xref: /openbsd-src/usr.bin/ssh/dns.c (revision a28daedfc357b214be5c701aa8ba8adb29a7f1c2)
1 /* $OpenBSD: dns.c,v 1.25 2008/06/12 00:03:49 dtucker Exp $ */
2 
3 /*
4  * Copyright (c) 2003 Wesley Griffin. All rights reserved.
5  * Copyright (c) 2003 Jakob Schlyter. All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  *
16  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
17  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
18  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
19  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
20  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
21  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
22  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
23  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
24  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
25  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
26  */
27 
28 #include <sys/types.h>
29 #include <sys/socket.h>
30 
31 #include <netdb.h>
32 #include <stdio.h>
33 #include <string.h>
34 
35 #include "xmalloc.h"
36 #include "key.h"
37 #include "dns.h"
38 #include "log.h"
39 
40 static const char *errset_text[] = {
41 	"success",		/* 0 ERRSET_SUCCESS */
42 	"out of memory",	/* 1 ERRSET_NOMEMORY */
43 	"general failure",	/* 2 ERRSET_FAIL */
44 	"invalid parameter",	/* 3 ERRSET_INVAL */
45 	"name does not exist",	/* 4 ERRSET_NONAME */
46 	"data does not exist",	/* 5 ERRSET_NODATA */
47 };
48 
49 static const char *
50 dns_result_totext(unsigned int res)
51 {
52 	switch (res) {
53 	case ERRSET_SUCCESS:
54 		return errset_text[ERRSET_SUCCESS];
55 	case ERRSET_NOMEMORY:
56 		return errset_text[ERRSET_NOMEMORY];
57 	case ERRSET_FAIL:
58 		return errset_text[ERRSET_FAIL];
59 	case ERRSET_INVAL:
60 		return errset_text[ERRSET_INVAL];
61 	case ERRSET_NONAME:
62 		return errset_text[ERRSET_NONAME];
63 	case ERRSET_NODATA:
64 		return errset_text[ERRSET_NODATA];
65 	default:
66 		return "unknown error";
67 	}
68 }
69 
70 /*
71  * Read SSHFP parameters from key buffer.
72  */
73 static int
74 dns_read_key(u_int8_t *algorithm, u_int8_t *digest_type,
75     u_char **digest, u_int *digest_len, const Key *key)
76 {
77 	int success = 0;
78 
79 	switch (key->type) {
80 	case KEY_RSA:
81 		*algorithm = SSHFP_KEY_RSA;
82 		break;
83 	case KEY_DSA:
84 		*algorithm = SSHFP_KEY_DSA;
85 		break;
86 	default:
87 		*algorithm = SSHFP_KEY_RESERVED; /* 0 */
88 	}
89 
90 	if (*algorithm) {
91 		*digest_type = SSHFP_HASH_SHA1;
92 		*digest = key_fingerprint_raw(key, SSH_FP_SHA1, digest_len);
93 		if (*digest == NULL)
94 			fatal("dns_read_key: null from key_fingerprint_raw()");
95 		success = 1;
96 	} else {
97 		*digest_type = SSHFP_HASH_RESERVED;
98 		*digest = NULL;
99 		*digest_len = 0;
100 		success = 0;
101 	}
102 
103 	return success;
104 }
105 
106 /*
107  * Read SSHFP parameters from rdata buffer.
108  */
109 static int
110 dns_read_rdata(u_int8_t *algorithm, u_int8_t *digest_type,
111     u_char **digest, u_int *digest_len, u_char *rdata, int rdata_len)
112 {
113 	int success = 0;
114 
115 	*algorithm = SSHFP_KEY_RESERVED;
116 	*digest_type = SSHFP_HASH_RESERVED;
117 
118 	if (rdata_len >= 2) {
119 		*algorithm = rdata[0];
120 		*digest_type = rdata[1];
121 		*digest_len = rdata_len - 2;
122 
123 		if (*digest_len > 0) {
124 			*digest = (u_char *) xmalloc(*digest_len);
125 			memcpy(*digest, rdata + 2, *digest_len);
126 		} else {
127 			*digest = (u_char *)xstrdup("");
128 		}
129 
130 		success = 1;
131 	}
132 
133 	return success;
134 }
135 
136 /*
137  * Check if hostname is numerical.
138  * Returns -1 if hostname is numeric, 0 otherwise
139  */
140 static int
141 is_numeric_hostname(const char *hostname)
142 {
143 	struct addrinfo hints, *ai;
144 
145 	/*
146 	 * We shouldn't ever get a null host but if we do then log an error
147 	 * and return -1 which stops DNS key fingerprint processing.
148 	 */
149 	if (hostname == NULL) {
150 		error("is_numeric_hostname called with NULL hostname");
151 		return -1;
152 	}
153 
154 	memset(&hints, 0, sizeof(hints));
155 	hints.ai_socktype = SOCK_DGRAM;
156 	hints.ai_flags = AI_NUMERICHOST;
157 
158 	if (getaddrinfo(hostname, NULL, &hints, &ai) == 0) {
159 		freeaddrinfo(ai);
160 		return -1;
161 	}
162 
163 	return 0;
164 }
165 
166 /*
167  * Verify the given hostname, address and host key using DNS.
168  * Returns 0 if lookup succeeds, -1 otherwise
169  */
170 int
171 verify_host_key_dns(const char *hostname, struct sockaddr *address,
172     const Key *hostkey, int *flags)
173 {
174 	u_int counter;
175 	int result;
176 	struct rrsetinfo *fingerprints = NULL;
177 
178 	u_int8_t hostkey_algorithm;
179 	u_int8_t hostkey_digest_type;
180 	u_char *hostkey_digest;
181 	u_int hostkey_digest_len;
182 
183 	u_int8_t dnskey_algorithm;
184 	u_int8_t dnskey_digest_type;
185 	u_char *dnskey_digest;
186 	u_int dnskey_digest_len;
187 
188 	*flags = 0;
189 
190 	debug3("verify_host_key_dns");
191 	if (hostkey == NULL)
192 		fatal("No key to look up!");
193 
194 	if (is_numeric_hostname(hostname)) {
195 		debug("skipped DNS lookup for numerical hostname");
196 		return -1;
197 	}
198 
199 	result = getrrsetbyname(hostname, DNS_RDATACLASS_IN,
200 	    DNS_RDATATYPE_SSHFP, 0, &fingerprints);
201 	if (result) {
202 		verbose("DNS lookup error: %s", dns_result_totext(result));
203 		return -1;
204 	}
205 
206 	if (fingerprints->rri_flags & RRSET_VALIDATED) {
207 		*flags |= DNS_VERIFY_SECURE;
208 		debug("found %d secure fingerprints in DNS",
209 		    fingerprints->rri_nrdatas);
210 	} else {
211 		debug("found %d insecure fingerprints in DNS",
212 		    fingerprints->rri_nrdatas);
213 	}
214 
215 	/* Initialize host key parameters */
216 	if (!dns_read_key(&hostkey_algorithm, &hostkey_digest_type,
217 	    &hostkey_digest, &hostkey_digest_len, hostkey)) {
218 		error("Error calculating host key fingerprint.");
219 		freerrset(fingerprints);
220 		return -1;
221 	}
222 
223 	if (fingerprints->rri_nrdatas)
224 		*flags |= DNS_VERIFY_FOUND;
225 
226 	for (counter = 0; counter < fingerprints->rri_nrdatas; counter++) {
227 		/*
228 		 * Extract the key from the answer. Ignore any badly
229 		 * formatted fingerprints.
230 		 */
231 		if (!dns_read_rdata(&dnskey_algorithm, &dnskey_digest_type,
232 		    &dnskey_digest, &dnskey_digest_len,
233 		    fingerprints->rri_rdatas[counter].rdi_data,
234 		    fingerprints->rri_rdatas[counter].rdi_length)) {
235 			verbose("Error parsing fingerprint from DNS.");
236 			continue;
237 		}
238 
239 		/* Check if the current key is the same as the given key */
240 		if (hostkey_algorithm == dnskey_algorithm &&
241 		    hostkey_digest_type == dnskey_digest_type) {
242 
243 			if (hostkey_digest_len == dnskey_digest_len &&
244 			    memcmp(hostkey_digest, dnskey_digest,
245 			    hostkey_digest_len) == 0) {
246 
247 				*flags |= DNS_VERIFY_MATCH;
248 			}
249 		}
250 		xfree(dnskey_digest);
251 	}
252 
253 	xfree(hostkey_digest); /* from key_fingerprint_raw() */
254 	freerrset(fingerprints);
255 
256 	if (*flags & DNS_VERIFY_FOUND)
257 		if (*flags & DNS_VERIFY_MATCH)
258 			debug("matching host key fingerprint found in DNS");
259 		else
260 			debug("mismatching host key fingerprint found in DNS");
261 	else
262 		debug("no host key fingerprint found in DNS");
263 
264 	return 0;
265 }
266 
267 /*
268  * Export the fingerprint of a key as a DNS resource record
269  */
270 int
271 export_dns_rr(const char *hostname, const Key *key, FILE *f, int generic)
272 {
273 	u_int8_t rdata_pubkey_algorithm = 0;
274 	u_int8_t rdata_digest_type = SSHFP_HASH_SHA1;
275 	u_char *rdata_digest;
276 	u_int rdata_digest_len;
277 
278 	u_int i;
279 	int success = 0;
280 
281 	if (dns_read_key(&rdata_pubkey_algorithm, &rdata_digest_type,
282 	    &rdata_digest, &rdata_digest_len, key)) {
283 
284 		if (generic)
285 			fprintf(f, "%s IN TYPE%d \\# %d %02x %02x ", hostname,
286 			    DNS_RDATATYPE_SSHFP, 2 + rdata_digest_len,
287 			    rdata_pubkey_algorithm, rdata_digest_type);
288 		else
289 			fprintf(f, "%s IN SSHFP %d %d ", hostname,
290 			    rdata_pubkey_algorithm, rdata_digest_type);
291 
292 		for (i = 0; i < rdata_digest_len; i++)
293 			fprintf(f, "%02x", rdata_digest[i]);
294 		fprintf(f, "\n");
295 		xfree(rdata_digest); /* from key_fingerprint_raw() */
296 		success = 1;
297 	} else {
298 		error("export_dns_rr: unsupported algorithm");
299 	}
300 
301 	return success;
302 }
303