Add SSHJ backend for OpenKeychain authentication (#995)

* Update sshj to 0.30.0 and improve algorithm order

Updates sshj to 0.30.0, which brings support for rsa-sha2-* key types
and bugfixes related to RSA certificates and Android Keystore backed
keys.

Along the way, this improves the algorithm preferences to be consistent
with the Mozilla Intermediate SSH configuration (as far as possible,
given that most certificate types and some encryption algorithms are
not yet supported).

We also add "ext-info-c" to the kex algorithm proposal to work around
certain kinds of "user agent sniffing" that limits the support of
rsa-sha2-* key types.

* Add SSHJ backend for OpenKeychain authentication

* Address review comments

Co-authored-by: Harsh Shandilya <me@msfjarvis.dev>

2 files changed, 12 insertions, 20 deletions

diff --git a/app/src/main/java/com/zeapo/pwdstore/git/operation/CredentialFinder.kt b/app/src/main/java/com/zeapo/pwdstore/git/operation/CredentialFinder.kt
index 423ceb80..6b6b8ea8 100644
--- a/app/src/main/java/com/zeapo/pwdstore/git/operation/CredentialFinder.kt
+++ b/app/src/main/java/com/zeapo/pwdstore/git/operation/CredentialFinder.kt
@@ -11,7 +11,7 @@ import com.google.android.material.textfield.TextInputEditText
 import com.google.android.material.textfield.TextInputLayout
 import com.zeapo.pwdstore.R
 import com.zeapo.pwdstore.git.config.ConnectionMode
-import com.zeapo.pwdstore.git.config.InteractivePasswordFinder
+import com.zeapo.pwdstore.git.sshj.InteractivePasswordFinder
 import com.zeapo.pwdstore.utils.PreferenceKeys
 import com.zeapo.pwdstore.utils.getEncryptedPrefs
 import com.zeapo.pwdstore.utils.requestInputFocusOnView
diff --git a/app/src/main/java/com/zeapo/pwdstore/git/operation/GitOperation.kt b/app/src/main/java/com/zeapo/pwdstore/git/operation/GitOperation.kt
index 881b8807..ae4674fe 100644
--- a/app/src/main/java/com/zeapo/pwdstore/git/operation/GitOperation.kt
+++ b/app/src/main/java/com/zeapo/pwdstore/git/operation/GitOperation.kt
@@ -8,7 +8,6 @@ import android.content.Intent
 import androidx.annotation.CallSuper
 import androidx.core.content.edit
 import androidx.fragment.app.FragmentActivity
-import androidx.preference.PreferenceManager
 import com.github.ajalt.timberkt.Timber.d
 import com.google.android.material.dialog.MaterialAlertDialogBuilder
 import com.zeapo.pwdstore.R
@@ -16,13 +15,13 @@ import com.zeapo.pwdstore.UserPreference
 import com.zeapo.pwdstore.git.ErrorMessages
 import com.zeapo.pwdstore.git.config.ConnectionMode
 import com.zeapo.pwdstore.git.config.GitSettings
-import com.zeapo.pwdstore.git.config.InteractivePasswordFinder
-import com.zeapo.pwdstore.git.config.SshApiSessionFactory
-import com.zeapo.pwdstore.git.config.SshAuthData
-import com.zeapo.pwdstore.git.config.SshjSessionFactory
+import com.zeapo.pwdstore.git.sshj.InteractivePasswordFinder
+import com.zeapo.pwdstore.git.sshj.SshAuthData
+import com.zeapo.pwdstore.git.sshj.SshjSessionFactory
 import com.zeapo.pwdstore.utils.PasswordRepository
 import com.zeapo.pwdstore.utils.PreferenceKeys
 import com.zeapo.pwdstore.utils.getEncryptedPrefs
+import com.zeapo.pwdstore.utils.sharedPrefs
 import java.io.File
 import net.schmizz.sshj.userauth.password.PasswordFinder
 import org.eclipse.jgit.api.Git
@@ -84,8 +83,9 @@ abstract class GitOperation(gitDir: File, internal val callingActivity: Fragment
         return this
     }
 
-    private fun withOpenKeychainAuthentication(identity: SshApiSessionFactory.ApiIdentity?): GitOperation {
-        SshSessionFactory.setInstance(SshApiSessionFactory(identity))
+    private fun withOpenKeychainAuthentication(activity: FragmentActivity): GitOperation {
+        val sessionFactory = SshjSessionFactory(SshAuthData.OpenKeychain(activity), hostKeyFile)
+        SshSessionFactory.setInstance(sessionFactory)
         this.provider = null
         return this
     }
@@ -116,7 +116,6 @@ abstract class GitOperation(gitDir: File, internal val callingActivity: Fragment
 
     suspend fun executeAfterAuthentication(
         connectionMode: ConnectionMode,
-        identity: SshApiSessionFactory.ApiIdentity?
     ) {
         when (connectionMode) {
             ConnectionMode.SshKey -> if (!sshKeyFile.exists()) {
@@ -137,7 +136,7 @@ abstract class GitOperation(gitDir: File, internal val callingActivity: Fragment
                 withPublicKeyAuthentication(
                     CredentialFinder(callingActivity, connectionMode)).execute()
             }
-            ConnectionMode.OpenKeychain -> withOpenKeychainAuthentication(identity).execute()
+            ConnectionMode.OpenKeychain -> withOpenKeychainAuthentication(callingActivity).execute()
             ConnectionMode.Password -> withPasswordAuthentication(
                 CredentialFinder(callingActivity, connectionMode)).execute()
             ConnectionMode.None -> execute()
@@ -150,17 +149,10 @@ abstract class GitOperation(gitDir: File, internal val callingActivity: Fragment
     @CallSuper
     open fun onError(err: Exception) {
         // Clear various auth related fields on failure
-        when (SshSessionFactory.getInstance()) {
-            is SshApiSessionFactory -> {
-                PreferenceManager.getDefaultSharedPreferences(callingActivity.applicationContext)
-                    .edit { remove(PreferenceKeys.SSH_OPENKEYSTORE_KEYID) }
-            }
-            is SshjSessionFactory -> {
-                callingActivity.getEncryptedPrefs("git_operation").edit {
-                        remove(PreferenceKeys.HTTPS_PASSWORD)
-                    }
-            }
+        callingActivity.getEncryptedPrefs("git_operation").edit {
+            remove(PreferenceKeys.SSH_KEY_LOCAL_PASSPHRASE)
         }
+        callingActivity.sharedPrefs.edit { remove(PreferenceKeys.SSH_OPENKEYSTORE_KEYID) }
         d(err)
         MaterialAlertDialogBuilder(callingActivity)
             .setTitle(callingActivity.resources.getString(R.string.jgit_error_dialog_title))