You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@mina.apache.org by tw...@apache.org on 2021/10/23 23:05:52 UTC
[mina-sshd] branch master updated (956dcbb -> 2e5e873)
This is an automated email from the ASF dual-hosted git repository.
twolf pushed a change to branch master
in repository https://gitbox.apache.org/repos/asf/mina-sshd.git.
from 956dcbb Set output and input encodings separately at end of KEX
new 445dea2 UserAuthPublicKey: make creating the key iterator overrideable
new 14b4ec0 [SSHD-1218] Pass session to SshAgentFactory.createClient()
new fc03c20 [SSHD-1218] Handle null SshAgent
new 12e0b3a [SSHD-1218] Use SSH agent only if allowed to
new 2e5e873 [SSHD-1219] RSA SHA2 signing via SSH agent
The 5 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
.../org/apache/sshd/agent/SshAgentFactory.java | 6 +++--
.../sshd/agent/common/AbstractAgentProxy.java | 28 ++++++++++++++++++++--
.../sshd/agent/local/ChannelAgentForwarding.java | 2 +-
.../apache/sshd/agent/local/LocalAgentFactory.java | 3 ++-
.../apache/sshd/agent/local/ProxyAgentFactory.java | 2 +-
.../apache/sshd/agent/unix/UnixAgentFactory.java | 2 +-
.../java/org/apache/sshd/client/SshClient.java | 2 ++
.../sshd/client/auth/pubkey/UserAuthPublicKey.java | 14 ++++++++++-
.../auth/pubkey/UserAuthPublicKeyIterator.java | 13 ++++++----
.../org/apache/sshd/deprecated/UserAuthAgent.java | 2 +-
10 files changed, 60 insertions(+), 14 deletions(-)
[mina-sshd] 04/05: [SSHD-1218] Use SSH agent only if allowed to
Posted by tw...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
twolf pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/mina-sshd.git
commit 12e0b3a6ce441827fdd27f9010f9b19853901744
Author: Thomas Wolf <tw...@apache.org>
AuthorDate: Sat Oct 23 23:43:48 2021 +0200
[SSHD-1218] Use SSH agent only if allowed to
If no default identities are to be used (which is determined by
HostConfigEntry.isIdentitiesOnly()), don't use the SSH agent in
publickey authentication.
---
sshd-core/src/main/java/org/apache/sshd/client/SshClient.java | 2 ++
.../org/apache/sshd/client/auth/pubkey/UserAuthPublicKey.java | 7 +++++++
.../apache/sshd/client/auth/pubkey/UserAuthPublicKeyIterator.java | 8 +++++---
3 files changed, 14 insertions(+), 3 deletions(-)
diff --git a/sshd-core/src/main/java/org/apache/sshd/client/SshClient.java b/sshd-core/src/main/java/org/apache/sshd/client/SshClient.java
index a00954c..015ded1 100644
--- a/sshd-core/src/main/java/org/apache/sshd/client/SshClient.java
+++ b/sshd-core/src/main/java/org/apache/sshd/client/SshClient.java
@@ -51,6 +51,7 @@ import org.apache.sshd.client.auth.password.PasswordAuthenticationReporter;
import org.apache.sshd.client.auth.password.PasswordIdentityProvider;
import org.apache.sshd.client.auth.password.UserAuthPasswordFactory;
import org.apache.sshd.client.auth.pubkey.PublicKeyAuthenticationReporter;
+import org.apache.sshd.client.auth.pubkey.UserAuthPublicKey;
import org.apache.sshd.client.auth.pubkey.UserAuthPublicKeyFactory;
import org.apache.sshd.client.config.hosts.HostConfigEntry;
import org.apache.sshd.client.config.hosts.HostConfigEntryResolver;
@@ -739,6 +740,7 @@ public class SshClient extends AbstractFactoryManager implements ClientFactoryMa
AbstractClientSession session = (AbstractClientSession) AbstractSession.getSession(ioSession);
session.setUsername(username);
session.setConnectAddress(address);
+ session.setAttribute(UserAuthPublicKey.USE_DEFAULT_IDENTITIES, Boolean.valueOf(useDefaultIdentities));
if (useDefaultIdentities) {
setupDefaultSessionIdentities(session, identities);
diff --git a/sshd-core/src/main/java/org/apache/sshd/client/auth/pubkey/UserAuthPublicKey.java b/sshd-core/src/main/java/org/apache/sshd/client/auth/pubkey/UserAuthPublicKey.java
index ec0d697..6ec8da5 100644
--- a/sshd-core/src/main/java/org/apache/sshd/client/auth/pubkey/UserAuthPublicKey.java
+++ b/sshd-core/src/main/java/org/apache/sshd/client/auth/pubkey/UserAuthPublicKey.java
@@ -34,6 +34,7 @@ import java.util.TreeSet;
import org.apache.sshd.client.auth.AbstractUserAuth;
import org.apache.sshd.client.auth.keyboard.UserInteraction;
import org.apache.sshd.client.session.ClientSession;
+import org.apache.sshd.common.AttributeRepository.AttributeKey;
import org.apache.sshd.common.NamedFactory;
import org.apache.sshd.common.RuntimeSshException;
import org.apache.sshd.common.SshConstants;
@@ -57,6 +58,12 @@ import org.apache.sshd.common.util.buffer.ByteArrayBuffer;
public class UserAuthPublicKey extends AbstractUserAuth implements SignatureFactoriesManager {
public static final String NAME = UserAuthPublicKeyFactory.NAME;
+ /**
+ * Is set on a {@link ClientSession} when it is created; if {@link Boolean#FALSE}, no agent or default identities
+ * shall be used.
+ */
+ public static final AttributeKey<Boolean> USE_DEFAULT_IDENTITIES = new AttributeKey<>();
+
protected final Deque<String> currentAlgorithms = new LinkedList<>();
protected Iterator<PublicKeyIdentity> keys;
diff --git a/sshd-core/src/main/java/org/apache/sshd/client/auth/pubkey/UserAuthPublicKeyIterator.java b/sshd-core/src/main/java/org/apache/sshd/client/auth/pubkey/UserAuthPublicKeyIterator.java
index 970aa7d..7240f55 100644
--- a/sshd-core/src/main/java/org/apache/sshd/client/auth/pubkey/UserAuthPublicKeyIterator.java
+++ b/sshd-core/src/main/java/org/apache/sshd/client/auth/pubkey/UserAuthPublicKeyIterator.java
@@ -56,9 +56,11 @@ public class UserAuthPublicKeyIterator extends AbstractKeyPairIterator<PublicKey
try {
Collection<Iterable<? extends PublicKeyIdentity>> identities = new ArrayList<>(2);
- Iterable<? extends PublicKeyIdentity> agentIds = initializeAgentIdentities(session);
- if (agentIds != null) {
- identities.add(agentIds);
+ if (Boolean.TRUE.equals(session.getAttribute(UserAuthPublicKey.USE_DEFAULT_IDENTITIES))) {
+ Iterable<? extends PublicKeyIdentity> agentIds = initializeAgentIdentities(session);
+ if (agentIds != null) {
+ identities.add(agentIds);
+ }
}
Iterable<? extends PublicKeyIdentity> sessionIds = initializeSessionIdentities(session, signatureFactories);
[mina-sshd] 03/05: [SSHD-1218] Handle null SshAgent
Posted by tw...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
twolf pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/mina-sshd.git
commit fc03c20c28da5833b8d46d9680a5da57de61dfae
Author: Thomas Wolf <tw...@apache.org>
AuthorDate: Sat Oct 23 21:01:35 2021 +0200
[SSHD-1218] Handle null SshAgent
Don't require a non-null result from SshAgentFactory.createClient().
Instead simply treat this case as if there was no SSH agent. This way,
an SshAgentFactory can return null if for a particular session no
communication with the SSH agent shall be done.
---
sshd-core/src/main/java/org/apache/sshd/agent/SshAgentFactory.java | 2 +-
.../apache/sshd/client/auth/pubkey/UserAuthPublicKeyIterator.java | 5 ++++-
2 files changed, 5 insertions(+), 2 deletions(-)
diff --git a/sshd-core/src/main/java/org/apache/sshd/agent/SshAgentFactory.java b/sshd-core/src/main/java/org/apache/sshd/agent/SshAgentFactory.java
index a0e6fe2..a528d58 100644
--- a/sshd-core/src/main/java/org/apache/sshd/agent/SshAgentFactory.java
+++ b/sshd-core/src/main/java/org/apache/sshd/agent/SshAgentFactory.java
@@ -45,7 +45,7 @@ public interface SshAgentFactory {
*
* @param session the {@link Session} the {@link SshAgent} is to be created for; may be {@code null}
* @param manager The {@link FactoryManager} instance
- * @return The {@link SshAgent} instance
+ * @return The {@link SshAgent} instance, or {@code null} if no SSH agent shall be used
* @throws IOException If failed to create the client
*/
SshAgent createClient(Session session, FactoryManager manager) throws IOException;
diff --git a/sshd-core/src/main/java/org/apache/sshd/client/auth/pubkey/UserAuthPublicKeyIterator.java b/sshd-core/src/main/java/org/apache/sshd/client/auth/pubkey/UserAuthPublicKeyIterator.java
index 09555f1..970aa7d 100644
--- a/sshd-core/src/main/java/org/apache/sshd/client/auth/pubkey/UserAuthPublicKeyIterator.java
+++ b/sshd-core/src/main/java/org/apache/sshd/client/auth/pubkey/UserAuthPublicKeyIterator.java
@@ -147,7 +147,10 @@ public class UserAuthPublicKeyIterator extends AbstractKeyPairIterator<PublicKey
return null;
}
- agent = Objects.requireNonNull(factory.createClient(session, manager), "No agent created");
+ agent = factory.createClient(session, manager);
+ if (agent == null) {
+ return null;
+ }
return new Iterable<KeyAgentIdentity>() {
@SuppressWarnings("synthetic-access")
private final Iterable<? extends Map.Entry<PublicKey, String>> agentIds = agent.getIdentities();
[mina-sshd] 02/05: [SSHD-1218] Pass session to
SshAgentFactory.createClient()
Posted by tw...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
twolf pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/mina-sshd.git
commit 14b4ec07e2bfa7fccc6a053846b0bc4cd5d0fddf
Author: Thomas Wolf <tw...@apache.org>
AuthorDate: Sat Oct 23 20:57:15 2021 +0200
[SSHD-1218] Pass session to SshAgentFactory.createClient()
This enables the factory to return different SshAgents depending on the
session and its configuration.
---
sshd-core/src/main/java/org/apache/sshd/agent/SshAgentFactory.java | 4 +++-
.../main/java/org/apache/sshd/agent/local/ChannelAgentForwarding.java | 2 +-
.../src/main/java/org/apache/sshd/agent/local/LocalAgentFactory.java | 3 ++-
.../src/main/java/org/apache/sshd/agent/local/ProxyAgentFactory.java | 2 +-
.../src/main/java/org/apache/sshd/agent/unix/UnixAgentFactory.java | 2 +-
.../org/apache/sshd/client/auth/pubkey/UserAuthPublicKeyIterator.java | 2 +-
sshd-core/src/test/java/org/apache/sshd/deprecated/UserAuthAgent.java | 2 +-
7 files changed, 10 insertions(+), 7 deletions(-)
diff --git a/sshd-core/src/main/java/org/apache/sshd/agent/SshAgentFactory.java b/sshd-core/src/main/java/org/apache/sshd/agent/SshAgentFactory.java
index bc391cf..a0e6fe2 100644
--- a/sshd-core/src/main/java/org/apache/sshd/agent/SshAgentFactory.java
+++ b/sshd-core/src/main/java/org/apache/sshd/agent/SshAgentFactory.java
@@ -24,6 +24,7 @@ import java.util.List;
import org.apache.sshd.common.FactoryManager;
import org.apache.sshd.common.channel.ChannelFactory;
import org.apache.sshd.common.session.ConnectionService;
+import org.apache.sshd.common.session.Session;
/**
* The <code>SshAgentFactory</code> is used to communicate with an SshAgent.
@@ -42,11 +43,12 @@ public interface SshAgentFactory {
/**
* Create an SshAgent that can be used on the client side by the authentication process to send possible keys.
*
+ * @param session the {@link Session} the {@link SshAgent} is to be created for; may be {@code null}
* @param manager The {@link FactoryManager} instance
* @return The {@link SshAgent} instance
* @throws IOException If failed to create the client
*/
- SshAgent createClient(FactoryManager manager) throws IOException;
+ SshAgent createClient(Session session, FactoryManager manager) throws IOException;
/**
* Create the server side that will be used by other SSH clients. It will usually create a channel that will forward
diff --git a/sshd-core/src/main/java/org/apache/sshd/agent/local/ChannelAgentForwarding.java b/sshd-core/src/main/java/org/apache/sshd/agent/local/ChannelAgentForwarding.java
index a91b1a2..e5f73af 100644
--- a/sshd-core/src/main/java/org/apache/sshd/agent/local/ChannelAgentForwarding.java
+++ b/sshd-core/src/main/java/org/apache/sshd/agent/local/ChannelAgentForwarding.java
@@ -63,7 +63,7 @@ public class ChannelAgentForwarding extends AbstractServerChannel {
Session session = getSession();
FactoryManager manager = Objects.requireNonNull(session.getFactoryManager(), "No factory manager");
SshAgentFactory factory = Objects.requireNonNull(manager.getAgentFactory(), "No agent factory");
- agent = factory.createClient(manager);
+ agent = factory.createClient(session, manager);
client = new AgentClient();
signalChannelOpenSuccess();
diff --git a/sshd-core/src/main/java/org/apache/sshd/agent/local/LocalAgentFactory.java b/sshd-core/src/main/java/org/apache/sshd/agent/local/LocalAgentFactory.java
index 18ffe60..cbdd861 100644
--- a/sshd-core/src/main/java/org/apache/sshd/agent/local/LocalAgentFactory.java
+++ b/sshd-core/src/main/java/org/apache/sshd/agent/local/LocalAgentFactory.java
@@ -30,6 +30,7 @@ import org.apache.sshd.agent.common.AgentDelegate;
import org.apache.sshd.common.FactoryManager;
import org.apache.sshd.common.channel.ChannelFactory;
import org.apache.sshd.common.session.ConnectionService;
+import org.apache.sshd.common.session.Session;
public class LocalAgentFactory implements SshAgentFactory {
public static final List<ChannelFactory> DEFAULT_FORWARDING_CHANNELS = Collections.unmodifiableList(
@@ -57,7 +58,7 @@ public class LocalAgentFactory implements SshAgentFactory {
}
@Override
- public SshAgent createClient(FactoryManager manager) throws IOException {
+ public SshAgent createClient(Session session, FactoryManager manager) throws IOException {
return new AgentDelegate(agent);
}
diff --git a/sshd-core/src/main/java/org/apache/sshd/agent/local/ProxyAgentFactory.java b/sshd-core/src/main/java/org/apache/sshd/agent/local/ProxyAgentFactory.java
index ffde9af..178bf7e 100644
--- a/sshd-core/src/main/java/org/apache/sshd/agent/local/ProxyAgentFactory.java
+++ b/sshd-core/src/main/java/org/apache/sshd/agent/local/ProxyAgentFactory.java
@@ -57,7 +57,7 @@ public class ProxyAgentFactory implements SshAgentFactory {
}
@Override
- public SshAgent createClient(FactoryManager manager) throws IOException {
+ public SshAgent createClient(Session session, FactoryManager manager) throws IOException {
String proxyId = manager.getString(SshAgent.SSH_AUTHSOCKET_ENV_NAME);
if (GenericUtils.isEmpty(proxyId)) {
throw new IllegalStateException("No " + SshAgent.SSH_AUTHSOCKET_ENV_NAME + " environment variable set");
diff --git a/sshd-core/src/main/java/org/apache/sshd/agent/unix/UnixAgentFactory.java b/sshd-core/src/main/java/org/apache/sshd/agent/unix/UnixAgentFactory.java
index a390aeb..07209e1 100644
--- a/sshd-core/src/main/java/org/apache/sshd/agent/unix/UnixAgentFactory.java
+++ b/sshd-core/src/main/java/org/apache/sshd/agent/unix/UnixAgentFactory.java
@@ -74,7 +74,7 @@ public class UnixAgentFactory implements SshAgentFactory {
}
@Override
- public SshAgent createClient(FactoryManager manager) throws IOException {
+ public SshAgent createClient(Session session, FactoryManager manager) throws IOException {
String authSocket = manager.getString(SshAgent.SSH_AUTHSOCKET_ENV_NAME);
if (GenericUtils.isEmpty(authSocket)) {
throw new SshException("No " + SshAgent.SSH_AUTHSOCKET_ENV_NAME + " value");
diff --git a/sshd-core/src/main/java/org/apache/sshd/client/auth/pubkey/UserAuthPublicKeyIterator.java b/sshd-core/src/main/java/org/apache/sshd/client/auth/pubkey/UserAuthPublicKeyIterator.java
index 07b115b..09555f1 100644
--- a/sshd-core/src/main/java/org/apache/sshd/client/auth/pubkey/UserAuthPublicKeyIterator.java
+++ b/sshd-core/src/main/java/org/apache/sshd/client/auth/pubkey/UserAuthPublicKeyIterator.java
@@ -147,7 +147,7 @@ public class UserAuthPublicKeyIterator extends AbstractKeyPairIterator<PublicKey
return null;
}
- agent = Objects.requireNonNull(factory.createClient(manager), "No agent created");
+ agent = Objects.requireNonNull(factory.createClient(session, manager), "No agent created");
return new Iterable<KeyAgentIdentity>() {
@SuppressWarnings("synthetic-access")
private final Iterable<? extends Map.Entry<PublicKey, String>> agentIds = agent.getIdentities();
diff --git a/sshd-core/src/test/java/org/apache/sshd/deprecated/UserAuthAgent.java b/sshd-core/src/test/java/org/apache/sshd/deprecated/UserAuthAgent.java
index 52f11a2..42c43d1 100644
--- a/sshd-core/src/test/java/org/apache/sshd/deprecated/UserAuthAgent.java
+++ b/sshd-core/src/test/java/org/apache/sshd/deprecated/UserAuthAgent.java
@@ -52,7 +52,7 @@ public class UserAuthAgent extends AbstractUserAuth {
if (agentFactory == null) {
throw new IllegalStateException("No ssh agent factory has been configured");
}
- this.agent = agentFactory.createClient(factoryManager);
+ this.agent = agentFactory.createClient(session, factoryManager);
this.keys = agent.getIdentities().iterator();
}
[mina-sshd] 01/05: UserAuthPublicKey: make creating the key
iterator overrideable
Posted by tw...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
twolf pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/mina-sshd.git
commit 445dea2ed6a769caee8805aeea1348468413331f
Author: Thomas Wolf <tw...@apache.org>
AuthorDate: Sat Oct 23 20:48:27 2021 +0200
UserAuthPublicKey: make creating the key iterator overrideable
Introduce a protected factory method.
---
.../java/org/apache/sshd/client/auth/pubkey/UserAuthPublicKey.java | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/sshd-core/src/main/java/org/apache/sshd/client/auth/pubkey/UserAuthPublicKey.java b/sshd-core/src/main/java/org/apache/sshd/client/auth/pubkey/UserAuthPublicKey.java
index 96efa12..ec0d697 100644
--- a/sshd-core/src/main/java/org/apache/sshd/client/auth/pubkey/UserAuthPublicKey.java
+++ b/sshd-core/src/main/java/org/apache/sshd/client/auth/pubkey/UserAuthPublicKey.java
@@ -89,7 +89,7 @@ public class UserAuthPublicKey extends AbstractUserAuth implements SignatureFact
releaseKeys(); // just making sure in case multiple calls to the method
try {
- keys = new UserAuthPublicKeyIterator(session, this);
+ keys = createPublicKeyIterator(session, this);
} catch (Error e) {
warn("init({})[{}] failed ({}) to initialize session keys: {}",
session, service, e.getClass().getSimpleName(), e.getMessage(), e);
@@ -97,6 +97,11 @@ public class UserAuthPublicKey extends AbstractUserAuth implements SignatureFact
}
}
+ protected Iterator<PublicKeyIdentity> createPublicKeyIterator(ClientSession session, SignatureFactoriesManager manager)
+ throws Exception {
+ return new UserAuthPublicKeyIterator(session, manager);
+ }
+
@Override
protected boolean sendAuthDataRequest(ClientSession session, String service) throws Exception {
boolean debugEnabled = log.isDebugEnabled();
[mina-sshd] 05/05: [SSHD-1219] RSA SHA2 signing via SSH agent
Posted by tw...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
twolf pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/mina-sshd.git
commit 2e5e873a2f9999a2802e19bf0fe25a289cb0d5d7
Author: Thomas Wolf <tw...@apache.org>
AuthorDate: Sat Oct 23 21:42:57 2021 +0200
[SSHD-1219] RSA SHA2 signing via SSH agent
Compute the flags depending on the wanted signature algorithm, and
set them in the request. Note that the old "IETF" SSH1 protocol does
not support this.
---
.../sshd/agent/common/AbstractAgentProxy.java | 28 ++++++++++++++++++++--
1 file changed, 26 insertions(+), 2 deletions(-)
diff --git a/sshd-core/src/main/java/org/apache/sshd/agent/common/AbstractAgentProxy.java b/sshd-core/src/main/java/org/apache/sshd/agent/common/AbstractAgentProxy.java
index da38c72..97e78b7 100644
--- a/sshd-core/src/main/java/org/apache/sshd/agent/common/AbstractAgentProxy.java
+++ b/sshd-core/src/main/java/org/apache/sshd/agent/common/AbstractAgentProxy.java
@@ -113,12 +113,37 @@ public abstract class AbstractAgentProxy extends AbstractLoggingBean implements
}
Buffer buffer = createBuffer((byte) cmd);
+ String keyType = KeyUtils.getKeyType(key);
+ int flags = 0;
if (CoreModuleProperties.AGENT_FORWARDING_TYPE_IETF.equals(channelType)) {
buffer.putString("sign");
+ } else {
+ String signatureAlgorithm;
+ if (!GenericUtils.isEmpty(algo)) {
+ if (!KeyUtils.getCanonicalKeyType(algo).equals(keyType)) {
+ throw new IllegalArgumentException(
+ "Bad signing request: signature algorithm '" + algo + "' not applicable to '" + keyType + "' key");
+ }
+ signatureAlgorithm = algo;
+ } else {
+ signatureAlgorithm = keyType;
+ }
+ switch (signatureAlgorithm) {
+ case KeyUtils.RSA_SHA512_KEY_TYPE_ALIAS:
+ case KeyUtils.RSA_SHA512_CERT_TYPE_ALIAS:
+ flags = 4;
+ break;
+ case KeyUtils.RSA_SHA256_KEY_TYPE_ALIAS:
+ case KeyUtils.RSA_SHA256_CERT_TYPE_ALIAS:
+ flags = 2;
+ break;
+ default:
+ break;
+ }
}
buffer.putPublicKey(key);
buffer.putBytes(data);
- buffer.putInt(0);
+ buffer.putInt(flags);
buffer = request(prepare(buffer));
int responseType = buffer.getUByte();
@@ -128,7 +153,6 @@ public abstract class AbstractAgentProxy extends AbstractLoggingBean implements
byte[] signature = buffer.getBytes();
boolean debugEnabled = log.isDebugEnabled();
- String keyType = KeyUtils.getKeyType(key);
if (CoreModuleProperties.AGENT_FORWARDING_TYPE_IETF.equals(channelType)) {
if (debugEnabled) {
log.debug("sign({}/{})[{}] : {}",