xiaoxue_admin
/
dbx
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix(ssh): support legacy hmac-sha1 MAC

This commit is contained in:
t8y2 2026-07-07 14:14:09 +08:00
parent 2b4cefc987
commit adb8da3ad3
1 changed files with 18 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
crates/dbx-core/src/db/ssh_tunnel.rs
View File

@ -10,7 +10,7 @@ use base64::Engine;
use russh::client::{self, Config, Handle};
use russh::keys::agent::{client::AgentClient, AgentIdentity};
use russh::keys::{decode_secret_key, key::PrivateKeyWithHashAlg, PrivateKey};
use russh::{kex, ChannelMsg, Preferred};
use russh::{kex, mac, ChannelMsg, Preferred};
use tokio::io::{AsyncReadExt, AsyncWriteExt};
use tokio::net::TcpListener;
use tokio::sync::Mutex;
@ -55,6 +55,13 @@ fn ssh_client_config() -> Config {
}
preferred.kex = Cow::Owned(kex);
let mut mac = preferred.mac.into_owned();
// Keep SHA-1 MAC support as a last-resort fallback for legacy SSH proxies.
if !mac.contains(&mac::HMAC_SHA1) {
mac.push(mac::HMAC_SHA1);
}
preferred.mac = Cow::Owned(mac);
Config { nodelay: true, keepalive_interval: Some(Duration::from_secs(30)), preferred, ..Default::default() }
}
@ -923,6 +930,16 @@ mod tests {
assert!(ecdh_index < group14_sha1_index);
}
#[test]
fn ssh_client_config_keeps_legacy_mac_after_safe_defaults() {
let config = ssh_client_config();
let mac = config.preferred.mac;
let sha2_index = mac.iter().position(|algorithm| *algorithm == russh::mac::HMAC_SHA256).unwrap();
let sha1_index = mac.iter().position(|algorithm| *algorithm == russh::mac::HMAC_SHA1).unwrap();
assert!(sha2_index < sha1_index);
}
#[test]
fn sanitizes_invalid_openssh_private_key_comment() {
let mut key = openssh_container(&padded_private_blob(&[0xff, 0xfe, b'a']));