Version 1.8.0 (25 Oct 2016)
Daniel Stenberg (25 Oct 2016)
- RELEASE-NOTES: adjusted for 1.8.0
Kamil Dudka (20 Oct 2016)
- Revert "aes: the init function fails when OpenSSL has AES support"
This partially reverts commit f4f2298ef3635acd031cc2ee0e71026cdcda5864
because it caused the compatibility code to call initialization routines
redundantly, leading to memory leakage with OpenSSL 1.1 and broken curl
test-suite in Fedora:
88 bytes in 1 blocks are definitely lost in loss record 5 of 8
at 0x4C2DB8D: malloc (vg_replace_malloc.c:299)
by 0x72C607D: CRYPTO_zalloc (mem.c:100)
by 0x72A2480: EVP_CIPHER_meth_new (cmeth_lib.c:18)
by 0x4E5A550: make_ctr_evp.isra.0 (openssl.c:407)
by 0x4E5A8E8: _libssh2_init_aes_ctr (openssl.c:471)
by 0x4E5BB5A: libssh2_init (global.c:49)
Daniel Stenberg (19 Oct 2016)
- [Charles Collicutt brought this change]
libssh2_wait_socket: Fix comparison with api_timeout to use milliseconds (#134)
Fixes#74
- [Charles Collicutt brought this change]
Set err_msg on _libssh2_wait_socket errors (#135)
- Revert "travis: Test mbedtls too"
This reverts commit 3e6de50a24815e72ec5597947f1831f6083b7da8.
Travis doesn't seem to support the mbedtls-dev package
- maketgz: support "only" to only update version number locally
and fix the date output locale
- configure: make the --with-* options override the OpenSSL default
... previously it would default to OpenSSL even with the --with-[crypto]
options used unless you specificly disabled OpenSSL. Now, enabling another
backend will automatically disable OpenSSL if the other one is found.
- [Keno Fischer brought this change]
docs: Add documentation on new cmake/configure options
- [Keno Fischer brought this change]
configure: Add support for building with mbedtls
- [wildart brought this change]
travis: Test mbedtls too
- [wildart brought this change]
crypto: add support for the mbedTLS backend
Closes#132
- [wildart brought this change]
cmake: Add CLEAR_MEMORY option, analogously to that for autoconf
- README.md: fix link typo
- README: markdown version to look nicer on github
Viktor Szakats (5 Sep 2016)
- [Taylor Holberton brought this change]
openssl: add OpenSSL 1.1.0 compatibility
Daniel Stenberg (4 Sep 2016)
- [Antenore Gatta brought this change]
tests: HAVE_NETINET_IN_H was not defined correctly (#127)
Fixes#125
- SECURITY: fix web site typo
- SECURITY: security process
GitHub (14 Aug 2016)
- [Alexander Lamaison brought this change]
Basic dockerised test suite.
This introduces a test suite for libssh2. It runs OpenSSH in a Docker
container because that works well on Windows (via docker-machine) as
well as Linux. Presumably it works on Mac too with docker-machine, but
I've not tested that.
Because the test suite is docker-machine aware, you can also run it
against a cloud provider, for more realistic network testing, by setting
your cloud provider as your active docker machine. The Appveyor CI setup
in this commit does that because Appveyor doesn't support docker
locally.
Kamil Dudka (3 Aug 2016)
- [Viktor Szakats brought this change]
misc.c: Delete unused static variables
Closes#114
Daniel Stenberg (9 Apr 2016)
- [Will Cosgrove brought this change]
Merge pull request #103 from willco007/patch-2
Fix for security issue CVE-2016-0787
Alexander Lamaison (2 Apr 2016)
- [Zenju brought this change]
Fix MSVC 14 compilation errors
For _MSC_VER == 1900 these macros are not needed and create problems:
1>C:\Program Files (x86)\Windows Kits\10\Include\10.0.10240.0\ucrt\stdio.h(1925): warning C4005: 'snprintf': macro redefinition (compiling source file libssh2-files\src\mac.c)
1> \win32\libssh2_config.h(27): note: see previous definition of 'snprintf' (compiling source file libssh2-files\src\mac.c)
1>C:\Program Files (x86)\Windows Kits\10\Include\10.0.10240.0\ucrt\stdio.h(1927): fatal error C1189: #error: Macro definition of snprintf conflicts with Standard Library function declaration (compiling source file libssh2-files\src\mac.c)
Daniel Stenberg (26 Mar 2016)
- [Brad Harder brought this change]
_libssh2_channel_open: speeling error fixed in channel error message
Alexander Lamaison (15 Mar 2016)
- Link with crypt32.lib on Windows.
Makes linking with static OpenSSL work again. Although it's not
required for dynamic OpenSSL, it does no harm.
Fixes#98.
- [Craig A. Berry brought this change]
Tweak VMS help file building.
Primarily this is handling cases where top-level files moved into
the docs/ directory. I also corrected a typo and removed the
claim that libssh2 is public domain.
- [Craig A. Berry brought this change]
Build with standard stat structure on VMS.
This gets us large file support, is available on any VMS release
in the last decade and more, and gives stat other modern features
such as 64-bit ino_t.
- [Craig A. Berry brought this change]
Update vms/libssh2_config.h.
VMS does have stdlib.h, gettimeofday(), and OpenSSL. The latter
is appropriate to hard-wire in the configuration because it's
installed by default as part of the base operating system and
there is currently no libgcrypt port.
- [Craig A. Berry brought this change]
VMS can't use %zd for off_t format.
%z is a C99-ism that VMS doesn't currently have; even though the
compiler is C99-compliant, the library isn't quite. The off_t used
for the st_size element of the stat can be 32-bit or 64-bit, so
detect what we've got and pick a format accordingly.
- [Craig A. Berry brought this change]
Normalize line endings in libssh2_sftp_get_channel.3.
Somehow it got Windows-style CRLF endings so convert to just LF,
for consistency as well as not to confuse tools that will regard
the \r as content (e.g. the OpenVMS help librarian).
Dan Fandrich (29 Feb 2016)
- libgcrypt: Fixed a NULL pointer dereference on OOM
Daniel Stenberg (24 Feb 2016)
- [Viktor Szakats brought this change]
url updates, HTTP => HTTPS
Closes#87
Dan Fandrich (23 Feb 2016)
- RELEASE-NOTES: removed some duplicated names
Changes:
libssh2_session_set_last_error: Add function
mac: Add support for HMAC-SHA-256 and HMAC-SHA-512
WinCNG: support for SHA256/512 HMAC
kex: Added diffie-hellman-group-exchange-sha256 support
OS/400 crypto library QC3 support
Bug fixes:
diffie_hellman_sha256: convert bytes to bits CVE-2016-0787
SFTP: Increase speed and datasize in SFTP read
openssl: make libssh2_sha1 return error code
openssl: fix memleak in _libssh2_dsa_sha1_verify()
cmake: include CMake files in the release tarballs
Fix builds with Visual Studio 2015
hostkey.c: Fix compiling error when OPENSSL_NO_MD5 is defined
GNUmakefile: add support for LIBSSH2_LDFLAG_EXTRAS
GNUmakefile: add -m64 CFLAGS when targeting mingw64
kex: free server host key before allocating it (again)
SCP: add libssh2_scp_recv2 to support large (> 2GB) files on windows
channel: Detect bad usage of libssh2_channel_process_startup
userauth: Fix off by one error when reading public key file
kex: removed dupe entry from libssh2_kex_methods
_libssh2_error: Support allocating the error message
hostkey: fix invalid memory access if libssh2_dsa_new fails
hostkey: align code path of ssh_rsa_init to ssh_dss_init
libssh2.pc.in: fix the output of pkg-config --libs
wincng: fixed possible memory leak in _libssh2_wincng_hash
wincng: fixed _libssh2_wincng_hash_final return value
add OpenSSL 1.1.0-pre2 compatibility
agent_disconnect_unix: unset the agent fd after closing it
sftp: stop reading when buffer is full
sftp: Send at least one read request before reading
sftp: Don't return EAGAIN if data was written to buffer
sftp: Check read packet file offset
configure: build "silent" if possible
openssl: add OpenSSL 1.1.0-pre3-dev compatibility
GNUmakefile: list system libs after user libs
Problems found locating distfiles:
Package f-prot-antivirus6-fs-bin: missing distfile fp-NetBSD.x86.32-fs-6.2.3.tar.gz
Package f-prot-antivirus6-ws-bin: missing distfile fp-NetBSD.x86.32-ws-6.2.3.tar.gz
Package libidea: missing distfile libidea-0.8.2b.tar.gz
Package openssh: missing distfile openssh-7.1p1-hpn-20150822.diff.bz2
Package uvscan: missing distfile vlp4510e.tar.Z
Otherwise, existing SHA1 digests verified and found to be the same on
the machine holding the existing distfiles (morden). All existing
SHA1 digests retained for now as an audit trail.
Changelog:
Changes:
Added libssh2_userauth_publickey_frommemory()
Bug fixes:
wait_socket: wrong use of difftime()
userauth: Fixed prompt text no longer being copied to the prompts struct
mingw build: allow to pass custom CFLAGS
Let mansyntax.sh work regardless of where it is called from
Init HMAC_CTX before using it
direct_tcpip: Fixed channel write
WinCNG: fixed backend breakage
OpenSSL: caused by introducing libssh2_hmac_ctx_init
userauth.c: fix possible dereferences of a null pointer
wincng: Added explicit clear memory feature to WinCNG backend
openssl.c: fix possible segfault in case EVP_DigestInit fails
wincng: fix return code of libssh2_md5_init()
kex: do not ignore failure of libssh2_sha1_init()
scp: fix that scp_send may transmit not initialised memory
scp.c: improved command length calculation
nonblocking examples: fix warning about unused tvdiff on Mac OS X
configure: make clear-memory default but WARN if backend unsupported
OpenSSL: Enable use of OpenSSL that doesn't have DSA
OpenSSL: Use correct no-blowfish #define
kex: fix libgcrypt memory leaks of bignum
libssh2_channel_open: more detailed error message
wincng: fixed memleak in (block) cipher destructor
http://www.libssh2.org/adv_20150311.html
Set LICENSE.
Changelog:
This release includes the following changes:
o Added Windows Cryptography API: Next Generation based backend
This release includes the following bugfixes:
o Security Advisory for CVE-2015-1782, using SSH_MSG_KEXINIT data unbounded
o missing _libssh2_error in _libssh2_channel_write
o knownhost: Fix DSS keys being detected as unknown.
o knownhost: Restore behaviour of `libssh2_knownhost_writeline` with short buffer.
o libssh2.h: on Windows, a socket is of type SOCKET, not int
o libssh2_priv.h: a 1 bit bit-field should be unsigned
o windows build: do not export externals from static library
o Fixed two potential use-after-frees of the payload buffer
o Fixed a few memory leaks in error paths
o userauth: Fixed an attempt to free from stack on error
o agent_list_identities: Fixed memory leak on OOM
o knownhosts: Abort if the hosts buffer is too small
o sftp_close_handle: ensure the handle is always closed
o channel_close: Close the channel even in the case of errors
o docs: added missing libssh2_session_handshake.3 file
o docs: fixed a bunch of typos
o userauth_password: pass on the underlying error code
o _libssh2_channel_forward_cancel: accessed struct after free
o _libssh2_packet_add: avoid using uninitialized memory
o _libssh2_channel_forward_cancel: avoid memory leaks on error
o _libssh2_channel_write: client spins on write when window full
o windows build: fix build errors
o publickey_packet_receive: avoid junk in returned pointers
o channel_receive_window_adjust: store windows size always
o userauth_hostbased_fromfile: zero assign to avoid uninitialized use
o configure: change LIBS not LDFLAGS when checking for libs
o agent_connect_unix: make sure there's a trailing zero
o MinGW build: Fixed redefine warnings.
o sftpdir.c: added authentication method detection.
o Watcom build: added support for WinCNG build.
o configure.ac: replace AM_CONFIG_HEADER with AC_CONFIG_HEADERS
o sftp_statvfs: fix for servers not supporting statfvs extension
o knownhost.c: use LIBSSH2_FREE macro instead of free
o Fixed compilation using mingw-w64
o knownhost.c: fixed that 'key_type_len' may be used uninitialized
o configure: Display individual crypto backends on separate lines
o examples on Windows: check for WSAStartup return code
o examples on Windows: check for socket return code
o agent.c: check return code of MapViewOfFile
o kex.c: fix possible NULL pointer de-reference with session->kex
o packet.c: fix possible NULL pointer de-reference within listen_state
o tests on Windows: check for WSAStartup return code
o userauth.c: improve readability and clarity of for-loops
o examples on Windows: use native SOCKET-type instead of int
o packet.c: i < 256 was always true and i would overflow to 0
o kex.c: make sure mlist is not set to NULL
o session.c: check return value of session_nonblock in debug mode
o session.c: check return value of session_nonblock during startup
o userauth.c: make sure that sp_len is positive and avoid overflows
o knownhost.c: fix use of uninitialized argument variable wrote
o openssl: initialise the digest context before calling EVP_DigestInit()
o libssh2_agent_init: init ->fd to LIBSSH2_INVALID_SOCKET
o configure.ac: Add zlib to Requires.private in libssh2.pc if using zlib
o configure.ac: Rework crypto library detection
o configure.ac: Reorder --with-* options in --help output
o configure.ac: Call zlib zlib and not libz in text but keep option names
o Fix non-autotools builds: Always define the LIBSSH2_OPENSSL CPP macro
o sftp: seek: Don't flush buffers on same offset
o sftp: statvfs: Along error path, reset the correct 'state' variable.
o sftp: Add support for fsync (OpenSSH extension).
o _libssh2_channel_read: fix data drop when out of window
o comp_method_zlib_decomp: Improve buffer growing algorithm
o _libssh2_channel_read: Honour window_size_initial
o window_size: redid window handling for flow control reasons
o knownhosts: handle unknown key types
Changelog:
Version 1.4.3 - November 27 2012
libssh2 1.4.3 GPG sig (685712 bytes)
Changes:
compression: add support for zlib@openssh.com
Bug fixes:
sftp_read: return error if a too large package arrives
libssh2_hostkey_hash.3: update the description of return value
Fixed MSVC NMakefile
examples: use stderr for messages, stdout for data
openssl: do not leak memory when handling errors
improved handling of disabled MD5 algorithm in OpenSSL
known_hosts: Fail when parsing unknown keys in known_hosts file
configure: gcrypt doesn't come with pkg-config support
session_free: wrong variable used for keeping state
libssh2_userauth_publickey_fromfile_ex.3: mention publickey == NULL
comp_method_zlib_decomp: handle Z_BUF_ERROR when inflating
Version 1.4.2 - May 18 2012
libssh2 1.4.2 GPG sig (679992 bytes)
Bug fixes:
Return LIBSSH2_ERROR_SOCKET_DISCONNECT on EOF when reading banner
userauth.c: fread() from public key file to correctly detect any
errors
configure.ac: Add option to disable build of the example
applications
Added 'Requires.private:' line to libssh2.pc
SFTP: filter off incoming "zombie" responses
gettimeofday: no need for a replacement under cygwin
SSH_MSG_CHANNEL_REQUEST: default to want_reply
win32/libssh2_config.h: Remove hardcoded #define LIBSSH2_HAVE_ZLIB
Version 1.4.1 - April 4 2012
libssh2 1.4.1 GPG sig (658507 bytes)
Bug fixes:
build error with gcrypt backend
always do "forced" window updates to avoid corner case stalls
aes: the init function fails when OpenSSL has AES support
transport_send: Finish in-progress key exchange before sending data
channel_write: acknowledge transport errors
examples/x11.c: Make sure sizeof passed to read operation is correct
examples/x11.c:,Fix suspicious sizeof usage
sftp_packet_add: verify the packet before accepting it
SFTP: preserve the original error code more
sftp_packet_read: adjust window size as necessary
Use safer snprintf rather then sprintf in several places
Define and use LIBSSH2_INVALID_SOCKET instead of INVALID_SOCKET
sftp_write: cannot return acked data *and* EAGAIN
sftp_read: avoid data *and* EAGAIN
libssh2.h: Add missing prototype for libssh2_session_banner_set()
Version 1.4.0 - January 31 2012
libssh2 1.4.0 GPG sig (653514 bytes)
Changes:
Added libssh2_session_supported_algs()
Added libssh2_session_banner_get()
Added libssh2_sftp_get_channel()
libssh2.h: bump the default window size to 256K
Bug fixes:
sftp-seek: clear EOF flag
userauth: Provide more informations if ssh pub key extraction fails
ssh2_exec: skip error outputs for EAGAIN
LIBSSH2_SFTP_PACKET_MAXLEN: increase to 80000
knownhost_check(): Don't dereference ext if NULL is passed
knownhost_add: Avoid dereferencing uninitialized memory on error
path
OpenSSL EVP: fix threaded use of structs
_libssh2_channel_read: react on errors from receive_window_adjust
sftp_read: cap the read ahead maximum amount
_libssh2_channel_read: fix non-blocking window adjusting
Version 1.3.0 - September 6 2011
libssh2 1.3.0 GPG sig (639262 bytes)
Changes:
Added custom callbacks for performing low level socket I/O
Bug fixes:
sftp_read: advance offset correctly for buffered copies
libssh2_sftp_seek64: flush packetlist and buffered data
_libssh2_packet_add: adjust window size when truncating
sftp_read: a short read is not end of file
Version 1.2.9 - August 16 2011
libssh2 1.2.9 GPG sig (642150 bytes)
Changes:
Added libssh2_session_set_timeout() and
libssh2_session_get_timeout() to make blocking calls get a timeout
Bug fixes:
configure and pkg-config: fix $VERSION
s/\.NF/.nf/ to fix wrong macro name caught by man --warnings
keepalive: add first basic man pages
sftp_write: flush the packetlist on error
sftp_write: clean offsets on error
msvcproj: added libs and debug stuff
SCP: fix incorrect error code
session_startup: init state properly
sftp_write_sliding: send the complete file
userauth_keyboard_interactive: skip code on zero length auth
_libssh2_wait_socket: fix timeouts for poll() uses
agent_list_identities: fix out of scope access
_libssh2_recv(): handle ENOENT error as EAGAIN
userauth_keyboard_interactive: fix buffer overflow
removed man pages for non-existing functions!
gettimeofday: fix name space pollution
_libssh2_channel_write: handle window_size == 0 better
Version 1.2.8 - April 5 2011
libssh2 1.2.8 GPG sig (637707 bytes)
Changes:
added libssh2_free, libssh2_channel_get_exit_signal and
libssh2_session_handshake
SFTP read/write remade and now MUCH faster, especially on high
latency connections
added new examples: ssh2_echo.c, sftp_append.c and
sftp_write_sliding.c
userauth: derive publickey from private
NEWS: now generated from git
Bug fixes:
Support unlimited number of host names in a single line of the
known_hosts file.
fix memory leak in userauth_keyboard_interactive()
fix memory leaks (two times cipher_data) for each sftp session
session_startup: manage server data before server identification
SCP: allow file names with bytes > 126
scp_recv: improved treatment of channel_read() returning zero
libssh2_userauth_authenticated: make it work as documented
variable size cleanup: match internal variable sizes better with the
sizes of the fields used on the wire
channel_request_pty_size: fix reqPTY_state
sftp_symlink: return error if receive buffer too small
sftp_readdir: return error if buffer is too small
libssh2_knownhost_readfile.3: clarify return value
configure: stop using the deprecated AM_INIT_AUTOMAKE syntax
Fixed Win32 makefile which was now broken at resource build
kex_agree_hostkey: fix NULL pointer derefence
_libssh2_ntohu64: fix conversion from network bytes to uint64
ssize_t: proper typedef with MSVC compilers
zlib: Add debug tracing of zlib errors
decomp: increase decompression buffer sizes
Version 1.2.7 - August 17 2010
libssh2 1.2.7 GPG sig (583105 bytes)
Changes:
Added Watcom makefile
Bug fixes:
Better handling of invalid key files
inputchecks: make lots of API functions check for NULL pointers
libssh2_session_callback_set: extended the man page
SFTP: limit write() to not produce overly large packets
agent: make libssh2_agent_userauth() work blocking properly
_libssh2_userauth_publickey: reject method names longer than the
data
channel_free: ignore problems with channel_close()
typedef: make ssize_t get typedef without LIBSSH2_WIN32
_libssh2_wait_socket: poll needs milliseconds
libssh2_wait_socket: reset error code to "leak" EAGAIN less
Added include for sys/select.h to get fd.set on some platforms
session_free: free more data to avoid memory leaks
openssl: make use of the EVP interface
Fix underscore typo for 64-bit printf format specifiers on Windows
Make libssh2_debug() create a correctly terminated string
userauth_hostbased_fromfile: packet length too short
handshake: Compression enabled at the wrong time
Don't overflow MD5 server hostkey
Version 1.2.6 - June 10 2010
libssh2 1.2.6 GPG sig (579590 bytes)
Changes:
Added libssh2_sftp_statvfs() and libssh2_sftp_fstatvfs()
Added libssh2_knownhost_checkp()
Added libssh2_scp_send64()
Bug fixes:
wait_socket: make c89 compliant and use two fd_sets for select()
OpenSSL AES-128-CTR detection
proper keyboard-interactive user dialog in the sftp.c example
build procedure for VMS
fixed libssh2.dsw to use the generated libssh2.dsp
several Windows-related build fixes
fail to init SFTP if session isn't already authenticated
many tiny fixes that address clang-analyzer warnings
sftp_open: deal with short channel_write calls
libssh2_publickey_init: fixed to work better non-blocking
sftp_close_handle: add precation to not access NULL pointer
sftp_readdir: simplified and bugfixed
channel_write: if data has been sent, don't return EAGAIN
Version 1.2.5 - April 13 2010
libssh2 1.2.5 GPG sig (559553 bytes)
Changes:
Added Add keep-alive support: libssh2_keepalive_config() and
libssh2_keepalive_send()
Added libssh2_knownhost_addc(), libssh2_init() and libssh2_exit()
Added LIBSSH2_SFTP_S_IS***() macros
Bug fixes:
fix memory leak in libssh2_session_startup()
added missing error codes - shown as hangs in blocking mode
fix memory leak in userauth_keyboard_interactive()
libssh2_knownhost_del: fix write to freed memory
Send and receive channel EOF before sending SSH_MSG_CHANNEL_CLOSE
Use AES-CTR from OpenSSL when available
Fixed gettimeofday to compile with Visual C++ 6
NULL dereference when window adjusting a non-existing channel
avoid using poll on interix and mac os x systems
fix scp memory leak
Correctly clear blocking flag after sending multipart packet
Reduce used window sizes by factor 10
libssh2_userauth_publickey_fromfile_ex() handles a NULL password
sftp_init() deal with _libssh2_channel_write() short returns
Version 1.2.4 - February 13 2010
libssh2 1.2.4 GPG sig (547675 bytes)
Bug fixes:
Resolve compile issues on Solaris x64 and UltraSPARC
Allow compiling with OpenSSL when AES isn't available
Fix Tru64 socklen_t compile issue with example/direct_tcpip.c
Version 1.2.3 - February 3 2010
libssh2 1.2.3 GPG sig (547652 bytes)
Changes:
ssh-agent support with the new libssh2_agent_* functions
Added libssh2_trace_sethandler()
Added the direct_tcpip.c and ssh2_agent.c examples
Bug fixes:
Fixed memory leak in userauth_publickey
Fixed publickey authentication regression
Silenced several compiler warnings
avoid returning data to memory already freed
transport layer fix for bogus -39 (LIBSSH2_ERROR_BAD_USE) errors
Fixed padding in ssh-dss signature blob encoding
Fixed direction blocking flag problems
Fixed memory leak in sftp_fstat()
changes:
-Support for the "aes128-ctr", "aes192-ctr", "aes256-ctr" ciphers
-Support for the "arcfour128" cipher
-Fix crash when server sends an invalid SSH_MSG_IGNORE message
This changes the buildlink3.mk files to use an include guard for the
recursive include. The use of BUILDLINK_DEPTH, BUILDLINK_DEPENDS,
BUILDLINK_PACKAGES and BUILDLINK_ORDER is handled by a single new
variable BUILDLINK_TREE. Each buildlink3.mk file adds a pair of
enter/exit marker, which can be used to reconstruct the tree and
to determine first level includes. Avoiding := for large variables
(BUILDLINK_ORDER) speeds up parse time as += has linear complexity.
The include guard reduces system time by avoiding reading files over and
over again. For complex packages this reduces both %user and %sys time to
half of the former time.
