agent-skill-manager 1.22.0 → 2.0.0

package/node_modules/ssh2/lib/protocol/kex.js

@@ -1,1908 +0,0 @@
-'use strict';
-
-const {
-  createDiffieHellman,
-  createDiffieHellmanGroup,
-  createECDH,
-  createHash,
-  createPublicKey,
-  diffieHellman,
-  generateKeyPairSync,
-  randomFillSync,
-} = require('crypto');
-
-const { Ber } = require('asn1');
-
-const {
-  COMPAT,
-  curve25519Supported,
-  DEFAULT_KEX,
-  DEFAULT_SERVER_HOST_KEY,
-  DEFAULT_CIPHER,
-  DEFAULT_MAC,
-  DEFAULT_COMPRESSION,
-  DISCONNECT_REASON,
-  MESSAGE,
-} = require('./constants.js');
-const {
-  CIPHER_INFO,
-  createCipher,
-  createDecipher,
-  MAC_INFO,
-} = require('./crypto.js');
-const { parseDERKey } = require('./keyParser.js');
-const {
-  bufferFill,
-  bufferParser,
-  convertSignature,
-  doFatalError,
-  FastBuffer,
-  sigSSHToASN1,
-  writeUInt32BE,
-} = require('./utils.js');
-const {
-  PacketReader,
-  PacketWriter,
-  ZlibPacketReader,
-  ZlibPacketWriter,
-} = require('./zlib.js');
-
-let MESSAGE_HANDLERS;
-
-const GEX_MIN_BITS = 2048; // RFC 8270
-const GEX_MAX_BITS = 8192; // RFC 8270
-
-const EMPTY_BUFFER = Buffer.alloc(0);
-
-// Client/Server
-function kexinit(self) {
-  /*
-    byte         SSH_MSG_KEXINIT
-    byte[16]     cookie (random bytes)
-    name-list    kex_algorithms
-    name-list    server_host_key_algorithms
-    name-list    encryption_algorithms_client_to_server
-    name-list    encryption_algorithms_server_to_client
-    name-list    mac_algorithms_client_to_server
-    name-list    mac_algorithms_server_to_client
-    name-list    compression_algorithms_client_to_server
-    name-list    compression_algorithms_server_to_client
-    name-list    languages_client_to_server
-    name-list    languages_server_to_client
-    boolean      first_kex_packet_follows
-    uint32       0 (reserved for future extension)
-  */
-
-  let payload;
-  if (self._compatFlags & COMPAT.BAD_DHGEX) {
-    const entry = self._offer.lists.kex;
-    let kex = entry.array;
-    let found = false;
-    for (let i = 0; i < kex.length; ++i) {
-      if (kex[i].includes('group-exchange')) {
-        if (!found) {
-          found = true;
-          // Copy array lazily
-          kex = kex.slice();
-        }
-        kex.splice(i--, 1);
-      }
-    }
-    if (found) {
-      let len = 1 + 16 + self._offer.totalSize + 1 + 4;
-      const newKexBuf = Buffer.from(kex.join(','));
-      len -= (entry.buffer.length - newKexBuf.length);
-
-      const all = self._offer.lists.all;
-      const rest = new Uint8Array(
-        all.buffer,
-        all.byteOffset + 4 + entry.buffer.length,
-        all.length - (4 + entry.buffer.length)
-      );
-
-      payload = Buffer.allocUnsafe(len);
-      writeUInt32BE(payload, newKexBuf.length, 17);
-      payload.set(newKexBuf, 17 + 4);
-      payload.set(rest, 17 + 4 + newKexBuf.length);
-    }
-  }
-
-  if (payload === undefined) {
-    payload = Buffer.allocUnsafe(1 + 16 + self._offer.totalSize + 1 + 4);
-    self._offer.copyAllTo(payload, 17);
-  }
-
-  self._debug && self._debug('Outbound: Sending KEXINIT');
-
-  payload[0] = MESSAGE.KEXINIT;
-  randomFillSync(payload, 1, 16);
-
-  // Zero-fill first_kex_packet_follows and reserved bytes
-  bufferFill(payload, 0, payload.length - 5);
-
-  self._kexinit = payload;
-
-  // Needed to correct the starting position in allocated "packets" when packets
-  // will be buffered due to active key exchange
-  self._packetRW.write.allocStart = 0;
-
-  // TODO: only create single buffer and set _kexinit as slice of packet instead
-  {
-    const p = self._packetRW.write.allocStartKEX;
-    const packet = self._packetRW.write.alloc(payload.length, true);
-    packet.set(payload, p);
-    self._cipher.encrypt(self._packetRW.write.finalize(packet, true));
-  }
-}
-
-function handleKexInit(self, payload) {
-  /*
-    byte         SSH_MSG_KEXINIT
-    byte[16]     cookie (random bytes)
-    name-list    kex_algorithms
-    name-list    server_host_key_algorithms
-    name-list    encryption_algorithms_client_to_server
-    name-list    encryption_algorithms_server_to_client
-    name-list    mac_algorithms_client_to_server
-    name-list    mac_algorithms_server_to_client
-    name-list    compression_algorithms_client_to_server
-    name-list    compression_algorithms_server_to_client
-    name-list    languages_client_to_server
-    name-list    languages_server_to_client
-    boolean      first_kex_packet_follows
-    uint32       0 (reserved for future extension)
-  */
-  const init = {
-    kex: undefined,
-    serverHostKey: undefined,
-    cs: {
-      cipher: undefined,
-      mac: undefined,
-      compress: undefined,
-      lang: undefined,
-    },
-    sc: {
-      cipher: undefined,
-      mac: undefined,
-      compress: undefined,
-      lang: undefined,
-    },
-  };
-
-  bufferParser.init(payload, 17);
-
-  if ((init.kex = bufferParser.readList()) === undefined
-      || (init.serverHostKey = bufferParser.readList()) === undefined
-      || (init.cs.cipher = bufferParser.readList()) === undefined
-      || (init.sc.cipher = bufferParser.readList()) === undefined
-      || (init.cs.mac = bufferParser.readList()) === undefined
-      || (init.sc.mac = bufferParser.readList()) === undefined
-      || (init.cs.compress = bufferParser.readList()) === undefined
-      || (init.sc.compress = bufferParser.readList()) === undefined
-      || (init.cs.lang = bufferParser.readList()) === undefined
-      || (init.sc.lang = bufferParser.readList()) === undefined) {
-    bufferParser.clear();
-    return doFatalError(
-      self,
-      'Received malformed KEXINIT',
-      'handshake',
-      DISCONNECT_REASON.KEY_EXCHANGE_FAILED
-    );
-  }
-
-  const pos = bufferParser.pos();
-  const firstFollows = (pos < payload.length && payload[pos] === 1);
-  bufferParser.clear();
-
-  const local = self._offer;
-  const remote = init;
-
-  let localKex = local.lists.kex.array;
-  if (self._compatFlags & COMPAT.BAD_DHGEX) {
-    let found = false;
-    for (let i = 0; i < localKex.length; ++i) {
-      if (localKex[i].indexOf('group-exchange') !== -1) {
-        if (!found) {
-          found = true;
-          // Copy array lazily
-          localKex = localKex.slice();
-        }
-        localKex.splice(i--, 1);
-      }
-    }
-  }
-
-  let clientList;
-  let serverList;
-  let i;
-  const debug = self._debug;
-
-  debug && debug('Inbound: Handshake in progress');
-
-  // Key exchange method =======================================================
-  debug && debug(`Handshake: (local) KEX method: ${localKex}`);
-  debug && debug(`Handshake: (remote) KEX method: ${remote.kex}`);
-  let remoteExtInfoEnabled;
-  if (self._server) {
-    serverList = localKex;
-    clientList = remote.kex;
-    remoteExtInfoEnabled = (clientList.indexOf('ext-info-c') !== -1);
-  } else {
-    serverList = remote.kex;
-    clientList = localKex;
-    remoteExtInfoEnabled = (serverList.indexOf('ext-info-s') !== -1);
-  }
-  if (self._strictMode === undefined) {
-    if (self._server) {
-      self._strictMode =
-        (clientList.indexOf('kex-strict-c-v00@openssh.com') !== -1);
-    } else {
-      self._strictMode =
-        (serverList.indexOf('kex-strict-s-v00@openssh.com') !== -1);
-    }
-    // Note: We check for seqno of 1 instead of 0 since we increment before
-    //       calling the packet handler
-    if (self._strictMode) {
-      debug && debug('Handshake: strict KEX mode enabled');
-      if (self._decipher.inSeqno !== 1) {
-        if (debug)
-          debug('Handshake: KEXINIT not first packet in strict KEX mode');
-        return doFatalError(
-          self,
-          'Handshake failed: KEXINIT not first packet in strict KEX mode',
-          'handshake',
-          DISCONNECT_REASON.KEY_EXCHANGE_FAILED
-        );
-      }
-    }
-  }
-  // Check for agreeable key exchange algorithm
-  for (i = 0;
-       i < clientList.length && serverList.indexOf(clientList[i]) === -1;
-       ++i);
-  if (i === clientList.length) {
-    // No suitable match found!
-    debug && debug('Handshake: no matching key exchange algorithm');
-    return doFatalError(
-      self,
-      'Handshake failed: no matching key exchange algorithm',
-      'handshake',
-      DISCONNECT_REASON.KEY_EXCHANGE_FAILED
-    );
-  }
-  init.kex = clientList[i];
-  debug && debug(`Handshake: KEX algorithm: ${clientList[i]}`);
-  if (firstFollows && (!remote.kex.length || clientList[i] !== remote.kex[0])) {
-    // Ignore next inbound packet, it was a wrong first guess at KEX algorithm
-    self._skipNextInboundPacket = true;
-  }
-
-
-  // Server host key format ====================================================
-  const localSrvHostKey = local.lists.serverHostKey.array;
-  debug && debug(`Handshake: (local) Host key format: ${localSrvHostKey}`);
-  debug && debug(
-    `Handshake: (remote) Host key format: ${remote.serverHostKey}`
-  );
-  if (self._server) {
-    serverList = localSrvHostKey;
-    clientList = remote.serverHostKey;
-  } else {
-    serverList = remote.serverHostKey;
-    clientList = localSrvHostKey;
-  }
-  // Check for agreeable server host key format
-  for (i = 0;
-       i < clientList.length && serverList.indexOf(clientList[i]) === -1;
-       ++i);
-  if (i === clientList.length) {
-    // No suitable match found!
-    debug && debug('Handshake: No matching host key format');
-    return doFatalError(
-      self,
-      'Handshake failed: no matching host key format',
-      'handshake',
-      DISCONNECT_REASON.KEY_EXCHANGE_FAILED
-    );
-  }
-  init.serverHostKey = clientList[i];
-  debug && debug(`Handshake: Host key format: ${clientList[i]}`);
-
-
-  // Client->Server cipher =====================================================
-  const localCSCipher = local.lists.cs.cipher.array;
-  debug && debug(`Handshake: (local) C->S cipher: ${localCSCipher}`);
-  debug && debug(`Handshake: (remote) C->S cipher: ${remote.cs.cipher}`);
-  if (self._server) {
-    serverList = localCSCipher;
-    clientList = remote.cs.cipher;
-  } else {
-    serverList = remote.cs.cipher;
-    clientList = localCSCipher;
-  }
-  // Check for agreeable client->server cipher
-  for (i = 0;
-       i < clientList.length && serverList.indexOf(clientList[i]) === -1;
-       ++i);
-  if (i === clientList.length) {
-    // No suitable match found!
-    debug && debug('Handshake: No matching C->S cipher');
-    return doFatalError(
-      self,
-      'Handshake failed: no matching C->S cipher',
-      'handshake',
-      DISCONNECT_REASON.KEY_EXCHANGE_FAILED
-    );
-  }
-  init.cs.cipher = clientList[i];
-  debug && debug(`Handshake: C->S Cipher: ${clientList[i]}`);
-
-
-  // Server->Client cipher =====================================================
-  const localSCCipher = local.lists.sc.cipher.array;
-  debug && debug(`Handshake: (local) S->C cipher: ${localSCCipher}`);
-  debug && debug(`Handshake: (remote) S->C cipher: ${remote.sc.cipher}`);
-  if (self._server) {
-    serverList = localSCCipher;
-    clientList = remote.sc.cipher;
-  } else {
-    serverList = remote.sc.cipher;
-    clientList = localSCCipher;
-  }
-  // Check for agreeable server->client cipher
-  for (i = 0;
-       i < clientList.length && serverList.indexOf(clientList[i]) === -1;
-       ++i);
-  if (i === clientList.length) {
-    // No suitable match found!
-    debug && debug('Handshake: No matching S->C cipher');
-    return doFatalError(
-      self,
-      'Handshake failed: no matching S->C cipher',
-      'handshake',
-      DISCONNECT_REASON.KEY_EXCHANGE_FAILED
-    );
-  }
-  init.sc.cipher = clientList[i];
-  debug && debug(`Handshake: S->C cipher: ${clientList[i]}`);
-
-
-  // Client->Server MAC ========================================================
-  const localCSMAC = local.lists.cs.mac.array;
-  debug && debug(`Handshake: (local) C->S MAC: ${localCSMAC}`);
-  debug && debug(`Handshake: (remote) C->S MAC: ${remote.cs.mac}`);
-  if (CIPHER_INFO[init.cs.cipher].authLen > 0) {
-    init.cs.mac = '';
-    debug && debug('Handshake: C->S MAC: <implicit>');
-  } else {
-    if (self._server) {
-      serverList = localCSMAC;
-      clientList = remote.cs.mac;
-    } else {
-      serverList = remote.cs.mac;
-      clientList = localCSMAC;
-    }
-    // Check for agreeable client->server hmac algorithm
-    for (i = 0;
-         i < clientList.length && serverList.indexOf(clientList[i]) === -1;
-         ++i);
-    if (i === clientList.length) {
-      // No suitable match found!
-      debug && debug('Handshake: No matching C->S MAC');
-      return doFatalError(
-        self,
-        'Handshake failed: no matching C->S MAC',
-        'handshake',
-        DISCONNECT_REASON.KEY_EXCHANGE_FAILED
-      );
-    }
-    init.cs.mac = clientList[i];
-    debug && debug(`Handshake: C->S MAC: ${clientList[i]}`);
-  }
-
-
-  // Server->Client MAC ========================================================
-  const localSCMAC = local.lists.sc.mac.array;
-  debug && debug(`Handshake: (local) S->C MAC: ${localSCMAC}`);
-  debug && debug(`Handshake: (remote) S->C MAC: ${remote.sc.mac}`);
-  if (CIPHER_INFO[init.sc.cipher].authLen > 0) {
-    init.sc.mac = '';
-    debug && debug('Handshake: S->C MAC: <implicit>');
-  } else {
-    if (self._server) {
-      serverList = localSCMAC;
-      clientList = remote.sc.mac;
-    } else {
-      serverList = remote.sc.mac;
-      clientList = localSCMAC;
-    }
-    // Check for agreeable server->client hmac algorithm
-    for (i = 0;
-         i < clientList.length && serverList.indexOf(clientList[i]) === -1;
-         ++i);
-    if (i === clientList.length) {
-      // No suitable match found!
-      debug && debug('Handshake: No matching S->C MAC');
-      return doFatalError(
-        self,
-        'Handshake failed: no matching S->C MAC',
-        'handshake',
-        DISCONNECT_REASON.KEY_EXCHANGE_FAILED
-      );
-    }
-    init.sc.mac = clientList[i];
-    debug && debug(`Handshake: S->C MAC: ${clientList[i]}`);
-  }
-
-
-  // Client->Server compression ================================================
-  const localCSCompress = local.lists.cs.compress.array;
-  debug && debug(`Handshake: (local) C->S compression: ${localCSCompress}`);
-  debug && debug(`Handshake: (remote) C->S compression: ${remote.cs.compress}`);
-  if (self._server) {
-    serverList = localCSCompress;
-    clientList = remote.cs.compress;
-  } else {
-    serverList = remote.cs.compress;
-    clientList = localCSCompress;
-  }
-  // Check for agreeable client->server compression algorithm
-  for (i = 0;
-       i < clientList.length && serverList.indexOf(clientList[i]) === -1;
-       ++i);
-  if (i === clientList.length) {
-    // No suitable match found!
-    debug && debug('Handshake: No matching C->S compression');
-    return doFatalError(
-      self,
-      'Handshake failed: no matching C->S compression',
-      'handshake',
-      DISCONNECT_REASON.KEY_EXCHANGE_FAILED
-    );
-  }
-  init.cs.compress = clientList[i];
-  debug && debug(`Handshake: C->S compression: ${clientList[i]}`);
-
-
-  // Server->Client compression ================================================
-  const localSCCompress = local.lists.sc.compress.array;
-  debug && debug(`Handshake: (local) S->C compression: ${localSCCompress}`);
-  debug && debug(`Handshake: (remote) S->C compression: ${remote.sc.compress}`);
-  if (self._server) {
-    serverList = localSCCompress;
-    clientList = remote.sc.compress;
-  } else {
-    serverList = remote.sc.compress;
-    clientList = localSCCompress;
-  }
-  // Check for agreeable server->client compression algorithm
-  for (i = 0;
-       i < clientList.length && serverList.indexOf(clientList[i]) === -1;
-       ++i);
-  if (i === clientList.length) {
-    // No suitable match found!
-    debug && debug('Handshake: No matching S->C compression');
-    return doFatalError(
-      self,
-      'Handshake failed: no matching S->C compression',
-      'handshake',
-      DISCONNECT_REASON.KEY_EXCHANGE_FAILED
-    );
-  }
-  init.sc.compress = clientList[i];
-  debug && debug(`Handshake: S->C compression: ${clientList[i]}`);
-
-  init.cs.lang = '';
-  init.sc.lang = '';
-
-  // XXX: hack -- find a better way to do this
-  if (self._kex) {
-    if (!self._kexinit) {
-      // We received a rekey request, but we haven't sent a KEXINIT in response
-      // yet
-      kexinit(self);
-    }
-    self._decipher._onPayload = onKEXPayload.bind(self, { firstPacket: false });
-  }
-
-  self._kex = createKeyExchange(init, self, payload);
-  self._kex.remoteExtInfoEnabled = remoteExtInfoEnabled;
-  self._kex.start();
-}
-
-const createKeyExchange = (() => {
-  function convertToMpint(buf) {
-    let idx = 0;
-    let length = buf.length;
-    while (buf[idx] === 0x00) {
-      ++idx;
-      --length;
-    }
-    let newBuf;
-    if (buf[idx] & 0x80) {
-      newBuf = Buffer.allocUnsafe(1 + length);
-      newBuf[0] = 0;
-      buf.copy(newBuf, 1, idx);
-      buf = newBuf;
-    } else if (length !== buf.length) {
-      newBuf = Buffer.allocUnsafe(length);
-      buf.copy(newBuf, 0, idx);
-      buf = newBuf;
-    }
-    return buf;
-  }
-
-  class KeyExchange {
-    constructor(negotiated, protocol, remoteKexinit) {
-      this._protocol = protocol;
-
-      this.sessionID = (protocol._kex ? protocol._kex.sessionID : undefined);
-      this.negotiated = negotiated;
-      this.remoteExtInfoEnabled = false;
-      this._step = 1;
-      this._public = null;
-      this._dh = null;
-      this._sentNEWKEYS = false;
-      this._receivedNEWKEYS = false;
-      this._finished = false;
-      this._hostVerified = false;
-
-      // Data needed for initializing cipher/decipher/etc.
-      this._kexinit = protocol._kexinit;
-      this._remoteKexinit = remoteKexinit;
-      this._identRaw = protocol._identRaw;
-      this._remoteIdentRaw = protocol._remoteIdentRaw;
-      this._hostKey = undefined;
-      this._dhData = undefined;
-      this._sig = undefined;
-    }
-    finish(scOnly) {
-      if (this._finished)
-        return false;
-      this._finished = true;
-
-      const isServer = this._protocol._server;
-      const negotiated = this.negotiated;
-
-      const pubKey = this.convertPublicKey(this._dhData);
-      let secret = this.computeSecret(this._dhData);
-      if (secret instanceof Error) {
-        secret.message =
-          `Error while computing DH secret (${this.type}): ${secret.message}`;
-        secret.level = 'handshake';
-        return doFatalError(
-          this._protocol,
-          secret,
-          DISCONNECT_REASON.KEY_EXCHANGE_FAILED
-        );
-      }
-
-      const hash = createHash(this.hashName);
-      // V_C
-      hashString(hash, (isServer ? this._remoteIdentRaw : this._identRaw));
-      // "V_S"
-      hashString(hash, (isServer ? this._identRaw : this._remoteIdentRaw));
-      // "I_C"
-      hashString(hash, (isServer ? this._remoteKexinit : this._kexinit));
-      // "I_S"
-      hashString(hash, (isServer ? this._kexinit : this._remoteKexinit));
-      // "K_S"
-      const serverPublicHostKey = (isServer
-                                   ? this._hostKey.getPublicSSH()
-                                   : this._hostKey);
-      hashString(hash, serverPublicHostKey);
-
-      if (this.type === 'groupex') {
-        // Group exchange-specific
-        const params = this.getDHParams();
-        const num = Buffer.allocUnsafe(4);
-        // min (uint32)
-        writeUInt32BE(num, this._minBits, 0);
-        hash.update(num);
-        // preferred (uint32)
-        writeUInt32BE(num, this._prefBits, 0);
-        hash.update(num);
-        // max (uint32)
-        writeUInt32BE(num, this._maxBits, 0);
-        hash.update(num);
-        // prime
-        hashString(hash, params.prime);
-        // generator
-        hashString(hash, params.generator);
-      }
-
-      // method-specific data sent by client
-      hashString(hash, (isServer ? pubKey : this.getPublicKey()));
-      // method-specific data sent by server
-      const serverPublicKey = (isServer ? this.getPublicKey() : pubKey);
-      hashString(hash, serverPublicKey);
-      // shared secret ("K")
-      hashString(hash, secret);
-
-      // "H"
-      const exchangeHash = hash.digest();
-
-      if (!isServer) {
-        bufferParser.init(this._sig, 0);
-        const sigType = bufferParser.readString(true);
-
-        if (!sigType) {
-          return doFatalError(
-            this._protocol,
-            'Malformed packet while reading signature',
-            'handshake',
-            DISCONNECT_REASON.KEY_EXCHANGE_FAILED
-          );
-        }
-
-        if (sigType !== negotiated.serverHostKey) {
-          return doFatalError(
-            this._protocol,
-            `Wrong signature type: ${sigType}, `
-              + `expected: ${negotiated.serverHostKey}`,
-            'handshake',
-            DISCONNECT_REASON.KEY_EXCHANGE_FAILED
-          );
-        }
-
-        // "s"
-        let sigValue = bufferParser.readString();
-
-        bufferParser.clear();
-
-        if (sigValue === undefined) {
-          return doFatalError(
-            this._protocol,
-            'Malformed packet while reading signature',
-            'handshake',
-            DISCONNECT_REASON.KEY_EXCHANGE_FAILED
-          );
-        }
-
-        if (!(sigValue = sigSSHToASN1(sigValue, sigType))) {
-          return doFatalError(
-            this._protocol,
-            'Malformed signature',
-            'handshake',
-            DISCONNECT_REASON.KEY_EXCHANGE_FAILED
-          );
-        }
-
-        let parsedHostKey;
-        {
-          bufferParser.init(this._hostKey, 0);
-          const name = bufferParser.readString(true);
-          const hostKey = this._hostKey.slice(bufferParser.pos());
-          bufferParser.clear();
-          parsedHostKey = parseDERKey(hostKey, name);
-          if (parsedHostKey instanceof Error) {
-            parsedHostKey.level = 'handshake';
-            return doFatalError(
-              this._protocol,
-              parsedHostKey,
-              DISCONNECT_REASON.KEY_EXCHANGE_FAILED
-            );
-          }
-        }
-
-        let hashAlgo;
-        // Check if we need to override the default hash algorithm
-        switch (this.negotiated.serverHostKey) {
-          case 'rsa-sha2-256': hashAlgo = 'sha256'; break;
-          case 'rsa-sha2-512': hashAlgo = 'sha512'; break;
-        }
-
-        this._protocol._debug
-          && this._protocol._debug('Verifying signature ...');
-
-        const verified = parsedHostKey.verify(exchangeHash, sigValue, hashAlgo);
-        if (verified !== true) {
-          if (verified instanceof Error) {
-            this._protocol._debug && this._protocol._debug(
-              `Signature verification failed: ${verified.stack}`
-            );
-          } else {
-            this._protocol._debug && this._protocol._debug(
-              'Signature verification failed'
-            );
-          }
-          return doFatalError(
-            this._protocol,
-            'Handshake failed: signature verification failed',
-            'handshake',
-            DISCONNECT_REASON.KEY_EXCHANGE_FAILED
-          );
-        }
-        this._protocol._debug && this._protocol._debug('Verified signature');
-      } else {
-        // Server
-
-        let hashAlgo;
-        // Check if we need to override the default hash algorithm
-        switch (this.negotiated.serverHostKey) {
-          case 'rsa-sha2-256': hashAlgo = 'sha256'; break;
-          case 'rsa-sha2-512': hashAlgo = 'sha512'; break;
-        }
-
-        this._protocol._debug && this._protocol._debug(
-          'Generating signature ...'
-        );
-
-        let signature = this._hostKey.sign(exchangeHash, hashAlgo);
-        if (signature instanceof Error) {
-          return doFatalError(
-            this._protocol,
-            'Handshake failed: signature generation failed for '
-              + `${this._hostKey.type} host key: ${signature.message}`,
-            'handshake',
-            DISCONNECT_REASON.KEY_EXCHANGE_FAILED
-          );
-        }
-
-        signature = convertSignature(signature, this._hostKey.type);
-        if (signature === false) {
-          return doFatalError(
-            this._protocol,
-            'Handshake failed: signature conversion failed for '
-              + `${this._hostKey.type} host key`,
-            'handshake',
-            DISCONNECT_REASON.KEY_EXCHANGE_FAILED
-          );
-        }
-
-        // Send KEX reply
-        /*
-          byte      SSH_MSG_KEXDH_REPLY
-                      / SSH_MSG_KEX_DH_GEX_REPLY
-                      / SSH_MSG_KEX_ECDH_REPLY
-          string    server public host key and certificates (K_S)
-          string    <method-specific data>
-          string    signature of H
-        */
-        const sigType = this.negotiated.serverHostKey;
-        const sigTypeLen = Buffer.byteLength(sigType);
-        const sigLen = 4 + sigTypeLen + 4 + signature.length;
-        let p = this._protocol._packetRW.write.allocStartKEX;
-        const packet = this._protocol._packetRW.write.alloc(
-          1
-            + 4 + serverPublicHostKey.length
-            + 4 + serverPublicKey.length
-            + 4 + sigLen,
-          true
-        );
-
-        packet[p] = MESSAGE.KEXDH_REPLY;
-
-        writeUInt32BE(packet, serverPublicHostKey.length, ++p);
-        packet.set(serverPublicHostKey, p += 4);
-
-        writeUInt32BE(packet,
-                      serverPublicKey.length,
-                      p += serverPublicHostKey.length);
-        packet.set(serverPublicKey, p += 4);
-
-        writeUInt32BE(packet, sigLen, p += serverPublicKey.length);
-
-        writeUInt32BE(packet, sigTypeLen, p += 4);
-        packet.utf8Write(sigType, p += 4, sigTypeLen);
-
-        writeUInt32BE(packet, signature.length, p += sigTypeLen);
-        packet.set(signature, p += 4);
-
-        if (this._protocol._debug) {
-          let type;
-          switch (this.type) {
-            case 'group':
-              type = 'KEXDH_REPLY';
-              break;
-            case 'groupex':
-              type = 'KEXDH_GEX_REPLY';
-              break;
-            default:
-              type = 'KEXECDH_REPLY';
-          }
-          this._protocol._debug(`Outbound: Sending ${type}`);
-        }
-        this._protocol._cipher.encrypt(
-          this._protocol._packetRW.write.finalize(packet, true)
-        );
-      }
-
-      if (isServer || !scOnly)
-        trySendNEWKEYS(this);
-
-      let hsCipherConfig;
-      let hsWrite;
-      const completeHandshake = (partial) => {
-        if (hsCipherConfig) {
-          trySendNEWKEYS(this);
-          hsCipherConfig.outbound.seqno = this._protocol._cipher.outSeqno;
-          this._protocol._cipher.free();
-          this._protocol._cipher = createCipher(hsCipherConfig);
-          this._protocol._packetRW.write = hsWrite;
-          hsCipherConfig = undefined;
-          hsWrite = undefined;
-          this._protocol._onHandshakeComplete(negotiated);
-
-          return false;
-        }
-
-        if (!this.sessionID)
-          this.sessionID = exchangeHash;
-
-        {
-          const newSecret = Buffer.allocUnsafe(4 + secret.length);
-          writeUInt32BE(newSecret, secret.length, 0);
-          newSecret.set(secret, 4);
-          secret = newSecret;
-        }
-
-        // Initialize new ciphers, deciphers, etc.
-
-        const csCipherInfo = CIPHER_INFO[negotiated.cs.cipher];
-        const scCipherInfo = CIPHER_INFO[negotiated.sc.cipher];
-
-        const csIV = generateKEXVal(csCipherInfo.ivLen,
-                                    this.hashName,
-                                    secret,
-                                    exchangeHash,
-                                    this.sessionID,
-                                    'A');
-        const scIV = generateKEXVal(scCipherInfo.ivLen,
-                                    this.hashName,
-                                    secret,
-                                    exchangeHash,
-                                    this.sessionID,
-                                    'B');
-        const csKey = generateKEXVal(csCipherInfo.keyLen,
-                                     this.hashName,
-                                     secret,
-                                     exchangeHash,
-                                     this.sessionID,
-                                     'C');
-        const scKey = generateKEXVal(scCipherInfo.keyLen,
-                                     this.hashName,
-                                     secret,
-                                     exchangeHash,
-                                     this.sessionID,
-                                     'D');
-        let csMacInfo;
-        let csMacKey;
-        if (!csCipherInfo.authLen) {
-          csMacInfo = MAC_INFO[negotiated.cs.mac];
-          csMacKey = generateKEXVal(csMacInfo.len,
-                                    this.hashName,
-                                    secret,
-                                    exchangeHash,
-                                    this.sessionID,
-                                    'E');
-        }
-        let scMacInfo;
-        let scMacKey;
-        if (!scCipherInfo.authLen) {
-          scMacInfo = MAC_INFO[negotiated.sc.mac];
-          scMacKey = generateKEXVal(scMacInfo.len,
-                                    this.hashName,
-                                    secret,
-                                    exchangeHash,
-                                    this.sessionID,
-                                    'F');
-        }
-
-        const config = {
-          inbound: {
-            onPayload: this._protocol._onPayload,
-            seqno: this._protocol._decipher.inSeqno,
-            decipherInfo: (!isServer ? scCipherInfo : csCipherInfo),
-            decipherIV: (!isServer ? scIV : csIV),
-            decipherKey: (!isServer ? scKey : csKey),
-            macInfo: (!isServer ? scMacInfo : csMacInfo),
-            macKey: (!isServer ? scMacKey : csMacKey),
-          },
-          outbound: {
-            onWrite: this._protocol._onWrite,
-            seqno: this._protocol._cipher.outSeqno,
-            cipherInfo: (isServer ? scCipherInfo : csCipherInfo),
-            cipherIV: (isServer ? scIV : csIV),
-            cipherKey: (isServer ? scKey : csKey),
-            macInfo: (isServer ? scMacInfo : csMacInfo),
-            macKey: (isServer ? scMacKey : csMacKey),
-          },
-        };
-        this._protocol._decipher.free();
-        hsCipherConfig = config;
-        this._protocol._decipher = createDecipher(config);
-
-        const rw = {
-          read: undefined,
-          write: undefined,
-        };
-        switch (negotiated.cs.compress) {
-          case 'zlib': // starts immediately
-            if (isServer)
-              rw.read = new ZlibPacketReader();
-            else
-              rw.write = new ZlibPacketWriter(this._protocol);
-            break;
-          case 'zlib@openssh.com':
-            // Starts after successful user authentication
-
-            if (this._protocol._authenticated) {
-              // If a rekey happens and this compression method is selected and
-              // we already authenticated successfully, we need to start
-              // immediately instead
-              if (isServer)
-                rw.read = new ZlibPacketReader();
-              else
-                rw.write = new ZlibPacketWriter(this._protocol);
-              break;
-            }
-          // FALLTHROUGH
-          default:
-            // none -- never any compression/decompression
-
-            if (isServer)
-              rw.read = new PacketReader();
-            else
-              rw.write = new PacketWriter(this._protocol);
-        }
-        switch (negotiated.sc.compress) {
-          case 'zlib': // starts immediately
-            if (isServer)
-              rw.write = new ZlibPacketWriter(this._protocol);
-            else
-              rw.read = new ZlibPacketReader();
-            break;
-          case 'zlib@openssh.com':
-            // Starts after successful user authentication
-
-            if (this._protocol._authenticated) {
-              // If a rekey happens and this compression method is selected and
-              // we already authenticated successfully, we need to start
-              // immediately instead
-              if (isServer)
-                rw.write = new ZlibPacketWriter(this._protocol);
-              else
-                rw.read = new ZlibPacketReader();
-              break;
-            }
-          // FALLTHROUGH
-          default:
-            // none -- never any compression/decompression
-
-            if (isServer)
-              rw.write = new PacketWriter(this._protocol);
-            else
-              rw.read = new PacketReader();
-        }
-        this._protocol._packetRW.read.cleanup();
-        this._protocol._packetRW.write.cleanup();
-        this._protocol._packetRW.read = rw.read;
-        hsWrite = rw.write;
-
-        // Cleanup/reset various state
-        this._public = null;
-        this._dh = null;
-        this._kexinit = this._protocol._kexinit = undefined;
-        this._remoteKexinit = undefined;
-        this._identRaw = undefined;
-        this._remoteIdentRaw = undefined;
-        this._hostKey = undefined;
-        this._dhData = undefined;
-        this._sig = undefined;
-
-        if (!partial)
-          return completeHandshake();
-        return false;
-      };
-
-      if (isServer || scOnly)
-        this.finish = completeHandshake;
-
-      if (!isServer)
-        return completeHandshake(scOnly);
-    }
-
-    start() {
-      if (!this._protocol._server) {
-        if (this._protocol._debug) {
-          let type;
-          switch (this.type) {
-            case 'group':
-              type = 'KEXDH_INIT';
-              break;
-            default:
-              type = 'KEXECDH_INIT';
-          }
-          this._protocol._debug(`Outbound: Sending ${type}`);
-        }
-
-        const pubKey = this.getPublicKey();
-
-        let p = this._protocol._packetRW.write.allocStartKEX;
-        const packet = this._protocol._packetRW.write.alloc(
-          1 + 4 + pubKey.length,
-          true
-        );
-        packet[p] = MESSAGE.KEXDH_INIT;
-        writeUInt32BE(packet, pubKey.length, ++p);
-        packet.set(pubKey, p += 4);
-        this._protocol._cipher.encrypt(
-          this._protocol._packetRW.write.finalize(packet, true)
-        );
-      }
-    }
-    getPublicKey() {
-      this.generateKeys();
-
-      const key = this._public;
-
-      if (key)
-        return this.convertPublicKey(key);
-    }
-    convertPublicKey(key) {
-      let newKey;
-      let idx = 0;
-      let len = key.length;
-      while (key[idx] === 0x00) {
-        ++idx;
-        --len;
-      }
-
-      if (key[idx] & 0x80) {
-        newKey = Buffer.allocUnsafe(1 + len);
-        newKey[0] = 0;
-        key.copy(newKey, 1, idx);
-        return newKey;
-      }
-
-      if (len !== key.length) {
-        newKey = Buffer.allocUnsafe(len);
-        key.copy(newKey, 0, idx);
-        key = newKey;
-      }
-      return key;
-    }
-    computeSecret(otherPublicKey) {
-      this.generateKeys();
-
-      try {
-        return convertToMpint(this._dh.computeSecret(otherPublicKey));
-      } catch (ex) {
-        return ex;
-      }
-    }
-    parse(payload) {
-      const type = payload[0];
-      switch (this._step) {
-        case 1:
-          if (this._protocol._server) {
-            // Server
-            if (type !== MESSAGE.KEXDH_INIT) {
-              return doFatalError(
-                this._protocol,
-                `Received packet ${type} instead of ${MESSAGE.KEXDH_INIT}`,
-                'handshake',
-                DISCONNECT_REASON.KEY_EXCHANGE_FAILED
-              );
-            }
-            this._protocol._debug && this._protocol._debug(
-              'Received DH Init'
-            );
-            /*
-              byte     SSH_MSG_KEXDH_INIT
-                         / SSH_MSG_KEX_ECDH_INIT
-              string   <method-specific data>
-            */
-            bufferParser.init(payload, 1);
-            const dhData = bufferParser.readString();
-            bufferParser.clear();
-            if (dhData === undefined) {
-              return doFatalError(
-                this._protocol,
-                'Received malformed KEX*_INIT',
-                'handshake',
-                DISCONNECT_REASON.KEY_EXCHANGE_FAILED
-              );
-            }
-
-            // Client public key
-            this._dhData = dhData;
-
-            let hostKey =
-              this._protocol._hostKeys[this.negotiated.serverHostKey];
-            if (Array.isArray(hostKey))
-              hostKey = hostKey[0];
-            this._hostKey = hostKey;
-
-            this.finish();
-          } else {
-            // Client
-            if (type !== MESSAGE.KEXDH_REPLY) {
-              return doFatalError(
-                this._protocol,
-                `Received packet ${type} instead of ${MESSAGE.KEXDH_REPLY}`,
-                'handshake',
-                DISCONNECT_REASON.KEY_EXCHANGE_FAILED
-              );
-            }
-            this._protocol._debug && this._protocol._debug(
-              'Received DH Reply'
-            );
-            /*
-              byte      SSH_MSG_KEXDH_REPLY
-                          / SSH_MSG_KEX_DH_GEX_REPLY
-                          / SSH_MSG_KEX_ECDH_REPLY
-              string    server public host key and certificates (K_S)
-              string    <method-specific data>
-              string    signature of H
-            */
-            bufferParser.init(payload, 1);
-            let hostPubKey;
-            let dhData;
-            let sig;
-            if ((hostPubKey = bufferParser.readString()) === undefined
-                || (dhData = bufferParser.readString()) === undefined
-                || (sig = bufferParser.readString()) === undefined) {
-              bufferParser.clear();
-              return doFatalError(
-                this._protocol,
-                'Received malformed KEX*_REPLY',
-                'handshake',
-                DISCONNECT_REASON.KEY_EXCHANGE_FAILED
-              );
-            }
-            bufferParser.clear();
-
-            // Check that the host public key type matches what was negotiated
-            // during KEXINIT swap
-            bufferParser.init(hostPubKey, 0);
-            const hostPubKeyType = bufferParser.readString(true);
-            bufferParser.clear();
-            if (hostPubKeyType === undefined) {
-              return doFatalError(
-                this._protocol,
-                'Received malformed host public key',
-                'handshake',
-                DISCONNECT_REASON.KEY_EXCHANGE_FAILED
-              );
-            }
-            if (hostPubKeyType !== this.negotiated.serverHostKey) {
-              // Check if we need to make an exception
-              switch (this.negotiated.serverHostKey) {
-                case 'rsa-sha2-256':
-                case 'rsa-sha2-512':
-                  if (hostPubKeyType === 'ssh-rsa')
-                    break;
-                // FALLTHROUGH
-                default:
-                  return doFatalError(
-                    this._protocol,
-                    'Host key does not match negotiated type',
-                    'handshake',
-                    DISCONNECT_REASON.KEY_EXCHANGE_FAILED
-                  );
-              }
-            }
-
-            this._hostKey = hostPubKey;
-            this._dhData = dhData;
-            this._sig = sig;
-
-            let checked = false;
-            let ret;
-            if (this._protocol._hostVerifier === undefined) {
-              ret = true;
-              this._protocol._debug && this._protocol._debug(
-                'Host accepted by default (no verification)'
-              );
-            } else {
-              ret = this._protocol._hostVerifier(hostPubKey, (permitted) => {
-                if (checked)
-                  return;
-                checked = true;
-                if (permitted === false) {
-                  this._protocol._debug && this._protocol._debug(
-                    'Host denied (verification failed)'
-                  );
-                  return doFatalError(
-                    this._protocol,
-                    'Host denied (verification failed)',
-                    'handshake',
-                    DISCONNECT_REASON.KEY_EXCHANGE_FAILED
-                  );
-                }
-                this._protocol._debug && this._protocol._debug(
-                  'Host accepted (verified)'
-                );
-                this._hostVerified = true;
-                if (this._receivedNEWKEYS)
-                  this.finish();
-                else
-                  trySendNEWKEYS(this);
-              });
-            }
-            if (ret === undefined) {
-              // Async host verification
-              ++this._step;
-              return;
-            }
-            checked = true;
-            if (ret === false) {
-              this._protocol._debug && this._protocol._debug(
-                'Host denied (verification failed)'
-              );
-              return doFatalError(
-                this._protocol,
-                'Host denied (verification failed)',
-                'handshake',
-                DISCONNECT_REASON.KEY_EXCHANGE_FAILED
-              );
-            }
-            this._protocol._debug && this._protocol._debug(
-              'Host accepted (verified)'
-            );
-            this._hostVerified = true;
-            trySendNEWKEYS(this);
-          }
-          ++this._step;
-          break;
-        case 2:
-          if (type !== MESSAGE.NEWKEYS) {
-            return doFatalError(
-              this._protocol,
-              `Received packet ${type} instead of ${MESSAGE.NEWKEYS}`,
-              'handshake',
-              DISCONNECT_REASON.KEY_EXCHANGE_FAILED
-            );
-          }
-          this._protocol._debug && this._protocol._debug(
-            'Inbound: NEWKEYS'
-          );
-          this._receivedNEWKEYS = true;
-          if (this._protocol._strictMode)
-            this._protocol._decipher.inSeqno = 0;
-          ++this._step;
-
-          return this.finish(!this._protocol._server && !this._hostVerified);
-        default:
-          return doFatalError(
-            this._protocol,
-            `Received unexpected packet ${type} after NEWKEYS`,
-            'handshake',
-            DISCONNECT_REASON.KEY_EXCHANGE_FAILED
-          );
-      }
-    }
-  }
-
-  class Curve25519Exchange extends KeyExchange {
-    constructor(hashName, ...args) {
-      super(...args);
-
-      this.type = '25519';
-      this.hashName = hashName;
-      this._keys = null;
-    }
-    generateKeys() {
-      if (!this._keys)
-        this._keys = generateKeyPairSync('x25519');
-    }
-    getPublicKey() {
-      this.generateKeys();
-
-      const key = this._keys.publicKey.export({ type: 'spki', format: 'der' });
-      return key.slice(-32); // HACK: avoids parsing DER/BER header
-    }
-    convertPublicKey(key) {
-      let newKey;
-      let idx = 0;
-      let len = key.length;
-      while (key[idx] === 0x00) {
-        ++idx;
-        --len;
-      }
-
-      if (key.length === 32)
-        return key;
-
-      if (len !== key.length) {
-        newKey = Buffer.allocUnsafe(len);
-        key.copy(newKey, 0, idx);
-        key = newKey;
-      }
-      return key;
-    }
-    computeSecret(otherPublicKey) {
-      this.generateKeys();
-
-      try {
-        const asnWriter = new Ber.Writer();
-        asnWriter.startSequence();
-          // algorithm
-          asnWriter.startSequence();
-            asnWriter.writeOID('1.3.101.110'); // id-X25519
-          asnWriter.endSequence();
-
-          // PublicKey
-          asnWriter.startSequence(Ber.BitString);
-            asnWriter.writeByte(0x00);
-            // XXX: hack to write a raw buffer without a tag -- yuck
-            asnWriter._ensure(otherPublicKey.length);
-            otherPublicKey.copy(asnWriter._buf,
-                                asnWriter._offset,
-                                0,
-                                otherPublicKey.length);
-            asnWriter._offset += otherPublicKey.length;
-          asnWriter.endSequence();
-        asnWriter.endSequence();
-
-        return convertToMpint(diffieHellman({
-          privateKey: this._keys.privateKey,
-          publicKey: createPublicKey({
-            key: asnWriter.buffer,
-            type: 'spki',
-            format: 'der',
-          }),
-        }));
-      } catch (ex) {
-        return ex;
-      }
-    }
-  }
-
-  class ECDHExchange extends KeyExchange {
-    constructor(curveName, hashName, ...args) {
-      super(...args);
-
-      this.type = 'ecdh';
-      this.curveName = curveName;
-      this.hashName = hashName;
-    }
-    generateKeys() {
-      if (!this._dh) {
-        this._dh = createECDH(this.curveName);
-        this._public = this._dh.generateKeys();
-      }
-    }
-  }
-
-  class DHGroupExchange extends KeyExchange {
-    constructor(hashName, ...args) {
-      super(...args);
-
-      this.type = 'groupex';
-      this.hashName = hashName;
-      this._prime = null;
-      this._generator = null;
-      this._minBits = GEX_MIN_BITS;
-      this._prefBits = dhEstimate(this.negotiated);
-      if (this._protocol._compatFlags & COMPAT.BUG_DHGEX_LARGE)
-        this._prefBits = Math.min(this._prefBits, 4096);
-      this._maxBits = GEX_MAX_BITS;
-    }
-    start() {
-      if (this._protocol._server)
-        return;
-      this._protocol._debug && this._protocol._debug(
-        'Outbound: Sending KEXDH_GEX_REQUEST'
-      );
-      let p = this._protocol._packetRW.write.allocStartKEX;
-      const packet = this._protocol._packetRW.write.alloc(
-        1 + 4 + 4 + 4,
-        true
-      );
-      packet[p] = MESSAGE.KEXDH_GEX_REQUEST;
-      writeUInt32BE(packet, this._minBits, ++p);
-      writeUInt32BE(packet, this._prefBits, p += 4);
-      writeUInt32BE(packet, this._maxBits, p += 4);
-      this._protocol._cipher.encrypt(
-        this._protocol._packetRW.write.finalize(packet, true)
-      );
-    }
-    generateKeys() {
-      if (!this._dh && this._prime && this._generator) {
-        this._dh = createDiffieHellman(this._prime, this._generator);
-        this._public = this._dh.generateKeys();
-      }
-    }
-    setDHParams(prime, generator) {
-      if (!Buffer.isBuffer(prime))
-        throw new Error('Invalid prime value');
-      if (!Buffer.isBuffer(generator))
-        throw new Error('Invalid generator value');
-      this._prime = prime;
-      this._generator = generator;
-    }
-    getDHParams() {
-      if (this._dh) {
-        return {
-          prime: convertToMpint(this._dh.getPrime()),
-          generator: convertToMpint(this._dh.getGenerator()),
-        };
-      }
-    }
-    parse(payload) {
-      const type = payload[0];
-      switch (this._step) {
-        case 1: {
-          if (this._protocol._server) {
-            if (type !== MESSAGE.KEXDH_GEX_REQUEST) {
-              return doFatalError(
-                this._protocol,
-                `Received packet ${type} instead of `
-                  + MESSAGE.KEXDH_GEX_REQUEST,
-                'handshake',
-                DISCONNECT_REASON.KEY_EXCHANGE_FAILED
-              );
-            }
-            // TODO: allow user implementation to provide safe prime and
-            // generator on demand to support group exchange on server side
-            return doFatalError(
-              this._protocol,
-              'Group exchange not implemented for server',
-              'handshake',
-              DISCONNECT_REASON.KEY_EXCHANGE_FAILED
-            );
-          }
-
-          if (type !== MESSAGE.KEXDH_GEX_GROUP) {
-            return doFatalError(
-              this._protocol,
-              `Received packet ${type} instead of ${MESSAGE.KEXDH_GEX_GROUP}`,
-              'handshake',
-              DISCONNECT_REASON.KEY_EXCHANGE_FAILED
-            );
-          }
-
-          this._protocol._debug && this._protocol._debug(
-            'Received DH GEX Group'
-          );
-
-          /*
-            byte    SSH_MSG_KEX_DH_GEX_GROUP
-            mpint   p, safe prime
-            mpint   g, generator for subgroup in GF(p)
-          */
-          bufferParser.init(payload, 1);
-          let prime;
-          let gen;
-          if ((prime = bufferParser.readString()) === undefined
-              || (gen = bufferParser.readString()) === undefined) {
-            bufferParser.clear();
-            return doFatalError(
-              this._protocol,
-              'Received malformed KEXDH_GEX_GROUP',
-              'handshake',
-              DISCONNECT_REASON.KEY_EXCHANGE_FAILED
-            );
-          }
-          bufferParser.clear();
-
-          // TODO: validate prime
-          this.setDHParams(prime, gen);
-          this.generateKeys();
-          const pubkey = this.getPublicKey();
-
-          this._protocol._debug && this._protocol._debug(
-            'Outbound: Sending KEXDH_GEX_INIT'
-          );
-
-          let p = this._protocol._packetRW.write.allocStartKEX;
-          const packet =
-            this._protocol._packetRW.write.alloc(1 + 4 + pubkey.length, true);
-          packet[p] = MESSAGE.KEXDH_GEX_INIT;
-          writeUInt32BE(packet, pubkey.length, ++p);
-          packet.set(pubkey, p += 4);
-          this._protocol._cipher.encrypt(
-            this._protocol._packetRW.write.finalize(packet, true)
-          );
-
-          ++this._step;
-          break;
-        }
-        case 2:
-          if (this._protocol._server) {
-            if (type !== MESSAGE.KEXDH_GEX_INIT) {
-              return doFatalError(
-                this._protocol,
-                `Received packet ${type} instead of ${MESSAGE.KEXDH_GEX_INIT}`,
-                'handshake',
-                DISCONNECT_REASON.KEY_EXCHANGE_FAILED
-              );
-            }
-            this._protocol._debug && this._protocol._debug(
-              'Received DH GEX Init'
-            );
-            return doFatalError(
-              this._protocol,
-              'Group exchange not implemented for server',
-              'handshake',
-              DISCONNECT_REASON.KEY_EXCHANGE_FAILED
-            );
-          } else if (type !== MESSAGE.KEXDH_GEX_REPLY) {
-            return doFatalError(
-              this._protocol,
-              `Received packet ${type} instead of ${MESSAGE.KEXDH_GEX_REPLY}`,
-              'handshake',
-              DISCONNECT_REASON.KEY_EXCHANGE_FAILED
-            );
-          }
-          this._protocol._debug && this._protocol._debug(
-            'Received DH GEX Reply'
-          );
-          this._step = 1;
-          payload[0] = MESSAGE.KEXDH_REPLY;
-          this.parse = KeyExchange.prototype.parse;
-          this.parse(payload);
-      }
-    }
-  }
-
-  class DHExchange extends KeyExchange {
-    constructor(groupName, hashName, ...args) {
-      super(...args);
-
-      this.type = 'group';
-      this.groupName = groupName;
-      this.hashName = hashName;
-    }
-    start() {
-      if (!this._protocol._server) {
-        this._protocol._debug && this._protocol._debug(
-          'Outbound: Sending KEXDH_INIT'
-        );
-        const pubKey = this.getPublicKey();
-        let p = this._protocol._packetRW.write.allocStartKEX;
-        const packet =
-          this._protocol._packetRW.write.alloc(1 + 4 + pubKey.length, true);
-        packet[p] = MESSAGE.KEXDH_INIT;
-        writeUInt32BE(packet, pubKey.length, ++p);
-        packet.set(pubKey, p += 4);
-        this._protocol._cipher.encrypt(
-          this._protocol._packetRW.write.finalize(packet, true)
-        );
-      }
-    }
-    generateKeys() {
-      if (!this._dh) {
-        this._dh = createDiffieHellmanGroup(this.groupName);
-        this._public = this._dh.generateKeys();
-      }
-    }
-    getDHParams() {
-      if (this._dh) {
-        return {
-          prime: convertToMpint(this._dh.getPrime()),
-          generator: convertToMpint(this._dh.getGenerator()),
-        };
-      }
-    }
-  }
-
-  return (negotiated, ...args) => {
-    if (typeof negotiated !== 'object' || negotiated === null)
-      throw new Error('Invalid negotiated argument');
-    const kexType = negotiated.kex;
-    if (typeof kexType === 'string') {
-      args = [negotiated, ...args];
-      switch (kexType) {
-        case 'curve25519-sha256':
-        case 'curve25519-sha256@libssh.org':
-          if (!curve25519Supported)
-            break;
-          return new Curve25519Exchange('sha256', ...args);
-
-        case 'ecdh-sha2-nistp256':
-          return new ECDHExchange('prime256v1', 'sha256', ...args);
-        case 'ecdh-sha2-nistp384':
-          return new ECDHExchange('secp384r1', 'sha384', ...args);
-        case 'ecdh-sha2-nistp521':
-          return new ECDHExchange('secp521r1', 'sha512', ...args);
-
-        case 'diffie-hellman-group1-sha1':
-          return new DHExchange('modp2', 'sha1', ...args);
-        case 'diffie-hellman-group14-sha1':
-          return new DHExchange('modp14', 'sha1', ...args);
-        case 'diffie-hellman-group14-sha256':
-          return new DHExchange('modp14', 'sha256', ...args);
-        case 'diffie-hellman-group15-sha512':
-          return new DHExchange('modp15', 'sha512', ...args);
-        case 'diffie-hellman-group16-sha512':
-          return new DHExchange('modp16', 'sha512', ...args);
-        case 'diffie-hellman-group17-sha512':
-          return new DHExchange('modp17', 'sha512', ...args);
-        case 'diffie-hellman-group18-sha512':
-          return new DHExchange('modp18', 'sha512', ...args);
-
-        case 'diffie-hellman-group-exchange-sha1':
-          return new DHGroupExchange('sha1', ...args);
-        case 'diffie-hellman-group-exchange-sha256':
-          return new DHGroupExchange('sha256', ...args);
-      }
-      throw new Error(`Unsupported key exchange algorithm: ${kexType}`);
-    }
-    throw new Error(`Invalid key exchange type: ${kexType}`);
-  };
-})();
-
-const KexInit = (() => {
-  const KEX_PROPERTY_NAMES = [
-    'kex',
-    'serverHostKey',
-    ['cs', 'cipher' ],
-    ['sc', 'cipher' ],
-    ['cs', 'mac' ],
-    ['sc', 'mac' ],
-    ['cs', 'compress' ],
-    ['sc', 'compress' ],
-    ['cs', 'lang' ],
-    ['sc', 'lang' ],
-  ];
-  return class KexInit {
-    constructor(obj) {
-      if (typeof obj !== 'object' || obj === null)
-        throw new TypeError('Argument must be an object');
-
-      const lists = {
-        kex: undefined,
-        serverHostKey: undefined,
-        cs: {
-          cipher: undefined,
-          mac: undefined,
-          compress: undefined,
-          lang: undefined,
-        },
-        sc: {
-          cipher: undefined,
-          mac: undefined,
-          compress: undefined,
-          lang: undefined,
-        },
-
-        all: undefined,
-      };
-      let totalSize = 0;
-      for (const prop of KEX_PROPERTY_NAMES) {
-        let base;
-        let val;
-        let desc;
-        let key;
-        if (typeof prop === 'string') {
-          base = lists;
-          val = obj[prop];
-          desc = key = prop;
-        } else {
-          const parent = prop[0];
-          base = lists[parent];
-          key = prop[1];
-          val = obj[parent][key];
-          desc = `${parent}.${key}`;
-        }
-        const entry = { array: undefined, buffer: undefined };
-        if (Buffer.isBuffer(val)) {
-          entry.array = ('' + val).split(',');
-          entry.buffer = val;
-          totalSize += 4 + val.length;
-        } else {
-          if (typeof val === 'string')
-            val = val.split(',');
-          if (Array.isArray(val)) {
-            entry.array = val;
-            entry.buffer = Buffer.from(val.join(','));
-          } else {
-            throw new TypeError(`Invalid \`${desc}\` type: ${typeof val}`);
-          }
-          totalSize += 4 + entry.buffer.length;
-        }
-        base[key] = entry;
-      }
-
-      const all = Buffer.allocUnsafe(totalSize);
-      lists.all = all;
-
-      let allPos = 0;
-      for (const prop of KEX_PROPERTY_NAMES) {
-        let data;
-        if (typeof prop === 'string')
-          data = lists[prop].buffer;
-        else
-          data = lists[prop[0]][prop[1]].buffer;
-        allPos = writeUInt32BE(all, data.length, allPos);
-        all.set(data, allPos);
-        allPos += data.length;
-      }
-
-      this.totalSize = totalSize;
-      this.lists = lists;
-    }
-    copyAllTo(buf, offset) {
-      const src = this.lists.all;
-      if (typeof offset !== 'number')
-        throw new TypeError(`Invalid offset value: ${typeof offset}`);
-      if (buf.length - offset < src.length)
-        throw new Error('Insufficient space to copy list');
-      buf.set(src, offset);
-      return src.length;
-    }
-  };
-})();
-
-const hashString = (() => {
-  const LEN = Buffer.allocUnsafe(4);
-  return (hash, buf) => {
-    writeUInt32BE(LEN, buf.length, 0);
-    hash.update(LEN);
-    hash.update(buf);
-  };
-})();
-
-function generateKEXVal(len, hashName, secret, exchangeHash, sessionID, char) {
-  let ret;
-  if (len) {
-    let digest = createHash(hashName)
-                   .update(secret)
-                   .update(exchangeHash)
-                   .update(char)
-                   .update(sessionID)
-                   .digest();
-    while (digest.length < len) {
-      const chunk = createHash(hashName)
-                      .update(secret)
-                      .update(exchangeHash)
-                      .update(digest)
-                      .digest();
-      const extended = Buffer.allocUnsafe(digest.length + chunk.length);
-      extended.set(digest, 0);
-      extended.set(chunk, digest.length);
-      digest = extended;
-    }
-    if (digest.length === len)
-      ret = digest;
-    else
-      ret = new FastBuffer(digest.buffer, digest.byteOffset, len);
-  } else {
-    ret = EMPTY_BUFFER;
-  }
-  return ret;
-}
-
-function onKEXPayload(state, payload) {
-  // XXX: move this to the Decipher implementations?
-  if (payload.length === 0) {
-    this._debug && this._debug('Inbound: Skipping empty packet payload');
-    return;
-  }
-
-  if (this._skipNextInboundPacket) {
-    this._skipNextInboundPacket = false;
-    return;
-  }
-
-  payload = this._packetRW.read.read(payload);
-
-  const type = payload[0];
-
-  if (!this._strictMode) {
-    switch (type) {
-      case MESSAGE.IGNORE:
-      case MESSAGE.UNIMPLEMENTED:
-      case MESSAGE.DEBUG:
-        if (!MESSAGE_HANDLERS)
-          MESSAGE_HANDLERS = require('./handlers.js');
-        return MESSAGE_HANDLERS[type](this, payload);
-    }
-  }
-
-  switch (type) {
-    case MESSAGE.DISCONNECT:
-      if (!MESSAGE_HANDLERS)
-        MESSAGE_HANDLERS = require('./handlers.js');
-      return MESSAGE_HANDLERS[type](this, payload);
-    case MESSAGE.KEXINIT:
-      if (!state.firstPacket) {
-        return doFatalError(
-          this,
-          'Received extra KEXINIT during handshake',
-          'handshake',
-          DISCONNECT_REASON.KEY_EXCHANGE_FAILED
-        );
-      }
-      state.firstPacket = false;
-      return handleKexInit(this, payload);
-    default:
-      // Ensure packet is either an algorithm negotiation or KEX
-      // algorithm-specific packet
-      if (type < 20 || type > 49) {
-        return doFatalError(
-          this,
-          `Received unexpected packet type ${type}`,
-          'handshake',
-          DISCONNECT_REASON.KEY_EXCHANGE_FAILED
-        );
-      }
-  }
-
-  return this._kex.parse(payload);
-}
-
-function dhEstimate(neg) {
-  const csCipher = CIPHER_INFO[neg.cs.cipher];
-  const scCipher = CIPHER_INFO[neg.sc.cipher];
-  // XXX: if OpenSSH's `umac-*` MACs are ever supported, their key lengths will
-  // also need to be considered when calculating `bits`
-  const bits = Math.max(
-    0,
-    (csCipher.sslName === 'des-ede3-cbc' ? 14 : csCipher.keyLen),
-    csCipher.blockLen,
-    csCipher.ivLen,
-    (scCipher.sslName === 'des-ede3-cbc' ? 14 : scCipher.keyLen),
-    scCipher.blockLen,
-    scCipher.ivLen
-  ) * 8;
-  if (bits <= 112)
-    return 2048;
-  if (bits <= 128)
-    return 3072;
-  if (bits <= 192)
-    return 7680;
-  return 8192;
-}
-
-function trySendNEWKEYS(kex) {
-  if (!kex._sentNEWKEYS) {
-    kex._protocol._debug && kex._protocol._debug(
-      'Outbound: Sending NEWKEYS'
-    );
-    const p = kex._protocol._packetRW.write.allocStartKEX;
-    const packet = kex._protocol._packetRW.write.alloc(1, true);
-    packet[p] = MESSAGE.NEWKEYS;
-    kex._protocol._cipher.encrypt(
-      kex._protocol._packetRW.write.finalize(packet, true)
-    );
-    kex._sentNEWKEYS = true;
-    if (kex._protocol._strictMode)
-      kex._protocol._cipher.outSeqno = 0;
-  }
-}
-
-module.exports = {
-  KexInit,
-  kexinit,
-  onKEXPayload,
-  DEFAULT_KEXINIT_CLIENT: new KexInit({
-    kex: DEFAULT_KEX.concat(['ext-info-c', 'kex-strict-c-v00@openssh.com']),
-    serverHostKey: DEFAULT_SERVER_HOST_KEY,
-    cs: {
-      cipher: DEFAULT_CIPHER,
-      mac: DEFAULT_MAC,
-      compress: DEFAULT_COMPRESSION,
-      lang: [],
-    },
-    sc: {
-      cipher: DEFAULT_CIPHER,
-      mac: DEFAULT_MAC,
-      compress: DEFAULT_COMPRESSION,
-      lang: [],
-    },
-  }),
-  DEFAULT_KEXINIT_SERVER: new KexInit({
-    kex: DEFAULT_KEX.concat(['kex-strict-s-v00@openssh.com']),
-    serverHostKey: DEFAULT_SERVER_HOST_KEY,
-    cs: {
-      cipher: DEFAULT_CIPHER,
-      mac: DEFAULT_MAC,
-      compress: DEFAULT_COMPRESSION,
-      lang: [],
-    },
-    sc: {
-      cipher: DEFAULT_CIPHER,
-      mac: DEFAULT_MAC,
-      compress: DEFAULT_COMPRESSION,
-      lang: [],
-    },
-  }),
-  HANDLERS: {
-    [MESSAGE.KEXINIT]: handleKexInit,
-  },
-};