IPV6 curl sftp known_host key validation failure about curl HOT 6 CLOSED

The known_hosts format is a weakly specified format, I am not aware of any clear documentation or effort to specify how an IPv6 address should be canonicalized for it. I imagine that reading the OpenSSH source code to figure out what they do is the best way.

Also, the known hosts check is actually performed by the SSH library using the name curl passes to the library so if there is any massaging of the host name to be done, it should actually be done within the SSH library. Or the their knownhost APIs should document exactly how to provide IPv6 host names. Since I wrote the libssh2 one, I'm fairly sure it does not because it was not on my mind when I did that. Many years ago.

from curl.

When curl parses a URL with an IPv6 numeral address, it canonicalizes it and converts it into the shortest possible version. Since a single IPv6 address can be written in a nearly infinite number of ways, this is a way to increase the chances that an IPv6 address ends up the same way independently of how it is provided.

You could argue that the known_hosts file format is notoriously bad for handling IPv6 addresses because of their "flexible" nature.

from curl.

Yes I think it's fair to proceed this way, but maybe curl should also try to apply the same canonicalization on the ip listed in the known_hosts before comparing them to make sure they are in the same format ?

I don't know if there is a specification/documentation on how the ip should be formatted in the know_hosts file, maybe they should always be put in their short form in the first place. (Meaning it would be the responsibility of our app to canonicalize the ip)

from curl.

Yes it's what I was checking in the code, indeed it seems I created the issue on the wrong component, sorry.

In our case with libssh2 it would happen here I guess:

And the location where maybe some canonicalization could be added is here in libssh2:
https://github.com/libssh2/libssh2/blob/master/src/knownhost.c#L409

Do you think I should raise a new issue on libssh2 to go at the bottom of this ?
On my side I worked around for now by formatting the ipv6 in its shortest form in the know_hosts but I think semantically it should have worked as well without changes.

from curl.

Do you think I should raise a new issue on libssh2 to go at the bottom of this ?

Yes, I think that is the right thing to do.

from curl.

I think we do the right thing in curl. We should look into canonicalizing the IPv6 addresses inside libssh2.

from curl.