fix(ec2): give warning when OpenSSH client is outdated.

packages/core/src/shared/extensions/ssh.ts

@@ -6,6 +6,7 @@
 import * as vscode from 'vscode'
 import * as path from 'path'
 import * as nls from 'vscode-nls'
+import * as semver from 'semver'
 import fs from '../fs/fs'
 import { getLogger } from '../logger'
 import { ChildProcess } from '../utilities/processUtils'
@@ -148,3 +149,35 @@ export async function startVscodeRemote(
 
     await new ProcessClass(vscPath, ['--folder-uri', workspaceUri]).run()
 }
+/**
+ * Uses provided sshPath to get version of OpenSSH. If sshPath is not OpenSSH, returns undefined.
+ * @param sshPath
+ * @returns
+ */
+export async function getSshVersion(sshPath: string): Promise<string | undefined> {
+    const result = await new ChildProcess(sshPath, ['-V'], { collect: true }).run()
+
+    return parseSshVersion(result.stdout === '' ? result.stderr : result.stdout)
+}
+
+export async function ensureSshVersionGte(sshPath: string, minVersion: string): Promise<void | never> {
+    const sshVersion = await getSshVersion(sshPath)
+    if (sshVersion && semver.lt(sshVersion, minVersion)) {
+        const msg = `SSH version ${sshVersion} is not supported, please upgrade OpenSSH to ${minVersion} or higher`
+        getLogger().error(msg)
+        throw new Error(msg)
+    }
+}
+
+function parseSshVersion(output: string): string | undefined {
+    const match = output.match(/OpenSSH_(\d+)\.(\d+)/)
+    if (!match) {
+        getLogger().warn(`ssh: failed to parse SSH version: ${output}`)
+        return undefined
+    }
+
+    const major = parseInt(match[1], 10)
+    const minor = parseInt(match[2], 10)
+
+    return `${major}.${minor}.0`
+}

packages/core/src/shared/remoteSession.ts

@@ -22,6 +22,7 @@ import { findSshPath, getVscodeCliPath } from './utilities/pathFind'
 import { IamClient } from './clients/iamClient'
 import { IAM } from 'aws-sdk'
 import { getIdeProperties } from './extensionUtilities'
+import { ensureSshVersionGte } from './extensions/ssh'
 
 const policyAttachDelay = 5000
 
@@ -99,6 +100,16 @@ export async function ensureDependencies(): Promise<Result<DependencyPaths, Canc
         return await handleMissingTool(tools)
     }
 
+    if (tools.isOk()) {
+        const sshPath = tools.unwrap().ssh
+        // Pre 7.6 does not support accept-new as StrictHostKeyChecking
+        try {
+            await ensureSshVersionGte(sshPath, '7.6.0')
+        } catch (e) {
+            return Result.err(e as Error)
+        }
+    }
+
     return tools
 }
 

packages/core/src/test/shared/extensions/ssh.test.ts

@@ -4,7 +4,12 @@
  */
 import * as assert from 'assert'
 import { ChildProcess } from '../../../shared/utilities/processUtils'
-import { startSshAgent } from '../../../shared/extensions/ssh'
+import { ensureSshVersionGte, getSshVersion, startSshAgent } from '../../../shared/extensions/ssh'
+import { createExecutableFile, createTestWorkspaceFolder } from '../../testUtil'
+import { isWin } from '../../../shared/vscode/env'
+import path from 'path'
+import { fs } from '../../../shared'
+import { WorkspaceFolder } from 'vscode'
 
 describe('SSH Agent', function () {
     it('can start the agent on windows', async function () {
@@ -29,3 +34,36 @@ describe('SSH Agent', function () {
         assert.strictEqual(await getStatus(), 'Running')
     })
 })
+
+describe('SSH Versioning', function () {
+    let tempDir: WorkspaceFolder
+
+    before(async function () {
+        tempDir = await createTestWorkspaceFolder()
+    })
+
+    after(async function () {
+        await fs.delete(tempDir.uri.fsPath, { force: true, recursive: true })
+    })
+
+    it('gets ssh version from path', async function () {
+        const testSshVersion = async (sshName: string, sshOutput: string, expectedVersion: string) => {
+            const sshPath = path.join(tempDir.uri.fsPath, `${sshName}${isWin() ? '.cmd' : ''}`)
+            await createExecutableFile(sshPath, `echo "${sshOutput}"`)
+            const version = await getSshVersion(sshPath)
+            assert.strictEqual(version, expectedVersion)
+        }
+
+        await testSshVersion('ssh', 'OpenSSH_9.7p1, LibreSSL 3.3.6', '9.7.0')
+        await testSshVersion('ssh2', 'OpenSSH_6.6.1p1, OpenSSL 1.0.1e-fips 11 Feb 2013', '6.6.0')
+        await testSshVersion('ssh3', 'OpenSSH_7.4p1, OpenSSL 1.0.1e-fips 11 Feb 2013', '7.4.0')
+    })
+
+    it('asserts version is above threshold', async function () {
+        const sshPath = path.join(tempDir.uri.fsPath, `ssh3${isWin() ? '.cmd' : ''}`)
+        await createExecutableFile(sshPath, `echo "'OpenSSH_9.7p1, LibreSSL 3.3.6'"`)
+        await assert.rejects(async () => await ensureSshVersionGte(sshPath, '9.10'))
+        await assert.doesNotReject(async () => await ensureSshVersionGte(sshPath, '9.7.0'))
+        await assert.doesNotReject(async () => await ensureSshVersionGte(sshPath, '9.2.0'))
+    })
+})

packages/toolkit/.changes/next-release/Bug Fix-eb585326-75f2-40f3-9ef2-781a885b2e28.json

@@ -0,0 +1,4 @@
+{
+	"type": "Bug Fix",
+	"description": "ec2/codecatalyst remote connect: warn user when OpenSSH client is outdated"
+}