luo980/curl
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

tool_operate: fail SSH transfers without server auth

Browse Source 
This now insists on using a server auth option unless --insecure is
provided. As an added bonus, it now also only checks for the knownhosts
file once (if found).

Ref: #16197
Closes #16205
This commit is contained in:
Daniel Stenberg 2025-02-22 13:05:17 +01:00
parent 4c5099868e
commit e1b3d46944
No known key found for this signature in database
GPG Key ID: 5CC908FDB71E12C2
3 changed files with 18 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/tool_cfgable.h
View File

@ -324,6 +324,8 @@ struct GlobalConfig {
char *libcurl; /* Output libcurl code to this filename */
char *ssl_sessions; /* file to load/save SSL session tickets */
char *help_category; /* The help category, if set */
char *knownhosts; /* known host path, if set. curl_free()
this */
struct tool_var *variables;
struct OperationConfig *first;
struct OperationConfig *current;

21
src/tool_operate.c
View File

@ -1156,16 +1156,24 @@ static CURLcode config2setopts(struct GlobalConfig *global,
my_setopt(curl, CURLOPT_SSH_COMPRESSION, 1L);
if(!config->insecure_ok) {
char *known = findfile(".ssh/known_hosts", FALSE);
char *known = global->knownhosts;
if(!known)
known = findfile(".ssh/known_hosts", FALSE);
if(known) {
/* new in curl 7.19.6 */
result = res_setopt_str(curl, CURLOPT_SSH_KNOWNHOSTS, known);
curl_free(known);
if(result == CURLE_UNKNOWN_OPTION)
/* libssh2 version older than 1.1.1 */
result = CURLE_OK;
if(result)
if(result) {
global->knownhosts = NULL;
curl_free(known);
return result;
}
/* store it in global to avoid repeated checks */
global->knownhosts = known;
}
else if(!config->hostpubmd5 && !config->hostpubsha256) {
errorf(global, "Couldn't find a known_hosts file");
return CURLE_FAILED_INIT;
}
else
warnf(global, "Couldn't find a known_hosts file");
@ -3266,6 +3274,7 @@ CURLcode operate(struct GlobalConfig *global, int argc, argv_item_t argv[])
}
varcleanup(global);
curl_free(global->knownhosts);
return result;
}

2
tests/data/test445
View File

@ -46,7 +46,7 @@ http-proxy
Refuse tunneling protocols through HTTP proxy
</name>
<command>
-x http://%HOSTIP:%PROXYPORT/%TESTNUMBER -p gopher://127.0.0.1 dict://127.0.0.1 http://moo https://example telnet://another ftp://yes ftps://again imap://more ldap://perhaps mqtt://yes pop3://mail rtsp://harder scp://copy sftp://files smb://wird smtp://send
-x http://%HOSTIP:%PROXYPORT/%TESTNUMBER -p gopher://127.0.0.1 dict://127.0.0.1 http://moo https://example telnet://another ftp://yes ftps://again imap://more ldap://perhaps mqtt://yes pop3://mail rtsp://harder scp://copy sftp://files smb://wird smtp://send -k
</command>
</client>