_num_bits(key->rsa->n), bits);
logit("Warning: replace %d with %d in %s, line %lu.",
bits, BN_num_bits(key->rsa->n), filename, linenum);
}
#endif
return 1;
}
static HostkeyMarker static HostkeyMarker
check_markers(char **cpp) check_markers(char **cpp)
{ {
@ -295,8 +277,8 @@ load_hostkeys(struct hostkeys *hostkeys, const char *host, const char *path)
ctx.num_loaded = 0; ctx.num_loaded = 0;
ctx.hostkeys = hostkeys; ctx.hostkeys = hostkeys;
if ((r = hostkeys_foreach(path, record_hostkey, &ctx, host, if ((r = hostkeys_foreach(path, record_hostkey, &ctx, host, NULL,
HKF_WANT_MATCH_HOST|HKF_WANT_PARSE_KEY)) != 0) { HKF_WANT_MATCH|HKF_WANT_PARSE_KEY)) != 0) {
if (r != SSH_ERR_SYSTEM_ERROR && errno != ENOENT) if (r != SSH_ERR_SYSTEM_ERROR && errno != ENOENT)
debug("%s: hostkeys_foreach failed for %s: %s", debug("%s: hostkeys_foreach failed for %s: %s",
__func__, path, ssh_err(r)); __func__, path, ssh_err(r));
@ -433,7 +415,7 @@ lookup_key_in_hostkeys_by_type(struct hostkeys *hostkeys, int keytype,
} }
static int static int
write_host_entry(FILE *f, const char *host, write_host_entry(FILE *f, const char *host, const char *ip,
const struct sshkey *key, int store_hash) const struct sshkey *key, int store_hash)
{ {
int r, success = 0; int r, success = 0;
@ -444,8 +426,11 @@ write_host_entry(FILE *f, const char *host,
error("%s: host_hash failed", __func__); error("%s: host_hash failed", __func__);
return 0; return 0;
} }
} fprintf(f, "%s ", hashed_host);
fprintf(f, "%s ", store_hash ? hashed_host : host); } else if (ip != NULL)
fprintf(f, "%s,%s ", host, ip);
else
fprintf(f, "%s ", host);
if ((r = sshkey_write(key, f)) == 0) if ((r = sshkey_write(key, f)) == 0)
success = 1; success = 1;
@ -471,7 +456,7 @@ add_host_to_hostfile(const char *filename, const char *host,
f = fopen(filename, "a"); f = fopen(filename, "a");
if (!f) if (!f)
return 0; return 0;
success = write_host_entry(f, host, key, store_hash); success = write_host_entry(f, host, NULL, key, store_hash);
fclose(f); fclose(f);
return success; return success;
} }
@ -480,19 +465,20 @@ struct host_delete_ctx {
FILE *out; FILE *out;
int quiet; int quiet;
const char *host; const char *host;
int *skip_keys; int *skip_keys; /* XXX split for host/ip? might want to ensure both */
struct sshkey * const *keys; struct sshkey * const *keys;
size_t nkeys; size_t nkeys;
int modified;
}; };
static int static int
host_delete(struct hostkey_foreach_line *l, void *_ctx) host_delete(struct hostkey_foreach_line *l, void *_ctx)
{ {
struct host_delete_ctx *ctx = (struct host_delete_ctx *)_ctx; struct host_delete_ctx *ctx = (struct host_delete_ctx *)_ctx;
int loglevel = ctx->quiet ? SYSLOG_LEVEL_DEBUG1 : SYSLOG_LEVEL_INFO; int loglevel = ctx->quiet ? SYSLOG_LEVEL_DEBUG1 : SYSLOG_LEVEL_VERBOSE;
size_t i; size_t i;
if (l->status == HKF_STATUS_HOST_MATCHED) { if (l->status == HKF_STATUS_MATCHED) {
if (l->marker != MRK_NONE) { if (l->marker != MRK_NONE) {
/* Don't remove CA and revocation lines */ /* Don't remove CA and revocation lines */
fprintf(ctx->out, "%s\n", l->line); fprintf(ctx->out, "%s\n", l->line);
@ -525,9 +511,10 @@ host_delete(struct hostkey_foreach_line *l, void *_ctx)
* Hostname matches and has no CA/revoke marker, delete it * Hostname matches and has no CA/revoke marker, delete it
* by *not* writing the line to ctx->out. * by *not* writing the line to ctx->out.
*/ */
do_log2(loglevel, "%s%s%s:%ld: Host %s removed", do_log2(loglevel, "%s%s%s:%ld: Removed %s key for host %s",
ctx->quiet ? __func__ : "", ctx->quiet ? ": " : "", ctx->quiet ? __func__ : "", ctx->quiet ? ": " : "",
l->path, l->linenum, ctx->host); l->path, l->linenum, sshkey_type(l->key), ctx->host);
ctx->modified = 1;
return 0; return 0;
} }
/* Retain non-matching hosts and invalid lines when deleting */ /* Retain non-matching hosts and invalid lines when deleting */
@ -541,13 +528,13 @@ host_delete(struct hostkey_foreach_line *l, void *_ctx)
} }
int int
hostfile_replace_entries(const char *filename, const char *host, hostfile_replace_entries(const char *filename, const char *host, const char *ip,
struct sshkey **keys, size_t nkeys, int store_hash, int quiet) struct sshkey **keys, size_t nkeys, int store_hash, int quiet, int hash_alg)
{ {
int r, fd, oerrno = 0; int r, fd, oerrno = 0;
int loglevel = quiet ? SYSLOG_LEVEL_DEBUG1 : SYSLOG_LEVEL_INFO; int loglevel = quiet ? SYSLOG_LEVEL_DEBUG1 : SYSLOG_LEVEL_VERBOSE;
struct host_delete_ctx ctx; struct host_delete_ctx ctx;
char *temp = NULL, *back = NULL; char *fp, *temp = NULL, *back = NULL;
mode_t omask; mode_t omask;
size_t i; size_t i;
@ -560,6 +547,7 @@ hostfile_replace_entries(const char *filename, const char *host,
return SSH_ERR_ALLOC_FAIL; return SSH_ERR_ALLOC_FAIL;
ctx.keys = keys; ctx.keys = keys;
ctx.nkeys = nkeys; ctx.nkeys = nkeys;
ctx.modified = 0;
/* /*
* Prepare temporary file for in-place deletion. * Prepare temporary file for in-place deletion.
@ -585,7 +573,7 @@ hostfile_replace_entries(const char *filename, const char *host,
} }
/* Remove all entries for the specified host from the file */ /* Remove all entries for the specified host from the file */
if ((r = hostkeys_foreach(filename, host_delete, &ctx, host, if ((r = hostkeys_foreach(filename, host_delete, &ctx, host, ip,
HKF_WANT_PARSE_KEY)) != 0) { HKF_WANT_PARSE_KEY)) != 0) {
error("%s: hostkeys_foreach failed: %s", __func__, ssh_err(r)); error("%s: hostkeys_foreach failed: %s", __func__, ssh_err(r));
goto fail; goto fail;
@ -595,28 +583,37 @@ hostfile_replace_entries(const char *filename, const char *host,
for (i = 0; i < nkeys; i++) { for (i = 0; i < nkeys; i++) {
if (ctx.skip_keys[i]) if (ctx.skip_keys[i])
continue; continue;
do_log2(loglevel, "%s%sadd %s key to %s", if ((fp = sshkey_fingerprint(keys[i], hash_alg,
quiet ? __func__ : "", quiet ? ": " : NULL, SSH_FP_DEFAULT)) == NULL) {
sshkey_type(keys[i]), filename); r = SSH_ERR_ALLOC_FAIL;
if (!write_host_entry(ctx.out, host, keys[i], store_hash)) { goto fail;
}
do_log2(loglevel, "%s%sAdding new key for %s to %s: %s %s",
quiet ? __func__ : "", quiet ? ": " : "", host, filename,
sshkey_ssh_name(keys[i]), fp);
free(fp);
if (!write_host_entry(ctx.out, host, ip, keys[i], store_hash)) {
r = SSH_ERR_INTERNAL_ERROR; r = SSH_ERR_INTERNAL_ERROR;
goto fail; goto fail;
} }
ctx.modified = 1;
} }
fclose(ctx.out); fclose(ctx.out);
ctx.out = NULL; ctx.out = NULL;
if (ctx.modified) {
/* Backup the original file and replace it with the temporary */ /* Backup the original file and replace it with the temporary */
if (unlink(back) == -1 && errno != ENOENT) { if (unlink(back) == -1 && errno != ENOENT) {
oerrno = errno; oerrno = errno;
error("%s: unlink %.100s: %s", __func__, back, strerror(errno)); error("%s: unlink %.100s: %s", __func__,
back, strerror(errno));
r = SSH_ERR_SYSTEM_ERROR; r = SSH_ERR_SYSTEM_ERROR;
goto fail; goto fail;
} }
if (link(filename, back) == -1) { if (link(filename, back) == -1) {
oerrno = errno; oerrno = errno;
error("%s: link %.100s to %.100s: %s", __func__, filename, back, error("%s: link %.100s to %.100s: %s", __func__,
strerror(errno)); filename, back, strerror(errno));
r = SSH_ERR_SYSTEM_ERROR; r = SSH_ERR_SYSTEM_ERROR;
goto fail; goto fail;
} }
@ -627,6 +624,13 @@ hostfile_replace_entries(const char *filename, const char *host,
r = SSH_ERR_SYSTEM_ERROR; r = SSH_ERR_SYSTEM_ERROR;
goto fail; goto fail;
} }
} else {
/* No changes made; just delete the temporary file */
if (unlink(temp) != 0)
error("%s: unlink \"%s\": %s", __func__,
temp, strerror(errno));
}
/* success */ /* success */
r = 0; r = 0;
fail: fail:
@ -663,18 +667,20 @@ match_maybe_hashed(const char *host, const char *names, int *was_hashed)
int int
hostkeys_foreach(const char *path, hostkeys_foreach_fn *callback, void *ctx, hostkeys_foreach(const char *path, hostkeys_foreach_fn *callback, void *ctx,
const char *host, u_int options) const char *host, const char *ip, u_int options)
{ {
FILE *f; FILE *f;
char line[8192], oline[8192]; char line[8192], oline[8192], ktype[128];
u_long linenum = 0; u_long linenum = 0;
char *cp, *cp2; char *cp, *cp2;
u_int kbits; u_int kbits;
int hashed;
int s, r = 0; int s, r = 0;
struct hostkey_foreach_line lineinfo; struct hostkey_foreach_line lineinfo;
size_t l;
memset(&lineinfo, 0, sizeof(lineinfo)); memset(&lineinfo, 0, sizeof(lineinfo));
if (host == NULL && (options & HKF_WANT_MATCH_HOST) != 0) if (host == NULL && (options & HKF_WANT_MATCH) != 0)
return SSH_ERR_INVALID_ARGUMENT; return SSH_ERR_INVALID_ARGUMENT;
if ((f = fopen(path, "r")) == NULL) if ((f = fopen(path, "r")) == NULL)
return SSH_ERR_SYSTEM_ERROR; return SSH_ERR_SYSTEM_ERROR;
@ -689,13 +695,15 @@ hostkeys_foreach(const char *path, hostkeys_foreach_fn *callback, void *ctx,
lineinfo.path = path; lineinfo.path = path;
lineinfo.linenum = linenum; lineinfo.linenum = linenum;
lineinfo.line = oline; lineinfo.line = oline;
lineinfo.marker = MRK_NONE;
lineinfo.status = HKF_STATUS_OK; lineinfo.status = HKF_STATUS_OK;
lineinfo.keytype = KEY_UNSPEC;
/* Skip any leading whitespace, comments and empty lines. */ /* Skip any leading whitespace, comments and empty lines. */
for (cp = line; *cp == ' ' || *cp == '\t'; cp++) for (cp = line; *cp == ' ' || *cp == '\t'; cp++)
; ;
if (!*cp || *cp == '#' || *cp == '\n') { if (!*cp || *cp == '#' || *cp == '\n') {
if ((options & HKF_WANT_MATCH_HOST) == 0) { if ((options & HKF_WANT_MATCH) == 0) {
lineinfo.status = HKF_STATUS_COMMENT; lineinfo.status = HKF_STATUS_COMMENT;
if ((r = callback(&lineinfo, ctx)) != 0) if ((r = callback(&lineinfo, ctx)) != 0)
break; break;
@ -706,7 +714,7 @@ hostkeys_foreach(const char *path, hostkeys_foreach_fn *callback, void *ctx,
if ((lineinfo.marker = check_markers(&cp)) == MRK_ERROR) { if ((lineinfo.marker = check_markers(&cp)) == MRK_ERROR) {
verbose("%s: invalid marker at %s:%lu", verbose("%s: invalid marker at %s:%lu",
__func__, path, linenum); __func__, path, linenum);
if ((options & HKF_WANT_MATCH_HOST) == 0) if ((options & HKF_WANT_MATCH) == 0)
goto bad; goto bad;
continue; continue;
} }
@ -719,24 +727,47 @@ hostkeys_foreach(const char *path, hostkeys_foreach_fn *callback, void *ctx,
/* Check if the host name matches. */ /* Check if the host name matches. */
if (host != NULL) { if (host != NULL) {
s = match_maybe_hashed(host, lineinfo.hosts, if ((s = match_maybe_hashed(host, lineinfo.hosts,
&lineinfo.was_hashed); &hashed)) == -1) {
if (s == 1)
lineinfo.status = HKF_STATUS_HOST_MATCHED;
else if ((options & HKF_WANT_MATCH_HOST) != 0)
continue;
else if (s == -1) {
debug2("%s: %s:%ld: bad host hash \"%.32s\"", debug2("%s: %s:%ld: bad host hash \"%.32s\"",
__func__, path, linenum, lineinfo.hosts); __func__, path, linenum, lineinfo.hosts);
goto bad; goto bad;
} }
if (s == 1) {
lineinfo.status = HKF_STATUS_MATCHED;
lineinfo.match |= HKF_MATCH_HOST |
(hashed ? HKF_MATCH_HOST_HASHED : 0);
}
/* Try matching IP address if supplied */
if (ip != NULL) {
if ((s = match_maybe_hashed(ip, lineinfo.hosts,
&hashed)) == -1) {
debug2("%s: %s:%ld: bad ip hash "
"\"%.32s\"", __func__, path,
linenum, lineinfo.hosts);
goto bad;
}
if (s == 1) {
lineinfo.status = HKF_STATUS_MATCHED;
lineinfo.match |= HKF_MATCH_IP |
(hashed ? HKF_MATCH_IP_HASHED : 0);
}
}
/*
* Skip this line if host matching requested and
* neither host nor address matched.
*/
if ((options & HKF_WANT_MATCH) != 0 &&
lineinfo.status != HKF_STATUS_MATCHED)
continue;
} }
/* Got a match. Skip host name and any following whitespace */ /* Got a match. Skip host name and any following whitespace */
for (; *cp2 == ' ' || *cp2 == '\t'; cp2++) for (; *cp2 == ' ' || *cp2 == '\t'; cp2++)
; ;
if (*cp2 == '\0' || *cp2 == '#') { if (*cp2 == '\0' || *cp2 == '#') {
debug2("%s:%ld: truncated before key", path, linenum); debug2("%s:%ld: truncated before key type",
path, linenum);
goto bad; goto bad;
} }
lineinfo.rawkey = cp = cp2; lineinfo.rawkey = cp = cp2;
@ -749,7 +780,8 @@ hostkeys_foreach(const char *path, hostkeys_foreach_fn *callback, void *ctx,
*/ */
if ((lineinfo.key = sshkey_new(KEY_UNSPEC)) == NULL) { if ((lineinfo.key = sshkey_new(KEY_UNSPEC)) == NULL) {
error("%s: sshkey_new failed", __func__); error("%s: sshkey_new failed", __func__);
return SSH_ERR_ALLOC_FAIL; r = SSH_ERR_ALLOC_FAIL;
break;
} }
if (!hostfile_read_key(&cp, &kbits, lineinfo.key)) { if (!hostfile_read_key(&cp, &kbits, lineinfo.key)) {
#ifdef WITH_SSH1 #ifdef WITH_SSH1
@ -757,7 +789,8 @@ hostkeys_foreach(const char *path, hostkeys_foreach_fn *callback, void *ctx,
lineinfo.key = sshkey_new(KEY_RSA1); lineinfo.key = sshkey_new(KEY_RSA1);
if (lineinfo.key == NULL) { if (lineinfo.key == NULL) {
error("%s: sshkey_new fail", __func__); error("%s: sshkey_new fail", __func__);
return SSH_ERR_ALLOC_FAIL; r = SSH_ERR_ALLOC_FAIL;
break;
} }
if (!hostfile_read_key(&cp, &kbits, if (!hostfile_read_key(&cp, &kbits,
lineinfo.key)) lineinfo.key))
@ -766,9 +799,43 @@ hostkeys_foreach(const char *path, hostkeys_foreach_fn *callback, void *ctx,
goto bad; goto bad;
#endif #endif
} }
if (!hostfile_check_key(kbits, lineinfo.key, host, lineinfo.keytype = lineinfo.key->type;
path, linenum)) { lineinfo.comment = cp;
} else {
/* Extract and parse key type */
l = strcspn(lineinfo.rawkey, " \t");
if (l <= 1 || l >= sizeof(ktype) ||
lineinfo.rawkey[l] == '\0')
goto bad;
memcpy(ktype, lineinfo.rawkey, l);
ktype[l] = '\0';
lineinfo.keytype = sshkey_type_from_name(ktype);
#ifdef WITH_SSH1
/*
* Assume RSA1 if the first component is a short
* decimal number.
*/
if (lineinfo.keytype == KEY_UNSPEC && l < 8 &&
strspn(ktype, "0123456789") == l)
lineinfo.keytype = KEY_RSA1;
#endif
/*
* Check that something other than whitespace follows
* the key type. This won't catch all corruption, but
* it does catch trivial truncation.
*/
cp2 += l; /* Skip past key type */
for (; *cp2 == ' ' || *cp2 == '\t'; cp2++)
;
if (*cp2 == '\0' || *cp2 == '#') {
debug2("%s:%ld: truncated after key type",
path, linenum);
lineinfo.keytype = KEY_UNSPEC;
}
if (lineinfo.keytype == KEY_UNSPEC) {
bad: bad:
sshkey_free(lineinfo.key);
lineinfo.key = NULL;
lineinfo.status = HKF_STATUS_INVALID; lineinfo.status = HKF_STATUS_INVALID;
if ((r = callback(&lineinfo, ctx)) != 0) if ((r = callback(&lineinfo, ctx)) != 0)
break; break;

31
hostfile.h
View File

@ -1,4 +1,4 @@
/* $OpenBSD: hostfile.h,v 1.23 2015/01/26 03:04:45 djm Exp $ */ /* $OpenBSD: hostfile.h,v 1.24 2015/02/16 22:08:57 djm Exp $ */
/* /*
* Author: Tatu Ylonen <ylo@cs.hut.fi> * Author: Tatu Ylonen <ylo@cs.hut.fi>
@ -44,8 +44,9 @@ int hostfile_read_key(char **, u_int *, struct sshkey *);
int add_host_to_hostfile(const char *, const char *, int add_host_to_hostfile(const char *, const char *,
const struct sshkey *, int); const struct sshkey *, int);
int hostfile_replace_entries(const char *filename, const char *host, int hostfile_replace_entries(const char *filename,
struct sshkey **keys, size_t nkeys, int store_hash, int quiet); const char *host, const char *ip, struct sshkey **keys, size_t nkeys,
int store_hash, int quiet, int hash_alg);
#define HASH_MAGIC "|1|" #define HASH_MAGIC "|1|"
#define HASH_DELIM '|' #define HASH_DELIM '|'
@ -60,13 +61,19 @@ char *host_hash(const char *, const char *, u_int);
* hostnames. Allows access to the raw keyfile lines to allow * hostnames. Allows access to the raw keyfile lines to allow
* streaming edits to the file to take place. * streaming edits to the file to take place.
*/ */
#define HKF_WANT_MATCH_HOST (1) /* return only matching hosts */ #define HKF_WANT_MATCH (1) /* return only matching hosts/addrs */
#define HKF_WANT_PARSE_KEY (1<<1) /* need key parsed */ #define HKF_WANT_PARSE_KEY (1<<1) /* need key parsed */
#define HKF_STATUS_OK 1 /* Line parsed, didn't match host */ #define HKF_STATUS_OK 0 /* Line parsed, didn't match host */
#define HKF_STATUS_INVALID 2 /* line had parse error */ #define HKF_STATUS_INVALID 1 /* line had parse error */
#define HKF_STATUS_COMMENT 3 /* valid line contained no key */ #define HKF_STATUS_COMMENT 2 /* valid line contained no key */
#define HKF_STATUS_HOST_MATCHED 4 /* hostname matched */ #define HKF_STATUS_MATCHED 3 /* hostname or IP matched */
#define HKF_MATCH_HOST (1) /* hostname matched */
#define HKF_MATCH_IP (1<<1) /* address matched */
#define HKF_MATCH_HOST_HASHED (1<<2) /* hostname was hashed */
#define HKF_MATCH_IP_HASHED (1<<3) /* address was hashed */
/* XXX HKF_MATCH_KEY_TYPE? */
/* /*
* The callback function receives this as an argument for each matching * The callback function receives this as an argument for each matching
@ -76,12 +83,13 @@ char *host_hash(const char *, const char *, u_int);
struct hostkey_foreach_line { struct hostkey_foreach_line {
const char *path; /* Path of file */ const char *path; /* Path of file */
u_long linenum; /* Line number */ u_long linenum; /* Line number */
int status; /* One of HKF_STATUS_* */ u_int status; /* One of HKF_STATUS_* */
u_int match; /* Zero or more of HKF_MATCH_* OR'd together */
char *line; /* Entire key line; mutable by callback */ char *line; /* Entire key line; mutable by callback */
int marker; /* CA/revocation markers; indicated by MRK_* value */ int marker; /* CA/revocation markers; indicated by MRK_* value */
const char *hosts; /* Raw hosts text, may be hashed or list multiple */ const char *hosts; /* Raw hosts text, may be hashed or list multiple */
int was_hashed; /* Non-zero if hostname was hashed */
const char *rawkey; /* Text of key and any comment following it */ const char *rawkey; /* Text of key and any comment following it */
int keytype; /* Type of key; KEY_UNSPEC for invalid/comment lines */
struct sshkey *key; /* Key, if parsed ok and HKF_WANT_MATCH_HOST set */ struct sshkey *key; /* Key, if parsed ok and HKF_WANT_MATCH_HOST set */
const char *comment; /* Any comment following the key */ const char *comment; /* Any comment following the key */
}; };
@ -93,7 +101,8 @@ struct hostkey_foreach_line {
*/ */
typedef int hostkeys_foreach_fn(struct hostkey_foreach_line *l, void *ctx); typedef int hostkeys_foreach_fn(struct hostkey_foreach_line *l, void *ctx);
/* Iterate over a hostkeys file */
int hostkeys_foreach(const char *path, hostkeys_foreach_fn *callback, void *ctx, int hostkeys_foreach(const char *path, hostkeys_foreach_fn *callback, void *ctx,
const char *host, u_int options); const char *host, const char *ip, u_int options);
#endif #endif

35
ssh-keygen.c
View File

@ -1,4 +1,4 @@
/* $OpenBSD: ssh-keygen.c,v 1.261 2015/01/30 01:10:33 djm Exp $ */ /* $OpenBSD: ssh-keygen.c,v 1.262 2015/02/16 22:08:57 djm Exp $ */
/* /*
* Author: Tatu Ylonen <ylo@cs.hut.fi> * Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1994 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland * Copyright (c) 1994 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@ -1052,19 +1052,15 @@ known_hosts_hash(struct hostkey_foreach_line *l, void *_ctx)
char *hashed, *cp, *hosts, *ohosts; char *hashed, *cp, *hosts, *ohosts;
int has_wild = l->hosts && strcspn(l->hosts, "*?!") != strlen(l->hosts); int has_wild = l->hosts && strcspn(l->hosts, "*?!") != strlen(l->hosts);
/* Retain invalid lines when hashing, but mark file as invalid. */ switch (l->status) {
if (l->status == HKF_STATUS_INVALID) { case HKF_STATUS_OK:
ctx->invalid = 1; case HKF_STATUS_MATCHED:
fprintf(stderr, "%s:%ld: invalid line\n", l->path, l->linenum);
fprintf(ctx->out, "%s\n", l->line);
return 0;
}
/* /*
* Don't hash hosts already already hashed, with wildcard characters * Don't hash hosts already already hashed, with wildcard
* or a CA/revocation marker. * characters or a CA/revocation marker.
*/ */
if (l->was_hashed || has_wild || l->marker != MRK_NONE) { if ((l->match & HKF_MATCH_HOST_HASHED) != 0 ||
has_wild || l->marker != MRK_NONE) {
fprintf(ctx->out, "%s\n", l->line); fprintf(ctx->out, "%s\n", l->line);
if (has_wild && !find_host) { if (has_wild && !find_host) {
fprintf(stderr, "%s:%ld: ignoring host name " fprintf(stderr, "%s:%ld: ignoring host name "
@ -1086,6 +1082,17 @@ known_hosts_hash(struct hostkey_foreach_line *l, void *_ctx)
} }
free(ohosts); free(ohosts);
return 0; return 0;
case HKF_STATUS_INVALID:
/* Retain invalid lines, but mark file as invalid. */
ctx->invalid = 1;
fprintf(stderr, "%s:%ld: invalid line\n", l->path, l->linenum);
/* FALLTHROUGH */
default:
fprintf(ctx->out, "%s\n", l->line);
return 0;
}
/* NOTREACHED */
return -1;
} }
static int static int
@ -1093,7 +1100,7 @@ known_hosts_find_delete(struct hostkey_foreach_line *l, void *_ctx)
{ {
struct known_hosts_ctx *ctx = (struct known_hosts_ctx *)_ctx; struct known_hosts_ctx *ctx = (struct known_hosts_ctx *)_ctx;
if (l->status == HKF_STATUS_HOST_MATCHED) { if (l->status == HKF_STATUS_MATCHED) {
if (delete_host) { if (delete_host) {
if (l->marker != MRK_NONE) { if (l->marker != MRK_NONE) {
/* Don't remove CA and revocation lines */ /* Don't remove CA and revocation lines */
@ -1180,7 +1187,7 @@ do_known_hosts(struct passwd *pw, const char *name)
/* XXX support identity_file == "-" for stdin */ /* XXX support identity_file == "-" for stdin */
if ((r = hostkeys_foreach(identity_file, if ((r = hostkeys_foreach(identity_file,
hash_hosts ? known_hosts_hash : known_hosts_find_delete, &ctx, hash_hosts ? known_hosts_hash : known_hosts_find_delete, &ctx,
name, find_host ? HKF_WANT_MATCH_HOST : 0)) != 0) name, NULL, find_host ? HKF_WANT_MATCH : 0)) != 0)
fatal("%s: hostkeys_foreach failed: %s", __func__, ssh_err(r)); fatal("%s: hostkeys_foreach failed: %s", __func__, ssh_err(r));
if (inplace) if (inplace)