2 * Author: Tatu Ylonen <ylo@cs.hut.fi>
3 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
5 * Functions for returning the canonical host name of the remote site.
7 * As far as I am concerned, the code I have written for this software
8 * can be used freely for any purpose. Any derived versions of this
9 * software must be clearly marked as such, and if the derived work is
10 * incompatible with the protocol description in the RFC file, it must be
11 * called by a name other than "ssh" or "Secure Shell".
15 RCSID("$OpenBSD: canohost.c,v 1.42 2005/02/18 03:05:53 djm Exp $");
22 static void check_ip_options(int, char *);
25 * Return the canonical name of the host at the other end of the socket. The
26 * caller should free the returned string with xfree.
30 get_remote_hostname(int sock
, int use_dns
)
32 struct sockaddr_storage from
;
35 struct addrinfo hints
, *ai
, *aitop
;
36 char name
[NI_MAXHOST
], ntop
[NI_MAXHOST
], ntop2
[NI_MAXHOST
];
38 /* Get IP address of client. */
39 fromlen
= sizeof(from
);
40 memset(&from
, 0, sizeof(from
));
41 if (getpeername(sock
, (struct sockaddr
*)&from
, &fromlen
) < 0) {
42 debug("getpeername failed: %.100s", strerror(errno
));
46 if (from
.ss_family
== AF_INET
)
47 check_ip_options(sock
, ntop
);
49 ipv64_normalise_mapped(&from
, &fromlen
);
51 if (from
.ss_family
== AF_INET6
)
52 fromlen
= sizeof(struct sockaddr_in6
);
54 if (getnameinfo((struct sockaddr
*)&from
, fromlen
, ntop
, sizeof(ntop
),
55 NULL
, 0, NI_NUMERICHOST
) != 0)
56 fatal("get_remote_hostname: getnameinfo NI_NUMERICHOST failed");
61 debug3("Trying to reverse map address %.100s.", ntop
);
62 /* Map the IP address to a host name. */
63 if (getnameinfo((struct sockaddr
*)&from
, fromlen
, name
, sizeof(name
),
64 NULL
, 0, NI_NAMEREQD
) != 0) {
65 /* Host name not found. Use ip address. */
70 * if reverse lookup result looks like a numeric hostname,
71 * someone is trying to trick us by PTR record like following:
72 * 1.1.1.10.in-addr.arpa. IN PTR 2.3.4.5
74 memset(&hints
, 0, sizeof(hints
));
75 hints
.ai_socktype
= SOCK_DGRAM
; /*dummy*/
76 hints
.ai_flags
= AI_NUMERICHOST
;
77 if (getaddrinfo(name
, "0", &hints
, &ai
) == 0) {
78 logit("Nasty PTR record \"%s\" is set up for %s, ignoring",
85 * Convert it to all lowercase (which is expected by the rest
88 for (i
= 0; name
[i
]; i
++)
90 name
[i
] = tolower(name
[i
]);
92 * Map it back to an IP address and check that the given
93 * address actually is an address of this host. This is
94 * necessary because anyone with access to a name server can
95 * define arbitrary names for an IP address. Mapping from
96 * name to IP address can be trusted better (but can still be
97 * fooled if the intruder has access to the name server of
100 memset(&hints
, 0, sizeof(hints
));
101 hints
.ai_family
= from
.ss_family
;
102 hints
.ai_socktype
= SOCK_STREAM
;
103 if (getaddrinfo(name
, NULL
, &hints
, &aitop
) != 0) {
104 logit("reverse mapping checking getaddrinfo for %.700s "
105 "failed - POSSIBLE BREAKIN ATTEMPT!", name
);
106 return xstrdup(ntop
);
108 /* Look for the address from the list of addresses. */
109 for (ai
= aitop
; ai
; ai
= ai
->ai_next
) {
110 if (getnameinfo(ai
->ai_addr
, ai
->ai_addrlen
, ntop2
,
111 sizeof(ntop2
), NULL
, 0, NI_NUMERICHOST
) == 0 &&
112 (strcmp(ntop
, ntop2
) == 0))
116 /* If we reached the end of the list, the address was not there. */
118 /* Address not found for the host name. */
119 logit("Address %.100s maps to %.600s, but this does not "
120 "map back to the address - POSSIBLE BREAKIN ATTEMPT!",
122 return xstrdup(ntop
);
124 return xstrdup(name
);
128 * If IP options are supported, make sure there are none (log and
129 * disconnect them if any are found). Basically we are worried about
130 * source routing; it can be used to pretend you are somebody
131 * (ip-address) you are not. That itself may be "almost acceptable"
132 * under certain circumstances, but rhosts autentication is useless
133 * if source routing is accepted. Notice also that if we just dropped
134 * source routing here, the other side could use IP spoofing to do
135 * rest of the interaction and could still bypass security. So we
136 * exit here if we detect any IP options.
140 check_ip_options(int sock
, char *ipaddr
)
144 char text
[sizeof(options
) * 3 + 1];
145 socklen_t option_size
;
149 if ((ip
= getprotobyname("ip")) != NULL
)
150 ipproto
= ip
->p_proto
;
152 ipproto
= IPPROTO_IP
;
153 option_size
= sizeof(options
);
154 if (getsockopt(sock
, ipproto
, IP_OPTIONS
, options
,
155 &option_size
) >= 0 && option_size
!= 0) {
157 for (i
= 0; i
< option_size
; i
++)
158 snprintf(text
+ i
*3, sizeof(text
) - i
*3,
159 " %2.2x", options
[i
]);
160 logit("Connection from %.100s with IP options:%.800s",
162 packet_disconnect("Connection from %.100s with IP options:%.800s",
165 #endif /* IP_OPTIONS */
169 ipv64_normalise_mapped(struct sockaddr_storage
*addr
, socklen_t
*len
)
171 struct sockaddr_in6
*a6
= (struct sockaddr_in6
*)addr
;
172 struct sockaddr_in
*a4
= (struct sockaddr_in
*)addr
;
173 struct in_addr inaddr
;
176 if (addr
->ss_family
!= AF_INET6
||
177 !IN6_IS_ADDR_V4MAPPED(&a6
->sin6_addr
))
180 debug3("Normalising mapped IPv4 in IPv6 address");
182 memcpy(&inaddr
, ((char *)&a6
->sin6_addr
) + 12, sizeof(inaddr
));
183 port
= a6
->sin6_port
;
185 memset(addr
, 0, sizeof(*a4
));
187 a4
->sin_family
= AF_INET
;
189 memcpy(&a4
->sin_addr
, &inaddr
, sizeof(inaddr
));
194 * Return the canonical name of the host in the other side of the current
195 * connection. The host name is cached, so it is efficient to call this
200 get_canonical_hostname(int use_dns
)
202 static char *canonical_host_name
= NULL
;
203 static int use_dns_done
= 0;
205 /* Check if we have previously retrieved name with same option. */
206 if (canonical_host_name
!= NULL
) {
207 if (use_dns_done
!= use_dns
)
208 xfree(canonical_host_name
);
210 return canonical_host_name
;
213 /* Get the real hostname if socket; otherwise return UNKNOWN. */
214 if (packet_connection_is_on_socket())
215 canonical_host_name
= get_remote_hostname(
216 packet_get_connection_in(), use_dns
);
218 canonical_host_name
= xstrdup("UNKNOWN");
220 use_dns_done
= use_dns
;
221 return canonical_host_name
;
225 * Returns the local/remote IP-address/hostname of socket as a string.
226 * The returned string must be freed.
229 get_socket_address(int sock
, int remote
, int flags
)
231 struct sockaddr_storage addr
;
233 char ntop
[NI_MAXHOST
];
236 /* Get IP address of client. */
237 addrlen
= sizeof(addr
);
238 memset(&addr
, 0, sizeof(addr
));
241 if (getpeername(sock
, (struct sockaddr
*)&addr
, &addrlen
)
245 if (getsockname(sock
, (struct sockaddr
*)&addr
, &addrlen
)
250 /* Work around Linux IPv6 weirdness */
251 if (addr
.ss_family
== AF_INET6
)
252 addrlen
= sizeof(struct sockaddr_in6
);
254 ipv64_normalise_mapped(&addr
, &addrlen
);
256 /* Get the address in ascii. */
257 if ((r
= getnameinfo((struct sockaddr
*)&addr
, addrlen
, ntop
,
258 sizeof(ntop
), NULL
, 0, flags
)) != 0) {
259 error("get_socket_address: getnameinfo %d failed: %s", flags
,
260 r
== EAI_SYSTEM
? strerror(errno
) : gai_strerror(r
));
263 return xstrdup(ntop
);
267 get_peer_ipaddr(int sock
)
271 if ((p
= get_socket_address(sock
, 1, NI_NUMERICHOST
)) != NULL
)
273 return xstrdup("UNKNOWN");
277 get_local_ipaddr(int sock
)
281 if ((p
= get_socket_address(sock
, 0, NI_NUMERICHOST
)) != NULL
)
283 return xstrdup("UNKNOWN");
287 get_local_name(int sock
)
289 return get_socket_address(sock
, 0, NI_NAMEREQD
);
293 * Returns the IP-address of the remote host as a string. The returned
294 * string must not be freed.
298 get_remote_ipaddr(void)
300 static char *canonical_host_ip
= NULL
;
302 /* Check whether we have cached the ipaddr. */
303 if (canonical_host_ip
== NULL
) {
304 if (packet_connection_is_on_socket()) {
306 get_peer_ipaddr(packet_get_connection_in());
307 if (canonical_host_ip
== NULL
)
310 /* If not on socket, return UNKNOWN. */
311 canonical_host_ip
= xstrdup("UNKNOWN");
314 return canonical_host_ip
;
318 get_remote_name_or_ip(u_int utmp_len
, int use_dns
)
320 static const char *remote
= "";
322 remote
= get_canonical_hostname(use_dns
);
323 if (utmp_len
== 0 || strlen(remote
) > utmp_len
)
324 remote
= get_remote_ipaddr();
328 /* Returns the local/remote port for the socket. */
331 get_sock_port(int sock
, int local
)
333 struct sockaddr_storage from
;
335 char strport
[NI_MAXSERV
];
338 /* Get IP address of client. */
339 fromlen
= sizeof(from
);
340 memset(&from
, 0, sizeof(from
));
342 if (getsockname(sock
, (struct sockaddr
*)&from
, &fromlen
) < 0) {
343 error("getsockname failed: %.100s", strerror(errno
));
347 if (getpeername(sock
, (struct sockaddr
*)&from
, &fromlen
) < 0) {
348 debug("getpeername failed: %.100s", strerror(errno
));
353 /* Work around Linux IPv6 weirdness */
354 if (from
.ss_family
== AF_INET6
)
355 fromlen
= sizeof(struct sockaddr_in6
);
357 /* Return port number. */
358 if ((r
= getnameinfo((struct sockaddr
*)&from
, fromlen
, NULL
, 0,
359 strport
, sizeof(strport
), NI_NUMERICSERV
)) != 0)
360 fatal("get_sock_port: getnameinfo NI_NUMERICSERV failed: %s",
361 r
== EAI_SYSTEM
? strerror(errno
) : gai_strerror(r
));
362 return atoi(strport
);
365 /* Returns remote/local port number for the current connection. */
371 * If the connection is not a socket, return 65535. This is
372 * intentionally chosen to be an unprivileged port number.
374 if (!packet_connection_is_on_socket())
377 /* Get socket and return the port number. */
378 return get_sock_port(packet_get_connection_in(), local
);
382 get_peer_port(int sock
)
384 return get_sock_port(sock
, 0);
388 get_remote_port(void)
390 static int port
= -1;
392 /* Cache to avoid getpeername() on a dead connection */