mirror of https://github.com/libssh2/libssh2.git synced 2026-10-24 03:48:58 +03:00

Files

hunterinvariants dd47304a16 knownhost: match equivalent IPv6 literals

Plain known-host entries are currently compared as text, so equivalent
expanded and compressed IPv6 literals do not match.

This change keeps the existing exact-string fast path and compares two
valid plain IPv6 literals by their 128-bit address. It also supports
bracketed IPv6 host-and-port entries while requiring the port suffix to
match exactly.

No DNS lookup is performed. Hostname matching and the CUSTOM and hashed
known-host paths remain unchanged.

Reported-by: Krisscut on github
Fixes #1398

Closes #2568

2026-09-02 07:26:55 +02:00

2.4 KiB

Raw Permalink Blame History

c, SPDX-License-Identifier, Title, Section, Source, See-also

SPDX-License-Identifier

Title

Section

Source

See-also

BSD-3-Clause

libssh2_knownhost_check

libssh2

libssh2_knownhost_add(3)

libssh2_knownhost_free(3)

libssh2_knownhost_init(3)

NAME

libssh2_knownhost_check - check a host+key against the list of known hosts

SYNOPSIS

#include <libssh2.h>

int libssh2_knownhost_check(LIBSSH2_KNOWNHOSTS *hosts,
                            const char *host,
                            const char *key, size_t keylen,
                            int typemask,
                            struct libssh2_knownhost **knownhost);

DESCRIPTION

Checks a host and its associated key against the collection of known hosts, and returns info back about the (partially) matched entry.

host is a pointer the hostname in plain text. The hostname can be the IP numerical address of the host or the full name.

For LIBSSH2_KNOWNHOST_TYPE_PLAIN, valid IPv6 literals are compared by their binary address, so equivalent compressed and expanded representations match. No DNS lookup is performed. Hostnames, custom names and hashed known-host entries retain their existing matching behavior.

key is a pointer to the key for the given host.

keylen is the total size in bytes of the key pointed to by the key argument

typemask is a bitmask that specifies format and info about the data passed to this function. Specifically, it details what format the hostname is, what format the key is and what key type it is.

The hostname is given as one of the following types: LIBSSH2_KNOWNHOST_TYPE_PLAIN or LIBSSH2_KNOWNHOST_TYPE_CUSTOM.

The key is encoded using one of the following encodings: LIBSSH2_KNOWNHOST_KEYENC_RAW or LIBSSH2_KNOWNHOST_KEYENC_BASE64.

knownhost if set to non-NULL, it must be a pointer to a 'struct libssh2_knownhost' pointer that gets filled in to point to info about a known host that matches or partially matches.

RETURN VALUE

libssh2_knownhost_check(3) returns info about how well the provided host + key pair matched one of the entries in the list of known hosts.

LIBSSH2_KNOWNHOST_CHECK_FAILURE - something prevented the check to be made

LIBSSH2_KNOWNHOST_CHECK_NOTFOUND - no host match was found

LIBSSH2_KNOWNHOST_CHECK_MATCH - hosts and keys match.

LIBSSH2_KNOWNHOST_CHECK_MISMATCH - host was found, but the keys did not match!

AVAILABILITY

Added in libssh2 1.2

EXAMPLE

See the ssh2_exec.c example as provided in the tarball.

2.4 KiB Raw Permalink Blame History