Expose the configured `IdentityAgent` and `IdentitiesOnly` options - #15

Open

alexey-milovidov wants to merge 795 commits into

continue-pr-115072-identity-agent-option

This pull request is big! We're only showing the most recent 250 commits

Commits on Aug 12, 2025

poll: Fix memory leak on failed realloc()
Jakuje
committed
5a6e2fd
poll: Initialize ssh_poll_handle pointers
Jakuje
committed
5691e0f
socket: Free poll handle when resetting socket state
Jakuje
committed
118a747

Commits on Aug 14, 2025

tests: Enable all key exchange methods in ssh_ping
Jakuje
committed
771e19a
CVE-2025-8277: packet: Adjust packet filter to work when DH-GEX is guessed wrongly
Jakuje
committed
4310a69
CVE-2025-8277: Fix memory leak of unused ephemeral key pair after client's wrong KEX guess

eferollo
authored and
Jakuje
committed
ccff22d
CVE-2025-8277: ecdh: Free previously allocated pubkeys
Jakuje
committed
c9d95ab
tests: Invoke all combinations of wrong guesses during rekey
Jakuje
committed
d357a9f
CVE-2025-8277: wrapper: Free cv25519 private key on cleanup
Jakuje
committed
9ada7aa
CVE-2025-8277: mbedtls: Avoid leaking ecdh keys
Jakuje
committed
ffed80f
CVE-2025-8114: Fix NULL pointer dereference after allocation failure

cryptomilk
authored and
Jakuje
committed
53ac23d
socket: do not free poll object if it is locked

catenacyber
authored and
Jakuje
committed
c992614
poll: Use is_locked helper where possible
Jakuje
committed
df4e907

Commits on Sep 9, 2025

refactor(pki): Define RSA_MIN_KEY_SIZE and update related checks

DarkPhoenix42
authored and
Jakuje
committed
e8bbd19

Commits on Sep 10, 2025

Commits on Sep 18, 2025

fix(bind): Remove code duplication in ssh_bind_listen

eferollo
authored and
Jakuje
committed
c94e2ef

Commits on Sep 25, 2025

fuzz: test allocations failures

catenacyber
authored and
Jakuje
committed
59a502e
tests: Rewrite all fuzzers to LLVMFuzzerInitialize and nalloc
Jakuje
committed
a3c5d3b
feat(buffer): add ssh_buffer_dup function to duplicate existing buffers

DarkPhoenix42
authored and
Jakuje
committed
2f77727
test(buffer): add unit tests for ssh_buffer_dup function

DarkPhoenix42
authored and
Jakuje
committed
8541b65
pki: define RSA_DEFAULT_KEY_SIZE

DarkPhoenix42
authored and
Jakuje
committed
8c4e337
pki: update RSA key generation to use default size when parameter is 0

DarkPhoenix42
authored and
Jakuje
committed
08cbbea

Commits on Sep 30, 2025

refactor(pki): separate the sk signature buffer packing to a separate function

DarkPhoenix42
authored and
Jakuje
committed
55bb909
mbedtls: Warn about missing featues of mbedTLS build
Jakuje
committed
607dad0

Commits on Oct 1, 2025

examples: Add more flexibility to set verbosity
Jakuje
committed
c551402
sftpserver: Remove some needless parts
Jakuje
committed
a51384f
sftpserver: Fix loop termination
Jakuje
committed
6aea779
tests: Fix wording in comment to make sense
Jakuje
committed
ecb11f1
connector: Reformat
Jakuje
committed
8a0aa17
connector: Fix default connector flags
Jakuje
committed
c932790
channels: Improve logging information about channels
Jakuje
committed
dc45b8f
connector: Improve logging
Jakuje
committed
8966e57
examples: Replace magic numbers with FD constants
Jakuje
committed
a49e0c2
examples: Reformat
Jakuje
committed
029754e
Add RequiredRsaSize configuration option
Jakuje
committed
00f1d6f

Commits on Oct 10, 2025

feat(string): add ssh_string_from_data function to create ssh_string from data buffer

DarkPhoenix42
authored and
Jakuje
committed
74d1bf5
tests(string): add tests for ssh_string_from_data function

DarkPhoenix42
authored and
Jakuje
committed
f3d70e5
examples: Support passing port to libssh_scp to simplify testing
Jakuje
committed
07d099f
scp: Workaround for Cisco devices not handling single quotes
Jakuje
committed
358553e

Commits on Nov 4, 2025

libcrypto: update EVP API usage

vapier
authored and
Jakuje
committed
e93c1f6
ttyopts: make non-POSIX defines optional

vapier
authored and
Jakuje
committed
66e8491
pki_crypto: Avoid potential memory leak if malloc fails
Jakuje
committed
d307bfa

Commits on Nov 5, 2025

kex: Implement mlkem768x25519-sha256

sahanaprasad07
authored and
Jakuje
committed
a9c8f94
client: Reset session packet state on disconnect

zacikpa
authored and
Jakuje
committed
41b8b33
tests: Adjust valgrind supressions for Fedora 43
Jakuje
committed
a94df4b
tests: Avoid needless pthread_exit()
Jakuje
committed
b9c6701
tests: Remove the -E which is overridden by followed -E on ctest CLI
Jakuje
committed
950abbb
Suppress remaining OpenSSL 3.5 memory leaks
Jakuje
committed
b042477

Commits on Nov 6, 2025

mlkem768: Fix missing jumps in error handling

zacikpa
authored and
Jakuje
committed
80541ab
Remove references to (unused) pre-release ssh messages SSH2_MSG_ECMQV_*
Jakuje
committed
3444f4c
kex: Place PQC KEX methods first
Jakuje
committed
491cd81
pkd: Run ed25519 tests with dropbear
Jakuje
committed
b64e7f6
pkd: Run tests with ecdsa and ed25519 keys with dropbear
Jakuje
committed
cefc4f8
Bump minimal RSA key size to 1024
Jakuje
committed
ee6e2c6
coverage: Ignore parse errors again
Jakuje
committed
ae33ced
pki: Use constant for minimal RSA key size in FIPS
Jakuje
committed
63fbf00

Commits on Nov 8, 2025

cmake: add cmake module to find libfido2
DarkPhoenix42
committed
150d606
cmake: add build option to enable FIDO2/U2F support
DarkPhoenix42
committed
ebe632c
ci: enable FIDO2/U2F support in some images
DarkPhoenix42
committed
7db75e8
fido2: add sk_api.h
DarkPhoenix42
committed
302d868
tests(torture_sk): validate sk_flags against allowed security key flags
DarkPhoenix42
committed
eda5c65
fido2: declare callbacks for sk operations
DarkPhoenix42
committed
8ba9e93
fido2: add helper functions for writing FIDO2/U2F callbacks
DarkPhoenix42
committed
c1dd30b

Commits on Nov 9, 2025

Commits on Nov 13, 2025

Commits on Nov 19, 2025

Commits on Nov 21, 2025

chore(editorconfig): Put CMakeLists.txt in its own section
cryptomilk
committed
b62675b
cmake: Add .cmake-format.yaml
cryptomilk
committed
5ce4b65
docs: Use a modern doxygen theme
cryptomilk
committed
e5108f2

Commits on Nov 25, 2025

ecdh: Factor out keypair generation

zacikpa
authored and
Jakuje
committed
7911580
kex: Implement remaining hybrid ML-KEM methods

zacikpa
authored and
Jakuje
committed
0ef7901

Commits on Dec 12, 2025

Replace explicit_bzero with ssh_burn

7adidaz
authored and
Jakuje
committed
64f72ed
zeroize sensitive buffers in ssh_sntrup761x25519_build_k

7adidaz
authored and
Jakuje
committed
541cd39
server: Check strdup allocation failure
Jakuje
committed
ee180c6
ssh_known_hosts_get_algorithms: Simplify cleanup ...
Jakuje
committed
9d6df9d
libcrypto.c: Use openssl const algorithm names

jogme
authored and
Jakuje
committed
dd80a56
set log level when debug option is increased

7adidaz
authored and
Jakuje
committed
3938e5e
refactor auth options handler

7adidaz
authored and
Jakuje
committed
1833ce8
Support new '-o' option parsing to client

7adidaz
authored and
Jakuje
committed
ecea5b6
use standard O_NONBLOCK naming

vapier
authored and
Jakuje
committed
3526e02

Commits on Dec 17, 2025

hybrid_mlkem: Convert ECDH shared secret to a fixed-size string

zacikpa
authored and
Jakuje
committed
4bad7cc

Commits on Dec 18, 2025

Improve doxygen docs

nikhil-nari
authored and
Jakuje
committed
f8d943a
Improve doxygen documentation

nikhil-nari
authored and
Jakuje
committed
4feb0dd
fix : modify ssh_connector_free to accept NULL values

nikhil-nari
authored and
Jakuje
committed
79966eb

Commits on Dec 19, 2025

config: Fix error paths of configuration parsing
Jakuje
committed
e82677a
tests: Reproducer for missing value to LogLevel
Jakuje
committed
163373c

Commits on Jan 2, 2026

Happy new year 2026!
Jakuje
committed
228208a
connect: Improve logging around the connection code

Jakuje
authored and
Ram-Z
committed
f52be27
connect: Support AddressFamily option
Ram-Z
committed
c4f1a70
ssh_client: Return non-zero on config parsing failure
Ram-Z
committed
62c85a5
tests: suppress leaks from NSS modules
Ram-Z
committed
ce45ba8
tidy(unittests): zero-init config string pointers
Ram-Z
committed
98a844c

Commits on Jan 5, 2026

tests: Use standard way of setting cmake variables
Jakuje
committed
3e074a3
pkd: Run openssh client with SK keys
Jakuje
committed
5c496ac
pki: Avoild false positive matches when comparing certificates in mbedtls and gcrypt
Jakuje
committed
0d5a265
pki: Fix comparing public key of certificate
Jakuje
committed
38f3d15
tests: Improve test coverage of comparing certificates
Jakuje
committed
701a215
feat: add gssapi key exchange

xaerru
authored and
Jakuje
committed
bc5211d
feat: add "gssapi-keyex" for server

xaerru
authored and
Jakuje
committed
9044fcd
feat: add SSH2_MSG_KEXGSS_HOSTKEY support to client and server

xaerru
authored and
Jakuje
committed
d730b40
feat: test null hostkey on ci

xaerru
authored and
Jakuje
committed
fd1c3e8
feat: add null hostkey for server

xaerru
authored and
Jakuje
committed
c1aab99
fix: create fopen wrapper and block default hostkey paths

xaerru
authored and
Jakuje
committed
f9d7cad
feat: implement packet filter for SSH2_MSG_KEXGSS_COMPLETE

xaerru
authored and
Jakuje
committed
06b61f7
reformat: gssapi key exchange

xaerru
authored and
Jakuje
committed
a0707af
fix: use strcmp instead of strncmp to avoid prefix match

xaerru
authored and
Jakuje
committed
d0e5cf7
fix: replace pthread_exit in gssapi tests

xaerru
authored and
Jakuje
committed
6d81ecd
tests: add valgrind suppressions

xaerru
authored and
Jakuje
committed
96807b9
refactor: remove issue link from .gitlab-ci.yml

xaerru
authored and
Jakuje
committed
5d06ee4
reformat: some nits

xaerru
authored and
Jakuje
committed
213556c
refactor: remove extra else if branch for disable_hostkeys

xaerru
authored and
Jakuje
committed
5a99cf9
fix: move ssh_gssapi_check_client_config() from ssh_options_set to ssh_options_apply

xaerru
authored and
Jakuje
committed
83114b6
tests: add config tests for SSH_OPTIONS_GSSAPI_KEY_EXCHANGE

xaerru
authored and
Jakuje
committed
e94fd6c
fix: some possible memory leaks

xaerru
authored and
Jakuje
committed
4ba0746
tests: add test for gssapi server key exchange with null hostkey and no tgt

xaerru
authored and
Jakuje
committed
f149017
Move GSSAPI KEX messages to be numerically sorted
Jakuje
committed
043b1fb
packet: Implement packet filter for non-implemented GSSAPI messages
Jakuje
committed
06cefe1
gssapi: reformat parts
Jakuje
committed
83ae6b3
md: Implement one-shot md5

zacikpa
authored and
Jakuje
committed
2c5bb17
session: Refactor ssh_get_publickey_hash

zacikpa
authored and
Jakuje
committed
3710b31
curve25519: Make ssh_curve25519_build_k public

zacikpa
authored and
Jakuje
committed
ad23fe8
libgcrypt: make bignum_dup usable with const_bignum

zacikpa
authored and
Jakuje
committed
a30ba00
torture_packet: use SSH2_MSG_IGNORE type of test packet

zacikpa
authored and
Jakuje
committed
5fed1bc
gssapi: Add support for ECDH GSSAPI KEX

zacikpa
authored and
Jakuje
committed
88c2ea6
doc: document support for gssapi-keyex and related KEX methods

zacikpa
authored and
Jakuje
committed
ced98d4
options: replace SSH_OPTIONS_GSSAPI_KEY_EXCHANGE_ALGS example

zacikpa
authored and
Jakuje
committed
06edb2d
packet: complete GSSAPI packet filter

zacikpa
authored and
Jakuje
committed
06eea93
gssapi: add null checks for session->gssapi before using it

zacikpa
authored and
Jakuje
committed
e04d753
packet_cb: adjust response to NEWKEYS w.r.t. GSSAPI

zacikpa
authored and
Jakuje
committed
11c4b29
tests: reenable wait in torture_gssapi_server_key_exchange_null

zacikpa
authored and
Jakuje
committed
f7cad42
auth: check for strdup allocation failure in ssh_userauth_gssapi_keyex

zacikpa
authored and
Jakuje
committed
b79a681
bind: adjust hostkey error messages to be more precise

zacikpa
authored and
Jakuje
committed
4d3da78
tests: test fallback to regular key exchange from gssapi-keyex

zacikpa
authored and
Jakuje
committed
d3e80d9
gssapi: enable gssapi-keyex in FIPS mode

zacikpa
authored and
Jakuje
committed
9b4ee9c
auth: do not prefer hostbound auth if there is no host key

zacikpa
authored and
Jakuje
committed
d2bb1ba
tests: test pubkey auth after gssapi-keyex with null host key

zacikpa
authored and
Jakuje
committed
7c25746
ci: Add bug links as reasoning why some tests are not run

zacikpa
authored and
Jakuje
committed
65abae0
gssapi: free session->gssapi->user before assigning

zacikpa
authored and
Jakuje
committed
d0d45c8
config: Allow setting username from configuration
Jakuje
committed
3208446
socket: Properly close the proxyjump FD when proxy connection fails
Jakuje
committed
deffea5
tests: Test proxyjump configuration parsing
Jakuje
committed
82db6a7
connect: Close possibly leaking socket
Jakuje
committed
c36bd23
feat: Add interoperability tests for PuTTY

nikhil-nari
authored and
Jakuje
committed
0618627

Commits on Jan 6, 2026

Add Keyboard Interactive
anshulagrawal2902
committed
3f00078

Commits on Jan 7, 2026

gssapi: Check return value from ssh_gssapi_init()
Jakuje
committed
f5eb3e5
gssapi: Avoid possible memory leak on error condition
Jakuje
committed
48fdf4b
connect: Avoid calling close with negative argument
Jakuje
committed
c9abf5e
connector: Avoid possible underflow ...
Jakuje
committed
b61bb3f
dh-gex: Initialize best_size to make the code mode straight-forward
Jakuje
committed
a8ca282
pki: Improve documentation about pubkey import functions
Jakuje
committed
1f1309c
gssapi: Fix typo
Jakuje
committed
9a33519
Add ML-KEM implementation for gcrypt
Jakuje
committed
76c6ee9
cmake: Make the WITH_INTERNAL_DOC function do something
Jakuje
committed
02ae2ac
ci: Include internal docs in the docs coverage reports
Jakuje
committed
57225a7

Commits on Jan 12, 2026

cmake: Download doxygen theme during build not configure run

cryptomilk
authored and
Jakuje
committed
40ba3c6

Commits on Jan 15, 2026

tests: Reformat torture_auth_pkcs11
Jakuje
committed
be5a900
sntrup: Avoid linking issues in external_override tests
Jakuje
committed
5545b88
tests: Print read bytes to debug failures
Jakuje
committed
acd5dac
tests: Remove unused variable
Jakuje
committed
247ebb4
tests: Remove needless goto
Jakuje
committed
16771cc
tests: Log server messages to separate files
Jakuje
committed
89d51ce
tests: Set explicit kex algorithm
Jakuje
committed
a983142
tests: Authentication with Ed25519 pkcs11 key
Jakuje
committed
18ec01c
tests: Skip agent forwarding test if we are too deep in filesystem
Jakuje
committed
c90b239
tests: Remove trailing whitespace
Jakuje
committed
cb0f7d9
ci: Use pkcs11-provider on c9s
Jakuje
committed
ad8d0c1
tests: Avoid needless skip in testcases
Jakuje
committed
7dea005
config: Pass the right types to OPTIONS_RSA_MIN_SIZE
Jakuje
committed
3c2b254
options: Fix doc string
Jakuje
committed
ef45b8a
tests: Provide minimal openssl configuration file
Jakuje
committed
b33a90d
Add missing check in ML-KEM implementation of gcrypt
Jakuje
committed
5a795ce
tests: Apply verbosity also for the ssh_bind
Jakuje
committed
9780fa2
Native ML-KEM768 implementation
Jakuje
committed
34db488

Commits on Feb 2, 2026

docs: document sftp_session public API type

Madhav Vasisth
authored and
Jakuje
committed
da27d23
ci: add CLI helper to run GitLab CI jobs locally

ShreyasMahajann
authored and
Jakuje
committed
f47d1c7
reformat libcrypto.c

ShreyasMahajann
authored and
Jakuje
committed
6c5459e
crypto: Add support for Poly1305 from LibreSSL

ShreyasMahajann
authored and
Jakuje
committed
a1e4972
ci: Test against latest LibreSSL

ShreyasMahajann
authored and
Jakuje
committed
971d441
mlkem: Use fprintf instead of internal logging function
Jakuje
committed
d936b7e
tests: Workaround softhsm-2.7.0 bug in hashed ECDSA
Jakuje
committed
d297621
Require abimap 0.4.0
Jakuje
committed
809f9b7
cmake: Propagate WITH_FINAL to abimap conditionally
Jakuje
committed
b2abcf8

Commits on Feb 3, 2026

gssapi: Sanitize input parameters
Jakuje
committed
a189c2e
knownhosts: Avoid memory leaks on invalid entries
Jakuje
committed
1525ea3
Reproducer for memory leak from parsing knonw hosts
Jakuje
committed
1b3c061

Commits on Feb 4, 2026

bugfix: test presence of before_connection before dereferencing

galorithm
authored and
Jakuje
committed
26b9ba5
misc: Document ssh_list_append()
Jakuje
committed
052c821
auth: Log the username used for authentication
Jakuje
committed
7e235f8
test: Tighten testing to make sure right user and key is used with proxyjumps
Jakuje
committed
ea34645
socket: Refactor proxyJump connection and log more events and information
Jakuje
committed
832f92e
sftp: Remove needless newline from log messages
Jakuje
committed
7342e73
tests: Cover three steps jump parsing
Jakuje
committed
efb7a7c
tests: Log SFTP server messages to stderr
Jakuje
committed
d75a54e
connector: Simplify handling of out/err channels
Jakuje
committed
8e8f091
Update list of implemented RFCs and drafts
Jakuje
committed
76b14ea

Commits on Feb 5, 2026

misc: Reformat ssh_path_expand_escape
Jakuje
committed
3dfaa70
misc: Reformat ssh_get_user_home_dir()
Jakuje
committed
a7cf4bb
misc: Cache user home directory in session
Jakuje
committed
31ceec0
Fix percent expand character %d to home directory
Jakuje
committed
ce0b616
New ssh_get_local_hostname()
Jakuje
committed
59ed66b
misc: Add support for %j and %C percent expand
Jakuje
committed
5b0cee7
test: Verify expand characters work as expected
Jakuje
committed
c78d2bb
misc: Rewrite custom getting of port to use options API
Jakuje
committed
b4f6d8b
options: Allow listing all identity files
Jakuje
committed
39d931f
tests: Check SSH_OPTIONS_NEXT_IDENTITY functionality
Jakuje
committed
8a134e0
sftp_aio: Test sftp aio with libssh proxyjump

galorithm
authored and
Jakuje
committed
29dd787
connector: Fix sftp aio read/write with ProxyJump

galorithm
authored and
Jakuje
committed
dc39902
sftp: Reformat sftp_extensions_* API
Jakuje
committed
f0fdfd4
sftp: Fix out-of-bound read from sftp extensions
Jakuje
committed
855a085
Reproducer for out of bounds read of SFTP extensions
Jakuje
committed
b90b7f2
ed25519: Avoid timing leak when comparing private keys
Jakuje
committed
5654c59
pki: Discourage comparing private keys
Jakuje
committed
b3e13b7
sftp: Initialize pointers
Jakuje
committed
28d6d10
CVE-2026-0968: sftp: Sanitize input handling in sftp_parse_longname()
Jakuje
committed
20856f4
CVE-2026-0968 tests: Reproducer for invalid longname data
Jakuje
committed
90a5d8f
CVE-2026-0967 match: Avoid recursive matching (ReDoS)
Jakuje
committed
a411de5
CVE-2026-0966 misc: Avoid heap buffer underflow in ssh_get_hexa
Jakuje
committed
417a095
CVE-2026-0966 tests: Test coverage for ssh_get_hexa
Jakuje
committed
9be8358
CVE-2026-0966 doc: Update guided tour to use SHA256 fingerprints
Jakuje
committed
1b2a4f7
CVE-2026-0965 config: Do not attempt to read non-regular and too large configuration files
Jakuje
committed
a5eb30d
CVE-2026-0964 scp: Reject invalid paths received through scp
Jakuje
committed
daa8081
cmake: Reformat DefineOptions.cmake with cmake-format

cryptomilk
authored and
Jakuje
committed
12ccea8
CVE-2025-14821 cmake: Fix global config location on Windows

cryptomilk
authored and
Jakuje
committed
6a7f19e

Commits on Feb 10, 2026

misc: Fix possible NULL dereference
Jakuje
committed
60ad19c
fix typos
Jakuje
committed
3232d72
Copy changelog + ABI files from last minor releases
Jakuje
committed
7e02580
libssh-0.12.0
Jakuje
committed
5031388

Commits on Aug 19, 2026

Add `IdentityAgent` option retrieval
alexey-milovidov
committed
79b6c45

Commits on Aug 20, 2026

Add `IdentitiesOnly` option retrieval
alexey-milovidov
committed
2dc1be7