Skip to content

Add support for RSA SHA-2 public key algorithms #1177

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
WojciechNagorski merged 10 commits into from
Sep 23, 2023
Merged

Add support for RSA SHA-2 public key algorithms #1177

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
a0bb979
Abstract out the hash algorithm from RsaDigitalSignature
Rob-Hague Aug 30, 2023
64ef0f1
Add integration tests
Rob-Hague Sep 12, 2023
7e774d4
Add DigitalSignature property to KeyHostAlgorithm
Rob-Hague Sep 16, 2023
3640b35
Add IHostAlgorithmsProvider interface
Rob-Hague Sep 13, 2023
c599ecf
Verify the host signature
Rob-Hague Sep 13, 2023
6aede89
Merge branch 'develop' into rsa-sha2
WojciechNagorski Sep 17, 2023
b03daa8
Fix HostKeyEventArgsTest after merge
Rob-Hague Sep 18, 2023
143b334
Remove PubkeyAcceptedAlgorithms ssh-rsa
WojciechNagorski Sep 19, 2023
14005f8
Add test coverage for RSA keys in PrivateKeyFile
Rob-Hague Sep 19, 2023
614fdaa
Obsolete IPrivateKeySource
Rob-Hague Sep 19, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 0 additions & 2 deletions src/Renci.SshNet.IntegrationTests/Common/RemoteSshdConfigExtensions.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,9 +20,7 @@ public static void Reset(this RemoteSshdConfig remoteSshdConfig)
.ClearCiphers()
.ClearKeyExchangeAlgorithms()
.ClearHostKeyAlgorithms()
.AddHostKeyAlgorithm(HostKeyAlgorithm.SshRsa)
.ClearPublicKeyAcceptedAlgorithms()
.AddPublicKeyAcceptedAlgorithms(PublicKeyAlgorithm.SshRsa)
.WithUsePAM(true)
.Update()
.Restart();
Expand Down
1 change: 0 additions & 1 deletion src/Renci.SshNet.IntegrationTests/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,6 @@ RUN apk update && apk upgrade --no-cache && \
chmod 400 /etc/ssh/ssh*key && \
sed -i 's/#PasswordAuthentication yes/PasswordAuthentication yes/' /etc/ssh/sshd_config && \
sed -i 's/#LogLevel\s*INFO/LogLevel DEBUG3/' /etc/ssh/sshd_config && \
echo 'PubkeyAcceptedAlgorithms ssh-rsa' >> /etc/ssh/sshd_config && \
chmod 646 /etc/ssh/sshd_config && \
# install and configure sudo
apk add --no-cache sudo && \
Expand Down
7 changes: 5 additions & 2 deletions src/Renci.SshNet.TestTools.OpenSSH/SshdConfig.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -211,8 +211,11 @@ public void SaveTo(TextWriter writer)
writer.WriteLine("MACs " + string.Join(",", MessageAuthenticationCodeAlgorithms.Select(c => c.Name).ToArray()));
}

writer.WriteLine("PubkeyAcceptedAlgorithms " + string.Join(",", PublicKeyAcceptedAlgorithms.Select(c => c.Name).ToArray()));

if (PublicKeyAcceptedAlgorithms.Count > 0)
{
writer.WriteLine("PubkeyAcceptedAlgorithms " + string.Join(",", PublicKeyAcceptedAlgorithms.Select(c => c.Name).ToArray()));
}

foreach (var match in Matches)
{
_matchFormatter.Format(match, writer);
Expand Down
2 changes: 1 addition & 1 deletion src/Renci.SshNet/PrivateKeyAuthenticationMethod.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -111,7 +111,7 @@ public override AuthenticationResult Authenticate(Session session)

session.WaitOnHandle(_authenticationCompleted);

if (_authenticationResult == AuthenticationResult.Success)
if (_authenticationResult is AuthenticationResult.Success or AuthenticationResult.PartialSuccess)
Comment thread
Rob-Hague marked this conversation as resolved.
{
break;
}
Expand Down
19 changes: 16 additions & 3 deletions src/Renci.SshNet/PrivateKeyFile.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -270,7 +270,17 @@ private void Open(Stream privateKey, string passPhrase)
break;
case "OPENSSH":
_key = ParseOpenSshV1Key(decryptedData, passPhrase);
HostKey = new KeyHostAlgorithm(_key.ToString(), _key);
if (_key is RsaKey parsedRsaKey)
{
_hostAlgorithms.Add(new KeyHostAlgorithm("rsa-sha2-512", _key, new RsaDigitalSignature(parsedRsaKey, HashAlgorithmName.SHA512)));
_hostAlgorithms.Add(new KeyHostAlgorithm("rsa-sha2-256", _key, new RsaDigitalSignature(parsedRsaKey, HashAlgorithmName.SHA256)));
_hostAlgorithms.Add(new KeyHostAlgorithm("ssh-rsa", _key));
}
else
{
HostKey = new KeyHostAlgorithm(_key.ToString(), _key);
}

break;
case "SSH2 ENCRYPTED":
var reader = new SshDataReader(decryptedData);
Expand Down Expand Up @@ -325,8 +335,11 @@ private void Open(Stream privateKey, string passPhrase)
var inverseQ = reader.ReadBigIntWithBits(); // u
var q = reader.ReadBigIntWithBits(); // p
var p = reader.ReadBigIntWithBits(); // q
_key = new RsaKey(modulus, exponent, d, p, q, inverseQ);
HostKey = new KeyHostAlgorithm("ssh-rsa", _key);
var decryptedRsaKey = new RsaKey(modulus, exponent, d, p, q, inverseQ);
_key = decryptedRsaKey;
_hostAlgorithms.Add(new KeyHostAlgorithm("rsa-sha2-512", _key, new RsaDigitalSignature(decryptedRsaKey, HashAlgorithmName.SHA512)));
_hostAlgorithms.Add(new KeyHostAlgorithm("rsa-sha2-256", _key, new RsaDigitalSignature(decryptedRsaKey, HashAlgorithmName.SHA256)));
_hostAlgorithms.Add(new KeyHostAlgorithm("ssh-rsa", _key));
}
else if (keyType == "dl-modp{sign{dsa-nist-sha1},dh{plain}}")
{
Expand Down