summaryrefslogtreecommitdiff
path: root/sshconnect.c
diff options
context:
space:
mode:
authorBen Lindstrom <mouring@eviladmin.org>2000-12-02 19:03:54 +0000
committerBen Lindstrom <mouring@eviladmin.org>2000-12-02 19:03:54 +0000
commitc72745afa96a87d41a22804f48499db12d95dfcd (patch)
treef4c529e4effe1a7f0c9b818bd198a305c73efeb9 /sshconnect.c
parenta15e39b05fa013e16bbe293244cb49b0f27e2901 (diff)
20001203
- (bal) OpenBSD CVS updates: - markus@cvs.openbsd.org 2000/11/30 22:54:31 [channels.c] debug->warn if tried to do -R style fwd w/o client requesting this; ok neils@ - markus@cvs.openbsd.org 2000/11/29 20:39:17 [cipher.c] des_cbc_encrypt -> des_ncbc_encrypt since it already updates the IV - markus@cvs.openbsd.org 2000/11/30 18:33:05 [ssh-agent.c] agents must not dump core, ok niels@ - markus@cvs.openbsd.org 2000/11/30 07:04:02 [ssh.1] T is for both protocols - markus@cvs.openbsd.org 2000/12/01 00:00:51 [ssh.1] typo; from green@FreeBSD.org - markus@cvs.openbsd.org 2000/11/30 07:02:35 [ssh.c] check -T before isatty() - provos@cvs.openbsd.org 2000/11/29 13:51:27 [sshconnect.c] show IP address and hostname when new key is encountered. okay markus@ - markus@cvs.openbsd.org 2000/11/30 22:53:35 [sshconnect.c] disable agent/x11/port fwding if hostkey has changed; ok niels@ - marksu@cvs.openbsd.org 2000/11/29 21:11:59 [sshd.c] sshd -D, startup w/o deamon(), for monitoring scripts or inittab; from handler@sub-rosa.com and eric@urbanrange.com; ok niels@
Diffstat (limited to 'sshconnect.c')
-rw-r--r--sshconnect.c30
1 files changed, 18 insertions, 12 deletions
diff --git a/sshconnect.c b/sshconnect.c
index b33f2095..b54e75a8 100644
--- a/sshconnect.c
+++ b/sshconnect.c
@@ -13,7 +13,7 @@
*/
#include "includes.h"
-RCSID("$OpenBSD: sshconnect.c,v 1.81 2000/11/06 23:16:35 markus Exp $");
+RCSID("$OpenBSD: sshconnect.c,v 1.83 2000/11/30 22:53:35 markus Exp $");
#include <openssl/bn.h>
#include <openssl/dsa.h>
@@ -508,13 +508,11 @@ check_host_key(char *host, struct sockaddr *hostaddr, Key *host_key,
if (options.proxy_command != NULL && options.check_host_ip)
options.check_host_ip = 0;
- if (options.check_host_ip) {
- if (getnameinfo(hostaddr, salen, ntop, sizeof(ntop),
- NULL, 0, NI_NUMERICHOST) != 0)
- fatal("check_host_key: getnameinfo failed");
- ip = xstrdup(ntop);
- }
-
+ if (getnameinfo(hostaddr, salen, ntop, sizeof(ntop),
+ NULL, 0, NI_NUMERICHOST) != 0)
+ fatal("check_host_key: getnameinfo failed");
+ ip = xstrdup(ntop);
+
/*
* Store the host key from the known host file in here so that we can
* compare it with the key for the IP address.
@@ -577,10 +575,10 @@ check_host_key(char *host, struct sockaddr *hostaddr, Key *host_key,
char prompt[1024];
char *fp = key_fingerprint(host_key);
snprintf(prompt, sizeof(prompt),
- "The authenticity of host '%.200s' can't be established.\n"
+ "The authenticity of host '%.200s (%s)' can't be established.\n"
"%s key fingerprint is %s.\n"
"Are you sure you want to continue connecting (yes/no)? ",
- host, type, fp);
+ host, ip, type, fp);
if (!read_yes_or_no(prompt, -1))
fatal("Aborted by user!\n");
}
@@ -647,6 +645,14 @@ check_host_key(char *host, struct sockaddr *hostaddr, Key *host_key,
error("Agent forwarding is disabled to avoid trojan horses.");
options.forward_agent = 0;
}
+ if (options.forward_x11) {
+ error("X11 forwarding is disabled to avoid trojan horses.");
+ options.forward_x11 = 0;
+ }
+ if (options.num_local_forwards > 0 || options.num_remote_forwards > 0) {
+ error("Port forwarding is disabled to avoid trojan horses.");
+ options.num_local_forwards = options.num_remote_forwards = 0;
+ }
/*
* XXX Should permit the user to change to use the new id.
* This could be done by converting the host key to an
@@ -656,8 +662,8 @@ check_host_key(char *host, struct sockaddr *hostaddr, Key *host_key,
*/
break;
}
- if (options.check_host_ip)
- xfree(ip);
+
+ xfree(ip);
}
/*