octoleo/phpseclib
1
0
Fork 0
mirror of https://github.com/phpseclib/phpseclib.git synced 2024-11-15 17:57:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch '2.0' into 3.0

Browse Source
This commit is contained in:
terrafrost 2023-11-22 04:44:23 -06:00
commit 7cc1814f9d
1 changed files with 31 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
phpseclib/Net/SSH2.php
View File

@ -343,6 +343,14 @@ class SSH2
*/ */
private $languages_client_to_server = false; private $languages_client_to_server = false;
/**
* Server Signature Algorithms
*
* @link https://www.rfc-editor.org/rfc/rfc8308.html#section-3.1
* @var array|false
*/
private $server_sig_algs = false;
/** /**
* Preferred Algorithms * Preferred Algorithms
* *
@ -1122,6 +1130,7 @@ class SSH2
4 => 'NET_SSH2_MSG_DEBUG', 4 => 'NET_SSH2_MSG_DEBUG',
5 => 'NET_SSH2_MSG_SERVICE_REQUEST', 5 => 'NET_SSH2_MSG_SERVICE_REQUEST',
6 => 'NET_SSH2_MSG_SERVICE_ACCEPT', 6 => 'NET_SSH2_MSG_SERVICE_ACCEPT',
7 => 'NET_SSH2_MSG_EXT_INFO', // RFC 8308
20 => 'NET_SSH2_MSG_KEXINIT', 20 => 'NET_SSH2_MSG_KEXINIT',
21 => 'NET_SSH2_MSG_NEWKEYS', 21 => 'NET_SSH2_MSG_NEWKEYS',
30 => 'NET_SSH2_MSG_KEXDH_INIT', 30 => 'NET_SSH2_MSG_KEXDH_INIT',
@ -1535,6 +1544,8 @@ class SSH2
$preferred['client_to_server']['comp'] : $preferred['client_to_server']['comp'] :
SSH2::getSupportedCompressionAlgorithms(); SSH2::getSupportedCompressionAlgorithms();
$kex_algorithms = array_merge($kex_algorithms, array('ext-info-c'));
// some SSH servers have buggy implementations of some of the above algorithms // some SSH servers have buggy implementations of some of the above algorithms
switch (true) { switch (true) {
case $this->server_identifier == 'SSH-2.0-SSHD': case $this->server_identifier == 'SSH-2.0-SSHD':
@ -2332,7 +2343,23 @@ class SSH2
throw $e; throw $e;
} }
list($type, $service) = Strings::unpackSSH2('Cs', $response); list($type) = Strings::unpackSSH2('C', $response);
if ($type == NET_SSH2_MSG_EXT_INFO) {
list($nr_extensions) = Strings::unpackSSH2('N', $response);
for ($i = 0; $i < $nr_extensions; $i++) {
list($extension_name, $extension_value) = Strings::unpackSSH2('ss', $response);
if ($extension_name == 'server-sig-algs') {
$this->server_sig_algs = explode(',', $extension_value);
}
}
$response = $this->get_binary_packet();
list($type) = Strings::unpackSSH2('C', $response);
}
list($service) = Strings::unpackSSH2('s', $response);
if ($type != NET_SSH2_MSG_SERVICE_ACCEPT || $service != 'ssh-userauth') { if ($type != NET_SSH2_MSG_SERVICE_ACCEPT || $service != 'ssh-userauth') {
$this->disconnect_helper(NET_SSH2_DISCONNECT_PROTOCOL_ERROR); $this->disconnect_helper(NET_SSH2_DISCONNECT_PROTOCOL_ERROR);
throw new \UnexpectedValueException('Expected SSH_MSG_SERVICE_ACCEPT'); throw new \UnexpectedValueException('Expected SSH_MSG_SERVICE_ACCEPT');
@ -2607,7 +2634,9 @@ class SSH2
if ($publickey instanceof RSA) { if ($publickey instanceof RSA) {
$privatekey = $privatekey->withPadding(RSA::SIGNATURE_PKCS1); $privatekey = $privatekey->withPadding(RSA::SIGNATURE_PKCS1);
$algos = ['rsa-sha2-256', 'rsa-sha2-512', 'ssh-rsa']; $algos = ['rsa-sha2-256', 'rsa-sha2-512', 'ssh-rsa'];
if (isset($this->preferred['hostkey'])) { if ($this->server_sig_algs) {
$algos = array_intersect($this->server_sig_algs, $algos);
} elseif (isset($this->preferred['hostkey'])) {
$algos = array_intersect($this->preferred['hostkey'], $algos); $algos = array_intersect($this->preferred['hostkey'], $algos);
} }
$algo = self::array_intersect_first($algos, $this->supported_private_key_algorithms); $algo = self::array_intersect_first($algos, $this->supported_private_key_algorithms);