super-fast-gem 0.0.1

data/net-ssh-7.3.3/lib/net/ssh/transport/kex/diffie_hellman_group_exchange_sha1.rb

@@ -0,0 +1,72 @@
+require 'net/ssh/errors'
+require 'net/ssh/transport/constants'
+require 'net/ssh/transport/kex/diffie_hellman_group1_sha1'
+
+module Net::SSH::Transport::Kex
+  # A key-exchange service implementing the
+  # "diffie-hellman-group-exchange-sha1" key-exchange algorithm.
+  class DiffieHellmanGroupExchangeSHA1 < DiffieHellmanGroup1SHA1
+    MINIMUM_BITS      = 1024
+    MAXIMUM_BITS      = 8192
+
+    private
+
+    # Compute the number of bits needed for the given number of bytes.
+    def compute_need_bits
+      # for Compatibility: OpenSSH requires (need_bits * 2 + 1) length of parameter
+      need_bits = data[:need_bytes] * 8 * 2 + 1
+
+      data[:minimum_dh_bits] ||= MINIMUM_BITS
+
+      if need_bits < data[:minimum_dh_bits]
+        need_bits = data[:minimum_dh_bits]
+      elsif need_bits > MAXIMUM_BITS
+        need_bits = MAXIMUM_BITS
+      end
+
+      data[:need_bits] = need_bits
+      data[:need_bytes] = need_bits / 8
+    end
+
+    # Returns the DH key parameters for the given session.
+    def get_parameters
+      compute_need_bits
+
+      # request the DH key parameters for the given number of bits.
+      buffer = Net::SSH::Buffer.from(:byte, KEXDH_GEX_REQUEST, :long, data[:minimum_dh_bits],
+                                     :long, data[:need_bits], :long, MAXIMUM_BITS)
+      connection.send_message(buffer)
+
+      buffer = connection.next_message
+      raise Net::SSH::Exception, "expected KEXDH_GEX_GROUP, got #{buffer.type}" unless buffer.type == KEXDH_GEX_GROUP
+
+      p = buffer.read_bignum
+      g = buffer.read_bignum
+
+      [p, g]
+    end
+
+    # Returns the INIT/REPLY constants used by this algorithm.
+    def get_message_types
+      [KEXDH_GEX_INIT, KEXDH_GEX_REPLY]
+    end
+
+    # Build the signature buffer to use when verifying a signature from
+    # the server.
+    def build_signature_buffer(result)
+      response = Net::SSH::Buffer.new
+      response.write_string data[:client_version_string],
+                            data[:server_version_string],
+                            data[:client_algorithm_packet],
+                            data[:server_algorithm_packet],
+                            result[:key_blob]
+      response.write_long MINIMUM_BITS,
+                          data[:need_bits],
+                          MAXIMUM_BITS
+      response.write_bignum dh.p, dh.g, dh.pub_key,
+                            result[:server_dh_pubkey],
+                            result[:shared_secret]
+      response
+    end
+  end
+end

data/net-ssh-7.3.3/lib/net/ssh/transport/kex/diffie_hellman_group_exchange_sha256.rb

@@ -0,0 +1,11 @@
+require 'net/ssh/transport/kex/diffie_hellman_group_exchange_sha1'
+
+module Net::SSH::Transport::Kex
+  # A key-exchange service implementing the
+  # "diffie-hellman-group-exchange-sha256" key-exchange algorithm.
+  class DiffieHellmanGroupExchangeSHA256 < DiffieHellmanGroupExchangeSHA1
+    def digester
+      OpenSSL::Digest::SHA256
+    end
+  end
+end

data/net-ssh-7.3.3/lib/net/ssh/transport/kex/ecdh_sha2_nistp256.rb

@@ -0,0 +1,39 @@
+require 'net/ssh/transport/kex/abstract5656'
+
+module Net
+  module SSH
+    module Transport
+      module Kex
+        # A key-exchange service implementing the "ecdh-sha2-nistp256"
+        # key-exchange algorithm. (defined in RFC 5656)
+        class EcdhSHA2NistP256 < Abstract5656
+          def digester
+            OpenSSL::Digest::SHA256
+          end
+
+          def curve_name
+            OpenSSL::PKey::EC::CurveNameAlias['nistp256']
+          end
+
+          private
+
+          def generate_key # :nodoc:
+            OpenSSL::PKey::EC.generate(curve_name)
+          end
+
+          # compute shared secret from server's public key and client's private key
+          def compute_shared_secret(server_ecdh_pubkey)
+            pk = OpenSSL::PKey::EC::Point.new(OpenSSL::PKey::EC.new(curve_name).group,
+                                              OpenSSL::BN.new(server_ecdh_pubkey, 2))
+            OpenSSL::BN.new(ecdh.dh_compute_key(pk), 2)
+          end
+
+          ## string   Q_C, client's ephemeral public key octet string
+          def ecdh_public_key_bytes
+            ecdh.public_key.to_bn.to_s(2)
+          end
+        end
+      end
+    end
+  end
+end

data/net-ssh-7.3.3/lib/net/ssh/transport/kex/ecdh_sha2_nistp384.rb

@@ -0,0 +1,21 @@
+require 'net/ssh/transport/kex/ecdh_sha2_nistp256'
+
+module Net
+  module SSH
+    module Transport
+      module Kex
+        # A key-exchange service implementing the "ecdh-sha2-nistp256"
+        # key-exchange algorithm. (defined in RFC 5656)
+        class EcdhSHA2NistP384 < EcdhSHA2NistP256
+          def digester
+            OpenSSL::Digest::SHA384
+          end
+
+          def curve_name
+            OpenSSL::PKey::EC::CurveNameAlias['nistp384']
+          end
+        end
+      end
+    end
+  end
+end

data/net-ssh-7.3.3/lib/net/ssh/transport/kex/ecdh_sha2_nistp521.rb

@@ -0,0 +1,21 @@
+require 'net/ssh/transport/kex/ecdh_sha2_nistp256'
+
+module Net
+  module SSH
+    module Transport
+      module Kex
+        # A key-exchange service implementing the "ecdh-sha2-nistp521"
+        # key-exchange algorithm. (defined in RFC 5656)
+        class EcdhSHA2NistP521 < EcdhSHA2NistP256
+          def digester
+            OpenSSL::Digest::SHA512
+          end
+
+          def curve_name
+            OpenSSL::PKey::EC::CurveNameAlias['nistp521']
+          end
+        end
+      end
+    end
+  end
+end

data/net-ssh-7.3.3/lib/net/ssh/transport/kex.rb

@@ -0,0 +1,31 @@
+require 'net/ssh/transport/kex/diffie_hellman_group1_sha1'
+require 'net/ssh/transport/kex/diffie_hellman_group14_sha1'
+require 'net/ssh/transport/kex/diffie_hellman_group14_sha256'
+require 'net/ssh/transport/kex/diffie_hellman_group_exchange_sha1'
+require 'net/ssh/transport/kex/diffie_hellman_group_exchange_sha256'
+require 'net/ssh/transport/kex/ecdh_sha2_nistp256'
+require 'net/ssh/transport/kex/ecdh_sha2_nistp384'
+require 'net/ssh/transport/kex/ecdh_sha2_nistp521'
+require 'net/ssh/transport/kex/curve25519_sha256_loader'
+
+module Net::SSH::Transport
+  module Kex
+    # Maps the supported key-exchange algorithms as named by the SSH protocol
+    # to their corresponding implementors.
+    MAP = {
+      'diffie-hellman-group1-sha1' => DiffieHellmanGroup1SHA1,
+      'diffie-hellman-group14-sha1' => DiffieHellmanGroup14SHA1,
+      'diffie-hellman-group14-sha256' => DiffieHellmanGroup14SHA256,
+      'diffie-hellman-group-exchange-sha1' => DiffieHellmanGroupExchangeSHA1,
+      'diffie-hellman-group-exchange-sha256' => DiffieHellmanGroupExchangeSHA256,
+      'ecdh-sha2-nistp256' => EcdhSHA2NistP256,
+      'ecdh-sha2-nistp384' => EcdhSHA2NistP384,
+      'ecdh-sha2-nistp521' => EcdhSHA2NistP521
+    }
+
+    if Net::SSH::Transport::Kex::Curve25519Sha256Loader::LOADED
+      MAP['curve25519-sha256'] = Curve25519Sha256
+      MAP['curve25519-sha256@libssh.org'] = Curve25519Sha256
+    end
+  end
+end

data/net-ssh-7.3.3/lib/net/ssh/transport/key_expander.rb

@@ -0,0 +1,30 @@
+module Net
+  module SSH
+    module Transport
+      module KeyExpander
+        # Generate a key value in accordance with the SSH2 specification.
+        # (RFC4253 7.2. "Output from Key Exchange")
+        def self.expand_key(bytes, start, options = {})
+          if bytes == 0
+            return ""
+          end
+
+          k = start[0, bytes]
+          return k if k.length >= bytes
+
+          digester = options[:digester] or raise 'No digester supplied'
+          shared   = options[:shared] or raise 'No shared secret supplied'
+          hash     = options[:hash] or raise 'No hash supplied'
+
+          while k.length < bytes
+            step = digester.digest(shared + hash + k)
+            bytes_needed = bytes - k.length
+            k << step[0, bytes_needed]
+          end
+
+          return k
+        end
+      end
+    end
+  end
+end

data/net-ssh-7.3.3/lib/net/ssh/transport/openssl.rb

@@ -0,0 +1,274 @@
+require 'openssl'
+require 'net/ssh/authentication/pub_key_fingerprint'
+
+module OpenSSL
+  # This class is originally defined in the OpenSSL module. As needed, methods
+  # have been added to it by the Net::SSH module for convenience in dealing with
+  # SSH functionality.
+  class BN
+    # Converts a BN object to a string. The format used is that which is
+    # required by the SSH2 protocol.
+    def to_ssh
+      if zero?
+        return [0].pack("N")
+      else
+        buf = to_s(2)
+        if buf.getbyte(0)[7] == 1
+          return [buf.length + 1, 0, buf].pack("NCA*")
+        else
+          return [buf.length, buf].pack("NA*")
+        end
+      end
+    end
+  end
+
+  module PKey
+    class PKey
+      include Net::SSH::Authentication::PubKeyFingerprint
+    end
+
+    # This class is originally defined in the OpenSSL module. As needed, methods
+    # have been added to it by the Net::SSH module for convenience in dealing
+    # with SSH functionality.
+    class DH
+      # Determines whether the pub_key for this key is valid. (This algorithm
+      # lifted more-or-less directly from OpenSSH, dh.c, dh_pub_is_valid.)
+      def valid?
+        return false if pub_key.nil? || pub_key < 0
+
+        bits_set = 0
+        pub_key.num_bits.times { |i| bits_set += 1 if pub_key.bit_set?(i) }
+        return (bits_set > 1 && pub_key < p)
+      end
+    end
+
+    # This class is originally defined in the OpenSSL module. As needed, methods
+    # have been added to it by the Net::SSH module for convenience in dealing
+    # with SSH functionality.
+    class RSA
+      # Returns "ssh-rsa", which is the description of this key type used by the
+      # SSH2 protocol.
+      def ssh_type
+        "ssh-rsa"
+      end
+
+      alias ssh_signature_type ssh_type
+
+      # Converts the key to a blob, according to the SSH2 protocol.
+      def to_blob
+        @blob ||= Net::SSH::Buffer.from(:string, ssh_type, :bignum, e, :bignum, n).to_s
+      end
+
+      # Verifies the given signature matches the given data.
+      def ssh_do_verify(sig, data, options = {})
+        digester =
+          if options[:host_key] == "rsa-sha2-512"
+            OpenSSL::Digest::SHA512.new
+          elsif options[:host_key] == "rsa-sha2-256"
+            OpenSSL::Digest::SHA256.new
+          else
+            OpenSSL::Digest::SHA1.new
+          end
+
+        verify(digester, sig, data)
+      end
+
+      # Returns the signature for the given data.
+      def ssh_do_sign(data, sig_alg = nil)
+        digester =
+          if sig_alg == "rsa-sha2-512"
+            OpenSSL::Digest::SHA512.new
+          elsif sig_alg == "rsa-sha2-256"
+            OpenSSL::Digest::SHA256.new
+          else
+            OpenSSL::Digest::SHA1.new
+          end
+        sign(digester, data)
+      end
+    end
+
+    # This class is originally defined in the OpenSSL module. As needed, methods
+    # have been added to it by the Net::SSH module for convenience in dealing
+    # with SSH functionality.
+    class DSA
+      # Returns "ssh-dss", which is the description of this key type used by the
+      # SSH2 protocol.
+      def ssh_type
+        "ssh-dss"
+      end
+
+      alias ssh_signature_type ssh_type
+
+      # Converts the key to a blob, according to the SSH2 protocol.
+      def to_blob
+        @blob ||= Net::SSH::Buffer.from(:string, ssh_type,
+                                        :bignum, p, :bignum, q, :bignum, g, :bignum, pub_key).to_s
+      end
+
+      # Verifies the given signature matches the given data.
+      def ssh_do_verify(sig, data, options = {})
+        sig_r = sig[0, 20].unpack("H*")[0].to_i(16)
+        sig_s = sig[20, 20].unpack("H*")[0].to_i(16)
+        a1sig = OpenSSL::ASN1::Sequence([
+                                          OpenSSL::ASN1::Integer(sig_r),
+                                          OpenSSL::ASN1::Integer(sig_s)
+                                        ])
+        return verify(OpenSSL::Digest::SHA1.new, a1sig.to_der, data)
+      end
+
+      # Signs the given data.
+      def ssh_do_sign(data, sig_alg = nil)
+        sig = sign(OpenSSL::Digest::SHA1.new, data)
+        a1sig = OpenSSL::ASN1.decode(sig)
+
+        sig_r = a1sig.value[0].value.to_s(2)
+        sig_s = a1sig.value[1].value.to_s(2)
+
+        sig_size = params["q"].num_bits / 8
+        raise OpenSSL::PKey::DSAError, "bad sig size" if sig_r.length > sig_size || sig_s.length > sig_size
+
+        sig_r = "\0" * (20 - sig_r.length) + sig_r if sig_r.length < 20
+        sig_s = "\0" * (20 - sig_s.length) + sig_s if sig_s.length < 20
+
+        return sig_r + sig_s
+      end
+    end
+
+    # This class is originally defined in the OpenSSL module. As needed, methods
+    # have been added to it by the Net::SSH module for convenience in dealing
+    # with SSH functionality.
+    class EC
+      CurveNameAlias = {
+        'nistp256' => 'prime256v1',
+        'nistp384' => 'secp384r1',
+        'nistp521' => 'secp521r1'
+      }.freeze
+
+      CurveNameAliasInv = {
+        'prime256v1' => 'nistp256',
+        'secp384r1' => 'nistp384',
+        'secp521r1' => 'nistp521'
+      }.freeze
+
+      def self.read_keyblob(curve_name_in_type, buffer)
+        curve_name_in_key = buffer.read_string
+
+        unless curve_name_in_type == curve_name_in_key
+          raise Net::SSH::Exception, "curve name mismatched (`#{curve_name_in_key}' with `#{curve_name_in_type}')"
+        end
+
+        public_key_oct = buffer.read_string
+        begin
+          curvename = OpenSSL::PKey::EC::CurveNameAlias[curve_name_in_key]
+          group = OpenSSL::PKey::EC::Group.new(curvename)
+          point = OpenSSL::PKey::EC::Point.new(group, OpenSSL::BN.new(public_key_oct, 2))
+          asn1 = OpenSSL::ASN1::Sequence(
+            [
+              OpenSSL::ASN1::Sequence(
+                [
+                  OpenSSL::ASN1::ObjectId("id-ecPublicKey"),
+                  OpenSSL::ASN1::ObjectId(curvename)
+                ]
+              ),
+              OpenSSL::ASN1::BitString(point.to_octet_string(:uncompressed))
+            ]
+          )
+
+          key = OpenSSL::PKey::EC.new(asn1.to_der)
+
+          return key
+        rescue OpenSSL::PKey::ECError
+          raise NotImplementedError, "unsupported key type `#{type}'"
+        end
+      end
+
+      # Returns the description of this key type used by the
+      # SSH2 protocol, like "ecdsa-sha2-nistp256"
+      def ssh_type
+        "ecdsa-sha2-#{CurveNameAliasInv[group.curve_name]}"
+      end
+
+      alias ssh_signature_type ssh_type
+
+      def digester
+        if group.curve_name =~ /^[a-z]+(\d+)\w*\z/
+          curve_size = Regexp.last_match(1).to_i
+          if curve_size <= 256
+            OpenSSL::Digest::SHA256.new
+          elsif curve_size <= 384
+            OpenSSL::Digest::SHA384.new
+          else
+            OpenSSL::Digest::SHA512.new
+          end
+        else
+          OpenSSL::Digest::SHA256.new
+        end
+      end
+      private :digester
+
+      # Converts the key to a blob, according to the SSH2 protocol.
+      def to_blob
+        @blob ||= Net::SSH::Buffer.from(:string, ssh_type,
+                                        :string, CurveNameAliasInv[group.curve_name],
+                                        :mstring, public_key.to_bn.to_s(2)).to_s
+        @blob
+      end
+
+      # Verifies the given signature matches the given data.
+      def ssh_do_verify(sig, data, options = {})
+        digest = digester.digest(data)
+        a1sig = nil
+
+        begin
+          sig_r_len = sig[0, 4].unpack('H*')[0].to_i(16)
+          sig_l_len = sig[4 + sig_r_len, 4].unpack('H*')[0].to_i(16)
+
+          sig_r = sig[4, sig_r_len].unpack('H*')[0]
+          sig_s = sig[4 + sig_r_len + 4, sig_l_len].unpack('H*')[0]
+
+          a1sig = OpenSSL::ASN1::Sequence([
+                                            OpenSSL::ASN1::Integer(sig_r.to_i(16)),
+                                            OpenSSL::ASN1::Integer(sig_s.to_i(16))
+                                          ])
+        rescue StandardError
+        end
+
+        if a1sig.nil?
+          return false
+        else
+          dsa_verify_asn1(digest, a1sig.to_der)
+        end
+      end
+
+      # Returns the signature for the given data.
+      def ssh_do_sign(data, sig_alg = nil)
+        digest = digester.digest(data)
+        sig = dsa_sign_asn1(digest)
+        a1sig = OpenSSL::ASN1.decode(sig)
+
+        sig_r = a1sig.value[0].value
+        sig_s = a1sig.value[1].value
+
+        Net::SSH::Buffer.from(:bignum, sig_r, :bignum, sig_s).to_s
+      end
+
+      class Point
+        # Returns the description of this key type used by the
+        # SSH2 protocol, like "ecdsa-sha2-nistp256"
+        def ssh_type
+          "ecdsa-sha2-#{CurveNameAliasInv[group.curve_name]}"
+        end
+
+        alias ssh_signature_type ssh_type
+
+        # Converts the key to a blob, according to the SSH2 protocol.
+        def to_blob
+          @blob ||= Net::SSH::Buffer.from(:string, ssh_type,
+                                          :string, CurveNameAliasInv[group.curve_name],
+                                          :mstring, to_bn.to_s(2)).to_s
+          @blob
+        end
+      end
+    end
+  end
+end

data/net-ssh-7.3.3/lib/net/ssh/transport/openssl_cipher_extensions.rb

@@ -0,0 +1,8 @@
+module Net::SSH::Transport
+  # we add those mehtods to OpenSSL::Chipher instances
+  module OpenSSLCipherExtensions
+    def implicit_mac?
+      false
+    end
+  end
+end