Implement detached signal sender #56
Commits on Sep 12, 2023
-
Use
ChannelMsg::WindowAdjustedduring data transferOpenSSH server sends `CHANNEL_WINDOW_ADJUST` messages before window_size is 0. Handle these message at each turn of the loop within `Channel.send_data` Signed-off-by: Joe Grund <[email protected]>
Commits on Sep 20, 2023
-
-
-
-
-
-
Revert "Use
ChannelMsg::WindowAdjustedduring data transfer"This reverts commit 52e5eaa.
-
Commits on Sep 22, 2023
-
-
-
Moved handling of ChannelMsg::WindowAdjusted in the Session::server_r…
…ead_authenticated() method
-
-
-
-
-
-
-
-
Commits on Sep 26, 2023
Commits on Oct 31, 2023
-
This is analogous to OpenSSH's ServerAliveInterval option.
-
Timer wasn't being reset on each send of keepalive, causing lots of keepalives to be sent rather than just one.
-
-
Commits on Nov 1, 2023
-
-
-
-
-
-
Reduce busywaiting in ChannelTx
Completely eliminating the busywaiting will require using a different or additional synchronization primitive for the window size. `tokio::sync::Notify` will not (yet) suffice because it has no "_owned" variant of its `Notified` future.
-
-
-
-
-
Commits on Nov 3, 2023
Commits on Nov 5, 2023
Commits on Nov 9, 2023
Commits on Nov 15, 2023
Commits on Dec 2, 2023
-
fixed Eugeny#218 - fixed padding calculation, AES-GCM rekey and hmac-…
…sha2-256(-etm) MAC
-
Commits on Dec 11, 2023
Commits on Jan 18, 2024
-
Improve keepalive and inactivity timers
* Add an analogue of OpenSSH's `ServerAliveCountMax`. * Use disjunctive futures for cleanly making these timers optional. * Use the `Session` to pass information back to the main bg loop from the plaintext packet reader, so that only nontrivial data transfer will reset the inactivity timer. (And so that `ServerAliveCountMax` will be judged correctly.)
-
Add ClientAliveInterval analogue to server
Also bring client and server into parity regarding timers. Also, per OpenSSH documentation, only reset keepalive timer when receiving data, not when sending it. Also, always reset the inactivity timer unless the iteration was ended via sending a keepalive request.
-
-
-
-
-
Receive data after exit status in example
Yes, some SSH servers will send data after they've sent the exit status.
Commits on Jan 23, 2024
Commits on Jan 26, 2024
-
-
-
-
-
-
-
Add
russh::server::run_on_socketto facilitate dropping privileges ……immediately after socket binding
-
-
Commits on Feb 3, 2024
-
server/encrypted.rs: respect
proceed_with_methodsin "none" and "pa……ssword" authentication methods
-
Pretty sure this should be "client" since we are the server in this module.
Commits on Feb 4, 2024
Commits on Feb 7, 2024
Commits on Feb 8, 2024
-
-
Merge branch 'refactor/handler_trait' of github.com:ricott1/russh int…
…o refactor/handler_trait
-
Commits on Feb 10, 2024
Commits on Feb 26, 2024
Commits on Feb 27, 2024
-
Additional Disconnect Handling
- Allow Server Handle to trigger Disconnect - Allow Client Handler to read Disconnect reason Rename Handler disconnect event Include all types of disconnect in disconnected callback Remove no longer valid comment
Commits on Mar 1, 2024
Commits on Mar 14, 2024
-
Allow retrieving peer SSH Protocol Version String (Eugeny#260)
Allow retrieving peer SSH Protocol Version String
Commits on Mar 21, 2024
-
Eugeny#259, Eugeny#245, ref Eugeny#227 - fixed host key algo selectio…
…n when Preferred::key and the available host keys don't match (Eugeny#262)
Commits on Mar 27, 2024
-
Fix compilation error when using without the flate2 feature (Eugeny#263)
When compiling without the default features, the compilation of russh fail with message concerning unknown Error type in compression.rs and unknown flate2 crate in lib.rs (when defining the error type) This PR specify the same Error type as the flate2-featured Compression/Decompression function and disable error cases specific to flate2.
Commits on Apr 22, 2024
-
-
Updated
curve25519-dalekto 4.1.2 (Eugeny#269)Due to [this issue](dalek-cryptography/curve25519-dalek#618) the current version of `russh` does not compile on the current nightly compiler. I have updated the dependency for curve25519-dalek to `4.1.2` which solves the problem.
-
Implement ecdsa-sha2-nistp{256,384,521} (Eugeny#267)
* Moved ECDSA into `ec` module. * Added support and tests for these algorithms. Ported and cleaned up from a different fork of thrussh by me. --------- Co-authored-by: Eugene <[email protected]>
Commits on Apr 28, 2024
-
Add pure-rust RSA implementation (Eugeny#273)
* SSH encoding of RSA keys is moved into `protocol` module. * Decouple the SSH encoding into traits. * When `openssl` feature is not enabled, the pure-rust RSA impl is used. Alternative implementation for Eugeny#225
-
Fix ed25519 key format in pkcs8 (Eugeny#272)
* Add support for decoding ed25519 keys in PrivateKeyInfo format * Fix ed25519 encoding and decoding in OneAsymmetricKey format Closes: Eugeny#271 Co-authored-by: Eugene <[email protected]>
-
Replace custom PKCS Eugeny#8 parsing with
dercrate and others (Eug……eny#274) This makes code leaner but pulls in more dependencies. The benefit to us is that we don't have to maintain (and fix) our own DER encoders and decoders for PKCS#8 keys. --------- Co-authored-by: Eugene <[email protected]>
Commits on Apr 30, 2024
Commits on May 4, 2024
-
Implements client support for OpenSSH Certificates (Eugeny#278)
Adds support for using OpenSSH Certificates based on [OpenSSH Specs](https://cvsweb.openbsd.org/src/usr.bin/ssh/PROTOCOL.certkeys?annotate=HEAD) using the existing `PublicKey` authentication. **Approach:** Adds a new `authenticate_openssh_cert()` method, similar to `authenticate_publickey()` for passing certificate and the private key for authentication and signature generation. Internally a new `AuthMethod::OpenSSHCertificate` is added to handle certificate specific authentication flow. **Changes include -** - Updated example `examples/client_exec_interactive.rs` with an optional argument to pass the openssh certificate path. - Dependencies `ssh-key` and `ssh-encoding` are added from `RustCrypto/SSH` for parsing, encoding. The server-side support for this might be tricky, I am yet to explore.
-
Use
ssh-keycrate to decode OpenSSH public/private keys (Eugeny#279)Eugeny#140 Co-authored-by: Eugene <[email protected]>
-
add shoaibmerchant as a contributor for code (Eugeny#280)
Adds @shoaibmerchant as a contributor for code. This was requested by Eugeny [in this comment](Eugeny#278 (comment)) [skip ci] --------- Co-authored-by: allcontributors[bot] <46447321+allcontributors[bot]@users.noreply.github.com>
-
-
-
Commits on May 10, 2024
-
ecdh-sha2-nistp{256,384,521} kex support (Eugeny#282)
Adds support for ecdh-sha2-nistp{256,384,521} key exchange algorithms using the [elliptic-curve](https://docs.rs/elliptic-curve/latest/elliptic_curve/index.html), [p256](https://docs.rs/p256/latest/p256/index.html), [p384](https://docs.rs/p384/latest/p384/), and [p521](https://docs.rs/p521/latest/p521/) crates. Intentionally avoids adding these to the preferred Kex list as the security of these curves is considered controversial. Users would need to explicitly use the kex via config Resolves Eugeny#210 --------- Co-authored-by: Eugene <[email protected]> -
add gleason-m as a contributor for code (Eugeny#283)
Adds @gleason-m as a contributor for code. This was requested by Eugeny [in this comment](Eugeny#282 (comment)) [skip ci] --------- Co-authored-by: allcontributors[bot] <46447321+allcontributors[bot]@users.noreply.github.com>
Commits on May 25, 2024
-
cryptovec: Fix a segmentation fault (Eugeny#288)
The `CryptoVec::resize` implementation was running into a segmentation fault in some case. If the capacity of the vector was more than 0, and that the new allocation failed, the call to `std::ptr::copy_non_overlapping` would have a null pointer as destination. This was very easy to trigger by a malicious peer, they just had to send a packet with an announced size large enough for the allocation to fail. The code now correctly panics, which would only end the current thread and not crash the whole application without giving it a chance to continue running.
-
add elegaanz as a contributor for code (Eugeny#289)
Adds @elegaanz as a contributor for code. This was requested by Eugeny [in this comment](Eugeny#288 (comment)) [skip ci] --------- Co-authored-by: allcontributors[bot] <46447321+allcontributors[bot]@users.noreply.github.com>
Commits on May 26, 2024
-
Allow ssh-rsa keys to be used for rsa-sha2-* auth (Eugeny#290)
This worked before [this change](Eugeny@194430b#diff-81b0128d04a2d9a37bdc6931dec1cb426a8ff7c6ad4ef10e1555ca3e29f08380L159), and is permitted by the specification, as can be seen in [the example in section 3.2 of RFC8332](https://www.rfc-editor.org/rfc/rfc8332#section-3.2).
Commits on May 31, 2024
Commits on Jun 2, 2024
-
Fix hardcoded public key auth negotiation (Eugeny#294)
Authentication using RSA public keys was incorrectly hardcoded to use `ssh-rsa`, i.e., SHA1. This led to public keys set up to use `rsa-sha2-256` or `rsa-sha2-512` falling back to `ssh-rsa` and being rejected by modern SSH servers that are configured not to support SHA1 by default. The solution derives the hash name from the public key instead of hardcoding it.
-
add tomknig as a contributor for code (Eugeny#295)
Adds @tomknig as a contributor for code. This was requested by Eugeny [in this comment](Eugeny#294 (comment)) [skip ci] --------- Co-authored-by: allcontributors[bot] <46447321+allcontributors[bot]@users.noreply.github.com>
Commits on Jun 3, 2024
Commits on Jun 7, 2024
-
Fix block ciphers + HMAC_SHA1_ETM (Eugeny#298)
Due to an incorrect specified array length, any combinaison of a cipher using `block.rs`and `HMAC_SHA1_ETM` such as: ``` let mut config = client::Config::default(); config.preferred.cipher = &[cipher::AES_128_CTR]; config.preferred.mac = &[mac::HMAC_SHA1_ETM]; ``` Would fail during packet auth. ``` [...] [2024-06-07T12:49:14Z DEBUG russh::cipher] reading, clear len = 276 [2024-06-07T12:49:14Z DEBUG russh::cipher] read_exact 280 [2024-06-07T12:49:14Z DEBUG russh::cipher] read_exact done [2024-06-07T12:49:14Z TRACE russh::client] disconnected [2024-06-07T12:49:14Z DEBUG russh::client] disconnected: Error(PacketAuth) [2024-06-07T12:49:14Z TRACE mio::poll] deregistering event source from poller [2024-06-07T12:49:14Z DEBUG russh::client] drop session [2024-06-07T12:49:14Z DEBUG russh::client] drop handle ``` This PR fixes that.
-
add Barre as a contributor for code (Eugeny#300)
Adds @Barre as a contributor for code. This was requested by Eugeny [in this comment](Eugeny#298 (comment)) [skip ci] --------- Co-authored-by: allcontributors[bot] <46447321+allcontributors[bot]@users.noreply.github.com>
Commits on Jun 8, 2024
-
add spoutn1k as a contributor for code (Eugeny#303)
Adds @spoutn1k as a contributor for code. This was requested by Eugeny [in this comment](Eugeny#302 (comment)) [skip ci] --------- Co-authored-by: allcontributors[bot] <46447321+allcontributors[bot]@users.noreply.github.com>
-
Implement
-cbcciphers. (Eugeny#297)This PR addresses issues related to connecting to legacy Cisco devices with no upgrade path (similar to issue Eugeny#277). Changes Introduced • Refactored cipher/mod.rs: Make room to be able to implement CBC crypto support. • Updated cipher/block.rs: To provide an interface compatible with both streaming ciphers and CBC. • General Cipher Updates: Light modifications to other ciphers for compatibility with the new interface. Context I had trouble connecting to older Cisco devices which posed challenges due to their outdated cryptographic support. --------- Co-authored-by: Eugene <[email protected]>
Commits on Jun 28, 2024
Commits on Jul 4, 2024
-
Add support for glob pattern matching in Host directives (Eugeny#306)
- update parse logic to perform host glob matching (using globset) - generalise token expansion so it can be used to qualify hosts as well as localising ProxyCommand - add proxyjump to the config structure --------- Co-authored-by: Adam Chappell <[email protected]>
-
add packetsource as a contributor for code (Eugeny#309)
Adds @packetsource as a contributor for code. This was requested by Eugeny [in this comment](Eugeny#306 (comment)) [skip ci] --------- Co-authored-by: allcontributors[bot] <46447321+allcontributors[bot]@users.noreply.github.com>
Commits on Jul 16, 2024
Commits on Jul 17, 2024
Commits on Jul 18, 2024
-
fixed warp-tech/warpgate#996 - prevent offering unparsable keys from …
…ending the session
Commits on Aug 2, 2024
-
Update Cargo.toml (Eugeny#321)
Bumps the dependency to at least 4.1.3 as per the advisory [Advisory](https://rustsec.org/advisories/RUSTSEC-2024-0344.html) (even though this crate may not be using the function mentioned in the advisory, it is better to bump it to ensure that there is no chance of other dependencies pulling it)
-
Consolidate dirs deps (Eugeny#320)
It seems like the project ended up with two different dependencies providing access to the home directory. This PR consolidates these dependencies into a single dependency. I've done so by using the `home` crate since on linux it has 0 dependencies and is well supported due to being a part of the cargo repo. But if you'd prefer I could swap this PR to use `dirs-next`. I would like to avoid `dirs` since it is pulling in strange dependencies dirs-dev/dirs-sys-rs#26
Commits on Aug 5, 2024
Commits on Aug 14, 2024
-
fixed GHSA-vgvv-x7xg-6cqg - OOM Denial of Service due to allocation o…
…f untrusted packet size
-
-
Commits on Aug 17, 2024
Commits on Aug 20, 2024
-
Implement streamlocal-forward for remote => local UDS forwarding (Eug…
…eny#312) I left a `// NEED HELP` comment on places where I didn't fully figure out what to do, so I'd really appreciate it if some maintainers helped me out in those places. --------- Co-authored-by: Eugene <[email protected]>
-
-
Commits on Aug 21, 2024
-
Remove leftover extraneous debugging in host globbing function (Eugen…
…y#328) Apologies. I accidentally left a stray dbg!() in when checking the glob expansion logic of hosts in the russh-config SSH config parsing code. This PR simply removes it. Co-authored-by: Adam Chappell <[email protected]>
Commits on Aug 22, 2024
-
fixed
Error::Disconnectgetting returned fromconnectinstead of ……the more specific error type when connection fails during kex phase
-
-
Commits on Aug 24, 2024
-
Implement detached signal sender
Allow signals to be sent detached from the channel struct. This is done using a higher-order function and by cloning the sender so it can be used independently of the `Channel`. This is useful to be able to spawn a cancelation handler separately from the main `Channel` recieve loop. Signed-off-by: Joe Grund <[email protected]> f08f74 Signed-off-by: Joe Grund <[email protected]>