Top Description Inners Fields Constructors Methods
org.eclipse.jgit.transport.sshd

public Class SshdSessionFactory

extends SshSessionFactory
implements Closeable
Class Inheritance
All Implemented Interfaces
java.io.Closeable, java.lang.AutoCloseable
Known Direct Subclasses
org.eclipse.jgit.transport.sshd.SshdSessionFactoryBuilder.State.SessionFactory
Imports
java.io.Closeable, .File, .IOException, java.nio.file.Files, .InvalidPathException, .Path, java.security.KeyPair, java.time.Duration, java.util.ArrayList, .Arrays, .Collections, .HashSet, .List, .Map, .Set, java.util.concurrent.ConcurrentHashMap, java.util.concurrent.atomic.AtomicBoolean, java.util.function.Supplier, java.util.stream.Collectors, org.apache.sshd.client.ClientBuilder, .SshClient, org.apache.sshd.client.auth.UserAuthFactory, org.apache.sshd.client.auth.keyboard.UserAuthKeyboardInteractiveFactory, org.apache.sshd.client.auth.password.UserAuthPasswordFactory, org.apache.sshd.client.config.hosts.HostConfigEntryResolver, org.apache.sshd.common.NamedFactory, org.apache.sshd.common.compression.BuiltinCompressions, org.apache.sshd.common.config.keys.FilePasswordProvider, org.apache.sshd.common.config.keys.loader.openssh.kdf.BCryptKdfOptions, org.apache.sshd.common.keyprovider.KeyIdentityProvider, org.apache.sshd.common.signature.BuiltinSignatures, .Signature, org.eclipse.jgit.annotations.NonNull, org.eclipse.jgit.errors.TransportException, org.eclipse.jgit.internal.transport.ssh.OpenSshConfigFile, org.eclipse.jgit.internal.transport.sshd.CachingKeyPairProvider, .GssApiWithMicAuthFactory, .JGitPublicKeyAuthFactory, .JGitServerKeyVerifier, .JGitSshClient, .JGitSshConfig, .JGitUserInteraction, .OpenSshServerKeyDatabase, .PasswordProviderWrapper, .SshdText, org.eclipse.jgit.internal.transport.sshd.agent.JGitSshAgentFactory, org.eclipse.jgit.transport.CredentialsProvider, .SshConfigStore, .SshConstants, .SshSessionFactory, .URIish, org.eclipse.jgit.transport.sshd.agent.Connector, .ConnectorFactory, org.eclipse.jgit.util.FS

A SshSessionFactory that uses Apache MINA sshd. Classes from Apache MINA sshd are kept private to avoid API evolution problems when Apache MINA sshd interfaces change.
Since
5.2

Nested and Inner Type Summary

Modifier and TypeClass and Description
private static class
SshdSessionFactory.Tuple

A simple general map key.

Field Summary

Modifier and TypeField and Description
private final AtomicBoolean
private final Map<SshdSessionFactory.Tuple, HostConfigEntryResolver>
private final Map<SshdSessionFactory.Tuple, Iterable<KeyPair>>
private final Map<SshdSessionFactory.Tuple, ServerKeyDatabase>
private File
private final KeyCache
private static final String
private final ProxyDataFactory
private final Set<SshdSession>
private File

Constructor Summary

AccessConstructor and Description
public
SshdSessionFactory()

Creates a new SshdSessionFactory without key cache and a DefaultProxyDataFactory.

public
SshdSessionFactory(KeyCache
KeyCache to use for caching ssh keys, or null to not use a key cache
keyCache
,
ProxyDataFactory
ProxyDataFactory to use, or null to not use a proxy database (in which case connections through proxies will not be possible)
proxies
)

Creates a new SshdSessionFactory using the given KeyCache and ProxyDataFactory.

Method Summary

Modifier and TypeMethod and Description
public void
close()

Implements java.io.Closeable.close.

Closes this stream and releases any system resources associated with it.

private FilePasswordProvider

Returns:

a new FilePasswordProvider
createFilePasswordProvider
(Supplier<KeyPasswordProvider>
providing the KeyPasswordProvider to delegate to
providerFactory
)

Creates a FilePasswordProvider for a new session.

protected KeyPasswordProvider

Returns:

a new KeyPasswordProvider, or null to use the global KeyPasswordProviderFactory
createKeyPasswordProvider
(CredentialsProvider
the CredentialsProvider to delegate to for user interactions
provider
)

Creates a KeyPasswordProvider for a new session.

protected ServerKeyDatabase

Returns:

the ServerKeyDatabase
createServerKeyDatabase
(File
home directory to use for ~ replacement
homeDir
,
File
representing ~/.ssh/
sshDir
)

Creates a ServerKeyDatabase to verify server host keys.

protected SshConfigStore

Returns:

A SshConfigStore, or null if none is to be used
createSshConfigStore
(File
may be used for ~-replacements by the returned config store
homeDir
,
File
to use, or null if none
configFile
,
String
user name of the current user on the local OS
localUserName
)

Obtains a SshConfigStore, or null if no SSH config is to be used.

protected ConnectorFactory

Returns:

the factory, or null if no SSH agent support is desired
getConnectorFactory
()

Gets a ConnectorFactory.

protected List<Path>

Returns:

a possibly empty list of paths containing default identities (private keys)
getDefaultIdentities
(File
the directory that represents ~/.ssh/
sshDir
)

Gets a list of default identities, i.e., private key files that shall always be tried for public key authentication.

protected Iterable<KeyPair>

Returns:

an Iterable over the default keys
getDefaultKeys
(File
to look in for keys
sshDir
)

Determines the default keys.

protected List<Path>

Returns:

the possibly empty list of default known host file paths.
getDefaultKnownHostsFiles
(File
directory containing ssh configurations
sshDir
)

Gets the list of default user known hosts files.

protected String

Returns:

a comma-separated list of mechanism names, or null if none
getDefaultPreferredAuthentications
()

Gets the list of default preferred authentication mechanisms.

public File

Returns:

the directory, or null if not set
getHomeDirectory
()

Retrieves the global user home directory

private HostConfigEntryResolver

Returns:

the resolver
getHostConfigEntryResolver
(File
home directory to use for ~ replacement
homeDir
,
File
to use for looking for the config file
sshDir
)

Obtain a HostConfigEntryResolver to read the ssh config file and to determine host entries for connections.

protected final KeyCache

Returns:

the KeyCache, or null if none.
getKeyCache
()

Obtains the KeyCache to use to cache loaded keys.

protected ServerKeyDatabase

Returns:

the ServerKeyDatabase
getServerKeyDatabase
(File
home directory to use for ~ replacement
homeDir
,
File
representing ~/.ssh/
sshDir
)

Obtains a ServerKeyDatabase to verify server host keys.

public SshdSession
getSession(URIish
URI of the remote host to connect to
uri
,
CredentialsProvider
provider to support authentication, may be null if no user input for authentication is needed
credentialsProvider
,
FS
the file system abstraction to use for certain file operations, such as reading configuration files
fs
,
int
connection timeout for creating the session, in milliseconds
tms
)

Implements abstract org.eclipse.jgit.transport.SshSessionFactory.getSession.

Opens (or reuses) a session to a host.

private static List<NamedFactory<Signature>>

Returns:

a list of supported signature factories
getSignatureFactories
()

Apache MINA sshd 2.6.0 has removed DSA, DSA_CERT and RSA_CERT.

protected File

Returns:

the file (need not exist), or null if no config file shall be used
getSshConfig
(File
representing ~/.ssh/
sshDir
)

Determines the ssh config file.

public File

Returns:

the directory, or null if not set
getSshDirectory
()

Retrieves the global .ssh directory

public String
getType()

Implements abstract org.eclipse.jgit.transport.SshSessionFactory.getType.

The name of the type of session factory.

private List<UserAuthFactory>

Returns:

the non-empty list of factories.
getUserAuthFactories
()

Gets the user authentication mechanisms (or rather, factories for them).

private Supplier<KeyPasswordProvider>
private void
register(SshdSession newSession)

public void
setHomeDirectory(File
to use
homeDir
)

Set a global directory to use as the user's home directory

public void
setSshDirectory(File
to use
sshDir
)

Set a global directory to use as the .ssh directory

private KeyIdentityProvider

Returns:

a KeyIdentityProvider that provides the given keys
toKeyIdentityProvider
(Iterable<KeyPair>
to provide via the returned KeyIdentityProvider
keys
)

Converts an Iterable of {link KeyPair}s into a KeyIdentityProvider.

private void
unregister(SshdSession oldSession)

Inherited from org.eclipse.jgit.transport.SshSessionFactory:
getInstancegetLocalUserNamereleaseSessionsetInstance

Field Detail

closingback to summary
private final AtomicBoolean closing
defaultHostConfigEntryResolverback to summary
private final Map<SshdSessionFactory.Tuple, HostConfigEntryResolver> defaultHostConfigEntryResolver
defaultKeysback to summary
private final Map<SshdSessionFactory.Tuple, Iterable<KeyPair>> defaultKeys
defaultServerKeyDatabaseback to summary
private final Map<SshdSessionFactory.Tuple, ServerKeyDatabase> defaultServerKeyDatabase
homeDirectoryback to summary
private File homeDirectory
keyCacheback to summary
private final KeyCache keyCache
MINA_SSHDback to summary
private static final String MINA_SSHD
proxiesback to summary
private final ProxyDataFactory proxies
sessionsback to summary
private final Set<SshdSession> sessions
sshDirectoryback to summary
private File sshDirectory

Constructor Detail

SshdSessionFactoryback to summary
public SshdSessionFactory()

Creates a new SshdSessionFactory without key cache and a DefaultProxyDataFactory.

SshdSessionFactoryback to summary
public SshdSessionFactory(KeyCache keyCache, ProxyDataFactory proxies)

Creates a new SshdSessionFactory using the given KeyCache and ProxyDataFactory. The keyCache is used for all sessions created through this session factory; cached keys are destroyed when the session factory is closed.

Caching ssh keys in memory for an extended period of time is generally considered bad practice, but there may be circumstances where using a KeyCache is still the right choice, for instance to avoid that a user gets prompted several times for the same password for the same key. In general, however, it is preferable not to use a key cache but to use a KeyPasswordProvider that has access to some secure storage and can save and retrieve passwords from there without user interaction. Another approach is to use an SSH agent.

Note that the underlying ssh library (Apache MINA sshd) may or may not keep ssh keys in memory for unspecified periods of time irrespective of the use of a KeyCache.

By default, the factory uses the java.util.ServiceLoader to find a ConnectorFactory for creating a Connector to connect to a running SSH agent. If it finds one, the SSH agent is used in publickey authentication. If there is none, no SSH agent will ever be contacted. Note that one can define IdentitiesOnly yes for a host entry in the ~/.ssh/config file to bypass the SSH agent in any case.

Parameters
keyCache:KeyCache

KeyCache to use for caching ssh keys, or null to not use a key cache

proxies:ProxyDataFactory

ProxyDataFactory to use, or null to not use a proxy database (in which case connections through proxies will not be possible)

Method Detail

closeback to summary
public void close()

Implements java.io.Closeable.close.

Doc from java.io.Closeable.close.

Closes this stream and releases any system resources associated with it. If the stream is already closed then invoking this method has no effect.

As noted in AutoCloseable#close(), cases where the close may fail require careful attention. It is strongly advised to relinquish the underlying resources and to internally mark the Closeable as closed, prior to throwing the IOException.

Annotations
@Override
createFilePasswordProviderback to summary
private FilePasswordProvider createFilePasswordProvider(Supplier<KeyPasswordProvider> providerFactory)

Creates a FilePasswordProvider for a new session.

Parameters
providerFactory:Supplier<KeyPasswordProvider>

providing the KeyPasswordProvider to delegate to

Returns:FilePasswordProvider

a new FilePasswordProvider

Annotations
@NonNull
createKeyPasswordProviderback to summary
protected KeyPasswordProvider createKeyPasswordProvider(CredentialsProvider provider)

Creates a KeyPasswordProvider for a new session.

Parameters
provider:CredentialsProvider

the CredentialsProvider to delegate to for user interactions

Returns:KeyPasswordProvider

a new KeyPasswordProvider, or null to use the global KeyPasswordProviderFactory

createServerKeyDatabaseback to summary
protected ServerKeyDatabase createServerKeyDatabase(File homeDir, File sshDir)

Creates a ServerKeyDatabase to verify server host keys. The default implementation returns a ServerKeyDatabase that recognizes the two openssh standard files ~/.ssh/known_hosts and ~/.ssh/known_hosts2 as well as any files configured via the UserKnownHostsFile option in the ssh config file.

Parameters
homeDir:File

home directory to use for ~ replacement

sshDir:File

representing ~/.ssh/

Returns:ServerKeyDatabase

the ServerKeyDatabase

Annotations
@NonNull
Since
5.8
createSshConfigStoreback to summary
protected SshConfigStore createSshConfigStore(File homeDir, File configFile, String localUserName)

Obtains a SshConfigStore, or null if no SSH config is to be used. The default implementation returns null if configFile == null and otherwise an OpenSSH-compatible store reading host entries from the given file.

Parameters
homeDir:File

may be used for ~-replacements by the returned config store

configFile:File

to use, or null if none

localUserName:String

user name of the current user on the local OS

Returns:SshConfigStore

A SshConfigStore, or null if none is to be used

Since
5.8
getConnectorFactoryback to summary
protected ConnectorFactory getConnectorFactory()

Gets a ConnectorFactory. If this returns null, SSH agents are not supported.

The default implementation uses ConnectorFactory#getDefault()

Returns:ConnectorFactory

the factory, or null if no SSH agent support is desired

Since
6.0
getDefaultIdentitiesback to summary
protected List<Path> getDefaultIdentities(File sshDir)

Gets a list of default identities, i.e., private key files that shall always be tried for public key authentication. Typically those are ~/.ssh/id_dsa, ~/.ssh/id_rsa, and so on. The default implementation returns the files defined in SshConstants#DEFAULT_IDENTITIES.

Parameters
sshDir:File

the directory that represents ~/.ssh/

Returns:List<Path>

a possibly empty list of paths containing default identities (private keys)

Annotations
@NonNull
getDefaultKeysback to summary
protected Iterable<KeyPair> getDefaultKeys(File sshDir)

Determines the default keys. The default implementation will lazy load the default identity files.

Subclasses may override and return an Iterable of whatever keys are appropriate. If the returned iterable lazily loads keys, it should be an instance of AbstractResourceKeyPairProvider so that the session can later pass it the password provider wrapped as a FilePasswordProvider via AbstractResourceKeyPairProvider#setPasswordFinder(FilePasswordProvider) so that encrypted, password-protected keys can be loaded.

The default implementation uses exactly this mechanism; class CachingKeyPairProvider may serve as a model for a customized lazy-loading Iterable implementation

If the Iterable returned has the keys already pre-loaded or otherwise doesn't need to decrypt encrypted keys, it can be any Iterable, for instance a simple List.

Parameters
sshDir:File

to look in for keys

Returns:Iterable<KeyPair>

an Iterable over the default keys

Annotations
@NonNull
Since
5.3
getDefaultKnownHostsFilesback to summary
protected List<Path> getDefaultKnownHostsFiles(File sshDir)

Gets the list of default user known hosts files. The default returns ~/.ssh/known_hosts and ~/.ssh/known_hosts2. The ssh config UserKnownHostsFile overrides this default.

Parameters
sshDir:File

directory containing ssh configurations

Returns:List<Path>

the possibly empty list of default known host file paths.

Annotations
@NonNull
getDefaultPreferredAuthenticationsback to summary
protected String getDefaultPreferredAuthentications()

Gets the list of default preferred authentication mechanisms. If null is returned the openssh default list will be in effect. If the ssh config defines PreferredAuthentications the value from the ssh config takes precedence.

Returns:String

a comma-separated list of mechanism names, or null if none

getHomeDirectoryback to summary
public File getHomeDirectory()

Retrieves the global user home directory

Returns:File

the directory, or null if not set

getHostConfigEntryResolverback to summary
private HostConfigEntryResolver getHostConfigEntryResolver(File homeDir, File sshDir)

Obtain a HostConfigEntryResolver to read the ssh config file and to determine host entries for connections.

Parameters
homeDir:File

home directory to use for ~ replacement

sshDir:File

to use for looking for the config file

Returns:HostConfigEntryResolver

the resolver

Annotations
@NonNull
getKeyCacheback to summary
protected final KeyCache getKeyCache()

Obtains the KeyCache to use to cache loaded keys.

Returns:KeyCache

the KeyCache, or null if none.

getServerKeyDatabaseback to summary
protected ServerKeyDatabase getServerKeyDatabase(File homeDir, File sshDir)

Obtains a ServerKeyDatabase to verify server host keys. The default implementation returns a ServerKeyDatabase that recognizes the two openssh standard files ~/.ssh/known_hosts and ~/.ssh/known_hosts2 as well as any files configured via the UserKnownHostsFile option in the ssh config file.

Parameters
homeDir:File

home directory to use for ~ replacement

sshDir:File

representing ~/.ssh/

Returns:ServerKeyDatabase

the ServerKeyDatabase

Annotations
@NonNull
Since
5.5
getSessionback to summary
public SshdSession getSession(URIish uri, CredentialsProvider credentialsProvider, FS fs, int tms) throws TransportException

Implements abstract org.eclipse.jgit.transport.SshSessionFactory.getSession.

Doc from org.eclipse.jgit.transport.SshSessionFactory.getSession.

Opens (or reuses) a session to a host. The returned session is connected and authenticated and is ready for further use.

Parameters
uri:URIish

URI of the remote host to connect to

credentialsProvider:CredentialsProvider

provider to support authentication, may be null if no user input for authentication is needed

fs:FS

the file system abstraction to use for certain file operations, such as reading configuration files

tms:int

connection timeout for creating the session, in milliseconds

Returns:SshdSession

a connected and authenticated session for communicating with the remote host given by the uri

Annotations
@Override
Exceptions
TransportException:
if the session could not be created
getSignatureFactoriesback to summary
private static List<NamedFactory<Signature>> getSignatureFactories()

Apache MINA sshd 2.6.0 has removed DSA, DSA_CERT and RSA_CERT. We have to set it up explicitly to still allow users to connect with DSA keys.

Returns:List<NamedFactory<Signature>>

a list of supported signature factories

Annotations
@SuppressWarnings:deprecation
getSshConfigback to summary
protected File getSshConfig(File sshDir)

Determines the ssh config file. The default implementation returns ~/.ssh/config. If the file does not exist and is created later it will be picked up. To not use a config file at all, return null.

Parameters
sshDir:File

representing ~/.ssh/

Returns:File

the file (need not exist), or null if no config file shall be used

Since
5.5
getSshDirectoryback to summary
public File getSshDirectory()

Retrieves the global .ssh directory

Returns:File

the directory, or null if not set

getTypeback to summary
public String getType()

Implements abstract org.eclipse.jgit.transport.SshSessionFactory.getType.

Doc from org.eclipse.jgit.transport.SshSessionFactory.getType.

The name of the type of session factory.

Returns:String

the name of the type of session factory.

Annotations
@Override
getUserAuthFactoriesback to summary
private List<UserAuthFactory> getUserAuthFactories()

Gets the user authentication mechanisms (or rather, factories for them). By default this returns gssapi-with-mic, public-key, password, and keyboard-interactive, in that order. The order is only significant if the ssh config does not set PreferredAuthentications; if it is set, the order defined there will be taken.

Returns:List<UserAuthFactory>

the non-empty list of factories.

Annotations
@NonNull
newKeyPasswordProviderback to summary
private Supplier<KeyPasswordProvider> newKeyPasswordProvider(CredentialsProvider credentials)
registerback to summary
private void register(SshdSession newSession) throws IOException
setHomeDirectoryback to summary
public void setHomeDirectory(File homeDir)

Set a global directory to use as the user's home directory

Parameters
homeDir:File

to use

setSshDirectoryback to summary
public void setSshDirectory(File sshDir)

Set a global directory to use as the .ssh directory

Parameters
sshDir:File

to use

toKeyIdentityProviderback to summary
private KeyIdentityProvider toKeyIdentityProvider(Iterable<KeyPair> keys)

Converts an Iterable of {link KeyPair}s into a KeyIdentityProvider.

Parameters
keys:Iterable<KeyPair>

to provide via the returned KeyIdentityProvider

Returns:KeyIdentityProvider

a KeyIdentityProvider that provides the given keys

unregisterback to summary
private void unregister(SshdSession oldSession)
org.eclipse.jgit.transport.sshd back to summary

private final Class SshdSessionFactory.Tuple

extends Object
Class Inheritance

A simple general map key.

Field Summary

Modifier and TypeField and Description
private Object[]

Constructor Summary

AccessConstructor and Description
public
Tuple(Object[] objects)

Method Summary

Modifier and TypeMethod and Description
public boolean
equals(Object
the reference object with which to compare.
obj
)

Overrides java.lang.Object.equals.

Indicates whether some other object is "equal to" this one.

public int
hashCode()

Overrides java.lang.Object.hashCode.

Returns a hash code value for this object.

Inherited from java.lang.Object:
clonefinalizegetClassnotifynotifyAlltoStringwaitwaitwait

Field Detail

objectsback to summary
private Object[] objects

Constructor Detail

Tupleback to summary
public Tuple(Object[] objects)

Method Detail

equalsback to summary
public boolean equals(Object obj)

Overrides java.lang.Object.equals.

Doc from java.lang.Object.equals.

Indicates whether some other object is "equal to" this one.

The equals method implements an equivalence relation on non-null object references:

  • It is reflexive: for any non-null reference value x, x.equals(x) should return true.
  • It is symmetric: for any non-null reference values x and y, x.equals(y) should return true if and only if y.equals(x) returns true.
  • It is transitive: for any non-null reference values x, y, and z, if x.equals(y) returns true and y.equals(z) returns true, then x.equals(z) should return true.
  • It is consistent: for any non-null reference values x and y, multiple invocations of x.equals(y) consistently return true or consistently return false, provided no information used in equals comparisons on the objects is modified.
  • For any non-null reference value x, x.equals(null) should return false.

An equivalence relation partitions the elements it operates on into equivalence classes; all the members of an equivalence class are equal to each other. Members of an equivalence class are substitutable for each other, at least for some purposes.

Parameters
obj:Object

the reference object with which to compare.

Returns:boolean

true if this object is the same as the obj argument; false otherwise.

Annotations
@Override
hashCodeback to summary
public int hashCode()

Overrides java.lang.Object.hashCode.

Doc from java.lang.Object.hashCode.

Returns a hash code value for this object. This method is supported for the benefit of hash tables such as those provided by java.util.HashMap.

The general contract of hashCode is:

  • Whenever it is invoked on the same object more than once during an execution of a Java application, the hashCode method must consistently return the same integer, provided no information used in equals comparisons on the object is modified. This integer need not remain consistent from one execution of an application to another execution of the same application.
  • If two objects are equal according to the equals method, then calling the hashCode method on each of the two objects must produce the same integer result.
  • It is not required that if two objects are unequal according to the equals method, then calling the hashCode method on each of the two objects must produce distinct integer results. However, the programmer should be aware that producing distinct integer results for unequal objects may improve the performance of hash tables.
Returns:int

a hash code value for this object

Annotations
@Override