Register a default kex handler with the SshDaemon
With MINA updated to 2.8.0 we can easily support the server-sig-algs key
exchange extension. This is necessary to support modern clients when
using RSA keys as they have begun to disable RSA+SHA1 support. RSA+SHA2
remains viable, but for clients to use that combo the server must
indicate support via the server-sig-algs key exchange extension.
Updating MINA to 2.8.0 was not sufficient for Gerrit because Gerrit does
not use MINA's ServerBuilder. The MINA 2.8.0 update only addresses this
issue automatically when using the ServerBuilder, as it sets the default
kexExtensionHandler for you. Since Gerrit is building the server itself
we need to set the kexExtensionHandler to MINA's default handler which
includes server-sig-algs support. This is the behavior you would get if
using MINA 2.8.0 and its ServerBuilder.
Making this update produces this log line in ssh client logs:
debug1: kex_input_ext_info: server-sig-algs=<...rsa-sha2-512,rsa-sha2-256,ssh-rsa>
This log line does not appear with older Gerrit as the SSH server didn't
previously have a kex handler.
Release-Notes: Support ssh kex server-sig-algs for modern RSA clients
Bug: Issue 13930
Change-Id: Ia822d0ab291ce5a1cc29dfbe2ac9e2de499fafc3
(cherry picked from commit 0b7dba05dfc7d065acc15baee9ec192a99cce4cd)
diff --git a/java/com/google/gerrit/sshd/SshDaemon.java b/java/com/google/gerrit/sshd/SshDaemon.java
index 553287ec..f9d0769 100644
--- a/java/com/google/gerrit/sshd/SshDaemon.java
+++ b/java/com/google/gerrit/sshd/SshDaemon.java
@@ -85,6 +85,7 @@
import org.apache.sshd.common.io.nio2.Nio2ServiceFactoryFactory;
import org.apache.sshd.common.kex.BuiltinDHFactories;
import org.apache.sshd.common.kex.KeyExchangeFactory;
+import org.apache.sshd.common.kex.extension.DefaultServerKexExtensionHandler;
import org.apache.sshd.common.keyprovider.KeyPairProvider;
import org.apache.sshd.common.mac.Mac;
import org.apache.sshd.common.random.Random;
@@ -480,6 +481,7 @@
}
private void initKeyExchanges(Config cfg) {
+ setKexExtensionHandler(DefaultServerKexExtensionHandler.INSTANCE);
List<KeyExchangeFactory> a =
NamedFactory.setUpTransformedFactories(
true,
