upstream commit

Revert commitid: gJtIN6rRTS3CHy9b.

-------------
identify the case where SSHFP records are missing but other DNS RR
types are present and display a more useful error message for this
case; patch by Thordur Bjornsson; bz#2501; ok dtucker@
-------------

This caused unexpected failures when VerifyHostKeyDNS=yes, SSHFP results
are missing but the user already has the key in known_hosts

Spotted by dtucker@

Upstream-ID: 97e31742fddaf72046f6ffef091ec0d823299920

1 files changed, 6 insertions, 43 deletions

diff --git a/sshconnect.c b/sshconnect.c
index 608566207..dc7a704d2 100644
--- a/sshconnect.c
+++ b/sshconnect.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshconnect.c,v 1.286 2017/09/12 06:32:07 djm Exp $ */
+/* $OpenBSD: sshconnect.c,v 1.287 2017/09/14 04:32:21 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -83,7 +83,6 @@ extern uid_t original_effective_uid;
 
 static int show_other_keys(struct hostkeys *, struct sshkey *);
 static void warn_changed_key(struct sshkey *);
-static void warn_missing_key(struct sshkey *);
 
 /* Expand a proxy command */
 static char *
@@ -871,16 +870,6 @@ check_host_key(char *hostname, struct sockaddr *hostaddr, u_short port,
                         free(ra);
                         free(fp);
                 }
-                if (options.verify_host_key_dns &&
-                    options.strict_host_key_checking &&
-                    !matching_host_key_dns) {
-                        snprintf(msg, sizeof(msg),
-                            "Are you sure you want to continue connecting "
-                            "(yes/no)? ");
-                        if (!confirm(msg))
-                                goto fail;
-                        msg[0] = '\0';
-                }
                 hostkey_trusted = 1;
                 break;
         case HOST_NEW:
@@ -1282,17 +1271,10 @@ verify_host_key(char *host, struct sockaddr *hostaddr, struct sshkey *host_key)
                                 if (flags & DNS_VERIFY_MATCH) {
                                         matching_host_key_dns = 1;
                                 } else {
-                                        if (flags & DNS_VERIFY_MISSING) {
-                                                warn_missing_key(plain);
-                                                error("Add this host key to "
-                                                    "the SSHFP RR in DNS to get rid "
-                                                    "of this message.");
-                                        } else {
-                                                warn_changed_key(plain);
-                                                error("Update the SSHFP RR in DNS "
-                                                    "with the new host key to get rid "
-                                                    "of this message.");
-                                        }
+                                        warn_changed_key(plain);
+                                        error("Update the SSHFP RR in DNS "
+                                            "with the new host key to get rid "
+                                            "of this message.");
                                 }
                         }
                 }
@@ -1424,31 +1406,12 @@ warn_changed_key(struct sshkey *host_key)
         error("Someone could be eavesdropping on you right now (man-in-the-middle attack)!");
         error("It is also possible that a host key has just been changed.");
         error("The fingerprint for the %s key sent by the remote host is\n%s.",
-            sshkey_type(host_key), fp);
+            key_type(host_key), fp);
         error("Please contact your system administrator.");
 
         free(fp);
 }
 
-static void
-warn_missing_key(struct sshkey *host_key)
-{
-        char *fp;
-
-        fp = sshkey_fingerprint(host_key, options.fingerprint_hash,
-            SSH_FP_DEFAULT);
-        if (fp == NULL)
-                fatal("%s: sshkey_fingerprint fail", __func__);
-
-        error("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@");
-        error("@    WARNING: REMOTE HOST IDENTIFICATION IS MISSING       @");
-        error("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@");
-        error("The fingerprint for the %s key sent by the remote host is\n%s.",
-            sshkey_type(host_key), fp);
-        error("Please contact your system administrator.");
-
-        free(fp);
-}
 /*
  * Execute a local command
  */