Add rsa-sha2 signatures to default client

Netopeer2 can be configured to only allow rsa-sha2 signatures, in
which case we fail to connect to it. Add these to the list of
supported signatures by default.

Change-Id: I00a961e23c06c99dfca0043dd2129fc1438d0b94
Signed-off-by: Robert Varga <robert.varga@pantheon.tech>

diff --git a/netconf/netconf-netty-util/src/main/java/org/opendaylight/netconf/nettyutil/handler/ssh/client/NetconfClientBuilder.java b/netconf/netconf-netty-util/src/main/java/org/opendaylight/netconf/nettyutil/handler/ssh/client/NetconfClientBuilder.java
index d0efcf640f21e0d210d5cfda4b34e3f6bb2480f0..cb2ba4edadcfae1564dcadadbc40c59d918a4e4f 100644 (file)
--- a/netconf/netconf-netty-util/src/main/java/org/opendaylight/netconf/nettyutil/handler/ssh/client/NetconfClientBuilder.java
+++ b/netconf/netconf-netty-util/src/main/java/org/opendaylight/netconf/nettyutil/handler/ssh/client/NetconfClientBuilder.java
@@ -10,14 +10,29 @@ package org.opendaylight.netconf.nettyutil.handler.ssh.client;
 import static com.google.common.base.Verify.verify;
 
 import com.google.common.annotations.Beta;
+import com.google.common.collect.ImmutableList;
+import com.google.common.collect.Streams;
+import java.util.Arrays;
 import org.opendaylight.netconf.shaded.sshd.client.ClientBuilder;
 import org.opendaylight.netconf.shaded.sshd.client.SshClient;
+import org.opendaylight.netconf.shaded.sshd.common.NamedFactory;
+import org.opendaylight.netconf.shaded.sshd.common.signature.BuiltinSignatures;
+import org.opendaylight.netconf.shaded.sshd.common.signature.Signature;
 
 /**
  * A {@link ClientBuilder} which builds {@link NetconfSshClient} instances.
  */
 @Beta
 public class NetconfClientBuilder extends ClientBuilder {
+    // RFC8332 rsa-sha2-256/rsa-sha2-512 are not a part of Mina's default set of signatures for clients as of 2.5.1.
+    // Add them to ensure interop with modern highly-secured devices.
+    private static final ImmutableList<NamedFactory<Signature>> FULL_SIGNATURE_PREFERENCE =
+            Streams.concat(DEFAULT_SIGNATURE_PREFERENCE.stream(), Arrays.asList(
+                BuiltinSignatures.rsaSHA512, BuiltinSignatures.rsaSHA256).stream())
+            .filter(BuiltinSignatures::isSupported)
+            .distinct()
+            .collect(ImmutableList.<NamedFactory<Signature>>toImmutableList());
+
     @Override
     public NetconfSshClient build() {
         final SshClient client = super.build();
@@ -30,6 +45,9 @@ public class NetconfClientBuilder extends ClientBuilder {
         if (factory == null) {
             factory = NetconfSshClient.DEFAULT_NETCONF_SSH_CLIENT_FACTORY;
         }
+        if (signatureFactories == null) {
+            signatureFactories = FULL_SIGNATURE_PREFERENCE;
+        }
         return super.fillWithDefaultValues();
     }
 }