Merge branch 'main' into pr/656

Author: Eugeny

.all-contributorsrc

@@ -679,6 +679,24 @@
       "contributions": [
         "code"
       ]
+    },
+    {
+      "login": "Mota-Link",
+      "name": "Mota-Link",
+      "avatar_url": "https://avatars.githubusercontent.com/u/83714159?v=4",
+      "profile": "https://github.com/Mota-Link",
+      "contributions": [
+        "code"
+      ]
+    },
+    {
+      "login": "mjc",
+      "name": "Mika Cohen",
+      "avatar_url": "https://avatars.githubusercontent.com/u/1977?v=4",
+      "profile": "https://github.com/mjc",
+      "contributions": [
+        "code"
+      ]
     }
   ],
   "contributorsPerLine": 7,

Cargo.toml

@@ -28,6 +28,6 @@ ssh-key = { version = "=0.6.16", features = [
     "ppk",
     "hazmat-allow-insecure-rsa-keys",
 ], package = "internal-russh-forked-ssh-key" }
-thiserror = "1.0.30"
+thiserror = "2.0.18"
 tokio = { version = "1.17.0" }
 tokio-stream = { version = "0.1.3", features = ["net", "sync"] }

README.md

@@ -1,7 +1,7 @@
 # Russh
 
 [![Rust](https://github.com/warp-tech/russh/actions/workflows/rust.yml/badge.svg)](https://github.com/warp-tech/russh/actions/workflows/rust.yml)  <!-- ALL-CONTRIBUTORS-BADGE:START - Do not remove or modify this section -->
-[![All Contributors](https://img.shields.io/badge/all_contributors-75-orange.svg?style=flat-square)](#contributors-)
+[![All Contributors](https://img.shields.io/badge/all_contributors-76-orange.svg?style=flat-square)](#contributors-)
 <!-- ALL-CONTRIBUTORS-BADGE:END -->
 
 Low-level Tokio SSH2 client and server implementation.
@@ -227,6 +227,8 @@ Thanks goes to these wonderful people ([emoji key](https://allcontributors.org/d
       <td align="center" valign="top" width="14.28%"><a href="https://cubic-vm.org"><img src="https://avatars.githubusercontent.com/u/155455820?v=4?s=100" width="100px;" alt="Roger Knecht"/><br /><sub><b>Roger Knecht</b></sub></a><br /><a href="https://github.com/Eugeny/russh/commits?author=rogkne" title="Code">💻</a></td>
       <td align="center" valign="top" width="14.28%"><a href="https://gui.wf"><img src="https://avatars.githubusercontent.com/u/48162143?v=4?s=100" width="100px;" alt="Guilherme Fontes"/><br /><sub><b>Guilherme Fontes</b></sub></a><br /><a href="https://github.com/Eugeny/russh/commits?author=gui-wf" title="Code">💻</a></td>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/zeroleo12345"><img src="https://avatars.githubusercontent.com/u/13072815?v=4?s=100" width="100px;" alt="Lyn"/><br /><sub><b>Lyn</b></sub></a><br /><a href="https://github.com/Eugeny/russh/commits?author=zeroleo12345" title="Code">💻</a></td>
+      <td align="center" valign="top" width="14.28%"><a href="https://github.com/Mota-Link"><img src="https://avatars.githubusercontent.com/u/83714159?v=4?s=100" width="100px;" alt="Mota-Link"/><br /><sub><b>Mota-Link</b></sub></a><br /><a href="https://github.com/Eugeny/russh/commits?author=Mota-Link" title="Code">💻</a></td>
+      <td align="center" valign="top" width="14.28%"><a href="https://github.com/mjc"><img src="https://avatars.githubusercontent.com/u/1977?v=4?s=100" width="100px;" alt="Mika Cohen"/><br /><sub><b>Mika Cohen</b></sub></a><br /><a href="https://github.com/Eugeny/russh/commits?author=mjc" title="Code">💻</a></td>
     </tr>
   </tbody>
 </table>

cryptovec/src/cryptovec.rs

@@ -1,7 +1,7 @@
 use std::fmt::Debug;
 use std::ops::{Deref, DerefMut, Index, IndexMut, Range, RangeFrom, RangeFull, RangeTo};
 
-use crate::platform::{self, mlock, munlock};
+use crate::platform::{mlock, munlock};
 
 /// A buffer which zeroes its memory on `.clear()`, `.resize()`, and
 /// reallocations, to avoid copying secrets around.
@@ -208,10 +208,11 @@ impl CryptoVec {
     /// version with zeros.
     pub fn resize(&mut self, size: usize) {
         if size <= self.capacity && size > self.size {
-            // If this is an expansion, just resize.
+            // If this is an expansion within capacity, the memory is already zeroed.
             self.size = size
         } else if size <= self.size {
-            // If this is a truncation, resize and erase the extra memory.
+            // If this is a truncation, securely erase the extra memory.
+            // Uses zeroize (optimization_barrier) to prevent dead-store elimination.
             unsafe {
                 zeroize(self.p.add(size), self.size - size);
             }
@@ -365,7 +366,7 @@ impl Drop for CryptoVec {
         if self.capacity > 0 {
             unsafe {
                 zeroize(self.p, self.size);
-                let _ = platform::munlock(self.p, self.capacity);
+                let _ = munlock(self.p, self.capacity);
                 let layout = std::alloc::Layout::from_size_align_unchecked(self.capacity, 1);
                 std::alloc::dealloc(self.p, layout);
             }

russh-config/src/lib.rs

@@ -26,25 +26,25 @@ mod proxy;
 pub use proxy::*;
 
 #[derive(Clone, Debug, Default)]
-struct HostConfig {
+pub struct HostConfig {
     /// http://man.openbsd.org/OpenBSD-current/man5/ssh_config.5#User
-    user: Option<String>,
+    pub user: Option<String>,
     /// http://man.openbsd.org/OpenBSD-current/man5/ssh_config.5#Hostname
-    hostname: Option<String>,
+    pub hostname: Option<String>,
     /// http://man.openbsd.org/OpenBSD-current/man5/ssh_config.5#Port
-    port: Option<u16>,
+    pub port: Option<u16>,
     /// http://man.openbsd.org/OpenBSD-current/man5/ssh_config.5#IdentityFile
-    identity_file: Option<Vec<PathBuf>>,
+    pub identity_file: Option<Vec<PathBuf>>,
     /// http://man.openbsd.org/OpenBSD-current/man5/ssh_config.5#ProxyCommand
-    proxy_command: Option<String>,
+    pub proxy_command: Option<String>,
     /// http://man.openbsd.org/OpenBSD-current/man5/ssh_config.5#ProxyJump
-    proxy_jump: Option<String>,
+    pub proxy_jump: Option<String>,
     /// http://man.openbsd.org/OpenBSD-current/man5/ssh_config.5#AddKeysToAgent
-    add_keys_to_agent: Option<AddKeysToAgent>,
+    pub add_keys_to_agent: Option<AddKeysToAgent>,
     /// http://man.openbsd.org/OpenBSD-current/man5/ssh_config.5#UserKnownHostsFile
-    user_known_hosts_file: Option<PathBuf>,
+    pub user_known_hosts_file: Option<PathBuf>,
     /// http://man.openbsd.org/OpenBSD-current/man5/ssh_config.5#StrictHostKeyChecking
-    strict_host_key_checking: Option<bool>,
+    pub strict_host_key_checking: Option<bool>,
 }
 
 impl HostConfig {
@@ -132,10 +132,10 @@ impl SshConfig {
 
 #[derive(Clone, Debug)]
 pub struct Config {
-    host_name: String,
-    user: Option<String>,
-    port: Option<u16>,
-    host_config: HostConfig,
+    pub host_name: String,
+    pub user: Option<String>,
+    pub port: Option<u16>,
+    pub host_config: HostConfig,
 }
 
 impl Config {

russh/examples/echoserver.rs

@@ -52,7 +52,7 @@ struct Server {
 }
 
 impl Server {
-    async fn post(&mut self, data: CryptoVec) {
+    async fn post(&mut self, data: Vec<u8>) {
         let mut clients = self.clients.lock().await;
         for (id, (channel, s)) in clients.iter_mut() {
             if *id != self.id {
@@ -116,7 +116,7 @@ impl server::Handler for Server {
             return Err(russh::Error::Disconnect);
         }
 
-        let data = CryptoVec::from(format!("Got data: {}\r\n", String::from_utf8_lossy(data)));
+        let data = format!("Got data: {}\r\n", String::from_utf8_lossy(data)).into_bytes();
         self.post(data.clone()).await;
         session.data(channel, data)?;
         Ok(())

russh/examples/ratatui_app.rs

@@ -36,7 +36,7 @@ impl TerminalHandle {
         let (sender, mut receiver) = unbounded_channel::<Vec<u8>>();
         tokio::spawn(async move {
             while let Some(data) = receiver.recv().await {
-                let result = handle.data(channel_id, data.into()).await;
+                let result = handle.data(channel_id, data).await;
                 if result.is_err() {
                     eprintln!("Failed to send data: {result:?}");
                 }

russh/examples/ratatui_shared_app.rs

@@ -36,7 +36,7 @@ impl TerminalHandle {
         let (sender, mut receiver) = unbounded_channel::<Vec<u8>>();
         tokio::spawn(async move {
             while let Some(data) = receiver.recv().await {
-                let result = handle.data(channel_id, data.into()).await;
+                let result = handle.data(channel_id, data).await;
                 if result.is_err() {
                     eprintln!("Failed to send data: {result:?}");
                 }

russh/examples/test.rs

@@ -90,7 +90,7 @@ impl server::Handler for Server {
         {
             let mut clients = self.clients.lock().unwrap();
             for ((_, _channel_id), ref mut channel) in clients.iter_mut() {
-                session.data(channel.id(), CryptoVec::from(data.to_vec()))?;
+                session.data(channel.id(), data.to_vec())?;
             }
         }
         Ok(())

russh/src/auth.rs

@@ -235,9 +235,9 @@ pub enum CurrentRequest {
     #[cfg_attr(target_arch = "wasm32", allow(dead_code))]
     PublicKey {
         #[allow(dead_code)]
-        key: CryptoVec,
+        key: Vec<u8>,
         #[allow(dead_code)]
-        algo: CryptoVec,
+        algo: Vec<u8>,
         sent_pk_ok: bool,
     },
     KeyboardInteractive {