dartssh2

What's Changed

• fix: stop offloading elliptic curve key exchange to isolates by @vicajilau in #227

Full Changelog: v3.3.0...v3.3.1

• Removed the background isolate offload from X25519 and NIST curve key exchange, which cost more than the work it was hiding. Generating an ephemeral key or computing the shared secret on these curves is one fixed-size scalar multiply, well under a millisecond, while Isolate.run takes several times that to spawn and tear down, and a client pays it twice per handshake. On a memory constrained Android device the spawn delay was long enough for the server to time out the key exchange and close the connection before SSH_MSG_NEWKEYS went out, surfacing as SSHAuthAbortError with a null reason [#226]. Thanks [@cesarcamps].
• Kept the offload for finite field Diffie-Hellman, which is the one exchange whose cost the peer controls: group exchange lets the server name a modulus of up to 8192 bits, and modular exponentiation grows steeply with it.
• Added debug logging around host key signature verification and the onVerifyHostKey callback. Everything between receiving the key exchange reply and sending SSH_MSG_NEWKEYS used to run without a single printDebug call, so a slow user callback and a slow shared secret were indistinguishable in a trace, and both looked like a hung handshake [#226].

What's Changed

• docs: document hostbased authentication in the README by @vicajilau in #220
• feat: deprecate SSHTransport.onPacket in favour of onMessage by @vicajilau in #221
• test: pin the request count of an SFTP download by @vicajilau in #222
• fix: report malformed packets as SSHPacketError, and fix readBytes on views by @vicajilau in #223
• ci: run interop tests against a local OpenSSH server by @vicajilau in #224
• test: build the interop server so its algorithms are known by @vicajilau in #225

Full Changelog: v3.2.0...v3.3.0

• Added SSHDisconnectError, so the reason the peer gave for terminating the connection reaches the caller. SSH_MSG_DISCONNECT carries a reason code and a description, which is where OpenSSH puts lines such as "no matching key exchange method found"; the transport used to log it and close cleanly, leaving an unexplained disconnection [#224].
• Fixed SSHMessageReader.readBytes() indexing the underlying buffer instead of the message, so it returned the wrong bytes whenever the message was a view into a larger buffer, which is what every SSH and SFTP payload is. Only OpenSSH private key decoding called it, on a freshly decoded blob where the two coincide, so nothing was broken in practice [#223].
• Changed malformed packets to raise SSHPacketError instead of RangeError or IndexError. Every decoder that parses peer-supplied bytes went through the latter, which are how Dart reports a bug in the caller: a handler catching SSHError missed them, and inside a stream callback they escaped as uncaught errors [#223].
• Deprecated SSHTransport.onPacket in favour of onMessage, which reports whether it recognized a message so the transport can answer unknown ones as RFC 4253 requires. onPacket keeps working [#221].
• Added interop tests that run a real dartssh2 client against a real OpenSSH server, forcing one algorithm per connection across the ciphers, key exchanges and MACs, plus a command and an SFTP round trip. Unit tests can only show the library agrees with itself, which is how the X11 screen number stayed a string until #194 [#224] [#225].
• Removed the last test helper pointing at infrastructure belonging to the previous maintainer's organisation. It was unused [#224].
• Added regression tests pinning how many requests an SFTP download costs, so a repeat of the 3.0.2 read size collapse fails a test rather than needing to be found by hand [#222].
• Documented hostbased authentication in the README, which 3.2.0 added without mentioning it anywhere outside the changelog [#220].

What's Changed

• Add hostbased authentication and methodsLeft handling by @GT-610 in #218
• Add OpenSSH ChaCha20-Poly1305 packet cipher by @GT-610 in #217
• Implement RFC-compliant SSH_MSG_UNIMPLEMENTED handling by @GT-610 in #216
• fix: limit SFTP packet sizes by @GT-610 in #215
• chore: release 3.2.0 by @vicajilau in #219

Full Changelog: v3.1.0...v3.2.0

• Added the [email protected] packet cipher, implemented as OpenSSH's own construction rather than the RFC 8439 AEAD: two independent ChaCha20 keys, a separately encrypted packet length, and Poly1305 over the raw encrypted length and body. It joins the default cipher list in third place, after the two AES-GCM variants, so it is negotiated with servers that do not offer AES-GCM [#217]. Thanks [@GT-610].
• Added RFC 4252 hostbased authentication through the asynchronous SSHIdentity API, with the new SSHClient.hostbasedIdentities, SSHClient.hostName and SSHClient.userNameOnClientHost options. The host key blob type is kept separate from the signature algorithm, so RSA SHA-2 signatures work [#218]. Thanks [@GT-610].
• Changed the authentication state machine to treat the server's methodsLeft as an allow-list while keeping the client's own preference order, to keep publickey and hostbased available only while identities remain, and to reset publickey state after a partial success, as OpenSSH does [#218]. Thanks [@GT-610].
• Added RFC 4253 SSH_MSG_UNIMPLEMENTED handling. Genuinely unrecognized messages are now reported with the rejected packet's own sequence number, while SSH_MSG_IGNORE, SSH_MSG_DEBUG and incoming SSH_MSG_UNIMPLEMENTED are consumed without creating reply loops. Unexpected messages during the initial strict key exchange disconnect, matching OpenSSH, while rekeys reply instead [#216]. Thanks [@GT-610].
• Added SSHTransport.onMessage, a handler that reports whether it recognized a message so the transport knows when to reply SSH_MSG_UNIMPLEMENTED. The existing onPacket keeps working unchanged and assumes every packet it receives is handled [#216]. Thanks [@GT-610].
• Added a 256 KiB limit on SFTP packets in both directions, matching SFTP_MAX_MSG_LENGTH in OpenSSH, with the four-byte length prefix excluded. Without it a peer could declare an arbitrarily large packet and make the client buffer indefinitely while waiting for a body that never arrives [#215]. Thanks [@GT-610].

What's Changed

• Create SECURITY.md by @vicajilau in #205
• Update dependabot.yml by @vicajilau in #206
• feat: mitigate Terrapin, harden default algorithms, and cover the crypto paths by @vicajilau in #207
• ci: restrict workflow permissions and point Dependabot at the manifest by @vicajilau in #208
• chore(deps): bump lints from 5.1.1 to 6.1.0 by @dependabot[bot] in #209
• Fix SSH channel window and open state handling by @GT-610 in #210
• fix: fail the channel, not the connection, on peer protocol violations by @vicajilau in #213
• Fix pending futures when SSH components terminate by @GT-610 in #212
• docs: reference the pull requests behind every 3.1.0 changelog entry by @vicajilau in #214

Full Changelog: v3.0.2...v3.1.0

• Fixed operations hanging forever when the component they were waiting on terminated. A channel request, a global request or a channel open whose reply could no longer arrive now fails with the error that ended the connection or the channel, instead of leaving the caller awaiting a reply that will never come [#212]. Thanks [@GT-610].
• Changed SSH_MSG_CHANNEL_CLOSE, channel destruction and transport termination to be terminal for pending replies, while SSH_MSG_CHANNEL_EOF remains non-terminal, since RFC 4254 allows request replies to arrive after EOF [#212]. Thanks [@GT-610].
• Fixed a channel stalling forever once a slow reader paused the stream: the receive window was never replenished after it reached zero, so the channel could not accept another byte for the rest of its life. This affected any slow consumer, such as an SFTP download or shell output [#210]. Thanks [@GT-610].
• Added the channel limits required by RFC 4254 §5.2: data beyond the advertised maximum packet size or beyond the remaining receive window is rejected, and a window adjustment that would overflow the 32-bit window is refused [#210]. Thanks [@GT-610].
• Changed a peer that breaks those limits to fail only the affected channel, raising the error on its stream so the caller finds out, while the connection and its other channels stay alive [#213]. Thanks [@vicajilau].
• Added rejection of unsolicited and duplicate channel open confirmations and failures, which used to be ignored [#210]. Thanks [@GT-610].
• Fixed channel identifiers leaking on a failed channel open, on an open still pending when the connection closed, and when sending the open request threw [#210]. Thanks [@GT-610].
• Added strict key exchange ([email protected]), the countermeasure against the Terrapin attack (CVE-2023-48795). It is negotiated automatically and, when the server supports it, packet sequence numbers are reset after every SSH_MSG_NEWKEYS, SSH_MSG_IGNORE / SSH_MSG_UNIMPLEMENTED / SSH_MSG_DEBUG are rejected during a key exchange, and the first SSH_MSG_KEXINIT is required to be the first packet of the connection. Exposed as SSHClient.strictKex [#207]. Thanks [@vicajilau].
• Added SSH_MSG_EXT_INFO support (RFC 8308). The client advertises ext-info-c and exposes the signature algorithms the server accepts as SSHClient.serverSigAlgs [#207]. Thanks [@vicajilau].
• Changed the default algorithm preferences. AES-GCM is now the preferred cipher instead of being opt-in, encrypt-then-MAC is preferred over encrypt-and-MAC, and ssh-rsa (SHA-1) is now last among the host key algorithms. CBC ciphers and hmac-sha1 remain available but are only reached when a server offers nothing better [#207]. Thanks [@vicajilau].
• Removed three broken algorithms from the defaults: diffie-hellman-group1-sha1 (1024-bit group), hmac-md5, and the truncated hmac-sha2-[256|512]-96 variants. They are still implemented and can be re-enabled by passing them to SSHAlgorithms explicitly [#207]. Thanks [@vicajilau].
• Fixed SSH_Message_Userauth_Request.decode() swapping the old and new password when decoding a password change request, contrary to RFC 4252 §8 [#207]. Thanks [@vicajilau].
• Fixed SSH_Message_Userauth_Request.decode() not reading the boolean that precedes the algorithm name in a publickey request (RFC 4252 §7), which misparsed every signed request and could not represent an unsigned probe [#207]. Thanks [@vicajilau].
• Added a SECURITY.md with a private vulnerability reporting process [#207]. Thanks [@vicajilau].
• Documented onVerifyHostKey in the README. Host key signatures were and are always verified, but deciding whether the key is the expected one is the caller's job, and omitting the handler accepts any host key [#207]. Thanks [@vicajilau].

What's Changed

• chore: point repository URLs at vicajilau/dartssh2 by @vicajilau in #202
• Register SFTP reply waiters before sending requests by @GT-610 in #199
• Fix NIST ECDH private scalar generation by @GT-610 in #201
• fix: retry short SFTP reads without collapsing the request size by @vicajilau in #203
• chore: follow the default branch rename from master to main by @vicajilau in #204

Full Changelog: v3.0.1...v3.0.2

• Fixed silent data loss in SFTP reads when a server returned fewer bytes than requested, which the protocol allows: the missing suffix is now retried instead of skipped, so SftpFile.read() and SftpClient.download() no longer return truncated, misaligned data [#200] [#203]. Thanks [@GT-610].
• Fixed NIST ECDH private scalar generation, which sampled only 65 bytes for P-521 and could therefore never set the 521st bit, and replaced the modulo reduction with rejection sampling for a uniform scalar in 1 <= x < n [#201]. Thanks [@GT-610].
• Changed SftpFile.read() to process pipelined read replies as they arrive while still emitting chunks ordered by file offset [#200]. Thanks [@GT-610].
• Changed SftpFile.read() to throw SftpError when a server returns more bytes than requested, instead of silently truncating the surplus [#200]. Thanks [@GT-610].
• Registered SFTP reply waiters before sending each request, so a reply can no longer be discarded by a channel that delivers it synchronously [#199]. Thanks [@GT-610].
• Limited SFTP read resizing to short replies of at least 512 bytes, so a single tiny reply no longer pins every later request to that floor for the rest of a transfer [#203].

What's Changed

• Fix SSHChannel.remoteChannelId by @GT-610 in #196
• Fix stdout error handling in runWithResult by @GT-610 in #195
• Use a cryptographically secure random source by @GT-610 in #193
• Fix X11 screen number encoding by @GT-610 in #194
• fix: propagate stderr stream errors in runWithResult and release 3.0.1 by @vicajilau in #197
• fix: derive the OpenSSH PEM check int from the secure random source by @vicajilau in #198

Full Changelog: v3.0.0...v3.0.1

• Fixed X11 forwarding by encoding and decoding the x11-req screen number as a uint32 instead of a string, as required by RFC 4254 §6.3 [#194]. Thanks [@GT-610].
• Fixed SSHChannel.remoteChannelId returning the local channel id instead of the id assigned by the peer [#196]. Thanks [@GT-610].
• Fixed SSHClient.run() and SSHClient.runWithResult() hanging forever when the stdout stream emitted an error, by routing stdout errors to the stdout completer [#195]. Thanks [@GT-610].
• Fixed SSHClient.run() and SSHClient.runWithResult() raising an uncaught error, instead of throwing to the caller, when the stderr stream emitted an error while stdout was still open. Both streams are now awaited together, and the session is closed on failure so the SSH channel is no longer leaked [#197].
• Switched SSH protocol randomness to a Random.secure() source and widened byte generation to the full 0x00-0xff range, covering key exchange cookies, ephemeral key exchange private values, and OpenSSH private key encryption seeds [#193]. Thanks [@GT-610].
• Switched the check int of OpenSSH private keys written by SSHKeyPair.toPem() to the same secure random source, removing the last insecure Random() usage in the library [#198].

What's Changed

• feat: support asynchronous external identities, RFC 4252 probing, and async close (#190) by @vicajilau in #192

Full Changelog: v2.22.5...v3.0.0

• BREAKING: Changed SSHClient.identities getter type from List<SSHKeyPair>? to List<SSHIdentity>? to support asynchronous external signers (OS agents, hardware tokens, smart cards, Secure Enclave, Android Keystore, and custom signers) [#190]. Constructor invocations passing List<SSHKeyPair> remain 100% source-compatible.
• BREAKING: Changed SSHClient.close() return type from void to Future<void> to allow awaiting complete socket and channel teardown.
• Added SSHIdentity abstraction, SSHRawHostKey, and SSHRawSignature with optional comment and shouldProbe properties [#190].
• Added support for Public-Key Probing (RFC 4252 §7.8) with SSH_Message_Userauth_PK_Ok and SSHIdentity.shouldProbe to check server key acceptance before requesting hardware token / user interaction.
• Exported src/ssh_identity.dart and src/ssh_hostkey.dart in lib/dartssh2.dart.

What's Changed

• fix: export ssh_userauth.dart in public API (#188) by @vicajilau in #189

Full Changelog: v2.22.4...v2.22.5

• Exported src/ssh_userauth.dart in lib/dartssh2.dart to expose SSHUserInfoRequest, SSHUserInfoPrompt, SSHAuthMethod, and SSHChangePasswordResponse [#188]. Thanks [@vicajilau].

What's Changed

• Advertise the RFC 8731 kex name curve25519-sha256 by @nickn17 in #187

New Contributors

• @nickn17 made their first contribution in #187

Full Changelog: v2.22.3...v2.22.4

• Advertised standard RFC 8731 key exchange name curve25519-sha256 alongside legacy [email protected] [#187]. Thanks [@nickn17].

What's Changed

• fix(sftp): close the underlying channel in SftpClient.close() by @keinstn in #186

New Contributors

• @keinstn made their first contribution in #186

Full Changelog: v2.22.2...v2.22.3

• Fixed an SSH channel leak in SftpClient.close() by closing the underlying SSH channel and returning Future<void> to allow awaiting channel teardown [#186]. Thanks [@keinstn].

• Added flush() to SSHSocket, SSHClient, and SSHChannel to allow force flushing of buffered outgoing data [#183]. Thanks [@vicajilau].

• Fixed a keepalive issue where overlapping pings could occur and caught errors during ping execution. Thanks [@vicajilau].

• Added optional handshakeTimeout and authTimeout to SSHClient to limit connection negotiation and user authentication times [#182]. Thanks [@GT-610].

• Fixed an SSHTransport busy-loop (100% CPU / ANR) that occurred when a partial packet remained in the read buffer [#179]. Thanks [@vicajilau].

• Added SSHSession.waitForExit({Duration? timeout}) to await remote process exit status with an optional timeout [#176]. Thanks [@GT-610].
• Hardened SOCKS5 dynamic forwarding (half-close streaming, dialing guards, timeout cancellation, malformed UTF-8 decoding, and buffer limits) [#175]. Thanks [@GT-610].
• Hardened SSH agent channel frame validation (rejecting empty or oversized frames) and fallback RSA signature type checks [#175]. Thanks [@GT-610].
• Improved EC private key parsing with proper ASN.1 OID curve detection, public point derivation validation, and robust comments decoding [#175]. Thanks [@GT-610].

• BREAKING: Bumped the minimum Dart SDK constraint to 3.0.0 [#23]. Thanks [@vicajilau].
• BREAKING: Declared OpenSSHKeyPair as a mixin class to comply with Dart 3.0 class modifier rules [#23]. Thanks [@vicajilau].
• Offloaded all cryptographic key exchange (KEX) calculations to background isolates using Isolate.run on platforms that support it, preventing the Flutter main thread from blocking/freezing during connection [#23]. Thanks [@vicajilau].
• Refactored internal key exchange isolate communication payloads (X25519, NIST Curves, DH) to use Dart 3.0 type-safe Records [#23]. Thanks [@vicajilau].

• Added tolerant HTTP-date parsing to accept all RFC 7231 §7.1.1.1 HTTP-date formats (IMF-fixdate, RFC 850, asctime) for HTTP response headers [#170]. Thanks [@GT-610].
• Added chunked transfer-encoding decoding for HTTP response bodies according to RFC 7230 §4.1, improving interoperability with HTTP/1.1 servers [#171]. Thanks [@GT-610].
• Added support for OpenSSH's [email protected] SFTP extension to perform atomic renames with POSIX semantics (replace destination if it exists) when advertised by the server [#172]. Thanks [@GT-610].
• Added SftpFile.downloadToRandomAccess to download a remote file directly into a dart:io RandomAccessFile using out-of-order pipelined writes, maximizing download performance on high-latency links [#173]. Thanks [@GT-610].
• Fixed a connection drop bug during AEAD (AES-GCM) decryption caused by incorrect padding length validation offset calculation [#168]. Thanks [@nuclear06].

• Fixed AES-GCM cipher encryption and decryption sequence number/nonce counter resetting during key exchanges [#165]. Thanks [@vicajilau].
• BREAKING: SSHHostkeyVerifyHandler now receives an OpenSSH-style SHA256:<base64> host key fingerprint instead of the previous raw MD5 digest, so host key pinning code must be updated accordingly [#162]. Thanks [@thyssentishman].

• Made SSHPem.decode accept CRLF (\r\n) line endings in addition to LF when parsing PEM content [#157]. Thanks [@gkc].

• Improved Web/WASM compatibility by updating SSHSocket conditional imports so web runtimes consistently use the web socket shim and avoid incorrect native socket selection [#88]. Thanks [@vicajilau].
• Added local dynamic forwarding (SSHClient.forwardDynamic) with SOCKS5 NO AUTH + CONNECT, including configurable handshake/connect timeouts and connection limits.
• Added AES-GCM ([email protected], [email protected]) AEAD groundwork in transport and cipher negotiation; currently opt-in (not enabled by default yet). [email protected] remains pending [#26]. Thanks [@vicajilau].

• BREAKING: Changed SSHChannelController.sendEnv() from void to Future<bool> to properly await environment variable setup responses and avoid race conditions with PTY requests [#102]. Thanks [@itzhoujun] and [@vicajilau].
• Clarified shell stdio wiring for CLI-only usage and guarded example/shell.dart against missing local terminal handles (for example GUI-launched Windows .exe) [#121]. Thanks [@bradmartin333] and [@vicajilau].
• Added support for parsing legacy unencrypted EC PRIVATE KEY PEM format in SSHKeyPair.fromPem [#109]. Thanks [@jooy2] and [@vicajilau].
• Added SSHClient.runWithResult() to expose command output together with exitCode and exitSignal while keeping run() as a convenience API [#99]. Thanks [@falrom] and [@vicajilau].
• Added non-breaking high-level SFTP download() / downloadTo() APIs and read pipeline tuning knobs (chunkSize, maxPendingRequests) for improved large-file throughput while preserving stream compatibility [#124]. Thanks [@vicajilau].
• Made SFTP directory/file name parsing tolerant to malformed UTF-8 bytes to avoid FormatException on non-UTF-8 server filenames [#95]. Thanks [@vicajilau].

• Updated pointycastle dependency to ^4.0.0 [#131]. Thanks [@vicajilau].
• Added foundational X11 forwarding support with session x11-req API, incoming x11 channel handling, and protocol tests [#1]. Thanks [@vicajilau].
• Exposed SSH ident configuration from SSHClient [#135]. Thanks [@Remulic] and [@vicajilau].
• Propagated the underlying exception in SSHAuthAbortError through reason for better diagnostics [#133]. Thanks [@james-thorpe] and [@vicajilau].
• Accepted SSH-1.99-* server banners as SSH-2 compatible during version exchange and added regression tests [#132]. Thanks [@james-thorpe] and [@vicajilau].
• Added SSH agent forwarding support ([email protected]) with in-memory agent handling and RSA sign-request flag support [#139]. Thanks [@Wackymax] and [@vicajilau].
• Normalized HTTP response line parsing in SSHHttpClientResponse to handle CRLF endings consistently and avoid trailing line-ending artifacts in parsed status/header fields [#145]. Thanks [@vicajilau].
• Fixed SFTP packet encoding/decoding consistency: SftpInitPacket.decode now parses extension pairs correctly and SftpExtendedReplyPacket.encode now preserves raw payload bytes [#145]. Thanks [@vicajilau].

• Fixed SSH connections through bastion hosts where the target server sends its version string immediately upon connection (which is standard behavior per RFC 4253) [#141]. Thanks [@shihuili1218].
• Adds a new forwardLocalUnix() function, which is an equivalent of ssh -L localPort:remoteSocketPath [#140]. Thanks [@isegal].

• docs: Update NoPorts naming [#115]. [@XavierChanth].
• Add parameter disableHostkeyVerification [#123]. Thanks [@alexander-irion].
• Add support for server initiated re-keying [#125]. Thanks [@MarBazuz].
• Add support for new algorithms "mac-sha2-256-96", "hmac-sha2-512-96", "[email protected]", "[email protected]" [#126] [#127]. Thanks [@reinbeumer].

• Fixed streams and channel not closing after receiving SSH_Message_Channel_Close [#116]. [@cbenhagen].
• Fixed lint issues.
• Added tests.
• Updated dependencies.

• Fixed Type 'Uint8' not found issue.

• Improved Readme.
• Bug fix in SftpFileWriter for [#50], [#71], [#100].
• Added DartShell product [#101].
• Fixed dynamic return on SftpFileOpenMode in | operator [#80].
• DCM updated.
• Fixed warnings related with new DCM version.
• Dependencies updated.
• Fixed Flutter 3.24 issue.

• Make the type of SSHForwardChannel.sink to StreamSink<List<int>> to match its super class.
• Added SSHHttpClient for easy http request forwarding.

• Better handling of channel close.
• Make SSHForwardChannel implement SSHSocket for better interoperability.

• Make SftpFileWriter implement Future<void> for backward compatibility.

• Export SftpFileWriter

• SftpFile.write now returns a SftpFileWriter that can be used to control the writing process.
• Support SftpClient.statvfs and SftpFile.statvfs.
• Support automatic keepalive.

• Update README.md
• Move cli into separate package.
• Properly handle chunk read error during stream read.

• Upgrade pinenacl to 0.5.0.
• Fix bug in exporting openssh private key to pem, thanks [@PIDAMI]

• Update README.md

• Update README.md

• Update README.md

• Upgrade rsa authentication algorithm to rsa-sha2-256.

• Support encrypted RSA format private key

• Allow username with @ in dartssh2 command [#24]

• Allow ignoring stdout or stderr in SSHClient.run.
• Add SSHAuthFailError and SSHAuthAbortError.
• Fix file type detection.
• Fix empty identity handling [#21]
• Add connection reset handing.
• Add more tests

• Fix js import path [#18].
• Ignore remote data after channel closed.

• Fix lint errors

• Remove unused dependencies
• Fix lint errors

• Fix null check error in kill() [#17]
• More examples in README.md

• More examples in README.md
• Limit the maximum size of channel packets

• Support session stdin streaming and EOF

• Support ssh v2 when version string does not contain CR [#14], thanks [@Migarl]

• Add remoteVersion field to SSHClient

• Add description field in SSHChannelOpenError

• Update README.md
• Support export keypair to PEM

• Update README.md
• Support loading OpenSSH encrypted pem files.

• Implements local port forwarding
• Implements remote port forwarding
• Implements SFTP client
• More supported algorithms
• Added dartsftp command

• Rework login logic.
• dartssh command now supports login with public key.

• dartssh command now supports terminal window resize.

• Fix typos.

• Organize exports.

• Dependency update.
• Sound null safety.
• Replace deprecated pedantic with package:lints
• Fix crash running vim by [@linhanyu]. [#1]