Skip to content

Commit 6ab4a96

Browse files
author
Gusted
authored
Update golang.org/x/crypto (#19097)
* Update golang.org/x/crypto - Update dependency to include fix for CVE. - See https://groups.google.com/g/golang-announce/c/-cp44ypCT5s/m/wmegxkLiAQAJ?utm_medium=email&utm_source=footer * Fix deprecation notice * Remove workaround - Introduced in #17281 - Fixed in x/crypto: - golang/crypto@5d542ad - & golang/crypto@3147a52 * Update Kex Algorithms - Use standardized name for curve22519-sha256. golang/crypto@9b07691 - Prefer SHA256 version over SHA1 version. golang/crypto@e4b3678
1 parent c88f2e2 commit 6ab4a96

File tree

6 files changed

+6
-62
lines changed

6 files changed

+6
-62
lines changed

‎custom/conf/app.example.ini‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -117,7 +117,7 @@ RUN_MODE = ; prod
117117
;;
118118
;; For the built-in SSH server, choose the key exchange algorithms to support for SSH connections,
119119
;; for system SSH this setting has no effect
120-
;SSH_SERVER_KEY_EXCHANGES = curve25519-sha256@libssh.org, ecdh-sha2-nistp256, ecdh-sha2-nistp384, ecdh-sha2-nistp521, diffie-hellman-group14-sha1
120+
;SSH_SERVER_KEY_EXCHANGES = curve25519-sha256, ecdh-sha2-nistp256, ecdh-sha2-nistp384, ecdh-sha2-nistp521, diffie-hellman-group14-sha256, diffie-hellman-group14-sha1
121121
;;
122122
;; For the built-in SSH server, choose the MACs to support for SSH connections,
123123
;; for system SSH this setting has no effect

‎docs/content/doc/advanced/config-cheat-sheet.en-us.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -280,7 +280,7 @@ The following configuration set `Content-Type: application/vnd.android.package-a
280280
- `SSH_AUTHORIZED_PRINCIPALS_BACKUP`: **false/true**: Enable SSH Authorized Principals Backup when rewriting all keys, default is true if `SSH_AUTHORIZED_PRINCIPALS_ALLOW` is not `off`.
281281
- `SSH_AUTHORIZED_KEYS_COMMAND_TEMPLATE`: **{{.AppPath}} --config={{.CustomConf}} serv key-{{.Key.ID}}**: Set the template for the command to passed on authorized keys. Possible keys are: AppPath, AppWorkPath, CustomConf, CustomPath, Key - where Key is a `models/asymkey.PublicKey` and the others are strings which are shellquoted.
282282
- `SSH_SERVER_CIPHERS`: **chacha20-poly1305@openssh.com, aes128-ctr, aes192-ctr, aes256-ctr, aes128-gcm@openssh.com, aes256-gcm@openssh.com**: For the built-in SSH server, choose the ciphers to support for SSH connections, for system SSH this setting has no effect.
283-
- `SSH_SERVER_KEY_EXCHANGES`: **curve25519-sha256@libssh.org, ecdh-sha2-nistp256, ecdh-sha2-nistp384, ecdh-sha2-nistp521, diffie-hellman-group14-sha1**: For the built-in SSH server, choose the key exchange algorithms to support for SSH connections, for system SSH this setting has no effect.
283+
- `SSH_SERVER_KEY_EXCHANGES`: **curve25519-sha256, ecdh-sha2-nistp256, ecdh-sha2-nistp384, ecdh-sha2-nistp521, diffie-hellman-group14-sha256, diffie-hellman-group14-sha1**: For the built-in SSH server, choose the key exchange algorithms to support for SSH connections, for system SSH this setting has no effect.
284284
- `SSH_SERVER_MACS`: **hmac-sha2-256-etm@openssh.com, hmac-sha2-256, hmac-sha1**: For the built-in SSH server, choose the MACs to support for SSH connections, for system SSH this setting has no effect
285285
- `SSH_SERVER_HOST_KEYS`: **ssh/gitea.rsa, ssh/gogs.rsa**: For the built-in SSH server, choose the keypairs to offer as the host key. The private key should be at `SSH_SERVER_HOST_KEY` and the public `SSH_SERVER_HOST_KEY.pub`. Relative paths are made absolute relative to the `APP_DATA_PATH`. If no key exists a 4096 bit RSA key will be created for you.
286286
- `SSH_KEY_TEST_PATH`: **/tmp**: Directory to create temporary files in when testing public keys using ssh-keygen, default is the system temporary directory.

‎go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -122,7 +122,7 @@ require (
122122
go.uber.org/atomic v1.9.0 // indirect
123123
go.uber.org/multierr v1.8.0 // indirect
124124
go.uber.org/zap v1.21.0 // indirect
125-
golang.org/x/crypto v0.0.0-20220214200702-86341886e292
125+
golang.org/x/crypto v0.0.0-20220315160706-3147a52a75dd
126126
golang.org/x/net v0.0.0-20220225172249-27dd8689420f
127127
golang.org/x/oauth2 v0.0.0-20220223155221-ee480838109b
128128
golang.org/x/sys v0.0.0-20220227234510-4e6760a101f9

‎go.sum‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1683,8 +1683,8 @@ golang.org/x/crypto v0.0.0-20210817164053-32db794688a5/go.mod h1:GvvjBRRGRdwPK5y
16831683
golang.org/x/crypto v0.0.0-20211108221036-ceb1ce70b4fa/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
16841684
golang.org/x/crypto v0.0.0-20211117183948-ae814b36b871/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
16851685
golang.org/x/crypto v0.0.0-20220112180741-5e0467b6c7ce/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
1686-
golang.org/x/crypto v0.0.0-20220214200702-86341886e292 h1:f+lwQ+GtmgoY+A2YaQxlSOnDjXcQ7ZRLWOHbC6HtRqE=
1687-
golang.org/x/crypto v0.0.0-20220214200702-86341886e292/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
1686+
golang.org/x/crypto v0.0.0-20220315160706-3147a52a75dd h1:XcWmESyNjXJMLahc3mqVQJcgSTDxFxhETVlfk9uGc38=
1687+
golang.org/x/crypto v0.0.0-20220315160706-3147a52a75dd/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
16881688
golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
16891689
golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
16901690
golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=

‎modules/setting/setting.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -164,7 +164,7 @@ var (
164164
Domain: "",
165165
Port: 22,
166166
ServerCiphers: []string{"chacha20-poly1305@openssh.com", "aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-gcm@openssh.com", "aes256-gcm@openssh.com"},
167-
ServerKeyExchanges: []string{"curve25519-sha256@libssh.org", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group14-sha1"},
167+
ServerKeyExchanges: []string{"curve25519-sha256", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1"},
168168
ServerMACs: []string{"hmac-sha2-256-etm@openssh.com", "hmac-sha2-256", "hmac-sha1"},
169169
KeygenPath: "ssh-keygen",
170170
MinimumKeySizeCheck: true,

‎modules/ssh/ssh.go‎

Lines changed: 0 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -317,65 +317,9 @@ func Listen(host string, port int, ciphers, keyExchanges, macs []string) {
317317
}
318318
}
319319

320-
// Workaround slightly broken behaviour in x/crypto/ssh/handshake.go:458-463
321-
//
322-
// Fundamentally the issue here is that HostKeyAlgos make the incorrect assumption
323-
// that the PublicKey().Type() matches the signature algorithm.
324-
//
325-
// Therefore we need to add duplicates for the RSA with different signing algorithms.
326-
signers := make([]ssh.Signer, 0, len(srv.HostSigners))
327-
for _, signer := range srv.HostSigners {
328-
if signer.PublicKey().Type() == "ssh-rsa" {
329-
signers = append(signers,
330-
&wrapSigner{
331-
Signer: signer,
332-
algorithm: gossh.SigAlgoRSASHA2512,
333-
},
334-
&wrapSigner{
335-
Signer: signer,
336-
algorithm: gossh.SigAlgoRSASHA2256,
337-
},
338-
)
339-
}
340-
signers = append(signers, signer)
341-
}
342-
srv.HostSigners = signers
343-
344320
go listen(&srv)
345321
}
346322

347-
// wrapSigner wraps a signer and overrides its public key type with the provided algorithm
348-
type wrapSigner struct {
349-
ssh.Signer
350-
algorithm string
351-
}
352-
353-
// PublicKey returns an associated PublicKey instance.
354-
func (s *wrapSigner) PublicKey() gossh.PublicKey {
355-
return &wrapPublicKey{
356-
PublicKey: s.Signer.PublicKey(),
357-
algorithm: s.algorithm,
358-
}
359-
}
360-
361-
// Sign returns raw signature for the given data. This method
362-
// will apply the hash specified for the keytype to the data using
363-
// the algorithm assigned for this key
364-
func (s *wrapSigner) Sign(rand io.Reader, data []byte) (*gossh.Signature, error) {
365-
return s.Signer.(gossh.AlgorithmSigner).SignWithAlgorithm(rand, data, s.algorithm)
366-
}
367-
368-
// wrapPublicKey wraps a PublicKey and overrides its type
369-
type wrapPublicKey struct {
370-
gossh.PublicKey
371-
algorithm string
372-
}
373-
374-
// Type returns the algorithm
375-
func (k *wrapPublicKey) Type() string {
376-
return k.algorithm
377-
}
378-
379323
// GenKeyPair make a pair of public and private keys for SSH access.
380324
// Public key is encoded in the format for inclusion in an OpenSSH authorized_keys file.
381325
// Private Key generated is PEM encoded

0 commit comments

Comments
 (0)