Reproducer for memory leak from parsing knonw hosts

Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Reviewed-by: Norbert Pocs <norbertpocs0@gmail.com>

.clang-format

@@ -22,8 +22,8 @@ BinPackArguments: false
 BinPackParameters: false
 AllowAllArgumentsOnNextLine: false
 AllowShortFunctionsOnASingleLine: Empty
-# TODO with Clang 19, replace the below with
+BreakAfterReturnType: ExceptShortType
-# BreakAfterReturnType: ExceptShortType
 AlwaysBreakAfterReturnType: AllDefinitions
 AlignEscapedNewlines: Left
 ForEachMacros: ['ssh_callbacks_iterate']
+AlignConsecutiveMacros: 'Consecutive'

.clang-format-ignore

@@ -0,0 +1 @@
+src/external/*

.cmake-format.yaml

@@ -0,0 +1,6 @@
+---
+line_width: 80
+tab_size: 4
+use_tabchars: false
+separate_ctrl_name_with_space: true
+separate_fn_name_with_space: false

.editorconfig

@@ -12,7 +12,12 @@ indent_style = space
 indent_size = 4
 tab_width = 4
 
-[{CMakeLists.txt,*.cmake}]
+[CMakeLists.txt]
+indent_style = space
+indent_size = 4
+tab_width = 4
+
+[*.cmake]
 indent_style = space
 indent_size = 4
 tab_width = 4

.gitignore

@@ -10,3 +10,4 @@ tags
 /build
 /obj*
 doc/tags.xml
+.DS_Store

.gitlab-ci.yml

@@ -3,6 +3,7 @@ variables:
   BUILD_IMAGES_PROJECT: libssh/build-images
   CENTOS8_BUILD: buildenv-c8s
   CENTOS9_BUILD: buildenv-c9s
+  CENTOS10_BUILD: buildenv-c10s
   FEDORA_BUILD: buildenv-fedora
   MINGW_BUILD: buildenv-mingw
   TUMBLEWEED_BUILD: buildenv-tumbleweed
@@ -16,7 +17,7 @@ stages:
   - analysis
 
 # This is some black magic to select between branch pipelines and
-# merge request pipelines to avoid running same pipelines in twice
+# merge request pipelines to avoid running same pipelines twice
 workflow:
   rules:
     - if: '$CI_COMMIT_BRANCH && $CI_OPEN_MERGE_REQUESTS && $CI_PIPELINE_SOURCE == "push"'
@@ -26,13 +27,17 @@ workflow:
       when: never
     - if: '$CI_COMMIT_BRANCH'
 
-.build:
+.build_options:
-  stage: build
   variables:
     CMAKE_DEFAULT_OPTIONS: "-DCMAKE_BUILD_TYPE=RelWithDebInfo -DPICKY_DEVELOPER=ON"
-    CMAKE_BUILD_OPTIONS: "-DWITH_BLOWFISH_CIPHER=ON -DWITH_SFTP=ON -DWITH_SERVER=ON -DWITH_ZLIB=ON -DWITH_PCAP=ON -DWITH_DEBUG_CRYPTO=ON -DWITH_DEBUG_PACKET=ON -DWITH_DEBUG_CALLTRACE=ON"
+    CMAKE_DEFAULT_DEBUG_OPTIONS: "-DCMAKE_C_FLAGS='-O0 -g -ggdb' -DPICKY_DEVELOPER=ON"
+    CMAKE_BUILD_OPTIONS: "-DWITH_BLOWFISH_CIPHER=ON -DWITH_SFTP=ON -DWITH_SERVER=ON -DWITH_ZLIB=ON -DWITH_PCAP=ON -DWITH_FIDO2=ON -DWITH_DEBUG_CRYPTO=ON -DWITH_DEBUG_PACKET=ON -DWITH_DEBUG_CALLTRACE=ON"
     CMAKE_TEST_OPTIONS: "-DUNIT_TESTING=ON -DCLIENT_TESTING=ON -DSERVER_TESTING=ON -DGSSAPI_TESTING=ON -DWITH_BENCHMARKS=ON -DFUZZ_TESTING=ON"
     CMAKE_OPTIONS: $CMAKE_DEFAULT_OPTIONS $CMAKE_BUILD_OPTIONS $CMAKE_TEST_OPTIONS
+
+.build:
+  extends: .build_options
+  stage: build
   before_script: &build
     - uname -a
     - cat /etc/os-release
@@ -74,12 +79,46 @@ workflow:
 .fedora:
   extends: .tests
   image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$FEDORA_BUILD
-  variables:
-    CMAKE_ADDITIONAL_OPTIONS: -DWITH_PKCS11_URI=ON
 
 .tumbleweed:
   extends: .tests
   image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$TUMBLEWEED_BUILD
+  script:
+    # torture_gssapi_key_exchange_null is excluded because of a bug
+    # https://bugzilla.opensuse.org/show_bug.cgi?id=1254680
+    - cmake $CMAKE_OPTIONS $CMAKE_ADDITIONAL_OPTIONS .. &&
+      make -j$(nproc) &&
+      ctest --output-on-failure -E "^torture_gssapi_key_exchange_null$"
+
+.centos:
+  extends: .tests
+  variables:
+    OPENSSL_ENABLE_SHA1_SIGNATURES: 1
+
+.centos10:
+  extends: .centos
+  image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$CENTOS10_BUILD
+
+.centos9:
+  extends: .centos
+  image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$CENTOS9_BUILD
+
+# Unit testing only, no client and pkd testing, because cwrap is not available
+# for MinGW
+.mingw:
+  extends: .tests
+  variables:
+    WINEDEBUG: -all
+  script:
+    - $WINEBIN $CMAKE_DEFAULT_OPTIONS
+      -DWITH_SFTP=ON
+      -DWITH_SERVER=ON
+      -DWITH_ZLIB=ON
+      -DWITH_PCAP=ON
+      -DWITH_FIDO2=ON
+      -DUNIT_TESTING=ON .. &&
+      make -j$(nproc) &&
+      ctest --output-on-failure -E torture_rand
 
 .fips:
   extends: .tests
@@ -107,7 +146,7 @@ review:
   image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$FEDORA_BUILD
   script:
     - ERROR=0
-      codespell --ignore-words-list=keypair,sorce,ned,nd,ue || ERROR=1;
+      codespell --ignore-words-list=keypair,sorce,ned,nd,ue,pendin || ERROR=1;
       ./.gitlab-ci/clang-format-check.sh || ERROR=1;
       ./.gitlab-ci/git-check-signoff-trailer.sh ${CI_MERGE_REQUEST_DIFF_BASE_SHA} || ERROR=1;
       ./.gitlab-ci/shellcheck.sh || ERROR=1;
@@ -122,13 +161,31 @@ review:
 ###############################################################################
 #                               CentOS builds                                 #
 ###############################################################################
-centos9s/openssl_3.0.x/x86_64:
+centos10s/openssl_3.5.x/x86_64:
-  image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$CENTOS9_BUILD
+  extends: .centos10
-  extends: .tests
   variables:
-    CMAKE_ADDITIONAL_OPTIONS: -DWITH_PKCS11_URI=ON
+    CMAKE_ADDITIONAL_OPTIONS: -DWITH_PKCS11_URI=ON -DWITH_PKCS11_PROVIDER=ON
+  script:
+    - cmake $CMAKE_OPTIONS $CMAKE_ADDITIONAL_OPTIONS .. &&
+      make -j$(nproc) &&
+      ctest --output-on-failure
+
+centos10s/openssl_3.5.x/x86_64/fips:
+  extends: .fips
+  image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$CENTOS10_BUILD
+  variables:
+    CMAKE_ADDITIONAL_OPTIONS: -DWITH_PKCS11_URI=ON -DWITH_PKCS11_PROVIDER=ON
+    OPENSSL_ENABLE_SHA1_SIGNATURES: 1
+  script:
+    - cmake $CMAKE_OPTIONS $CMAKE_ADDITIONAL_OPTIONS .. &&
+      make -j$(nproc) &&
+      OPENSSL_FORCE_FIPS_MODE=1 ctest --output-on-failure
+
+centos9s/openssl_3.5.x/x86_64:
+  extends: .centos9
+  variables:
+    CMAKE_ADDITIONAL_OPTIONS: -DWITH_PKCS11_URI=ON -DWITH_PKCS11_PROVIDER=ON
   script:
-    - export OPENSSL_ENABLE_SHA1_SIGNATURES=1
     - cmake $CMAKE_OPTIONS $CMAKE_ADDITIONAL_OPTIONS .. &&
       make -j$(nproc) &&
       ctest --output-on-failure
@@ -139,14 +196,17 @@ centos9s/mbedtls_2.x/x86_64:
   variables:
     CMAKE_ADDITIONAL_OPTIONS: "-DWITH_MBEDTLS=ON -DWITH_DEBUG_CRYPTO=ON -DWITH_BLOWFISH_CIPHER=OFF"
 
-centos9s/openssl_3.0.x/x86_64/fips:
+centos9s/openssl_3.5.x/x86_64/fips:
   extends: .fips
   image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$CENTOS9_BUILD
+  variables:
+    OPENSSL_ENABLE_SHA1_SIGNATURES: 1
   script:
-    - export OPENSSL_ENABLE_SHA1_SIGNATURES=1
+    # torture_gssapi_key_exchange_* tests are excluded because gssapi-keyex is disabled
+    # by OpenSSH in FIPS mode in RHEL 9
     - cmake $CMAKE_OPTIONS $CMAKE_ADDITIONAL_OPTIONS .. &&
       make -j$(nproc) &&
-      OPENSSL_FORCE_FIPS_MODE=1 ctest --output-on-failure
+      OPENSSL_FORCE_FIPS_MODE=1 ctest --output-on-failure -E "^torture_gssapi_key_exchange.*"
 
 centos8s/openssl_1.1.1/x86_64:
   image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$CENTOS8_BUILD
@@ -162,9 +222,11 @@ centos8s/openssl_1.1.1/x86_64/fips:
   extends: .fips
   image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$CENTOS8_BUILD
   script:
+    # torture_gssapi_key_exchange_* and torture_gssapi_server_key_exchange_* tests are excluded
+    # because gssapi-keyex is not allowed in FIPS mode in RHEL 8
     - cmake $CMAKE_OPTIONS $CMAKE_ADDITIONAL_OPTIONS .. &&
       make -j$(nproc) &&
-      OPENSSL_FORCE_FIPS_MODE=1 ctest --output-on-failure
+      OPENSSL_FORCE_FIPS_MODE=1 ctest --output-on-failure -E "^torture_gssapi.*key_exchange.*"
 
 ###############################################################################
 #                               Fedora builds                                 #
@@ -177,14 +239,16 @@ fedora/docs:
   extends: .build
   image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$FEDORA_BUILD
   script:
-    - cmake .. && make docs_coverage && make docs
+    - cmake -DWITH_INTERNAL_DOC=ON .. && make docs_coverage && make docs
   coverage: '/^Documentation coverage is \d+.\d+%/'
 
 fedora/ninja:
   extends: .fedora
   image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$FEDORA_BUILD
+  variables:
+    CTEST_OUTPUT_ON_FAILURE: 1
   script:
-    - cmake -G Ninja $CMAKE_OPTIONS ../ && ninja && CTEST_OUTPUT_ON_FAILURE=1 ninja test
+    - cmake -G Ninja $CMAKE_OPTIONS ../ && ninja && ninja test
 
 fedora/coverage:
   extends: .fedora
@@ -204,15 +268,15 @@ fedora/coverage:
         coverage_format: cobertura
         path: obj/coverage_xml.xml
 
-fedora/openssl_3.0.x/x86_64:
+fedora/openssl_3.x/x86_64:
   extends: .fedora
 
-fedora/openssl_3.0.x/x86_64/pkcs11-provider:
+fedora/openssl_3.x/x86_64/pkcs11-provider:
   variables:
     CMAKE_ADDITIONAL_OPTIONS: -DWITH_PKCS11_URI=ON -DWITH_PKCS11_PROVIDER=ON
   extends: .fedora
 
-fedora/openssl_3.0.x/x86_64/minimal:
+fedora/openssl_3.x/x86_64/minimal:
   extends: .fedora
   variables:
   script:
@@ -222,9 +286,10 @@ fedora/openssl_3.0.x/x86_64/minimal:
       -DWITH_SERVER=OFF
       -DWITH_ZLIB=OFF
       -DWITH_PCAP=OFF
+      -DWITH_GSSAPI=OFF
+      -DWITH_GEX=OFF
       -DUNIT_TESTING=ON
-      -DCLIENT_TESTING=ON
+      -DCLIENT_TESTING=ON .. &&
-      -DWITH_GEX=OFF .. &&
       make -j$(nproc)
 
 .valgrind:
@@ -236,6 +301,37 @@ fedora/openssl_3.0.x/x86_64/minimal:
       make test_memcheck
     - cat Testing/Temporary/MemoryChecker.*.log | wc -l | grep "^0$"
 
+fedora/libressl/x86_64:
+  extends: .fedora
+  stage: test
+  image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$FEDORA_BUILD
+  variables:
+    LIBRESSL_VERSION: "4.2.1"
+    CMAKE_ADDITIONAL_OPTIONS: >
+      -DCMAKE_C_FLAGS="-I/opt/libressl/include"
+      -DOPENSSL_ROOT_DIR=/opt/libressl
+      -DOPENSSL_INCLUDE_DIR=/opt/libressl/include
+      -DOPENSSL_CRYPTO_LIBRARY=/opt/libressl/lib/libcrypto.so
+      -DOPENSSL_SSL_LIBRARY=/opt/libressl/lib/libssl.so
+      -DWITH_GSSAPI=OFF
+      -DWITH_FIDO2=OFF
+  before_script:
+    - *build
+    - dnf install -y perl-core autoconf automake libtool pkgconf-pkg-config
+    - curl -LO https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-${LIBRESSL_VERSION}.tar.gz
+    - tar xf libressl-${LIBRESSL_VERSION}.tar.gz
+    - cd libressl-${LIBRESSL_VERSION}
+    - ./configure --prefix=/opt/libressl
+    - make -j$(nproc)
+    - make install
+    - cd ..
+  script:
+    - export PKG_CONFIG_PATH=/opt/libressl/lib/pkgconfig
+    - export LD_LIBRARY_PATH=/opt/libressl/lib
+    - cmake $CMAKE_OPTIONS $CMAKE_ADDITIONAL_OPTIONS .. &&
+      make -j$(nproc) &&
+      ctest --output-on-failure
+
 # The PKCS#11 support is turned off as it brings dozens of memory issues from
 # engine_pkcs11 or openssl itself
 fedora/valgrind/openssl:
@@ -306,47 +402,26 @@ fedora/undefined-sanitizer:
 fedora/libgcrypt/x86_64:
   extends: .fedora
   variables:
-    CMAKE_ADDITIONAL_OPTIONS: "-DWITH_GCRYPT=ON -DWITH_DEBUG_CRYPTO=ON"
+    CMAKE_ADDITIONAL_OPTIONS: "-DWITH_GCRYPT=ON"
 
-fedora/mbedtls_2.x/x86_64:
+fedora/mbedtls_3.x/x86_64:
   extends: .fedora
   variables:
-    CMAKE_ADDITIONAL_OPTIONS: "-DWITH_MBEDTLS=ON -DWITH_DEBUG_CRYPTO=ON "
+    CMAKE_ADDITIONAL_OPTIONS: "-DWITH_MBEDTLS=ON"
 
-# Unit testing only, no client and pkd testing, because cwrap is not available
-# for MinGW
 fedora/mingw64:
   image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$MINGW_BUILD
-  extends: .tests
+  extends: .mingw
-  script:
+  variables:
-    - export WINEPATH=/usr/x86_64-w64-mingw32/sys-root/mingw/bin
+    WINEPATH: /usr/x86_64-w64-mingw32/sys-root/mingw/bin
-    - export WINEDEBUG=-all
+    WINEBIN: mingw64-cmake
-    - mingw64-cmake $CMAKE_DEFAULT_OPTIONS
-      -DWITH_SFTP=ON
-      -DWITH_SERVER=ON
-      -DWITH_ZLIB=ON
-      -DWITH_PCAP=ON
-      -DUNIT_TESTING=ON .. &&
-      make -j$(nproc) &&
-      ctest --output-on-failure
 
-# Unit testing only, no client and pkd testing, because cwrap is not available
-# for MinGW
 fedora/mingw32:
   image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$MINGW_BUILD
-  extends: .tests
+  extends: .mingw
-  script:
+  variables:
-    - export WINEPATH=/usr/i686-w64-mingw32/sys-root/mingw/bin
+    WINEPATH: /usr/i686-w64-mingw32/sys-root/mingw/bin
-    - export WINEDEBUG=-all
+    WINEBIN: mingw32-cmake
-    - mingw32-cmake $CMAKE_DEFAULT_OPTIONS
-      -DWITH_SFTP=ON
-      -DWITH_SERVER=ON
-      -DWITH_ZLIB=ON
-      -DWITH_PCAP=ON
-      -DUNIT_TESTING=ON .. &&
-      make -j$(nproc) &&
-      ctest --output-on-failure
-
 
 ###############################################################################
 #                               Fedora csbuild                                #
@@ -355,6 +430,8 @@ fedora/mingw32:
   stage: analysis
   variables:
     GIT_DEPTH: "100"
+    CSCPPC_ADD_OPTS: "--library=./.gitlab-ci/cmocka.cfg"
+    CMAKE_OPTIONS: "-DCMAKE_BUILD_TYPE=Debug -DPICKY_DEVELOPER=ON -DUNIT_TESTING=ON -DCLIENT_TESTING=ON -DSERVER_TESTING=ON -DFUZZ_TESTING=ON"
   image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$FEDORA_BUILD
   before_script:
     - |
@@ -372,6 +449,14 @@ fedora/mingw32:
       git branch --contains $CI_COMMIT_BEFORE_SHA 2>/dev/null || export CI_COMMIT_BEFORE_SHA=$(git rev-parse "${CI_COMMIT_SHA}~20")
 
       export CI_COMMIT_RANGE="$CI_COMMIT_BEFORE_SHA..$CI_COMMIT_SHA"
+  script:
+    - csbuild
+      --build-dir=obj-csbuild
+      --build-cmd "rm -rf CMakeFiles CMakeCache.txt && cmake $CMAKE_OPTIONS $CMAKE_ADDITIONAL_OPTIONS @SRCDIR@ && make clean && make -j$(nproc)"
+      --git-commit-range $CI_COMMIT_RANGE
+      --color
+      --print-current --print-fixed
+
   tags:
     - saas-linux-small-amd64
   except:
@@ -384,36 +469,75 @@ fedora/mingw32:
     paths:
       - obj-csbuild/
 
-fedora/csbuild/openssl_3.0.x:
+fedora/csbuild/openssl_3.x:
   extends: .csbuild
-  script:
-    - csbuild
-      --build-dir=obj-csbuild
-      --build-cmd "rm -rf CMakeFiles CMakeCache.txt && cmake -DCMAKE_BUILD_TYPE=Debug -DPICKY_DEVELOPER=ON -DUNIT_TESTING=ON -DCLIENT_TESTING=ON -DSERVER_TESTING=ON -DFUZZ_TESTING=ON @SRCDIR@ && make clean && make -j$(nproc)"
-      --git-commit-range $CI_COMMIT_RANGE
-      --color
-      --print-current --print-fixed
 
 fedora/csbuild/libgcrypt:
   extends: .csbuild
-  script:
+  variables:
-    - csbuild
+    CMAKE_ADDITIONAL_OPTIONS: -DWITH_GCRYPT=ON
-      --build-dir=obj-csbuild
-      --build-cmd "rm -rf CMakeFiles CMakeCache.txt && cmake -DCMAKE_BUILD_TYPE=Debug -DPICKY_DEVELOPER=ON -DUNIT_TESTING=ON -DCLIENT_TESTING=ON -DSERVER_TESTING=ON -DFUZZ_TESTING=ON -DWITH_GCRYPT=ON @SRCDIR@ && make clean && make -j$(nproc)"
-      --git-commit-range $CI_COMMIT_RANGE
-      --color
-      --print-current --print-fixed
 
 fedora/csbuild/mbedtls:
   extends: .csbuild
-  script:
+  variables:
-    - csbuild
+    CMAKE_ADDITIONAL_OPTIONS: -DWITH_MBEDTLS=ON
-      --build-dir=obj-csbuild
-      --build-cmd "rm -rf CMakeFiles CMakeCache.txt && cmake -DCMAKE_BUILD_TYPE=Debug -DPICKY_DEVELOPER=ON -DUNIT_TESTING=ON -DCLIENT_TESTING=ON -DSERVER_TESTING=ON -DFUZZ_TESTING=ON -DWITH_MBEDTLS=ON @SRCDIR@ && make clean && make -j$(nproc)"
-      --git-commit-range $CI_COMMIT_RANGE
-      --color
-      --print-current --print-fixed
 
+###############################################################################
+#                               Fedora abidiff                                #
+###############################################################################
+
+fedora/abidiff:
+  stage: analysis
+  variables:
+    GIT_DEPTH: "100"
+    CMAKE_OPTIONS: $CMAKE_DEFAULT_DEBUG_OPTIONS $CMAKE_BUILD_OPTIONS
+  image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$FEDORA_BUILD
+  before_script:
+    - uname -a
+    - cat /etc/os-release
+    - mount
+    - df -h
+    - cat /proc/swaps
+    - free -h
+    - |
+      # for merge requests
+      if [[ -n "$CI_MERGE_REQUEST_DIFF_BASE_SHA" ]]; then
+          export CI_COMMIT_BEFORE_SHA="$CI_MERGE_REQUEST_DIFF_BASE_SHA"
+      fi
+      # for branches run
+      if [[ -z "$CI_COMMIT_BEFORE_SHA" ]]; then
+          export CI_COMMIT_BEFORE_SHA=$(git rev-parse "${CI_COMMIT_SHA}~20")
+      fi
+
+      # Check if the commit exists in this branch
+      # This is not the case for a force push
+      git branch --contains $CI_COMMIT_BEFORE_SHA 2>/dev/null || export CI_COMMIT_BEFORE_SHA=$(git rev-parse "${CI_COMMIT_SHA}~20")
+
+    - mkdir -p obj-${CI_COMMIT_BEFORE_SHA}
+    - mkdir -p obj-${CI_COMMIT_SHA}
+
+    - export INSTALL_DIR1=$(pwd)/install/${CI_COMMIT_BEFORE_SHA}
+    - export INSTALL_DIR2=$(pwd)/install/${CI_COMMIT_SHA}
+  script:
+    - git checkout ${CI_COMMIT_BEFORE_SHA}
+    - pushd obj-${CI_COMMIT_BEFORE_SHA}
+    - cmake ${CMAKE_OPTIONS} -DCMAKE_INSTALL_PREFIX=${INSTALL_DIR1} .. &&
+      make -j$(nproc) && make -j$(nproc) install
+    - popd
+    - ls -l ${INSTALL_DIR1}/lib*/
+    - git checkout ${CI_COMMIT_SHA}
+    - pushd obj-${CI_COMMIT_SHA}
+    - cmake ${CMAKE_OPTIONS} -DCMAKE_INSTALL_PREFIX=${INSTALL_DIR2} .. &&
+      make -j$(nproc) && make -j$(nproc) install
+    - popd
+    - ls -l ${INSTALL_DIR2}/lib*/
+    - ./.gitlab-ci/checkabi.sh ${INSTALL_DIR1} ${INSTALL_DIR2}
+  tags:
+    - saas-linux-small-amd64
+  except:
+    - tags
+  only:
+    - merge_requests
 
 ###############################################################################
 #                               Ubuntu builds                                 #
@@ -421,12 +545,18 @@ fedora/csbuild/mbedtls:
 ubuntu/openssl_3.0.x/x86_64:
   image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$UBUNTU_BUILD
   extends: .tests
+  script:
+    # torture_gssapi_key_exchange_null is excluded because of a bug
+    # https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/2134527
+    - cmake $CMAKE_OPTIONS $CMAKE_ADDITIONAL_OPTIONS .. &&
+      make -j$(nproc) &&
+      ctest --output-on-failure -E "^torture_gssapi_key_exchange_null$"
 
 
 ###############################################################################
 #                               Alpine builds                                 #
 ###############################################################################
-alpine/openssl_3.0.x/musl:
+alpine/openssl_3.x/musl:
   image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$ALPINE_BUILD
   extends: .tests
   script:
@@ -443,10 +573,10 @@ alpine/openssl_3.0.x/musl:
 ###############################################################################
 #                             Tumbleweed builds                               #
 ###############################################################################
-tumbleweed/openssl_3.0.x/x86_64/gcc:
+tumbleweed/openssl_3.x/x86_64/gcc:
   extends: .tumbleweed
 
-tumbleweed/openssl_3.0.x/x86/gcc:
+tumbleweed/openssl_3.x/x86/gcc:
   extends: .tumbleweed
   script:
     - cmake
@@ -459,12 +589,12 @@ tumbleweed/openssl_3.0.x/x86/gcc:
       -DUNIT_TESTING=ON .. &&
       make -j$(nproc)
 
-tumbleweed/openssl_3.0.x/x86_64/gcc7:
+tumbleweed/openssl_3.x/x86_64/gcc7:
   extends: .tumbleweed
   variables:
     CMAKE_ADDITIONAL_OPTIONS: "-DCMAKE_C_COMPILER=gcc-7 -DCMAKE_CXX_COMPILER=g++-7"
 
-tumbleweed/openssl_3.0.x/x86/gcc7:
+tumbleweed/openssl_3.x/x86/gcc7:
   extends: .tumbleweed
   script:
     - cmake
@@ -476,7 +606,7 @@ tumbleweed/openssl_3.0.x/x86/gcc7:
       make -j$(nproc) &&
       ctest --output-on-failure
 
-tumbleweed/openssl_3.0.x/x86_64/clang:
+tumbleweed/openssl_3.x/x86_64/clang:
   extends: .tumbleweed
   variables:
     CMAKE_ADDITIONAL_OPTIONS: "-DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++"
@@ -486,13 +616,19 @@ tumbleweed/mbedtls-3.6.x/x86_64/gcc:
   variables:
     CMAKE_ADDITIONAL_OPTIONS: "-DKRB5_CONFIG=/usr/lib/mit/bin/krb5-config -DWITH_MBEDTLS=ON -DWITH_DEBUG_CRYPTO=ON -DWITH_BLOWFISH_CIPHER=OFF "
 
+tumbleweed/mbedtls-3.6.x/x86_64/clang:
+  extends: .tumbleweed
+  variables:
+    CMAKE_ADDITIONAL_OPTIONS: "-DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++ -DKRB5_CONFIG=/usr/lib/mit/bin/krb5-config -DWITH_MBEDTLS=ON -DWITH_DEBUG_CRYPTO=ON -DWITH_BLOWFISH_CIPHER=OFF "
+
 tumbleweed/static-analysis:
   extends: .tests
   stage: analysis
   image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$TUMBLEWEED_BUILD
+  variables:
+    CCC_CC: clang
+    CCC_CXX: clang++
   script:
-    - export CCC_CC=clang
-    - export CCC_CXX=clang++
     - scan-build cmake
       -DCMAKE_BUILD_TYPE=Debug
       -DCMAKE_C_COMPILER=clang
@@ -516,19 +652,12 @@ tumbleweed/static-analysis:
 freebsd/openssl_1.1.1/x86_64:
   image:
   extends: .tests
+  variables:
+    CMAKE_OPTIONS: $CMAKE_DEFAULT_OPTIONS -DWITH_SFTP=ON -DWITH_SERVER=ON -DWITH_ZLIB=ON -DWITH_PCAP=ON -DUNIT_TESTING=ON
   before_script:
-    - mkdir -p obj && cd obj && cmake
+    - mkdir -p obj && cd obj && cmake $CMAKE_OPTIONS ..
-      -DCMAKE_BUILD_TYPE=RelWithDebInfo
-      -DPICKY_DEVELOPER=ON
-      -DWITH_SFTP=ON -DWITH_SERVER=ON -DWITH_ZLIB=ON -DWITH_PCAP=ON
-      -DUNIT_TESTING=ON ..
   script:
-    - cmake $CMAKE_DEFAULT_OPTIONS
+    - cmake $CMAKE_OPTIONS .. &&
-      -DWITH_SFTP=ON
-      -DWITH_SERVER=ON
-      -DWITH_ZLIB=ON
-      -DWITH_PCAP=ON
-      -DUNIT_TESTING=ON .. &&
       make &&
       ctest --output-on-failure
   tags:
@@ -538,7 +667,6 @@ freebsd/openssl_1.1.1/x86_64:
     - branches@libssh/libssh-mirror
     - branches@cryptomilk/libssh-mirror
     - branches@jjelen/libssh-mirror
-    - branches@marco.fortina/libssh-mirror
 
 
 ###############################################################################
@@ -547,9 +675,7 @@ freebsd/openssl_1.1.1/x86_64:
 # 2024-05-13: These jobs run out of the stages as they take extremely long and
 # usually timeout with the update to Gitlab 17.0
 .vs:
-  stage: analysis
+  stage: test
-  needs: []
-  allow_failure: true
   cache:
     key: vcpkg.${CI_JOB_NAME}
     paths:
@@ -579,13 +705,14 @@ freebsd/openssl_1.1.1/x86_64:
     - vcpkg install cmocka
     - vcpkg install openssl
     - vcpkg install zlib
+    - vcpkg install libfido2
     - vcpkg integrate install
     - mkdir -p obj; if ($?) {cd obj}; if (! $?) {exit 1}
     - cmake
         -A $PLATFORM
         -DCMAKE_TOOLCHAIN_FILE=C:/vcpkg/scripts/buildsystems/vcpkg.cmake
         -DPICKY_DEVELOPER=ON
-        -DWITH_SFTP=ON -DWITH_SERVER=ON -DWITH_ZLIB=ON -DWITH_PCAP=ON
+        -DWITH_SFTP=ON -DWITH_SERVER=ON -DWITH_ZLIB=ON -DWITH_PCAP=ON -DWITH_FIDO2=ON
         -DUNIT_TESTING=ON ..
 
 visualstudio/x86_64:
@@ -641,3 +768,38 @@ coverity:
     when: on_failure
     paths:
       - obj/cov-int/*.txt
+
+###############################################################################
+#                                  MacOS                                      #
+###############################################################################
+.macos:
+  extends: .build_options
+  tags:
+    - saas-macos-medium-m1
+  image: macos-14-xcode-15
+  before_script:
+    - echo "MacOS runner started"
+    - brew update
+    - brew install cmake openssl cmocka doxygen
+    - mkdir obj && cd obj
+  only:
+    - branches@libssh/libssh-mirror
+    - branches@cryptomilk/libssh-mirror
+    - branches@jjelen/libssh-mirror
+
+# TODO add -DFUZZ_TESTING=ON clang cant find _LLVMFuzzerInitialize on arm64
+macos-m1:
+  extends: .macos
+  variables:
+    HOMEBREW_NO_AUTO_UPDATE: 1
+    CMAKE_TEST_OPTIONS: "-DUNIT_TESTING=ON"
+  stage: test
+  script:
+    - cmake $CMAKE_OPTIONS .. &&
+      make -j$(sysctl -n hw.logicalcpu) &&
+      ctest --output-on-failure
+  artifacts:
+    expire_in: 1 week
+    when: on_failure
+    paths:
+      - obj/

.gitlab-ci/checkabi.sh

@@ -0,0 +1,42 @@
+#!/bin/bash
+
+INSTALL_DIR1=${1}
+INSTALL_DIR2=${2}
+
+abidiff \
+    --headers-dir1 "${INSTALL_DIR1}/include/libssh/" \
+    --headers-dir2 "${INSTALL_DIR2}/include/libssh/" \
+    "${INSTALL_DIR1}/lib64/libssh.so" \
+    "${INSTALL_DIR2}/lib64/libssh.so" \
+    --fail-no-debug-info
+abiret=$?
+
+ABIDIFF_ERROR=$(((abiret & 0x01) != 0))
+ABIDIFF_USAGE_ERROR=$(((abiret & 0x02) != 0))
+ABIDIFF_ABI_CHANGE=$(((abiret & 0x04) != 0))
+ABIDIFF_ABI_INCOMPATIBLE_CHANGE=$(((abiret & 0x08) != 0))
+ABIDIFF_UNKNOWN_BIT_SET=$(((abiret & 0xf0) != 0))
+
+if [ $ABIDIFF_ERROR -ne 0 ]; then
+    echo "abidiff reported ABIDIFF_ERROR."
+    exit 1
+fi
+if [ $ABIDIFF_USAGE_ERROR -ne 0 ]; then
+    echo "abidiff reported ABIDIFF_USAGE_ERROR."
+    exit 1
+fi
+if [ $ABIDIFF_UNKNOWN_BIT_SET -ne 0 ]; then
+    echo "abidiff reported ABIDIFF_UNKNOWN_BIT_SET."
+    exit 1
+fi
+
+if [ $ABIDIFF_ABI_INCOMPATIBLE_CHANGE -ne 0 ]; then
+    echo "abidiff result ABIDIFF_ABI_INCOMPATIBLE_CHANGE, this breaks the API!"
+    exit 1
+fi
+
+if [ $ABIDIFF_ABI_CHANGE -ne 0 ]; then
+  echo "Ignoring abidiff result ABI_CHANGE"
+fi
+
+exit 0

.gitlab-ci/cmocka.cfg

@@ -0,0 +1,475 @@
+<?xml version="1.0"?>
+<!--
+  cppcheck library configuration for cmocka
+
+  This file provides cppcheck with information about cmocka's assertion functions
+  and their behavior, particularly that assertion failures do not return.
+
+  This helps cppcheck understand that after assert_non_null(ptr), the pointer
+  is guaranteed to be non-NULL, eliminating false positives like:
+    - nullPointerArithmeticOutOfMemory
+    - nullPointer
+    - etc.
+
+  Usage:
+    cppcheck --library=cmocka.cfg [other options] <source files>
+
+  For more information on cppcheck library format, see:
+    https://cppcheck.sourceforge.io/manual.html#library-configuration
+-->
+<def format="2">
+  <!-- Core functions -->
+  <function name="_fail">
+    <noreturn>true</noreturn>
+    <arg nr="1" direction="in">
+      <not-null/>
+    </arg>
+    <arg nr="2" direction="in"/>
+  </function>
+
+  <!-- Boolean assertions -->
+  <function name="_assert_true">
+    <arg nr="1" direction="in">
+      <valid>arg1 != 0</valid>
+    </arg>
+    <arg nr="2" direction="in">
+      <not-null/>
+    </arg>
+    <arg nr="3" direction="in">
+      <not-null/>
+    </arg>
+    <arg nr="4" direction="in"/>
+  </function>
+
+  <function name="_assert_false">
+    <arg nr="1" direction="in">
+      <valid>arg1 == 0</valid>
+    </arg>
+    <arg nr="2" direction="in">
+      <not-null/>
+    </arg>
+    <arg nr="3" direction="in">
+      <not-null/>
+    </arg>
+    <arg nr="4" direction="in"/>
+  </function>
+
+  <!-- Pointer assertions -->
+  <function name="_assert_ptr_equal_msg">
+    <arg nr="1" direction="in">
+      <valid>arg1 == arg2</valid>
+    </arg>
+    <arg nr="2" direction="in"/>
+    <arg nr="3" direction="in">
+      <not-null/>
+    </arg>
+    <arg nr="4" direction="in"/>
+    <arg nr="5" direction="in"/>
+  </function>
+
+  <function name="_assert_ptr_not_equal_msg">
+    <arg nr="1" direction="in">
+      <valid>arg1 != arg2</valid>
+    </arg>
+    <arg nr="2" direction="in"/>
+    <arg nr="3" direction="in">
+      <not-null/>
+    </arg>
+    <arg nr="4" direction="in"/>
+    <arg nr="5" direction="in"/>
+  </function>
+
+  <!-- Integer assertions -->
+  <function name="_assert_int_equal">
+    <arg nr="1" direction="in">
+      <valid>arg1 == arg2</valid>
+    </arg>
+    <arg nr="2" direction="in"/>
+    <arg nr="3" direction="in">
+      <not-null/>
+    </arg>
+    <arg nr="4" direction="in"/>
+  </function>
+
+  <function name="_assert_int_not_equal">
+    <arg nr="1" direction="in">
+      <valid>arg1 != arg2</valid>
+    </arg>
+    <arg nr="2" direction="in"/>
+    <arg nr="3" direction="in">
+      <not-null/>
+    </arg>
+    <arg nr="4" direction="in"/>
+  </function>
+
+  <function name="_assert_uint_equal">
+    <arg nr="1" direction="in">
+      <valid>arg1 == arg2</valid>
+    </arg>
+    <arg nr="2" direction="in"/>
+    <arg nr="3" direction="in">
+      <not-null/>
+    </arg>
+    <arg nr="4" direction="in"/>
+  </function>
+
+  <function name="_assert_uint_not_equal">
+    <arg nr="1" direction="in">
+      <valid>arg1 != arg2</valid>
+    </arg>
+    <arg nr="2" direction="in"/>
+    <arg nr="3" direction="in">
+      <not-null/>
+    </arg>
+    <arg nr="4" direction="in"/>
+  </function>
+
+  <!-- Float/double assertions -->
+  <function name="_assert_float_equal">
+    <arg nr="1" direction="in"/>
+    <arg nr="2" direction="in"/>
+    <arg nr="3" direction="in"/>
+    <arg nr="4" direction="in">
+      <not-null/>
+    </arg>
+    <arg nr="5" direction="in"/>
+  </function>
+
+  <function name="_assert_float_not_equal">
+    <arg nr="1" direction="in"/>
+    <arg nr="2" direction="in"/>
+    <arg nr="3" direction="in"/>
+    <arg nr="4" direction="in">
+      <not-null/>
+    </arg>
+    <arg nr="5" direction="in"/>
+  </function>
+
+  <function name="_assert_double_equal">
+    <arg nr="1" direction="in"/>
+    <arg nr="2" direction="in"/>
+    <arg nr="3" direction="in"/>
+    <arg nr="4" direction="in">
+      <not-null/>
+    </arg>
+    <arg nr="5" direction="in"/>
+  </function>
+
+  <function name="_assert_double_not_equal">
+    <arg nr="1" direction="in"/>
+    <arg nr="2" direction="in"/>
+    <arg nr="3" direction="in"/>
+    <arg nr="4" direction="in">
+      <not-null/>
+    </arg>
+    <arg nr="5" direction="in"/>
+  </function>
+
+  <!-- String assertions -->
+  <function name="_assert_string_equal">
+    <arg nr="1" direction="in">
+      <not-null/>
+    </arg>
+    <arg nr="2" direction="in">
+      <not-null/>
+    </arg>
+    <arg nr="3" direction="in">
+      <not-null/>
+    </arg>
+    <arg nr="4" direction="in"/>
+  </function>
+
+  <function name="_assert_string_not_equal">
+    <arg nr="1" direction="in">
+      <not-null/>
+    </arg>
+    <arg nr="2" direction="in">
+      <not-null/>
+    </arg>
+    <arg nr="3" direction="in">
+      <not-null/>
+    </arg>
+    <arg nr="4" direction="in"/>
+  </function>
+
+  <!-- Memory assertions -->
+  <function name="_assert_memory_equal">
+    <arg nr="1" direction="in">
+      <not-null/>
+    </arg>
+    <arg nr="2" direction="in">
+      <not-null/>
+    </arg>
+    <arg nr="3" direction="in"/>
+    <arg nr="4" direction="in">
+      <not-null/>
+    </arg>
+    <arg nr="5" direction="in"/>
+  </function>
+
+  <function name="_assert_memory_not_equal">
+    <arg nr="1" direction="in">
+      <not-null/>
+    </arg>
+    <arg nr="2" direction="in">
+      <not-null/>
+    </arg>
+    <arg nr="3" direction="in"/>
+    <arg nr="4" direction="in">
+      <not-null/>
+    </arg>
+    <arg nr="5" direction="in"/>
+  </function>
+
+  <!-- Range assertions -->
+  <function name="_assert_int_in_range">
+    <arg nr="1" direction="in">
+      <valid>arg2 &lt;= arg1 &amp;&amp; arg1 &lt;= arg3</valid>
+    </arg>
+    <arg nr="2" direction="in"/>
+    <arg nr="3" direction="in"/>
+    <arg nr="4" direction="in">
+      <not-null/>
+    </arg>
+    <arg nr="5" direction="in"/>
+  </function>
+
+  <function name="_assert_int_not_in_range">
+    <arg nr="1" direction="in">
+      <valid>arg1 &lt; arg2 || arg3 &lt; arg1</valid>
+    </arg>
+    <arg nr="2" direction="in"/>
+    <arg nr="3" direction="in"/>
+    <arg nr="4" direction="in">
+      <not-null/>
+    </arg>
+    <arg nr="5" direction="in"/>
+  </function>
+
+  <function name="_assert_uint_in_range">
+    <arg nr="1" direction="in">
+      <valid>arg2 &lt;= arg1 &amp;&amp; arg1 &lt;= arg3</valid>
+    </arg>
+    <arg nr="2" direction="in"/>
+    <arg nr="3" direction="in"/>
+    <arg nr="4" direction="in">
+      <not-null/>
+    </arg>
+    <arg nr="5" direction="in"/>
+  </function>
+
+  <function name="_assert_uint_not_in_range">
+    <arg nr="1" direction="in">
+      <valid>arg1 &lt; arg2 || arg3 &lt; arg1</valid>
+    </arg>
+    <arg nr="2" direction="in"/>
+    <arg nr="3" direction="in"/>
+    <arg nr="4" direction="in">
+      <not-null/>
+    </arg>
+    <arg nr="5" direction="in"/>
+  </function>
+
+  <function name="_assert_float_in_range">
+    <arg nr="1" direction="in"/>
+    <arg nr="2" direction="in"/>
+    <arg nr="3" direction="in"/>
+    <arg nr="4" direction="in"/>
+    <arg nr="5" direction="in">
+      <not-null/>
+    </arg>
+    <arg nr="6" direction="in"/>
+  </function>
+
+  <function name="_assert_float_not_in_range">
+    <arg nr="1" direction="in"/>
+    <arg nr="2" direction="in"/>
+    <arg nr="3" direction="in"/>
+    <arg nr="4" direction="in"/>
+    <arg nr="5" direction="in">
+      <not-null/>
+    </arg>
+    <arg nr="6" direction="in"/>
+  </function>
+
+  <!-- Set assertions -->
+  <function name="_assert_int_in_set">
+    <arg nr="1" direction="in"/>
+    <arg nr="2" direction="in">
+      <not-null/>
+    </arg>
+    <arg nr="3" direction="in"/>
+    <arg nr="4" direction="in">
+      <not-null/>
+    </arg>
+    <arg nr="5" direction="in">
+      <not-null/>
+    </arg>
+    <arg nr="6" direction="in"/>
+  </function>
+
+  <function name="_assert_int_not_in_set">
+    <arg nr="1" direction="in"/>
+    <arg nr="2" direction="in">
+      <not-null/>
+    </arg>
+    <arg nr="3" direction="in"/>
+    <arg nr="4" direction="in">
+      <not-null/>
+    </arg>
+    <arg nr="5" direction="in">
+      <not-null/>
+    </arg>
+    <arg nr="6" direction="in"/>
+  </function>
+
+  <function name="_assert_uint_in_set">
+    <arg nr="1" direction="in"/>
+    <arg nr="2" direction="in">
+      <not-null/>
+    </arg>
+    <arg nr="3" direction="in"/>
+    <arg nr="4" direction="in">
+      <not-null/>
+    </arg>
+    <arg nr="5" direction="in">
+      <not-null/>
+    </arg>
+    <arg nr="6" direction="in"/>
+  </function>
+
+  <function name="_assert_uint_not_in_set">
+    <arg nr="1" direction="in"/>
+    <arg nr="2" direction="in">
+      <not-null/>
+    </arg>
+    <arg nr="3" direction="in"/>
+    <arg nr="4" direction="in">
+      <not-null/>
+    </arg>
+    <arg nr="5" direction="in">
+      <not-null/>
+    </arg>
+    <arg nr="6" direction="in"/>
+  </function>
+
+  <function name="_assert_not_in_set">
+    <arg nr="1" direction="in"/>
+    <arg nr="2" direction="in">
+      <not-null/>
+    </arg>
+    <arg nr="3" direction="in"/>
+    <arg nr="4" direction="in">
+      <not-null/>
+    </arg>
+    <arg nr="5" direction="in">
+      <not-null/>
+    </arg>
+    <arg nr="6" direction="in"/>
+  </function>
+
+  <function name="_assert_float_in_set">
+    <arg nr="1" direction="in"/>
+    <arg nr="2" direction="in">
+      <not-null/>
+    </arg>
+    <arg nr="3" direction="in"/>
+    <arg nr="4" direction="in"/>
+    <arg nr="5" direction="in">
+      <not-null/>
+    </arg>
+    <arg nr="6" direction="in">
+      <not-null/>
+    </arg>
+    <arg nr="7" direction="in"/>
+  </function>
+
+  <function name="_assert_float_not_in_set">
+    <arg nr="1" direction="in"/>
+    <arg nr="2" direction="in">
+      <not-null/>
+    </arg>
+    <arg nr="3" direction="in"/>
+    <arg nr="4" direction="in"/>
+    <arg nr="5" direction="in">
+      <not-null/>
+    </arg>
+    <arg nr="6" direction="in">
+      <not-null/>
+    </arg>
+    <arg nr="7" direction="in"/>
+  </function>
+
+  <!-- Return code assertion -->
+  <function name="_assert_return_code">
+    <arg nr="1" direction="in">
+      <valid>0 &lt;= arg1</valid>
+    </arg>
+    <arg nr="2" direction="in"/>
+    <arg nr="3" direction="in">
+      <not-null/>
+    </arg>
+    <arg nr="4" direction="in">
+      <not-null/>
+    </arg>
+    <arg nr="5" direction="in"/>
+  </function>
+
+  <!-- Macro definitions -->
+  <!-- Boolean macros -->
+  <define name="assert_true(c)" value="_assert_true(cast_to_uintmax_type(c), #c, __FILE__, __LINE__)"/>
+  <define name="assert_false(c)" value="_assert_false(cast_to_uintmax_type(c), #c, __FILE__, __LINE__)"/>
+
+  <!-- Pointer macros -->
+  <define name="assert_non_null(c)" value="assert_ptr_not_equal((c), NULL)"/>
+  <define name="assert_non_null_msg(c, msg)" value="assert_ptr_not_equal_msg((c), NULL, (msg))"/>
+  <define name="assert_null(c)" value="assert_ptr_equal((c), NULL)"/>
+  <define name="assert_null_msg(c, msg)" value="assert_ptr_equal_msg((c), NULL, (msg))"/>
+  <define name="assert_ptr_equal(a, b)" value="assert_ptr_equal_msg((a), (b), NULL)"/>
+  <define name="assert_ptr_equal_msg(a, b, msg)" value="_assert_ptr_equal_msg((const void*)(a), (const void*)(b), __FILE__, __LINE__, (msg))"/>
+  <define name="assert_ptr_not_equal(a, b)" value="_assert_ptr_not_equal_msg((const void*)(a), (const void*)(b), __FILE__, __LINE__, NULL)"/>
+  <define name="assert_ptr_not_equal_msg(a, b, msg)" value="_assert_ptr_not_equal_msg((const void*)(a), (const void*)(b), __FILE__, __LINE__, (msg))"/>
+
+  <!-- Integer macros -->
+  <define name="assert_int_equal(a, b)" value="_assert_int_equal(cast_to_intmax_type(a), cast_to_intmax_type(b), __FILE__, __LINE__)"/>
+  <define name="assert_int_not_equal(a, b)" value="_assert_int_not_equal(cast_to_intmax_type(a), cast_to_intmax_type(b), __FILE__, __LINE__)"/>
+  <define name="assert_uint_equal(a, b)" value="_assert_uint_equal(cast_to_uintmax_type(a), cast_to_uintmax_type(b), __FILE__, __LINE__)"/>
+  <define name="assert_uint_not_equal(a, b)" value="_assert_uint_not_equal(cast_to_uintmax_type(a), cast_to_uintmax_type(b), __FILE__, __LINE__)"/>
+
+  <!-- Float/double macros -->
+  <define name="assert_float_equal(a, b, epsilon)" value="_assert_float_equal((float)(a), (float)(b), (float)(epsilon), __FILE__, __LINE__)"/>
+  <define name="assert_float_not_equal(a, b, epsilon)" value="_assert_float_not_equal((float)(a), (float)(b), (float)(epsilon), __FILE__, __LINE__)"/>
+  <define name="assert_double_equal(a, b, epsilon)" value="_assert_double_equal((double)(a), (double)(b), (double)(epsilon), __FILE__, __LINE__)"/>
+  <define name="assert_double_not_equal(a, b, epsilon)" value="_assert_double_not_equal((double)(a), (double)(b), (double)(epsilon), __FILE__, __LINE__)"/>
+
+  <!-- String macros -->
+  <define name="assert_string_equal(a, b)" value="_assert_string_equal((const char*)(a), (const char*)(b), __FILE__, __LINE__)"/>
+  <define name="assert_string_not_equal(a, b)" value="_assert_string_not_equal((const char*)(a), (const char*)(b), __FILE__, __LINE__)"/>
+
+  <!-- Memory macros -->
+  <define name="assert_memory_equal(a, b, size)" value="_assert_memory_equal((const void*)(a), (const void*)(b), size, __FILE__, __LINE__)"/>
+  <define name="assert_memory_not_equal(a, b, size)" value="_assert_memory_not_equal((const void*)(a), (const void*)(b), size, __FILE__, __LINE__)"/>
+
+  <!-- Range macros -->
+  <define name="assert_int_in_range(value, minimum, maximum)" value="_assert_int_in_range(cast_to_intmax_type(value), cast_to_intmax_type(minimum), cast_to_intmax_type(maximum), __FILE__, __LINE__)"/>
+  <define name="assert_int_not_in_range(value, minimum, maximum)" value="_assert_int_not_in_range(cast_to_intmax_type(value), cast_to_intmax_type(minimum), cast_to_intmax_type(maximum), __FILE__, __LINE__)"/>
+  <define name="assert_uint_in_range(value, minimum, maximum)" value="_assert_uint_in_range(cast_to_uintmax_type(value), cast_to_uintmax_type(minimum), cast_to_uintmax_type(maximum), __FILE__, __LINE__)"/>
+  <define name="assert_uint_not_in_range(value, minimum, maximum)" value="_assert_uint_not_in_range(cast_to_uintmax_type(value), cast_to_uintmax_type(minimum), cast_to_uintmax_type(maximum), __FILE__, __LINE__)"/>
+  <define name="assert_in_range(value, minimum, maximum)" value="assert_uint_in_range(value, minimum, maximum)"/>
+  <define name="assert_not_in_range(value, minimum, maximum)" value="assert_uint_not_in_range(value, minimum, maximum)"/>
+  <define name="assert_float_in_range(value, minimum, maximum, epsilon)" value="_assert_float_in_range((double)(value), (double)(minimum), (double)(maximum), (double)(epsilon), __FILE__, __LINE__)"/>
+  <define name="assert_float_not_in_range(value, minimum, maximum, epsilon)" value="_assert_float_not_in_range((double)(value), (double)(minimum), (double)(maximum), (double)(epsilon), __FILE__, __LINE__)"/>
+
+  <!-- Set macros -->
+  <define name="assert_in_set(value, values, number_of_values)" value="_assert_not_in_set(cast_to_uintmax_type(value), (uintmax_t*)(values), number_of_values, __FILE__, __LINE__, 0)"/>
+  <define name="assert_not_in_set(value, values, number_of_values)" value="_assert_not_in_set(cast_to_uintmax_type(value), (uintmax_t*)(values), number_of_values, __FILE__, __LINE__, 1)"/>
+  <define name="assert_int_in_set(value, values, number_of_values)" value="_assert_int_in_set(cast_to_intmax_type(value), (intmax_t*)(values), number_of_values, __FILE__, __LINE__, 0)"/>
+  <define name="assert_int_not_in_set(value, values, number_of_values)" value="_assert_int_not_in_set(cast_to_intmax_type(value), (intmax_t*)(values), number_of_values, __FILE__, __LINE__, 1)"/>
+  <define name="assert_uint_in_set(value, values, number_of_values)" value="_assert_uint_in_set(cast_to_uintmax_type(value), (uintmax_t*)(values), number_of_values, __FILE__, __LINE__, 0)"/>
+  <define name="assert_uint_not_in_set(value, values, number_of_values)" value="_assert_uint_not_in_set(cast_to_uintmax_type(value), (uintmax_t*)(values), number_of_values, __FILE__, __LINE__, 1)"/>
+  <define name="assert_float_in_set(value, values, number_of_values, epsilon)" value="_assert_float_in_set((double)(value), (double*)(values), number_of_values, (double)(epsilon), __FILE__, __LINE__, 0)"/>
+  <define name="assert_float_not_in_set(value, values, number_of_values, epsilon)" value="_assert_float_not_in_set((double)(value), (double*)(values), number_of_values, (double)(epsilon), __FILE__, __LINE__, 1)"/>
+
+  <!-- Return code macro -->
+  <define name="assert_return_code(rc, error)" value="_assert_return_code(cast_to_intmax_type(rc), (int32_t)(error), #rc, __FILE__, __LINE__)"/>
+</def>

.gitlab-ci/local-ci.sh

@@ -0,0 +1,116 @@
+#!/usr/bin/env bash
+set -e
+
+RED="\033[1;31m"
+GREEN="\033[1;32m"
+YELLOW="\033[1;33m"
+BLUE="\033[1;34m"
+RESET="\033[0m"
+
+export GCL_IGNORE_PREDEFINED_VARS=CI_REGISTRY
+
+BASE_SHA=$(git merge-base HEAD origin/master 2>/dev/null || git rev-parse HEAD~1)
+
+COMMON_ARGS=(
+  --variable "CI_MERGE_REQUEST_DIFF_BASE_SHA=$BASE_SHA"
+  --variable "CI_REGISTRY=registry.gitlab.com"
+  --json-schema-validation=false
+)
+
+check_requirements() {
+  for cmd in docker git gitlab-ci-local; do
+    if ! command -v "$cmd" >/dev/null 2>&1; then
+      echo -e "${RED}Missing dependency: $cmd${RESET}"
+      exit 1
+    fi
+    echo -e "${GREEN}Found: $cmd${RESET}"
+  done
+
+  if ! docker info >/dev/null 2>&1; then
+    echo -e "${RED}Docker daemon is not running or permission denied${RESET}"
+    exit 1
+  fi
+}
+
+list_jobs() {
+  gitlab-ci-local --list --json-schema-validation=false | awk 'NR>1 {print $1}'
+}
+
+run_job() {
+  JOB="$1"
+  echo -e "${YELLOW}Running CI job: $JOB${RESET}"
+  gitlab-ci-local "$JOB" "${COMMON_ARGS[@]}"
+}
+
+cleanup_images() {
+  echo -e "${BLUE}Removing libssh CI images only...${RESET}"
+  docker images --format "{{.Repository}}:{{.Tag}} {{.ID}}" \
+    | grep "$CI_REGISTRY/$BUILD_IMAGES_PROJECT" \
+    | awk '{print $2}' \
+    | xargs -r docker rmi -f
+}
+
+usage() {
+  echo
+  echo -e "${BLUE}Usage:${RESET}"
+  echo "  $0 --list"
+  echo "  $0 --run <job-name>"
+  echo "  $0 --all"
+  echo "  $0 --run <job-name> --clean"
+  echo "  $0 --all --clean"
+  echo
+  exit 1
+}
+
+check_requirements
+
+CLEAN=0
+MODE=""
+JOB=""
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --list)
+      MODE="list"
+      shift
+      ;;
+    --run)
+      MODE="run"
+      JOB="$2"
+      shift 2
+      ;;
+    --all)
+      MODE="all"
+      shift
+      ;;
+    --clean)
+      CLEAN=1
+      shift
+      ;;
+    *)
+      usage
+      ;;
+  esac
+done
+
+case "$MODE" in
+  list)
+    list_jobs
+    ;;
+  run)
+    [[ -z "$JOB" ]] && usage
+    run_job "$JOB"
+    [[ "$CLEAN" -eq 1 ]] && cleanup_images
+    ;;
+  all)
+    for job in $(list_jobs); do
+      run_job "$job"
+      [[ "$CLEAN" -eq 1 ]] && cleanup_images
+    done
+    ;;
+  *)
+    usage
+    ;;
+esac
+
+echo -e "${GREEN}Done.${RESET}"

.gitlab/merge_request_templates/default.md

@@ -0,0 +1,16 @@
+Add a description of the new feature/bug fix. Reference any relevant bugs.
+
+## Checklist
+ * [ ] Commits have `Signed-off-by:` with name/author being identical to the commit author
+ * [ ] Code modified for feature
+ * [ ] Test suite updated with functionality tests
+ * [ ] Test suite updated with negative tests
+ * [ ] Documentation updated
+ * [ ] The project pipelines timeout is [extended](https://docs.gitlab.com/ee/ci/pipelines/settings.html#set-a-limit-for-how-long-jobs-can-run) at least to 2 hours.
+
+## Reviewer's checklist:
+ * [ ] Any issues marked for closing are addressed
+ * [ ] There is a test suite reasonably covering new functionality or modifications
+ * [ ] Function naming, parameters, return values, types, etc., are consistent and according to [CONTRIBUTING.md](https://gitlab.com/libssh/libssh-mirror/-/blob/master/CONTRIBUTING.md)
+ * [ ] This feature/change has adequate documentation added
+ * [ ] No obvious mistakes in the code

CMakeLists.txt

@@ -1,4 +1,4 @@
-cmake_minimum_required(VERSION 3.12.0)
+cmake_minimum_required(VERSION 3.14.0)
 
 # Specify search path for CMake modules to be loaded by include()
 # and find_package()
@@ -9,7 +9,7 @@ list(APPEND CMAKE_MODULE_PATH "${CMAKE_CURRENT_SOURCE_DIR}/cmake/Modules")
 include(DefineCMakeDefaults)
 include(DefineCompilerFlags)
 
-project(libssh VERSION 0.11.00 LANGUAGES C CXX)
+project(libssh VERSION 0.11.00 LANGUAGES C)
 
 # global needed variable
 set(APPLICATION_NAME ${PROJECT_NAME})
@@ -41,6 +41,8 @@ macro_ensure_out_of_source_build("${PROJECT_NAME} requires an out of source buil
 # Copy library files to a lib sub-directory
 set(CMAKE_LIBRARY_OUTPUT_DIRECTORY "${CMAKE_BINARY_DIR}/lib")
 
+set(LIBSSSH_PC_REQUIRES_PRIVATE "")
+
 # search for libraries
 if (WITH_ZLIB)
     find_package(ZLIB REQUIRED)
@@ -66,6 +68,7 @@ find_package(Threads)
 
 if (WITH_GSSAPI)
     find_package(GSSAPI)
+    list(APPEND LIBSSH_PC_REQUIRES_PRIVATE ${GSSAPI_PC_REQUIRES})
 endif (WITH_GSSAPI)
 
 if (WITH_NACL)
@@ -75,9 +78,19 @@ if (WITH_NACL)
     endif (NOT NACL_FOUND)
 endif (WITH_NACL)
 
+if (WITH_FIDO2)
+    find_package(libfido2)
+    if (LIBFIDO2_FOUND)
+        set(HAVE_LIBFIDO2 ON)
+    else (LIBFIDO2_FOUND)
+        set(HAVE_LIBFIDO2 OFF)
+        message(WARNING "libfido2 was not found. Internal support for interacting with FIDO2/U2F devices using the USB HID protocol will not be available.")
+    endif (LIBFIDO2_FOUND)
+endif (WITH_FIDO2)
+
 # Disable symbol versioning in non UNIX platforms
 if (UNIX)
-    find_package(ABIMap 0.3.1)
+    find_package(ABIMap 0.4.0)
 else (UNIX)
     set(WITH_SYMBOL_VERSIONING OFF)
 endif (UNIX)
@@ -168,6 +181,10 @@ if (WITH_SYMBOL_VERSIONING AND ABIMAP_FOUND)
             set(ALLOW_ABI_BREAK "BREAK_ABI")
         endif()
 
+        if (WITH_FINAL)
+            set(FINAL "FINAL")
+        endif()
+
         # Target we can depend on in 'make dist'
         set(_SYMBOL_TARGET "${PROJECT_NAME}.map")
 
@@ -180,7 +197,7 @@ if (WITH_SYMBOL_VERSIONING AND ABIMAP_FOUND)
                           RELEASE_NAME_VERSION ${PROJECT_NAME}_${LIBRARY_VERSION}
                           CURRENT_MAP ${MAP_PATH}
                           COPY_TO ${MAP_PATH}
-                          FINAL
+                          ${FINAL}
                           ${ALLOW_ABI_BREAK})
 
         # Write the current version to the source
@@ -190,12 +207,13 @@ endif (WITH_SYMBOL_VERSIONING AND ABIMAP_FOUND)
 
 # Coverage
 if (WITH_COVERAGE)
+    ENABLE_LANGUAGE(CXX)
     include(CodeCoverage)
     setup_target_for_coverage_lcov(
         NAME "coverage"
         EXECUTABLE make test
         DEPENDENCIES ssh tests)
-    set(GCOVR_ADDITIONAL_ARGS --xml-pretty --exclude-unreachable-branches --print-summary)
+    set(GCOVR_ADDITIONAL_ARGS --xml-pretty --exclude-unreachable-branches --print-summary --gcov-ignore-parse-errors)
     setup_target_for_coverage_gcovr_xml(
         NAME "coverage_xml"
         EXECUTABLE make test
@@ -234,6 +252,10 @@ message(STATUS "Client code testing: ${CLIENT_TESTING}")
 message(STATUS "Blowfish cipher support: ${HAVE_BLOWFISH}")
 message(STATUS "PKCS #11 URI support: ${WITH_PKCS11_URI}")
 message(STATUS "With PKCS #11 provider support: ${WITH_PKCS11_PROVIDER}")
+message(STATUS "With FIDO2/U2F support: ${WITH_FIDO2}")
+if (WITH_FIDO2)
+    message(STATUS "With libfido2 (internal usb-hid support): ${HAVE_LIBFIDO2}")
+endif (WITH_FIDO2)
 set(_SERVER_TESTING OFF)
 if (WITH_SERVER)
     set(_SERVER_TESTING ${SERVER_TESTING})
@@ -248,9 +270,15 @@ message(STATUS "Benchmarks: ${WITH_BENCHMARKS}")
 message(STATUS "Symbol versioning: ${WITH_SYMBOL_VERSIONING}")
 message(STATUS "Allow ABI break: ${WITH_ABI_BREAK}")
 message(STATUS "Release is final: ${WITH_FINAL}")
+if (WITH_HERMETIC_USR)
+    message(STATUS "User global client config: ${USR_GLOBAL_CLIENT_CONFIG}")
+endif ()
 message(STATUS "Global client config: ${GLOBAL_CLIENT_CONFIG}")
 if (WITH_SERVER)
-message(STATUS "Global bind config: ${GLOBAL_BIND_CONFIG}")
+    if (WITH_HERMETIC_USR)
+        message(STATUS "User global bind config: ${USR_GLOBAL_BIND_CONFIG}")
+    endif ()
+    message(STATUS "Global bind config: ${GLOBAL_BIND_CONFIG}")
 endif()
 message(STATUS "********************************************")
 

CONTRIBUTING.md

@@ -117,6 +117,52 @@ libssh Developer's Certificate of Origin for each patch, or inside each
 patch. Just the sign-off message is all that is required once we've
 received the initial email.
 
+## Continuous Integration
+
+Contributing patches through Merge Request workflow on Gitlab allows us to run
+various checks on various configuration as part of Gitlab CI. Unfortunately,
+some pipelines are slower (as they involve building dependencies) so the default
+timeout of 1 hour needs to be extended at least to 2 hours. This can be done in
+project settings of your libssh fork:
+
+https://docs.gitlab.com/ee/ci/pipelines/settings.html#set-a-limit-for-how-long-jobs-can-run
+
+Otherwise you will encounter errors like these, usually on visualstudio builds:
+
+```
+ERROR: Job failed: execution took longer than 1h0m0s seconds
+The script exceeded the maximum execution time set for the job
+```
+
+Note, that the built dependencies are cached so after successful build in your
+namespace, the rebuilds should be much faster.
+
+## Running GitLab CI locally (optional helper)
+
+For contributors working on CI, build system changes, or adding new CI jobs, it can be useful to run GitLab CI pipelines locally before pushing.
+
+libssh provides a small helper script based on `gitlab-ci-local` that can:
+
+- List all jobs defined in `.gitlab-ci.yml`
+- Run a specific job or the full pipeline locally
+- Automatically pick up new jobs when they are added to the CI configuration
+- Optionally clean up CI Docker images after execution
+
+### Requirements
+
+- Docker (daemon running)
+- git
+- gitlab-ci-local  
+  https://github.com/firecow/gitlab-ci-local
+
+### Usage
+
+```bash
+./.gitlab-ci/local-ci.sh --list
+./.gitlab-ci/local-ci.sh --run fedora/libressl/x86_64
+./.gitlab-ci/local-ci.sh --all
+./.gitlab-ci/local-ci.sh --run fedora/libressl/x86_64 --clean
+```
 
 # Coding conventions in the libssh tree
 
@@ -517,6 +563,37 @@ Bad example:
             break;
     }
 
+## ABI Versioning and Symbol Management
+
+To maintain [ABI](https://en.wikipedia.org/wiki/Application_binary_interface) stability
+and ensure backward compatibility, libssh uses **symbol versioning** to track and manage
+exported functions and variables. This allows libssh to introduce new symbols or modify
+existing functions in an ABI-compatible way.
+
+When introducing a new symbol:
+
+1. Use the `LIBSSH_API` macro to mark the symbol as part of the public API.
+2. If you have [abimap](https://github.com/ansasaki/abimap) installed, the new symbols are
+automatically generated in the `src/libssh_dev.map` file in the **build** directory and used automatically for building the updated library. But, depending on the version of `abimap` under use, you may face linker errors like: `unable to find version dependency LIBSSH_4_9_0`. In this case, you need to manually replace the existing `src/libssh.map` file with the generated `libssh_dev.map` file to update the symbol versioning.
+3. If you do not have abimap installed, the modified/added symbols must manually be added to the
+`src/libssh.map` file. The symbols must be added in the following format (assuming that 4_10_0 is the latest released version):
+
+```
+LIBSSH_AFTER_4_10_0
+{
+    global:
+        new_function;
+        new_variable;
+} LIBSSH_4_10_0;
+```
+4. After following either of the above steps, the library can be successfully built and
+tested without any linker errors.
+
+5. When submitting the patch, make sure that any new symbols have been added to `libssh.map` as described in step 3, so that the new additions may not be excluded from the next release due to human error.
+
+Also, to maintain ABI compatibility, existing symbols must not be removed. Instead, they can
+be marked as deprecated using the `LIBSSH_DEPRECATED` macro. This allows the symbol to be
+removed in a future release without breaking the ABI.
 
 Have fun and happy libssh hacking!
 

CPackConfig.cmake

@@ -10,7 +10,7 @@ set(CPACK_PACKAGE_VERSION ${PROJECT_VERSION})
 
 # SOURCE GENERATOR
 set(CPACK_SOURCE_GENERATOR "TXZ")
-set(CPACK_SOURCE_IGNORE_FILES "~$;[.]swp$;/[.]git/;/[.]clangd/;/[.]cache/;.gitignore;/build*;/obj*;tags;cscope.*;compile_commands.json;.*\.patch")
+set(CPACK_SOURCE_IGNORE_FILES "~$;[.]swp$;/[.]bare/;/[.]git/;/[.]git;/[.]clangd/;/[.]cache/;.gitignore;/build*;/obj*;tags;cscope.*;compile_commands.json;.*\.patch")
 set(CPACK_SOURCE_PACKAGE_FILE_NAME "${CPACK_PACKAGE_NAME}-${CPACK_PACKAGE_VERSION}")
 
 ### NSIS INSTALLER

CompilerChecks.cmake

@@ -16,7 +16,6 @@ if (UNIX)
         endif()
     endif()
 
-    add_c_compiler_flag("-std=gnu99" SUPPORTED_COMPILER_FLAGS)
     add_c_compiler_flag("-Wpedantic" SUPPORTED_COMPILER_FLAGS)
     add_c_compiler_flag("-Wall" SUPPORTED_COMPILER_FLAGS)
     add_c_compiler_flag("-Wshadow" SUPPORTED_COMPILER_FLAGS)
@@ -49,6 +48,7 @@ if (UNIX)
     add_c_compiler_flag("-Werror=implicit-int" SUPPORTED_COMPILER_FLAGS)
     add_c_compiler_flag("-Wint-conversion" SUPPORTED_COMPILER_FLAGS)
     add_c_compiler_flag("-Werror=int-conversion" SUPPORTED_COMPILER_FLAGS)
+    add_c_compiler_flag("-Werror=unused-variable" SUPPORTED_COMPILER_FLAGS)
 
     check_c_compiler_flag("-Wformat" REQUIRED_FLAGS_WFORMAT)
     if (REQUIRED_FLAGS_WFORMAT)
@@ -92,9 +92,12 @@ if (UNIX)
     endif (WITH_STACK_PROTECTOR_STRONG)
 
     if (NOT WINDOWS AND NOT CYGWIN)
-        check_c_compiler_flag_ssp("-fstack-clash-protection" WITH_STACK_CLASH_PROTECTION)
+        # apple m* chips do not support this option
-        if (WITH_STACK_CLASH_PROTECTION)
+        if (NOT ${CMAKE_SYSTEM_PROCESSOR} STREQUAL arm64)
-            list(APPEND SUPPORTED_COMPILER_FLAGS "-fstack-clash-protection")
+            check_c_compiler_flag_ssp("-fstack-clash-protection" WITH_STACK_CLASH_PROTECTION)
+            if (WITH_STACK_CLASH_PROTECTION)
+                list(APPEND SUPPORTED_COMPILER_FLAGS "-fstack-clash-protection")
+            endif()
         endif()
     endif()
 

ConfigureChecks.cmake

@@ -64,6 +64,7 @@ check_include_file(arpa/inet.h HAVE_ARPA_INET_H)
 check_include_file(byteswap.h HAVE_BYTESWAP_H)
 check_include_file(glob.h HAVE_GLOB_H)
 check_include_file(valgrind/valgrind.h HAVE_VALGRIND_VALGRIND_H)
+check_include_file(ifaddrs.h HAVE_IFADDRS_H)
 
 if (WIN32)
   check_include_file(io.h HAVE_IO_H)
@@ -103,6 +104,12 @@ if (OPENSSL_FOUND)
     check_function_exists(RAND_priv_bytes HAVE_OPENSSL_RAND_PRIV_BYTES)
     check_function_exists(EVP_chacha20 HAVE_OPENSSL_EVP_CHACHA20)
 
+    # Check for ML-KEM availability (OpenSSL 3.5+)
+    if (OPENSSL_VERSION VERSION_GREATER_EQUAL "3.5.0")
+        set(HAVE_OPENSSL_MLKEM 1)
+        set(HAVE_MLKEM1024 1)
+    endif ()
+
     unset(CMAKE_REQUIRED_INCLUDES)
     unset(CMAKE_REQUIRED_LIBRARIES)
 endif()
@@ -133,6 +140,7 @@ check_function_exists(strncpy HAVE_STRNCPY)
 check_function_exists(strndup HAVE_STRNDUP)
 check_function_exists(strtoull HAVE_STRTOULL)
 check_function_exists(explicit_bzero HAVE_EXPLICIT_BZERO)
+check_function_exists(memset_explicit HAVE_MEMSET_EXPLICIT)
 check_function_exists(memset_s HAVE_MEMSET_S)
 
 if (HAVE_GLOB_H)
@@ -225,7 +233,12 @@ if (GCRYPT_FOUND)
     endif (GCRYPT_VERSION VERSION_GREATER "1.4.6")
     if (NOT GCRYPT_VERSION VERSION_LESS "1.7.0")
         set(HAVE_GCRYPT_CHACHA_POLY 1)
+        set(HAVE_GCRYPT_CURVE25519 1)
     endif (NOT GCRYPT_VERSION VERSION_LESS "1.7.0")
+    if (GCRYPT_VERSION VERSION_GREATER_EQUAL "1.10.1")
+        set(HAVE_GCRYPT_MLKEM 1)
+        set(HAVE_MLKEM1024 1)
+    endif ()
 endif (GCRYPT_FOUND)
 
 if (MBEDTLS_FOUND)
@@ -235,6 +248,13 @@ if (MBEDTLS_FOUND)
     set(CMAKE_REQUIRED_INCLUDES "${MBEDTLS_INCLUDE_DIR}/mbedtls")
     check_include_file(chacha20.h HAVE_MBEDTLS_CHACHA20_H)
     check_include_file(poly1305.h HAVE_MBEDTLS_POLY1305_H)
+    if (MBEDTLS_VERSION VERSION_LESS "3.0.0")
+        check_symbol_exists(MBEDTLS_ECP_DP_CURVE25519_ENABLED "config.h" HAVE_MBEDTLS_CURVE25519)
+    else()
+        check_symbol_exists(MBEDTLS_ECP_DP_CURVE25519_ENABLED "mbedtls_config.h" HAVE_MBEDTLS_CURVE25519)
+    endif()
+
+
     if (WITH_BLOWFISH_CIPHER)
         check_include_file(blowfish.h HAVE_BLOWFISH)
     endif()

DefineOptions.cmake

@@ -13,6 +13,7 @@ option(WITH_INTERNAL_DOC "Compile doxygen internal documentation" OFF)
 option(BUILD_SHARED_LIBS "Build shared libraries" ON)
 option(WITH_PKCS11_URI "Build with PKCS#11 URI support" OFF)
 option(WITH_PKCS11_PROVIDER "Use the PKCS#11 provider for accessing pkcs11 objects" OFF)
+option(WITH_FIDO2 "Build with FIDO2/U2F support" OFF)
 option(UNIT_TESTING "Build with unit tests" OFF)
 option(CLIENT_TESTING "Build with client tests; requires openssh" OFF)
 option(SERVER_TESTING "Build with server tests; requires openssh and dropbear" OFF)
@@ -27,6 +28,7 @@ option(WITH_INSECURE_NONE "Enable insecure none cipher and MAC algorithms (not s
 option(WITH_EXEC "Enable libssh to execute arbitrary commands from configuration files or options (match exec, proxy commands and OpenSSH-based proxy-jumps)." ON)
 option(FUZZ_TESTING "Build with fuzzer for the server and client (automatically enables none cipher!)" OFF)
 option(PICKY_DEVELOPER "Build with picky developer flags" OFF)
+option(WITH_HERMETIC_USR "Build with support for hermetic /usr/" OFF)
 
 if (WITH_ZLIB)
     set(WITH_LIBZ ON)
@@ -59,6 +61,11 @@ if (NOT GLOBAL_CLIENT_CONFIG)
   set(GLOBAL_CLIENT_CONFIG "/etc/ssh/ssh_config")
 endif (NOT GLOBAL_CLIENT_CONFIG)
 
+if (WITH_HERMETIC_USR)
+  set(USR_GLOBAL_BIND_CONFIG "/usr${GLOBAL_BIND_CONFIG}")
+  set(USR_GLOBAL_CLIENT_CONFIG "/usr${GLOBAL_CLIENT_CONFIG}")
+endif (WITH_HERMETIC_USR)
+
 if (FUZZ_TESTING)
   set(WITH_INSECURE_NONE ON)
 endif (FUZZ_TESTING)

INSTALL

@@ -38,14 +38,16 @@ First, you need to configure the compilation, using CMake. Go inside the
 `build` dir. Create it if it doesn't exist.
 
 GNU/Linux, MacOS X, MSYS/MinGW:
-
+    cmake -DCMAKE_INSTALL_PREFIX=/usr -DCMAKE_BUILD_TYPE=Debug ..
-    cmake -DUNIT_TESTING=ON -DCMAKE_INSTALL_PREFIX=/usr -DCMAKE_BUILD_TYPE=Debug ..
     make
 
 On Windows you should choose a makefile generator with -G or use
 
     cmake-gui.exe ..
 
+To enable building tests use -DUNIT_TESTING=ON. For this, the
+[cmocka](https://cmocka.org) dependency is required.
+
 To enable additional client tests against a local OpenSSH server, add the
 compile option -DCLIENT_TESTING=ON. These tests require an OpenSSH
 server package and some wrapper libraries (see optional requirements) to

cmake/Modules/AddCMockaTest.cmake

@@ -117,6 +117,7 @@ function(ADD_CMOCKA_TEST _TARGET_NAME)
         ${TARGET_SYSTEM_EMULATOR} ${_TARGET_NAME}
     )
     if (WITH_COVERAGE)
+        ENABLE_LANGUAGE(CXX)
         include(CodeCoverage)
         append_coverage_compiler_flags_to_target(${_TARGET_NAME})
     endif (WITH_COVERAGE)

cmake/Modules/FindGCrypt.cmake

@@ -39,6 +39,15 @@ find_path(GCRYPT_INCLUDE_DIR
         include
 )
 
+find_path(GCRYPT_ERROR_INCLUDE_DIR
+    NAMES
+        gpg-error.h
+    HINTS
+        ${_GCRYPT_ROOT_HINTS_AND_PATHS}
+    PATH_SUFFIXES
+        include
+)
+
 find_library(GCRYPT_LIBRARY
     NAMES
         gcrypt
@@ -56,8 +65,10 @@ find_library(GCRYPT_ERROR_LIBRARY
         libgpg-error6-0
     HINTS
         ${_GCRYPT_ROOT_HINTS_AND_PATHS}
+    PATH_SUFFIXES
+        lib        
 )
-set(GCRYPT_LIBRARIES ${GCRYPT_LIBRARY}  ${GCRYPT_ERROR_LIBRARY})
+set(GCRYPT_LIBRARIES ${GCRYPT_ERROR_LIBRARY} ${GCRYPT_LIBRARY})
 
 if (GCRYPT_INCLUDE_DIR)
     file(STRINGS "${GCRYPT_INCLUDE_DIR}/gcrypt.h" _gcrypt_version_str REGEX "^#define GCRYPT_VERSION \"[0-9]+\\.[0-9]+\\.[0-9]")
@@ -83,5 +94,25 @@ else (GCRYPT_VERSION)
         GCRYPT_LIBRARIES)
 endif (GCRYPT_VERSION)
 
-# show the GCRYPT_INCLUDE_DIRS and GCRYPT_LIBRARIES variables only in the advanced view
+# show the GCRYPT_INCLUDE_DIRS, GCRYPT_LIBRARIES and GCRYPT_ERROR_INCLUDE_DIR variables only in the advanced view
-mark_as_advanced(GCRYPT_INCLUDE_DIR GCRYPT_LIBRARIES)
+mark_as_advanced(GCRYPT_INCLUDE_DIR GCRYPT_ERROR_INCLUDE_DIR GCRYPT_LIBRARIES)
+
+if(GCRYPT_FOUND)
+  if(NOT TARGET libgcrypt::libgcrypt)
+      add_library(libgcrypt::libgcrypt UNKNOWN IMPORTED)
+      set_target_properties(libgcrypt::libgcrypt PROPERTIES
+                            INTERFACE_INCLUDE_DIRECTORIES "${GCRYPT_INCLUDE_DIR}"
+                            INTERFACE_LINK_LIBRARIES libgcrypt::libgcrypt
+                            IMPORTED_LINK_INTERFACE_LANGUAGES "C"
+                            IMPORTED_LOCATION "${GCRYPT_LIBRARY}")
+  endif()
+  
+  if(NOT TARGET libgpg-error::libgpg-error)
+      add_library(libgpg-error::libgpg-error UNKNOWN IMPORTED)
+      set_target_properties(libgpg-error::libgpg-error PROPERTIES
+                            INTERFACE_INCLUDE_DIRECTORIES "${GCRYPT_ERROR_INCLUDE_DIR}"
+                            INTERFACE_LINK_LIBRARIES libgpg-error::libgpg-error
+                            IMPORTED_LINK_INTERFACE_LANGUAGES "C"
+                            IMPORTED_LOCATION "${GCRYPT_ERROR_LIBRARY}")
+  endif()
+endif()

cmake/Modules/FindGSSAPI.cmake

@@ -11,6 +11,8 @@
 #  GSSAPI_INCLUDE_DIR - the GSSAPI include directory
 #  GSSAPI_LIBRARIES - Link these to use GSSAPI
 #  GSSAPI_DEFINITIONS - Compiler switches required for using GSSAPI
+#  GSSAPI_PC_REQUIRES - pkg-config module name if found, needed for
+#                       Requires.private for static linking
 #
 #=============================================================================
 #  Copyright (c) 2013 Andreas Schneider <asn@cryptomilk.org>
@@ -24,12 +26,23 @@
 #=============================================================================
 #
 
+set(_mit_modname "mit-krb5-gssapi")
+set(_heimdal_modname "heimdal-gssapi")
+
+if(NOT _GSSAPI_ROOT_HINTS AND NOT _GSSAPI_ROOT_PATHS)
+    find_package(PkgConfig QUIET)
+    if (PKG_CONFIG_FOUND)
+        pkg_search_module(_GSSAPI ${_mit_modname} ${_heimdal_modname})
+    endif()
+endif()
+
 find_path(GSSAPI_ROOT_DIR
     NAMES
         include/gssapi.h
         include/gssapi/gssapi.h
     HINTS
         ${_GSSAPI_ROOT_HINTS}
+        "${_GSSAPI_INCLUDEDIR}"
     PATHS
         ${_GSSAPI_ROOT_PATHS}
 )
@@ -317,9 +330,15 @@ endif (GSSAPI_FLAVOR_HEIMDAL)
 include(FindPackageHandleStandardArgs)
 find_package_handle_standard_args(GSSAPI DEFAULT_MSG GSSAPI_LIBRARIES GSSAPI_INCLUDE_DIR)
 
-if (GSSAPI_INCLUDE_DIRS AND GSSAPI_LIBRARIES)
+if(GSSAPI_FOUND)
-    set(GSSAPI_FOUND TRUE)
+    if(_GSSAPI_FOUND) # via pkg-config
-endif (GSSAPI_INCLUDE_DIRS AND GSSAPI_LIBRARIES)
+        if (GSSAPI_FLAVOR_MIT)
+            set(GSSAPI_PC_REQUIRES ${_mit_modname})
+        elseif (GSSAPI_FLAVOR_HEIMDAL)
+            set(GSSAPI_PC_REQUIRES ${_heimdal_modname})
+        endif()
+    endif()
+endif()
 
-# show the GSSAPI_INCLUDE_DIRS and GSSAPI_LIBRARIES variables only in the advanced view
+# show the GSSAPI_INCLUDE_DIR and GSSAPI_LIBRARIES variables only in the advanced view
-mark_as_advanced(GSSAPI_INCLUDE_DIRS GSSAPI_LIBRARIES)
+mark_as_advanced(GSSAPI_INCLUDE_DIR GSSAPI_LIBRARIES)

cmake/Modules/FindMbedTLS.cmake

@@ -72,21 +72,23 @@ find_library(MBEDTLS_X509_LIBRARY
 set(MBEDTLS_LIBRARIES ${MBEDTLS_SSL_LIBRARY} ${MBEDTLS_CRYPTO_LIBRARY}
         ${MBEDTLS_X509_LIBRARY})
 
+# mbedtls 2.8
 if (MBEDTLS_INCLUDE_DIR AND EXISTS "${MBEDTLS_INCLUDE_DIR}/mbedtls/version.h")
-    # mbedtls 2.8
     file(STRINGS "${MBEDTLS_INCLUDE_DIR}/mbedtls/version.h" _mbedtls_version_str REGEX
             "^#[\t ]*define[\t ]+MBEDTLS_VERSION_STRING[\t ]+\"[0-9]+.[0-9]+.[0-9]+\"")
 
-    string(REGEX REPLACE "^.*MBEDTLS_VERSION_STRING.*([0-9]+.[0-9]+.[0-9]+).*"
+    string(REGEX REPLACE "^.*MBEDTLS_VERSION_STRING.*([0-9]+\\.[0-9]+\\.[0-9]+).*$"
             "\\1" MBEDTLS_VERSION "${_mbedtls_version_str}")
-elseif (MBEDTLS_INCLUDE_DIR AND EXISTS "${MBEDTLS_INCLUDE_DIR}/mbedtls/build_info.h")
+endif()
-    # mbedtls 3.6
+
-    file(STRINGS "${MBEDTLS_INCLUDE_DIR}/mbedtls/version.h" _mbedtls_version_str REGEX
+# mbedtls 3.6
+if (NOT MBEDTLS_VERSION AND MBEDTLS_INCLUDE_DIR AND EXISTS "${MBEDTLS_INCLUDE_DIR}/mbedtls/build_info.h")
+    file(STRINGS "${MBEDTLS_INCLUDE_DIR}/mbedtls/build_info.h" _mbedtls_version_str REGEX
             "^#[\t ]*define[\t ]+MBEDTLS_VERSION_STRING[\t ]+\"[0-9]+.[0-9]+.[0-9]+\"")
 
-    string(REGEX REPLACE "^.*MBEDTLS_VERSION_STRING.*([0-9]+.[0-9]+.[0-9]+).*"
+    string(REGEX REPLACE "^.*MBEDTLS_VERSION_STRING.*([0-9]+\\.[0-9]+\\.[0-9]+).*$"
             "\\1" MBEDTLS_VERSION "${_mbedtls_version_str}")
-endif ()
+endif()
 
 include(FindPackageHandleStandardArgs)
 if (MBEDTLS_VERSION)
@@ -110,3 +112,32 @@ endif (MBEDTLS_VERSION)
 
 # show the MBEDTLS_INCLUDE_DIRS and MBEDTLS_LIBRARIES variables only in the advanced view
 mark_as_advanced(MBEDTLS_INCLUDE_DIR MBEDTLS_LIBRARIES)
+
+if(MBEDTLS_FOUND)
+  if(NOT TARGET MbedTLS::mbedcrypto)
+      add_library(MbedTLS::mbedcrypto UNKNOWN IMPORTED)
+      set_target_properties(MbedTLS::mbedcrypto PROPERTIES
+                            INTERFACE_INCLUDE_DIRECTORIES "${MBEDTLS_INCLUDE_DIR}"
+                            INTERFACE_LINK_LIBRARIES MbedTLS::mbedcrypto
+                            IMPORTED_LINK_INTERFACE_LANGUAGES "C"
+                            IMPORTED_LOCATION "${MBEDTLS_CRYPTO_LIBRARY}")
+  endif()
+
+  if(NOT TARGET MbedTLS::mbedx509)
+      add_library(MbedTLS::mbedx509 UNKNOWN IMPORTED)
+      set_target_properties(MbedTLS::mbedx509 PROPERTIES
+                            INTERFACE_INCLUDE_DIRECTORIES "${MBEDTLS_INCLUDE_DIR}"
+                            INTERFACE_LINK_LIBRARIES MbedTLS::mbedx509
+                            IMPORTED_LINK_INTERFACE_LANGUAGES "C"
+                            IMPORTED_LOCATION "${MBEDTLS_X509_LIBRARY}")
+  endif()
+
+  if(NOT TARGET MbedTLS::mbedtls)
+      add_library(MbedTLS::mbedtls UNKNOWN IMPORTED)
+      set_target_properties(MbedTLS::mbedtls PROPERTIES
+                            INTERFACE_INCLUDE_DIRECTORIES "${MBEDTLS_INCLUDE_DIR}"
+                            INTERFACE_LINK_LIBRARIES MbedTLS::mbedtls
+                            IMPORTED_LINK_INTERFACE_LANGUAGES "C"
+                            IMPORTED_LOCATION "${MBEDTLS_LIBRARY}")
+  endif()
+endif()

cmake/Modules/Findlibfido2.cmake

@@ -0,0 +1,63 @@
+# - Try to find libfido2
+# Once done this will define
+#
+#  LIBFIDO2_ROOT_DIR - Set this variable to the root installation of libfido2
+#
+# Read-Only variables:
+#  LIBFIDO2_FOUND - system has libfido2
+#  LIBFIDO2_INCLUDE_DIR - the libfido2 include directory
+#  LIBFIDO2_LIBRARIES - Link these to use libfido2
+#
+# The libfido2 library provides support for communicating
+# with FIDO2/U2F devices over USB/NFC.
+#
+#  Copyright (c) 2025 Praneeth Sarode <praneethsarode@gmail.com>
+#
+#  Redistribution and use is allowed according to the terms of the New
+#  BSD license.
+#  For details see the accompanying COPYING-CMAKE-SCRIPTS file.
+#
+
+
+set(_LIBFIDO2_ROOT_HINTS
+    $ENV{LIBFIDO2_ROOT_DIR}
+    ${LIBFIDO2_ROOT_DIR}
+)
+
+set(_LIBFIDO2_ROOT_PATHS
+    "$ENV{PROGRAMFILES}/libfido2"
+)
+
+set(_LIBFIDO2_ROOT_HINTS_AND_PATHS
+    HINTS ${_LIBFIDO2_ROOT_HINTS}
+    PATHS ${_LIBFIDO2_ROOT_PATHS}
+)
+
+find_path(LIBFIDO2_INCLUDE_DIR
+    NAMES
+        fido.h
+    HINTS
+        ${_LIBFIDO2_ROOT_HINTS_AND_PATHS}
+    PATH_SUFFIXES
+        include
+)
+
+find_library(LIBFIDO2_LIBRARY
+    NAMES
+        fido2
+    HINTS
+        ${_LIBFIDO2_ROOT_HINTS_AND_PATHS}
+    PATH_SUFFIXES
+        lib
+        lib64
+)
+
+set(LIBFIDO2_LIBRARIES
+    ${LIBFIDO2_LIBRARY}
+)
+
+include(FindPackageHandleStandardArgs)
+find_package_handle_standard_args(libfido2 DEFAULT_MSG LIBFIDO2_LIBRARIES LIBFIDO2_INCLUDE_DIR)
+
+# show the LIBFIDO2_INCLUDE_DIR and LIBFIDO2_LIBRARIES variables only in the advanced view
+mark_as_advanced(LIBFIDO2_INCLUDE_DIR LIBFIDO2_LIBRARIES)

config.h.cmake

@@ -9,9 +9,11 @@
 #cmakedefine SOURCEDIR "${SOURCEDIR}"
 
 /* Global bind configuration file path */
+#cmakedefine USR_GLOBAL_BIND_CONFIG "${USR_GLOBAL_BIND_CONFIG}"
 #cmakedefine GLOBAL_BIND_CONFIG "${GLOBAL_BIND_CONFIG}"
 
 /* Global client configuration file path */
+#cmakedefine USR_GLOBAL_CLIENT_CONFIG "${USR_GLOBAL_CLIENT_CONFIG}"
 #cmakedefine GLOBAL_CLIENT_CONFIG "${GLOBAL_CLIENT_CONFIG}"
 
 /************************** HEADER FILES *************************/
@@ -58,6 +60,9 @@
 /* Define to 1 if you have the <stdint.h> header file. */
 #cmakedefine HAVE_STDINT_H 1
 
+/* Define to 1 if you have the <ifaddrs.h> header file. */
+#cmakedefine HAVE_IFADDRS_H 1
+
 /* Define to 1 if you have the <openssl/aes.h> header file. */
 #cmakedefine HAVE_OPENSSL_AES_H 1
 
@@ -82,6 +87,9 @@
 /* Define to 1 if you have elliptic curve cryptography in openssl */
 #cmakedefine HAVE_OPENSSL_ECC 1
 
+/* Define to 1 if mbedTLS supports curve25519 */
+#cmakedefine HAVE_MBEDTLS_CURVE25519 1
+
 /* Define to 1 if you have elliptic curve cryptography in gcrypt */
 #cmakedefine HAVE_GCRYPT_ECC 1
 
@@ -94,6 +102,9 @@
 /* Define to 1 if you have gcrypt with ChaCha20/Poly1305 support */
 #cmakedefine HAVE_GCRYPT_CHACHA_POLY 1
 
+/* Define to 1 if you have gcrypt with curve25519 support */
+#cmakedefine HAVE_GCRYPT_CURVE25519
+
 /*************************** FUNCTIONS ***************************/
 
 /* Define to 1 if you have the `EVP_chacha20' function. */
@@ -168,6 +179,9 @@
 /* Define to 1 if you have the `explicit_bzero' function. */
 #cmakedefine HAVE_EXPLICIT_BZERO 1
 
+/* Define to 1 if you have the `memset_explicit' function. */
+#cmakedefine HAVE_MEMSET_EXPLICIT 1
+
 /* Define to 1 if you have the `memset_s' function. */
 #cmakedefine HAVE_MEMSET_S 1
 
@@ -180,6 +194,15 @@
 /* Define to 1 if we have support for blowfish */
 #cmakedefine HAVE_BLOWFISH 1
 
+/* Define to 1 if we have support for ML-KEM in libgcrypt */
+#cmakedefine HAVE_GCRYPT_MLKEM 1
+
+/* Define to 1 if we have support for ML-KEM in OpenSSL */
+#cmakedefine HAVE_OPENSSL_MLKEM 1
+
+/* Define to 1 if we have support for ML-KEM1024 in either backend */
+#cmakedefine HAVE_MLKEM1024 1
+
 /*************************** LIBRARIES ***************************/
 
 /* Define to 1 if you have the `crypto' library (-lcrypto). */
@@ -197,6 +220,10 @@
 /* Define to 1 if you have the `cmocka' library (-lcmocka). */
 #cmakedefine HAVE_CMOCKA 1
 
+/* Define to 1 if you have the `libfido2' library (-lfido2).
+ * This is required for interacting with FIDO2/U2F devices over USB-HID. */
+#cmakedefine HAVE_LIBFIDO2 1
+
 /**************************** OPTIONS ****************************/
 
 #cmakedefine HAVE_GCC_THREAD_LOCAL_STORAGE 1
@@ -263,6 +290,9 @@
 /* Define to 1 if we want to build a support for PKCS #11 provider. */
 #cmakedefine WITH_PKCS11_PROVIDER 1
 
+/* Define to 1 if you want to enable FIDO2/U2F support */
+#cmakedefine WITH_FIDO2 1
+
 /*************************** ENDIAN *****************************/
 
 /* Define WORDS_BIGENDIAN to 1 if your processor stores words with the most

doc/CMakeLists.txt

@@ -1,91 +1,247 @@
 #
 # Build the documentation
 #
-if (${CMAKE_VERSION} VERSION_GREATER "3.8.99")
+# To build the documentation with a local doxygen-awesome-css directory:
-
+#
+#   cmake -S . -B obj \
+#         -DDOXYGEN_AWESOME_CSS_DIR=/path/to/doxygen-awesome-css
+#   cmake --build obj --target docs
+#
+# The tarball can be downloaded from:
+#   https://github.com/jothepro/doxygen-awesome-css/archive/refs/tags/v2.4.1.tar.gz
+#
 find_package(Doxygen)
 
 if (DOXYGEN_FOUND)
+    set(DOXYGEN_AWESOME_CSS_PROJECT
+        "https://github.com/jothepro/doxygen-awesome-css")
+    set(DOXYGEN_AWESOME_CSS_VERSION "2.4.1")
+    set(DOXYGEN_AWESOME_CSS_URL
+        "${DOXYGEN_AWESOME_CSS_PROJECT}/archive/refs/tags/v${DOXYGEN_AWESOME_CSS_VERSION}.tar.gz"
+    )
+
+    # Allow specifying a local doxygen-awesome-css directory (useful for
+    # packaging)
+    if (NOT DEFINED DOXYGEN_AWESOME_CSS_DIR)
+        # Custom target to download doxygen-awesome-css at build time
+        add_custom_target(
+            doxygen-awesome-css
+            COMMAND
+                ${CMAKE_COMMAND} -DURL=${DOXYGEN_AWESOME_CSS_URL}
+                -DDEST_DIR=${CMAKE_CURRENT_BINARY_DIR}
+                -DVERSION=${DOXYGEN_AWESOME_CSS_VERSION} -P
+                ${CMAKE_CURRENT_SOURCE_DIR}/fetch_doxygen_awesome.cmake
+            COMMENT "Fetching doxygen-awesome-css theme")
+
+        set(AWESOME_CSS_DIR
+            "${CMAKE_CURRENT_BINARY_DIR}/doxygen-awesome-css-${DOXYGEN_AWESOME_CSS_VERSION}"
+        )
+    else ()
+        message(
+            STATUS
+                "Using doxygen-awesome-css from ${DOXYGEN_AWESOME_CSS_DIR}")
+        set(AWESOME_CSS_DIR "${DOXYGEN_AWESOME_CSS_DIR}")
+    endif ()
+
+    # Project title shown in documentation
     set(DOXYGEN_PROJECT_NAME ${PROJECT_NAME})
+    # Project version number shown in documentation
     set(DOXYGEN_PROJECT_NUMBER ${PROJECT_VERSION})
+    # Brief description shown below project name
     set(DOXYGEN_PROJECT_BRIEF "The SSH library")
+    # Project favicon (browser tab icon)
+    set(DOXYGEN_PROJECT_ICON ${CMAKE_CURRENT_SOURCE_DIR}/favicon.png)
 
+    # Number of spaces used for indentation in code blocks
     set(DOXYGEN_TAB_SIZE 4)
+    # Generate output optimized for C (vs C++)
     set(DOXYGEN_OPTIMIZE_OUTPUT_FOR_C YES)
+    # Enable parsing of markdown in comments
     set(DOXYGEN_MARKDOWN_SUPPORT YES)
-    set(DOXYGEN_FULL_PATH_NAMES NO)
+    # Warn about undocumented members to improve documentation quality
-    set(DOXYGEN_GENERATE_TAGFILE "tags.xml")
+    set(DOXYGEN_WARN_IF_UNDOCUMENTED YES)
+    # Do not extract private class members
+    set(DOXYGEN_EXTRACT_PRIVATE NO)
+    if (WITH_INTERNAL_DOC)
+        # Include internal documentation
+        set(DOXYGEN_INTERNAL_DOCS YES)
+    else ()
+        # Do not include internal documentation
+        set(DOXYGEN_INTERNAL_DOCS NO)
+    endif( WITH_INTERNAL_DOC)
+    # Disable built-in clipboard (using doxygen-awesome extension instead)
+    set(DOXYGEN_HTML_COPY_CLIPBOARD NO)
+    # Disable page outline panel (using interactive TOC extension instead)
+    set(DOXYGEN_PAGE_OUTLINE_PANEL NO)
 
-    set(DOXYGEN_PREDEFINED DOXYGEN
+    # Required configuration for doxygen-awesome-css theme Generate treeview
-                           WITH_SERVER
+    # sidebar for navigation
-                           WITH_SFTP
+    set(DOXYGEN_GENERATE_TREEVIEW YES)
+    # Enable default index pages
+    set(DOXYGEN_DISABLE_INDEX NO)
+    # Use top navigation bar instead of full sidebar (required for theme
+    # compatibility)
+    set(DOXYGEN_FULL_SIDEBAR NO)
+    # Use light color style (required for Doxygen >= 1.9.5)
+    set(DOXYGEN_HTML_COLORSTYLE LIGHT)
+
+    # Disable diagram generation (not relevant for C projects)
+    set(DOXYGEN_HAVE_DOT NO)
+    set(DOXYGEN_CLASS_DIAGRAMS NO)
+    set(DOXYGEN_CALL_GRAPH NO)
+    set(DOXYGEN_CALLER_GRAPH NO)
+
+    # Preprocessor defines to use when parsing code
+    set(DOXYGEN_PREDEFINED DOXYGEN WITH_SERVER WITH_SFTP
                            PRINTF_ATTRIBUTE\(x,y\))
-    set(DOXYGEN_DOT_GRAPH_MAX_NODES 100)
 
-    set(DOXYGEN_EXCLUDE ${CMAKE_CURRENT_SOURCE_DIR}/that_style)
+    # Exclude patterns for files we don't want to document
-    set(DOXYGEN_HTML_HEADER ${CMAKE_CURRENT_SOURCE_DIR}/that_style/header.html)
+    set(DOXYGEN_EXCLUDE_PATTERNS */src/external/* fe25519.h ge25519.h sc25519.h
-    set(DOXYGEN_HTML_EXTRA_STYLESHEET ${CMAKE_CURRENT_SOURCE_DIR}/that_style/that_style.css)
+                                 blf.h)
-    set(DOXYGEN_HTML_EXTRA_FILES ${CMAKE_CURRENT_SOURCE_DIR}/that_style/img/nav_edge_left.svg
+    # Exclude internal structures from documentation
-                                 ${CMAKE_CURRENT_SOURCE_DIR}/that_style/img/nav_edge_right.svg
+    set(DOXYGEN_EXCLUDE_SYMBOLS_STRUCTS
-                                 ${CMAKE_CURRENT_SOURCE_DIR}/that_style/img/nav_edge_inter.svg
+        chacha20_poly1305_keysched,
-                                 ${CMAKE_CURRENT_SOURCE_DIR}/that_style/img/sync_off.png
+        dh_ctx,
-                                 ${CMAKE_CURRENT_SOURCE_DIR}/that_style/img/sync_on.png
+        dh_ctx,
-                                 ${CMAKE_CURRENT_SOURCE_DIR}/that_style/img/splitbar_handle.svg
+        dh_keypair,
-                                 ${CMAKE_CURRENT_SOURCE_DIR}/that_style/img/doc.svg
+        error_struct,
-                                 ${CMAKE_CURRENT_SOURCE_DIR}/that_style/img/mag_glass.svg
+        packet_struct,
-                                 ${CMAKE_CURRENT_SOURCE_DIR}/that_style/img/folderclosed.svg
+        pem_get_password_struct,
-                                 ${CMAKE_CURRENT_SOURCE_DIR}/that_style/img/folderopen.svg
+        ssh_tokens_st,
-                                 ${CMAKE_CURRENT_SOURCE_DIR}/that_style/js/striped_bg.js)
+        sftp_attributes_struct,
-     set(DOXYGEN_EXCLUDE_PATTERNS */src/external/* fe25519.h ge25519.h sc25519.h
+        sftp_client_message_struct,
-                                  blf.h)
+        sftp_dir_struct,
-     set(DOXYGEN_EXCLUDE_SYMBOLS_STRUCTS chacha20_poly1305_keysched,dh_ctx,dh_ctx,dh_keypair,error_struct,
+        sftp_ext_struct,
-                                         packet_struct,pem_get_password_struct,ssh_tokens_st,
+        sftp_file_struct,
-                                         sftp_attributes_struct,sftp_client_message_struct,
+        sftp_message_struct,
-                                         sftp_dir_struct,sftp_ext_struct,sftp_file_struct,sftp_message_struct,
+        sftp_packet_struct,
-                                         sftp_packet_struct,sftp_request_queue_struct,sftp_session_struct,
+        sftp_request_queue_struct,
-                                         sftp_status_message_struct,ssh_agent_state_struct,
+        sftp_session_struct,
-                                         ssh_agent_struct,ssh_auth_auto_state_struct,ssh_auth_request,
+        sftp_status_message_struct,
-                                         ssh_bind_config_keyword_table_s,ssh_bind_config_match_keyword_table_s,
+        ssh_agent_state_struct,
-                                         ssh_bind_struct,ssh_buffer_struct,ssh_channel_callbacks_struct,
+        ssh_agent_struct,
-                                         ssh_channel_read_termination_struct,ssh_channel_request,
+        ssh_auth_auto_state_struct,
-                                         ssh_channel_request_open,ssh_channel_struct,ssh_cipher_struct,
+        ssh_auth_request,
-                                         ssh_common_struct,ssh_config_keyword_table_s,
+        ssh_bind_config_keyword_table_s,
-                                         ssh_config_match_keyword_table_s,ssh_connector_struct,
+        ssh_bind_config_match_keyword_table_s,
-                                         ssh_counter_struct,ssh_crypto_struct,ssh_event_fd_wrapper,
+        ssh_bind_struct,
-                                         ssh_event_struct,ssh_global_request,ssh_gssapi_struct,ssh_hmac_struct,
+        ssh_buffer_struct,
-                                         ssh_iterator,ssh_kbdint_struct,ssh_kex_struct,ssh_key_struct,
+        ssh_channel_callbacks_struct,
-                                         ssh_knownhosts_entry,ssh_list,ssh_mac_ctx_struct,ssh_message_struct,
+        ssh_channel_read_termination_struct,
-                                         ssh_packet_callbacks_struct,ssh_packet_header,ssh_poll_ctx_struct,
+        ssh_channel_request,
-                                         ssh_poll_handle_struct,ssh_pollfd_struct,ssh_private_key_struct,
+        ssh_channel_request_open,
-                                         ssh_public_key_struct,ssh_scp_struct,ssh_service_request,
+        ssh_channel_struct,
-                                         ssh_session_struct,ssh_signature_struct,ssh_socket_struct,
+        ssh_cipher_struct,
-                                         ssh_string_struct,ssh_threads_callbacks_struct,ssh_timestamp,)
+        ssh_common_struct,
-     set(DOXYGEN_EXCLUDE_SYMBOLS_MACRO SSH_FXP*,SSH_SOCKET*,SERVERBANNER,SOCKOPT_TYPE_ARG4,SSH_FILEXFER*,
+        ssh_config_keyword_table_s,
-                                       SSH_FXF*,SSH_S_*,SFTP_*,NSS_BUFLEN_PASSWD,CLOCK,MAX_LINE_SIZE,
+        ssh_config_match_keyword_table_s,
-                                       PKCS11_URI,KNOWNHOSTS_MAXTYPES,)
+        ssh_connector_struct,
-     set(DOXYGEN_EXCLUDE_SYMBOLS_TYPEDEFS sftp_attributes,sftp_client_message,sftp_dir,sftp_ext,sftp_file,
+        ssh_counter_struct,
-                                          sftp_message,sftp_packet,sftp_request_queue,sftp_session,
+        ssh_crypto_struct,
-                                          sftp_status_message,sftp_statvfs_t,poll_fn,ssh_callback_int,
+        ssh_event_fd_wrapper,
-                                          ssh_callback_data,ssh_callback_int_int,ssh_message_callback,
+        ssh_event_struct,
-                                          ssh_channel_callback_int,ssh_channel_callback_data,ssh_callbacks,
+        ssh_global_request,
-                                          ssh_gssapi_select_oid_callback,ssh_gssapi_accept_sec_ctx_callback,
+        ssh_gssapi_struct,
-                                          ssh_gssapi_verify_mic_callback,ssh_server_callbacks,ssh_socket_callbacks,
+        ssh_hmac_struct,
-                                          ssh_packet_callbacks,ssh_channel_callbacks,ssh_bind,ssh_bind_callbacks,)
+        ssh_iterator,
-     set(DOXYGEN_EXCLUDE_SYMBOLS ${DOXYGEN_EXCLUDE_SYMBOLS_STRUCTS}
+        ssh_kbdint_struct,
-                                 ${DOXYGEN_EXCLUDE_SYMBOLS_MACRO}
+        ssh_kex_struct,
-                                 ${DOXYGEN_EXCLUDE_SYMBOLS_TYPEDEFS})
+        ssh_key_struct,
+        ssh_knownhosts_entry,
+        ssh_list,
+        ssh_mac_ctx_struct,
+        ssh_message_struct,
+        ssh_packet_callbacks_struct,
+        ssh_packet_header,
+        ssh_poll_ctx_struct,
+        ssh_poll_handle_struct,
+        ssh_pollfd_struct,
+        ssh_private_key_struct,
+        ssh_public_key_struct,
+        ssh_scp_struct,
+        ssh_service_request,
+        ssh_session_struct,
+        ssh_signature_struct,
+        ssh_socket_struct,
+        ssh_string_struct,
+        ssh_threads_callbacks_struct,
+        ssh_timestamp)
+    set(DOXYGEN_EXCLUDE_SYMBOLS_MACRO
+        SSH_FXP*,
+        SSH_SOCKET*,
+        SERVERBANNER,
+        SOCKOPT_TYPE_ARG4,
+        SSH_FILEXFER*,
+        SSH_FXF*,
+        SSH_S_*,
+        SFTP_*,
+        NSS_BUFLEN_PASSWD,
+        CLOCK,
+        MAX_LINE_SIZE,
+        PKCS11_URI,
+        KNOWNHOSTS_MAXTYPES)
+    set(DOXYGEN_EXCLUDE_SYMBOLS_TYPEDEFS
+        sftp_attributes,
+        sftp_client_message,
+        sftp_dir,
+        sftp_ext,
+        sftp_file,
+        sftp_message,
+        sftp_packet,
+        sftp_request_queue,
+        sftp_status_message,
+        sftp_statvfs_t,
+        poll_fn,
+        ssh_callback_int,
+        ssh_callback_data,
+        ssh_callback_int_int,
+        ssh_message_callback,
+        ssh_channel_callback_int,
+        ssh_channel_callback_data,
+        ssh_callbacks,
+        ssh_gssapi_select_oid_callback,
+        ssh_gssapi_accept_sec_ctx_callback,
+        ssh_gssapi_verify_mic_callback,
+        ssh_server_callbacks,
+        ssh_socket_callbacks,
+        ssh_packet_callbacks,
+        ssh_channel_callbacks,
+        ssh_bind,
+        ssh_bind_callbacks)
+    set(DOXYGEN_EXCLUDE_SYMBOLS
+        ${DOXYGEN_EXCLUDE_SYMBOLS_STRUCTS} ${DOXYGEN_EXCLUDE_SYMBOLS_MACRO}
+        ${DOXYGEN_EXCLUDE_SYMBOLS_TYPEDEFS})
+
+    # Custom layout file to rename "Topics" to "API Reference" and simplify
+    # navigation
+    set(DOXYGEN_LAYOUT_FILE ${CMAKE_CURRENT_SOURCE_DIR}/DoxygenLayout.xml)
+    # Custom HTML header with doxygen-awesome extension initialization
+    set(DOXYGEN_HTML_HEADER ${CMAKE_CURRENT_SOURCE_DIR}/header.html)
+    # Modern CSS theme for documentation with custom libssh.org color scheme
+    set(DOXYGEN_HTML_EXTRA_STYLESHEET
+        ${AWESOME_CSS_DIR}/doxygen-awesome.css
+        ${CMAKE_CURRENT_SOURCE_DIR}/doxygen-custom.css)
+    # JavaScript extensions: dark mode toggle, copy button, paragraph links,
+    # interactive TOC
+    set(DOXYGEN_HTML_EXTRA_FILES
+        ${AWESOME_CSS_DIR}/doxygen-awesome-darkmode-toggle.js
+        ${AWESOME_CSS_DIR}/doxygen-awesome-fragment-copy-button.js
+        ${AWESOME_CSS_DIR}/doxygen-awesome-paragraph-link.js
+        ${AWESOME_CSS_DIR}/doxygen-awesome-interactive-toc.js)
 
-    # This updates the Doxyfile if we do changes here
     set(_doxyfile_template "${CMAKE_BINARY_DIR}/CMakeDoxyfile.in")
     set(_target_doxyfile "${CMAKE_CURRENT_BINARY_DIR}/Doxyfile.docs")
     configure_file("${_doxyfile_template}" "${_target_doxyfile}")
 
-    doxygen_add_docs(docs
+    doxygen_add_docs(docs ${CMAKE_SOURCE_DIR}/include/libssh
-                     ${CMAKE_SOURCE_DIR}/include/libssh
+                     ${CMAKE_SOURCE_DIR}/src ${CMAKE_CURRENT_SOURCE_DIR})
-                     ${CMAKE_SOURCE_DIR}/src
-                     ${CMAKE_CURRENT_SOURCE_DIR})
 
-    add_custom_target(docs_coverage COMMAND ${CMAKE_SOURCE_DIR}/doc/doc_coverage.sh ${CMAKE_BINARY_DIR})
+    # Make docs depend on doxygen-awesome-css download (if not using local dir)
-endif() # DOXYGEN_FOUND
+    if (TARGET doxygen-awesome-css)
+        add_dependencies(docs doxygen-awesome-css)
+    endif ()
 
-endif() # CMAKE_VERSION
+    add_custom_target(
+        docs_coverage COMMAND ${CMAKE_SOURCE_DIR}/doc/doc_coverage.sh
+                              ${CMAKE_BINARY_DIR})
+endif (DOXYGEN_FOUND)

doc/DoxygenLayout.xml

@@ -0,0 +1,242 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<doxygenlayout version="2.0">
+  <!-- Generated by doxygen 1.14.0 -->
+  <!-- Navigation index tabs for HTML output -->
+  <navindex>
+    <tab type="mainpage" visible="yes" title=""/>
+    <tab type="topics" visible="yes" title="API Reference" intro=""/>
+    <tab type="pages" visible="yes" title="" intro=""/>
+    <tab type="files" visible="yes" title="">
+      <tab type="filelist" visible="yes" title="" intro=""/>
+      <tab type="globals" visible="yes" title="" intro=""/>
+    </tab>
+    <tab type="structs" visible="yes" title="">
+      <tab type="structlist" visible="yes" title="" intro=""/>
+      <tab type="structindex" visible="$ALPHABETICAL_INDEX" title=""/>
+    </tab>
+  </navindex>
+
+  <!-- Layout definition for a class page -->
+  <class>
+    <briefdescription visible="yes"/>
+    <includes visible="$SHOW_HEADERFILE"/>
+    <inheritancegraph visible="yes"/>
+    <collaborationgraph visible="yes"/>
+    <memberdecl>
+      <nestedclasses visible="yes" title=""/>
+      <publictypes visible="yes" title=""/>
+      <services visible="yes" title=""/>
+      <interfaces visible="yes" title=""/>
+      <publicslots visible="yes" title=""/>
+      <signals visible="yes" title=""/>
+      <publicmethods visible="yes" title=""/>
+      <publicstaticmethods visible="yes" title=""/>
+      <publicattributes visible="yes" title=""/>
+      <publicstaticattributes visible="yes" title=""/>
+      <protectedtypes visible="yes" title=""/>
+      <protectedslots visible="yes" title=""/>
+      <protectedmethods visible="yes" title=""/>
+      <protectedstaticmethods visible="yes" title=""/>
+      <protectedattributes visible="yes" title=""/>
+      <protectedstaticattributes visible="yes" title=""/>
+      <packagetypes visible="yes" title=""/>
+      <packagemethods visible="yes" title=""/>
+      <packagestaticmethods visible="yes" title=""/>
+      <packageattributes visible="yes" title=""/>
+      <packagestaticattributes visible="yes" title=""/>
+      <properties visible="yes" title=""/>
+      <events visible="yes" title=""/>
+      <privatetypes visible="yes" title=""/>
+      <privateslots visible="yes" title=""/>
+      <privatemethods visible="yes" title=""/>
+      <privatestaticmethods visible="yes" title=""/>
+      <privateattributes visible="yes" title=""/>
+      <privatestaticattributes visible="yes" title=""/>
+      <friends visible="yes" title=""/>
+      <related visible="yes" title="" subtitle=""/>
+      <membergroups visible="yes"/>
+    </memberdecl>
+    <detaileddescription visible="yes" title=""/>
+    <memberdef>
+      <inlineclasses visible="yes" title=""/>
+      <typedefs visible="yes" title=""/>
+      <enums visible="yes" title=""/>
+      <services visible="yes" title=""/>
+      <interfaces visible="yes" title=""/>
+      <constructors visible="yes" title=""/>
+      <functions visible="yes" title=""/>
+      <related visible="yes" title=""/>
+      <variables visible="yes" title=""/>
+      <properties visible="yes" title=""/>
+      <events visible="yes" title=""/>
+    </memberdef>
+    <allmemberslink visible="yes"/>
+    <usedfiles visible="$SHOW_USED_FILES"/>
+    <authorsection visible="yes"/>
+  </class>
+
+  <!-- Layout definition for a namespace page -->
+  <namespace>
+    <briefdescription visible="yes"/>
+    <memberdecl>
+      <nestednamespaces visible="yes" title=""/>
+      <constantgroups visible="yes" title=""/>
+      <interfaces visible="yes" title=""/>
+      <classes visible="yes" title=""/>
+      <concepts visible="yes" title=""/>
+      <structs visible="yes" title=""/>
+      <exceptions visible="yes" title=""/>
+      <typedefs visible="yes" title=""/>
+      <sequences visible="yes" title=""/>
+      <dictionaries visible="yes" title=""/>
+      <enums visible="yes" title=""/>
+      <functions visible="yes" title=""/>
+      <variables visible="yes" title=""/>
+      <properties visible="yes" title=""/>
+      <membergroups visible="yes"/>
+    </memberdecl>
+    <detaileddescription visible="yes" title=""/>
+    <memberdef>
+      <inlineclasses visible="yes" title=""/>
+      <typedefs visible="yes" title=""/>
+      <sequences visible="yes" title=""/>
+      <dictionaries visible="yes" title=""/>
+      <enums visible="yes" title=""/>
+      <functions visible="yes" title=""/>
+      <variables visible="yes" title=""/>
+      <properties visible="yes" title=""/>
+    </memberdef>
+    <authorsection visible="yes"/>
+  </namespace>
+
+  <!-- Layout definition for a concept page -->
+  <concept>
+    <briefdescription visible="yes"/>
+    <includes visible="$SHOW_HEADERFILE"/>
+    <definition visible="yes" title=""/>
+    <detaileddescription visible="yes" title=""/>
+    <authorsection visible="yes"/>
+  </concept>
+
+  <!-- Layout definition for a file page -->
+  <file>
+    <briefdescription visible="yes"/>
+    <includes visible="$SHOW_INCLUDE_FILES"/>
+    <includegraph visible="yes"/>
+    <includedbygraph visible="yes"/>
+    <sourcelink visible="yes"/>
+    <memberdecl>
+      <interfaces visible="yes" title=""/>
+      <classes visible="yes" title=""/>
+      <structs visible="yes" title=""/>
+      <exceptions visible="yes" title=""/>
+      <namespaces visible="yes" title=""/>
+      <concepts visible="yes" title=""/>
+      <constantgroups visible="yes" title=""/>
+      <defines visible="yes" title=""/>
+      <typedefs visible="yes" title=""/>
+      <sequences visible="yes" title=""/>
+      <dictionaries visible="yes" title=""/>
+      <enums visible="yes" title=""/>
+      <functions visible="yes" title=""/>
+      <variables visible="yes" title=""/>
+      <properties visible="yes" title=""/>
+      <membergroups visible="yes"/>
+    </memberdecl>
+    <detaileddescription visible="yes" title=""/>
+    <memberdef>
+      <inlineclasses visible="yes" title=""/>
+      <defines visible="yes" title=""/>
+      <typedefs visible="yes" title=""/>
+      <sequences visible="yes" title=""/>
+      <dictionaries visible="yes" title=""/>
+      <enums visible="yes" title=""/>
+      <functions visible="yes" title=""/>
+      <variables visible="yes" title=""/>
+      <properties visible="yes" title=""/>
+    </memberdef>
+    <authorsection/>
+  </file>
+
+  <!-- Layout definition for a group page -->
+  <group>
+    <briefdescription visible="yes"/>
+    <groupgraph visible="yes"/>
+    <memberdecl>
+      <nestedgroups visible="yes" title=""/>
+      <modules visible="yes" title=""/>
+      <dirs visible="yes" title=""/>
+      <files visible="yes" title=""/>
+      <namespaces visible="yes" title=""/>
+      <concepts visible="yes" title=""/>
+      <classes visible="yes" title=""/>
+      <defines visible="yes" title=""/>
+      <typedefs visible="yes" title=""/>
+      <sequences visible="yes" title=""/>
+      <dictionaries visible="yes" title=""/>
+      <enums visible="yes" title=""/>
+      <enumvalues visible="yes" title=""/>
+      <functions visible="yes" title=""/>
+      <variables visible="yes" title=""/>
+      <signals visible="yes" title=""/>
+      <publicslots visible="yes" title=""/>
+      <protectedslots visible="yes" title=""/>
+      <privateslots visible="yes" title=""/>
+      <events visible="yes" title=""/>
+      <properties visible="yes" title=""/>
+      <friends visible="yes" title=""/>
+      <membergroups visible="yes"/>
+    </memberdecl>
+    <detaileddescription visible="yes" title=""/>
+    <memberdef>
+      <pagedocs/>
+      <inlineclasses visible="yes" title=""/>
+      <defines visible="yes" title=""/>
+      <typedefs visible="yes" title=""/>
+      <sequences visible="yes" title=""/>
+      <dictionaries visible="yes" title=""/>
+      <enums visible="yes" title=""/>
+      <enumvalues visible="yes" title=""/>
+      <functions visible="yes" title=""/>
+      <variables visible="yes" title=""/>
+      <signals visible="yes" title=""/>
+      <publicslots visible="yes" title=""/>
+      <protectedslots visible="yes" title=""/>
+      <privateslots visible="yes" title=""/>
+      <events visible="yes" title=""/>
+      <properties visible="yes" title=""/>
+      <friends visible="yes" title=""/>
+    </memberdef>
+    <authorsection visible="yes"/>
+  </group>
+
+  <!-- Layout definition for a C++20 module page -->
+  <module>
+    <briefdescription visible="yes"/>
+    <exportedmodules visible="yes"/>
+    <memberdecl>
+      <concepts visible="yes" title=""/>
+      <classes visible="yes" title=""/>
+      <enums visible="yes" title=""/>
+      <typedefs visible="yes" title=""/>
+      <functions visible="yes" title=""/>
+      <variables visible="yes" title=""/>
+      <membergroups visible="yes" title=""/>
+    </memberdecl>
+    <detaileddescription visible="yes" title=""/>
+    <memberdecl>
+      <files visible="yes"/>
+    </memberdecl>
+  </module>
+
+  <!-- Layout definition for a directory page -->
+  <directory>
+    <briefdescription visible="yes"/>
+    <directorygraph visible="yes"/>
+    <memberdecl>
+      <dirs visible="yes"/>
+      <files visible="yes"/>
+    </memberdecl>
+    <detaileddescription visible="yes" title=""/>
+  </directory>
+</doxygenlayout>

doc/authentication.dox

@@ -105,7 +105,7 @@ Here is a small example of password authentication:
 @code
 int authenticate_password(ssh_session session)
 {
-  char *password;
+  char *password = NULL;
   int rc;
 
   password = getpass("Enter your password: ");
@@ -218,7 +218,7 @@ int authenticate_kbdint(ssh_session session)
   rc = ssh_userauth_kbdint(session, NULL, NULL);
   while (rc == SSH_AUTH_INFO)
   {
-    const char *name, *instruction;
+    const char *name = NULL, *instruction = NULL;
     int nprompts, iprompt;
 
     name = ssh_userauth_kbdint_getname(session);
@@ -231,7 +231,7 @@ int authenticate_kbdint(ssh_session session)
       printf("%s\n", instruction);
     for (iprompt = 0; iprompt < nprompts; iprompt++)
     {
-      const char *prompt;
+      const char *prompt = NULL;
       char echo;
 
       prompt = ssh_userauth_kbdint_getprompt(session, iprompt, &echo);
@@ -251,7 +251,7 @@ int authenticate_kbdint(ssh_session session)
       }
       else
       {
-        char *ptr;
+        char *ptr = NULL;
 
         ptr = getpass(prompt);
         if (ssh_userauth_kbdint_setanswer(session, iprompt, ptr) < 0)
@@ -354,7 +354,7 @@ The following example shows how to retrieve and dispose the issue banner:
 int display_banner(ssh_session session)
 {
   int rc;
-  char *banner;
+  char *banner = NULL;
 
 /*
  *** Does not work without calling ssh_userauth_none() first ***

doc/command.dox

@@ -22,7 +22,7 @@ a SSH session that uses this channel:
 @code
 int show_remote_files(ssh_session session)
 {
-  ssh_channel channel;
+  ssh_channel channel = NULL;
   int rc;
 
   channel = ssh_channel_new(session);
@@ -91,4 +91,10 @@ that it used:
 }
 @endcode
 
+Warning: In a single channel, only ONE command can be executed!
+If you want to executed multiple commands, allocate separate channels for
+them or consider opening interactive shell.
+Attempting to run multiple consecutive commands in one channel will fail.
+
+
 */

doc/doxygen-custom.css

@@ -0,0 +1,127 @@
+/**
+ * Custom color scheme for libssh documentation
+ * Based on libssh.org color palette
+ */
+
+html {
+    /* Primary colors - using libssh.org orange accent */
+    --primary-color: #F78C40;
+    --primary-dark-color: #f57900;
+    --primary-light-color: #fab889;
+
+    /* Accent color - neutral gray */
+    --primary-lighter-color: #5A5A5A;
+
+    /* Page colors - clean white background */
+    --page-background-color: #ffffff;
+    --page-foreground-color: #333333;
+    --page-secondary-foreground-color: #666666;
+
+    /* Links - use the warm orange color */
+    --link-color: #F78C40;
+    --link-hover-color: #f0690a;
+
+    /* Code blocks and fragments - very light background */
+    --code-background: #f9f9f9;
+    --fragment-background: #f9f9f9;
+
+    /* Borders - subtle light grey */
+    --separator-color: #e0e0e0;
+    --border-light-color: #f0f0f0;
+
+    /* Side navigation - pure white */
+    --side-nav-background: #ffffff;
+
+    /* Menu colors - warm orange accent */
+    --menu-selected-background: #F78C40;
+
+    /* Tables and boxes - lighter */
+    --tablehead-background: #fbc7a2;
+    --tablehead-foreground: #333333;
+}
+
+/* Header styling with libssh brand colors */
+#titlearea {
+    background-color: #5A5A5A;
+    background-image: linear-gradient(to right, #5A5A5A, #6a6a6a);
+    border-bottom: 3px solid #F78C40;
+}
+
+#projectname {
+    color: #ffffff !important;
+}
+
+#projectbrief {
+    color: #fab889 !important;
+}
+
+/* Top navigation tabs */
+#top {
+    background: linear-gradient(to bottom, #5A5A5A 0%, #6a6a6a 100%);
+}
+
+.tabs, .tabs2, .tabs3 {
+    background-image: none;
+    background-color: transparent;
+}
+
+.tablist li {
+    background: rgba(255, 255, 255, 0.1);
+    border-right: 1px solid rgba(255, 255, 255, 0.2);
+}
+
+.tablist li:hover {
+    background: rgba(255, 255, 255, 0.2);
+}
+
+.tablist li.current {
+    background: #F78C40;
+    border-bottom: 3px solid #f57900;
+}
+
+/* Tab text colors - comprehensive selectors */
+#nav-path ul li a,
+.tabs a,
+.tabs2 a,
+.tabs3 a,
+.tablist a,
+.tablist a:link,
+.tablist a:visited,
+.tablist li a,
+#main-nav a,
+.sm > li > a,
+.sm > li > a .sub-arrow {
+    color: #ffffff !important;
+    text-shadow: 0px 1px 2px rgba(0, 0, 0, 0.3);
+}
+
+/* Active/current tab text */
+#nav-path ul li.current a,
+.tabs .current a,
+.tabs2 .current a,
+.tabs3 .current a,
+.tablist .current a,
+.tablist .current a:link,
+.tablist .current a:visited,
+.tablist li.current a,
+#main-nav .current a,
+.sm .current a {
+    color: #333333 !important;
+    text-shadow: none;
+}
+
+/* Dropdown arrow - white color for top menu */
+.sm-dox a span.sub-arrow {
+    border-right-color: #ffffff !important;
+    border-bottom-color: #ffffff !important;
+}
+
+/* Dropdown menu text - must be dark on white background */
+/* Make this as specific as possible to override white color */
+.sm-dox > li > ul > li > a,
+.sm-dox li ul li a,
+.sm-dox ul li a,
+#main-menu ul li a {
+    color: #333333 !important;
+    text-shadow: none !important;
+}

doc/fetch_doxygen_awesome.cmake

@@ -0,0 +1,41 @@
+# Script to download doxygen-awesome-css at build time
+#
+# Usage:
+#   cmake -P fetch_doxygen_awesome.cmake \
+#         -DURL=<download_url> \
+#         -DDEST_DIR=<destination_directory> \
+#         -DVERSION=<version>
+
+if(NOT DEFINED URL)
+    message(FATAL_ERROR "URL not specified")
+endif()
+if(NOT DEFINED DEST_DIR)
+    message(FATAL_ERROR "DEST_DIR not specified")
+endif()
+if(NOT DEFINED VERSION)
+    message(FATAL_ERROR "VERSION not specified")
+endif()
+
+set(EXTRACT_DIR "${DEST_DIR}/doxygen-awesome-css-${VERSION}")
+
+if(NOT EXISTS "${EXTRACT_DIR}/doxygen-awesome.css")
+    message(STATUS "Downloading doxygen-awesome-css ${VERSION}...")
+    set(TARBALL "${DEST_DIR}/doxygen-awesome-css.tar.gz")
+    file(DOWNLOAD
+        "${URL}"
+        "${TARBALL}"
+        STATUS download_status
+        SHOW_PROGRESS
+    )
+    list(GET download_status 0 status_code)
+    if(NOT status_code EQUAL 0)
+        list(GET download_status 1 error_msg)
+        message(FATAL_ERROR "Download failed: ${error_msg}")
+    endif()
+    message(STATUS "Extracting doxygen-awesome-css...")
+    file(ARCHIVE_EXTRACT
+        INPUT "${TARBALL}"
+        DESTINATION "${DEST_DIR}"
+    )
+    file(REMOVE "${TARBALL}")
+endif()

doc/fido2.dox

@@ -0,0 +1,601 @@
+/**
+
+@page libssh_tutor_fido2 Chapter 11: FIDO2/U2F Keys Support
+
+@section fido2_intro Introduction
+
+The traditional SSH public key model stores the private key on disk
+and anyone who obtains that file (and possibly its passphrase) can impersonate
+the user. FIDO2 authenticators, such as USB security keys, are hardware tokens
+that generate or securely store private key material within a secure element
+and may require explicit user interaction such as a touch, PIN, or biometric
+verification for use. Hence, security keys are far safer from theft or
+exfiltration than traditional file-based SSH keys. libssh provides support
+for FIDO2/U2F security keys as hardware-backed SSH authentication credentials.
+
+This chapter explains the concepts, build prerequisites, the API, and
+usage patterns for enrolling (creating) and using security key-backed SSH
+keys, including resident (discoverable) credentials.
+
+@subsection fido2_resident_keys Resident Keys
+
+Two credential storage modes exist for security keys:
+
+ - Non-resident (default): A credential ID (key handle) and metadata are
+	 stored on the client-side in a key file. This key handle must be
+	 presented to the FIDO2/U2F device while signing. This is somewhat
+	 similar to traditional SSH keys, except that the key handle is not the
+	 private key itself, but used in combination with the device's master key
+	 to derive the actual private key.
+
+ - Resident (discoverable): The credential (and metadata like user id) is
+	 stored on the device. No local file is needed; the device can enumerate or
+	 locate the credential internally when queried.
+
+Advantages of resident keys include portability (using the same device
+across hosts) and resilience (no loss if the local machine is destroyed).
+Although, they may be limited by the storage of the authenticator.
+
+@subsection fido2_presence_verification User Presence vs. User Verification
+
+FIDO2 distinguishes between:
+
+ - User Presence (UP): A simple physical interaction (touch) to confirm a
+	 human is present.
+
+ - User Verification (UV): Verification of the user’s identity through
+     biometric authentication or a PIN.
+
+Requiring UV provides additional protection if the device is stolen
+and used without the PIN/biometric.
+
+libssh exposes flags controlling these requirements (see below).
+
+@subsection fido2_callbacks The Callback Abstraction
+
+Different environments may need to access security keys through different
+transport layers (e.g., USB-HID, NFC, Bluetooth, etc.). To accommodate
+this variability, libssh does not hard-code a single implementation.
+
+Instead, it defines a small callback interface (`ssh_sk_callbacks`) used for all
+security key operations. Any implementation of this callback interface can be used
+by higher-level PKI functions to perform enroll/sign/load_resident_keys
+operations without needing to know the transport specifics. Hence, users can
+define their own implementations for these callbacks to support different
+transport protocols or custom hardware. Refer @ref fido2_custom_callbacks
+for additional details.
+
+The callback interface is defined in `libssh/callbacks.h` and the behaviour
+and return values are specified by `libssh/sk_api.h`, which is the same
+interface defined by OpenSSH for its security key support. This means that
+any callback implementations (also called "middleware" in OpenSSH terminology)
+developed for OpenSSH can be adapted to libssh with minimal changes.
+
+The following operations are abstracted by the callback interface:
+
+ - api_version(): Report the version of the SK API that the callback implementation
+   is based on, so that libssh can check whether this implementation would be
+   compatible with the SK API version that it supports.
+   Refer @ref fido2_custom_callbacks_version for additional details.
+ - enroll(): Create (enroll) a new credential, returning public key, key
+	 handle, attestation data.
+ - sign(): Produce a signature for supplied inputs using an existing key
+	 handle.
+ - load_resident_keys(): Enumerate resident (discoverable) credentials stored
+	 on the authenticator.
+
+libssh provides a default implementation of the `ssh_sk_callbacks` using
+the libfido2 library for the USB-HID transport protocol. Hence, by default,
+libssh can interact with any FIDO2/U2F device that supports USB-HID and is
+compatible with libfido2, without requiring any additional modifications.
+
+@subsection fido2_build Building with FIDO2 Support
+
+To enable FIDO2/U2F support, libssh must be built with the WITH_FIDO2
+build option as follows:
+
+@verbatim
+	cmake -DWITH_FIDO2=ON <other options> ..
+@endverbatim
+
+libssh will also build the default USB-HID `ssh_sk_callbacks`, if the
+libfido2 library and headers are installed on your system.
+
+@warning If built without libfido2, support for interacting with FIDO2/U2F
+devices over USB-HID will not be available.
+
+@subsection fido2_api_overview API Overview
+
+Security key operations are configured through the `ssh_pki_ctx`
+which allows to specify both general PKI options and FIDO2-specific
+options such as the sk_callbacks, challenge data, application string, flags, etc.
+
+The following sections describe the options that can be configured and how
+the `ssh_pki_ctx` is used in conjunction with `ssh_key` to perform
+enrollment, signing, and resident key loading operations.
+
+@subsection fido2_key_objects Security Key Objects & Metadata
+
+Security keys are surfaced as `ssh_key` objects of type
+`SSH_KEYTYPE_SK_ECDSA` and `SSH_KEYTYPE_SK_ED25519` (corresponding to the
+OpenSSH public key algorithm names `sk-ecdsa-sha2-nistp256@openssh.com` and
+`sk-ssh-ed25519@openssh.com`). In addition to standard key handling, libssh
+exposes the following helper functions to retrieve embedded SK metadata:
+
+ - ssh_key_get_sk_application(): Returns the relying party / application
+	 (RP ID) string. The Relying Party ID (RP ID) is a string
+	 that identifies the application or service requesting key enrollment. It
+	 ensures that a credential is bound to a specific origin, preventing
+	 phishing across sites. During registration, the authenticator associates
+	 the credential with this RP ID so that it can later only be used for
+	 authentication requests from the same relying party. For SSH keys, the
+	 common format is "ssh:user@host".
+
+ - ssh_key_get_sk_user_id(): Returns a copy of the user ID associated with a key
+	 which represents a unique identifier for the user within the relying
+	 party (application) context. It is typically a string (such as an
+	 email, or a random identifier) that helps distinguish credentials
+	 belonging to different users for the same application.
+
+   Though the user ID can be binary data according to the FIDO2 spec, libssh only
+   supports NUL-terminated strings for enrolling new keys in order to remain compatible
+   with the OpenSSH's sk-api interface.
+
+   However, libssh does support loading existing resident keys with user IDs containing
+   arbitrary binary data. It does so by using an `ssh_string` to store the loaded key's
+   user_id, and an `ssh_string` can contain arbitrary binary data that can not be stored
+   in a traditional NUL-terminated string (like null bytes).
+
+   @note The user_id is NOT stored in the key file for non-resident keys. It is only
+   available for resident (discoverable) keys loaded from the authenticator via
+   ssh_sk_resident_keys_load(). For keys imported from files, this function returns
+   NULL.
+
+ - ssh_key_get_sk_flags(): Returns the flags associated with the key. The
+	 following are the supported flags and they can be combined using
+	 bitwise OR:
+     - SSH_SK_USER_PRESENCE_REQD : Require user presence (touch).
+     - SSH_SK_USER_VERIFICATION_REQD : Require user verification
+	   (PIN/biometric).
+     - SSH_SK_RESIDENT_KEY : Request a resident discoverable credential.
+     - SSH_SK_FORCE_OPERATION : Force resident (discoverable) credential
+	   creation even if one with same application and user_id already
+	   exists.
+
+These functions perform no additional communication with the
+authenticator, this metadata is captured during enrollment/loading and
+cached in the `ssh_key`.
+
+@subsection fido2_options Setting Security Key Context Options
+
+Options are set via ssh_pki_ctx_options_set().
+
+Representative security key options:
+ - SSH_PKI_OPTION_SK_APPLICATION (const char *): Required relying party ID
+   If not set, a default value of "ssh:" is used.
+ - SSH_PKI_OPTION_SK_FLAGS (uint8_t *): Flags described above. If not set,
+   defaults to SSH_SK_USER_PRESENCE_REQD. This is because OpenSSH `sshd`
+   requires user presence for security key authentication by default.
+ - SSH_PKI_OPTION_SK_USER_ID (const char *): Represents a unique identifier
+   for the user within the relying party (application) context.
+   It is typically a string (such as an email, or a random identifier) that
+   helps distinguish credentials belonging to different users for the same
+   application. If not set, defaults to 64 zeros.
+ - SSH_PKI_OPTION_SK_CHALLENGE (ssh_buffer): Custom challenge; if omitted a
+   random 32-byte challenge is generated.
+ - SSH_PKI_OPTION_SK_CALLBACKS (ssh_sk_callbacks): Replace the default
+   callbacks with custom callbacks.
+
+PIN callback: Use ssh_pki_ctx_set_sk_pin_callback() to register a function
+matching `ssh_auth_callback` to prompt for and supply a PIN. The callback may
+be called multiple times to ask for the pin depending on the authenticator policy.
+
+Callback options: Callback implementations may accept additional configuration
+name/value options such as the path to the fido device. These options can be provided via
+`ssh_pki_ctx_sk_callbacks_option_set()`. Refer @ref fido2_custom_callbacks_options
+for additional details.
+
+The built-in callback implementation provided by libssh supports additional options,
+with their names defined in `libssh.h` prefixed with `SSH_SK_OPTION_NAME_*`, such as:
+
+SSH_SK_OPTION_NAME_DEVICE_PATH: Used for specifying a device path.
+If the device path is not specified and multiple devices are connected, then
+depending upon the operation and the flags set, the callback implementation may
+automatically select a suitable device, or the user may be prompted to touch the
+device they want to use.
+
+SSH_SK_OPTION_NAME_USER_ID: Used for setting the user ID.
+Note that the user ID can also be set using the ssh_pki_ctx_options_set() API.
+
+@subsection fido2_enrollment Enrollment Example
+
+An enrollment operation creates a new credential on the authenticator and
+returns an ssh_key object representing it. The application and user_id
+fields are required for creating the credential. The other options are
+optional. A successful enrollment returns the public key, key handle, and
+metadata which are stored in the ssh_key object, and may optionally return
+attestation data which is used for verifying the authenticator model and
+firmware version.
+
+Below is a simple example enrolling an Ed25519 security key (non-resident)
+requiring user presence only:
+
+@code
+#include <libssh/libssh.h>
+#include <string.h>
+
+static int pin_cb(const char *prompt,
+                  char *buf,
+                  size_t len,
+                  int echo,
+                  int verify,
+                  void *userdata)
+{
+    (void)prompt;
+    (void)echo;
+    (void)verify;
+    (void)userdata;
+
+    /* In a real application, the user would be prompted to enter the PIN */
+    const char *pin = "4242";
+    size_t l = strlen(pin);
+    if (l + 1 > len) {
+        return SSH_ERROR;
+    }
+
+    memcpy(buf, pin, l + 1);
+    return SSH_OK;
+}
+
+int enroll_sk_key()
+{
+    const char *app = "ssh:user@host";
+    const char *user_id = "alice";
+    uint8_t flags = SSH_SK_USER_PRESENCE_REQD | SSH_SK_USER_VERIFICATION_REQD;
+    const char *device_path = "/dev/hidraw6"; /* Optional device path */
+
+    ssh_pki_ctx pki_ctx = ssh_pki_ctx_new();
+    ssh_pki_ctx_options_set(pki_ctx, SSH_PKI_OPTION_SK_APPLICATION, app);
+    ssh_pki_ctx_options_set(pki_ctx, SSH_PKI_OPTION_SK_USER_ID, user_id);
+    ssh_pki_ctx_options_set(pki_ctx, SSH_PKI_OPTION_SK_FLAGS, &flags);
+
+    ssh_pki_ctx_set_sk_pin_callback(pki_ctx, pin_cb, NULL);
+
+    ssh_pki_ctx_sk_callbacks_option_set(pki_ctx,
+                                        SSH_SK_OPTION_NAME_DEVICE_PATH,
+                                        device_path,
+                                        true);
+
+    ssh_key enrolled = NULL;
+    int rc = ssh_pki_generate_key(SSH_KEYTYPE_SK_ED25519,
+                                  pki_ctx,
+                                  &enrolled); /* produces sk-ed25519 key */
+
+    /* Save enrolled key using ssh_pki_export_privkey_file, retrieve attestation
+     * buffer etc. */
+
+    /* Free context and key when done */
+}
+@endcode
+
+After a successful enrollment, you can retrieve the attestation buffer
+(if provided by the authenticator) from the PKI context:
+
+@code
+ssh_buffer att_buf = NULL;
+rc = ssh_pki_ctx_get_sk_attestation_buffer(pki_ctx, &att_buf);
+if (rc == SSH_OK && att_buf != NULL) {
+    /* att_buf now contains the serialized attestation
+     * ("ssh-sk-attest-v01"). You can inspect, save, or
+     * parse the buffer as needed
+     */
+    ssh_buffer_free(att_buf);
+}
+@endcode
+
+Notes:
+- The attestation buffer is only populated if the enrollment operation
+  succeeds and the authenticator provides attestation data.
+- `ssh_pki_ctx_get_sk_attestation_buffer()` returns a copy of the attestation
+  buffer; the caller must free it with `ssh_buffer_free()`.
+
+@subsection fido2_signing Authenticating with a Stored Security Key Public Key
+
+To authenticate using a security key, the application typically loads the
+previously enrolled sk-* private key, establishes an SSH connection, and
+calls `ssh_userauth_publickey()`. libssh automatically recognizes security
+key types and transparently handles the required hardware-backed
+authentication steps such as prompting for a touch or PIN using the
+configured security key callbacks.
+
+Example:
+@code
+#include <libssh/libssh.h>
+#include <stdio.h>
+
+int auth_with_sk_file(const char *host,
+                      const char *user,
+                      const char *privkey_path)
+{
+    ssh_session session = NULL;
+    ssh_key privkey = NULL;
+    int rc = SSH_ERROR;
+
+    session = ssh_new();
+    ssh_options_set(session, SSH_OPTIONS_HOST, host);
+    ssh_options_set(session, SSH_OPTIONS_USER, user);
+    ssh_connect(session);
+
+    ssh_pki_import_privkey_file(privkey_path, NULL, NULL, NULL, &privkey);
+
+    ssh_pki_ctx pki_ctx = ssh_pki_ctx_new();
+    /* Optionally set PIN callback, device path, etc. */
+    /* ssh_pki_ctx_set_sk_pin_callback(pki_ctx, pin_cb, NULL); */
+
+    ssh_options_set(session, SSH_OPTIONS_PKI_CONTEXT, pki_ctx);
+
+    rc = ssh_userauth_publickey(session, user, privkey);
+    if (rc == SSH_AUTH_SUCCESS) {
+        printf("Authenticated with security key.\n");
+        rc = SSH_OK;
+    } else {
+        fprintf(stderr,
+                "Authentication failed rc=%d err=%s\n",
+                rc,
+                ssh_get_error(session));
+        rc = SSH_ERROR;
+    }
+
+    /* Free resources */
+}
+@endcode
+
+@subsection fido2_resident Resident Key Enumeration
+
+Resident keys stored on the device can be discovered and loaded with
+ssh_sk_resident_keys_load() which takes a PKI context (configured with
+a PIN callback) and returns each key as an ssh_key and the number of keys loaded.
+
+Example:
+
+@code
+#include <libssh/libssh.h>
+#include <stdio.h>
+#include <string.h>
+
+static int pin_cb(const char *prompt,
+                  char *buf,
+                  size_t len,
+                  int echo,
+                  int verify,
+                  void *userdata)
+{
+    (void)prompt;
+    (void)echo;
+    (void)verify;
+    (void)userdata;
+    const char *pin = "4242";
+    size_t l = strlen(pin);
+
+    if (l + 1 > len) {
+        return SSH_ERROR;
+    }
+
+    memcpy(buf, pin, l + 1);
+    return SSH_OK;
+}
+
+int auth_with_resident(const char *host,
+                       const char *user,
+                       const char *application,
+                       const char *user_id)
+{
+    ssh_pki_ctx pki_ctx = NULL;
+    size_t num_found = 0;
+    ssh_key *keys = NULL;
+    ssh_key final_key = NULL;
+    int rc = SSH_ERROR;
+
+    ssh_string cur_application = NULL;
+    ssh_string cur_user_id = NULL;
+    ssh_string expected_application = NULL;
+    ssh_string expected_user_id = NULL;
+
+    pki_ctx = ssh_pki_ctx_new();
+    ssh_pki_ctx_set_sk_pin_callback(pki_ctx, pin_cb, NULL);
+
+    expected_application = ssh_string_from_char(application);
+    expected_user_id = ssh_string_from_char(user_id);
+
+    rc = ssh_sk_resident_keys_load(pki_ctx, &keys, &num_found);
+    for (size_t i = 0; i < num_found; i++) {
+        cur_application = ssh_key_get_sk_application(keys[i]);
+        cur_user_id = ssh_key_get_sk_user_id(keys[i]);
+
+        if (ssh_string_cmp(cur_application, expected_application) == 0 &&
+            ssh_string_cmp(cur_user_id, expected_user_id) == 0) {
+            SSH_STRING_FREE(cur_application);
+            SSH_STRING_FREE(cur_user_id);
+            final_key = keys[i];
+            break;
+        }
+
+        SSH_STRING_FREE(cur_application);
+        SSH_STRING_FREE(cur_user_id);
+    }
+
+    SSH_STRING_FREE(expected_application);
+    SSH_STRING_FREE(expected_user_id);
+
+    /* Continue with authentication using the ssh_key with
+     * ssh_userauth_publickey as usual, and free resources when done. */
+}
+@endcode
+
+@subsection fido2_sshsig Signing using the sshsig API
+
+Security keys can also be used for general-purpose signing of arbitrary data
+(without SSH authentication) using the existing `sshsig_sign()` and `sshsig_verify()`
+functions. These functions work seamlessly with security key types
+(`SSH_KEYTYPE_SK_ECDSA` and `SSH_KEYTYPE_SK_ED25519`) and will automatically
+invoke the configured security key callbacks to perform hardware-backed signing
+operations.
+
+@subsection fido2_custom_callbacks Implementing Custom Callback Implementations
+
+Users may need to implement custom callback implementations to support
+different transport protocols (e.g., NFC, Bluetooth) beyond the default USB-HID
+support. This section describes how to implement and integrate custom callback
+implementations.
+
+To implement custom callbacks, you must include the following headers:
+
+@code
+#include <libssh/callbacks.h>  /* For ssh_sk_callbacks_struct */
+#include <libssh/sk_api.h>     /* For SK API constants and data structures */
+@endcode
+
+The `libssh/sk_api.h` header provides the complete interface specification including
+request/response structures, flags, and version macros.
+
+@subsubsection fido2_custom_callbacks_version API Version Compatibility
+
+libssh validates callback implementations by checking the API version returned by
+the `api_version()` callback. To ensure compatibility, libssh compares the major
+version (upper 16 bits) of the returned value with `LIBSSH_SK_API_VERSION_MAJOR`.
+If they don't match, libssh will reject the callback implementation.
+This ensures that the callbacks' SK API matches the major version expected by libssh,
+while allowing minor version differences.
+
+@subsubsection fido2_custom_callbacks_implementation Implementation Example
+
+Here's a minimal example of defining and using custom callbacks:
+
+@code
+#include <libssh/libssh.h>
+#include <libssh/callbacks.h>
+#include <libssh/sk_api.h>
+
+/* Your custom API version callback */
+static uint32_t my_sk_api_version(void)
+{
+    /* Match the major version, set your own minor version */
+    return SSH_SK_VERSION_MAJOR | 0x0001;
+}
+
+/* Your custom enroll callback */
+static int my_sk_enroll(uint32_t alg,
+                        const uint8_t *challenge,
+                        size_t challenge_len,
+                        const char *application,
+                        uint8_t flags,
+                        const char *pin,
+                        struct sk_option **options,
+                        struct sk_enroll_response **enroll_response)
+{
+    /* Parse options array to extract custom parameters */
+    if (options != NULL) {
+        for (size_t i = 0; options[i] != NULL; i++) {
+            if (strcmp(options[i]->name, "my_custom_option") == 0) {
+                /* Use options[i]->value */
+            }
+        }
+    }
+
+    /* Implement your enroll logic here */
+    /* ... */
+
+    return SSH_SK_ERR_GENERAL; /* Return appropriate error code */
+}
+
+/* Implement other required callbacks: sign, load_resident_keys */
+/* ... */
+
+/* Define your callback structure */
+static struct ssh_sk_callbacks_struct my_sk_callbacks = {
+    .size = sizeof(struct ssh_sk_callbacks_struct),
+    .api_version = my_sk_api_version,
+    .enroll = my_sk_enroll,
+    .sign = my_sk_sign,              /* Your implementation */
+    .load_resident_keys = my_sk_load_resident_keys,  /* Your implementation */
+};
+
+/* Usage example */
+void use_custom_callbacks(void)
+{
+    ssh_pki_ctx pki_ctx = ssh_pki_ctx_new();
+
+    /* Set your custom callbacks */
+    ssh_pki_ctx_options_set(pki_ctx,
+                            SSH_PKI_OPTION_SK_CALLBACKS,
+                            &my_sk_callbacks);
+
+    /* Pass custom options to your callbacks */
+    ssh_pki_ctx_sk_callbacks_option_set(pki_ctx,
+                                        "my_custom_option",
+                                        "my_custom_value",
+                                        false);
+
+    /* Use the context for enrollment, signing, etc. */
+}
+@endcode
+
+@subsubsection fido2_custom_callbacks_options Passing Custom Options
+
+The `ssh_pki_ctx_sk_callbacks_option_set()` function allows you to pass
+implementation-specific options as name/value string pairs:
+
+@code
+ssh_pki_ctx_sk_callbacks_option_set(pki_ctx,
+                                    "option_name",
+                                    "option_value",
+                                    required);
+@endcode
+
+Parameters:
+- `option_name`: The name of the option (e.g., "device_path", "my_custom_param")
+- `option_value`: The string value for this option
+- `required`: If true, this option must be processed by the callback implementation
+  and cannot be ignored. If false, the option is advisory and can be skipped if the
+  callback implementation does not support it.
+
+These options are passed to your callbacks in the `struct sk_option **options`
+parameter as a NULL-terminated array. Each `sk_option` has the following fields:
+- `name`: The option name (char *)
+- `value`: The option value (char *)
+- `required`: Whether the option must be processed (uint8_t, non-zero = required)
+
+@subsubsection fido2_custom_callbacks_openssh OpenSSH Middleware Compatibility
+
+Since libssh uses the same SK API as OpenSSH, middleware implementations developed
+for OpenSSH can be adapted with minimal changes.
+To adapt an OpenSSH middleware for libssh, create a wrapper that populates
+`ssh_sk_callbacks_struct` with pointers to the middleware's functions.
+
+@subsection fido2_testing Testing and Environment Variables
+
+Unit tests covering USB-HID enroll/sign/load_resident_keys operations can be found
+in the `tests/unittests/torture_sk_usbhid.c` file. To run these tests you
+must have libfido2 installed and the WITH_FIDO2=ON build option set.
+Additionally, you must ensure the following:
+
+ - An actual FIDO2 device must be connected to the test machine.
+ - The TORTURE_SK_USBHID environment variable must be set.
+ - The environment variable TORTURE_SK_PIN=<device PIN> must be set.
+
+If these are not set, the tests are skipped.
+
+The higher level PKI integration tests can be found in
+`tests/unittests/torture_pki_sk.c` and the tests related to the sshsig API
+can be found in `tests/unittests/torture_pki_sshsig.c`.
+These use the callback implementation provided by OpenSSH's sk-dummy.so,
+which simulates an authenticator without requiring any hardware. Hence, these tests
+can be run in the CI environment.
+However, these tests can also be configured to use the default USB-HID callbacks
+by setting the same environment variables as described above.
+
+The following devices were tested during development:
+
+- Yubico Security Key NFC - USB-A
+
+*/

doc/forwarding.dox

@@ -100,7 +100,7 @@ used to retrieve google's home page from the remote SSH server.
 @code
 int direct_forwarding(ssh_session session)
 {
-  ssh_channel forwarding_channel;
+  ssh_channel forwarding_channel = NULL;
   int rc = SSH_ERROR;
   char *http_get = "GET / HTTP/1.1\nHost: www.google.com\n\n";
   int nbytes, nwritten;
@@ -161,7 +161,7 @@ local libssh application, which handles them:
 int web_server(ssh_session session)
 {
   int rc;
-  ssh_channel channel;
+  ssh_channel channel = NULL;
   char buffer[256];
   int nbytes, nwritten;
   int port = 0;

doc/guided_tour.dox

@@ -79,7 +79,7 @@ Here is a small example of how to use it:
 
 int main()
 {
-  ssh_session my_ssh_session;
+  ssh_session my_ssh_session = NULL;
   int verbosity = SSH_LOG_PROTOCOL;
   int port = 22;
 
@@ -126,7 +126,7 @@ Here's an example:
 
 int main()
 {
-  ssh_session my_ssh_session;
+  ssh_session my_ssh_session = NULL;
   int rc;
 
   my_ssh_session = ssh_new();
@@ -190,8 +190,8 @@ int verify_knownhost(ssh_session session)
     ssh_key srv_pubkey = NULL;
     size_t hlen;
     char buf[10];
-    char *hexa;
+    char *hexa = NULL;
-    char *p;
+    char *p = NULL;
     int cmp;
     int rc;
 
@@ -317,9 +317,9 @@ The example below shows an authentication with password:
 
 int main()
 {
-  ssh_session my_ssh_session;
+  ssh_session my_ssh_session = NULL;
   int rc;
-  char *password;
+  char *password = NULL;
 
   // Open session and set options
   my_ssh_session = ssh_new();
@@ -380,7 +380,7 @@ The example below shows how to execute a remote command:
 @code
 int show_remote_processes(ssh_session session)
 {
-  ssh_channel channel;
+  ssh_channel channel = NULL;
   int rc;
   char buffer[256];
   int nbytes;

doc/header.html

@@ -0,0 +1,92 @@
+<!-- HTML header for doxygen 1.14.0-->
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "https://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" lang="$langISO">
+<head>
+<meta http-equiv="Content-Type" content="text/xhtml;charset=UTF-8"/>
+<meta http-equiv="X-UA-Compatible" content="IE=11"/>
+<meta name="generator" content="Doxygen $doxygenversion"/>
+<meta name="viewport" content="width=device-width, initial-scale=1"/>
+<!--BEGIN PROJECT_NAME--><title>$projectname: $title</title><!--END PROJECT_NAME-->
+<!--BEGIN !PROJECT_NAME--><title>$title</title><!--END !PROJECT_NAME-->
+<!--BEGIN PROJECT_ICON-->
+<link rel="icon" href="$relpath^$projecticon" type="image/x-icon" />
+<!--END PROJECT_ICON-->
+<link href="$relpath^tabs.css" rel="stylesheet" type="text/css"/>
+<!--BEGIN FULL_SIDEBAR-->
+<script type="text/javascript">var page_layout=1;</script>
+<!--END FULL_SIDEBAR-->
+<script type="text/javascript" src="$relpath^jquery.js"></script>
+<script type="text/javascript" src="$relpath^dynsections.js"></script>
+<!--BEGIN COPY_CLIPBOARD-->
+<script type="text/javascript" src="$relpath^clipboard.js"></script>
+<!--END COPY_CLIPBOARD-->
+$treeview
+$search
+$mathjax
+$darkmode
+<link href="$relpath^$stylesheet" rel="stylesheet" type="text/css" />
+$extrastylesheet
+<script type="text/javascript" src="$relpath^doxygen-awesome-darkmode-toggle.js"></script>
+<script type="text/javascript">
+DoxygenAwesomeDarkModeToggle.init()
+</script>
+<script type="text/javascript" src="$relpath^doxygen-awesome-fragment-copy-button.js"></script>
+<script type="text/javascript">
+DoxygenAwesomeFragmentCopyButton.init()
+</script>
+<script type="text/javascript" src="$relpath^doxygen-awesome-paragraph-link.js"></script>
+<script type="text/javascript">
+DoxygenAwesomeParagraphLink.init()
+</script>
+<script type="text/javascript" src="$relpath^doxygen-awesome-interactive-toc.js"></script>
+<script type="text/javascript">
+DoxygenAwesomeInteractiveToc.init()
+</script>
+</head>
+<body>
+<!--BEGIN FULL_SIDEBAR-->
+<div id="side-nav" class="ui-resizable side-nav-resizable"><!-- do not remove this div, it is closed by doxygen! -->
+<!--END FULL_SIDEBAR-->
+
+<div id="top"><!-- do not remove this div, it is closed by doxygen! -->
+
+<!--BEGIN TITLEAREA-->
+<div id="titlearea">
+<table cellspacing="0" cellpadding="0">
+ <tbody>
+ <tr id="projectrow">
+  <!--BEGIN PROJECT_LOGO-->
+  <td id="projectlogo"><img alt="Logo" src="$relpath^$projectlogo"$logosize/></td>
+  <!--END PROJECT_LOGO-->
+  <!--BEGIN PROJECT_NAME-->
+  <td id="projectalign">
+   <div id="projectname">$projectname<!--BEGIN PROJECT_NUMBER--><span id="projectnumber">&#160;$projectnumber</span><!--END PROJECT_NUMBER-->
+   </div>
+   <!--BEGIN PROJECT_BRIEF--><div id="projectbrief">$projectbrief</div><!--END PROJECT_BRIEF-->
+  </td>
+  <!--END PROJECT_NAME-->
+  <!--BEGIN !PROJECT_NAME-->
+   <!--BEGIN PROJECT_BRIEF-->
+    <td>
+    <div id="projectbrief">$projectbrief</div>
+    </td>
+   <!--END PROJECT_BRIEF-->
+  <!--END !PROJECT_NAME-->
+  <!--BEGIN DISABLE_INDEX-->
+   <!--BEGIN SEARCHENGINE-->
+     <!--BEGIN !FULL_SIDEBAR-->
+    <td>$searchbox</td>
+     <!--END !FULL_SIDEBAR-->
+   <!--END SEARCHENGINE-->
+  <!--END DISABLE_INDEX-->
+ </tr>
+  <!--BEGIN SEARCHENGINE-->
+   <!--BEGIN FULL_SIDEBAR-->
+   <tr><td colspan="2">$searchbox</td></tr>
+   <!--END FULL_SIDEBAR-->
+  <!--END SEARCHENGINE-->
+ </tbody>
+</table>
+</div>
+<!--END TITLEAREA-->
+<!-- end header part -->

doc/introduction.dox

@@ -48,6 +48,8 @@ Table of contents:
 
 @subpage libssh_tutor_sftp_aio
 
+@subpage libssh_tutor_fido2
+
 @subpage libssh_tutor_todo
 
 */

doc/mainpage.dox

@@ -19,12 +19,13 @@ the interesting functions as you go.
 
 The libssh library provides:
 
- - <strong>Key Exchange Methods</strong>: <i>curve25519-sha256, curve25519-sha256@libssh.org, ecdh-sha2-nistp256, ecdh-sha2-nistp384, ecdh-sha2-nistp521</i>, diffie-hellman-group1-sha1, diffie-hellman-group14-sha1
+ - <strong>Key Exchange Methods</strong>: <i>sntrup761x25519-sha512, sntrup761x25519-sha512@openssh.com, mlkem768x25519-sha256, mlkem768nistp256-sha256, mlkem1024nistp384-sha384, curve25519-sha256, curve25519-sha256@libssh.org, ecdh-sha2-nistp256, ecdh-sha2-nistp384, ecdh-sha2-nistp521</i>, diffie-hellman-group1-sha1, diffie-hellman-group14-sha1
+ - <strong>GSSAPI Key Exchange Methods</strong>: gss-group14-sha256-*, gss-group16-sha512-*, gss-nistp256-sha256-*, gss-curve25519-sha256-*
  - <strong>Public Key Algorithms</strong>: ssh-ed25519, ecdsa-sha2-nistp256, ecdsa-sha2-nistp384, ecdsa-sha2-nistp521, ssh-rsa, rsa-sha2-512, rsa-sha2-256
  - <strong>Ciphers</strong>: <i>aes256-ctr, aes192-ctr, aes128-ctr</i>, aes256-cbc (rijndael-cbc@lysator.liu.se), aes192-cbc, aes128-cbc, 3des-cbc, blowfish-cbc
  - <strong>Compression Schemes</strong>: zlib, <i>zlib@openssh.com</i>, none
  - <strong>MAC hashes</strong>: hmac-sha1, hmac-sha2-256, hmac-sha2-512, hmac-md5
- - <strong>Authentication</strong>: none, password, public-key, keyboard-interactive, <i>gssapi-with-mic</i>
+ - <strong>Authentication</strong>: none, password, public-key, keyboard-interactive, <i>gssapi-with-mic, gssapi-keyex</i>
  - <strong>Channels</strong>: shell, exec (incl. SCP wrapper), direct-tcpip, subsystem, <i>auth-agent-req@openssh.com</i>
  - <strong>Global Requests</strong>: tcpip-forward, forwarded-tcpip
  - <strong>Channel Requests</strong>: x11, pty, <i>exit-status, signal, exit-signal, keepalive@openssh.com, auth-agent-req@openssh.com</i>

doc/pkcs11.dox

@@ -81,10 +81,6 @@ We recommend the users to provide a specific PKCS #11 URI so that it matches onl
 If the engine discovers multiple slots that could potentially contain the private keys referenced
 by the provided PKCS #11 URI, the engine will not try to authenticate.
 
-For testing, the SoftHSM PKCS#11 library is used. But it has some issues with
+For testing, the SoftHSM PKCS#11 library is used.
-OpenSSL initialization/cleanup when used with OpenSSL 3.0 so we are using it
-indirectly through a p11-kit remoting as described in the following article:
-
-https://p11-glue.github.io/p11-glue/p11-kit/manual/remoting.html
 
 */

doc/shell.dox

@@ -26,7 +26,7 @@ The code sample below achieves these tasks:
 @code
 int shell_session(ssh_session session)
 {
-  ssh_channel channel;
+  ssh_channel channel = NULL;
   int rc;
 
   channel = ssh_channel_new(session);

doc/that_style/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2017 Jan-Lukas Wynen
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

doc/that_style/README.md

@@ -1,22 +0,0 @@
-# that style
-A plain, more modern HTML style for Doxygen
-
-## Requirements
-- Doxygen (tested with version 1.8.13)
-- *optional*: a sass/scss compiler if you want to modify the style
-
-## Simple usage
-Tell Doxygen about the files for that style as shown in [doxyfile.conf](doxyfile.conf). You might need to adjust the
-paths depending on where you installed that style.
-When you run Doxygen, all files are copied into to generated HTML folder. So you don't need to keep the originals around
-unless you want to re-generate the documentation.
-
-## Advanced
-that style uses a custom javascript to hack some nice stripes into some tables. It has to be loaded from HTML. Hence you need
-to use the provided custom header. Since its default content may change when Doxygen is updated, there might be syntax error in
-the generated HTML. If this is the case, you can remove the custom header (adjust your doxyfile.conf). This has no
-disadvantages other than removing the stripes.
-
-[that_style.css](that_style.css) was generated from the scss files in the folder [sass](sass). If you want to change the style,
-use those files in order to have better control. For instance, you can easily change most colors by modifying the variables
-in the beginning of [that_style.scss](sass/that_style.scss).

doc/that_style/header.html

@@ -1,56 +0,0 @@
-<!-- HTML header for doxygen 1.8.13-->
-<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
-<head>
-<meta http-equiv="Content-Type" content="text/xhtml;charset=UTF-8"/>
-<meta http-equiv="X-UA-Compatible" content="IE=9"/>
-<meta name="generator" content="Doxygen $doxygenversion"/>
-<meta name="viewport" content="width=device-width, initial-scale=1"/>
-<!--BEGIN PROJECT_NAME--><title>$projectname: $title</title><!--END PROJECT_NAME-->
-<!--BEGIN !PROJECT_NAME--><title>$title</title><!--END !PROJECT_NAME-->
-<link href="$relpath^tabs.css" rel="stylesheet" type="text/css"/>
-<script type="text/javascript" src="$relpath^jquery.js"></script>
-<script type="text/javascript" src="$relpath^dynsections.js"></script>
-$treeview
-$search
-$mathjax
-<link href="$relpath^$stylesheet" rel="stylesheet" type="text/css" />
-<script src="$relpath^striped_bg.js"></script>
-$extrastylesheet
-</head>
-<body>
-<div id="top"><!-- do not remove this div, it is closed by doxygen! -->
-
-<!--BEGIN TITLEAREA-->
-<div id="titlearea">
-<table cellspacing="0" cellpadding="0">
- <tbody>
- <tr style="height: 56px;">
-  <!--BEGIN PROJECT_LOGO-->
-  <td id="projectlogo"><img alt="Logo" src="$relpath^$projectlogo"/></td>
-  <!--END PROJECT_LOGO-->
-  <!--BEGIN PROJECT_NAME-->
-  <td id="projectalign" style="padding-left: 0.5em;">
-   <div id="projectname">$projectname
-   <!--BEGIN PROJECT_NUMBER-->&#160;<span id="projectnumber">$projectnumber</span><!--END PROJECT_NUMBER-->
-   </div>
-   <!--BEGIN PROJECT_BRIEF--><div id="projectbrief">$projectbrief</div><!--END PROJECT_BRIEF-->
-  </td>
-  <!--END PROJECT_NAME-->
-  <!--BEGIN !PROJECT_NAME-->
-   <!--BEGIN PROJECT_BRIEF-->
-    <td style="padding-left: 0.5em;">
-    <div id="projectbrief">$projectbrief</div>
-    </td>
-   <!--END PROJECT_BRIEF-->
-  <!--END !PROJECT_NAME-->
-  <!--BEGIN DISABLE_INDEX-->
-   <!--BEGIN SEARCHENGINE-->
-   <td>$searchbox</td>
-   <!--END SEARCHENGINE-->
-  <!--END DISABLE_INDEX-->
- </tr>
- </tbody>
-</table>
-</div>
-<!--END TITLEAREA-->
-<!-- end header part -->

doc/that_style/img/doc.svg

@@ -1,97 +0,0 @@
-<?xml version="1.0" encoding="UTF-8" standalone="no"?>
-<!-- Created with Inkscape (http://www.inkscape.org/) -->
-
-<svg
-   xmlns:dc="http://purl.org/dc/elements/1.1/"
-   xmlns:cc="http://creativecommons.org/ns#"
-   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
-   xmlns:svg="http://www.w3.org/2000/svg"
-   xmlns="http://www.w3.org/2000/svg"
-   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
-   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
-   width="24"
-   height="22"
-   viewBox="0 0 6.3499999 5.8208335"
-   version="1.1"
-   id="svg8"
-   sodipodi:docname="doc.svg"
-   inkscape:version="0.92.1 r">
-  <defs
-     id="defs2" />
-  <sodipodi:namedview
-     id="base"
-     pagecolor="#ffffff"
-     bordercolor="#666666"
-     borderopacity="1.0"
-     inkscape:pageopacity="0.0"
-     inkscape:pageshadow="2"
-     inkscape:zoom="32"
-     inkscape:cx="11.139212"
-     inkscape:cy="14.811193"
-     inkscape:document-units="mm"
-     inkscape:current-layer="layer1"
-     showgrid="false"
-     inkscape:showpageshadow="false"
-     units="px"
-     inkscape:window-width="2560"
-     inkscape:window-height="1357"
-     inkscape:window-x="0"
-     inkscape:window-y="0"
-     inkscape:window-maximized="1" />
-  <metadata
-     id="metadata5">
-    <rdf:RDF>
-      <cc:Work
-         rdf:about="">
-        <dc:format>image/svg+xml</dc:format>
-        <dc:type
-           rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
-        <dc:title />
-      </cc:Work>
-    </rdf:RDF>
-  </metadata>
-  <g
-     inkscape:label="Layer 1"
-     inkscape:groupmode="layer"
-     id="layer1"
-     transform="translate(0,-291.17915)">
-    <path
-       style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:1;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:#ffffff;fill-opacity:1;fill-rule:nonzero;stroke:#4d4d4d;stroke-width:0.26458329;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;paint-order:normal;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate"
-       d="M 3.315043,291.8406 H 1.4552083 v 4.49792 h 3.1749999 v -3.10055 z"
-       id="path5095"
-       inkscape:connector-curvature="0" />
-    <path
-       style="color:#000000;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:medium;line-height:normal;font-family:sans-serif;font-variant-ligatures:normal;font-variant-position:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-alternates:normal;font-feature-settings:normal;text-indent:0;text-align:start;text-decoration:none;text-decoration-line:none;text-decoration-style:solid;text-decoration-color:#000000;letter-spacing:normal;word-spacing:normal;text-transform:none;writing-mode:lr-tb;direction:ltr;text-orientation:mixed;dominant-baseline:auto;baseline-shift:baseline;text-anchor:start;white-space:normal;shape-padding:0;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:1;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;vector-effect:none;fill:#4d4d4d;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:0.26458332px;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate"
-       d="m 3.1837239,291.84114 v 1.71186 h 1.4472656 v -0.31418 H 3.4473958 v -1.39768 z"
-       id="path5128"
-       inkscape:connector-curvature="0" />
-    <rect
-       style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:1;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:#4d4d4d;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:0.52916664;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;paint-order:normal;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate"
-       id="rect5132"
-       width="2.1166668"
-       height="0.26458332"
-       x="1.8520833"
-       y="293.82498" />
-    <rect
-       style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:1;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:#4d4d4d;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:0.52916664;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;paint-order:normal;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate"
-       id="rect5136"
-       width="1.0583334"
-       height="0.26458332"
-       x="1.8520832"
-       y="294.35416" />
-    <rect
-       y="294.88333"
-       x="1.8520832"
-       height="0.26458332"
-       width="1.8520833"
-       id="rect5138"
-       style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:1;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:#4d4d4d;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:0.52916664;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;paint-order:normal;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate" />
-    <rect
-       style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:1;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:#4d4d4d;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:0.52916664;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;paint-order:normal;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate"
-       id="rect4543"
-       width="1.5875"
-       height="0.26458332"
-       x="1.8520832"
-       y="295.41248" />
-  </g>
-</svg>

doc/that_style/img/folderclosed.svg

@@ -1,77 +0,0 @@
-<?xml version="1.0" encoding="UTF-8" standalone="no"?>
-<!-- Created with Inkscape (http://www.inkscape.org/) -->
-
-<svg
-   xmlns:dc="http://purl.org/dc/elements/1.1/"
-   xmlns:cc="http://creativecommons.org/ns#"
-   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
-   xmlns:svg="http://www.w3.org/2000/svg"
-   xmlns="http://www.w3.org/2000/svg"
-   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
-   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
-   width="24"
-   height="22"
-   viewBox="0 0 6.3499998 5.8208335"
-   version="1.1"
-   id="svg8"
-   inkscape:version="0.92.1 r"
-   sodipodi:docname="folderclosed.svg"
-   inkscape:export-filename="/home/jl/Prog/doxygen_style/folderclosed.png"
-   inkscape:export-xdpi="96"
-   inkscape:export-ydpi="96">
-  <defs
-     id="defs2" />
-  <sodipodi:namedview
-     id="base"
-     pagecolor="#ffffff"
-     bordercolor="#666666"
-     borderopacity="1.0"
-     inkscape:pageopacity="0.0"
-     inkscape:pageshadow="2"
-     inkscape:zoom="51.113139"
-     inkscape:cx="7.7057751"
-     inkscape:cy="12.584171"
-     inkscape:document-units="mm"
-     inkscape:current-layer="layer1"
-     showgrid="false"
-     inkscape:snap-global="false"
-     units="px"
-     inkscape:showpageshadow="false"
-     inkscape:window-width="2560"
-     inkscape:window-height="1357"
-     inkscape:window-x="0"
-     inkscape:window-y="0"
-     inkscape:window-maximized="1"
-     inkscape:measure-start="0,0"
-     inkscape:measure-end="0,0" />
-  <metadata
-     id="metadata5">
-    <rdf:RDF>
-      <cc:Work
-         rdf:about="">
-        <dc:format>image/svg+xml</dc:format>
-        <dc:type
-           rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
-        <dc:title />
-      </cc:Work>
-    </rdf:RDF>
-  </metadata>
-  <g
-     inkscape:label="Layer 1"
-     inkscape:groupmode="layer"
-     id="layer1"
-     transform="translate(0,-291.17915)">
-    <path
-       inkscape:connector-curvature="0"
-       style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:1;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:#4d4d4d;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:0.26458332;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;paint-order:stroke fill markers;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate"
-       d="m 0.52916667,292.2374 -0.26458334,0.52925 v 3.43958 H 4.7625001 v -3.43958 H 2.38125 L 2.1166667,292.2374 Z"
-       id="rect4498"
-       sodipodi:nodetypes="cccccccc" />
-    <path
-       inkscape:connector-curvature="0"
-       style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:1;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:#cccccc;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:0.66145831;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate"
-       d="M 2.9104167,292.76665 2.38125,293.56034 H 0.26458333 v 0.26464 H 2.38125 l 0.5291667,-0.79375 h 1.8520834 v -0.26458 z"
-       id="rect4500"
-       sodipodi:nodetypes="ccccccccc" />
-  </g>
-</svg>

doc/that_style/img/folderopen.svg

@@ -1,83 +0,0 @@
-<?xml version="1.0" encoding="UTF-8" standalone="no"?>
-<!-- Created with Inkscape (http://www.inkscape.org/) -->
-
-<svg
-   xmlns:dc="http://purl.org/dc/elements/1.1/"
-   xmlns:cc="http://creativecommons.org/ns#"
-   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
-   xmlns:svg="http://www.w3.org/2000/svg"
-   xmlns="http://www.w3.org/2000/svg"
-   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
-   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
-   width="24"
-   height="22"
-   viewBox="0 0 6.3499998 5.8208335"
-   version="1.1"
-   id="svg8"
-   inkscape:version="0.92.1 r"
-   sodipodi:docname="folderopen.svg"
-   inkscape:export-filename="/home/jl/Prog/doxygen_style/folderopen.png"
-   inkscape:export-xdpi="96"
-   inkscape:export-ydpi="96">
-  <defs
-     id="defs2" />
-  <sodipodi:namedview
-     id="base"
-     pagecolor="#ffffff"
-     bordercolor="#666666"
-     borderopacity="1.0"
-     inkscape:pageopacity="0.0"
-     inkscape:pageshadow="2"
-     inkscape:zoom="43.725861"
-     inkscape:cx="8.2043861"
-     inkscape:cy="13.464183"
-     inkscape:document-units="mm"
-     inkscape:current-layer="layer1"
-     showgrid="false"
-     inkscape:snap-global="false"
-     units="px"
-     inkscape:showpageshadow="false"
-     inkscape:window-width="2560"
-     inkscape:window-height="1357"
-     inkscape:window-x="0"
-     inkscape:window-y="0"
-     inkscape:window-maximized="1"
-     inkscape:measure-start="0,0"
-     inkscape:measure-end="0,0" />
-  <metadata
-     id="metadata5">
-    <rdf:RDF>
-      <cc:Work
-         rdf:about="">
-        <dc:format>image/svg+xml</dc:format>
-        <dc:type
-           rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
-        <dc:title />
-      </cc:Work>
-    </rdf:RDF>
-  </metadata>
-  <g
-     inkscape:label="Layer 1"
-     inkscape:groupmode="layer"
-     id="layer1"
-     transform="translate(0,-291.17915)">
-    <path
-       inkscape:connector-curvature="0"
-       style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:1;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:#4d4d4d;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:0.66145831;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate"
-       d="m 0.52916667,292.23748 -0.26458334,0.52917 v 3.43958 H 4.762461 l 7.8e-5,-3.43958 H 2.38125 l -0.2645833,-0.52917 z"
-       id="path5228"
-       sodipodi:nodetypes="cccccccc" />
-    <path
-       inkscape:connector-curvature="0"
-       id="path5279"
-       d="M 1.0583333,293.5604 H 5.55625 L 4.7625,296.20603 H 0.26458333 Z"
-       style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:1;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:#ececec;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:0.66145831;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate"
-       sodipodi:nodetypes="ccccc" />
-    <path
-       sodipodi:nodetypes="ccccccc"
-       inkscape:connector-curvature="0"
-       id="path5234"
-       d="M 1.0583333,294.35415 H 3.175 l 0.5291667,-0.52917 H 5.55625 L 4.7625,296.20603 H 0.26458333 Z"
-       style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:1;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:#4d4d4d;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:0.66145831;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate" />
-  </g>
-</svg>

doc/that_style/img/mag_glass.svg

@@ -1,73 +0,0 @@
-<?xml version="1.0" encoding="UTF-8" standalone="no"?>
-<!-- Created with Inkscape (http://www.inkscape.org/) -->
-
-<svg
-   xmlns:dc="http://purl.org/dc/elements/1.1/"
-   xmlns:cc="http://creativecommons.org/ns#"
-   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
-   xmlns:svg="http://www.w3.org/2000/svg"
-   xmlns="http://www.w3.org/2000/svg"
-   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
-   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
-   width="22"
-   height="22"
-   viewBox="0 0 5.8208332 5.8208335"
-   version="1.1"
-   id="svg8"
-   inkscape:version="0.92.1 r"
-   sodipodi:docname="mag_glass.svg">
-  <defs
-     id="defs2" />
-  <sodipodi:namedview
-     id="base"
-     pagecolor="#ffffff"
-     bordercolor="#666666"
-     borderopacity="1.0"
-     inkscape:pageopacity="0.0"
-     inkscape:pageshadow="2"
-     inkscape:zoom="32"
-     inkscape:cx="8.961936"
-     inkscape:cy="10.205344"
-     inkscape:document-units="mm"
-     inkscape:current-layer="layer1"
-     showgrid="false"
-     units="px"
-     inkscape:showpageshadow="false"
-     inkscape:snap-bbox="false"
-     inkscape:bbox-nodes="true"
-     inkscape:window-width="2560"
-     inkscape:window-height="1357"
-     inkscape:window-x="0"
-     inkscape:window-y="0"
-     inkscape:window-maximized="1"
-     inkscape:snap-global="false" />
-  <metadata
-     id="metadata5">
-    <rdf:RDF>
-      <cc:Work
-         rdf:about="">
-        <dc:format>image/svg+xml</dc:format>
-        <dc:type
-           rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
-        <dc:title></dc:title>
-      </cc:Work>
-    </rdf:RDF>
-  </metadata>
-  <g
-     inkscape:label="Layer 1"
-     inkscape:groupmode="layer"
-     id="layer1"
-     transform="translate(0,-291.17915)">
-    <path
-       style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:1;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:#333333;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:1.99999988;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate"
-       d="M 6.9101562 2.4082031 C 3.1105656 2.4082031 -5.9211895e-16 5.5081643 0 9.3027344 C 0 13.097342 3.1105656 16.197266 6.9101562 16.197266 C 8.2869348 16.197266 9.5698699 15.787508 10.650391 15.087891 L 15.162109 19.587891 L 16.636719 18.115234 L 12.214844 13.707031 C 13.214837 12.510659 13.818359 10.974238 13.818359 9.3027344 C 13.818359 5.5081643 10.709747 2.4082031 6.9101562 2.4082031 z M 6.9101562 4.9101562 C 9.3624717 4.9101562 11.324219 6.8631249 11.324219 9.3027344 C 11.324219 11.742382 9.3624717 13.695312 6.9101562 13.695312 C 4.4578408 13.695312 2.5019531 11.742382 2.5019531 9.3027344 C 2.5019531 6.8631249 4.4578408 4.9101562 6.9101562 4.9101562 z "
-       transform="matrix(0.26458333,0,0,0.26458333,0,291.17915)"
-       id="rect4524" />
-    <path
-       transform="matrix(0.99422295,0,0,0.68955299,-0.83134947,91.755588)"
-       style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:1;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:#333333;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:0.63466448;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate"
-       inkscape:transform-center-y="0.25905895"
-       d="m 5.6074138,294.49889 -1.0836583,-1.87695 2.1673165,0 z"
-       id="path4491" />
-  </g>
-</svg>

doc/that_style/img/nav_edge_inter.svg

@@ -1,73 +0,0 @@
-<?xml version="1.0" encoding="UTF-8" standalone="no"?>
-<!-- Created with Inkscape (http://www.inkscape.org/) -->
-
-<svg
-   xmlns:dc="http://purl.org/dc/elements/1.1/"
-   xmlns:cc="http://creativecommons.org/ns#"
-   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
-   xmlns:svg="http://www.w3.org/2000/svg"
-   xmlns="http://www.w3.org/2000/svg"
-   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
-   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
-   width="10.53333"
-   height="32"
-   viewBox="0 0 9.8749964 30"
-   id="svg2"
-   version="1.1"
-   inkscape:version="0.92.1 r"
-   sodipodi:docname="nav_edge_inter.svg">
-  <defs
-     id="defs4" />
-  <sodipodi:namedview
-     id="base"
-     pagecolor="#ffffff"
-     bordercolor="#666666"
-     borderopacity="1.0"
-     inkscape:pageopacity="0.0"
-     inkscape:pageshadow="2"
-     inkscape:zoom="32"
-     inkscape:cx="8.6823304"
-     inkscape:cy="16.225639"
-     inkscape:document-units="px"
-     inkscape:current-layer="layer1"
-     showgrid="false"
-     units="px"
-     inkscape:snap-bbox="true"
-     inkscape:bbox-paths="false"
-     inkscape:bbox-nodes="true"
-     inkscape:snap-bbox-edge-midpoints="true"
-     inkscape:object-nodes="true"
-     inkscape:window-width="2560"
-     inkscape:window-height="1357"
-     inkscape:window-x="0"
-     inkscape:window-y="0"
-     inkscape:window-maximized="1" />
-  <metadata
-     id="metadata7">
-    <rdf:RDF>
-      <cc:Work
-         rdf:about="">
-        <dc:format>image/svg+xml</dc:format>
-        <dc:type
-           rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
-        <dc:title></dc:title>
-      </cc:Work>
-    </rdf:RDF>
-  </metadata>
-  <g
-     inkscape:label="Layer 1"
-     inkscape:groupmode="layer"
-     id="layer1"
-     transform="translate(0,-1022.3622)">
-    <path
-       style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:1;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:none;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:0;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate"
-       d="m 0,1022.3622 v 15 15 l 8,-15 z"
-       id="path4143"
-       inkscape:connector-curvature="0" />
-    <path
-       style="color:#000000;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:medium;line-height:normal;font-family:sans-serif;font-variant-ligatures:normal;font-variant-position:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-alternates:normal;font-feature-settings:normal;text-indent:0;text-align:start;text-decoration:none;text-decoration-line:none;text-decoration-style:solid;text-decoration-color:#000000;letter-spacing:normal;word-spacing:normal;text-transform:none;writing-mode:lr-tb;direction:ltr;text-orientation:mixed;dominant-baseline:auto;baseline-shift:baseline;text-anchor:start;white-space:normal;shape-padding:0;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:1;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;vector-effect:none;fill:#333333;fill-opacity:1;fill-rule:evenodd;stroke:none;stroke-width:0.9375px;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate"
-       d="m 1.2910156,1022.3496 -0.82421872,0.4473 7.87890622,14.5527 -7.87890622,14.5527 0.82421872,0.4473 8.1210938,-15 z"
-       id="path5240"
-       inkscape:connector-curvature="0" />
-  </g>
-</svg>

doc/that_style/img/nav_edge_left.svg

@@ -1,73 +0,0 @@
-<?xml version="1.0" encoding="UTF-8" standalone="no"?>
-<!-- Created with Inkscape (http://www.inkscape.org/) -->
-
-<svg
-   xmlns:dc="http://purl.org/dc/elements/1.1/"
-   xmlns:cc="http://creativecommons.org/ns#"
-   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
-   xmlns:svg="http://www.w3.org/2000/svg"
-   xmlns="http://www.w3.org/2000/svg"
-   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
-   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
-   width="8.5333338"
-   height="32"
-   viewBox="0 0 8.0000001 30"
-   id="svg2"
-   version="1.1"
-   inkscape:version="0.92.1 r"
-   sodipodi:docname="nav_edge_left.svg">
-  <defs
-     id="defs4" />
-  <sodipodi:namedview
-     id="base"
-     pagecolor="#ffffff"
-     bordercolor="#666666"
-     borderopacity="1.0"
-     inkscape:pageopacity="0.0"
-     inkscape:pageshadow="2"
-     inkscape:zoom="32"
-     inkscape:cx="5.3721385"
-     inkscape:cy="14.16429"
-     inkscape:document-units="px"
-     inkscape:current-layer="layer1"
-     showgrid="false"
-     units="px"
-     inkscape:snap-bbox="true"
-     inkscape:bbox-paths="false"
-     inkscape:bbox-nodes="false"
-     inkscape:snap-bbox-edge-midpoints="false"
-     inkscape:object-nodes="true"
-     inkscape:window-width="2560"
-     inkscape:window-height="1357"
-     inkscape:window-x="0"
-     inkscape:window-y="0"
-     inkscape:window-maximized="1" />
-  <metadata
-     id="metadata7">
-    <rdf:RDF>
-      <cc:Work
-         rdf:about="">
-        <dc:format>image/svg+xml</dc:format>
-        <dc:type
-           rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
-        <dc:title></dc:title>
-      </cc:Work>
-    </rdf:RDF>
-  </metadata>
-  <g
-     inkscape:label="Layer 1"
-     inkscape:groupmode="layer"
-     id="layer1"
-     transform="translate(0,-1022.3622)">
-    <path
-       style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:1;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:#ffffff;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:6;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate"
-       d="M 0 0 L 0 32 L 8.5332031 16 L 0 0 z "
-       transform="matrix(0.93749998,0,0,0.93749998,0,1022.3622)"
-       id="rect4586" />
-    <path
-       style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:1;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:none;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:0;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate"
-       d="m 0,1022.3622 v 15 15 l 8,-15 z"
-       id="path4143"
-       inkscape:connector-curvature="0" />
-  </g>
-</svg>

doc/that_style/img/nav_edge_right.svg

@@ -1,73 +0,0 @@
-<?xml version="1.0" encoding="UTF-8" standalone="no"?>
-<!-- Created with Inkscape (http://www.inkscape.org/) -->
-
-<svg
-   xmlns:dc="http://purl.org/dc/elements/1.1/"
-   xmlns:cc="http://creativecommons.org/ns#"
-   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
-   xmlns:svg="http://www.w3.org/2000/svg"
-   xmlns="http://www.w3.org/2000/svg"
-   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
-   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
-   width="8"
-   height="30"
-   viewBox="0 0 8.0000001 30"
-   id="svg2"
-   version="1.1"
-   inkscape:version="0.91 r13725"
-   sodipodi:docname="nav_edge.svg">
-  <defs
-     id="defs4" />
-  <sodipodi:namedview
-     id="base"
-     pagecolor="#ffffff"
-     bordercolor="#666666"
-     borderopacity="1.0"
-     inkscape:pageopacity="0.0"
-     inkscape:pageshadow="2"
-     inkscape:zoom="32"
-     inkscape:cx="5.3721385"
-     inkscape:cy="14.16429"
-     inkscape:document-units="px"
-     inkscape:current-layer="layer1"
-     showgrid="false"
-     units="px"
-     inkscape:snap-bbox="true"
-     inkscape:bbox-paths="false"
-     inkscape:bbox-nodes="false"
-     inkscape:snap-bbox-edge-midpoints="false"
-     inkscape:object-nodes="true"
-     inkscape:window-width="2560"
-     inkscape:window-height="1357"
-     inkscape:window-x="0"
-     inkscape:window-y="0"
-     inkscape:window-maximized="1" />
-  <metadata
-     id="metadata7">
-    <rdf:RDF>
-      <cc:Work
-         rdf:about="">
-        <dc:format>image/svg+xml</dc:format>
-        <dc:type
-           rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
-        <dc:title></dc:title>
-      </cc:Work>
-    </rdf:RDF>
-  </metadata>
-  <g
-     inkscape:label="Layer 1"
-     inkscape:groupmode="layer"
-     id="layer1"
-     transform="translate(0,-1022.3622)">
-    <path
-       style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:1;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:none;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:0;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate"
-       d="m 0,1022.3622 0,15 0,15 8,-15 -8,-15 z"
-       id="path4143"
-       inkscape:connector-curvature="0" />
-    <path
-       style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:1;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:#ffffff;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:0;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate"
-       d="m 1e-8,1022.3622 7.99999999,15 0,-15 -8,0 z m 7.99999999,15 -8,15 8,0 0,-15 z"
-       id="rect4136"
-       inkscape:connector-curvature="0" />
-  </g>
-</svg>

doc/that_style/img/splitbar_handle.svg

@@ -1,120 +0,0 @@
-<?xml version="1.0" encoding="UTF-8" standalone="no"?>
-<!-- Created with Inkscape (http://www.inkscape.org/) -->
-
-<svg
-   xmlns:dc="http://purl.org/dc/elements/1.1/"
-   xmlns:cc="http://creativecommons.org/ns#"
-   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
-   xmlns:svg="http://www.w3.org/2000/svg"
-   xmlns="http://www.w3.org/2000/svg"
-   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
-   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
-   width="6"
-   height="9"
-   viewBox="0 0 1.5875 2.3812501"
-   version="1.1"
-   id="svg8"
-   inkscape:version="0.92.1 r"
-   sodipodi:docname="splitbar_handle.svg">
-  <defs
-     id="defs2" />
-  <sodipodi:namedview
-     id="base"
-     pagecolor="#ffffff"
-     bordercolor="#666666"
-     borderopacity="1.0"
-     inkscape:pageopacity="0.0"
-     inkscape:pageshadow="2"
-     inkscape:zoom="32"
-     inkscape:cx="8.7681488"
-     inkscape:cy="-2.7929517"
-     inkscape:document-units="mm"
-     inkscape:current-layer="layer1"
-     showgrid="false"
-     units="px"
-     inkscape:showpageshadow="false"
-     showguides="false"
-     inkscape:window-width="2560"
-     inkscape:window-height="1357"
-     inkscape:window-x="0"
-     inkscape:window-y="0"
-     inkscape:window-maximized="1">
-    <inkscape:grid
-       type="xygrid"
-       id="grid4487" />
-  </sodipodi:namedview>
-  <metadata
-     id="metadata5">
-    <rdf:RDF>
-      <cc:Work
-         rdf:about="">
-        <dc:format>image/svg+xml</dc:format>
-        <dc:type
-           rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
-        <dc:title></dc:title>
-      </cc:Work>
-    </rdf:RDF>
-  </metadata>
-  <g
-     inkscape:label="Layer 1"
-     inkscape:groupmode="layer"
-     id="layer1"
-     transform="translate(0,-294.61873)">
-    <rect
-       style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:1;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:#ffffff;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:0.52916664;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate"
-       id="rect4485"
-       width="0.26458335"
-       height="0.26458332"
-       x="0.26458332"
-       y="294.8833" />
-    <rect
-       y="294.8833"
-       x="1.0583333"
-       height="0.26458332"
-       width="0.26458335"
-       id="rect4489"
-       style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:1;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:#ffffff;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:0.52916664;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate" />
-    <rect
-       y="295.41248"
-       x="0.26458329"
-       height="0.26458332"
-       width="0.26458335"
-       id="rect4491"
-       style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:1;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:#ffffff;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:0.52916664;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate" />
-    <rect
-       style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:1;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:#ffffff;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:0.52916664;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate"
-       id="rect4493"
-       width="0.26458335"
-       height="0.26458332"
-       x="1.0583333"
-       y="295.41248" />
-    <rect
-       style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:1;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:#ffffff;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:0.52916664;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate"
-       id="rect4495"
-       width="0.26458335"
-       height="0.26458332"
-       x="0.26458332"
-       y="295.94165" />
-    <rect
-       y="295.94165"
-       x="1.0583333"
-       height="0.26458332"
-       width="0.26458335"
-       id="rect4497"
-       style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:1;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:#ffffff;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:0.52916664;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate" />
-    <rect
-       y="296.47079"
-       x="0.26458329"
-       height="0.26458332"
-       width="0.26458335"
-       id="rect4499"
-       style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:1;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:#ffffff;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:0.52916664;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate" />
-    <rect
-       style="color:#000000;clip-rule:nonzero;display:inline;overflow:visible;visibility:visible;opacity:1;isolation:auto;mix-blend-mode:normal;color-interpolation:sRGB;color-interpolation-filters:linearRGB;solid-color:#000000;solid-opacity:1;fill:#ffffff;fill-opacity:1;fill-rule:nonzero;stroke:none;stroke-width:0.52916664;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;color-rendering:auto;image-rendering:auto;shape-rendering:auto;text-rendering:auto;enable-background:accumulate"
-       id="rect4501"
-       width="0.26458335"
-       height="0.26458332"
-       x="1.0583333"
-       y="296.47079" />
-  </g>
-</svg>

doc/that_style/js/striped_bg.js

@@ -1,32 +0,0 @@
-// Adds extra CSS classes "even" and "odd" to .memberdecls to allow
-// striped backgrounds.
-function MemberDeclsStriper () {
-    var counter = 0;
-    
-    this.stripe = function() {
-        $(".memberdecls tbody").children().each(function(i) {
-            
-            // reset counter at every heading -> always start with even
-            if ($(this).is(".heading")) {
-                counter = 0;
-            }
-
-            // add extra classes
-            if (counter % 2 == 1) {
-                $(this).addClass("odd");
-            }
-            else {
-                $(this).addClass("even");
-            }
-
-            // advance counter at every separator
-            // this is the only way to reliably detect which table rows belong together
-            if ($(this).is('[class^="separator"]')) {
-                counter++;
-            }
-        });
-    }
-}
-
-// execute the function
-$(document).ready(new MemberDeclsStriper().stripe);

examples/CMakeLists.txt

@@ -30,9 +30,11 @@ if (UNIX AND NOT WIN32)
         target_compile_options(samplesftp PRIVATE ${DEFAULT_C_COMPILE_FLAGS})
         target_link_libraries(samplesftp ssh::ssh)
 
-        add_executable(sample_sftpserver sample_sftpserver.c ${examples_SRCS})
+        if (WITH_SERVER)
-        target_compile_options(sample_sftpserver PRIVATE ${DEFAULT_C_COMPILE_FLAGS})
+            add_executable(sample_sftpserver sample_sftpserver.c ${examples_SRCS})
-        target_link_libraries(sample_sftpserver ssh::ssh ${ARGP_LIBRARIES})
+            target_compile_options(sample_sftpserver PRIVATE ${DEFAULT_C_COMPILE_FLAGS})
+            target_link_libraries(sample_sftpserver ssh::ssh ${ARGP_LIBRARIES})
+        endif (WITH_SERVER)
     endif (WITH_SFTP)
 
     add_executable(ssh-client ssh_client.c ${examples_SRCS})

examples/authentication.c

@@ -30,8 +30,8 @@ int authenticate_kbdint(ssh_session session, const char *password)
 
     err = ssh_userauth_kbdint(session, NULL, NULL);
     while (err == SSH_AUTH_INFO) {
-        const char *instruction;
+        const char *instruction = NULL;
-        const char *name;
+        const char *name = NULL;
         char buffer[128];
         int i, n;
 
@@ -48,8 +48,8 @@ int authenticate_kbdint(ssh_session session, const char *password)
         }
 
         for (i = 0; i < n; i++) {
-            const char *answer;
+            const char *answer = NULL;
-            const char *prompt;
+            const char *prompt = NULL;
             char echo;
 
             prompt = ssh_userauth_kbdint_getprompt(session, i, &echo);
@@ -58,7 +58,7 @@ int authenticate_kbdint(ssh_session session, const char *password)
             }
 
             if (echo) {
-                char *p;
+                char *p = NULL;
 
                 printf("%s", prompt);
 
@@ -66,7 +66,6 @@ int authenticate_kbdint(ssh_session session, const char *password)
                     return SSH_AUTH_ERROR;
                 }
 
-                buffer[sizeof(buffer) - 1] = '\0';
                 if ((p = strchr(buffer, '\n'))) {
                     *p = '\0';
                 }
@@ -75,7 +74,7 @@ int authenticate_kbdint(ssh_session session, const char *password)
                     return SSH_AUTH_ERROR;
                 }
 
-                memset(buffer, 0, strlen(buffer));
+                memset(buffer, 0, sizeof(buffer));
             } else {
                 if (password && strstr(prompt, "Password:")) {
                     answer = password;
@@ -143,11 +142,11 @@ int authenticate_console(ssh_session session)
     int rc;
     int method;
     char password[128] = {0};
-    char *banner;
+    char *banner = NULL;
 
     // Try to authenticate
     rc = ssh_userauth_none(session, NULL);
-    if (rc == SSH_AUTH_ERROR) {
+    if (rc == SSH_AUTH_ERROR || !ssh_is_connected(session)) {
         error(session);
         return rc;
     }
@@ -156,7 +155,7 @@ int authenticate_console(ssh_session session)
     while (rc != SSH_AUTH_SUCCESS) {
         if (method & SSH_AUTH_METHOD_GSSAPI_MIC){
             rc = ssh_userauth_gssapi(session);
-            if(rc == SSH_AUTH_ERROR) {
+            if (rc == SSH_AUTH_ERROR || !ssh_is_connected(session)) {
                 error(session);
                 return rc;
             } else if (rc == SSH_AUTH_SUCCESS) {
@@ -166,7 +165,7 @@ int authenticate_console(ssh_session session)
         // Try to authenticate with public key first
         if (method & SSH_AUTH_METHOD_PUBLICKEY) {
             rc = ssh_userauth_publickey_auto(session, NULL, NULL);
-            if (rc == SSH_AUTH_ERROR) {
+            if (rc == SSH_AUTH_ERROR || !ssh_is_connected(session)) {
                 error(session);
                 return rc;
             } else if (rc == SSH_AUTH_SUCCESS) {
@@ -206,7 +205,7 @@ int authenticate_console(ssh_session session)
         // Try to authenticate with keyboard interactive";
         if (method & SSH_AUTH_METHOD_INTERACTIVE) {
             rc = authenticate_kbdint(session, NULL);
-            if (rc == SSH_AUTH_ERROR) {
+            if (rc == SSH_AUTH_ERROR || !ssh_is_connected(session)) {
                 error(session);
                 return rc;
             } else if (rc == SSH_AUTH_SUCCESS) {
@@ -221,7 +220,7 @@ int authenticate_console(ssh_session session)
         // Try to authenticate with password
         if (method & SSH_AUTH_METHOD_PASSWORD) {
             rc = ssh_userauth_password(session, NULL, password);
-            if (rc == SSH_AUTH_ERROR) {
+            if (rc == SSH_AUTH_ERROR || !ssh_is_connected(session)) {
                 error(session);
                 return rc;
             } else if (rc == SSH_AUTH_SUCCESS) {

examples/connect_ssh.c

@@ -21,47 +21,57 @@ clients must be made or how a client should react.
 #include "examples_common.h"
 #include <stdio.h>
 
-ssh_session connect_ssh(const char *host, const char *user,int verbosity){
+ssh_session connect_ssh(const char *host, const char *port, const char *user, int verbosity)
-  ssh_session session;
+{
-  int auth=0;
+    ssh_session session = NULL;
+    int auth = 0;
 
-  session=ssh_new();
+    session = ssh_new();
-  if (session == NULL) {
+    if (session == NULL) {
-    return NULL;
+        return NULL;
-  }
-
-  if(user != NULL){
-    if (ssh_options_set(session, SSH_OPTIONS_USER, user) < 0) {
-      ssh_free(session);
-      return NULL;
     }
-  }
 
-  if (ssh_options_set(session, SSH_OPTIONS_HOST, host) < 0) {
+    if (user != NULL) {
-    ssh_free(session);
+        if (ssh_options_set(session, SSH_OPTIONS_USER, user) < 0) {
-    return NULL;
+            ssh_free(session);
-  }
+            return NULL;
-  ssh_options_set(session, SSH_OPTIONS_LOG_VERBOSITY, &verbosity);
+        }
-  if(ssh_connect(session)){
+    }
-    fprintf(stderr,"Connection failed : %s\n",ssh_get_error(session));
+
+    if (port != NULL) {
+        if (ssh_options_set(session, SSH_OPTIONS_PORT_STR, port) < 0) {
+            ssh_free(session);
+            return NULL;
+        }
+    }
+
+    if (ssh_options_set(session, SSH_OPTIONS_HOST, host) < 0) {
+        ssh_free(session);
+        return NULL;
+    }
+    ssh_options_set(session, SSH_OPTIONS_LOG_VERBOSITY, &verbosity);
+    if (ssh_connect(session)) {
+        fprintf(stderr, "Connection failed : %s\n", ssh_get_error(session));
+        ssh_disconnect(session);
+        ssh_free(session);
+        return NULL;
+    }
+    if (verify_knownhost(session) < 0) {
+        ssh_disconnect(session);
+        ssh_free(session);
+        return NULL;
+    }
+    auth = authenticate_console(session);
+    if (auth == SSH_AUTH_SUCCESS) {
+        return session;
+    } else if (auth == SSH_AUTH_DENIED) {
+        fprintf(stderr, "Authentication failed\n");
+    } else {
+        fprintf(stderr,
+                "Error while authenticating : %s\n",
+                ssh_get_error(session));
+    }
     ssh_disconnect(session);
     ssh_free(session);
     return NULL;
-  }
-  if(verify_knownhost(session)<0){
-    ssh_disconnect(session);
-    ssh_free(session);
-    return NULL;
-  }
-  auth=authenticate_console(session);
-  if(auth==SSH_AUTH_SUCCESS){
-    return session;
-  } else if(auth==SSH_AUTH_DENIED){
-    fprintf(stderr,"Authentication failed\n");
-  } else {
-    fprintf(stderr,"Error while authenticating : %s\n",ssh_get_error(session));
-  }
-  ssh_disconnect(session);
-  ssh_free(session);
-  return NULL;
 }

examples/examples_common.h

@@ -16,11 +16,11 @@ clients must be made or how a client should react.
 #include <libssh/libssh.h>
 
 /** Zero a structure */
-#define ZERO_STRUCT(x) memset((char *)&(x), 0, sizeof(x))
+#define ZERO_STRUCT(x) memset(&(x), 0, sizeof(x))
 
 int authenticate_console(ssh_session session);
 int authenticate_kbdint(ssh_session session, const char *password);
 int verify_knownhost(ssh_session session);
-ssh_session connect_ssh(const char *hostname, const char *user, int verbosity);
+ssh_session connect_ssh(const char *hostname, const char *port, const char *user, int verbosity);
 
 #endif /* EXAMPLES_COMMON_H_ */

examples/exec.c

@@ -5,13 +5,13 @@
 #include "examples_common.h"
 
 int main(void) {
-    ssh_session session;
+    ssh_session session = NULL;
-    ssh_channel channel;
+    ssh_channel channel = NULL;
     char buffer[256];
     int rbytes, wbytes, total = 0;
     int rc;
 
-    session = connect_ssh("localhost", NULL, 0);
+    session = connect_ssh("localhost", NULL, NULL, 0);
     if (session == NULL) {
         ssh_finalize();
         return 1;

examples/keygen2.c

@@ -350,7 +350,12 @@ int main(int argc, char *argv[])
         goto end;
     }
 
-    if (arguments.action_list && arguments.file) {
+    if (arguments.file == NULL) {
+        fprintf(stderr, "Error: Missing argument file\n");
+        goto end;
+    }
+
+    if (arguments.action_list) {
         list_fingerprint(arguments.file);
         goto end;
     }

examples/knownhosts.c

@@ -38,7 +38,7 @@ int verify_knownhost(ssh_session session)
     char buf[10];
     unsigned char *hash = NULL;
     size_t hlen;
-    ssh_key srv_pubkey;
+    ssh_key srv_pubkey = NULL;
     int rc;
 
     rc = ssh_get_server_publickey(session, &srv_pubkey);

examples/libssh_scp.c

@@ -26,10 +26,11 @@ program.
 #define BUF_SIZE 16384
 #endif
 
-static char **sources;
+static char **sources = NULL;
 static int nsources;
-static char *destination;
+static char *destination = NULL;
 static int verbosity = 0;
+static char *port = NULL;
 
 struct location {
     int is_ssh;
@@ -49,9 +50,10 @@ enum {
 static void usage(const char *argv0) {
     fprintf(stderr, "Usage : %s [options] [[user@]host1:]file1 ... \n"
             "                               [[user@]host2:]destination\n"
-            "sample scp client - libssh-%s\n",
+            "sample scp client - libssh-%s\n"
-            //      "Options :\n",
+            "Options :\n"
-            //      "  -r : use RSA to verify host public key\n",
+            "  -P : use port to connect to remote host\n"
+            "  -v : increase verbosity of libssh. Can be used multiple times\n",
             argv0,
             ssh_version(0));
     exit(0);
@@ -60,11 +62,14 @@ static void usage(const char *argv0) {
 static int opts(int argc, char **argv) {
     int i;
 
-    while((i = getopt(argc, argv, "v")) != -1) {
+    while((i = getopt(argc, argv, "P:v")) != -1) {
         switch(i) {
         case 'v':
             verbosity++;
             break;
+        case 'P':
+            port = optarg;
+            break;
         default:
             fprintf(stderr, "unknown option %c\n", optopt);
             usage(argv[0]);
@@ -114,9 +119,14 @@ static void location_free(struct location *loc)
     }
 }
 
-static struct location *parse_location(char *loc) {
+static struct location *parse_location(char *loc)
-    struct location *location;
+{
-    char *ptr;
+    struct location *location = NULL;
+    char *ptr = NULL;
+
+    if (loc == NULL) {
+        return NULL;
+    }
 
     location = malloc(sizeof(struct location));
     if (location == NULL) {
@@ -178,7 +188,7 @@ static void close_location(struct location *loc) {
 
 static int open_location(struct location *loc, int flag) {
     if (loc->is_ssh && flag == WRITE) {
-        loc->session = connect_ssh(loc->host, loc->user, verbosity);
+        loc->session = connect_ssh(loc->host, port, loc->user, verbosity);
         if (!loc->session) {
             fprintf(stderr, "Couldn't connect to %s\n", loc->host);
             return -1;
@@ -204,7 +214,7 @@ static int open_location(struct location *loc, int flag) {
         }
         return 0;
     } else if (loc->is_ssh && flag == READ) {
-        loc->session = connect_ssh(loc->host, loc->user, verbosity);
+        loc->session = connect_ssh(loc->host, port, loc->user, verbosity);
         if (!loc->session) {
             fprintf(stderr, "Couldn't connect to %s\n", loc->host);
             return -1;

examples/proxy.c

@@ -35,8 +35,8 @@ clients must be made or how a client should react.
 static int authenticated=0;
 static int tries = 0;
 static int error = 0;
-static ssh_channel chan=NULL;
+static ssh_channel chan = NULL;
-static char *username;
+static char *username = NULL;
 static ssh_gssapi_creds client_creds = NULL;
 
 static int auth_password(ssh_session session, const char *user,
@@ -204,11 +204,12 @@ static error_t parse_opt (int key, char *arg, struct argp_state *state) {
 static struct argp argp = {options, parse_opt, args_doc, doc, NULL, NULL, NULL};
 #endif /* HAVE_ARGP_H */
 
-int main(int argc, char **argv){
+int main(int argc, char **argv)
-    ssh_session session;
+{
-    ssh_bind sshbind;
+    ssh_session session = NULL;
-    ssh_event mainloop;
+    ssh_bind sshbind = NULL;
-    ssh_session client_session;
+    ssh_event mainloop = NULL;
+    ssh_session client_session = NULL;
 
     struct ssh_server_callbacks_struct cb = {
         .userdata = NULL,
@@ -219,7 +220,7 @@ int main(int argc, char **argv){
 
     char buf[BUF_SIZE];
     char host[128]="";
-    char *ptr;
+    char *ptr = NULL;
     int i,r, rc;
 
     sshbind=ssh_bind_new();
@@ -336,4 +337,3 @@ int main(int argc, char **argv){
     ssh_finalize();
     return 0;
 }
-

examples/sample_sftpserver.c

@@ -148,6 +148,7 @@ static error_t parse_opt(int key, char *arg, struct argp_state *state)
     ssh_bind sshbind = state->input;
     static int no_default_keys = 0;
     static int rsa_already_set = 0, ecdsa_already_set = 0;
+    static int verbosity = 0;
 
     switch (key)
     {
@@ -176,8 +177,10 @@ static error_t parse_opt(int key, char *arg, struct argp_state *state)
         strncpy(authorizedkeys, arg, DEF_STR_SIZE - 1);
         break;
     case 'v':
-        ssh_bind_options_set(sshbind, SSH_BIND_OPTIONS_LOG_VERBOSITY_STR,
+        verbosity++;
-                             "3");
+        ssh_bind_options_set(sshbind,
+                             SSH_BIND_OPTIONS_LOG_VERBOSITY,
+                             &verbosity);
         break;
     case ARGP_KEY_ARG:
         if (state->arg_num >= 1)
@@ -213,10 +216,7 @@ static struct argp argp = {options, parse_opt, args_doc, doc, NULL, NULL, NULL};
 #endif /* HAVE_ARGP_H */
 
 /* A userdata struct for channel. */
-struct channel_data_struct
+struct channel_data_struct {
-{
-    /* Event which is used to poll the above descriptors. */
-    ssh_event event;
     sftp_session sftp;
 };
 
@@ -378,18 +378,11 @@ static void handle_session(ssh_event event, ssh_session session)
     do {
         /* Poll the main event which takes care of the session, the channel and
          * even our child process's stdout/stderr (once it's started). */
-        if (ssh_event_dopoll(event, -1) == SSH_ERROR) {
+        if (ssh_event_dopoll(event, 100) == SSH_ERROR) {
             ssh_channel_close(sdata.channel);
         }
-
+    } while (ssh_channel_is_open(sdata.channel) &&
-        /* If child process's stdout/stderr has been registered with the event,
+             !ssh_channel_is_eof(sdata.channel));
-         * or the child process hasn't started yet, continue. */
-        if (cdata.event != NULL) {
-            continue;
-        }
-        /* FIXME The server keeps hanging in the poll above when the client
-         * closes the channel */
-    } while (ssh_channel_is_open(sdata.channel));
 
     ssh_channel_send_eof(sdata.channel);
     ssh_channel_close(sdata.channel);

examples/samplesshd-cb.c

@@ -244,10 +244,11 @@ static error_t parse_opt (int key, char *arg, struct argp_state *state) {
 static struct argp argp = {options, parse_opt, args_doc, doc, NULL, NULL, NULL};
 #endif /* HAVE_ARGP_H */
 
-int main(int argc, char **argv){
+int main(int argc, char **argv)
-    ssh_session session;
+{
-    ssh_bind sshbind;
+    ssh_session session = NULL;
-    ssh_event mainloop;
+    ssh_bind sshbind = NULL;
+    ssh_event mainloop = NULL;
     struct ssh_server_callbacks_struct cb = {
         .userdata = NULL,
         .auth_none_function = auth_none,
@@ -339,4 +340,3 @@ int main(int argc, char **argv){
     ssh_finalize();
     return 0;
 }
-

examples/samplesshd-kbdint.c

@@ -174,8 +174,8 @@ static error_t parse_opt (int key, char *arg, struct argp_state *state) {
 static struct argp argp = {options, parse_opt, args_doc, doc, NULL, NULL, NULL};
 #endif /* HAVE_ARGP_H */
 
-static const char *name;
+static const char *name = NULL;
-static const char *instruction;
+static const char *instruction = NULL;
 static const char *prompts[2];
 static char echo[] = { 1, 0 };
 
@@ -279,11 +279,12 @@ static int authenticate(ssh_session session) {
     return 0;
 }
 
-int main(int argc, char **argv){
+int main(int argc, char **argv)
-    ssh_session session;
+{
-    ssh_bind sshbind;
+    ssh_session session = NULL;
-    ssh_message message;
+    ssh_bind sshbind = NULL;
-    ssh_channel chan=0;
+    ssh_message message = NULL;
+    ssh_channel chan = NULL;
     char buf[BUF_SIZE];
     int auth=0;
     int shell=0;
@@ -411,4 +412,3 @@ int main(int argc, char **argv){
     ssh_finalize();
     return 0;
 }
-

examples/scp_download.c

@@ -32,151 +32,163 @@ static const char *createcommand =
     "cd /tmp/libssh_tests && date > a && date > b && mkdir c && date > d";
 static char *host = NULL;
 
-static void usage(const char *argv0){
+static void usage(const char *argv0)
-  fprintf(stderr,"Usage : %s [options] host\n"
+{
-      "sample tiny scp downloader client - libssh-%s\n"
+    fprintf(stderr,
-	  "This program will create files in /tmp and try to fetch them\n",
+            "Usage : %s [options] host\n"
-//      "Options :\n",
+            "sample tiny scp downloader client - libssh-%s\n"
-//      "  -r : use RSA to verify host public key\n",
+            "This program will create files in /tmp and try to fetch them\n",
-      argv0,
+            argv0,
-      ssh_version(0));
+            ssh_version(0));
-  exit(0);
+    exit(0);
 }
 
-static int opts(int argc, char **argv){
+static int opts(int argc, char **argv)
-  int i;
+{
-  while((i=getopt(argc,argv,"v"))!=-1){
+    int i;
-    switch(i){
+
-      case 'v':
+    while ((i = getopt(argc, argv, "v")) != -1) {
-        verbosity++;
+        switch (i) {
-        break;
+        case 'v':
-      default:
+            verbosity++;
-        fprintf(stderr,"unknown option %c\n",optopt);
+            break;
+        default:
+            fprintf(stderr, "unknown option %c\n", optopt);
+            usage(argv[0]);
+            return -1;
+        }
+    }
+    host = argv[optind];
+    if (host == NULL)
         usage(argv[0]);
+    return 0;
+}
+
+static void create_files(ssh_session session)
+{
+    ssh_channel channel = ssh_channel_new(session);
+    char buffer[1];
+    int rc;
+
+    if (channel == NULL) {
+        fprintf(stderr, "Error creating channel: %s\n", ssh_get_error(session));
+        exit(EXIT_FAILURE);
+    }
+    if (ssh_channel_open_session(channel) != SSH_OK) {
+        fprintf(stderr, "Error creating channel: %s\n", ssh_get_error(session));
+        ssh_channel_free(channel);
+        exit(EXIT_FAILURE);
+    }
+    if (ssh_channel_request_exec(channel, createcommand) != SSH_OK) {
+        fprintf(stderr,
+                "Error executing command: %s\n",
+                ssh_get_error(session));
+        ssh_channel_close(channel);
+        ssh_channel_free(channel);
+        exit(EXIT_FAILURE);
+    }
+    while (!ssh_channel_is_eof(channel)) {
+        rc = ssh_channel_read(channel, buffer, 1, 1);
+        if (rc != 1) {
+            fprintf(stderr, "Error reading from channel\n");
+            ssh_channel_close(channel);
+            ssh_channel_free(channel);
+            return;
+        }
+
+        rc = write(1, buffer, 1);
+        if (rc < 0) {
+            fprintf(stderr, "Error writing to buffer\n");
+            ssh_channel_close(channel);
+            ssh_channel_free(channel);
+            return;
+        }
+    }
+    ssh_channel_close(channel);
+    ssh_channel_free(channel);
+}
+
+static int fetch_files(ssh_session session)
+{
+    int size;
+    char buffer[BUF_SIZE];
+    int mode;
+    char *filename = NULL;
+    int r;
+    ssh_scp scp = ssh_scp_new(session,
+                              SSH_SCP_READ | SSH_SCP_RECURSIVE,
+                              "/tmp/libssh_tests/*");
+    if (ssh_scp_init(scp) != SSH_OK) {
+        fprintf(stderr, "error initializing scp: %s\n", ssh_get_error(session));
+        ssh_scp_free(scp);
         return -1;
     }
-  }
+    printf("Trying to download 3 files (a,b,d) and 1 directory (c)\n");
-  host = argv[optind];
+    do {
-  if(host == NULL)
+        r = ssh_scp_pull_request(scp);
-	  usage(argv[0]);
+        switch (r) {
-  return 0;
+        case SSH_SCP_REQUEST_NEWFILE:
+            size = ssh_scp_request_get_size(scp);
+            filename = strdup(ssh_scp_request_get_filename(scp));
+            mode = ssh_scp_request_get_permissions(scp);
+            printf("downloading file %s, size %d, perms 0%o\n",
+                   filename,
+                   size,
+                   mode);
+            free(filename);
+            ssh_scp_accept_request(scp);
+            r = ssh_scp_read(scp, buffer, sizeof(buffer));
+            if (r == SSH_ERROR) {
+                fprintf(stderr,
+                        "Error reading scp: %s\n",
+                        ssh_get_error(session));
+                ssh_scp_close(scp);
+                ssh_scp_free(scp);
+                return -1;
+            }
+            printf("done\n");
+            break;
+        case SSH_ERROR:
+            fprintf(stderr, "Error: %s\n", ssh_get_error(session));
+            ssh_scp_close(scp);
+            ssh_scp_free(scp);
+            return -1;
+        case SSH_SCP_REQUEST_WARNING:
+            fprintf(stderr, "Warning: %s\n", ssh_scp_request_get_warning(scp));
+            break;
+        case SSH_SCP_REQUEST_NEWDIR:
+            filename = strdup(ssh_scp_request_get_filename(scp));
+            mode = ssh_scp_request_get_permissions(scp);
+            printf("downloading directory %s, perms 0%o\n", filename, mode);
+            free(filename);
+            ssh_scp_accept_request(scp);
+            break;
+        case SSH_SCP_REQUEST_ENDDIR:
+            printf("End of directory\n");
+            break;
+        case SSH_SCP_REQUEST_EOF:
+            printf("End of requests\n");
+            goto end;
+        }
+    } while (1);
+end:
+    ssh_scp_close(scp);
+    ssh_scp_free(scp);
+    return 0;
 }
 
-static void create_files(ssh_session session){
+int main(int argc, char **argv)
-	ssh_channel channel=ssh_channel_new(session);
+{
-	char buffer[1];
+    ssh_session session = NULL;
-        int rc;
+    if (opts(argc, argv) < 0)
-
+        return EXIT_FAILURE;
-	if(channel == NULL){
+    session = connect_ssh(host, NULL, NULL, verbosity);
-		fprintf(stderr,"Error creating channel: %s\n",ssh_get_error(session));
+    if (session == NULL)
-		exit(EXIT_FAILURE);
+        return EXIT_FAILURE;
-	}
+    create_files(session);
-	if(ssh_channel_open_session(channel) != SSH_OK){
+    fetch_files(session);
-		fprintf(stderr,"Error creating channel: %s\n",ssh_get_error(session));
+    ssh_disconnect(session);
-		ssh_channel_free(channel);
+    ssh_free(session);
-		exit(EXIT_FAILURE);
+    ssh_finalize();
-	}
+    return 0;
-	if(ssh_channel_request_exec(channel,createcommand) != SSH_OK){
-		fprintf(stderr,"Error executing command: %s\n",ssh_get_error(session));
-		ssh_channel_close(channel);
-		ssh_channel_free(channel);
-		exit(EXIT_FAILURE);
-	}
-	while(!ssh_channel_is_eof(channel)){
-		rc = ssh_channel_read(channel,buffer,1,1);
-                if (rc != 1) {
-                    fprintf(stderr, "Error reading from channel\n");
-                    ssh_channel_close(channel);
-                    ssh_channel_free(channel);
-                    return;
-                }
-
-                rc = write(1, buffer, 1);
-                if (rc < 0) {
-                    fprintf(stderr, "Error writing to buffer\n");
-                    ssh_channel_close(channel);
-                    ssh_channel_free(channel);
-                    return;
-                }
-	}
-	ssh_channel_close(channel);
-	ssh_channel_free(channel);
-}
-
-
-static int fetch_files(ssh_session session){
-  int size;
-  char buffer[BUF_SIZE];
-  int mode;
-  char *filename;
-  int r;
-  ssh_scp scp=ssh_scp_new(session, SSH_SCP_READ | SSH_SCP_RECURSIVE, "/tmp/libssh_tests/*");
-  if(ssh_scp_init(scp) != SSH_OK){
-	  fprintf(stderr,"error initializing scp: %s\n",ssh_get_error(session));
-	  ssh_scp_free(scp);
-	  return -1;
-  }
-  printf("Trying to download 3 files (a,b,d) and 1 directory (c)\n");
-  do {
-
-	  r=ssh_scp_pull_request(scp);
-	  switch(r){
-	  case SSH_SCP_REQUEST_NEWFILE:
-		  size=ssh_scp_request_get_size(scp);
-		  filename=strdup(ssh_scp_request_get_filename(scp));
-		  mode=ssh_scp_request_get_permissions(scp);
-		  printf("downloading file %s, size %d, perms 0%o\n",filename,size,mode);
-		  free(filename);
-		  ssh_scp_accept_request(scp);
-		  r=ssh_scp_read(scp,buffer,sizeof(buffer));
-		  if(r==SSH_ERROR){
-			  fprintf(stderr,"Error reading scp: %s\n",ssh_get_error(session));
-			  ssh_scp_close(scp);
-			  ssh_scp_free(scp);
-			  return -1;
-		  }
-		  printf("done\n");
-		  break;
-	  case SSH_ERROR:
-		  fprintf(stderr,"Error: %s\n",ssh_get_error(session));
-		  ssh_scp_close(scp);
-		  ssh_scp_free(scp);
-		  return -1;
-	  case SSH_SCP_REQUEST_WARNING:
-		  fprintf(stderr,"Warning: %s\n",ssh_scp_request_get_warning(scp));
-		  break;
-	  case SSH_SCP_REQUEST_NEWDIR:
-		  filename=strdup(ssh_scp_request_get_filename(scp));
-		  mode=ssh_scp_request_get_permissions(scp);
-		  printf("downloading directory %s, perms 0%o\n",filename,mode);
-		  free(filename);
-		  ssh_scp_accept_request(scp);
-		  break;
-	  case SSH_SCP_REQUEST_ENDDIR:
-		  printf("End of directory\n");
-		  break;
-	  case SSH_SCP_REQUEST_EOF:
-		  printf("End of requests\n");
-		  goto end;
-	  }
-  } while (1);
-  end:
-  ssh_scp_close(scp);
-  ssh_scp_free(scp);
-  return 0;
-}
-
-int main(int argc, char **argv){
-  ssh_session session;
-  if(opts(argc,argv)<0)
-    return EXIT_FAILURE;
-  session=connect_ssh(host,NULL,verbosity);
-  if(session == NULL)
-	  return EXIT_FAILURE;
-  create_files(session);
-  fetch_files(session);
-  ssh_disconnect(session);
-  ssh_free(session);
-  ssh_finalize();
-  return 0;
 }

examples/senddata.c

@@ -5,60 +5,60 @@
 
 #define LIMIT 0x100000000UL
 
-int main(void) {
+int main(void)
-  ssh_session session;
+{
-  ssh_channel channel;
+    ssh_session session = NULL;
-  char buffer[1024*1024];
+    ssh_channel channel = NULL;
-  int rc;
+    char buffer[1024 * 1024] = {0};
-  uint64_t total=0;
+    int rc;
-  uint64_t lastshown=4096;
+    uint64_t total = 0;
-  session = connect_ssh("localhost", NULL, 0);
+    uint64_t lastshown = 4096;
-  if (session == NULL) {
+    session = connect_ssh("localhost", NULL, NULL, 0);
-    return 1;
+    if (session == NULL) {
-  }
+        return 1;
-
-  channel = ssh_channel_new(session);
-  if (channel == NULL) {
-    ssh_disconnect(session);
-    return 1;
-  }
-
-  rc = ssh_channel_open_session(channel);
-  if (rc < 0) {
-    ssh_channel_close(channel);
-    ssh_disconnect(session);
-    return 1;
-  }
-
-  rc = ssh_channel_request_exec(channel, "cat > /dev/null");
-  if (rc < 0) {
-    ssh_channel_close(channel);
-    ssh_disconnect(session);
-    return 1;
-  }
-
-
-  while ((rc = ssh_channel_write(channel, buffer, sizeof(buffer))) > 0) {
-    total += rc;
-    if(total/2 >= lastshown){
-      printf("written %llx\n", (long long unsigned int) total);
-      lastshown=total;
     }
-    if(total > LIMIT)
-      break;
-  }
 
-  if (rc < 0) {
+    channel = ssh_channel_new(session);
-    printf("error : %s\n",ssh_get_error(session));
+    if (channel == NULL) {
+        ssh_disconnect(session);
+        return 1;
+    }
+
+    rc = ssh_channel_open_session(channel);
+    if (rc < 0) {
+        ssh_channel_close(channel);
+        ssh_disconnect(session);
+        return 1;
+    }
+
+    rc = ssh_channel_request_exec(channel, "cat > /dev/null");
+    if (rc < 0) {
+        ssh_channel_close(channel);
+        ssh_disconnect(session);
+        return 1;
+    }
+
+    while ((rc = ssh_channel_write(channel, buffer, sizeof(buffer))) > 0) {
+        total += rc;
+        if (total / 2 >= lastshown) {
+            printf("written %llx\n", (long long unsigned int)total);
+            lastshown = total;
+        }
+        if (total > LIMIT)
+            break;
+    }
+
+    if (rc < 0) {
+        printf("error : %s\n", ssh_get_error(session));
+        ssh_channel_close(channel);
+        ssh_disconnect(session);
+        return 1;
+    }
+
+    ssh_channel_send_eof(channel);
     ssh_channel_close(channel);
+
     ssh_disconnect(session);
-    return 1;
-  }
 
-  ssh_channel_send_eof(channel);
+    return 0;
-  ssh_channel_close(channel);
-
-  ssh_disconnect(session);
-
-  return 0;
 }

examples/ssh_X11_client.c

@@ -70,6 +70,7 @@
 
 #include <errno.h>
 #include <fcntl.h>
+#include <inttypes.h>
 #include <poll.h>
 #include <pthread.h>
 #include <stddef.h>
@@ -231,7 +232,7 @@ static void _logging_callback(int priority, const char *function,
 
     milliseconds = _current_timestamp();
 
-    fprintf(fp, "[%s.%jd, %d] %s: %s\n", buf, milliseconds, priority,
+    fprintf(fp, "[%s.%" PRId64 ", %d] %s: %s\n", buf, milliseconds, priority,
             function, buffer);
     fclose(fp);
 }

examples/ssh_client.c

@@ -39,8 +39,6 @@
 
 #include <libssh/callbacks.h>
 #include <libssh/libssh.h>
-#include <libssh/sftp.h>
-
 
 #include "examples_common.h"
 #define MAXCMD 10
@@ -53,7 +51,7 @@ static struct termios terminal;
 
 static char *pcap_file = NULL;
 
-static char *proxycommand;
+static char *proxycommand = NULL;
 
 static int auth_callback(const char *prompt,
                          char *buf,
@@ -88,22 +86,24 @@ static void add_cmd(char *cmd)
 
 static void usage(void)
 {
-    fprintf(stderr,
+    fprintf(
-            "Usage : ssh [options] [login@]hostname\n"
+        stderr,
-            "sample client - libssh-%s\n"
+        "Usage : ssh [options] [login@]hostname\n"
-            "Options :\n"
+        "sample client - libssh-%s\n"
-            "  -l user : log in as user\n"
+        "Options :\n"
-            "  -p port : connect to port\n"
+        "  -l user : log in as user\n"
-            "  -r : use RSA to verify host public key\n"
+        "  -p port : connect to port\n"
-            "  -F file : parse configuration file instead of default one\n"
+        "  -o option : set configuration option (e.g., -o Compression=yes)\n"
+        "  -r : use RSA to verify host public key\n"
+        "  -F file : parse configuration file instead of default one\n"
 #ifdef WITH_PCAP
-            "  -P file : create a pcap debugging file\n"
+        "  -P file : create a pcap debugging file\n"
 #endif
 #ifndef _WIN32
-            "  -T proxycommand : command to execute as a socket proxy\n"
+        "  -T proxycommand : command to execute as a socket proxy\n"
 #endif
-            "\n",
+        "\n",
-            ssh_version(0));
+        ssh_version(0));
 
     exit(0);
 }
@@ -112,8 +112,8 @@ static int opts(int argc, char **argv)
 {
     int i;
 
-    while((i = getopt(argc,argv,"T:P:F:")) != -1) {
+    while ((i = getopt(argc, argv, "T:P:F:")) != -1) {
-        switch(i){
+        switch (i) {
         case 'P':
             pcap_file = optarg;
             break;
@@ -159,16 +159,14 @@ static void cfmakeraw(struct termios *termios_p)
 
 static void do_cleanup(int i)
 {
-  /* unused variable */
+    (void)i;
-  (void) i;
 
-  tcsetattr(0, TCSANOW, &terminal);
+    tcsetattr(0, TCSANOW, &terminal);
 }
 
 static void do_exit(int i)
 {
-    /* unused variable */
+    (void)i;
-    (void) i;
 
     do_cleanup(0);
     exit(0);
@@ -179,7 +177,7 @@ static int signal_delayed = 0;
 #ifdef SIGWINCH
 static void sigwindowchanged(int i)
 {
-    (void) i;
+    (void)i;
     signal_delayed = 1;
 }
 #endif
@@ -213,18 +211,18 @@ static void select_loop(ssh_session session,ssh_channel channel)
     /* stdin */
     connector_in = ssh_connector_new(session);
     ssh_connector_set_out_channel(connector_in, channel, SSH_CONNECTOR_STDINOUT);
-    ssh_connector_set_in_fd(connector_in, 0);
+    ssh_connector_set_in_fd(connector_in, STDIN_FILENO);
     ssh_event_add_connector(event, connector_in);
 
     /* stdout */
     connector_out = ssh_connector_new(session);
-    ssh_connector_set_out_fd(connector_out, 1);
+    ssh_connector_set_out_fd(connector_out, STDOUT_FILENO);
     ssh_connector_set_in_channel(connector_out, channel, SSH_CONNECTOR_STDINOUT);
     ssh_event_add_connector(event, connector_out);
 
     /* stderr */
     connector_err = ssh_connector_new(session);
-    ssh_connector_set_out_fd(connector_err, 2);
+    ssh_connector_set_out_fd(connector_err, STDERR_FILENO);
     ssh_connector_set_in_channel(connector_err, channel, SSH_CONNECTOR_STDERR);
     ssh_event_add_connector(event, connector_err);
 
@@ -251,9 +249,9 @@ static void select_loop(ssh_session session,ssh_channel channel)
 
 static void shell(ssh_session session)
 {
-    ssh_channel channel;
+    ssh_channel channel = NULL;
     struct termios terminal_local;
-    int interactive=isatty(0);
+    int interactive = isatty(0);
 
     channel = ssh_channel_new(session);
     if (channel == NULL) {
@@ -339,7 +337,7 @@ static void batch_shell(ssh_session session)
 static int client(ssh_session session)
 {
     int auth = 0;
-    char *banner;
+    char *banner = NULL;
     int state;
 
     if (user) {
@@ -357,10 +355,8 @@ static int client(ssh_session session)
     }
     /* Parse configuration file if specified: The command-line options will
      * overwrite items loaded from configuration file */
-    if (config_file != NULL) {
+    if (ssh_options_parse_config(session, config_file) < 0) {
-        ssh_options_parse_config(session, config_file);
+        return -1;
-    } else {
-        ssh_options_parse_config(session, NULL);
     }
 
     if (ssh_connect(session)) {
@@ -423,7 +419,7 @@ static void cleanup_pcap(void)
 
 int main(int argc, char **argv)
 {
-    ssh_session session;
+    ssh_session session = NULL;
 
     ssh_init();
     session = ssh_new();

examples/ssh_server.c

@@ -192,9 +192,6 @@ static struct argp argp = {options, parse_opt, args_doc, doc, NULL, NULL, NULL};
 static int
 parse_opt(int argc, char **argv, ssh_bind sshbind)
 {
-    int no_default_keys = 0;
-    int rsa_already_set = 0;
-    int ecdsa_already_set = 0;
     int key;
 
     while((key = getopt(argc, argv, "a:e:k:p:P:r:u:v")) != -1) {
@@ -202,16 +199,10 @@ parse_opt(int argc, char **argv, ssh_bind sshbind)
             ssh_bind_options_set(sshbind, SSH_BIND_OPTIONS_BINDPORT_STR, optarg);
         } else if (key == 'k') {
             ssh_bind_options_set(sshbind, SSH_BIND_OPTIONS_HOSTKEY, optarg);
-            /* We can't track the types of keys being added with this
-            option, so let's ensure we keep the keys we're adding
-            by just not setting the default keys */
-            no_default_keys = 1;
         } else if (key == 'r') {
             ssh_bind_options_set(sshbind, SSH_BIND_OPTIONS_HOSTKEY, optarg);
-            rsa_already_set = 1;
         } else if (key == 'e') {
             ssh_bind_options_set(sshbind, SSH_BIND_OPTIONS_HOSTKEY, optarg);
-            ecdsa_already_set = 1;
         } else if (key == 'a') {
             strncpy(authorizedkeys, optarg, DEF_STR_SIZE-1);
         } else if (key == 'u') {
@@ -256,12 +247,6 @@ parse_opt(int argc, char **argv, ssh_bind sshbind)
 
     ssh_bind_options_set(sshbind, SSH_BIND_OPTIONS_BINDADDR, argv[optind]);
 
-    if (!no_default_keys) {
-        set_default_keys(sshbind,
-                         rsa_already_set,
-                         ecdsa_already_set);
-    }
-
     return 0;
 }
 #endif /* HAVE_ARGP_H */
@@ -646,6 +631,58 @@ auth_publickey(ssh_session session,
     return SSH_AUTH_DENIED;
 }
 
+static int kbdint_check_response(ssh_session session)
+{
+    int count, cmp;
+    const char *answer = NULL;
+
+    count = ssh_userauth_kbdint_getnanswers(session);
+    if (count != 2) {
+        return 0;
+    }
+
+    answer = ssh_userauth_kbdint_getanswer(session, 0);
+    cmp = strcasecmp("omnitrix", answer);
+    if (cmp != 0) {
+        return 0;
+    }
+
+    answer = ssh_userauth_kbdint_getanswer(session, 1);
+    cmp = strcmp("000", answer);
+    if (cmp != 0) {
+        return 0;
+    }
+
+    return 1;
+}
+
+static int
+auth_kbdint(ssh_message message, ssh_session session, void *userdata)
+{
+    struct session_data_struct *sdata = (struct session_data_struct *)userdata;
+    const char *name = "\n\nKeyboard-Interactive Fancy Authentication\n";
+    const char *instruction = "Most powerful weapon in the galaxy";
+    const char *prompts[2] = {"Name of the weapon: ", "Destruct Code: "};
+    char echo[] = {1, 0};
+    if (!ssh_message_auth_kbdint_is_response(message)) {
+        printf("User %s wants to auth with kbdint\n",
+               ssh_message_auth_user(message));
+        ssh_message_auth_interactive_request(message,
+                                             name,
+                                             instruction,
+                                             2,
+                                             prompts,
+                                             echo);
+        return SSH_AUTH_INFO;
+    } else {
+        if (kbdint_check_response(session)) {
+            sdata->authenticated = 1;
+            return SSH_AUTH_SUCCESS;
+        }
+        return SSH_AUTH_DENIED;
+    }
+}
+
 static ssh_channel
 channel_open(ssh_session session, void *userdata)
 {
@@ -735,14 +772,15 @@ handle_session(ssh_event event, ssh_session session)
     struct ssh_server_callbacks_struct server_cb = {
         .userdata = &sdata,
         .auth_password_function = auth_password,
+        .auth_kbdint_function = auth_kbdint,
         .channel_open_request_session_function = channel_open,
     };
 
     if (authorizedkeys[0]) {
         server_cb.auth_pubkey_function = auth_publickey;
-        ssh_set_auth_methods(session, SSH_AUTH_METHOD_PASSWORD | SSH_AUTH_METHOD_PUBLICKEY);
+        ssh_set_auth_methods(session, SSH_AUTH_METHOD_PASSWORD | SSH_AUTH_METHOD_PUBLICKEY | SSH_AUTH_METHOD_INTERACTIVE);
     } else
-        ssh_set_auth_methods(session, SSH_AUTH_METHOD_PASSWORD);
+        ssh_set_auth_methods(session, SSH_AUTH_METHOD_PASSWORD | SSH_AUTH_METHOD_INTERACTIVE);
 
     ssh_callbacks_init(&server_cb);
     ssh_callbacks_init(&channel_cb);

examples/sshd_direct-tcpip.c

@@ -361,7 +361,7 @@ my_fd_data_function(UNUSED_PARAM(socket_t fd),
 {
     struct event_fd_data_struct *event_fd_data = (struct event_fd_data_struct *)userdata;
     ssh_channel channel = event_fd_data->channel;
-    ssh_session session;
+    ssh_session session = NULL;
     int len, i, wr;
     char buf[BUF_SIZE];
     int blocking;
@@ -455,8 +455,8 @@ open_tcp_socket(ssh_message msg)
 {
     struct sockaddr_in sin;
     int forwardsock = -1;
-    struct hostent *host;
+    struct hostent *host = NULL;
-    const char *dest_hostname;
+    const char *dest_hostname = NULL;
     int dest_port;
 
     forwardsock = socket(AF_INET, SOCK_STREAM, 0);
@@ -499,8 +499,8 @@ message_callback(UNUSED_PARAM(ssh_session session),
                  UNUSED_PARAM(void *userdata))
 {
     ssh_channel channel;
-    int socket_fd, *pFd;
+    int socket_fd, *pFd = NULL;
-    struct ssh_channel_callbacks_struct *cb_chan;
+    struct ssh_channel_callbacks_struct *cb_chan = NULL;
     struct event_fd_data_struct *event_fd_data;
 
     _ssh_log(SSH_LOG_PACKET, "=== message_callback", "Message type: %d",
@@ -655,8 +655,8 @@ static struct argp argp = {options, parse_opt, args_doc, doc, NULL, NULL, NULL};
 int
 main(int argc, char **argv)
 {
-    ssh_session session;
+    ssh_session session = NULL;
-    ssh_bind sshbind;
+    ssh_bind sshbind = NULL;
     struct ssh_server_callbacks_struct cb = {
         .userdata = NULL,
         .auth_password_function = auth_password,

examples/sshnetcat.c

@@ -39,223 +39,237 @@ clients must be made or how a client should react.
 #define BUF_SIZE 4096
 #endif
 
-char *host;
+char *host = NULL;
-const char *desthost="localhost";
+const char *desthost = "localhost";
-const char *port="22";
+const char *port = "22";
 
 #ifdef WITH_PCAP
 #include <libssh/pcap.h>
-char *pcap_file=NULL;
+char *pcap_file = NULL;
 #endif
 
 static void usage(void)
 {
-  fprintf(stderr,"Usage : sshnetcat [user@]host forwarded_host forwarded_port\n");
+    fprintf(stderr,
-  exit(1);
+            "Usage : sshnetcat [user@]host forwarded_host forwarded_port\n");
+    exit(1);
 }
 
-static int opts(int argc, char **argv){
+static int opts(int argc, char **argv)
+{
     int i;
-    while((i=getopt(argc,argv,"P:"))!=-1){
+    while ((i = getopt(argc, argv, "P:")) != -1) {
-        switch(i){
+        switch (i) {
 #ifdef WITH_PCAP
-        	case 'P':
+        case 'P':
-        		pcap_file=optarg;
+            pcap_file = optarg;
-        		break;
+            break;
 #endif
-            default:
+        default:
-                fprintf(stderr,"unknown option %c\n",optopt);
+            fprintf(stderr, "unknown option %c\n", optopt);
-                usage();
+            usage();
         }
     }
-    if(optind < argc)
+    if (optind < argc)
-        host=argv[optind++];
+        host = argv[optind++];
-    if(optind < argc)
+    if (optind < argc)
-        desthost=argv[optind++];
+        desthost = argv[optind++];
-    if(optind < argc)
+    if (optind < argc)
-        port=argv[optind++];
+        port = argv[optind++];
-    if(host==NULL)
+    if (host == NULL)
         usage();
     return 0;
 }
 
-static void select_loop(ssh_session session,ssh_channel channel){
+static void select_loop(ssh_session session, ssh_channel channel)
-	fd_set fds;
+{
-	struct timeval timeout;
+    fd_set fds;
-	char buffer[BUF_SIZE];
+    struct timeval timeout;
-	/* channels will be set to the channels to poll.
+    char buffer[BUF_SIZE];
-	 * outchannels will contain the result of the poll
+    /* channels will be set to the channels to poll.
-	 */
+     * outchannels will contain the result of the poll
-	ssh_channel channels[2], outchannels[2];
+     */
-	int lus;
+    ssh_channel channels[2], outchannels[2];
-	int eof=0;
+    int lus;
-	int maxfd;
+    int eof = 0;
-	int ret;
+    int maxfd;
-	while(channel){
+    int ret;
-		do{
+    while (channel) {
+        do {
             int fd;
 
             ZERO_STRUCT(fds);
-			FD_ZERO(&fds);
+            FD_ZERO(&fds);
-			if(!eof)
+            if (!eof)
-				FD_SET(0,&fds);
+                FD_SET(0, &fds);
-			timeout.tv_sec=30;
+            timeout.tv_sec = 30;
-			timeout.tv_usec=0;
+            timeout.tv_usec = 0;
 
             fd = ssh_get_fd(session);
             if (fd == -1) {
-                fprintf(stderr, "Error getting the session file descriptor: %s\n",
+                fprintf(stderr,
-                                ssh_get_error(session));
+                        "Error getting the session file descriptor: %s\n",
+                        ssh_get_error(session));
                 return;
             }
             FD_SET(fd, &fds);
             maxfd = fd + 1;
 
-			channels[0]=channel; // set the first channel we want to read from
+            channels[0] = channel; // set the first channel we want to read from
-			channels[1]=NULL;
+            channels[1] = NULL;
-			ret=ssh_select(channels,outchannels,maxfd,&fds,&timeout);
+            ret = ssh_select(channels, outchannels, maxfd, &fds, &timeout);
-			if(ret==EINTR)
+            if (ret == EINTR)
-				continue;
+                continue;
-			if(FD_ISSET(0,&fds)){
+            if (FD_ISSET(0, &fds)) {
-				lus=read(0,buffer,sizeof(buffer));
+                lus = read(0, buffer, sizeof(buffer));
-				if(lus)
+                if (lus)
-					ssh_channel_write(channel,buffer,lus);
+                    ssh_channel_write(channel, buffer, lus);
-				else {
+                else {
-					eof=1;
+                    eof = 1;
-					ssh_channel_send_eof(channel);
+                    ssh_channel_send_eof(channel);
-				}
+                }
-			}
+            }
-			if(channel && ssh_channel_is_closed(channel)){
+            if (channel && ssh_channel_is_closed(channel)) {
-				ssh_channel_free(channel);
+                ssh_channel_free(channel);
-				channel=NULL;
+                channel = NULL;
-				channels[0]=NULL;
+                channels[0] = NULL;
-			}
+            }
-			if(outchannels[0]){
+            if (outchannels[0]) {
-				while(channel && ssh_channel_is_open(channel) && ssh_channel_poll(channel,0)){
+                while (channel && ssh_channel_is_open(channel) &&
-					lus = ssh_channel_read(channel,buffer,sizeof(buffer),0);
+                       ssh_channel_poll(channel, 0)) {
-					if(lus==-1){
+                    lus = ssh_channel_read(channel, buffer, sizeof(buffer), 0);
-						fprintf(stderr, "Error reading channel: %s\n",
+                    if (lus == -1) {
-								ssh_get_error(session));
+                        fprintf(stderr,
-						return;
+                                "Error reading channel: %s\n",
-					}
+                                ssh_get_error(session));
-					if(lus==0){
+                        return;
-						ssh_channel_free(channel);
-						channel=channels[0]=NULL;
-					} else {
-						ret = write(1, buffer, lus);
-						if (ret < 0) {
-							fprintf(stderr, "Error writing to stdin: %s",
-								strerror(errno));
-							return;
-						}
-					}
-				}
-				while(channel && ssh_channel_is_open(channel) && ssh_channel_poll(channel,1)){ /* stderr */
-					lus = ssh_channel_read(channel, buffer, sizeof(buffer), 1);
-					if(lus==-1){
-						fprintf(stderr, "Error reading channel: %s\n",
-								ssh_get_error(session));
-						return;
-					}
-					if(lus==0){
-						ssh_channel_free(channel);
-						channel=channels[0]=NULL;
-					} else {
-						ret = write(2, buffer, lus);
-						if (ret < 0) {
-							fprintf(stderr, "Error writing to stderr: %s",
-								strerror(errno));
-							return;
-						}
                     }
-				}
+                    if (lus == 0) {
-			}
+                        ssh_channel_free(channel);
-			if(channel && ssh_channel_is_closed(channel)){
+                        channel = channels[0] = NULL;
-				ssh_channel_free(channel);
+                    } else {
-				channel=NULL;
+                        ret = write(1, buffer, lus);
-			}
+                        if (ret < 0) {
-		} while (ret==EINTR || ret==SSH_EINTR);
+                            fprintf(stderr,
-
+                                    "Error writing to stdin: %s",
-	}
+                                    strerror(errno));
+                            return;
+                        }
+                    }
+                }
+                while (channel && ssh_channel_is_open(channel) &&
+                       ssh_channel_poll(channel, 1)) { /* stderr */
+                    lus = ssh_channel_read(channel, buffer, sizeof(buffer), 1);
+                    if (lus == -1) {
+                        fprintf(stderr,
+                                "Error reading channel: %s\n",
+                                ssh_get_error(session));
+                        return;
+                    }
+                    if (lus == 0) {
+                        ssh_channel_free(channel);
+                        channel = channels[0] = NULL;
+                    } else {
+                        ret = write(2, buffer, lus);
+                        if (ret < 0) {
+                            fprintf(stderr,
+                                    "Error writing to stderr: %s",
+                                    strerror(errno));
+                            return;
+                        }
+                    }
+                }
+            }
+            if (channel && ssh_channel_is_closed(channel)) {
+                ssh_channel_free(channel);
+                channel = NULL;
+            }
+        } while (ret == EINTR || ret == SSH_EINTR);
+    }
 }
 
-static void forwarding(ssh_session session){
+static void forwarding(ssh_session session)
+{
     ssh_channel channel;
     int r;
     channel = ssh_channel_new(session);
     r = ssh_channel_open_forward(channel, desthost, atoi(port), "localhost", 22);
-    if(r<0) {
+    if (r < 0) {
-        printf("error forwarding port : %s\n",ssh_get_error(session));
+        printf("error forwarding port : %s\n", ssh_get_error(session));
         return;
     }
-    select_loop(session,channel);
+    select_loop(session, channel);
 }
 
-static int client(ssh_session session){
+static int client(ssh_session session)
-  int auth=0;
+{
-  char *banner;
+    int auth = 0;
-  int state;
+    char *banner = NULL;
+    int state;
 
-  if (ssh_options_set(session, SSH_OPTIONS_HOST ,host) < 0)
+    if (ssh_options_set(session, SSH_OPTIONS_HOST, host) < 0)
-    return -1;
+        return -1;
-  ssh_options_parse_config(session, NULL);
+    ssh_options_parse_config(session, NULL);
 
-  if(ssh_connect(session)){
+    if (ssh_connect(session)) {
-      fprintf(stderr,"Connection failed : %s\n",ssh_get_error(session));
+        fprintf(stderr, "Connection failed : %s\n", ssh_get_error(session));
-      return -1;
+        return -1;
-  }
+    }
-  state=verify_knownhost(session);
+    state = verify_knownhost(session);
-  if (state != 0)
+    if (state != 0)
-  	return -1;
+        return -1;
-  ssh_userauth_none(session, NULL);
+    ssh_userauth_none(session, NULL);
-  banner=ssh_get_issue_banner(session);
+    banner = ssh_get_issue_banner(session);
-  if(banner){
+    if (banner) {
-      printf("%s\n",banner);
+        printf("%s\n", banner);
-      free(banner);
+        free(banner);
-  }
+    }
-  auth=authenticate_console(session);
+    auth = authenticate_console(session);
-  if(auth != SSH_AUTH_SUCCESS){
+    if (auth != SSH_AUTH_SUCCESS) {
-  	return -1;
+        return -1;
-  }
+    }
- 	forwarding(session);
+    forwarding(session);
-  return 0;
+    return 0;
 }
 
 #ifdef WITH_PCAP
 ssh_pcap_file pcap;
 void set_pcap(ssh_session session);
-void set_pcap(ssh_session session){
+void set_pcap(ssh_session session)
-	if(!pcap_file)
+{
-		return;
+    if (!pcap_file)
-	pcap=ssh_pcap_file_new();
+        return;
-	if(ssh_pcap_file_open(pcap,pcap_file) == SSH_ERROR){
+    pcap = ssh_pcap_file_new();
-		printf("Error opening pcap file\n");
+    if (ssh_pcap_file_open(pcap, pcap_file) == SSH_ERROR) {
-		ssh_pcap_file_free(pcap);
+        printf("Error opening pcap file\n");
-		pcap=NULL;
+        ssh_pcap_file_free(pcap);
-		return;
+        pcap = NULL;
-	}
+        return;
-	ssh_set_pcap_file(session,pcap);
+    }
+    ssh_set_pcap_file(session, pcap);
 }
 
 void cleanup_pcap(void);
 void cleanup_pcap(void)
 {
-	ssh_pcap_file_free(pcap);
+    ssh_pcap_file_free(pcap);
-	pcap = NULL;
+    pcap = NULL;
 }
 #endif
 
-int main(int argc, char **argv){
+int main(int argc, char **argv)
-    ssh_session session;
+{
+    ssh_session session = NULL;
 
     session = ssh_new();
 
-    if(ssh_options_getopt(session, &argc, argv)) {
+    if (ssh_options_getopt(session, &argc, argv)) {
-      fprintf(stderr, "error parsing command line :%s\n",
+        fprintf(stderr,
-          ssh_get_error(session));
+                "error parsing command line :%s\n",
-      usage();
+                ssh_get_error(session));
+        usage();
     }
-    opts(argc,argv);
+    opts(argc, argv);
 #ifdef WITH_PCAP
     set_pcap(session);
 #endif

include/libssh/CMakeLists.txt

@@ -29,6 +29,13 @@ if (WITH_SERVER)
   endif (WITH_SFTP)
 endif (WITH_SERVER)
 
+if (WITH_FIDO2)
+    set(libssh_HDRS
+        ${libssh_HDRS}
+        sk_api.h
+    )
+endif (WITH_FIDO2)
+
 install(
   FILES
     ${libssh_HDRS}

include/libssh/auth.h

@@ -52,42 +52,45 @@ typedef struct ssh_kbdint_struct* ssh_kbdint;
 ssh_kbdint ssh_kbdint_new(void);
 void ssh_kbdint_clean(ssh_kbdint kbd);
 void ssh_kbdint_free(ssh_kbdint kbd);
+int ssh_userauth_gssapi_keyex(ssh_session session);
 
 /** @internal
  * States of authentication in the client-side. They describe
  * what was the last response from the server
  */
 enum ssh_auth_state_e {
-  /** No authentication asked */
+    /** No authentication asked */
-  SSH_AUTH_STATE_NONE=0,
+    SSH_AUTH_STATE_NONE = 0,
-  /** Last authentication response was a partial success */
+    /** Last authentication response was a partial success */
-  SSH_AUTH_STATE_PARTIAL,
+    SSH_AUTH_STATE_PARTIAL,
-  /** Last authentication response was a success */
+    /** Last authentication response was a success */
-  SSH_AUTH_STATE_SUCCESS,
+    SSH_AUTH_STATE_SUCCESS,
-  /** Last authentication response was failed */
+    /** Last authentication response was failed */
-  SSH_AUTH_STATE_FAILED,
+    SSH_AUTH_STATE_FAILED,
-  /** Last authentication was erroneous */
+    /** Last authentication was erroneous */
-  SSH_AUTH_STATE_ERROR,
+    SSH_AUTH_STATE_ERROR,
-  /** Last state was a keyboard-interactive ask for info */
+    /** Last state was a keyboard-interactive ask for info */
-  SSH_AUTH_STATE_INFO,
+    SSH_AUTH_STATE_INFO,
-  /** Last state was a public key accepted for authentication */
+    /** Last state was a public key accepted for authentication */
-  SSH_AUTH_STATE_PK_OK,
+    SSH_AUTH_STATE_PK_OK,
-  /** We asked for a keyboard-interactive authentication */
+    /** We asked for a keyboard-interactive authentication */
-  SSH_AUTH_STATE_KBDINT_SENT,
+    SSH_AUTH_STATE_KBDINT_SENT,
-  /** We have sent an userauth request with gssapi-with-mic */
+    /** We have sent an userauth request with gssapi-with-mic */
-  SSH_AUTH_STATE_GSSAPI_REQUEST_SENT,
+    SSH_AUTH_STATE_GSSAPI_REQUEST_SENT,
-  /** We are exchanging tokens until authentication */
+    /** We are exchanging tokens until authentication */
-  SSH_AUTH_STATE_GSSAPI_TOKEN,
+    SSH_AUTH_STATE_GSSAPI_TOKEN,
-  /** We have sent the MIC and expecting to be authenticated */
+    /** We have sent the MIC and expecting to be authenticated */
-  SSH_AUTH_STATE_GSSAPI_MIC_SENT,
+    SSH_AUTH_STATE_GSSAPI_MIC_SENT,
-  /** We have offered a pubkey to check if it is supported */
+    /** We have offered a pubkey to check if it is supported */
-  SSH_AUTH_STATE_PUBKEY_OFFER_SENT,
+    SSH_AUTH_STATE_PUBKEY_OFFER_SENT,
-  /** We have sent pubkey and signature expecting to be authenticated */
+    /** We have sent pubkey and signature expecting to be authenticated */
-  SSH_AUTH_STATE_PUBKEY_AUTH_SENT,
+    SSH_AUTH_STATE_PUBKEY_AUTH_SENT,
-  /** We have sent a password expecting to be authenticated */
+    /** We have sent a password expecting to be authenticated */
-  SSH_AUTH_STATE_PASSWORD_AUTH_SENT,
+    SSH_AUTH_STATE_PASSWORD_AUTH_SENT,
-  /** We have sent a request without auth information (method 'none') */
+    /** We have sent a request without auth information (method 'none') */
-  SSH_AUTH_STATE_AUTH_NONE_SENT,
+    SSH_AUTH_STATE_AUTH_NONE_SENT,
+    /** We have sent the MIC and expecting to be authenticated */
+    SSH_AUTH_STATE_GSSAPI_KEYEX_MIC_SENT,
 };
 
 /** @internal

include/libssh/bignum.h

@@ -31,6 +31,7 @@ extern "C" {
 
 bignum ssh_make_string_bn(ssh_string string);
 ssh_string ssh_make_bignum_string(bignum num);
+ssh_string ssh_make_padded_bignum_string(bignum num, size_t pad_len);
 void ssh_print_bignum(const char *which, const_bignum num);
 
 #ifdef __cplusplus

include/libssh/bind.h

@@ -54,6 +54,8 @@ struct ssh_bind_struct {
   char *pubkey_accepted_key_types;
   char* moduli_file;
   int rsa_min_size;
+  bool gssapi_key_exchange;
+  char *gssapi_key_exchange_algs;
 };
 
 struct ssh_poll_handle_struct *ssh_bind_get_poll(struct ssh_bind_struct

include/libssh/bind_config.h

@@ -52,6 +52,7 @@ enum ssh_bind_config_opcode_e {
     BIND_CFG_MATCH,
     BIND_CFG_PUBKEY_ACCEPTED_KEY_TYPES,
     BIND_CFG_HOSTKEY_ALGORITHMS,
+    BIND_CFG_REQUIRED_RSA_SIZE,
 
     BIND_CFG_MAX /* Keep this one last in the list */
 };

include/libssh/buffer.h

@@ -74,6 +74,8 @@ ssh_string ssh_buffer_get_ssh_string(ssh_buffer buffer);
 uint32_t ssh_buffer_pass_bytes_end(ssh_buffer buffer, uint32_t len);
 uint32_t ssh_buffer_pass_bytes(ssh_buffer buffer, uint32_t len);
 
+ssh_buffer ssh_buffer_dup(const ssh_buffer buffer);
+
 #ifdef __cplusplus
 }
 #endif

include/libssh/callbacks.h

@@ -113,6 +113,17 @@ typedef void (*ssh_status_callback) (ssh_session session, float status,
 typedef void (*ssh_global_request_callback) (ssh_session session,
                                         ssh_message message, void *userdata);
 
+/**
+ * @brief SSH connect status callback. These are functions that report the
+ * status of the connection i,e. a function indicating the completed percentage
+ * of the connection
+ * steps.
+ * @param userdata Userdata to be passed to the callback function.
+ * @param status Percentage of connection status, going from 0.0 to 1.0
+ * once connection is done.
+ */
+typedef void (*ssh_connect_status_callback)(void *userdata, float status);
+
 /**
  * @brief Handles an SSH new channel open X11 request. This happens when the server
  * sends back an X11 connection attempt. This is a client-side API
@@ -181,7 +192,7 @@ struct ssh_callbacks_struct {
    * This function gets called during connection time to indicate the
    * percentage of connection steps completed.
    */
-  void (*connect_status_function)(void *userdata, float status);
+  ssh_connect_status_callback connect_status_function;
   /**
    * This function will be called each time a global request is received.
    */
@@ -209,36 +220,41 @@ typedef struct ssh_callbacks_struct *ssh_callbacks;
  * @param user User that wants to authenticate
  * @param password Password used for authentication
  * @param userdata Userdata to be passed to the callback function.
- * @returns SSH_AUTH_SUCCESS Authentication is accepted.
+ * @returns `SSH_AUTH_SUCCESS` Authentication is accepted.
- * @returns SSH_AUTH_PARTIAL Partial authentication, more authentication means are needed.
+ * @returns `SSH_AUTH_PARTIAL` Partial authentication, more authentication means
- * @returns SSH_AUTH_DENIED Authentication failed.
+ * are needed.
+ * @returns `SSH_AUTH_DENIED` Authentication failed.
  */
 typedef int (*ssh_auth_password_callback) (ssh_session session, const char *user, const char *password,
 		void *userdata);
 
 /**
- * @brief SSH authentication callback. Tries to authenticates user with the "none" method
+ * @brief SSH authentication callback. Tries to authenticates user with the
- * which is anonymous or passwordless.
+ * "none" method which is anonymous or passwordless.
  * @param session Current session handler
  * @param user User that wants to authenticate
  * @param userdata Userdata to be passed to the callback function.
- * @returns SSH_AUTH_SUCCESS Authentication is accepted.
+ * @returns `SSH_AUTH_SUCCESS` Authentication is accepted.
- * @returns SSH_AUTH_PARTIAL Partial authentication, more authentication means are needed.
+ * @returns `SSH_AUTH_PARTIAL` Partial authentication, more authentication means
- * @returns SSH_AUTH_DENIED Authentication failed.
+ * are needed.
+ * @returns `SSH_AUTH_DENIED` Authentication failed.
  */
 typedef int (*ssh_auth_none_callback) (ssh_session session, const char *user, void *userdata);
 
 /**
- * @brief SSH authentication callback. Tries to authenticates user with the "gssapi-with-mic" method
+ * @brief SSH authentication callback. Tries to authenticates user with the
+ * "gssapi-with-mic" method
  * @param session Current session handler
  * @param user Username of the user (can be spoofed)
  * @param principal Authenticated principal of the user, including realm.
  * @param userdata Userdata to be passed to the callback function.
- * @returns SSH_AUTH_SUCCESS Authentication is accepted.
+ * @returns `SSH_AUTH_SUCCESS` Authentication is accepted.
- * @returns SSH_AUTH_PARTIAL Partial authentication, more authentication means are needed.
+ * @returns `SSH_AUTH_PARTIAL` Partial authentication, more authentication means
- * @returns SSH_AUTH_DENIED Authentication failed.
+ * are needed.
- * @warning Implementations should verify that parameter user matches in some way the principal.
+ * @returns `SSH_AUTH_DENIED` Authentication failed.
- * user and principal can be different. Only the latter is guaranteed to be safe.
+ * @warning Implementations should verify that parameter user matches in some
+ * way the principal. user and principal can be different. Only the latter is
+ * guaranteed to be safe.
  */
 typedef int (*ssh_auth_gssapi_mic_callback) (ssh_session session, const char *user, const char *principal,
 		void *userdata);
@@ -248,17 +264,29 @@ typedef int (*ssh_auth_gssapi_mic_callback) (ssh_session session, const char *us
  * @param session Current session handler
  * @param user User that wants to authenticate
  * @param pubkey public key used for authentication
- * @param signature_state SSH_PUBLICKEY_STATE_NONE if the key is not signed (simple public key probe),
+ * @param signature_state `SSH_PUBLICKEY_STATE_NONE` if the key is not signed
- *							SSH_PUBLICKEY_STATE_VALID if the signature is valid. Others values should be
+ * (simple public key probe), `SSH_PUBLICKEY_STATE_VALID` if the signature is
- *							replied with a SSH_AUTH_DENIED.
+ * valid. Others values should be replied with a `SSH_AUTH_DENIED`.
  * @param userdata Userdata to be passed to the callback function.
- * @returns SSH_AUTH_SUCCESS Authentication is accepted.
+ * @returns `SSH_AUTH_SUCCESS` Authentication is accepted.
- * @returns SSH_AUTH_PARTIAL Partial authentication, more authentication means are needed.
+ * @returns `SSH_AUTH_PARTIAL` Partial authentication, more authentication means
- * @returns SSH_AUTH_DENIED Authentication failed.
+ * are needed.
+ * @returns `SSH_AUTH_DENIED` Authentication failed.
  */
 typedef int (*ssh_auth_pubkey_callback) (ssh_session session, const char *user, struct ssh_key_struct *pubkey,
 		char signature_state, void *userdata);
 
+/**
+ * @brief SSH authentication callback. Tries to authenticates user with the "keyboard-interactive" method
+ * @param message Current message
+ * @param session Current session handler
+ * @param userdata Userdata to be passed to the callback function.
+ * @returns SSH_AUTH_SUCCESS Authentication is accepted.
+ * @returns SSH_AUTH_INFO More info required for authentication.
+ * @returns SSH_AUTH_PARTIAL Partial authentication, more authentication means are needed.
+ * @returns SSH_AUTH_DENIED Authentication failed.
+*/
+typedef int (*ssh_auth_kbdint_callback) (ssh_message message, ssh_session session, void *userdata);
 
 /**
  * @brief Handles an SSH service request
@@ -268,7 +296,6 @@ typedef int (*ssh_auth_pubkey_callback) (ssh_session session, const char *user,
  * @returns 0 if the request is to be allowed
  * @returns -1 if the request should not be allowed
  */
-
 typedef int (*ssh_service_request_callback) (ssh_session session, const char *service, void *userdata);
 
 /**
@@ -281,7 +308,7 @@ typedef int (*ssh_service_request_callback) (ssh_session session, const char *se
  */
 typedef ssh_channel (*ssh_channel_open_request_session_callback) (ssh_session session, void *userdata);
 
-/*
+/**
  * @brief handle the beginning of a GSSAPI authentication, server side.
  *        Callback should select the oid and also acquire the server credential.
  * @param session current session handler
@@ -296,35 +323,57 @@ typedef ssh_channel (*ssh_channel_open_request_session_callback) (ssh_session se
 typedef ssh_string (*ssh_gssapi_select_oid_callback) (ssh_session session, const char *user,
 		int n_oid, ssh_string *oids, void *userdata);
 
-/*
+/**
  * @brief handle the negotiation of a security context, server side.
  * @param session current session handler
  * @param[in] input_token input token provided by client
  * @param[out] output_token output of the gssapi accept_sec_context method,
  *				NULL after completion.
- * @returns SSH_OK if the token was generated correctly or accept_sec_context
+ * @returns `SSH_OK` if the token was generated correctly or accept_sec_context
  * returned GSS_S_COMPLETE
- * @returns SSH_ERROR in case of error
+ * @returns `SSH_ERROR` in case of error
  * @warning It is not necessary to fill this callback in if libssh is linked
  * with libgssapi.
  */
 typedef int (*ssh_gssapi_accept_sec_ctx_callback) (ssh_session session,
 		ssh_string input_token, ssh_string *output_token, void *userdata);
 
-/*
+/**
  * @brief Verify and authenticates a MIC, server side.
  * @param session current session handler
  * @param[in] mic input mic to be verified provided by client
  * @param[in] mic_buffer buffer of data to be signed.
  * @param[in] mic_buffer_size size of mic_buffer
- * @returns SSH_OK if the MIC was authenticated correctly
+ * @returns `SSH_OK` if the MIC was authenticated correctly
- * @returns SSH_ERROR in case of error
+ * @returns `SSH_ERROR` in case of error
  * @warning It is not necessary to fill this callback in if libssh is linked
  * with libgssapi.
  */
 typedef int (*ssh_gssapi_verify_mic_callback) (ssh_session session,
 		ssh_string mic, void *mic_buffer, size_t mic_buffer_size, void *userdata);
 
+/**
+ * @brief Handles an SSH new channel open "direct-tcpip" request. This
+ * happens when the client forwards an incoming TCP connection on a port it
+ * wants to forward to the destination. This is a server-side API
+ * @param session current session handler
+ * @param destination_address the address that the TCP connection connected to
+ * @param destination_port the port that the TCP connection connected to
+ * @param originator_address the originator IP address
+ * @param originator_port the originator port
+ * @param userdata Userdata to be passed to the callback function.
+ * @returns a valid ssh_channel handle if the request is to be allowed
+ * @returns NULL if the request should not be allowed
+ * @warning The channel pointer returned by this callback must be closed by the
+ * application.
+ */
+typedef ssh_channel (*ssh_channel_open_request_direct_tcpip_callback)(
+    ssh_session session,
+    const char *destination_address,
+    int destination_port,
+    const char *originator_address,
+    int originator_port,
+    void *userdata);
 
 /**
  * This structure can be used to implement a libssh server, with appropriate callbacks.
@@ -372,9 +421,21 @@ struct ssh_server_callbacks_struct {
   /** This function will be called when a gssapi token comes in.
    */
   ssh_gssapi_accept_sec_ctx_callback gssapi_accept_sec_ctx_function;
-  /* This function will be called when a MIC needs to be verified.
+  /** This function will be called when a MIC needs to be verified.
    */
   ssh_gssapi_verify_mic_callback gssapi_verify_mic_function;
+  /**
+   * This function will be called when an incoming "direct-tcpip"
+   * request is received.
+   */
+  ssh_channel_open_request_direct_tcpip_callback
+      channel_open_request_direct_tcpip_function;
+
+  /** This function gets called when a client tries to authenticate through
+   * keyboard interactive method.
+  */
+  ssh_auth_kbdint_callback auth_kbdint_function;
+
 };
 typedef struct ssh_server_callbacks_struct *ssh_server_callbacks;
 
@@ -400,7 +461,7 @@ typedef struct ssh_server_callbacks_struct *ssh_server_callbacks;
  *
  * @param  cb           The callback structure itself.
  *
- * @return SSH_OK on success, SSH_ERROR on error.
+ * @return `SSH_OK` on success, `SSH_ERROR` on error.
  */
 LIBSSH_API int ssh_set_server_callbacks(ssh_session session, ssh_server_callbacks cb);
 
@@ -531,14 +592,17 @@ typedef struct ssh_socket_callbacks_struct *ssh_socket_callbacks;
         }                           \
     } while(0)
 
-/** @brief Prototype for a packet callback, to be called when a new packet arrives
+/** @brief Prototype for a packet callback, to be called when a new packet
+ * arrives
  * @param session The current session of the packet
  * @param type packet type (see ssh2.h)
- * @param packet buffer containing the packet, excluding size, type and padding fields
+ * @param packet buffer containing the packet, excluding size, type and padding
+ * fields
  * @param user user argument to the callback
  * and are called each time a packet shows up
- * @returns SSH_PACKET_USED Packet was parsed and used
+ * @returns `SSH_PACKET_USED` Packet was parsed and used
- * @returns SSH_PACKET_NOT_USED Packet was not used or understood, processing must continue
+ * @returns `SSH_PACKET_NOT_USED` Packet was not used or understood, processing
+ * must continue
  */
 typedef int (*ssh_packet_callback) (ssh_session session, uint8_t type, ssh_buffer packet, void *user);
 
@@ -597,7 +661,7 @@ typedef struct ssh_packet_callbacks_struct *ssh_packet_callbacks;
  *
  * @param  cb           The callback structure itself.
  *
- * @return SSH_OK on success, SSH_ERROR on error.
+ * @return `SSH_OK` on success, `SSH_ERROR` on error.
  */
 LIBSSH_API int ssh_set_callbacks(ssh_session session, ssh_callbacks cb);
 
@@ -949,7 +1013,7 @@ typedef struct ssh_channel_callbacks_struct *ssh_channel_callbacks;
  *
  * @param  cb           The callback structure itself.
  *
- * @return SSH_OK on success, SSH_ERROR on error.
+ * @return `SSH_OK` on success, `SSH_ERROR` on error.
  * @warning this function will not replace existing callbacks but set the
  *          new one atop of them.
  */
@@ -968,7 +1032,7 @@ LIBSSH_API int ssh_set_channel_callbacks(ssh_channel channel,
  *
  * @param  cb           The callback structure itself.
  *
- * @return SSH_OK on success, SSH_ERROR on error.
+ * @return `SSH_OK` on success, `SSH_ERROR` on error.
  *
  * @see ssh_set_channel_callbacks
  */
@@ -985,7 +1049,7 @@ LIBSSH_API int ssh_add_channel_callbacks(ssh_channel channel,
  *
  * @param cb       The callback structure to remove
  *
- * @returns SSH_OK on success, SSH_ERROR on error.
+ * @returns `SSH_OK` on success, `SSH_ERROR` on error.
  */
 LIBSSH_API int ssh_remove_channel_callbacks(ssh_channel channel,
                                             ssh_channel_callbacks cb);
@@ -1018,7 +1082,7 @@ struct ssh_threads_callbacks_struct {
  * @param[in] cb   A pointer to a ssh_threads_callbacks_struct structure, which
  *                 contains the different callbacks to be set.
  *
- * @returns        Always returns SSH_OK.
+ * @returns        Always returns `SSH_OK`.
  *
  * @see ssh_threads_callbacks_struct
  * @see SSH_THREADS_PTHREAD
@@ -1115,6 +1179,177 @@ struct ssh_jump_callbacks_struct {
     ssh_jump_authenticate_callback authenticate;
 };
 
+/* Security key callbacks */
+
+/*
+ * Forward declarations for structs that have been defined in sk_api.h.
+ * If you need to work with the fields inside them, please include
+ * libssh/sk_api.h
+ */
+struct sk_enroll_response;
+struct sk_sign_response;
+struct sk_resident_key;
+struct sk_option;
+
+#define LIBSSH_SK_API_VERSION_MAJOR 0x000a0000
+
+/**
+ * @brief FIDO2/U2F SK API version callback.
+ *
+ * Returns the version of the FIDO2/U2F API that the callbacks implement.
+ * This callback allows custom callback implementations to specify their
+ * SK API version for compatibility checking with libssh's security key
+ * interface.
+ *
+ * @details Version compatibility is determined by comparing the major version
+ * portion (upper 16 bits) of the returned value with SSH_SK_VERSION_MAJOR.
+ *
+ * For compatibility, implementations should return a version where:
+ * (returned_version & SSH_SK_VERSION_MAJOR_MASK) == SSH_SK_VERSION_MAJOR
+ *
+ * This ensures that the callbacks' SK API matches the major version expected
+ * by libssh, while allowing minor version differences for backward
+ * compatibility.
+ *
+ * @see LIBSSH_SK_API_VERSION_MAJOR Current expected major API version
+ * @see SSH_SK_VERSION_MAJOR_MASK Mask for extracting major version (0xffff0000)
+ */
+typedef uint32_t (*sk_api_version_callback)(void);
+
+/**
+ * @brief FIDO2/U2F key enrollment callback.
+ *
+ * Enrolls a new FIDO2/U2F security key credential (private key generation).
+ * This callback handles the creation of new FIDO2/U2F credentials, including
+ * both resident and non-resident keys.
+ *
+ * @param[in] alg The cryptographic algorithm to use
+ * @param[in] challenge Random challenge data for enrollment
+ * @param[in] challenge_len Length of the challenge data
+ * @param[in] application Application identifier (relying party ID)
+ * @param[in] flags Enrollment flags
+ * @param[in] pin PIN for user verification (may be NULL)
+ * @param[in] options Array of enrollment options (device path, user ID, etc.)
+ * @param[out] enroll_response Enrollment response containing public key,
+ *                             key handle, signature, and attestation data
+ *
+ * @returns SSH_OK on success, SSH_SK_ERR_* codes on failure.
+ */
+typedef int (*sk_enroll_callback)(uint32_t alg,
+                                  const uint8_t *challenge,
+                                  size_t challenge_len,
+                                  const char *application,
+                                  uint8_t flags,
+                                  const char *pin,
+                                  struct sk_option **options,
+                                  struct sk_enroll_response **enroll_response);
+
+/**
+ * @brief FIDO2/U2F security key signing callback.
+ *
+ * Signs data using a FIDO2 security key credential. This callback performs
+ * cryptographic signing operations using previously enrolled FIDO2/U2F
+ * credentials.
+ *
+ * @param[in] alg The cryptographic algorithm used by the key
+ * @param[in] data Data to be signed
+ * @param[in] data_len Length of the data to sign
+ * @param[in] application Application identifier (relying party ID)
+ * @param[in] key_handle Key handle identifying the credential
+ * @param[in] key_handle_len Length of the key handle
+ * @param[in] flags Signing flags
+ * @param[in] pin PIN for user verification (may be NULL)
+ * @param[in] options Array of signing options (device path, etc.)
+ * @param[out] sign_response Signature response containing signature data,
+ *                           flags, and counter information
+ *
+ * @returns SSH_OK on success, SSH_SK_ERR_* codes on failure.
+ */
+typedef int (*sk_sign_callback)(uint32_t alg,
+                                const uint8_t *data,
+                                size_t data_len,
+                                const char *application,
+                                const uint8_t *key_handle,
+                                size_t key_handle_len,
+                                uint8_t flags,
+                                const char *pin,
+                                struct sk_option **options,
+                                struct sk_sign_response **sign_response);
+
+/**
+ * @brief FIDO2 security key resident keys loading callback.
+ *
+ * Enumerates and loads all resident keys (discoverable credentials) stored
+ * on FIDO2 devices. Resident keys are credentials stored directly on
+ * the device itself and can be discovered without prior knowledge
+ * of key handles.
+ *
+ * @param[in] pin PIN for accessing resident keys (required for most operations)
+ * @param[in] options Array of options (device path, etc.)
+ * @param[out] resident_keys Array of resident key structures containing key
+ * data, application IDs, user information, and metadata
+ * @param[out] num_keys_found Number of resident keys found and loaded
+ *
+ * @returns SSH_OK on success, SSH_SK_ERR_* codes on failure.
+ */
+typedef int (*sk_load_resident_keys_callback)(
+    const char *pin,
+    struct sk_option **options,
+    struct sk_resident_key ***resident_keys,
+    size_t *num_keys_found);
+
+/**
+ * @brief FIDO2/U2F security key callbacks structure.
+ *
+ * This structure contains callbacks for FIDO2/U2F operations.
+ * It allows applications to provide custom implementations of FIDO2/U2F
+ * operations to override the default libfido2-based implementation.
+ *
+ * @warning These callbacks will only be called if libssh was built with
+ * FIDO2/U2F support enabled. (WITH_FIDO2 = ON).
+ */
+struct ssh_sk_callbacks_struct {
+    /** DON'T SET THIS use ssh_callbacks_init() instead. */
+    size_t size;
+
+    /**
+     * This callback returns the SK API version used by the callback
+     * implementation.
+     *
+     * @see sk_api_version_callback for detailed documentation
+     */
+    sk_api_version_callback api_version;
+
+    /**
+     * This callback enrolls a new FIDO2/U2F credential, generating
+     * a new key pair and optionally storing it on the device itself
+     * (resident keys).
+     *
+     * @see sk_enroll_callback for detailed documentation
+     */
+    sk_enroll_callback enroll;
+
+    /**
+     * This callback performs cryptographic signing operations using a
+     * previously enrolled FIDO2/U2F credential.
+     *
+     * @see sk_sign_callback for detailed documentation
+     */
+    sk_sign_callback sign;
+
+    /**
+     * This callback enumerates and loads all resident keys (discoverable
+     * credentials) stored on the FIDO2 device.
+     *
+     * @see sk_load_resident_keys_callback for detailed documentation
+     */
+    sk_load_resident_keys_callback load_resident_keys;
+};
+
+typedef struct ssh_sk_callbacks_struct *ssh_sk_callbacks;
+
+const struct ssh_sk_callbacks_struct *ssh_sk_get_default_callbacks(void);
+
 #ifdef __cplusplus
 }
 #endif

include/libssh/config.h

@@ -24,6 +24,7 @@
 #ifndef LIBSSH_CONFIG_H_
 #define LIBSSH_CONFIG_H_
 
+#include "libssh/libssh.h"
 
 enum ssh_config_opcode_e {
     /* Unknown opcode */
@@ -66,7 +67,14 @@ enum ssh_config_opcode_e {
     SOC_CONTROLMASTER,
     SOC_CONTROLPATH,
     SOC_CERTIFICATE,
+    SOC_REQUIRED_RSA_SIZE,
+    SOC_ADDRESSFAMILY,
+    SOC_GSSAPIKEYEXCHANGE,
+    SOC_GSSAPIKEXALGORITHMS,
 
     SOC_MAX /* Keep this one last in the list */
 };
+enum ssh_config_opcode_e ssh_config_get_opcode(char *keyword);
+int ssh_config_parse_line_cli(ssh_session session, const char *line);
+
 #endif /* LIBSSH_CONFIG_H_ */

include/libssh/crypto.h

@@ -45,10 +45,11 @@
 #ifdef HAVE_OPENSSL_ECDH_H
 #include <openssl/ecdh.h>
 #endif
+#include "libssh/curve25519.h"
 #include "libssh/dh.h"
 #include "libssh/ecdh.h"
 #include "libssh/kex.h"
-#include "libssh/curve25519.h"
+#include "libssh/sntrup761.h"
 
 #define DIGEST_MAX_LEN 64
 
@@ -56,32 +57,52 @@
 #define AES_GCM_IVLEN  12
 
 enum ssh_key_exchange_e {
-  /* diffie-hellman-group1-sha1 */
+    /* diffie-hellman-group1-sha1 */
-  SSH_KEX_DH_GROUP1_SHA1=1,
+    SSH_KEX_DH_GROUP1_SHA1 = 1,
-  /* diffie-hellman-group14-sha1 */
+    /* diffie-hellman-group14-sha1 */
-  SSH_KEX_DH_GROUP14_SHA1,
+    SSH_KEX_DH_GROUP14_SHA1,
 #ifdef WITH_GEX
-  /* diffie-hellman-group-exchange-sha1 */
+    /* diffie-hellman-group-exchange-sha1 */
-  SSH_KEX_DH_GEX_SHA1,
+    SSH_KEX_DH_GEX_SHA1,
-  /* diffie-hellman-group-exchange-sha256 */
+    /* diffie-hellman-group-exchange-sha256 */
-  SSH_KEX_DH_GEX_SHA256,
+    SSH_KEX_DH_GEX_SHA256,
 #endif /* WITH_GEX */
-  /* ecdh-sha2-nistp256 */
+    /* ecdh-sha2-nistp256 */
-  SSH_KEX_ECDH_SHA2_NISTP256,
+    SSH_KEX_ECDH_SHA2_NISTP256,
-  /* ecdh-sha2-nistp384 */
+    /* ecdh-sha2-nistp384 */
-  SSH_KEX_ECDH_SHA2_NISTP384,
+    SSH_KEX_ECDH_SHA2_NISTP384,
-  /* ecdh-sha2-nistp521 */
+    /* ecdh-sha2-nistp521 */
-  SSH_KEX_ECDH_SHA2_NISTP521,
+    SSH_KEX_ECDH_SHA2_NISTP521,
-  /* curve25519-sha256@libssh.org */
+    /* curve25519-sha256@libssh.org */
-  SSH_KEX_CURVE25519_SHA256_LIBSSH_ORG,
+    SSH_KEX_CURVE25519_SHA256_LIBSSH_ORG,
-  /* curve25519-sha256 */
+    /* curve25519-sha256 */
-  SSH_KEX_CURVE25519_SHA256,
+    SSH_KEX_CURVE25519_SHA256,
-  /* diffie-hellman-group16-sha512 */
+    /* diffie-hellman-group16-sha512 */
-  SSH_KEX_DH_GROUP16_SHA512,
+    SSH_KEX_DH_GROUP16_SHA512,
-  /* diffie-hellman-group18-sha512 */
+    /* diffie-hellman-group18-sha512 */
-  SSH_KEX_DH_GROUP18_SHA512,
+    SSH_KEX_DH_GROUP18_SHA512,
-  /* diffie-hellman-group14-sha256 */
+    /* diffie-hellman-group14-sha256 */
-  SSH_KEX_DH_GROUP14_SHA256,
+    SSH_KEX_DH_GROUP14_SHA256,
+    /* sntrup761x25519-sha512@openssh.com */
+    SSH_KEX_SNTRUP761X25519_SHA512_OPENSSH_COM,
+    /* sntrup761x25519-sha512 */
+    SSH_KEX_SNTRUP761X25519_SHA512,
+    /* mlkem768x25519-sha256 */
+    SSH_KEX_MLKEM768X25519_SHA256,
+    /* mlkem768nistp256-sha256 */
+    SSH_KEX_MLKEM768NISTP256_SHA256,
+#ifdef HAVE_MLKEM1024
+    /* mlkem1024nistp384-sha384 */
+    SSH_KEX_MLKEM1024NISTP384_SHA384,
+#endif /* HAVE_MLKEM1024 */
+    /* gss-group14-sha256-* */
+    SSH_GSS_KEX_DH_GROUP14_SHA256,
+    /* gss-group16-sha512-* */
+    SSH_GSS_KEX_DH_GROUP16_SHA512,
+    /* gss-nistp256-sha256-* */
+    SSH_GSS_KEX_ECDH_NISTP256_SHA256,
+    /* gss-curve25519-sha256-* */
+    SSH_GSS_KEX_CURVE25519_SHA256,
 };
 
 enum ssh_cipher_e {
@@ -105,6 +126,9 @@ struct dh_ctx;
 
 struct ssh_crypto_struct {
     bignum shared_secret;
+    ssh_string hybrid_client_init;
+    ssh_string hybrid_server_reply;
+    ssh_string hybrid_shared_secret;
     struct dh_ctx *dh_ctx;
 #ifdef WITH_GEX
     size_t dh_pmin; size_t dh_pn; size_t dh_pmax; /* preferred group parameters */
@@ -125,9 +149,28 @@ struct ssh_crypto_struct {
     ssh_string ecdh_server_pubkey;
 #endif
 #ifdef HAVE_CURVE25519
+#ifdef HAVE_LIBCRYPTO
+    EVP_PKEY *curve25519_privkey;
+#elif defined(HAVE_GCRYPT_CURVE25519)
+    gcry_sexp_t curve25519_privkey;
+#else
     ssh_curve25519_privkey curve25519_privkey;
+#endif
     ssh_curve25519_pubkey curve25519_client_pubkey;
     ssh_curve25519_pubkey curve25519_server_pubkey;
+#endif
+#ifdef HAVE_OPENSSL_MLKEM
+    EVP_PKEY *mlkem_privkey;
+#else
+    unsigned char *mlkem_privkey;
+    size_t mlkem_privkey_len;
+#endif
+    ssh_string mlkem_client_pubkey;
+    ssh_string mlkem_ciphertext;
+#ifdef HAVE_SNTRUP761
+    ssh_sntrup761_privkey sntrup761_privkey;
+    ssh_sntrup761_pubkey sntrup761_client_pubkey;
+    ssh_sntrup761_ciphertext sntrup761_ciphertext;
 #endif
     ssh_string dh_server_signature; /* information used by dh_handshake. */
     size_t session_id_len;
@@ -223,9 +266,8 @@ int sshkdf_derive_key(struct ssh_crypto_struct *crypto,
                       size_t requested_len);
 
 int secure_memcmp(const void *s1, const void *s2, size_t n);
-#if defined(HAVE_LIBCRYPTO) && !defined(WITH_PKCS11_PROVIDER)
+
-ENGINE *pki_get_engine(void);
+void compress_cleanup(struct ssh_crypto_struct *crypto);
-#endif /* HAVE_LIBCRYPTO */
 
 #ifdef __cplusplus
 }

include/libssh/curve25519.h

@@ -50,6 +50,10 @@ int crypto_scalarmult(unsigned char *q, const unsigned char *n, const unsigned c
 typedef unsigned char ssh_curve25519_pubkey[CURVE25519_PUBKEY_SIZE];
 typedef unsigned char ssh_curve25519_privkey[CURVE25519_PRIVKEY_SIZE];
 
+int ssh_curve25519_init(ssh_session session);
+int curve25519_do_create_k(ssh_session session, ssh_curve25519_pubkey k);
+int ssh_curve25519_create_k(ssh_session session, ssh_curve25519_pubkey k);
+int ssh_curve25519_build_k(ssh_session session);
 
 int ssh_client_curve25519_init(ssh_session session);
 void ssh_client_curve25519_remove_callbacks(ssh_session session);

include/libssh/ecdh.h

@@ -48,6 +48,7 @@ extern "C" {
 
 extern struct ssh_packet_callbacks_struct ssh_ecdh_client_callbacks;
 /* Backend-specific functions.  */
+int ssh_ecdh_init(ssh_session session);
 int ssh_client_ecdh_init(ssh_session session);
 void ssh_client_ecdh_remove_callbacks(ssh_session session);
 int ecdh_build_k(ssh_session session);

include/libssh/ed25519.h

@@ -29,12 +29,41 @@
  * @{
  */
 
+/** @internal
+ * @brief ED25519 public key.
+ * Ed25519 public key consist of 32 bytes.
+ */
 #define ED25519_PK_LEN 32
+
+/** @internal
+ * @brief ED25519 secret key.
+ * Ed25519 secret key consist of 64 bytes.
+ */
 #define ED25519_SK_LEN 64
+
+/** @internal
+ * @brief ED25519 signature.
+ * Ed25519 signatures consist of 64 bytes.
+ */
 #define ED25519_SIG_LEN 64
 
+/** @internal
+ * @brief ED25519 public key.
+ * The public key consists of 32 bytes and can be used for signature
+ * verification.
+ */
 typedef uint8_t ed25519_pubkey[ED25519_PK_LEN];
+
+/** @internal
+ * @brief ED25519 private key.
+ * The private key consists of 64 bytes and should be kept secret.
+ */
 typedef uint8_t ed25519_privkey[ED25519_SK_LEN];
+
+/** @internal
+ * @brief ED25519 signature.
+ * Ed25519 signatures consists of 64 bytes.
+ */
 typedef uint8_t ed25519_signature[ED25519_SIG_LEN];
 
 #ifdef __cplusplus
@@ -46,7 +75,7 @@ extern "C" {
  * @param[out] pk generated public key
  * @param[out] sk generated secret key
  * @return     0 on success, -1 on error.
- * */
+ */
 int crypto_sign_ed25519_keypair(ed25519_pubkey pk, ed25519_privkey sk);
 
 /** @internal

include/libssh/gssapi.h

@@ -29,6 +29,11 @@
 /* all OID begin with the tag identifier + length */
 #define SSH_OID_TAG 06
 
+#define GSSAPI_KEY_EXCHANGE_SUPPORTED "gss-group14-sha256-," \
+                                      "gss-group16-sha512-," \
+                                      "gss-nistp256-sha256-," \
+                                      "gss-curve25519-sha256-"
+
 typedef struct ssh_gssapi_struct *ssh_gssapi;
 
 #ifdef __cplusplus
@@ -44,14 +49,12 @@ enum ssh_gssapi_state_e {
 
 struct ssh_gssapi_struct{
     enum ssh_gssapi_state_e state; /* current state */
-    struct gss_OID_desc_struct mech; /* mechanism being elected for auth */
     gss_cred_id_t server_creds; /* credentials of server */
     gss_cred_id_t client_creds; /* creds delegated by the client */
     gss_ctx_id_t ctx; /* the authentication context */
     gss_name_t client_name; /* Identity of the client */
     char *user; /* username of client */
     char *canonic_user; /* canonic form of the client's username */
-    char *service; /* name of the service */
     struct {
         gss_name_t server_name; /* identity of server */
         OM_uint32 flags; /* flags used for init context */
@@ -65,6 +68,7 @@ struct ssh_gssapi_struct{
 int ssh_gssapi_handle_userauth(ssh_session session, const char *user, uint32_t n_oid, ssh_string *oids);
 SSH_PACKET_CALLBACK(ssh_packet_userauth_gssapi_token_server);
 SSH_PACKET_CALLBACK(ssh_packet_userauth_gssapi_mic);
+int ssh_gssapi_server_oids(gss_OID_set *selected);
 #endif /* WITH_SERVER */
 
 SSH_PACKET_CALLBACK(ssh_packet_userauth_gssapi_token);
@@ -76,7 +80,20 @@ int ssh_gssapi_init(ssh_session session);
 void ssh_gssapi_log_error(int verb, const char *msg_a, int maj_stat, int min_stat);
 int ssh_gssapi_auth_mic(ssh_session session);
 void ssh_gssapi_free(ssh_session session);
+int ssh_gssapi_client_identity(ssh_session session, gss_OID_set *valid_oids);
 char *ssh_gssapi_name_to_char(gss_name_t name);
+int ssh_gssapi_import_name(struct ssh_gssapi_struct *gssapi, const char *host);
+OM_uint32 ssh_gssapi_init_ctx(struct ssh_gssapi_struct *gssapi,
+                              gss_buffer_desc *input_token,
+                              gss_buffer_desc *output_token,
+                              OM_uint32 *ret_flags);
+
+char *ssh_gssapi_oid_hash(ssh_string oid);
+char *ssh_gssapi_kex_mechs(ssh_session session);
+int ssh_gssapi_check_client_config(ssh_session session);
+ssh_buffer ssh_gssapi_build_mic(ssh_session session, const char *context);
+int ssh_gssapi_auth_keyex_mic(ssh_session session,
+                              gss_buffer_desc *mic_token_buf);
 
 #ifdef __cplusplus
 }

include/libssh/hybrid_mlkem.h

@@ -0,0 +1,51 @@
+/*
+ * This file is part of the SSH Library
+ *
+ * Copyright (c) 2025 by Red Hat, Inc.
+ *
+ * Author: Sahana Prasad <sahana@redhat.com>
+ * Author: Pavol Žáčik <pzacik@redhat.com>
+ * Author: Claude (Anthropic)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ */
+
+#ifndef HYBRID_MLKEM_H_
+#define HYBRID_MLKEM_H_
+
+#include "libssh/mlkem.h"
+#include "libssh/wrapper.h"
+
+#include "config.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#define NISTP256_SHARED_SECRET_SIZE 32
+#define NISTP384_SHARED_SECRET_SIZE 48
+
+int ssh_client_hybrid_mlkem_init(ssh_session session);
+void ssh_client_hybrid_mlkem_remove_callbacks(ssh_session session);
+
+#ifdef WITH_SERVER
+void ssh_server_hybrid_mlkem_init(ssh_session session);
+#endif /* WITH_SERVER */
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* HYBRID_MLKEM_H_ */

include/libssh/kex-gss.h

@@ -0,0 +1,36 @@
+/*
+ * kex-gss.h - GSSAPI key exchange
+ *
+ * This file is part of the SSH Library
+ *
+ * Copyright (c) 2024 by Gauravsingh Sisodia <xaerru@gmail.com>
+ *
+ * The SSH Library is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation; either version 2.1 of the License, or (at your
+ * option) any later version.
+ *
+ * The SSH Library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Lesser General Public
+ * License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with the SSH Library; see the file COPYING.  If not, write to
+ * the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
+ * MA 02111-1307, USA.
+ */
+#ifndef KEX_GSS_H_
+#define KEX_GSS_H_
+
+#include "config.h"
+#ifdef WITH_GSSAPI
+
+int ssh_client_gss_kex_init(ssh_session session);
+void ssh_server_gss_kex_init(ssh_session session);
+int ssh_server_gss_kex_process_init(ssh_session session, ssh_buffer packet);
+void ssh_client_gss_kex_remove_callbacks(ssh_session session);
+void ssh_client_gss_kex_remove_callback_hostkey(ssh_session session);
+
+#endif /* WITH_GSSAPI */
+#endif /* KEX_GSS_H_ */

include/libssh/kex.h

@@ -31,6 +31,9 @@ struct ssh_kex_struct {
     char *methods[SSH_KEX_METHODS];
 };
 
+/* crypto.h needs ssh_kex_struct so it is included below the struct definition */
+#include "libssh/crypto.h"
+
 #ifdef __cplusplus
 extern "C" {
 #endif
@@ -52,10 +55,10 @@ char *ssh_prefix_default_algos(enum ssh_kex_types_e algo, const char *list);
 char **ssh_space_tokenize(const char *chain);
 int ssh_get_kex1(ssh_session session);
 char *ssh_find_matching(const char *in_d, const char *what_d);
-const char *ssh_kex_get_supported_method(uint32_t algo);
+const char *ssh_kex_get_supported_method(enum ssh_kex_types_e type);
-const char *ssh_kex_get_default_methods(uint32_t algo);
+const char *ssh_kex_get_default_methods(enum ssh_kex_types_e type);
-const char *ssh_kex_get_fips_methods(uint32_t algo);
+const char *ssh_kex_get_fips_methods(enum ssh_kex_types_e type);
-const char *ssh_kex_get_description(uint32_t algo);
+const char *ssh_kex_get_description(enum ssh_kex_types_e type);
 char *ssh_client_select_hostkeys(ssh_session session);
 int ssh_send_rekex(ssh_session session);
 int server_set_kex(ssh_session session);
@@ -64,6 +67,7 @@ int ssh_make_sessionid(ssh_session session);
 int ssh_hashbufin_add_cookie(ssh_session session, unsigned char *cookie);
 int ssh_hashbufout_add_cookie(ssh_session session);
 int ssh_generate_session_keys(ssh_session session);
+bool ssh_kex_is_gss(struct ssh_crypto_struct *crypto);
 
 #ifdef __cplusplus
 }

include/libssh/libcrypto.h

@@ -121,6 +121,15 @@ typedef BN_CTX* bignum_CTX;
 
 ssh_string pki_key_make_ecpoint_string(const EC_GROUP *g, const EC_POINT *p);
 int pki_key_ecgroup_name_to_nid(const char *group);
+
+#if defined(WITH_PKCS11_URI)
+#if defined(WITH_PKCS11_PROVIDER)
+int pki_load_pkcs11_provider(void);
+#else
+ENGINE *pki_get_engine(void);
+#endif
+#endif /* WITH_PKCS11_PROVIDER */
+
 #endif /* HAVE_LIBCRYPTO */
 
 #endif /* LIBCRYPTO_H_ */

include/libssh/libgcrypt.h

@@ -98,9 +98,9 @@ int ssh_gcry_rand_range(bignum rnd, bignum max);
 #define bignum_rand_range(rnd, max) ssh_gcry_rand_range(rnd, max);
 #define bignum_dup(orig, dest) do { \
         if (*(dest) == NULL) { \
-            *(dest) = gcry_mpi_copy(orig); \
+            *(dest) = gcry_mpi_copy((const gcry_mpi_t)orig); \
         } else { \
-            gcry_mpi_set(*(dest), orig); \
+            gcry_mpi_set(*(dest), (const gcry_mpi_t)orig); \
         } \
     } while(0)
 /* Helper functions for data conversions.  */

include/libssh/libssh.h

@@ -1,7 +1,7 @@
 /*
  * This file is part of the SSH Library
  *
- * Copyright (c) 2003-2024 by Aris Adamantiadis and the libssh team
+ * Copyright (c) 2003-2026 by Aris Adamantiadis and the libssh team
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
@@ -49,9 +49,10 @@
   #endif
 #endif
 
-#include <stdarg.h>
-#include <stdint.h>
 #include <inttypes.h>
+#include <stdarg.h>
+#include <stdbool.h>
+#include <stdint.h>
 
 #ifdef _MSC_VER
   typedef int mode_t;
@@ -106,6 +107,7 @@ typedef struct ssh_session_struct* ssh_session;
 typedef struct ssh_string_struct* ssh_string;
 typedef struct ssh_event_struct* ssh_event;
 typedef struct ssh_connector_struct * ssh_connector;
+typedef struct ssh_pki_ctx_struct *ssh_pki_ctx;
 typedef void* ssh_gssapi_creds;
 
 /* Socket type */
@@ -150,13 +152,14 @@ enum ssh_auth_e {
 };
 
 /* auth flags */
-#define SSH_AUTH_METHOD_UNKNOWN     0x0000u
+#define SSH_AUTH_METHOD_UNKNOWN      0x0000u
-#define SSH_AUTH_METHOD_NONE        0x0001u
+#define SSH_AUTH_METHOD_NONE         0x0001u
-#define SSH_AUTH_METHOD_PASSWORD    0x0002u
+#define SSH_AUTH_METHOD_PASSWORD     0x0002u
-#define SSH_AUTH_METHOD_PUBLICKEY   0x0004u
+#define SSH_AUTH_METHOD_PUBLICKEY    0x0004u
-#define SSH_AUTH_METHOD_HOSTBASED   0x0008u
+#define SSH_AUTH_METHOD_HOSTBASED    0x0008u
-#define SSH_AUTH_METHOD_INTERACTIVE 0x0010u
+#define SSH_AUTH_METHOD_INTERACTIVE  0x0010u
-#define SSH_AUTH_METHOD_GSSAPI_MIC  0x0020u
+#define SSH_AUTH_METHOD_GSSAPI_MIC   0x0020u
+#define SSH_AUTH_METHOD_GSSAPI_KEYEX 0x0040u
 
 /* messages */
 enum ssh_requests_e {
@@ -369,6 +372,12 @@ enum ssh_control_master_options_e {
   SSH_CONTROL_MASTER_AUTOASK
 };
 
+enum ssh_address_family_options_e {
+    SSH_ADDRESS_FAMILY_ANY,
+    SSH_ADDRESS_FAMILY_INET,
+    SSH_ADDRESS_FAMILY_INET6
+};
+
 enum ssh_options_e {
     SSH_OPTIONS_HOST,
     SSH_OPTIONS_PORT,
@@ -419,6 +428,10 @@ enum ssh_options_e {
     SSH_OPTIONS_CERTIFICATE,
     SSH_OPTIONS_PROXYJUMP,
     SSH_OPTIONS_PROXYJUMP_CB_LIST_APPEND,
+    SSH_OPTIONS_PKI_CONTEXT,
+    SSH_OPTIONS_ADDRESS_FAMILY,
+    SSH_OPTIONS_GSSAPI_KEY_EXCHANGE,
+    SSH_OPTIONS_GSSAPI_KEY_EXCHANGE_ALGS,
 };
 
 enum {
@@ -720,9 +733,17 @@ LIBSSH_API int ssh_key_cmp(const ssh_key k1,
                            const ssh_key k2,
                            enum ssh_keycmp_e what);
 LIBSSH_API ssh_key ssh_key_dup(const ssh_key key);
+LIBSSH_API uint32_t ssh_key_get_sk_flags(const ssh_key key);
+LIBSSH_API ssh_string ssh_key_get_sk_application(const ssh_key key);
+LIBSSH_API ssh_string ssh_key_get_sk_user_id(const ssh_key key);
+
+SSH_DEPRECATED LIBSSH_API int
+ssh_pki_generate(enum ssh_keytypes_e type, int parameter, ssh_key *pkey);
+
+LIBSSH_API int ssh_pki_generate_key(enum ssh_keytypes_e type,
+                                    ssh_pki_ctx pki_context,
+                                    ssh_key *pkey);
 
-LIBSSH_API int ssh_pki_generate(enum ssh_keytypes_e type, int parameter,
-        ssh_key *pkey);
 LIBSSH_API int ssh_pki_import_privkey_base64(const char *b64_key,
                                              const char *passphrase,
                                              ssh_auth_callback auth_fn,
@@ -843,6 +864,7 @@ LIBSSH_API int ssh_string_fill(ssh_string str, const void *data, size_t len);
     do { if ((x) != NULL) { ssh_string_free(x); x = NULL; } } while(0)
 LIBSSH_API void ssh_string_free(ssh_string str);
 LIBSSH_API ssh_string ssh_string_from_char(const char *what);
+LIBSSH_API ssh_string ssh_string_from_data(const void *data, size_t len);
 LIBSSH_API size_t ssh_string_len(ssh_string str);
 LIBSSH_API ssh_string ssh_string_new(size_t size);
 LIBSSH_API const char *ssh_string_get_char(ssh_string str);
@@ -850,6 +872,7 @@ LIBSSH_API char *ssh_string_to_char(ssh_string str);
 #define SSH_STRING_FREE_CHAR(x) \
     do { if ((x) != NULL) { ssh_string_free_char(x); x = NULL; } } while(0)
 LIBSSH_API void ssh_string_free_char(char *s);
+LIBSSH_API int ssh_string_cmp(ssh_string s1, ssh_string s2);
 
 LIBSSH_API int ssh_getpass(const char *prompt, char *buf, size_t len, int echo,
     int verify);
@@ -874,6 +897,7 @@ LIBSSH_API const char* ssh_get_cipher_in(ssh_session session);
 LIBSSH_API const char* ssh_get_cipher_out(ssh_session session);
 LIBSSH_API const char* ssh_get_hmac_in(ssh_session session);
 LIBSSH_API const char* ssh_get_hmac_out(ssh_session session);
+LIBSSH_API const char *ssh_get_supported_methods(enum ssh_kex_types_e type);
 
 LIBSSH_API ssh_buffer ssh_buffer_new(void);
 LIBSSH_API void ssh_buffer_free(ssh_buffer buffer);
@@ -886,6 +910,105 @@ LIBSSH_API void *ssh_buffer_get(ssh_buffer buffer);
 LIBSSH_API uint32_t ssh_buffer_get_len(ssh_buffer buffer);
 LIBSSH_API int ssh_session_set_disconnect_message(ssh_session session, const char *message);
 
+/* SSHSIG hashes data independently from the key used, so we use a new enum
+   to avoid confusion. See
+   https://gitlab.com/jas/ietf-sshsig-format/-/blob/cc70a225cbd695d5a6f20aaebdb4b92b0818e43a/ietf-sshsig-format.md#L137
+ */
+enum sshsig_digest_e {
+    SSHSIG_DIGEST_SHA2_256 = 0,
+    SSHSIG_DIGEST_SHA2_512 = 1,
+};
+
+LIBSSH_API int sshsig_sign(const void *data,
+                           size_t data_length,
+                           ssh_key privkey,
+                           ssh_pki_ctx pki_context,
+                           const char *sig_namespace,
+                           enum sshsig_digest_e hash_alg,
+                           char **signature);
+LIBSSH_API int sshsig_verify(const void *data,
+                             size_t data_length,
+                             const char *signature,
+                             const char *sig_namespace,
+                             ssh_key *sign_key);
+
+/* PKI context API */
+
+enum ssh_pki_options_e {
+    SSH_PKI_OPTION_RSA_KEY_SIZE,
+
+    /* Security Key options */
+    SSH_PKI_OPTION_SK_APPLICATION,
+    SSH_PKI_OPTION_SK_FLAGS,
+    SSH_PKI_OPTION_SK_USER_ID,
+    SSH_PKI_OPTION_SK_CHALLENGE,
+    SSH_PKI_OPTION_SK_CALLBACKS,
+};
+
+/* FIDO2/U2F Operation Flags */
+
+/** Requires user presence confirmation (tap/touch) */
+#ifndef SSH_SK_USER_PRESENCE_REQD
+#define SSH_SK_USER_PRESENCE_REQD 0x01
+#endif
+
+/** Requires user verification (PIN/biometric) - FIDO2 only */
+#ifndef SSH_SK_USER_VERIFICATION_REQD
+#define SSH_SK_USER_VERIFICATION_REQD 0x04
+#endif
+
+/** Force resident key enrollment even if a resident key with given user ID
+ * already exists - FIDO2 only */
+#ifndef SSH_SK_FORCE_OPERATION
+#define SSH_SK_FORCE_OPERATION 0x10
+#endif
+
+/** Create/use resident key stored on authenticator - FIDO2 only */
+#ifndef SSH_SK_RESIDENT_KEY
+#define SSH_SK_RESIDENT_KEY 0x20
+#endif
+
+LIBSSH_API ssh_pki_ctx ssh_pki_ctx_new(void);
+
+LIBSSH_API int ssh_pki_ctx_options_set(ssh_pki_ctx context,
+                                       enum ssh_pki_options_e option,
+                                       const void *value);
+
+LIBSSH_API int ssh_pki_ctx_set_sk_pin_callback(ssh_pki_ctx context,
+                                               ssh_auth_callback pin_callback,
+                                               void *userdata);
+
+#define SSH_SK_OPTION_NAME_DEVICE_PATH "device"
+#define SSH_SK_OPTION_NAME_USER_ID     "user"
+
+LIBSSH_API int ssh_pki_ctx_sk_callbacks_option_set(ssh_pki_ctx context,
+                                                   const char *name,
+                                                   const char *value,
+                                                   bool required);
+
+LIBSSH_API int ssh_pki_ctx_sk_callbacks_options_clear(ssh_pki_ctx context);
+
+LIBSSH_API int
+ssh_pki_ctx_get_sk_attestation_buffer(const struct ssh_pki_ctx_struct *context,
+                                      ssh_buffer *attestation_buffer);
+
+LIBSSH_API void ssh_pki_ctx_free(ssh_pki_ctx context);
+
+#define SSH_PKI_CTX_FREE(x)      \
+    do {                         \
+        if ((x) != NULL) {       \
+            ssh_pki_ctx_free(x); \
+            x = NULL;            \
+        }                        \
+    } while (0)
+
+/* Security key resident keys API */
+
+LIBSSH_API int
+ssh_sk_resident_keys_load(const struct ssh_pki_ctx_struct *pki_context,
+                          ssh_key **resident_keys_result,
+                          size_t *num_keys_found_result);
+
 #ifndef LIBSSH_LEGACY_0_4
 #include "libssh/legacy.h"
 #endif

include/libssh/messages.h

@@ -28,6 +28,7 @@ struct ssh_auth_request {
     int method;
     char *password;
     struct ssh_key_struct *pubkey;
+    struct ssh_key_struct *server_pubkey;
     char *sigtype;
     enum ssh_publickey_state_e signature_state;
     char kbdint_response;

include/libssh/mlkem.h

@@ -0,0 +1,73 @@
+/*
+ * This file is part of the SSH Library
+ *
+ * Copyright (c) 2025 by Red Hat, Inc.
+ *
+ * Author: Pavol Žáčik <pzacik@redhat.com>
+ *
+ * The SSH Library is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, version 2.1 of the License.
+ *
+ * The SSH Library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Lesser General Public
+ * License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with the SSH Library; see the file COPYING.  If not, write to
+ * the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
+ * MA 02111-1307, USA.
+ */
+
+#ifndef MLKEM_H_
+#define MLKEM_H_
+
+#include "libssh/crypto.h"
+#include "libssh/libssh.h"
+#include "libssh/session.h"
+
+#include "config.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+struct mlkem_type_info {
+    size_t pubkey_size;
+    size_t ciphertext_size;
+#ifdef HAVE_GCRYPT_MLKEM
+    size_t privkey_size;
+    enum gcry_kem_algos alg;
+#elif defined(HAVE_OPENSSL_MLKEM)
+    const char *name;
+#else
+    size_t privkey_size;
+#endif
+};
+
+extern const struct mlkem_type_info MLKEM768_INFO;
+#ifdef HAVE_MLKEM1024
+extern const struct mlkem_type_info MLKEM1024_INFO;
+#endif
+
+#define MLKEM_SHARED_SECRET_SIZE 32
+
+typedef unsigned char ssh_mlkem_shared_secret[MLKEM_SHARED_SECRET_SIZE];
+
+const struct mlkem_type_info *
+kex_type_to_mlkem_info(enum ssh_key_exchange_e kex_type);
+
+int ssh_mlkem_init(ssh_session session);
+
+int ssh_mlkem_encapsulate(ssh_session session,
+                          ssh_mlkem_shared_secret shared_secret);
+
+int ssh_mlkem_decapsulate(const ssh_session session,
+                          ssh_mlkem_shared_secret shared_secret);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* MLKEM_H_ */

include/libssh/mlkem_native.h

@@ -0,0 +1,127 @@
+/*
+ * This file is part of the SSH Library
+ *
+ * Copyright (c) 2025 by Red Hat, Inc.
+ *
+ * Author: Jakub Jelen <jjelen@redhat.com>
+ *
+ * The SSH Library is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, version 2.1 of the License.
+ *
+ * The SSH Library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Lesser General Public
+ * License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with the SSH Library; see the file COPYING.  If not, write to
+ * the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
+ * MA 02111-1307, USA.
+ */
+
+#ifndef MLKEM_NATIVE_H_
+#define MLKEM_NATIVE_H_
+
+#include <stdbool.h>
+#include <stddef.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include "config.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/**
+A monomorphic instance of libcrux_ml_kem.types.MlKemPrivateKey
+with const generics
+- $2400size_t
+*/
+typedef struct libcrux_ml_kem_types_MlKemPrivateKey_d9_s {
+    uint8_t value[2400U];
+} libcrux_ml_kem_types_MlKemPrivateKey_d9;
+
+/**
+A monomorphic instance of libcrux_ml_kem.types.MlKemPublicKey
+with const generics
+- $1184size_t
+*/
+typedef struct libcrux_ml_kem_types_MlKemPublicKey_30_s {
+    uint8_t value[1184U];
+} libcrux_ml_kem_types_MlKemPublicKey_30;
+
+typedef struct libcrux_ml_kem_mlkem768_MlKem768KeyPair_s {
+    libcrux_ml_kem_types_MlKemPrivateKey_d9 sk;
+    libcrux_ml_kem_types_MlKemPublicKey_30 pk;
+} libcrux_ml_kem_mlkem768_MlKem768KeyPair;
+
+typedef struct libcrux_ml_kem_mlkem768_MlKem768Ciphertext_s {
+    uint8_t value[1088U];
+} libcrux_ml_kem_mlkem768_MlKem768Ciphertext;
+
+/**
+A monomorphic instance of K.
+with types libcrux_ml_kem_types_MlKemCiphertext[[$1088size_t]],
+uint8_t[32size_t]
+
+*/
+typedef struct tuple_c2_s {
+    libcrux_ml_kem_mlkem768_MlKem768Ciphertext fst;
+    uint8_t snd[32U];
+} tuple_c2;
+
+/**
+ Generate ML-KEM 768 Key Pair
+*/
+libcrux_ml_kem_mlkem768_MlKem768KeyPair
+libcrux_ml_kem_mlkem768_portable_generate_key_pair(uint8_t randomness[64U]);
+
+/**
+ Validate a public key.
+
+ Returns `true` if valid, and `false` otherwise.
+*/
+bool libcrux_ml_kem_mlkem768_portable_validate_public_key(
+    libcrux_ml_kem_types_MlKemPublicKey_30 *public_key);
+
+/**
+ Encapsulate ML-KEM 768
+
+ Generates an ([`MlKem768Ciphertext`], [`MlKemSharedSecret`]) tuple.
+ The input is a reference to an [`MlKem768PublicKey`] and [`SHARED_SECRET_SIZE`]
+ bytes of `randomness`.
+*/
+tuple_c2 libcrux_ml_kem_mlkem768_portable_encapsulate(
+    libcrux_ml_kem_types_MlKemPublicKey_30 *public_key,
+    uint8_t randomness[32U]);
+
+/**
+ Decapsulate ML-KEM 768
+
+ Generates an [`MlKemSharedSecret`].
+ The input is a reference to an [`MlKem768PrivateKey`] and an
+ [`MlKem768Ciphertext`].
+*/
+void libcrux_ml_kem_mlkem768_portable_decapsulate(
+    libcrux_ml_kem_types_MlKemPrivateKey_d9 *private_key,
+    libcrux_ml_kem_mlkem768_MlKem768Ciphertext *ciphertext,
+    uint8_t ret[32U]);
+
+/* rename some types to be a bit more ergonomic */
+#define libcrux_mlkem768_keypair    libcrux_ml_kem_mlkem768_MlKem768KeyPair_s
+#define libcrux_mlkem768_pk         libcrux_ml_kem_types_MlKemPublicKey_30_s
+#define libcrux_mlkem768_sk         libcrux_ml_kem_types_MlKemPrivateKey_d9_s
+#define libcrux_mlkem768_ciphertext libcrux_ml_kem_mlkem768_MlKem768Ciphertext_s
+#define libcrux_mlkem768_enc_result tuple_c2_s
+/* defines for PRNG inputs */
+#define LIBCRUX_ML_KEM_KEY_PAIR_PRNG_LEN 64U
+#define LIBCRUX_ML_KEM_ENC_PRNG_LEN      32
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* MLKEM_NATIVE_H_ */

include/libssh/options.h

@@ -25,6 +25,7 @@
 extern "C" {
 #endif
 
+int ssh_config_parse(ssh_session session, FILE *fp, bool global);
 int ssh_config_parse_file(ssh_session session, const char *filename);
 int ssh_config_parse_string(ssh_session session, const char *input);
 int ssh_options_set_algo(ssh_session session,

include/libssh/packet.h

@@ -58,6 +58,7 @@ extern "C" {
 SSH_PACKET_CALLBACK(ssh_packet_unimplemented);
 SSH_PACKET_CALLBACK(ssh_packet_disconnect_callback);
 SSH_PACKET_CALLBACK(ssh_packet_ignore_callback);
+SSH_PACKET_CALLBACK(ssh_packet_debug_callback);
 SSH_PACKET_CALLBACK(ssh_packet_dh_reply);
 SSH_PACKET_CALLBACK(ssh_packet_newkeys);
 SSH_PACKET_CALLBACK(ssh_packet_service_accept);

include/libssh/pki.h

@@ -46,11 +46,24 @@
 #define MAX_PUBKEY_SIZE 0x100000 /* 1M */
 #define MAX_PRIVKEY_SIZE 0x400000 /* 4M */
 
+#define RSA_MIN_KEY_SIZE      1024
+#define RSA_MIN_FIPS_KEY_SIZE 2048
+#define RSA_DEFAULT_KEY_SIZE  3072
+
 #define SSH_KEY_FLAG_EMPTY   0x0
 #define SSH_KEY_FLAG_PUBLIC  0x0001
 #define SSH_KEY_FLAG_PRIVATE 0x0002
 #define SSH_KEY_FLAG_PKCS11_URI 0x0004
 
+/* Constants matching the Lightweight Secure Shell Signature Format */
+/* https://datatracker.ietf.org/doc/draft-josefsson-sshsig-format */
+#define SSHSIG_VERSION            0x01
+#define SSHSIG_MAGIC_PREAMBLE     "SSHSIG"
+#define SSHSIG_MAGIC_PREAMBLE_LEN (sizeof(SSHSIG_MAGIC_PREAMBLE) - 1)
+#define SSHSIG_BEGIN_SIGNATURE    "-----BEGIN SSH SIGNATURE-----"
+#define SSHSIG_END_SIGNATURE      "-----END SSH SIGNATURE-----"
+#define SSHSIG_LINE_LENGTH        76
+
 struct ssh_key_struct {
     enum ssh_keytypes_e type;
     int flags;
@@ -63,11 +76,12 @@ struct ssh_key_struct {
     mbedtls_pk_context *pk;
     mbedtls_ecdsa_context *ecdsa;
 #elif defined(HAVE_LIBCRYPTO)
-    /* This holds either ENGINE key for PKCS#11 support or just key in
+    /* This holds either ENGINE/PROVIDER key for PKCS#11 support
-     * high-level format */
+     * or just key in high-level format */
     EVP_PKEY *key;
+    /* keep this around for FIPS mode so we can parse the public keys. We won't
+     * be able to use them nor use the private keys though */
     uint8_t *ed25519_pubkey;
-    uint8_t *ed25519_privkey;
 #endif /* HAVE_LIBGCRYPT */
 #ifndef HAVE_LIBCRYPTO
     ed25519_pubkey *ed25519_pubkey;
@@ -76,6 +90,14 @@ struct ssh_key_struct {
     ssh_string sk_application;
     ssh_buffer cert;
     enum ssh_keytypes_e cert_type;
+
+    /* Security Key specific private data */
+    uint8_t sk_flags;
+    ssh_string sk_key_handle;
+    ssh_string sk_reserved;
+
+    /* Resident key specific metadata */
+    ssh_string sk_user_id;
 };
 
 struct ssh_signature_struct {
@@ -127,6 +149,11 @@ enum ssh_digest_e ssh_key_hash_from_name(const char *name);
     ((kt) >= SSH_KEYTYPE_ECDSA_P256_CERT01 &&\
      (kt) <= SSH_KEYTYPE_ED25519_CERT01))
 
+#define is_sk_key_type(kt)                                             \
+    ((kt) == SSH_KEYTYPE_SK_ECDSA || (kt) == SSH_KEYTYPE_SK_ED25519 || \
+     (kt) == SSH_KEYTYPE_SK_ECDSA_CERT01 ||                            \
+     (kt) == SSH_KEYTYPE_SK_ED25519_CERT01)
+
 /* SSH Signature Functions */
 ssh_signature ssh_signature_new(void);
 void ssh_signature_free(ssh_signature sign);

include/libssh/pki_context.h

@@ -0,0 +1,103 @@
+/*
+ * This file is part of the SSH Library
+ *
+ * Copyright (c) 2025 Praneeth Sarode <praneethsarode@gmail.com>
+ *
+ * The SSH Library is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, version 2.1 of the License.
+ *
+ * The SSH Library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Lesser General Public
+ * License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with the SSH Library; see the file COPYING.  If not, write to
+ * the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
+ * MA 02111-1307, USA.
+ */
+
+#ifndef PKI_CONTEXT_H
+#define PKI_CONTEXT_H
+
+#include "libssh/callbacks.h"
+#include "libssh/libssh.h"
+
+/**
+ * @brief Security key context structure
+ *
+ * Context structure containing all parameters and callbacks
+ * needed for FIDO2/U2F security key operations.
+ */
+struct ssh_pki_ctx_struct {
+    /** @brief Desired RSA modulus size in bits
+     *
+     * Specified size of RSA keys to generate. If set to 0, defaults to 3072
+     * bits. Must be greater than or equal to 1024, as anything below is
+     * considered insecure.
+     */
+    int rsa_key_size;
+
+    /** @brief Security key callbacks
+     *
+     * Provides enroll/sign/load_resident_keys operations.
+     */
+    const struct ssh_sk_callbacks_struct *sk_callbacks;
+
+    /** @brief Application identifier string for the security key credential
+     *
+     * FIDO2 relying party identifier, typically "ssh:user@hostname" format.
+     * This is required for all security key operations.
+     */
+    char *sk_application;
+
+    /** @brief FIDO2 operation flags
+     *
+     * Bitfield controlling authenticator behavior. Combine with bitwise OR:
+     * - SSH_SK_USER_PRESENCE_REQD (0x01): Require user touch
+     * - SSH_SK_USER_VERIFICATION_REQD (0x04): Require PIN/biometric
+     * - SSH_SK_FORCE_OPERATION (0x10): Override duplicate detection
+     * - SSH_SK_RESIDENT_KEY (0x20): Create discoverable credential
+     */
+    uint8_t sk_flags;
+
+    /** @brief PIN callback for authenticator user verification (optional)
+     *
+     * Callback invoked to obtain a PIN or perform user verification when
+     * SSH_SK_USER_VERIFICATION_REQD is set or the authenticator requires it.
+     * If NULL, no interactive PIN retrieval is performed.
+     */
+    ssh_auth_callback sk_pin_callback;
+
+    /** @brief User supplied pointer passed to callbacks (optional)
+     *
+     * Generic pointer set by the application and forwarded to
+     * interactive callbacks (e.g. PIN callback) to allow applications to
+     * carry state context.
+     */
+    void *sk_userdata;
+
+    /** @brief Custom challenge data for enrollment (optional)
+     *
+     * Buffer containing challenge data signed by the authenticator.
+     * If NULL, a random 32-byte challenge is automatically generated.
+     */
+    ssh_buffer sk_challenge_buffer;
+
+    /** @brief Options to be passed to the sk_callbacks (optional)
+     *
+     * NULL-terminated array of sk_option pointers owned by this context.
+     */
+    struct sk_option **sk_callbacks_options;
+
+    /** @brief The buffer used to store attestation information returned in a
+     * key enrollment operation
+     */
+    ssh_buffer sk_attestation_buffer;
+};
+
+/* Internal PKI context functions */
+ssh_pki_ctx ssh_pki_ctx_dup(const ssh_pki_ctx context);
+
+#endif /* PKI_CONTEXT_H */

include/libssh/pki_priv.h

@@ -61,6 +61,7 @@ enum ssh_digest_e ssh_key_type_to_hash(ssh_session session,
                                        enum ssh_keytypes_e type);
 
 /* SSH Key Functions */
+ssh_key pki_key_dup_common_init(const ssh_key key, int demote);
 ssh_key pki_key_dup(const ssh_key key, int demote);
 int pki_key_generate_rsa(ssh_key key, int parameter);
 int pki_key_generate_ecdsa(ssh_key key, int parameter);
@@ -148,6 +149,7 @@ int pki_signature_from_ed25519_blob(ssh_signature sig, ssh_string sig_blob);
 int pki_privkey_build_ed25519(ssh_key key,
                               ssh_string pubkey,
                               ssh_string privkey);
+int pki_pubkey_build_ed25519(ssh_key key, ssh_string pubkey);
 
 /* PKI Container OpenSSH */
 ssh_key ssh_pki_openssh_pubkey_import(const char *text_key);
@@ -162,6 +164,16 @@ int pki_uri_import(const char *uri_name, ssh_key *key, enum ssh_key_e key_type);
 #endif /* WITH_PKCS11_URI */
 
 bool ssh_key_size_allowed_rsa(int min_size, ssh_key key);
+
+/* Security Key Helper Functions */
+int pki_buffer_pack_sk_priv_data(ssh_buffer buffer, const ssh_key key);
+int pki_buffer_unpack_sk_priv_data(ssh_buffer buffer, ssh_key key);
+int pki_sk_signature_buffer_prepare(const ssh_key key,
+                                    const ssh_signature sig,
+                                    const unsigned char *input,
+                                    size_t input_len,
+                                    ssh_buffer *sk_buffer_out);
+
 #ifdef __cplusplus
 }
 #endif

include/libssh/pki_sk.h

@@ -0,0 +1,90 @@
+/*
+ * This file is part of the SSH Library
+ *
+ * Copyright (c) 2025 Praneeth Sarode <praneethsarode@gmail.com>
+ *
+ * The SSH Library is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, version 2.1 of the License.
+ *
+ * The SSH Library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Lesser General Public
+ * License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with the SSH Library; see the file COPYING.  If not, write to
+ * the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
+ * MA 02111-1307, USA.
+ */
+
+#ifndef PKI_SK_H
+#define PKI_SK_H
+
+#include "libssh/libssh.h"
+#include "libssh/pki.h"
+
+#include <stdint.h>
+
+#define SSH_SK_MAX_USER_ID_LEN 64
+
+/**
+ * @brief Enroll a new security key using a U2F/FIDO2 authenticator
+ *
+ * Creates a new security key credential configured according to the parameters
+ * in the PKI context. This function handles key enrollment for both ECDSA and
+ * Ed25519 algorithms, generates appropriate challenges, and returns the
+ * enrolled key with optional attestation data.
+ *
+ * The PKI context must be configured with appropriate security key parameters
+ * using ssh_pki_ctx_options_set() before calling this function. Required
+ * options include SSH_PKI_OPTION_SK_APPLICATION, SSH_PKI_OPTION_SK_USER_ID, and
+ * SSH_PKI_OPTION_SK_CALLBACKS.
+ *
+ * @param[in] context The PKI context containing security key configuration and
+ *                    parameters
+ * @param[in] key_type The type of key to enroll (SSH_KEYTYPE_SK_ECDSA or
+ *                     SSH_KEYTYPE_SK_ED25519)
+ * @param[out] enrolled_key_result Pointer to store the enrolled ssh_key
+ *
+ * @return SSH_OK on success, SSH_ERROR on failure
+ *
+ * @see ssh_pki_ctx_new()
+ * @see ssh_pki_ctx_options_set()
+ * @see ssh_pki_ctx_get_sk_attestation_buffer()
+ */
+int pki_sk_enroll_key(ssh_pki_ctx context,
+                      enum ssh_keytypes_e key_type,
+                      ssh_key *enrolled_key_result);
+
+/**
+ * @brief Sign arbitrary data using a security key and a PKI context
+ *
+ * This function performs signing operations configured according to the
+ * parameters in the PKI context and returns a properly formatted
+ * ssh_signature. The caller must free the signature when it is no longer
+ * needed.
+ *
+ * The PKI context should be configured with appropriate security key parameters
+ * using ssh_pki_ctx_options_set() before calling this function. The security
+ * key must have been previously enrolled or loaded.
+ *
+ * @param[in] context The PKI context containing security key configuration and
+ *                    parameters
+ * @param[in] key The security key to use for signing
+ * @param[in] data The data to sign
+ * @param[in] data_len Length of data to sign
+ *
+ * @return A valid ssh_signature on success, NULL on failure
+ *
+ * @see ssh_pki_ctx_new()
+ * @see ssh_pki_ctx_options_set()
+ * @see pki_sk_enroll_key()
+ * @see ssh_signature_free()
+ */
+ssh_signature pki_sk_do_sign(ssh_pki_ctx context,
+                             const ssh_key key,
+                             const uint8_t *data,
+                             size_t data_len);
+
+#endif /* PKI_SK_H */