Skip to content

Perform host fingerprint validation via SSHFP fingerprint matching and RES_TRUSTAD flag checking if supported #3

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jreidthompson wants to merge 54 commits into
base: main
Choose a base branch
from
Open

Perform host fingerprint validation via SSHFP fingerprint matching and RES_TRUSTAD flag checking if supported #3

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
54 commits
Select commit Hold shift + click to select a range
c424a82
Implement minimal dnssec/trust ad, initial code
jreidthompson Oct 6, 2023
c86aca2
Perform checklib for libresolv
jreidthompson Oct 8, 2023
c2c9ff6
Add libresolv harness files
jreidthompson Oct 9, 2023
39278d0
Add harnessLibResolv to sftpTest unit
jreidthompson Oct 9, 2023
4905947
Start to shim libresolv functions in order to implement tests
jreidthompson Oct 20, 2023
03e82e0
Rework trustad
jreidthompson Oct 23, 2023
68dcbe0
Refactor. Update/add tests
jreidthompson Oct 30, 2023
134f159
u22 full coverage
jreidthompson Oct 30, 2023
d2a21c4
Update help
jreidthompson Oct 31, 2023
60d6d22
Update tests for u20
jreidthompson Oct 31, 2023
ed7a8d3
Skip trust_ad check on OS's that do not support/define RES_TRUSTAD
jreidthompson Nov 1, 2023
fa888c4
Refactor, change references from trust ad to sshfp
jreidthompson Nov 3, 2023
8a1ab49
Reorder some code, update tests accordingly
jreidthompson Nov 6, 2023
19d2ecd
Remove extraneous blank lines
jreidthompson Nov 6, 2023
e2f6f35
Add known dnssec trust_ad SSHFP record
jreidthompson Nov 6, 2023
2be433b
Refactor to eliminate a valgrind error that was occurring on d10 and f38
jreidthompson Nov 14, 2023
c00e2d2
Attempt to remedy CI meson issue
jreidthompson Nov 14, 2023
04428df
Determined FTM definitions for rh7 to compile with libresolv
jreidthompson Nov 20, 2023
0ea785e
Attempt to fix ci doc build
jreidthompson Nov 20, 2023
6375f37
Update help
jreidthompson Nov 27, 2023
2e0e2dc
Fix CI build failure on doc/s390
jreidthompson Dec 4, 2023
be5be43
Note that DEFAULT_SOURCE AND BSD_SOURCE can be removed when support f…
jreidthompson Dec 4, 2023
4d3fe86
Attempt to fix configure issue
jreidthompson Dec 4, 2023
3f0f17e
Attempt to fix configure issue
jreidthompson Dec 4, 2023
1266dc6
Attempt to fix CI freebsd issue
jreidthompson Dec 4, 2023
6cff20b
Attempt to fix configure issue
jreidthompson Dec 4, 2023
3f4a173
Attempt to fix CI freebsd issue
jreidthompson Dec 4, 2023
121fa28
Attempt to fix CI freebsd issue
jreidthompson Dec 4, 2023
8178f14
Attempt to fix CI freebsd issue
jreidthompson Dec 4, 2023
4e16045
Attempt to fix CI freebsd issue
jreidthompson Dec 5, 2023
8a124d8
Attempt to fix CI freebsd issue
jreidthompson Dec 5, 2023
2d616e0
Attempt to fix CI freebsd issue
jreidthompson Dec 5, 2023
40be5e4
Attempt to fix CI freebsd issue
jreidthompson Dec 5, 2023
2dc7a36
Do not define T_SSHFP for freebsd, just use ns_t_sshfp instead
jreidthompson Dec 5, 2023
505038d
Refactor to see if these are now unneded
jreidthompson Dec 6, 2023
306301a
Missed configure
jreidthompson Dec 6, 2023
35ef869
Rework meson.build and configure.ac
jreidthompson Dec 6, 2023
336cdbe
Generate configure
jreidthompson Dec 6, 2023
5fe9222
Check CI, needs cleanup, docs updated
jreidthompson Dec 11, 2023
32f2a63
Missed sftpTest in last commit
jreidthompson Dec 11, 2023
a7e12ce
Add DNS response with ad set but no sshfp records
jreidthompson Dec 11, 2023
f047070
Fix format
jreidthompson Dec 11, 2023
c685482
Rename option to repo-sftp-verify-sshfp
jreidthompson Dec 11, 2023
0a2c644
Regen configure
jreidthompson Dec 11, 2023
522e289
Revert configure.ac change
jreidthompson Dec 11, 2023
e1d9027
Rename option, update help, update tests
jreidthompson Dec 11, 2023
d6f8148
Try to make libresolv optional
jreidthompson Dec 11, 2023
e138622
Try using predefined header check for resolv.h
jreidthompson Dec 12, 2023
583c521
Update meson.build, configure.ac re optional libresolv
jreidthompson Dec 12, 2023
e206b40
Revert last change to meson build
jreidthompson Dec 12, 2023
1a806e4
Rework fingerprint matching
jreidthompson Dec 13, 2023
301f518
Fix test
jreidthompson Dec 13, 2023
fb39738
Refactor LOG_WARN_FMT to LOG_DETAIL_FMT in sshfp fingerprint loop
jreidthompson Dec 20, 2023
7cf63c6
Rebase to main
jreidthompson Jan 15, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions meson.build
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,10 @@ cc = meson.get_compiler('c')
# OS-specific settings
####################################################################################################################################
if host_machine.system() == 'linux'
# BSD_SOURCE can be removed when support for RHEL7 is dropped,
# DEFAULT_SOURCE can be removed when support for RHEL7 is dropped if we rewrite a few hstrerror calls to a generic error message
add_global_arguments('-D_DEFAULT_SOURCE', language : 'c')
add_global_arguments('-D_BSD_SOURCE', language : 'c')
add_global_arguments('-D_POSIX_C_SOURCE=200809L', language : 'c')
elif host_machine.system() == 'darwin'
add_global_arguments('-D_DARWIN_C_SOURCE', language : 'c')
Expand Down Expand Up @@ -174,6 +178,13 @@ if lib_ssh2.found()
configuration.set('HAVE_LIBSSH2', true, description: 'Is libssh2 present?')
endif

# Find optional libresolv library
lib_resolv = cc.find_library('resolv', required: false)

if lib_resolv.found()
configuration.set('HAVE_LIBRESOLV', true, description: 'Is libresolv present?')
endif

# Find optional zstd library
lib_zstd = dependency('libzstd', version: '>=1.0', required: false)

Expand Down
8 changes: 8 additions & 0 deletions src/build/config/config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2460,6 +2460,14 @@ option:
command: repo-type
depend: repo-sftp-host

repo-sftp-verify-via-sshfp:
section: global
group: repo
type: boolean
default: false
command: repo-type
depend: repo-sftp-host

repo-storage-verify-tls:
section: global
group: repo
Expand Down
15 changes: 14 additions & 1 deletion src/build/configure.ac
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,12 +15,17 @@ AC_PROG_CC
AC_CANONICAL_HOST
AC_SUBST(CFLAGS, "${CFLAGS} -std=c99")

# BSD_SOURCE can be removed when support for RHEL7 is dropped
# DEFAULT_SOURCE can be removed when support for RHEL7 is dropped if we rewrite a few hstrerror calls to a generic error message
# ----------------------------------------------------------------------------------------------------------------------------------
case $host_os in
darwin*)
AC_SUBST(CPPFLAGS, "${CPPFLAGS} -D_DARWIN_C_SOURCE")
;;

linux*)
AC_SUBST(CPPFLAGS, "${CPPFLAGS} -D_DEFAULT_SOURCE")
AC_SUBST(CPPFLAGS, "${CPPFLAGS} -D_BSD_SOURCE")
AC_SUBST(CPPFLAGS, "${CPPFLAGS} -D_POSIX_C_SOURCE=200809L")
;;
esac
Expand Down Expand Up @@ -113,7 +118,7 @@ AC_CHECK_LIB(
[AC_CHECK_HEADER(lz4frame.h, [AC_DEFINE(HAVE_LIBLZ4) AC_SUBST(LIBS, "${LIBS} -llz4")],
[AC_MSG_ERROR([header file <lz4frame.h> is required])])])

# Check optional libSSH2 library
# Check optional libssh2 library
# ----------------------------------------------------------------------------------------------------------------------------------
AC_CHECK_LIB(
[ssh2], [libssh2_init],
Expand All @@ -124,6 +129,14 @@ AC_CHECK_LIB(
[AC_CHECK_HEADER(libssh2_sftp.h, [],
[AC_MSG_ERROR([header file <libssh2_sftp.h> is required])])])

# Check for optional resolv library if we have libssh2
# ----------------------------------------------------------------------------------------------------------------------------------
if test "x$ac_cv_lib_ssh2_libssh2_init" = "xyes"
then
AC_CHECK_LIB([resolv], [ns_initparse], [], [])
AC_HEADER_RESOLV
fi

# Check optional zst library. Ignore any versions below 1.0.
# ----------------------------------------------------------------------------------------------------------------------------------
AC_CHECK_LIB(
Expand Down
11 changes: 11 additions & 0 deletions src/build/help/help.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1059,6 +1059,17 @@
<example>path</example>
</config-key>

<config-key id="repo-sftp-verify-via-sshfp" name="SFTP Verify Via SSHFP">
<summary>SFTP verify via SSHFP.</summary>

<text>
<p>Perform fingerprint verification via SSHFP records. This assumes that DNS resolution is configured to resolve to a DNS server that has been properly configured for DNSSEC and that the path between the host and the DNS server is secure. The OS must support RES_TRUSTAD (ad flag) in order to verify via SSHFP. If any DNS provided fingerprints match, the host will be trusted. If the DNS response ad flag is not set, or no DNS fingerprints are provided, or no DNS fingerprints match the host fingerprint, warnings are logged and <backrest/> will failover to attempt to verify via normal methods.</p>
</text>

<default>n</default>
<example>y</example>
</config-key>

<config-key id="repo-sftp-host" name="SFTP Repository Host">
<summary>SFTP repository host.</summary>

Expand Down
3 changes: 2 additions & 1 deletion src/config/config.auto.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -136,7 +136,7 @@ Option constants
#define CFGOPT_TYPE "type"
#define CFGOPT_VERBOSE "verbose"

#define CFG_OPTION_TOTAL 179
#define CFG_OPTION_TOTAL 180

/***********************************************************************************************************************************
Option value constants
Expand Down Expand Up @@ -528,6 +528,7 @@ typedef enum
cfgOptRepoSftpPrivateKeyFile,
cfgOptRepoSftpPrivateKeyPassphrase,
cfgOptRepoSftpPublicKeyFile,
cfgOptRepoSftpVerifyViaSshfp,
cfgOptRepoStorageCaFile,
cfgOptRepoStorageCaPath,
cfgOptRepoStorageHost,
Expand Down
87 changes: 87 additions & 0 deletions src/config/parse.auto.c.inc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8733,6 +8733,92 @@ static const ParseRuleOption parseRuleOption[CFG_OPTION_TOTAL] =
), // opt/repo-sftp-public-key-file
), // opt/repo-sftp-public-key-file
// -----------------------------------------------------------------------------------------------------------------------------
PARSE_RULE_OPTION // opt/repo-sftp-verify-via-sshfp
( // opt/repo-sftp-verify-via-sshfp
PARSE_RULE_OPTION_NAME("repo-sftp-verify-via-sshfp"), // opt/repo-sftp-verify-via-sshfp
PARSE_RULE_OPTION_TYPE(cfgOptTypeBoolean), // opt/repo-sftp-verify-via-sshfp
PARSE_RULE_OPTION_NEGATE(true), // opt/repo-sftp-verify-via-sshfp
PARSE_RULE_OPTION_RESET(true), // opt/repo-sftp-verify-via-sshfp
PARSE_RULE_OPTION_REQUIRED(true), // opt/repo-sftp-verify-via-sshfp
PARSE_RULE_OPTION_SECTION(cfgSectionGlobal), // opt/repo-sftp-verify-via-sshfp
PARSE_RULE_OPTION_GROUP_MEMBER(true), // opt/repo-sftp-verify-via-sshfp
PARSE_RULE_OPTION_GROUP_ID(cfgOptGrpRepo), // opt/repo-sftp-verify-via-sshfp
// opt/repo-sftp-verify-via-sshfp
PARSE_RULE_OPTION_COMMAND_ROLE_MAIN_VALID_LIST // opt/repo-sftp-verify-via-sshfp
( // opt/repo-sftp-verify-via-sshfp
PARSE_RULE_OPTION_COMMAND(cfgCmdAnnotate) // opt/repo-sftp-verify-via-sshfp
PARSE_RULE_OPTION_COMMAND(cfgCmdArchiveGet) // opt/repo-sftp-verify-via-sshfp
PARSE_RULE_OPTION_COMMAND(cfgCmdArchivePush) // opt/repo-sftp-verify-via-sshfp
PARSE_RULE_OPTION_COMMAND(cfgCmdBackup) // opt/repo-sftp-verify-via-sshfp
PARSE_RULE_OPTION_COMMAND(cfgCmdCheck) // opt/repo-sftp-verify-via-sshfp
PARSE_RULE_OPTION_COMMAND(cfgCmdExpire) // opt/repo-sftp-verify-via-sshfp
PARSE_RULE_OPTION_COMMAND(cfgCmdInfo) // opt/repo-sftp-verify-via-sshfp
PARSE_RULE_OPTION_COMMAND(cfgCmdManifest) // opt/repo-sftp-verify-via-sshfp
PARSE_RULE_OPTION_COMMAND(cfgCmdRepoCreate) // opt/repo-sftp-verify-via-sshfp
PARSE_RULE_OPTION_COMMAND(cfgCmdRepoGet) // opt/repo-sftp-verify-via-sshfp
PARSE_RULE_OPTION_COMMAND(cfgCmdRepoLs) // opt/repo-sftp-verify-via-sshfp
PARSE_RULE_OPTION_COMMAND(cfgCmdRepoPut) // opt/repo-sftp-verify-via-sshfp
PARSE_RULE_OPTION_COMMAND(cfgCmdRepoRm) // opt/repo-sftp-verify-via-sshfp
PARSE_RULE_OPTION_COMMAND(cfgCmdRestore) // opt/repo-sftp-verify-via-sshfp
PARSE_RULE_OPTION_COMMAND(cfgCmdStanzaCreate) // opt/repo-sftp-verify-via-sshfp
PARSE_RULE_OPTION_COMMAND(cfgCmdStanzaDelete) // opt/repo-sftp-verify-via-sshfp
PARSE_RULE_OPTION_COMMAND(cfgCmdStanzaUpgrade) // opt/repo-sftp-verify-via-sshfp
PARSE_RULE_OPTION_COMMAND(cfgCmdVerify) // opt/repo-sftp-verify-via-sshfp
), // opt/repo-sftp-verify-via-sshfp
// opt/repo-sftp-verify-via-sshfp
PARSE_RULE_OPTION_COMMAND_ROLE_ASYNC_VALID_LIST // opt/repo-sftp-verify-via-sshfp
( // opt/repo-sftp-verify-via-sshfp
PARSE_RULE_OPTION_COMMAND(cfgCmdArchiveGet) // opt/repo-sftp-verify-via-sshfp
PARSE_RULE_OPTION_COMMAND(cfgCmdArchivePush) // opt/repo-sftp-verify-via-sshfp
), // opt/repo-sftp-verify-via-sshfp
// opt/repo-sftp-verify-via-sshfp
PARSE_RULE_OPTION_COMMAND_ROLE_LOCAL_VALID_LIST // opt/repo-sftp-verify-via-sshfp
( // opt/repo-sftp-verify-via-sshfp
PARSE_RULE_OPTION_COMMAND(cfgCmdArchiveGet) // opt/repo-sftp-verify-via-sshfp
PARSE_RULE_OPTION_COMMAND(cfgCmdArchivePush) // opt/repo-sftp-verify-via-sshfp
PARSE_RULE_OPTION_COMMAND(cfgCmdBackup) // opt/repo-sftp-verify-via-sshfp
PARSE_RULE_OPTION_COMMAND(cfgCmdRestore) // opt/repo-sftp-verify-via-sshfp
PARSE_RULE_OPTION_COMMAND(cfgCmdVerify) // opt/repo-sftp-verify-via-sshfp
), // opt/repo-sftp-verify-via-sshfp
// opt/repo-sftp-verify-via-sshfp
PARSE_RULE_OPTION_COMMAND_ROLE_REMOTE_VALID_LIST // opt/repo-sftp-verify-via-sshfp
( // opt/repo-sftp-verify-via-sshfp
PARSE_RULE_OPTION_COMMAND(cfgCmdAnnotate) // opt/repo-sftp-verify-via-sshfp
PARSE_RULE_OPTION_COMMAND(cfgCmdArchiveGet) // opt/repo-sftp-verify-via-sshfp
PARSE_RULE_OPTION_COMMAND(cfgCmdArchivePush) // opt/repo-sftp-verify-via-sshfp
PARSE_RULE_OPTION_COMMAND(cfgCmdCheck) // opt/repo-sftp-verify-via-sshfp
PARSE_RULE_OPTION_COMMAND(cfgCmdInfo) // opt/repo-sftp-verify-via-sshfp
PARSE_RULE_OPTION_COMMAND(cfgCmdManifest) // opt/repo-sftp-verify-via-sshfp
PARSE_RULE_OPTION_COMMAND(cfgCmdRepoCreate) // opt/repo-sftp-verify-via-sshfp
PARSE_RULE_OPTION_COMMAND(cfgCmdRepoGet) // opt/repo-sftp-verify-via-sshfp
PARSE_RULE_OPTION_COMMAND(cfgCmdRepoLs) // opt/repo-sftp-verify-via-sshfp
PARSE_RULE_OPTION_COMMAND(cfgCmdRepoPut) // opt/repo-sftp-verify-via-sshfp
PARSE_RULE_OPTION_COMMAND(cfgCmdRepoRm) // opt/repo-sftp-verify-via-sshfp
PARSE_RULE_OPTION_COMMAND(cfgCmdRestore) // opt/repo-sftp-verify-via-sshfp
PARSE_RULE_OPTION_COMMAND(cfgCmdStanzaCreate) // opt/repo-sftp-verify-via-sshfp
PARSE_RULE_OPTION_COMMAND(cfgCmdStanzaDelete) // opt/repo-sftp-verify-via-sshfp
PARSE_RULE_OPTION_COMMAND(cfgCmdStanzaUpgrade) // opt/repo-sftp-verify-via-sshfp
PARSE_RULE_OPTION_COMMAND(cfgCmdVerify) // opt/repo-sftp-verify-via-sshfp
), // opt/repo-sftp-verify-via-sshfp
// opt/repo-sftp-verify-via-sshfp
PARSE_RULE_OPTIONAL // opt/repo-sftp-verify-via-sshfp
( // opt/repo-sftp-verify-via-sshfp
PARSE_RULE_OPTIONAL_GROUP // opt/repo-sftp-verify-via-sshfp
( // opt/repo-sftp-verify-via-sshfp
PARSE_RULE_OPTIONAL_DEPEND // opt/repo-sftp-verify-via-sshfp
( // opt/repo-sftp-verify-via-sshfp
PARSE_RULE_VAL_OPT(cfgOptRepoType), // opt/repo-sftp-verify-via-sshfp
PARSE_RULE_VAL_STRID(parseRuleValStrIdSftp), // opt/repo-sftp-verify-via-sshfp
), // opt/repo-sftp-verify-via-sshfp
// opt/repo-sftp-verify-via-sshfp
PARSE_RULE_OPTIONAL_DEFAULT // opt/repo-sftp-verify-via-sshfp
( // opt/repo-sftp-verify-via-sshfp
PARSE_RULE_VAL_BOOL_FALSE, // opt/repo-sftp-verify-via-sshfp
), // opt/repo-sftp-verify-via-sshfp
), // opt/repo-sftp-verify-via-sshfp
), // opt/repo-sftp-verify-via-sshfp
), // opt/repo-sftp-verify-via-sshfp
// -----------------------------------------------------------------------------------------------------------------------------
PARSE_RULE_OPTION // opt/repo-storage-ca-file
( // opt/repo-storage-ca-file
PARSE_RULE_OPTION_NAME("repo-storage-ca-file"), // opt/repo-storage-ca-file
Expand Down Expand Up @@ -10988,6 +11074,7 @@ static const uint8_t optionResolveOrder[] =
cfgOptRepoSftpPrivateKeyFile, // opt-resolve-order
cfgOptRepoSftpPrivateKeyPassphrase, // opt-resolve-order
cfgOptRepoSftpPublicKeyFile, // opt-resolve-order
cfgOptRepoSftpVerifyViaSshfp, // opt-resolve-order
cfgOptRepoStorageCaFile, // opt-resolve-order
cfgOptRepoStorageCaPath, // opt-resolve-order
cfgOptRepoStorageHost, // opt-resolve-order
Expand Down
Loading