Skip to content

v0.50.0

Latest
Latest
Compare
Choose a tag to compare
@github-actions github-actions released this 29 Jan 20:35
v0.50.0
89fed88

Significant changes

russh_keys merged into russh

  • 23cc724: (#450) - the russh_keys crate has been fully merged into russh. If you have been importing from russh::keys, no changes are needed, otherwise remove the russh_keys dependency and replace all use russh_keys imports with use russh::keys.

Native async traits

  • 3e04597: (#455) - client::Handler, server::Handler and other traits are now native Rust async traits. In most cases, you can simply remove the #[async_trait] macro from your trait impl. Alternatively, you can enable the async_trait feature, which will turn the traits into #[async_trait]s again. Note that the old async_trait support will be removed soon.

RSA hash negotiation

Russh client now supports the server-sig-algs OpenSSH extension and can automatically select the strongest hash for RSA keys.

You can use russh::client::Handle::best_supported_rsa_hash() to choose the hash.

PrivateKeyWithHashAlg::new is now infallible and will ignore hash_alg for non-RSA keys, so you don't have to build separate logic just for RSA keys:

session.authenticate_publickey(
    user, 
    PrivateKeyWithHashAlg::new(
        Arc::new(key_pair),
        session.best_supported_rsa_hash().await?.unwrap_or(...), // some fallback Option<HashAlg>
    ),
).await?;

If you just want to fall back to SHA1 / ssh-rsa in case the server does not support server-sig-algs:

session.authenticate_publickey(
    user, 
    PrivateKeyWithHashAlg::new(
        Arc::new(key_pair),
        session.best_supported_rsa_hash().await?.flatten(),
    ),
).await?;

Channel backpressure

  • f89c19c: added backpressure to channel buffers (#412) (Eric Rodrigues Pires) #412 - set Config::channel_buffer_size to control how many channel messages can be buffered before backpressure propagates over the network. Previously russh would simply buffer unread channel messages infinitely, eventually causing an out-of-RAM situation, and now it will block the connection until you consume them. Even if the server does not write data to the channel (e.g. it's a write-only channel for you as a client), it is still writing flow control messages, which you must consume.

So, any time you open a channel, make sure you have a loop somewhere that is either polling .wait() or reads from the AsyncRead side of its ChannelStream.

ssh-key traits

  • ab8aca8: russh has migrated to its own fork of the ssh-key crate, removed bundled workarounds - if you were relying on traits directly imported from ssh_key, you might need to import them from russh::keys::ssh_key instead.

New features

  • c9baadf: DH GEX support (#440) - diffie-hellman-group-exchange-sha256 KEX is now on the default kex list. To take advantage of dynamic DH groups, pre-generate some safe primes and implement dynamic group lookup in the server::Handler::lookup_dh_gex_group method - see this method's docs for more info.
  • 66f9416: Add an option to enable TCP_NODELAY (#435) (Patryk Wychowaniec)
  • 571dbe3: added support for loading PPK v2 and v3 private keys
  • 030468a: added authentication_banner method to server::Handler (#415) (Eric Rodrigues Pires) #415 - you can now send a dynamic SSH banner to clients.
  • 4c7b27a: expose the "remaining methods" field in auth failure responses #441
  • 77f53ed: support for parsing X9.62 EC private keys
  • 902010f: Allow setting hash algorithm to use for signing requests of SSH agent (#449) (Wiktor Kwapisiewicz) #449

MSRV

MSRV for the russh crate is now 1.75

Changes

  • 7c7cb1b: feature-gate des dependency (#424) (Eric Seppanen) #424
  • d9fb484: Include error-reason when failining in CryptoVec unix (#443) (Adrian Müller (DTT)) #443

Fixes

  • 7c1060f: fixed client keyboard-interactive auth not working as second auth method
  • ad56a8e: fixed #418 - client - incorrect kex signature verification for RSA-SHA2
  • 85c45cb: Remove calls to dbg!() (#414) (Eric Rodrigues Pires) #414
  • 65bc5e2: remove unused bcrypt-pbkdf dependency (#421) (Eric Seppanen) #421
  • cb22369: src/platform/unix.rs:cfg detect macos (#447) (@RandyMcMillan) #447
  • 039054b: bump dependency versions to the minimum version that compiles. (#428) (Eric Seppanen) #428
  • 242b1e1: replace unmaintained tempdir dependency with tempfile (#423) (Eric Seppanen) #423
  • 49ab949: Enforce MSRV (#430) #430
  • 290bdbe: fixed unwrap panic in pageant
  • 4fe938e: Send proper algorithm for certificates (#451) (Jerome Gravel-Niquet) #451

Contributors

RandyMcMillan
Assets 2
Loading