knownhosts: Add ssh_session_export_known_hosts_entry()

Signed-off-by: Andreas Schneider <asn@cryptomilk.org>

include/libssh/libssh.h

@@ -538,6 +538,9 @@ LIBSSH_API int ssh_known_hosts_parse_line(const char *host,
                                           struct ssh_knownhosts_entry **entry);
 LIBSSH_API enum ssh_known_hosts_e ssh_session_has_known_hosts_entry(ssh_session session);
 
+LIBSSH_API int ssh_session_export_known_hosts_entry(ssh_session session,
+                                                    char **pentry_string);
+
 /* LOGGING */
 LIBSSH_API int ssh_set_log_level(int level);
 LIBSSH_API int ssh_get_log_level(void);

src/knownhosts.c

@@ -36,6 +36,7 @@
 #include "libssh/options.h"
 #include "libssh/misc.h"
 #include "libssh/pki.h"
+#include "libssh/dh.h"
 
 static int hash_hostname(const char *name,
                          unsigned char *salt,
@@ -471,3 +472,91 @@ enum ssh_known_hosts_e ssh_session_has_known_hosts_entry(ssh_session session)
 
     return SSH_KNOWN_HOSTS_OK;
 }
+
+/**
+ * @brief Export the current session information to a known_hosts string.
+ *
+ * This exports the current information of a session which is connected so a
+ * ssh server into an entry line which can be added to a known_hosts file.
+ *
+ * @param[in]  session  The session with information to export.
+ *
+ * @param[in]  pentry_string A pointer to a string to store the alloocated
+ *                           line of the entry. The user must free it using
+ *                           ssh_string_free_char().
+ *
+ * @return SSH_OK on succcess, SSH_ERROR otherwise.
+ */
+int ssh_session_export_known_hosts_entry(ssh_session session,
+                                         char **pentry_string)
+{
+    ssh_key server_pubkey = NULL;
+    char *host = NULL;
+    char entry_buf[4096] = {0};
+    int rc;
+
+    if (pentry_string == NULL) {
+        ssh_set_error_invalid(session);
+        return SSH_ERROR;
+    }
+
+    if (session->opts.host == NULL) {
+        ssh_set_error(session, SSH_FATAL,
+                      "Can't create known_hosts entry - hostname unknown");
+        return SSH_ERROR;
+    }
+
+    host = ssh_session_get_host_port(session);
+    if (host == NULL) {
+        return SSH_ERROR;
+    }
+
+    if (session->current_crypto == NULL) {
+        ssh_set_error(session, SSH_FATAL,
+                      "No current crypto context, please connnect first");
+        SAFE_FREE(host);
+        return SSH_ERROR;
+    }
+
+    server_pubkey = ssh_dh_get_current_server_publickey(session);
+    if (server_pubkey == NULL){
+        ssh_set_error(session, SSH_FATAL, "No public key present");
+        SAFE_FREE(host);
+        return SSH_ERROR;
+    }
+
+    if (ssh_key_type(server_pubkey) == SSH_KEYTYPE_RSA1) {
+        rc = ssh_pki_export_pubkey_rsa1(server_pubkey,
+                                        host,
+                                        entry_buf,
+                                        sizeof(entry_buf));
+        SAFE_FREE(host);
+        if (rc < 0) {
+            return SSH_ERROR;
+        }
+    } else {
+        char *b64_key = NULL;
+
+        rc = ssh_pki_export_pubkey_base64(server_pubkey, &b64_key);
+        if (rc < 0) {
+            SAFE_FREE(host);
+            return SSH_ERROR;
+        }
+
+        snprintf(entry_buf, sizeof(entry_buf),
+                    "%s %s %s\n",
+                    host,
+                    server_pubkey->type_c,
+                    b64_key);
+
+        SAFE_FREE(host);
+        SAFE_FREE(b64_key);
+    }
+
+    *pentry_string = strdup(entry_buf);
+    if (*pentry_string == NULL) {
+        return SSH_ERROR;
+    }
+
+    return SSH_OK;
+}

tests/client/CMakeLists.txt

@@ -8,6 +8,7 @@ set(LIBSSH_CLIENT_TESTS
     torture_auth
     torture_forward
     torture_knownhosts
+    torture_knownhosts_verify
     torture_proxycommand
     torture_session
     torture_request_env)

tests/client/torture_knownhosts_verify.c

@@ -0,0 +1,121 @@
+/*
+ * This file is part of the SSH Library
+ *
+ * Copyright (c) 2018 by Andreas Schneider
+ *
+ * The SSH Library is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation; either version 2.1 of the License, or (at your
+ * option) any later version.
+ *
+ * The SSH Library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Lesser General Public
+ * License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with the SSH Library; see the file COPYING.  If not, write to
+ * the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
+ * MA 02111-1307, USA.
+ */
+
+#include "config.h"
+
+#define LIBSSH_STATIC
+
+#include "torture.h"
+
+#include <sys/types.h>
+#include <pwd.h>
+
+#include "knownhosts.c"
+
+#define TORTURE_KNOWN_HOSTS_FILE "libssh_torture_knownhosts"
+
+static int sshd_group_setup(void **state)
+{
+    torture_setup_sshd_server(state);
+
+    return 0;
+}
+
+static int sshd_group_teardown(void **state) {
+    torture_teardown_sshd_server(state);
+
+    return 0;
+}
+
+static int session_setup(void **state)
+{
+    struct torture_state *s = *state;
+    int verbosity = torture_libssh_verbosity();
+    struct passwd *pwd;
+
+    pwd = getpwnam("bob");
+    assert_non_null(pwd);
+    setuid(pwd->pw_uid);
+
+    s->ssh.session = ssh_new();
+    assert_non_null(s->ssh.session);
+
+    ssh_options_set(s->ssh.session, SSH_OPTIONS_LOG_VERBOSITY, &verbosity);
+    ssh_options_set(s->ssh.session, SSH_OPTIONS_HOST, TORTURE_SSH_SERVER);
+
+    ssh_options_set(s->ssh.session, SSH_OPTIONS_USER, TORTURE_SSH_USER_ALICE);
+
+    return 0;
+}
+
+static int session_teardown(void **state)
+{
+    struct torture_state *s = *state;
+    char known_hosts_file[1024];
+
+    snprintf(known_hosts_file,
+             sizeof(known_hosts_file),
+             "%s/%s",
+             s->socket_dir,
+             TORTURE_KNOWN_HOSTS_FILE);
+
+    ssh_disconnect(s->ssh.session);
+    ssh_free(s->ssh.session);
+
+    unlink(known_hosts_file);
+
+    return 0;
+}
+
+#define KNOWN_HOST_ENTRY "127.0.0.10 ecdsa-sha2-nistp521 AAAAE2VjZHNhLXNoYTItbmlzdHA1MjEAAAAIbmlzdHA1MjEAAACFBAHOg+9vHW2kJB50j7c7WkcCcOtwgZdeXMpAeEl17sFnTTrT8wYo1FCzE07wV262vIC+AE3fXUJ7sJ/CkFIdk/8/gQEY1jyoXB3Bsee16VwhJGsMzGGh1FJ0XXhRJjUbG18qbH9JiSgE1N4fIM0zJG68fAyUxRxCI1wUobOOB7EmFZd18g==\n"
+static void torture_knownhosts_export(void **state)
+{
+    struct torture_state *s = *state;
+    ssh_session session = s->ssh.session;
+    char *entry = NULL;
+    int rc;
+
+    rc = ssh_connect(session);
+    assert_int_equal(rc, SSH_OK);
+
+    rc = ssh_session_export_known_hosts_entry(session, &entry);
+    assert_int_equal(rc, SSH_OK);
+
+    assert_string_equal(entry, KNOWN_HOST_ENTRY);
+    SAFE_FREE(entry);
+}
+
+int torture_run_tests(void) {
+    int rc;
+    struct CMUnitTest tests[] = {
+        cmocka_unit_test_setup_teardown(torture_knownhosts_export,
+                                        session_setup,
+                                        session_teardown),
+    };
+
+    ssh_init();
+
+    torture_filter_tests(tests);
+    rc = cmocka_run_group_tests(tests, sshd_group_setup, sshd_group_teardown);
+
+    ssh_finalize();
+    return rc;
+}