net-ssh 5.0.2 → 7.0.1

data/lib/net/ssh/transport/cipher_factory.rb

@@ -3,68 +3,56 @@ require 'net/ssh/transport/ctr.rb'
 require 'net/ssh/transport/key_expander'
 require 'net/ssh/transport/identity_cipher'
 
-module Net 
-  module SSH 
+module Net
+  module SSH
     module Transport
-
       # Implements a factory of OpenSSL cipher algorithms.
       class CipherFactory
         # Maps the SSH name of a cipher to it's corresponding OpenSSL name
         SSH_TO_OSSL = {
-          "3des-cbc"                    => "des-ede3-cbc",
-          "blowfish-cbc"                => "bf-cbc",
-          "aes256-cbc"                  => "aes-256-cbc",
-          "aes192-cbc"                  => "aes-192-cbc",
-          "aes128-cbc"                  => "aes-128-cbc",
-          "idea-cbc"                    => "idea-cbc",
-          "cast128-cbc"                 => "cast-cbc",
+          "3des-cbc" => "des-ede3-cbc",
+          "blowfish-cbc" => "bf-cbc",
+          "aes256-cbc" => "aes-256-cbc",
+          "aes192-cbc" => "aes-192-cbc",
+          "aes128-cbc" => "aes-128-cbc",
+          "idea-cbc" => "idea-cbc",
+          "cast128-cbc" => "cast-cbc",
           "rijndael-cbc@lysator.liu.se" => "aes-256-cbc",
-          "arcfour128"                  => "rc4",
-          "arcfour256"                  => "rc4",
-          "arcfour512"                  => "rc4",
-          "arcfour"                     => "rc4",
-    
-          "3des-ctr"                    => "des-ede3",
-          "blowfish-ctr"                => "bf-ecb",
-    
-          "aes256-ctr"                  => ::OpenSSL::Cipher.ciphers.include?("aes-256-ctr") ? "aes-256-ctr" : "aes-256-ecb",
-          "aes192-ctr"                  => ::OpenSSL::Cipher.ciphers.include?("aes-192-ctr") ? "aes-192-ctr" : "aes-192-ecb",
-          "aes128-ctr"                  => ::OpenSSL::Cipher.ciphers.include?("aes-128-ctr") ? "aes-128-ctr" : "aes-128-ecb",
-          "cast128-ctr"                 => "cast5-ecb",
-    
-          "none"                        => "none"
-        }
-    
-        # Ruby's OpenSSL bindings always return a key length of 16 for RC4 ciphers
-        # resulting in the error: OpenSSL::CipherError: key length too short.
-        # The following ciphers will override this key length.
-        KEY_LEN_OVERRIDE = {
-          "arcfour256"                  => 32,
-          "arcfour512"                  => 64
+          "3des-ctr" => "des-ede3",
+          "blowfish-ctr" => "bf-ecb",
+
+          "aes256-ctr" => ::OpenSSL::Cipher.ciphers.include?("aes-256-ctr") ? "aes-256-ctr" : "aes-256-ecb",
+          "aes192-ctr" => ::OpenSSL::Cipher.ciphers.include?("aes-192-ctr") ? "aes-192-ctr" : "aes-192-ecb",
+          "aes128-ctr" => ::OpenSSL::Cipher.ciphers.include?("aes-128-ctr") ? "aes-128-ctr" : "aes-128-ecb",
+          'cast128-ctr' => 'cast5-ecb',
+
+          'none' => 'none'
         }
-    
+
         # Returns true if the underlying OpenSSL library supports the given cipher,
         # and false otherwise.
         def self.supported?(name)
           ossl_name = SSH_TO_OSSL[name] or raise NotImplementedError, "unimplemented cipher `#{name}'"
           return true if ossl_name == "none"
+
           return OpenSSL::Cipher.ciphers.include?(ossl_name)
         end
-    
+
         # Retrieves a new instance of the named algorithm. The new instance
         # will be initialized using an iv and key generated from the given
         # iv, key, shared, hash and digester values. Additionally, the
         # cipher will be put into encryption or decryption mode, based on the
         # value of the +encrypt+ parameter.
-        def self.get(name, options={})
+        def self.get(name, options = {})
           ossl_name = SSH_TO_OSSL[name] or raise NotImplementedError, "unimplemented cipher `#{name}'"
           return IdentityCipher if ossl_name == "none"
+
           cipher = OpenSSL::Cipher.new(ossl_name)
-    
+
           cipher.send(options[:encrypt] ? :encrypt : :decrypt)
-    
+
           cipher.padding = 0
-    
+
           if name =~ /-ctr(@openssh.org)?$/
             if ossl_name !~ /-ctr/
               cipher.extend(Net::SSH::Transport::CTR)
@@ -72,16 +60,15 @@ module Net
               cipher = Net::SSH::Transport::OpenSSLAESCTR.new(cipher)
             end
           end
-          cipher.iv = Net::SSH::Transport::KeyExpander.expand_key(cipher.iv_len, options[:iv], options) if ossl_name != "rc4"
-    
-          key_len = KEY_LEN_OVERRIDE[name] || cipher.key_len
+          cipher.iv = Net::SSH::Transport::KeyExpander.expand_key(cipher.iv_len, options[:iv], options)
+
+          key_len = cipher.key_len
           cipher.key_len = key_len
           cipher.key = Net::SSH::Transport::KeyExpander.expand_key(key_len, options[:key], options)
-          cipher.update(" " * 1536) if (ossl_name == "rc4" && name != "arcfour")
-    
+
           return cipher
         end
-    
+
         # Returns a two-element array containing the [ key-length,
         # block-size ] for the named cipher algorithm. If the cipher
         # algorithm is unknown, or is "none", 0 is returned for both elements
@@ -94,26 +81,23 @@ module Net
             result << 0 if options[:iv_len]
           else
             cipher = OpenSSL::Cipher.new(ossl_name)
-            key_len = KEY_LEN_OVERRIDE[name] || cipher.key_len
+            key_len = cipher.key_len
             cipher.key_len = key_len
-    
+
             block_size =
               case ossl_name
-              when "rc4"
-                8
               when /\-ctr/
                 Net::SSH::Transport::OpenSSLAESCTR.block_size
               else
                 cipher.block_size
               end
-    
+
             result = [key_len, block_size]
             result << cipher.iv_len if options[:iv_len]
           end
           result
         end
       end
-
     end
   end
 end

data/lib/net/ssh/transport/constants.rb

@@ -1,35 +1,39 @@
-module Net 
-  module SSH 
+module Net
+  module SSH
     module Transport
       module Constants
-    
         #--
         # Transport layer generic messages
         #++
-    
+
         DISCONNECT                = 1
         IGNORE                    = 2
         UNIMPLEMENTED             = 3
         DEBUG                     = 4
         SERVICE_REQUEST           = 5
         SERVICE_ACCEPT            = 6
-    
+
         #--
         # Algorithm negotiation messages
         #++
-    
+
         KEXINIT                   = 20
         NEWKEYS                   = 21
-    
+
         #--
         # Key exchange method specific messages
         #++
-    
+
         KEXDH_INIT                = 30
         KEXDH_REPLY               = 31
-    
+
         KEXECDH_INIT              = 30
         KEXECDH_REPLY             = 31
+
+        KEXDH_GEX_GROUP           = 31
+        KEXDH_GEX_INIT            = 32
+        KEXDH_GEX_REPLY           = 33
+        KEXDH_GEX_REQUEST         = 34
       end
     end
   end

data/lib/net/ssh/transport/ctr.rb

@@ -2,7 +2,7 @@ require 'openssl'
 require 'delegate'
 
 module Net::SSH::Transport
-  #:nodoc:
+  # :nodoc:
   class OpenSSLAESCTR < SimpleDelegator
     def initialize(original)
       super
@@ -26,13 +26,13 @@ module Net::SSH::Transport
     end
   end
 
-  #:nodoc:
+  # :nodoc:
   # Pure-Ruby implementation of Stateful Decryption Counter(SDCTR) Mode
   # for Block Ciphers. See RFC4344 for detail.
   module CTR
     def self.extended(orig)
       orig.instance_eval {
-        @remaining = ""
+        @remaining = String.new
         @counter = nil
         @counter_len = orig.block_size
         orig.encrypt
@@ -67,13 +67,13 @@ module Net::SSH::Transport
         end
 
         def reset
-          @remaining = ""
+          @remaining = String.new
         end
 
         def update(data)
           @remaining += data
 
-          encrypted = ""
+          encrypted = String.new
 
           offset = 0
           while (@remaining.bytesize - offset) >= block_size
@@ -88,20 +88,14 @@ module Net::SSH::Transport
         end
 
         def final
-          unless @remaining.empty?
-            s = xor!(@remaining, _update(@counter))
-          else
-            s = ""
-          end
-
-          @remaining = ""
-
+          s = @remaining.empty? ? '' : xor!(@remaining, _update(@counter))
+          @remaining = String.new
           s
         end
 
         def xor!(s1, s2)
           s = []
-          s1.unpack('Q*').zip(s2.unpack('Q*')) {|a,b| s.push(a ^ b) }
+          s1.unpack('Q*').zip(s2.unpack('Q*')) {|a, b| s.push(a ^ b) }
           s.pack('Q*')
         end
         singleton_class.send(:private, :xor!)

data/lib/net/ssh/transport/hmac/abstract.rb

@@ -5,10 +5,21 @@ module Net
   module SSH
     module Transport
       module HMAC
-
         # The base class of all OpenSSL-based HMAC algorithm wrappers.
         class Abstract
-          class <<self
+          class << self
+            def etm(*v)
+              @etm = false if !defined?(@etm)
+              if v.empty?
+                @etm = superclass.etm if @etm.nil? && superclass.respond_to?(:etm)
+                return @etm
+              elsif v.length == 1
+                @etm = v.first
+              else
+                raise ArgumentError, "wrong number of arguments (#{v.length} for 1)"
+              end
+            end
+
             def key_length(*v)
               @key_length = nil if !defined?(@key_length)
               if v.empty?
@@ -46,6 +57,10 @@ module Net
             end
           end
 
+          def etm
+            self.class.etm
+          end
+
           def key_length
             self.class.key_length
           end
@@ -61,19 +76,19 @@ module Net
           # The key in use for this instance.
           attr_reader :key
 
-          def initialize(key=nil)
+          def initialize(key = nil)
             self.key = key
           end
 
           # Sets the key to the given value, truncating it so that it is the correct
           # length.
           def key=(value)
-            @key = value ? value.to_s[0,key_length] : nil
+            @key = value ? value.to_s[0, key_length] : nil
           end
 
           # Compute the HMAC digest for the given data string.
           def digest(data)
-            OpenSSL::HMAC.digest(digest_class.new, key, data)[0,mac_length]
+            OpenSSL::HMAC.digest(digest_class.new, key, data)[0, mac_length]
           end
         end
       end

data/lib/net/ssh/transport/hmac/md5.rb

@@ -1,12 +1,10 @@
 require 'net/ssh/transport/hmac/abstract'
 
 module Net::SSH::Transport::HMAC
-
   # The MD5 HMAC algorithm.
   class MD5 < Abstract
     mac_length   16
     key_length   16
     digest_class OpenSSL::Digest::MD5
   end
-
 end

data/lib/net/ssh/transport/hmac/md5_96.rb

@@ -1,11 +1,9 @@
 require 'net/ssh/transport/hmac/md5'
 
 module Net::SSH::Transport::HMAC
-
   # The MD5-96 HMAC algorithm. This returns only the first 12 bytes of
   # the digest.
   class MD5_96 < MD5
     mac_length 12
   end
-
 end

data/lib/net/ssh/transport/hmac/none.rb

@@ -1,7 +1,6 @@
 require 'net/ssh/transport/hmac/abstract'
 
 module Net::SSH::Transport::HMAC
-
   # The "none" algorithm. This has a key and mac length of 0.
   class None < Abstract
     key_length 0
@@ -11,5 +10,4 @@ module Net::SSH::Transport::HMAC
       ""
     end
   end
-
 end

data/lib/net/ssh/transport/hmac/ripemd160.rb

@@ -1,7 +1,6 @@
 require 'net/ssh/transport/hmac/abstract'
 
 module Net::SSH::Transport::HMAC
-
   # The RIPEMD-160 HMAC algorithm. This has a mac and key length of 20, and
   # uses the RIPEMD-160 digest algorithm.
   class RIPEMD160 < Abstract
@@ -9,5 +8,4 @@ module Net::SSH::Transport::HMAC
     key_length   20
     digest_class OpenSSL::Digest::RIPEMD160
   end
-
 end

data/lib/net/ssh/transport/hmac/sha1.rb

@@ -1,7 +1,6 @@
 require 'net/ssh/transport/hmac/abstract'
 
 module Net::SSH::Transport::HMAC
-
   # The SHA1 HMAC algorithm. This has a mac and key length of 20, and
   # uses the SHA1 digest algorithm.
   class SHA1 < Abstract
@@ -9,5 +8,4 @@ module Net::SSH::Transport::HMAC
     key_length   20
     digest_class OpenSSL::Digest::SHA1
   end
-
 end

data/lib/net/ssh/transport/hmac/sha1_96.rb

@@ -1,11 +1,9 @@
 require 'net/ssh/transport/hmac/sha1'
 
 module Net::SSH::Transport::HMAC
-
   # The SHA1-96 HMAC algorithm. This returns only the first 12 bytes of
   # the digest.
   class SHA1_96 < SHA1
     mac_length 12
   end
-
 end

data/lib/net/ssh/transport/hmac/sha2_256.rb

@@ -1,15 +1,11 @@
 require 'net/ssh/transport/hmac/abstract'
 
-if defined?(OpenSSL::Digest::SHA256) # need openssl support
-  module Net::SSH::Transport::HMAC
-
-    # The SHA-256 HMAC algorithm. This has a mac and key length of 32, and
-    # uses the SHA-256 digest algorithm.
-    class SHA2_256 < Abstract
-      mac_length   32
-      key_length   32
-      digest_class OpenSSL::Digest::SHA256
-    end
-
+module Net::SSH::Transport::HMAC
+  # The SHA-256 HMAC algorithm. This has a mac and key length of 32, and
+  # uses the SHA-256 digest algorithm.
+  class SHA2_256 < Abstract
+    mac_length   32
+    key_length   32
+    digest_class OpenSSL::Digest::SHA256
   end
 end

data/lib/net/ssh/transport/hmac/sha2_256_96.rb

@@ -1,13 +1,9 @@
 require 'net/ssh/transport/hmac/abstract'
 
 module Net::SSH::Transport::HMAC
-
-  if defined?(SHA2_256) # need openssl support
-    # The SHA256-96 HMAC algorithm. This returns only the first 12 bytes of
-    # the digest.
-    class SHA2_256_96 < SHA2_256
-      mac_length 12
-    end
+  # The SHA256-96 HMAC algorithm. This returns only the first 12 bytes of
+  # the digest.
+  class SHA2_256_96 < SHA2_256
+    mac_length 12
   end
-
 end

data/lib/net/ssh/transport/hmac/sha2_256_etm.rb

@@ -0,0 +1,12 @@
+require 'net/ssh/transport/hmac/abstract'
+
+module Net::SSH::Transport::HMAC
+  # The SHA-256 Encrypt-Then-Mac HMAC algorithm. This has a mac and
+  # key length of 32, and uses the SHA-256 digest algorithm.
+  class SHA2_256_Etm < Abstract
+    etm          true
+    mac_length   32
+    key_length   32
+    digest_class OpenSSL::Digest::SHA256
+  end
+end

data/lib/net/ssh/transport/hmac/sha2_512.rb

@@ -1,14 +1,11 @@
 require 'net/ssh/transport/hmac/abstract'
 
 module Net::SSH::Transport::HMAC
-
-  if defined?(OpenSSL::Digest::SHA512) # need openssl support
-    # The SHA-512 HMAC algorithm. This has a mac and key length of 64, and
-    # uses the SHA-512 digest algorithm.
-    class SHA2_512 < Abstract
-      mac_length   64
-      key_length   64
-      digest_class OpenSSL::Digest::SHA512
-    end
+  # The SHA-512 HMAC algorithm. This has a mac and key length of 64, and
+  # uses the SHA-512 digest algorithm.
+  class SHA2_512 < Abstract
+    mac_length   64
+    key_length   64
+    digest_class OpenSSL::Digest::SHA512
   end
 end

data/lib/net/ssh/transport/hmac/sha2_512_96.rb

@@ -1,13 +1,9 @@
 require 'net/ssh/transport/hmac/abstract'
 
 module Net::SSH::Transport::HMAC
-
-  if defined?(SHA2_512) # need openssl support
-    # The SHA2-512-96 HMAC algorithm. This returns only the first 12 bytes of
-    # the digest.
-    class SHA2_512_96 < SHA2_512
-      mac_length 12
-    end
+  # The SHA2-512-96 HMAC algorithm. This returns only the first 12 bytes of
+  # the digest.
+  class SHA2_512_96 < SHA2_512
+    mac_length 12
   end
-
 end

data/lib/net/ssh/transport/hmac/sha2_512_etm.rb

@@ -0,0 +1,12 @@
+require 'net/ssh/transport/hmac/abstract'
+
+module Net::SSH::Transport::HMAC
+  # The SHA-512 Encrypt-Then-Mac HMAC algorithm. This has a mac and
+  # key length of 64, and uses the SHA-512 digest algorithm.
+  class SHA2_512_Etm < Abstract
+    etm          true
+    mac_length   64
+    key_length   64
+    digest_class OpenSSL::Digest::SHA512
+  end
+end

data/lib/net/ssh/transport/hmac.rb

@@ -7,6 +7,8 @@ require 'net/ssh/transport/hmac/sha2_256'
 require 'net/ssh/transport/hmac/sha2_256_96'
 require 'net/ssh/transport/hmac/sha2_512'
 require 'net/ssh/transport/hmac/sha2_512_96'
+require 'net/ssh/transport/hmac/sha2_256_etm'
+require 'net/ssh/transport/hmac/sha2_512_etm'
 require 'net/ssh/transport/hmac/ripemd160'
 require 'net/ssh/transport/hmac/none'
 
@@ -15,24 +17,24 @@ require 'net/ssh/transport/hmac/none'
 module Net::SSH::Transport::HMAC
   # The mapping of SSH hmac algorithms to their implementations
   MAP = {
-    'hmac-md5'       => MD5,
-    'hmac-md5-96'    => MD5_96,
-    'hmac-sha1'      => SHA1,
-    'hmac-sha1-96'   => SHA1_96,
+    'hmac-md5' => MD5,
+    'hmac-md5-96' => MD5_96,
+    'hmac-sha1' => SHA1,
+    'hmac-sha1-96' => SHA1_96,
+    'hmac-sha2-256' => SHA2_256,
+    'hmac-sha2-256-96' => SHA2_256_96,
+    'hmac-sha2-512' => SHA2_512,
+    'hmac-sha2-512-96' => SHA2_512_96,
+    'hmac-sha2-256-etm@openssh.com' => SHA2_256_Etm,
+    'hmac-sha2-512-etm@openssh.com' => SHA2_512_Etm,
     'hmac-ripemd160' => RIPEMD160,
     'hmac-ripemd160@openssh.com' => RIPEMD160,
     'none' => None
   }
 
-  # add mapping to sha2 hmac algorithms if they're available
-  MAP['hmac-sha2-256']    = SHA2_256    if defined?(::Net::SSH::Transport::HMAC::SHA2_256)
-  MAP['hmac-sha2-256-96'] = SHA2_256_96 if defined?(::Net::SSH::Transport::HMAC::SHA2_256_96)
-  MAP['hmac-sha2-512']    = SHA2_512    if defined?(::Net::SSH::Transport::HMAC::SHA2_512)
-  MAP['hmac-sha2-512-96'] = SHA2_512_96 if defined?(::Net::SSH::Transport::HMAC::SHA2_512_96)
-
   # Retrieves a new hmac instance of the given SSH type (+name+). If +key+ is
   # given, the new instance will be initialized with that key.
-  def self.get(name, key="", parameters = {})
+  def self.get(name, key = "", parameters = {})
     impl = MAP[name] or raise ArgumentError, "hmac not found: #{name.inspect}"
     impl.new(Net::SSH::Transport::KeyExpander.expand_key(impl.key_length, key, parameters))
   end

data/lib/net/ssh/transport/identity_cipher.rb

@@ -1,59 +1,57 @@
-module Net 
-  module SSH 
+module Net
+  module SSH
     module Transport
-
       # A cipher that does nothing but pass the data through, unchanged. This
       # keeps things in the code nice and clean when a cipher has not yet been
       # determined (i.e., during key exchange).
       class IdentityCipher
-        class <<self
+        class << self
           # A default block size of 8 is required by the SSH2 protocol.
           def block_size
             8
           end
-    
+
           # Returns an arbitrary integer.
           def iv_len
             4
           end
-    
+
           # Does nothing. Returns self.
           def encrypt
             self
           end
-    
+
           # Does nothing. Returns self.
           def decrypt
             self
           end
-    
+
           # Passes its single argument through unchanged.
           def update(text)
             text
           end
-    
+
           # Returns the empty string.
           def final
             ""
           end
-    
+
           # The name of this cipher, which is "identity".
           def name
             "identity"
           end
-    
+
           # Does nothing. Returns nil.
           def iv=(v)
             nil
           end
-    
+
           # Does nothing. Returns self.
           def reset
             self
           end
         end
       end
-
     end
   end
 end