The codebase no longer relies on `gettimeofday()`. It still serves as an
unconditional fallback in `ssh2_now()` on non-Windows, if no modern
alternative exists. Let us know if this causes an issue.
To simplify, make configure fast, and avoid the detection discrepancy
between autotools and cmake.
Follow-up to 0d998d16c0#2494
Follow-up to 694d38e33e#2493
Follow-up to a43dc6d504#2490
Follow-up to 04665fedff#2491
Follow-up to c97959e9b6#2489
Follow-up to 9c421761bc#2341Closes#2485
Drop feature detection for it at configure time.
To simplify, improve configure performance, make examples build better
standalone, and sync with curl.
Closes#2467
Drop feature detection for it at configure time.
To simplify, improve configure performance, make examples build better
standalone, and sync with curl.
Closes#2466
`select()` was used unconditionally in internal function
`ssh2_wait_socket()`, when `poll()` is not available, since
9d55db6501 (2007-02-02, release 0.15)
It means the build was broken without `select()` in such case. There
were also no reports about this being an issue. Therefore detecting it
at configure time is superfluous.
Drop feature detections, and drop `libssh2_poll()` implementation
fallback logic dealing with an impossible no-poll-no-select build.
Follow-up to 9d55db6501Closes#2464
Copy `curlx_str_number()` from curl, reduced to libssh2 needs by
dropping hex support and to have only one API entry, and reindented.
To replace `strtol()`, `strtoll()`, `stroi64()`. The new solution is
portable, no longer requires elaborate build-time detection, does
provide error handline, supports values limits and is const-friendly.
The new function does not skip leading spaces compared to the
replaced ones.
This should also fix C89 macOS builds where autotools configure
misdetected `strtoll()` and break the build, before this patch.
Refs:
d5c738c608https://github.com/curl/curl/pull/15692
Credits-to: Daniel Stenberg
Closes#2456
To complement/replace similar fixes made earlier to
`ssh2_base64_encode()` and `knownhost_line()`, respectively.
Until libssh2 1.11.1, `libssh2_knownhost_add*()` public APIs had a
special behavior when they received `keylen == 0` argument. They
automatically determined the length of the `key` buffer via `strlen()`.
When passing zero length either on purpose or by accident, it could
result in an OOB read if the buffer's actual length was zero. (Such case
could also happen within libssh2's own code.)
This behavior was not documented on the man page, but the public
`libssh2.h` header mentioned it in comments.
Earlier patch #1641 dropped this behavior for one codepath, which was a
breaking change, arguably for the better. This patch fixes the remaining
codepath and removes this behavior from these functions completely. They
now return `LIBSSH2_ERROR_BAD_USE` when called with a zero `keylen`
argument, with an explanatory error string.
Recommended fix is passing `key` buffer length, or `strlen()` it at the
call site if the buffer is null-terminated, and making sure the buffer
is non-empty.
Refs:
https://github.com/libssh2/libssh2/pull/2363/files#diff-5182b571dc174e7b59106f0ea398a54784a0eb6c32eb95b9952cfa1aca893a71R8665e2d4d7905https://github.com/curl/curl/pull/18617
Follow-up to 102e444846#2363
Follow-up to d1c0e14d2a#1641
Follow-up to 4b991b232dCloses#2364
To have the same root name and same length, to match terms used
elsewhere in the code. To make it easy to identify them in pairs and by
suffix.
Also: move passphrase arg _after_ key source, where missing.
Closes#2362
In libssh2 for what looks like historical reasons, the codepaths for
reading keys are split for reading them from a file or reading them from
a memory buffer. This split is causing many, otherwise identical code to
be duplicated and living their own lives. It also means getting updates
or fixes separately at times, and generally causing duplicate
maintenance and arguably code bloat. The duplication makes its way into
the internal crypto interface (`crypto.h`) and with it, into each
backend, causing further code duplication and subtly or completely
different behavior (and bugs) depending on sourcing the same key from
file or memory buffer.
These effects are undesired both for using and maintaining libssh2.
Loading files via a distinct code may make sense for large files and/or
on devices with constrained memory, but in practice key files are tiny,
expected to remain so, and many (most?) codepaths already preload the
whole file into a memory buffer, and process it as such anyway.
To avoid code duplication and different behavior, this patch aims to
merge these codepaths, in the hostkey and userauth end of the code.
Closes#2354
Stop detecting standard `snprintf()`, and expect it to be available.
Except for the only known platform where it's missing: Visual Studio
2013 and older, where we keep using the existing local implementation.
`snprintf()` was already required to build examples and tests.
Closes#2326
Also:
- sync with canonical `BSD-3-Clause.txt`:
- number the clauses.
- wording in the 3rd clause.
- add 'All rights reserved.' where missing.
- agent: sync with rest of files.
- agent: merge two, identical, embedded headers.
- fix comments nits found nearby.
Closes#2247
Use fixed stack buffer when requested 256 sockets or less. Allocate from
heap otherwise.
There is no other `alloca()` user, so drop detecting it via autotools
(CMake never got support for this). Also re-enable a warning option that
was incompatible with autotools's `AC_FUNC_ALLOCA` code.
This patch may reduce performance when polling 257+ sockets (due to
calloc/free), and comes with higher stack use ('256 * sizeof(struct
pollfd)') than before this patch, when using `poll()` (typically on Unix
platforms except Darwin and Interix).
Note: `libssh2_poll()` is deprecated since v1.2.0 (2009-08-10).
Follow-up to 209d06d6c9Closes#2041
- man pages: grammar
- examples: add missing parentheses to macro values
- examples: replace `write()` with `_write()` on Windows.
(to avoid warnings.)
- examples, tests: drop redundant NULL assigments.
- examples: fix to cleanup on error in ssh2_echo, ssh2_exec.
- libssh2.rpgle.in: make hex notation consistent in comment.
- chacha, session.h: avoid comparison with literal NULL.
- prefer 'unrecognized' vs 'unknown' in error messages.
- mbedtls: sync a code pattern with others in the code in
`ssh2_rsa_new()`.
- openssl: declutter and update comment for wolfSSL `HMAC_Update()`
exception. Also drop FIXME as the upstream incompatibility seems
intentional.
- pem, userauth, wincng: fix, clarify error messages.
- wincng: add explanation for `NOLINT` exception, reword another
comment.
(suggested by Copilot)
- misc: drop redundant parentheses.
- test_read: fix a type mismatch.
- openssl: use indexed syntax for readability.
- vms/man2help: fix tool name is help text.
- formatting: reflow, newlines, spaces, comment typos.
Some of these reported by GitHub Code Quality / Copilot.
Closes#2042
The attributes have an effect on the prototype only, it's not necessary
to set it on function definitions. It may have had a role of which
functions are public, but this is easy to spot by their `libssh2_`
prefixes, esp. after #1961.
Closes#1969
From `_libssh2_*` to `ssh2_*`, `LIBSSH2_*` -> `SSH2_*`. To make the code
easier to read, write, to fit more into the maximum line width without
folding, and to avoid using reserved namespace (`_*`).
Namespacing after this patch:
- `libssh2_`, `LIBSSH2_` (rarely preceded with `_`): public API.
- `ssh2_`, `SSH2_`: private API.
- `ssh2_<crypto-backend>_`: non-static crypto functions.
where `<crypto-backend>` is: lgcr, mbed, ossl, wcng, os400qc3
- local macros and static functions try to be short, descriptive of
their scope, without strict namespacing. They also avoid namespaces
used above for clarity.
Also:
- reflow using clang-format (and manually where necessary.)
- merge split error strings where possible (manually).
- shorten `_libssh2_debug()` to `ssh2_deb()`.
- shorten `_libssh2_error()` to `ssh2_err()`.
- move `libssh2_*` internal symbols to the `ssh2_*` namespace.
- shorten local macro/enum prefixes from `LIBSSH2_` to `SSH2_`.
- mbedtls, wincng: move static functions to the local namespace, where
missing.
- drop stray no-op `ssh2_init_aes_ctr()` symbols (libgcrypt, mbedtls).
- move crypto primitives to crypto-local namespace
`ssh2_(lgcr|mbed|ossl|wcng)_`, where missing.
- normalize crypo-local and crypto-static function namespace to:
`mbed_*`, `ssh2_mbed_,*` `wcng_*`, `ssh2_wcng_*`.
- `LIBSSH2_CIPHER_T()` -> `SSH2_CIPHER_T()`
Follow-up to 689b202320#1923
- rename `ssh2_store_bignum2_bytes()` -> `ssh2_store_bignum_bytes()`.
- drop redundant `void *` cast from `SSH2_UNCONST()` values.
- os400qc3: drop unused static `ssh2_bn_from_bn()`.
- os400qc3: move static `ssh2_bn_resize()` off the ssh2 namespace.
- libssh2.rpgle.in: drop private macros `LIBSSH2_DH_GEX*`.
- rename `ARRAY_SIZE()` to `SSH2_ARRAYSIZE()` for uniqueness.
- agent: drop unused/commented `SSH_AGENTC_*` protocol 1 macros.
- fix stray symbol references found in comments.
- minor whitespace fixes along the way.
Note:
- `ssh2` as a namespace has the minor downside of potential confusion
with SSH protocol 2 (vs 1). In practice I think this is fine.
- `SSH2_` prefix has been used in two places before this patch:
4 `SSH2_AGENT*` macros in `agent.c` and 2 `SSH2_MSG_KEX_ECDH_*` macros
in `libssh2_priv.h`. The latter is coming from
https://datatracker.ietf.org/doc/html/rfc9941. If this ever creates
confusion they can be moved under an `IETF_` namespace for example.
- libssh2_userauth_publickey_sk: the public man page says the callbacks
needs to be using `LIBSSH2_ALLOC()` for allocation and responsible for
freeing. It's an internal macro and should not be mentioned or
necessary in public docs.
Ref: ed439a29bb#698
Follow-up to 8c9b7771ee#1931
Follow-up to 689b202320#1923
Ref: #1949Closes#1961
Checker script and wordlist comes from curl.
Also:
- checksrc.pl: sync up with curl.
- unfold an IETF URL.
- update all IETF URLs where missing.
Closes#1959
Also:
- switch to non-deprecated alternative in examples.
- add pointers and deprecation warning to libssh2_scp_send man page.
Cherry-picked from #1484
- Build scripts must be executed by the os/400 shell (sh), not bash which
is a PASE program: The `-ot` non-POSIX test extension works in os/400 as
well. Ref: https://github.com/libssh2/libssh2/pull/1364#issue-2241646754
- Drop/fixup mods trying to make some syntax highlighters happier.
Follow-up to c6625707b9#1358
Assisted-by: Patrick Monnerat
Closes#1364Closes#1366
- use `$()` instead of backticks, and re-arrange double-quotes inside.
- add missing `|| exit 1` to `cd` calls. (could be dropped by using `set -eu`.)
- add `-n` to a few `if`s.
- shorten redirections by using `{} >` (as shellcheck recommended).
- silence warnings where variables were detected as unused (SC2034).
- a couple misc updates to silence warnings.
- switch to bash shebang for `-ot` feature.
- split two lines to unbreak syntax highlighting in my editor. (`$(expr \`, `$(dirname \`)
Also enable CI checks for OS/400 shell scripts.
Ref: d88b9bcdafCloses#1358
- Handle MD5 conditionals in os400qc3.
- Check for errors in os400qc3 pbkdf1.
- Implement an optional build options override file.
- Sync ILE/RPG copy files with current C header files.
- Allow a null session within a string conversion cache.
- Add an ILE/RPG example.
- Adjust outdated copyrights in changed files.
- os400: delete unused `HAVE_STDINT_H`.
- fuzz: delete redundant `stdint.h` use.
`inttypes.h` is already included via `testinput.h`.
- docs/TODO: adjust type in planned function.
Closes#1212
- All files have prominent copyright and SPDX identifier
- If not embedded in the file, in the .reuse/dep5 file
- All used licenses are in LICENSES/ (not shipped in tarballs)
- A new REUSE CI job verify that all files are OK
Assisted-by: Viktor Szakats
Closes#1084
Also:
- uppercase `(C)`.
- add missing 'All rights reserved.' lines.
- drop duplicate 'Author' lines.
- add copyright headers where missing.
- enable copyright header check in checksrc.
Reasons for deleting years (copied as-is from curl):
- they are mostly pointless in all major jurisdictions
- many big corporations and projects already don't use them
- saves us from pointless churn
- git keeps history for us
- the year range is kept in COPYING
Closes#1082
Unless I'm missing something, it looks like `libssh2.h` has been using
`libssh2_int64_t` unconditionally since at least 2010-04-17 when
`libssh2_scp_send64()` landed via commit
be9ee7095e.
This makes it redundant to detect `HAVE_LONGLONG` to fallback to a
32-bit `scpRecv_size` in `libssh2_priv.h`. Then deal with possible
combinations of this flag and `strtoll()` options, which was
error-prone.
Instead, assume in `libssh2_priv.h` that we have `libssh2_int64_t`, and
use it always.
For MSVC, this means `_MSC_VER` `1310` (from year 2003) is now
required. Based on the above, this was already so before this patch.
If there happens to be no 64-bit `strtoll()` detected, fall back to the
32-bit `strtol()` (this should never happen with MSVC, and probably
neither with any other reasonably modern toolchain.)
Also make sure to set `HAVE_STRTOI64` for older, non-CMake, MSVC builds
(e.g. `Makefile.mk` or `NMakefile` ones).
Closes#1002
- fix indentation errors.
- reformat `cmake/FindmbedTLS.cmake`
- replace a macro with a variable in `example/sftp_RW_nonblock.c`.
- delete macOS macro `_DARWIN_USE_64_BIT_INODE` from the
OS/400 config header, `os400/libssh2_config.h`.
- fix other minor nits.
Closes#983
Drop checks from Windows builds and enable it based on `WIN32`.
This saves detection time and also makes 3rd party builds simpler.
Also:
- delete `HAVE_DISABLED_NONBLOCKING`, that we used in build tools to
explicitly disable an explicit `#error` in `session.c`.
- replace existing `WSAEWOULDBLOCK` check for Windows support with
`WIN32`. Cleaner with the same result.
Follow-up to f1e80d8d8c
Follow-up to 5644eea216Closes#980
* os400: support QADRT development files in a non-standard directory
This enables the possibility to compile libssh2 even if the ascii
runtime development files are not installed system-wide.
* userauth_kbd_packet: fix a pointer target type mismatch.
A temporary variable matching the parameter type is used before copying
to the real target and checking for overflow (that should not occur!).
* os400qc3: move and fix big number procedures
A bug added by a previous code style cleaning is fixed.
_libssh2_random() now checks and return the success status.
* os400qc3: fix cipher definition block lengths
They were wrongly set to the key size.
* Diffie-Hellman min/max modulus sizes are dependent of crypto-backend
In particular, os400qc3 limits the maximum group size to 2048-bits.
Move definitions of these parameters to crypto backend header files.
* kex: return an error if Diffie-Hellman key pair generation fails
* os400: add an ascii assert.h header file
* os400qc3: implement RSA SHA2 256/512
- introduce `src/crypto.c` as an umbrella source that does nothing else
than include the selected crypto backend source. Moving this job from
the built-tool to the C preprocessor.
- this allows dropping the various techniques to pick the correct crypto
backend sources in autotools, CMake and other build method. Including
the per-backend `Makefile.<crypto-backend>.inc` makefiles.
- copy a trick from curl and instead of maintaining duplicate source
lists for CMake, convert the GNU Makefile kept for autotools
automatically. Do this in `docs`, `examples` and `src`.
Ref: dfabe8bca2/CMakeLists.txt (L1399-L1413)
Also fixes missing `libssh2_setup.h` from `src/CMakeFiles.txt` after
59666e03f0.
- move `Makefile.inc` from root to `src`.
- reformat `src/Makefile.inc` to list each source in separate lines,
re-align the continuation character and sort the lists alphabetically.
- update `docs/HACKING-CRYPTO` accordingly.
- autotools: update the way we add crypto-backends to `LIBS`.
- delete old CSV headers, indent, and merge two lines in
`docs/Makefile.am` and `src/Makefile.am`.
- add `libssh2.pc` to `.gitignore`, while there.
Closes#941
libssh2 uses `wincrypt.h` aka the `crypt32` Windows system library
for the function `CryptDecodeObjectEx()` [1]. This function has been
available for Win32 (and UWP/WinRT apps) for a long while. Even old
MinGW supports it, and also Watcom 1.9, of the rare/old compilers
I checked.
CMake had it permanently enabled, while it also did an extra check
for the header to add the lib to the lib list. Autotools did the
detection proper. Other builds had it permanently enabled.
It seems safe to assume this function/header/lib is available in all
environments we support.
In this patch we simplify by deleting these detections and feature
flags from all build tools.
Keep the feature flag internal to `wincng.h`, and for extra safety add
the new macro `LIBSSH2_WINCNG_DISABLE_WINCRYPT` do disable it via
custom `CPPFLAGS`.
WinCNG's other requirement is `bcrypt`. That also has been universally
available for a long time. Here the only known outlier is old/legacy
MinGW, which is missing support.
[1] https://learn.microsoft.com/en-us/windows/win32/api/wincrypt/nf-wincrypt-cryptdecodeobjectexCloses#916
`libssh2.h` required `winsock2.h` for `_WIN32` since
81d53de4dc (2011-06-04).
Apply that to the whole codebase. This makes it unnecessary to detect
`HAVE_WINSOCK2_H` and allows to drop all its uses.
Completes TODO from b66d7317ca
TODO: Straighten out the use a mixture of `HAVE_WINDOWS_H`,
`WIN32`, `_WIN32` to detect Windows.
It was used once in `src/libssh2_priv.h`, but without any effect.
The header included `ws2tcpip.h` twice, once guarded by
`HAVE_WS2TCPIP_H` and another time by `HAVE_WINSOCK2_H`.
Dedupe these to not use `HAVE_WS2TCPIP_H`. Then delete detection
of this feature from all build methods.
TODO: Replace `HAVE_WINSOCK2_H` with `_WIN32`/`WIN32`.
Null-cipher and null-MAC are security footguns we want to avoid.
Existing option names to toggle these were ambiguous and gave room for
misinterpretation. Some projects may have had these options enabled by
accident.
This patch aims to make it more difficult to enable them, and making
sure that existing methods require an update to stay enabled.
- delete CMake/autotools settings to enable the "none" cipher and MAC.
- rename existing C macros that can enable them.
To use them, pass them as custom `CPPFLAGS` to the build.
- enable them only if `LIBSSH2DEBUG` is also enabled.
Best would be to delete them, though they may have some use while
developing libssh2 itself, or debugging.
libssh2 supports an "old" style KEX message
`SSH2_MSG_KEX_DH_GEX_REQUEST_OLD`, as an off-by-default build option.
OpenSSH deprecated/disabled this feature in v6.9 (2015-07-01):
https://www.openssh.com/releasenotes.html#6.9
This patch deletes this obsolete feature from libssh2, with no option
to enable it.
Added to libssh2 in: cf8ca63ea0 (2004-12-31)
RFC: https://datatracker.ietf.org/doc/html/rfc4419 (2006-03)
libssh2 built with OpenSSL and without its `EVP_aes_128_ctr()`, aka
`HAVE_EVP_AES_128_CTR`, option are working incorrectly. This option
wasn't always auto-detected by autotools up until recently (#811).
Non-cmake, non-autotools build methods never enabled it automatically.
OpenSSL supports this options since at least v1.0.2, which is already
EOLed and considered obsolete. OpenSSL forks (LibreSSL, BoringSSL)
supported it all along.
In this patch we enable this option unconditionally, now requiring
OpenSSL supporting this function, or one of its forks.
Also modernize OpenSSL lib references to what 1.0.2 and newer versions
have been using.
Fixes#739
