mikrotik-backup/vendor/libssh2-sys/PROVENANCE.md

# Vendored libssh2 security backports

This directory contains the compilation sources of **libssh2-sys 0.3.3** from
crates.io, with narrowly scoped libssh2 security backports. The application uses
it through Cargo's `[patch.crates-io]` mechanism. It is not a new upstream release
and does not claim to be libssh2 1.11.2.

## Source identity and licensing

- Published package: <https://crates.io/crates/libssh2-sys/0.3.3>.
- Original archive: <https://static.crates.io/crates/libssh2-sys/libssh2-sys-0.3.3.crate>.
- Archive SHA-256: `0f5eb74291e8691cab524a01274a1b1e7742b1a94f29d8b101d8aadc8372c1cd`.
- Wrapper repository revision: `1abdbdb031cfea7e9e3dca7980ea36845bba1da8`.
- Bundled libssh2 revision: `090f23d1852a0b62e081bd12c4d05adc1c4af47a`.
- Wrapper license: `LICENSE-MIT` or `LICENSE-APACHE`, preserved verbatim.
- Native library license and additional notices: `libssh2/COPYING`,
  `libssh2/LICENSES/`, and the original source headers, preserved verbatim.

Only files needed by the original Cargo build and licenses were copied. Upstream
examples, CI files, manuals and unrelated build-system files are omitted. The
original Rust FFI source and C headers are unchanged. The small tests in this
directory are new regression checks for this distribution, licensed under MIT.

The published source is based on libssh2 1.11.1 and already includes backports for
CVE-2025-15661, CVE-2026-55199 and CVE-2026-55200, plus the SFTP status follow-up
`4ed26f5740bdd409269ed9fb48a28bf8f565b681`. Those fixes are retained.

## Additional patches

The unmodified upstream patch downloads are in `patches/upstream/`.
`patches/upstream-manifest.json` records each URL, full commit and SHA-256.

| Issue | Upstream commit | Change carried into the bundled code |
|---|---|---|
| CVE-2026-7598 | [256d04b60d80](https://github.com/libssh2/libssh2/commit/256d04b60d80bf1190e96b0ad1e91b2174d744b1) | Reject overflowing username lengths in authentication APIs; correct the password-change length comparison. |
| CVE-2026-66032 | [5e4776146552](https://github.com/libssh2/libssh2/commit/5e4776146552d898b9c0e1b313cd093fa8dc92d0) | Null the freed SFTP response pointer before waiting for a handle response. |
| CVE-2026-66033 | [a2ed82d40964](https://github.com/libssh2/libssh2/commit/a2ed82d40964bbc0d64cd717aa0a5a892117d2e6) | Apply AES-GCM bounds checks in release builds before computing the cipher length. |
| CVE-2026-66034 | [a13bb6c773f0](https://github.com/libssh2/libssh2/commit/a13bb6c773f0d55ad1628cede57e99803cd898d9) | Check remaining publickey response data before consuming a server-supplied comment length. |
| CVE-2026-66035 | [42e33d81577e](https://github.com/libssh2/libssh2/commit/42e33d81577ed4b95d4b4f6f845e5ee8efe5eeb4) | Reject an ETM packet too short for its MAC, length and first cipher block before decrypting. |
| CVE-2026-58050 | [34497525929b](https://github.com/libssh2/libssh2/commit/34497525929b9a47f03dfb81887ac896202b7e12) | Bound publickey attribute count to 1024 before multiplying for allocation. |
| CVE-2026-58051 | [a9758da45a52](https://github.com/libssh2/libssh2/commit/a9758da45a52bc8c630ec9493804d0c6ea30b24a) | Initialize newly allocated publickey list entries before error cleanup can inspect them. |
| Publickey cleanup follow-up | [c2f1a3a21b4c](https://github.com/libssh2/libssh2/commit/c2f1a3a21b4c922cbcf50bf7c009b740141a1e7a) | Initialize all new entries and free partially initialized attribute allocations. |
| Publickey terminator follow-up | [ad16eb112f4a](https://github.com/libssh2/libssh2/commit/ad16eb112f4a9591acdf5f6f2981328613e6b626) | Include the reserved terminator entry in zero-initialization. |

Upstream renamed private symbols after the bundled base revision. Backports use
the corresponding old `_libssh2_*` / `LIBSSH2_*` names and local formatting.
Upstream `SSH2_SAFEFREE(session, p->payload)` is represented by the equivalent
`LIBSSH2_FREE(session, p->payload); p->payload = NULL;`. The three publickey
initialization/cleanup patches are combined into their final corrected form.
These mechanical adaptations do not change their conditions or error codes.

## Reproducible patch and build selection

`patches/security-backports.patch` applies to an extracted, original 0.3.3 crate
with `patch -p1`. Its SHA-256 is:

```text
b6f970cfc5749e0ba35695b7d49b0774a191779d159a438249f9065ecc8a88bd
```

Replay was checked on a fresh copy: all seven modified files were byte-identical
to the shipped source. `SHA256SUMS` covers the shipped vendor files except the
checksum list itself. Verify it from this directory with `sha256sum -c SHA256SUMS`.

`build.rs` always compiles the bundled C source. It rejects
`LIBSSH2_SYS_USE_PKG_CONFIG`; automatic vcpkg fallback and the build-time Git
submodule command are removed. Source/header changes trigger a rebuild. This
prevents a local system libssh2 from silently replacing the corrected source.
OpenSSL and zlib remain the original supported backend dependencies. Their
operating-system packages require the usual security maintenance.

The wrapper manifest is marked `publish = false`; unused pkg-config/vcpkg direct
build dependencies are removed. All other wrapper features and dependencies are
preserved.

## Regression verification

After a Linux Cargo build, use the archive emitted by this exact path dependency:

```sh
vendor/libssh2-sys/tests/run-security-regressions.sh \
  /absolute/path/to/target/debug/build/libssh2-sys-<build-id>/out/build/libssh2.a
```

The test passes deliberately malformed short and oversized AES-GCM blocks and
overflowing username lengths, without a network connection. It requires a C
compiler and the OpenSSL/zlib development libraries used by the normal build.
The application integration tests separately exercise real SSH, SFTP, SCP,
configuration export and binary upload against a local SSH server.

The published `README.md` records which checks were actually run. A
clean RustSec report alone does not audit bundled C code, prove absence of other
vulnerabilities, or replace device testing.