net-ssh 5.2.0 → 6.0.0

data/lib/net/ssh/transport/hmac.rb

@@ -7,6 +7,8 @@ require 'net/ssh/transport/hmac/sha2_256'
 require 'net/ssh/transport/hmac/sha2_256_96'
 require 'net/ssh/transport/hmac/sha2_512'
 require 'net/ssh/transport/hmac/sha2_512_96'
+require 'net/ssh/transport/hmac/sha2_256_etm'
+require 'net/ssh/transport/hmac/sha2_512_etm'
 require 'net/ssh/transport/hmac/ripemd160'
 require 'net/ssh/transport/hmac/none'
 
@@ -15,21 +17,21 @@ require 'net/ssh/transport/hmac/none'
 module Net::SSH::Transport::HMAC
   # The mapping of SSH hmac algorithms to their implementations
   MAP = {
-    'hmac-md5'       => MD5,
-    'hmac-md5-96'    => MD5_96,
-    'hmac-sha1'      => SHA1,
-    'hmac-sha1-96'   => SHA1_96,
-    'hmac-ripemd160' => RIPEMD160,
-    'hmac-ripemd160@openssh.com' => RIPEMD160,
-    'none' => None
+    'hmac-md5'                      => MD5,
+    'hmac-md5-96'                   => MD5_96,
+    'hmac-sha1'                     => SHA1,
+    'hmac-sha1-96'                  => SHA1_96,
+    'hmac-sha2-256'                 => SHA2_256,
+    'hmac-sha2-256-96'              => SHA2_256_96,
+    'hmac-sha2-512'                 => SHA2_512,
+    'hmac-sha2-512-96'              => SHA2_512_96,
+    'hmac-sha2-256-etm@openssh.com' => SHA2_256_Etm,
+    'hmac-sha2-512-etm@openssh.com' => SHA2_512_Etm,
+    'hmac-ripemd160'                => RIPEMD160,
+    'hmac-ripemd160@openssh.com'    => RIPEMD160,
+    'none'                          => None
   }
 
-  # add mapping to sha2 hmac algorithms if they're available
-  MAP['hmac-sha2-256']    = SHA2_256    if defined?(::Net::SSH::Transport::HMAC::SHA2_256)
-  MAP['hmac-sha2-256-96'] = SHA2_256_96 if defined?(::Net::SSH::Transport::HMAC::SHA2_256_96)
-  MAP['hmac-sha2-512']    = SHA2_512    if defined?(::Net::SSH::Transport::HMAC::SHA2_512)
-  MAP['hmac-sha2-512-96'] = SHA2_512_96 if defined?(::Net::SSH::Transport::HMAC::SHA2_512_96)
-
   # Retrieves a new hmac instance of the given SSH type (+name+). If +key+ is
   # given, the new instance will be initialized with that key.
   def self.get(name, key="", parameters = {})

data/lib/net/ssh/transport/hmac/abstract.rb

@@ -9,6 +9,18 @@ module Net
         # The base class of all OpenSSL-based HMAC algorithm wrappers.
         class Abstract
           class <<self
+            def etm(*v)
+              @etm = false if !defined?(@etm)
+              if v.empty?
+                @etm = superclass.etm if @etm.nil? && superclass.respond_to?(:etm)
+                return @etm
+              elsif v.length == 1
+                @etm = v.first
+              else
+                raise ArgumentError, "wrong number of arguments (#{v.length} for 1)"
+              end
+            end
+
             def key_length(*v)
               @key_length = nil if !defined?(@key_length)
               if v.empty?
@@ -46,6 +58,10 @@ module Net
             end
           end
 
+          def etm
+            self.class.etm
+          end
+
           def key_length
             self.class.key_length
           end

data/lib/net/ssh/transport/hmac/sha2_256.rb

@@ -1,15 +1,11 @@
 require 'net/ssh/transport/hmac/abstract'
 
-if defined?(OpenSSL::Digest::SHA256) # need openssl support
-  module Net::SSH::Transport::HMAC
-
-    # The SHA-256 HMAC algorithm. This has a mac and key length of 32, and
-    # uses the SHA-256 digest algorithm.
-    class SHA2_256 < Abstract
-      mac_length   32
-      key_length   32
-      digest_class OpenSSL::Digest::SHA256
-    end
-
+module Net::SSH::Transport::HMAC
+  # The SHA-256 HMAC algorithm. This has a mac and key length of 32, and
+  # uses the SHA-256 digest algorithm.
+  class SHA2_256 < Abstract
+    mac_length   32
+    key_length   32
+    digest_class OpenSSL::Digest::SHA256
   end
 end

data/lib/net/ssh/transport/hmac/sha2_256_96.rb

@@ -1,13 +1,9 @@
 require 'net/ssh/transport/hmac/abstract'
 
 module Net::SSH::Transport::HMAC
-
-  if defined?(SHA2_256) # need openssl support
-    # The SHA256-96 HMAC algorithm. This returns only the first 12 bytes of
-    # the digest.
-    class SHA2_256_96 < SHA2_256
-      mac_length 12
-    end
+  # The SHA256-96 HMAC algorithm. This returns only the first 12 bytes of
+  # the digest.
+  class SHA2_256_96 < SHA2_256
+    mac_length 12
   end
-
 end

data/lib/net/ssh/transport/hmac/sha2_256_etm.rb

@@ -0,0 +1,12 @@
+require 'net/ssh/transport/hmac/abstract'
+
+module Net::SSH::Transport::HMAC
+  # The SHA-256 Encrypt-Then-Mac HMAC algorithm. This has a mac and
+  # key length of 32, and uses the SHA-256 digest algorithm.
+  class SHA2_256_Etm < Abstract
+    etm          true
+    mac_length   32
+    key_length   32
+    digest_class OpenSSL::Digest::SHA256
+  end
+end

data/lib/net/ssh/transport/hmac/sha2_512.rb

@@ -1,14 +1,11 @@
 require 'net/ssh/transport/hmac/abstract'
 
 module Net::SSH::Transport::HMAC
-
-  if defined?(OpenSSL::Digest::SHA512) # need openssl support
-    # The SHA-512 HMAC algorithm. This has a mac and key length of 64, and
-    # uses the SHA-512 digest algorithm.
-    class SHA2_512 < Abstract
-      mac_length   64
-      key_length   64
-      digest_class OpenSSL::Digest::SHA512
-    end
+  # The SHA-512 HMAC algorithm. This has a mac and key length of 64, and
+  # uses the SHA-512 digest algorithm.
+  class SHA2_512 < Abstract
+    mac_length   64
+    key_length   64
+    digest_class OpenSSL::Digest::SHA512
   end
 end

data/lib/net/ssh/transport/hmac/sha2_512_96.rb

@@ -1,13 +1,9 @@
 require 'net/ssh/transport/hmac/abstract'
 
 module Net::SSH::Transport::HMAC
-
-  if defined?(SHA2_512) # need openssl support
-    # The SHA2-512-96 HMAC algorithm. This returns only the first 12 bytes of
-    # the digest.
-    class SHA2_512_96 < SHA2_512
-      mac_length 12
-    end
+  # The SHA2-512-96 HMAC algorithm. This returns only the first 12 bytes of
+  # the digest.
+  class SHA2_512_96 < SHA2_512
+    mac_length 12
   end
-
 end

data/lib/net/ssh/transport/hmac/sha2_512_etm.rb

@@ -0,0 +1,12 @@
+require 'net/ssh/transport/hmac/abstract'
+
+module Net::SSH::Transport::HMAC
+  # The SHA-512 Encrypt-Then-Mac HMAC algorithm. This has a mac and
+  # key length of 64, and uses the SHA-512 digest algorithm.
+  class SHA2_512_Etm < Abstract
+    etm          true
+    mac_length   64
+    key_length   64
+    digest_class OpenSSL::Digest::SHA512
+  end
+end

data/lib/net/ssh/transport/kex.rb

@@ -2,25 +2,28 @@ require 'net/ssh/transport/kex/diffie_hellman_group1_sha1'
 require 'net/ssh/transport/kex/diffie_hellman_group14_sha1'
 require 'net/ssh/transport/kex/diffie_hellman_group_exchange_sha1'
 require 'net/ssh/transport/kex/diffie_hellman_group_exchange_sha256'
+require 'net/ssh/transport/kex/ecdh_sha2_nistp256'
+require 'net/ssh/transport/kex/ecdh_sha2_nistp384'
+require 'net/ssh/transport/kex/ecdh_sha2_nistp521'
+require 'net/ssh/transport/kex/curve25519_sha256_loader'
 
 module Net::SSH::Transport
   module Kex
     # Maps the supported key-exchange algorithms as named by the SSH protocol
     # to their corresponding implementors.
     MAP = {
-      'diffie-hellman-group-exchange-sha1' => DiffieHellmanGroupExchangeSHA1,
-      'diffie-hellman-group1-sha1'         => DiffieHellmanGroup1SHA1,
-      'diffie-hellman-group14-sha1'        => DiffieHellmanGroup14SHA1
+      'diffie-hellman-group1-sha1'           => DiffieHellmanGroup1SHA1,
+      'diffie-hellman-group14-sha1'          => DiffieHellmanGroup14SHA1,
+      'diffie-hellman-group-exchange-sha1'   => DiffieHellmanGroupExchangeSHA1,
+      'diffie-hellman-group-exchange-sha256' => DiffieHellmanGroupExchangeSHA256,
+      'ecdh-sha2-nistp256'                   => EcdhSHA2NistP256,
+      'ecdh-sha2-nistp384'                   => EcdhSHA2NistP384,
+      'ecdh-sha2-nistp521'                   => EcdhSHA2NistP521
     }
-    MAP['diffie-hellman-group-exchange-sha256'] = DiffieHellmanGroupExchangeSHA256 if defined?(DiffieHellmanGroupExchangeSHA256)
-    if defined?(OpenSSL::PKey::EC)
-      require 'net/ssh/transport/kex/ecdh_sha2_nistp256'
-      require 'net/ssh/transport/kex/ecdh_sha2_nistp384'
-      require 'net/ssh/transport/kex/ecdh_sha2_nistp521'
 
-      MAP['ecdh-sha2-nistp256'] = EcdhSHA2NistP256
-      MAP['ecdh-sha2-nistp384'] = EcdhSHA2NistP384
-      MAP['ecdh-sha2-nistp521'] = EcdhSHA2NistP521
+    if Net::SSH::Transport::Kex::Curve25519Sha256Loader::LOADED
+      MAP['curve25519-sha256'] = Curve25519Sha256
+      MAP['curve25519-sha256@libssh.org'] = Curve25519Sha256
     end
   end
 end

data/lib/net/ssh/transport/kex/abstract.rb

@@ -0,0 +1,123 @@
+require 'net/ssh/buffer'
+require 'net/ssh/errors'
+require 'net/ssh/loggable'
+require 'net/ssh/transport/openssl'
+require 'net/ssh/transport/constants'
+
+module Net
+  module SSH
+    module Transport
+      module Kex
+        # Abstract class that implement Diffie-Hellman Key Exchange
+        # See https://tools.ietf.org/html/rfc4253#page-21
+        class Abstract
+          include Loggable
+          include Constants
+
+          attr_reader :algorithms
+          attr_reader :connection
+          attr_reader :data
+          attr_reader :dh
+
+          # Create a new instance of the Diffie-Hellman Key Exchange algorithm.
+          # The Diffie-Hellman (DH) key exchange provides a shared secret that
+          # cannot be determined by either party alone.  The key exchange is
+          # combined with a signature with the host key to provide host
+          # authentication.
+          def initialize(algorithms, connection, data)
+            @algorithms = algorithms
+            @connection = connection
+
+            @data = data.dup
+            @dh = generate_key
+            @logger = @data.delete(:logger)
+          end
+
+          # Perform the key-exchange for the given session, with the given
+          # data. This method will return a hash consisting of the
+          # following keys:
+          #
+          # * :session_id
+          # * :server_key
+          # * :shared_secret
+          # * :hashing_algorithm
+          #
+          # The caller is expected to be able to understand how to use these
+          # deliverables.
+          def exchange_keys
+            result = send_kexinit
+            verify_server_key(result[:server_key])
+            session_id = verify_signature(result)
+            confirm_newkeys
+
+            {
+              session_id: session_id,
+              server_key: result[:server_key],
+              shared_secret: result[:shared_secret],
+              hashing_algorithm: digester
+            }
+          end
+
+          def digester
+            raise NotImplementedError, 'abstract class: digester not implemented'
+          end
+
+          private
+
+          # Verify that the given key is of the expected type, and that it
+          # really is the key for the session's host. Raise Net::SSH::Exception
+          # if it is not.
+          def verify_server_key(key) #:nodoc:
+            if key.ssh_type != algorithms.host_key
+              raise Net::SSH::Exception, "host key algorithm mismatch '#{key.ssh_type}' != '#{algorithms.host_key}'"
+            end
+
+            blob, fingerprint = generate_key_fingerprint(key)
+
+            unless connection.host_key_verifier.verify(key: key, key_blob: blob, fingerprint: fingerprint, session: connection)
+              raise Net::SSH::Exception, 'host key verification failed'
+            end
+          end
+
+          def generate_key_fingerprint(key)
+            blob = Net::SSH::Buffer.from(:key, key).to_s
+
+            fingerprint = Net::SSH::Authentication::PubKeyFingerprint.fingerprint(blob, @connection.options[:fingerprint_hash] || 'SHA256')
+
+            [blob, fingerprint]
+          rescue StandardError => e
+            [nil, "(could not generate fingerprint: #{e.message})"]
+          end
+
+          # Verify the signature that was received. Raise Net::SSH::Exception
+          # if the signature could not be verified. Otherwise, return the new
+          # session-id.
+          def verify_signature(result) #:nodoc:
+            response = build_signature_buffer(result)
+
+            hash = digester.digest(response.to_s)
+
+            unless connection.host_key_verifier.verify_signature { result[:server_key].ssh_do_verify(result[:server_sig], hash) }
+              raise Net::SSH::Exception, 'could not verify server signature'
+            end
+
+            hash
+          end
+
+          # Send the NEWKEYS message, and expect the NEWKEYS message in
+          # reply.
+          def confirm_newkeys #:nodoc:
+            # send own NEWKEYS message first (the wodSSHServer won't send first)
+            response = Net::SSH::Buffer.new
+            response.write_byte(NEWKEYS)
+            connection.send_message(response)
+
+            # wait for the server's NEWKEYS message
+            buffer = connection.next_message
+            raise Net::SSH::Exception, 'expected NEWKEYS' unless buffer.type == NEWKEYS
+          end
+        end
+      end
+    end
+  end
+end

data/lib/net/ssh/transport/kex/abstract5656.rb

@@ -0,0 +1,72 @@
+require 'net/ssh/transport/kex/abstract'
+
+module Net
+  module SSH
+    module Transport
+      module Kex
+        # Implement key-exchange algorithm from Elliptic Curve Algorithm Integration
+        # in the Secure Shell Transport Layer (RFC 5656)
+        class Abstract5656 < Abstract
+          alias ecdh dh
+
+          def curve_name
+            raise NotImplementedError, 'abstract class: curve_name not implemented'
+          end
+
+          private
+
+          def get_message_types
+            [KEXECDH_INIT, KEXECDH_REPLY]
+          end
+
+          def build_signature_buffer(result)
+            response = Net::SSH::Buffer.new
+            response.write_string data[:client_version_string],
+                                  data[:server_version_string],
+                                  data[:client_algorithm_packet],
+                                  data[:server_algorithm_packet],
+                                  result[:key_blob],
+                                  ecdh_public_key_bytes,
+                                  result[:server_ecdh_pubkey]
+            response.write_bignum result[:shared_secret]
+            response
+          end
+
+          def send_kexinit #:nodoc:
+            init, reply = get_message_types
+
+            # send the KEXECDH_INIT message
+            ## byte     SSH_MSG_KEX_ECDH_INIT
+            ## string   Q_C, client's ephemeral public key octet string
+            buffer = Net::SSH::Buffer.from(:byte, init, :mstring, ecdh_public_key_bytes)
+            connection.send_message(buffer)
+
+            # expect the following KEXECDH_REPLY message
+            ## byte     SSH_MSG_KEX_ECDH_REPLY
+            ## string   K_S, server's public host key
+            ## string   Q_S, server's ephemeral public key octet string
+            ## string   the signature on the exchange hash
+            buffer = connection.next_message
+            raise Net::SSH::Exception, 'expected REPLY' unless buffer.type == reply
+
+            result = {}
+            result[:key_blob] = buffer.read_string
+            result[:server_key] = Net::SSH::Buffer.new(result[:key_blob]).read_key
+            result[:server_ecdh_pubkey] = buffer.read_string
+            result[:shared_secret] = compute_shared_secret(result[:server_ecdh_pubkey])
+
+            sig_buffer = Net::SSH::Buffer.new(buffer.read_string)
+            sig_type = sig_buffer.read_string
+            if sig_type != algorithms.host_key_format
+              raise Net::SSH::Exception, "host key algorithm mismatch for signature '#{sig_type}' != '#{algorithms.host_key_format}'"
+            end
+
+            result[:server_sig] = sig_buffer.read_string
+
+            result
+          end
+        end
+      end
+    end
+  end
+end

data/lib/net/ssh/transport/kex/curve25519_sha256.rb

@@ -0,0 +1,38 @@
+gem 'x25519' # raise if the gem x25519 is not installed
+
+require 'x25519'
+require 'net/ssh/transport/constants'
+require 'net/ssh/transport/kex/abstract5656'
+
+module Net
+  module SSH
+    module Transport
+      module Kex
+        # A key-exchange service implementing the "curve25519-sha256@libssh.org"
+        # key-exchange algorithm. (defined in https://tools.ietf.org/html/draft-ietf-curdle-ssh-curves-06)
+        class Curve25519Sha256 < Abstract5656
+          def digester
+            OpenSSL::Digest::SHA256
+          end
+
+          private
+
+          def generate_key #:nodoc:
+            ::X25519::Scalar.generate
+          end
+
+          ## string   Q_C, client's ephemeral public key octet string
+          def ecdh_public_key_bytes
+            ecdh.public_key.to_bytes
+          end
+
+          # compute shared secret from server's public key and client's private key
+          def compute_shared_secret(server_ecdh_pubkey)
+            pk = ::X25519::MontgomeryU.new(server_ecdh_pubkey)
+            OpenSSL::BN.new(ecdh.diffie_hellman(pk).to_bytes, 2)
+          end
+        end
+      end
+    end
+  end
+end