)]}'
{
  "commit": "e4e2799dd7aab89f583e1d898300d96367750991",
  "tree": "8dea5d1514ff1119f8c7edd829a2d5ec1e43dc0c",
  "parents": [
    "459e26527287adbc2adcc5d0d49abff9a5f315a7"
  ],
  "author": {
    "name": "Han-Wen Nienhuys",
    "email": "hanwen@google.com",
    "time": "Wed Mar 29 19:21:25 2017 +0200"
  },
  "committer": {
    "name": "Han-Wen Nienhuys",
    "email": "hanwen@google.com",
    "time": "Thu Mar 30 15:57:35 2017 +0000"
  },
  "message": "ssh: require host key checking in the ClientConfig\n\nThis change breaks existing behavior.\n\nBefore, a missing ClientConfig.HostKeyCallback would cause host key\nchecking to be disabled. In this configuration, establishing a\nconnection to any host just works, so today, most SSH client code in\nthe wild does not perform any host key checks.\n\nThis makes it easy to perform a MITM attack:\n\n* SSH installations that use keyboard-interactive or password\nauthentication can be attacked with MITM, thereby stealing\npasswords.\n\n* Clients that use public-key authentication with agent forwarding are\nalso vulnerable: the MITM server could allow the login to succeed, and\nthen immediately ask the agent to authenticate the login to the real\nserver.\n\n* Clients that use public-key authentication without agent forwarding\nare harder to attack unnoticedly: an attacker cannot authenticate the\nlogin to the real server, so it cannot in general present a convincing\nserver to the victim.\n\nNow, a missing HostKeyCallback will cause the handshake to fail. This\nchange also provides InsecureIgnoreHostKey() and FixedHostKey(key) as\nready made host checkers.\n\nA simplistic parser for OpenSSH\u0027s known_hosts file is given as an\nexample.  This change does not provide a full-fledged parser, as it\nhas complexity (wildcards, revocation, hashed addresses) that will\nneed further consideration.\n\nWhen introduced, the host checking feature maintained backward\ncompatibility at the expense of security. We have decided this is not\nthe right tradeoff for the SSH library.\n\nFixes golang/go#19767\n\nChange-Id: I45fc7ba9bd1ea29c31ec23f115cdbab99913e814\nReviewed-on: https://go-review.googlesource.com/38701\nRun-TryBot: Han-Wen Nienhuys \u003chanwen@google.com\u003e\nTryBot-Result: Gobot Gobot \u003cgobot@golang.org\u003e\nReviewed-by: Brad Fitzpatrick \u003cbradfitz@golang.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "a13a6500173e394f5f9703c4e9002b769ccad157",
      "old_mode": 33188,
      "old_path": "ssh/agent/client_test.go",
      "new_id": "93d3a9cd23052a4c587dcfa1cc91df16fb01667f",
      "new_mode": 33188,
      "new_path": "ssh/agent/client_test.go"
    },
    {
      "type": "modify",
      "old_id": "c1130f77ab49c243ac9f488b71da448b8a05c814",
      "old_mode": 33188,
      "old_path": "ssh/agent/example_test.go",
      "new_id": "85562253eafad45434845e283b1aff2d85433c18",
      "new_mode": 33188,
      "new_path": "ssh/agent/example_test.go"
    },
    {
      "type": "modify",
      "old_id": "ec9cdeeb54da50980a202ead3b3050a55e79cccc",
      "old_mode": 33188,
      "old_path": "ssh/agent/server_test.go",
      "new_id": "6b0837d94cdd63eb928b220430523f7c968302fa",
      "new_mode": 33188,
      "new_path": "ssh/agent/server_test.go"
    },
    {
      "type": "modify",
      "old_id": "6331c94d53bc991332064fb0cfbd62075337f6a5",
      "old_mode": 33188,
      "old_path": "ssh/certs.go",
      "new_id": "67600e2402377a1af7118e5b3cf5e811a071866d",
      "new_mode": 33188,
      "new_path": "ssh/certs.go"
    },
    {
      "type": "modify",
      "old_id": "c97f2978e8f6c61a771d0e36ddc5ab8f9daf6758",
      "old_mode": 33188,
      "old_path": "ssh/client.go",
      "new_id": "667e37118e6faa38e801ccef458145c28b516ead",
      "new_mode": 33188,
      "new_path": "ssh/client.go"
    },
    {
      "type": "modify",
      "old_id": "e384c796b7548d76ab86f9b9de942f74ed0286c4",
      "old_mode": 33188,
      "old_path": "ssh/client_auth_test.go",
      "new_id": "b526f662523717a7b6316a6aa82370eafcafd9de",
      "new_mode": 33188,
      "new_path": "ssh/client_auth_test.go"
    },
    {
      "type": "modify",
      "old_id": "1fe790cb494c6b8348690da1bcf7e9a89b8716e1",
      "old_mode": 33188,
      "old_path": "ssh/client_test.go",
      "new_id": "bc5e985f8ccdcb43c00b2d2cf6b888451217dfb9",
      "new_mode": 33188,
      "new_path": "ssh/client_test.go"
    },
    {
      "type": "modify",
      "old_id": "d6be8946629210740906a38f1f00fd9bff358122",
      "old_mode": 33188,
      "old_path": "ssh/doc.go",
      "new_id": "67b7322c058058f4f794aab619d49b68b7289bd6",
      "new_mode": 33188,
      "new_path": "ssh/doc.go"
    },
    {
      "type": "modify",
      "old_id": "4d2eabd0f40a8b003f250d25b50ab2acbece6d80",
      "old_mode": 33188,
      "old_path": "ssh/example_test.go",
      "new_id": "618398ceae004bcf3832166b71c2876c9b57a3bb",
      "new_mode": 33188,
      "new_path": "ssh/example_test.go"
    },
    {
      "type": "modify",
      "old_id": "8de650644a5ba818ae13fad5a01d6a62fe093e5d",
      "old_mode": 33188,
      "old_path": "ssh/handshake.go",
      "new_id": "1b63ba8a6df20bd64cbac295481e058e8520d6cc",
      "new_mode": 33188,
      "new_path": "ssh/handshake.go"
    },
    {
      "type": "modify",
      "old_id": "1b831127e899fd0ec839a1f5ed6f596dd3c472c4",
      "old_mode": 33188,
      "old_path": "ssh/handshake_test.go",
      "new_id": "77d1aac76551a8dd8f1a107502fd19ff9bb9da11",
      "new_mode": 33188,
      "new_path": "ssh/handshake_test.go"
    },
    {
      "type": "modify",
      "old_id": "f35a378f2e3143cb60ffcac0eec07aa8d58f091a",
      "old_mode": 33188,
      "old_path": "ssh/session_test.go",
      "new_id": "7dce6dd699bed2f4444afb0cf6aa413f9ee3fc9f",
      "new_mode": 33188,
      "new_path": "ssh/session_test.go"
    },
    {
      "type": "modify",
      "old_id": "364790f17d7be0433b5eb404ce7bb9704a2863c1",
      "old_mode": 33188,
      "old_path": "ssh/test/cert_test.go",
      "new_id": "bc83e4f5df4589cb3d4053d732259461dc0f97cb",
      "new_mode": 33188,
      "new_path": "ssh/test/cert_test.go"
    }
  ]
}