xref: /freebsd/crypto/openssh/dns.c (revision 7aa383846770374466b1dcb2cefd71bde9acf463)
1 /* $OpenBSD: dns.c,v 1.26 2010/02/26 20:29:54 djm Exp $ */
2 
3 /*
4  * Copyright (c) 2003 Wesley Griffin. All rights reserved.
5  * Copyright (c) 2003 Jakob Schlyter. All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  *
16  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
17  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
18  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
19  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
20  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
21  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
22  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
23  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
24  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
25  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
26  */
27 
28 #include "includes.h"
29 
30 #include <sys/types.h>
31 #include <sys/socket.h>
32 
33 #include <netdb.h>
34 #include <stdarg.h>
35 #include <stdio.h>
36 #include <string.h>
37 
38 #include "xmalloc.h"
39 #include "key.h"
40 #include "dns.h"
41 #include "log.h"
42 
43 static const char *errset_text[] = {
44 	"success",		/* 0 ERRSET_SUCCESS */
45 	"out of memory",	/* 1 ERRSET_NOMEMORY */
46 	"general failure",	/* 2 ERRSET_FAIL */
47 	"invalid parameter",	/* 3 ERRSET_INVAL */
48 	"name does not exist",	/* 4 ERRSET_NONAME */
49 	"data does not exist",	/* 5 ERRSET_NODATA */
50 };
51 
52 static const char *
53 dns_result_totext(unsigned int res)
54 {
55 	switch (res) {
56 	case ERRSET_SUCCESS:
57 		return errset_text[ERRSET_SUCCESS];
58 	case ERRSET_NOMEMORY:
59 		return errset_text[ERRSET_NOMEMORY];
60 	case ERRSET_FAIL:
61 		return errset_text[ERRSET_FAIL];
62 	case ERRSET_INVAL:
63 		return errset_text[ERRSET_INVAL];
64 	case ERRSET_NONAME:
65 		return errset_text[ERRSET_NONAME];
66 	case ERRSET_NODATA:
67 		return errset_text[ERRSET_NODATA];
68 	default:
69 		return "unknown error";
70 	}
71 }
72 
73 /*
74  * Read SSHFP parameters from key buffer.
75  */
76 static int
77 dns_read_key(u_int8_t *algorithm, u_int8_t *digest_type,
78     u_char **digest, u_int *digest_len, Key *key)
79 {
80 	int success = 0;
81 
82 	switch (key->type) {
83 	case KEY_RSA:
84 		*algorithm = SSHFP_KEY_RSA;
85 		break;
86 	case KEY_DSA:
87 		*algorithm = SSHFP_KEY_DSA;
88 		break;
89 	default:
90 		*algorithm = SSHFP_KEY_RESERVED; /* 0 */
91 	}
92 
93 	if (*algorithm) {
94 		*digest_type = SSHFP_HASH_SHA1;
95 		*digest = key_fingerprint_raw(key, SSH_FP_SHA1, digest_len);
96 		if (*digest == NULL)
97 			fatal("dns_read_key: null from key_fingerprint_raw()");
98 		success = 1;
99 	} else {
100 		*digest_type = SSHFP_HASH_RESERVED;
101 		*digest = NULL;
102 		*digest_len = 0;
103 		success = 0;
104 	}
105 
106 	return success;
107 }
108 
109 /*
110  * Read SSHFP parameters from rdata buffer.
111  */
112 static int
113 dns_read_rdata(u_int8_t *algorithm, u_int8_t *digest_type,
114     u_char **digest, u_int *digest_len, u_char *rdata, int rdata_len)
115 {
116 	int success = 0;
117 
118 	*algorithm = SSHFP_KEY_RESERVED;
119 	*digest_type = SSHFP_HASH_RESERVED;
120 
121 	if (rdata_len >= 2) {
122 		*algorithm = rdata[0];
123 		*digest_type = rdata[1];
124 		*digest_len = rdata_len - 2;
125 
126 		if (*digest_len > 0) {
127 			*digest = (u_char *) xmalloc(*digest_len);
128 			memcpy(*digest, rdata + 2, *digest_len);
129 		} else {
130 			*digest = (u_char *)xstrdup("");
131 		}
132 
133 		success = 1;
134 	}
135 
136 	return success;
137 }
138 
139 /*
140  * Check if hostname is numerical.
141  * Returns -1 if hostname is numeric, 0 otherwise
142  */
143 static int
144 is_numeric_hostname(const char *hostname)
145 {
146 	struct addrinfo hints, *ai;
147 
148 	/*
149 	 * We shouldn't ever get a null host but if we do then log an error
150 	 * and return -1 which stops DNS key fingerprint processing.
151 	 */
152 	if (hostname == NULL) {
153 		error("is_numeric_hostname called with NULL hostname");
154 		return -1;
155 	}
156 
157 	memset(&hints, 0, sizeof(hints));
158 	hints.ai_socktype = SOCK_DGRAM;
159 	hints.ai_flags = AI_NUMERICHOST;
160 
161 	if (getaddrinfo(hostname, NULL, &hints, &ai) == 0) {
162 		freeaddrinfo(ai);
163 		return -1;
164 	}
165 
166 	return 0;
167 }
168 
169 /*
170  * Verify the given hostname, address and host key using DNS.
171  * Returns 0 if lookup succeeds, -1 otherwise
172  */
173 int
174 verify_host_key_dns(const char *hostname, struct sockaddr *address,
175     Key *hostkey, int *flags)
176 {
177 	u_int counter;
178 	int result;
179 	struct rrsetinfo *fingerprints = NULL;
180 
181 	u_int8_t hostkey_algorithm;
182 	u_int8_t hostkey_digest_type;
183 	u_char *hostkey_digest;
184 	u_int hostkey_digest_len;
185 
186 	u_int8_t dnskey_algorithm;
187 	u_int8_t dnskey_digest_type;
188 	u_char *dnskey_digest;
189 	u_int dnskey_digest_len;
190 
191 	*flags = 0;
192 
193 	debug3("verify_host_key_dns");
194 	if (hostkey == NULL)
195 		fatal("No key to look up!");
196 
197 	if (is_numeric_hostname(hostname)) {
198 		debug("skipped DNS lookup for numerical hostname");
199 		return -1;
200 	}
201 
202 	result = getrrsetbyname(hostname, DNS_RDATACLASS_IN,
203 	    DNS_RDATATYPE_SSHFP, 0, &fingerprints);
204 	if (result) {
205 		verbose("DNS lookup error: %s", dns_result_totext(result));
206 		return -1;
207 	}
208 
209 	if (fingerprints->rri_flags & RRSET_VALIDATED) {
210 		*flags |= DNS_VERIFY_SECURE;
211 		debug("found %d secure fingerprints in DNS",
212 		    fingerprints->rri_nrdatas);
213 	} else {
214 		debug("found %d insecure fingerprints in DNS",
215 		    fingerprints->rri_nrdatas);
216 	}
217 
218 	/* Initialize host key parameters */
219 	if (!dns_read_key(&hostkey_algorithm, &hostkey_digest_type,
220 	    &hostkey_digest, &hostkey_digest_len, hostkey)) {
221 		error("Error calculating host key fingerprint.");
222 		freerrset(fingerprints);
223 		return -1;
224 	}
225 
226 	if (fingerprints->rri_nrdatas)
227 		*flags |= DNS_VERIFY_FOUND;
228 
229 	for (counter = 0; counter < fingerprints->rri_nrdatas; counter++) {
230 		/*
231 		 * Extract the key from the answer. Ignore any badly
232 		 * formatted fingerprints.
233 		 */
234 		if (!dns_read_rdata(&dnskey_algorithm, &dnskey_digest_type,
235 		    &dnskey_digest, &dnskey_digest_len,
236 		    fingerprints->rri_rdatas[counter].rdi_data,
237 		    fingerprints->rri_rdatas[counter].rdi_length)) {
238 			verbose("Error parsing fingerprint from DNS.");
239 			continue;
240 		}
241 
242 		/* Check if the current key is the same as the given key */
243 		if (hostkey_algorithm == dnskey_algorithm &&
244 		    hostkey_digest_type == dnskey_digest_type) {
245 
246 			if (hostkey_digest_len == dnskey_digest_len &&
247 			    memcmp(hostkey_digest, dnskey_digest,
248 			    hostkey_digest_len) == 0) {
249 
250 				*flags |= DNS_VERIFY_MATCH;
251 			}
252 		}
253 		xfree(dnskey_digest);
254 	}
255 
256 	xfree(hostkey_digest); /* from key_fingerprint_raw() */
257 	freerrset(fingerprints);
258 
259 	if (*flags & DNS_VERIFY_FOUND)
260 		if (*flags & DNS_VERIFY_MATCH)
261 			debug("matching host key fingerprint found in DNS");
262 		else
263 			debug("mismatching host key fingerprint found in DNS");
264 	else
265 		debug("no host key fingerprint found in DNS");
266 
267 	return 0;
268 }
269 
270 /*
271  * Export the fingerprint of a key as a DNS resource record
272  */
273 int
274 export_dns_rr(const char *hostname, Key *key, FILE *f, int generic)
275 {
276 	u_int8_t rdata_pubkey_algorithm = 0;
277 	u_int8_t rdata_digest_type = SSHFP_HASH_SHA1;
278 	u_char *rdata_digest;
279 	u_int rdata_digest_len;
280 
281 	u_int i;
282 	int success = 0;
283 
284 	if (dns_read_key(&rdata_pubkey_algorithm, &rdata_digest_type,
285 	    &rdata_digest, &rdata_digest_len, key)) {
286 
287 		if (generic)
288 			fprintf(f, "%s IN TYPE%d \\# %d %02x %02x ", hostname,
289 			    DNS_RDATATYPE_SSHFP, 2 + rdata_digest_len,
290 			    rdata_pubkey_algorithm, rdata_digest_type);
291 		else
292 			fprintf(f, "%s IN SSHFP %d %d ", hostname,
293 			    rdata_pubkey_algorithm, rdata_digest_type);
294 
295 		for (i = 0; i < rdata_digest_len; i++)
296 			fprintf(f, "%02x", rdata_digest[i]);
297 		fprintf(f, "\n");
298 		xfree(rdata_digest); /* from key_fingerprint_raw() */
299 		success = 1;
300 	} else {
301 		error("export_dns_rr: unsupported algorithm");
302 	}
303 
304 	return success;
305 }
306