Upgrade SSH transport to MINA SSHD 2.14 and fix RSA-SHA2 SSH auth#1487
Open
dkhokhlov wants to merge 2 commits into
Open
Upgrade SSH transport to MINA SSHD 2.14 and fix RSA-SHA2 SSH auth#1487dkhokhlov wants to merge 2 commits into
dkhokhlov wants to merge 2 commits into
Conversation
Add server-sig-algs support so modern OpenSSH clients can negotiate RSA-SHA2 signatures successfully, and adapt the Gitblit SSH command/session integrations to the SSHD 2.x APIs. Also fix publickey auth session handling so the two-step PK_OK flow used by newer SSHD/OpenSSH combinations does not reject the signed follow-up request after the key has already been accepted.
Upgrade the SSH stack to modern MINA SSHD, restore Ed25519/EdDSA key handling, and fix the test harness so SSH integration tests reliably start and reuse the embedded server. Also repair SSH command alias resolution and channel lifecycle handling exposed by the newer client/server behavior.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This updates Gitblit's SSH transport from Apache MINA SSHD
1.7.0to2.14.0and fixes interoperability with modern OpenSSH clients using RSA-SHA2 signatures.The immediate user-visible failure was SSH public key authentication with RSA keys from current OpenSSH clients. In practice this showed up as negotiation/authentication failures against
Gitblit's SSH endpoint. After upgrading the SSH stack, a few SSH test and command-path issues also needed to be corrected to make the upgraded transport behave reliably.
What changed
2.14.0DispatchCommandWhy this is needed
Gitblit
1.10.0is still pinned to an old MINA SSHD release. That older stack does not interoperate correctly with modern OpenSSH RSA public key authentication in practice.Upgrading the dependency alone was not enough. The newer SSH stack exposed two additional issues:
DispatchCommandresolved aliases before the alias map was populated, which broke commands such askeys lsandkeys rmon a fresh dispatcher instanceThis patch fixes both the transport problem and the issues exposed by the upgraded SSH stack.
Validation
I validated the SSH path with focused integration coverage.
Relevant passing tests:
com.gitblit.tests.SshDaemonTestcom.gitblit.tests.SshKeysDispatcherTestcom.gitblit.transport.ssh.FileKeyPairProviderTestThe RSA-SHA2-specific coverage added here lives in:
SshDaemonTestIt verifies authentication with:
rsa-sha2-256rsa-sha2-512and asserts there is no fallback to legacy
ssh-rsa.Notes
This PR is intentionally scoped to the SSH transport and the test/runtime issues directly exposed by that upgrade. It does not try to clean up unrelated test failures elsewhere in the suite.
Fixes #1488