Prior to this patch, the documentation stated that the `.text` buffers
filled by the API caller are "free(3)d" by libssh2, referring to the
default system deallocator. In reality however, libssh2 was using
`SSH2_FREE*()` to free these buffers, respecting custom allocators, if
set by the user via `libssh2_session_init_ex()`.
libssh2 behaved this way since the initial implementation committed in
da653774aa 2005-06-11, v0.11
Later, examples were added that use `strdup()` to allocate, which was
(and is) accurate because they do not use a custom allocator:
9a1ce06e31 2007-07-22
Then, when the documentation landed, it incorrectly documented
`free(3)`, perhaps basing it on the examples added earlier:
d4aa801f6f 2008-03-08
I assume that callers overriding the custom allocators are more likely
to have fixed their code to adhere with how libssh2 actually behaved,
rather than believing the documentation and live with an allocator
mismatch for all these years.
Therefore I think this is a documentation error, and this patch
addresses this.
Reported-by: Makise Kurisu
Fixes GHSA-p6p8-66vc-3f24
Reverts ce631aafe1#2659
Follow-up to d4aa801f6f
Follow-up to da653774aaCloses#2661
`LIBSSH2_USERAUTH_KBDINT_PROMPT` and `LIBSSH2_USERAUTH_KBDINT_RESPONSE`
have a `text` pointer which require using the default system allocator
by the API user, as documented in
`docs/libssh2_userauth_keyboard_interactive_ex.md`.
To align with `libssh2_userauth_publickey_sk()` and best-practices, add
FIXMEs to replace this requirement to use `LIBSSH2_ALLOC_FUNC` for the
custom allocator set via `libssh2_session_init_ex()` (or, if not set use
the default system allocator.)
The above fix requires an ABI break, or a replacement parallel API that
fixes this issue.
Reported-by: Makise Kurisu
Ref: GHSA-p6p8-66vc-3f24
Closes#2659
To avoid the chance of breaking compatibility. Make an exception for
values also passed to `strlen()` because these were already not
supporting callers passing `x, y`-style macro expressions to these
macros, as arguments.
Also note that SFTP handle args already did not support this due to the
lack of parentheses in `libssh2_sftp_close()`, `libssh2_sftp_closedir()`
macros.
Follow-up to b6f307dca9#1898Closes#2577
`libssh2_channel_get_exit_status()` returns 0 both for a real exit
status of 0 and for a channel that never received an `exit-status`
request. A server that force-closes a session, like OpenSSH under
`ChannelTimeout`, makes a still-running command look like a clean exit
0. Reproduction with the stock `example/ssh2_exec` is in #2515.
This adds `libssh2_channel_has_exit_status()`, returning 1 once the
request arrived, the name you suggested.
The new field sits in `_LIBSSH2_CHANNEL` in `libssh2_priv.h` and callers
only ever hold a pointer, so no ABI change.
`libssh2_channel_get_exit_signal()` already lets a caller see whether
that request arrived by leaving the pointer NULL, exit-status was the
odd one out.
Man page and a `test_exit_status` covering both states are included.
Follow-up to 77bd3c1215Fixes#2515Closes#2516
Being included if `HAVE_SYS_UIO_H` was set. This macro is set by libssh2
autotools and cmake configure and thus not meant to be available or used
in public headers. It may trigger this include in libssh2-user projects
which accidentally set this macro on their own.
Also the stated reason for this include elsewhere in the code is "for
struct iovec on some platforms", but `iovec` isn't referenced from
public headers. The original commit says it is for Windows, but Windows
(MSVC and mingw-w64 that is) do not provide this header. Then it was
subsequently guarded for Darwin builds, and then switched to the current
guard in the commit initially bringing CMake support to libssh2.
This patch may in theory break 3rd-party projects which by accident
relied on `libssh2.h` include this header for them.
Follow-up to 6bf8983368
Follow-up to c070bdacc7Closes#2470
To complement/replace similar fixes made earlier to
`ssh2_base64_encode()` and `knownhost_line()`, respectively.
Until libssh2 1.11.1, `libssh2_knownhost_add*()` public APIs had a
special behavior when they received `keylen == 0` argument. They
automatically determined the length of the `key` buffer via `strlen()`.
When passing zero length either on purpose or by accident, it could
result in an OOB read if the buffer's actual length was zero. (Such case
could also happen within libssh2's own code.)
This behavior was not documented on the man page, but the public
`libssh2.h` header mentioned it in comments.
Earlier patch #1641 dropped this behavior for one codepath, which was a
breaking change, arguably for the better. This patch fixes the remaining
codepath and removes this behavior from these functions completely. They
now return `LIBSSH2_ERROR_BAD_USE` when called with a zero `keylen`
argument, with an explanatory error string.
Recommended fix is passing `key` buffer length, or `strlen()` it at the
call site if the buffer is null-terminated, and making sure the buffer
is non-empty.
Refs:
https://github.com/libssh2/libssh2/pull/2363/files#diff-5182b571dc174e7b59106f0ea398a54784a0eb6c32eb95b9952cfa1aca893a71R8665e2d4d7905https://github.com/curl/curl/pull/18617
Follow-up to 102e444846#2363
Follow-up to d1c0e14d2a#1641
Follow-up to 4b991b232dCloses#2364
To have the same root name and same length, to match terms used
elsewhere in the code. To make it easy to identify them in pairs and by
suffix.
Also: move passphrase arg _after_ key source, where missing.
Closes#2362
In libssh2 for what looks like historical reasons, the codepaths for
reading keys are split for reading them from a file or reading them from
a memory buffer. This split is causing many, otherwise identical code to
be duplicated and living their own lives. It also means getting updates
or fixes separately at times, and generally causing duplicate
maintenance and arguably code bloat. The duplication makes its way into
the internal crypto interface (`crypto.h`) and with it, into each
backend, causing further code duplication and subtly or completely
different behavior (and bugs) depending on sourcing the same key from
file or memory buffer.
These effects are undesired both for using and maintaining libssh2.
Loading files via a distinct code may make sense for large files and/or
on devices with constrained memory, but in practice key files are tiny,
expected to remain so, and many (most?) codepaths already preload the
whole file into a memory buffer, and process it as such anyway.
To avoid code duplication and different behavior, this patch aims to
merge these codepaths, in the hostkey and userauth end of the code.
Closes#2354
Also:
- sync with canonical `BSD-3-Clause.txt`:
- number the clauses.
- wording in the 3rd clause.
- add 'All rights reserved.' where missing.
- agent: sync with rest of files.
- agent: merge two, identical, embedded headers.
- fix comments nits found nearby.
Closes#2247
Returning for example (without newlines):
```
crypto:LibreSSL MD5:off MD5-PEM:off RIPEMD160:off DSA:off
RSA:on RSA-SHA1:on ECDSA:on ED25519:on ML-KEM:off
AES-CTR:on AES-CBC:on BLOWFISH:off RC4:off CAST:off
3DES:off zlib:on clear-memory:on debug-logging:on
```
To allow library users to find out these details, and add a searchable
static string to binaries with this information.
Possible values for `crypto`: `AWS-LC`, `BoringSSL`, `Libgcrypt`,
`LibreSSL`, `mbedTLS`, `OpenSSL`, `OpenSSL/1.1.1`, `OS400QC3`, `WinCNG`,
`wolfSSL`.
Also:
- replace manual translation of crypto engine enum to name in CMake
integration test snippet with the new API.
Fixes#2161Closes#2178
- sync picky compiler warning options with curl:
- update version mappings for latest Apple clang.
- replace `-pedantic` with `-Wpedantic` on newer toolchains.
- adjust warning cutoff versions.
- enable new picky warnings.
- unlock picky warnings for most recent MSVC.
- GHA: bump some MSVC jobs to to VS2026.
Fix fallouts:
- configure: replace `-I` with `-isystem` for dependency headers.
Notably it silences picky warnings otherwise found in 3rd-party
headers, e.g. `-Wreserved-identifier` in `gpg-error.h`,
`openssl/lhash.h`, `wolfssl/wolfcrypt/hmac.h`, or
`-Wcast-function-type-strict` in `openssl/rsa.h`.
It also aligns autotools builds with CMake (and curl builds).
Logic copied from curl.
- example/x11: fix to not use reserved symbols.
- include, src/libssh2_priv.h: silence `-Wreserved-identifier` locally.
May be fixed for real in a future patch.
- avoid using reserved C++ keyword `public`.
- openssl: silence `-Wcast-function-type-strict` locally for
non-OpenSSL3 builds.
- mbedtls, openssl: fix potentially uninitialized variable warnings.
(extend to all compilers from MSVC in openssl)
- fix `LIBSSH2_SOCKET_MASK` signedness on Windows.
- wincng: apply casts from `int` to `enum` to silence
`-Wimplicit-int-enum-cast`.
- configure: disable `-Wleading-whitespace=spaces` to due
incompatibility with `AC_FUNC_ALLOCA`.
- packet: fix to pass `int` as mask length.
- fix `-Wformat-signedness`.
- src/libssh2_priv.h: silence `-Wreserved-macro-identifier` locally for
mingw-w64 builds.
- GHA: add workaround for missing NSIS on windows-2025 runner images.
Closes#1972
- fix typos in comments and documentation.
- fix references to non-existing functions in comments.
- libssh2_session_free: fix see-also reference on man page.
- libssh2_scp_recv2: fix typo in prototype on man page.
- man2help: use increment operator.
- badwords: extend with new words and an exclusion.
- userauth: unfold string.
- clang-format and manual formatting.
Closes#1988
- `libssh2_knownhost_add()`.
- `libssh2_poll_channel_read()`.
Follow-up to 2b8038e175
- `libssh2_sftp_seek()`.
Follow-up to 6875285b71
- `libssh2_sftp_tell()`.
Follow-up to 8eba2961ac
- exclude `LIBSSH2_KNOWNHOST_KEY_SSHDSS` and `LIBSSH2_HOSTKEY_TYPE_DSS`
macros when `LIBSSH2_NO_DEPRECATED` is set.
They are both documented as deprecated in man pages.
- disable the above two features when building libssh2 with
`LIBSSH2_NO_DEPRECATED`.
- TODO: add `libssh2_sign_sk()` for a future rename to
`libssh2_userauth_sign_sk()`.
- TODO: add remark for `libssh2_session_flag()`.
Also considered `libssh2_session_flag()` which is marked for removal in
TODO (bab3a30220), but it's the only way
to enable compression, which is also used by curl. It needs an API
replacement to control compression, or perhaps only deprecate the rest
of flags.
Closes#1977
Based on it having a public man page, it was likely meant to be a public
function. Mark it `LIBSSH2_API` to export it from the DLL on Windows.
Also move its public prototype next to userauth functions, since its
implemented in userauth.c (though not using the namespace).
Follow-up to ed439a29bb#698Closes#1965
Move `LIBSSH2_API` inline, too.
Also:
- fix missing argument names from a function typedef.
- fix pointer argument formatting.
Follow-up to e85ce25b4c#1960
Follow-up to 6ffb96321c#1935Closes#1964
Checker script and wordlist comes from curl.
Also:
- checksrc.pl: sync up with curl.
- unfold an IETF URL.
- update all IETF URLs where missing.
Closes#1959
- reflow a few lines.
- drop space between cast and value. To match majority of code.
- drop space between `*` and variable in declarations and argument
lists. To match majority of code.
Closes#1899
Deprecated since v1.2.0 (2009-08-10).
Also:
- disable examples ssh2_echo and x11 for no-deprecate builds. They
will need to be rewritten or deleted due to reliance on this API.
- ssh2_echo: replace a macro with `sizeof()`.
- update man page.
Follow-up to b1414503f5#1266
Follow-up to 2b8038e175Closes#1838
https://github.com/libssh2/libssh2/issues/1578
WINDLL means that the current project using this library is a DLL; not
that this library was built as a DLL. This check for _WINDLL is
incorrect, and the LIBSSH2_EXPORTS flag should be used instead.
Description of problem - build libssh2 as a static library to be
included in a dynamic library; if libssh2 uses _WINDLL then the names
generated are `__imp_*` which do not exist in the static build of the
library.
---------
Co-authored-by: d3x0r <d3x0r@no-reply.github.com>
It's supported by all known mingw-w64 and MSVC versions, likely also by
other modern Windows compilers.
After this patch, the `LIBSSH2_USE_WIN32_LARGE_FILES` and
`LIBSSH2_USE_WIN32_SMALL_FILES` macros are ignored by the libssh2 public
header, and it no longer defines them.
Closes#1771
- ci/appveyor: add clang-cl job.
- ci/appvayor: optimize setting an env.
- build: fix clang-cl builds.
- build: fix `-Wcast-function-type` compiler warnings for OpenSSL 3.
- build: use `stdint.h` with MSVC when supported.
- src: use `PRId64` for MSVC where supported.
- src: avoid recursive macro definition for `recv()` and `send()`.
- session: silence `-Wcast-function-type` for `libssh2_session_callback_set2()`.
Sadly this function is still not fully warning-clean, and it
seems we'd need separate setter-getters for each callback
to avoid all warnings.
Closes#1484
Also:
- switch to non-deprecated alternative in examples.
- add pointers and deprecation warning to libssh2_scp_send man page.
Cherry-picked from #1484
As noted in #771 and #1473, the blessed and signed releases are on
libssh2.org and any other archives, like those generated by GitHub,
are just a collection of files from the tag and are not the official
releases.
This adds a note, which already exists for `LIBSSH2_TIMESTAMP`, to
`LIBSSH2_VERSION`, to clarify this fact.
Closes#1475
Also:
- add `LIBSSH2_DSA_ENABLE` to enable it explicitly.
- test the above option in CI.
- say 'deprecated' in docs and public header.
- disable DSA in the CI server config.
(OpenSSH 9.8 no longer builds with it by default)
https://www.openssh.com/txt/release-9.8
Patch-by: Jose Quaresma
- disable more DSA code when not enabled.
Fixes#1433Closes#1435
- If the length of a response is `UINT_MAX - 3` or larger, an unsigned
integer overflow occurs on 64-bit systems. Avoid such truncation to
always allocate enough memory to avoid subsequent out of boundary
writes.
Patch-by: Tobias Stoeckmann
- also add FIXME to bump up length field to `size_t` (ABI break)
Closes#1337
Also:
- delete unused internal macro `libssh2_md5()` where defined.
- prefix `libssh2_os400qc3_hash*()` function names with underscore.
These are public/visible, but internal.
- add FIXMEs to OS/400 code to verify update/final calls; some OS API,
some internal.
Ref: https://github.com/libssh2/libssh2/pull/1301#discussion_r1446861650
Reviewed-by: Michael Buckley
Reviewed-by: Patrick Monnerat
Closes#1303
Before this patch, SHA2 and SHA1 init function results were cast to
`void`. This patch makes sure to verify these values.
Also:
- exclude an `assert(0)` from release builds in `_libssh2_sha_algo_ctx_init()`.
(return error instead)
- fix indentation / whitespace
Reviewed-by: Michael Buckley
Closes#1301
