-
Notifications
You must be signed in to change notification settings - Fork 8
/
NEWS
10896 lines (6980 loc) · 337 KB
/
NEWS
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
Changelog for the libssh2 project. Generated with git2news.pl
Daniel Stenberg (16 Oct 2024)
- RELEASE-NOTES: 1.11.1
Viktor Szakats (8 Oct 2024)
- RELEASE-NOTES: sync [ci skip]
- [Anders Borum brought this change]
session: support server banners up to 8192 bytes (was: 256)
If server had banner exceeding 256 bytes there wasn't enough room in
`_LIBSSH2_SESSION.banner_TxRx_banner`. Only the first 256 bytes would be
read making the first packet read fail but also dooming key exchange as
`session->remote.banner` didn't include everything.
This change bumps the banner buffer to 8KB to match OpenSSH.
Fixes #1442
Closes #1443
- RELEASE-NOTES: sync [ci skip]
- cmake: sync and improve Find modules, add `pkg-config` native detection
- sync code between Find modules.
- wolfssl: replace `pkg-config` hints with native detection.
- libgcrypt, mbedtls: add `pkg-config`-based native detection.
- libgcrypt: add version detection.
- limit `pkg-config` use for `UNIX`, vcpkg, and non-cross MinGW builds,
and builds with no manual customization via `*_INCLUDE_DIR` or
`*_LIBRARY`.
- replace and sync Find module header comments.
- ci: delete manual mbedTLS config that's now redundant.
Based on similar work done in curl.
Second attempt at #1420
Closes #1445
- cmake: initialize `LIBSSH2_LIBDIRS` [ci skip]
Follow-up to c87f12963037b22e6b60411c9c2d6513c06e2f03 #1466
- ci/appveyor: fix and bump OpenSSL 3 path, add path check
Follow-up to b5e68bdc37c6afa0dc777794dda8307167919d04 #1461
Closes #1468
- cmake: link to OpenSSL::Crypto, not OpenSSL::SSL
Follow-up to 82b09f9b3aae97f641fbcc2d746d2a6383abe857 #1322
Follow-up to c84745e34e53f863ffba997ceeee7d43d1c63a4b #1128
Cherry-picked from #1445
Closes #1467
- cmake: generate `LIBSSH2_PC_LIBS_PRIVATE` dynamically
Generate `LIBSSH2_PC_LIBS_PRIVATE` from `LIBSSH2_LIBS`.
Also add extra libdirs (`-L`) to `Libs` and `Libs.private`.
Logic copied from curl.
Closes #1466
- cmake: initialize `LIBSSH2_PC_REQUIRES_PRIVATE` [ci skip]
Follow-up to 0fce9dcc2909ffff5f4a1a1bc3d359fc7f409299 #1464
- cmake: add comment about `ibssh2.pc.in` variables [ci skip]
- cmake: support absolute `CMAKE_INSTALL_INCLUDEDIR`/`CMAKE_INSTALL_LIBDIR`
in `libssh2.pc`.
Also use `${exec_prefix}` (instead of `${prefix}`) as a base for `libdir`.
Closes #1465
- cmake: rename two variables and initialize them
- `LIBRARIES` -> `LIBSSH2_LIBS`
- `SOCKET_LIBRARIES` -> `LIBSSH2_LIBS_SOCKET`
Also initialize them before use.
Cherry-picked from #1445
Closes #1464
- ci/appveyor: reduce test runs (workaround for infrastructure permafails)
Jobs consistently fail to connect to the test server (run in GHA) since
2024-Aug-29:
https://ci.appveyor.com/project/libssh2org/libssh2/builds/50498393
There was an earlier phase of failures one month before that, that got
fixed by increasing the wait for the server in
bf3af90b3f1bb14cf452df7a8eb55cc9088f3e7f.
Thus, skip running tests in AppVeyor CI jobs, except: After some
experiments, it seems that running tests with the last OpenSSL job and
the last WinCrypt job _work_, which still leaves some coverage.
It remains to be seen how stable this is.
This is meant as a temporary fix till there is a solution to make all
jobs run tests reliable like up until a few months ago.
Closes #1461
- [Patrick Monnerat brought this change]
os400: drop vsprintf() use
Follow-up to discussion in #1457
Plus e-mail address update.
Closes #1462
- RELEASE-NOTES: sync [ci skip]
Daniel Stenberg (30 Sep 2024)
- openssl: free allocated resources when using openssl3
Reproduces consistently with curl test case 638
Closes #1459
Viktor Szakats (28 Sep 2024)
- checksrc: update, check all sources, fix fallouts
update from curl:
https://github.com/curl/curl/blob/cff75acfeca65738da8297aee0b30427b004b240/scripts/checksrc.pl
Closes #1457
- cmake: prefer `find_dependency()` in `libssh2-config.cmake`
CMake manual suggest using `find_dependency()` (over `find_package()`)
in `config.cmake` scripts.
Ref: https://cmake.org/cmake/help/latest/module/CMakeFindDependencyMacro.html
Closes #1460
- ci: use Ninja with cmake
Closes #1458
GitHub (27 Sep 2024)
- [dksslq brought this change]
Fix memory leaks in _libssh2_ecdsa_curve_name_with_octal_new and _libssh2_ecdsa_verify (#1449)
Better error handling in`_libssh2_ecdsa_curve_name_with_octal_new` and `_libssh2_ecdsa_verify` to prevent leaks.
Credit: dksslq <[email protected]>
- [rolag brought this change]
Fix unstable connections over nonblocking sockets (#1454)
The `send_existing()` function allows partially sent packets to be sent
fully before any further packets are sent. Originally this returned
`LIBSSH2_ERROR_BAD_USE` when a different caller or thread tried to send
an existing packet created by a different caller or thread causing the
connection to disconnect. Commit 33dddd2f8ac3bc81 removed the return
allowing any caller to continue sending another caller's packet. This
caused connection instability as discussed in #1397 and confused the
client and server causing occasional duplicate packets to be sent and
giving the error `rcvd too much data` as discussed in #1431. We return
`LIBSSH2_ERROR_EAGAIN` instead to allow existing callers to finish
sending their own packets.
Fixes #1397
Fixes #1431
Related #720
Credit: klux21, rolag
- [Will Cosgrove brought this change]
Prevent possible double free of hostkey (#1452)
NULL server hostkey based on fuzzer failure case.
Viktor Szakats (7 Sep 2024)
- cmake: tidy up syntax, minor improvements
- make internal variables underscore-lowercase.
- unfold lines.
- fold lines setting header directories.
- fix indent.
- drop interim variable `EXAMPLES`.
- initialize some variables before populating them.
- clear a variable after use.
- add `libssh2_dumpvars()` function for debugging.
- allow to override default `CMAKE_UNITY_BUILD_BATCH_SIZE`.
- bump up default `CMAKE_UNITY_BUILD_BATCH_SIZE` to 0 (was 32).
- tidy up option descriptions.
Closes #1446
- cmake: rename mbedTLS and wolfSSL Find modules
To match the curl ones.
Cherry-picked from #1445
- RELEASE-NOTES: sync [ci skip]
- cmake: fixup version detection in mbedTLS find module
- avoid warning with 2.x versions about missing header file while
extracting the version number.
- clear temp variables.
Closes #1444
- buildconf: drop
Use `autoreconf -fi` instead.
Follow-up to fc5d77881eb6bb179f831e626d15f4f29179aad5
Closes #1441
- [Michael Buckley brought this change]
Implement [email protected]
Probably the biggest and potentially most controversial change we have
to upstream.
Because earlier versions of OpenSSL implemented the algorithm before
standardization, using an older version of OpenSSL can cause problems
connecting to OpenSSH servers. Because of this, we use the public domain
reference implementation instead of the crypto backends, just like
OpenSSH does.
We've been holding this one for a few years. We were about to upstream
it around the same time as aes128gcm landed upstream, and the two
changes were completely incompatible. Honestly, it took me weeks to
reconcile these two implementations, and it could be much better.
Our original implementation changed every crypt method to decrypt the
entire message at once. the AESGCM implementation instead went with this
firstlast design, where a firstlast paramater indicates whether this is
the first or last call to the crypt method for each message. That added
a lot of bookkeeping overhead, and wasn't compatible with the chacha
public domain implementation.
As far as I could tell, OpenSSH uses the technique of decrypting the
entire message in one go, and doesn't have anything like firstlast.
However, I could not get out aes128gcm implementation to work that way,
nor could I get the chacha implementation to work with firstlast, so I
split it down the middle and let each implementation work differently.
It's kind of a mess, and probably should be cleaned up, but I don't have
the time to spend on it anymore, and it's probably better to have
everything upstream.
Fixes #584
Closes #1426
- tidy-up: do/while formatting
Also fix an indentation and delete empty lines.
Closes #1440
- wolfssl: drop header path hack
The wolfSSL OpenSSL headers reside in `wolfssl/openssl/*.h`.
Before this patch the wolfSSL OpenSSL compatibilty header includes were
shared with the native OpenSSL codepath, and used `openssl/*h`. For
wolfSSL builds this required a hack to append the
`<wolfssl-prefix>/wolfssl` directory to the header search path, to find
the headers.
This patch changes the source to use the correct header references,
allowing to drop the header path hack.
Also fix to use the correct variable to set up the header path in CMake:
`WOLFSSL_INCLUDE_DIRS` (was: `WOLFSSL_INCLUDE_DIR`, without the `S`)
Closes #1439
- cmake: mbedTLS detection tidy-ups
- set and use `MBEDTLS_INCLUDE_DIRS`.
- stop marking `MBEDTLS_LIBRARIES` as advanced.
Closes #1438
- cmake: add quotes, delete ending dirseps
Follow-up to 3fa5282d6284efba62dc591697e6a687152bdcb1 #1166
Closes #1437
- CI/appveyor: increase wait for SSH server on GHA [ci skip]
Blind attempt to make AppVeyor CI tests work again.
- disable DSA by default
Also:
- add `LIBSSH2_DSA_ENABLE` to enable it explicitly.
- test the above option in CI.
- say 'deprecated' in docs and public header.
- disable DSA in the CI server config.
(OpenSSH 9.8 no longer builds with it by default)
https://www.openssh.com/txt/release-9.8
Patch-by: Jose Quaresma
- disable more DSA code when not enabled.
Fixes #1433
Closes #1435
GitHub (30 Jul 2024)
- [Viktor Szakats brought this change]
tidy-up: link updates (#1434)
Marc Hoersken (27 Jul 2024)
- ci/GHA: revert concurrency and improve permissions
Statuses are per AppVeyor event and commit, not pull-request.
Also align permissions approach with curl, least priviledge.
Partially reverts b08cfbc99fa4df3459db4e1ccf4263fd260e9b15.
GitHub (23 Jul 2024)
- [Will Cosgrove brought this change]
Always init mbedtls_pk_context (#1430)
In the failure case, mbedtls_pk_context could be free'd without first being initialized.
- [Viktor Szakats brought this change]
mbedtls: tidy-up (#1429)
- [Will Cosgrove brought this change]
Correctly initialize values (#1428)
Fix regression with commit from #1421
Viktor Szakats (14 Jul 2024)
- RELEASE-NOTES: sync [ci skip]
- [Seo Suchan brought this change]
mbedtls: expose `mbedtls_pk_load_file()` for our use
While it's moved to pk_internal, it won't removed in mbedTLS 3.6 LTS
so it's safe to redeclare it on our side to find it.
This is implementing emergency fix suggested from
https://github.com/libssh2/libssh2/commit/2e4c5ec4627b3ecf4b6da16f365c011dec9a31b4#commitcomment-141379351
Follow-up to e973493f992313b3be73f51d3f7ca6d52e288558 #1393
Follow-up to 2e4c5ec4627b3ecf4b6da16f365c011dec9a31b4 #1349
Closes #1421
GitHub (13 Jul 2024)
- [Viktor Szakats brought this change]
ci/GHA: simplify mbedTLS build hack for autotools (#1425)
Follow-up to e973493f992313b3be73f51d3f7ca6d52e288558 #1393
- [Michael Buckley brought this change]
Always check for null pointers before calling _libssh2_bn_set_word (#1423)
- [Viktor Szakats brought this change]
ci/GHA: FreeBSD 14.1, actions bump (#1424)
- [Michael Buckley brought this change]
Increase SFTP_HANDLE_MAXLEN back to 4092 (#1422)
Match OpenSSH for compatibility.
Viktor Szakats (10 Jul 2024)
- ci/GHA: tidy up casing [ci skip]
- REUSE: fix typo in comment
- REUSE: shorten and improve
Follow-up to 70b8bf314cf4566a7529c5d6eae63097a926abb0 #1419
- REUSE: upgrade to `REUSE.toml`
Closes #1419
- build: stop detecting `sys/param.h` header
This header is no longer used.
Follow-up to 12427f4fb8e789adcee4a6e30974932883915e88 #1415
Closes #1418
- [Nicolas Mora brought this change]
tests: avoid using `MAXPATHLEN`, for portability
`MAXPATHLEN` is not present in some systems, e.g. GNU Hurd.
Co-authored-by: Viktor Szakats
Ref: 54bef4c5dad868a9d45fdbfca9729b191c0abab5 #198
Fixes #1414
Closes #1415
- cmake: sync formatting in `cmake/Find*` modules
- [Michael Buckley brought this change]
sftp: implement [email protected]
Add a new function `libssh2_sftp_posix_rename_ex()` and
`libssh2_sftp_posix_rename()`, which implement
the [email protected] extension.
If the server does not support this extension, the function returns
`LIBSSH2_FX_OP_UNSUPPORTED` and it's up to the user to recover, possibly
by calling `libssh2_sftp_rename()`.
Co-authored-by: Viktor Szakats (bump to size_t)
Closes #1386
- src: use `UINT32_MAX`
Needs to be defined for platforms missing it, e.g. VS2008.
Closes #1413
GitHub (25 Jun 2024)
- [Michael Buckley brought this change]
Fix a memory leak in key exchange. (#1412)
Original fix submitted as a patch by Trzik.
Co-authored-by: Michael Buckley <[email protected]>
Viktor Szakats (25 Jun 2024)
- RELEASE-NOTES: sync [ci skip]
- wolfssl: fix `EVP_Cipher()` use with v5.6.0 and older
Add workaround for the wolfSSL `EVP_Cipher(*p, NULL, NULL, 0)` bug to
make libssh2 work with wolfSSL v5.6.0 and older.
wolfSSL fixed this issue in v5.7.0:
https://github.com/wolfSSL/wolfssl/pull/7143
https://github.com/wolfSSL/wolfssl/commit/b0de0a1c95119786cf5651dd76dd7d7bdfac5a04
Without our local workaround:
- v5.3.0 and older fail most tests:
Ref: https://github.com/libssh2/libssh2/actions/runs/9646827522/job/26604211476#step:17:1263
- v5.4.0, v5.5.x, v5.6.0 fail these:
```
29 - test_read-aes128-cbc (Failed)
30 - test_read-aes128-ctr (Failed)
32 - test_read-aes192-cbc (Failed)
33 - test_read-aes192-ctr (Failed)
34 - test_read-aes256-cbc (Failed)
35 - test_read-aes256-ctr (Failed)
```
Ref: https://github.com/libssh2/libssh2/actions/runs/9646827522/job/26604233819#step:17:978
Oddly enough the workaround breaks OpenSSL tests, so only enable it for
the affected wolfSSL versions.
Also add new build-from-source wolfSSL CI job to test the new codepath.
wolfSSL has a build bug where `wolfssl/options.h` and
`wolfssl/version.h` are not copied to the `install` destination with
autotools. With CMake it has a different bug where `wolfcrypt/sp_int.h`
is not copied (with v5.4.0). And another with CMake where `FIPS_mode()`
remains missing (with v5.6.0 and earlier.)
Therefore use CMake with v5.5.4 and a workaround for `FIPS_mode()`.
Another option is autotools with v5.4.0 and a workaround for `install`,
but CMake builds quicker.
Regression-from 3c953c05d67eb1ebcfd3316f279f12c4b1d600b4 #797
Fixes #1020
Fixes #1299
Assisted-by: Michael Buckley via #1394
Closes #1394 (another attempt to fix the mentioned wolfSSL bug)
Closes #1407
- wolfssl: bump version in upstream issue comment [ci skip]
- wolfssl: require v5.4.0 for AES-GCM
Earlier versions crash while running tests.
This patch is part of a series of fixes to make wolfSSL AES-GCM support
work together with libssh2.
Possibly related is this wolfSSL bugfix patch, released in v5.4.0:
https://github.com/wolfSSL/wolfssl/pull/5205
https://github.com/wolfSSL/wolfssl/commit/fb3c611275dfe454c331baa0818445a0406c208a
"Fix another AES-GCM EVP control command issue"
Ref: #1020
Ref: #1299
Cherry-picked from #1407
Closes #1411
- tests: fix excluding AES-GCM tests
Replace hard-coded crypto backends and rely on `LIBSSH2_GCM` macro
to decide whether to run AES-GCM tests.
Without this, build attempted to run AES-GCM tests (and failed)
for crypto backends that have conditional support for this feature, e.g.
wolfSSL without the necessary features built-in
(as in before Homewbrew wolfssl 5.7.0_1, or OpenSSL v1.1.0 and older).
This patch is part of a series of fixes to make wolfSSL AES-GCM support
work together with libssh2.
Cherry-picked from #1407
Closes #1410
- ci/GHA: fix wolfSSL-from-source AES-GCM tests
Turns out these tests:
```
31 - [email protected] (Failed)
36 - [email protected] (Failed)
```
were failing because AES-GCM wasn't enabled in libssh2. This in turn
happened because the `WOLFSSL_AESGCM_STREAM` macro wasn't enabled while
building wolfSSL. Which happened because this macro isn't enabled by
any CMake-level wolfSSL option. Passing it as `CPPFLAGS` fixes it.
This allows enabling tests with wolfSSL 5.7.0.
Follow-up to d4cea53f53c78febad14b4caa600e25d1aaf92fd #1408
Closes #1409
- ci/GHA: add Linux job with latest wolfSSL built from source
After this patch it's possible to run tests with wolfSSL 5.7.0.
wolfSSL 5.7.0 fixes this bug that affects open issues #1020 and #1299:
https://github.com/wolfSSL/wolfssl/pull/7143
`-DWOLFSSL_OPENSSLALL=ON` is necessary for `wolfSSL_FIPS_mode()`
Closes #1408
- ci/GHA: tidy up build-from-source steps [ci skip]
- make curl downloads less verbose.
- fix cmake warning:
```
CMake Warning:
No source or binary directory provided. Both will be assumed to be the
same as the current working directory, but note that this warning will
become a fatal error in future CMake releases.
```
Ref: https://github.com/libssh2/libssh2/actions/runs/9509866494/job/26213472410#step:5:32
- [Adam brought this change]
src: fix type warning in `libssh2_sftp_unlink` macro
The `libssh2_sftp_unlink` macro was implicitly casting the `size_t`
returned by `strlen` to the `unsigned int` type expected by
`libssh2_sftp_unlink_ex`.
This fix adds an explicit cast to match similar macro definitions in
the same file (e.g. `libssh2_sftp_rename`, `libssh2_sftp_mkdir`).
Closes #1406
- libssh2.pc: reference mbedcrypto pkgconfig
mbedtls 3.6.0 got pkgconfig support:
https://github.com/Mbed-TLS/mbedtls/commit/a4d17b34f354557838e05d2cb47200e8dcaaf59b
Reference it from `libssh2.pc`.
Closes #1405
- tidy-up: typo in comment [ci skip]
- RELEASE-NOTES: sync [ci skip]
Also bump planned deprecation dates.
- ci/GHA: show configure logs on failure and other tidy-ups
- dump cmake error log on configure failure. (for cmake 3.26 and newer)
- dump `config.log` on autotools configure failure.
- convert specs filename to Windows format before passing to CMake.
- add missing quotes.
Closes #1403
- ci/GHA: bump parallel jobs to nproc+1
Ref: https://docs.github.com/en/actions/using-github-hosted-runners/about-github-hosted-runners/about-github-hosted-runners#standard-github-hosted-runners-for-public-repositories
Closes #1402
- ci/GHA: show test logs on failure
Closes #1401
- ci/GHA: fix `Dockerfile` failing after Ubuntu package update
Likely due an upstream Ubuntu package update (requiring an apt-get
install call beforehand), tests run via autotools started failing with
no change in the libssh2 repo:
```
FAIL: test_aa_warmup
====================
Error running command 'docker build --quiet -t libssh2/openssh_server %s' (exit 256): Dockerfile:10
--------------------
8 | && apt-get clean \
9 | && rm -rf /var/lib/apt/lists/*
10 | >>> RUN mkdir /var/run/sshd
11 |
12 | # Chmodding because, when building on Windows, files are copied in with
--------------------
ERROR: failed to solve: process "/bin/sh -c mkdir /var/run/sshd" did not complete successfully: exit code: 1
Failed to build docker image
Cannot stop session - none started
Cannot stop container - none started
Command: docker build --quiet -t libssh2/openssh_server ../../tests/openssh_server
FAIL test_aa_warmup (exit status: 1)
```
Ref: https://github.com/libssh2/libssh2/actions/runs/9322194756/job/25662748095#step:11:390
Fix it by skipping `mkdir` if `/var/run/sshd` already exists.
(Why cmake-based jobs aren't affected, I don't know.)
Ref: https://github.com/libssh2/libssh2/commit/50143d5867d35df76a6cf589ca8a13b22105aa64#commitcomment-142560875
Closes #1400
- ci/GHA: use ubuntu-latest with OmniOS job
It's the same as ubuntu-22.04.
Also update OmniOS package search link.
- ci: disable dependency tracking in autotools builds
For better build performance. Dependency tracking causes a build
overhead while compiling to help a subsequent build, but in CI there is
never one and the extra work is discarded.
Closes #1396
- mbedtls: fail to compile with v3.6.0 outside CI
A compile-time failure is preferred over an unexpected one at
runtime.
The problem is silenced with a macro in CI and this macro will have
to be added to more platforms when mbedTLS v3.6.0 reaches them.
Follow-up to 2e4c5ec4627b3ecf4b6da16f365c011dec9a31b4 #1349
Closes #1393
- tests: drop default cygpath option `-u`
- tidy-up: fix typo found by codespell
Ref: https://github.com/libssh2/libssh2/actions/runs/9224795055/job/25380857082?pr=1393#step:4:5
- ci/GHA: shell syntax tidy-up
Closes #1390
- RELEASE-NOTES: sync [ci skip]
- ci/GHA: bump NetBSD/OpenBSD, add NetBSD arm64 job
OpenBSD arm64 jobs were very slow, so skipped that.
Closes #1388
- autotools: fix to update `LDFLAGS` for each detected dependency
autotools lib detection routine failed to extend LDFLAGS for each
detection. This could cause successful detection of a dependency, but
later failing to use it. This did not cause an issue as long as all
dependencies lived under the same prefix, but started breaking on macOS
ARM + Homebrew where this was no longer true for mbedTLS and zlib in
particular.
Follow-up to 844115393bffb4e92c6569204cbe4cd8e553480d #1381
Follow-up to ae2770de25949bc7c74e60b4cc6a011bbe1d3d7c #1377
Closes #1384
GitHub (8 May 2024)
- [Michael Buckley brought this change]
OpenSSL 3: Fix calculating DSA public key (#1380)
Viktor Szakats (8 May 2024)
- ci/GHA: tidy-up wolfSSL autotools config on macOS
Closes #1383
- ci/GHA: shorter mbedTLS autotools workaround
Follow-up to 844115393bffb4e92c6569204cbe4cd8e553480d #1381
Closes #1382
GitHub (8 May 2024)
- [Michael Buckley brought this change]
ci: fix mbedtls runners on macOS (#1381)
Sets LDFLAGS while configuring the autoconf mbedTLS build for macOS.
Viktor Szakats (29 Apr 2024)
- RELEASE-NOTES: sync [ci skip]
- [binary1248 brought this change]
wincng: fix `DH_GEX_MAXGROUP` set higher than supported
In 1c3a03ebc3166cf69735111aba2b8cee57cdba51 #493,
`LIBSSH2_DH_GEX_MAXGROUP` was introduced to specify
crypto-backend-specific modulus sizes. Unfortunately, the max size for
the wincng DH modulus was defined to 8192, probably because this is the
value most other backends support.
According to Microsoft documentation [1], `BCryptGenerateKeyPair`
currently only supports up to 4096-bit keys when the selected algorithm
is `BCRYPT_DH_ALGORITHM`. Requesting larger keys when calling
`BCryptGenerateKeyPair` in `_libssh2_dh_key_pair` always results in
`STATUS_INVALID_PARAMETER` being returned and ultimately key exchange
failing.
When attempting to connect to any server that offers 8192 bit DH, this
causes key exchange to always fail when using the wincng backend.
Reducing `LIBSSH2_DH_GEX_MAXGROUP` to 4096 fixes the issue.
[1] https://learn.microsoft.com/en-us/windows/win32/api/bcrypt/nf-bcrypt-bcryptgeneratekeypair
Closes #1372
- build: silence warnings inside `FD_SET()`/`FD_ISSET()` macros
Use an ugly workaround to silence `-Wsign-conversion` warnings triggered
by the internals of `FD_SET()`/`FD_ISSET()` macros. They've been showing
up in OmniOS CI builds when compiling `example` programs. They also have
been seen with older Cygwin and other envs and configurations.
Also scope two related variables in examples.
E.g.:
```
../../example/direct_tcpip.c:251:9: warning: conversion to 'long unsigned int' from 'libssh2_socket_t' {aka 'int'} may change the sign of the result [-Wsign-conversion]
251 | FD_SET(forwardsock, &fds);
| ^~~~~~
../../example/direct_tcpip.c:251:9: warning: conversion to 'long unsigned int' from 'libssh2_socket_t' {aka 'int'} may change the sign of the result [-Wsign-conversion]
../../example/direct_tcpip.c:251:9: warning: conversion to 'long unsigned int' from 'long int' may change the sign of the result [-Wsign-conversion]
../../example/direct_tcpip.c:251:9: warning: conversion to 'long int' from 'long unsigned int' may change the sign of the result [-Wsign-conversion]
../../example/direct_tcpip.c:259:18: warning: conversion to 'long unsigned int' from 'libssh2_socket_t' {aka 'int'} may change the sign of the result [-Wsign-conversion]
259 | if(rc && FD_ISSET(forwardsock, &fds)) {
| ^~~~~~~~
../../example/direct_tcpip.c:259:18: warning: conversion to 'long unsigned int' from 'libssh2_socket_t' {aka 'int'} may change the sign of the result [-Wsign-conversion]
../../example/direct_tcpip.c:259:18: warning: conversion to 'long unsigned int' from 'long int' may change the sign of the result [-Wsign-conversion]
```
Ref: https://github.com/libssh2/libssh2/actions/runs/8854199687/job/24316762831#step:3:2020
Closes #1379
- autotools: use `AM_CFLAGS`
Use `AM_CFLAGS` to pass custom, per-target C flags. This replaces using
`CFLAGS` which triggered this warning when running `autoreconf -fi`:
```
tests/Makefile.am:8: warning: 'CFLAGS' is a user variable, you should not override it;
tests/Makefile.am:8: use 'AM_CFLAGS' instead
```
(Only for `tests`, even though `example` and `src` also used this
method. The warning is also missing from curl, that also uses
`CFLAGS`.)
Follow-up to 3ec53f3ea26f61cbf2e0fbbeccb852fca7f9b156 #1286
Closes #1378
GitHub (25 Apr 2024)
- [Viktor Szakats brought this change]
ci/GHA: fix gcrypt with autotools/macOS/Homebrew/ARM64 (#1377)
mbedtls configure fails to detect anything due to this:
```
configure:23101: gcc -o conftest -g -O2 -I/opt/homebrew/include conftest.c -lmbedcrypto -lz >&5
ld: library 'mbedcrypto' not found
clang: error: linker command failed with exit code 1 (use -v to see invocation)
```
Viktor Szakats (25 Apr 2024)
- autotools: delete bogus square bracket from help text [ci skip]
Follow-up to 3f98bfb0900b5e68445a339cfebc60b307a24650 #1368
GitHub (25 Apr 2024)
- [Viktor Szakats brought this change]
ci/GHA: fix verbose option for autotools jobs (#1376)
Also enable verbose for macOS `make` step.
- [Viktor Szakats brought this change]
ci/GHA: dump `config.log` on failure for macOS autotools jobs (#1375)
- [Viktor Szakats brought this change]
ci/GHA: fix `autoreconf` failure on macOS/Homebrew (#1374)
By manually installing `libtool`.
```
autoreconf -fi
shell: /bin/bash -e {0}
configure.ac:75: error: possibly undefined macro: AC_LIBTOOL_WIN32_DLL
If this token and others are legitimate, please use m4_pattern_allow.
See the Autoconf documentation.
configure.ac:76: error: possibly undefined macro: AC_PROG_LIBTOOL
autoreconf: error: /opt/homebrew/Cellar/autoconf/2.72/bin/autoconf failed with exit status: 1
```
Ref: https://github.com/libssh2/libssh2/actions/runs/8833608758/job/24253334557#step:4:1
- [Viktor Szakats brought this change]
ci/GHA: fixup Homebrew location (for ARM runners) (#1373)
GHA macOS runners became ARM64 machines. Make the Homebrew prefix
dynamic to adapt to these installations.
Viktor Szakats (14 Apr 2024)
- RELEASE-NOTES: sync [ci skip]
- [Patrick Monnerat brought this change]
os400: Add two recent files to the distribution
Closes #1364
- wincng: add to ci/GHA, add `./configure` option `--enable-ecdsa-wincng`
- add `./configure` option `--enable-ecdsa-wincng`
- add WinCNG autotools jobs to GHA.
- enable WinCNG ECDSA in some GHA jobs (both CMake and autotools).
Follow-up to 3e72343737e5b17ac98236c03d5591d429b119ae #1315
Closes #1368
GitHub (14 Apr 2024)
- [Johannes Passing brought this change]
wincng: add ECDSA support for host and user authentication (#1315)
The WinCNG backend currently only supports DSA and RSA. This PR
adds ECDSA support for host and user authentication.
* Disable WinCNG ECDSA support by default to maintain backward
compatibility for projects that target versions below Windows 10.
* Add cmake option `ENABLE_ECDSA_WINCNG` to guard ECDSA support.
* Update AppVeyor job matrix to only enable ECDSA on Server 2016+
Viktor Szakats (14 Apr 2024)
- ci: enable Unity mode for most CMake builds
Ref: 7129ea9ca8cca86dac80a6bac2d63937987efe9d #1034
Closes #1367
- os400: fix shellcheck warnings in scripts (fixups)
- Build scripts must be executed by the os/400 shell (sh), not bash which
is a PASE program: The `-ot` non-POSIX test extension works in os/400 as
well. Ref: https://github.com/libssh2/libssh2/pull/1364#issue-2241646754
- Drop/fixup mods trying to make some syntax highlighters happier.
Follow-up to c6625707b94d9093f38f1a0a4d89c11b64f12ba8 #1358
Assisted-by: Patrick Monnerat
Closes #1364
Closes #1366
- cmake: style tidy-up (more)
Follow-up to 3fa5282d6284efba62dc591697e6a687152bdcb1 #1166
Closes #1365
- RELEASE-NOTES: sync [ci skip]
- os400: fix shellcheck warnings in scripts
- use `$()` instead of backticks, and re-arrange double-quotes inside.
- add missing `|| exit 1` to `cd` calls. (could be dropped by using `set -eu`.)
- add `-n` to a few `if`s.
- shorten redirections by using `{} >` (as shellcheck recommended).
- silence warnings where variables were detected as unused (SC2034).
- a couple misc updates to silence warnings.
- switch to bash shebang for `-ot` feature.
- split two lines to unbreak syntax highlighting in my editor. (`$(expr \`, `$(dirname \`)
Also enable CI checks for OS/400 shell scripts.
Ref: d88b9bcdafe9d19aad2fb120d0a0acb3edab64f7
Closes #1358
- RELEASE-NOTES: sync [ci skip]
- ci: add shellcheck job and script
Add FIXME for OS/400 scripts.
Cherry-picked from #1358
- tests: fix shellcheck issues in `test_sshd.test`
Cherry-picked from #1358
- RELEASE-NOTES: sync [ci skip]
GitHub (9 Apr 2024)
- [Viktor Szakats brought this change]
ci/appveyor: re-enable OpenSSL 3, also bump to 3.2.1 (#1363)
Ref: 104744f4a523de574ce3767c50948d9b8385be4c #1348
Viktor Szakats (9 Apr 2024)
- ci: use a better test timestamp [ci skip]
Mar 27 2024 08:00:00 GMT+0000
Follow-up to 2d765e454d98b794a5e5bbc497b1fcba4a9b8c4b #1360
GitHub (9 Apr 2024)
- [Viktor Szakats brought this change]
ci: verify build and install from tarball (#1362)
Install verification based on:
https://github.com/curl/curl/blob/28c5ddf13ac311d10bc4e8f9fc4ce0858a19b888/scripts/installcheck.sh
Viktor Szakats (9 Apr 2024)
- tidy-up: dir names, command-line [ci skip]
Follow-up to 2d765e454d98b794a5e5bbc497b1fcba4a9b8c4b #1360
- cmake: tidy up function name casing in `CopyRuntimeDependencies.cmake`
Use lowercase to match callers.
GitHub (9 Apr 2024)
- [Viktor Szakats brought this change]
ci: add reproducibility test for `maketgz` (#1360)
Viktor Szakats (9 Apr 2024)
- maketgz: add reproducible dir entries to tarballs
In the initial implementation of reproducible tarballs, they were
missing directory entries, while .zip archives had them. It meant
that on extracting the tarball, on-disk directory entries got the
current timestamp.
This patch fixes this by including directory entries in the tarball,
with reproducible timestamps. It also moves sorting inside tar,
to ensure reproducible directory entry timestamps on extract
(without the need of `--delay-directory-restore` option, when
extracting with GNU tar. BSD tar got that right by default.)