tree 30c08da090b69e297b57a5e764144ba96b03a87b
parent 1dcd07e0b4f78f1041634390deed97c0977a1137
author Clark Boylan <clark.boylan@gmail.com> 1645557641 -0800
committer Clark Boylan <clark.boylan@gmail.com> 1665610751 +0000

Register a default kex handler with the SshDaemon

With MINA updated to 2.8.0 we can easily support the server-sig-algs key
exchange extension. This is necessary to support modern clients when
using RSA keys as they have begun to disable RSA+SHA1 support. RSA+SHA2
remains viable, but for clients to use that combo the server must
indicate support via the server-sig-algs key exchange extension.

Updating MINA to 2.8.0 was not sufficient for Gerrit because Gerrit does
not use MINA's ServerBuilder. The MINA 2.8.0 update only addresses this
issue automatically when using the ServerBuilder, as it sets the default
kexExtensionHandler for you. Since Gerrit is building the server itself
we need to set the kexExtensionHandler to MINA's default handler which
includes server-sig-algs support. This is the behavior you would get if
using MINA 2.8.0 and its ServerBuilder.

Making this update produces this log line in ssh client logs:

  debug1: kex_input_ext_info: server-sig-algs=<...rsa-sha2-512,rsa-sha2-256,ssh-rsa>

This log line does not appear with older Gerrit as the SSH server didn't
previously have a kex handler.

Release-Notes: Support ssh kex server-sig-algs for modern RSA clients
Bug: Issue 13930
Change-Id: Ia822d0ab291ce5a1cc29dfbe2ac9e2de499fafc3
(cherry picked from commit 0b7dba05dfc7d065acc15baee9ec192a99cce4cd)