summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Prepare 5.3.0-SNAPSHOT buildsMatthias Sohn2018-12-0367-407/+407
| | | | | Change-Id: I8951c2cf650cc3e41d2baa0b330b94468cfed5c2 Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>
* Merge branch 'stable-5.2'Matthias Sohn2018-12-0326-26/+92
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | * stable-5.2: Format lib/BUILD with buildifier Update Orbit to S20181128170323 for 2018-12 RC1 Include id_ed25519 in the known default identity files Apache MINA sshd client: enable support for ed25519 keys Prepare 5.2.0-SNAPSHOT builds Set git environment variables for hooks JGit v5.2.0.201811281532-m3 Change-Id: If96adcbf35ccf8d9f4da0f5d97491f502f5a72a9 Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>
| * Format lib/BUILD with buildifierDavid Pursehouse2018-12-021-1/+1
| | | | | | | | | | Change-Id: I63db70e6e6f4da44a211621d8721ede66bce44bd Signed-off-by: David Pursehouse <david.pursehouse@gmail.com>
| * Update Orbit to S20181128170323 for 2018-12 RC1Matthias Sohn2018-12-0313-20/+20
| | | | | | | | Change-Id: I4f66b907d8027cae779f54ef0bdc5d36b4a21f6f Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>
| * Include id_ed25519 in the known default identity filesThomas Wolf2018-12-021-1/+1
| | | | | | | | Change-Id: I9fb30c8fbb65536782ee73644c8990eb6661c660 Signed-off-by: Thomas Wolf <thomas.wolf@paranor.ch>
| * Apache MINA sshd client: enable support for ed25519 keysThomas Wolf2018-12-0210-2/+58
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Include the net.i2p.crypto.eddsa bundle via a hard dependency. Add tests for dealing with ed25519 host keys and user key files. Manual tests: fetching from git.eclipse.org with an ed25519 user key, and pushing this change itself using the same ed25519 key. Note that sshd 2.0.0 does not yet support encrypted ed25519 private keys. Bug: 541272 Change-Id: I7072f4014d9eca755b4a2412e19c086235e5eae9 Signed-off-by: Thomas Wolf <thomas.wolf@paranor.ch>
| * Merge "Set git environment variables for hooks" into stable-5.2Thomas Wolf2018-12-022-2/+12
| |\
| | * Set git environment variables for hooksThomas Wolf2018-11-302-2/+12
| | | | | | | | | | | | | | | | | | | | | Set GIT_DIR and GIT_WORK_TREE when calling hooks. Bug: 541622 Change-Id: I6153d8a6a934ec37a3a5e7319c2d0e516f539ab7 Signed-off-by: Thomas Wolf <thomas.wolf@paranor.ch>
| * | Prepare 5.2.0-SNAPSHOT buildsMatthias Sohn2018-11-3067-71/+71
| |/ | | | | | | | | Change-Id: I18646aaeee51047b234b758dcc1c2f89fd01b2f8 Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>
| * JGit v5.2.0.201811281532-m3v5.2.0.201811281532-m3Matthias Sohn2018-11-2867-71/+71
| | | | | | | | | | Change-Id: I79988b473d67e565d8f6bcac40ee9a14b26c9e60 Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>
* | Upgrade spotbugs-maven-plugin to 3.1.9Michael Keppler2018-12-021-1/+1
|/ | | | | Change-Id: Idc447dfbcd165ef0362142bd17434d304c6c7f01 Signed-off-by: Michael Keppler <Michael.Keppler@gmx.de>
* Update Apache commons compress to 1.18.0Matthias Sohn2018-11-282-3/+3
| | | | | | | | | | | to consume fix for vulnerability [1] in Apache commons compress which is fixed in version 1.18. [1] https://nvd.nist.gov/vuln/detail/CVE-2018-1324 CQ: 18320 Change-Id: I39b1d815e5b8e0208600afafe7a72bb603d04fb8 Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>
* Fix running tests from bazelMatthias Sohn2018-11-284-0/+43
| | | | | | | | The new dependency to mockito for JDKHttpConnectionTest wasn't added for bazel test run. Change-Id: Ie967b7152340a0b3e05cced7eadfd40af78d9995 Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>
* Update Orbit to I20181128011035Matthias Sohn2018-11-2813-34/+34
| | | | | | | | | | to consume fix for vulnerability [1] in Apache commons compress which is fixed in version 1.18. [1] CVE-2018-1324 CQ: 18320 Change-Id: I01e435fda834bbb22892a1cfba411d0196d7de17 Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>
* Update bcprov-jdk15on used in tests to 1.59Matthias Sohn2018-11-281-3/+1
| | | | | CQ: 15889 Change-Id: I04c9099941dd1929cd9075ad6c89660a63e7de8f Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>
* Merge "Fix IndexDiffs for git links"Christian Halstrick2018-11-287-4/+129
|\
| * Fix IndexDiffs for git linksThomas Wolf2018-11-267-4/+129
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | After cloning a repo with a submodule, non-recursively, JGit would encounter in its TreeWalk in IndexDiff: * first, a missing gitlink (in index & HEAD, not in working tree) * second, the untracked folder (not in index and head, in working tree) As a result, it would report the submodule as missing. Canonical git reports a clean workspace. The root cause of this is that the path of a gitlink "x" did not compare equal to the path of a tree "x" in JGit. Correct Paths.compare() to account for that. If two paths are otherwise equal, then let gitlinks match both trees and files. Matching trees solves the bug. Matching files is necessary to handle the case where the gitlink directory was replaced by a file; see the new test case IndexDiffSubmoduleTest.testSubmoduleReplacedByFile(). Comparisons of unequal paths are left untouched, so the sort order is unchanged. After the fix, another bug(?) in WorkingTreeIterator became apparent: with core.dirNoGitLinks = true, it was no longer possible to overwrite a gitlink in the index. This is now fixed in WorkingTreeIterator. Add new test cases for the bug itself and for some related cases (submodule directory deleted or replaced by a file) in IndexDiffSubmoduleTest. Add a test for missing files in IndexDiffTest, and adapt the PathsTest to test matching gitlinks. Bug: 467631 Change-Id: I0549d10d46b1858e5eec3cc15095aa9f1d5f5280 Signed-off-by: Thomas Wolf <thomas.wolf@paranor.ch>
* | Merge branch 'stable-5.1'David Pursehouse2018-11-272-26/+68
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | * stable-5.1: Fix DescribeCommand with multiple match options Fix git-describe tie-breakers Change-Id: I64d9b0099fc0d8449ec08f0b5653572b5c2f840f Signed-off-by: David Pursehouse <david.pursehouse@gmail.com>
| * \ Merge branch 'stable-5.0' into stable-5.1David Pursehouse2018-11-272-26/+68
| |\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * stable-5.0: Fix DescribeCommand with multiple match options Fix git-describe tie-breakers Change-Id: I63e7a56bb617b5ce8774e1dc7f5efdde25e7cd97 Signed-off-by: David Pursehouse <david.pursehouse@gmail.com>
| | * \ Merge branch 'stable-4.11' into stable-5.0David Pursehouse2018-11-272-26/+68
| | |\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * stable-4.11: Fix DescribeCommand with multiple match options Fix git-describe tie-breakers Change-Id: Ibb98f143ee0ce7635beb30ec404b4134a73788f6 Signed-off-by: David Pursehouse <david.pursehouse@gmail.com>
| | | * | Fix DescribeCommand with multiple match optionsMatthias Sohn2018-11-262-12/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | when multiple match options are given in git describe the result must not depend on the order of the match options. JGit wrongly picked the first match using the match options in the order they were defined. Fix this by concatenating the streams of matching tags for all match options and then choosing the first match on the concatenated stream sorted in tie break order. See https://git-scm.com/docs/git-describe#git-describe---matchltpatterngt Change-Id: Id01433d35fa16fb4c30526605bee041ac1d954b2 Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>
| | | * | Fix git-describe tie-breakersHåvard Wall2018-11-092-16/+62
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Correct behaviour as git 1.7.1.1 is to resolve tie-breakers to choose the most recent tag. https://github.com/git/git/blob/master/Documentation/RelNotes/1.7.1.1.txt: * "git describe" did not tie-break tags that point at the same commit correctly; newer ones are preferred by paying attention to the tagger date now. Bug: 538610 Change-Id: Ib0b2a301997bb7f75935baf7005473f4de952a64 Signed-off-by: Håvard Wall <haavardw@gmail.com>
* | | | | Remove unused externalized text "submodulesNotSupported"Matthias Sohn2018-11-271-1/+0
| |_|_|/ |/| | | | | | | | | | | | | | | | | | | This text is unused since d72b9328. Change-Id: I82e5652e205d7b238ff8adc21994029b828b09f4 Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>
* | | | Add a method to get all values of HTTP header defined as listMatthias Sohn2018-11-268-5/+205
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | According to RFC 2616 [1] header field names are case insensitive. Header fields defined as a comma separated list can have multiple header fields with the same field name. Add a method to HttpConnection which retrieves all values with a given header field name with the field name compared case insensitive. [1] https://tools.ietf.org/html/rfc2616#section-4.2" Change-Id: I7f601b21cda99e84f43f866c7c7cb4cb0e3cf5c3 Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>
* | | | Undo treating blobs with NULs as a single lineThomas Wolf2018-11-264-17/+84
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This partially reverts commit a551b646: revert the changes in RawParseUtils.lineMap(). Forcing all blobs containing a NUL byte as a single line causes blame to produce useless results as soon as it hits any version containing a NUL byte. Doing binary detection at this level also has the problem that the user cannot control it. Not by setting the text attribute nor in any other way. This came up in bug 541036, where a Java source inadvertently contained NUL bytes in strings. Even fixing this by using escapes "\000" will not fix JGit's blame for this file because the past versions will still contain the NUL byte. Native git can blame that file from bug 541036 fine. Added new tests verifying that blaming a text file containing a NUL byte produces sensible results. Bug: 541036 Change-Id: I8991bec88e9827cc096868c6026ea1890b6d0d32 Signed-off-by: Thomas Wolf <thomas.wolf@paranor.ch>
* | | | Update Ant to 1.10.5Matthias Sohn2018-11-228-21/+21
| | | | | | | | | | | | | | | | | | | | CQ: 18322 Change-Id: I88982116e02598b0ac658c4d740d7a7c1e37280a Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>
* | | | Update Orbit to S20181120221132 for 2018-12Matthias Sohn2018-11-2213-20/+20
| | | | | | | | | | | | | | | | Change-Id: Ice169d000e4757732e847ba5e2ea5e59945a09e8 Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>
* | | | Update mockito to 2.13.0Matthias Sohn2018-11-227-40/+68
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Update mockito and its dependencies to latest version available in Orbit: - mockito 2.13.0.v20180426-1843 - net.bytebuddy.byte-buddy 1.7.9.v20180420-1519 - net.bytebuddy.byte-buddy-agent 1.7.9.v20180420-1519 - org.objenesis 2.6.0.v20180420-1519 CQ: 18301 CQ: 18303 CQ: 18319 Change-Id: I3dd01e5b0b5a023fcb6530e8ec76729cfc41d735 Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>
* | | | Remove unnecessary modifiers from interfacesJonathan Nieder2018-11-206-19/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This continues what commit d9ac7ddf1026123fee6c4477d172d614522dfc08 (Remove unnecessary modifiers from interfaces, 2018-11-15) started. Change-Id: I89720985a5a986722a0dcb9b5e9bbc25996bd5b3
* | | | New GpgConfig for typed access to GPG settingsGunnar Wagenknecht2018-11-203-0/+298
| | | | | | | | | | | | | | | | | | | | Change-Id: Ifece38132e0390931d33b5678bbbd4a43f9099da Signed-off-by: Gunnar Wagenknecht <gunnar@wagenknecht.org>
* | | | Revert C Git 1.7.5 bug workaroundMasaya Suzuki2018-11-195-70/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts the workaround introduced by 1c6c73c5a9b8dd700be45d658f165a464265dba7, which is a patch for dealing with a buggy C Git client v1.7.5 in 2012. We'll stop supporting very old C Git clients. Change-Id: I94999a39101c96f210b5eca3c2f620c15eb1ac1b Signed-off-by: Masaya Suzuki <masayasuzuki@google.com>
* | | | Apache MINA sshd client: don't leak HostConfigEntryThomas Wolf2018-11-173-17/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ProxyDataFactory had a parameter of type HostConfigEntry, but actually it wasn't used anywhere. Remove it -- it was the last leaked type from Apache MINA sshd. Also use the logger provided by upstream SshClient instead of creating a new Logger. Bug: 520927 Change-Id: Iaa78bbb998a5e574fa091664b75c48a3b9cfb897 Signed-off-by: Thomas Wolf <thomas.wolf@paranor.ch>
* | | | Apache MINA sshd client: test & fix password authenticationThomas Wolf2018-11-1711-26/+431
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add tests for password and keyboard-interactive authentication. Implement password authentication; the default provided by sshd is non-interactive, which is not useful for JGit. Make sure the CredentialsProvider gets reset on successive password retrieval attempts. Otherwise it might always return the same non- accepted password from a secure storage. (That one was discovered by actually trying this via EGit; the JGit tests don't catch this.) Change the default order of authentication mechanisms to prefer password over keyboard-interactive. This is a mitigation for upstream bug SSHD-866.[1] Also include a fix for upstream bug SSHD-867.[2] [1] https://issues.apache.org/jira/projects/SSHD/issues/SSHD-866 [2] https://issues.apache.org/jira/projects/SSHD/issues/SSHD-867 Bug: 520927 Change-Id: I423e548f06d3b51531016cf08938c8bd7acaa2a9 Signed-off-by: Thomas Wolf <thomas.wolf@paranor.ch>
* | | | Move SshTestGitServer to new bundle org.eclipse.jgit.junit.sshThomas Wolf2018-11-1727-93/+916
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Create the bundle and move the SshTestGitServer there. Verified that the Eclipse build still works and ran JSchSshTest and ApacheSshTest as junit tests inside Eclipse. Update maven build and features to account for that. Verified by running full maven build including packaging. Update bazel build files to account for that. Verified by a clean-slate bazel build :all, followed by running the JSchSshTest and the ApacheSshTest via bazel. Change-Id: Ia084942f4425b454529de148e00417e7da786a90 Signed-off-by: Thomas Wolf <thomas.wolf@paranor.ch>
* | | | Apache MINA sshd client: proxy supportThomas Wolf2018-11-1728-24/+3157
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is not about the ssh config ProxyCommand but about programmatic support for HTTP and SOCKS5 proxies. Eclipse allows the user to specify such proxies, and JSch at least contains code to connect through proxies. So our Apache MINA sshd client also should be able to do this. Add interfaces and provide two implementations for HTTP and SOCKS5 proxies. Adapt the core code to be able to deal with proxy connections at all. The built-in client-side support for this in sshd 2.0.0 is woefully inadequate. Tested manually by running proxies and then fetching various real- world repositories via these proxies from different servers. Proxies tested: ssh -D (SOCKS, anonymous), tinyproxy (HTTP, anonymous), and 3proxy (SOCKS & HTTP, username-password authentication). The GSS-API authentication is untested since I have no Kerberos setup. Bug: 520927 Change-Id: I1a5c34687d439b3ef8373c5d58e24004f93e63ae Signed-off-by: Thomas Wolf <thomas.wolf@paranor.ch>
* | | | Apache MINA sshd client: don't leak upstream classes and interfacesThomas Wolf2018-11-1610-94/+343
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We will get an API evolution problem if we expose as API classes and interfaces that derive from upstream classes or interfaces. Upstream interfaces also evolve quite erratically and evolution doesn't seem to follow semantic versioning. Introduce a new KeyPasswordProvider interface so that we don't have to depend on the upstream FilePasswordProvider in our API. (We do need _some_ abstraction for getting passwords for encrypted keys in the API; EGit will need to provide its own implementation.) Move some other upstream dependencies (HostConfigEntry, and various previously protected methods in SshdSessionFactory) out of the API: classes moved to internal space, and methods made private. The only dependencies on upstream interfaces are thus in a few method parameter types. Those cannot be avoided, but should also not pose problems. Bug: 520927 Change-Id: Idc9c6b0f237f29f46343c0fe15179242f2007bec Signed-off-by: Thomas Wolf <thomas.wolf@paranor.ch>
* | | | Remove unnecessary modifiers from interfacesIvan Frade2018-11-1532-119/+117
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | From Oracle's "Defining an interface": "All abstract, default, and static methods in an interface are implicitly public, so you can omit the public modifier." (Without any modifier, the interface methods are also abstract, so we omit also the "abstract") "In addition, an interface can contain constant declarations. All constant values defined in an interface are implicitly public, static, and final. Once again, you can omit these modifiers." This makes the code more consistent. Now all interfaces under org.eclipse.jgit follow the guidelines. Change-Id: I4fe6deb111899ec1b4318ab5a6050f3851fa1fd3 Signed-off-by: Ivan Frade <ifrade@google.com>
* | | | Merge "Call unlockPack in finally"David Pursehouse2018-11-141-11/+17
|\ \ \ \
| * | | | Call unlockPack in finallyMasaya Suzuki2018-11-111-11/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The lock is obtained in receivePackAndCheckConnectivity. It seems to me the structure that requres the caller to unlock the lock is wrong, but at least by calling in finally ensures it is called even if an exception is thrown. Change-Id: I123841b017baf5acffe0064d1004ef11a0a5e6c2 Signed-off-by: Masaya Suzuki <masayasuzuki@google.com>
* | | | | Format org.eclipse.jgit.pgm/BUILD with buildifierDavid Pursehouse2018-11-141-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | Change-Id: I08de1e262c56ffdd9f4bc9b58f7b43964cce969a Signed-off-by: David Pursehouse <david.pursehouse@gmail.com>
* | | | | Add --ssh option to command-line commandsThomas Wolf2018-11-147-0/+87
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Enables using the new ssh client based on Apache MINA sshd instead of the old JSch client. The default is still JSch, so unless the command is invoked with --ssh apache, there's no change. I prefer this over some fiddling with the GIT_SSH environment variable since that variable is handled in the JGit core bundle, which should remain free of any dependency to org.eclipse.jgit.ssh.apache to avoid problems in Gerrit or other JGit users that may use a different Apache MINA sshd version. Bug: 520927 Change-Id: I8460759c7113ef7887520fb0d297aa312200c69f Signed-off-by: Thomas Wolf <thomas.wolf@paranor.ch>
* | | | | Apache MINA sshd: use NumberOfPasswordPrompts for encrypted keysThomas Wolf2018-11-1410-21/+555
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | sshd only asks exactly once for the password. C.f. upstream issue SSHD-850.[1] So we have to work around this limitation for now. Once we move to sshd > 2.1.0, this can be simplified somewhat. [1] https://issues.apache.org/jira/browse/SSHD-850 Bug: 520927 Change-Id: Id65650228486c5ed30affa9c62eac982e01ae207 Signed-off-by: Thomas Wolf <thomas.wolf@paranor.ch>
* | | | | Merge "Format BUILD files with buildifier"David Pursehouse2018-11-143-13/+13
|\ \ \ \ \
| * | | | | Format BUILD files with buildifierDavid Pursehouse2018-11-133-13/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Change-Id: I7eb83e0560b1826c4f8567e9bc5fbdb2ae3fe9d0 Signed-off-by: David Pursehouse <david.pursehouse@gmail.com>
* | | | | | Apache MINA sshd client: properly handle HostKeyAlgorithms configThomas Wolf2018-11-1310-17/+518
|/ / / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | By default sshd will use its default built-in list, which matches the one of openssh (as far as the algorithms exist in sshd at all). But it doesn't handle HostKeyAlgorithms from the ssh config at all. Implement this as in openssh, including the '+' and '-' modifiers and reordering the default if there are known host keys for a server already. Add tests for the reordering. Also use a more robust reader for the known hosts file. The default aborts on the first error. Bug: 520927 Change-Id: Ib1684440bfe2e96140536aa1a93c4bd4a0d35916 Signed-off-by: Thomas Wolf <thomas.wolf@paranor.ch>
* | | | | Apache MINA sshd client: respect NumberOfPasswordPromptsThomas Wolf2018-11-133-0/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Set the internal property on the session as defined in the ssh config. Note that NumberOfPasswordPrompts in openssh applies independently to both user logins in keyboard-interactive authentication _and_ to passphrases for identity files (encrypted keys). Apache MINA sshd uses the setting only for keyboard-interactive authentication, but not for identity file passphrase prompts. For identity files, it asks exactly once. This has been reported as issue SSHD-850 upstream.[1] [1] https://issues.apache.org/jira/browse/SSHD-850 Bug: 520927 Change-Id: I390ffe9e1c52b96d3e8e28fd8edbdc73dde9edb4 Signed-off-by: Thomas Wolf <thomas.wolf@paranor.ch>
* | | | | Apache MINA sshd client: add gssapi-with-mic authenticationThomas Wolf2018-11-138-5/+653
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | sshd does support gssapi-with-mic on the server side, but has no built-in client-side support for this authentication mechanism. Add our own implementation for it, following RFC 4462.[1] To avoid needlessly re-trying mechanisms that aren't even configured on the client, we disable mechanisms that fail on the very first attempt to use them. Since we have no real Kerberos5 test setup, this cannot be fully tested in CI. The disabling of the authentication mechanism and that it is skipped when not successful _is_ tested. [1] https://www.ietf.org/rfc/rfc4462.txt Bug: 520927 Change-Id: I5d0cdb14103588a57c52f927df541b589ab88d88 Signed-off-by: Thomas Wolf <thomas.wolf@paranor.ch>
* | | | | Add ssh tests for PreferredAuthenticationsThomas Wolf2018-11-134-0/+63
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Tests that it works with unknown authentications in the list, and fails if there are no common authentications between server and client. The latter also tests that the ssh config setting is taken into account at all. And promptly the JGit sshd client didn't. Add a fix for this. It's a tiny bit hacky: Apache MINA looks up a custom property set on a hierarchy of "PropertyResolver"s starting with the session. On the session itself this property can never be set since it's read already in the session constructor before anyone had any chance to set it. The next element in the resolver hierarchy is the sshd SshClient, and so we set that property there. Since we use one SshClient and one ClientSession per JGit SshdSession, this is OK. Bug: 520927 Change-Id: I62446fc1fffde125a8965c030240f0918ae234b7 Signed-off-by: Thomas Wolf <thomas.wolf@paranor.ch>
* | | | | Add features for the Apache MINA sshd implementationThomas Wolf2018-11-1329-28/+1238
| | | | | | | | | | | | | | | | | | | | | | | | | Bug: 520927 Change-Id: Ida3e218e0552848ef6285de1dc1e41866f7f873e Signed-off-by: Thomas Wolf <thomas.wolf@paranor.ch>
* | | | | Apache MINA sshd clientThomas Wolf2018-11-13101-9/+5740
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add a new ssh client implementation based on Apach MINA sshd 2.0.0. This implementation uses JGit's own config file parser and host entry resolver. Code inspection of the Apache MINA implementation revealed a few bugs or idiosyncrasies that immediately would re-introduce bugs already fixed in the past in JGit. Apache MINA sshd is not without quirks either, and I had to configure and override more than I had expected. But at least it was all doable in clean ways. Apache MINA boasts support for Bouncy Castle, so in theory this should open the way to using more ssh key algorithms, such as ed25519. The implementation is in a separate bundle and is still not used in the core org.eclipse.jgit bundle. The tests re-use the ssh tests from the core test bundle. Bug: 520927 Change-Id: Ib35e73c35799140fe050d1ff4fb18d0d3596580e Signed-off-by: Thomas Wolf <thomas.wolf@paranor.ch>
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-17 00:28:44 +0000