*/
#include "includes.h"
-RCSID("$OpenBSD: sshconnect.c,v 1.96 2001/02/08 22:35:30 markus Exp $");
+RCSID("$OpenBSD: sshconnect.c,v 1.104 2001/04/12 19:15:25 markus Exp $");
#include <openssl/bn.h>
* Connect to the given ssh server using a proxy command.
*/
int
-ssh_proxy_connect(const char *host, u_short port, uid_t original_real_uid,
+ssh_proxy_connect(const char *host, u_short port, struct passwd *pw,
const char *proxy_command)
{
Buffer command;
char *argv[10];
/* Child. Permanently give up superuser privileges. */
- permanently_set_uid(original_real_uid);
+ permanently_set_uid(pw);
/* Redirect stdin and stdout. */
close(pin[1]);
* Creates a (possibly privileged) socket for use as the ssh connection.
*/
int
-ssh_create_socket(uid_t original_real_uid, int privileged, int family)
+ssh_create_socket(struct passwd *pw, int privileged, int family)
{
int sock;
* Just create an ordinary socket on arbitrary port. We use
* the user's uid to create the socket.
*/
- temporarily_use_uid(original_real_uid);
+ temporarily_use_uid(pw);
sock = socket(family, SOCK_STREAM, 0);
if (sock < 0)
error("socket: %.100s", strerror(errno));
int
ssh_connect(const char *host, struct sockaddr_storage * hostaddr,
u_short port, int connection_attempts,
- int anonymous, uid_t original_real_uid,
+ int anonymous, struct passwd *pw,
const char *proxy_command)
{
int gaierr;
}
/* If a proxy command is given, connect using it. */
if (proxy_command != NULL)
- return ssh_proxy_connect(host, port, original_real_uid, proxy_command);
+ return ssh_proxy_connect(host, port, pw, proxy_command);
/* No proxy command. */
host, ntop, strport);
/* Create a socket for connecting. */
- sock = ssh_create_socket(original_real_uid,
+ sock = ssh_create_socket(pw,
#ifdef HAVE_CYGWIN
!anonymous,
#else
* hope that it will help with tcp_wrappers showing
* the remote uid as root.
*/
- temporarily_use_uid(original_real_uid);
+ temporarily_use_uid(pw);
if (connect(sock, ai->ai_addr, ai->ai_addrlen) >= 0) {
/* Successful connection. */
memcpy(hostaddr, ai->ai_addr, ai->ai_addrlen);
Key *file_key;
char *type = key_type(host_key);
char *ip = NULL;
- char hostline[1000], *hostp;
+ char hostline[1000], *hostp, *fp;
HostStatus host_status;
HostStatus ip_status;
int local = 0, host_ip_differ = 0;
debug("Found key in %s:%d", host_file, host_line);
if (options.check_host_ip && ip_status == HOST_NEW) {
if (!add_host_to_hostfile(user_hostfile, ip, host_key))
- log("Failed to add the %s host key for IP address '%.30s' to the list of known hosts (%.30s).",
+ log("Failed to add the %s host key for IP address '%.128s' to the list of known hosts (%.30s).",
type, ip, user_hostfile);
else
- log("Warning: Permanently added the %s host key for IP address '%.30s' to the list of known hosts.",
+ log("Warning: Permanently added the %s host key for IP address '%.128s' to the list of known hosts.",
type, ip);
}
break;
} else if (options.strict_host_key_checking == 2) {
/* The default */
char prompt[1024];
+ fp = key_fingerprint(host_key, SSH_FP_MD5, SSH_FP_HEX);
snprintf(prompt, sizeof(prompt),
"The authenticity of host '%.200s (%s)' can't be established.\n"
"%s key fingerprint is %s.\n"
"Are you sure you want to continue connecting (yes/no)? ",
- host, ip, type, key_fingerprint(host_key));
+ host, ip, type, fp);
+ xfree(fp);
if (!read_yes_or_no(prompt, -1))
- fatal("Aborted by user!\n");
+ fatal("Aborted by user!");
}
if (options.check_host_ip && ip_status == HOST_NEW) {
snprintf(hostline, sizeof(hostline), "%s,%s", host, ip);
error("Offending key for IP in %s:%d", ip_file, ip_line);
}
/* The host key has changed. */
+ fp = key_fingerprint(host_key, SSH_FP_MD5, SSH_FP_HEX);
error("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@");
error("@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @");
error("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@");
error("Someone could be eavesdropping on you right now (man-in-the-middle attack)!");
error("It is also possible that the %s host key has just been changed.", type);
error("The fingerprint for the %s key sent by the remote host is\n%s.",
- type, key_fingerprint(host_key));
+ type, fp);
error("Please contact your system administrator.");
error("Add correct host key in %.100s to get rid of this message.",
user_hostfile);
error("Offending key in %s:%d", host_file, host_line);
+ xfree(fp);
/*
* If strict host key checking is in use, the user will have
if (options.check_host_ip && host_status != HOST_CHANGED &&
ip_status == HOST_CHANGED) {
log("Warning: the %s host key for '%.200s' "
- "differs from the key for the IP address '%.30s'",
+ "differs from the key for the IP address '%.128s'",
type, host, ip);
if (host_status == HOST_OK)
log("Matching host key in %s:%d", host_file, host_line);
} else if (options.strict_host_key_checking == 2) {
if (!read_yes_or_no("Are you sure you want " \
"to continue connecting (yes/no)? ", -1))
- fatal("Aborted by user!\n");
+ fatal("Aborted by user!");
}
}
* This function does not require super-user privileges.
*/
void
-ssh_login(int host_key_valid, RSA *own_host_key, const char *orighost,
- struct sockaddr *hostaddr, uid_t original_real_uid)
+ssh_login(Key **keys, int nkeys, const char *orighost,
+ struct sockaddr *hostaddr, struct passwd *pw)
{
- struct passwd *pw;
char *host, *cp;
char *server_user, *local_user;
- /* Get local user name. Use it as server user if no user name was given. */
- pw = getpwuid(original_real_uid);
- if (!pw)
- fatal("User id %u not found from user database.", original_real_uid);
local_user = xstrdup(pw->pw_name);
server_user = options.user ? options.user : local_user;
/* authenticate user */
if (compat20) {
ssh_kex2(host, hostaddr);
- ssh_userauth2(server_user, host);
+ ssh_userauth2(local_user, server_user, host, keys, nkeys);
} else {
ssh_kex(host, hostaddr);
- ssh_userauth(local_user, server_user, host, host_key_valid, own_host_key);
+ ssh_userauth1(local_user, server_user, host, keys, nkeys);
}
}
+
+void
+ssh_put_password(char *password)
+{
+ int size;
+ char *padded;
+
+ if (datafellows & SSH_BUG_PASSWORDPAD) {
+ packet_put_string(password, strlen(password));
+ return;
+ }
+ size = roundup(strlen(password) + 1, 32);
+ padded = xmalloc(size);
+ memset(padded, 0, size);
+ strlcpy(padded, password, size);
+ packet_put_string(padded, size);
+ memset(padded, 0, size);
+ xfree(padded);
+}
andersk / openssh.git / blobdiff