- markus@cvs.openbsd.org 2002/07/29 18:57:30

[openssh.git] / sshconnect.c

diff --git a/sshconnect.c b/sshconnect.c
index ba5deb441b0e38eef2a00b9ac6b0f1918527155a..6004bf5e41db05b29495545f156c406fca280203 100644 (file)
--- a/sshconnect.c
+++ b/sshconnect.c
@@ -13,7 +13,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: sshconnect.c,v 1.129 2002/07/09 12:04:02 itojun Exp $");
+RCSID("$OpenBSD: sshconnect.c,v 1.133 2002/07/29 18:57:30 markus Exp $");
 
 #include <openssl/bn.h>
 
@@ -46,18 +46,7 @@ extern uid_t original_effective_uid;
 #define INET6_ADDRSTRLEN 46
 #endif
 
-#if 0
-static const char *
-sockaddr_ntop(struct sockaddr *sa, socklen_t salen)
-{
-       static char addrbuf[NI_MAXHOST];
-
-       if (getnameinfo(sa, salen, addrbuf, sizeof(addrbuf), NULL, 0,
-           NI_NUMERICHOST) != 0)
-               fatal("sockaddr_ntop: getnameinfo NI_NUMERICHOST failed");
-       return addrbuf;
-}
-#endif
+static int show_other_keys(const char *, Key *);
 
 /*
  * Connect to the given ssh server using a proxy command.
@@ -309,11 +298,8 @@ ssh_connect(const char *host, struct sockaddr_storage * hostaddr,
                        } else {
                                if (errno == ECONNREFUSED)
                                        full_failure = 0;
-#if 0
-                               log("ssh: connect to address %s port %s: %s",
-                                   sockaddr_ntop(ai->ai_addr, ai->ai_addrlen),
-                                   strport, strerror(errno));
-#endif
+                               debug("connect to address %s port %s: %s",
+                                   ntop, strport, strerror(errno));
                                /*
                                 * Close the failed socket; there appear to
                                 * be some problems when reusing a socket for
@@ -336,8 +322,11 @@ ssh_connect(const char *host, struct sockaddr_storage * hostaddr,
        freeaddrinfo(aitop);
 
        /* Return failure if we didn't get a successful connection. */
-       if (attempt >= connection_attempts)
+       if (attempt >= connection_attempts) {
+               log("ssh: connect to host %s port %s: %s",
+                   host, strport, strerror(errno));
                return full_failure ? ECONNABORTED : ECONNREFUSED;
+       }
 
        debug("Connection established.");
 
@@ -507,7 +496,7 @@ check_host_key(char *host, struct sockaddr *hostaddr, Key *host_key,
        int salen;
        char ntop[NI_MAXHOST];
        char msg[1024];
-       int len, host_line, ip_line;
+       int len, host_line, ip_line, has_keys;
        const char *host_file = NULL, *ip_file = NULL;
 
        /*
@@ -651,14 +640,19 @@ check_host_key(char *host, struct sockaddr *hostaddr, Key *host_key,
                            "have requested strict checking.", type, host);
                        goto fail;
                } else if (options.strict_host_key_checking == 2) {
+                       has_keys = show_other_keys(host, host_key);
                        /* The default */
                        fp = key_fingerprint(host_key, SSH_FP_MD5, SSH_FP_HEX);
                        snprintf(msg, sizeof(msg),
                            "The authenticity of host '%.200s (%s)' can't be "
-                           "established.\n"
+                           "established%s\n"
                            "%s key fingerprint is %s.\n"
                            "Are you sure you want to continue connecting "
-                           "(yes/no)? ", host, ip, type, fp);
+                           "(yes/no)? ",
+                            host, ip,
+                            has_keys ? ",\nbut keys of different type are already "
+                            "known for this host." : ".",
+                            type, fp);
                        xfree(fp);
                        if (!confirm(msg))
                                goto fail;
@@ -761,6 +755,9 @@ check_host_key(char *host, struct sockaddr *hostaddr, Key *host_key,
                 * accept the authentication.
                 */
                break;
+       case HOST_FOUND:
+               fatal("internal error");
+               break;
        }
 
        if (options.check_host_ip && host_status != HOST_CHANGED &&
@@ -872,3 +869,58 @@ ssh_put_password(char *password)
        memset(padded, 0, size);
        xfree(padded);
 }
+
+static int
+show_key_from_file(const char *file, const char *host, int keytype)
+{
+       Key *found;
+       char *fp;
+       int line, ret;
+
+       found = key_new(keytype);
+       if ((ret = lookup_key_in_hostfile_by_type(file, host,
+           keytype, found, &line))) {
+               fp = key_fingerprint(found, SSH_FP_MD5, SSH_FP_HEX);
+               log("WARNING: %s key found for host %s\n"
+                   "in %s:%d\n"
+                   "%s key fingerprint %s.",
+                   key_type(found), host, file, line,
+                   key_type(found), fp);
+               xfree(fp);
+       }
+       key_free(found);
+       return (ret);
+}
+
+/* print all known host keys for a given host, but skip keys of given type */
+static int
+show_other_keys(const char *host, Key *key)
+{
+       int type[] = { KEY_RSA1, KEY_RSA, KEY_DSA, -1};
+       int i, found = 0;
+
+       for (i = 0; type[i] != -1; i++) {
+               if (type[i] == key->type)
+                       continue;
+               if (type[i] != KEY_RSA1 &&
+                   show_key_from_file(options.user_hostfile2, host, type[i])) {
+                       found = 1;
+                       continue;
+               }
+               if (type[i] != KEY_RSA1 &&
+                   show_key_from_file(options.system_hostfile2, host, type[i])) {
+                       found = 1;
+                       continue;
+               }
+               if (show_key_from_file(options.user_hostfile, host, type[i])) {
+                       found = 1;
+                       continue;
+               }
+               if (show_key_from_file(options.system_hostfile, host, type[i])) {
+                       found = 1;
+                       continue;
+               }
+               debug2("no key of type %d for host %s", type[i], host);
+       }
+       return (found);
+}