diff options
author | Damien Miller <djm@mindrot.org> | 2000-05-07 12:03:14 +1000 |
---|---|---|
committer | Damien Miller <djm@mindrot.org> | 2000-05-07 12:03:14 +1000 |
commit | e247cc402bc391650f014316363dbce78ad85dc7 (patch) | |
tree | 65d72c3d3514c6119f47017f14b71ed153485a5d /sshconnect.c | |
parent | 0437b33e54fd72060d17908d6abf96bfabaacad2 (diff) |
- Remove references to SSLeay.
- Big OpenBSD CVS update
- markus@cvs.openbsd.org
[clientloop.c]
- typo
[session.c]
- update proctitle on pty alloc/dealloc, e.g. w/ windows client
[session.c]
- update proctitle for proto 1, too
[channels.h nchan.c serverloop.c session.c sshd.c]
- use c-style comments
- deraadt@cvs.openbsd.org
[scp.c]
- more atomicio
- markus@cvs.openbsd.org
[channels.c]
- set O_NONBLOCK
[ssh.1]
- update AUTHOR
[readconf.c ssh-keygen.c ssh.h]
- default DSA key file ~/.ssh/id_dsa
[clientloop.c]
- typo, rm verbose debug
- deraadt@cvs.openbsd.org
[ssh-keygen.1]
- document DSA use of ssh-keygen
[sshd.8]
- a start at describing what i understand of the DSA side
[ssh-keygen.1]
- document -X and -x
[ssh-keygen.c]
- simplify usage
- markus@cvs.openbsd.org
[sshd.8]
- there is no rhosts_dsa
[ssh-keygen.1]
- document -y, update -X,-x
[nchan.c]
- fix close for non-open ssh1 channels
[servconf.c servconf.h ssh.h sshd.8 sshd.c ]
- s/DsaKey/HostDSAKey/, document option
[sshconnect2.c]
- respect number_of_password_prompts
[channels.c channels.h servconf.c servconf.h session.c sshd.8]
- GatewayPorts for sshd, ok deraadt@
[ssh-add.1 ssh-agent.1 ssh.1]
- more doc on: DSA, id_dsa, known_hosts2, authorized_keys2
[ssh.1]
- more info on proto 2
[sshd.8]
- sync AUTHOR w/ ssh.1
[key.c key.h sshconnect.c]
- print key type when talking about host keys
[packet.c]
- clear padding in ssh2
[dsa.c key.c radix.c ssh.h sshconnect1.c uuencode.c uuencode.h]
- replace broken uuencode w/ libc b64_ntop
[auth2.c]
- log failure before sending the reply
[key.c radix.c uuencode.c]
- remote trailing comments before calling __b64_pton
[auth2.c readconf.c readconf.h servconf.c servconf.h ssh.1]
[sshconnect2.c sshd.8]
- add DSAAuthetication option to ssh/sshd, document SSH2 in sshd.8
- Bring in b64_ntop and b64_pton from OpenBSD libc (bsd-base64.[ch])
Diffstat (limited to 'sshconnect.c')
-rw-r--r-- | sshconnect.c | 34 |
1 files changed, 18 insertions, 16 deletions
diff --git a/sshconnect.c b/sshconnect.c index 859450d36..9b25d7c20 100644 --- a/sshconnect.c +++ b/sshconnect.c | |||
@@ -8,7 +8,7 @@ | |||
8 | */ | 8 | */ |
9 | 9 | ||
10 | #include "includes.h" | 10 | #include "includes.h" |
11 | RCSID("$OpenBSD: sshconnect.c,v 1.71 2000/04/26 21:28:33 markus Exp $"); | 11 | RCSID("$OpenBSD: sshconnect.c,v 1.72 2000/05/04 09:50:22 markus Exp $"); |
12 | 12 | ||
13 | #include <openssl/bn.h> | 13 | #include <openssl/bn.h> |
14 | #include <openssl/dsa.h> | 14 | #include <openssl/dsa.h> |
@@ -465,6 +465,7 @@ check_host_key(char *host, struct sockaddr *hostaddr, Key *host_key, | |||
465 | const char *user_hostfile, const char *system_hostfile) | 465 | const char *user_hostfile, const char *system_hostfile) |
466 | { | 466 | { |
467 | Key *file_key; | 467 | Key *file_key; |
468 | char *type = key_type(host_key); | ||
468 | char *ip = NULL; | 469 | char *ip = NULL; |
469 | char hostline[1000], *hostp; | 470 | char hostline[1000], *hostp; |
470 | HostStatus host_status; | 471 | HostStatus host_status; |
@@ -551,18 +552,19 @@ check_host_key(char *host, struct sockaddr *hostaddr, Key *host_key, | |||
551 | switch (host_status) { | 552 | switch (host_status) { |
552 | case HOST_OK: | 553 | case HOST_OK: |
553 | /* The host is known and the key matches. */ | 554 | /* The host is known and the key matches. */ |
554 | debug("Host '%.200s' is known and matches the host key.", host); | 555 | debug("Host '%.200s' is known and matches the %s host key.", |
556 | host, type); | ||
555 | if (options.check_host_ip) { | 557 | if (options.check_host_ip) { |
556 | if (ip_status == HOST_NEW) { | 558 | if (ip_status == HOST_NEW) { |
557 | if (!add_host_to_hostfile(user_hostfile, ip, host_key)) | 559 | if (!add_host_to_hostfile(user_hostfile, ip, host_key)) |
558 | log("Failed to add the host key for IP address '%.30s' to the list of known hosts (%.30s).", | 560 | log("Failed to add the %s host key for IP address '%.30s' to the list of known hosts (%.30s).", |
559 | ip, user_hostfile); | 561 | type, ip, user_hostfile); |
560 | else | 562 | else |
561 | log("Warning: Permanently added host key for IP address '%.30s' to the list of known hosts.", | 563 | log("Warning: Permanently added the %s host key for IP address '%.30s' to the list of known hosts.", |
562 | ip); | 564 | type, ip); |
563 | } else if (ip_status != HOST_OK) | 565 | } else if (ip_status != HOST_OK) |
564 | log("Warning: the host key for '%.200s' differs from the key for the IP address '%.30s'", | 566 | log("Warning: the %s host key for '%.200s' differs from the key for the IP address '%.30s'", |
565 | host, ip); | 567 | type, host, ip); |
566 | } | 568 | } |
567 | break; | 569 | break; |
568 | case HOST_NEW: | 570 | case HOST_NEW: |
@@ -570,16 +572,16 @@ check_host_key(char *host, struct sockaddr *hostaddr, Key *host_key, | |||
570 | if (options.strict_host_key_checking == 1) { | 572 | if (options.strict_host_key_checking == 1) { |
571 | /* User has requested strict host key checking. We will not add the host key | 573 | /* User has requested strict host key checking. We will not add the host key |
572 | automatically. The only alternative left is to abort. */ | 574 | automatically. The only alternative left is to abort. */ |
573 | fatal("No host key is known for %.200s and you have requested strict checking.", host); | 575 | fatal("No %s host key is known for %.200s and you have requested strict checking.", type, host); |
574 | } else if (options.strict_host_key_checking == 2) { | 576 | } else if (options.strict_host_key_checking == 2) { |
575 | /* The default */ | 577 | /* The default */ |
576 | char prompt[1024]; | 578 | char prompt[1024]; |
577 | char *fp = key_fingerprint(host_key); | 579 | char *fp = key_fingerprint(host_key); |
578 | snprintf(prompt, sizeof(prompt), | 580 | snprintf(prompt, sizeof(prompt), |
579 | "The authenticity of host '%.200s' can't be established.\n" | 581 | "The authenticity of host '%.200s' can't be established.\n" |
580 | "Key fingerprint is %s.\n" | 582 | "%s key fingerprint is %s.\n" |
581 | "Are you sure you want to continue connecting (yes/no)? ", | 583 | "Are you sure you want to continue connecting (yes/no)? ", |
582 | host, fp); | 584 | host, type, fp); |
583 | if (!read_yes_or_no(prompt, -1)) | 585 | if (!read_yes_or_no(prompt, -1)) |
584 | fatal("Aborted by user!\n"); | 586 | fatal("Aborted by user!\n"); |
585 | } | 587 | } |
@@ -594,8 +596,8 @@ check_host_key(char *host, struct sockaddr *hostaddr, Key *host_key, | |||
594 | log("Failed to add the host to the list of known hosts (%.500s).", | 596 | log("Failed to add the host to the list of known hosts (%.500s).", |
595 | user_hostfile); | 597 | user_hostfile); |
596 | else | 598 | else |
597 | log("Warning: Permanently added '%.200s' to the list of known hosts.", | 599 | log("Warning: Permanently added '%.200s' (%s) to the list of known hosts.", |
598 | hostp); | 600 | hostp, type); |
599 | break; | 601 | break; |
600 | case HOST_CHANGED: | 602 | case HOST_CHANGED: |
601 | if (options.check_host_ip && host_ip_differ) { | 603 | if (options.check_host_ip && host_ip_differ) { |
@@ -609,7 +611,7 @@ check_host_key(char *host, struct sockaddr *hostaddr, Key *host_key, | |||
609 | error("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@"); | 611 | error("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@"); |
610 | error("@ WARNING: POSSIBLE DNS SPOOFING DETECTED! @"); | 612 | error("@ WARNING: POSSIBLE DNS SPOOFING DETECTED! @"); |
611 | error("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@"); | 613 | error("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@"); |
612 | error("The host key for %s has changed,", host); | 614 | error("The %s host key for %s has changed,", type, host); |
613 | error("and the key for the according IP address %s", ip); | 615 | error("and the key for the according IP address %s", ip); |
614 | error("%s. This could either mean that", msg); | 616 | error("%s. This could either mean that", msg); |
615 | error("DNS SPOOFING is happening or the IP address for the host"); | 617 | error("DNS SPOOFING is happening or the IP address for the host"); |
@@ -621,7 +623,7 @@ check_host_key(char *host, struct sockaddr *hostaddr, Key *host_key, | |||
621 | error("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@"); | 623 | error("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@"); |
622 | error("IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!"); | 624 | error("IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!"); |
623 | error("Someone could be eavesdropping on you right now (man-in-the-middle attack)!"); | 625 | error("Someone could be eavesdropping on you right now (man-in-the-middle attack)!"); |
624 | error("It is also possible that the host key has just been changed."); | 626 | error("It is also possible that the %s host key has just been changed.", type); |
625 | error("Please contact your system administrator."); | 627 | error("Please contact your system administrator."); |
626 | error("Add correct host key in %.100s to get rid of this message.", | 628 | error("Add correct host key in %.100s to get rid of this message.", |
627 | user_hostfile); | 629 | user_hostfile); |
@@ -631,7 +633,7 @@ check_host_key(char *host, struct sockaddr *hostaddr, Key *host_key, | |||
631 | * to edit the key manually and we can only abort. | 633 | * to edit the key manually and we can only abort. |
632 | */ | 634 | */ |
633 | if (options.strict_host_key_checking) | 635 | if (options.strict_host_key_checking) |
634 | fatal("Host key for %.200s has changed and you have requested strict checking.", host); | 636 | fatal("%s host key for %.200s has changed and you have requested strict checking.", type, host); |
635 | 637 | ||
636 | /* | 638 | /* |
637 | * If strict host key checking has not been requested, allow | 639 | * If strict host key checking has not been requested, allow |