From f3c11692a9881b2d74263e20749ff58da1fd8443 Mon Sep 17 00:00:00 2001 From: Daniel Stenberg Date: Mon, 29 Jun 2026 08:05:16 +0200 Subject: [PATCH] CURLOPT_SSH_*_KEYFILE: used for setting up, then no more So changing them after the connection is made still allows libcurl to reuse the existing connections. Reported-by: Bigtang on hackerone Closes #22211 --- docs/libcurl/opts/CURLOPT_SSH_PRIVATE_KEYFILE.md | 8 ++++++-- docs/libcurl/opts/CURLOPT_SSH_PUBLIC_KEYFILE.md | 5 +++++ 2 files changed, 11 insertions(+), 2 deletions(-) diff --git a/docs/libcurl/opts/CURLOPT_SSH_PRIVATE_KEYFILE.md b/docs/libcurl/opts/CURLOPT_SSH_PRIVATE_KEYFILE.md index 2a1f79845d..efc627b8dc 100644 --- a/docs/libcurl/opts/CURLOPT_SSH_PRIVATE_KEYFILE.md +++ b/docs/libcurl/opts/CURLOPT_SSH_PRIVATE_KEYFILE.md @@ -33,8 +33,7 @@ used, libcurl defaults to **$HOME/.ssh/id_rsa** or **$HOME/.ssh/id_dsa** if the HOME environment variable is set, and in the current directory if HOME is not set. -If the file is password-protected, set the password with -CURLOPT_KEYPASSWD(3). +If the file is password-protected, set the password with CURLOPT_KEYPASSWD(3). The SSH library derives the public key from this private key when possible. If the SSH library cannot derive the public key from the private one and no @@ -44,6 +43,11 @@ fails. The application does not have to keep the string around after setting this option. +This option is used to set up a new connection only. The private key is used +when libcurl establishes a new SSH connection; once that connection has been +successfully set up and verified, it is deemed vetted and may be reused by +libcurl even if this option is changed. + # DEFAULT As explained above diff --git a/docs/libcurl/opts/CURLOPT_SSH_PUBLIC_KEYFILE.md b/docs/libcurl/opts/CURLOPT_SSH_PUBLIC_KEYFILE.md index 161daf4ecf..5cd2fc5b8c 100644 --- a/docs/libcurl/opts/CURLOPT_SSH_PUBLIC_KEYFILE.md +++ b/docs/libcurl/opts/CURLOPT_SSH_PUBLIC_KEYFILE.md @@ -40,6 +40,11 @@ no public one is provided, the transfer fails. The application does not have to keep the string around after setting this option. +This option is used to set up a new connection only. The public key is used +when libcurl establishes a new SSH connection; once that connection has been +successfully set up and verified, it is deemed vetted and may be reused by +libcurl even if this option is changed. + # DEFAULT NULL