Merge branch 'hans/ssh/ssh_dbg_hostkey/OTP-14658' into maint

2 files changed, 154 insertions, 41 deletions

diff --git a/lib/ssh/src/ssh_dbg.erl b/lib/ssh/src/ssh_dbg.erl
index 3f742ad9b6..906640b490 100644
--- a/lib/ssh/src/ssh_dbg.erl
+++ b/lib/ssh/src/ssh_dbg.erl
@@ -24,6 +24,7 @@
 
 -export([messages/0, messages/1, messages/2, messages/3,
 	 auth/0,     auth/1,     auth/2,     auth/3,
+	 hostkey/0,  hostkey/1,  hostkey/2,  hostkey/3,
 	 stop/0
 	]).
 
@@ -46,6 +47,11 @@ auth(F) -> start(auth,F).
 auth(F,X) -> start(auth,F,X).
 auth(F,M,I) -> start(auth,F,M,I).
 
+hostkey() -> start(hostkey).
+hostkey(F) -> start(hostkey,F).
+hostkey(F,X) -> start(hostkey,F,X).
+hostkey(F,M,I) -> start(hostkey,F,M,I).
+
 stop() -> dbg:stop().
 
 %%%----------------------------------------------------------------
@@ -71,23 +77,44 @@ fmt_fun(F) -> fun(Fmt,Args,Data) -> F(Fmt,Args), Data end.
 id_fun() ->  fun(X) -> X end.
 
 %%%----------------------------------------------------------------
-dbg_ssh(msg) ->
-    dbg_ssh(auth),
-    dbg:tp(ssh_message,encode,1, x),
-    dbg:tp(ssh_message,decode,1, x),
-    dbg:tpl(ssh_transport,select_algorithm,4, x),
-    dbg:tp(ssh_transport,hello_version_msg,1, x),
-    dbg:tp(ssh_transport,handle_hello_version,1, x),
-    dbg:tpl(ssh_connection_handler,ext_info,2, x);
+dbg_ssh(What) ->
+    case [E || E <- lists:flatten(dbg_ssh0(What)),
+               element(1,E) =/= ok] of
+        [] -> ok;
+        Other -> Other
+    end.
+            
+
+dbg_ssh0(auth) ->
+    [dbg:tp(ssh_transport,hello_version_msg,1, x),
+     dbg:tp(ssh_transport,handle_hello_version,1, x),
+     dbg:tp(ssh_message,encode,1, x),
+     dbg:tpl(ssh_transport,select_algorithm,4, x),
+     dbg:tpl(ssh_connection_handler,ext_info,2, x),
+     lists:map(fun(F) -> dbg:tp(ssh_auth, F, x) end,
+               [publickey_msg, password_msg, keyboard_interactive_msg])
+    ];
+
+dbg_ssh0(hostkey) ->
+    [dbg:tpl(ssh_transport, verify_host_key, 4, x),
+     dbg:tp(ssh_transport, verify, 4, x),
+     dbg:tpl(ssh_transport, known_host_key, 3, x),
+%%     dbg:tpl(ssh_transport, accepted_host, 4, x),
+     dbg:tpl(ssh_transport, add_host_key, 4, x),
+     dbg:tpl(ssh_transport, is_host_key, 5, x)
+    ];
+
+dbg_ssh0(msg) ->
+    [dbg_ssh0(hostkey),
+     dbg_ssh0(auth),
+     dbg:tp(ssh_message,encode,1, x),
+     dbg:tp(ssh_message,decode,1, x),
+     dbg:tpl(ssh_transport,select_algorithm,4, x),
+     dbg:tp(ssh_transport,hello_version_msg,1, x),
+     dbg:tp(ssh_transport,handle_hello_version,1, x),
+     dbg:tpl(ssh_connection_handler,ext_info,2, x)
+    ].
    
-dbg_ssh(auth) ->
-    dbg:tp(ssh_transport,hello_version_msg,1, x),
-    dbg:tp(ssh_transport,handle_hello_version,1, x),
-    dbg:tp(ssh_message,encode,1, x),
-    dbg:tpl(ssh_transport,select_algorithm,4, x),
-    dbg:tpl(ssh_connection_handler,ext_info,2, x),
-    lists:foreach(fun(F) -> dbg:tp(ssh_auth, F, x) end,
-                  [publickey_msg, password_msg, keyboard_interactive_msg]).
    
 %%%================================================================
 cond_start(Type, WriteFun, MangleArgFun, Init) ->
@@ -110,10 +137,10 @@ msg_formater(msg, {trace_ts,_Pid,call,{ssh_message,decode,_},_TS}, D) ->
 msg_formater(msg, {trace_ts,Pid,return_from,{ssh_message,decode,1},Msg,TS}, D) -> 
     fmt("~n~s ~p RECV ~s~n", [ts(TS),Pid,wr_record(shrink_bin(Msg))], D);
 
-msg_formater(auth, {trace_ts,Pid,return_from,{ssh_message,decode,1},#ssh_msg_userauth_failure{authentications=As},TS}, D) -> 
+msg_formater(_auth, {trace_ts,Pid,return_from,{ssh_message,decode,1},#ssh_msg_userauth_failure{authentications=As},TS}, D) -> 
     fmt("~n~s ~p Client login FAILURE. Try ~s~n", [ts(TS),Pid,As], D);
 	
-msg_formater(auth, {trace_ts,Pid,return_from,{ssh_message,decode,1},#ssh_msg_userauth_success{},TS}, D) -> 
+msg_formater(_auth, {trace_ts,Pid,return_from,{ssh_message,decode,1},#ssh_msg_userauth_success{},TS}, D) -> 
     fmt("~n~s ~p Client login SUCCESS~n", [ts(TS),Pid], D);
 
 	
@@ -155,10 +182,50 @@ msg_formater(_, {trace_ts,Pid,return_from,{ssh_connection_handler,ext_info,2},St
             D
     end;
 
+msg_formater(_, {trace_ts,Pid,call, {ssh_transport,verify_host_key,[_Ssh,_PK,_Dgst,{AlgStr,_Sign}]},TS}, D) ->
+    fmt("~n~s ~p Client got a ~s hostkey. Will try to verify it~n", [ts(TS),Pid,AlgStr], D);
+msg_formater(_, {trace_ts,Pid,return_from, {ssh_transport,verify_host_key,4}, Result, TS}, D) ->
+    case Result of
+        ok -> fmt("~n~s ~p Hostkey verified.~n", [ts(TS),Pid], D);
+        {error,E} ->
+              fmt("~n~s ~p ***** Hostkey NOT verified: ~p ******!~n", [ts(TS),Pid,E], D);
+        _  -> fmt("~n~s ~p ***** Hostkey is NOT verified: ~p ******!~n", [ts(TS),Pid,Result], D)
+    end;
+        
+msg_formater(_, {trace_ts,Pid,return_from, {ssh_transport,verify,4}, Result, TS}, D) ->
+    case Result of
+        true -> D;
+        _ -> fmt("~n~s ~p Couldn't verify the signature!~n", [ts(TS),Pid], D)
+    end;
+
+msg_formater(_, {trace_ts,_Pid,call, {ssh_transport,is_host_key,_}, _TS}, D) -> D;
+msg_formater(_, {trace_ts,Pid,return_from, {ssh_transport,is_host_key,5}, {CbMod,Result}, TS}, D) ->
+    case Result of
+        true -> fmt("~n~s ~p Hostkey found by ~p.~n", [ts(TS),Pid,CbMod], D);
+        _    -> fmt("~n~s ~p Hostkey NOT found by ~p.~n", [ts(TS),Pid,CbMod], D)
+    end;
+
+msg_formater(_, {trace_ts,_Pid,call, {ssh_transport,add_host_key,_}, _TS}, D) -> D;
+msg_formater(_, {trace_ts,Pid,return_from, {ssh_transport,add_host_key,4}, {CbMod,Result}, TS}, D) ->
+    case Result of
+        ok -> fmt("~n~s ~p New hostkey added by ~p.~n", [ts(TS),Pid,CbMod], D);
+        _  -> D
+    end;
+
+msg_formater(_, {trace_ts,_Pid,call,{ssh_transport,known_host_key,_},_TS}, D) -> D;
+msg_formater(_, {trace_ts,Pid,return_from, {ssh_transport,known_host_key,3}, Result, TS}, D) ->
+    case Result of
+        ok -> D;
+        {error,E} -> fmt("~n~s ~p Hostkey addition failed: ~p~n", [ts(TS),Pid,E], D);
+        _ -> fmt("~n~s ~p Hostkey addition: ~p~n", [ts(TS),Pid,Result], D)
+    end;
+
 msg_formater(_, {trace_ts,Pid,call,{ssh_auth,publickey_msg,[[SigAlg,#ssh{user=User}]]},TS}, D) ->
      fmt("~n~s ~p Client will try to login user ~p with public key algorithm ~p~n", [ts(TS),Pid,User,SigAlg], D);
 msg_formater(_, {trace_ts,Pid,return_from,{ssh_auth,publickey_msg,1},{not_ok,#ssh{user=User}},TS}, D) ->
      fmt("~s ~p User ~p can't login with that kind of public key~n", [ts(TS),Pid,User], D);
+msg_formater(_, {trace_ts,Pid,return_from,{ssh_auth,publickey_msg,1},{_,#ssh{user=User}},TS}, D) ->
+     fmt("~s ~p User ~p logged in~n", [ts(TS),Pid,User], D);
 
 msg_formater(_, {trace_ts,Pid,call,{ssh_auth,password_msg,[[#ssh{user=User}]]},TS}, D) ->
      fmt("~n~s ~p Client will try to login user ~p with password~n", [ts(TS),Pid,User], D);
@@ -187,26 +254,20 @@ msg_formater(msg, {trace_ts,Pid,'receive',ErlangMsg,TS}, D) ->
     fmt("~n~s ~p ERL MSG RECEIVE~n ~p~n", [ts(TS),Pid,shrink_bin(ErlangMsg)], D);
 
 
-%% msg_formater(_, {trace_ts,_Pid,return_from,MFA,_Ret,_TS}=M, D) ->
-%%     case lists:member(MFA, [{ssh_auth,keyboard_interactive_msg,1},
-%%                             {ssh_auth,password_msg,1},
-%%                             {ssh_auth,publickey_msg,1}]) of
-%%         true ->
-%%             D;
-%%         false ->
-%%             fmt("~nDBG ~n~p~n", [shrink_bin(M)], D)
-%%     end;
-
-%% msg_formater(_, M, D) ->
-%%     fmt("~nDBG ~n~p~n", [shrink_bin(M)], D).
-
-msg_formater(_, _, D) -> 
-     D.
+msg_formater(_, _M, D) ->
+    fmt("~nDBG other ~n~p~n", [shrink_bin(_M)], D),
+    D.
 
 %%%----------------------------------------------------------------
 -record(data, {writer,
+               initialized,
                acc}).
 
+fmt(Fmt, Args,  D=#data{initialized=false}) ->
+    fmt(Fmt, Args,
+        D#data{acc = (D#data.writer)("~s~n", [initial_info()], D#data.acc),
+               initialized = true}
+       );
 fmt(Fmt, Args,  D=#data{writer=Write, acc=Acc}) ->
     D#data{acc = Write(Fmt,Args,Acc)}.
 
@@ -221,10 +282,47 @@ setup_tracer(Type, WriteFun, MangleArgFun, Init) ->
 		      msg_formater(Type, MangleArgFun(Arg), D)
 	      end,
     InitialData = #data{writer = WriteFun,
+                        initialized = false,
                         acc = Init},
     {ok,_} = dbg:tracer(process, {Handler, InitialData}),
     ok.
 
+
+initial_info() ->
+    Lines =
+        [ts(erlang:timestamp()),
+         "",
+         "SSH:"]
+        ++ as_list_of_lines(case application:get_key(ssh,vsn) of
+                                {ok,Vsn} -> Vsn;
+                                _ -> "(ssh not started)"
+                            end)
+        ++ ["",
+            "Cryptolib:"]
+        ++ as_list_of_lines(crypto:info_lib())
+        ++ ["",
+            "Crypto app:"]
+        ++ as_list_of_lines(crypto:supports()),
+    W = max_len(Lines),
+    append_lines([line_of($*, W+4)]
+                 ++ prepend_lines("* ", Lines)
+                 ++ [line_of($-, W+4)],
+                 io_lib:nl()
+               ).
+    
+    
+as_list_of_lines(Term) ->
+    prepend_lines("  ",
+                  string:tokens(lists:flatten(io_lib:format("~p",[Term])),
+                                io_lib:nl()  % Get line endings in current OS
+                               )
+                 ).
+
+line_of(Char,W) -> lists:duplicate(W,Char).
+max_len(L) -> lists:max([length(S) || S<-L]).
+append_lines(L, X)  -> [S++X || S<-L].
+prepend_lines(X, L) -> [X++S || S<-L].
+
 %%%----------------------------------------------------------------
 shrink_bin(B) when is_binary(B), size(B)>256 -> {'*** SHRINKED BIN',
 						 size(B),
diff --git a/lib/ssh/src/ssh_transport.erl b/lib/ssh/src/ssh_transport.erl
index 0052347912..46154cf536 100644
--- a/lib/ssh/src/ssh_transport.erl
+++ b/lib/ssh/src/ssh_transport.erl
@@ -824,6 +824,7 @@ verify_host_key(#ssh{algorithms=Alg}=SSH, PublicKey, Digest, {AlgStr,Signature})
     end.
 
 
+%%% -> boolean() | {error,_}
 accepted_host(Ssh, PeerName, Public, Opts) ->
     case ?GET_OPT(silently_accept_hosts, Opts) of
 
@@ -845,11 +846,16 @@ accepted_host(Ssh, PeerName, Public, Opts) ->
 
         %% Call-back alternatives: A user provided fun is called for the decision:
         F when is_function(F,2) ->
-	    true == (catch F(PeerName, public_key:ssh_hostkey_fingerprint(Public)));
+            case catch F(PeerName, public_key:ssh_hostkey_fingerprint(Public)) of
+                true -> true;
+                _ -> {error, fingerprint_check_failed}
+            end;
 
 	{DigestAlg,F} when is_function(F,2) ->
-	    true == (catch F(PeerName, public_key:ssh_hostkey_fingerprint(DigestAlg,Public)))
-        
+            case catch F(PeerName, public_key:ssh_hostkey_fingerprint(DigestAlg,Public)) of
+                true -> true;
+                _ -> {error, {fingerprint_check_failed,DigestAlg}}
+            end
     end.
 
 
@@ -867,18 +873,27 @@ fmt_hostkey(X) -> X.
 known_host_key(#ssh{opts = Opts, key_cb = {KeyCb,KeyCbOpts}, peer = {PeerName,_}} = Ssh, 
 	       Public, Alg) ->
     UserOpts = ?GET_OPT(user_options, Opts),
-    case KeyCb:is_host_key(Public, PeerName, Alg, [{key_cb_private,KeyCbOpts}|UserOpts]) of
-	true ->
+    case is_host_key(KeyCb, Public, PeerName, Alg, [{key_cb_private,KeyCbOpts}|UserOpts]) of
+	{_,true} ->
 	    ok;
-	false ->
+	{_,false} ->
 	    case accepted_host(Ssh, PeerName, Public, Opts) of
 		true ->
-		    KeyCb:add_host_key(PeerName, Public, [{key_cb_private,KeyCbOpts}|UserOpts]);
+		    {_,R} = add_host_key(KeyCb, PeerName, Public, [{key_cb_private,KeyCbOpts}|UserOpts]),
+                    R;
 		false ->
-		    {error, rejected}
+		    {error, rejected_by_user};
+                {error,E} ->
+                    {error,E}
 	    end
     end.
 	    
+is_host_key(KeyCb, Public, PeerName, Alg, Data) ->
+    {KeyCb, KeyCb:is_host_key(Public, PeerName, Alg, Data)}.
+
+add_host_key(KeyCb, PeerName, Public, Data) ->
+    {KeyCb, KeyCb:add_host_key(PeerName, Public, Data)}.
+    
 
 %%   Each of the algorithm strings MUST be a comma-separated list of
 %%   algorithm names (see ''Algorithm Naming'' in [SSH-ARCH]).  Each