[datlechin]

Summary

• libs-3 (build(libs): publish libs-3 #3764) builds libssh2 master with its new defaults. Measured with libssh2_session_supported_algs against libs-2 and libs-5, macOS and the iOS simulator alike, it no longer offers:
  • key exchange: diffie-hellman-group1-sha1, diffie-hellman-group14-sha1, diffie-hellman-group-exchange-sha1
  • host keys and RSA signatures: ssh-rsa, ssh-rsa-cert-v01@openssh.com
  • ciphers: 3des-cbc, blowfish-cbc, cast128-cbc, arcfour, arcfour128
  • MACs: hmac-sha1, hmac-sha1-96, hmac-sha1-etm@openssh.com, hmac-md5, hmac-md5-96, hmac-ripemd160, hmac-ripemd160@openssh.com
• They stay off. ssh-dss was already absent in libs-2 (libssh2 1.11.1), so it is not part of this change.
• Both apps: a failed negotiation reads the server's KEXINIT from the handshake bytes. When everything the server offers for that step is on the list above, the message adds "The server offers only TablePro no longer supports: ."
• Both apps: an RSA key against a server that takes only ssh-rsa signatures got libssh2's -17 "No signing signature matched" (0.83.0-beta.1 signed in). It is now negotiationFailed at a new keySignature stage: "TablePro and the SSH server have no signature algorithm in common for this key."
• Mac: in that case an unencrypted key no longer brings up the passphrase prompt, and an agent whose keys all hit it no longer says "Run ssh-add -l".
• The banner's software version keeps printable ASCII only (RFC 4253, 4.2), and a name the server repeats is listed once.
• Probes: ssh-test-servers.sh adds sha1kex, rsahost, sha1mac and rsasig, with matrix cells for both apps. lacking reads the app's libssh2 archive instead of the harness, since the app now names these methods. check-libssh2-algorithms.sh prints what a libs release dropped.
• 6 package strings in both catalogs. iOS has no changelog (apple/RELEASING.md, iOS).
• Changed test: SSHNegotiationFailureTests calls withoutPseudoMethods, the new name of clientMethods.

Test plan

• SSHServerProposalTests (new), SSHNegotiationFailureTests, LibSSH2NegotiationTests (scripted server offering the dropped methods to the shipped libssh2), iOS LibSSH2AuthenticationTests, SSHTunnelFactoryTests, SSHTunnelErrorClassifierTests.
• apple/scripts/probes/check-ssh-tunnel-matrix.sh with libs-5 against OpenSSH 10.3 and 9.9: 195 of 196 cells. ios/v10/30-clients-one-tunnel had client 17, then 21, of 30 reset at load averages of 41 and 28: the iOS listen backlog is 16, and this change does not touch the listener or relay.
• apple/scripts/probes/check-libssh2-algorithms.sh prints exactly the list above.

Docs: TableProApp/docs#121 (draft, lands after this).