Skip to content

Conversation

@vszakats
Copy link
Member

@vszakats vszakats commented Nov 16, 2025

test 1459 "SFTP with corrupted known_hosts" was seen failing in the past.
To fix it, the test was automatically disabled when detecting libssh
0.9.3 or older, as in the curl CircleCI job, running on Ubuntu 20.04.
This work for a long time, until bumping the CircleCI runner to Ubuntu
22.04 (to have OpenSSL 3), where the test was running again, and failing
with the isssue seen in the past.

Turns out the issue issue isn't libssh 0.9.3 itself, but
a CircleCI-specific default configuration in /etc/ssh/ssh_config:

# BEGIN ANSIBLE MANAGED BLOCK
Host *
StrictHostKeyChecking no     <------ this particular line
HashKnownHosts no
SendEnv LANG LC_*
# END ANSIBLE MANAGED BLOCK

libssh will consult configuration files on hard-coded default system
locations and alter its behavior based on settings found in them.

This libssh behavior is present in all supported versions:
https://gitlab.com/libssh/libssh-mirror/-/commit/5a2abd34ce9ad97c69906c5fb7b07e26e96fceaa
https://gitlab.com/libssh/libssh-mirror/-/tags/libssh-0.9.0

It means the existing disable logic based on libssh version worked by
coincidence, and what needs to be checked is these configurations
to decide if it's safe to run the test. Another, simpler option is
to also accept the result code 67, though in that case the test
wouldn't actually test what we want, but would pass anyway.

With the old oldlibssh workaround deleted, and the problematic setting
manually overridden (StrictHostKeyChecking yes):

To fix, replace the runtests oldlibssh detection logic to parse
libssh config files (instead of checking for libssh version) and disable
test 1459 based on that. Notice the detection is making a light attempt
to parse these files, and does not implement most config file features
(such as includes, quoted values and = operator.)

The new runtests workaround tests OK with the:

GHA jobs are not affected and they work fine, with 1459 running successfully
before and after this patch.

It's possible the libssh API offers ways to control config file use
and/or set the strict host checking option programatically. Maybe
to enable in debug mode (albeit CircleCI job are not debug-enabled),
or offer an option for them. It may be something for a future patch.

Follow-up to 2354092 #8622
Follow-up to 4b01a57 #8548
Follow-up to bdc664a #8490
Follow-up to 7c140f6 #8444

Ref: 6d9c5c9 #19549

@vszakats vszakats added SCP/SFTP tests CI Continuous Integration labels Nov 16, 2025
@vszakats vszakats changed the title [WIP] test1459: fixup for certain libssh configurations runtests: detect bad libssh differently for test 1459 Nov 16, 2025
@vszakats vszakats changed the title runtests: detect bad libssh differently for test 1459 runtests: detect bad libssh differently for test 1459 (fixing CircleCI libssh job) Nov 16, 2025
@vszakats vszakats changed the title runtests: detect bad libssh differently for test 1459 (fixing CircleCI libssh job) runtests: detect bad libssh differently for test 1459 (fixing CircleCI) Nov 16, 2025
@vszakats vszakats closed this in c07a7f6 Nov 16, 2025
@vszakats vszakats deleted the vsz/test1459 branch November 16, 2025 22:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

CI Continuous Integration SCP/SFTP tests

Development

Successfully merging this pull request may close these issues.

1 participant