You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@mina.apache.org by lg...@apache.org on 2021/04/01 15:51:28 UTC
[mina-sshd] branch master updated: [SSHD-1136] Use configuration
property to decide whether to allow fallback to DH group exchange using
SHA-1 if no suitable primes found for SHA-256
This is an automated email from the ASF dual-hosted git repository.
lgoldstein pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/mina-sshd.git
The following commit(s) were added to refs/heads/master by this push:
new 595c791 [SSHD-1136] Use configuration property to decide whether to allow fallback to DH group exchange using SHA-1 if no suitable primes found for SHA-256
595c791 is described below
commit 595c7911e9aa5407dbd3f7c5dc837beba7c43834
Author: Lyor Goldstein <lg...@apache.org>
AuthorDate: Thu Apr 1 18:27:46 2021 +0300
[SSHD-1136] Use configuration property to decide whether to allow fallback to DH group exchange using SHA-1 if no suitable primes found for SHA-256
---
CHANGES.md | 1 +
.../main/java/org/apache/sshd/core/CoreModuleProperties.java | 6 ++++++
.../src/main/java/org/apache/sshd/server/kex/DHGEXServer.java | 10 +++++++++-
3 files changed, 16 insertions(+), 1 deletion(-)
diff --git a/CHANGES.md b/CHANGES.md
index 8cf7dc8..4681c75 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -54,5 +54,6 @@
* [SSHD-1133](https://issues.apache.org/jira/browse/SSHD-1133) Added capability to specify a custom charset for parsing incoming commands to the `ScpShell`
* [SSHD-1133](https://issues.apache.org/jira/browse/SSHD-1133) Added capability to specify a custom charset for returning environment variables related data from the `ScpShell`
* [SSHD-1133](https://issues.apache.org/jira/browse/SSHD-1133) Added capability to specify a custom charset for handling the SCP protocol textual commands and responses
+* [SSHD-1136](https://issues.apache.org/jira/browse/SSHD-1136) Use configuration property to decide whether to allow fallback to DH group exchange using SHA-1 if no suitable primes found for SHA-256
* [SSHD-1137](https://issues.apache.org/jira/browse/SSHD-1137) Added capability to override LinkOption(s) when accessing a file/folder via SFTP
* [SSHD-1147](https://issues.apache.org/jira/browse/SSHD-1147) SftpInputStreamAsync: get file size before SSH_FXP_OPEN
\ No newline at end of file
diff --git a/sshd-core/src/main/java/org/apache/sshd/core/CoreModuleProperties.java b/sshd-core/src/main/java/org/apache/sshd/core/CoreModuleProperties.java
index 062166d..9a21d72 100644
--- a/sshd-core/src/main/java/org/apache/sshd/core/CoreModuleProperties.java
+++ b/sshd-core/src/main/java/org/apache/sshd/core/CoreModuleProperties.java
@@ -131,6 +131,12 @@ public final class CoreModuleProperties {
= Property.bool("send-immediate-kex-init", true);
/**
+ * Whether allowed to fall back to DH group with SHA-1 KEX if exhausted all available primes for SHA-256
+ */
+ public static final Property<Boolean> ALLOW_DHG1_KEX_FALLBACK
+ = Property.bool("allow-dhg1-kex-fallback", false);
+
+ /**
* Key used to set the heartbeat interval in milliseconds (0 to disable = default)
*/
public static final Property<Duration> HEARTBEAT_INTERVAL
diff --git a/sshd-core/src/main/java/org/apache/sshd/server/kex/DHGEXServer.java b/sshd-core/src/main/java/org/apache/sshd/server/kex/DHGEXServer.java
index 34c2e9d..bda216b 100644
--- a/sshd-core/src/main/java/org/apache/sshd/server/kex/DHGEXServer.java
+++ b/sshd-core/src/main/java/org/apache/sshd/server/kex/DHGEXServer.java
@@ -274,7 +274,15 @@ public class DHGEXServer extends AbstractDHServerKeyExchange {
List<Moduli.DhGroup> groups = loadModuliGroups(session);
List<Moduli.DhGroup> selected = selectModuliGroups(session, min, prf, max, groups);
if (GenericUtils.isEmpty(selected)) {
- log.warn("chooseDH({})[{}][prf={}, min={}, max={}] No suitable primes found, defaulting to DHG1",
+ if (!CoreModuleProperties.ALLOW_DHG1_KEX_FALLBACK.getRequired(session)) {
+ log.error("chooseDH({})[{}][prf={}, min={}, max={}] No suitable primes found - failing",
+ this, session, prf, min, max);
+ throw new SshException(
+ SshConstants.SSH2_DISCONNECT_KEY_EXCHANGE_FAILED,
+ "No suitable primes found for DH group exchange");
+ }
+
+ log.warn("chooseDH({})[{}][prf={}, min={}, max={}] No suitable primes found - defaulting to DHG1",
this, session, prf, min, max);
return getDH(new BigInteger(DHGroupData.getP1()), new BigInteger(DHGroupData.getG()));
}