1818 */
1919package com .gitblit .transport .ssh ;
2020
21+ import java .io .File ;
2122import java .io .FileInputStream ;
2223import java .io .InputStreamReader ;
24+ import java .security .KeyFactory ;
2325import java .security .KeyPair ;
26+ import java .security .PrivateKey ;
27+ import java .security .PublicKey ;
2428import java .util .Arrays ;
2529import java .util .Iterator ;
2630import java .util .NoSuchElementException ;
2731
32+ import org .apache .sshd .common .config .keys .PrivateKeyEntryDecoder ;
2833import org .apache .sshd .common .keyprovider .AbstractKeyPairProvider ;
2934import org .apache .sshd .common .util .security .SecurityUtils ;
30- import org .bouncycastle .openssl .PEMDecryptorProvider ;
31- import org .bouncycastle .openssl .PEMEncryptedKeyPair ;
3235import org .bouncycastle .openssl .PEMKeyPair ;
3336import org .bouncycastle .openssl .PEMParser ;
34- import org .bouncycastle .openssl .PasswordFinder ;
3537import org .bouncycastle .openssl .jcajce .JcaPEMKeyConverter ;
36- import org .bouncycastle .openssl .jcajce .JcePEMDecryptorProviderBuilder ;
38+ import org .bouncycastle .crypto .params .AsymmetricKeyParameter ;
39+ import org .bouncycastle .crypto .params .Ed25519PrivateKeyParameters ;
40+ import org .bouncycastle .crypto .params .Ed25519PublicKeyParameters ;
41+ import org .bouncycastle .crypto .util .OpenSSHPrivateKeyUtil ;
42+ import org .bouncycastle .crypto .util .OpenSSHPublicKeyUtil ;
43+ import org .bouncycastle .jcajce .spec .OpenSSHPrivateKeySpec ;
44+ import org .bouncycastle .jcajce .spec .OpenSSHPublicKeySpec ;
45+ import org .bouncycastle .util .io .pem .PemObject ;
46+ import org .bouncycastle .util .io .pem .PemReader ;
3747
3848/**
3949 * This host key provider loads private keys from the specified files.
40- *
50+ * <p>
4151 * Note that this class has a direct dependency on BouncyCastle and won't work
4252 * unless it has been correctly registered as a security provider.
4353 *
4454 * @author <a href="mailto:dev@mina.apache.org">Apache MINA SSHD Project</a>
4555 */
46- public class FileKeyPairProvider extends AbstractKeyPairProvider {
56+ public class FileKeyPairProvider extends AbstractKeyPairProvider
57+ {
4758
4859 private String [] files ;
49- private PasswordFinder passwordFinder ;
50-
51- public FileKeyPairProvider () {
52- }
5360
54- public FileKeyPairProvider (String [] files ) {
55- this . files = files ;
61+ public FileKeyPairProvider ()
62+ {
5663 }
5764
58- public FileKeyPairProvider (String [] files , PasswordFinder passwordFinder ) {
65+ public FileKeyPairProvider (String [] files )
66+ {
5967 this .files = files ;
60- this .passwordFinder = passwordFinder ;
6168 }
6269
63- public String [] getFiles () {
70+ public String [] getFiles ()
71+ {
6472 return files ;
6573 }
6674
67- public void setFiles (String [] files ) {
75+ public void setFiles (String [] files )
76+ {
6877 this .files = files ;
6978 }
7079
71- public PasswordFinder getPasswordFinder () {
72- return passwordFinder ;
73- }
74-
75- public void setPasswordFinder (PasswordFinder passwordFinder ) {
76- this .passwordFinder = passwordFinder ;
77- }
7880
79- public Iterable <KeyPair > loadKeys () {
81+ @ Override
82+ public Iterable <KeyPair > loadKeys ()
83+ {
8084 if (!SecurityUtils .isBouncyCastleRegistered ()) {
8185 throw new IllegalStateException ("BouncyCastle must be registered as a JCE provider" );
8286 }
83- return new Iterable <KeyPair >() {
87+ return new Iterable <KeyPair >()
88+ {
8489 @ Override
85- public Iterator <KeyPair > iterator () {
86- return new Iterator <KeyPair >() {
90+ public Iterator <KeyPair > iterator ()
91+ {
92+ return new Iterator <KeyPair >()
93+ {
8794 private final Iterator <String > iterator = Arrays .asList (files ).iterator ();
8895 private KeyPair nextKeyPair ;
8996 private boolean nextKeyPairSet = false ;
97+
9098 @ Override
91- public boolean hasNext () {
99+ public boolean hasNext ()
100+ {
92101 return nextKeyPairSet || setNextObject ();
93102 }
103+
94104 @ Override
95- public KeyPair next () {
105+ public KeyPair next ()
106+ {
96107 if (!nextKeyPairSet ) {
97108 if (!setNextObject ()) {
98109 throw new NoSuchElementException ();
@@ -101,13 +112,22 @@ public KeyPair next() {
101112 nextKeyPairSet = false ;
102113 return nextKeyPair ;
103114 }
115+
104116 @ Override
105- public void remove () {
117+ public void remove ()
118+ {
106119 throw new UnsupportedOperationException ();
107120 }
108- private boolean setNextObject () {
121+
122+ private boolean setNextObject ()
123+ {
109124 while (iterator .hasNext ()) {
110125 String file = iterator .next ();
126+ File f = new File (file );
127+ if (!f .isFile ()) {
128+ log .debug ("File does not exist, skipping {}" , file );
129+ continue ;
130+ }
111131 nextKeyPair = doLoadKey (file );
112132 if (nextKeyPair != null ) {
113133 nextKeyPairSet = true ;
@@ -122,30 +142,71 @@ private boolean setNextObject() {
122142 };
123143 }
124144
125- protected KeyPair doLoadKey (String file ) {
145+
146+ private KeyPair doLoadKey (String file )
147+ {
126148 try {
127- PEMParser r = new PEMParser (new InputStreamReader (new FileInputStream (file )));
128- try {
149+
150+ try (PemReader r = new PemReader (new InputStreamReader (new FileInputStream (file )))) {
151+ PemObject pemObject = r .readPemObject ();
152+ if ("OPENSSH PRIVATE KEY" .equals (pemObject .getType ())) {
153+ // This reads a properly OpenSSH formatted ed25519 private key file.
154+ // It is currently unused because the SSHD library in play doesn't work with proper keys.
155+ // This is kept in the hope that in the future the library offers proper support.
156+ try {
157+ byte [] privateKeyContent = pemObject .getContent ();
158+ AsymmetricKeyParameter privateKeyParameters = OpenSSHPrivateKeyUtil .parsePrivateKeyBlob (privateKeyContent );
159+ if (privateKeyParameters instanceof Ed25519PrivateKeyParameters ) {
160+ OpenSSHPrivateKeySpec privkeySpec = new OpenSSHPrivateKeySpec (privateKeyContent );
161+
162+ Ed25519PublicKeyParameters publicKeyParameters = ((Ed25519PrivateKeyParameters )privateKeyParameters ).generatePublicKey ();
163+ OpenSSHPublicKeySpec pubKeySpec = new OpenSSHPublicKeySpec (OpenSSHPublicKeyUtil .encodePublicKey (publicKeyParameters ));
164+
165+ KeyFactory kf = KeyFactory .getInstance ("Ed25519" , "BC" );
166+ PrivateKey privateKey = kf .generatePrivate (privkeySpec );
167+ PublicKey publicKey = kf .generatePublic (pubKeySpec );
168+ return new KeyPair (publicKey , privateKey );
169+ }
170+ else {
171+ log .warn ("OpenSSH format is only supported for Ed25519 key type. Unable to read key " + file );
172+ }
173+ }
174+ catch (Exception e ) {
175+ log .warn ("Unable to read key " + file , e );
176+ }
177+ return null ;
178+ }
179+
180+ if ("EDDSA PRIVATE KEY" .equals (pemObject .getType ())) {
181+ // This reads the ed25519 key from a file format that we created in SshDaemon.
182+ // The type EDDSA PRIVATE KEY was given by us and nothing official.
183+ byte [] privateKeyContent = pemObject .getContent ();
184+ PrivateKeyEntryDecoder <? extends PublicKey ,? extends PrivateKey > decoder = SecurityUtils .getOpenSSHEDDSAPrivateKeyEntryDecoder ();
185+ PrivateKey privateKey = decoder .decodePrivateKey (null , privateKeyContent , 0 , privateKeyContent .length );
186+ PublicKey publicKey = SecurityUtils . recoverEDDSAPublicKey (privateKey );
187+ return new KeyPair (publicKey , privateKey );
188+ }
189+ }
190+
191+ try (PEMParser r = new PEMParser (new InputStreamReader (new FileInputStream (file )))) {
129192 Object o = r .readObject ();
130193
131194 JcaPEMKeyConverter pemConverter = new JcaPEMKeyConverter ();
132195 pemConverter .setProvider ("BC" );
133- if (passwordFinder != null && o instanceof PEMEncryptedKeyPair ) {
134- JcePEMDecryptorProviderBuilder decryptorBuilder = new JcePEMDecryptorProviderBuilder ();
135- PEMDecryptorProvider pemDecryptor = decryptorBuilder .build (passwordFinder .getPassword ());
136- o = pemConverter .getKeyPair (((PEMEncryptedKeyPair ) o ).decryptKeyPair (pemDecryptor ));
137- }
138-
139196 if (o instanceof PEMKeyPair ) {
140197 o = pemConverter .getKeyPair ((PEMKeyPair )o );
141- return (KeyPair ) o ;
142- } else if (o instanceof KeyPair ) {
143- return (KeyPair ) o ;
198+ return (KeyPair )o ;
199+ }
200+ else if (o instanceof KeyPair ) {
201+ return (KeyPair )o ;
202+ }
203+ else {
204+ log .warn ("Cannot read unsupported PEM object of type: " + o .getClass ().getCanonicalName ());
144205 }
145- } finally {
146- r .close ();
147206 }
148- } catch (Exception e ) {
207+
208+ }
209+ catch (Exception e ) {
149210 log .warn ("Unable to read key " + file , e );
150211 }
151212 return null ;
0 commit comments