crypto/openssh/sshconnect.c

712 check_host_cert(const char *host, const Key *host_key)
716 	if (key_cert_check_authority(host_key, 1, 0, host, &reason) != 0) {
720 	if (buffer_len(host_key->cert->critical) != 0) {
810     Key *host_key, int readonly,
824 	int r, want_cert = key_is_cert(host_key), host_ip_differ = 0;
875 	want_cert = key_is_cert(host_key);
876 	type = key_type(host_key);
882 	host_status = check_key_in_hostkeys(host_hostkeys, host_key,
891 		ip_status = check_key_in_hostkeys(ip_hostkeys, host_key,
908 		if (want_cert && !check_host_cert(hostname, host_key))
916 			    host_key, options.hash_known_hosts))
926 			fp = sshkey_fingerprint(host_key,
928 			ra = sshkey_fingerprint(host_key,
942 			if (check_host_key(hostname, hostaddr, 0, host_key,
964 			if (show_other_keys(host_hostkeys, host_key))
971 			fp = sshkey_fingerprint(host_key,
973 			ra = sshkey_fingerprint(host_key,
1014 				    host, host_key, options.hash_known_hosts) &&
1016 				    host_key, options.hash_known_hosts);
1020 				    hostline, host_key,
1025 			    host_key, options.hash_known_hosts);
1090 		warn_changed_key(host_key);
1222 		raw_key = key_from_private(host_key);
1225 		host_key = raw_key;
1241 verify_host_key(char *host, struct sockaddr *hostaddr, Key *host_key)
1248 	if ((fp = sshkey_fingerprint(host_key,
1255 	if (sshkey_is_cert(host_key)) {
1256 		if ((cafp = sshkey_fingerprint(host_key->cert->signature_key,
1263 		sshkey_format_cert_validity(host_key->cert,
1267 		    sshkey_ssh_name(host_key), fp,
1268 		    (unsigned long long)host_key->cert->serial,
1269 		    host_key->cert->key_id,
1270 		    sshkey_ssh_name(host_key->cert->signature_key), cafp,
1272 		for (i = 0; i < host_key->cert->nprincipals; i++) {
1274 			    host_key->cert->principals[i]);
1278 		    sshkey_ssh_name(host_key) : sshkey_type(host_key), fp);
1281 	if (sshkey_equal(previous_host_key, host_key)) {
1283 		    __func__, sshkey_type(host_key), fp);
1290 		r = sshkey_check_revoked(host_key, options.revoked_host_keys);
1296 			    sshkey_type(host_key), fp,
1302 			    "revoked keys file %s: %s", sshkey_type(host_key),
1314 		if ((r = sshkey_from_private(host_key, &plain)) != 0)
1337 	r = check_host_key(host, hostaddr, options.port, host_key, RDRW,
1345 	if (r == 0 && host_key != NULL) {
1347 		previous_host_key = key_from_private(host_key);
1458 warn_changed_key(Key *host_key)
1462 	fp = sshkey_fingerprint(host_key, options.fingerprint_hash,
1474 	    key_type(host_key), fp);