crypto/openssh/sshconnect.c

6  * Code to connect to a remote host, and to perform the client side of the
89     const char *host, const char *host_arg, int port)
98 	    "h", host,
113 ssh_proxy_fdpass_connect(struct ssh *ssh, const char *host,
129 	    host, host_arg, port);
195 ssh_proxy_connect(struct ssh *ssh, const char *host, const char *host_arg,
212 	    host, host_arg, port);
438  * Opens a TCP/IP connection to the remote server on the given host.
439  * The address of the remote host will be returned in hostaddr.
443  * and %p substituted for host and port, respectively) to use to contact
447 ssh_connect_direct(struct ssh *ssh, const char *host, struct addrinfo *aitop,
467 		 * Loop through addresses for this host, and try each one in
493 				host, ntop, strport);
524 		error("ssh: connect to host %s port %s: %s",
525 		    host, strport, errno == 0 ? "failure" : strerror(errno));
545 ssh_connect(struct ssh *ssh, const char *host, const char *host_arg,
552 		return ssh_connect_direct(ssh, host, addrs, hostaddr, port,
566 		return ssh_proxy_fdpass_connect(ssh, host, host_arg, port,
569 	return ssh_proxy_connect(ssh, host, host_arg, port,
618  * host keys in known_hosts files. These may have a port number appended.
688 	const char *host, *ip;
755 	    ctx->host, ctx->ip, HKF_WANT_PARSE_KEY, 0)) != 0) {
767  * Find 'key' in known hosts file(s) that do not match host/ip.
771 hostkeys_find_by_key(const char *host, const char *ip, const struct sshkey *key,
785 	ctx.host = host;
813 other_hostkeys_message(const char *host, const char *ip,
821 	hostkeys_find_by_key(host, ip, key,
828 	xasprintf(&ret, "This host key is known by the following other "
926  * check whether the supplied host key is valid, return -1 if the key
942 	char *ip = NULL, *host = NULL;
955 	 * Force accepting of the host key for loopback/localhost. The
959 	 * essentially disables host authentication for localhost; however,
964 		debug("Forcing accepting of host key for "
986 	    clobber_port ? 0 : port, &host, &ip);
998 		load_hostkeys(host_hostkeys, host, user_hostfiles[i], 0);
1000 		load_hostkeys(host_hostkeys, host, system_hostfiles[i], 0);
1003 		    "HOSTNAME", cinfo, host_key, host);
1025 	 * Check if the host key is present in the user's list of known
1057 		/* The host is known and the key matches. */
1058 		debug("Host '%.200s' is known and matches the %s host %s.",
1059 		    host, type, want_cert ? "certificate" : "key");
1076 				debug3_f("certificate host key in use; "
1088 			debug3_f("host key found in GlobalKnownHostsFile; "
1093 			debug3_f("host key found via KnownHostsCommand; "
1098 				logit("%s host key for IP address "
1103 				logit("Failed to add the %s host key for IP "
1108 				logit("Warning: Permanently added the %s host "
1139 		/* The host is new. */
1143 			 * User has requested strict host key checking.  We
1144 			 * will not add the host key automatically.  The only
1147 			error("No %s host key is known for %.200s and you "
1148 			    "have requested strict checking.", type, host);
1154 			xasprintf(&msg1, "The authenticity of host "
1155 			    "'%.200s (%s)' can't be established", host, ip);
1159 				    "type are already known for this host.");
1175 				    "%s host key fingerprint found in DNS.",
1180 			if ((msg2 = other_hostkeys_message(host, ip, host_key,
1203 			snprintf(hostline, sizeof(hostline), "%s,%s", host, ip);
1206 				/* Add hash of host and IP separately */
1208 				    host, host_key, options.hash_known_hosts) &&
1212 				/* Add unhashed "host,ip" */
1218 			r = add_host_to_hostfile(user_hostfiles[0], host,
1220 			hostp = host;
1224 			logit("Failed to add the host to the list of known "
1234 		error("The %s host key for %s is marked as revoked.", type, host);
1236 		error("impersonate this host.");
1239 		 * If strict host key checking is in use, the user will have
1244 			error("%s host key for %.200s was revoked and you have "
1245 			    "requested strict checking.", type, host);
1275 			error("The %s host key for %s has changed,", type, host);
1278 			error("DNS SPOOFING is happening or the IP address for the host");
1279 			error("and its host key have changed at the same time.");
1284 		/* The host key has changed. */
1287 			error("Add correct host key in %.100s to get rid "
1296 		 * If strict host key checking is in use, the user will have
1302 			    "requested strict checking.", host);
1308 		 * If strict host key checking has not been requested, allow
1351 			error("UpdateHostkeys is disabled because the host "
1356 			fatal("Error: forwarding disabled due to host key "
1361 		 * This could be done by converting the host key to an
1362 		 * identifying sentence, tell that the host identifies itself
1375 		    "Warning: the %s host key for '%.200s' "
1378 		    type, host, ip, ip_found->file, ip_found->line);
1382 			    "\nMatching host key in %s:%lu",
1408 	free(host);
1431 	free(host);
1441 verify_host_key(char *host, struct sockaddr *hostaddr, struct sshkey *host_key,
1451 		error_fr(r, "fingerprint host key");
1465 		debug("Server host certificate: %s %s, serial %llu "
1473 			debug2("Server host certificate hostname: %s",
1477 		debug("Server host key: %s %s", sshkey_ssh_name(host_key), fp);
1481 		debug2_f("server host key %s %s matches cached key",
1500 			error_r(r, "Error checking host key %s %s in "
1517 		if (verify_host_key_dns(host, hostaddr, plain, &flags) == 0) {
1530 					    "with the new host key to get rid "
1536 	r = check_host_key(host, cinfo, hostaddr, options.port, host_key,
1565 	char *host;
1573 	host = xstrdup(orighost);
1574 	lowercase(host);
1585 	debug("Authenticating to %s:%d as '%s'", host, port, server_user);
1586 	ssh_kex2(ssh, host, hostaddr, port, cinfo);
1587 	ssh_userauth2(ssh, local_user, server_user, host, sensitive);
1589 	free(host);
1592 /* print all known host keys for a given host, but skip keys of given type */
1622 		logit("WARNING: %s key found for host %s\n"
1626 		    found->host, found->file, found->line,
1652 	error("It is also possible that a host key has just been changed.");
1653 	error("The fingerprint for the %s key sent by the remote host is\n%s.",