* Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
* All rights reserved
- * Created: Sat Mar 18 22:15:47 1995 ylo
* Code to connect to a remote host, and to perform the client side of the
* login (authentication) dialog.
+ *
+ * As far as I am concerned, the code I have written for this software
+ * can be used freely for any purpose. Any derived versions of this
+ * software must be clearly marked as such, and if the derived work is
+ * incompatible with the protocol description in the RFC file, it must be
+ * called by a name other than "ssh" or "Secure Shell".
*/
#include "includes.h"
-RCSID("$OpenBSD: sshconnect.c,v 1.77 2000/08/28 03:50:54 deraadt Exp $");
+RCSID("$OpenBSD: sshconnect.c,v 1.83 2000/11/30 22:53:35 markus Exp $");
#include <openssl/bn.h>
#include <openssl/dsa.h>
char *server_version_string = NULL;
extern Options options;
-#ifdef HAVE___PROGNAME
extern char *__progname;
-#else /* HAVE___PROGNAME */
-static const char *__progname = "ssh";
-#endif /* HAVE___PROGNAME */
/*
* Connect to the given ssh server using a proxy command.
/* Create a socket for connecting. */
sock = ssh_create_socket(original_real_uid,
#ifdef HAVE_CYGWIN
- !anonymous && port < IPPORT_RESERVED,
+ !anonymous,
#else
- !anonymous && geteuid() == 0 && port < IPPORT_RESERVED,
+ !anonymous && geteuid() == 0,
#endif
ai->ai_family);
if (sock < 0)
int remote_major, remote_minor, i, mismatch;
int connection_in = packet_get_connection_in();
int connection_out = packet_get_connection_out();
+ int minor1 = PROTOCOL_MINOR_1;
/* Read other side\'s version identification. */
for (;;) {
}
if (remote_minor < 3) {
fatal("Remote machine has too old SSH software version.");
- } else if (remote_minor == 3) {
+ } else if (remote_minor == 3 || remote_minor == 4) {
/* We speak 1.3, too. */
enable_compat13();
+ minor1 = 3;
if (options.forward_agent) {
log("Agent forwarding disabled for protocol 1.3");
options.forward_agent = 0;
/* Send our own protocol version identification. */
snprintf(buf, sizeof buf, "SSH-%d.%d-%.100s\n",
compat20 ? PROTOCOL_MAJOR_2 : PROTOCOL_MAJOR_1,
- compat20 ? PROTOCOL_MINOR_2 : PROTOCOL_MINOR_1,
+ compat20 ? PROTOCOL_MINOR_2 : minor1,
SSH_VERSION);
if (atomicio(write, connection_out, buf, strlen(buf)) != strlen(buf))
fatal("write: %.100s", strerror(errno));
retval = defval;
if (strcmp(buf, "yes") == 0)
retval = 1;
- if (strcmp(buf, "no") == 0)
+ else if (strcmp(buf, "no") == 0)
retval = 0;
+ else
+ fprintf(stderr, "Please type 'yes' or 'no'.\n");
if (retval != -1) {
if (f != stdin)
if (options.proxy_command != NULL && options.check_host_ip)
options.check_host_ip = 0;
- if (options.check_host_ip) {
- if (getnameinfo(hostaddr, salen, ntop, sizeof(ntop),
- NULL, 0, NI_NUMERICHOST) != 0)
- fatal("check_host_key: getnameinfo failed");
- ip = xstrdup(ntop);
- }
-
+ if (getnameinfo(hostaddr, salen, ntop, sizeof(ntop),
+ NULL, 0, NI_NUMERICHOST) != 0)
+ fatal("check_host_key: getnameinfo failed");
+ ip = xstrdup(ntop);
+
/*
* Store the host key from the known host file in here so that we can
* compare it with the key for the IP address.
char prompt[1024];
char *fp = key_fingerprint(host_key);
snprintf(prompt, sizeof(prompt),
- "The authenticity of host '%.200s' can't be established.\n"
+ "The authenticity of host '%.200s (%s)' can't be established.\n"
"%s key fingerprint is %s.\n"
"Are you sure you want to continue connecting (yes/no)? ",
- host, type, fp);
+ host, ip, type, fp);
if (!read_yes_or_no(prompt, -1))
fatal("Aborted by user!\n");
}
error("Agent forwarding is disabled to avoid trojan horses.");
options.forward_agent = 0;
}
+ if (options.forward_x11) {
+ error("X11 forwarding is disabled to avoid trojan horses.");
+ options.forward_x11 = 0;
+ }
+ if (options.num_local_forwards > 0 || options.num_remote_forwards > 0) {
+ error("Port forwarding is disabled to avoid trojan horses.");
+ options.num_local_forwards = options.num_remote_forwards = 0;
+ }
/*
* XXX Should permit the user to change to use the new id.
* This could be done by converting the host key to an
*/
break;
}
- if (options.check_host_ip)
- xfree(ip);
+
+ xfree(ip);
}
/*