nhyatt/putty-source
1
0
Fork 0
mirror of https://git.tartarus.org/simon/putty.git synced 2025-07-03 12:32:47 -05:00
Code Issues Projects Releases Wiki Activity

Special host key warning when a better key exists.

Browse Source 
If you're connecting to a new server and it _only_ provides host key
types you've configured to be below the warning threshold, it's OK to
give the standard askalg() message. But if you've newly demoted a host
key type and now reconnect to some server for which that type was the
best key you had cached, the askalg() wording isn't really appropriate
(it's not that the key we've settled on is the first type _supported
by the server_, it's that it's the first type _cached by us_), and
also it's potentially helpful to list the better algorithms so that
the user can pick one to cross-certify.
This commit is contained in:
Simon Tatham
2016-03-27 18:08:49 +01:00
parent 909a7af07c
commit 940a82fd37
6 changed files with 212 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

49
ssh.c
View File

@ -6813,10 +6813,53 @@ static void do_ssh2_transport(Ssh ssh, const void *vin, int inlen,
}
if (s->warn_hk) {
int j, k;
char *betteralgs;
ssh_set_frozen(ssh, 1);
s->dlgret = askalg(ssh->frontend, "host key type",
ssh->hostkey->name,
ssh_dialog_callback, ssh);
/*
* Change warning box wording depending on why we chose a
* warning-level host key algorithm. If it's because
* that's all we have *cached*, use the askhk mechanism,
* and list the host keys we could usefully cross-certify.
* Otherwise, use askalg for the standard wording.
*/
betteralgs = NULL;
for (j = 0; j < ssh->n_uncert_hostkeys; j++) {
const struct ssh_signkey_with_user_pref_id *hktype =
&hostkey_algs[ssh->uncert_hostkeys[j]];
int better = FALSE;
for (k = 0; k < HK_MAX; k++) {
int id = conf_get_int_int(ssh->conf, CONF_ssh_hklist, k);
if (id == HK_WARN) {
break;
} else if (id == hktype->id) {
better = TRUE;
break;
}
}
if (better) {
if (betteralgs) {
char *old_ba = betteralgs;
betteralgs = dupcat(betteralgs, ",",
hktype->alg->name,
(const char *)NULL);
sfree(old_ba);
} else {
betteralgs = dupstr(hktype->alg->name);
}
}
}
if (betteralgs) {
s->dlgret = askhk(ssh->frontend, ssh->hostkey->name,
betteralgs, ssh_dialog_callback, ssh);
sfree(betteralgs);
} else {
s->dlgret = askalg(ssh->frontend, "host key type",
ssh->hostkey->name,
ssh_dialog_callback, ssh);
}
if (s->dlgret < 0) {
do {
crReturnV;