Thomas Wolf [Thu, 30 Dec 2021 16:49:44 +0000 (17:49 +0100)]
sshd: Add README.md for SSH agents
Explain SSH agent protocols, what transports are available and how to
choose them in ~/.ssh/config. For Windows, add some information on
which commonly used SSH agents can be used.
Change-Id: I0b08a95654fd76643512606edb1ed74d9980aa85 Signed-off-by: Thomas Wolf <thomas.wolf@paranor.ch>
Thomas Wolf [Wed, 29 Dec 2021 19:33:33 +0000 (20:33 +0100)]
sshd: Skip unknown keys from the SSH agent
An SSH agent might contain keys that Apache MINA sshd cannot handle.
Pageant for instance can contain ed448 keys, which are not implemented
in OpenSSH or in Apache MINA sshd.
When an agent delivers such keys, simply skip (and log) them. That way,
we can work with the remaining keys. Otherwise a single unknown key in
the agent would break pubkey authentication.
Change-Id: I3945d932c7e64b628465004cfbaf10f4dc05f3e4 Signed-off-by: Thomas Wolf <thomas.wolf@paranor.ch>
Thomas Wolf [Tue, 28 Dec 2021 18:54:30 +0000 (19:54 +0100)]
sshd: support the AddKeysToAgent ssh config
Add parsing of the config. Implement the SSH agent protocol for adding
a key. In the pubkey authentication, add keys to the agent as soon as
they've been loaded successfully, before even attempting to use them
for authentication. OpenSSH does the same.
Bug: 577052
Change-Id: Id1c08d9676a74652256b22281c2f8fa0b6508fa6 Signed-off-by: Thomas Wolf <thomas.wolf@paranor.ch>
Thomas Wolf [Tue, 28 Dec 2021 17:07:21 +0000 (18:07 +0100)]
sshd: handle "IdentityAgent SSH_AUTH_SOCK" in ssh config
OpenSSH has (for legacy reasons?) the option of specifying the default
environment variable directly, instead of using ${SSH_AUTH_SOCK}. Make
sure the plain variable name is not taken as a relative path name.
Bug: 577053
Change-Id: If8f550dffc43887254f71aa0b487c50fa14d0627 Signed-off-by: Thomas Wolf <thomas.wolf@paranor.ch>
Thomas Wolf [Mon, 27 Dec 2021 20:39:23 +0000 (21:39 +0100)]
sshd: Connector for the Win32-OpenSSH SSH agent
Win32-OpenSSH uses a named Windows pipe for communication. Implement
a connector for this mechanism using JNA. Choose the appropriate
connector based on the setting of the 'identityAgent' parameter.
Bug: 577053
Change-Id: I205f07fb33654aa18ca5db92706e65544ce38641 Signed-off-by: Thomas Wolf <thomas.wolf@paranor.ch>
Thomas Wolf [Mon, 27 Dec 2021 18:50:24 +0000 (19:50 +0100)]
sshd: handle IdentitiesOnly with an SSH agent
If an SSH agent is used but "IdentitiesOnly yes" is set, only those
keys from the agent that correspond to one of the keys explicitly given
via an IdentityFile directive are to be used.
Implement this by filtering the list of keys obtained from the agent
against the list of IdentityFiles, each entry suffixed with ".pub".
Load the public keys from these files, and ignore all other keys from
the agent. Keys without ".pub" file are also ignored.
Apache MINA sshd has no operation to load only the public key from a
private key file, so we have to rely on *.pub files.
Bug: 577053
Change-Id: I75c2c0b3ce35781c933ec2944bd6da1b94f4caf9 Signed-off-by: Thomas Wolf <thomas.wolf@paranor.ch>
Thomas Wolf [Sun, 26 Dec 2021 13:36:48 +0000 (14:36 +0100)]
sshd: support IdentityAgent config
Handle the 'none' value, and change the value to select Pageant to
something that looks like an absolute UNC path name to avoid it's
handled as an relative path name.
Bug: 577053
Change-Id: I4ccf047abbc1def50e2782319e4fa7c744069401 Signed-off-by: Thomas Wolf <thomas.wolf@paranor.ch>
Nail Samatov [Fri, 21 Jan 2022 16:30:51 +0000 (19:30 +0300)]
LFS: Fix error occurring during delete branch
Fix TransportException occurring when deleting
a branch and push that change to remote repository
if BuiltinLFS is used to work with repository.
When finding LFS pointers in RemoteRepUpdate,
LfsPrePushHook fails to open ObjectReader
with new object id equal to ObjectId.zeroId().
If update is a deleting update (new object id is zero id),
we can assume that this update doesn't contain LFS Pointer
and we can skip step with extracting LFS pointer for that
RemoteRefUpdate.
Bug: 578313
Change-Id: Ic4367978338b8234d39d9af0d9674490f79fc22d Signed-off-by: Nail Samatov <sanail@yandex.ru>
DFS block cache: report index load and evict stats
Enhance cache performance monitoring for large data such as pack and
bitmap indexes. Provide details about what is loaded and evicted from
cache like total number of cache hits, time in cache before eviction.
Add a custom consumer to report loading events and eviction events when
enabled.
David Ostrovsky [Fri, 24 Dec 2021 06:43:48 +0000 (07:43 +0100)]
Bazel: Switch to using toolchain resolution for java rules
Bump Bazel version to release 5.0.0. In this new Bazel release,
--incompatible_use_toolchain_resolution_for_java_rules is flipped, that
means that the build must be adapted to toolchain resolution.
Specification toolchain resolution for java rules is here: [1]. Main
tracking Bazel issue is here: [2].
Given that new Bazel release also added support for remote JDK 17, add
experimental support for building with remote JDK 17 to produce major
byte code version 61.
Matthias Sohn [Tue, 11 Jan 2022 23:19:56 +0000 (00:19 +0100)]
Update orbit to I20220111151929
and update
- com.google.gson to 2.8.9.v20220111-1409
- org.bouncycastle.bcpg to 1.70.0.v20220105-1522
- org.bouncycastle.bcpkix to 1.70.0.v20220105-1522
- org.bouncycastle.bcprov to 1.70.0.v20220105-1522
- org.bouncycastle.bcutil to 1.70.0.v20220105-1522
Move this test to another class and skip it when running tests with
bazel since the bazel test runner does not allow to create files in the
home directory.
FS#userHome retrieves the home directory on the first call and caches it
for subsequent calls to avoid overhead in case path translation is
required (currently on cygwin). This prevents that the test can mock the
home directory using MockSystemReader like SshTestHarness does.
Marcin Czech [Wed, 22 Dec 2021 16:42:36 +0000 (17:42 +0100)]
UploadPack v2 protocol: Stop negotiation for orphan refs
The fetch of a single orphan ref (for example Gerrit meta ref:
refs/changes/21/21/meta) did not stop the negotiation so client
had to advertise all refs. This impacts the fetch performance
on repositories with a large number of refs (for example on
Gerrit repository it takes 20 seconds to fetch meta ref
comparing to 1.2 second to fetch ref with parent).
To avoid this issue UploadPack, used on the server side,
now checks if all `want` refs have parents, if not this
means that client doesn't need any extra objects, hence
the server responds with `ready` and finishes the
negotiation phase.
Thomas Wolf [Thu, 6 Jan 2022 18:33:44 +0000 (19:33 +0100)]
sshd: backport upstream fix for SSHD-1231
SSHD-1231[1] may lead to exceptions when trying to authenticate first
with an RSA key that is rejected by the server. The upstream fix is a
one-liner but unfortunately didn't make it into Apache MINA sshd 2.8.0.
Incorporate the upstream fix in JGitPublicKeyAuthentication, and add
a test case for this.
Thomas Wolf [Mon, 27 Dec 2021 10:32:15 +0000 (11:32 +0100)]
[releng] bump japicmp base version and configure sshd bundles
Bump the japicmp base version to 6.0.0.202111291000-r and configure
the o.e.j.ssh.apache and o.e.j.ssh.apache.agent bundles to ignore
internal classes.
Change-Id: Id95350c73b9141e1583f9de5fb6ab2496c7407d9 Signed-off-by: Thomas Wolf <thomas.wolf@paranor.ch>
Matthias Sohn [Thu, 16 Dec 2021 17:42:45 +0000 (18:42 +0100)]
Use slf4j-simple instead of log4j for logging
JGit uses slf4j-api as logging API.
The libraries
- org.eclipse.jgit.http.test
- org.eclipse.jgit.pgm
- org.eclipse.jgit.ssh.apache.test
- org.eclipse.jgit.test
used the outdated log4j 1.2.15 which is EOL since years.
Since both jgit command line and also the tests don't need sophisticated
logging features replace log4j with the much simpler slf4j-simple log
implementation. The org.slf4j.binding.simple 1.7.30 archive has only
25kB instead of 429kB for log4j 1.2.15
Applications using jgit are free to choose any other log implementation
supporting slf4j API.
Matthias Sohn [Mon, 13 Dec 2021 23:07:10 +0000 (00:07 +0100)]
Update orbit to R20211213173813
and update
- com.google.gson to 2.8.8.v20211029-0838
- javaewah to 1.1.13.v20211029-0839
- net.i2p.crypto.eddsa to 0.3.0.v20210923-1401
- org.apache.ant to 1.10.12.v20211102-1452
- org.apache.commons.compress to 1.21.0.v20211103-2100
- org.bouncycastle.bcprov to 1.69.0.v20210923-1401
- org.junit to 4.13.2.v20211018-1956
Thomas Wolf [Sun, 26 Dec 2021 15:05:17 +0000 (16:05 +0100)]
Merge branch 'stable-6.0'
* stable-6.0:
Revert "RefDirectory.scanRef: Re-use file existence check done in snapshot creation"
TreeRevFilter: fix wrong stop when the given path disappears
Change-Id: Id7540d03991cdcf6f405e946b8cbbcc6a9696a31 Signed-off-by: Thomas Wolf <thomas.wolf@paranor.ch>
Thomas Wolf [Sun, 26 Dec 2021 15:03:40 +0000 (16:03 +0100)]
Merge branch 'stable-5.13' into stable-6.0
* stable-5.13:
Revert "RefDirectory.scanRef: Re-use file existence check done in snapshot creation"
TreeRevFilter: fix wrong stop when the given path disappears
Change-Id: Ibd69e9d941ad9262b61dd0c4368e48cb82597a12 Signed-off-by: Thomas Wolf <thomas.wolf@paranor.ch>
PackBitmapIndexV1: support parallel loading of reverse index
Speed up bitmap creation by loading reverse index in parallel
to reading bitmap from storage. Latency changes from
(time_to_read_bitmap + time_to_load_reverse_index) to
max(time_to_read_bitmap, time_to_load_reverse_index).
Add new option to DfsReaderOptions to control parallel reverse index
loading. Static cached thread pool is added to PackBitmapIndexV1 for
reverse index loading, and when not in use consumes minimal resources.
projects / jgit.git / log