[openssh-commits] [openssh] branch master updated (7e446d3f5 -> 4b5860ed2)

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

djm pushed a change to branch master
in repository openssh.

    from 7e446d3f5 upstream: Automatically detect IPv6 support
     new 1b23e24d2 upstream: use sshpkt_fatal instead of plain fatal() for errors in
     new 786cb6a14 upstream: ssh: implement mlkem768nistp256-sha256; ok djm@
     new ddbcd8ffd upstream: ssh: implement mlkem768brainpoolp256r1-sha256; ok djm@
     new 05000bc5e upstream: Fix double frees (impossible to reach outside of a test
     new 52154c2d2 upstream: Move check of public key type against allowed algorithms
     new 4b5860ed2 upstream: pass back errors from ed25519 key generation, which

The 6 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails.  The revisions
listed as "add" were already present in the repository and have only
been added to this reference.


Detailed log of new commits:

commit 4b5860ed27f758c9d8156714cbd8a62562420907
Author: djm at openbsd.org <djm at openbsd.org>
Date:   Thu Jul 30 03:39:39 2026 +0000

    upstream: pass back errors from ed25519 key generation, which
    
    theoretically can fail. From Dimitri John Ledkov via GHPR702.
    
    ok deraadt@ dtucker@
    
    OpenBSD-Commit-ID: 1ecdd981c3f89393092949ff5e96662946fc5040

commit 52154c2d232de1d5a161cb900bdb0792043ae142
Author: djm at openbsd.org <djm at openbsd.org>
Date:   Thu Jul 30 03:37:39 2026 +0000

    upstream: Move check of public key type against allowed algorithms
    
    to before parsing of the key sent by the peer.
    
    This removes at least some key parsing and verification paths from
    the pre-auth attack surface.
    
    Suggested by Christopher Paul Rohlf of Anthropic, ok deraadt@
    
    OpenBSD-Commit-ID: 4560b53b5cd2fe9b875436e48995a1829c2a9dea

commit 05000bc5ea80485540bac655f83b65d7f868af11
Author: deraadt at openbsd.org <deraadt at openbsd.org>
Date:   Thu Jul 30 03:13:34 2026 +0000

    upstream: Fix double frees (impossible to reach outside of a test
    
    harness), and also use freezero where possible from Christopher Paul Rohlf at
    Anthropic ok djm
    
    OpenBSD-Commit-ID: 50227bff4ffd4a93aad399f21fc20f1c3cbf2c69

commit ddbcd8ffdabeeb04955ea187739904a52f09c8c9
Author: markus at openbsd.org <markus at openbsd.org>
Date:   Mon Jul 27 12:31:09 2026 +0000

    upstream: ssh: implement mlkem768brainpoolp256r1-sha256; ok djm@
    
    OpenBSD-Commit-ID: 99a304085f96d9a595b326c06694290c5612620c

commit 786cb6a14cede4c1bfcf7a1989b53c9a28c8bee4
Author: markus at openbsd.org <markus at openbsd.org>
Date:   Mon Jul 27 12:28:52 2026 +0000

    upstream: ssh: implement mlkem768nistp256-sha256; ok djm@
    
    OpenBSD-Commit-ID: f5daafce2fcb44684606197873dab4cd189524a9

commit 1b23e24d21238f49d362b4304625dace6afbd4eb
Author: djm at openbsd.org <djm at openbsd.org>
Date:   Thu Jul 23 06:33:06 2026 +0000

    upstream: use sshpkt_fatal instead of plain fatal() for errors in
    
    the packet code as this provides context of the failing peer (address, port,
    user, etc). Based on patch from Dag-Erling Smørgrav
    MIME-Version: 1.0
    Content-Type: text/plain; charset=UTF-8
    Content-Transfer-Encoding: 8bit
    
    OpenBSD-Commit-ID: 2e50ab08ab697722230f5d7dbebc9ea3c4f2931b

Summary of changes:
 Makefile.in                              |   2 +-
 auth2-hostbased.c                        |  13 +--
 auth2-pubkey.c                           |  12 +--
 kex-names.c                              |   8 +-
 kex.h                                    |  14 ++-
 kexecdh.c                                |   8 +-
 kexgen.c                                 |  13 ++-
 kexmlkem768x25519.c => kexmlkem768ecdh.c | 168 +++++++++++++++++++------------
 monitor.c                                |   3 +-
 packet.c                                 |   6 +-
 ssh-ed25519.c                            |   5 +-
 ssh-keyscan.c                            |   3 +-
 ssh-mldsa-eddsa.c                        |   9 +-
 ssh_api.c                                |   4 +-
 sshconnect2.c                            |   3 +-
 sshd-auth.c                              |   3 +-
 16 files changed, 176 insertions(+), 98 deletions(-)
 copy kexmlkem768x25519.c => kexmlkem768ecdh.c (64%)

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.