1 files changed, 25 insertions, 6 deletions

diff --git a/sshconnect.c b/sshconnect.c
index 324f5e0a3..563405ecb 100644
--- a/sshconnect.c
+++ b/sshconnect.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshconnect.c,v 1.246 2014/02/06 22:21:01 djm Exp $ */
+/* $OpenBSD: sshconnect.c,v 1.251 2014/07/15 15:54:14 millert Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -54,9 +54,9 @@
 #include "sshconnect.h"
 #include "hostfile.h"
 #include "log.h"
+#include "misc.h"
 #include "readconf.h"
 #include "atomicio.h"
-#include "misc.h"
 #include "dns.h"
 #include "roaming.h"
 #include "monitor_fdpass.h"
@@ -65,6 +65,7 @@
 
 char *client_version_string = NULL;
 char *server_version_string = NULL;
+Key *previous_host_key = NULL;
 
 static int matching_host_key_dns = 0;
 
@@ -709,7 +710,7 @@ check_host_cert(const char *host, const Key *host_key)
                 error("%s", reason);
                 return 0;
         }
-        if (buffer_len(&host_key->cert->critical) != 0) {
+        if (buffer_len(host_key->cert->critical) != 0) {
                 error("Certificate for %s contains unsupported "
                     "critical options(s)", host);
                 return 0;
@@ -1222,7 +1223,7 @@ fail:
 int
 verify_host_key(char *host, struct sockaddr *hostaddr, Key *host_key)
 {
-        int flags = 0;
+        int r = -1, flags = 0;
         char *fp;
         Key *plain = NULL;
 
@@ -1230,6 +1231,11 @@ verify_host_key(char *host, struct sockaddr *hostaddr, Key *host_key)
         debug("Server host key: %s %s", key_type(host_key), fp);
         free(fp);
 
+        if (key_equal(previous_host_key, host_key)) {
+                debug("%s: server host key matches cached key", __func__);
+                return 0;
+        }
+
         if (options.verify_host_key_dns) {
                 /*
                  * XXX certs are not yet supported for DNS, so downgrade
@@ -1244,7 +1250,8 @@ verify_host_key(char *host, struct sockaddr *hostaddr, Key *host_key)
                                     flags & DNS_VERIFY_MATCH &&
                                     flags & DNS_VERIFY_SECURE) {
                                         key_free(plain);
-                                        return 0;
+                                        r = 0;
+                                        goto done;
                                 }
                                 if (flags & DNS_VERIFY_MATCH) {
                                         matching_host_key_dns = 1;
@@ -1259,9 +1266,17 @@ verify_host_key(char *host, struct sockaddr *hostaddr, Key *host_key)
                 key_free(plain);
         }
 
-        return check_host_key(host, hostaddr, options.port, host_key, RDRW,
+        r = check_host_key(host, hostaddr, options.port, host_key, RDRW,
             options.user_hostfiles, options.num_user_hostfiles,
             options.system_hostfiles, options.num_system_hostfiles);
+
+done:
+        if (r == 0 && host_key != NULL) {
+                key_free(previous_host_key);
+                previous_host_key = key_from_private(host_key);
+        }
+
+        return r;
 }
 
 /*
@@ -1297,8 +1312,12 @@ ssh_login(Sensitive *sensitive, const char *orighost,
                 ssh_kex2(host, hostaddr, port);
                 ssh_userauth2(local_user, server_user, host, sensitive);
         } else {
+#ifdef WITH_SSH1
                 ssh_kex(host, hostaddr);
                 ssh_userauth1(local_user, server_user, host, sensitive);
+#else
+                fatal("ssh1 is not unsupported");
+#endif
         }
         free(local_user);
 }