-
-
Notifications
You must be signed in to change notification settings - Fork 145
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
JSch: Merge with v0.2.23 of the JSch fork
... with the following exceptions: - Do not include Bouncy Castle algorithm implementations. (Require Java 16 instead.) This means that our JSch fork cannot currently support the [email protected] cipher, since the non-Bouncy-Castle implementation of that algorithm from JSch v0.1.71 and prior is not compatible with the current OpenSSH implementation. - Restore formatted comments nuked by the Maven formatter. - Do not include unused/unneeded code. - Restore public access to *.jzlib.JZlib and *.jzlib.ZStream. (NOTE: We should maybe revisit eliminating JZlib and using java.util.zip for everything, since we don't actually use SSH compression.) - Adapt the server-sig-algs implementation in mwiede/jsch@c17147c8 to better emulate the behavior of OpenSSH. (More specifically, OpenSSH only applies server-sig-algs to RSA keys: https://github.com/openssh/openssh-portable/blob/826483d51a9fee60703298bbf839d9ce37943474/sshconnect2.c#L1163-L1169.) Take the example of an SSH agent that offers 7 keys. The 7th key is the correct key to authenticate with a server, but that key uses a non-RSA algorithm (e.g. ssh-ed25519) that the server does not advertise in server-sig-algs. With MaxAuthTries=6, OpenSSH will fail to authenticate with that configuration by default, but it will succeed if the correct key is explicitly specified with the ssh -i option or the IdentityFile configuration keyword (because explicitly specifying the key promotes it to the head of the list.) JSch v0.1.66+ performs an initial authentication pass with only the algorithms advertised in server-sig-algs, then it performs a second pass with the other client-supported algorithms. With the aforementioned configuration, that behavior causes MaxAuthTries to be exceeded on the first pass (a fatal error), and the second pass never happens. Our implementation instead populates the existing Session.supportedRSAMethods list from the server-sig-algs message, if the server sent that message and the jsch.enable_server_sig_algs system property is enabled. This ensures that the client will not try any RSA algorithms except for those advertised in server-sig-algs. Note, however, that some OpenSSH server implementations still advertise ssh-rsa in server-sig-algs even if the algorithm is disabled in sshd_config. Functional and logging code from the following TurboVNC commits has been retained or adapted: 095c380 fb36f3b 053e754 dda0283 0a4aeb6 b632a9c 6838846 4a40896 273bfde fd34df2 ed50650 58986b7 dc2a88f d654a91 674e98c Completes #323
- Loading branch information
1 parent
5ff8910
commit d2da5fe
Showing
310 changed files
with
31,025 additions
and
25,601 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,35 @@ | ||
| /* | ||
| * Copyright (c) 2011 ymnk, JCraft,Inc. All rights reserved. | ||
| * | ||
| * Redistribution and use in source and binary forms, with or without modification, are permitted | ||
| * provided that the following conditions are met: | ||
| * | ||
| * 1. Redistributions of source code must retain the above copyright notice, this list of conditions | ||
| * and the following disclaimer. | ||
| * | ||
| * 2. Redistributions in binary form must reproduce the above copyright notice, this list of | ||
| * conditions and the following disclaimer in the documentation and/or other materials provided with | ||
| * the distribution. | ||
| * | ||
| * 3. The names of the authors may not be used to endorse or promote products derived from this | ||
| * software without specific prior written permission. | ||
| * | ||
| * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT | ||
| * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE | ||
| * DISCLAIMED. IN NO EVENT SHALL JCRAFT, INC. OR ANY CONTRIBUTORS TO THIS SOFTWARE BE LIABLE FOR ANY | ||
| * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT | ||
| * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR | ||
| * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT | ||
| * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS | ||
| * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. | ||
| */ | ||
|
|
||
| package com.jcraft.jsch; | ||
|
|
||
| public interface AgentConnector { | ||
| String getName(); | ||
|
|
||
| boolean isAvailable(); | ||
|
|
||
| void query(Buffer buffer) throws AgentProxyException; | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,99 @@ | ||
| /* | ||
| * Copyright (c) 2011 ymnk, JCraft,Inc. All rights reserved. | ||
| * Copyright (c) 2018, 2025 D. R. Commander. All rights reserved. | ||
| * | ||
| * Redistribution and use in source and binary forms, with or without modification, are permitted | ||
| * provided that the following conditions are met: | ||
| * | ||
| * 1. Redistributions of source code must retain the above copyright notice, this list of conditions | ||
| * and the following disclaimer. | ||
| * | ||
| * 2. Redistributions in binary form must reproduce the above copyright notice, this list of | ||
| * conditions and the following disclaimer in the documentation and/or other materials provided with | ||
| * the distribution. | ||
| * | ||
| * 3. The names of the authors may not be used to endorse or promote products derived from this | ||
| * software without specific prior written permission. | ||
| * | ||
| * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT | ||
| * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE | ||
| * DISCLAIMED. IN NO EVENT SHALL JCRAFT, INC. OR ANY CONTRIBUTORS TO THIS SOFTWARE BE LIABLE FOR ANY | ||
| * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT | ||
| * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR | ||
| * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT | ||
| * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS | ||
| * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. | ||
| */ | ||
|
|
||
| package com.jcraft.jsch; | ||
|
|
||
| class AgentIdentity implements Identity { | ||
|
|
||
| private AgentProxy agent; | ||
| private byte[] blob; | ||
| private String comment; | ||
| private String algname; | ||
| private HASH hash; | ||
|
|
||
| AgentIdentity(AgentProxy agent, byte[] blob, String comment) { | ||
| this.agent = agent; | ||
| this.blob = blob; | ||
| this.comment = comment; | ||
| algname = Util.byte2str((new Buffer(blob)).getString()); | ||
| } | ||
|
|
||
| private HASH genHash() { | ||
| try { | ||
| Class c = Class.forName(JSch.getConfig("md5")); | ||
| hash = (HASH)(c.getDeclaredConstructor().newInstance()); | ||
| hash.init(); | ||
| } catch (Exception e) { | ||
| } | ||
| return hash; | ||
| } | ||
|
|
||
| @Override | ||
| public boolean setPassphrase(byte[] passphrase) throws JSchException { | ||
| return true; | ||
| } | ||
|
|
||
| @Override | ||
| public byte[] getPublicKeyBlob() { | ||
| return blob; | ||
| } | ||
|
|
||
| @Override | ||
| public String getFingerPrint() { | ||
| if (hash == null) hash = genHash(); | ||
| if (blob == null) return null; | ||
| return Util.getFingerPrint(hash, blob, false, true); | ||
| } | ||
|
|
||
| @Override | ||
| public byte[] getSignature(byte[] data) { | ||
| return agent.sign(blob, data, null); | ||
| } | ||
|
|
||
| @Override | ||
| public byte[] getSignature(byte[] data, String alg) { | ||
| return agent.sign(blob, data, alg); | ||
| } | ||
|
|
||
| @Override | ||
| public String getAlgName() { | ||
| return algname; | ||
| } | ||
|
|
||
| @Override | ||
| public String getName() { | ||
| return comment; | ||
| } | ||
|
|
||
| @Override | ||
| public boolean isEncrypted() { | ||
| return false; | ||
| } | ||
|
|
||
| @Override | ||
| public void clear() {} | ||
| } |
Oops, something went wrong.