CVE-2023-27538: SSH connection too eager reuse still

How it was found

Summary:

There's a check if SSH keys match between new and existing connection when considering reuse. This check is broken due to wrong comparison: #define PROTO_FAMILY_SSH (CURLPROTO_SCP|CURLPROTO_SFTP) ... else if(get_protocol_family(needle->handler) == PROTO_FAMILY_SSH) { This never matches as handler family is either CURLPROTO_SCP or CURLPROTO_SFTP.

Remediation

• Make the code: else if(get_protocol_family(needle->handler) & PROTO_FAMILY_SSH) {

Steps To Reproduce:

1. Make two connections to the same host with different ssh keys

Impact

Connection reuse when different ssh keys are used.