From d1e7d9197b7fe417fb4d62aad5ea8f15a06d906c Mon Sep 17 00:00:00 2001 From: Mats Lindestam Date: Sun, 26 Sep 2021 23:20:53 +0200 Subject: libssh2: add SHA256 fingerprint support Added support for SHA256 fingerprint in command line curl and in libcurl. Closes #7646 --- docs/TODO | 10 ---- docs/cmdline-opts/Makefile.inc | 1 + docs/cmdline-opts/hostpubsha256.d | 11 ++++ docs/libcurl/curl_easy_setopt.3 | 2 + .../opts/CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256.3 | 60 ++++++++++++++++++++++ docs/libcurl/opts/Makefile.inc | 1 + docs/libcurl/symbols-in-versions | 1 + docs/options-in-versions | 1 + 8 files changed, 77 insertions(+), 10 deletions(-) create mode 100644 docs/cmdline-opts/hostpubsha256.d create mode 100644 docs/libcurl/opts/CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256.3 (limited to 'docs') diff --git a/docs/TODO b/docs/TODO index 2fca64797..4a9d99805 100644 --- a/docs/TODO +++ b/docs/TODO @@ -138,7 +138,6 @@ 17. SSH protocols 17.1 Multiplexing 17.2 Handle growing SFTP files - 17.3 Support better than MD5 hostkey hash 17.4 Support CURLOPT_PREQUOTE 17.5 SSH over HTTPS proxy with more backends @@ -930,15 +929,6 @@ https://github.com/curl/curl/issues/4344 -17.3 Support better than MD5 hostkey hash - - libcurl offers the CURLOPT_SSH_HOST_PUBLIC_KEY_MD5 option for verifying the - server's key. MD5 is generally being deprecated so we should implement - support for stronger hashing algorithms. libssh2 itself is what provides this - underlying functionality and it supports at least SHA-1 as an alternative. - SHA-1 is also being deprecated these days so we should consider working with - libssh2 to instead offer support for SHA-256 or similar. - 17.4 Support CURLOPT_PREQUOTE The two other QUOTE options are supported for SFTP, but this was left out for diff --git a/docs/cmdline-opts/Makefile.inc b/docs/cmdline-opts/Makefile.inc index 6e04552e9..506025a75 100644 --- a/docs/cmdline-opts/Makefile.inc +++ b/docs/cmdline-opts/Makefile.inc @@ -96,6 +96,7 @@ DPAGES = \ header.d \ help.d \ hostpubmd5.d \ + hostpubsha256.d \ hsts.d \ http0.9.d \ http1.0.d \ diff --git a/docs/cmdline-opts/hostpubsha256.d b/docs/cmdline-opts/hostpubsha256.d new file mode 100644 index 000000000..81e6f9851 --- /dev/null +++ b/docs/cmdline-opts/hostpubsha256.d @@ -0,0 +1,11 @@ +Long: hostpubsha256 +Arg: +Help: Acceptable SHA256 hash of the host public key +Protocols: SFTP SCP +Added: 7.80.0 +Category: sftp scp +Example: --hostpubsha256 NDVkMTQxMGQ1ODdmMjQ3MjczYjAyOTY5MmRkMjVmNDQ= sftp://example.com/ +--- +Pass a string containing a Base64-encoded SHA256 hash of the remote +host's public key. Curl will refuse the connection with the host +unless the hashes match. diff --git a/docs/libcurl/curl_easy_setopt.3 b/docs/libcurl/curl_easy_setopt.3 index b83f5b635..592692b94 100644 --- a/docs/libcurl/curl_easy_setopt.3 +++ b/docs/libcurl/curl_easy_setopt.3 @@ -642,6 +642,8 @@ SSH authentication types. See \fICURLOPT_SSH_AUTH_TYPES(3)\fP Enable SSH compression. See \fICURLOPT_SSH_COMPRESSION(3)\fP .IP CURLOPT_SSH_HOST_PUBLIC_KEY_MD5 MD5 of host's public key. See \fICURLOPT_SSH_HOST_PUBLIC_KEY_MD5(3)\fP +.IP CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 +SHA256 of host's public key. See \fICURLOPT_SSH_HOST_PUBLIC_KEY_SHA256(3)\fP .IP CURLOPT_SSH_PUBLIC_KEYFILE File name of public key. See \fICURLOPT_SSH_PUBLIC_KEYFILE(3)\fP .IP CURLOPT_SSH_PRIVATE_KEYFILE diff --git a/docs/libcurl/opts/CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256.3 b/docs/libcurl/opts/CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256.3 new file mode 100644 index 000000000..30be32ef2 --- /dev/null +++ b/docs/libcurl/opts/CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256.3 @@ -0,0 +1,60 @@ +.\" ************************************************************************** +.\" * _ _ ____ _ +.\" * Project ___| | | | _ \| | +.\" * / __| | | | |_) | | +.\" * | (__| |_| | _ <| |___ +.\" * \___|\___/|_| \_\_____| +.\" * +.\" * Copyright (C) 1998 - 2021, Daniel Stenberg, , et al. +.\" * +.\" * This software is licensed as described in the file COPYING, which +.\" * you should have received as part of this distribution. The terms +.\" * are also available at https://curl.se/docs/copyright.html. +.\" * +.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell +.\" * copies of the Software, and permit persons to whom the Software is +.\" * furnished to do so, under the terms of the COPYING file. +.\" * +.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY +.\" * KIND, either express or implied. +.\" * +.\" ************************************************************************** +.\" +.TH CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 3 "27 Aug 2021" "libcurl 7.80.0" "curl_easy_setopt options" +.SH NAME +CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 \- SHA256 hash of SSH server public key +.SH SYNOPSIS +.nf +#include + +CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256, + char *sha256); +.SH DESCRIPTION +Pass a char * pointing to a string containing a Base64-encoded SHA256 +hash of the remote host's public key. +The transfer will fail if the given hash doesn't match the hash the +remote host provides. + +.SH DEFAULT +NULL +.SH PROTOCOLS +SCP and SFTP +.SH EXAMPLE +.nf +CURL *curl = curl_easy_init(); +if(curl) { + curl_easy_setopt(curl, CURLOPT_URL, "sftp://example.com/file"); + curl_easy_setopt(curl, CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256, + "NDVkMTQxMGQ1ODdmMjQ3MjczYjAyOTY5MmRkMjVmNDQ="); + ret = curl_easy_perform(curl); + curl_easy_cleanup(curl); +} +.fi +.SH AVAILABILITY +Added in 7.80.0 +Requires the libssh2 back-end. +.SH RETURN VALUE +Returns CURLE_OK if the option is supported, CURLE_UNKNOWN_OPTION if not, or +CURLE_OUT_OF_MEMORY if there was insufficient heap space. +.SH "SEE ALSO" +.BR CURLOPT_SSH_PUBLIC_KEYFILE "(3), " CURLOPT_SSH_AUTH_TYPES "(3), " diff --git a/docs/libcurl/opts/Makefile.inc b/docs/libcurl/opts/Makefile.inc index 1181331b9..4ef5ddf43 100644 --- a/docs/libcurl/opts/Makefile.inc +++ b/docs/libcurl/opts/Makefile.inc @@ -326,6 +326,7 @@ man_MANS = \ CURLOPT_SSH_AUTH_TYPES.3 \ CURLOPT_SSH_COMPRESSION.3 \ CURLOPT_SSH_HOST_PUBLIC_KEY_MD5.3 \ + CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256.3 \ CURLOPT_SSH_KEYDATA.3 \ CURLOPT_SSH_KEYFUNCTION.3 \ CURLOPT_SSH_KNOWNHOSTS.3 \ diff --git a/docs/libcurl/symbols-in-versions b/docs/libcurl/symbols-in-versions index 55f25b6b0..8be22d504 100644 --- a/docs/libcurl/symbols-in-versions +++ b/docs/libcurl/symbols-in-versions @@ -613,6 +613,7 @@ CURLOPT_SOURCE_USERPWD 7.12.1 - 7.15.5 CURLOPT_SSH_AUTH_TYPES 7.16.1 CURLOPT_SSH_COMPRESSION 7.56.0 CURLOPT_SSH_HOST_PUBLIC_KEY_MD5 7.17.1 +CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 7.80.0 CURLOPT_SSH_KEYDATA 7.19.6 CURLOPT_SSH_KEYFUNCTION 7.19.6 CURLOPT_SSH_KNOWNHOSTS 7.19.6 diff --git a/docs/options-in-versions b/docs/options-in-versions index 6fada9381..ac087a1ef 100644 --- a/docs/options-in-versions +++ b/docs/options-in-versions @@ -84,6 +84,7 @@ --header (-H) 5.0 --help (-h) 4.0 --hostpubmd5 7.17.1 +--hostpubsha256 7.80.0 --hsts 7.74.0 --http0.9 7.64.0 --http1.0 (-0) 7.9.1 -- cgit v1.2.1