A malicious or compromised SCP server could return file or directory names containing
path separators, drive qualifiers, or parent-directory references.
ScpClient.Download(string, DirectoryInfo) combined these into a local path without
validation, allowing writes outside the destination directory. Server-supplied C and D
record names are now validated before being combined into a local path.
Signed-off-by: Nadav0077 <18245584+Nadav0077@users.noreply.github.com>
SCP performs a transfer by running scp on the server with the remote path
embedded in a command. On a shell-based server that command is interpreted
by a shell, so a path that is not quoted to suit that shell can be executed
as a command on the server (GHSA-mggc-4xg6-vcxf); on a non-shell-based
server the path is used literally and must not be quoted at all. The right
encoding therefore depends on the server, and no single transformation is
safe for every server.
Rather than default this choice, obsolete the ScpClient constructors that
implicitly used DoubleQuote and add constructors that take an
IRemotePathTransformation explicitly, so callers must choose one suited to
their server and trust environment. DoubleQuote remains the default for the
obsolete constructors, so existing behaviour is unchanged. Document the
consideration on ScpClient and IRemotePathTransformation, and recommend
using SFTP.
* Downgrade testcontainers to 4.11
Running the .NET Framework integration tests locally (not CI since we don't use the library
there) is broken in 4.12. Also add .dockerignore since the image was including 200MB of
stuff under bin/.
* bump to 4.13
* Tweak internal IProgress usage for APM and sync UploadFile/DownloadFile
Changes to support IProgress<> callback on UploadAsync/DownloadAsync meant wrapping
the Action<> callback on existing methods in a Progress<>, which posts the callback
onto the current synchronisation context rather than the threadpool. For the legacy
APM methods (Begin[..]), let's just preserve their old behaviour.
For the synchronous methods, posting to the synchronisation context is probably the
worst choice (because if there is one, the method itself is running there). We can
either revert to the threadpool as well, or take the opportunity to invoke the
callback synchronously, which is a behavioural change but probably the least
surprising behaviour for a synchronous method.
* keep callbacks on the threadpool
Actually, we could call the Download callback synchronously easily enough, but the Upload progress
reports are being made on the message listener thread upon request ack. A more involved
scheme could drain callbacks to fire during the read loop. For now just make it all the
same behaviour as in 2025.1.0.
* Bump the dependencies group with 11 updates
Bumps coverlet.collector from 6.0.4 to 10.0.1
Bumps coverlet.msbuild from 6.0.4 to 10.0.1
Bumps GitHubActionsTestLogger from 3.0.1 to 3.0.4
Bumps Meziantou.Analyzer from 3.0.18 to 3.0.114
Bumps Microsoft.Bcl.Cryptography from 10.0.3 to 10.0.9
Bumps Microsoft.Extensions.Logging.Console from 10.0.3 to 10.0.9
Bumps MSTest from 4.1.0 to 4.2.3
Bumps PolySharp from 1.15.0 to 1.16.0
Bumps SonarAnalyzer.CSharp from 10.20.0.135146 to 10.27.0.140913
Bumps System.Formats.Asn1 from 10.0.3 to 10.0.9
Bumps Testcontainers from 4.10.0 to 4.12.0
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Robert Hague <rh@johnstreetcapital.com>
* Bump the dependencies group
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Robert Hague <rh@johnstreetcapital.com>
Co-authored-by: Rob Hague <rob.hague00@gmail.com>
This adds an SftpException which sits between the existing SftpPathNotFoundException/
SftpPermissionDeniedException and SshException, and which contains the response code
from the SSH_FXP_STATUS packet, along with a default message if one was not provided.
SftpPathNotFoundException also gains a Path property which is populated in cases where
it makes sense.
* Build the read-ahead mechanism into SftpFileStream
This change unifies the SFTP download implementations that exist via DownloadFile and
via SftpFileStream, by rewriting SftpFileStream to perform the same "read-aheads" as
DownloadFile. This brings the performance of downloads via SftpFileStream in line with
DownloadFile, such that the latter is now effectively SftpFileStream.CopyTo. It also
brings the recently added DownloadFileAsync up to speed since that was implemented via
SftpFileStream.CopyToAsync.
The methodology is a mix of the previous one and that within OpenSSH: the first call to
SftpFileStream.Read sends one read request to the server. The second sends two and when
not interrupted by Write or similar, the number of in-flight read requests continues to
scale up in this fashion.
I have measured CopyTo to be 3-20x faster than before, depending on file size and server
round-trip time.
* Check CanSeek in ReadAllBytes
* Squeeze out some performance
* CI: add Windows Integration Tests for .NET
see https://github.com/sshnet/SSH.NET/pull/1702#issuecomment-3342506642
* fix podman setup with Windows and .NET
* debug
* x
* x
* x
* revert
* Run Windows .NET tests in separate job
so they run in parallel and we avoid the Common_CreateMoreChannelsThanMaxSessions test failure.
* fix coverlet artifacts
* fix missing PermitTTY in RemoteSshdConfig Reset
this fixes a test failure in Common_CreateMoreChannelsThanMaxSessions
when running the tests multiple times against the same SSH server
instance.
see https://github.com/sshnet/SSH.NET/pull/1704#issuecomment-3343210311
* speed up Windows tests
turns out this is caused by DNS resolution taking about
2 seconds on every new connection...
* add windows integration tests to Publish needs:
---------
Co-authored-by: Rob Hague <rob.hague00@gmail.com>
Co-authored-by: Robert Hague <rh@johnstreetcapital.com>
* Bump actions/checkout from 4 to 5
* Bump actions/upload-pages-artifact from 3 to 4
* Bump actions/download-artifact from 4 to 5
* Bump the dependencies group with 5 updates
* fix
* fix locally failing portforwarding tests
port already in use
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Rob Hague <rob.hague00@gmail.com>
When the key exchange produces less key material than is needed for the cipher or hmac
algorithms, there is an iterative procedure to produce more.
For example, a SHA-1 key exchange algorithm produces 20 bytes of key material.
A SHA-256 hmac uses a 32 byte key, so one iteration of the procedure produces another
20 bytes of key material for a total of 40 which is sufficient for the hmac key.
The library works correctly in such cases of one iteration, but the logic is wrong if
more than one iteration is needed. In #1660, the connection uses a SHA-1 kex algorithm
with a SHA-512 hmac (64 byte key), requiring 3 iterations of the extension procedure and
resulting in an error upon connection.
This change fixes the logic to use the output of the previous iteration per the spec.
closes#1660
SftpClient.CreateText does not truncate the file if it exists, contrary to
System.IO.File.CreateText which does. It is documented, but seems pretty
unintuitive and more like a mistake than a concious decision.
I considered leaving this 14 year old behaviour as it is, but turns out other
people have hit it as well (it also affects WriteAll{Bytes/Text/Lines}).
* Bump the dependencies group with 4 updates
Bumps BouncyCastle.Cryptography from 2.6.1 to 2.6.2
Bumps Meziantou.Analyzer from 2.0.205 to 2.0.210
Bumps MSTest from 3.9.3 to 3.10.0
Bumps SonarAnalyzer.CSharp from 10.13.0.120203 to 10.15.0.120848
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Rob Hague <rob.hague00@gmail.com>
* Fixes spelling errors in comments, private members, and public members in test projects
* Adds en-GB as spell checker option; reverts notable cases of American English
* convert file UTF-16 LE BOM -> UTF-8
---------
Co-authored-by: Rob Hague <rob.hague00@gmail.com>
The library currently does not check for matching host key algorithms until needed
at the end of the key exchange, in contrast to other algorithm types which are checked
beforehand. This leads to confusing or uninformative errors, normally from the server
(correctly) closing the connection.
This change moves that check alongside the rest of them, and also improves the error
messages that arise from no matching algorithms.
* Added GetAttributesAsync to SftpClient
* Adding integration tests + unit test
* Address warnings in test classes.
---------
Co-authored-by: William Decker <william.decker@syndigo.com>
* Bump the dependencies group with 5 updates
* use MEL 8.0.3
* use MSTest meta package
* revert Meziantou due to NRE
* add a more useful global.json and pin third party action
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Rob Hague <rob.hague00@gmail.com>
* CI: run .NET Framework Integration Tests on Windows
* use apt-get
* use vampire/setup-wsl
* Run Windows Integration Tests in separate job
so publish doesn't depend on it
* Ignore flakey Test from #1253 in CI
* Drop net6.0 target
* Update src/Renci.SshNet/Common/TaskToAsyncResult.cs
Co-authored-by: Rob Hague <rob.hague00@gmail.com>
* remove redundant #if
for some reason this made the compiler suddenly
realize that the plain text variables are unused.
* use TargetFrameworkIdentifier
this doesn't work in Directory.Build.props, moved it to Directory.Build.targets.
* fix null reference warnings in Benchmarks
seems like the warnings were (somehow) disabled here
before and were fixed by the previous TargetFrameworkIdentifier
change.
* fix unused plainTextOffset in AesGcmCipher.BclImpl
* CI retry
* more cosmetics
* more
* update README
* Revert "use TargetFrameworkIdentifier"
This reverts commit 076ede161d.
---------
Co-authored-by: Rob Hague <rob.hague00@gmail.com>
Co-authored-by: Robert Hague <rh@johnstreetcapital.com>
DSA is removed at compile time from OpenSSH 9.8 and higher.
That means we can no longer test it in our integration tests. It seems like a
good time to remove it. From the OpenSSH release notes:
DSA, as specified in the SSHv2 protocol, is inherently weak - being
limited to a 160 bit private key and use of the SHA1 digest. Its
estimated security level is only 80 bits symmetric equivalent.
OpenSSH has disabled DSA keys by default since 2015 but has retained
run-time optional support for them. DSA was the only mandatory-to-
implement algorithm in the SSHv2 RFCs, mostly because alternative
algorithms were encumbered by patents when the SSHv2 protocol was
specified.
This has not been the case for decades at this point and better
algorithms are well supported by all actively-maintained SSH
implementations. We do not consider the costs of maintaining DSA
in OpenSSH to be justified and hope that removing it from OpenSSH
can accelerate its wider deprecation in supporting cryptography
libraries.
* Replace DiagnosticAbstrations with Microsoft.Extensions.Logging.Abstractions
* add documentation
* reduce allocations by SessionId hex conversion
generate the hex string once instead of every log
call and optimize ToHex().
* Update docfx/logging.md
Co-authored-by: Rob Hague <rob.hague00@gmail.com>
* reduce log levels
* hook up testcontainers logging
* drop packet logs further down to trace
* add kex traces
---------
Co-authored-by: Rob Hague <rob.hague00@gmail.com>
* Add .NET 9 target
* Disable SonarSource S3236
This following change in the runtime now causes this analyzer
to complain about some Debug.Assert calls which doesn't make sense.
https://github.com/dotnet/core/blob/main/release-notes/9.0/preview/preview7/libraries.md#debugassert-now-reports-assert-condition-by-defaulthttps://rules.sonarsource.com/csharp/RSPEC-3236/
* make use of .NET 9 Lock type
see https://github.com/dotnet/runtime/issues/34812
* Define own Lock type to avoid ifdefs
* revert irrelevant style changes
* update global.json
* Keep net8.0 target in IntegrationTests
Co-authored-by: Rob Hague <rob.hague00@gmail.com>
* fix Package Downgrade Warning
for some reason this happens starting with .NET 9.0 RC2:
/home/mus/git/SSH.NET/test/Renci.SshNet.IntegrationTests/Renci.SshNet.IntegrationTests.csproj : error NU1605:
Warning As Error: Detected package downgrade: BouncyCastle.Cryptography from 2.4.0 to 2.3.1. Reference the package directly from the project to select a different version.
Renci.SshNet.IntegrationTests -> SSH.NET 1.0.0 -> BouncyCastle.Cryptography (>= 2.4.0)
Renci.SshNet.IntegrationTests -> Testcontainers 3.10.0 -> BouncyCastle.Cryptography (>= 2.3.1)
* update global.json to RC2
* update global.json to .NET 9 GA
* update GitHub Actions for .NET 9
---------
Co-authored-by: Rob Hague <rob.hague00@gmail.com>
* Migrate from AppVeyor to GitHub Actions
* also run on pull_request
* small formatting improvements
* add on: workflow_dispatch
this is needed to re-run jobs manually from the web UI
* Publish NuGet package to GitHub Registry
only on develop branch.
* re-add empty appveyor.yml
so it doesn't fail CI until AppVeyor integration is disabled
* fix appveyor
* typo
for some reason this happens starting with .NET 9.0 RC2:
/home/mus/git/SSH.NET/test/Renci.SshNet.IntegrationTests/Renci.SshNet.IntegrationTests.csproj : error NU1605:
Warning As Error: Detected package downgrade: BouncyCastle.Cryptography from 2.4.0 to 2.3.1. Reference the package directly from the project to select a different version.
Renci.SshNet.IntegrationTests -> SSH.NET 1.0.0 -> BouncyCastle.Cryptography (>= 2.4.0)
Renci.SshNet.IntegrationTests -> Testcontainers 3.10.0 -> BouncyCastle.Cryptography (>= 2.3.1)
* Added support for deleting directories asynchronously
* Clarify that the task represents the asynchronous delete operation
Co-authored-by: Rob Hague <rob.hague00@gmail.com>
* Added DeleteAsync and DeleteDirectoryAsync to ISftpClient
* Inherit docs from interface
* Added additional tests for new async delete functions
* Update list directory test to use async delete methods
* x
---------
Co-authored-by: Rob Hague <rob.hague00@gmail.com>
Nadav0077