bump: Switch to libssh-0.12.2

libssh/CHANGELOG.md

@@ -1,5 +1,9 @@
 See the upstream [CHANGELOG](libssh-mirror/CHANGELOG)
 
+0.12.2
+- Based on upstream tag libssh-0.12.2
+- Manually patches upstream to include mbedtls-v4 support (ac4b723c)
+
 0.12.0~3
 - Based on upstream master branch (HEAD)
 - Includes mbedtls-v4 support

libssh/idf_component.yml

@@ -1,4 +1,4 @@
-version: "0.12.0~3"
+version: "0.12.2"
 url: https://github.com/david-cermak/libssh
 license: LGPL-2.1
 description: The component provides a general purpose SSH connectivity

libssh/install.sh

@@ -1,7 +1,11 @@
 #!/bin/bash
 
 # libssh installation script
-# This script patches the libssh upstream (adds optional MLKEM support)
+# This script patches the libssh upstream mirror (adds optional MLKEM/SNTRUP
+# support and mbedTLS v4 / PSA-Crypto backend support).
+#
+# Patches are applied in the order listed below and must be applied from the
+# libssh component root directory (the parent of libssh-mirror/).
 
 set -e  # Exit on any error
 
@@ -11,16 +15,22 @@ SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 LIBSSH_VERSION="mirror"    # Developer's mode
 PATCH_DIR="${SCRIPT_DIR}/patches"
 
+# Patches are applied in this order; mbedtls_v4 must go first so the later
+# port patches build on top of the mbedTLS v4 backend changes.
+PATCH_ORDER="mbedtls_v4.patch esp_idf_port.patch"
+
 # Apply ESP-IDF port patches
-if [ -d "${PATCH_DIR}" ]; then
-    for patch_file in "${PATCH_DIR}"/*.patch; do
-        [ -f "$patch_file" ] || continue
-        echo "Applying patch: $(basename "$patch_file")..."
-        if ! patch -p0 < "$patch_file"; then
-            echo "Failed to apply patch: $(basename "$patch_file")"
-            exit 1
-        fi
-    done
-fi
+for patch_name in ${PATCH_ORDER}; do
+    patch_file="${PATCH_DIR}/${patch_name}"
+    [ -f "$patch_file" ] || {
+        echo "Missing patch: ${patch_name}"
+        exit 1
+    }
+    echo "Applying patch: ${patch_name}..."
+    if ! patch -p0 < "$patch_file"; then
+        echo "Failed to apply patch: ${patch_name}"
+        exit 1
+    fi
+done
 
 echo "libssh ${LIBSSH_VERSION} installed successfully."

libssh/patches/esp_idf_port.patch

@@ -1,5 +1,4 @@
 diff --git a/include/libssh/sntrup761.h b/include/libssh/sntrup761.h
-index aa05a9fd..2b6bfb6f 100644
 --- libssh-mirror/include/libssh/sntrup761.h
 +++ libssh-mirror/include/libssh/sntrup761.h
 @@ -31,7 +31,7 @@
@@ -12,18 +11,17 @@ index aa05a9fd..2b6bfb6f 100644
  #endif
 
 diff --git a/src/client.c b/src/client.c
-index 4a6ee24a..ef419c09 100644
 --- libssh-mirror/src/client.c
 +++ libssh-mirror/src/client.c
-@@ -306,6 +306,7 @@ int dh_handshake(ssh_session session)
+@@ -306,6 +306,7 @@
              rc = ssh_client_sntrup761x25519_init(session);
              break;
  #endif
 +#ifdef HAVE_MLKEM
          case SSH_KEX_MLKEM768X25519_SHA256:
          case SSH_KEX_MLKEM768NISTP256_SHA256:
  #ifdef HAVE_MLKEM1024
-@@ -313,6 +314,7 @@ int dh_handshake(ssh_session session)
+@@ -313,6 +314,7 @@
  #endif
              rc = ssh_client_hybrid_mlkem_init(session);
              break;
@@ -32,7 +30,6 @@ index 4a6ee24a..ef419c09 100644
              rc = SSH_ERROR;
          }
 diff --git a/src/kex.c b/src/kex.c
-index 698e62c2..5227c0ae 100644
 --- libssh-mirror/src/kex.c
 +++ libssh-mirror/src/kex.c
 @@ -105,6 +105,7 @@
@@ -53,31 +50,31 @@ index 698e62c2..5227c0ae 100644
 
  #ifdef HAVE_ECC
  #define ECDH "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,"
-@@ -1003,6 +1007,7 @@ kex_select_kex_type(const char *kex)
+@@ -1003,6 +1007,7 @@
          return SSH_KEX_SNTRUP761X25519_SHA512_OPENSSH_COM;
      } else if (strcmp(kex, "sntrup761x25519-sha512") == 0) {
          return SSH_KEX_SNTRUP761X25519_SHA512;
 +#ifdef HAVE_MLKEM
      } else if (strcmp(kex, "mlkem768x25519-sha256") == 0) {
          return SSH_KEX_MLKEM768X25519_SHA256;
      } else if (strcmp(kex, "mlkem768nistp256-sha256") == 0) {
-@@ -1011,6 +1016,7 @@ kex_select_kex_type(const char *kex)
+@@ -1011,6 +1016,7 @@
      } else if (strcmp(kex, "mlkem1024nistp384-sha384") == 0) {
          return SSH_KEX_MLKEM1024NISTP384_SHA384;
  #endif
 +#endif /* HAVE_MLKEM */
      }
      /* should not happen. We should be getting only valid names at this stage */
      return 0;
-@@ -1065,6 +1071,7 @@ static void revert_kex_callbacks(ssh_session session)
+@@ -1065,6 +1071,7 @@
          ssh_client_sntrup761x25519_remove_callbacks(session);
          break;
  #endif
 +#ifdef HAVE_MLKEM
      case SSH_KEX_MLKEM768X25519_SHA256:
      case SSH_KEX_MLKEM768NISTP256_SHA256:
  #ifdef HAVE_MLKEM1024
-@@ -1072,6 +1079,9 @@ static void revert_kex_callbacks(ssh_session session)
+@@ -1072,6 +1079,9 @@
  #endif
          ssh_client_hybrid_mlkem_remove_callbacks(session);
          break;
@@ -87,63 +84,66 @@ index 698e62c2..5227c0ae 100644
      }
  }
 
-@@ -1671,6 +1681,7 @@ int ssh_make_sessionid(ssh_session session)
+@@ -1671,6 +1681,7 @@
          }
          break;
  #endif /* HAVE_SNTRUP761 */
 +#ifdef HAVE_MLKEM
      case SSH_KEX_MLKEM768X25519_SHA256:
      case SSH_KEX_MLKEM768NISTP256_SHA256:
  #ifdef HAVE_MLKEM1024
-@@ -1687,6 +1698,7 @@ int ssh_make_sessionid(ssh_session session)
+@@ -1687,6 +1698,7 @@
              goto error;
          }
          break;
 +#endif /* HAVE_MLKEM */
      default:
          /* Handle unsupported kex types - this should not happen in normal operation */
          rc = SSH_ERROR;
-@@ -1696,11 +1708,13 @@ int ssh_make_sessionid(ssh_session session)
-     switch (session->next_crypto->kex_type) {
-     case SSH_KEX_SNTRUP761X25519_SHA512:
-     case SSH_KEX_SNTRUP761X25519_SHA512_OPENSSH_COM:
+@@ -1701,6 +1713,7 @@
+                              session->next_crypto->shared_secret,
+                              SHA512_DIGEST_LEN);
+         break;
 +#ifdef HAVE_MLKEM
      case SSH_KEX_MLKEM768X25519_SHA256:
      case SSH_KEX_MLKEM768NISTP256_SHA256:
  #ifdef HAVE_MLKEM1024
-     case SSH_KEX_MLKEM1024NISTP384_SHA384:
+@@ -1708,6 +1721,7 @@
  #endif
-+#endif /* HAVE_MLKEM */
          rc = ssh_buffer_pack(buf, "S", session->next_crypto->hybrid_shared_secret);
          break;
++#endif /* HAVE_MLKEM */
      default:
-@@ -1922,11 +1936,13 @@ int ssh_generate_session_keys(ssh_session session)
-     switch (session->next_crypto->kex_type) {
-     case SSH_KEX_SNTRUP761X25519_SHA512:
-     case SSH_KEX_SNTRUP761X25519_SHA512_OPENSSH_COM:
+         rc = ssh_buffer_pack(buf, "B", session->next_crypto->shared_secret);
+         break;
+@@ -1930,6 +1944,7 @@
+         k_string = ssh_make_padded_bignum_string(crypto->shared_secret,
+                                                  crypto->digest_len);
+         break;
 +#ifdef HAVE_MLKEM
      case SSH_KEX_MLKEM768X25519_SHA256:
      case SSH_KEX_MLKEM768NISTP256_SHA256:
  #ifdef HAVE_MLKEM1024
-     case SSH_KEX_MLKEM1024NISTP384_SHA384:
+@@ -1937,6 +1952,7 @@
  #endif
-+#endif /* HAVE_MLKEM */
          k_string = ssh_string_copy(crypto->hybrid_shared_secret);
          break;
++#endif /* HAVE_MLKEM */
      default:
+         k_string = ssh_make_bignum_string(crypto->shared_secret);
+         break;
 diff --git a/src/wrapper.c b/src/wrapper.c
-index 80d3ff3d..49e34354 100644
 --- libssh-mirror/src/wrapper.c
 +++ libssh-mirror/src/wrapper.c
-@@ -642,6 +642,7 @@ int crypt_set_algorithms_server(ssh_session session){
+@@ -625,6 +625,7 @@
          ssh_server_sntrup761x25519_init(session);
          break;
  #endif
 +#ifdef HAVE_MLKEM
      case SSH_KEX_MLKEM768X25519_SHA256:
      case SSH_KEX_MLKEM768NISTP256_SHA256:
  #ifdef HAVE_MLKEM1024
-@@ -649,6 +650,7 @@ int crypt_set_algorithms_server(ssh_session session){
+@@ -632,6 +633,7 @@
  #endif
          ssh_server_hybrid_mlkem_init(session);
          break;