| 246 | } |
| 247 | |
| 248 | int CChannelSSH::verifyKnownhost(ssh_session session) |
| 249 | { |
| 250 | int nRet = -1; |
| 251 | QString szErr; |
| 252 | ssh_key srv_pubkey = NULL; |
| 253 | |
| 254 | auto &net = m_pParameter->m_Net; |
| 255 | |
| 256 | nRet = ssh_get_server_publickey(session, &srv_pubkey); |
| 257 | if (nRet < 0) { |
| 258 | szErr = tr("SSH failed: Get server public key.") + " " + net.GetHost() + "; ["; |
| 259 | szErr += ssh_get_error(session); |
| 260 | szErr += "]"; |
| 261 | qCritical(log) << szErr; |
| 262 | setErrorString(szErr); |
| 263 | return -1; |
| 264 | } |
| 265 | unsigned char *hash = NULL; |
| 266 | size_t nLen = 0; |
| 267 | nRet = ssh_get_publickey_hash(srv_pubkey, |
| 268 | SSH_PUBLICKEY_HASH_SHA1, |
| 269 | &hash, |
| 270 | &nLen); |
| 271 | ssh_key_free(srv_pubkey); |
| 272 | if(nRet) { |
| 273 | szErr = tr("SSH failed: Get public key hash value fail."); |
| 274 | qCritical(log) << szErr; |
| 275 | setErrorString(szErr); |
| 276 | return -2; |
| 277 | } |
| 278 | QByteArray baHash((const char*)hash, nLen); |
| 279 | QString szHash = baHash.toHex(':').toStdString().c_str(); |
| 280 | ssh_clean_pubkey_hash(&hash); |
| 281 | |
| 282 | QMessageBox::StandardButton btRet = QMessageBox::Yes; |
| 283 | bool checkBox = false; |
| 284 | enum ssh_known_hosts_e state = ssh_session_is_known_server(session); |
| 285 | switch(state) { |
| 286 | case SSH_KNOWN_HOSTS_OK: |
| 287 | nRet = 0; |
| 288 | break; |
| 289 | case SSH_KNOWN_HOSTS_CHANGED: |
| 290 | nRet = -3; |
| 291 | szErr = net.GetHost() + " " + tr("the host key for server changed. it is now:") + "\n"; |
| 292 | szErr += szHash + "\n"; |
| 293 | szErr += tr("For security reasons, connection will be stopped.") + "\n"; |
| 294 | szErr += tr("Please look at the OpenSSL documentation on " |
| 295 | "how to add a private CA to the store."); |
| 296 | qCritical(log) << szErr; |
| 297 | setErrorString(szErr); |
| 298 | break; |
| 299 | case SSH_KNOWN_HOSTS_OTHER: |
| 300 | nRet = -4; |
| 301 | szErr = net.GetHost() + " " + tr("the host key for this server was not found but an other type of key exists.") + "\n"; |
| 302 | szErr += tr("An attacker might change the default server key to " |
| 303 | "confuse your client into thinking the key does not exist") + "\n"; |
| 304 | szErr += tr("For security reasons, connection will be stopped.") + "\n"; |
| 305 | szErr += tr("Please look at the OpenSSL documentation on " |