diff --git a/CHANGELOG.md b/CHANGELOG.md index 2a342ee3..b2b602aa 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,12 @@ # Changelog +## 3.0.36 - 2024-02-25 + +- BigInteger: put guardrails on isPrime() and randomPrime() (CVE-2024-27354) +- ASN1: limit OID length (CVE-2024-27355) +- EC: when using openssl to do signing use unencrypted key (#1979) +- SSH2: add different options to isConnected() (#1983) + ## 3.0.35 - 2023-12-18 - SSH2: implement terrapin attack countermeasures (#1972) @@ -237,6 +244,12 @@ - Salsa20 / ChaCha20 - namespace changed from `phpseclib\` to `\phpseclib3` to facilitate phpseclib 2 shim (phpseclib2_compat) +## 2.0.47 - 2024-02-25 + +- BigInteger: add getLength() and getLengthInBytes() methods +- BigInteger: put guardrails on isPrime() and randomPrime() (CVE-2024-27354) +- ASN1: limit OID length (CVE-2024-27355) + ## 2.0.46 - 2023-12-28 - SSH2: implement terrapin attack countermeasures (#1972) @@ -603,6 +616,12 @@ - Classes were renamed and namespaced ([#243](https://github.com/phpseclib/phpseclib/issues/243)) - The use of an autoloader is now required (e.g. Composer) +## 1.0.23 - 2024-02-25 + +- BigInteger: add getLength() and getLengthInBytes() methods +- BigInteger: put guardrails on isPrime() and randomPrime() (CVE-2024-27354) +- ASN1: limit OID length (CVE-2024-27355) + ## 1.0.22 - 2023-12-28 - SFTP: fix issue with get() downloading to files / streams (#1934) diff --git a/README.md b/README.md index c4b27147..7166bafe 100644 --- a/README.md +++ b/README.md @@ -51,7 +51,7 @@ SSH-2, SFTP, X.509, an arbitrary-precision integer arithmetic library, Ed25519 / * PHP4 compatible * Composer compatible (PSR-0 autoloading) * Install using Composer: `composer require phpseclib/phpseclib:~1.0` -* [Download 1.0.22 as ZIP](http://sourceforge.net/projects/phpseclib/files/phpseclib1.0.22.zip/download) +* [Download 1.0.23 as ZIP](http://sourceforge.net/projects/phpseclib/files/phpseclib1.0.23.zip/download) ## Security contact information diff --git a/phpseclib/Net/SSH2.php b/phpseclib/Net/SSH2.php index dfe7a39d..e977e2ff 100644 --- a/phpseclib/Net/SSH2.php +++ b/phpseclib/Net/SSH2.php @@ -3023,9 +3023,39 @@ class SSH2 /** * Is the connection still active? */ - public function isConnected(): bool + * + * $level has 3x possible values: + * 0 (default): phpseclib takes a passive approach to see if the connection is still active by calling feof() + * on the socket + * 1: phpseclib takes an active approach to see if the connection is still active by sending an SSH_MSG_IGNORE + * packet that doesn't require a response + * 2: phpseclib takes an active approach to see if the connection is still active by sending an SSH_MSG_CHANNEL_OPEN + * packet and imediately trying to close that channel. some routers, in particular, however, will only let you + * open one channel, so this approach could yield false positives + * + * @param int $level + * @return bool + */ + public function isConnected(int $level = 0): bool { - return ($this->bitmap & self::MASK_CONNECTED) && is_resource($this->fsock) && !feof($this->fsock); + if ($level < 0 || $level > 2) { + throw new InvalidArgumentException('$level must be 0, 1 or 2'); + } + + if ($level == 0) { + return ($this->bitmap & self::MASK_CONNECTED) && is_resource($this->fsock) && !feof($this->fsock); + } + try { + if ($level == 1) { + $this->send_binary_packet(pack('CN', NET_SSH2_MSG_IGNORE, 0)); + } else { + $this->openChannel(self::CHANNEL_KEEP_ALIVE); + $this->close_channel(self::CHANNEL_KEEP_ALIVE); + } + return true; + } catch (\Exception $e) { + return false; + } } /**