Skip to content

Commit 4b813b8

Browse files
ylangiscylangisc
committed
For RSA keys all possible signature algorithms must be tried. Also refer to hierynomus/sshj#763.
1 parent 12c3d64 commit 4b813b8

File tree

14 files changed

+119
-46
lines changed

14 files changed

+119
-46
lines changed

‎examples/pom.xml

+1-1
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55

66
<groupId>com.jcraft</groupId>
77
<artifactId>jsch.agentproxy.examples</artifactId>
8-
<version>0.0.9</version>
8+
<version>0.0.10-SNAPSHOT</version>
99
<name>examples to demonstrate how to use jsch-agent-proxy</name>
1010

1111
<dependencies>

‎jsch-agent-proxy-connector-factory/pom.xml

+1-1
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
<parent>
77
<groupId>com.jcraft</groupId>
88
<artifactId>jsch.agentproxy</artifactId>
9-
<version>0.0.9</version>
9+
<version>0.0.10-SNAPSHOT</version>
1010
</parent>
1111

1212
<artifactId>jsch.agentproxy.connector-factory</artifactId>

‎jsch-agent-proxy-core/pom.xml

+1-1
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
<parent>
77
<groupId>com.jcraft</groupId>
88
<artifactId>jsch.agentproxy</artifactId>
9-
<version>0.0.9</version>
9+
<version>0.0.10-SNAPSHOT</version>
1010
</parent>
1111

1212
<artifactId>jsch.agentproxy.core</artifactId>

‎jsch-agent-proxy-core/src/main/java/com/jcraft/jsch/agentproxy/AgentProxy.java

+7-1
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,8 @@ public class AgentProxy {
6767
private static final byte SSH_COM_AGENT2_FAILURE = 102;
6868

6969
private static final byte SSH_AGENT_OLD_SIGNATURE = 0x01;
70+
public static final byte SSH_AGENT_RSA_SHA2_256 = 0x02;
71+
public static final byte SSH_AGENT_RSA_SHA2_512 = 0x04;
7072

7173
private final byte[] buf = new byte[1024];
7274
private final Buffer buffer = new Buffer(buf);
@@ -116,6 +118,10 @@ public synchronized Identity[] getIdentities() {
116118
}
117119

118120
public synchronized byte[] sign(byte[] blob, byte[] data) {
121+
return this.sign(blob, data, 0);
122+
}
123+
124+
public synchronized byte[] sign(byte[] blob, byte[] data, int flags) {
119125
byte[] result = null;
120126

121127
byte code1 = SSH2_AGENTC_SIGN_REQUEST;
@@ -127,7 +133,7 @@ public synchronized byte[] sign(byte[] blob, byte[] data) {
127133
buffer.putByte(code1);
128134
buffer.putString(blob);
129135
buffer.putString(data);
130-
buffer.putInt(0); // SSH_AGENT_OLD_SIGNATURE
136+
buffer.putInt(flags);
131137
buffer.insertLength();
132138

133139
try {

‎jsch-agent-proxy-jsch/pom.xml

+1-1
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
<parent>
77
<groupId>com.jcraft</groupId>
88
<artifactId>jsch.agentproxy</artifactId>
9-
<version>0.0.9</version>
9+
<version>0.0.10-SNAPSHOT</version>
1010
</parent>
1111

1212
<artifactId>jsch.agentproxy.jsch</artifactId>

‎jsch-agent-proxy-pageant/pom.xml

+1-1
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
<parent>
77
<groupId>com.jcraft</groupId>
88
<artifactId>jsch.agentproxy</artifactId>
9-
<version>0.0.9</version>
9+
<version>0.0.10-SNAPSHOT</version>
1010
</parent>
1111

1212
<artifactId>jsch.agentproxy.pageant</artifactId>

‎jsch-agent-proxy-sshagent/pom.xml

+1-1
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
<parent>
77
<groupId>com.jcraft</groupId>
88
<artifactId>jsch.agentproxy</artifactId>
9-
<version>0.0.9</version>
9+
<version>0.0.10-SNAPSHOT</version>
1010
</parent>
1111

1212
<artifactId>jsch.agentproxy.sshagent</artifactId>

‎jsch-agent-proxy-sshj/pom.xml

+16-3
Original file line numberDiff line numberDiff line change
@@ -6,23 +6,28 @@
66
<parent>
77
<groupId>com.jcraft</groupId>
88
<artifactId>jsch.agentproxy</artifactId>
9-
<version>0.0.9</version>
9+
<version>0.0.10-SNAPSHOT</version>
1010
</parent>
1111

1212
<artifactId>jsch.agentproxy.sshj</artifactId>
1313
<name>a library to use jsch-agent-proxy with sshj</name>
1414

1515
<dependencies>
1616
<dependency>
17-
<groupId>net.schmizz</groupId>
17+
<groupId>com.hierynomus</groupId>
1818
<artifactId>sshj</artifactId>
19-
<version>[0.8.1,)</version>
19+
<version>[0.33.0,)</version>
2020
</dependency>
2121
<dependency>
2222
<groupId>com.jcraft</groupId>
2323
<artifactId>jsch.agentproxy.core</artifactId>
2424
<version>${project.version}</version>
2525
</dependency>
26+
<dependency>
27+
<groupId>org.slf4j</groupId>
28+
<artifactId>slf4j-api</artifactId>
29+
<version>1.7.32</version>
30+
</dependency>
2631
</dependencies>
2732

2833
<build>
@@ -32,6 +37,14 @@
3237
<artifactId>maven-jar-plugin</artifactId>
3338
<version>2.3.2</version>
3439
</plugin>
40+
<plugin>
41+
<groupId>org.apache.maven.plugins</groupId>
42+
<artifactId>maven-compiler-plugin</artifactId>
43+
<configuration>
44+
<source>7</source>
45+
<target>7</target>
46+
</configuration>
47+
</plugin>
3548
</plugins>
3649
</build>
3750
</project>

‎jsch-agent-proxy-sshj/src/main/java/com/jcraft/jsch/agentproxy/sshj/AuthAgent.java

+81-29
Original file line numberDiff line numberDiff line change
@@ -28,87 +28,125 @@ LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
2828
*/
2929
package com.jcraft.jsch.agentproxy.sshj;
3030

31+
import com.hierynomus.sshj.key.KeyAlgorithm;
32+
import com.hierynomus.sshj.key.KeyAlgorithms;
3133
import com.jcraft.jsch.agentproxy.AgentProxy;
3234
import com.jcraft.jsch.agentproxy.Identity;
3335
import net.schmizz.sshj.common.Buffer;
36+
import net.schmizz.sshj.common.KeyType;
3437
import net.schmizz.sshj.common.Message;
3538
import net.schmizz.sshj.common.SSHPacket;
3639
import net.schmizz.sshj.transport.TransportException;
3740
import net.schmizz.sshj.userauth.UserAuthException;
3841
import net.schmizz.sshj.userauth.method.AbstractAuthMethod;
39-
import org.slf4j.Logger;
40-
import org.slf4j.LoggerFactory;
42+
43+
import java.io.IOException;
44+
import java.util.LinkedList;
45+
import java.util.Queue;
4146

4247
/**
4348
* An AuthMethod for sshj authentication with an agent.
4449
*/
4550
public class AuthAgent extends AbstractAuthMethod {
46-
protected final Logger log = LoggerFactory.getLogger(getClass());
4751

48-
/** The AgentProxy instance that is used for signing */
52+
/**
53+
* The AgentProxy instance that is used for signing
54+
*/
4955
private final AgentProxy agentProxy;
50-
/** The identity from Agent */
56+
/**
57+
* The identity from Agent
58+
*/
5159
private final Identity identity;
52-
/** The identity's key algorithm */
60+
/**
61+
* The identity's key algorithm
62+
*/
5363
private final String algorithm;
5464
private final String comment;
5565

66+
private Queue<KeyAlgorithm> available;
67+
68+
private final KeyType keyType;
69+
5670
public AuthAgent(AgentProxy agentProxy, Identity identity) throws Buffer.BufferException {
5771
super("publickey");
5872
this.agentProxy = agentProxy;
5973
this.identity = identity;
6074
this.comment = new String(identity.getComment());
6175
this.algorithm = (new Buffer.PlainBuffer(identity.getBlob())).readString();
76+
this.keyType = KeyType.fromString(algorithm);
77+
}
78+
79+
private KeyAlgorithm getPublicKeyAlgorithm(KeyType keyType) throws TransportException {
80+
if (available == null) {
81+
available = new LinkedList<>(params.getTransport().getClientKeyAlgorithms(keyType));
82+
}
83+
return available.peek();
6284
}
6385

64-
/** Internal use. */
6586
@Override
66-
public void handle(Message cmd, SSHPacket buf)
67-
throws UserAuthException, TransportException {
68-
if (cmd == Message.USERAUTH_60)
69-
sendSignedReq();
70-
else
71-
super.handle(cmd, buf);
87+
public boolean shouldRetry() {
88+
if (available != null) {
89+
available.poll();
90+
return !available.isEmpty();
91+
}
92+
return false;
7293
}
7394

7495
protected SSHPacket putPubKey(SSHPacket reqBuf)
7596
throws UserAuthException {
76-
reqBuf
77-
.putString(algorithm)
78-
.putBytes(identity.getBlob()).getCompactData();
79-
return reqBuf;
97+
try {
98+
KeyAlgorithm ka = getPublicKeyAlgorithm(keyType);
99+
if (ka != null) {
100+
reqBuf.putString(ka.getKeyAlgorithm()).putBytes(identity.getBlob()).getCompactData();
101+
return reqBuf;
102+
}
103+
} catch (IOException ioe) {
104+
throw new UserAuthException("No KeyAlgorithm configured for key " + keyType, ioe);
105+
}
106+
throw new UserAuthException("No KeyAlgorithm configured for key " + keyType);
80107
}
81108

82-
private SSHPacket putSig(SSHPacket reqBuf)
83-
throws UserAuthException {
109+
private int getSignFlags(KeyAlgorithm algorithm) {
110+
if (keyType == KeyType.RSA) {
111+
if (KeyAlgorithms.RSASHA256().getName().equals(algorithm.getKeyAlgorithm())) {
112+
return AgentProxy.SSH_AGENT_RSA_SHA2_256;
113+
}
114+
if (KeyAlgorithms.RSASHA512().getName().equals(algorithm.getKeyAlgorithm())) {
115+
return AgentProxy.SSH_AGENT_RSA_SHA2_512;
116+
}
117+
}
118+
return 0;
119+
}
120+
121+
protected SSHPacket putSig(SSHPacket reqBuf)
122+
throws TransportException {
84123
final byte[] dataToSign = new Buffer.PlainBuffer()
85124
.putString(params.getTransport().getSessionID())
86125
.putBuffer(reqBuf) // & rest of the data for sig
87126
.getCompactData();
88127

89-
reqBuf.putBytes(agentProxy.sign(identity.getBlob(), dataToSign));
128+
reqBuf.putBytes(agentProxy.sign(identity.getBlob(), dataToSign, getSignFlags(getPublicKeyAlgorithm(keyType))));
90129

91130
return reqBuf;
92131
}
93132

94133
/**
95-
* Send SSH_MSG_USERAUTH_REQUEST containing the signature.
96-
*
97-
* @throws UserAuthException
98-
* @throws TransportException
134+
* Internal use.
99135
*/
100-
private void sendSignedReq()
136+
@Override
137+
public void handle(Message cmd, SSHPacket buf)
101138
throws UserAuthException, TransportException {
102-
params.getTransport().write(putSig(buildReq(true)));
139+
if (cmd == Message.USERAUTH_60)
140+
sendSignedReq();
141+
else
142+
super.handle(cmd, buf);
103143
}
104144

105145
/**
106146
* Builds SSH_MSG_USERAUTH_REQUEST packet.
107147
*
108148
* @param signed whether the request packet will contain signature
109-
*
110149
* @return the {@link SSHPacket} containing the request packet
111-
*
112150
* @throws UserAuthException
113151
*/
114152
private SSHPacket buildReq(boolean signed)
@@ -117,7 +155,21 @@ private SSHPacket buildReq(boolean signed)
117155
return putPubKey(super.buildReq().putBoolean(signed));
118156
}
119157

120-
/** Builds a feeler request (sans signature). */
158+
/**
159+
* Send SSH_MSG_USERAUTH_REQUEST containing the signature.
160+
*
161+
* @throws UserAuthException
162+
* @throws TransportException
163+
*/
164+
private void sendSignedReq()
165+
throws UserAuthException, TransportException {
166+
log.debug("Key acceptable, sending signed request");
167+
params.getTransport().write(putSig(buildReq(true)));
168+
}
169+
170+
/**
171+
* Builds a feeler request (sans signature).
172+
*/
121173
@Override
122174
protected SSHPacket buildReq()
123175
throws UserAuthException {

‎jsch-agent-proxy-svnkit-trilead-ssh2/pom.xml

+1-1
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
<parent>
77
<groupId>com.jcraft</groupId>
88
<artifactId>jsch.agentproxy</artifactId>
9-
<version>0.0.9</version>
9+
<version>0.0.10-SNAPSHOT</version>
1010
</parent>
1111

1212
<artifactId>jsch.agentproxy.svnkit-trilead-ssh2</artifactId>

‎jsch-agent-proxy-usocket-jna/pom.xml

+1-1
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
<parent>
77
<groupId>com.jcraft</groupId>
88
<artifactId>jsch.agentproxy</artifactId>
9-
<version>0.0.9</version>
9+
<version>0.0.10-SNAPSHOT</version>
1010
</parent>
1111

1212
<artifactId>jsch.agentproxy.usocket-jna</artifactId>

‎jsch-agent-proxy-usocket-junixsocket/pom.xml

+1-1
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
<parent>
77
<groupId>com.jcraft</groupId>
88
<artifactId>jsch.agentproxy</artifactId>
9-
<version>0.0.9</version>
9+
<version>0.0.10-SNAPSHOT</version>
1010
</parent>
1111

1212
<artifactId>jsch.agentproxy.usocket-junixsocket</artifactId>

‎jsch-agent-proxy-usocket-nc/pom.xml

+1-1
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
<parent>
77
<groupId>com.jcraft</groupId>
88
<artifactId>jsch.agentproxy</artifactId>
9-
<version>0.0.9</version>
9+
<version>0.0.10-SNAPSHOT</version>
1010
</parent>
1111

1212
<artifactId>jsch.agentproxy.usocket-nc</artifactId>

‎pom.xml

+5-3
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99

1010
<groupId>com.jcraft</groupId>
1111
<artifactId>jsch.agentproxy</artifactId>
12-
<version>0.0.9</version>
12+
<version>0.0.10-SNAPSHOT</version>
1313
<packaging>pom</packaging>
1414
<name>jsch-agent-proxy: a parent of modules</name>
1515

@@ -45,6 +45,8 @@
4545
<jsch.version>0.1.49</jsch.version>
4646
<jna.version>4.1.0</jna.version>
4747
<trilead.version>1.0.0-build217</trilead.version>
48+
<maven.compile.source>1.8</maven.compile.source>
49+
<maven.compile.target>1.8</maven.compile.target>
4850
</properties>
4951

5052
<developers>
@@ -95,8 +97,8 @@
9597
<artifactId>maven-compiler-plugin</artifactId>
9698
<version>2.3.2</version>
9799
<configuration>
98-
<source>1.5</source>
99-
<target>1.5</target>
100+
<source>${maven.compile.source}</source>
101+
<target>${maven.compile.target}</target>
100102
</configuration>
101103
</plugin>
102104
<plugin>

0 commit comments

Comments
 (0)