- (stevesk) OpenSSH CVS update:

[openssh.git] / sshconnect.c

diff --git a/sshconnect.c b/sshconnect.c
index 7144040ef27951c826ac9ff2f5f2899749a057c9..b54e75a8a29fbb29ff5fbf3163d91727043bfce3 100644 (file)
--- a/sshconnect.c
+++ b/sshconnect.c
@@ -13,7 +13,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: sshconnect.c,v 1.78 2000/09/07 20:27:54 deraadt Exp $");
+RCSID("$OpenBSD: sshconnect.c,v 1.83 2000/11/30 22:53:35 markus Exp $");
 
 #include <openssl/bn.h>
 #include <openssl/dsa.h>
@@ -35,11 +35,7 @@ char *client_version_string = NULL;
 char *server_version_string = NULL;
 
 extern Options options;
-#ifdef HAVE___PROGNAME
 extern char *__progname;
-#else /* HAVE___PROGNAME */
-static const char *__progname = "ssh";
-#endif /* HAVE___PROGNAME */
 
 /*
  * Connect to the given ssh server using a proxy command.
@@ -249,9 +245,9 @@ ssh_connect(const char *host, struct sockaddr_storage * hostaddr,
                        /* Create a socket for connecting. */
                        sock = ssh_create_socket(original_real_uid,
 #ifdef HAVE_CYGWIN
-                           !anonymous && port < IPPORT_RESERVED,
+                           !anonymous,
 #else
-                           !anonymous && geteuid() == 0 && port < IPPORT_RESERVED,
+                           !anonymous && geteuid() == 0,
 #endif
                            ai->ai_family);
                        if (sock < 0)
@@ -321,6 +317,7 @@ ssh_exchange_identification()
        int remote_major, remote_minor, i, mismatch;
        int connection_in = packet_get_connection_in();
        int connection_out = packet_get_connection_out();
+       int minor1 = PROTOCOL_MINOR_1; 
 
        /* Read other side\'s version identification. */
        for (;;) {
@@ -374,9 +371,10 @@ ssh_exchange_identification()
                }
                if (remote_minor < 3) {
                        fatal("Remote machine has too old SSH software version.");
-               } else if (remote_minor == 3) {
+               } else if (remote_minor == 3 || remote_minor == 4) {
                        /* We speak 1.3, too. */
                        enable_compat13();
+                       minor1 = 3;
                        if (options.forward_agent) {
                                log("Agent forwarding disabled for protocol 1.3");
                                options.forward_agent = 0;
@@ -402,7 +400,7 @@ ssh_exchange_identification()
        /* Send our own protocol version identification. */
        snprintf(buf, sizeof buf, "SSH-%d.%d-%.100s\n",
            compat20 ? PROTOCOL_MAJOR_2 : PROTOCOL_MAJOR_1,
-           compat20 ? PROTOCOL_MINOR_2 : PROTOCOL_MINOR_1,
+           compat20 ? PROTOCOL_MINOR_2 : minor1,
            SSH_VERSION);
        if (atomicio(write, connection_out, buf, strlen(buf)) != strlen(buf))
                fatal("write: %.100s", strerror(errno));
@@ -444,8 +442,10 @@ read_yes_or_no(const char *prompt, int defval)
                        retval = defval;
                if (strcmp(buf, "yes") == 0)
                        retval = 1;
-               if (strcmp(buf, "no") == 0)
+               else if (strcmp(buf, "no") == 0)
                        retval = 0;
+               else
+                       fprintf(stderr, "Please type 'yes' or 'no'.\n");
 
                if (retval != -1) {
                        if (f != stdin)
@@ -508,13 +508,11 @@ check_host_key(char *host, struct sockaddr *hostaddr, Key *host_key,
        if (options.proxy_command != NULL && options.check_host_ip)
                options.check_host_ip = 0;
 
-       if (options.check_host_ip) {
-               if (getnameinfo(hostaddr, salen, ntop, sizeof(ntop),
-                   NULL, 0, NI_NUMERICHOST) != 0)
-                       fatal("check_host_key: getnameinfo failed");
-               ip = xstrdup(ntop);
-       }
-
+       if (getnameinfo(hostaddr, salen, ntop, sizeof(ntop),
+                       NULL, 0, NI_NUMERICHOST) != 0)
+               fatal("check_host_key: getnameinfo failed");
+       ip = xstrdup(ntop);
+  
        /*
         * Store the host key from the known host file in here so that we can
         * compare it with the key for the IP address.
@@ -577,10 +575,10 @@ check_host_key(char *host, struct sockaddr *hostaddr, Key *host_key,
                        char prompt[1024];
                        char *fp = key_fingerprint(host_key);
                        snprintf(prompt, sizeof(prompt),
-                           "The authenticity of host '%.200s' can't be established.\n"
+                           "The authenticity of host '%.200s (%s)' can't be established.\n"
                            "%s key fingerprint is %s.\n"
                            "Are you sure you want to continue connecting (yes/no)? ",
-                           host, type, fp);
+                           host, ip, type, fp);
                        if (!read_yes_or_no(prompt, -1))
                                fatal("Aborted by user!\n");
                }
@@ -647,6 +645,14 @@ check_host_key(char *host, struct sockaddr *hostaddr, Key *host_key,
                        error("Agent forwarding is disabled to avoid trojan horses.");
                        options.forward_agent = 0;
                }
+               if (options.forward_x11) {
+                       error("X11 forwarding is disabled to avoid trojan horses.");
+                       options.forward_x11 = 0;
+               }
+               if (options.num_local_forwards > 0 || options.num_remote_forwards > 0) {
+                       error("Port forwarding is disabled to avoid trojan horses.");
+                       options.num_local_forwards = options.num_remote_forwards = 0;
+               }
                /*
                 * XXX Should permit the user to change to use the new id.
                 * This could be done by converting the host key to an
@@ -656,8 +662,8 @@ check_host_key(char *host, struct sockaddr *hostaddr, Key *host_key,
                 */
                break;
        }
-       if (options.check_host_ip)
-               xfree(ip);
+
+       xfree(ip);
 }
 
 /*