net-ssh 2.7.0 → 7.3.0

data/lib/net/ssh/transport/chacha20_poly1305_cipher.rb

@@ -0,0 +1,117 @@
+require 'rbnacl'
+require 'net/ssh/loggable'
+
+module Net
+  module SSH
+    module Transport
+      ## Implements the chacha20-poly1305@openssh cipher
+      class ChaCha20Poly1305Cipher
+        include Net::SSH::Loggable
+
+        # Implicit HMAC, no need to do anything
+        class ImplicitHMac
+          def etm
+            # TODO: ideally this shouln't be called
+            true
+          end
+
+          def key_length
+            64
+          end
+        end
+
+        def initialize(encrypt:, key:)
+          @chacha_hdr = OpenSSL::Cipher.new("chacha20")
+          key_len = @chacha_hdr.key_len
+          @chacha_main = OpenSSL::Cipher.new("chacha20")
+          @poly = RbNaCl::OneTimeAuths::Poly1305
+          if key.size < key_len * 2
+            error { "chacha20_poly1305: keylength doesn't match" }
+            raise "chacha20_poly1305: keylength doesn't match"
+          end
+          if encrypt
+            @chacha_hdr.encrypt
+            @chacha_main.encrypt
+          else
+            @chacha_hdr.decrypt
+            @chacha_main.decrypt
+          end
+          main_key = key[0...key_len]
+          @chacha_main.key = main_key
+          hdr_key = key[key_len...(2 * key_len)]
+          @chacha_hdr.key = hdr_key
+        end
+
+        def update_cipher_mac(payload, sequence_number)
+          iv_data = [0, 0, 0, sequence_number].pack("NNNN")
+          @chacha_main.iv = iv_data
+          poly_key = @chacha_main.update(([0] * 32).pack('C32'))
+
+          packet_length = payload.size
+          length_data = [packet_length].pack("N")
+          @chacha_hdr.iv = iv_data
+          packet = @chacha_hdr.update(length_data)
+
+          iv_data[0] = 1.chr
+          @chacha_main.iv = iv_data
+          unencrypted_data = payload
+          packet += @chacha_main.update(unencrypted_data)
+
+          packet += @poly.auth(poly_key, packet)
+          return packet
+        end
+
+        def read_length(data, sequence_number)
+          iv_data = [0, 0, 0, sequence_number].pack("NNNN")
+          @chacha_hdr.iv = iv_data
+          @chacha_hdr.update(data).unpack1("N")
+        end
+
+        def read_and_mac(data, mac, sequence_number)
+          iv_data = [0, 0, 0, sequence_number].pack("NNNN")
+          @chacha_main.iv = iv_data
+          poly_key = @chacha_main.update(([0] * 32).pack('C32'))
+
+          iv_data[0] = 1.chr
+          @chacha_main.iv = iv_data
+          unencrypted_data = @chacha_main.update(data[4..])
+          begin
+            ok = @poly.verify(poly_key, mac, data[0..])
+            raise Net::SSH::Exception, "corrupted hmac detected #{name}" unless ok
+          rescue RbNaCl::BadAuthenticatorError
+            raise Net::SSH::Exception, "corrupted hmac detected #{name}"
+          end
+          return unencrypted_data
+        end
+
+        def mac_length
+          16
+        end
+
+        def block_size
+          8
+        end
+
+        def name
+          "chacha20-poly1305@openssh.com"
+        end
+
+        def implicit_mac?
+          true
+        end
+
+        def implicit_mac
+          return ImplicitHMac.new
+        end
+
+        def self.block_size
+          8
+        end
+
+        def self.key_length
+          64
+        end
+      end
+    end
+  end
+end

data/lib/net/ssh/transport/chacha20_poly1305_cipher_loader.rb

@@ -0,0 +1,17 @@
+module Net
+  module SSH
+    module Transport
+      # Loads chacha20 poly1305 support which requires optinal dependency rbnacl
+      module ChaCha20Poly1305CipherLoader
+        begin
+          require 'net/ssh/transport/chacha20_poly1305_cipher'
+          LOADED = true
+          ERROR = nil
+        rescue LoadError => e
+          ERROR = e
+          LOADED = false
+        end
+      end
+    end
+  end
+end

data/lib/net/ssh/transport/cipher_factory.rb

@@ -1,106 +1,130 @@
 require 'openssl'
 require 'net/ssh/transport/ctr.rb'
+require 'net/ssh/transport/aes128_gcm'
+require 'net/ssh/transport/aes256_gcm'
 require 'net/ssh/transport/key_expander'
 require 'net/ssh/transport/identity_cipher'
-
-module Net; module SSH; module Transport
-
-  # Implements a factory of OpenSSL cipher algorithms.
-  class CipherFactory
-    # Maps the SSH name of a cipher to it's corresponding OpenSSL name
-    SSH_TO_OSSL = {
-      "3des-cbc"                    => "des-ede3-cbc",
-      "blowfish-cbc"                => "bf-cbc",
-      "aes256-cbc"                  => "aes-256-cbc",
-      "aes192-cbc"                  => "aes-192-cbc",
-      "aes128-cbc"                  => "aes-128-cbc",
-      "idea-cbc"                    => "idea-cbc",
-      "cast128-cbc"                 => "cast-cbc",
-      "rijndael-cbc@lysator.liu.se" => "aes-256-cbc",
-      "arcfour128"                  => "rc4",
-      "arcfour256"                  => "rc4",
-      "arcfour512"                  => "rc4",
-      "arcfour"                     => "rc4",
-      "camellia128-cbc"             => "camellia-128-cbc",
-      "camellia192-cbc"             => "camellia-192-cbc",
-      "camellia256-cbc"             => "camellia-256-cbc",
-      "camellia128-cbc@openssh.org" => "camellia-128-cbc",
-      "camellia192-cbc@openssh.org" => "camellia-192-cbc",
-      "camellia256-cbc@openssh.org" => "camellia-256-cbc",
-
-      "3des-ctr"                    => "des-ede3",
-      "blowfish-ctr"                => "bf-ecb",
-      "aes256-ctr"                  => "aes-256-ecb",
-      "aes192-ctr"                  => "aes-192-ecb",
-      "aes128-ctr"                  => "aes-128-ecb",
-      "cast128-ctr"                 => "cast5-ecb",
-      "camellia128-ctr"             => "camellia-128-ecb",
-      "camellia192-ctr"             => "camellia-192-ecb",
-      "camellia256-ctr"             => "camellia-256-ecb",
-      "camellia128-ctr@openssh.org" => "camellia-128-ecb",
-      "camellia192-ctr@openssh.org" => "camellia-192-ecb",
-      "camellia256-ctr@openssh.org" => "camellia-256-ecb",
-
-      "none"                        => "none",
-    }
-
-    # Ruby's OpenSSL bindings always return a key length of 16 for RC4 ciphers
-    # resulting in the error: OpenSSL::CipherError: key length too short. 
-    # The following ciphers will override this key length. 
-    KEY_LEN_OVERRIDE = {
-      "arcfour256"                  => 32,
-      "arcfour512"                  => 64
-    }
-
-
-    # Returns true if the underlying OpenSSL library supports the given cipher,
-    # and false otherwise.
-    def self.supported?(name)
-      ossl_name = SSH_TO_OSSL[name] or raise NotImplementedError, "unimplemented cipher `#{name}'"
-      return true if ossl_name == "none"
-      return OpenSSL::Cipher.ciphers.include?(ossl_name)
-    end
-
-    # Retrieves a new instance of the named algorithm. The new instance
-    # will be initialized using an iv and key generated from the given
-    # iv, key, shared, hash and digester values. Additionally, the
-    # cipher will be put into encryption or decryption mode, based on the
-    # value of the +encrypt+ parameter.
-    def self.get(name, options={})
-      ossl_name = SSH_TO_OSSL[name] or raise NotImplementedError, "unimplemented cipher `#{name}'"
-      return IdentityCipher if ossl_name == "none"
-      cipher = OpenSSL::Cipher::Cipher.new(ossl_name)
-
-      cipher.send(options[:encrypt] ? :encrypt : :decrypt)
-
-      cipher.padding = 0
-
-      cipher.extend(Net::SSH::Transport::CTR) if (name =~ /-ctr(@openssh.org)?$/)
-
-      cipher.iv      = Net::SSH::Transport::KeyExpander.expand_key(cipher.iv_len, options[:iv], options) if ossl_name != "rc4"
-
-      key_len = KEY_LEN_OVERRIDE[name] || cipher.key_len
-      cipher.key_len = key_len
-      cipher.key     = Net::SSH::Transport::KeyExpander.expand_key(key_len, options[:key], options)
-      cipher.update(" " * 1536) if (ossl_name == "rc4" && name != "arcfour")
-
-      return cipher
-    end
-
-    # Returns a two-element array containing the [ key-length,
-    # block-size ] for the named cipher algorithm. If the cipher
-    # algorithm is unknown, or is "none", 0 is returned for both elements
-    # of the tuple.
-    def self.get_lengths(name)
-      ossl_name = SSH_TO_OSSL[name]
-      return [0, 0] if ossl_name.nil? || ossl_name == "none"
-
-      cipher = OpenSSL::Cipher::Cipher.new(ossl_name)
-      key_len = KEY_LEN_OVERRIDE[name] || cipher.key_len
-      cipher.key_len = key_len
-      
-      return [key_len, ossl_name=="rc4" ? 8 : cipher.block_size]
+require 'net/ssh/transport/chacha20_poly1305_cipher_loader'
+require 'net/ssh/transport/openssl_cipher_extensions'
+
+module Net
+  module SSH
+    module Transport
+      # Implements a factory of OpenSSL cipher algorithms.
+      class CipherFactory
+        # Maps the SSH name of a cipher to it's corresponding OpenSSL name
+        SSH_TO_OSSL = {
+          "3des-cbc" => "des-ede3-cbc",
+          "blowfish-cbc" => "bf-cbc",
+          "aes256-cbc" => "aes-256-cbc",
+          "aes192-cbc" => "aes-192-cbc",
+          "aes128-cbc" => "aes-128-cbc",
+          "idea-cbc" => "idea-cbc",
+          "cast128-cbc" => "cast-cbc",
+          "rijndael-cbc@lysator.liu.se" => "aes-256-cbc",
+          "3des-ctr" => "des-ede3",
+          "blowfish-ctr" => "bf-ecb",
+
+          "aes256-ctr" => ::OpenSSL::Cipher.ciphers.include?("aes-256-ctr") ? "aes-256-ctr" : "aes-256-ecb",
+          "aes192-ctr" => ::OpenSSL::Cipher.ciphers.include?("aes-192-ctr") ? "aes-192-ctr" : "aes-192-ecb",
+          "aes128-ctr" => ::OpenSSL::Cipher.ciphers.include?("aes-128-ctr") ? "aes-128-ctr" : "aes-128-ecb",
+          'cast128-ctr' => 'cast5-ecb',
+
+          'none' => 'none'
+        }
+
+        SSH_TO_CLASS = {
+          'aes256-gcm@openssh.com' => Net::SSH::Transport::AES256_GCM,
+          'aes128-gcm@openssh.com' => Net::SSH::Transport::AES128_GCM
+        }.tap do |hash|
+          if Net::SSH::Transport::ChaCha20Poly1305CipherLoader::LOADED
+            hash['chacha20-poly1305@openssh.com'] =
+              Net::SSH::Transport::ChaCha20Poly1305Cipher
+          end
+        end
+
+        # Returns true if the underlying OpenSSL library supports the given cipher,
+        # and false otherwise.
+        def self.supported?(name)
+          return true if SSH_TO_CLASS.key?(name)
+
+          ossl_name = SSH_TO_OSSL[name] or raise NotImplementedError, "unimplemented cipher `#{name}'"
+          return true if ossl_name == "none"
+
+          return SSH_TO_CLASS.key?(name) || OpenSSL::Cipher.ciphers.include?(ossl_name)
+        end
+
+        # Retrieves a new instance of the named algorithm. The new instance
+        # will be initialized using an iv and key generated from the given
+        # iv, key, shared, hash and digester values. Additionally, the
+        # cipher will be put into encryption or decryption mode, based on the
+        # value of the +encrypt+ parameter.
+        def self.get(name, options = {})
+          klass = SSH_TO_CLASS[name]
+          unless klass.nil?
+            key_len = klass.key_length
+            key = Net::SSH::Transport::KeyExpander.expand_key(key_len, options[:key], options)
+            return klass.new(encrypt: options[:encrypt], key: key)
+          end
+
+          ossl_name = SSH_TO_OSSL[name] or raise NotImplementedError, "unimplemented cipher `#{name}'"
+          return IdentityCipher if ossl_name == "none"
+
+          cipher = OpenSSL::Cipher.new(ossl_name)
+
+          cipher.send(options[:encrypt] ? :encrypt : :decrypt)
+
+          cipher.padding = 0
+
+          cipher.extend(Net::SSH::Transport::OpenSSLCipherExtensions)
+          if name =~ /-ctr(@openssh.org)?$/
+            if ossl_name !~ /-ctr/
+              cipher.extend(Net::SSH::Transport::CTR)
+            else
+              cipher = Net::SSH::Transport::OpenSSLAESCTR.new(cipher)
+            end
+          end
+          cipher.iv = Net::SSH::Transport::KeyExpander.expand_key(cipher.iv_len, options[:iv], options)
+
+          key_len = cipher.key_len
+          cipher.key_len = key_len
+          cipher.key = Net::SSH::Transport::KeyExpander.expand_key(key_len, options[:key], options)
+
+          return cipher
+        end
+
+        # Returns a two-element array containing the [ key-length,
+        # block-size ] for the named cipher algorithm. If the cipher
+        # algorithm is unknown, or is "none", 0 is returned for both elements
+        # of the tuple.
+        # if :iv_len option is supplied the third return value will be ivlen
+        def self.get_lengths(name, options = {})
+          klass = SSH_TO_CLASS[name]
+          return [klass.key_length, klass.block_size] unless klass.nil?
+
+          ossl_name = SSH_TO_OSSL[name]
+          if ossl_name.nil? || ossl_name == "none"
+            result = [0, 0]
+            result << 0 if options[:iv_len]
+          else
+            cipher = OpenSSL::Cipher.new(ossl_name)
+            key_len = cipher.key_len
+            cipher.key_len = key_len
+
+            block_size =
+              case ossl_name
+              when /\-ctr/
+                Net::SSH::Transport::OpenSSLAESCTR.block_size
+              else
+                cipher.block_size
+              end
+
+            result = [key_len, block_size]
+            result << cipher.iv_len if options[:iv_len]
+          end
+          result
+        end
+      end
     end
   end
-
-end; end; end
+end

data/lib/net/ssh/transport/constants.rb

@@ -1,32 +1,40 @@
-module Net; module SSH; module Transport
-  module Constants
+module Net
+  module SSH
+    module Transport
+      module Constants
+        #--
+        # Transport layer generic messages
+        #++
 
-    #--
-    # Transport layer generic messages
-    #++
+        DISCONNECT                = 1
+        IGNORE                    = 2
+        UNIMPLEMENTED             = 3
+        DEBUG                     = 4
+        SERVICE_REQUEST           = 5
+        SERVICE_ACCEPT            = 6
 
-    DISCONNECT                = 1
-    IGNORE                    = 2
-    UNIMPLEMENTED             = 3
-    DEBUG                     = 4
-    SERVICE_REQUEST           = 5
-    SERVICE_ACCEPT            = 6
+        #--
+        # Algorithm negotiation messages
+        #++
 
-    #--
-    # Algorithm negotiation messages
-    #++
+        KEXINIT                   = 20
+        NEWKEYS                   = 21
 
-    KEXINIT                   = 20
-    NEWKEYS                   = 21
+        #--
+        # Key exchange method specific messages
+        #++
 
-    #--
-    # Key exchange method specific messages
-    #++
+        KEXDH_INIT                = 30
+        KEXDH_REPLY               = 31
 
-    KEXDH_INIT                = 30
-    KEXDH_REPLY               = 31
+        KEXECDH_INIT              = 30
+        KEXECDH_REPLY             = 31
 
-    KEXECDH_INIT              = 30
-    KEXECDH_REPLY             = 31
+        KEXDH_GEX_GROUP           = 31
+        KEXDH_GEX_INIT            = 32
+        KEXDH_GEX_REPLY           = 33
+        KEXDH_GEX_REQUEST         = 34
+      end
+    end
   end
-end; end; end
+end

data/lib/net/ssh/transport/ctr.rb

@@ -1,23 +1,46 @@
 require 'openssl'
+require 'delegate'
 
 module Net::SSH::Transport
+  # :nodoc:
+  class OpenSSLAESCTR < SimpleDelegator
+    def initialize(original)
+      super
+      @was_reset = false
+    end
+
+    def block_size
+      16
+    end
+
+    def self.block_size
+      16
+    end
+
+    def reset
+      @was_reset = true
+    end
+
+    def iv=(iv_s)
+      super unless @was_reset
+    end
+  end
 
+  # :nodoc:
   # Pure-Ruby implementation of Stateful Decryption Counter(SDCTR) Mode
   # for Block Ciphers. See RFC4344 for detail.
   module CTR
     def self.extended(orig)
       orig.instance_eval {
-        @remaining = ""
+        @remaining = String.new
         @counter = nil
         @counter_len = orig.block_size
         orig.encrypt
         orig.padding = 0
-      }
 
-      class <<orig
-        alias :_update :update
-        private :_update
-        undef :update
+        singleton_class.send(:alias_method, :_update, :update)
+        singleton_class.send(:private, :_update)
+        singleton_class.send(:undef_method, :update)
 
         def iv
           @counter
@@ -44,42 +67,38 @@ module Net::SSH::Transport
         end
 
         def reset
-          @remaining = ""
+          @remaining = String.new
         end
 
         def update(data)
           @remaining += data
 
-          encrypted = ""
+          encrypted = String.new
 
-          while @remaining.bytesize >= block_size
-            encrypted += xor!(@remaining.slice!(0, block_size),
+          offset = 0
+          while (@remaining.bytesize - offset) >= block_size
+            encrypted += xor!(@remaining.slice(offset, block_size),
                               _update(@counter))
             increment_counter!
+            offset += block_size
           end
+          @remaining = @remaining.slice(offset..-1)
 
           encrypted
         end
 
         def final
-          unless @remaining.empty?
-            s = xor!(@remaining, _update(@counter))
-          else
-            s = ""
-          end
-
-          @remaining = ""
-
+          s = @remaining.empty? ? '' : xor!(@remaining, _update(@counter))
+          @remaining = String.new
           s
         end
 
-        private
-
         def xor!(s1, s2)
           s = []
-          s1.unpack('Q*').zip(s2.unpack('Q*')) {|a,b| s.push(a^b) }
+          s1.unpack('Q*').zip(s2.unpack('Q*')) {|a, b| s.push(a ^ b) }
           s.pack('Q*')
         end
+        singleton_class.send(:private, :xor!)
 
         def increment_counter!
           c = @counter_len
@@ -89,7 +108,8 @@ module Net::SSH::Transport
             end
           end
         end
-      end
+        singleton_class.send(:private, :increment_counter!)
+      }
     end
   end
 end