net-ssh-backports 6.3.0.backports

data/lib/net/ssh/transport/kex/abstract5656.rb

@@ -0,0 +1,72 @@
+require 'net/ssh/transport/kex/abstract'
+
+module Net
+  module SSH
+    module Transport
+      module Kex
+        # Implement key-exchange algorithm from Elliptic Curve Algorithm Integration
+        # in the Secure Shell Transport Layer (RFC 5656)
+        class Abstract5656 < Abstract
+          alias ecdh dh
+
+          def curve_name
+            raise NotImplementedError, 'abstract class: curve_name not implemented'
+          end
+
+          private
+
+          def get_message_types
+            [KEXECDH_INIT, KEXECDH_REPLY]
+          end
+
+          def build_signature_buffer(result)
+            response = Net::SSH::Buffer.new
+            response.write_string data[:client_version_string],
+                                  data[:server_version_string],
+                                  data[:client_algorithm_packet],
+                                  data[:server_algorithm_packet],
+                                  result[:key_blob],
+                                  ecdh_public_key_bytes,
+                                  result[:server_ecdh_pubkey]
+            response.write_bignum result[:shared_secret]
+            response
+          end
+
+          def send_kexinit #:nodoc:
+            init, reply = get_message_types
+
+            # send the KEXECDH_INIT message
+            ## byte     SSH_MSG_KEX_ECDH_INIT
+            ## string   Q_C, client's ephemeral public key octet string
+            buffer = Net::SSH::Buffer.from(:byte, init, :mstring, ecdh_public_key_bytes)
+            connection.send_message(buffer)
+
+            # expect the following KEXECDH_REPLY message
+            ## byte     SSH_MSG_KEX_ECDH_REPLY
+            ## string   K_S, server's public host key
+            ## string   Q_S, server's ephemeral public key octet string
+            ## string   the signature on the exchange hash
+            buffer = connection.next_message
+            raise Net::SSH::Exception, 'expected REPLY' unless buffer.type == reply
+
+            result = {}
+            result[:key_blob] = buffer.read_string
+            result[:server_key] = Net::SSH::Buffer.new(result[:key_blob]).read_key
+            result[:server_ecdh_pubkey] = buffer.read_string
+            result[:shared_secret] = compute_shared_secret(result[:server_ecdh_pubkey])
+
+            sig_buffer = Net::SSH::Buffer.new(buffer.read_string)
+            sig_type = sig_buffer.read_string
+            if sig_type != algorithms.host_key_format
+              raise Net::SSH::Exception, "host key algorithm mismatch for signature '#{sig_type}' != '#{algorithms.host_key_format}'"
+            end
+
+            result[:server_sig] = sig_buffer.read_string
+
+            result
+          end
+        end
+      end
+    end
+  end
+end

data/lib/net/ssh/transport/kex/curve25519_sha256.rb

@@ -0,0 +1,39 @@
+gem 'x25519' # raise if the gem x25519 is not installed
+
+require 'x25519'
+
+require 'net/ssh/transport/constants'
+require 'net/ssh/transport/kex/abstract5656'
+
+module Net
+  module SSH
+    module Transport
+      module Kex
+        # A key-exchange service implementing the "curve25519-sha256@libssh.org"
+        # key-exchange algorithm. (defined in https://tools.ietf.org/html/draft-ietf-curdle-ssh-curves-06)
+        class Curve25519Sha256 < Abstract5656
+          def digester
+            OpenSSL::Digest::SHA256
+          end
+
+          private
+
+          def generate_key #:nodoc:
+            ::X25519::Scalar.generate
+          end
+
+          ## string   Q_C, client's ephemeral public key octet string
+          def ecdh_public_key_bytes
+            ecdh.public_key.to_bytes
+          end
+
+          # compute shared secret from server's public key and client's private key
+          def compute_shared_secret(server_ecdh_pubkey)
+            pk = ::X25519::MontgomeryU.new(server_ecdh_pubkey)
+            OpenSSL::BN.new(ecdh.diffie_hellman(pk).to_bytes, 2)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/net/ssh/transport/kex/curve25519_sha256_loader.rb

@@ -0,0 +1,30 @@
+module Net
+  module SSH
+    module Transport
+      module Kex
+        # Loads Curve25519Sha256 support which requires optinal dependencies
+        module Curve25519Sha256Loader
+          begin
+            require 'net/ssh/transport/kex/curve25519_sha256'
+            LOADED = true
+            ERROR = nil
+          rescue LoadError => e
+            ERROR = e
+            LOADED = false
+          end
+
+          def self.raiseUnlessLoaded(message)
+            description = ERROR.is_a?(LoadError) ? dependenciesRequiredForX25519 : ''
+            description << "#{ERROR.class} : \"#{ERROR.message}\"\n" if ERROR
+            raise NotImplementedError, "#{message}\n#{description}" unless LOADED
+          end
+
+          def self.dependenciesRequiredForX25519
+            result = "net-ssh requires the following gems for x25519 support:\n"
+            result << " * x25519\n"
+          end
+        end
+      end
+    end
+  end
+end

data/lib/net/ssh/transport/kex/diffie_hellman_group14_sha1.rb

@@ -0,0 +1,37 @@
+require 'net/ssh/transport/kex/diffie_hellman_group1_sha1'
+
+module Net
+  module SSH
+    module Transport
+      module Kex
+        # A key-exchange service implementing the "diffie-hellman-group14-sha1"
+        # key-exchange algorithm. (defined in RFC 4253)
+        class DiffieHellmanGroup14SHA1 < DiffieHellmanGroup1SHA1
+          # The value of 'P', as a string, in hexadecimal
+          P_s = "FFFFFFFF" "FFFFFFFF" "C90FDAA2" "2168C234" +
+                "C4C6628B" "80DC1CD1" "29024E08" "8A67CC74" +
+                "020BBEA6" "3B139B22" "514A0879" "8E3404DD" +
+                "EF9519B3" "CD3A431B" "302B0A6D" "F25F1437" +
+                "4FE1356D" "6D51C245" "E485B576" "625E7EC6" +
+                "F44C42E9" "A637ED6B" "0BFF5CB6" "F406B7ED" +
+                "EE386BFB" "5A899FA5" "AE9F2411" "7C4B1FE6" +
+                "49286651" "ECE45B3D" "C2007CB8" "A163BF05" +
+                "98DA4836" "1C55D39A" "69163FA8" "FD24CF5F" +
+                "83655D23" "DCA3AD96" "1C62F356" "208552BB" +
+                "9ED52907" "7096966D" "670C354E" "4ABC9804" +
+                "F1746C08" "CA18217C" "32905E46" "2E36CE3B" +
+                "E39E772C" "180E8603" "9B2783A2" "EC07A28F" +
+                "B5C55DF0" "6F4C52C9" "DE2BCBF6" "95581718" +
+                "3995497C" "EA956AE5" "15D22618" "98FA0510" +
+                "15728E5A" "8AACAA68" "FFFFFFFF" "FFFFFFFF"
+
+          # The radix in which P_s represents the value of P
+          P_r = 16
+
+          # The group constant
+          G = 2
+        end
+      end
+    end
+  end
+end

data/lib/net/ssh/transport/kex/diffie_hellman_group14_sha256.rb

@@ -0,0 +1,11 @@
+require 'net/ssh/transport/kex/diffie_hellman_group14_sha1'
+
+module Net::SSH::Transport::Kex
+  # A key-exchange service implementing the "diffie-hellman-group14-sha256"
+  # key-exchange algorithm.
+  class DiffieHellmanGroup14SHA256 < DiffieHellmanGroup14SHA1
+    def digester
+      OpenSSL::Digest::SHA256
+    end
+  end
+end

data/lib/net/ssh/transport/kex/diffie_hellman_group1_sha1.rb

@@ -0,0 +1,122 @@
+require 'net/ssh/transport/kex/abstract'
+
+module Net
+  module SSH
+    module Transport
+      module Kex
+        # A key-exchange service implementing the "diffie-hellman-group1-sha1"
+        # key-exchange algorithm.
+        class DiffieHellmanGroup1SHA1 < Abstract
+          # The value of 'P', as a string, in hexadecimal
+          P_s = "FFFFFFFF" "FFFFFFFF" "C90FDAA2" "2168C234" +
+                "C4C6628B" "80DC1CD1" "29024E08" "8A67CC74" +
+                "020BBEA6" "3B139B22" "514A0879" "8E3404DD" +
+                "EF9519B3" "CD3A431B" "302B0A6D" "F25F1437" +
+                "4FE1356D" "6D51C245" "E485B576" "625E7EC6" +
+                "F44C42E9" "A637ED6B" "0BFF5CB6" "F406B7ED" +
+                "EE386BFB" "5A899FA5" "AE9F2411" "7C4B1FE6" +
+                "49286651" "ECE65381" "FFFFFFFF" "FFFFFFFF"
+
+          # The radix in which P_s represents the value of P
+          P_r = 16
+
+          # The group constant
+          G = 2
+
+          def digester
+            OpenSSL::Digest::SHA1
+          end
+
+          private
+
+          # Returns the DH key parameters for the current connection. [p, q]
+          def get_parameters
+            [
+              OpenSSL::BN.new(self.class::P_s, self.class::P_r),
+              self.class::G
+            ]
+          end
+
+          # Returns the INIT/REPLY constants used by this algorithm.
+          def get_message_types
+            [KEXDH_INIT, KEXDH_REPLY]
+          end
+
+          # Build the signature buffer to use when verifying a signature from
+          # the server.
+          def build_signature_buffer(result)
+            response = Net::SSH::Buffer.new
+            response.write_string data[:client_version_string],
+                                  data[:server_version_string],
+                                  data[:client_algorithm_packet],
+                                  data[:server_algorithm_packet],
+                                  result[:key_blob]
+            response.write_bignum dh.pub_key,
+                                  result[:server_dh_pubkey],
+                                  result[:shared_secret]
+            response
+          end
+
+          # Generate a DH key with a private key consisting of the given
+          # number of bytes.
+          def generate_key #:nodoc:
+            dh = OpenSSL::PKey::DH.new
+
+            if dh.respond_to?(:set_pqg)
+              p, g = get_parameters
+              dh.set_pqg(p, nil, g)
+            else
+              dh.p, dh.g = get_parameters
+            end
+
+            dh.generate_key!
+            until dh.valid? && dh.priv_key.num_bytes == data[:need_bytes]
+              if dh.respond_to?(:set_key)
+                dh.set_key(nil, OpenSSL::BN.rand(data[:need_bytes] * 8))
+              else
+                dh.priv_key = OpenSSL::BN.rand(data[:need_bytes] * 8)
+              end
+              dh.generate_key!
+            end
+            dh
+          end
+
+          # Send the KEXDH_INIT message, and expect the KEXDH_REPLY. Return the
+          # resulting buffer.
+          #
+          # Parse the buffer from a KEXDH_REPLY message, returning a hash of
+          # the extracted values.
+          def send_kexinit #:nodoc:
+            init, reply = get_message_types
+
+            # send the KEXDH_INIT message
+            buffer = Net::SSH::Buffer.from(:byte, init, :bignum, dh.pub_key)
+            connection.send_message(buffer)
+
+            # expect the KEXDH_REPLY message
+            buffer = connection.next_message
+            raise Net::SSH::Exception, "expected REPLY" unless buffer.type == reply
+
+            result = Hash.new
+
+            result[:key_blob] = buffer.read_string
+            result[:server_key] = Net::SSH::Buffer.new(result[:key_blob]).read_key
+            result[:server_dh_pubkey] = buffer.read_bignum
+            result[:shared_secret] = OpenSSL::BN.new(dh.compute_key(result[:server_dh_pubkey]), 2)
+
+            sig_buffer = Net::SSH::Buffer.new(buffer.read_string)
+            sig_type = sig_buffer.read_string
+            if sig_type != algorithms.host_key_format
+              raise Net::SSH::Exception,
+                "host key algorithm mismatch for signature " +
+                "'#{sig_type}' != '#{algorithms.host_key_format}'"
+            end
+            result[:server_sig] = sig_buffer.read_string
+
+            return result
+          end
+        end
+      end
+    end
+  end
+end

data/lib/net/ssh/transport/kex/diffie_hellman_group_exchange_sha1.rb

@@ -0,0 +1,72 @@
+require 'net/ssh/errors'
+require 'net/ssh/transport/constants'
+require 'net/ssh/transport/kex/diffie_hellman_group1_sha1'
+
+module Net::SSH::Transport::Kex
+  # A key-exchange service implementing the
+  # "diffie-hellman-group-exchange-sha1" key-exchange algorithm.
+  class DiffieHellmanGroupExchangeSHA1 < DiffieHellmanGroup1SHA1
+    MINIMUM_BITS      = 1024
+    MAXIMUM_BITS      = 8192
+
+    private
+
+    # Compute the number of bits needed for the given number of bytes.
+    def compute_need_bits
+      # for Compatibility: OpenSSH requires (need_bits * 2 + 1) length of parameter
+      need_bits = data[:need_bytes] * 8 * 2 + 1
+
+      data[:minimum_dh_bits] ||= MINIMUM_BITS
+
+      if need_bits < data[:minimum_dh_bits]
+        need_bits = data[:minimum_dh_bits]
+      elsif need_bits > MAXIMUM_BITS
+        need_bits = MAXIMUM_BITS
+      end
+
+      data[:need_bits] = need_bits
+      data[:need_bytes] = need_bits / 8
+    end
+
+    # Returns the DH key parameters for the given session.
+    def get_parameters
+      compute_need_bits
+
+      # request the DH key parameters for the given number of bits.
+      buffer = Net::SSH::Buffer.from(:byte, KEXDH_GEX_REQUEST, :long, data[:minimum_dh_bits],
+        :long, data[:need_bits], :long, MAXIMUM_BITS)
+      connection.send_message(buffer)
+
+      buffer = connection.next_message
+      raise Net::SSH::Exception, "expected KEXDH_GEX_GROUP, got #{buffer.type}" unless buffer.type == KEXDH_GEX_GROUP
+
+      p = buffer.read_bignum
+      g = buffer.read_bignum
+
+      [p, g]
+    end
+
+    # Returns the INIT/REPLY constants used by this algorithm.
+    def get_message_types
+      [KEXDH_GEX_INIT, KEXDH_GEX_REPLY]
+    end
+
+    # Build the signature buffer to use when verifying a signature from
+    # the server.
+    def build_signature_buffer(result)
+      response = Net::SSH::Buffer.new
+      response.write_string data[:client_version_string],
+                            data[:server_version_string],
+                            data[:client_algorithm_packet],
+                            data[:server_algorithm_packet],
+                            result[:key_blob]
+      response.write_long MINIMUM_BITS,
+                          data[:need_bits],
+                          MAXIMUM_BITS
+      response.write_bignum dh.p, dh.g, dh.pub_key,
+                            result[:server_dh_pubkey],
+                            result[:shared_secret]
+      response
+    end
+  end
+end

data/lib/net/ssh/transport/kex/diffie_hellman_group_exchange_sha256.rb

@@ -0,0 +1,11 @@
+require 'net/ssh/transport/kex/diffie_hellman_group_exchange_sha1'
+
+module Net::SSH::Transport::Kex
+  # A key-exchange service implementing the
+  # "diffie-hellman-group-exchange-sha256" key-exchange algorithm.
+  class DiffieHellmanGroupExchangeSHA256 < DiffieHellmanGroupExchangeSHA1
+    def digester
+      OpenSSL::Digest::SHA256
+    end
+  end
+end

data/lib/net/ssh/transport/kex/ecdh_sha2_nistp256.rb

@@ -0,0 +1,39 @@
+require 'net/ssh/transport/kex/abstract5656'
+
+module Net
+  module SSH
+    module Transport
+      module Kex
+        # A key-exchange service implementing the "ecdh-sha2-nistp256"
+        # key-exchange algorithm. (defined in RFC 5656)
+        class EcdhSHA2NistP256 < Abstract5656
+          def digester
+            OpenSSL::Digest::SHA256
+          end
+
+          def curve_name
+            OpenSSL::PKey::EC::CurveNameAlias['nistp256']
+          end
+
+          private
+
+          def generate_key #:nodoc:
+            OpenSSL::PKey::EC.new(curve_name).generate_key
+          end
+
+          # compute shared secret from server's public key and client's private key
+          def compute_shared_secret(server_ecdh_pubkey)
+            pk = OpenSSL::PKey::EC::Point.new(OpenSSL::PKey::EC.new(curve_name).group,
+                                              OpenSSL::BN.new(server_ecdh_pubkey, 2))
+            OpenSSL::BN.new(ecdh.dh_compute_key(pk), 2)
+          end
+
+          ## string   Q_C, client's ephemeral public key octet string
+          def ecdh_public_key_bytes
+            ecdh.public_key.to_bn.to_s(2)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/net/ssh/transport/kex/ecdh_sha2_nistp384.rb

@@ -0,0 +1,21 @@
+require 'net/ssh/transport/kex/ecdh_sha2_nistp256'
+
+module Net
+  module SSH
+    module Transport
+      module Kex
+        # A key-exchange service implementing the "ecdh-sha2-nistp256"
+        # key-exchange algorithm. (defined in RFC 5656)
+        class EcdhSHA2NistP384 < EcdhSHA2NistP256
+          def digester
+            OpenSSL::Digest::SHA384
+          end
+
+          def curve_name
+            OpenSSL::PKey::EC::CurveNameAlias['nistp384']
+          end
+        end
+      end
+    end
+  end
+end

data/lib/net/ssh/transport/kex/ecdh_sha2_nistp521.rb

@@ -0,0 +1,21 @@
+require 'net/ssh/transport/kex/ecdh_sha2_nistp256'
+
+module Net
+  module SSH
+    module Transport
+      module Kex
+        # A key-exchange service implementing the "ecdh-sha2-nistp521"
+        # key-exchange algorithm. (defined in RFC 5656)
+        class EcdhSHA2NistP521 < EcdhSHA2NistP256
+          def digester
+            OpenSSL::Digest::SHA512
+          end
+
+          def curve_name
+            OpenSSL::PKey::EC::CurveNameAlias['nistp521']
+          end
+        end
+      end
+    end
+  end
+end

data/lib/net/ssh/transport/kex.rb

@@ -0,0 +1,31 @@
+require 'net/ssh/transport/kex/diffie_hellman_group1_sha1'
+require 'net/ssh/transport/kex/diffie_hellman_group14_sha1'
+require 'net/ssh/transport/kex/diffie_hellman_group14_sha256'
+require 'net/ssh/transport/kex/diffie_hellman_group_exchange_sha1'
+require 'net/ssh/transport/kex/diffie_hellman_group_exchange_sha256'
+require 'net/ssh/transport/kex/ecdh_sha2_nistp256'
+require 'net/ssh/transport/kex/ecdh_sha2_nistp384'
+require 'net/ssh/transport/kex/ecdh_sha2_nistp521'
+require 'net/ssh/transport/kex/curve25519_sha256_loader'
+
+module Net::SSH::Transport
+  module Kex
+    # Maps the supported key-exchange algorithms as named by the SSH protocol
+    # to their corresponding implementors.
+    MAP = {
+      'diffie-hellman-group1-sha1'           => DiffieHellmanGroup1SHA1,
+      'diffie-hellman-group14-sha1'          => DiffieHellmanGroup14SHA1,
+      'diffie-hellman-group14-sha256'        => DiffieHellmanGroup14SHA256,
+      'diffie-hellman-group-exchange-sha1'   => DiffieHellmanGroupExchangeSHA1,
+      'diffie-hellman-group-exchange-sha256' => DiffieHellmanGroupExchangeSHA256,
+      'ecdh-sha2-nistp256'                   => EcdhSHA2NistP256,
+      'ecdh-sha2-nistp384'                   => EcdhSHA2NistP384,
+      'ecdh-sha2-nistp521'                   => EcdhSHA2NistP521
+    }
+
+    if Net::SSH::Transport::Kex::Curve25519Sha256Loader::LOADED
+      MAP['curve25519-sha256'] = Curve25519Sha256
+      MAP['curve25519-sha256@libssh.org'] = Curve25519Sha256
+    end
+  end
+end

data/lib/net/ssh/transport/key_expander.rb

@@ -0,0 +1,30 @@
+module Net
+  module SSH
+    module Transport
+      module KeyExpander
+        # Generate a key value in accordance with the SSH2 specification.
+        # (RFC4253 7.2. "Output from Key Exchange")
+        def self.expand_key(bytes, start, options={})
+          if bytes == 0
+            return ""
+          end
+
+          k = start[0, bytes]
+          return k if k.length >= bytes
+
+          digester = options[:digester] or raise 'No digester supplied'
+          shared   = options[:shared] or raise 'No shared secret supplied'
+          hash     = options[:hash] or raise 'No hash supplied'
+
+          while k.length < bytes
+            step = digester.digest(shared + hash + k)
+            bytes_needed = bytes - k.length
+            k << step[0, bytes_needed]
+          end
+
+          return k
+        end
+      end
+    end
+  end
+end