From 41f3f94d9191f2454ac12ae9130e44b78c55e1fd Mon Sep 17 00:00:00 2001 From: Viktor Szakats Date: Fri, 24 Apr 2026 13:31:53 +0200 Subject: [PATCH] sshserver.pl: add option to enable KEX algorithms in sshd Necessary when the libssh2/libssh client library does not support KEX algos offered by default by the OpenSSH server. E.g. libssh2 with WinCNG combined with OpenSSH 10+. Also: use this option in GHA/windows. Follow-up to 3b8bb1a86afbaf967163bf6709b1825e11655bf5 #21219 Follow-up to c98d0a2e9aa7ec87d16af8b056e6e7c0d614feec #21220 Closes #21438 --- .github/workflows/windows.yml | 2 ++ tests/sshserver.pl | 3 +++ 2 files changed, 5 insertions(+) diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml index e9a64b436c..e5a223d4a6 100644 --- a/.github/workflows/windows.yml +++ b/.github/workflows/windows.yml @@ -510,6 +510,7 @@ jobs: if [[ "${MATRIX_INSTALL}" = *'libssh2-wincng'* ]]; then TFLAGS+=' ~SCP ~SFTP' # Flaky: `-8, Unable to exchange encryption keys`. https://github.com/libssh2/libssh2/issues/804 unset CURL_TEST_SSH_KEYALGO # libssh2 built with WinCNG does not support ssh-ed25519 hostkeys + export CURL_TEST_SSH_ENABLE_KEX=diffie-hellman-group-exchange-sha256 fi if [[ "${TFLAGS}" = *'-t'* ]]; then TFLAGS+=' !2300' # Leaks memory and file handle via tool_doswin.c / win32_stdin_read_thread() @@ -1164,6 +1165,7 @@ jobs: "${MATRIX_INSTALL_VCPKG}" = *'libssh2[core,zlib]'* ]]; then TFLAGS+=' ~SCP ~SFTP' # Flaky: `-8, Unable to exchange encryption keys`. https://github.com/libssh2/libssh2/issues/804 unset CURL_TEST_SSH_KEYALGO # libssh2 built with WinCNG does not support ssh-ed25519 hostkeys + export CURL_TEST_SSH_ENABLE_KEX=diffie-hellman-group-exchange-sha256 fi if [ -n "${MATRIX_OPENSSH}" ]; then # OpenSSH-Windows TFLAGS+=' ~601 ~603 ~617 ~619 ~621 ~641 ~665 ~2004' # SCP diff --git a/tests/sshserver.pl b/tests/sshserver.pl index a5938f66f2..4718713e89 100755 --- a/tests/sshserver.pl +++ b/tests/sshserver.pl @@ -630,6 +630,9 @@ push @cfgarr, 'HostbasedAuthentication no'; push @cfgarr, 'HostbasedUsesNameFromPacketOnly no'; push @cfgarr, 'IgnoreRhosts yes'; push @cfgarr, 'IgnoreUserKnownHosts yes'; +if(($sshdid =~ /OpenSSH/) && ($sshdvernum >= 700) && $ENV{'CURL_TEST_SSH_ENABLE_KEX'}) { + push @cfgarr, 'KexAlgorithms +' . $ENV{'CURL_TEST_SSH_ENABLE_KEX'}; +} if(($sshdid =~ /OpenSSH/) && ($sshdvernum >= 750) && $ENV{'CURL_TEST_SSH_DISABLE_KEX'}) { push @cfgarr, 'KexAlgorithms -' . $ENV{'CURL_TEST_SSH_DISABLE_KEX'}; }