mirror/tabby
2
0
Fork 0
mirror of https://github.com/Eugeny/tabby.git synced 2024-12-15 06:30:13 +08:00
Code Issues Packages Projects Releases Wiki Activity

ssh: blacklist broken kex algorithms

Browse Source
This commit is contained in:
Eugene Pankov 2021-01-24 11:26:43 +01:00
parent fe936c7726
commit 5417efe558
No known key found for this signature in database
GPG Key ID: 5896FCBBDD1CF4F4
3 changed files with 15 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
terminus-ssh/src/api.ts
View File

@ -398,3 +398,9 @@ export interface SSHConnectionGroup {
name: string name: string
connections: SSHConnection[] connections: SSHConnection[]
} }
export const ALGORITHM_BLACKLIST = [
// cause native crashes in node crypto, use EC instead
'diffie-hellman-group-exchange-sha256',
'diffie-hellman-group-exchange-sha1',
]

6
terminus-ssh/src/components/editConnectionModal.component.ts
View File

@ -3,7 +3,7 @@ import { Component } from '@angular/core'
import { NgbModal, NgbActiveModal } from '@ng-bootstrap/ng-bootstrap' import { NgbModal, NgbActiveModal } from '@ng-bootstrap/ng-bootstrap'
import { ElectronService, HostAppService, ConfigService } from 'terminus-core' import { ElectronService, HostAppService, ConfigService } from 'terminus-core'
import { PasswordStorageService } from '../services/passwordStorage.service' import { PasswordStorageService } from '../services/passwordStorage.service'
import { SSHConnection, LoginScript, SSHAlgorithmType } from '../api' import { SSHConnection, LoginScript, SSHAlgorithmType, ALGORITHM_BLACKLIST } from '../api'
import { PromptModalComponent } from './promptModal.component' import { PromptModalComponent } from './promptModal.component'
import { ALGORITHMS } from 'ssh2-streams/lib/constants' import { ALGORITHMS } from 'ssh2-streams/lib/constants'
@ -40,8 +40,8 @@ export class EditConnectionModalComponent {
[SSHAlgorithmType.CIPHER]: 'CIPHER', [SSHAlgorithmType.CIPHER]: 'CIPHER',
[SSHAlgorithmType.HMAC]: 'HMAC', [SSHAlgorithmType.HMAC]: 'HMAC',
}[k] }[k]
this.supportedAlgorithms[k] = ALGORITHMS[supportedAlg] this.supportedAlgorithms[k] = ALGORITHMS[supportedAlg].filter(x => !ALGORITHM_BLACKLIST.includes(x))
this.defaultAlgorithms[k] = ALGORITHMS[defaultAlg] this.defaultAlgorithms[k] = ALGORITHMS[defaultAlg].filter(x => !ALGORITHM_BLACKLIST.includes(x))
} }
} }

8
terminus-ssh/src/services/ssh.service.ts
View File

@ -12,7 +12,7 @@ import * as sshpk from 'sshpk'
import { ToastrService } from 'ngx-toastr' import { ToastrService } from 'ngx-toastr'
import { HostAppService, Platform, Logger, LogService, ElectronService, AppService, SelectorOption, ConfigService } from 'terminus-core' import { HostAppService, Platform, Logger, LogService, ElectronService, AppService, SelectorOption, ConfigService } from 'terminus-core'
import { SettingsTabComponent } from 'terminus-settings' import { SettingsTabComponent } from 'terminus-settings'
import { SSHConnection, SSHSession } from '../api' import { ALGORITHM_BLACKLIST, SSHConnection, SSHSession } from '../api'
import { PromptModalComponent } from '../components/promptModal.component' import { PromptModalComponent } from '../components/promptModal.component'
import { PasswordStorageService } from './passwordStorage.service' import { PasswordStorageService } from './passwordStorage.service'
import { SSHTabComponent } from '../components/sshTab.component' import { SSHTabComponent } from '../components/sshTab.component'
@ -147,6 +147,10 @@ export class SSHService {
session.ssh = ssh session.ssh = ssh
let connected = false let connected = false
let savedPassword: string|null = null let savedPassword: string|null = null
const algorithms = {}
for (const key of Object.keys(session.connection.algorithms ?? {})) {
algorithms[key] = session.connection.algorithms![key].filter(x => !ALGORITHM_BLACKLIST.includes(x))
}
await new Promise(async (resolve, reject) => { await new Promise(async (resolve, reject) => {
ssh.on('ready', () => { ssh.on('ready', () => {
connected = true connected = true
@ -267,7 +271,7 @@ export class SSHService {
return true return true
}, },
hostHash: 'sha256' as any, hostHash: 'sha256' as any,
algorithms: session.connection.algorithms, algorithms,
sock: session.jumpStream, sock: session.jumpStream,
authHandler: methodsLeft => { authHandler: methodsLeft => {
while (true) { while (true) {