From 88f740cc94c403c16b45ccf2af566662476354e4 Mon Sep 17 00:00:00 2001 From: srstack Date: Fri, 31 Jul 2026 22:10:50 +0800 Subject: [PATCH] fix(pty): use openssl crypto backend on windows for curve25519 kex The windows build defaulted to libssh2's WinCNG backend, which only offers finite-field DH key exchange. Modern servers (OpenSSH >= 10) no longer accept those, failing with 'Unable to exchange encryption keys'. Enabling ssh2's openssl-on-win32 feature builds libssh2 against the already-vendored OpenSSL, restoring curve25519-sha256 and ecdh-sha2-nistp* offers. --- otty-pty/Cargo.toml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/otty-pty/Cargo.toml b/otty-pty/Cargo.toml index 269e8fa..cbca693 100644 --- a/otty-pty/Cargo.toml +++ b/otty-pty/Cargo.toml @@ -15,7 +15,10 @@ anyhow = { workspace = true } thiserror = { workspace = true } log = { workspace = true } mio = { workspace = true, features = ["os-ext", "net"] } -ssh2 = "0.9.5" +# `openssl-on-win32`: make the Windows build use the (vendored) OpenSSL +# crypto backend instead of WinCNG. WinCNG offers only finite-field DH key +# exchange, which modern servers (OpenSSH >= 10) no longer accept. +ssh2 = { version = "0.9.5", features = ["openssl-on-win32"] } # Force a statically-linked (vendored) OpenSSL build. The `ssh2` crate pulls in # `libssh2-sys` -> `openssl-sys`, which by default links the host's libssl. # Different Ubuntu releases ship incompatible sonames (libssl1.1 on 20.04,