- djm@cvs.openbsd.org 2005/03/01 10:40:27

[openssh.git] / sshconnect.c

diff --git a/sshconnect.c b/sshconnect.c
index 5972e2ba963bc37fa9138fd5ae04e0d07e7bcd84..bafe7ba925b7dd1db3b035bff30f11b290d8b946 100644 (file)
--- a/sshconnect.c
+++ b/sshconnect.c
@@ -13,7 +13,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: sshconnect.c,v 1.153 2003/11/12 16:39:58 jakob Exp $");
+RCSID("$OpenBSD: sshconnect.c,v 1.160 2005/03/01 10:40:27 djm Exp $");
 
 #include <openssl/bn.h>
 
@@ -31,7 +31,6 @@ RCSID("$OpenBSD: sshconnect.c,v 1.153 2003/11/12 16:39:58 jakob Exp $");
 #include "readconf.h"
 #include "atomicio.h"
 #include "misc.h"
-#include "readpass.h"
 
 #include "dns.h"
 
@@ -74,7 +73,7 @@ ssh_proxy_connect(const char *host, u_short port, const char *proxy_command)
         * Build the final command string in the buffer by making the
         * appropriate substitutions to the given proxy command.
         *
-        * Use "exec" to avoid "sh -c" processes on some platforms 
+        * Use "exec" to avoid "sh -c" processes on some platforms
         * (e.g. Solaris)
         */
        buffer_init(&command);
@@ -231,12 +230,12 @@ timeout_connect(int sockfd, const struct sockaddr *serv_addr,
        if (timeout <= 0)
                return (connect(sockfd, serv_addr, addrlen));
 
-       if (fcntl(sockfd, F_SETFL, O_NONBLOCK) < 0)
-               return (-1);
-
+       set_nonblock(sockfd);
        rc = connect(sockfd, serv_addr, addrlen);
-       if (rc == 0)
+       if (rc == 0) {
+               unset_nonblock(sockfd);
                return (0);
+       }
        if (errno != EINPROGRESS)
                return (-1);
 
@@ -261,15 +260,15 @@ timeout_connect(int sockfd, const struct sockaddr *serv_addr,
                break;
        case -1:
                /* Select error */
-               debug("select: %s", strerror(errno));
+               debug("select: %s", strerror(errno));
                break;
        case 1:
                /* Completed or failed */
                optval = 0;
                optlen = sizeof(optval);
-               if (getsockopt(sockfd, SOL_SOCKET, SO_ERROR, &optval, 
+               if (getsockopt(sockfd, SOL_SOCKET, SO_ERROR, &optval,
                    &optlen) == -1) {
-                       debug("getsockopt: %s", strerror(errno));
+                       debug("getsockopt: %s", strerror(errno));
                        break;
                }
                if (optval != 0) {
@@ -277,6 +276,7 @@ timeout_connect(int sockfd, const struct sockaddr *serv_addr,
                        break;
                }
                result = 0;
+               unset_nonblock(sockfd);
                break;
        default:
                /* Should not occur */
@@ -297,12 +297,6 @@ timeout_connect(int sockfd, const struct sockaddr *serv_addr,
  * second).  If proxy_command is non-NULL, it specifies the command (with %h
  * and %p substituted for host and port, respectively) to use to contact
  * the daemon.
- * Return values:
- *    0 for OK
- *    ECONNREFUSED if we got a "Connection Refused" by the peer on any address
- *    ECONNABORTED if we failed without a "Connection refused"
- * Suitable error messages for the connection failure will already have been
- * printed.
  */
 int
 ssh_connect(const char *host, struct sockaddr_storage * hostaddr,
@@ -315,12 +309,6 @@ ssh_connect(const char *host, struct sockaddr_storage * hostaddr,
        char ntop[NI_MAXHOST], strport[NI_MAXSERV];
        struct addrinfo hints, *ai, *aitop;
        struct servent *sp;
-       /*
-        * Did we get only other errors than "Connection refused" (which
-        * should block fallback to rsh and similar), or did we get at least
-        * one "Connection refused"?
-        */
-       int full_failure = 1;
 
        debug2("ssh_connect: needpriv %d", needpriv);
 
@@ -381,8 +369,6 @@ ssh_connect(const char *host, struct sockaddr_storage * hostaddr,
                                memcpy(hostaddr, ai->ai_addr, ai->ai_addrlen);
                                break;
                        } else {
-                               if (errno == ECONNREFUSED)
-                                       full_failure = 0;
                                debug("connect to address %s port %s: %s",
                                    ntop, strport, strerror(errno));
                                /*
@@ -408,15 +394,15 @@ ssh_connect(const char *host, struct sockaddr_storage * hostaddr,
 
        /* Return failure if we didn't get a successful connection. */
        if (attempt >= connection_attempts) {
-               logit("ssh: connect to host %s port %s: %s",
+               error("ssh: connect to host %s port %s: %s",
                    host, strport, strerror(errno));
-               return full_failure ? ECONNABORTED : ECONNREFUSED;
+               return (-1);
        }
 
        debug("Connection established.");
 
-       /* Set keepalives if requested. */
-       if (options.keepalives &&
+       /* Set SO_KEEPALIVE if requested. */
+       if (options.tcp_keep_alive &&
            setsockopt(sock, SOL_SOCKET, SO_KEEPALIVE, (void *)&on,
            sizeof(on)) < 0)
                error("setsockopt SO_KEEPALIVE: %.100s", strerror(errno));
@@ -692,7 +678,7 @@ check_host_key(char *host, struct sockaddr *hostaddr, Key *host_key,
                                    "'%.128s' not in list of known hosts.",
                                    type, ip);
                        else if (!add_host_to_hostfile(user_hostfile, ip,
-                           host_key))
+                           host_key, options.hash_known_hosts))
                                logit("Failed to add the %s host key for IP "
                                    "address '%.128s' to the list of known "
                                    "hosts (%.30s).", type, ip, user_hostfile);
@@ -758,7 +744,8 @@ check_host_key(char *host, struct sockaddr *hostaddr, Key *host_key,
                 * If not in strict mode, add the key automatically to the
                 * local known_hosts file.
                 */
-               if (!add_host_to_hostfile(user_hostfile, hostp, host_key))
+               if (!add_host_to_hostfile(user_hostfile, hostp, host_key,
+                   options.hash_known_hosts))
                        logit("Failed to add the host to the list of known "
                            "hosts (%.500s).", user_hostfile);
                else
@@ -767,19 +754,19 @@ check_host_key(char *host, struct sockaddr *hostaddr, Key *host_key,
                break;
        case HOST_CHANGED:
                if (options.check_host_ip && host_ip_differ) {
-                       char *msg;
+                       char *key_msg;
                        if (ip_status == HOST_NEW)
-                               msg = "is unknown";
+                               key_msg = "is unknown";
                        else if (ip_status == HOST_OK)
-                               msg = "is unchanged";
+                               key_msg = "is unchanged";
                        else
-                               msg = "has a different value";
+                               key_msg = "has a different value";
                        error("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@");
                        error("@       WARNING: POSSIBLE DNS SPOOFING DETECTED!          @");
                        error("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@");
                        error("The %s host key for %s has changed,", type, host);
                        error("and the key for the according IP address %s", ip);
-                       error("%s. This could either mean that", msg);
+                       error("%s. This could either mean that", key_msg);
                        error("DNS SPOOFING is happening or the IP address for the host");
                        error("and its host key have changed at the same time.");
                        if (ip_status != HOST_NEW)