Skip to content

Commit eeb26dd

Browse files
author
Lyor Goldstein
committed
[apacheGH-445] Implemented OpenSSH strict KEX protocol
1 parent f5c63a8 commit eeb26dd

File tree

9 files changed

+563
-231
lines changed

9 files changed

+563
-231
lines changed

‎CHANGES.md

+6
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,12 @@
3636

3737
## Behavioral changes and enhancements
3838

39+
### [GH-445 - Terrapin attack mitigation](https://github.com/apache/mina-sshd/issues/429)
40+
41+
There is a **new** `CoreModuleProperties` property that controls the mitigation for the [Terrapin attach](https://terrapin-attack.com/) via what is known as
42+
"strict-KEX" (see [OpenSSH PROTOCOL - 1.9 transport: strict key exchange extension](https://github.com/openssh/openssh-portable/blob/master/PROTOCOL)).
43+
It is **disabled** by default due to its experimental nature and possible interoperability issues, so users who wish to use this feature must turn it on *explicitly*.
44+
3945
### New `ScpTransferEventListener` callback method
4046

4147
Following [GH-428/GH-392](https://github.com/apache/mina-sshd/issues/428) a new `handleReceiveCommandAckInfo` method has been added to enable users to inspect

‎docs/standards.md

+21-13
Original file line numberDiff line numberDiff line change
@@ -29,23 +29,31 @@
2929
above mentioned hooks for [RFC 8308](https://tools.ietf.org/html/rfc8308).
3030
* [RFC 8731 - Secure Shell (SSH) Key Exchange Method Using Curve25519 and Curve448](https://tools.ietf.org/html/rfc8731)
3131
* [Key Exchange (KEX) Method Updates and Recommendations for Secure Shell](https://tools.ietf.org/html/draft-ietf-curdle-ssh-kex-sha2-03)
32+
33+
## *OpenSSH*
3234
* [OpenSSH support for U2F/FIDO security keys](https://github.com/openssh/openssh-portable/blob/master/PROTOCOL.u2f)
3335
* **Note:** the server side supports these keys by default. The client side requires specific initialization
3436
* [OpenSSH public-key certificate authentication system for use by SSH](https://github.com/openssh/openssh-portable/blob/master/PROTOCOL.certkeys)
37+
* [OpenSSH 1.9 transport: strict key exchange extension](https://github.com/openssh/openssh-portable/blob/master/PROTOCOL)
38+
39+
## SFTP version 3-6 + extensions
40+
41+
* `supported` - [DRAFT 05 - section 4.4](https://datatracker.ietf.org/doc/html/draft-ietf-secsh-filexfer-05#section-4.4)
42+
* `supported2` - [DRAFT 13 section 5.4](https://datatracker.ietf.org/doc/html/draft-ietf-secsh-filexfer-13#section-5.4)
43+
* `versions` - [DRAFT 09 Section 4.6](https://datatracker.ietf.org/doc/html/draft-ietf-secsh-filexfer-09#section-4.6)
44+
* `vendor-id` - [DRAFT 09 - section 4.4](https://datatracker.ietf.org/doc/html/draft-ietf-secsh-filexfer-09#section-4.4)
45+
* `acl-supported` - [DRAFT 11 - section 5.4](https://datatracker.ietf.org/doc/html/draft-ietf-secsh-filexfer-11#section-5.4)
46+
* `newline` - [DRAFT 09 Section 4.3](https://datatracker.ietf.org/doc/html/draft-ietf-secsh-filexfer-09#section-4.3)
47+
* `md5-hash`, `md5-hash-handle` - [DRAFT 09 - section 9.1.1](https://datatracker.ietf.org/doc/html/draft-ietf-secsh-filexfer-09#section-9.1.1)
48+
* `check-file-handle`, `check-file-name` - [DRAFT 09 - section 9.1.2](https://datatracker.ietf.org/doc/html/draft-ietf-secsh-filexfer-09#section-9.1.2)
49+
* `copy-file`, `copy-data` - [DRAFT 00 - sections 6, 7](https://tools.ietf.org/id/draft-ietf-secsh-filexfer-extensions-00.txt)
50+
* `space-available` - [DRAFT 09 - section 9.2](https://datatracker.ietf.org/doc/html/draft-ietf-secsh-filexfer-09#section-9.2)
51+
* `filename-charset`, `filename-translation-control` - [DRAFT 13 - section 6](https://tools.ietf.org/html/draft-ietf-secsh-filexfer-13#section-6) - only client side
52+
* Several [OpenSSH SFTP extensions](https://github.com/openssh/openssh-portable/blob/master/PROTOCOL)
53+
54+
## Miscellaneous
55+
3556
* [SSH proxy jumps](./internals.md#ssh-jumps)
36-
* SFTP version 3-6 + extensions
37-
* `supported` - [DRAFT 05 - section 4.4](https://datatracker.ietf.org/doc/html/draft-ietf-secsh-filexfer-05#section-4.4)
38-
* `supported2` - [DRAFT 13 section 5.4](https://datatracker.ietf.org/doc/html/draft-ietf-secsh-filexfer-13#section-5.4)
39-
* `versions` - [DRAFT 09 Section 4.6](https://datatracker.ietf.org/doc/html/draft-ietf-secsh-filexfer-09#section-4.6)
40-
* `vendor-id` - [DRAFT 09 - section 4.4](https://datatracker.ietf.org/doc/html/draft-ietf-secsh-filexfer-09#section-4.4)
41-
* `acl-supported` - [DRAFT 11 - section 5.4](https://datatracker.ietf.org/doc/html/draft-ietf-secsh-filexfer-11#section-5.4)
42-
* `newline` - [DRAFT 09 Section 4.3](https://datatracker.ietf.org/doc/html/draft-ietf-secsh-filexfer-09#section-4.3)
43-
* `md5-hash`, `md5-hash-handle` - [DRAFT 09 - section 9.1.1](https://datatracker.ietf.org/doc/html/draft-ietf-secsh-filexfer-09#section-9.1.1)
44-
* `check-file-handle`, `check-file-name` - [DRAFT 09 - section 9.1.2](https://datatracker.ietf.org/doc/html/draft-ietf-secsh-filexfer-09#section-9.1.2)
45-
* `copy-file`, `copy-data` - [DRAFT 00 - sections 6, 7](https://tools.ietf.org/id/draft-ietf-secsh-filexfer-extensions-00.txt)
46-
* `space-available` - [DRAFT 09 - section 9.2](https://datatracker.ietf.org/doc/html/draft-ietf-secsh-filexfer-09#section-9.2)
47-
* `filename-charset`, `filename-translation-control` - [DRAFT 13 - section 6](https://tools.ietf.org/html/draft-ietf-secsh-filexfer-13#section-6) - only client side
48-
* Several [OpenSSH SFTP extensions](https://github.com/openssh/openssh-portable/blob/master/PROTOCOL)
4957
* [Endless tarpit](https://nullprogram.com/blog/2019/03/22/) - see [HOWTO(s)](./howto.md) section.
5058

5159
## Implemented/available support

‎docs/technical/kex.md

+8
Original file line numberDiff line numberDiff line change
@@ -129,3 +129,11 @@ thread is not overrun by producers and actually can finish.
129129
Again, "client" and "server" could also be inverted. For instance, a client uploading
130130
files via SFTP might have an application thread pumping data through a channel, which
131131
might be blocked during KEX.
132+
133+
## [OpenSSH 1.9 transport: strict key exchange extension](https://github.com/openssh/openssh-portable/blob/master/PROTOCOL)
134+
135+
136+
There is a **new** `CoreModuleProperties` property that controls the mitigation for the [Terrapin attack](https://terrapin-attack.com/) via what is known as "strict-KEX"
137+
It is **disabled** by default due to its experimental nature and possible interoperability issues, so users who wish to use this feature must turn it on *explicitly*.
138+
The pseudo KEX values are *appended* to the initial proposals sent to the peer and removed when received before proceeding with the standard KEX proposals negotiation so
139+
as not to interfere with it (other than marking that they were detected).

‎sshd-common/src/main/java/org/apache/sshd/common/config/ConfigFileReaderSupport.java

+2
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,8 @@ public final class ConfigFileReaderSupport {
8989
public static final String MACS_CONFIG_PROP = "MACs";
9090
// see http://manpages.ubuntu.com/manpages/precise/en/man5/sshd_config.5.html
9191
public static final String KEX_ALGORITHMS_CONFIG_PROP = "KexAlgorithms";
92+
// see https://github.com/openssh/openssh-portable/blob/master/PROTOCOL - section 1.9
93+
public static final String STRICT_KEX_CUSTOM_CONFIG_PROP = "UseStrictKex";
9294
// see http://linux.die.net/man/5/ssh_config
9395
public static final String HOST_KEY_ALGORITHMS_CONFIG_PROP = "HostKeyAlgorithms";
9496
// see http://manpages.ubuntu.com/manpages/precise/en/man5/sshd_config.5.html

‎sshd-common/src/main/java/org/apache/sshd/common/kex/extension/KexExtensions.java

+15
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,21 @@ public final class KexExtensions {
5959
public static final String CLIENT_KEX_EXTENSION = "ext-info-c";
6060
public static final String SERVER_KEX_EXTENSION = "ext-info-s";
6161

62+
/**
63+
* Reminder:
64+
*
65+
* These pseudo-algorithms are only valid in the initial SSH2_MSG_KEXINIT and MUST be ignored if they are present in
66+
* subsequent SSH2_MSG_KEXINIT packets.
67+
*
68+
* <B>Note:</B> these values are <U>appended</U> to the initial proposals and removed if received before proceeding
69+
* with the standard KEX proposals negotiation.
70+
*
71+
* @see <A HREF="https://github.com/openssh/openssh-portable/blob/master/PROTOCOL">OpenSSH PROTOCOL - 1.9 transport:
72+
* strict key exchange extension</A>
73+
*/
74+
public static final String STRICT_KEX_CLIENT_EXTENSION = "[email protected]";
75+
public static final String STRICT_KEX_SERVER_EXTENSION = "[email protected]";
76+
6277
@SuppressWarnings("checkstyle:Indentation")
6378
public static final Predicate<String> IS_KEX_EXTENSION_SIGNAL
6479
= n -> CLIENT_KEX_EXTENSION.equalsIgnoreCase(n) || SERVER_KEX_EXTENSION.equalsIgnoreCase(n);

‎sshd-core/src/main/java/org/apache/sshd/common/config/SshConfigFileReader.java

+6
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,7 @@
4545
import org.apache.sshd.common.signature.Signature;
4646
import org.apache.sshd.common.util.GenericUtils;
4747
import org.apache.sshd.common.util.ValidateUtils;
48+
import org.apache.sshd.core.CoreModuleProperties;
4849

4950
/**
5051
* Reads and interprets some useful configurations from an OpenSSH configuration file.
@@ -256,6 +257,11 @@ public static <M extends AbstractFactoryManager> M configureKeyExchanges(
256257
M manager, PropertyResolver props, boolean lenient,
257258
Function<? super DHFactory, ? extends KeyExchangeFactory> xformer, boolean ignoreUnsupported) {
258259
Objects.requireNonNull(props, "No properties to configure");
260+
Boolean useStrictKex = props.getBoolean(ConfigFileReaderSupport.STRICT_KEX_CUSTOM_CONFIG_PROP);
261+
if (useStrictKex != null) {
262+
CoreModuleProperties.USE_STRICT_KEX.set(manager, useStrictKex);
263+
}
264+
259265
return configureKeyExchanges(manager,
260266
props.getString(ConfigFileReaderSupport.KEX_ALGORITHMS_CONFIG_PROP),
261267
lenient, xformer, ignoreUnsupported);

0 commit comments

Comments
 (0)