Use RSA for ssh server

The bouncy-castle bump increased the default size of DSA to 2048 which
some clients can choke on. We shouldn't use DSA anyhow so switch it up
to 4096 RSA everywhere.

Change-Id: I936eb240a534367fff550d25dcedc3de069c6654
Signed-off-by: Tomas Cere <tcere@cisco.com>

diff --git a/netconf/netconf-ssh/src/main/java/org/opendaylight/netconf/ssh/NetconfNorthboundSshServer.java b/netconf/netconf-ssh/src/main/java/org/opendaylight/netconf/ssh/NetconfNorthboundSshServer.java
index f7b6a443d586819943b16c8a8826cdf7ff5c8378..72878b1e6caa13f8cee77235c4cd21783cdcc6c8 100644 (file)
--- a/netconf/netconf-ssh/src/main/java/org/opendaylight/netconf/ssh/NetconfNorthboundSshServer.java
+++ b/netconf/netconf-ssh/src/main/java/org/opendaylight/netconf/ssh/NetconfNorthboundSshServer.java
@@ -28,6 +28,10 @@ public class NetconfNorthboundSshServer {
 
     private static final Logger LOG = LoggerFactory.getLogger(NetconfNorthboundSshServer.class);
 
+    private static final String DEFAULT_PRIVATE_KEY_PATH = "./configuration/netconf-mdsal-nb/RSA.pk";
+    private static final String DEFAULT_ALGORITHM = "RSA";
+    private static final int DEFAULT_KEY_SIZE = 4096;
+
     private final ChannelFuture localServer;
     private final SshProxyServer sshProxyServer;
 
@@ -50,7 +54,8 @@ public class NetconfNorthboundSshServer {
         sshProxyServerConfigurationBuilder.setLocalAddress(localAddress);
         sshProxyServerConfigurationBuilder.setAuthenticator(authProvider);
         sshProxyServerConfigurationBuilder.setIdleTimeout(Integer.MAX_VALUE);
-        sshProxyServerConfigurationBuilder.setKeyPairProvider(new PEMGeneratorHostKeyProvider());
+        sshProxyServerConfigurationBuilder.setKeyPairProvider(new PEMGeneratorHostKeyProvider(DEFAULT_PRIVATE_KEY_PATH,
+                DEFAULT_ALGORITHM, DEFAULT_KEY_SIZE));
 
         localServer.addListener(future -> {
             if (future.isDone() && !future.isCancelled()) {

diff --git a/netconf/netconf-ssh/src/main/java/org/opendaylight/netconf/ssh/osgi/NetconfSSHActivator.java b/netconf/netconf-ssh/src/main/java/org/opendaylight/netconf/ssh/osgi/NetconfSSHActivator.java
index f31f7b95b1ed93cb0d81e202ee5b5ab99f5f54da..e498b56e7375e3be20574ee6851c8e0a11970f6a 100644 (file)
--- a/netconf/netconf-ssh/src/main/java/org/opendaylight/netconf/ssh/osgi/NetconfSSHActivator.java
+++ b/netconf/netconf-ssh/src/main/java/org/opendaylight/netconf/ssh/osgi/NetconfSSHActivator.java
@@ -14,7 +14,6 @@ import java.net.InetSocketAddress;
 import java.util.concurrent.ExecutorService;
 import java.util.concurrent.Executors;
 import java.util.concurrent.ScheduledExecutorService;
-import java.util.concurrent.ThreadFactory;
 import org.apache.sshd.common.util.ThreadUtils;
 import org.apache.sshd.server.keyprovider.PEMGeneratorHostKeyProvider;
 import org.opendaylight.netconf.ssh.SshProxyServer;
@@ -44,12 +43,8 @@ public class NetconfSSHActivator implements BundleActivator {
 
     @Override
     public void start(final BundleContext bundleContext) throws IOException, InvalidSyntaxException {
-        minaTimerExecutor = Executors.newScheduledThreadPool(POOL_SIZE, new ThreadFactory() {
-            @Override
-            public Thread newThread(final Runnable runnable) {
-                return new Thread(runnable, "netconf-ssh-server-mina-timers");
-            }
-        });
+        minaTimerExecutor = Executors.newScheduledThreadPool(POOL_SIZE,
+            runnable -> new Thread(runnable, "netconf-ssh-server-mina-timers"));
         clientGroup = new NioEventLoopGroup();
         nioExecutor = ThreadUtils.newFixedThreadPool("netconf-ssh-server-nio-group", POOL_SIZE);
         server = startSSHServer(bundleContext);

diff --git a/netconf/netconf-ssh/src/test/java/org/opendaylight/netconf/netty/SSHTest.java b/netconf/netconf-ssh/src/test/java/org/opendaylight/netconf/netty/SSHTest.java
index 3b1a6950280d2722df43f36ff9ca3148b3c3dee9..d9a0756978ecf528f70a449cf8a138c856c208af 100644 (file)
--- a/netconf/netconf-ssh/src/test/java/org/opendaylight/netconf/netty/SSHTest.java
+++ b/netconf/netconf-ssh/src/test/java/org/opendaylight/netconf/netty/SSHTest.java
@@ -30,7 +30,6 @@ import org.apache.sshd.server.keyprovider.PEMGeneratorHostKeyProvider;
 import org.junit.AfterClass;
 import org.junit.BeforeClass;
 import org.junit.Test;
-import org.opendaylight.netconf.auth.AuthProvider;
 import org.opendaylight.netconf.netty.EchoClientHandler.State;
 import org.opendaylight.netconf.nettyutil.handler.ssh.authentication.LoginPassword;
 import org.opendaylight.netconf.nettyutil.handler.ssh.client.AsyncSshHandler;
@@ -75,13 +74,9 @@ public class SSHTest {
         final SshProxyServer sshProxyServer = new SshProxyServer(minaTimerEx, nettyGroup, nioExec);
         sshProxyServer.bind(new SshProxyServerConfigurationBuilder()
                 .setBindingAddress(addr).setLocalAddress(NetconfConfiguration.NETCONF_LOCAL_ADDRESS)
-                .setAuthenticator(new AuthProvider() {
-                        @Override
-                        public boolean authenticated(final String username, final String password) {
-                            return true;
-                        }
-                })
-                .setKeyPairProvider(new PEMGeneratorHostKeyProvider(sshKeyPair.toPath().toAbsolutePath().toString()))
+                .setAuthenticator((username, password) -> true)
+                .setKeyPairProvider(new PEMGeneratorHostKeyProvider(sshKeyPair.toPath().toAbsolutePath().toString(),
+                        "RSA", 4096))
                 .setIdleTimeout(Integer.MAX_VALUE).createSshProxyServerConfiguration());
 
         final EchoClientHandler echoClientHandler = connectClient(addr);

diff --git a/netconf/netconf-ssh/src/test/java/org/opendaylight/netconf/ssh/authentication/SSHServerTest.java b/netconf/netconf-ssh/src/test/java/org/opendaylight/netconf/ssh/authentication/SSHServerTest.java
index 7af4598997cc6254906f387fa7d809f8c0092ee0..1d31f6b77a8064ad57da00bbf143ae7d35fc7c29 100644 (file)
--- a/netconf/netconf-ssh/src/test/java/org/opendaylight/netconf/ssh/authentication/SSHServerTest.java
+++ b/netconf/netconf-ssh/src/test/java/org/opendaylight/netconf/ssh/authentication/SSHServerTest.java
@@ -30,7 +30,6 @@ import org.junit.Before;
 import org.junit.Test;
 import org.mockito.Mock;
 import org.mockito.MockitoAnnotations;
-import org.opendaylight.netconf.auth.AuthProvider;
 import org.opendaylight.netconf.ssh.SshProxyServer;
 import org.opendaylight.netconf.ssh.SshProxyServerConfigurationBuilder;
 import org.opendaylight.netconf.util.osgi.NetconfConfiguration;
@@ -74,13 +73,9 @@ public class SSHServerTest {
         server = new SshProxyServer(minaTimerEx, clientGroup, nioExec);
         server.bind(new SshProxyServerConfigurationBuilder()
                 .setBindingAddress(addr).setLocalAddress(NetconfConfiguration.NETCONF_LOCAL_ADDRESS)
-                .setAuthenticator(new AuthProvider() {
-                    @Override
-                    public boolean authenticated(final String username, final String password) {
-                        return true;
-                    }
-                })
-                .setKeyPairProvider(new PEMGeneratorHostKeyProvider(sshKeyPair.toPath().toAbsolutePath().toString()))
+                .setAuthenticator((username, password) -> true)
+                .setKeyPairProvider(new PEMGeneratorHostKeyProvider(sshKeyPair.toPath().toAbsolutePath().toString(),
+                        "RSA", 4096))
                 .setIdleTimeout(Integer.MAX_VALUE).createSshProxyServerConfiguration());
         LOG.info("SSH server started on {}", PORT);
     }

diff --git a/netconf/tools/netconf-testtool/src/main/java/org/opendaylight/netconf/test/tool/NetconfDeviceSimulator.java b/netconf/tools/netconf-testtool/src/main/java/org/opendaylight/netconf/test/tool/NetconfDeviceSimulator.java
index 6e01531dc775cd5dc2a5b6fb1be1f9b592c7ac9f..53ca53ab70ab4eabfdeeb8011d80e6119c31c87b 100644 (file)
--- a/netconf/tools/netconf-testtool/src/main/java/org/opendaylight/netconf/test/tool/NetconfDeviceSimulator.java
+++ b/netconf/tools/netconf-testtool/src/main/java/org/opendaylight/netconf/test/tool/NetconfDeviceSimulator.java
@@ -43,7 +43,6 @@ import org.opendaylight.controller.config.util.capability.Capability;
 import org.opendaylight.controller.config.util.capability.YangModuleCapability;
 import org.opendaylight.netconf.api.monitoring.NetconfMonitoringService;
 import org.opendaylight.netconf.api.xml.XmlNetconfConstants;
-import org.opendaylight.netconf.auth.AuthProvider;
 import org.opendaylight.netconf.impl.NetconfServerDispatcherImpl;
 import org.opendaylight.netconf.impl.NetconfServerSessionNegotiatorFactory;
 import org.opendaylight.netconf.impl.SessionIdProvider;
@@ -263,12 +262,7 @@ public class NetconfDeviceSimulator implements Closeable {
         return new SshProxyServerConfigurationBuilder()
                 .setBindingAddress(bindingAddress)
                 .setLocalAddress(tcpLocalAddress)
-                .setAuthenticator(new AuthProvider() {
-                    @Override
-                    public boolean authenticated(final String username, final String password) {
-                        return true;
-                    }
-                })
+                .setAuthenticator((username, password) -> true)
                 .setKeyPairProvider(keyPairProvider)
                 .setIdleTimeout(Integer.MAX_VALUE)
                 .createSshProxyServerConfiguration();
@@ -277,7 +271,7 @@ public class NetconfDeviceSimulator implements Closeable {
     private PEMGeneratorHostKeyProvider getPemGeneratorHostKeyProvider() {
         try {
             final Path tempFile = Files.createTempFile("tempKeyNetconfTest", "suffix");
-            return new PEMGeneratorHostKeyProvider(tempFile.toAbsolutePath().toString());
+            return new PEMGeneratorHostKeyProvider(tempFile.toAbsolutePath().toString(), "RSA", 4096);
         } catch (final IOException e) {
             LOG.error("Unable to generate PEM key", e);
             throw new RuntimeException(e);