+/* $OpenBSD: ssh-keyscan.c,v 1.76 2008/04/30 10:14:03 djm Exp $ */
/*
* Copyright 1995, 1996 by David Mazieres <dm@lcs.mit.edu>.
*
*/
#include "includes.h"
-RCSID("$OpenBSD: ssh-keyscan.c,v 1.52 2005/03/01 15:47:14 jmc Exp $");
-
+
#include "openbsd-compat/sys-queue.h"
+#include <sys/resource.h>
+#ifdef HAVE_SYS_TIME_H
+# include <sys/time.h>
+#endif
+
+#include <netinet/in.h>
+#include <arpa/inet.h>
#include <openssl/bn.h>
+#include <netdb.h>
+#include <errno.h>
#include <setjmp.h>
+#include <stdarg.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <signal.h>
+#include <string.h>
+#include <unistd.h>
+
#include "xmalloc.h"
#include "ssh.h"
#include "ssh1.h"
+#include "buffer.h"
#include "key.h"
+#include "cipher.h"
#include "kex.h"
#include "compat.h"
#include "myproposal.h"
#include "packet.h"
#include "dispatch.h"
-#include "buffer.h"
-#include "bufaux.h"
#include "log.h"
#include "atomicio.h"
#include "misc.h"
#define KT_DSA 2
#define KT_RSA 4
-int get_keytypes = KT_RSA1; /* Get only RSA1 keys by default */
+int get_keytypes = KT_RSA; /* Get only RSA keys by default */
int hash_hosts = 0; /* Hash hostname on output */
extern char *__progname;
fd_set *read_wait;
-size_t read_wait_size;
+size_t read_wait_nfdset;
int ncon;
int nonfatal_fatal = 0;
jmp_buf kexjmp;
lb->stream = stdin;
}
- if (!(lb->buf = malloc(lb->size = LINEBUF_SIZE))) {
+ if (!(lb->buf = malloc((lb->size = LINEBUF_SIZE)))) {
if (errfun)
(*errfun) ("linebuf (%s): malloc failed\n", lb->filename);
xfree(lb);
static char *
Linebuf_getline(Linebuf * lb)
{
- int n = 0;
+ size_t n = 0;
void *p;
lb->lineno++;
c->c_kex->kex[KEX_DH_GRP1_SHA1] = kexdh_client;
c->c_kex->kex[KEX_DH_GRP14_SHA1] = kexdh_client;
c->c_kex->kex[KEX_DH_GEX_SHA1] = kexgex_client;
+ c->c_kex->kex[KEX_DH_GEX_SHA256] = kexgex_client;
c->c_kex->verify_host_key = hostjump;
if (!(j = setjmp(kexjmp))) {
hints.ai_family = IPv4or6;
hints.ai_socktype = SOCK_STREAM;
if ((gaierr = getaddrinfo(host, strport, &hints, &aitop)) != 0)
- fatal("getaddrinfo %s: %s", host, gai_strerror(gaierr));
+ fatal("getaddrinfo %s: %s", host, ssh_gai_strerror(gaierr));
for (ai = aitop; ai; ai = ai->ai_next) {
s = socket(ai->ai_family, ai->ai_socktype, ai->ai_protocol);
if (s < 0) {
static void
congreet(int s)
{
- int remote_major = 0, remote_minor = 0, n = 0;
+ int n = 0, remote_major = 0, remote_minor = 0;
char buf[256], *cp;
char remote_version[sizeof buf];
size_t bufsiz;
con *c = &fdcon[s];
- bufsiz = sizeof(buf);
- cp = buf;
- while (bufsiz-- && (n = atomicio(read, s, cp, 1)) == 1 && *cp != '\n') {
- if (*cp == '\r')
- *cp = '\n';
- cp++;
- }
- if (n < 0) {
- if (errno != ECONNREFUSED)
- error("read (%s): %s", c->c_name, strerror(errno));
- conrecycle(s);
- return;
+ for (;;) {
+ memset(buf, '\0', sizeof(buf));
+ bufsiz = sizeof(buf);
+ cp = buf;
+ while (bufsiz-- &&
+ (n = atomicio(read, s, cp, 1)) == 1 && *cp != '\n') {
+ if (*cp == '\r')
+ *cp = '\n';
+ cp++;
+ }
+ if (n != 1 || strncmp(buf, "SSH-", 4) == 0)
+ break;
}
if (n == 0) {
- error("%s: Connection closed by remote host", c->c_name);
+ switch (errno) {
+ case EPIPE:
+ error("%s: Connection closed by remote host", c->c_name);
+ break;
+ case ECONNREFUSED:
+ break;
+ default:
+ error("read (%s): %s", c->c_name, strerror(errno));
+ break;
+ }
conrecycle(s);
return;
}
n = snprintf(buf, sizeof buf, "SSH-%d.%d-OpenSSH-keyscan\r\n",
c->c_keytype == KT_RSA1? PROTOCOL_MAJOR_1 : PROTOCOL_MAJOR_2,
c->c_keytype == KT_RSA1? PROTOCOL_MINOR_1 : PROTOCOL_MINOR_2);
- if (atomicio(vwrite, s, buf, n) != n) {
+ if (n < 0 || (size_t)n >= sizeof(buf)) {
+ error("snprintf: buffer too small");
+ confree(s);
+ return;
+ }
+ if (atomicio(vwrite, s, buf, n) != (size_t)n) {
error("write (%s): %s", c->c_name, strerror(errno));
confree(s);
return;
conread(int s)
{
con *c = &fdcon[s];
- int n;
+ size_t n;
if (c->c_status == CS_CON) {
congreet(s);
return;
}
n = atomicio(read, s, c->c_data + c->c_off, c->c_len - c->c_off);
- if (n < 0) {
+ if (n == 0) {
error("read (%s): %s", c->c_name, strerror(errno));
confree(s);
return;
keyprint(c, keygrab_ssh1(c));
confree(s);
return;
- break;
default:
fatal("conread: invalid status %d", c->c_status);
break;
} else
seltime.tv_sec = seltime.tv_usec = 0;
- r = xmalloc(read_wait_size);
- memcpy(r, read_wait, read_wait_size);
- e = xmalloc(read_wait_size);
- memcpy(e, read_wait, read_wait_size);
+ r = xcalloc(read_wait_nfdset, sizeof(fd_mask));
+ e = xcalloc(read_wait_nfdset, sizeof(fd_mask));
+ memcpy(r, read_wait, read_wait_nfdset * sizeof(fd_mask));
+ memcpy(e, read_wait, read_wait_nfdset * sizeof(fd_mask));
while (select(maxfd, r, NULL, e, &seltime) == -1 &&
(errno == EAGAIN || errno == EINTR))
seed_rng();
TAILQ_INIT(&tq);
+ /* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */
+ sanitise_stdfd();
+
if (argc <= 1)
usage();
fatal("%s: not enough file descriptors", __progname);
if (maxfd > fdlim_get(0))
fdlim_set(maxfd);
- fdcon = xmalloc(maxfd * sizeof(con));
- memset(fdcon, 0, maxfd * sizeof(con));
+ fdcon = xcalloc(maxfd, sizeof(con));
- read_wait_size = howmany(maxfd, NFDBITS) * sizeof(fd_mask);
- read_wait = xmalloc(read_wait_size);
- memset(read_wait, 0, read_wait_size);
+ read_wait_nfdset = howmany(maxfd, NFDBITS);
+ read_wait = xcalloc(read_wait_nfdset, sizeof(fd_mask));
if (fopt_count) {
Linebuf *lb;