* Bump the dependencies group with 5 updates
* use MEL 8.0.3
* use MSTest meta package
* revert Meziantou due to NRE
* add a more useful global.json and pin third party action
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Rob Hague <rob.hague00@gmail.com>
* Only enable TreatWarningsAsErrors in Release
* Remove global.json
this doesn't actually do anything useful like this.
* Also check CI
Co-authored-by: Rob Hague <rob.hague00@gmail.com>
---------
Co-authored-by: Rob Hague <rob.hague00@gmail.com>
* Add an OrderedDictionary implementation for algorithm priorities
During the key exchange, the algorithms to be used are chosen based on the order that
the client sends: first algorithm is most desirable. Currently, the algorithm
collections in ConnectionInfo are defined as IDictionary<,> and backed by
Dictionary<,>, which does not have any guarantees on the order of enumeration
(in practice, when only adding and not removing items it does enumerate in the order
that items were added as an implementation detail, but it's not great to rely on it).
This change adds IOrderedDictionary<,> and uses it in ConnectionInfo. On .NET 9,
this is backed by System.Collections.Generic.OrderedDictionary<,> and on lower
targets, it uses a relatively simple implementation backed by a List and a
Dictionary.
* use ThrowIfNegative
* CI: run .NET Framework Integration Tests on Windows
* use apt-get
* use vampire/setup-wsl
* Run Windows Integration Tests in separate job
so publish doesn't depend on it
* Ignore flakey Test from #1253 in CI
* Drop net6.0 target
* Update src/Renci.SshNet/Common/TaskToAsyncResult.cs
Co-authored-by: Rob Hague <rob.hague00@gmail.com>
* remove redundant #if
for some reason this made the compiler suddenly
realize that the plain text variables are unused.
* use TargetFrameworkIdentifier
this doesn't work in Directory.Build.props, moved it to Directory.Build.targets.
* fix null reference warnings in Benchmarks
seems like the warnings were (somehow) disabled here
before and were fixed by the previous TargetFrameworkIdentifier
change.
* fix unused plainTextOffset in AesGcmCipher.BclImpl
* CI retry
* more cosmetics
* more
* update README
* Revert "use TargetFrameworkIdentifier"
This reverts commit 076ede161d.
---------
Co-authored-by: Rob Hague <rob.hague00@gmail.com>
Co-authored-by: Robert Hague <rh@johnstreetcapital.com>
The new(-ish) implementation of SshCommand has a race condition for short-lived
commands where SSH_MSG_CHANNEL_CLOSE may be processed on the message loop thread
before SSH_MSG_CHANNEL_SUCCESS is waited upon on the Execute (main) thread. This
manifests in an ArgumentNull/NullReference exception on the wait handle because
the channel has already been closed and disposed.
Fix this by only delaying the channel dispose until the command dispose.
We currently don't recognise any global requests from the server, but if one is
sent, then per RFC 4253 section 4 we still need to reply when the server expects
one. So send SSH_MSG_REQUEST_FAILURE in this case.
* Move IDisposable implementation declaration from inheritees to parent AuthenticationMethod
* Move common Dispose code to AuthenticationMethod class
* Remove unnecessary finalizers
* just move the definition
---------
Co-authored-by: Michał Drzymała <michalxdrzymala@gmail.com>
Co-authored-by: Rob Hague <rob.hague00@gmail.com>
DSA is removed at compile time from OpenSSH 9.8 and higher.
That means we can no longer test it in our integration tests. It seems like a
good time to remove it. From the OpenSSH release notes:
DSA, as specified in the SSHv2 protocol, is inherently weak - being
limited to a 160 bit private key and use of the SHA1 digest. Its
estimated security level is only 80 bits symmetric equivalent.
OpenSSH has disabled DSA keys by default since 2015 but has retained
run-time optional support for them. DSA was the only mandatory-to-
implement algorithm in the SSHv2 RFCs, mostly because alternative
algorithms were encumbered by patents when the SSHv2 protocol was
specified.
This has not been the case for decades at this point and better
algorithms are well supported by all actively-maintained SSH
implementations. We do not consider the costs of maintaining DSA
in OpenSSH to be justified and hope that removing it from OpenSSH
can accelerate its wider deprecation in supporting cryptography
libraries.
* Use System.Security.Cryptography in DesCipher and TripleDesCipher; Fall back to use BouncyCastle if BCL doesn't support
* Drop DesCipher; Replace PKCS7Padding with BouncyCastle's implementation.
* Restore `CbcCipherMode`
* Restore AesCipherMode; Use BlockImpl instead of BouncyCastleImpl for 3DES-CFB on lower targets.
* Restore the xml doc comment
* Tighten private key checking to reveal padding issue
* `Encrypt` should take into account padding for length of `inputBuffer` passed to `EncryptBlock` if padding is specified, no matter input is divisible or not.
* `Decrypt` should take into account unpadding for the final output if padding is specified.
* `Decrypt` should take into account *manual* padding for length of `inputBuffer` passed to `DecryptBlock` and unpadding for the final output if padding is not specified and mode is CFB or OFB.
* `Encrypt` should take into account *manual* padding for length of `inputBuffer` passed to `EncryptBlock` and unpadding for the final output if padding is not specified and mode is CFB or OFB.
* Rectify DES cipher tests. There's no padding in the data.
* Borrow `PadCount` method from BouncyCastle
* Manually pad input in CTR mode as well. Update AesCipherTest.
Co-Authored-By: Rob Hague <5132141+Rob-Hague@users.noreply.github.com>
* Manually pad/unpad for Aes CFB/OFB mode
* Update test/Renci.SshNet.Tests/Classes/Security/Cryptography/Ciphers/AesCipherTest.Gen.cs.txt
Co-authored-by: Rob Hague <rob.hague00@gmail.com>
* Re-generate AES cipher tests
---------
Co-authored-by: Rob Hague <5132141+Rob-Hague@users.noreply.github.com>
Co-authored-by: Rob Hague <rob.hague00@gmail.com>
* Drop net7.0 target
.NET 7 is EOL since May. The only .NET 7 features we use are
`ObjectDisposedException.ThrowIf` (moved to a throw helper) and
some newer regex features.
This feels a bit weird, but I suppose it is the expected course of action.
* fix build warning-as-error which is suddenly appearing on net6.0
IsAotCompatible not supported on net6.0
---------
Co-authored-by: Wojciech Nagórski <wojtpl2@gmail.com>
* Replace DiagnosticAbstrations with Microsoft.Extensions.Logging.Abstractions
* add documentation
* reduce allocations by SessionId hex conversion
generate the hex string once instead of every log
call and optimize ToHex().
* Update docfx/logging.md
Co-authored-by: Rob Hague <rob.hague00@gmail.com>
* reduce log levels
* hook up testcontainers logging
* drop packet logs further down to trace
* add kex traces
---------
Co-authored-by: Rob Hague <rob.hague00@gmail.com>
* Add .NET 9 target
* Disable SonarSource S3236
This following change in the runtime now causes this analyzer
to complain about some Debug.Assert calls which doesn't make sense.
https://github.com/dotnet/core/blob/main/release-notes/9.0/preview/preview7/libraries.md#debugassert-now-reports-assert-condition-by-defaulthttps://rules.sonarsource.com/csharp/RSPEC-3236/
* make use of .NET 9 Lock type
see https://github.com/dotnet/runtime/issues/34812
* Define own Lock type to avoid ifdefs
* revert irrelevant style changes
* update global.json
* Keep net8.0 target in IntegrationTests
Co-authored-by: Rob Hague <rob.hague00@gmail.com>
* fix Package Downgrade Warning
for some reason this happens starting with .NET 9.0 RC2:
/home/mus/git/SSH.NET/test/Renci.SshNet.IntegrationTests/Renci.SshNet.IntegrationTests.csproj : error NU1605:
Warning As Error: Detected package downgrade: BouncyCastle.Cryptography from 2.4.0 to 2.3.1. Reference the package directly from the project to select a different version.
Renci.SshNet.IntegrationTests -> SSH.NET 1.0.0 -> BouncyCastle.Cryptography (>= 2.4.0)
Renci.SshNet.IntegrationTests -> Testcontainers 3.10.0 -> BouncyCastle.Cryptography (>= 2.3.1)
* update global.json to RC2
* update global.json to .NET 9 GA
* update GitHub Actions for .NET 9
---------
Co-authored-by: Rob Hague <rob.hague00@gmail.com>
* Migrate from AppVeyor to GitHub Actions
* also run on pull_request
* small formatting improvements
* add on: workflow_dispatch
this is needed to re-run jobs manually from the web UI
* Publish NuGet package to GitHub Registry
only on develop branch.
* re-add empty appveyor.yml
so it doesn't fail CI until AppVeyor integration is disabled
* fix appveyor
* typo
* Split PrivateKeyFile into different implementations.
* Remove duplicate keyName check. Get cipherName and salt only if the key is PKCS1 format.
---------
Co-authored-by: Rob Hague <rob.hague00@gmail.com>
* Handle lower-case hex in private key's salt field
I'm using BouncyCastle (http://bouncycastle.org/) to produce public/private key pairs. In later versions of SSH.NET an exception is thrown (SshException: "Invalid private key file.") while establishing connection using the private keys previously generated.
It seems to be an issue with the regex matching the private key file data which this commit handles properly.
* add test
---------
Co-authored-by: Robert Hague <rh@johnstreetcapital.com>
for some reason this happens starting with .NET 9.0 RC2:
/home/mus/git/SSH.NET/test/Renci.SshNet.IntegrationTests/Renci.SshNet.IntegrationTests.csproj : error NU1605:
Warning As Error: Detected package downgrade: BouncyCastle.Cryptography from 2.4.0 to 2.3.1. Reference the package directly from the project to select a different version.
Renci.SshNet.IntegrationTests -> SSH.NET 1.0.0 -> BouncyCastle.Cryptography (>= 2.4.0)
Renci.SshNet.IntegrationTests -> Testcontainers 3.10.0 -> BouncyCastle.Cryptography (>= 2.3.1)
Rob Hague