Also:
- RELEASE-NOTES: announce removal after next release.
- allow build-time macro to enable in the meantime.
- skip in tests if disabled.
- keep testing in CI with other legacy options.
- workaround oss-fuzzer hang and timeout after 10 minutes by keeping
SHA1-based MACs enabled in the fuzzer build.
Ref: https://github.com/libssh2/libssh2/pull/2444#issuecomment-5110853610
Follow-up to 99f935358d#2443Closes#2444
Low-level logic copied from curl, and adapted to libssh2.
Also: use secure fopen CRT functions.
Credits-to: Jay Satiro
Credits-to: Viktor Szakats
Closes#2318
- pass `--` before passing input files.
- scripts/maketgz: robustify `rm` invocations.
- prefer `$(pwd)` or `$PWD`.
- tests/cmake/test.sh: dump configs to CI log.
- tests/gen_keys.sh: fix to skip DSA if missing.
- replace openssl with `base` and `*sum` tools.
- tests/ossfuzz/ossfuzz.sh: fix to add a space before `-j`.
Closes#2265
Checker script and wordlist comes from curl.
Also:
- checksrc.pl: sync up with curl.
- unfold an IETF URL.
- update all IETF URLs where missing.
Closes#1959
- apply manually selected clang-format fixes.
- apply manual formatting fixes.
- move return type inline with the declaration.
(for private APIs)
- os400qc3: fix missed `_libssh2_dh_ctx` -> `libssh2_dh_ctx`.
Follow-up to 689b202320#1923
- os400qc3: drop redundant line-continuation backslashes.
- delete copy of function name from function top comments.
- move literal to right hand side in a couple of comparisons.
- drop redundant `extern` keywords.
Follow-up to 6ffb96321c#1935Closes#1936
Require CMake 3.18 (2020-07-15) or newer, up from 3.7 (2016-11-11) prior
to this patch.
This requirement also applies to the distributed `libssh2-config.cmake`.
To allow dropping compatibility code maintained for old versions, and to
use features which were unpractical in separate code paths. Also to make
testing, documentation and development easier, and builds faster due
CMake performance improvements over time.
CMake offers pre-built binaries for major platforms. They work without
an install step, just by unpacking and pointing the cmake command to
them. Making upgrades easy in many cases:
https://cmake.org/download/https://cmake.org/files/https://github.com/Kitware/CMake/releases
CMake 3.18 brings these feature as generally available when building or
consuming curl/libcurl:
LTO support, improved performance, `pkg-config` and interface target
support, `OBJECT` target (for faster libcurl builds), modern invocation
with `-S`/`-B` options, better support for custom linker options,
FetchContent, `--verbose` and `--install` options, `CMAKE_GENERATOR`
env, last but not least unity mode and Ninja generator.
Ref: https://github.com/curl/curl/discussions/18704Closes#1839
## Summary
Replace `assert()` with `goto EXIT_LABEL` in the `FUZZ_ASSERT` macro in
`ssh2_client_fuzzer.cc`.
### Problem
When `socketpair()` fails (e.g., due to file descriptor exhaustion
during long fuzzing runs), `FUZZ_ASSERT(rc == 0)` calls `assert()`,
which aborts the entire fuzzer process. LibFuzzer expects harnesses to
handle errors gracefully by returning 0 — aborting terminates the
fuzzing campaign.
The rest of the fuzzer already uses `goto EXIT_LABEL` for error handling
(lines 38, 53, 59, 69, 73), so the `assert()` in `FUZZ_ASSERT` is
inconsistent with the existing pattern.
### Fix
Change `assert((COND))` to `goto EXIT_LABEL` in the `FUZZ_ASSERT` macro,
making it consistent with all other error paths in the fuzzer.
## Coverage comparison (60 seconds, empty seed corpus, ASan, libFuzzer)
| Metric | Original | Fixed | Change |
|--------|----------|-------|--------|
| Edge coverage | 320 | 373 | +16.56% (+53 edges) |
| Feature coverage | 696 | 778 | +11.78% (+82 features) |
Note: The coverage improvement may be due to fuzzer randomness rather
than the fix itself, but it confirms the fix does not regress coverage.
Credit:
Ze Sheng
Also:
- rename a spellcheck file to match curl.
- editorconfig: fix line width.
- editorconfig: make it use UTF-8.
- editroconfig: apply some rules to all files.
- .gitignore: drop dupe, drop `.DS_Store` (not created by this repo),
sort.
- .gitignore: add for tests executables.
Closes#1718
- cmake: add support to build ossfuzz.
Enable with `-DBUILD_OSSFUZZ=ON`.
Also supports `-DLIB_FUZZING_ENGINE=` like autotools does.
- check for `__clang__` when suppressing warnings in source. Necessary
for clang-cl, which set `__clang__`, but doesn't set `__GNU__`.
- cmake: optimize out 4 picky warning option detections with gcc.
- cmake: bring `-pedantic-error`, `-Wall` use closer to curl's.
- cmake: set `-Wno-language-extension-token` for clang-cl.
- cmake: escape only the necessary `-W` options for clang-cl.
- cmake: apply picky warnings to C++.
- cmake: replace `unset(VAR)` with `set(VAR "")` for init.
- cmake: prefer dash-style MSVC options.
- cmake: simplify `MATCHES` expression.
- cmake: formatting/whitespace.
- ci/GHA: bump `actions/upload-artifact` to v4
Closes#1524
- os400: delete unused `HAVE_STDINT_H`.
- fuzz: delete redundant `stdint.h` use.
`inttypes.h` is already included via `testinput.h`.
- docs/TODO: adjust type in planned function.
Closes#1212
- fix skip auth if `userauthlist` is NULL.
Closes#836 (Reported-by: @sudipm-mukherjee on github)
- fix most silenced `checksrc` warnings.
- sync examples/tests code between each other.
(output messages, error handling, declaration order, comments)
- stop including unnecessary headers.
- always deinitialize in case of error.
- drop some redundant variables.
- add error handling where missing.
- show more error codes.
- switch `perror()` to `fprintf()`.
- fix some `printf()`s to be `fprintf()`.
- formatting.
Closes#960
- fix shellcheck warnings:
- use quotes
- use `$()`
- use `printf` (instead of calling perl).
- indent.
- copy/adapt header comment from curl to `maketgz`.
Many files have been added to the cmake build files but not the automake
ones in recent years. Missing ones have been added so automake "make
dist" will now create a usable tar ball.
The integration tests using Docker are now built with automake as well
(with "make check"). They are not run yet since they aren't working yet
on Linux.
file: ssh_client_fuzzer.cc
notes: the session needs blocking mode turned on to avoid EAGAIN being returned from libssh2_session_handshake()
credit:
Will Cosgrove, reviewed by Michael Buckley
Files:
.travis.yml, configure.ac, ossfuzz
Notes:
This adds support for an OSS-Fuzz fuzzing target in ssh2_client_fuzzer,
which is a cut down example of ssh2.c. Future enhancements can improve
coverage.
Credit:
Max Dymond
