Log errors in kex_exchange_identification() with level verbose instead

of error to reduce preauth log spam. All of those get logged with a more
generic error message by sshpkt_fatal().

feedback from sthen@
ok djm@

diff --git a/usr.bin/ssh/kex.c b/usr.bin/ssh/kex.c
index cdd5c25..615ede8 100644 (file)
--- a/usr.bin/ssh/kex.c
+++ b/usr.bin/ssh/kex.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: kex.c,v 1.179 2023/08/18 01:37:41 djm Exp $ */
+/* $OpenBSD: kex.c,v 1.180 2023/08/21 21:16:18 tobhe Exp $ */
 /*
  * Copyright (c) 2000, 2001 Markus Friedl.  All rights reserved.
  *
@@ -1336,7 +1336,7 @@ kex_exchange_identification(struct ssh *ssh, int timeout_ms,
                        len = atomicio(read, ssh_packet_get_connection_in(ssh),
                            &c, 1);
                        if (len != 1 && errno == EPIPE) {
-                               error_f("Connection closed by remote host");
+                               verbose_f("Connection closed by remote host");
                                r = SSH_ERR_CONN_CLOSED;
                                goto out;
                        } else if (len != 1) {
@@ -1352,7 +1352,7 @@ kex_exchange_identification(struct ssh *ssh, int timeout_ms,
                        if (c == '\n')
                                break;
                        if (c == '\0' || expect_nl) {
-                               error_f("banner line contains invalid "
+                               verbose_f("banner line contains invalid "
                                    "characters");
                                goto invalid;
                        }
@@ -1362,7 +1362,7 @@ kex_exchange_identification(struct ssh *ssh, int timeout_ms,
                                goto out;
                        }
                        if (sshbuf_len(peer_version) > SSH_MAX_BANNER_LEN) {
-                               error_f("banner line too long");
+                               verbose_f("banner line too long");
                                goto invalid;
                        }
                }
@@ -1378,7 +1378,7 @@ kex_exchange_identification(struct ssh *ssh, int timeout_ms,
                }
                /* Do not accept lines before the SSH ident from a client */
                if (ssh->kex->server) {
-                       error_f("client sent invalid protocol identifier "
+                       verbose_f("client sent invalid protocol identifier "
                            "\"%.256s\"", cp);
                        free(cp);
                        goto invalid;