Merge pull request #16 from david-cermak/feat/libssh_v0.12

feat(libssh): Update to support v0.12 upstream

Author: david-cermak

libssh/CMakeLists.txt

@@ -1,4 +1,4 @@
-set(LIBSSH_VERSION "0.11.0")
+set(LIBSSH_VERSION "0.12.0")
 set(LIBSSH_DIR "libssh-${LIBSSH_VERSION}")
 
 set(libssh_SRCS
@@ -35,6 +35,7 @@ set(libssh_SRCS
   packet_crypt.c
   pcap.c
   pki.c
+  pki_context.c
   pki_container_openssh.c
   poll.c
   session.c
@@ -44,6 +45,7 @@ set(libssh_SRCS
   threads.c
   ttyopts.c
   wrapper.c
+  gzip.c
   external/bcrypt_pbkdf.c
   external/blowfish.c
   config_parser.c
@@ -68,6 +70,14 @@ ${libssh_SRCS}
     external/sc25519.c
 )
 
+if(CONFIG_LIBSSH_SNTRUP761)
+set(libssh_SRCS
+${libssh_SRCS}
+    sntrup761.c
+    external/sntrup761.c
+)
+endif()
+
 set(libssh_SRCS
 ${libssh_SRCS}
     external/chacha.c
@@ -90,9 +100,20 @@ ${libssh_SRCS}
 
 set(libssh_SRCS
 ${libssh_SRCS}
+    curve25519_fallback.c
     external/curve25519_ref.c
 )
 
+if(CONFIG_LIBSSH_MLKEM)
+set(libssh_SRCS
+${libssh_SRCS}
+    mlkem.c
+    hybrid_mlkem.c
+    mlkem_native.c
+    external/libcrux_mlkem768_sha3.c
+)
+endif()
+
 list(TRANSFORM libssh_SRCS PREPEND "${LIBSSH_DIR}/src/")
 
 idf_component_register(SRCS ${libssh_SRCS}
@@ -114,3 +135,6 @@ endif()
 
 set_source_files_properties(${LIBSSH_DIR}/src/external/bcrypt_pbkdf.c PROPERTIES COMPILE_OPTIONS "-Wno-unterminated-string-initialization")
 set_source_files_properties(${LIBSSH_DIR}/src/external/chacha.c PROPERTIES COMPILE_OPTIONS "-Wno-unterminated-string-initialization")
+if(CONFIG_LIBSSH_MLKEM)
+set_source_files_properties(${LIBSSH_DIR}/src/external/libcrux_mlkem768_sha3.c PROPERTIES COMPILE_OPTIONS "-Wno-declaration-after-statement")
+endif()

libssh/Kconfig

@@ -0,0 +1,25 @@
+menu "libssh"
+
+    config LIBSSH_SNTRUP761
+        bool "Enable SNTRUP761 (post-quantum) key exchange"
+        default n
+        help
+            Enable the sntrup761x25519-sha512 hybrid key exchange
+            algorithm. This adds significant stack usage due to the
+            SNTRUP761 cryptographic operations. Disable to reduce the
+            memory footprint on constrained devices.
+
+    config LIBSSH_MLKEM
+        bool "Enable ML-KEM (post-quantum) key exchange"
+        default n
+        help
+            Enable ML-KEM (Module-Lattice-based Key Exchange Mechanism)
+            hybrid key exchange algorithms: mlkem768x25519-sha256 and
+            mlkem768nistp256-sha256.
+
+            The ML-KEM implementation adds significant code size (~80 KB)
+            and stack usage (~40 KB) due to the libcrux cryptographic
+            library. Disable to reduce the memory footprint on
+            constrained devices.
+
+endmenu

libssh/idf_component.yml

@@ -1,4 +1,4 @@
-version: "0.11.0~1"
+version: "0.12.0"
 url: https://github.com/david-cermak/libssh
 license: LGPL-2.1
 description: The component provides a general purpose SSH connectivity

libssh/install.sh

@@ -1,16 +1,17 @@
 #!/bin/bash
 
 # libssh installation script
-# This script downloads, extracts, and builds libssh from source
+# This script downloads, extracts, and patches libssh for the ESP-IDF port
 
 set -e  # Exit on any error
 
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+
 # Configuration
-LIBSSH_VERSION="0.11.0"
+LIBSSH_VERSION="0.12.0"
 LIBSSH_URL="https://git.libssh.org/projects/libssh.git/snapshot/libssh-${LIBSSH_VERSION}.tar.xz"
 LIBSSH_DIR="libssh-${LIBSSH_VERSION}"
-INSTALL_DIR="/usr/local"
-
+PATCH_DIR="${SCRIPT_DIR}/patches"
 
 echo "Downloading libssh ${LIBSSH_VERSION}..."
 
@@ -29,3 +30,17 @@ if ! tar -xf "libssh-${LIBSSH_VERSION}.tar.xz"; then
 fi
 
 rm "libssh-${LIBSSH_VERSION}.tar.xz"
+
+# Apply ESP-IDF port patches
+if [ -d "${PATCH_DIR}" ]; then
+    for patch_file in "${PATCH_DIR}"/*.patch; do
+        [ -f "$patch_file" ] || continue
+        echo "Applying patch: $(basename "$patch_file")..."
+        if ! patch -p0 < "$patch_file"; then
+            echo "Failed to apply patch: $(basename "$patch_file")"
+            exit 1
+        fi
+    done
+fi
+
+echo "libssh ${LIBSSH_VERSION} installed successfully."

libssh/patches/esp_idf_port.patch

@@ -0,0 +1,149 @@
+--- libssh-0.12.0/include/libssh/sntrup761.h	2026-02-10 10:35:23.000000000 +0100
++++ libssh-0.12.0/include/libssh/sntrup761.h	2026-04-10 18:22:41.362169147 +0200
+@@ -31,7 +31,7 @@
+ extern "C" {
+ #endif
+
+-#ifdef HAVE_CURVE25519
++#if defined(HAVE_CURVE25519) && !defined(WITHOUT_SNTRUP761)
+ #define HAVE_SNTRUP761 1
+ #endif
+
+--- libssh-0.12.0/src/kex.c	2026-02-10 10:35:23.000000000 +0100
++++ libssh-0.12.0/src/kex.c	2026-04-10 18:10:37.885707940 +0200
+@@ -105,6 +105,7 @@
+ #define SNTRUP761X25519 ""
+ #endif /* HAVE_SNTRUP761 */
+
++#ifdef HAVE_MLKEM
+ #ifdef HAVE_MLKEM1024
+ #define HYBRID_MLKEM "mlkem768x25519-sha256," \
+                      "mlkem768nistp256-sha256," \
+@@ -113,6 +114,9 @@
+ #define HYBRID_MLKEM "mlkem768x25519-sha256," \
+                      "mlkem768nistp256-sha256,"
+ #endif /* HAVE_MLKEM1024 */
++#else
++#define HYBRID_MLKEM ""
++#endif /* HAVE_MLKEM */
+
+ #ifdef HAVE_ECC
+ #define ECDH "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,"
+@@ -995,6 +999,7 @@
+         return SSH_KEX_SNTRUP761X25519_SHA512_OPENSSH_COM;
+     } else if (strcmp(kex, "sntrup761x25519-sha512") == 0) {
+         return SSH_KEX_SNTRUP761X25519_SHA512;
++#ifdef HAVE_MLKEM
+     } else if (strcmp(kex, "mlkem768x25519-sha256") == 0) {
+         return SSH_KEX_MLKEM768X25519_SHA256;
+     } else if (strcmp(kex, "mlkem768nistp256-sha256") == 0) {
+@@ -1003,6 +1008,7 @@
+     } else if (strcmp(kex, "mlkem1024nistp384-sha384") == 0) {
+         return SSH_KEX_MLKEM1024NISTP384_SHA384;
+ #endif
++#endif /* HAVE_MLKEM */
+     }
+     /* should not happen. We should be getting only valid names at this stage */
+     return 0;
+@@ -1057,6 +1063,7 @@
+         ssh_client_sntrup761x25519_remove_callbacks(session);
+         break;
+ #endif
++#ifdef HAVE_MLKEM
+     case SSH_KEX_MLKEM768X25519_SHA256:
+     case SSH_KEX_MLKEM768NISTP256_SHA256:
+ #ifdef HAVE_MLKEM1024
+@@ -1064,6 +1071,9 @@
+ #endif
+         ssh_client_hybrid_mlkem_remove_callbacks(session);
+         break;
++#endif /* HAVE_MLKEM */
++    default:
++        break;
+     }
+ }
+
+@@ -1663,6 +1673,7 @@
+         }
+         break;
+ #endif /* HAVE_SNTRUP761 */
++#ifdef HAVE_MLKEM
+     case SSH_KEX_MLKEM768X25519_SHA256:
+     case SSH_KEX_MLKEM768NISTP256_SHA256:
+ #ifdef HAVE_MLKEM1024
+@@ -1679,6 +1690,7 @@
+             goto error;
+         }
+         break;
++#endif /* HAVE_MLKEM */
+     default:
+         /* Handle unsupported kex types - this should not happen in normal operation */
+         rc = SSH_ERROR;
+@@ -1693,6 +1705,7 @@
+                              session->next_crypto->shared_secret,
+                              SHA512_DIGEST_LEN);
+         break;
++#ifdef HAVE_MLKEM
+     case SSH_KEX_MLKEM768X25519_SHA256:
+     case SSH_KEX_MLKEM768NISTP256_SHA256:
+ #ifdef HAVE_MLKEM1024
+@@ -1700,6 +1713,7 @@
+ #endif
+         rc = ssh_buffer_pack(buf, "S", session->next_crypto->hybrid_shared_secret);
+         break;
++#endif /* HAVE_MLKEM */
+     default:
+         rc = ssh_buffer_pack(buf, "B", session->next_crypto->shared_secret);
+         break;
+@@ -1922,6 +1936,7 @@
+         k_string = ssh_make_padded_bignum_string(crypto->shared_secret,
+                                                  crypto->digest_len);
+         break;
++#ifdef HAVE_MLKEM
+     case SSH_KEX_MLKEM768X25519_SHA256:
+     case SSH_KEX_MLKEM768NISTP256_SHA256:
+ #ifdef HAVE_MLKEM1024
+@@ -1929,6 +1944,7 @@
+ #endif
+         k_string = ssh_string_copy(crypto->hybrid_shared_secret);
+         break;
++#endif /* HAVE_MLKEM */
+     default:
+         k_string = ssh_make_bignum_string(crypto->shared_secret);
+         break;
+--- libssh-0.12.0/src/client.c	2026-02-10 10:35:23.000000000 +0100
++++ libssh-0.12.0/src/client.c	2026-04-10 18:10:37.885707940 +0200
+@@ -306,6 +306,7 @@
+             rc = ssh_client_sntrup761x25519_init(session);
+             break;
+ #endif
++#ifdef HAVE_MLKEM
+         case SSH_KEX_MLKEM768X25519_SHA256:
+         case SSH_KEX_MLKEM768NISTP256_SHA256:
+ #ifdef HAVE_MLKEM1024
+@@ -313,6 +314,7 @@
+ #endif
+             rc = ssh_client_hybrid_mlkem_init(session);
+             break;
++#endif /* HAVE_MLKEM */
+         default:
+             rc = SSH_ERROR;
+         }
+--- libssh-0.12.0/src/wrapper.c	2026-02-10 10:35:23.000000000 +0100
++++ libssh-0.12.0/src/wrapper.c	2026-04-10 18:10:37.885707940 +0200
+@@ -625,6 +625,7 @@
+         ssh_server_sntrup761x25519_init(session);
+         break;
+ #endif
++#ifdef HAVE_MLKEM
+     case SSH_KEX_MLKEM768X25519_SHA256:
+     case SSH_KEX_MLKEM768NISTP256_SHA256:
+ #ifdef HAVE_MLKEM1024
+@@ -632,6 +633,7 @@
+ #endif
+         ssh_server_hybrid_mlkem_init(session);
+         break;
++#endif /* HAVE_MLKEM */
+     default:
+         ssh_set_error(session,
+                       SSH_FATAL,

libssh/port/config.h

@@ -4,14 +4,15 @@
 #define PACKAGE "libssh"
 
 /* Version number of package */
-#define VERSION "0.11.0"
+#define VERSION "0.12.0"
 
 #define SYSCONFDIR "etc"
-#define BINARYDIR "/home/david/repos/libssh-0.11.0/build_minimal"
-#define SOURCEDIR "/home/david/repos/libssh-0.11.0"
+#define BINARYDIR "/home/david/repos/libssh-0.12.0/build_minimal"
+#define SOURCEDIR "/home/david/repos/libssh-0.12.0"
 
 /* Global bind configuration file path */
 #define GLOBAL_BIND_CONFIG "/etc/ssh/libssh_server_config"
+#define GLOBAL_CONF_DIR "/etc/ssh"
 
 /* Global client configuration file path */
 #define GLOBAL_CLIENT_CONFIG "/etc/ssh/ssh_config"
@@ -259,6 +260,16 @@
 /* Define to 1 if you want to enable calltrace debug output */
 #define DEBUG_CALLTRACE 1
 
+/* Define to 1 if you want to enable SNTRUP761 hybrid key exchange */
+#ifndef CONFIG_LIBSSH_SNTRUP761
+#define WITHOUT_SNTRUP761 1
+#endif
+
+/* Define to 1 if you want to enable ML-KEM hybrid key exchange */
+#ifdef CONFIG_LIBSSH_MLKEM
+#define HAVE_MLKEM 1
+#endif
+
 /* Define to 1 if you want to enable NaCl support */
 /* #undef WITH_NACL */
 

libssh/port/idf_compat.h

@@ -16,6 +16,7 @@ int socketpair(int domain, int type, int protocol, int sv[2]);
 
 // socket utils
 #define PF_UNIX AF_UNIX
+#define NI_NUMERICHOST AI_NUMERICHOST
 
 // termios
 #ifndef IMAXBEL