File manager - Edit - /home/newsbmcs.com/public_html/static/img/logo/transport.py.tar
Back
usr/local/CyberCP/lib/python3.10/site-packages/paramiko/transport.py 0000644 00000405563 15030036335 0021273 0 ustar 00 # Copyright (C) 2003-2007 Robey Pointer <robeypointer@gmail.com> # Copyright (C) 2003-2007 Robey Pointer <robeypointer@gmail.com> # # This file is part of paramiko. # # Paramiko is free software; you can redistribute it and/or modify it under the # terms of the GNU Lesser General Public License as published by the Free # Software Foundation; either version 2.1 of the License, or (at your option) # any later version. # # Paramiko is distributed in the hope that it will be useful, but WITHOUT ANY # WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR # A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more # details. # # You should have received a copy of the GNU Lesser General Public License # along with Paramiko; if not, write to the Free Software Foundation, Inc., # 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. """ Core protocol implementation """ import os import socket import sys import threading import time import weakref from hashlib import md5, sha1, sha256, sha512 from cryptography.hazmat.backends import default_backend from cryptography.hazmat.primitives.ciphers import algorithms, Cipher, modes import paramiko from paramiko import util from paramiko.auth_handler import AuthHandler, AuthOnlyHandler from paramiko.ssh_gss import GSSAuth from paramiko.channel import Channel from paramiko.common import ( xffffffff, cMSG_CHANNEL_OPEN, cMSG_IGNORE, cMSG_GLOBAL_REQUEST, DEBUG, MSG_KEXINIT, MSG_IGNORE, MSG_DISCONNECT, MSG_DEBUG, ERROR, WARNING, cMSG_UNIMPLEMENTED, INFO, cMSG_KEXINIT, cMSG_NEWKEYS, MSG_NEWKEYS, cMSG_REQUEST_SUCCESS, cMSG_REQUEST_FAILURE, CONNECTION_FAILED_CODE, OPEN_FAILED_ADMINISTRATIVELY_PROHIBITED, OPEN_SUCCEEDED, cMSG_CHANNEL_OPEN_FAILURE, cMSG_CHANNEL_OPEN_SUCCESS, MSG_GLOBAL_REQUEST, MSG_REQUEST_SUCCESS, MSG_REQUEST_FAILURE, cMSG_SERVICE_REQUEST, MSG_SERVICE_ACCEPT, MSG_CHANNEL_OPEN_SUCCESS, MSG_CHANNEL_OPEN_FAILURE, MSG_CHANNEL_OPEN, MSG_CHANNEL_SUCCESS, MSG_CHANNEL_FAILURE, MSG_CHANNEL_DATA, MSG_CHANNEL_EXTENDED_DATA, MSG_CHANNEL_WINDOW_ADJUST, MSG_CHANNEL_REQUEST, MSG_CHANNEL_EOF, MSG_CHANNEL_CLOSE, MIN_WINDOW_SIZE, MIN_PACKET_SIZE, MAX_WINDOW_SIZE, DEFAULT_WINDOW_SIZE, DEFAULT_MAX_PACKET_SIZE, HIGHEST_USERAUTH_MESSAGE_ID, MSG_UNIMPLEMENTED, MSG_NAMES, MSG_EXT_INFO, cMSG_EXT_INFO, byte_ord, ) from paramiko.compress import ZlibCompressor, ZlibDecompressor from paramiko.dsskey import DSSKey from paramiko.ed25519key import Ed25519Key from paramiko.kex_curve25519 import KexCurve25519 from paramiko.kex_gex import KexGex, KexGexSHA256 from paramiko.kex_group1 import KexGroup1 from paramiko.kex_group14 import KexGroup14, KexGroup14SHA256 from paramiko.kex_group16 import KexGroup16SHA512 from paramiko.kex_ecdh_nist import KexNistp256, KexNistp384, KexNistp521 from paramiko.kex_gss import KexGSSGex, KexGSSGroup1, KexGSSGroup14 from paramiko.message import Message from paramiko.packet import Packetizer, NeedRekeyException from paramiko.primes import ModulusPack from paramiko.rsakey import RSAKey from paramiko.ecdsakey import ECDSAKey from paramiko.server import ServerInterface from paramiko.sftp_client import SFTPClient from paramiko.ssh_exception import ( BadAuthenticationType, ChannelException, IncompatiblePeer, MessageOrderError, ProxyCommandFailure, SSHException, ) from paramiko.util import ( ClosingContextManager, clamp_value, b, ) # TripleDES is moving from `cryptography.hazmat.primitives.ciphers.algorithms` # in cryptography>=43.0.0 to `cryptography.hazmat.decrepit.ciphers.algorithms` # It will be removed from `cryptography.hazmat.primitives.ciphers.algorithms` # in cryptography==48.0.0. # # Source References: # - https://github.com/pyca/cryptography/commit/722a6393e61b3ac # - https://github.com/pyca/cryptography/pull/11407/files try: from cryptography.hazmat.decrepit.ciphers.algorithms import TripleDES except ImportError: from cryptography.hazmat.primitives.ciphers.algorithms import TripleDES # for thread cleanup _active_threads = [] def _join_lingering_threads(): for thr in _active_threads: thr.stop_thread() import atexit atexit.register(_join_lingering_threads) class Transport(threading.Thread, ClosingContextManager): """ An SSH Transport attaches to a stream (usually a socket), negotiates an encrypted session, authenticates, and then creates stream tunnels, called `channels <.Channel>`, across the session. Multiple channels can be multiplexed across a single session (and often are, in the case of port forwardings). Instances of this class may be used as context managers. """ _ENCRYPT = object() _DECRYPT = object() _PROTO_ID = "2.0" _CLIENT_ID = "paramiko_{}".format(paramiko.__version__) # These tuples of algorithm identifiers are in preference order; do not # reorder without reason! # NOTE: if you need to modify these, we suggest leveraging the # `disabled_algorithms` constructor argument (also available in SSHClient) # instead of monkeypatching or subclassing. _preferred_ciphers = ( "aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-cbc", "aes192-cbc", "aes256-cbc", "3des-cbc", ) _preferred_macs = ( "hmac-sha2-256", "hmac-sha2-512", "hmac-sha2-256-etm@openssh.com", "hmac-sha2-512-etm@openssh.com", "hmac-sha1", "hmac-md5", "hmac-sha1-96", "hmac-md5-96", ) # ~= HostKeyAlgorithms in OpenSSH land _preferred_keys = ( "ssh-ed25519", "ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss", ) # ~= PubKeyAcceptedAlgorithms _preferred_pubkeys = ( "ssh-ed25519", "ecdsa-sha2-nistp256", "ecdsa-sha2-nistp384", "ecdsa-sha2-nistp521", "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", "ssh-dss", ) _preferred_kex = ( "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group16-sha512", "diffie-hellman-group-exchange-sha256", "diffie-hellman-group14-sha256", "diffie-hellman-group-exchange-sha1", "diffie-hellman-group14-sha1", "diffie-hellman-group1-sha1", ) if KexCurve25519.is_available(): _preferred_kex = ("curve25519-sha256@libssh.org",) + _preferred_kex _preferred_gsskex = ( "gss-gex-sha1-toWM5Slw5Ew8Mqkay+al2g==", "gss-group14-sha1-toWM5Slw5Ew8Mqkay+al2g==", "gss-group1-sha1-toWM5Slw5Ew8Mqkay+al2g==", ) _preferred_compression = ("none",) _cipher_info = { "aes128-ctr": { "class": algorithms.AES, "mode": modes.CTR, "block-size": 16, "key-size": 16, }, "aes192-ctr": { "class": algorithms.AES, "mode": modes.CTR, "block-size": 16, "key-size": 24, }, "aes256-ctr": { "class": algorithms.AES, "mode": modes.CTR, "block-size": 16, "key-size": 32, }, "aes128-cbc": { "class": algorithms.AES, "mode": modes.CBC, "block-size": 16, "key-size": 16, }, "aes192-cbc": { "class": algorithms.AES, "mode": modes.CBC, "block-size": 16, "key-size": 24, }, "aes256-cbc": { "class": algorithms.AES, "mode": modes.CBC, "block-size": 16, "key-size": 32, }, "3des-cbc": { "class": TripleDES, "mode": modes.CBC, "block-size": 8, "key-size": 24, }, } _mac_info = { "hmac-sha1": {"class": sha1, "size": 20}, "hmac-sha1-96": {"class": sha1, "size": 12}, "hmac-sha2-256": {"class": sha256, "size": 32}, "hmac-sha2-256-etm@openssh.com": {"class": sha256, "size": 32}, "hmac-sha2-512": {"class": sha512, "size": 64}, "hmac-sha2-512-etm@openssh.com": {"class": sha512, "size": 64}, "hmac-md5": {"class": md5, "size": 16}, "hmac-md5-96": {"class": md5, "size": 12}, } _key_info = { # TODO: at some point we will want to drop this as it's no longer # considered secure due to using SHA-1 for signatures. OpenSSH 8.8 no # longer supports it. Question becomes at what point do we want to # prevent users with older setups from using this? "ssh-rsa": RSAKey, "ssh-rsa-cert-v01@openssh.com": RSAKey, "rsa-sha2-256": RSAKey, "rsa-sha2-256-cert-v01@openssh.com": RSAKey, "rsa-sha2-512": RSAKey, "rsa-sha2-512-cert-v01@openssh.com": RSAKey, "ssh-dss": DSSKey, "ssh-dss-cert-v01@openssh.com": DSSKey, "ecdsa-sha2-nistp256": ECDSAKey, "ecdsa-sha2-nistp256-cert-v01@openssh.com": ECDSAKey, "ecdsa-sha2-nistp384": ECDSAKey, "ecdsa-sha2-nistp384-cert-v01@openssh.com": ECDSAKey, "ecdsa-sha2-nistp521": ECDSAKey, "ecdsa-sha2-nistp521-cert-v01@openssh.com": ECDSAKey, "ssh-ed25519": Ed25519Key, "ssh-ed25519-cert-v01@openssh.com": Ed25519Key, } _kex_info = { "diffie-hellman-group1-sha1": KexGroup1, "diffie-hellman-group14-sha1": KexGroup14, "diffie-hellman-group-exchange-sha1": KexGex, "diffie-hellman-group-exchange-sha256": KexGexSHA256, "diffie-hellman-group14-sha256": KexGroup14SHA256, "diffie-hellman-group16-sha512": KexGroup16SHA512, "gss-group1-sha1-toWM5Slw5Ew8Mqkay+al2g==": KexGSSGroup1, "gss-group14-sha1-toWM5Slw5Ew8Mqkay+al2g==": KexGSSGroup14, "gss-gex-sha1-toWM5Slw5Ew8Mqkay+al2g==": KexGSSGex, "ecdh-sha2-nistp256": KexNistp256, "ecdh-sha2-nistp384": KexNistp384, "ecdh-sha2-nistp521": KexNistp521, } if KexCurve25519.is_available(): _kex_info["curve25519-sha256@libssh.org"] = KexCurve25519 _compression_info = { # zlib@openssh.com is just zlib, but only turned on after a successful # authentication. openssh servers may only offer this type because # they've had troubles with security holes in zlib in the past. "zlib@openssh.com": (ZlibCompressor, ZlibDecompressor), "zlib": (ZlibCompressor, ZlibDecompressor), "none": (None, None), } _modulus_pack = None _active_check_timeout = 0.1 def __init__( self, sock, default_window_size=DEFAULT_WINDOW_SIZE, default_max_packet_size=DEFAULT_MAX_PACKET_SIZE, gss_kex=False, gss_deleg_creds=True, disabled_algorithms=None, server_sig_algs=True, strict_kex=True, packetizer_class=None, ): """ Create a new SSH session over an existing socket, or socket-like object. This only creates the `.Transport` object; it doesn't begin the SSH session yet. Use `connect` or `start_client` to begin a client session, or `start_server` to begin a server session. If the object is not actually a socket, it must have the following methods: - ``send(bytes)``: Writes from 1 to ``len(bytes)`` bytes, and returns an int representing the number of bytes written. Returns 0 or raises ``EOFError`` if the stream has been closed. - ``recv(int)``: Reads from 1 to ``int`` bytes and returns them as a string. Returns 0 or raises ``EOFError`` if the stream has been closed. - ``close()``: Closes the socket. - ``settimeout(n)``: Sets a (float) timeout on I/O operations. For ease of use, you may also pass in an address (as a tuple) or a host string as the ``sock`` argument. (A host string is a hostname with an optional port (separated by ``":"``) which will be converted into a tuple of ``(hostname, port)``.) A socket will be connected to this address and used for communication. Exceptions from the ``socket`` call may be thrown in this case. .. note:: Modifying the the window and packet sizes might have adverse effects on your channels created from this transport. The default values are the same as in the OpenSSH code base and have been battle tested. :param socket sock: a socket or socket-like object to create the session over. :param int default_window_size: sets the default window size on the transport. (defaults to 2097152) :param int default_max_packet_size: sets the default max packet size on the transport. (defaults to 32768) :param bool gss_kex: Whether to enable GSSAPI key exchange when GSSAPI is in play. Default: ``False``. :param bool gss_deleg_creds: Whether to enable GSSAPI credential delegation when GSSAPI is in play. Default: ``True``. :param dict disabled_algorithms: If given, must be a dictionary mapping algorithm type to an iterable of algorithm identifiers, which will be disabled for the lifetime of the transport. Keys should match the last word in the class' builtin algorithm tuple attributes, such as ``"ciphers"`` to disable names within ``_preferred_ciphers``; or ``"kex"`` to disable something defined inside ``_preferred_kex``. Values should exactly match members of the matching attribute. For example, if you need to disable ``diffie-hellman-group16-sha512`` key exchange (perhaps because your code talks to a server which implements it differently from Paramiko), specify ``disabled_algorithms={"kex": ["diffie-hellman-group16-sha512"]}``. :param bool server_sig_algs: Whether to send an extra message to compatible clients, in server mode, with a list of supported pubkey algorithms. Default: ``True``. :param bool strict_kex: Whether to advertise (and implement, if client also advertises support for) a "strict kex" mode for safer handshaking. Default: ``True``. :param packetizer_class: Which class to use for instantiating the internal packet handler. Default: ``None`` (i.e.: use `Packetizer` as normal). .. versionchanged:: 1.15 Added the ``default_window_size`` and ``default_max_packet_size`` arguments. .. versionchanged:: 1.15 Added the ``gss_kex`` and ``gss_deleg_creds`` kwargs. .. versionchanged:: 2.6 Added the ``disabled_algorithms`` kwarg. .. versionchanged:: 2.9 Added the ``server_sig_algs`` kwarg. .. versionchanged:: 3.4 Added the ``strict_kex`` kwarg. .. versionchanged:: 3.4 Added the ``packetizer_class`` kwarg. """ self.active = False self.hostname = None self.server_extensions = {} self.advertise_strict_kex = strict_kex self.agreed_on_strict_kex = False # TODO: these two overrides on sock's type should go away sometime, too # many ways to do it! if isinstance(sock, str): # convert "host:port" into (host, port) hl = sock.split(":", 1) self.hostname = hl[0] if len(hl) == 1: sock = (hl[0], 22) else: sock = (hl[0], int(hl[1])) if type(sock) is tuple: # connect to the given (host, port) hostname, port = sock self.hostname = hostname reason = "No suitable address family" addrinfos = socket.getaddrinfo( hostname, port, socket.AF_UNSPEC, socket.SOCK_STREAM ) for family, socktype, proto, canonname, sockaddr in addrinfos: if socktype == socket.SOCK_STREAM: af = family # addr = sockaddr sock = socket.socket(af, socket.SOCK_STREAM) try: sock.connect((hostname, port)) except socket.error as e: reason = str(e) else: break else: raise SSHException( "Unable to connect to {}: {}".format(hostname, reason) ) # okay, normal socket-ish flow here... threading.Thread.__init__(self) self.daemon = True self.sock = sock # we set the timeout so we can check self.active periodically to # see if we should bail. socket.timeout exception is never propagated. self.sock.settimeout(self._active_check_timeout) # negotiated crypto parameters self.packetizer = (packetizer_class or Packetizer)(sock) self.local_version = "SSH-" + self._PROTO_ID + "-" + self._CLIENT_ID self.remote_version = "" self.local_cipher = self.remote_cipher = "" self.local_kex_init = self.remote_kex_init = None self.local_mac = self.remote_mac = None self.local_compression = self.remote_compression = None self.session_id = None self.host_key_type = None self.host_key = None # GSS-API / SSPI Key Exchange self.use_gss_kex = gss_kex # This will be set to True if GSS-API Key Exchange was performed self.gss_kex_used = False self.kexgss_ctxt = None self.gss_host = None if self.use_gss_kex: self.kexgss_ctxt = GSSAuth("gssapi-keyex", gss_deleg_creds) self._preferred_kex = self._preferred_gsskex + self._preferred_kex # state used during negotiation self.kex_engine = None self.H = None self.K = None self.initial_kex_done = False self.in_kex = False self.authenticated = False self._expected_packet = tuple() # synchronization (always higher level than write_lock) self.lock = threading.Lock() # tracking open channels self._channels = ChannelMap() self.channel_events = {} # (id -> Event) self.channels_seen = {} # (id -> True) self._channel_counter = 0 self.default_max_packet_size = default_max_packet_size self.default_window_size = default_window_size self._forward_agent_handler = None self._x11_handler = None self._tcp_handler = None self.saved_exception = None self.clear_to_send = threading.Event() self.clear_to_send_lock = threading.Lock() self.clear_to_send_timeout = 30.0 self.log_name = "paramiko.transport" self.logger = util.get_logger(self.log_name) self.packetizer.set_log(self.logger) self.auth_handler = None # response Message from an arbitrary global request self.global_response = None # user-defined event callbacks self.completion_event = None # how long (seconds) to wait for the SSH banner self.banner_timeout = 15 # how long (seconds) to wait for the handshake to finish after SSH # banner sent. self.handshake_timeout = 15 # how long (seconds) to wait for the auth response. self.auth_timeout = 30 # how long (seconds) to wait for opening a channel self.channel_timeout = 60 * 60 self.disabled_algorithms = disabled_algorithms or {} self.server_sig_algs = server_sig_algs # server mode: self.server_mode = False self.server_object = None self.server_key_dict = {} self.server_accepts = [] self.server_accept_cv = threading.Condition(self.lock) self.subsystem_table = {} # Handler table, now set at init time for easier per-instance # manipulation and subclass twiddling. self._handler_table = { MSG_EXT_INFO: self._parse_ext_info, MSG_NEWKEYS: self._parse_newkeys, MSG_GLOBAL_REQUEST: self._parse_global_request, MSG_REQUEST_SUCCESS: self._parse_request_success, MSG_REQUEST_FAILURE: self._parse_request_failure, MSG_CHANNEL_OPEN_SUCCESS: self._parse_channel_open_success, MSG_CHANNEL_OPEN_FAILURE: self._parse_channel_open_failure, MSG_CHANNEL_OPEN: self._parse_channel_open, MSG_KEXINIT: self._negotiate_keys, } def _filter_algorithm(self, type_): default = getattr(self, "_preferred_{}".format(type_)) return tuple( x for x in default if x not in self.disabled_algorithms.get(type_, []) ) @property def preferred_ciphers(self): return self._filter_algorithm("ciphers") @property def preferred_macs(self): return self._filter_algorithm("macs") @property def preferred_keys(self): # Interleave cert variants here; resistant to various background # overwriting of _preferred_keys, and necessary as hostkeys can't use # the logic pubkey auth does re: injecting/checking for certs at # runtime filtered = self._filter_algorithm("keys") return tuple( filtered + tuple("{}-cert-v01@openssh.com".format(x) for x in filtered) ) @property def preferred_pubkeys(self): return self._filter_algorithm("pubkeys") @property def preferred_kex(self): return self._filter_algorithm("kex") @property def preferred_compression(self): return self._filter_algorithm("compression") def __repr__(self): """ Returns a string representation of this object, for debugging. """ id_ = hex(id(self) & xffffffff) out = "<paramiko.Transport at {}".format(id_) if not self.active: out += " (unconnected)" else: if self.local_cipher != "": out += " (cipher {}, {:d} bits)".format( self.local_cipher, self._cipher_info[self.local_cipher]["key-size"] * 8, ) if self.is_authenticated(): out += " (active; {} open channel(s))".format( len(self._channels) ) elif self.initial_kex_done: out += " (connected; awaiting auth)" else: out += " (connecting)" out += ">" return out def atfork(self): """ Terminate this Transport without closing the session. On posix systems, if a Transport is open during process forking, both parent and child will share the underlying socket, but only one process can use the connection (without corrupting the session). Use this method to clean up a Transport object without disrupting the other process. .. versionadded:: 1.5.3 """ self.sock.close() self.close() def get_security_options(self): """ Return a `.SecurityOptions` object which can be used to tweak the encryption algorithms this transport will permit (for encryption, digest/hash operations, public keys, and key exchanges) and the order of preference for them. """ return SecurityOptions(self) def set_gss_host(self, gss_host, trust_dns=True, gssapi_requested=True): """ Normalize/canonicalize ``self.gss_host`` depending on various factors. :param str gss_host: The explicitly requested GSS-oriented hostname to connect to (i.e. what the host's name is in the Kerberos database.) Defaults to ``self.hostname`` (which will be the 'real' target hostname and/or host portion of given socket object.) :param bool trust_dns: Indicates whether or not DNS is trusted; if true, DNS will be used to canonicalize the GSS hostname (which again will either be ``gss_host`` or the transport's default hostname.) (Defaults to True due to backwards compatibility.) :param bool gssapi_requested: Whether GSSAPI key exchange or authentication was even requested. If not, this is a no-op and nothing happens (and ``self.gss_host`` is not set.) (Defaults to True due to backwards compatibility.) :returns: ``None``. """ # No GSSAPI in play == nothing to do if not gssapi_requested: return # Obtain the correct host first - did user request a GSS-specific name # to use that is distinct from the actual SSH target hostname? if gss_host is None: gss_host = self.hostname # Finally, canonicalize via DNS if DNS is trusted. if trust_dns and gss_host is not None: gss_host = socket.getfqdn(gss_host) # And set attribute for reference later. self.gss_host = gss_host def start_client(self, event=None, timeout=None): """ Negotiate a new SSH2 session as a client. This is the first step after creating a new `.Transport`. A separate thread is created for protocol negotiation. If an event is passed in, this method returns immediately. When negotiation is done (successful or not), the given ``Event`` will be triggered. On failure, `is_active` will return ``False``. (Since 1.4) If ``event`` is ``None``, this method will not return until negotiation is done. On success, the method returns normally. Otherwise an SSHException is raised. After a successful negotiation, you will usually want to authenticate, calling `auth_password <Transport.auth_password>` or `auth_publickey <Transport.auth_publickey>`. .. note:: `connect` is a simpler method for connecting as a client. .. note:: After calling this method (or `start_server` or `connect`), you should no longer directly read from or write to the original socket object. :param .threading.Event event: an event to trigger when negotiation is complete (optional) :param float timeout: a timeout, in seconds, for SSH2 session negotiation (optional) :raises: `.SSHException` -- if negotiation fails (and no ``event`` was passed in) """ self.active = True if event is not None: # async, return immediately and let the app poll for completion self.completion_event = event self.start() return # synchronous, wait for a result self.completion_event = event = threading.Event() self.start() max_time = time.time() + timeout if timeout is not None else None while True: event.wait(0.1) if not self.active: e = self.get_exception() if e is not None: raise e raise SSHException("Negotiation failed.") if event.is_set() or ( timeout is not None and time.time() >= max_time ): break def start_server(self, event=None, server=None): """ Negotiate a new SSH2 session as a server. This is the first step after creating a new `.Transport` and setting up your server host key(s). A separate thread is created for protocol negotiation. If an event is passed in, this method returns immediately. When negotiation is done (successful or not), the given ``Event`` will be triggered. On failure, `is_active` will return ``False``. (Since 1.4) If ``event`` is ``None``, this method will not return until negotiation is done. On success, the method returns normally. Otherwise an SSHException is raised. After a successful negotiation, the client will need to authenticate. Override the methods `get_allowed_auths <.ServerInterface.get_allowed_auths>`, `check_auth_none <.ServerInterface.check_auth_none>`, `check_auth_password <.ServerInterface.check_auth_password>`, and `check_auth_publickey <.ServerInterface.check_auth_publickey>` in the given ``server`` object to control the authentication process. After a successful authentication, the client should request to open a channel. Override `check_channel_request <.ServerInterface.check_channel_request>` in the given ``server`` object to allow channels to be opened. .. note:: After calling this method (or `start_client` or `connect`), you should no longer directly read from or write to the original socket object. :param .threading.Event event: an event to trigger when negotiation is complete. :param .ServerInterface server: an object used to perform authentication and create `channels <.Channel>` :raises: `.SSHException` -- if negotiation fails (and no ``event`` was passed in) """ if server is None: server = ServerInterface() self.server_mode = True self.server_object = server self.active = True if event is not None: # async, return immediately and let the app poll for completion self.completion_event = event self.start() return # synchronous, wait for a result self.completion_event = event = threading.Event() self.start() while True: event.wait(0.1) if not self.active: e = self.get_exception() if e is not None: raise e raise SSHException("Negotiation failed.") if event.is_set(): break def add_server_key(self, key): """ Add a host key to the list of keys used for server mode. When behaving as a server, the host key is used to sign certain packets during the SSH2 negotiation, so that the client can trust that we are who we say we are. Because this is used for signing, the key must contain private key info, not just the public half. Only one key of each type (RSA or DSS) is kept. :param .PKey key: the host key to add, usually an `.RSAKey` or `.DSSKey`. """ self.server_key_dict[key.get_name()] = key # Handle SHA-2 extensions for RSA by ensuring that lookups into # self.server_key_dict will yield this key for any of the algorithm # names. if isinstance(key, RSAKey): self.server_key_dict["rsa-sha2-256"] = key self.server_key_dict["rsa-sha2-512"] = key def get_server_key(self): """ Return the active host key, in server mode. After negotiating with the client, this method will return the negotiated host key. If only one type of host key was set with `add_server_key`, that's the only key that will ever be returned. But in cases where you have set more than one type of host key (for example, an RSA key and a DSS key), the key type will be negotiated by the client, and this method will return the key of the type agreed on. If the host key has not been negotiated yet, ``None`` is returned. In client mode, the behavior is undefined. :return: host key (`.PKey`) of the type negotiated by the client, or ``None``. """ try: return self.server_key_dict[self.host_key_type] except KeyError: pass return None @staticmethod def load_server_moduli(filename=None): """ (optional) Load a file of prime moduli for use in doing group-exchange key negotiation in server mode. It's a rather obscure option and can be safely ignored. In server mode, the remote client may request "group-exchange" key negotiation, which asks the server to send a random prime number that fits certain criteria. These primes are pretty difficult to compute, so they can't be generated on demand. But many systems contain a file of suitable primes (usually named something like ``/etc/ssh/moduli``). If you call `load_server_moduli` and it returns ``True``, then this file of primes has been loaded and we will support "group-exchange" in server mode. Otherwise server mode will just claim that it doesn't support that method of key negotiation. :param str filename: optional path to the moduli file, if you happen to know that it's not in a standard location. :return: True if a moduli file was successfully loaded; False otherwise. .. note:: This has no effect when used in client mode. """ Transport._modulus_pack = ModulusPack() # places to look for the openssh "moduli" file file_list = ["/etc/ssh/moduli", "/usr/local/etc/moduli"] if filename is not None: file_list.insert(0, filename) for fn in file_list: try: Transport._modulus_pack.read_file(fn) return True except IOError: pass # none succeeded Transport._modulus_pack = None return False def close(self): """ Close this session, and any open channels that are tied to it. """ if not self.active: return self.stop_thread() for chan in list(self._channels.values()): chan._unlink() self.sock.close() def get_remote_server_key(self): """ Return the host key of the server (in client mode). .. note:: Previously this call returned a tuple of ``(key type, key string)``. You can get the same effect by calling `.PKey.get_name` for the key type, and ``str(key)`` for the key string. :raises: `.SSHException` -- if no session is currently active. :return: public key (`.PKey`) of the remote server """ if (not self.active) or (not self.initial_kex_done): raise SSHException("No existing session") return self.host_key def is_active(self): """ Return true if this session is active (open). :return: True if the session is still active (open); False if the session is closed """ return self.active def open_session( self, window_size=None, max_packet_size=None, timeout=None ): """ Request a new channel to the server, of type ``"session"``. This is just an alias for calling `open_channel` with an argument of ``"session"``. .. note:: Modifying the the window and packet sizes might have adverse effects on the session created. The default values are the same as in the OpenSSH code base and have been battle tested. :param int window_size: optional window size for this session. :param int max_packet_size: optional max packet size for this session. :return: a new `.Channel` :raises: `.SSHException` -- if the request is rejected or the session ends prematurely .. versionchanged:: 1.13.4/1.14.3/1.15.3 Added the ``timeout`` argument. .. versionchanged:: 1.15 Added the ``window_size`` and ``max_packet_size`` arguments. """ return self.open_channel( "session", window_size=window_size, max_packet_size=max_packet_size, timeout=timeout, ) def open_x11_channel(self, src_addr=None): """ Request a new channel to the client, of type ``"x11"``. This is just an alias for ``open_channel('x11', src_addr=src_addr)``. :param tuple src_addr: the source address (``(str, int)``) of the x11 server (port is the x11 port, ie. 6010) :return: a new `.Channel` :raises: `.SSHException` -- if the request is rejected or the session ends prematurely """ return self.open_channel("x11", src_addr=src_addr) def open_forward_agent_channel(self): """ Request a new channel to the client, of type ``"auth-agent@openssh.com"``. This is just an alias for ``open_channel('auth-agent@openssh.com')``. :return: a new `.Channel` :raises: `.SSHException` -- if the request is rejected or the session ends prematurely """ return self.open_channel("auth-agent@openssh.com") def open_forwarded_tcpip_channel(self, src_addr, dest_addr): """ Request a new channel back to the client, of type ``forwarded-tcpip``. This is used after a client has requested port forwarding, for sending incoming connections back to the client. :param src_addr: originator's address :param dest_addr: local (server) connected address """ return self.open_channel("forwarded-tcpip", dest_addr, src_addr) def open_channel( self, kind, dest_addr=None, src_addr=None, window_size=None, max_packet_size=None, timeout=None, ): """ Request a new channel to the server. `Channels <.Channel>` are socket-like objects used for the actual transfer of data across the session. You may only request a channel after negotiating encryption (using `connect` or `start_client`) and authenticating. .. note:: Modifying the the window and packet sizes might have adverse effects on the channel created. The default values are the same as in the OpenSSH code base and have been battle tested. :param str kind: the kind of channel requested (usually ``"session"``, ``"forwarded-tcpip"``, ``"direct-tcpip"``, or ``"x11"``) :param tuple dest_addr: the destination address (address + port tuple) of this port forwarding, if ``kind`` is ``"forwarded-tcpip"`` or ``"direct-tcpip"`` (ignored for other channel types) :param src_addr: the source address of this port forwarding, if ``kind`` is ``"forwarded-tcpip"``, ``"direct-tcpip"``, or ``"x11"`` :param int window_size: optional window size for this session. :param int max_packet_size: optional max packet size for this session. :param float timeout: optional timeout opening a channel, default 3600s (1h) :return: a new `.Channel` on success :raises: `.SSHException` -- if the request is rejected, the session ends prematurely or there is a timeout opening a channel .. versionchanged:: 1.15 Added the ``window_size`` and ``max_packet_size`` arguments. """ if not self.active: raise SSHException("SSH session not active") timeout = self.channel_timeout if timeout is None else timeout self.lock.acquire() try: window_size = self._sanitize_window_size(window_size) max_packet_size = self._sanitize_packet_size(max_packet_size) chanid = self._next_channel() m = Message() m.add_byte(cMSG_CHANNEL_OPEN) m.add_string(kind) m.add_int(chanid) m.add_int(window_size) m.add_int(max_packet_size) if (kind == "forwarded-tcpip") or (kind == "direct-tcpip"): m.add_string(dest_addr[0]) m.add_int(dest_addr[1]) m.add_string(src_addr[0]) m.add_int(src_addr[1]) elif kind == "x11": m.add_string(src_addr[0]) m.add_int(src_addr[1]) chan = Channel(chanid) self._channels.put(chanid, chan) self.channel_events[chanid] = event = threading.Event() self.channels_seen[chanid] = True chan._set_transport(self) chan._set_window(window_size, max_packet_size) finally: self.lock.release() self._send_user_message(m) start_ts = time.time() while True: event.wait(0.1) if not self.active: e = self.get_exception() if e is None: e = SSHException("Unable to open channel.") raise e if event.is_set(): break elif start_ts + timeout < time.time(): raise SSHException("Timeout opening channel.") chan = self._channels.get(chanid) if chan is not None: return chan e = self.get_exception() if e is None: e = SSHException("Unable to open channel.") raise e def request_port_forward(self, address, port, handler=None): """ Ask the server to forward TCP connections from a listening port on the server, across this SSH session. If a handler is given, that handler is called from a different thread whenever a forwarded connection arrives. The handler parameters are:: handler( channel, (origin_addr, origin_port), (server_addr, server_port), ) where ``server_addr`` and ``server_port`` are the address and port that the server was listening on. If no handler is set, the default behavior is to send new incoming forwarded connections into the accept queue, to be picked up via `accept`. :param str address: the address to bind when forwarding :param int port: the port to forward, or 0 to ask the server to allocate any port :param callable handler: optional handler for incoming forwarded connections, of the form ``func(Channel, (str, int), (str, int))``. :return: the port number (`int`) allocated by the server :raises: `.SSHException` -- if the server refused the TCP forward request """ if not self.active: raise SSHException("SSH session not active") port = int(port) response = self.global_request( "tcpip-forward", (address, port), wait=True ) if response is None: raise SSHException("TCP forwarding request denied") if port == 0: port = response.get_int() if handler is None: def default_handler(channel, src_addr, dest_addr_port): # src_addr, src_port = src_addr_port # dest_addr, dest_port = dest_addr_port self._queue_incoming_channel(channel) handler = default_handler self._tcp_handler = handler return port def cancel_port_forward(self, address, port): """ Ask the server to cancel a previous port-forwarding request. No more connections to the given address & port will be forwarded across this ssh connection. :param str address: the address to stop forwarding :param int port: the port to stop forwarding """ if not self.active: return self._tcp_handler = None self.global_request("cancel-tcpip-forward", (address, port), wait=True) def open_sftp_client(self): """ Create an SFTP client channel from an open transport. On success, an SFTP session will be opened with the remote host, and a new `.SFTPClient` object will be returned. :return: a new `.SFTPClient` referring to an sftp session (channel) across this transport """ return SFTPClient.from_transport(self) def send_ignore(self, byte_count=None): """ Send a junk packet across the encrypted link. This is sometimes used to add "noise" to a connection to confuse would-be attackers. It can also be used as a keep-alive for long lived connections traversing firewalls. :param int byte_count: the number of random bytes to send in the payload of the ignored packet -- defaults to a random number from 10 to 41. """ m = Message() m.add_byte(cMSG_IGNORE) if byte_count is None: byte_count = (byte_ord(os.urandom(1)) % 32) + 10 m.add_bytes(os.urandom(byte_count)) self._send_user_message(m) def renegotiate_keys(self): """ Force this session to switch to new keys. Normally this is done automatically after the session hits a certain number of packets or bytes sent or received, but this method gives you the option of forcing new keys whenever you want. Negotiating new keys causes a pause in traffic both ways as the two sides swap keys and do computations. This method returns when the session has switched to new keys. :raises: `.SSHException` -- if the key renegotiation failed (which causes the session to end) """ self.completion_event = threading.Event() self._send_kex_init() while True: self.completion_event.wait(0.1) if not self.active: e = self.get_exception() if e is not None: raise e raise SSHException("Negotiation failed.") if self.completion_event.is_set(): break return def set_keepalive(self, interval): """ Turn on/off keepalive packets (default is off). If this is set, after ``interval`` seconds without sending any data over the connection, a "keepalive" packet will be sent (and ignored by the remote host). This can be useful to keep connections alive over a NAT, for example. :param int interval: seconds to wait before sending a keepalive packet (or 0 to disable keepalives). """ def _request(x=weakref.proxy(self)): return x.global_request("keepalive@lag.net", wait=False) self.packetizer.set_keepalive(interval, _request) def global_request(self, kind, data=None, wait=True): """ Make a global request to the remote host. These are normally extensions to the SSH2 protocol. :param str kind: name of the request. :param tuple data: an optional tuple containing additional data to attach to the request. :param bool wait: ``True`` if this method should not return until a response is received; ``False`` otherwise. :return: a `.Message` containing possible additional data if the request was successful (or an empty `.Message` if ``wait`` was ``False``); ``None`` if the request was denied. """ if wait: self.completion_event = threading.Event() m = Message() m.add_byte(cMSG_GLOBAL_REQUEST) m.add_string(kind) m.add_boolean(wait) if data is not None: m.add(*data) self._log(DEBUG, 'Sending global request "{}"'.format(kind)) self._send_user_message(m) if not wait: return None while True: self.completion_event.wait(0.1) if not self.active: return None if self.completion_event.is_set(): break return self.global_response def accept(self, timeout=None): """ Return the next channel opened by the client over this transport, in server mode. If no channel is opened before the given timeout, ``None`` is returned. :param int timeout: seconds to wait for a channel, or ``None`` to wait forever :return: a new `.Channel` opened by the client """ self.lock.acquire() try: if len(self.server_accepts) > 0: chan = self.server_accepts.pop(0) else: self.server_accept_cv.wait(timeout) if len(self.server_accepts) > 0: chan = self.server_accepts.pop(0) else: # timeout chan = None finally: self.lock.release() return chan def connect( self, hostkey=None, username="", password=None, pkey=None, gss_host=None, gss_auth=False, gss_kex=False, gss_deleg_creds=True, gss_trust_dns=True, ): """ Negotiate an SSH2 session, and optionally verify the server's host key and authenticate using a password or private key. This is a shortcut for `start_client`, `get_remote_server_key`, and `Transport.auth_password` or `Transport.auth_publickey`. Use those methods if you want more control. You can use this method immediately after creating a Transport to negotiate encryption with a server. If it fails, an exception will be thrown. On success, the method will return cleanly, and an encrypted session exists. You may immediately call `open_channel` or `open_session` to get a `.Channel` object, which is used for data transfer. .. note:: If you fail to supply a password or private key, this method may succeed, but a subsequent `open_channel` or `open_session` call may fail because you haven't authenticated yet. :param .PKey hostkey: the host key expected from the server, or ``None`` if you don't want to do host key verification. :param str username: the username to authenticate as. :param str password: a password to use for authentication, if you want to use password authentication; otherwise ``None``. :param .PKey pkey: a private key to use for authentication, if you want to use private key authentication; otherwise ``None``. :param str gss_host: The target's name in the kerberos database. Default: hostname :param bool gss_auth: ``True`` if you want to use GSS-API authentication. :param bool gss_kex: Perform GSS-API Key Exchange and user authentication. :param bool gss_deleg_creds: Whether to delegate GSS-API client credentials. :param gss_trust_dns: Indicates whether or not the DNS is trusted to securely canonicalize the name of the host being connected to (default ``True``). :raises: `.SSHException` -- if the SSH2 negotiation fails, the host key supplied by the server is incorrect, or authentication fails. .. versionchanged:: 2.3 Added the ``gss_trust_dns`` argument. """ if hostkey is not None: # TODO: a more robust implementation would be to ask each key class # for its nameS plural, and just use that. # TODO: that could be used in a bunch of other spots too if isinstance(hostkey, RSAKey): self._preferred_keys = [ "rsa-sha2-512", "rsa-sha2-256", "ssh-rsa", ] else: self._preferred_keys = [hostkey.get_name()] self.set_gss_host( gss_host=gss_host, trust_dns=gss_trust_dns, gssapi_requested=gss_kex or gss_auth, ) self.start_client() # check host key if we were given one # If GSS-API Key Exchange was performed, we are not required to check # the host key. if (hostkey is not None) and not gss_kex: key = self.get_remote_server_key() if ( key.get_name() != hostkey.get_name() or key.asbytes() != hostkey.asbytes() ): self._log(DEBUG, "Bad host key from server") self._log( DEBUG, "Expected: {}: {}".format( hostkey.get_name(), repr(hostkey.asbytes()) ), ) self._log( DEBUG, "Got : {}: {}".format( key.get_name(), repr(key.asbytes()) ), ) raise SSHException("Bad host key from server") self._log( DEBUG, "Host key verified ({})".format(hostkey.get_name()) ) if (pkey is not None) or (password is not None) or gss_auth or gss_kex: if gss_auth: self._log( DEBUG, "Attempting GSS-API auth... (gssapi-with-mic)" ) # noqa self.auth_gssapi_with_mic( username, self.gss_host, gss_deleg_creds ) elif gss_kex: self._log(DEBUG, "Attempting GSS-API auth... (gssapi-keyex)") self.auth_gssapi_keyex(username) elif pkey is not None: self._log(DEBUG, "Attempting public-key auth...") self.auth_publickey(username, pkey) else: self._log(DEBUG, "Attempting password auth...") self.auth_password(username, password) return def get_exception(self): """ Return any exception that happened during the last server request. This can be used to fetch more specific error information after using calls like `start_client`. The exception (if any) is cleared after this call. :return: an exception, or ``None`` if there is no stored exception. .. versionadded:: 1.1 """ self.lock.acquire() try: e = self.saved_exception self.saved_exception = None return e finally: self.lock.release() def set_subsystem_handler(self, name, handler, *args, **kwargs): """ Set the handler class for a subsystem in server mode. If a request for this subsystem is made on an open ssh channel later, this handler will be constructed and called -- see `.SubsystemHandler` for more detailed documentation. Any extra parameters (including keyword arguments) are saved and passed to the `.SubsystemHandler` constructor later. :param str name: name of the subsystem. :param handler: subclass of `.SubsystemHandler` that handles this subsystem. """ try: self.lock.acquire() self.subsystem_table[name] = (handler, args, kwargs) finally: self.lock.release() def is_authenticated(self): """ Return true if this session is active and authenticated. :return: True if the session is still open and has been authenticated successfully; False if authentication failed and/or the session is closed. """ return ( self.active and self.auth_handler is not None and self.auth_handler.is_authenticated() ) def get_username(self): """ Return the username this connection is authenticated for. If the session is not authenticated (or authentication failed), this method returns ``None``. :return: username that was authenticated (a `str`), or ``None``. """ if not self.active or (self.auth_handler is None): return None return self.auth_handler.get_username() def get_banner(self): """ Return the banner supplied by the server upon connect. If no banner is supplied, this method returns ``None``. :returns: server supplied banner (`str`), or ``None``. .. versionadded:: 1.13 """ if not self.active or (self.auth_handler is None): return None return self.auth_handler.banner def auth_none(self, username): """ Try to authenticate to the server using no authentication at all. This will almost always fail. It may be useful for determining the list of authentication types supported by the server, by catching the `.BadAuthenticationType` exception raised. :param str username: the username to authenticate as :return: list of auth types permissible for the next stage of authentication (normally empty) :raises: `.BadAuthenticationType` -- if "none" authentication isn't allowed by the server for this user :raises: `.SSHException` -- if the authentication failed due to a network error .. versionadded:: 1.5 """ if (not self.active) or (not self.initial_kex_done): raise SSHException("No existing session") my_event = threading.Event() self.auth_handler = AuthHandler(self) self.auth_handler.auth_none(username, my_event) return self.auth_handler.wait_for_response(my_event) def auth_password(self, username, password, event=None, fallback=True): """ Authenticate to the server using a password. The username and password are sent over an encrypted link. If an ``event`` is passed in, this method will return immediately, and the event will be triggered once authentication succeeds or fails. On success, `is_authenticated` will return ``True``. On failure, you may use `get_exception` to get more detailed error information. Since 1.1, if no event is passed, this method will block until the authentication succeeds or fails. On failure, an exception is raised. Otherwise, the method simply returns. Since 1.5, if no event is passed and ``fallback`` is ``True`` (the default), if the server doesn't support plain password authentication but does support so-called "keyboard-interactive" mode, an attempt will be made to authenticate using this interactive mode. If it fails, the normal exception will be thrown as if the attempt had never been made. This is useful for some recent Gentoo and Debian distributions, which turn off plain password authentication in a misguided belief that interactive authentication is "more secure". (It's not.) If the server requires multi-step authentication (which is very rare), this method will return a list of auth types permissible for the next step. Otherwise, in the normal case, an empty list is returned. :param str username: the username to authenticate as :param basestring password: the password to authenticate with :param .threading.Event event: an event to trigger when the authentication attempt is complete (whether it was successful or not) :param bool fallback: ``True`` if an attempt at an automated "interactive" password auth should be made if the server doesn't support normal password auth :return: list of auth types permissible for the next stage of authentication (normally empty) :raises: `.BadAuthenticationType` -- if password authentication isn't allowed by the server for this user (and no event was passed in) :raises: `.AuthenticationException` -- if the authentication failed (and no event was passed in) :raises: `.SSHException` -- if there was a network error """ if (not self.active) or (not self.initial_kex_done): # we should never try to send the password unless we're on a secure # link raise SSHException("No existing session") if event is None: my_event = threading.Event() else: my_event = event self.auth_handler = AuthHandler(self) self.auth_handler.auth_password(username, password, my_event) if event is not None: # caller wants to wait for event themselves return [] try: return self.auth_handler.wait_for_response(my_event) except BadAuthenticationType as e: # if password auth isn't allowed, but keyboard-interactive *is*, # try to fudge it if not fallback or ("keyboard-interactive" not in e.allowed_types): raise try: def handler(title, instructions, fields): if len(fields) > 1: raise SSHException("Fallback authentication failed.") if len(fields) == 0: # for some reason, at least on os x, a 2nd request will # be made with zero fields requested. maybe it's just # to try to fake out automated scripting of the exact # type we're doing here. *shrug* :) return [] return [password] return self.auth_interactive(username, handler) except SSHException: # attempt failed; just raise the original exception raise e def auth_publickey(self, username, key, event=None): """ Authenticate to the server using a private key. The key is used to sign data from the server, so it must include the private part. If an ``event`` is passed in, this method will return immediately, and the event will be triggered once authentication succeeds or fails. On success, `is_authenticated` will return ``True``. On failure, you may use `get_exception` to get more detailed error information. Since 1.1, if no event is passed, this method will block until the authentication succeeds or fails. On failure, an exception is raised. Otherwise, the method simply returns. If the server requires multi-step authentication (which is very rare), this method will return a list of auth types permissible for the next step. Otherwise, in the normal case, an empty list is returned. :param str username: the username to authenticate as :param .PKey key: the private key to authenticate with :param .threading.Event event: an event to trigger when the authentication attempt is complete (whether it was successful or not) :return: list of auth types permissible for the next stage of authentication (normally empty) :raises: `.BadAuthenticationType` -- if public-key authentication isn't allowed by the server for this user (and no event was passed in) :raises: `.AuthenticationException` -- if the authentication failed (and no event was passed in) :raises: `.SSHException` -- if there was a network error """ if (not self.active) or (not self.initial_kex_done): # we should never try to authenticate unless we're on a secure link raise SSHException("No existing session") if event is None: my_event = threading.Event() else: my_event = event self.auth_handler = AuthHandler(self) self.auth_handler.auth_publickey(username, key, my_event) if event is not None: # caller wants to wait for event themselves return [] return self.auth_handler.wait_for_response(my_event) def auth_interactive(self, username, handler, submethods=""): """ Authenticate to the server interactively. A handler is used to answer arbitrary questions from the server. On many servers, this is just a dumb wrapper around PAM. This method will block until the authentication succeeds or fails, periodically calling the handler asynchronously to get answers to authentication questions. The handler may be called more than once if the server continues to ask questions. The handler is expected to be a callable that will handle calls of the form: ``handler(title, instructions, prompt_list)``. The ``title`` is meant to be a dialog-window title, and the ``instructions`` are user instructions (both are strings). ``prompt_list`` will be a list of prompts, each prompt being a tuple of ``(str, bool)``. The string is the prompt and the boolean indicates whether the user text should be echoed. A sample call would thus be: ``handler('title', 'instructions', [('Password:', False)])``. The handler should return a list or tuple of answers to the server's questions. If the server requires multi-step authentication (which is very rare), this method will return a list of auth types permissible for the next step. Otherwise, in the normal case, an empty list is returned. :param str username: the username to authenticate as :param callable handler: a handler for responding to server questions :param str submethods: a string list of desired submethods (optional) :return: list of auth types permissible for the next stage of authentication (normally empty). :raises: `.BadAuthenticationType` -- if public-key authentication isn't allowed by the server for this user :raises: `.AuthenticationException` -- if the authentication failed :raises: `.SSHException` -- if there was a network error .. versionadded:: 1.5 """ if (not self.active) or (not self.initial_kex_done): # we should never try to authenticate unless we're on a secure link raise SSHException("No existing session") my_event = threading.Event() self.auth_handler = AuthHandler(self) self.auth_handler.auth_interactive( username, handler, my_event, submethods ) return self.auth_handler.wait_for_response(my_event) def auth_interactive_dumb(self, username, handler=None, submethods=""): """ Authenticate to the server interactively but dumber. Just print the prompt and / or instructions to stdout and send back the response. This is good for situations where partial auth is achieved by key and then the user has to enter a 2fac token. """ if not handler: def handler(title, instructions, prompt_list): answers = [] if title: print(title.strip()) if instructions: print(instructions.strip()) for prompt, show_input in prompt_list: print(prompt.strip(), end=" ") answers.append(input()) return answers return self.auth_interactive(username, handler, submethods) def auth_gssapi_with_mic(self, username, gss_host, gss_deleg_creds): """ Authenticate to the Server using GSS-API / SSPI. :param str username: The username to authenticate as :param str gss_host: The target host :param bool gss_deleg_creds: Delegate credentials or not :return: list of auth types permissible for the next stage of authentication (normally empty) :raises: `.BadAuthenticationType` -- if gssapi-with-mic isn't allowed by the server (and no event was passed in) :raises: `.AuthenticationException` -- if the authentication failed (and no event was passed in) :raises: `.SSHException` -- if there was a network error """ if (not self.active) or (not self.initial_kex_done): # we should never try to authenticate unless we're on a secure link raise SSHException("No existing session") my_event = threading.Event() self.auth_handler = AuthHandler(self) self.auth_handler.auth_gssapi_with_mic( username, gss_host, gss_deleg_creds, my_event ) return self.auth_handler.wait_for_response(my_event) def auth_gssapi_keyex(self, username): """ Authenticate to the server with GSS-API/SSPI if GSS-API kex is in use. :param str username: The username to authenticate as. :returns: a list of auth types permissible for the next stage of authentication (normally empty) :raises: `.BadAuthenticationType` -- if GSS-API Key Exchange was not performed (and no event was passed in) :raises: `.AuthenticationException` -- if the authentication failed (and no event was passed in) :raises: `.SSHException` -- if there was a network error """ if (not self.active) or (not self.initial_kex_done): # we should never try to authenticate unless we're on a secure link raise SSHException("No existing session") my_event = threading.Event() self.auth_handler = AuthHandler(self) self.auth_handler.auth_gssapi_keyex(username, my_event) return self.auth_handler.wait_for_response(my_event) def set_log_channel(self, name): """ Set the channel for this transport's logging. The default is ``"paramiko.transport"`` but it can be set to anything you want. (See the `.logging` module for more info.) SSH Channels will log to a sub-channel of the one specified. :param str name: new channel name for logging .. versionadded:: 1.1 """ self.log_name = name self.logger = util.get_logger(name) self.packetizer.set_log(self.logger) def get_log_channel(self): """ Return the channel name used for this transport's logging. :return: channel name as a `str` .. versionadded:: 1.2 """ return self.log_name def set_hexdump(self, hexdump): """ Turn on/off logging a hex dump of protocol traffic at DEBUG level in the logs. Normally you would want this off (which is the default), but if you are debugging something, it may be useful. :param bool hexdump: ``True`` to log protocol traffix (in hex) to the log; ``False`` otherwise. """ self.packetizer.set_hexdump(hexdump) def get_hexdump(self): """ Return ``True`` if the transport is currently logging hex dumps of protocol traffic. :return: ``True`` if hex dumps are being logged, else ``False``. .. versionadded:: 1.4 """ return self.packetizer.get_hexdump() def use_compression(self, compress=True): """ Turn on/off compression. This will only have an affect before starting the transport (ie before calling `connect`, etc). By default, compression is off since it negatively affects interactive sessions. :param bool compress: ``True`` to ask the remote client/server to compress traffic; ``False`` to refuse compression .. versionadded:: 1.5.2 """ if compress: self._preferred_compression = ("zlib@openssh.com", "zlib", "none") else: self._preferred_compression = ("none",) def getpeername(self): """ Return the address of the remote side of this Transport, if possible. This is effectively a wrapper around ``getpeername`` on the underlying socket. If the socket-like object has no ``getpeername`` method, then ``("unknown", 0)`` is returned. :return: the address of the remote host, if known, as a ``(str, int)`` tuple. """ gp = getattr(self.sock, "getpeername", None) if gp is None: return "unknown", 0 return gp() def stop_thread(self): self.active = False self.packetizer.close() # Keep trying to join() our main thread, quickly, until: # * We join()ed successfully (self.is_alive() == False) # * Or it looks like we've hit issue #520 (socket.recv hitting some # race condition preventing it from timing out correctly), wherein # our socket and packetizer are both closed (but where we'd # otherwise be sitting forever on that recv()). while ( self.is_alive() and self is not threading.current_thread() and not self.sock._closed and not self.packetizer.closed ): self.join(0.1) # internals... # TODO 4.0: make a public alias for this because multiple other classes # already explicitly rely on it...or just rewrite logging :D def _log(self, level, msg, *args): if issubclass(type(msg), list): for m in msg: self.logger.log(level, m) else: self.logger.log(level, msg, *args) def _get_modulus_pack(self): """used by KexGex to find primes for group exchange""" return self._modulus_pack def _next_channel(self): """you are holding the lock""" chanid = self._channel_counter while self._channels.get(chanid) is not None: self._channel_counter = (self._channel_counter + 1) & 0xFFFFFF chanid = self._channel_counter self._channel_counter = (self._channel_counter + 1) & 0xFFFFFF return chanid def _unlink_channel(self, chanid): """used by a Channel to remove itself from the active channel list""" self._channels.delete(chanid) def _send_message(self, data): self.packetizer.send_message(data) def _send_user_message(self, data): """ send a message, but block if we're in key negotiation. this is used for user-initiated requests. """ start = time.time() while True: self.clear_to_send.wait(0.1) if not self.active: self._log( DEBUG, "Dropping user packet because connection is dead." ) # noqa return self.clear_to_send_lock.acquire() if self.clear_to_send.is_set(): break self.clear_to_send_lock.release() if time.time() > start + self.clear_to_send_timeout: raise SSHException( "Key-exchange timed out waiting for key negotiation" ) # noqa try: self._send_message(data) finally: self.clear_to_send_lock.release() def _set_K_H(self, k, h): """ Used by a kex obj to set the K (root key) and H (exchange hash). """ self.K = k self.H = h if self.session_id is None: self.session_id = h def _expect_packet(self, *ptypes): """ Used by a kex obj to register the next packet type it expects to see. """ self._expected_packet = tuple(ptypes) def _verify_key(self, host_key, sig): key = self._key_info[self.host_key_type](Message(host_key)) if key is None: raise SSHException("Unknown host key type") if not key.verify_ssh_sig(self.H, Message(sig)): raise SSHException( "Signature verification ({}) failed.".format( self.host_key_type ) ) # noqa self.host_key = key def _compute_key(self, id, nbytes): """id is 'A' - 'F' for the various keys used by ssh""" m = Message() m.add_mpint(self.K) m.add_bytes(self.H) m.add_byte(b(id)) m.add_bytes(self.session_id) # Fallback to SHA1 for kex engines that fail to specify a hex # algorithm, or for e.g. transport tests that don't run kexinit. hash_algo = getattr(self.kex_engine, "hash_algo", None) hash_select_msg = "kex engine {} specified hash_algo {!r}".format( self.kex_engine.__class__.__name__, hash_algo ) if hash_algo is None: hash_algo = sha1 hash_select_msg += ", falling back to sha1" if not hasattr(self, "_logged_hash_selection"): self._log(DEBUG, hash_select_msg) setattr(self, "_logged_hash_selection", True) out = sofar = hash_algo(m.asbytes()).digest() while len(out) < nbytes: m = Message() m.add_mpint(self.K) m.add_bytes(self.H) m.add_bytes(sofar) digest = hash_algo(m.asbytes()).digest() out += digest sofar += digest return out[:nbytes] def _get_cipher(self, name, key, iv, operation): if name not in self._cipher_info: raise SSHException("Unknown client cipher " + name) else: cipher = Cipher( self._cipher_info[name]["class"](key), self._cipher_info[name]["mode"](iv), backend=default_backend(), ) if operation is self._ENCRYPT: return cipher.encryptor() else: return cipher.decryptor() def _set_forward_agent_handler(self, handler): if handler is None: def default_handler(channel): self._queue_incoming_channel(channel) self._forward_agent_handler = default_handler else: self._forward_agent_handler = handler def _set_x11_handler(self, handler): # only called if a channel has turned on x11 forwarding if handler is None: # by default, use the same mechanism as accept() def default_handler(channel, src_addr_port): self._queue_incoming_channel(channel) self._x11_handler = default_handler else: self._x11_handler = handler def _queue_incoming_channel(self, channel): self.lock.acquire() try: self.server_accepts.append(channel) self.server_accept_cv.notify() finally: self.lock.release() def _sanitize_window_size(self, window_size): if window_size is None: window_size = self.default_window_size return clamp_value(MIN_WINDOW_SIZE, window_size, MAX_WINDOW_SIZE) def _sanitize_packet_size(self, max_packet_size): if max_packet_size is None: max_packet_size = self.default_max_packet_size return clamp_value(MIN_PACKET_SIZE, max_packet_size, MAX_WINDOW_SIZE) def _ensure_authed(self, ptype, message): """ Checks message type against current auth state. If server mode, and auth has not succeeded, and the message is of a post-auth type (channel open or global request) an appropriate error response Message is crafted and returned to caller for sending. Otherwise (client mode, authed, or pre-auth message) returns None. """ if ( not self.server_mode or ptype <= HIGHEST_USERAUTH_MESSAGE_ID or self.is_authenticated() ): return None # WELP. We must be dealing with someone trying to do non-auth things # without being authed. Tell them off, based on message class. reply = Message() # Global requests have no details, just failure. if ptype == MSG_GLOBAL_REQUEST: reply.add_byte(cMSG_REQUEST_FAILURE) # Channel opens let us reject w/ a specific type + message. elif ptype == MSG_CHANNEL_OPEN: kind = message.get_text() # noqa chanid = message.get_int() reply.add_byte(cMSG_CHANNEL_OPEN_FAILURE) reply.add_int(chanid) reply.add_int(OPEN_FAILED_ADMINISTRATIVELY_PROHIBITED) reply.add_string("") reply.add_string("en") # NOTE: Post-open channel messages do not need checking; the above will # reject attempts to open channels, meaning that even if a malicious # user tries to send a MSG_CHANNEL_REQUEST, it will simply fall under # the logic that handles unknown channel IDs (as the channel list will # be empty.) return reply def _enforce_strict_kex(self, ptype): """ Conditionally raise `MessageOrderError` during strict initial kex. This method should only be called inside code that handles non-KEXINIT messages; it does not interrogate ``ptype`` besides using it to log more accurately. """ if self.agreed_on_strict_kex and not self.initial_kex_done: name = MSG_NAMES.get(ptype, f"msg {ptype}") raise MessageOrderError( f"In strict-kex mode, but was sent {name!r}!" ) def run(self): # (use the exposed "run" method, because if we specify a thread target # of a private method, threading.Thread will keep a reference to it # indefinitely, creating a GC cycle and not letting Transport ever be # GC'd. it's a bug in Thread.) # Hold reference to 'sys' so we can test sys.modules to detect # interpreter shutdown. self.sys = sys # active=True occurs before the thread is launched, to avoid a race _active_threads.append(self) tid = hex(id(self) & xffffffff) if self.server_mode: self._log(DEBUG, "starting thread (server mode): {}".format(tid)) else: self._log(DEBUG, "starting thread (client mode): {}".format(tid)) try: try: self.packetizer.write_all(b(self.local_version + "\r\n")) self._log( DEBUG, "Local version/idstring: {}".format(self.local_version), ) # noqa self._check_banner() # The above is actually very much part of the handshake, but # sometimes the banner can be read but the machine is not # responding, for example when the remote ssh daemon is loaded # in to memory but we can not read from the disk/spawn a new # shell. # Make sure we can specify a timeout for the initial handshake. # Re-use the banner timeout for now. self.packetizer.start_handshake(self.handshake_timeout) self._send_kex_init() self._expect_packet(MSG_KEXINIT) while self.active: if self.packetizer.need_rekey() and not self.in_kex: self._send_kex_init() try: ptype, m = self.packetizer.read_message() except NeedRekeyException: continue if ptype == MSG_IGNORE: self._enforce_strict_kex(ptype) continue elif ptype == MSG_DISCONNECT: self._parse_disconnect(m) break elif ptype == MSG_DEBUG: self._enforce_strict_kex(ptype) self._parse_debug(m) continue if len(self._expected_packet) > 0: if ptype not in self._expected_packet: exc_class = SSHException if self.agreed_on_strict_kex: exc_class = MessageOrderError raise exc_class( "Expecting packet from {!r}, got {:d}".format( self._expected_packet, ptype ) ) # noqa self._expected_packet = tuple() # These message IDs indicate key exchange & will differ # depending on exact exchange algorithm if (ptype >= 30) and (ptype <= 41): self.kex_engine.parse_next(ptype, m) continue if ptype in self._handler_table: error_msg = self._ensure_authed(ptype, m) if error_msg: self._send_message(error_msg) else: self._handler_table[ptype](m) elif ptype in self._channel_handler_table: chanid = m.get_int() chan = self._channels.get(chanid) if chan is not None: self._channel_handler_table[ptype](chan, m) elif chanid in self.channels_seen: self._log( DEBUG, "Ignoring message for dead channel {:d}".format( # noqa chanid ), ) else: self._log( ERROR, "Channel request for unknown channel {:d}".format( # noqa chanid ), ) break elif ( self.auth_handler is not None and ptype in self.auth_handler._handler_table ): handler = self.auth_handler._handler_table[ptype] handler(m) if len(self._expected_packet) > 0: continue else: # Respond with "I don't implement this particular # message type" message (unless the message type was # itself literally MSG_UNIMPLEMENTED, in which case, we # just shut up to avoid causing a useless loop). name = MSG_NAMES[ptype] warning = "Oops, unhandled type {} ({!r})".format( ptype, name ) self._log(WARNING, warning) if ptype != MSG_UNIMPLEMENTED: msg = Message() msg.add_byte(cMSG_UNIMPLEMENTED) msg.add_int(m.seqno) self._send_message(msg) self.packetizer.complete_handshake() except SSHException as e: self._log( ERROR, "Exception ({}): {}".format( "server" if self.server_mode else "client", e ), ) self._log(ERROR, util.tb_strings()) self.saved_exception = e except EOFError as e: self._log(DEBUG, "EOF in transport thread") self.saved_exception = e except socket.error as e: if type(e.args) is tuple: if e.args: emsg = "{} ({:d})".format(e.args[1], e.args[0]) else: # empty tuple, e.g. socket.timeout emsg = str(e) or repr(e) else: emsg = e.args self._log(ERROR, "Socket exception: " + emsg) self.saved_exception = e except Exception as e: self._log(ERROR, "Unknown exception: " + str(e)) self._log(ERROR, util.tb_strings()) self.saved_exception = e _active_threads.remove(self) for chan in list(self._channels.values()): chan._unlink() if self.active: self.active = False self.packetizer.close() if self.completion_event is not None: self.completion_event.set() if self.auth_handler is not None: self.auth_handler.abort() for event in self.channel_events.values(): event.set() try: self.lock.acquire() self.server_accept_cv.notify() finally: self.lock.release() self.sock.close() except: # Don't raise spurious 'NoneType has no attribute X' errors when we # wake up during interpreter shutdown. Or rather -- raise # everything *if* sys.modules (used as a convenient sentinel) # appears to still exist. if self.sys.modules is not None: raise def _log_agreement(self, which, local, remote): # Log useful, non-duplicative line re: an agreed-upon algorithm. # Old code implied algorithms could be asymmetrical (different for # inbound vs outbound) so we preserve that possibility. msg = "{}: ".format(which) if local == remote: msg += local else: msg += "local={}, remote={}".format(local, remote) self._log(DEBUG, msg) # protocol stages def _negotiate_keys(self, m): # throws SSHException on anything unusual self.clear_to_send_lock.acquire() try: self.clear_to_send.clear() finally: self.clear_to_send_lock.release() if self.local_kex_init is None: # remote side wants to renegotiate self._send_kex_init() self._parse_kex_init(m) self.kex_engine.start_kex() def _check_banner(self): # this is slow, but we only have to do it once for i in range(100): # give them 15 seconds for the first line, then just 2 seconds # each additional line. (some sites have very high latency.) if i == 0: timeout = self.banner_timeout else: timeout = 2 try: buf = self.packetizer.readline(timeout) except ProxyCommandFailure: raise except Exception as e: raise SSHException( "Error reading SSH protocol banner" + str(e) ) if buf[:4] == "SSH-": break self._log(DEBUG, "Banner: " + buf) if buf[:4] != "SSH-": raise SSHException('Indecipherable protocol version "' + buf + '"') # save this server version string for later self.remote_version = buf self._log(DEBUG, "Remote version/idstring: {}".format(buf)) # pull off any attached comment # NOTE: comment used to be stored in a variable and then...never used. # since 2003. ca 877cd974b8182d26fa76d566072917ea67b64e67 i = buf.find(" ") if i >= 0: buf = buf[:i] # parse out version string and make sure it matches segs = buf.split("-", 2) if len(segs) < 3: raise SSHException("Invalid SSH banner") version = segs[1] client = segs[2] if version != "1.99" and version != "2.0": msg = "Incompatible version ({} instead of 2.0)" raise IncompatiblePeer(msg.format(version)) msg = "Connected (version {}, client {})".format(version, client) self._log(INFO, msg) def _send_kex_init(self): """ announce to the other side that we'd like to negotiate keys, and what kind of key negotiation we support. """ self.clear_to_send_lock.acquire() try: self.clear_to_send.clear() finally: self.clear_to_send_lock.release() self.gss_kex_used = False self.in_kex = True kex_algos = list(self.preferred_kex) if self.server_mode: mp_required_prefix = "diffie-hellman-group-exchange-sha" kex_mp = [k for k in kex_algos if k.startswith(mp_required_prefix)] if (self._modulus_pack is None) and (len(kex_mp) > 0): # can't do group-exchange if we don't have a pack of potential # primes pkex = [ k for k in self.get_security_options().kex if not k.startswith(mp_required_prefix) ] self.get_security_options().kex = pkex available_server_keys = list( filter( list(self.server_key_dict.keys()).__contains__, # TODO: ensure tests will catch if somebody streamlines # this by mistake - case is the admittedly silly one where # the only calls to add_server_key() contain keys which # were filtered out of the below via disabled_algorithms. # If this is streamlined, we would then be allowing the # disabled algorithm(s) for hostkey use # TODO: honestly this prob just wants to get thrown out # when we make kex configuration more straightforward self.preferred_keys, ) ) else: available_server_keys = self.preferred_keys # Signal support for MSG_EXT_INFO so server will send it to us. # NOTE: doing this here handily means we don't even consider this # value when agreeing on real kex algo to use (which is a common # pitfall when adding this apparently). kex_algos.append("ext-info-c") # Similar to ext-info, but used in both server modes, so done outside # of above if/else. if self.advertise_strict_kex: which = "s" if self.server_mode else "c" kex_algos.append(f"kex-strict-{which}-v00@openssh.com") m = Message() m.add_byte(cMSG_KEXINIT) m.add_bytes(os.urandom(16)) m.add_list(kex_algos) m.add_list(available_server_keys) m.add_list(self.preferred_ciphers) m.add_list(self.preferred_ciphers) m.add_list(self.preferred_macs) m.add_list(self.preferred_macs) m.add_list(self.preferred_compression) m.add_list(self.preferred_compression) m.add_string(bytes()) m.add_string(bytes()) m.add_boolean(False) m.add_int(0) # save a copy for later (needed to compute a hash) self.local_kex_init = self._latest_kex_init = m.asbytes() self._send_message(m) def _really_parse_kex_init(self, m, ignore_first_byte=False): parsed = {} if ignore_first_byte: m.get_byte() m.get_bytes(16) # cookie, discarded parsed["kex_algo_list"] = m.get_list() parsed["server_key_algo_list"] = m.get_list() parsed["client_encrypt_algo_list"] = m.get_list() parsed["server_encrypt_algo_list"] = m.get_list() parsed["client_mac_algo_list"] = m.get_list() parsed["server_mac_algo_list"] = m.get_list() parsed["client_compress_algo_list"] = m.get_list() parsed["server_compress_algo_list"] = m.get_list() parsed["client_lang_list"] = m.get_list() parsed["server_lang_list"] = m.get_list() parsed["kex_follows"] = m.get_boolean() m.get_int() # unused return parsed def _get_latest_kex_init(self): return self._really_parse_kex_init( Message(self._latest_kex_init), ignore_first_byte=True, ) def _parse_kex_init(self, m): parsed = self._really_parse_kex_init(m) kex_algo_list = parsed["kex_algo_list"] server_key_algo_list = parsed["server_key_algo_list"] client_encrypt_algo_list = parsed["client_encrypt_algo_list"] server_encrypt_algo_list = parsed["server_encrypt_algo_list"] client_mac_algo_list = parsed["client_mac_algo_list"] server_mac_algo_list = parsed["server_mac_algo_list"] client_compress_algo_list = parsed["client_compress_algo_list"] server_compress_algo_list = parsed["server_compress_algo_list"] client_lang_list = parsed["client_lang_list"] server_lang_list = parsed["server_lang_list"] kex_follows = parsed["kex_follows"] self._log(DEBUG, "=== Key exchange possibilities ===") for prefix, value in ( ("kex algos", kex_algo_list), ("server key", server_key_algo_list), # TODO: shouldn't these two lines say "cipher" to match usual # terminology (including elsewhere in paramiko!)? ("client encrypt", client_encrypt_algo_list), ("server encrypt", server_encrypt_algo_list), ("client mac", client_mac_algo_list), ("server mac", server_mac_algo_list), ("client compress", client_compress_algo_list), ("server compress", server_compress_algo_list), ("client lang", client_lang_list), ("server lang", server_lang_list), ): if value == [""]: value = ["<none>"] value = ", ".join(value) self._log(DEBUG, "{}: {}".format(prefix, value)) self._log(DEBUG, "kex follows: {}".format(kex_follows)) self._log(DEBUG, "=== Key exchange agreements ===") # Record, and strip out, ext-info and/or strict-kex non-algorithms self._remote_ext_info = None self._remote_strict_kex = None to_pop = [] for i, algo in enumerate(kex_algo_list): if algo.startswith("ext-info-"): self._remote_ext_info = algo to_pop.insert(0, i) elif algo.startswith("kex-strict-"): # NOTE: this is what we are expecting from the /remote/ end. which = "c" if self.server_mode else "s" expected = f"kex-strict-{which}-v00@openssh.com" # Set strict mode if agreed. self.agreed_on_strict_kex = ( algo == expected and self.advertise_strict_kex ) self._log( DEBUG, f"Strict kex mode: {self.agreed_on_strict_kex}" ) to_pop.insert(0, i) for i in to_pop: kex_algo_list.pop(i) # CVE mitigation: expect zeroed-out seqno anytime we are performing kex # init phase, if strict mode was negotiated. if ( self.agreed_on_strict_kex and not self.initial_kex_done and m.seqno != 0 ): raise MessageOrderError( "In strict-kex mode, but KEXINIT was not the first packet!" ) # as a server, we pick the first item in the client's list that we # support. # as a client, we pick the first item in our list that the server # supports. if self.server_mode: agreed_kex = list( filter(self.preferred_kex.__contains__, kex_algo_list) ) else: agreed_kex = list( filter(kex_algo_list.__contains__, self.preferred_kex) ) if len(agreed_kex) == 0: # TODO: do an auth-overhaul style aggregate exception here? # TODO: would let us streamline log output & show all failures up # front raise IncompatiblePeer( "Incompatible ssh peer (no acceptable kex algorithm)" ) # noqa self.kex_engine = self._kex_info[agreed_kex[0]](self) self._log(DEBUG, "Kex: {}".format(agreed_kex[0])) if self.server_mode: available_server_keys = list( filter( list(self.server_key_dict.keys()).__contains__, self.preferred_keys, ) ) agreed_keys = list( filter( available_server_keys.__contains__, server_key_algo_list ) ) else: agreed_keys = list( filter(server_key_algo_list.__contains__, self.preferred_keys) ) if len(agreed_keys) == 0: raise IncompatiblePeer( "Incompatible ssh peer (no acceptable host key)" ) # noqa self.host_key_type = agreed_keys[0] if self.server_mode and (self.get_server_key() is None): raise IncompatiblePeer( "Incompatible ssh peer (can't match requested host key type)" ) # noqa self._log_agreement("HostKey", agreed_keys[0], agreed_keys[0]) if self.server_mode: agreed_local_ciphers = list( filter( self.preferred_ciphers.__contains__, server_encrypt_algo_list, ) ) agreed_remote_ciphers = list( filter( self.preferred_ciphers.__contains__, client_encrypt_algo_list, ) ) else: agreed_local_ciphers = list( filter( client_encrypt_algo_list.__contains__, self.preferred_ciphers, ) ) agreed_remote_ciphers = list( filter( server_encrypt_algo_list.__contains__, self.preferred_ciphers, ) ) if len(agreed_local_ciphers) == 0 or len(agreed_remote_ciphers) == 0: raise IncompatiblePeer( "Incompatible ssh server (no acceptable ciphers)" ) # noqa self.local_cipher = agreed_local_ciphers[0] self.remote_cipher = agreed_remote_ciphers[0] self._log_agreement( "Cipher", local=self.local_cipher, remote=self.remote_cipher ) if self.server_mode: agreed_remote_macs = list( filter(self.preferred_macs.__contains__, client_mac_algo_list) ) agreed_local_macs = list( filter(self.preferred_macs.__contains__, server_mac_algo_list) ) else: agreed_local_macs = list( filter(client_mac_algo_list.__contains__, self.preferred_macs) ) agreed_remote_macs = list( filter(server_mac_algo_list.__contains__, self.preferred_macs) ) if (len(agreed_local_macs) == 0) or (len(agreed_remote_macs) == 0): raise IncompatiblePeer( "Incompatible ssh server (no acceptable macs)" ) self.local_mac = agreed_local_macs[0] self.remote_mac = agreed_remote_macs[0] self._log_agreement( "MAC", local=self.local_mac, remote=self.remote_mac ) if self.server_mode: agreed_remote_compression = list( filter( self.preferred_compression.__contains__, client_compress_algo_list, ) ) agreed_local_compression = list( filter( self.preferred_compression.__contains__, server_compress_algo_list, ) ) else: agreed_local_compression = list( filter( client_compress_algo_list.__contains__, self.preferred_compression, ) ) agreed_remote_compression = list( filter( server_compress_algo_list.__contains__, self.preferred_compression, ) ) if ( len(agreed_local_compression) == 0 or len(agreed_remote_compression) == 0 ): msg = "Incompatible ssh server (no acceptable compression)" msg += " {!r} {!r} {!r}" raise IncompatiblePeer( msg.format( agreed_local_compression, agreed_remote_compression, self.preferred_compression, ) ) self.local_compression = agreed_local_compression[0] self.remote_compression = agreed_remote_compression[0] self._log_agreement( "Compression", local=self.local_compression, remote=self.remote_compression, ) self._log(DEBUG, "=== End of kex handshake ===") # save for computing hash later... # now wait! openssh has a bug (and others might too) where there are # actually some extra bytes (one NUL byte in openssh's case) added to # the end of the packet but not parsed. turns out we need to throw # away those bytes because they aren't part of the hash. self.remote_kex_init = cMSG_KEXINIT + m.get_so_far() def _activate_inbound(self): """switch on newly negotiated encryption parameters for inbound traffic""" block_size = self._cipher_info[self.remote_cipher]["block-size"] if self.server_mode: IV_in = self._compute_key("A", block_size) key_in = self._compute_key( "C", self._cipher_info[self.remote_cipher]["key-size"] ) else: IV_in = self._compute_key("B", block_size) key_in = self._compute_key( "D", self._cipher_info[self.remote_cipher]["key-size"] ) engine = self._get_cipher( self.remote_cipher, key_in, IV_in, self._DECRYPT ) etm = "etm@openssh.com" in self.remote_mac mac_size = self._mac_info[self.remote_mac]["size"] mac_engine = self._mac_info[self.remote_mac]["class"] # initial mac keys are done in the hash's natural size (not the # potentially truncated transmission size) if self.server_mode: mac_key = self._compute_key("E", mac_engine().digest_size) else: mac_key = self._compute_key("F", mac_engine().digest_size) self.packetizer.set_inbound_cipher( engine, block_size, mac_engine, mac_size, mac_key, etm=etm ) compress_in = self._compression_info[self.remote_compression][1] if compress_in is not None and ( self.remote_compression != "zlib@openssh.com" or self.authenticated ): self._log(DEBUG, "Switching on inbound compression ...") self.packetizer.set_inbound_compressor(compress_in()) # Reset inbound sequence number if strict mode. if self.agreed_on_strict_kex: self._log( DEBUG, "Resetting inbound seqno after NEWKEYS due to strict mode", ) self.packetizer.reset_seqno_in() def _activate_outbound(self): """switch on newly negotiated encryption parameters for outbound traffic""" m = Message() m.add_byte(cMSG_NEWKEYS) self._send_message(m) # Reset outbound sequence number if strict mode. if self.agreed_on_strict_kex: self._log( DEBUG, "Resetting outbound seqno after NEWKEYS due to strict mode", ) self.packetizer.reset_seqno_out() block_size = self._cipher_info[self.local_cipher]["block-size"] if self.server_mode: IV_out = self._compute_key("B", block_size) key_out = self._compute_key( "D", self._cipher_info[self.local_cipher]["key-size"] ) else: IV_out = self._compute_key("A", block_size) key_out = self._compute_key( "C", self._cipher_info[self.local_cipher]["key-size"] ) engine = self._get_cipher( self.local_cipher, key_out, IV_out, self._ENCRYPT ) etm = "etm@openssh.com" in self.local_mac mac_size = self._mac_info[self.local_mac]["size"] mac_engine = self._mac_info[self.local_mac]["class"] # initial mac keys are done in the hash's natural size (not the # potentially truncated transmission size) if self.server_mode: mac_key = self._compute_key("F", mac_engine().digest_size) else: mac_key = self._compute_key("E", mac_engine().digest_size) sdctr = self.local_cipher.endswith("-ctr") self.packetizer.set_outbound_cipher( engine, block_size, mac_engine, mac_size, mac_key, sdctr, etm=etm ) compress_out = self._compression_info[self.local_compression][0] if compress_out is not None and ( self.local_compression != "zlib@openssh.com" or self.authenticated ): self._log(DEBUG, "Switching on outbound compression ...") self.packetizer.set_outbound_compressor(compress_out()) if not self.packetizer.need_rekey(): self.in_kex = False # If client indicated extension support, send that packet immediately if ( self.server_mode and self.server_sig_algs and self._remote_ext_info == "ext-info-c" ): extensions = {"server-sig-algs": ",".join(self.preferred_pubkeys)} m = Message() m.add_byte(cMSG_EXT_INFO) m.add_int(len(extensions)) for name, value in sorted(extensions.items()): m.add_string(name) m.add_string(value) self._send_message(m) # we always expect to receive NEWKEYS now self._expect_packet(MSG_NEWKEYS) def _auth_trigger(self): self.authenticated = True # delayed initiation of compression if self.local_compression == "zlib@openssh.com": compress_out = self._compression_info[self.local_compression][0] self._log(DEBUG, "Switching on outbound compression ...") self.packetizer.set_outbound_compressor(compress_out()) if self.remote_compression == "zlib@openssh.com": compress_in = self._compression_info[self.remote_compression][1] self._log(DEBUG, "Switching on inbound compression ...") self.packetizer.set_inbound_compressor(compress_in()) def _parse_ext_info(self, msg): # Packet is a count followed by that many key-string to possibly-bytes # pairs. extensions = {} for _ in range(msg.get_int()): name = msg.get_text() value = msg.get_string() extensions[name] = value self._log(DEBUG, "Got EXT_INFO: {}".format(extensions)) # NOTE: this should work ok in cases where a server sends /two/ such # messages; the RFC explicitly states a 2nd one should overwrite the # 1st. self.server_extensions = extensions def _parse_newkeys(self, m): self._log(DEBUG, "Switch to new keys ...") self._activate_inbound() # can also free a bunch of stuff here self.local_kex_init = self.remote_kex_init = None self.K = None self.kex_engine = None if self.server_mode and (self.auth_handler is None): # create auth handler for server mode self.auth_handler = AuthHandler(self) if not self.initial_kex_done: # this was the first key exchange # (also signal to packetizer as it sometimes wants to know this # status as well, eg when seqnos rollover) self.initial_kex_done = self.packetizer._initial_kex_done = True # send an event? if self.completion_event is not None: self.completion_event.set() # it's now okay to send data again (if this was a re-key) if not self.packetizer.need_rekey(): self.in_kex = False self.clear_to_send_lock.acquire() try: self.clear_to_send.set() finally: self.clear_to_send_lock.release() return def _parse_disconnect(self, m): code = m.get_int() desc = m.get_text() self._log(INFO, "Disconnect (code {:d}): {}".format(code, desc)) def _parse_global_request(self, m): kind = m.get_text() self._log(DEBUG, 'Received global request "{}"'.format(kind)) want_reply = m.get_boolean() if not self.server_mode: self._log( DEBUG, 'Rejecting "{}" global request from server.'.format(kind), ) ok = False elif kind == "tcpip-forward": address = m.get_text() port = m.get_int() ok = self.server_object.check_port_forward_request(address, port) if ok: ok = (ok,) elif kind == "cancel-tcpip-forward": address = m.get_text() port = m.get_int() self.server_object.cancel_port_forward_request(address, port) ok = True else: ok = self.server_object.check_global_request(kind, m) extra = () if type(ok) is tuple: extra = ok ok = True if want_reply: msg = Message() if ok: msg.add_byte(cMSG_REQUEST_SUCCESS) msg.add(*extra) else: msg.add_byte(cMSG_REQUEST_FAILURE) self._send_message(msg) def _parse_request_success(self, m): self._log(DEBUG, "Global request successful.") self.global_response = m if self.completion_event is not None: self.completion_event.set() def _parse_request_failure(self, m): self._log(DEBUG, "Global request denied.") self.global_response = None if self.completion_event is not None: self.completion_event.set() def _parse_channel_open_success(self, m): chanid = m.get_int() server_chanid = m.get_int() server_window_size = m.get_int() server_max_packet_size = m.get_int() chan = self._channels.get(chanid) if chan is None: self._log(WARNING, "Success for unrequested channel! [??]") return self.lock.acquire() try: chan._set_remote_channel( server_chanid, server_window_size, server_max_packet_size ) self._log(DEBUG, "Secsh channel {:d} opened.".format(chanid)) if chanid in self.channel_events: self.channel_events[chanid].set() del self.channel_events[chanid] finally: self.lock.release() return def _parse_channel_open_failure(self, m): chanid = m.get_int() reason = m.get_int() reason_str = m.get_text() m.get_text() # ignored language reason_text = CONNECTION_FAILED_CODE.get(reason, "(unknown code)") self._log( ERROR, "Secsh channel {:d} open FAILED: {}: {}".format( chanid, reason_str, reason_text ), ) self.lock.acquire() try: self.saved_exception = ChannelException(reason, reason_text) if chanid in self.channel_events: self._channels.delete(chanid) if chanid in self.channel_events: self.channel_events[chanid].set() del self.channel_events[chanid] finally: self.lock.release() return def _parse_channel_open(self, m): kind = m.get_text() chanid = m.get_int() initial_window_size = m.get_int() max_packet_size = m.get_int() reject = False if ( kind == "auth-agent@openssh.com" and self._forward_agent_handler is not None ): self._log(DEBUG, "Incoming forward agent connection") self.lock.acquire() try: my_chanid = self._next_channel() finally: self.lock.release() elif (kind == "x11") and (self._x11_handler is not None): origin_addr = m.get_text() origin_port = m.get_int() self._log( DEBUG, "Incoming x11 connection from {}:{:d}".format( origin_addr, origin_port ), ) self.lock.acquire() try: my_chanid = self._next_channel() finally: self.lock.release() elif (kind == "forwarded-tcpip") and (self._tcp_handler is not None): server_addr = m.get_text() server_port = m.get_int() origin_addr = m.get_text() origin_port = m.get_int() self._log( DEBUG, "Incoming tcp forwarded connection from {}:{:d}".format( origin_addr, origin_port ), ) self.lock.acquire() try: my_chanid = self._next_channel() finally: self.lock.release() elif not self.server_mode: self._log( DEBUG, 'Rejecting "{}" channel request from server.'.format(kind), ) reject = True reason = OPEN_FAILED_ADMINISTRATIVELY_PROHIBITED else: self.lock.acquire() try: my_chanid = self._next_channel() finally: self.lock.release() if kind == "direct-tcpip": # handle direct-tcpip requests coming from the client dest_addr = m.get_text() dest_port = m.get_int() origin_addr = m.get_text() origin_port = m.get_int() reason = self.server_object.check_channel_direct_tcpip_request( my_chanid, (origin_addr, origin_port), (dest_addr, dest_port), ) else: reason = self.server_object.check_channel_request( kind, my_chanid ) if reason != OPEN_SUCCEEDED: self._log( DEBUG, 'Rejecting "{}" channel request from client.'.format(kind), ) reject = True if reject: msg = Message() msg.add_byte(cMSG_CHANNEL_OPEN_FAILURE) msg.add_int(chanid) msg.add_int(reason) msg.add_string("") msg.add_string("en") self._send_message(msg) return chan = Channel(my_chanid) self.lock.acquire() try: self._channels.put(my_chanid, chan) self.channels_seen[my_chanid] = True chan._set_transport(self) chan._set_window( self.default_window_size, self.default_max_packet_size ) chan._set_remote_channel( chanid, initial_window_size, max_packet_size ) finally: self.lock.release() m = Message() m.add_byte(cMSG_CHANNEL_OPEN_SUCCESS) m.add_int(chanid) m.add_int(my_chanid) m.add_int(self.default_window_size) m.add_int(self.default_max_packet_size) self._send_message(m) self._log( DEBUG, "Secsh channel {:d} ({}) opened.".format(my_chanid, kind) ) if kind == "auth-agent@openssh.com": self._forward_agent_handler(chan) elif kind == "x11": self._x11_handler(chan, (origin_addr, origin_port)) elif kind == "forwarded-tcpip": chan.origin_addr = (origin_addr, origin_port) self._tcp_handler( chan, (origin_addr, origin_port), (server_addr, server_port) ) else: self._queue_incoming_channel(chan) def _parse_debug(self, m): m.get_boolean() # always_display msg = m.get_string() m.get_string() # language self._log(DEBUG, "Debug msg: {}".format(util.safe_string(msg))) def _get_subsystem_handler(self, name): try: self.lock.acquire() if name not in self.subsystem_table: return None, [], {} return self.subsystem_table[name] finally: self.lock.release() _channel_handler_table = { MSG_CHANNEL_SUCCESS: Channel._request_success, MSG_CHANNEL_FAILURE: Channel._request_failed, MSG_CHANNEL_DATA: Channel._feed, MSG_CHANNEL_EXTENDED_DATA: Channel._feed_extended, MSG_CHANNEL_WINDOW_ADJUST: Channel._window_adjust, MSG_CHANNEL_REQUEST: Channel._handle_request, MSG_CHANNEL_EOF: Channel._handle_eof, MSG_CHANNEL_CLOSE: Channel._handle_close, } # TODO 4.0: drop this, we barely use it ourselves, it badly replicates the # Transport-internal algorithm management, AND does so in a way which doesn't # honor newer things like disabled_algorithms! class SecurityOptions: """ Simple object containing the security preferences of an ssh transport. These are tuples of acceptable ciphers, digests, key types, and key exchange algorithms, listed in order of preference. Changing the contents and/or order of these fields affects the underlying `.Transport` (but only if you change them before starting the session). If you try to add an algorithm that paramiko doesn't recognize, ``ValueError`` will be raised. If you try to assign something besides a tuple to one of the fields, ``TypeError`` will be raised. """ __slots__ = "_transport" def __init__(self, transport): self._transport = transport def __repr__(self): """ Returns a string representation of this object, for debugging. """ return "<paramiko.SecurityOptions for {!r}>".format(self._transport) def _set(self, name, orig, x): if type(x) is list: x = tuple(x) if type(x) is not tuple: raise TypeError("expected tuple or list") possible = list(getattr(self._transport, orig).keys()) forbidden = [n for n in x if n not in possible] if len(forbidden) > 0: raise ValueError("unknown cipher") setattr(self._transport, name, x) @property def ciphers(self): """Symmetric encryption ciphers""" return self._transport._preferred_ciphers @ciphers.setter def ciphers(self, x): self._set("_preferred_ciphers", "_cipher_info", x) @property def digests(self): """Digest (one-way hash) algorithms""" return self._transport._preferred_macs @digests.setter def digests(self, x): self._set("_preferred_macs", "_mac_info", x) @property def key_types(self): """Public-key algorithms""" return self._transport._preferred_keys @key_types.setter def key_types(self, x): self._set("_preferred_keys", "_key_info", x) @property def kex(self): """Key exchange algorithms""" return self._transport._preferred_kex @kex.setter def kex(self, x): self._set("_preferred_kex", "_kex_info", x) @property def compression(self): """Compression algorithms""" return self._transport._preferred_compression @compression.setter def compression(self, x): self._set("_preferred_compression", "_compression_info", x) class ChannelMap: def __init__(self): # (id -> Channel) self._map = weakref.WeakValueDictionary() self._lock = threading.Lock() def put(self, chanid, chan): self._lock.acquire() try: self._map[chanid] = chan finally: self._lock.release() def get(self, chanid): self._lock.acquire() try: return self._map.get(chanid, None) finally: self._lock.release() def delete(self, chanid): self._lock.acquire() try: try: del self._map[chanid] except KeyError: pass finally: self._lock.release() def values(self): self._lock.acquire() try: return list(self._map.values()) finally: self._lock.release() def __len__(self): self._lock.acquire() try: return len(self._map) finally: self._lock.release() class ServiceRequestingTransport(Transport): """ Transport, but also handling service requests, like it oughtta! .. versionadded:: 3.2 """ # NOTE: this purposefully duplicates some of the parent class in order to # modernize, refactor, etc. The intent is that eventually we will collapse # this one onto the parent in a backwards incompatible release. def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) self._service_userauth_accepted = False self._handler_table[MSG_SERVICE_ACCEPT] = self._parse_service_accept def _parse_service_accept(self, m): service = m.get_text() # Short-circuit for any service name not ssh-userauth. # NOTE: it's technically possible for 'service name' in # SERVICE_REQUEST/ACCEPT messages to be "ssh-connection" -- # but I don't see evidence of Paramiko ever initiating or expecting to # receive one of these. We /do/ see the 'service name' field in # MSG_USERAUTH_REQUEST/ACCEPT/FAILURE set to this string, but that is a # different set of handlers, so...! if service != "ssh-userauth": # TODO 4.0: consider erroring here (with an ability to opt out?) # instead as it probably means something went Very Wrong. self._log( DEBUG, 'Service request "{}" accepted (?)'.format(service) ) return # Record that we saw a service-userauth acceptance, meaning we are free # to submit auth requests. self._service_userauth_accepted = True self._log(DEBUG, "MSG_SERVICE_ACCEPT received; auth may begin") def ensure_session(self): # Make sure we're not trying to auth on a not-yet-open or # already-closed transport session; that's our responsibility, not that # of AuthHandler. if (not self.active) or (not self.initial_kex_done): # TODO: better error message? this can happen in many places, eg # user error (authing before connecting) or developer error (some # improperly handled pre/mid auth shutdown didn't become fatal # enough). The latter is much more common & should ideally be fixed # by terminating things harder? raise SSHException("No existing session") # Also make sure we've actually been told we are allowed to auth. if self._service_userauth_accepted: return # Or request to do so, otherwise. m = Message() m.add_byte(cMSG_SERVICE_REQUEST) m.add_string("ssh-userauth") self._log(DEBUG, "Sending MSG_SERVICE_REQUEST: ssh-userauth") self._send_message(m) # Now we wait to hear back; the user is expecting a blocking-style auth # request so there's no point giving control back anywhere. while not self._service_userauth_accepted: # TODO: feels like we're missing an AuthHandler Event like # 'self.auth_event' which is set when AuthHandler shuts down in # ways good AND bad. Transport only seems to have completion_event # which is unclear re: intent, eg it's set by newkeys which always # happens on connection, so it'll always be set by the time we get # here. # NOTE: this copies the timing of event.wait() in # AuthHandler.wait_for_response, re: 1/10 of a second. Could # presumably be smaller, but seems unlikely this period is going to # be "too long" for any code doing ssh networking... time.sleep(0.1) self.auth_handler = self.get_auth_handler() def get_auth_handler(self): # NOTE: using new sibling subclass instead of classic AuthHandler return AuthOnlyHandler(self) def auth_none(self, username): # TODO 4.0: merge to parent, preserving (most of) docstring self.ensure_session() return self.auth_handler.auth_none(username) def auth_password(self, username, password, fallback=True): # TODO 4.0: merge to parent, preserving (most of) docstring self.ensure_session() try: return self.auth_handler.auth_password(username, password) except BadAuthenticationType as e: # if password auth isn't allowed, but keyboard-interactive *is*, # try to fudge it if not fallback or ("keyboard-interactive" not in e.allowed_types): raise try: def handler(title, instructions, fields): if len(fields) > 1: raise SSHException("Fallback authentication failed.") if len(fields) == 0: # for some reason, at least on os x, a 2nd request will # be made with zero fields requested. maybe it's just # to try to fake out automated scripting of the exact # type we're doing here. *shrug* :) return [] return [password] return self.auth_interactive(username, handler) except SSHException: # attempt to fudge failed; just raise the original exception raise e def auth_publickey(self, username, key): # TODO 4.0: merge to parent, preserving (most of) docstring self.ensure_session() return self.auth_handler.auth_publickey(username, key) def auth_interactive(self, username, handler, submethods=""): # TODO 4.0: merge to parent, preserving (most of) docstring self.ensure_session() return self.auth_handler.auth_interactive( username, handler, submethods ) def auth_interactive_dumb(self, username, handler=None, submethods=""): # TODO 4.0: merge to parent, preserving (most of) docstring # NOTE: legacy impl omitted equiv of ensure_session since it just wraps # another call to an auth method. however we reinstate it for # consistency reasons. self.ensure_session() if not handler: def handler(title, instructions, prompt_list): answers = [] if title: print(title.strip()) if instructions: print(instructions.strip()) for prompt, show_input in prompt_list: print(prompt.strip(), end=" ") answers.append(input()) return answers return self.auth_interactive(username, handler, submethods) def auth_gssapi_with_mic(self, username, gss_host, gss_deleg_creds): # TODO 4.0: merge to parent, preserving (most of) docstring self.ensure_session() self.auth_handler = self.get_auth_handler() return self.auth_handler.auth_gssapi_with_mic( username, gss_host, gss_deleg_creds ) def auth_gssapi_keyex(self, username): # TODO 4.0: merge to parent, preserving (most of) docstring self.ensure_session() self.auth_handler = self.get_auth_handler() return self.auth_handler.auth_gssapi_keyex(username) usr/lib/python3/dist-packages/twisted/conch/ssh/transport.py 0000644 00000235122 15030036746 0020237 0 ustar 00 # -*- test-case-name: twisted.conch.test.test_transport -*- # Copyright (c) Twisted Matrix Laboratories. # See LICENSE for details. """ The lowest level SSH protocol. This handles the key negotiation, the encryption and the compression. The transport layer is described in RFC 4253. Maintainer: Paul Swartz """ import binascii import hmac import struct import zlib from hashlib import md5, sha1, sha256, sha384, sha512 from typing import Dict from cryptography.exceptions import UnsupportedAlgorithm from cryptography.hazmat.backends import default_backend from cryptography.hazmat.primitives import serialization from cryptography.hazmat.primitives.asymmetric import dh, ec, x25519 from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes from twisted import __version__ as twisted_version from twisted.conch.ssh import _kex, address, keys from twisted.conch.ssh.common import MP, NS, ffs, getMP, getNS from twisted.internet import defer, protocol from twisted.logger import Logger from twisted.python import randbytes from twisted.python.compat import iterbytes, networkString # This import is needed if SHA256 hashing is used. # from twisted.python.compat import nativeString def _mpFromBytes(data): """Make an SSH multiple-precision integer from big-endian L{bytes}. Used in ECDH key exchange. @type data: L{bytes} @param data: The input data, interpreted as a big-endian octet string. @rtype: L{bytes} @return: The given data encoded as an SSH multiple-precision integer. """ return MP(int.from_bytes(data, "big")) class _MACParams(tuple): """ L{_MACParams} represents the parameters necessary to compute SSH MAC (Message Authenticate Codes). L{_MACParams} is a L{tuple} subclass to maintain compatibility with older versions of the code. The elements of a L{_MACParams} are:: 0. The digest object used for the MAC 1. The inner pad ("ipad") string 2. The outer pad ("opad") string 3. The size of the digest produced by the digest object L{_MACParams} is also an object lesson in why tuples are a bad type for public APIs. @ivar key: The HMAC key which will be used. """ class SSHCiphers: """ SSHCiphers represents all the encryption operations that need to occur to encrypt and authenticate the SSH connection. @cvar cipherMap: A dictionary mapping SSH encryption names to 3-tuples of (<cryptography.hazmat.primitives.interfaces.CipherAlgorithm>, <block size>, <cryptography.hazmat.primitives.interfaces.Mode>) @cvar macMap: A dictionary mapping SSH MAC names to hash modules. @ivar outCipType: the string type of the outgoing cipher. @ivar inCipType: the string type of the incoming cipher. @ivar outMACType: the string type of the incoming MAC. @ivar inMACType: the string type of the incoming MAC. @ivar encBlockSize: the block size of the outgoing cipher. @ivar decBlockSize: the block size of the incoming cipher. @ivar verifyDigestSize: the size of the incoming MAC. @ivar outMAC: a tuple of (<hash module>, <inner key>, <outer key>, <digest size>) representing the outgoing MAC. @ivar inMAc: see outMAC, but for the incoming MAC. """ cipherMap = { b"3des-cbc": (algorithms.TripleDES, 24, modes.CBC), b"blowfish-cbc": (algorithms.Blowfish, 16, modes.CBC), b"aes256-cbc": (algorithms.AES, 32, modes.CBC), b"aes192-cbc": (algorithms.AES, 24, modes.CBC), b"aes128-cbc": (algorithms.AES, 16, modes.CBC), b"cast128-cbc": (algorithms.CAST5, 16, modes.CBC), b"aes128-ctr": (algorithms.AES, 16, modes.CTR), b"aes192-ctr": (algorithms.AES, 24, modes.CTR), b"aes256-ctr": (algorithms.AES, 32, modes.CTR), b"3des-ctr": (algorithms.TripleDES, 24, modes.CTR), b"blowfish-ctr": (algorithms.Blowfish, 16, modes.CTR), b"cast128-ctr": (algorithms.CAST5, 16, modes.CTR), b"none": (None, 0, modes.CBC), } macMap = { b"hmac-sha2-512": sha512, b"hmac-sha2-384": sha384, b"hmac-sha2-256": sha256, b"hmac-sha1": sha1, b"hmac-md5": md5, b"none": None, } def __init__(self, outCip, inCip, outMac, inMac): self.outCipType = outCip self.inCipType = inCip self.outMACType = outMac self.inMACType = inMac self.encBlockSize = 0 self.decBlockSize = 0 self.verifyDigestSize = 0 self.outMAC = (None, b"", b"", 0) self.inMAC = (None, b"", b"", 0) def setKeys(self, outIV, outKey, inIV, inKey, outInteg, inInteg): """ Set up the ciphers and hashes using the given keys, @param outIV: the outgoing initialization vector @param outKey: the outgoing encryption key @param inIV: the incoming initialization vector @param inKey: the incoming encryption key @param outInteg: the outgoing integrity key @param inInteg: the incoming integrity key. """ o = self._getCipher(self.outCipType, outIV, outKey) self.encryptor = o.encryptor() self.encBlockSize = o.algorithm.block_size // 8 o = self._getCipher(self.inCipType, inIV, inKey) self.decryptor = o.decryptor() self.decBlockSize = o.algorithm.block_size // 8 self.outMAC = self._getMAC(self.outMACType, outInteg) self.inMAC = self._getMAC(self.inMACType, inInteg) if self.inMAC: self.verifyDigestSize = self.inMAC[3] def _getCipher(self, cip, iv, key): """ Creates an initialized cipher object. @param cip: the name of the cipher, maps into cipherMap @param iv: the initialzation vector @param key: the encryption key @return: the cipher object. """ algorithmClass, keySize, modeClass = self.cipherMap[cip] if algorithmClass is None: return _DummyCipher() return Cipher( algorithmClass(key[:keySize]), modeClass(iv[: algorithmClass.block_size // 8]), backend=default_backend(), ) def _getMAC(self, mac, key): """ Gets a 4-tuple representing the message authentication code. (<hash module>, <inner hash value>, <outer hash value>, <digest size>) @type mac: L{bytes} @param mac: a key mapping into macMap @type key: L{bytes} @param key: the MAC key. @rtype: L{bytes} @return: The MAC components. """ mod = self.macMap[mac] if not mod: return (None, b"", b"", 0) # With stdlib we can only get attributes fron an instantiated object. hashObject = mod() digestSize = hashObject.digest_size blockSize = hashObject.block_size # Truncation here appears to contravene RFC 2104, section 2. However, # implementing the hashing behavior prescribed by the RFC breaks # interoperability with OpenSSH (at least version 5.5p1). key = key[:digestSize] + (b"\x00" * (blockSize - digestSize)) i = key.translate(hmac.trans_36) o = key.translate(hmac.trans_5C) result = _MACParams((mod, i, o, digestSize)) result.key = key return result def encrypt(self, blocks): """ Encrypt some data. @type blocks: L{bytes} @param blocks: The data to encrypt. @rtype: L{bytes} @return: The encrypted data. """ return self.encryptor.update(blocks) def decrypt(self, blocks): """ Decrypt some data. @type blocks: L{bytes} @param blocks: The data to decrypt. @rtype: L{bytes} @return: The decrypted data. """ return self.decryptor.update(blocks) def makeMAC(self, seqid, data): """ Create a message authentication code (MAC) for the given packet using the outgoing MAC values. @type seqid: L{int} @param seqid: The sequence ID of the outgoing packet. @type data: L{bytes} @param data: The data to create a MAC for. @rtype: L{str} @return: The serialized MAC. """ if not self.outMAC[0]: return b"" data = struct.pack(">L", seqid) + data return hmac.HMAC(self.outMAC.key, data, self.outMAC[0]).digest() def verify(self, seqid, data, mac): """ Verify an incoming MAC using the incoming MAC values. @type seqid: L{int} @param seqid: The sequence ID of the incoming packet. @type data: L{bytes} @param data: The packet data to verify. @type mac: L{bytes} @param mac: The MAC sent with the packet. @rtype: L{bool} @return: C{True} if the MAC is valid. """ if not self.inMAC[0]: return mac == b"" data = struct.pack(">L", seqid) + data outer = hmac.HMAC(self.inMAC.key, data, self.inMAC[0]).digest() return hmac.compare_digest(mac, outer) def _getSupportedCiphers(): """ Build a list of ciphers that are supported by the backend in use. @return: a list of supported ciphers. @rtype: L{list} of L{str} """ supportedCiphers = [] cs = [ b"aes256-ctr", b"aes256-cbc", b"aes192-ctr", b"aes192-cbc", b"aes128-ctr", b"aes128-cbc", b"cast128-ctr", b"cast128-cbc", b"blowfish-ctr", b"blowfish-cbc", b"3des-ctr", b"3des-cbc", ] for cipher in cs: algorithmClass, keySize, modeClass = SSHCiphers.cipherMap[cipher] try: Cipher( algorithmClass(b" " * keySize), modeClass(b" " * (algorithmClass.block_size // 8)), backend=default_backend(), ).encryptor() except UnsupportedAlgorithm: pass else: supportedCiphers.append(cipher) return supportedCiphers class SSHTransportBase(protocol.Protocol): """ Protocol supporting basic SSH functionality: sending/receiving packets and message dispatch. To connect to or run a server, you must use SSHClientTransport or SSHServerTransport. @ivar protocolVersion: A string representing the version of the SSH protocol we support. Currently defaults to '2.0'. @ivar version: A string representing the version of the server or client. Currently defaults to 'Twisted'. @ivar comment: An optional string giving more information about the server or client. @ivar supportedCiphers: A list of strings representing the encryption algorithms supported, in order from most-preferred to least. @ivar supportedMACs: A list of strings representing the message authentication codes (hashes) supported, in order from most-preferred to least. Both this and supportedCiphers can include 'none' to use no encryption or authentication, but that must be done manually, @ivar supportedKeyExchanges: A list of strings representing the key exchanges supported, in order from most-preferred to least. @ivar supportedPublicKeys: A list of strings representing the public key types supported, in order from most-preferred to least. @ivar supportedCompressions: A list of strings representing compression types supported, from most-preferred to least. @ivar supportedLanguages: A list of strings representing languages supported, from most-preferred to least. @ivar supportedVersions: A container of strings representing supported ssh protocol version numbers. @ivar isClient: A boolean indicating whether this is a client or server. @ivar gotVersion: A boolean indicating whether we have received the version string from the other side. @ivar buf: Data we've received but hasn't been parsed into a packet. @ivar outgoingPacketSequence: the sequence number of the next packet we will send. @ivar incomingPacketSequence: the sequence number of the next packet we are expecting from the other side. @ivar outgoingCompression: an object supporting the .compress(str) and .flush() methods, or None if there is no outgoing compression. Used to compress outgoing data. @ivar outgoingCompressionType: A string representing the outgoing compression type. @ivar incomingCompression: an object supporting the .decompress(str) method, or None if there is no incoming compression. Used to decompress incoming data. @ivar incomingCompressionType: A string representing the incoming compression type. @ivar ourVersionString: the version string that we sent to the other side. Used in the key exchange. @ivar otherVersionString: the version string sent by the other side. Used in the key exchange. @ivar ourKexInitPayload: the MSG_KEXINIT payload we sent. Used in the key exchange. @ivar otherKexInitPayload: the MSG_KEXINIT payload we received. Used in the key exchange @ivar sessionID: a string that is unique to this SSH session. Created as part of the key exchange, sessionID is used to generate the various encryption and authentication keys. @ivar service: an SSHService instance, or None. If it's set to an object, it's the currently running service. @ivar kexAlg: the agreed-upon key exchange algorithm. @ivar keyAlg: the agreed-upon public key type for the key exchange. @ivar currentEncryptions: an SSHCiphers instance. It represents the current encryption and authentication options for the transport. @ivar nextEncryptions: an SSHCiphers instance. Held here until the MSG_NEWKEYS messages are exchanged, when nextEncryptions is transitioned to currentEncryptions. @ivar first: the first bytes of the next packet. In order to avoid decrypting data twice, the first bytes are decrypted and stored until the whole packet is available. @ivar _keyExchangeState: The current protocol state with respect to key exchange. This is either C{_KEY_EXCHANGE_NONE} if no key exchange is in progress (and returns to this value after any key exchange completqes), C{_KEY_EXCHANGE_REQUESTED} if this side of the connection initiated a key exchange, and C{_KEY_EXCHANGE_PROGRESSING} if the other side of the connection initiated a key exchange. C{_KEY_EXCHANGE_NONE} is the initial value (however SSH connections begin with key exchange, so it will quickly change to another state). @ivar _blockedByKeyExchange: Whenever C{_keyExchangeState} is not C{_KEY_EXCHANGE_NONE}, this is a C{list} of pending messages which were passed to L{sendPacket} but could not be sent because it is not legal to send them while a key exchange is in progress. When the key exchange completes, another attempt is made to send these messages. @ivar _peerSupportsExtensions: a boolean indicating whether the other side of the connection supports RFC 8308 extension negotiation. @ivar peerExtensions: a dict of extensions supported by the other side of the connection. """ _log = Logger() protocolVersion = b"2.0" version = b"Twisted_" + twisted_version.encode("ascii") comment = b"" ourVersionString = ( b"SSH-" + protocolVersion + b"-" + version + b" " + comment ).strip() # L{None} is supported as cipher and hmac. For security they are disabled # by default. To enable them, subclass this class and add it, or do: # SSHTransportBase.supportedCiphers.append('none') # List ordered by preference. supportedCiphers = _getSupportedCiphers() supportedMACs = [ b"hmac-sha2-512", b"hmac-sha2-384", b"hmac-sha2-256", b"hmac-sha1", b"hmac-md5", # `none`, ] supportedKeyExchanges = _kex.getSupportedKeyExchanges() supportedPublicKeys = [] # Add the supported EC keys, and change the name from ecdh* to ecdsa* for eckey in supportedKeyExchanges: if eckey.find(b"ecdh") != -1: supportedPublicKeys += [eckey.replace(b"ecdh", b"ecdsa")] supportedPublicKeys += [b"ssh-rsa", b"ssh-dss"] if default_backend().ed25519_supported(): supportedPublicKeys.append(b"ssh-ed25519") supportedCompressions = [b"none", b"zlib"] supportedLanguages = () supportedVersions = (b"1.99", b"2.0") isClient = False gotVersion = False buf = b"" outgoingPacketSequence = 0 incomingPacketSequence = 0 outgoingCompression = None incomingCompression = None sessionID = None service = None # There is no key exchange activity in progress. _KEY_EXCHANGE_NONE = "_KEY_EXCHANGE_NONE" # Key exchange is in progress and we started it. _KEY_EXCHANGE_REQUESTED = "_KEY_EXCHANGE_REQUESTED" # Key exchange is in progress and both sides have sent KEXINIT messages. _KEY_EXCHANGE_PROGRESSING = "_KEY_EXCHANGE_PROGRESSING" # There is a fourth conceptual state not represented here: KEXINIT received # but not sent. Since we always send a KEXINIT as soon as we get it, we # can't ever be in that state. # The current key exchange state. _keyExchangeState = _KEY_EXCHANGE_NONE _blockedByKeyExchange = None # Added to key exchange algorithms by a client to indicate support for # extension negotiation. _EXT_INFO_C = b"ext-info-c" # Added to key exchange algorithms by a server to indicate support for # extension negotiation. _EXT_INFO_S = b"ext-info-s" _peerSupportsExtensions = False peerExtensions: Dict[bytes, bytes] = {} def connectionLost(self, reason): """ When the underlying connection is closed, stop the running service (if any), and log out the avatar (if any). @type reason: L{twisted.python.failure.Failure} @param reason: The cause of the connection being closed. """ if self.service: self.service.serviceStopped() if hasattr(self, "avatar"): self.logoutFunction() self._log.info("connection lost") def connectionMade(self): """ Called when the connection is made to the other side. We sent our version and the MSG_KEXINIT packet. """ self.transport.write(self.ourVersionString + b"\r\n") self.currentEncryptions = SSHCiphers(b"none", b"none", b"none", b"none") self.currentEncryptions.setKeys(b"", b"", b"", b"", b"", b"") self.sendKexInit() def sendKexInit(self): """ Send a I{KEXINIT} message to initiate key exchange or to respond to a key exchange initiated by the peer. @raise RuntimeError: If a key exchange has already been started and it is not appropriate to send a I{KEXINIT} message at this time. @return: L{None} """ if self._keyExchangeState != self._KEY_EXCHANGE_NONE: raise RuntimeError( "Cannot send KEXINIT while key exchange state is %r" % (self._keyExchangeState,) ) supportedKeyExchanges = list(self.supportedKeyExchanges) # Advertise extension negotiation (RFC 8308, section 2.1). At # present, the Conch client processes the "server-sig-algs" # extension (section 3.1), and the Conch server sends that but # ignores any extensions sent by the client, so strictly speaking at # the moment we only need to send this in the client case; however, # there's nothing to forbid the server from sending it as well, and # doing so makes things easier if it needs to process extensions # sent by clients in future. supportedKeyExchanges.append( self._EXT_INFO_C if self.isClient else self._EXT_INFO_S ) self.ourKexInitPayload = b"".join( [ bytes((MSG_KEXINIT,)), randbytes.secureRandom(16), NS(b",".join(supportedKeyExchanges)), NS(b",".join(self.supportedPublicKeys)), NS(b",".join(self.supportedCiphers)), NS(b",".join(self.supportedCiphers)), NS(b",".join(self.supportedMACs)), NS(b",".join(self.supportedMACs)), NS(b",".join(self.supportedCompressions)), NS(b",".join(self.supportedCompressions)), NS(b",".join(self.supportedLanguages)), NS(b",".join(self.supportedLanguages)), b"\000\000\000\000\000", ] ) self.sendPacket(MSG_KEXINIT, self.ourKexInitPayload[1:]) self._keyExchangeState = self._KEY_EXCHANGE_REQUESTED self._blockedByKeyExchange = [] def _allowedKeyExchangeMessageType(self, messageType): """ Determine if the given message type may be sent while key exchange is in progress. @param messageType: The type of message @type messageType: L{int} @return: C{True} if the given type of message may be sent while key exchange is in progress, C{False} if it may not. @rtype: L{bool} @see: U{http://tools.ietf.org/html/rfc4253#section-7.1} """ # Written somewhat peculularly to reflect the way the specification # defines the allowed message types. if 1 <= messageType <= 19: return messageType not in ( MSG_SERVICE_REQUEST, MSG_SERVICE_ACCEPT, MSG_EXT_INFO, ) if 20 <= messageType <= 29: return messageType not in (MSG_KEXINIT,) return 30 <= messageType <= 49 def sendPacket(self, messageType, payload): """ Sends a packet. If it's been set up, compress the data, encrypt it, and authenticate it before sending. If key exchange is in progress and the message is not part of key exchange, queue it to be sent later. @param messageType: The type of the packet; generally one of the MSG_* values. @type messageType: L{int} @param payload: The payload for the message. @type payload: L{str} """ if self._keyExchangeState != self._KEY_EXCHANGE_NONE: if not self._allowedKeyExchangeMessageType(messageType): self._blockedByKeyExchange.append((messageType, payload)) return payload = bytes((messageType,)) + payload if self.outgoingCompression: payload = self.outgoingCompression.compress( payload ) + self.outgoingCompression.flush(2) bs = self.currentEncryptions.encBlockSize # 4 for the packet length and 1 for the padding length totalSize = 5 + len(payload) lenPad = bs - (totalSize % bs) if lenPad < 4: lenPad = lenPad + bs packet = ( struct.pack("!LB", totalSize + lenPad - 4, lenPad) + payload + randbytes.secureRandom(lenPad) ) encPacket = self.currentEncryptions.encrypt( packet ) + self.currentEncryptions.makeMAC(self.outgoingPacketSequence, packet) self.transport.write(encPacket) self.outgoingPacketSequence += 1 def getPacket(self): """ Try to return a decrypted, authenticated, and decompressed packet out of the buffer. If there is not enough data, return None. @rtype: L{str} or L{None} @return: The decoded packet, if any. """ bs = self.currentEncryptions.decBlockSize ms = self.currentEncryptions.verifyDigestSize if len(self.buf) < bs: # Not enough data for a block return if not hasattr(self, "first"): first = self.currentEncryptions.decrypt(self.buf[:bs]) else: first = self.first del self.first packetLen, paddingLen = struct.unpack("!LB", first[:5]) if packetLen > 1048576: # 1024 ** 2 self.sendDisconnect( DISCONNECT_PROTOCOL_ERROR, networkString(f"bad packet length {packetLen}"), ) return if len(self.buf) < packetLen + 4 + ms: # Not enough data for a packet self.first = first return if (packetLen + 4) % bs != 0: self.sendDisconnect( DISCONNECT_PROTOCOL_ERROR, networkString( "bad packet mod (%i%%%i == %i)" % (packetLen + 4, bs, (packetLen + 4) % bs) ), ) return encData, self.buf = self.buf[: 4 + packetLen], self.buf[4 + packetLen :] packet = first + self.currentEncryptions.decrypt(encData[bs:]) if len(packet) != 4 + packetLen: self.sendDisconnect(DISCONNECT_PROTOCOL_ERROR, b"bad decryption") return if ms: macData, self.buf = self.buf[:ms], self.buf[ms:] if not self.currentEncryptions.verify( self.incomingPacketSequence, packet, macData ): self.sendDisconnect(DISCONNECT_MAC_ERROR, b"bad MAC") return payload = packet[5:-paddingLen] if self.incomingCompression: try: payload = self.incomingCompression.decompress(payload) except Exception: # Tolerate any errors in decompression self._log.failure("Error decompressing payload") self.sendDisconnect(DISCONNECT_COMPRESSION_ERROR, b"compression error") return self.incomingPacketSequence += 1 return payload def _unsupportedVersionReceived(self, remoteVersion): """ Called when an unsupported version of the ssh protocol is received from the remote endpoint. @param remoteVersion: remote ssh protocol version which is unsupported by us. @type remoteVersion: L{str} """ self.sendDisconnect( DISCONNECT_PROTOCOL_VERSION_NOT_SUPPORTED, b"bad version " + remoteVersion ) def dataReceived(self, data): """ First, check for the version string (SSH-2.0-*). After that has been received, this method adds data to the buffer, and pulls out any packets. @type data: L{bytes} @param data: The data that was received. """ self.buf = self.buf + data if not self.gotVersion: if len(self.buf) > 4096: self.sendDisconnect( DISCONNECT_CONNECTION_LOST, b"Peer version string longer than 4KB. " b"Preventing a denial of service attack.", ) return if self.buf.find(b"\n", self.buf.find(b"SSH-")) == -1: return # RFC 4253 section 4.2 ask for strict `\r\n` line ending. # Here we are a bit more relaxed and accept implementations ending # only in '\n'. # https://tools.ietf.org/html/rfc4253#section-4.2 lines = self.buf.split(b"\n") for p in lines: if p.startswith(b"SSH-"): self.gotVersion = True # Since the line was split on '\n' and most of the time # it uses '\r\n' we may get an extra '\r'. self.otherVersionString = p.rstrip(b"\r") remoteVersion = p.split(b"-")[1] if remoteVersion not in self.supportedVersions: self._unsupportedVersionReceived(remoteVersion) return i = lines.index(p) self.buf = b"\n".join(lines[i + 1 :]) packet = self.getPacket() while packet: messageNum = ord(packet[0:1]) self.dispatchMessage(messageNum, packet[1:]) packet = self.getPacket() def dispatchMessage(self, messageNum, payload): """ Send a received message to the appropriate method. @type messageNum: L{int} @param messageNum: The message number. @type payload: L{bytes} @param payload: The message payload. """ if messageNum < 50 and messageNum in messages: messageType = messages[messageNum][4:] f = getattr(self, f"ssh_{messageType}", None) if f is not None: f(payload) else: self._log.debug( "couldn't handle {messageType}: {payload!r}", messageType=messageType, payload=payload, ) self.sendUnimplemented() elif self.service: self.service.packetReceived(messageNum, payload) else: self._log.debug( "couldn't handle {messageNum}: {payload!r}", messageNum=messageNum, payload=payload, ) self.sendUnimplemented() def getPeer(self): """ Returns an L{SSHTransportAddress} corresponding to the other (peer) side of this transport. @return: L{SSHTransportAddress} for the peer @rtype: L{SSHTransportAddress} @since: 12.1 """ return address.SSHTransportAddress(self.transport.getPeer()) def getHost(self): """ Returns an L{SSHTransportAddress} corresponding to the this side of transport. @return: L{SSHTransportAddress} for the peer @rtype: L{SSHTransportAddress} @since: 12.1 """ return address.SSHTransportAddress(self.transport.getHost()) @property def kexAlg(self): """ The key exchange algorithm name agreed between client and server. """ return self._kexAlg @kexAlg.setter def kexAlg(self, value): """ Set the key exchange algorithm name. """ self._kexAlg = value # Client-initiated rekeying looks like this: # # C> MSG_KEXINIT # S> MSG_KEXINIT # C> MSG_KEX_DH_GEX_REQUEST or MSG_KEXDH_INIT # S> MSG_KEX_DH_GEX_GROUP or MSG_KEXDH_REPLY # C> MSG_KEX_DH_GEX_INIT or -- # S> MSG_KEX_DH_GEX_REPLY or -- # C> MSG_NEWKEYS # S> MSG_NEWKEYS # # Server-initiated rekeying is the same, only the first two messages are # switched. def ssh_KEXINIT(self, packet): """ Called when we receive a MSG_KEXINIT message. Payload:: bytes[16] cookie string keyExchangeAlgorithms string keyAlgorithms string incomingEncryptions string outgoingEncryptions string incomingAuthentications string outgoingAuthentications string incomingCompressions string outgoingCompressions string incomingLanguages string outgoingLanguages bool firstPacketFollows unit32 0 (reserved) Starts setting up the key exchange, keys, encryptions, and authentications. Extended by ssh_KEXINIT in SSHServerTransport and SSHClientTransport. @type packet: L{bytes} @param packet: The message data. @return: A L{tuple} of negotiated key exchange algorithms, key algorithms, and unhandled data, or L{None} if something went wrong. """ self.otherKexInitPayload = bytes((MSG_KEXINIT,)) + packet # This is useless to us: # cookie = packet[: 16] k = getNS(packet[16:], 10) strings, rest = k[:-1], k[-1] ( kexAlgs, keyAlgs, encCS, encSC, macCS, macSC, compCS, compSC, langCS, langSC, ) = (s.split(b",") for s in strings) # These are the server directions outs = [encSC, macSC, compSC] ins = [encCS, macCS, compCS] if self.isClient: outs, ins = ins, outs # Switch directions server = ( self.supportedKeyExchanges, self.supportedPublicKeys, self.supportedCiphers, self.supportedCiphers, self.supportedMACs, self.supportedMACs, self.supportedCompressions, self.supportedCompressions, ) client = (kexAlgs, keyAlgs, outs[0], ins[0], outs[1], ins[1], outs[2], ins[2]) if self.isClient: server, client = client, server self.kexAlg = ffs(client[0], server[0]) self.keyAlg = ffs(client[1], server[1]) self.nextEncryptions = SSHCiphers( ffs(client[2], server[2]), ffs(client[3], server[3]), ffs(client[4], server[4]), ffs(client[5], server[5]), ) self.outgoingCompressionType = ffs(client[6], server[6]) self.incomingCompressionType = ffs(client[7], server[7]) if ( None in ( self.kexAlg, self.keyAlg, self.outgoingCompressionType, self.incomingCompressionType, ) # We MUST disconnect if an extension negotiation indication ends # up being negotiated as a key exchange method (RFC 8308, # section 2.2). or self.kexAlg in (self._EXT_INFO_C, self._EXT_INFO_S) ): self.sendDisconnect( DISCONNECT_KEY_EXCHANGE_FAILED, b"couldn't match all kex parts" ) return if None in self.nextEncryptions.__dict__.values(): self.sendDisconnect( DISCONNECT_KEY_EXCHANGE_FAILED, b"couldn't match all kex parts" ) return self._peerSupportsExtensions = ( self._EXT_INFO_S if self.isClient else self._EXT_INFO_C ) in kexAlgs self._log.debug( "kex alg={kexAlg!r} key alg={keyAlg!r}", kexAlg=self.kexAlg, keyAlg=self.keyAlg, ) self._log.debug( "outgoing: {cip!r} {mac!r} {compression!r}", cip=self.nextEncryptions.outCipType, mac=self.nextEncryptions.outMACType, compression=self.outgoingCompressionType, ) self._log.debug( "incoming: {cip!r} {mac!r} {compression!r}", cip=self.nextEncryptions.inCipType, mac=self.nextEncryptions.inMACType, compression=self.incomingCompressionType, ) if self._keyExchangeState == self._KEY_EXCHANGE_REQUESTED: self._keyExchangeState = self._KEY_EXCHANGE_PROGRESSING else: self.sendKexInit() return kexAlgs, keyAlgs, rest # For SSHServerTransport to use def ssh_DISCONNECT(self, packet): """ Called when we receive a MSG_DISCONNECT message. Payload:: long code string description This means that the other side has disconnected. Pass the message up and disconnect ourselves. @type packet: L{bytes} @param packet: The message data. """ reasonCode = struct.unpack(">L", packet[:4])[0] description, foo = getNS(packet[4:]) self.receiveError(reasonCode, description) self.transport.loseConnection() def ssh_IGNORE(self, packet): """ Called when we receive a MSG_IGNORE message. No payload. This means nothing; we simply return. @type packet: L{bytes} @param packet: The message data. """ def ssh_UNIMPLEMENTED(self, packet): """ Called when we receive a MSG_UNIMPLEMENTED message. Payload:: long packet This means that the other side did not implement one of our packets. @type packet: L{bytes} @param packet: The message data. """ (seqnum,) = struct.unpack(">L", packet) self.receiveUnimplemented(seqnum) def ssh_DEBUG(self, packet): """ Called when we receive a MSG_DEBUG message. Payload:: bool alwaysDisplay string message string language This means the other side has passed along some debugging info. @type packet: L{bytes} @param packet: The message data. """ alwaysDisplay = bool(ord(packet[0:1])) message, lang, foo = getNS(packet[1:], 2) self.receiveDebug(alwaysDisplay, message, lang) def ssh_EXT_INFO(self, packet): """ Called when we get a MSG_EXT_INFO message. Payload:: uint32 nr-extensions repeat the following 2 fields "nr-extensions" times: string extension-name string extension-value (binary) @type packet: L{bytes} @param packet: The message data. """ (numExtensions,) = struct.unpack(">L", packet[:4]) packet = packet[4:] extensions = {} for _ in range(numExtensions): extName, extValue, packet = getNS(packet, 2) extensions[extName] = extValue self.peerExtensions = extensions def setService(self, service): """ Set our service to service and start it running. If we were running a service previously, stop it first. @type service: C{SSHService} @param service: The service to attach. """ self._log.debug("starting service {service!r}", service=service.name) if self.service: self.service.serviceStopped() self.service = service service.transport = self self.service.serviceStarted() def sendDebug(self, message, alwaysDisplay=False, language=b""): """ Send a debug message to the other side. @param message: the message to send. @type message: L{str} @param alwaysDisplay: if True, tell the other side to always display this message. @type alwaysDisplay: L{bool} @param language: optionally, the language the message is in. @type language: L{str} """ self.sendPacket( MSG_DEBUG, (b"\1" if alwaysDisplay else b"\0") + NS(message) + NS(language) ) def sendIgnore(self, message): """ Send a message that will be ignored by the other side. This is useful to fool attacks based on guessing packet sizes in the encrypted stream. @param message: data to send with the message @type message: L{str} """ self.sendPacket(MSG_IGNORE, NS(message)) def sendUnimplemented(self): """ Send a message to the other side that the last packet was not understood. """ seqnum = self.incomingPacketSequence self.sendPacket(MSG_UNIMPLEMENTED, struct.pack("!L", seqnum)) def sendDisconnect(self, reason, desc): """ Send a disconnect message to the other side and then disconnect. @param reason: the reason for the disconnect. Should be one of the DISCONNECT_* values. @type reason: L{int} @param desc: a descrption of the reason for the disconnection. @type desc: L{str} """ self.sendPacket(MSG_DISCONNECT, struct.pack(">L", reason) + NS(desc) + NS(b"")) self._log.info( "Disconnecting with error, code {code}\nreason: {description}", code=reason, description=desc, ) self.transport.loseConnection() def sendExtInfo(self, extensions): """ Send an RFC 8308 extension advertisement to the remote peer. Nothing is sent if the peer doesn't support negotiations. @type extensions: L{list} of (L{bytes}, L{bytes}) @param extensions: a list of (extension-name, extension-value) pairs. """ if self._peerSupportsExtensions: payload = b"".join( [struct.pack(">L", len(extensions))] + [NS(name) + NS(value) for name, value in extensions] ) self.sendPacket(MSG_EXT_INFO, payload) def _startEphemeralDH(self): """ Prepares for a Diffie-Hellman key agreement exchange. Creates an ephemeral keypair in the group defined by (self.g, self.p) and stores it. """ numbers = dh.DHParameterNumbers(self.p, self.g) parameters = numbers.parameters(default_backend()) self.dhSecretKey = parameters.generate_private_key() y = self.dhSecretKey.public_key().public_numbers().y self.dhSecretKeyPublicMP = MP(y) def _finishEphemeralDH(self, remoteDHpublicKey): """ Completes the Diffie-Hellman key agreement started by _startEphemeralDH, and forgets the ephemeral secret key. @type remoteDHpublicKey: L{int} @rtype: L{bytes} @return: The new shared secret, in SSH C{mpint} format. """ remoteKey = dh.DHPublicNumbers( remoteDHpublicKey, dh.DHParameterNumbers(self.p, self.g) ).public_key(default_backend()) secret = self.dhSecretKey.exchange(remoteKey) del self.dhSecretKey # The result of a Diffie-Hellman exchange is an integer, but # the Cryptography module returns it as bytes in a form that # is only vaguely documented. We fix it up to match the SSH # MP-integer format as described in RFC4251. secret = secret.lstrip(b"\x00") ch = ord(secret[0:1]) if ch & 0x80: # High bit set? # Make room for the sign bit prefix = struct.pack(">L", len(secret) + 1) + b"\x00" else: prefix = struct.pack(">L", len(secret)) return prefix + secret def _getKey(self, c, sharedSecret, exchangeHash): """ Get one of the keys for authentication/encryption. @type c: L{bytes} @param c: The letter identifying which key this is. @type sharedSecret: L{bytes} @param sharedSecret: The shared secret K. @type exchangeHash: L{bytes} @param exchangeHash: The hash H from key exchange. @rtype: L{bytes} @return: The derived key. """ hashProcessor = _kex.getHashProcessor(self.kexAlg) k1 = hashProcessor(sharedSecret + exchangeHash + c + self.sessionID) k1 = k1.digest() k2 = hashProcessor(sharedSecret + exchangeHash + k1).digest() k3 = hashProcessor(sharedSecret + exchangeHash + k1 + k2).digest() k4 = hashProcessor(sharedSecret + exchangeHash + k1 + k2 + k3).digest() return k1 + k2 + k3 + k4 def _keySetup(self, sharedSecret, exchangeHash): """ Set up the keys for the connection and sends MSG_NEWKEYS when finished, @param sharedSecret: a secret string agreed upon using a Diffie- Hellman exchange, so it is only shared between the server and the client. @type sharedSecret: L{str} @param exchangeHash: A hash of various data known by both sides. @type exchangeHash: L{str} """ if not self.sessionID: self.sessionID = exchangeHash initIVCS = self._getKey(b"A", sharedSecret, exchangeHash) initIVSC = self._getKey(b"B", sharedSecret, exchangeHash) encKeyCS = self._getKey(b"C", sharedSecret, exchangeHash) encKeySC = self._getKey(b"D", sharedSecret, exchangeHash) integKeyCS = self._getKey(b"E", sharedSecret, exchangeHash) integKeySC = self._getKey(b"F", sharedSecret, exchangeHash) outs = [initIVSC, encKeySC, integKeySC] ins = [initIVCS, encKeyCS, integKeyCS] if self.isClient: # Reverse for the client outs, ins = ins, outs self.nextEncryptions.setKeys(outs[0], outs[1], ins[0], ins[1], outs[2], ins[2]) self.sendPacket(MSG_NEWKEYS, b"") def _newKeys(self): """ Called back by a subclass once a I{MSG_NEWKEYS} message has been received. This indicates key exchange has completed and new encryption and compression parameters should be adopted. Any messages which were queued during key exchange will also be flushed. """ self._log.debug("NEW KEYS") self.currentEncryptions = self.nextEncryptions if self.outgoingCompressionType == b"zlib": self.outgoingCompression = zlib.compressobj(6) if self.incomingCompressionType == b"zlib": self.incomingCompression = zlib.decompressobj() self._keyExchangeState = self._KEY_EXCHANGE_NONE messages = self._blockedByKeyExchange self._blockedByKeyExchange = None for (messageType, payload) in messages: self.sendPacket(messageType, payload) def isEncrypted(self, direction="out"): """ Check if the connection is encrypted in the given direction. @type direction: L{str} @param direction: The direction: one of 'out', 'in', or 'both'. @rtype: L{bool} @return: C{True} if it is encrypted. """ if direction == "out": return self.currentEncryptions.outCipType != b"none" elif direction == "in": return self.currentEncryptions.inCipType != b"none" elif direction == "both": return self.isEncrypted("in") and self.isEncrypted("out") else: raise TypeError('direction must be "out", "in", or "both"') def isVerified(self, direction="out"): """ Check if the connection is verified/authentication in the given direction. @type direction: L{str} @param direction: The direction: one of 'out', 'in', or 'both'. @rtype: L{bool} @return: C{True} if it is verified. """ if direction == "out": return self.currentEncryptions.outMACType != b"none" elif direction == "in": return self.currentEncryptions.inMACType != b"none" elif direction == "both": return self.isVerified("in") and self.isVerified("out") else: raise TypeError('direction must be "out", "in", or "both"') def loseConnection(self): """ Lose the connection to the other side, sending a DISCONNECT_CONNECTION_LOST message. """ self.sendDisconnect(DISCONNECT_CONNECTION_LOST, b"user closed connection") # Client methods def receiveError(self, reasonCode, description): """ Called when we receive a disconnect error message from the other side. @param reasonCode: the reason for the disconnect, one of the DISCONNECT_ values. @type reasonCode: L{int} @param description: a human-readable description of the disconnection. @type description: L{str} """ self._log.error( "Got remote error, code {code}\nreason: {description}", code=reasonCode, description=description, ) def receiveUnimplemented(self, seqnum): """ Called when we receive an unimplemented packet message from the other side. @param seqnum: the sequence number that was not understood. @type seqnum: L{int} """ self._log.warn("other side unimplemented packet #{seqnum}", seqnum=seqnum) def receiveDebug(self, alwaysDisplay, message, lang): """ Called when we receive a debug message from the other side. @param alwaysDisplay: if True, this message should always be displayed. @type alwaysDisplay: L{bool} @param message: the debug message @type message: L{str} @param lang: optionally the language the message is in. @type lang: L{str} """ if alwaysDisplay: self._log.debug("Remote Debug Message: {message}", message=message) def _generateECPrivateKey(self): """ Generate an private key for ECDH key exchange. @rtype: The appropriate private key type matching C{self.kexAlg}: L{ec.EllipticCurvePrivateKey} for C{ecdh-sha2-nistp*}, or L{x25519.X25519PrivateKey} for C{curve25519-sha256}. @return: The generated private key. """ if self.kexAlg.startswith(b"ecdh-sha2-nistp"): try: curve = keys._curveTable[b"ecdsa" + self.kexAlg[4:]] except KeyError: raise UnsupportedAlgorithm("unused-key") return ec.generate_private_key(curve, default_backend()) elif self.kexAlg in (b"curve25519-sha256", b"curve25519-sha256@libssh.org"): return x25519.X25519PrivateKey.generate() else: raise UnsupportedAlgorithm( "Cannot generate elliptic curve private key for {!r}".format( self.kexAlg ) ) def _encodeECPublicKey(self, ecPub): """ Encode an elliptic curve public key to bytes. @type ecPub: The appropriate public key type matching C{self.kexAlg}: L{ec.EllipticCurvePublicKey} for C{ecdh-sha2-nistp*}, or L{x25519.X25519PublicKey} for C{curve25519-sha256}. @param ecPub: The public key to encode. @rtype: L{bytes} @return: The encoded public key. """ if self.kexAlg.startswith(b"ecdh-sha2-nistp"): return ecPub.public_bytes( serialization.Encoding.X962, serialization.PublicFormat.UncompressedPoint, ) elif self.kexAlg in (b"curve25519-sha256", b"curve25519-sha256@libssh.org"): return ecPub.public_bytes( serialization.Encoding.Raw, serialization.PublicFormat.Raw ) else: raise UnsupportedAlgorithm( f"Cannot encode elliptic curve public key for {self.kexAlg!r}" ) def _generateECSharedSecret(self, ecPriv, theirECPubBytes): """ Generate a shared secret for ECDH key exchange. @type ecPriv: The appropriate private key type matching C{self.kexAlg}: L{ec.EllipticCurvePrivateKey} for C{ecdh-sha2-nistp*}, or L{x25519.X25519PrivateKey} for C{curve25519-sha256}. @param ecPriv: Our private key. @rtype: L{bytes} @return: The generated shared secret, as an SSH multiple-precision integer. """ if self.kexAlg.startswith(b"ecdh-sha2-nistp"): try: curve = keys._curveTable[b"ecdsa" + self.kexAlg[4:]] except KeyError: raise UnsupportedAlgorithm("unused-key") theirECPub = ec.EllipticCurvePublicKey.from_encoded_point( curve, theirECPubBytes ) sharedSecret = ecPriv.exchange(ec.ECDH(), theirECPub) elif self.kexAlg in (b"curve25519-sha256", b"curve25519-sha256@libssh.org"): theirECPub = x25519.X25519PublicKey.from_public_bytes(theirECPubBytes) sharedSecret = ecPriv.exchange(theirECPub) else: raise UnsupportedAlgorithm( "Cannot generate elliptic curve shared secret for {!r}".format( self.kexAlg ) ) return _mpFromBytes(sharedSecret) class SSHServerTransport(SSHTransportBase): """ SSHServerTransport implements the server side of the SSH protocol. @ivar isClient: since we are never the client, this is always False. @ivar ignoreNextPacket: if True, ignore the next key exchange packet. This is set when the client sends a guessed key exchange packet but with an incorrect guess. @ivar dhGexRequest: the KEX_DH_GEX_REQUEST(_OLD) that the client sent. The key generation needs this to be stored. @ivar g: the Diffie-Hellman group generator. @ivar p: the Diffie-Hellman group prime. """ isClient = False ignoreNextPacket = 0 def ssh_KEXINIT(self, packet): """ Called when we receive a MSG_KEXINIT message. For a description of the packet, see SSHTransportBase.ssh_KEXINIT(). Additionally, this method checks if a guessed key exchange packet was sent. If it was sent, and it guessed incorrectly, the next key exchange packet MUST be ignored. """ retval = SSHTransportBase.ssh_KEXINIT(self, packet) if not retval: # Disconnected return else: kexAlgs, keyAlgs, rest = retval if ord(rest[0:1]): # Flag first_kex_packet_follows? if ( kexAlgs[0] != self.supportedKeyExchanges[0] or keyAlgs[0] != self.supportedPublicKeys[0] ): self.ignoreNextPacket = True # Guess was wrong def _ssh_KEX_ECDH_INIT(self, packet): """ Called from L{ssh_KEX_DH_GEX_REQUEST_OLD} to handle elliptic curve key exchanges. Payload:: string client Elliptic Curve Diffie-Hellman public key Just like L{_ssh_KEXDH_INIT} this message type is also not dispatched directly. Extra check to determine if this is really KEX_ECDH_INIT is required. First we load the host's public/private keys. Then we generate the ECDH public/private keypair for the given curve. With that we generate the shared secret key. Then we compute the hash to sign and send back to the client Along with the server's public key and the ECDH public key. @type packet: L{bytes} @param packet: The message data. @return: None. """ # Get the raw client public key. pktPub, packet = getNS(packet) # Get the host's public and private keys pubHostKey = self.factory.publicKeys[self.keyAlg] privHostKey = self.factory.privateKeys[self.keyAlg] # Generate the private key ecPriv = self._generateECPrivateKey() # Get the public key self.ecPub = ecPriv.public_key() encPub = self._encodeECPublicKey(self.ecPub) # Generate the shared secret sharedSecret = self._generateECSharedSecret(ecPriv, pktPub) # Finish update and digest h = _kex.getHashProcessor(self.kexAlg)() h.update(NS(self.otherVersionString)) h.update(NS(self.ourVersionString)) h.update(NS(self.otherKexInitPayload)) h.update(NS(self.ourKexInitPayload)) h.update(NS(pubHostKey.blob())) h.update(NS(pktPub)) h.update(NS(encPub)) h.update(sharedSecret) exchangeHash = h.digest() self.sendPacket( MSG_KEXDH_REPLY, NS(pubHostKey.blob()) + NS(encPub) + NS(privHostKey.sign(exchangeHash)), ) self._keySetup(sharedSecret, exchangeHash) def _ssh_KEXDH_INIT(self, packet): """ Called to handle the beginning of a non-group key exchange. Unlike other message types, this is not dispatched automatically. It is called from C{ssh_KEX_DH_GEX_REQUEST_OLD} because an extra check is required to determine if this is really a KEXDH_INIT message or if it is a KEX_DH_GEX_REQUEST_OLD message. The KEXDH_INIT payload:: integer e (the client's Diffie-Hellman public key) We send the KEXDH_REPLY with our host key and signature. @type packet: L{bytes} @param packet: The message data. """ clientDHpublicKey, foo = getMP(packet) self.g, self.p = _kex.getDHGeneratorAndPrime(self.kexAlg) self._startEphemeralDH() sharedSecret = self._finishEphemeralDH(clientDHpublicKey) h = _kex.getHashProcessor(self.kexAlg)() h.update(NS(self.otherVersionString)) h.update(NS(self.ourVersionString)) h.update(NS(self.otherKexInitPayload)) h.update(NS(self.ourKexInitPayload)) h.update(NS(self.factory.publicKeys[self.keyAlg].blob())) h.update(MP(clientDHpublicKey)) h.update(self.dhSecretKeyPublicMP) h.update(sharedSecret) exchangeHash = h.digest() self.sendPacket( MSG_KEXDH_REPLY, NS(self.factory.publicKeys[self.keyAlg].blob()) + self.dhSecretKeyPublicMP + NS(self.factory.privateKeys[self.keyAlg].sign(exchangeHash)), ) self._keySetup(sharedSecret, exchangeHash) def ssh_KEX_DH_GEX_REQUEST_OLD(self, packet): """ This represents different key exchange methods that share the same integer value. If the message is determined to be a KEXDH_INIT, L{_ssh_KEXDH_INIT} is called to handle it. If it is a KEX_ECDH_INIT, L{_ssh_KEX_ECDH_INIT} is called. Otherwise, for KEX_DH_GEX_REQUEST_OLD payload:: integer ideal (ideal size for the Diffie-Hellman prime) We send the KEX_DH_GEX_GROUP message with the group that is closest in size to ideal. If we were told to ignore the next key exchange packet by ssh_KEXINIT, drop it on the floor and return. @type packet: L{bytes} @param packet: The message data. """ if self.ignoreNextPacket: self.ignoreNextPacket = 0 return # KEXDH_INIT, KEX_ECDH_INIT, and KEX_DH_GEX_REQUEST_OLD # have the same value, so use another cue # to decide what kind of message the peer sent us. if _kex.isFixedGroup(self.kexAlg): return self._ssh_KEXDH_INIT(packet) elif _kex.isEllipticCurve(self.kexAlg): return self._ssh_KEX_ECDH_INIT(packet) else: self.dhGexRequest = packet ideal = struct.unpack(">L", packet)[0] self.g, self.p = self.factory.getDHPrime(ideal) self._startEphemeralDH() self.sendPacket(MSG_KEX_DH_GEX_GROUP, MP(self.p) + MP(self.g)) def ssh_KEX_DH_GEX_REQUEST(self, packet): """ Called when we receive a MSG_KEX_DH_GEX_REQUEST message. Payload:: integer minimum integer ideal integer maximum The client is asking for a Diffie-Hellman group between minimum and maximum size, and close to ideal if possible. We reply with a MSG_KEX_DH_GEX_GROUP message. If we were told to ignore the next key exchange packet by ssh_KEXINIT, drop it on the floor and return. @type packet: L{bytes} @param packet: The message data. """ if self.ignoreNextPacket: self.ignoreNextPacket = 0 return self.dhGexRequest = packet min, ideal, max = struct.unpack(">3L", packet) self.g, self.p = self.factory.getDHPrime(ideal) self._startEphemeralDH() self.sendPacket(MSG_KEX_DH_GEX_GROUP, MP(self.p) + MP(self.g)) def ssh_KEX_DH_GEX_INIT(self, packet): """ Called when we get a MSG_KEX_DH_GEX_INIT message. Payload:: integer e (client DH public key) We send the MSG_KEX_DH_GEX_REPLY message with our host key and signature. @type packet: L{bytes} @param packet: The message data. """ clientDHpublicKey, foo = getMP(packet) # TODO: we should also look at the value they send to us and reject # insecure values of f (if g==2 and f has a single '1' bit while the # rest are '0's, then they must have used a small y also). # TODO: This could be computed when self.p is set up # or do as openssh does and scan f for a single '1' bit instead sharedSecret = self._finishEphemeralDH(clientDHpublicKey) h = _kex.getHashProcessor(self.kexAlg)() h.update(NS(self.otherVersionString)) h.update(NS(self.ourVersionString)) h.update(NS(self.otherKexInitPayload)) h.update(NS(self.ourKexInitPayload)) h.update(NS(self.factory.publicKeys[self.keyAlg].blob())) h.update(self.dhGexRequest) h.update(MP(self.p)) h.update(MP(self.g)) h.update(MP(clientDHpublicKey)) h.update(self.dhSecretKeyPublicMP) h.update(sharedSecret) exchangeHash = h.digest() self.sendPacket( MSG_KEX_DH_GEX_REPLY, NS(self.factory.publicKeys[self.keyAlg].blob()) + self.dhSecretKeyPublicMP + NS(self.factory.privateKeys[self.keyAlg].sign(exchangeHash)), ) self._keySetup(sharedSecret, exchangeHash) def _keySetup(self, sharedSecret, exchangeHash): """ See SSHTransportBase._keySetup(). """ firstKey = self.sessionID is None SSHTransportBase._keySetup(self, sharedSecret, exchangeHash) # RFC 8308 section 2.4 says that the server MAY send EXT_INFO at # zero, one, or both of the following opportunities: the next packet # following the server's first MSG_NEWKEYS, or immediately preceding # the server's MSG_USERAUTH_SUCCESS. We have no need for the # latter, so make sure we only send it in the former case. if firstKey: self.sendExtInfo( [(b"server-sig-algs", b",".join(self.supportedPublicKeys))] ) def ssh_NEWKEYS(self, packet): """ Called when we get a MSG_NEWKEYS message. No payload. When we get this, the keys have been set on both sides, and we start using them to encrypt and authenticate the connection. @type packet: L{bytes} @param packet: The message data. """ if packet != b"": self.sendDisconnect(DISCONNECT_PROTOCOL_ERROR, b"NEWKEYS takes no data") return self._newKeys() def ssh_SERVICE_REQUEST(self, packet): """ Called when we get a MSG_SERVICE_REQUEST message. Payload:: string serviceName The client has requested a service. If we can start the service, start it; otherwise, disconnect with DISCONNECT_SERVICE_NOT_AVAILABLE. @type packet: L{bytes} @param packet: The message data. """ service, rest = getNS(packet) cls = self.factory.getService(self, service) if not cls: self.sendDisconnect( DISCONNECT_SERVICE_NOT_AVAILABLE, b"don't have service " + service ) return else: self.sendPacket(MSG_SERVICE_ACCEPT, NS(service)) self.setService(cls()) class SSHClientTransport(SSHTransportBase): """ SSHClientTransport implements the client side of the SSH protocol. @ivar isClient: since we are always the client, this is always True. @ivar _gotNewKeys: if we receive a MSG_NEWKEYS message before we are ready to transition to the new keys, this is set to True so we can transition when the keys are ready locally. @ivar x: our Diffie-Hellman private key. @ivar e: our Diffie-Hellman public key. @ivar g: the Diffie-Hellman group generator. @ivar p: the Diffie-Hellman group prime @ivar instance: the SSHService object we are requesting. @ivar _dhMinimalGroupSize: Minimal acceptable group size advertised by the client in MSG_KEX_DH_GEX_REQUEST. @type _dhMinimalGroupSize: int @ivar _dhMaximalGroupSize: Maximal acceptable group size advertised by the client in MSG_KEX_DH_GEX_REQUEST. @type _dhMaximalGroupSize: int @ivar _dhPreferredGroupSize: Preferred group size advertised by the client in MSG_KEX_DH_GEX_REQUEST. @type _dhPreferredGroupSize: int """ isClient = True # Recommended minimal and maximal values from RFC 4419, 3. _dhMinimalGroupSize = 1024 _dhMaximalGroupSize = 8192 # FIXME: https://twistedmatrix.com/trac/ticket/8103 # This may need to be more dynamic; compare kexgex_client in # OpenSSH. _dhPreferredGroupSize = 2048 def connectionMade(self): """ Called when the connection is started with the server. Just sets up a private instance variable. """ SSHTransportBase.connectionMade(self) self._gotNewKeys = 0 def ssh_KEXINIT(self, packet): """ Called when we receive a MSG_KEXINIT message. For a description of the packet, see SSHTransportBase.ssh_KEXINIT(). Additionally, this method sends the first key exchange packet. If the agreed-upon exchange is ECDH, generate a key pair for the corresponding curve and send the public key. If the agreed-upon exchange has a fixed prime/generator group, generate a public key and send it in a MSG_KEXDH_INIT message. Otherwise, ask for a 2048 bit group with a MSG_KEX_DH_GEX_REQUEST message. """ if SSHTransportBase.ssh_KEXINIT(self, packet) is None: # Connection was disconnected while doing base processing. # Maybe no common protocols were agreed. return # Are we using ECDH? if _kex.isEllipticCurve(self.kexAlg): # Generate the keys self.ecPriv = self._generateECPrivateKey() self.ecPub = self.ecPriv.public_key() # DH_GEX_REQUEST_OLD is the same number we need. self.sendPacket( MSG_KEX_DH_GEX_REQUEST_OLD, NS(self._encodeECPublicKey(self.ecPub)) ) elif _kex.isFixedGroup(self.kexAlg): # We agreed on a fixed group key exchange algorithm. self.g, self.p = _kex.getDHGeneratorAndPrime(self.kexAlg) self._startEphemeralDH() self.sendPacket(MSG_KEXDH_INIT, self.dhSecretKeyPublicMP) else: # We agreed on a dynamic group. Tell the server what range of # group sizes we accept, and what size we prefer; the server # will then select a group. self.sendPacket( MSG_KEX_DH_GEX_REQUEST, struct.pack( "!LLL", self._dhMinimalGroupSize, self._dhPreferredGroupSize, self._dhMaximalGroupSize, ), ) def _ssh_KEX_ECDH_REPLY(self, packet): """ Called to handle a reply to a ECDH exchange message(KEX_ECDH_INIT). Like the handler for I{KEXDH_INIT}, this message type has an overlapping value. This method is called from C{ssh_KEX_DH_GEX_GROUP} if that method detects a non-group key exchange is in progress. Payload:: string serverHostKey string server Elliptic Curve Diffie-Hellman public key string signature We verify the host key and continue if it passes verificiation. Otherwise raise an exception and return. @type packet: L{bytes} @param packet: The message data. @return: A deferred firing when key exchange is complete. """ def _continue_KEX_ECDH_REPLY(ignored, hostKey, pubKey, signature): # Save off the host public key. theirECHost = hostKey sharedSecret = self._generateECSharedSecret(self.ecPriv, pubKey) h = _kex.getHashProcessor(self.kexAlg)() h.update(NS(self.ourVersionString)) h.update(NS(self.otherVersionString)) h.update(NS(self.ourKexInitPayload)) h.update(NS(self.otherKexInitPayload)) h.update(NS(theirECHost)) h.update(NS(self._encodeECPublicKey(self.ecPub))) h.update(NS(pubKey)) h.update(sharedSecret) exchangeHash = h.digest() if not keys.Key.fromString(theirECHost).verify(signature, exchangeHash): self.sendDisconnect(DISCONNECT_KEY_EXCHANGE_FAILED, b"bad signature") else: self._keySetup(sharedSecret, exchangeHash) # Get the host public key, # the raw ECDH public key bytes and the signature hostKey, pubKey, signature, packet = getNS(packet, 3) # Easier to comment this out for now than to update all of the tests. # fingerprint = nativeString(base64.b64encode( # sha256(hostKey).digest())) fingerprint = b":".join( [binascii.hexlify(ch) for ch in iterbytes(md5(hostKey).digest())] ) d = self.verifyHostKey(hostKey, fingerprint) d.addCallback(_continue_KEX_ECDH_REPLY, hostKey, pubKey, signature) d.addErrback( lambda unused: self.sendDisconnect( DISCONNECT_HOST_KEY_NOT_VERIFIABLE, b"bad host key" ) ) return d def _ssh_KEXDH_REPLY(self, packet): """ Called to handle a reply to a non-group key exchange message (KEXDH_INIT). Like the handler for I{KEXDH_INIT}, this message type has an overlapping value. This method is called from C{ssh_KEX_DH_GEX_GROUP} if that method detects a non-group key exchange is in progress. Payload:: string serverHostKey integer f (server Diffie-Hellman public key) string signature We verify the host key by calling verifyHostKey, then continue in _continueKEXDH_REPLY. @type packet: L{bytes} @param packet: The message data. @return: A deferred firing when key exchange is complete. """ pubKey, packet = getNS(packet) f, packet = getMP(packet) signature, packet = getNS(packet) fingerprint = b":".join( [binascii.hexlify(ch) for ch in iterbytes(md5(pubKey).digest())] ) d = self.verifyHostKey(pubKey, fingerprint) d.addCallback(self._continueKEXDH_REPLY, pubKey, f, signature) d.addErrback( lambda unused: self.sendDisconnect( DISCONNECT_HOST_KEY_NOT_VERIFIABLE, b"bad host key" ) ) return d def ssh_KEX_DH_GEX_GROUP(self, packet): """ This handles different messages which share an integer value. If the key exchange does not have a fixed prime/generator group, we generate a Diffie-Hellman public key and send it in a MSG_KEX_DH_GEX_INIT message. Payload:: string g (group generator) string p (group prime) @type packet: L{bytes} @param packet: The message data. """ if _kex.isFixedGroup(self.kexAlg): return self._ssh_KEXDH_REPLY(packet) elif _kex.isEllipticCurve(self.kexAlg): return self._ssh_KEX_ECDH_REPLY(packet) else: self.p, rest = getMP(packet) self.g, rest = getMP(rest) self._startEphemeralDH() self.sendPacket(MSG_KEX_DH_GEX_INIT, self.dhSecretKeyPublicMP) def _continueKEXDH_REPLY(self, ignored, pubKey, f, signature): """ The host key has been verified, so we generate the keys. @param ignored: Ignored. @param pubKey: the public key blob for the server's public key. @type pubKey: L{str} @param f: the server's Diffie-Hellman public key. @type f: L{int} @param signature: the server's signature, verifying that it has the correct private key. @type signature: L{str} """ serverKey = keys.Key.fromString(pubKey) sharedSecret = self._finishEphemeralDH(f) h = _kex.getHashProcessor(self.kexAlg)() h.update(NS(self.ourVersionString)) h.update(NS(self.otherVersionString)) h.update(NS(self.ourKexInitPayload)) h.update(NS(self.otherKexInitPayload)) h.update(NS(pubKey)) h.update(self.dhSecretKeyPublicMP) h.update(MP(f)) h.update(sharedSecret) exchangeHash = h.digest() if not serverKey.verify(signature, exchangeHash): self.sendDisconnect(DISCONNECT_KEY_EXCHANGE_FAILED, b"bad signature") return self._keySetup(sharedSecret, exchangeHash) def ssh_KEX_DH_GEX_REPLY(self, packet): """ Called when we receive a MSG_KEX_DH_GEX_REPLY message. Payload:: string server host key integer f (server DH public key) We verify the host key by calling verifyHostKey, then continue in _continueGEX_REPLY. @type packet: L{bytes} @param packet: The message data. @return: A deferred firing once key exchange is complete. """ pubKey, packet = getNS(packet) f, packet = getMP(packet) signature, packet = getNS(packet) fingerprint = b":".join( [binascii.hexlify(c) for c in iterbytes(md5(pubKey).digest())] ) d = self.verifyHostKey(pubKey, fingerprint) d.addCallback(self._continueGEX_REPLY, pubKey, f, signature) d.addErrback( lambda unused: self.sendDisconnect( DISCONNECT_HOST_KEY_NOT_VERIFIABLE, b"bad host key" ) ) return d def _continueGEX_REPLY(self, ignored, pubKey, f, signature): """ The host key has been verified, so we generate the keys. @param ignored: Ignored. @param pubKey: the public key blob for the server's public key. @type pubKey: L{str} @param f: the server's Diffie-Hellman public key. @type f: L{int} @param signature: the server's signature, verifying that it has the correct private key. @type signature: L{str} """ serverKey = keys.Key.fromString(pubKey) sharedSecret = self._finishEphemeralDH(f) h = _kex.getHashProcessor(self.kexAlg)() h.update(NS(self.ourVersionString)) h.update(NS(self.otherVersionString)) h.update(NS(self.ourKexInitPayload)) h.update(NS(self.otherKexInitPayload)) h.update(NS(pubKey)) h.update( struct.pack( "!LLL", self._dhMinimalGroupSize, self._dhPreferredGroupSize, self._dhMaximalGroupSize, ) ) h.update(MP(self.p)) h.update(MP(self.g)) h.update(self.dhSecretKeyPublicMP) h.update(MP(f)) h.update(sharedSecret) exchangeHash = h.digest() if not serverKey.verify(signature, exchangeHash): self.sendDisconnect(DISCONNECT_KEY_EXCHANGE_FAILED, b"bad signature") return self._keySetup(sharedSecret, exchangeHash) def _keySetup(self, sharedSecret, exchangeHash): """ See SSHTransportBase._keySetup(). """ SSHTransportBase._keySetup(self, sharedSecret, exchangeHash) if self._gotNewKeys: self.ssh_NEWKEYS(b"") def ssh_NEWKEYS(self, packet): """ Called when we receive a MSG_NEWKEYS message. No payload. If we've finished setting up our own keys, start using them. Otherwise, remember that we've received this message. @type packet: L{bytes} @param packet: The message data. """ if packet != b"": self.sendDisconnect(DISCONNECT_PROTOCOL_ERROR, b"NEWKEYS takes no data") return if not self.nextEncryptions.encBlockSize: self._gotNewKeys = 1 return self._newKeys() self.connectionSecure() def ssh_SERVICE_ACCEPT(self, packet): """ Called when we receive a MSG_SERVICE_ACCEPT message. Payload:: string service name Start the service we requested. @type packet: L{bytes} @param packet: The message data. """ if packet == b"": self._log.info("got SERVICE_ACCEPT without payload") else: name = getNS(packet)[0] if name != self.instance.name: self.sendDisconnect( DISCONNECT_PROTOCOL_ERROR, b"received accept for service we did not request", ) self.setService(self.instance) def requestService(self, instance): """ Request that a service be run over this transport. @type instance: subclass of L{twisted.conch.ssh.service.SSHService} @param instance: The service to run. """ self.sendPacket(MSG_SERVICE_REQUEST, NS(instance.name)) self.instance = instance # Client methods def verifyHostKey(self, hostKey, fingerprint): """ Returns a Deferred that gets a callback if it is a valid key, or an errback if not. @type hostKey: L{bytes} @param hostKey: The host key to verify. @type fingerprint: L{bytes} @param fingerprint: The fingerprint of the key. @return: A deferred firing with C{True} if the key is valid. """ return defer.fail(NotImplementedError()) def connectionSecure(self): """ Called when the encryption has been set up. Generally, requestService() is called to run another service over the transport. """ raise NotImplementedError() class _NullEncryptionContext: """ An encryption context that does not actually encrypt anything. """ def update(self, data): """ 'Encrypt' new data by doing nothing. @type data: L{bytes} @param data: The data to 'encrypt'. @rtype: L{bytes} @return: The 'encrypted' data. """ return data class _DummyAlgorithm: """ An encryption algorithm that does not actually encrypt anything. """ block_size = 64 class _DummyCipher: """ A cipher for the none encryption method. @ivar block_size: the block size of the encryption. In the case of the none cipher, this is 8 bytes. """ algorithm = _DummyAlgorithm() def encryptor(self): """ Construct a noop encryptor. @return: The encryptor. """ return _NullEncryptionContext() def decryptor(self): """ Construct a noop decryptor. @return: The decryptor. """ return _NullEncryptionContext() DH_GENERATOR, DH_PRIME = _kex.getDHGeneratorAndPrime(b"diffie-hellman-group14-sha1") MSG_DISCONNECT = 1 MSG_IGNORE = 2 MSG_UNIMPLEMENTED = 3 MSG_DEBUG = 4 MSG_SERVICE_REQUEST = 5 MSG_SERVICE_ACCEPT = 6 MSG_EXT_INFO = 7 MSG_KEXINIT = 20 MSG_NEWKEYS = 21 MSG_KEXDH_INIT = 30 MSG_KEXDH_REPLY = 31 MSG_KEX_DH_GEX_REQUEST_OLD = 30 MSG_KEX_DH_GEX_REQUEST = 34 MSG_KEX_DH_GEX_GROUP = 31 MSG_KEX_DH_GEX_INIT = 32 MSG_KEX_DH_GEX_REPLY = 33 DISCONNECT_HOST_NOT_ALLOWED_TO_CONNECT = 1 DISCONNECT_PROTOCOL_ERROR = 2 DISCONNECT_KEY_EXCHANGE_FAILED = 3 DISCONNECT_RESERVED = 4 DISCONNECT_MAC_ERROR = 5 DISCONNECT_COMPRESSION_ERROR = 6 DISCONNECT_SERVICE_NOT_AVAILABLE = 7 DISCONNECT_PROTOCOL_VERSION_NOT_SUPPORTED = 8 DISCONNECT_HOST_KEY_NOT_VERIFIABLE = 9 DISCONNECT_CONNECTION_LOST = 10 DISCONNECT_BY_APPLICATION = 11 DISCONNECT_TOO_MANY_CONNECTIONS = 12 DISCONNECT_AUTH_CANCELLED_BY_USER = 13 DISCONNECT_NO_MORE_AUTH_METHODS_AVAILABLE = 14 DISCONNECT_ILLEGAL_USER_NAME = 15 messages = {} for name, value in list(globals().items()): # Avoid legacy messages which overlap with never ones if name.startswith("MSG_") and not name.startswith("MSG_KEXDH_"): messages[value] = name # Check for regressions (#5352) if "MSG_KEXDH_INIT" in messages or "MSG_KEXDH_REPLY" in messages: raise RuntimeError("legacy SSH mnemonics should not end up in messages dict")
| ver. 1.4 |
Github
|
.
| PHP 8.2.28 | Generation time: 0.02 |
proxy
|
phpinfo
|
Settings