mention sntrup761x25519-sha512 in manpages

Spotted by Colin Watson
back out unrelated manpages changes
2025-08-13 09:20:19 +10:00 · 2025-08-13 09:19:53 +10:00 · 2025-08-11 16:40:24 +10:00 · 2024-07-11 08:30:18 +10:00 · 2024-07-07 18:47:54 +10:00 · 2024-07-04 20:12:26 +10:00
8 changed files with 21 additions and 2 deletions
@@ -6,6 +6,10 @@ master :
 [![Fuzzing Status](https://oss-fuzz-build-logs.storage.googleapis.com/badges/openssh.svg)](https://bugs.chromium.org/p/oss-fuzz/issues/list?sort=-opened&can=1&q=proj:openssh)
 [![Coverity Status](https://scan.coverity.com/projects/21341/badge.svg)](https://scan.coverity.com/projects/openssh-portable)

+9.8 :
+[![C/C++ CI](https://github.com/openssh/openssh-portable/actions/workflows/c-cpp.yml/badge.svg?branch=V_9_8)](https://github.com/openssh/openssh-portable/actions/workflows/c-cpp.yml?query=branch:V_9_8)
+[![C/C++ CI self-hosted](https://github.com/openssh/openssh-portable-selfhosted/actions/workflows/selfhosted.yml/badge.svg?branch=V_9_8)](https://github.com/openssh/openssh-portable-selfhosted/actions/workflows/selfhosted.yml?query=branch:V_9_8)
+
 9.7 :
 [![C/C++ CI](https://github.com/openssh/openssh-portable/actions/workflows/c-cpp.yml/badge.svg?branch=V_9_7)](https://github.com/openssh/openssh-portable/actions/workflows/c-cpp.yml?query=branch:V_9_7)
 [![C/C++ CI self-hosted](https://github.com/openssh/openssh-portable-selfhosted/actions/workflows/selfhosted.yml/badge.svg?branch=V_9_7)](https://github.com/openssh/openssh-portable-selfhosted/actions/workflows/selfhosted.yml?query=branch:V_9_7)
@@ -1348,6 +1348,13 @@ EOD
 	AC_DEFINE([BROKEN_SETVBUF], [1],
 	    [LynxOS has broken setvbuf() implementation])
 	;;
+*-*-gnu*)
+	dnl GNU Hurd.  Needs to be after the linux and the other *-gnu entries.
+	dnl Target SUSv3/POSIX.1-2001 plus BSD specifics.
+	dnl _DEFAULT_SOURCE is the new name for _BSD_SOURCE
+	dnl _GNU_SOURCE is needed for setres*id prototypes.
+	CPPFLAGS="$CPPFLAGS -D_XOPEN_SOURCE=600 -D_BSD_SOURCE -D_DEFAULT_SOURCE -D_GNU_SOURCE"
+	;;
 esac

 AC_MSG_CHECKING([compiler and flags for sanity])
@@ -77,6 +77,8 @@ static const struct kexalg kexalgs[] = {
 	{ KEX_CURVE25519_SHA256, KEX_C25519_SHA256, 0, SSH_DIGEST_SHA256 },
 	{ KEX_CURVE25519_SHA256_OLD, KEX_C25519_SHA256, 0, SSH_DIGEST_SHA256 },
 #ifdef USE_SNTRUP761X25519
+	{ KEX_SNTRUP761X25519_SHA512_IANA, KEX_KEM_SNTRUP761X25519_SHA512, 0,
+	    SSH_DIGEST_SHA512 },
 	{ KEX_SNTRUP761X25519_SHA512, KEX_KEM_SNTRUP761X25519_SHA512, 0,
 	    SSH_DIGEST_SHA512 },
 #endif
@@ -63,6 +63,7 @@
 #define	KEX_CURVE25519_SHA256		"curve25519-sha256"
 #define	KEX_CURVE25519_SHA256_OLD	"[email protected]"
 #define	KEX_SNTRUP761X25519_SHA512	"[email protected]"
+#define	KEX_SNTRUP761X25519_SHA512_IANA	"sntrup761x25519-sha512"

 #define COMP_NONE	0
 /* pre-auth compression (COMP_ZLIB) is only supported in the client */
@@ -25,6 +25,7 @@
 */

 #define KEX_SERVER_KEX	\
+	"sntrup761x25519-sha512," \
 	"[email protected]," \
 	"curve25519-sha256," \
 	"[email protected]," \
@@ -366,7 +366,7 @@ ssh_systemd_notify(const char *fmt, ...)
 		error_f("socket \"%s\": %s", path, strerror(errno));
 		goto out;
 	}
-	if (connect(fd, &addr, sizeof(addr)) != 0) {
+	if (connect(fd, (struct sockaddr *)&addr, sizeof(addr)) != 0) {
 		error_f("socket \"%s\" connect: %s", path, strerror(errno));
 		goto out;
 	}
@@ -1281,6 +1281,7 @@ default set.
 .Pp
 The default is:
 .Bd -literal -offset indent
+sntrup761x25519-sha512,
 [email protected],
 curve25519-sha256,[email protected],
 ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,
@@ -1050,11 +1050,14 @@ ecdh-sha2-nistp384
 .It
 ecdh-sha2-nistp521
 .It
+sntrup761x25519-sha512
+.It
 [email protected]
 .El
 .Pp
 The default is:
 .Bd -literal -offset indent
+sntrup761x25519-sha512,
 [email protected],
 curve25519-sha256,[email protected],
 ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,
@@ -1586,7 +1589,7 @@ accumulated.
 .Pp
 Penalties are enabled by default with the default settings listed below
 but may disabled using the
-.Cm off
+.Cm no
 keyword.
 The defaults may be overridden by specifying one or more of the keywords below,
 separated by whitespace.
Author	SHA1	Message	Date
Damien Miller	a38b48e77c	mention sntrup761x25519-sha512 in manpages Spotted by Colin Watson	2025-08-13 09:20:19 +10:00
Damien Miller	d1460a1774	back out unrelated manpages changes spotted by Colin Wilson	2025-08-13 09:19:53 +10:00
Damien Miller	26f73db15e	support sntrup761x25519-sha512 alias OpenSSH 9.8 supports the [email protected] key agreement algorithm. As part of standardisation, this algorithm has been assigned the name sntrup761x25519-sha512. This commit enables the existing algorithm under this new name.	2025-08-11 16:40:24 +10:00
[email protected]	c21fc9d953	upstream: correct keyword; from Yatao Su via GHPR509 OpenBSD-Commit-ID: 81c778c76dea7ef407603caa157eb0c381c52ad2	2024-07-11 08:30:18 +10:00
Darren Tucker	b35a64dd7d	Cast to sockaddr * in systemd interface. Fixes build with musl libx. bz#3707.	2024-07-07 18:47:54 +10:00
Darren Tucker	34f7a962f9	Add 9.8 branch to ci-status page.	2024-07-04 20:12:26 +10:00
Samuel Thibault	20950a7c04	Fix detection of setresid on GNU/Hurd Like Linux, proper _SOURCE macros need to be set to get declarations of various standard functions, notably setresid. Now that Debian is using -Werror=implicit-function-declaration this is really required. While at it, define other _SOURCE macros like on GNU/Linux, since GNU/Hurd uses the same glibc.	2024-07-03 19:25:07 +10:00