[14.5-stable] zedUpload/sftp: accept a scheme-qualified host as well as bare host:port - #93
Merged
Conversation
getSftpClient assumed host was always a bare "host:port" and extracted the hostname for its pre-flight DNS check via a naive strings.Split(host, ":"), taking the first element. Since lf-edge/eve#5588, EVE's datastore Fqdn is always scheme-qualified for every datastore type, including SFTP (e.g. "sftp://host:port"), which broke that assumption: the first element became the literal scheme "sftp" instead of the real host, causing the SFTP download to fail with: sftpclient failed for sftp://244.244.244.244:22: lookup sftp on 127.0.0.1:53: no such host (i.e. trying to resolve "sftp") Detect which form was given via url.Parse: a real scheme-qualified authority-form URL parses with a non-empty Host, whereas a bare host:port also "succeeds" but only as an opaque URI (empty Host, with the part before the port's colon landing in Scheme/Opaque instead). Use u.Host when present, and fall back to the original bare host:port otherwise, so existing callers outside EVE are unaffected. Also replaces the naive colon-split used for the hostname-only DNS pre-check with net.SplitHostPort, which additionally fixes handling of a bracketed IPv6 literal (e.g. "[::1]:22") in both forms. Signed-off-by: Milan Lenco <milan@zededa.com> (cherry picked from commit 882c841)
milan-zededa
requested review from
christoph-zededa,
eriknordmark and
europaul
August 10, 2026 12:55
christoph-zededa
approved these changes
Aug 10, 2026
Let's Encrypt rotated badssl.com's wrong-host certificate onto a new intermediate (YR2) on 2026-07-28, breaking the hardcoded R10/R11/R13 match. Match only the stable, non-rotating parts of the issuer DN instead, matching the fix from main (commit 6b30666, "nettrace: don't pin Let's Encrypt intermediate"), adapted to this branch's older, non-subtest test structure. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Signed-off-by: Milan Lenco <milan@zededa.com>
milan-zededa
force-pushed
the
14-5-sftp-scheme
branch
from
August 10, 2026 13:15
3ca0a28 to
4cf602c
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
getSftpClientassumed host was always a barehost:portand extracted the hostname for its pre-flight DNS check via a naivestrings.Split(host, ":"), taking the first element. Since lf-edge/eve#5588, EVE's datastore Fqdn is always scheme-qualified for every datastore type, including SFTP (e.g.sftp://host:port), which broke that assumption: the first element became the literal schemesftpinstead of the real host, causing the SFTP download to fail with:(i.e. trying to resolve
sftp)Detect which form was given via
url.Parse: a real scheme-qualified authority-form URL parses with a non-empty Host, whereas a bare host:port also "succeeds" but only as an opaque URI (empty Host, with the part before the port's colon landing in Scheme/Opaque instead). Useu.Hostwhen present, and fall back to the original barehost:portotherwise, so existing callers outside EVE are unaffected.Also replaces the naive colon-split used for the hostname-only DNS pre-check with
net.SplitHostPort, which additionally fixes handling of a bracketed IPv6 literal (e.g.[::1]:22) in both forms.(cherry picked from commit 882c841)
Backport of #90