apache/mina-sshd sshd-2.14.0

SSHD 2.14.0

on GitHub

Full Changelog: sshd-2.13.2...sshd-2.14.0

Bug Fixes

• GH-524 Performance improvements
• GH-533 Fix multi-step authentication
• GH-582 Fix filtering in NamedFactory
• GH-587 Prevent NullPointerExceptionon closed channel in NettyIoSession
• GH-590 Better support for FIPS
• GH-597 Pass on Charset in ClientSession.executeRemoteCommand()

New Features

• New utility methods SftpClient.put(Path localFile, String remoteFileName) and
  SftpClient.put(InputStream in, String remoteFileName) facilitate SFTP file uploading.

GH-590 Better support for FIPS

Besides fixing a bug with bc-fips (the RandomGenerator class exists in normal Bouncy Castle,
but not in the FIPS version, but Apache MINA sshd referenced it even if only bc-fips was present),
support was improved for running in an environment restricted by FIPS.

There is a new system property org.apache.sshd.security.fipsEnabled. If set to true, a number
of crypto-algorithms not approved by FIPS 140 are disabled:

• key exchange methods sntrup761x25519-sha512, sntrup761x25519-sha512@openssh.com, curve25519-sha256, curve25519-sha256@libssh.org, curve448-sha512.
• the chacha20-poly1305 cipher.
• the bcrypt KDF used in encrypted private key files in OpenSSH format.
• all ed25519 keys and signatures.

Additionally, the new "SunJCEWrapper" SecurityProviderRegistrar (see below) and the
EdDSASecurityProviderRegistrar are disabled, and the BouncyCastleScurityProviderRegistrar
looks only for the "BCFIPS" security provider, not for the normal "BC" provider.

If the system property is not set to true, FIPS mode can be enabled programmatically
by calling SecurityUtils.setFipsMode() before any other call to Apache MINA sshd.

Potential compatibility issues

New security provider registrar

There is a new SecurityProviderRegistrar that is registered by default
if there is a SunJCE security provider. It uses the AES and
HmacSHA* implementations from SunJCE even if Bouncy Castle is also
registered. SunJCE has native implementations, whereas Bouncy Castle
may not.

The new registrar has the name "SunJCEWrapper" and can be configured
like any other registrar. It can be disabled via the system property
org.apache.sshd.security.provider.SunJCEWrapper.enabled=false. It is also
disabled in FIPS mode (see above).

GH-582 Fix filtering in NamedFactory

The methods NamedFactory.setupBuiltinFactories(boolean ignoreUnsupported, ...) and
NamedFactory.setupTransformedFactories(boolean ignoreUnsupported, ...) had a bug that
gave the "ignoreUnsupported" parameter actually the meaning of "include unsupported".

This was fixed in this release, but existing code calling these or one of the following methods:

• BaseBuilder.setUpDefaultMacs(boolean ignoreUnsupported)
• BaseBuilder.setUpDefaultCiphers(boolean ignoreUnsupported)
• ClientBuilder.setUpDefaultCompressionFactories(boolean ignoreUnsupported)
• ClientBuilder.setUpDefaultKeyExchanges(boolean ignoreUnsupported)
• ClientBuilder.setUpDefaultSignatureFactories(boolean ignoreUnsupported)
• ServerBuilder.setUpDefaultCompressionFactories(boolean ignoreUnsupported)
• ServerBuilder.setUpDefaultKeyExchanges(boolean ignoreUnsupported)
• ServerBuilder.setUpDefaultSignatureFactories(boolean ignoreUnsupported)
• any of the methods starting with SshConfigFileReader.configure
• SshClientConfigFileReader.configure(...)
• SshServerConfigFileReader.configure(...)

should be reviewed:

• if the method is called with parameter value true, the result will no longer include unsupported algorithms. Formerly it wrongly did.
• if the method is called with parameter value false, the result may include unsupported algorithms. Formerly it did not.

So if existing code used parameter value false to ensure it never got unsupported algorithms, change it to true.

Major Code Re-factoring

JDK requirements

• GH-536 The project now requires
  JDK 17 at build time, while the target runtime still remains unchanged to support JDK 8.