Skip to content

Commit

Permalink
Send ext-info-c with kex algorithms
Browse files Browse the repository at this point in the history
Some SSH servers will not honor the negotiated rsa-sha2-256 algorithms
if the client does not indicate support for SSH_MSG_EXT_INFO messages.
Since we only need to accept these messages, but are free to ignore
their contents, adding support amounts to sending "ext-info-c" with our
kex algorithm proposal.
  • Loading branch information
fmeum committed Jul 20, 2020
1 parent a5efdf1 commit 0cd47c1
Show file tree
Hide file tree
Showing 4 changed files with 28 additions and 1 deletion.
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@
package com.hierynomus.sshj.transport.kex;

import net.schmizz.sshj.transport.kex.KeyExchange;

/**
* Stub kex algorithm factory that indicates support for SSH2_MSG_EXT_INFO.
* Some servers will not send `rsa-sha2-*` signatures if the client doesn't indicate support.
*
* Note: Since the server sends `ext-info-s` to indicate support, this fake kex algorithm is never negotiated.
*/
public class ExtInfoClientFactory implements net.schmizz.sshj.common.Factory.Named<KeyExchange> {
@Override
public String getName() {
return "ext-info-c";
}

@Override
public KeyExchange create() {
return null;
}
}
4 changes: 3 additions & 1 deletion src/main/java/net/schmizz/sshj/DefaultConfig.java
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,7 @@
import com.hierynomus.sshj.transport.cipher.BlockCiphers;
import com.hierynomus.sshj.transport.cipher.StreamCiphers;
import com.hierynomus.sshj.transport.kex.DHGroups;
import com.hierynomus.sshj.transport.kex.ExtInfoClientFactory;
import com.hierynomus.sshj.transport.kex.ExtendedDHGroups;
import com.hierynomus.sshj.transport.mac.Macs;
import com.hierynomus.sshj.userauth.keyprovider.OpenSSHKeyV1KeyFile;
Expand Down Expand Up @@ -125,7 +126,8 @@ protected void initKeyExchangeFactories(boolean bouncyCastleRegistered) {
ExtendedDHGroups.Group16SHA256(),
ExtendedDHGroups.Group16SHA384AtSSH(),
ExtendedDHGroups.Group16SHA512AtSSH(),
ExtendedDHGroups.Group18SHA512AtSSH());
ExtendedDHGroups.Group18SHA512AtSSH(),
new ExtInfoClientFactory());
} else {
setKeyExchangeFactories(DHGroups.Group1SHA1(), new DHGexSHA1.Factory());
}
Expand Down
1 change: 1 addition & 0 deletions src/main/java/net/schmizz/sshj/common/Message.java
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,7 @@ public enum Message {
DEBUG(4),
SERVICE_REQUEST(5),
SERVICE_ACCEPT(6),
EXT_INFO(7),
KEXINIT(20),
NEWKEYS(21),

Expand Down
3 changes: 3 additions & 0 deletions src/main/java/net/schmizz/sshj/transport/TransportImpl.java
Original file line number Diff line number Diff line change
Expand Up @@ -529,6 +529,9 @@ public void handle(Message msg, SSHPacket buf)
case SERVICE_ACCEPT:
gotServiceAccept();
break;
case EXT_INFO:
log.debug("Received SSH_MSG_EXT_INFO");
break;
case USERAUTH_BANNER:
log.debug("Received USERAUTH_BANNER");
break;
Expand Down

0 comments on commit 0cd47c1

Please sign in to comment.