summaryrefslogtreecommitdiffstats
path: root/org.eclipse.jgit.ssh.apache
Commit message (Collapse)AuthorAgeFilesLines
* JGit v5.4.0.201906120450-rMatthias Sohn2019-06-123-4/+4
| | | | | Change-Id: Iea17cba848d4e53d69d34e952a2476c375721aa4 Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>
* Prepare 5.4.0-SNAPSHOT buildsMatthias Sohn2019-05-223-4/+4
| | | | | Change-Id: I9df6fccee253d4087f9afab4cb46e0a40b8a5699 Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>
* JGit v5.4.0.201905221418-m3v5.4.0.201905221418-m3Matthias Sohn2019-05-223-4/+4
| | | | | Change-Id: I8a7e687acfcf8c341abd726ae60b5ee173422215 Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>
* Convert to lambda or member referenceCarsten Hammer2019-05-161-11/+6
| | | | | | | | | | | Convert anonymous inner classes to lambda expressions or member references Bug: 545856 CQ: 19537 Change-Id: I621431c178e8b99316314602f7c66c9a36f9ae98 Signed-off-by: Carsten Hammer <carsten.hammer@t-online.de> Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>
* Apache MINA sshd client: test reading encrypted ed25519 keysThomas Wolf2019-05-062-0/+7
| | | | | | | | | | | | | | | Add encrypted ed25519 keys in the tests; sshd 2.2.0 can finally decrypt encrypted new-style OpenSSH key files. (Needs the "unlimited strength" JCE, which is the default since Java 8u161. On older JREs, users should install the policy files available from Oracle.) The "expensive" key added has been generated with OpenSSH's ssh-keygen -t ed25519 -a 256, i.e., with 256 bcrypt KDF rounds instead of the default 16. On my machine it takes about 2sec to decrypt. Bug: 541703 Change-Id: Id3872ca2fd75d8f009cbc932eeb6357d3d1f267c Signed-off-by: Thomas Wolf <thomas.wolf@paranor.ch>
* Apache MINA sshd client: adapt to sshd 2.2.0Thomas Wolf2019-05-0616-790/+174
| | | | | | | | | | | | | | Update target platforms, maven and bazel builds to use sshd 2.2.0. Adapt internal classes to changed sshd interfaces and remove previous work-arounds for asking repeatedly for key passwords and for loading keys lazily; both are now done by sshd. CQ: 19034 CQ: 19035 Bug: 541425 Change-Id: I85e1df6ebb8a94953a912d9b2b8a7b5bdfbd608a Signed-off-by: Thomas Wolf <thomas.wolf@paranor.ch> Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>
* Merge branch 'stable-5.3'Matthias Sohn2019-04-293-32/+44
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * stable-5.3: Prepare 5.3.2-SNAPSHOT builds JGit v5.3.1.201904271842-r Prepare 5.2.3-SNAPSHOT builds JGit v5.2.2.201904231744-r Revert 4678f4b and provide another solution for bug 467631 Apache MINA sshd: make sendKexInit() work also for re-keying Prepare 5.1.8-SNAPSHOT builds JGit v5.1.7.201904200442-r ObjectUploadListener: Add callback interface Prepare 4.11.9-SNAPSHOT builds JGit v4.11.8.201904181247-r Prepare 4.9.11-SNAPSHOT builds JGit v4.9.10.201904181027-r Prepare 4.7.10-SNAPSHOT builds JGit v4.7.9.201904161809-r Prepare 4.5.8-SNAPSHOT builds JGit v4.5.7.201904151645-r Remember the cause for invalidating a packfile Fix API problem filters Fix pack files scan when filesnapshot isn't modified Change-Id: I8a8671f7767444a77b809bd66a27d776c8332736 Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>
| * Prepare 5.3.2-SNAPSHOT buildsMatthias Sohn2019-04-283-16/+16
| | | | | | | | | | Change-Id: Iedd56602acc89783387098c7f92ce0e5bad091e0 Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>
| * JGit v5.3.1.201904271842-rv5.3.1.201904271842-rMatthias Sohn2019-04-283-4/+4
| | | | | | | | | | Change-Id: If3c323acfd2b6933f7d4fbec480cd4e82224f701 Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>
| * Merge branch 'stable-5.2' into stable-5.3Matthias Sohn2019-04-283-32/+44
| |\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * stable-5.2: Prepare 5.2.3-SNAPSHOT builds JGit v5.2.2.201904231744-r Revert 4678f4b and provide another solution for bug 467631 Apache MINA sshd: make sendKexInit() work also for re-keying Prepare 5.1.8-SNAPSHOT builds JGit v5.1.7.201904200442-r ObjectUploadListener: Add callback interface Prepare 4.11.9-SNAPSHOT builds JGit v4.11.8.201904181247-r Prepare 4.9.11-SNAPSHOT builds JGit v4.9.10.201904181027-r Prepare 4.7.10-SNAPSHOT builds JGit v4.7.9.201904161809-r Prepare 4.5.8-SNAPSHOT builds JGit v4.5.7.201904151645-r Remember the cause for invalidating a packfile Fix API problem filters Fix pack files scan when filesnapshot isn't modified Change-Id: Ie7e572ac7e346f21fe0c387d7448be168a9c127a Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>
| | * Prepare 5.2.3-SNAPSHOT buildsMatthias Sohn2019-04-243-16/+16
| | | | | | | | | | | | | | | Change-Id: I6ae3db901d986467128326073d4ba70406ae8385 Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>
| | * JGit v5.2.2.201904231744-rv5.2.2.201904231744-rMatthias Sohn2019-04-233-4/+4
| | | | | | | | | | | | | | | Change-Id: I4ed2aff28bff702a8c1b42814acb04c7ef9025a7 Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>
| | * Apache MINA sshd: make sendKexInit() work also for re-keyingThomas Wolf2019-04-203-32/+44
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The message delaying for the initial SSH messages (client identification followed by the initial key exchange request) was broken. sendKexInit() is _also_ called when a new key exchange is requested. We inadvertently also re-sent the client identification at that point, which is wrong and makes the server terminate the connection. Re-keying occurs from time to time during an SSH connection depending on time, the number of messages (packets/blocks) exchanged, or the amount of data exchanged. The net result was that for large repositories data-intensive operations failed on the first re-keying. Change the initial message delay such that the two messages for the client identification and the initial key exchange can be buffered individually while the proxy protocol is still in progress. The AbstractClientProxyConnector can now buffer several commands, which should also resolve bug 544715. Bug: 545920 Change-Id: If09ee963a439b39098a0f52a1510237b428df8dd Signed-off-by: Thomas Wolf <thomas.wolf@paranor.ch>
| | * Prepare 5.2.2-SNAPSHOT buildsMatthias Sohn2018-12-273-16/+16
| | | | | | | | | | | | | | | Change-Id: I9487f6a59ed684ad13bcfbff7d6c730ae4f37030 Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>
| | * JGit v5.2.1.201812262042-rv5.2.1.201812262042-rMatthias Sohn2018-12-273-4/+4
| | | | | | | | | | | | | | | Change-Id: Idfefc54e898f364407a931b787a26db2489b031c Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>
| | * Prepare 5.2.1-SNAPSHOT buildsMatthias Sohn2018-12-073-16/+16
| | | | | | | | | | | | | | | Change-Id: I68d9f5b1c8ca8e8eada9143093dc4fa82519edd8 Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>
| | * JGit v5.2.0.201812061821-rv5.2.0.201812061821-rMatthias Sohn2018-12-073-4/+4
| | | | | | | | | | | | | | | Change-Id: I8528c913ad1a820ee9a2fa6be1c9125b518caefe Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>
| * | Prepare 5.3.1-SNAPSHOT buildsMatthias Sohn2019-03-133-16/+16
| | | | | | | | | | | | | | | Change-Id: I8dc5e47bd19809d684579610edf922abca3cb3cc Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>
| * | JGit v5.3.0.201903130848-rv5.3.0.201903130848-rMatthias Sohn2019-03-133-4/+4
| | | | | | | | | | | | | | | Change-Id: I52256a6d07011030698299d9a97dd01ea825fb7f Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>
| * | Prepare 5.3.0-SNAPSHOT buildsMatthias Sohn2019-03-063-4/+4
| | | | | | | | | | | | | | | Change-Id: I9b934bcfad3d2091f4da163170348b0c8ef5e732 Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>
| * | JGit v5.3.0.201903061415-rc1v5.3.0.201903061415-rc1Matthias Sohn2019-03-063-4/+4
| | | | | | | | | | | | | | | Change-Id: I85866af97fe1c0c0a0da83a7605484082fa56b52 Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>
* | | Use Arrays.asList instead of copying array in a for loopCarsten Hammer2019-04-141-3/+2
| | | | | | | | | | | | | | | Change-Id: Ie44950f7d2f2f94a0412efb6c274f6e1e31efcd6 Signed-off-by: Carsten Hammer <carsten.hammer@t-online.de> Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>
* | | Join catch sections using multicatchCarsten Hammer2019-04-131-4/+1
| | | | | | | | | | | | | | | Change-Id: I1a9112e6a4f938638c599b489cb0858eca27ab91 Signed-off-by: Carsten Hammer <carsten.hammer@t-online.de> Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>
* | | Prepare 5.4.0-SNAPSHOT buildsMatthias Sohn2019-03-073-16/+16
|/ / | | | | | | | | Change-Id: I90a4791f63d0eba23da744c720e869f1830b86e7 Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>
* | SshdSessionFactory: generalize providing default keysThomas Wolf2019-01-224-24/+71
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Provide a mechanism for a subclass to provide its own set of default identities from anywhere as an Iterable<KeyPair>. The default implementation is functionally unchanged and uses the known default identity files in the ~/.ssh directory. A subclass can override the getDefaultKeys() function and return whatever keys are appropriate. Bug: 543152 Change-Id: I500d63146bc67e20e051f617790eb87c7cb500b6 Signed-off-by: Thomas Wolf <thomas.wolf@paranor.ch>
* | Consistently import constants from StandardCharsets as staticDavid Pursehouse2019-01-205-18/+18
| | | | | | | | | | Change-Id: I143c242c0e3299323ae166a59947b1195539e6bf Signed-off-by: David Pursehouse <david.pursehouse@gmail.com>
* | Apache MINA sshd client: less aggressive key file name cachingThomas Wolf2019-01-054-5/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | Don't use the ~/.ssh directory as cache key for the key provider but the configured paths of the default keys. Otherwise changes in that list of paths are not picked up. This is in particular a problem for EGit, where the user can modify this list of keys interactively in the preferences. Without this change, Eclipse needs to be restarted to pick up such changes. Bug: 542845 Change-Id: I63432fb10729a90b3c5e14f13e39bf482aef811b Signed-off-by: Thomas Wolf <thomas.wolf@paranor.ch>
* | Avoid double wordsMincong HUANG2018-12-211-1/+1
| | | | | | | | | | Change-Id: I0fdf595cba93f5a5cdd0496cee07ac91db304532 Signed-off-by: Mincong Huang <mincong.h@gmail.com>
* | Remove unnecessary @since tags from non-API classesDavid Pursehouse2018-12-203-3/+0
| | | | | | | | | | Change-Id: I6bed174c062a0785641dc8ad69151bf7e843cdcf Signed-off-by: David Pursehouse <david.pursehouse@gmail.com>
* | Enable japicmp for new SSH bundle; update its baselineThomas Wolf2018-12-151-2/+2
| | | | | | | | | | | | | | | | | | In the original contribution of this bundle, japicmp was disabled as no previous version to compare against existed. Enable it now. Update the version to compare against to 5.2.0.201812061821-r. Change-Id: I42f812befde2d0d98db5f87e05230b51af244ae6 Signed-off-by: Thomas Wolf <thomas.wolf@paranor.ch>
* | Prepare 5.3.0-SNAPSHOT buildsMatthias Sohn2018-12-033-16/+16
|/ | | | | Change-Id: I8951c2cf650cc3e41d2baa0b330b94468cfed5c2 Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>
* Apache MINA sshd client: enable support for ed25519 keysThomas Wolf2018-12-023-1/+10
| | | | | | | | | | | | | | | Include the net.i2p.crypto.eddsa bundle via a hard dependency. Add tests for dealing with ed25519 host keys and user key files. Manual tests: fetching from git.eclipse.org with an ed25519 user key, and pushing this change itself using the same ed25519 key. Note that sshd 2.0.0 does not yet support encrypted ed25519 private keys. Bug: 541272 Change-Id: I7072f4014d9eca755b4a2412e19c086235e5eae9 Signed-off-by: Thomas Wolf <thomas.wolf@paranor.ch>
* Prepare 5.2.0-SNAPSHOT buildsMatthias Sohn2018-11-303-4/+4
| | | | | Change-Id: I18646aaeee51047b234b758dcc1c2f89fd01b2f8 Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>
* JGit v5.2.0.201811281532-m3v5.2.0.201811281532-m3Matthias Sohn2018-11-283-4/+4
| | | | | Change-Id: I79988b473d67e565d8f6bcac40ee9a14b26c9e60 Signed-off-by: Matthias Sohn <matthias.sohn@sap.com>
* Remove unnecessary modifiers from interfacesJonathan Nieder2018-11-202-2/+2
| | | | | | | This continues what commit d9ac7ddf1026123fee6c4477d172d614522dfc08 (Remove unnecessary modifiers from interfaces, 2018-11-15) started. Change-Id: I89720985a5a986722a0dcb9b5e9bbc25996bd5b3
* Apache MINA sshd client: don't leak HostConfigEntryThomas Wolf2018-11-173-17/+7
| | | | | | | | | | | | ProxyDataFactory had a parameter of type HostConfigEntry, but actually it wasn't used anywhere. Remove it -- it was the last leaked type from Apache MINA sshd. Also use the logger provided by upstream SshClient instead of creating a new Logger. Bug: 520927 Change-Id: Iaa78bbb998a5e574fa091664b75c48a3b9cfb897 Signed-off-by: Thomas Wolf <thomas.wolf@paranor.ch>
* Apache MINA sshd client: test & fix password authenticationThomas Wolf2018-11-178-23/+264
| | | | | | | | | | | | | | | | | | | | | | | Add tests for password and keyboard-interactive authentication. Implement password authentication; the default provided by sshd is non-interactive, which is not useful for JGit. Make sure the CredentialsProvider gets reset on successive password retrieval attempts. Otherwise it might always return the same non- accepted password from a secure storage. (That one was discovered by actually trying this via EGit; the JGit tests don't catch this.) Change the default order of authentication mechanisms to prefer password over keyboard-interactive. This is a mitigation for upstream bug SSHD-866.[1] Also include a fix for upstream bug SSHD-867.[2] [1] https://issues.apache.org/jira/projects/SSHD/issues/SSHD-866 [2] https://issues.apache.org/jira/projects/SSHD/issues/SSHD-867 Bug: 520927 Change-Id: I423e548f06d3b51531016cf08938c8bd7acaa2a9 Signed-off-by: Thomas Wolf <thomas.wolf@paranor.ch>
* Apache MINA sshd client: proxy supportThomas Wolf2018-11-1724-21/+3005
| | | | | | | | | | | | | | | | | | | | | | This is not about the ssh config ProxyCommand but about programmatic support for HTTP and SOCKS5 proxies. Eclipse allows the user to specify such proxies, and JSch at least contains code to connect through proxies. So our Apache MINA sshd client also should be able to do this. Add interfaces and provide two implementations for HTTP and SOCKS5 proxies. Adapt the core code to be able to deal with proxy connections at all. The built-in client-side support for this in sshd 2.0.0 is woefully inadequate. Tested manually by running proxies and then fetching various real- world repositories via these proxies from different servers. Proxies tested: ssh -D (SOCKS, anonymous), tinyproxy (HTTP, anonymous), and 3proxy (SOCKS & HTTP, username-password authentication). The GSS-API authentication is untested since I have no Kerberos setup. Bug: 520927 Change-Id: I1a5c34687d439b3ef8373c5d58e24004f93e63ae Signed-off-by: Thomas Wolf <thomas.wolf@paranor.ch>
* Apache MINA sshd client: don't leak upstream classes and interfacesThomas Wolf2018-11-1610-94/+343
| | | | | | | | | | | | | | | | | | | | | | | We will get an API evolution problem if we expose as API classes and interfaces that derive from upstream classes or interfaces. Upstream interfaces also evolve quite erratically and evolution doesn't seem to follow semantic versioning. Introduce a new KeyPasswordProvider interface so that we don't have to depend on the upstream FilePasswordProvider in our API. (We do need _some_ abstraction for getting passwords for encrypted keys in the API; EGit will need to provide its own implementation.) Move some other upstream dependencies (HostConfigEntry, and various previously protected methods in SshdSessionFactory) out of the API: classes moved to internal space, and methods made private. The only dependencies on upstream interfaces are thus in a few method parameter types. Those cannot be avoided, but should also not pose problems. Bug: 520927 Change-Id: Idc9c6b0f237f29f46343c0fe15179242f2007bec Signed-off-by: Thomas Wolf <thomas.wolf@paranor.ch>
* Apache MINA sshd: use NumberOfPasswordPrompts for encrypted keysThomas Wolf2018-11-148-11/+490
| | | | | | | | | | | sshd only asks exactly once for the password. C.f. upstream issue SSHD-850.[1] So we have to work around this limitation for now. Once we move to sshd > 2.1.0, this can be simplified somewhat. [1] https://issues.apache.org/jira/browse/SSHD-850 Bug: 520927 Change-Id: Id65650228486c5ed30affa9c62eac982e01ae207 Signed-off-by: Thomas Wolf <thomas.wolf@paranor.ch>
* Apache MINA sshd client: properly handle HostKeyAlgorithms configThomas Wolf2018-11-138-10/+445
| | | | | | | | | | | | | | | | | | | By default sshd will use its default built-in list, which matches the one of openssh (as far as the algorithms exist in sshd at all). But it doesn't handle HostKeyAlgorithms from the ssh config at all. Implement this as in openssh, including the '+' and '-' modifiers and reordering the default if there are known host keys for a server already. Add tests for the reordering. Also use a more robust reader for the known hosts file. The default aborts on the first error. Bug: 520927 Change-Id: Ib1684440bfe2e96140536aa1a93c4bd4a0d35916 Signed-off-by: Thomas Wolf <thomas.wolf@paranor.ch>
* Apache MINA sshd client: respect NumberOfPasswordPromptsThomas Wolf2018-11-133-0/+23
| | | | | | | | | | | | | | | | Set the internal property on the session as defined in the ssh config. Note that NumberOfPasswordPrompts in openssh applies independently to both user logins in keyboard-interactive authentication _and_ to passphrases for identity files (encrypted keys). Apache MINA sshd uses the setting only for keyboard-interactive authentication, but not for identity file passphrase prompts. For identity files, it asks exactly once. This has been reported as issue SSHD-850 upstream.[1] [1] https://issues.apache.org/jira/browse/SSHD-850 Bug: 520927 Change-Id: I390ffe9e1c52b96d3e8e28fd8edbdc73dde9edb4 Signed-off-by: Thomas Wolf <thomas.wolf@paranor.ch>
* Apache MINA sshd client: add gssapi-with-mic authenticationThomas Wolf2018-11-136-3/+593
| | | | | | | | | | | | | | | | | | | sshd does support gssapi-with-mic on the server side, but has no built-in client-side support for this authentication mechanism. Add our own implementation for it, following RFC 4462.[1] To avoid needlessly re-trying mechanisms that aren't even configured on the client, we disable mechanisms that fail on the very first attempt to use them. Since we have no real Kerberos5 test setup, this cannot be fully tested in CI. The disabling of the authentication mechanism and that it is skipped when not successful _is_ tested. [1] https://www.ietf.org/rfc/rfc4462.txt Bug: 520927 Change-Id: I5d0cdb14103588a57c52f927df541b589ab88d88 Signed-off-by: Thomas Wolf <thomas.wolf@paranor.ch>
* Add ssh tests for PreferredAuthenticationsThomas Wolf2018-11-133-0/+40
| | | | | | | | | | | | | | | | | | | | Tests that it works with unknown authentications in the list, and fails if there are no common authentications between server and client. The latter also tests that the ssh config setting is taken into account at all. And promptly the JGit sshd client didn't. Add a fix for this. It's a tiny bit hacky: Apache MINA looks up a custom property set on a hierarchy of "PropertyResolver"s starting with the session. On the session itself this property can never be set since it's read already in the session constructor before anyone had any chance to set it. The next element in the resolver hierarchy is the sshd SshClient, and so we set that property there. Since we use one SshClient and one ClientSession per JGit SshdSession, this is OK. Bug: 520927 Change-Id: I62446fc1fffde125a8965c030240f0918ae234b7 Signed-off-by: Thomas Wolf <thomas.wolf@paranor.ch>
* Add features for the Apache MINA sshd implementationThomas Wolf2018-11-132-28/+78
| | | | | Bug: 520927 Change-Id: Ida3e218e0552848ef6285de1dc1e41866f7f873e Signed-off-by: Thomas Wolf <thomas.wolf@paranor.ch>
* Apache MINA sshd clientThomas Wolf2018-11-1336-0/+4685
Add a new ssh client implementation based on Apach MINA sshd 2.0.0. This implementation uses JGit's own config file parser and host entry resolver. Code inspection of the Apache MINA implementation revealed a few bugs or idiosyncrasies that immediately would re-introduce bugs already fixed in the past in JGit. Apache MINA sshd is not without quirks either, and I had to configure and override more than I had expected. But at least it was all doable in clean ways. Apache MINA boasts support for Bouncy Castle, so in theory this should open the way to using more ssh key algorithms, such as ed25519. The implementation is in a separate bundle and is still not used in the core org.eclipse.jgit bundle. The tests re-use the ssh tests from the core test bundle. Bug: 520927 Change-Id: Ib35e73c35799140fe050d1ff4fb18d0d3596580e Signed-off-by: Thomas Wolf <thomas.wolf@paranor.ch>
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-01 17:14:59 +0000