Skip to content

Merge upstream v2.18.0#11

Closed
GT-610 wants to merge 14 commits into
lollipopkit:masterfrom
TerminalStudio:master
Closed

Merge upstream v2.18.0#11
GT-610 wants to merge 14 commits into
lollipopkit:masterfrom
TerminalStudio:master

Conversation

@GT-610

@GT-610 GT-610 commented Jun 14, 2026

Copy link
Copy Markdown
Collaborator

Summary by CodeRabbit

发布说明

  • Bug Fixes

    • 修复了AES-GCM加解密中序列号重置问题,增强加密层数据包处理的正确性
  • Breaking Changes

    • SSH主机密钥指纹格式从MD5变更为OpenSSH风格SHA256(SHA256:<base64>格式)
  • Tests

    • 新增主机密钥指纹格式验证测试
    • 改进跨平台测试兼容性

@coderabbitai

coderabbitai Bot commented Jun 14, 2026

Copy link
Copy Markdown

Review Change Stack

📝 Walkthrough

Walkthrough

SSH 传输层新增独立 AEAD 包计数器(_localAeadPacketCount/_remoteAeadPacketCount)并在 NEWKEYS 时重置;主机密钥指纹计算从 MD5 改为 OpenSSH 风格 SHA256,同步更新测试与版本号至 2.18.0。

Changes

SSH 传输层安全修复与破坏性契约变更

Layer / File(s) Summary
AEAD 独立计数器字段与重置逻辑
lib/src/ssh_transport.dart
新增 _localAeadPacketCount/_remoteAeadPacketCount 字段;_applyLocalKeys/_applyRemoteKeys 在 NEWKEYS 后将其重置为 0;_sendAeadPacket_consumeAeadPacket_processAeadsequence 参数替换为对应的 AEAD 计数器,与普通 MAC 路径使用的 _localPacketSN/_remotePacketSN 分离。
主机密钥指纹 MD5 → SHA256 替换
lib/src/ssh_transport.dart
新增私有工具函数 _hostkeyFingerprint 生成 SHA256:<base64无填充> 格式指纹;更新 SSHHostkeyVerifyHandler 文档;在 _handleMessageKexInit 主机密钥校验路径中以其替换原 MD5Digest 调用(BREAKING 变更)。
传输层字段与方法文档注释补充
lib/src/ssh_transport.dart
为算法字段、disableHostkeyVerification、握手/加解密/密钥派生/消息分发等方法全面补充文档注释,无逻辑变更。
新增指纹格式与 onVerifyHostKey 集成测试
test/src/ssh_transport_fingerprint_test.dart, test/src/ssh_client_test.dart, test/test_utils.dart
新增 ssh_transport_fingerprint_test.dart 通过 dart:mirrors 反射验证 _hostkeyFingerprint 输出为 SHA256:<base64> 格式;新增两条 onVerifyHostKey 集成用例验证指纹格式及回调返回 false 时的中止行为;放宽现有握手中止测试对 SSHAuthAbortError.reason 的断言;fixture() 新增 \r\n\n 换行归一化。
版本号与 CHANGELOG 更新
pubspec.yaml, CHANGELOG.md
pubspec.yaml 版本从 2.17.1 升至 2.18.0CHANGELOG.md 新增 2.18.0 条目,记录 AES-GCM nonce 修复和 SSHHostkeyVerifyHandler 指纹格式的 BREAKING 变更及 [TerminalStudio#165] 引用链接。

Sequence Diagram(s)

sequenceDiagram
    participant Client as SSHClient
    participant Transport as SSHTransport
    participant Callback as onVerifyHostKey

    Transport->>Transport: _handleMessageKexInit 收到服务器 KEXINIT
    Transport->>Transport: _hostkeyFingerprint(hostkey) → SHA256:<base64>
    Transport->>Callback: fingerprint (UTF-8 Uint8List, SHA256 格式)
    alt 回调返回 true
        Callback-->>Transport: true
        Transport->>Transport: 继续握手,应用 _applyLocalKeys/_applyRemoteKeys
        Transport->>Transport: _localAeadPacketCount = 0 / _remoteAeadPacketCount = 0
    else 回调返回 false
        Callback-->>Transport: false
        Transport->>Client: 抛出主机密钥验证错误(SSHAuthAbortError)
    end
Loading

Possibly related PRs

  • lollipopkit/dartssh2#7:同样修改 lib/src/ssh_transport.dart_applyLocalKeys/_applyRemoteKeys 的 AEAD 密码状态清理逻辑,与本 PR 引入的 AEAD 包计数器重置属同一代码路径上的相关改动。
✨ Finishing Touches
⚔️ Resolve merge conflicts
  • Resolve merge conflict in branch master

Comment @coderabbitai help to get the list of available commands and usage tips.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@CHANGELOG.md`:
- Line 3: The CHANGELOG.md file contains a new reference `[`#162`]` on line 3 but
is missing the corresponding link definition in the reference section at the end
of the file. Add the missing markdown reference link definition for `[`#162`]` in
the references section of the CHANGELOG.md file, pointing to the appropriate
GitHub issue URL (following the same pattern as other reference definitions
already present in the file).
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 3f8e1c4a-dc75-442c-b495-159b22db7fd1

📥 Commits

Reviewing files that changed from the base of the PR and between b464a13 and 8a19446.

📒 Files selected for processing (6)
  • CHANGELOG.md
  • lib/src/ssh_transport.dart
  • pubspec.yaml
  • test/src/ssh_client_test.dart
  • test/src/ssh_transport_fingerprint_test.dart
  • test/test_utils.dart
📜 Review details
🔇 Additional comments (6)
test/src/ssh_transport_fingerprint_test.dart (1)

9-29: LGTM!

test/src/ssh_client_test.dart (1)

19-67: LGTM!

Also applies to: 195-196

test/test_utils.dart (1)

46-48: LGTM!

pubspec.yaml (1)

2-2: LGTM!

lib/src/ssh_transport.dart (2)

34-45: LGTM!

Also applies to: 1267-1277


217-231: LGTM!

Also applies to: 366-390, 723-751, 838-856, 876-894

Comment thread CHANGELOG.md
@@ -1,3 +1,7 @@
## [2.18.0] - 2026-05-18
- Fixed AES-GCM cipher encryption and decryption sequence number/nonce counter resetting during key exchanges [#165]. Thanks [@vicajilau].
- **BREAKING**: `SSHHostkeyVerifyHandler` now receives an OpenSSH-style `SHA256:<base64>` host key fingerprint instead of the previous raw MD5 digest, so host key pinning code must be updated accordingly [#162]. Thanks [@thyssentishman].

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

补上 [TerminalStudio#162] 的引用定义。

第 3 行新增了 [TerminalStudio#162],但文件末尾没有对应的链接定义,Markdown 会显示为失效链接。请在引用区补一条 [TerminalStudio#162]: ...

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@CHANGELOG.md` at line 3, The CHANGELOG.md file contains a new reference
`[`#162`]` on line 3 but is missing the corresponding link definition in the
reference section at the end of the file. Add the missing markdown reference
link definition for `[`#162`]` in the references section of the CHANGELOG.md file,
pointing to the appropriate GitHub issue URL (following the same pattern as
other reference definitions already present in the file).

@GT-610 GT-610 closed this Jun 15, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants