fix(gssapi): skip known_hosts check after GSSAPI KEX

Shorya Vardhanrequested to merge
shoryax/libssh-mirror:fix/gssapi-kex-host-verification into master

Fixes #351

When using GSSAPI key exchange, the server's identity is already proven via Kerberos mutual authentication (MIC verification). However, libssh was still attempting to verify the host via known_hosts, which fails when the null hostkey algorithm is negotiated - causing curl to report "SSL peer certificate or SSH remote key was not OK".

This fix introduces SSH_SESSION_FLAG_GSS_KEX_VERIFIED, which is set after a successful gss_verify_mic(). When this flag is set, ssh_session_is_known_server() returns SSH_KNOWN_HOSTS_OK immediately, bypassing the traditional host key lookup.

Changes:

  • include/libssh/session.h: Add SSH_SESSION_FLAG_GSS_KEX_VERIFIED flag
  • src/packet_cb.c: Set flag after successful MIC verification
  • src/knownhosts.c: Return SSH_KNOWN_HOSTS_OK if flag is set

Testing

Tested manually with a local Kerberos KDC (EXAMPLE.COM realm) and curl over SFTP:

Before fix: curl: (60) SSL peer certificate or SSH remote key was not OK

After fix:

  • Completed gssapi authentication
  • Authentication complete (file downloaded successfully, no host key errors)

Please let me know if I should cover any additional edge cases or make further adjustments.

Merge request reports