From bfa82b4e44494ac92f5a6c4b345691378c1e14d7 Mon Sep 17 00:00:00 2001 From: Uttam Gupta Date: Mon, 13 Jan 2025 14:08:04 -0800 Subject: [PATCH] =?UTF-8?q?Issue-973=20(part1)=20-=20Removing=20direct=20d?= =?UTF-8?q?ependency=20on=20BouncyCastle=20library=20and=20using=20JCE.=20?= =?UTF-8?q?-=20This=20is=20first=20change=20towards=20removing=20direct=20?= =?UTF-8?q?dependency=20on=20BouncyCastle.=20-=20Removed=20the=20imports?= =?UTF-8?q?=20org.bouncycastle.crypto.prng.RandomGenerator=20and=20=20=20o?= =?UTF-8?q?rg.bouncycastle.crypto.prng.VMPCRandomGenerator=20from=20the=20?= =?UTF-8?q?file=20=20=20BouncyCastleRandom.java,=20eliminating=20the=20dir?= =?UTF-8?q?ect=20dependency=20on=20BouncyCastle.=20=20=20Now=20using=20JCE?= =?UTF-8?q?=20with=20a=20provider,=20allowing=20SecureRandom=20to=20utiliz?= =?UTF-8?q?e=20the=20BC=20provider.=20-=20Added=20a=20new=20class,=20Bounc?= =?UTF-8?q?yCastleFipsRandom,=20similar=20to=20BouncyCastleRandom.java,=20?= =?UTF-8?q?=20=20which=20leverages=20the=20BCFIPS=20provider=20to=20create?= =?UTF-8?q?=20SecureRandom=20instances.=20-=20Upgraded=20gradle=20plugin,?= =?UTF-8?q?=20groovy=20and=20Mockito=20versions=20to=20ensure=20compatibil?= =?UTF-8?q?ity=20with=20Java=2021.=20=20=20from=20org.spockframework:spock?= =?UTF-8?q?-core:2.3-groovy-3.0=20to=20org.spockframework:spock-core:2.4-M?= =?UTF-8?q?5-groovy-4.0=20=20=20from=20org.mockito:mockito-core:4.11.0=20t?= =?UTF-8?q?o=20org.mockito:mockito-core:5.15.2=20=20=20from=20gradle-8.2-b?= =?UTF-8?q?in.zip=20to=20gradle-8.11-bin.zip=20=20Testing:=20I=20have=20ru?= =?UTF-8?q?n=20gradle=20clean=20build=20with=20java=2011=20and=20Java=2021?= =?UTF-8?q?=20and=20works.=20Test=20Gradle=20Test=20Executor=202;=20Execut?= =?UTF-8?q?ed:=20470/469/0=20=E2=9C=93=20Test=20Gradle=20Test=20Run=20:tes?= =?UTF-8?q?t;=20Executed:=20470/469/0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- build.gradle | 4 +- gradle/wrapper/gradle-wrapper.properties | 2 +- .../java/net/schmizz/sshj/DefaultConfig.java | 3 +- .../random/BouncyCastleFipsRandom.java | 78 +++++++++++++++++++ .../transport/random/BouncyCastleRandom.java | 41 ++++++---- 5 files changed, 110 insertions(+), 18 deletions(-) create mode 100644 src/main/java/net/schmizz/sshj/transport/random/BouncyCastleFipsRandom.java diff --git a/build.gradle b/build.gradle index 82ef8269..124bac0e 100644 --- a/build.gradle +++ b/build.gradle @@ -86,8 +86,8 @@ testing { useJUnitJupiter() dependencies { implementation "org.slf4j:slf4j-api:2.0.13" - implementation 'org.spockframework:spock-core:2.3-groovy-3.0' - implementation "org.mockito:mockito-core:4.11.0" + implementation "org.spockframework:spock-core:2.4-M5-groovy-4.0" + implementation "org.mockito:mockito-core:5.15.2" implementation "org.assertj:assertj-core:3.24.2" implementation "ru.vyarus:spock-junit5:1.2.0" implementation "org.apache.sshd:sshd-core:$sshdVersion" diff --git a/gradle/wrapper/gradle-wrapper.properties b/gradle/wrapper/gradle-wrapper.properties index 15de9024..e48eca57 100644 --- a/gradle/wrapper/gradle-wrapper.properties +++ b/gradle/wrapper/gradle-wrapper.properties @@ -1,5 +1,5 @@ distributionBase=GRADLE_USER_HOME distributionPath=wrapper/dists -distributionUrl=https\://services.gradle.org/distributions/gradle-8.2-bin.zip +distributionUrl=https\://services.gradle.org/distributions/gradle-8.11-bin.zip zipStoreBase=GRADLE_USER_HOME zipStorePath=wrapper/dists diff --git a/src/main/java/net/schmizz/sshj/DefaultConfig.java b/src/main/java/net/schmizz/sshj/DefaultConfig.java index 4de9958a..87b80837 100644 --- a/src/main/java/net/schmizz/sshj/DefaultConfig.java +++ b/src/main/java/net/schmizz/sshj/DefaultConfig.java @@ -59,7 +59,8 @@ import java.util.Properties; * net.schmizz.sshj.transport.mac.HMACMD596} *
  • {@link net.schmizz.sshj.ConfigImpl#setCompressionFactories Compression}: {@link net.schmizz.sshj.transport.compression.NoneCompression}
    • *
  • {@link net.schmizz.sshj.ConfigImpl#setKeyAlgorithms KeyAlgorithm}: {@link net.schmizz.sshj.signature.SignatureRSA}, {@link net.schmizz.sshj.signature.SignatureDSA}
    • - *
  • {@link net.schmizz.sshj.ConfigImpl#setRandomFactory PRNG}: {@link net.schmizz.sshj.transport.random.BouncyCastleRandom}* or {@link net.schmizz.sshj.transport.random.JCERandom}
    • + *
  • {@link net.schmizz.sshj.ConfigImpl#setRandomFactory BC}: {@link net.schmizz.sshj.transport.random.BouncyCastleRandom}* or {@link net.schmizz.sshj.transport.random.JCERandom}
    • + *
  • {@link net.schmizz.sshj.ConfigImpl#setRandomFactory BCFIPS}: {@link net.schmizz.sshj.transport.random.BouncyCastleFipsRandom}* or {@link net.schmizz.sshj.transport.random.JCERandom}
    • *
  • {@link net.schmizz.sshj.ConfigImpl#setFileKeyProviderFactories Key file support}: {@link net.schmizz.sshj.userauth.keyprovider.PKCS8KeyFile}*, {@link * net.schmizz.sshj.userauth.keyprovider.OpenSSHKeyFile}*
    • *
  • {@link net.schmizz.sshj.ConfigImpl#setVersion Client version}: {@code "NET_3_0"}
    • diff --git a/src/main/java/net/schmizz/sshj/transport/random/BouncyCastleFipsRandom.java b/src/main/java/net/schmizz/sshj/transport/random/BouncyCastleFipsRandom.java new file mode 100644 index 00000000..1628552e --- /dev/null +++ b/src/main/java/net/schmizz/sshj/transport/random/BouncyCastleFipsRandom.java @@ -0,0 +1,78 @@ +/* + * Copyright (C)2009 - SSHJ Contributors + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package net.schmizz.sshj.transport.random; + +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +import java.security.NoSuchProviderException; +import java.security.SecureRandom; + +/** + * BouncyCastle Random. This pseudo random number generator uses BouncyCastle fips. + * The JRE random will be used when creating a new generator to add some random data to the seed. + */ +public class BouncyCastleFipsRandom + implements Random { + + private static final Logger logger = LoggerFactory.getLogger(BouncyCastleFipsRandom.class); + + /** Named factory for the BouncyCastle Random */ + public static class Factory + implements net.schmizz.sshj.common.Factory { + + @Override + public Random create() { + return new BouncyCastleFipsRandom(); + } + + } + private byte[] tmp = new byte[16]; + private final SecureRandom random; + + public BouncyCastleFipsRandom() { + logger.info("Generating random seed from SecureRandom of BCFIPS."); + long t = System.currentTimeMillis(); + try { + // Use SecureRandom with the BCFIPS provider + random = SecureRandom.getInstance("DEFAULT", "BCFIPS"); + } catch (NoSuchProviderException e) { + throw new RuntimeException("BCFIPS provider is not available", e); + } catch (Exception e) { + throw new RuntimeException("Failed to initialize SecureRandom with BCFIPS provider", e); + } + logger.debug("Creating random seed took {} ms", System.currentTimeMillis() - t); + } + + @Override + public synchronized void fill(byte[] bytes, int start, int len) { + if (start == 0 && len == bytes.length) { + random.nextBytes(bytes); + } else { + synchronized (this) { + if (len > tmp.length) tmp = new byte[len]; + random.nextBytes(tmp); + System.arraycopy(tmp, 0, bytes, start, len); + } + } + } + + @Override + public void fill(byte[] bytes) { + random.nextBytes(bytes); + } + +} diff --git a/src/main/java/net/schmizz/sshj/transport/random/BouncyCastleRandom.java b/src/main/java/net/schmizz/sshj/transport/random/BouncyCastleRandom.java index d8211d3f..e41cd28a 100644 --- a/src/main/java/net/schmizz/sshj/transport/random/BouncyCastleRandom.java +++ b/src/main/java/net/schmizz/sshj/transport/random/BouncyCastleRandom.java @@ -15,15 +15,14 @@ */ package net.schmizz.sshj.transport.random; -import org.bouncycastle.crypto.prng.RandomGenerator; -import org.bouncycastle.crypto.prng.VMPCRandomGenerator; import org.slf4j.Logger; import org.slf4j.LoggerFactory; +import java.security.NoSuchProviderException; import java.security.SecureRandom; /** - * BouncyCastle Random. This pseudo random number generator uses the a very fast PRNG from BouncyCastle. + * BouncyCastle Random. This pseudo random number generator uses BouncyCastle non fips. * The JRE random will be used when creating a new generator to add some random data to the seed. */ public class BouncyCastleRandom @@ -41,21 +40,35 @@ public class BouncyCastleRandom } } + private byte[] tmp = new byte[16]; + private final SecureRandom random; - private final RandomGenerator random = new VMPCRandomGenerator(); - - public BouncyCastleRandom() { - logger.info("Generating random seed from SecureRandom."); - long t = System.currentTimeMillis(); - byte[] seed = new SecureRandom().generateSeed(8); - logger.debug("Creating random seed took {} ms", System.currentTimeMillis() - t); - random.addSeedMaterial(seed); + public BouncyCastleRandom() { + logger.info("Generating random seed from SecureRandom of BC."); + long t = System.currentTimeMillis(); + try { + // Use SecureRandom with the BC provider + random = SecureRandom.getInstance("DEFAULT", "BC"); + } catch (NoSuchProviderException e) { + throw new RuntimeException("BC provider is not in the classpath", e); + } catch (Exception e) { + throw new RuntimeException("Failed to initialize SecureRandom with BC provider", e); } + logger.debug("Creating random seed took {} ms", System.currentTimeMillis() - t); + } - @Override - public void fill(byte[] bytes, int start, int len) { - random.nextBytes(bytes, start, len); + @Override + public synchronized void fill(byte[] bytes, int start, int len) { + if (start == 0 && len == bytes.length) { + random.nextBytes(bytes); + } else { + synchronized (this) { + if (len > tmp.length) tmp = new byte[len]; + random.nextBytes(tmp); + System.arraycopy(tmp, 0, bytes, start, len); + } } + } @Override public void fill(byte[] bytes) {