Bump ssh-key to RC

Cargo.toml

@@ -17,16 +17,15 @@ rand = { version = "0.10", features = ["thread_rng"] }
 sha1 = { version = "0.10.5", features = ["oid"] }
 sha2 = { version = "0.10.6", features = ["oid"] }
 signature = "3.0.0-rc.10"
-ssh-encoding = { version = "0.2", features = ["bytes"] }
-ssh-key = { version = "=0.6.18", features = [
+ssh-encoding = { version = "=0.3.0-rc.9", features = ["bytes"] }
+ssh-key = { version = "=0.7.0-rc.10", features = [
     "ed25519",
     "p256",
     "p384",
     "p521",
     "encryption",
     "ppk",
-    "hazmat-allow-insecure-rsa-keys",
-], package = "internal-russh-forked-ssh-key" }
+] }
 thiserror = "2.0.18"
 tokio = { version = "1.17.0" }
-tokio-stream = { version = "0.1.3", features = ["net", "sync"] }
+tokio-stream = { version = "0.1.3", features = ["net", "sync"] }

cryptovec/src/ssh.rs

@@ -1,17 +1,7 @@
-use ssh_encoding::{Reader, Result, Writer};
+use ssh_encoding::{Result, Writer};
 
 use crate::CryptoVec;
 
-impl Reader for CryptoVec {
-    fn read<'o>(&mut self, out: &'o mut [u8]) -> Result<&'o [u8]> {
-        (&self[..]).read(out)
-    }
-
-    fn remaining_len(&self) -> usize {
-        self.len()
-    }
-}
-
 impl Writer for CryptoVec {
     fn write(&mut self, bytes: &[u8]) -> Result<()> {
         self.extend(bytes);

russh/Cargo.toml

@@ -23,7 +23,7 @@ des = ["dep:des"]
 # Danger: DSA algorithm is insecure.
 dsa = ["ssh-key/dsa"]
 ring = ["dep:ring"] # Alternative crypto backend.
-rsa = ["dep:rsa", "dep:pkcs1", "ssh-key/rsa", "ssh-key/rsa-sha1"]
+rsa = ["dep:rsa", "dep:pkcs1", "ssh-key/rsa"]
 serde = ["ssh-key/serde"]
 _bench = ["dep:criterion"]
 

russh/src/client/mod.rs

@@ -1135,6 +1135,7 @@ impl Session {
                     // The kex signal has not been consumed yet,
                     // so we can send return the concrete error to be propagated
                     // into the JoinHandle and returned from `connect_stream`
+                    debug!("disconnected during handshake {e:?}");
                     Err(e)
                 } else {
                     // The kex signal has been consumed, so no one is

russh/src/kex/curve25519.rs

@@ -7,11 +7,11 @@ use sha2::Digest;
 use ssh_encoding::{Encode, Writer};
 
 use super::{
-    compute_keys, encode_mpint, KexAlgorithm, KexAlgorithmImplementor, KexType, SharedSecret,
+    KexAlgorithm, KexAlgorithmImplementor, KexType, SharedSecret, compute_keys, encode_mpint,
 };
 use crate::mac::{self};
 use crate::session::Exchange;
-use crate::{cipher, msg, CryptoVec};
+use crate::{CryptoVec, cipher, msg};
 
 pub struct Curve25519KexType {}
 
@@ -79,7 +79,9 @@ impl KexAlgorithmImplementor for Curve25519Kex {
 
         // fill exchange.
         exchange.server_ephemeral.clear();
-        exchange.server_ephemeral.extend_from_slice(&server_pubkey.0);
+        exchange
+            .server_ephemeral
+            .extend_from_slice(&server_pubkey.0);
         let shared = server_secret * client_pubkey;
         self.shared_secret = Some(shared);
         Ok(())
@@ -99,7 +101,7 @@ impl KexAlgorithmImplementor for Curve25519Kex {
         client_ephemeral.extend_from_slice(&client_pubkey.0);
 
         msg::KEX_ECDH_INIT.encode(writer)?;
-        client_pubkey.0.encode(writer)?;
+        (&client_pubkey.0[..]).encode(writer)?;
 
         self.local_secret = Some(client_secret);
         Ok(())

russh/src/server/encrypted.rs

@@ -217,7 +217,10 @@ mod tests {
         }))
         .await;
 
-        assert_rejected(result, "server accepted an exec request with trailing bytes");
+        assert_rejected(
+            result,
+            "server accepted an exec request with trailing bytes",
+        );
     }
 
     #[tokio::test]
@@ -230,7 +233,10 @@ mod tests {
         }))
         .await;
 
-        assert_rejected(result, "server accepted a signal request with trailing bytes");
+        assert_rejected(
+            result,
+            "server accepted a signal request with trailing bytes",
+        );
     }
 
     #[tokio::test]
@@ -242,7 +248,10 @@ mod tests {
         }))
         .await;
 
-        assert_rejected(result, "server accepted a service request with trailing bytes");
+        assert_rejected(
+            result,
+            "server accepted a service request with trailing bytes",
+        );
     }
 
     #[tokio::test]
@@ -256,7 +265,10 @@ mod tests {
         }))
         .await;
 
-        assert_rejected(result, "server accepted a none auth request with trailing bytes");
+        assert_rejected(
+            result,
+            "server accepted a none auth request with trailing bytes",
+        );
     }
 
     #[tokio::test]
@@ -508,7 +520,12 @@ impl Encrypted {
                     PublicKeyOrCertificate::Certificate(ref cert) => {
                         // Validate certificate expiration
                         let now = SystemTime::now();
-                        if now < cert.valid_after_time() || now > cert.valid_before_time() {
+                        if cert.valid_after_time().map(|t| now < t).unwrap_or_default()
+                            || cert
+                                .valid_before_time()
+                                .map(|t| now > t)
+                                .unwrap_or_default()
+                        {
                             warn!("Certificate is expired or not yet valid");
                             reject_auth_request(until, &mut self.write, auth_request).await?;
                             return Ok(());
@@ -840,11 +857,9 @@ impl Session {
                     handler.extended_data(channel_num, ext, &data, self).await
                 } else {
                     if let Some(chan) = self.channels.get(&channel_num) {
-                        chan.send(ChannelMsg::Data {
-                            data: data.clone(),
-                        })
-                        .await
-                        .unwrap_or(())
+                        chan.send(ChannelMsg::Data { data: data.clone() })
+                            .await
+                            .unwrap_or(())
                     }
                     handler.data(channel_num, &data, self).await
                 }