net-ssh-clone 7.0.1
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +7 -0
- data/.dockerignore +6 -0
- data/.github/config/rubocop_linter_action.yml +4 -0
- data/.github/workflows/ci-with-docker.yml +44 -0
- data/.github/workflows/ci.yml +87 -0
- data/.github/workflows/rubocop.yml +13 -0
- data/.gitignore +13 -0
- data/.rubocop.yml +22 -0
- data/.rubocop_todo.yml +1081 -0
- data/CHANGES.txt +698 -0
- data/Dockerfile +27 -0
- data/Dockerfile.openssl3 +17 -0
- data/Gemfile +13 -0
- data/Gemfile.noed25519 +12 -0
- data/ISSUE_TEMPLATE.md +30 -0
- data/LICENSE.txt +19 -0
- data/Manifest +132 -0
- data/README.md +293 -0
- data/Rakefile +109 -0
- data/THANKS.txt +110 -0
- data/appveyor.yml +58 -0
- data/docker-compose.yml +23 -0
- data/lib/net/ssh/authentication/agent.rb +284 -0
- data/lib/net/ssh/authentication/certificate.rb +183 -0
- data/lib/net/ssh/authentication/constants.rb +20 -0
- data/lib/net/ssh/authentication/ed25519.rb +185 -0
- data/lib/net/ssh/authentication/ed25519_loader.rb +31 -0
- data/lib/net/ssh/authentication/key_manager.rb +310 -0
- data/lib/net/ssh/authentication/methods/abstract.rb +79 -0
- data/lib/net/ssh/authentication/methods/hostbased.rb +72 -0
- data/lib/net/ssh/authentication/methods/keyboard_interactive.rb +77 -0
- data/lib/net/ssh/authentication/methods/none.rb +34 -0
- data/lib/net/ssh/authentication/methods/password.rb +80 -0
- data/lib/net/ssh/authentication/methods/publickey.rb +137 -0
- data/lib/net/ssh/authentication/pageant.rb +497 -0
- data/lib/net/ssh/authentication/pub_key_fingerprint.rb +43 -0
- data/lib/net/ssh/authentication/session.rb +165 -0
- data/lib/net/ssh/buffer.rb +449 -0
- data/lib/net/ssh/buffered_io.rb +202 -0
- data/lib/net/ssh/config.rb +406 -0
- data/lib/net/ssh/connection/channel.rb +694 -0
- data/lib/net/ssh/connection/constants.rb +33 -0
- data/lib/net/ssh/connection/event_loop.rb +123 -0
- data/lib/net/ssh/connection/keepalive.rb +59 -0
- data/lib/net/ssh/connection/session.rb +712 -0
- data/lib/net/ssh/connection/term.rb +180 -0
- data/lib/net/ssh/errors.rb +106 -0
- data/lib/net/ssh/key_factory.rb +218 -0
- data/lib/net/ssh/known_hosts.rb +265 -0
- data/lib/net/ssh/loggable.rb +62 -0
- data/lib/net/ssh/packet.rb +106 -0
- data/lib/net/ssh/prompt.rb +62 -0
- data/lib/net/ssh/proxy/command.rb +123 -0
- data/lib/net/ssh/proxy/errors.rb +16 -0
- data/lib/net/ssh/proxy/http.rb +98 -0
- data/lib/net/ssh/proxy/https.rb +50 -0
- data/lib/net/ssh/proxy/jump.rb +54 -0
- data/lib/net/ssh/proxy/socks4.rb +67 -0
- data/lib/net/ssh/proxy/socks5.rb +140 -0
- data/lib/net/ssh/service/forward.rb +426 -0
- data/lib/net/ssh/test/channel.rb +147 -0
- data/lib/net/ssh/test/extensions.rb +173 -0
- data/lib/net/ssh/test/kex.rb +46 -0
- data/lib/net/ssh/test/local_packet.rb +53 -0
- data/lib/net/ssh/test/packet.rb +101 -0
- data/lib/net/ssh/test/remote_packet.rb +40 -0
- data/lib/net/ssh/test/script.rb +180 -0
- data/lib/net/ssh/test/socket.rb +65 -0
- data/lib/net/ssh/test.rb +94 -0
- data/lib/net/ssh/transport/algorithms.rb +502 -0
- data/lib/net/ssh/transport/cipher_factory.rb +103 -0
- data/lib/net/ssh/transport/constants.rb +40 -0
- data/lib/net/ssh/transport/ctr.rb +115 -0
- data/lib/net/ssh/transport/hmac/abstract.rb +97 -0
- data/lib/net/ssh/transport/hmac/md5.rb +10 -0
- data/lib/net/ssh/transport/hmac/md5_96.rb +9 -0
- data/lib/net/ssh/transport/hmac/none.rb +13 -0
- data/lib/net/ssh/transport/hmac/ripemd160.rb +11 -0
- data/lib/net/ssh/transport/hmac/sha1.rb +11 -0
- data/lib/net/ssh/transport/hmac/sha1_96.rb +9 -0
- data/lib/net/ssh/transport/hmac/sha2_256.rb +11 -0
- data/lib/net/ssh/transport/hmac/sha2_256_96.rb +9 -0
- data/lib/net/ssh/transport/hmac/sha2_256_etm.rb +12 -0
- data/lib/net/ssh/transport/hmac/sha2_512.rb +11 -0
- data/lib/net/ssh/transport/hmac/sha2_512_96.rb +9 -0
- data/lib/net/ssh/transport/hmac/sha2_512_etm.rb +12 -0
- data/lib/net/ssh/transport/hmac.rb +47 -0
- data/lib/net/ssh/transport/identity_cipher.rb +57 -0
- data/lib/net/ssh/transport/kex/abstract.rb +130 -0
- data/lib/net/ssh/transport/kex/abstract5656.rb +72 -0
- data/lib/net/ssh/transport/kex/curve25519_sha256.rb +39 -0
- data/lib/net/ssh/transport/kex/curve25519_sha256_loader.rb +30 -0
- data/lib/net/ssh/transport/kex/diffie_hellman_group14_sha1.rb +37 -0
- data/lib/net/ssh/transport/kex/diffie_hellman_group14_sha256.rb +11 -0
- data/lib/net/ssh/transport/kex/diffie_hellman_group1_sha1.rb +122 -0
- data/lib/net/ssh/transport/kex/diffie_hellman_group_exchange_sha1.rb +72 -0
- data/lib/net/ssh/transport/kex/diffie_hellman_group_exchange_sha256.rb +11 -0
- data/lib/net/ssh/transport/kex/ecdh_sha2_nistp256.rb +39 -0
- data/lib/net/ssh/transport/kex/ecdh_sha2_nistp384.rb +21 -0
- data/lib/net/ssh/transport/kex/ecdh_sha2_nistp521.rb +21 -0
- data/lib/net/ssh/transport/kex.rb +31 -0
- data/lib/net/ssh/transport/key_expander.rb +30 -0
- data/lib/net/ssh/transport/openssl.rb +274 -0
- data/lib/net/ssh/transport/packet_stream.rb +280 -0
- data/lib/net/ssh/transport/server_version.rb +77 -0
- data/lib/net/ssh/transport/session.rb +354 -0
- data/lib/net/ssh/transport/state.rb +208 -0
- data/lib/net/ssh/verifiers/accept_new.rb +33 -0
- data/lib/net/ssh/verifiers/accept_new_or_local_tunnel.rb +33 -0
- data/lib/net/ssh/verifiers/always.rb +58 -0
- data/lib/net/ssh/verifiers/never.rb +19 -0
- data/lib/net/ssh/version.rb +68 -0
- data/lib/net/ssh.rb +330 -0
- data/net-ssh-public_cert.pem +20 -0
- data/net-ssh.gemspec +44 -0
- data/support/ssh_tunnel_bug.rb +65 -0
- metadata +277 -0
@@ -0,0 +1,103 @@
|
|
1
|
+
require 'openssl'
|
2
|
+
require 'net/ssh/transport/ctr.rb'
|
3
|
+
require 'net/ssh/transport/key_expander'
|
4
|
+
require 'net/ssh/transport/identity_cipher'
|
5
|
+
|
6
|
+
module Net
|
7
|
+
module SSH
|
8
|
+
module Transport
|
9
|
+
# Implements a factory of OpenSSL cipher algorithms.
|
10
|
+
class CipherFactory
|
11
|
+
# Maps the SSH name of a cipher to it's corresponding OpenSSL name
|
12
|
+
SSH_TO_OSSL = {
|
13
|
+
"3des-cbc" => "des-ede3-cbc",
|
14
|
+
"blowfish-cbc" => "bf-cbc",
|
15
|
+
"aes256-cbc" => "aes-256-cbc",
|
16
|
+
"aes192-cbc" => "aes-192-cbc",
|
17
|
+
"aes128-cbc" => "aes-128-cbc",
|
18
|
+
"idea-cbc" => "idea-cbc",
|
19
|
+
"cast128-cbc" => "cast-cbc",
|
20
|
+
"rijndael-cbc@lysator.liu.se" => "aes-256-cbc",
|
21
|
+
"3des-ctr" => "des-ede3",
|
22
|
+
"blowfish-ctr" => "bf-ecb",
|
23
|
+
|
24
|
+
"aes256-ctr" => ::OpenSSL::Cipher.ciphers.include?("aes-256-ctr") ? "aes-256-ctr" : "aes-256-ecb",
|
25
|
+
"aes192-ctr" => ::OpenSSL::Cipher.ciphers.include?("aes-192-ctr") ? "aes-192-ctr" : "aes-192-ecb",
|
26
|
+
"aes128-ctr" => ::OpenSSL::Cipher.ciphers.include?("aes-128-ctr") ? "aes-128-ctr" : "aes-128-ecb",
|
27
|
+
'cast128-ctr' => 'cast5-ecb',
|
28
|
+
|
29
|
+
'none' => 'none'
|
30
|
+
}
|
31
|
+
|
32
|
+
# Returns true if the underlying OpenSSL library supports the given cipher,
|
33
|
+
# and false otherwise.
|
34
|
+
def self.supported?(name)
|
35
|
+
ossl_name = SSH_TO_OSSL[name] or raise NotImplementedError, "unimplemented cipher `#{name}'"
|
36
|
+
return true if ossl_name == "none"
|
37
|
+
|
38
|
+
return OpenSSL::Cipher.ciphers.include?(ossl_name)
|
39
|
+
end
|
40
|
+
|
41
|
+
# Retrieves a new instance of the named algorithm. The new instance
|
42
|
+
# will be initialized using an iv and key generated from the given
|
43
|
+
# iv, key, shared, hash and digester values. Additionally, the
|
44
|
+
# cipher will be put into encryption or decryption mode, based on the
|
45
|
+
# value of the +encrypt+ parameter.
|
46
|
+
def self.get(name, options = {})
|
47
|
+
ossl_name = SSH_TO_OSSL[name] or raise NotImplementedError, "unimplemented cipher `#{name}'"
|
48
|
+
return IdentityCipher if ossl_name == "none"
|
49
|
+
|
50
|
+
cipher = OpenSSL::Cipher.new(ossl_name)
|
51
|
+
|
52
|
+
cipher.send(options[:encrypt] ? :encrypt : :decrypt)
|
53
|
+
|
54
|
+
cipher.padding = 0
|
55
|
+
|
56
|
+
if name =~ /-ctr(@openssh.org)?$/
|
57
|
+
if ossl_name !~ /-ctr/
|
58
|
+
cipher.extend(Net::SSH::Transport::CTR)
|
59
|
+
else
|
60
|
+
cipher = Net::SSH::Transport::OpenSSLAESCTR.new(cipher)
|
61
|
+
end
|
62
|
+
end
|
63
|
+
cipher.iv = Net::SSH::Transport::KeyExpander.expand_key(cipher.iv_len, options[:iv], options)
|
64
|
+
|
65
|
+
key_len = cipher.key_len
|
66
|
+
cipher.key_len = key_len
|
67
|
+
cipher.key = Net::SSH::Transport::KeyExpander.expand_key(key_len, options[:key], options)
|
68
|
+
|
69
|
+
return cipher
|
70
|
+
end
|
71
|
+
|
72
|
+
# Returns a two-element array containing the [ key-length,
|
73
|
+
# block-size ] for the named cipher algorithm. If the cipher
|
74
|
+
# algorithm is unknown, or is "none", 0 is returned for both elements
|
75
|
+
# of the tuple.
|
76
|
+
# if :iv_len option is supplied the third return value will be ivlen
|
77
|
+
def self.get_lengths(name, options = {})
|
78
|
+
ossl_name = SSH_TO_OSSL[name]
|
79
|
+
if ossl_name.nil? || ossl_name == "none"
|
80
|
+
result = [0, 0]
|
81
|
+
result << 0 if options[:iv_len]
|
82
|
+
else
|
83
|
+
cipher = OpenSSL::Cipher.new(ossl_name)
|
84
|
+
key_len = cipher.key_len
|
85
|
+
cipher.key_len = key_len
|
86
|
+
|
87
|
+
block_size =
|
88
|
+
case ossl_name
|
89
|
+
when /\-ctr/
|
90
|
+
Net::SSH::Transport::OpenSSLAESCTR.block_size
|
91
|
+
else
|
92
|
+
cipher.block_size
|
93
|
+
end
|
94
|
+
|
95
|
+
result = [key_len, block_size]
|
96
|
+
result << cipher.iv_len if options[:iv_len]
|
97
|
+
end
|
98
|
+
result
|
99
|
+
end
|
100
|
+
end
|
101
|
+
end
|
102
|
+
end
|
103
|
+
end
|
@@ -0,0 +1,40 @@
|
|
1
|
+
module Net
|
2
|
+
module SSH
|
3
|
+
module Transport
|
4
|
+
module Constants
|
5
|
+
#--
|
6
|
+
# Transport layer generic messages
|
7
|
+
#++
|
8
|
+
|
9
|
+
DISCONNECT = 1
|
10
|
+
IGNORE = 2
|
11
|
+
UNIMPLEMENTED = 3
|
12
|
+
DEBUG = 4
|
13
|
+
SERVICE_REQUEST = 5
|
14
|
+
SERVICE_ACCEPT = 6
|
15
|
+
|
16
|
+
#--
|
17
|
+
# Algorithm negotiation messages
|
18
|
+
#++
|
19
|
+
|
20
|
+
KEXINIT = 20
|
21
|
+
NEWKEYS = 21
|
22
|
+
|
23
|
+
#--
|
24
|
+
# Key exchange method specific messages
|
25
|
+
#++
|
26
|
+
|
27
|
+
KEXDH_INIT = 30
|
28
|
+
KEXDH_REPLY = 31
|
29
|
+
|
30
|
+
KEXECDH_INIT = 30
|
31
|
+
KEXECDH_REPLY = 31
|
32
|
+
|
33
|
+
KEXDH_GEX_GROUP = 31
|
34
|
+
KEXDH_GEX_INIT = 32
|
35
|
+
KEXDH_GEX_REPLY = 33
|
36
|
+
KEXDH_GEX_REQUEST = 34
|
37
|
+
end
|
38
|
+
end
|
39
|
+
end
|
40
|
+
end
|
@@ -0,0 +1,115 @@
|
|
1
|
+
require 'openssl'
|
2
|
+
require 'delegate'
|
3
|
+
|
4
|
+
module Net::SSH::Transport
|
5
|
+
# :nodoc:
|
6
|
+
class OpenSSLAESCTR < SimpleDelegator
|
7
|
+
def initialize(original)
|
8
|
+
super
|
9
|
+
@was_reset = false
|
10
|
+
end
|
11
|
+
|
12
|
+
def block_size
|
13
|
+
16
|
14
|
+
end
|
15
|
+
|
16
|
+
def self.block_size
|
17
|
+
16
|
18
|
+
end
|
19
|
+
|
20
|
+
def reset
|
21
|
+
@was_reset = true
|
22
|
+
end
|
23
|
+
|
24
|
+
def iv=(iv_s)
|
25
|
+
super unless @was_reset
|
26
|
+
end
|
27
|
+
end
|
28
|
+
|
29
|
+
# :nodoc:
|
30
|
+
# Pure-Ruby implementation of Stateful Decryption Counter(SDCTR) Mode
|
31
|
+
# for Block Ciphers. See RFC4344 for detail.
|
32
|
+
module CTR
|
33
|
+
def self.extended(orig)
|
34
|
+
orig.instance_eval {
|
35
|
+
@remaining = String.new
|
36
|
+
@counter = nil
|
37
|
+
@counter_len = orig.block_size
|
38
|
+
orig.encrypt
|
39
|
+
orig.padding = 0
|
40
|
+
|
41
|
+
singleton_class.send(:alias_method, :_update, :update)
|
42
|
+
singleton_class.send(:private, :_update)
|
43
|
+
singleton_class.send(:undef_method, :update)
|
44
|
+
|
45
|
+
def iv
|
46
|
+
@counter
|
47
|
+
end
|
48
|
+
|
49
|
+
def iv_len
|
50
|
+
block_size
|
51
|
+
end
|
52
|
+
|
53
|
+
def iv=(iv_s)
|
54
|
+
@counter = iv_s if @counter.nil?
|
55
|
+
end
|
56
|
+
|
57
|
+
def encrypt
|
58
|
+
# DO NOTHING (always set to "encrypt")
|
59
|
+
end
|
60
|
+
|
61
|
+
def decrypt
|
62
|
+
# DO NOTHING (always set to "encrypt")
|
63
|
+
end
|
64
|
+
|
65
|
+
def padding=(pad)
|
66
|
+
# DO NOTHING (always 0)
|
67
|
+
end
|
68
|
+
|
69
|
+
def reset
|
70
|
+
@remaining = String.new
|
71
|
+
end
|
72
|
+
|
73
|
+
def update(data)
|
74
|
+
@remaining += data
|
75
|
+
|
76
|
+
encrypted = String.new
|
77
|
+
|
78
|
+
offset = 0
|
79
|
+
while (@remaining.bytesize - offset) >= block_size
|
80
|
+
encrypted += xor!(@remaining.slice(offset, block_size),
|
81
|
+
_update(@counter))
|
82
|
+
increment_counter!
|
83
|
+
offset += block_size
|
84
|
+
end
|
85
|
+
@remaining = @remaining.slice(offset..-1)
|
86
|
+
|
87
|
+
encrypted
|
88
|
+
end
|
89
|
+
|
90
|
+
def final
|
91
|
+
s = @remaining.empty? ? '' : xor!(@remaining, _update(@counter))
|
92
|
+
@remaining = String.new
|
93
|
+
s
|
94
|
+
end
|
95
|
+
|
96
|
+
def xor!(s1, s2)
|
97
|
+
s = []
|
98
|
+
s1.unpack('Q*').zip(s2.unpack('Q*')) {|a, b| s.push(a ^ b) }
|
99
|
+
s.pack('Q*')
|
100
|
+
end
|
101
|
+
singleton_class.send(:private, :xor!)
|
102
|
+
|
103
|
+
def increment_counter!
|
104
|
+
c = @counter_len
|
105
|
+
while ((c -= 1) > 0)
|
106
|
+
if @counter.setbyte(c, (@counter.getbyte(c) + 1) & 0xff) != 0
|
107
|
+
break
|
108
|
+
end
|
109
|
+
end
|
110
|
+
end
|
111
|
+
singleton_class.send(:private, :increment_counter!)
|
112
|
+
}
|
113
|
+
end
|
114
|
+
end
|
115
|
+
end
|
@@ -0,0 +1,97 @@
|
|
1
|
+
require 'openssl'
|
2
|
+
require 'openssl/digest'
|
3
|
+
|
4
|
+
module Net
|
5
|
+
module SSH
|
6
|
+
module Transport
|
7
|
+
module HMAC
|
8
|
+
# The base class of all OpenSSL-based HMAC algorithm wrappers.
|
9
|
+
class Abstract
|
10
|
+
class << self
|
11
|
+
def etm(*v)
|
12
|
+
@etm = false if !defined?(@etm)
|
13
|
+
if v.empty?
|
14
|
+
@etm = superclass.etm if @etm.nil? && superclass.respond_to?(:etm)
|
15
|
+
return @etm
|
16
|
+
elsif v.length == 1
|
17
|
+
@etm = v.first
|
18
|
+
else
|
19
|
+
raise ArgumentError, "wrong number of arguments (#{v.length} for 1)"
|
20
|
+
end
|
21
|
+
end
|
22
|
+
|
23
|
+
def key_length(*v)
|
24
|
+
@key_length = nil if !defined?(@key_length)
|
25
|
+
if v.empty?
|
26
|
+
@key_length = superclass.key_length if @key_length.nil? && superclass.respond_to?(:key_length)
|
27
|
+
return @key_length
|
28
|
+
elsif v.length == 1
|
29
|
+
@key_length = v.first
|
30
|
+
else
|
31
|
+
raise ArgumentError, "wrong number of arguments (#{v.length} for 1)"
|
32
|
+
end
|
33
|
+
end
|
34
|
+
|
35
|
+
def mac_length(*v)
|
36
|
+
@mac_length = nil if !defined?(@mac_length)
|
37
|
+
if v.empty?
|
38
|
+
@mac_length = superclass.mac_length if @mac_length.nil? && superclass.respond_to?(:mac_length)
|
39
|
+
return @mac_length
|
40
|
+
elsif v.length == 1
|
41
|
+
@mac_length = v.first
|
42
|
+
else
|
43
|
+
raise ArgumentError, "wrong number of arguments (#{v.length} for 1)"
|
44
|
+
end
|
45
|
+
end
|
46
|
+
|
47
|
+
def digest_class(*v)
|
48
|
+
@digest_class = nil if !defined?(@digest_class)
|
49
|
+
if v.empty?
|
50
|
+
@digest_class = superclass.digest_class if @digest_class.nil? && superclass.respond_to?(:digest_class)
|
51
|
+
return @digest_class
|
52
|
+
elsif v.length == 1
|
53
|
+
@digest_class = v.first
|
54
|
+
else
|
55
|
+
raise ArgumentError, "wrong number of arguments (#{v.length} for 1)"
|
56
|
+
end
|
57
|
+
end
|
58
|
+
end
|
59
|
+
|
60
|
+
def etm
|
61
|
+
self.class.etm
|
62
|
+
end
|
63
|
+
|
64
|
+
def key_length
|
65
|
+
self.class.key_length
|
66
|
+
end
|
67
|
+
|
68
|
+
def mac_length
|
69
|
+
self.class.mac_length
|
70
|
+
end
|
71
|
+
|
72
|
+
def digest_class
|
73
|
+
self.class.digest_class
|
74
|
+
end
|
75
|
+
|
76
|
+
# The key in use for this instance.
|
77
|
+
attr_reader :key
|
78
|
+
|
79
|
+
def initialize(key = nil)
|
80
|
+
self.key = key
|
81
|
+
end
|
82
|
+
|
83
|
+
# Sets the key to the given value, truncating it so that it is the correct
|
84
|
+
# length.
|
85
|
+
def key=(value)
|
86
|
+
@key = value ? value.to_s[0, key_length] : nil
|
87
|
+
end
|
88
|
+
|
89
|
+
# Compute the HMAC digest for the given data string.
|
90
|
+
def digest(data)
|
91
|
+
OpenSSL::HMAC.digest(digest_class.new, key, data)[0, mac_length]
|
92
|
+
end
|
93
|
+
end
|
94
|
+
end
|
95
|
+
end
|
96
|
+
end
|
97
|
+
end
|
@@ -0,0 +1,11 @@
|
|
1
|
+
require 'net/ssh/transport/hmac/abstract'
|
2
|
+
|
3
|
+
module Net::SSH::Transport::HMAC
|
4
|
+
# The RIPEMD-160 HMAC algorithm. This has a mac and key length of 20, and
|
5
|
+
# uses the RIPEMD-160 digest algorithm.
|
6
|
+
class RIPEMD160 < Abstract
|
7
|
+
mac_length 20
|
8
|
+
key_length 20
|
9
|
+
digest_class OpenSSL::Digest::RIPEMD160
|
10
|
+
end
|
11
|
+
end
|
@@ -0,0 +1,11 @@
|
|
1
|
+
require 'net/ssh/transport/hmac/abstract'
|
2
|
+
|
3
|
+
module Net::SSH::Transport::HMAC
|
4
|
+
# The SHA1 HMAC algorithm. This has a mac and key length of 20, and
|
5
|
+
# uses the SHA1 digest algorithm.
|
6
|
+
class SHA1 < Abstract
|
7
|
+
mac_length 20
|
8
|
+
key_length 20
|
9
|
+
digest_class OpenSSL::Digest::SHA1
|
10
|
+
end
|
11
|
+
end
|
@@ -0,0 +1,11 @@
|
|
1
|
+
require 'net/ssh/transport/hmac/abstract'
|
2
|
+
|
3
|
+
module Net::SSH::Transport::HMAC
|
4
|
+
# The SHA-256 HMAC algorithm. This has a mac and key length of 32, and
|
5
|
+
# uses the SHA-256 digest algorithm.
|
6
|
+
class SHA2_256 < Abstract
|
7
|
+
mac_length 32
|
8
|
+
key_length 32
|
9
|
+
digest_class OpenSSL::Digest::SHA256
|
10
|
+
end
|
11
|
+
end
|
@@ -0,0 +1,12 @@
|
|
1
|
+
require 'net/ssh/transport/hmac/abstract'
|
2
|
+
|
3
|
+
module Net::SSH::Transport::HMAC
|
4
|
+
# The SHA-256 Encrypt-Then-Mac HMAC algorithm. This has a mac and
|
5
|
+
# key length of 32, and uses the SHA-256 digest algorithm.
|
6
|
+
class SHA2_256_Etm < Abstract
|
7
|
+
etm true
|
8
|
+
mac_length 32
|
9
|
+
key_length 32
|
10
|
+
digest_class OpenSSL::Digest::SHA256
|
11
|
+
end
|
12
|
+
end
|
@@ -0,0 +1,11 @@
|
|
1
|
+
require 'net/ssh/transport/hmac/abstract'
|
2
|
+
|
3
|
+
module Net::SSH::Transport::HMAC
|
4
|
+
# The SHA-512 HMAC algorithm. This has a mac and key length of 64, and
|
5
|
+
# uses the SHA-512 digest algorithm.
|
6
|
+
class SHA2_512 < Abstract
|
7
|
+
mac_length 64
|
8
|
+
key_length 64
|
9
|
+
digest_class OpenSSL::Digest::SHA512
|
10
|
+
end
|
11
|
+
end
|
@@ -0,0 +1,12 @@
|
|
1
|
+
require 'net/ssh/transport/hmac/abstract'
|
2
|
+
|
3
|
+
module Net::SSH::Transport::HMAC
|
4
|
+
# The SHA-512 Encrypt-Then-Mac HMAC algorithm. This has a mac and
|
5
|
+
# key length of 64, and uses the SHA-512 digest algorithm.
|
6
|
+
class SHA2_512_Etm < Abstract
|
7
|
+
etm true
|
8
|
+
mac_length 64
|
9
|
+
key_length 64
|
10
|
+
digest_class OpenSSL::Digest::SHA512
|
11
|
+
end
|
12
|
+
end
|
@@ -0,0 +1,47 @@
|
|
1
|
+
require 'net/ssh/transport/key_expander'
|
2
|
+
require 'net/ssh/transport/hmac/md5'
|
3
|
+
require 'net/ssh/transport/hmac/md5_96'
|
4
|
+
require 'net/ssh/transport/hmac/sha1'
|
5
|
+
require 'net/ssh/transport/hmac/sha1_96'
|
6
|
+
require 'net/ssh/transport/hmac/sha2_256'
|
7
|
+
require 'net/ssh/transport/hmac/sha2_256_96'
|
8
|
+
require 'net/ssh/transport/hmac/sha2_512'
|
9
|
+
require 'net/ssh/transport/hmac/sha2_512_96'
|
10
|
+
require 'net/ssh/transport/hmac/sha2_256_etm'
|
11
|
+
require 'net/ssh/transport/hmac/sha2_512_etm'
|
12
|
+
require 'net/ssh/transport/hmac/ripemd160'
|
13
|
+
require 'net/ssh/transport/hmac/none'
|
14
|
+
|
15
|
+
# Implements a simple factory interface for fetching hmac implementations, or
|
16
|
+
# for finding the key lengths for hmac implementations.s
|
17
|
+
module Net::SSH::Transport::HMAC
|
18
|
+
# The mapping of SSH hmac algorithms to their implementations
|
19
|
+
MAP = {
|
20
|
+
'hmac-md5' => MD5,
|
21
|
+
'hmac-md5-96' => MD5_96,
|
22
|
+
'hmac-sha1' => SHA1,
|
23
|
+
'hmac-sha1-96' => SHA1_96,
|
24
|
+
'hmac-sha2-256' => SHA2_256,
|
25
|
+
'hmac-sha2-256-96' => SHA2_256_96,
|
26
|
+
'hmac-sha2-512' => SHA2_512,
|
27
|
+
'hmac-sha2-512-96' => SHA2_512_96,
|
28
|
+
'hmac-sha2-256-etm@openssh.com' => SHA2_256_Etm,
|
29
|
+
'hmac-sha2-512-etm@openssh.com' => SHA2_512_Etm,
|
30
|
+
'hmac-ripemd160' => RIPEMD160,
|
31
|
+
'hmac-ripemd160@openssh.com' => RIPEMD160,
|
32
|
+
'none' => None
|
33
|
+
}
|
34
|
+
|
35
|
+
# Retrieves a new hmac instance of the given SSH type (+name+). If +key+ is
|
36
|
+
# given, the new instance will be initialized with that key.
|
37
|
+
def self.get(name, key = "", parameters = {})
|
38
|
+
impl = MAP[name] or raise ArgumentError, "hmac not found: #{name.inspect}"
|
39
|
+
impl.new(Net::SSH::Transport::KeyExpander.expand_key(impl.key_length, key, parameters))
|
40
|
+
end
|
41
|
+
|
42
|
+
# Retrieves the key length for the hmac of the given SSH type (+name+).
|
43
|
+
def self.key_length(name)
|
44
|
+
impl = MAP[name] or raise ArgumentError, "hmac not found: #{name.inspect}"
|
45
|
+
impl.key_length
|
46
|
+
end
|
47
|
+
end
|
@@ -0,0 +1,57 @@
|
|
1
|
+
module Net
|
2
|
+
module SSH
|
3
|
+
module Transport
|
4
|
+
# A cipher that does nothing but pass the data through, unchanged. This
|
5
|
+
# keeps things in the code nice and clean when a cipher has not yet been
|
6
|
+
# determined (i.e., during key exchange).
|
7
|
+
class IdentityCipher
|
8
|
+
class << self
|
9
|
+
# A default block size of 8 is required by the SSH2 protocol.
|
10
|
+
def block_size
|
11
|
+
8
|
12
|
+
end
|
13
|
+
|
14
|
+
# Returns an arbitrary integer.
|
15
|
+
def iv_len
|
16
|
+
4
|
17
|
+
end
|
18
|
+
|
19
|
+
# Does nothing. Returns self.
|
20
|
+
def encrypt
|
21
|
+
self
|
22
|
+
end
|
23
|
+
|
24
|
+
# Does nothing. Returns self.
|
25
|
+
def decrypt
|
26
|
+
self
|
27
|
+
end
|
28
|
+
|
29
|
+
# Passes its single argument through unchanged.
|
30
|
+
def update(text)
|
31
|
+
text
|
32
|
+
end
|
33
|
+
|
34
|
+
# Returns the empty string.
|
35
|
+
def final
|
36
|
+
""
|
37
|
+
end
|
38
|
+
|
39
|
+
# The name of this cipher, which is "identity".
|
40
|
+
def name
|
41
|
+
"identity"
|
42
|
+
end
|
43
|
+
|
44
|
+
# Does nothing. Returns nil.
|
45
|
+
def iv=(v)
|
46
|
+
nil
|
47
|
+
end
|
48
|
+
|
49
|
+
# Does nothing. Returns self.
|
50
|
+
def reset
|
51
|
+
self
|
52
|
+
end
|
53
|
+
end
|
54
|
+
end
|
55
|
+
end
|
56
|
+
end
|
57
|
+
end
|