They are `ssh-rsa` and `ssh-rsa-cert-v01@openssh.com`, and insecure due
to their reliance on SHA1 hashes.
Also:
- hostkey: fix to accept all RSA hostkey methods in common
`hostkey_method_ssh_rsa_init()`.
- mbedtls: add missing RSA SHA1/SHA2 guards.
- mbedtls: cleanup on error in `mbed_pub_priv_key()`.
- os400qc3: add missing RSA SHA1/SHA2 guards. (untested)
- wincng: add missing RSA SHA1/SHA2 guards.
- crypto.h: add missing `#endif` comments.
- GHA: move stray `-DLIBSSH2_DSA_ENABLE` to its place.
Follow-up to b7ab0faa70#1435
- tests: fix to guard RSA tests with `LIBSSH2_RSA`, replacing
`LIBSSH2_RSA_SHA1` to keep test coverage. Keep using the latter for
testing SHA1-based signatures in `test_auth_pubkey_ok_rsa_signed`.
Follow-up to 3e14d67d26#2444
Follow-up to 99f935358d#2443Closes#2501
It turned out that the `poll()` and `select()` dependencies are used not
just from `libssh2_poll()` but from another internal function, which
makes the no-opping pointless.
Revert to keep the deprecation process simple.
Follow-up to f84a56dd3b#2452Closes#2465
They have been deprecated for almost 2 decades. Debian code search shows
two uses, by Perl and PHP bindings. GitHub code search turns up a couple
more bindings.
After the next release these functions turn into no-ops, and will return
permanent failure, and NULL pointer/size. Along with compile-time
warnings (added in earlier commits).
Note, `libssh2_base64_decode()` causes an unfixable memory leak in user
code. Dropping `libssh2_poll()` code helps dropping its internal
dependencies, and simplifies maintenance.
Two users of `libssh2_poll()` are `example/ssh2_echo.c` and
`examples/x11.c`. They'll break and will ideally need a revamp, or
dropped, after this.
Follow-up to 94d4a2d136#1838
Follow-up to cf3aac1aba
Follow-up to 2b8038e175
Follow-up to ba79d6b52dCloses#2452
Also:
- RELEASE-NOTES: announce removal after next release.
- allow build-time macro to enable in the meantime.
- skip in tests if disabled.
- keep testing in CI with other legacy options.
- workaround oss-fuzzer hang and timeout after 10 minutes by keeping
SHA1-based MACs enabled in the fuzzer build.
Ref: https://github.com/libssh2/libssh2/pull/2444#issuecomment-5110853610
Follow-up to 99f935358d#2443Closes#2444
Also:
- RELEASE-NOTES: announce removal after next release.
- allow build-time macro to enable in the meantime.
- keep testing in CI with other legacy options.
Closes#2443
Also added missed reported-by credits for (in order reporting):
Hananto Adi:
42e33d8157#2198
Also:
- try sorting without taking into account the number of contributions.
To enable support AES-GCM for both, and ed25519 for LibreSSL.
wolfSSL requires this version for AES-GCM due to bug:
https://github.com/wolfSSL/wolfssl/pull/5205
(Before this, libssh2 tests crash with AES-GCM enabled)
Also:
- openssl: add in-source version check for LibreSSL, OpenSSL and
wolfSSL.
- openssl: include `openssl/opensslv.h` to rely on other headers pulling
it in.
- cmake: add version check for wolfSSL.
- mbedtls: do the in-source version check earlier. To match openssl.
- sync up wording for #error messages
Follow-up to 16ef3a2720#2008Closes#2073
- fix typos in comments and documentation.
- fix references to non-existing functions in comments.
- libssh2_session_free: fix see-also reference on man page.
- libssh2_scp_recv2: fix typo in prototype on man page.
- man2help: use increment operator.
- badwords: extend with new words and an exclusion.
- userauth: unfold string.
- clang-format and manual formatting.
Closes#1988
Checker script and wordlist comes from curl.
Also:
- checksrc.pl: sync up with curl.
- unfold an IETF URL.
- update all IETF URLs where missing.
Closes#1959
Notably drop support for Windows XP and older, for old-mingw,
mingw-w64 <=v2.0, and ancient zlib, old Libgrcypt and wolfSSL.
To align with curl, more modern envs, more recent cryptography
implementations, a pending PR, and to reduce the compatibility mix.
Document existing minimums (and maximums) for:
LibreSSL, mbedTLS, OpenSSL, MSVC, CMake
Bump/set minimums for:
- Libgcrypt -> 1.8 (2017-07-18)
Ref: https://www.gnupg.org/download/index.html#end-of-life
Older versions may work.
- mingw-w64 -> 3.0 (2013-09-20) (was: old-mingw and all mingw-w64)
- wolfSSL -> 5.0.0 (2021-11-01)
Older versions may work.
- Windows -> Vista (2006-11-08 - 2012-04-10)
Before this patch, it was undocumented, though wincng internally set
the target version to Vista, when undefined.
Pending patch requiring Vista:
https://github.com/libssh2/libssh2/pull/1893
- zlib -> 1.2.5.2 (2011-12-11)
Document minimums for (adopted from curl):
- clang-tidy
- GNU autotools
- Perl
Also:
- comp: drop zlib compatibility with old versions, require `z_const`.
- wincng: document cutuff versions for compatibility fallbacks.
- wincng: drop support for old-mingw, mingw-w64 <3 and VS2008.
- mingw-w64: always set `_FILE_OFFSET_BITS=64`.
Closes#1919
