Merge remote-tracking branch 'origin/master' into junit5

# Conflicts:
#	pom.xml
#	sshd-cli/src/test/java/org/apache/sshd/cli/CliSupportSplitCommandLineArgumentsTest.java

.github/dependabot.yml

@@ -20,4 +20,28 @@ updates:
   - package-ecosystem: "maven"
     directory: "/"
     schedule:
-      interval: "weekly"
+      interval: "daily"
+    ignore:
+      # Those upgrades all require JDK > 8, so need to be postponed to 3.x
+      - dependency-name: "org.springframework:spring-core"
+        versions: [">= 6.0.0"]
+      - dependency-name: "org.springframework:spring-framework-bom"
+        versions: [">= 6.0.0"]
+      - dependency-name: "org.eclipse.jgit:org.eclipse.jgit"
+        versions: [ ">= 6.0.0" ]
+      - dependency-name: "org.eclipse.jgit:org.eclipse.jgit.ssh.apache"
+        versions: [ ">= 6.0.0" ]
+      - dependency-name: "org.eclipse.jgit:org.eclipse.jgit.pgm"
+        versions: [ ">= 6.0.0" ]
+      - dependency-name: "org.mockito:mockito-core"
+        versions: [ ">= 5.0.0" ]
+      - dependency-name: "org.slf4j:slf4j-api"
+        versions: [ ">= 2.0.0" ]
+      - dependency-name: "org.slf4j:slf4j-over-slf4j"
+        versions: [ ">= 2.0.0" ]
+      - dependency-name: "org.slf4j:jul-to-slf4j"
+        versions: [ ">= 2.0.0" ]
+      - dependency-name: "org.slf4j:slf4j-jdk14"
+        versions: [ ">= 2.0.0" ]
+      - dependency-name: "org.slf4j:slf4j-simple"
+        versions: [ ">= 2.0.0" ]

.github/workflows/master-build.yml

@@ -60,6 +60,11 @@ jobs:
           restore-keys: |
             ubuntu-latest-maven-
 
+      - name: Set up Maven
+        uses: stCarolas/setup-maven@v5
+        with:
+          maven-version: '3.9.8'
+
       - name: Check version (SNAPSHOT)
         # Only deploy SNAPSHOT versions. We do not use "exit 1" because we still want the workflow
         # to report success, we just want this job to do nothing.

.gitignore

@@ -5,6 +5,7 @@ Servers/
 .settings/
 RemoteSystemsTempFiles/
 .classpath
+.factorypath
 .project
 # Puthon related files
 .pydevproject

.mvn/maven.config

@@ -1,2 +1,3 @@
 -Dworkspace.root.dir=${session.rootDirectory}
 -DprojectRoot=${session.rootDirectory}
+-Dorg.slf4j.simpleLogger.log.net.sourceforge.pmd=off

CHANGES.md

@@ -39,27 +39,82 @@
 ## Bug Fixes
 
 * [GH-524](https://github.com/apache/mina-sshd/issues/524) Performance improvements
+* [GH-533](https://github.com/apache/mina-sshd/issues/533) Fix multi-step authentication
+* [GH-582](https://github.com/apache/mina-sshd/issues/582) Fix filtering in `NamedFactory`
+* [GH-587](https://github.com/apache/mina-sshd/issues/587) Prevent `NullPointerException`on closed channel in `NettyIoSession`
+* [GH-590](https://github.com/apache/mina-sshd/issues/590) Better support for FIPS
+* [GH-597](https://github.com/apache/mina-sshd/issues/597) Pass on `Charset` in `ClientSession.executeRemoteCommand()`
 
 ## New Features
 
-* New utility methods `SftpClient.put(Path localFile, String remoteFileName)` and `SftpClient.put(InputStream in, String remoteFileName)` facilitate SFTP file uploading.
+* New utility methods `SftpClient.put(Path localFile, String remoteFileName)` and
+`SftpClient.put(InputStream in, String remoteFileName)` facilitate SFTP file uploading.
+
+### [GH-590](https://github.com/apache/mina-sshd/issues/590) Better support for FIPS
+
+Besides fixing a bug with bc-fips (the `RandomGenerator` class exists in normal Bouncy Castle,
+but not in the FIPS version, but Apache MINA sshd referenced it even if only bc-fips was present), 
+support was improved for running in an environment restricted by FIPS.
+
+There is a new system property `org.apache.sshd.security.fipsEnabled`. If set to `true`, a number
+of crypto-algorithms not approved by FIPS 140 are disabled:
+
+* key exchange methods sntrup761x25519-sha512, sntrup761x25519-sha512<!-- -->@openssh.com, curve25519-sha256, curve25519-sha256<!-- -->@libssh.org, curve448-sha512.
+* the chacha20-poly1305 cipher.
+* the bcrypt KDF used in encrypted private key files in [OpenSSH format](https://github.com/openssh/openssh-portable/blob/master/PROTOCOL.key).
+* all ed25519 keys and signatures.
+
+Additionally, the new "SunJCEWrapper" `SecurityProviderRegistrar` (see below) and the
+`EdDSASecurityProviderRegistrar` are disabled, and the `BouncyCastleScurityProviderRegistrar`
+looks only for the "BCFIPS" security provider, not for the normal "BC" provider.
+
+If the system property is _not_ set to `true`, FIPS mode can be enabled programmatically
+by calling `SecurityUtils.setFipsMode()` before any other call to Apache MINA sshd.
 
 ## Potential compatibility issues
 
+### New security provider registrar
 There is a new `SecurityProviderRegistrar` that is registered by default
-if there is a `SunJCE` security provider and that uses the AES and
+if there is a `SunJCE` security provider. It uses the AES and
 HmacSHA* implementations from `SunJCE` even if Bouncy Castle is also
-registered. `SunJCE` has native implementation, whereas Bouncy Castle
+registered. `SunJCE` has native implementations, whereas Bouncy Castle
 may not.
 
 The new registrar has the name "SunJCEWrapper" and can be configured
 like any other registrar. It can be disabled via the system property
-`org.apache.sshd.security.provider.SunJCEWrapper.enabled=false`.
+`org.apache.sshd.security.provider.SunJCEWrapper.enabled=false`. It is also
+disabled in FIPS mode (see above).
+
+### [GH-582](https://github.com/apache/mina-sshd/issues/582) Fix filtering in `NamedFactory`
+
+The methods `NamedFactory.setupBuiltinFactories(boolean ignoreUnsupported, ...)` and
+`NamedFactory.setupTransformedFactories(boolean ignoreUnsupported, ...)` had a bug that
+gave the "ignoreUnsupported" parameter actually the meaning of "include unsupported".
+
+This was fixed in this release, but existing code calling these or one of the following methods:
+
+* `BaseBuilder.setUpDefaultMacs(boolean ignoreUnsupported)`
+* `BaseBuilder.setUpDefaultCiphers(boolean ignoreUnsupported)`
+* `ClientBuilder.setUpDefaultCompressionFactories(boolean ignoreUnsupported)`
+* `ClientBuilder.setUpDefaultKeyExchanges(boolean ignoreUnsupported)`
+* `ClientBuilder.setUpDefaultSignatureFactories(boolean ignoreUnsupported)`
+* `ServerBuilder.setUpDefaultCompressionFactories(boolean ignoreUnsupported)`
+* `ServerBuilder.setUpDefaultKeyExchanges(boolean ignoreUnsupported)`
+* `ServerBuilder.setUpDefaultSignatureFactories(boolean ignoreUnsupported)`
+* any of the methods starting with `SshConfigFileReader.configure`
+* `SshClientConfigFileReader.configure(...)`
+* `SshServerConfigFileReader.configure(...)`
+
+should be reviewed:
+
+* if the method is called with parameter value `true`, the result will no longer include unsupported algorithms. Formerly it wrongly did.
+* if the method is called with parameter value `false`, the result may include unsupported algorithms. Formerly it did not.
+
+So if existing code used parameter value `false` to ensure it never got unsupported algorithms, change it to `true`.
 
 ## Major Code Re-factoring
 
 ### JDK requirements
 
-The project now requires JDK 17 at build time 
-[GH-536](https://github.com/apache/mina-sshd/issues/536), while the target runtime
-still remains unchanged to support JDK 8.
+* [GH-536](https://github.com/apache/mina-sshd/issues/536) The project now requires
+JDK 17 at build time, while the target runtime still remains unchanged to support JDK 8.

README.md

@@ -70,6 +70,9 @@ implementation of the logging API can be selected from the many existing adaptor
 * *sshd-contrib* - **experimental** code that is currently under review and may find its way into one of the other artifacts
 (or become an entirely new artifact - e.g., *sshd-putty* evolved this way).
 
+* *sshd-benchmarks* - contains some JMH benchmarks for SSH operations. The benchmarks are intended to be run by developers locally;
+the artifact is not part of the binary distribution, and is not deployed to any maven repository.
+
 # [Optional dependencies](./docs/dependencies.md)
 
 # Quick reference

assembly/src/main/descriptors/unix-src.xml

@@ -40,6 +40,7 @@
                 <include>**/*.bin</include>
                 <include>**/*.jnilib</include>
                 <include>**/*.cert</include>
+                <include>**/.mvn/*</include>
 
                 <include>sshd-openpgp/src/test/resources/**/*</include>
             </includes>

assembly/src/main/descriptors/windows-src.xml

@@ -40,8 +40,12 @@
                 <include>**/*.bin</include>
                 <include>**/*.jnilib</include>
                 <include>**/*.cert</include>
+                <include>**/*.sh</include>
+                <include>**/.mvn/*</include>
 
                 <include>sshd-openpgp/src/test/resources/**/*</include>
+                <include>sshd-core/src/test/resources/org/apache/sshd/client/opensshcerts/**/*</include>
+                <include>sshd-benchmarks/src/main/resources/org/apache/sshd/**/*</include>
             </includes>
             <excludes>
                 <exclude>**/eclipse-classes/**</exclude>
@@ -72,6 +76,7 @@
                 <exclude>**/*.bin</exclude>
                 <exclude>**/*.jnilib</exclude>
                 <exclude>**/*.cert</exclude>
+                <exclude>**/*.sh</exclude>
                 <exclude>**/target/**</exclude>
                 <exclude>**/build/**</exclude>
                 <exclude>**/eclipse-classes/**</exclude>
@@ -90,6 +95,8 @@
                 <exclude>**/key.pem</exclude>
 
                 <exclude>sshd-core/src/docs/*.txt</exclude>
+                <exclude>sshd-core/src/test/resources/org/apache/sshd/client/opensshcerts/**/*</exclude>
+                <exclude>sshd-benchmarks/src/main/resources/org/apache/sshd/**/*</exclude>
                 <exclude>sshd-openpgp/src/test/resources/**/*</exclude>
             </excludes>
             <lineEnding>dos</lineEnding>

docs/security-providers.md

@@ -106,4 +106,31 @@ In any case, the values are auto-detected by the code but the user can intervene
 * If a **negative** value is set in either one then group exchange is **disabled**
 * Setting a value of zero indicates a **lazy** auto-detection of the supported range the next time these values are needed.
 
-Furthermore, if all possible primes have been exhausted the code no longer falls back to DH group exchange using SHA-1 unless the `ALLOW_DHG1_KEX_FALLBACK` core module property is set.
+Furthermore, if all possible primes have been exhausted the code no longer falls back to DH group exchange using SHA-1 unless the `ALLOW_DHG1_KEX_FALLBACK` core module property is set.
+
+## FIPS Mode
+
+Apache MINA sshd supports running in environments restricted by FIPS 140 through a special "FIPS mode".
+In FIPS mode, crypto-algorithms not approved by FIPS-140 are disabled.
+
+FIPS mode can be switched on in two ways:
+* via System property `org.apache.sshd.security.fipsEnabled=true`, or
+* if the system property is not set to `true` also programmatically via a call to `SecurityUtils.setFipsMode()` before any other call to the library.
+
+In FIPS mode, the following algorithms are disabled completely:
+* key exchange methods sntrup761x25519-sha512, sntrup761x25519-sha512<!-- -->@openssh.com, curve25519-sha256, curve25519-sha256<!-- -->@libssh.org, and curve448-sha512.
+* the chacha20-poly1305 cipher.
+* the bcrypt KDF used in encrypted private key files in [OpenSSH format](https://github.com/openssh/openssh-portable/blob/master/PROTOCOL.key).
+* all ed25519 keys and signatures.
+
+The `BouncyCastleSecurityProviderRegistrar` only considers the "BCFIPS" provider from `bc-fips`
+and disregards the "BC" provider from normal Bouncy Castle. The registrar for _EdDSA_ is disabled.
+For random numbers, `SecureRandom.getInstanceStrong()` is used.
+
+This FIPS mode does not automatically make an application using Apache MINA sshd FIPS-140-compliant.
+It only ensures that the Apache MINA sshd library does not provide or use algorithms that should not
+be used in FIPS-140-compliant applications running in approved mode.
+
+It is usually necessary to configure the JVM for full FIPS 140 compliance, for instance, by defining
+appropriate security providers statically. Any such configuration is beyond the scope of the Apache MINA
+sshd library.