print keyfile:line for changed hostkeys, for deraadt@; ok deraadt@

4 files changed, 37 insertions, 15 deletions

diff --git a/usr.bin/ssh/auth-rh-rsa.c b/usr.bin/ssh/auth-rh-rsa.c
index a9f17ef8383..48c075e66f3 100644
--- a/usr.bin/ssh/auth-rh-rsa.c
+++ b/usr.bin/ssh/auth-rh-rsa.c
@@ -13,7 +13,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: auth-rh-rsa.c,v 1.18 2000/11/12 19:50:37 markus Exp $");
+RCSID("$OpenBSD: auth-rh-rsa.c,v 1.19 2000/12/21 15:10:16 markus Exp $");
 
 #include "packet.h"
 #include "ssh.h"
@@ -60,7 +60,7 @@ auth_rhosts_rsa(struct passwd *pw, const char *client_user, RSA *client_host_key
 
 	/* Check if we know the host and its host key. */
 	host_status = check_host_in_hostfile(SSH_SYSTEM_HOSTFILE, canonical_hostname,
-	    client_key, found);
+	    client_key, found, NULL);
 
 	/* Check user host file unless ignored. */
 	if (host_status != HOST_OK && !options.ignore_user_known_hosts) {
@@ -80,7 +80,7 @@ auth_rhosts_rsa(struct passwd *pw, const char *client_user, RSA *client_host_key
 			/* XXX race between stat and the following open() */
 			temporarily_use_uid(pw->pw_uid);
 			host_status = check_host_in_hostfile(user_hostfile, canonical_hostname,
-			    client_key, found);
+			    client_key, found, NULL);
 			restore_uid();
 		}
 		xfree(user_hostfile);
diff --git a/usr.bin/ssh/hostfile.c b/usr.bin/ssh/hostfile.c
index af060e40aa5..1c3fb22ad43 100644
--- a/usr.bin/ssh/hostfile.c
+++ b/usr.bin/ssh/hostfile.c
@@ -36,7 +36,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: hostfile.c,v 1.22 2000/12/19 23:17:56 markus Exp $");
+RCSID("$OpenBSD: hostfile.c,v 1.23 2000/12/21 15:10:16 markus Exp $");
 
 #include "packet.h"
 #include "match.h"
@@ -107,7 +107,8 @@ hostfile_check_key(int bits, Key *key, const char *host, const char *filename, i
  */
 
 HostStatus
-check_host_in_hostfile(const char *filename, const char *host, Key *key, Key *found)
+check_host_in_hostfile(const char *filename, const char *host, Key *key,
+    Key *found, int *numret)
 {
 	FILE *f;
 	char line[8192];
@@ -164,6 +165,9 @@ check_host_in_hostfile(const char *filename, const char *host, Key *key, Key *fo
 		if (!hostfile_check_key(kbits, found, host, filename, linenum))
 			continue;
 
+		if (numret != NULL)
+			*numret = linenum;
+
 		/* Check if the current key is the same as the given key. */
 		if (key_equal(key, found)) {
 			/* Ok, they match. */
diff --git a/usr.bin/ssh/hostfile.h b/usr.bin/ssh/hostfile.h
index 9c2353bf986..dbdbd8f33f0 100644
--- a/usr.bin/ssh/hostfile.h
+++ b/usr.bin/ssh/hostfile.h
@@ -21,8 +21,10 @@
 typedef enum {
 	HOST_OK, HOST_NEW, HOST_CHANGED
 }       HostStatus;
+
 HostStatus
-check_host_in_hostfile(const char *filename, const char *host, Key *key, Key *found);
+check_host_in_hostfile(const char *filename, const char *host, Key *key,
+    Key *found, int *line);
 
 /*
  * Appends an entry to the host file.  Returns false if the entry could not
diff --git a/usr.bin/ssh/sshconnect.c b/usr.bin/ssh/sshconnect.c
index 00d8175a162..a894c7fc166 100644
--- a/usr.bin/ssh/sshconnect.c
+++ b/usr.bin/ssh/sshconnect.c
@@ -13,7 +13,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: sshconnect.c,v 1.84 2000/12/20 19:27:55 markus Exp $");
+RCSID("$OpenBSD: sshconnect.c,v 1.85 2000/12/21 15:10:17 markus Exp $");
 
 #include <openssl/bn.h>
 #include <openssl/dsa.h>
@@ -467,6 +467,8 @@ check_host_key(char *host, struct sockaddr *hostaddr, Key *host_key,
 	HostStatus ip_status;
 	int local = 0, host_ip_differ = 0;
 	char ntop[NI_MAXHOST];
+	int host_line = -1, ip_line = -1;
+	const char *host_file = NULL, *ip_file = NULL;
 
 	/*
 	 * Force accepting of the host key for loopback/localhost. The
@@ -519,19 +521,25 @@ check_host_key(char *host, struct sockaddr *hostaddr, Key *host_key,
 	 * Check if the host key is present in the user\'s list of known
 	 * hosts or in the systemwide list.
 	 */
-	host_status = check_host_in_hostfile(user_hostfile, host, host_key, file_key);
-	if (host_status == HOST_NEW)
-		host_status = check_host_in_hostfile(system_hostfile, host, host_key, file_key);
+	host_file = user_hostfile;
+	host_status = check_host_in_hostfile(host_file, host, host_key, file_key, &host_line);
+	if (host_status == HOST_NEW) {
+		host_file = system_hostfile;
+		host_status = check_host_in_hostfile(host_file, host, host_key, file_key, &host_line);
+	}
 	/*
 	 * Also perform check for the ip address, skip the check if we are
 	 * localhost or the hostname was an ip address to begin with
 	 */
 	if (options.check_host_ip && !local && strcmp(host, ip)) {
 		Key *ip_key = key_new(host_key->type);
-		ip_status = check_host_in_hostfile(user_hostfile, ip, host_key, ip_key);
 
-		if (ip_status == HOST_NEW)
-			ip_status = check_host_in_hostfile(system_hostfile, ip, host_key, ip_key);
+		ip_file = user_hostfile;
+		ip_status = check_host_in_hostfile(ip_file, ip, host_key, ip_key, &ip_line);
+		if (ip_status == HOST_NEW) {
+			ip_file = system_hostfile;
+			ip_status = check_host_in_hostfile(ip_file, ip, host_key, ip_key, &ip_line);
+		}
 		if (host_status == HOST_CHANGED &&
 		    (ip_status != HOST_CHANGED || !key_equal(ip_key, file_key)))
 			host_ip_differ = 1;
@@ -547,6 +555,7 @@ check_host_key(char *host, struct sockaddr *hostaddr, Key *host_key,
 		/* The host is known and the key matches. */
 		debug("Host '%.200s' is known and matches the %s host key.",
 		    host, type);
+		debug("Found key in %s:%d", host_file, host_line);
 		if (options.check_host_ip) {
 			if (ip_status == HOST_NEW) {
 				if (!add_host_to_hostfile(user_hostfile, ip, host_key))
@@ -555,9 +564,13 @@ check_host_key(char *host, struct sockaddr *hostaddr, Key *host_key,
 				else
 					log("Warning: Permanently added the %s host key for IP address '%.30s' to the list of known hosts.",
 					    type, ip);
-			} else if (ip_status != HOST_OK)
+			} else if (ip_status != HOST_OK) {
 				log("Warning: the %s host key for '%.200s' differs from the key for the IP address '%.30s'",
 				    type, host, ip);
+				log("Found key in %s:%d", host_file, host_line);
+				if (ip_line != -1)
+					log("Offending key for IP in %s:%d", ip_file, ip_line);
+			}
 		}
 		break;
 	case HOST_NEW:
@@ -608,7 +621,9 @@ check_host_key(char *host, struct sockaddr *hostaddr, Key *host_key,
 			error("and the key for the according IP address %s", ip);
 			error("%s. This could either mean that", msg);
 			error("DNS SPOOFING is happening or the IP address for the host");
-			error("and its host key have changed at the same time");
+			error("and its host key have changed at the same time.");
+			if (ip_line != -1)
+				error("Offending key for IP in %s:%d", ip_file, ip_line);
 		}
 		/* The host key has changed. */
 		error("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@");
@@ -620,6 +635,7 @@ check_host_key(char *host, struct sockaddr *hostaddr, Key *host_key,
 		error("Please contact your system administrator.");
 		error("Add correct host key in %.100s to get rid of this message.",
 		      user_hostfile);
+		error("Offending key in %s:%d", host_file, host_line);
 
 		/*
 		 * If strict host key checking is in use, the user will have