The sftp protocol connected and authenticated without checking the server
host key, so credentials were sent to any or spoofed server. Verify against
known_hosts (ssh_session_is_known_server, with a pre-0.8 fallback) before
authenticating; add a 'verify' option (default on) to opt out.
Strict checking is forced on for the check: libssh otherwise reports an
unknown server, and since 0.8 even a changed key, as known when the parsed
ssh config says StrictHostKeyChecking no.
This changes the default behaviour: like OpenSSH with
StrictHostKeyChecking=yes, sftp:// now refuses servers that are not in the
known_hosts file or whose key differs from the recorded one.
Fixes: credentials sent to unverified SSH servers (CWE-295)
Fixes: ZmW0mOvhU0qN
Found-by: Joshua Rogers <joshua.rogers@aisle.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
There are lots of files that don't need it: The number of object
files that actually need it went down from 2011 to 884 here.
Keep it for external users in order to not cause breakages.
Also improve the other headers a bit while just at it.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
Unnecessary since acf63d5350adeae551d412db699f8ca03f7e76b9;
also avoids relocations.
Reviewed-by: Anton Khirnov <anton@khirnov.net>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
Avoid using the deprecated functions ssh_try_publickey_from_file among
others in favor of symbols introduced in libssh 0.6.0 (Jan 2014) and
update configure to require this version.
Signed-off-by: Leo Izen <leo.izen@gmail.com>
Yet another case of forgotten 0 =! EOF translation.
While the documentation for this specific synchronous read
function does not mention it, the documentation for
`sftp_async_read` documents it, as well as looking at the
implementation of this function leads one to find
`if (handle->eof) { return 0; }`.
Reported by stnutt on IRC.
This commit also disables the async fate test, because it
used internal APIs in a non-kosher way, which no longer
exists.
* commit '2758cdedfb7ac61f8b5e4861f99218b6fd43491d':
lavf: reorganize URLProtocols
Merged-by: Derek Buitenhuis <derek.buitenhuis@gmail.com>
libssh provides a function for parsing ~/.ssh/config for ssh connection parameters like user, hostname, identity file
and port. This patch makes ffmpeg use this function to take parameters from the config file for everything that's not
explicitely set in the url. It also supports host aliases, i.e. using a shorthand in the url and replacing it with the
hostname / IP address specified for the shorthand in the config file.
Signed-off-by: Florian Jacob <projects+ffmpeg@florianjacob.de>
Signed-off-by: Lukasz Marek <lukasz.m.luki2@gmail.com>
According to doc, ssh_userauth_none must be called before ssh_userauth_list.
It solves login issue for new versions of libssh.
Signed-off-by: Lukasz Marek <lukasz.m.luki2@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Michael Niedermayer