{$message}
* setKey('abcdefghijklmnop'); * @@ -35,118 +39,33 @@ * ?> *
* setKey('12345678901234567890123456789012'); * @@ -26,26 +26,8 @@ * ?> *
* setKey('abcdefgh'); * @@ -32,170 +32,87 @@ * ?> *
* setKey('abcdefg'); * @@ -28,64 +28,50 @@ * ?> *
* setKey('abcdefgh'); * @@ -26,106 +26,28 @@ * ?> *
* setKey('abcdefgh'); * @@ -34,108 +34,59 @@ * ?> *
* createKey()); * * $plaintext = 'terrafrost'; @@ -26,9 +26,9 @@ * Here's an example of how to create signatures and verify signatures with this library: * * createKey()); * * $plaintext = 'terrafrost'; @@ -41,241 +41,211 @@ * ?> * * - * LICENSE: Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in - * all copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN - * THE SOFTWARE. - * * @category Crypt - * @package Crypt_RSA + * @package RSA * @author Jim Wigginton * @copyright 2009 Jim Wigginton * @license http://www.opensource.org/licenses/mit-license.html MIT License * @link http://phpseclib.sourceforge.net */ -/** - * Include Crypt_Random - */ -// the class_exists() will only be called if the crypt_random_string function hasn't been defined and -// will trigger a call to __autoload() if you're wanting to auto-load classes -// call function_exists() a second time to stop the include_once from being called outside -// of the auto loader -if (!function_exists('crypt_random_string')) { - include_once 'Random.php'; -} +namespace phpseclib\Crypt; -/** - * Include Crypt_Hash - */ -if (!class_exists('Crypt_Hash')) { - include_once 'Hash.php'; -} - -/**#@+ - * @access public - * @see Crypt_RSA::encrypt() - * @see Crypt_RSA::decrypt() - */ -/** - * Use {@link http://en.wikipedia.org/wiki/Optimal_Asymmetric_Encryption_Padding Optimal Asymmetric Encryption Padding} - * (OAEP) for encryption / decryption. - * - * Uses sha1 by default. - * - * @see Crypt_RSA::setHash() - * @see Crypt_RSA::setMGFHash() - */ -define('CRYPT_RSA_ENCRYPTION_OAEP', 1); -/** - * Use PKCS#1 padding. - * - * Although CRYPT_RSA_ENCRYPTION_OAEP offers more security, including PKCS#1 padding is necessary for purposes of backwards - * compatibility with protocols (like SSH-1) written before OAEP's introduction. - */ -define('CRYPT_RSA_ENCRYPTION_PKCS1', 2); -/**#@-*/ - -/**#@+ - * @access public - * @see Crypt_RSA::sign() - * @see Crypt_RSA::verify() - * @see Crypt_RSA::setHash() - */ -/** - * Use the Probabilistic Signature Scheme for signing - * - * Uses sha1 by default. - * - * @see Crypt_RSA::setSaltLength() - * @see Crypt_RSA::setMGFHash() - */ -define('CRYPT_RSA_SIGNATURE_PSS', 1); -/** - * Use the PKCS#1 scheme by default. - * - * Although CRYPT_RSA_SIGNATURE_PSS offers more security, including PKCS#1 signing is necessary for purposes of backwards - * compatibility with protocols (like SSH-2) written before PSS's introduction. - */ -define('CRYPT_RSA_SIGNATURE_PKCS1', 2); -/**#@-*/ - -/**#@+ - * @access private - * @see Crypt_RSA::createKey() - */ -/** - * ASN1 Integer - */ -define('CRYPT_RSA_ASN1_INTEGER', 2); -/** - * ASN1 Bit String - */ -define('CRYPT_RSA_ASN1_BITSTRING', 3); -/** - * ASN1 Octet String - */ -define('CRYPT_RSA_ASN1_OCTETSTRING', 4); -/** - * ASN1 Object Identifier - */ -define('CRYPT_RSA_ASN1_OBJECT', 6); -/** - * ASN1 Sequence (with the constucted bit set) - */ -define('CRYPT_RSA_ASN1_SEQUENCE', 48); -/**#@-*/ - -/**#@+ - * @access private - * @see Crypt_RSA::Crypt_RSA() - */ -/** - * To use the pure-PHP implementation - */ -define('CRYPT_RSA_MODE_INTERNAL', 1); -/** - * To use the OpenSSL library - * - * (if enabled; otherwise, the internal implementation will be used) - */ -define('CRYPT_RSA_MODE_OPENSSL', 2); -/**#@-*/ - -/** - * Default openSSL configuration file. - */ -define('CRYPT_RSA_OPENSSL_CONFIG', dirname(__FILE__) . '/../openssl.cnf'); - -/**#@+ - * @access public - * @see Crypt_RSA::createKey() - * @see Crypt_RSA::setPrivateKeyFormat() - */ -/** - * PKCS#1 formatted private key - * - * Used by OpenSSH - */ -define('CRYPT_RSA_PRIVATE_FORMAT_PKCS1', 0); -/** - * PuTTY formatted private key - */ -define('CRYPT_RSA_PRIVATE_FORMAT_PUTTY', 1); -/** - * XML formatted private key - */ -define('CRYPT_RSA_PRIVATE_FORMAT_XML', 2); -/** - * PKCS#8 formatted private key - */ -define('CRYPT_RSA_PRIVATE_FORMAT_PKCS8', 3); -/**#@-*/ - -/**#@+ - * @access public - * @see Crypt_RSA::createKey() - * @see Crypt_RSA::setPublicKeyFormat() - */ -/** - * Raw public key - * - * An array containing two Math_BigInteger objects. - * - * The exponent can be indexed with any of the following: - * - * 0, e, exponent, publicExponent - * - * The modulus can be indexed with any of the following: - * - * 1, n, modulo, modulus - */ -define('CRYPT_RSA_PUBLIC_FORMAT_RAW', 3); -/** - * PKCS#1 formatted public key (raw) - * - * Used by File/X509.php - * - * Has the following header: - * - * -----BEGIN RSA PUBLIC KEY----- - * - * Analogous to ssh-keygen's pem format (as specified by -m) - */ -define('CRYPT_RSA_PUBLIC_FORMAT_PKCS1', 4); -define('CRYPT_RSA_PUBLIC_FORMAT_PKCS1_RAW', 4); -/** - * XML formatted public key - */ -define('CRYPT_RSA_PUBLIC_FORMAT_XML', 5); -/** - * OpenSSH formatted public key - * - * Place in $HOME/.ssh/authorized_keys - */ -define('CRYPT_RSA_PUBLIC_FORMAT_OPENSSH', 6); -/** - * PKCS#1 formatted public key (encapsulated) - * - * Used by PHP's openssl_public_encrypt() and openssl's rsautl (when -pubin is set) - * - * Has the following header: - * - * -----BEGIN PUBLIC KEY----- - * - * Analogous to ssh-keygen's pkcs8 format (as specified by -m). Although PKCS8 - * is specific to private keys it's basically creating a DER-encoded wrapper - * for keys. This just extends that same concept to public keys (much like ssh-keygen) - */ -define('CRYPT_RSA_PUBLIC_FORMAT_PKCS8', 7); -/**#@-*/ +use phpseclib\Math\BigInteger; /** * Pure-PHP PKCS#1 compliant implementation of RSA. * - * @package Crypt_RSA + * @package RSA * @author Jim Wigginton * @access public */ -class Crypt_RSA +class RSA { + /**#@+ + * @access public + * @see self::encrypt() + * @see self::decrypt() + */ + /** + * Use {@link http://en.wikipedia.org/wiki/Optimal_Asymmetric_Encryption_Padding Optimal Asymmetric Encryption Padding} + * (OAEP) for encryption / decryption. + * + * Uses sha1 by default. + * + * @see self::setHash() + * @see self::setMGFHash() + */ + const ENCRYPTION_OAEP = 1; + /** + * Use PKCS#1 padding. + * + * Although self::ENCRYPTION_OAEP offers more security, including PKCS#1 padding is necessary for purposes of backwards + * compatibility with protocols (like SSH-1) written before OAEP's introduction. + */ + const ENCRYPTION_PKCS1 = 2; + /** + * Do not use any padding + * + * Although this method is not recommended it can none-the-less sometimes be useful if you're trying to decrypt some legacy + * stuff, if you're trying to diagnose why an encrypted message isn't decrypting, etc. + */ + const ENCRYPTION_NONE = 3; + /**#@-*/ + + /**#@+ + * @access public + * @see self::sign() + * @see self::verify() + * @see self::setHash() + */ + /** + * Use the Probabilistic Signature Scheme for signing + * + * Uses sha1 by default. + * + * @see self::setSaltLength() + * @see self::setMGFHash() + */ + const SIGNATURE_PSS = 1; + /** + * Use the PKCS#1 scheme by default. + * + * Although self::SIGNATURE_PSS offers more security, including PKCS#1 signing is necessary for purposes of backwards + * compatibility with protocols (like SSH-2) written before PSS's introduction. + */ + const SIGNATURE_PKCS1 = 2; + /**#@-*/ + + /**#@+ + * @access private + * @see \phpseclib\Crypt\RSA::createKey() + */ + /** + * ASN1 Integer + */ + const ASN1_INTEGER = 2; + /** + * ASN1 Bit String + */ + const ASN1_BITSTRING = 3; + /** + * ASN1 Octet String + */ + const ASN1_OCTETSTRING = 4; + /** + * ASN1 Object Identifier + */ + const ASN1_OBJECT = 6; + /** + * ASN1 Sequence (with the constucted bit set) + */ + const ASN1_SEQUENCE = 48; + /**#@-*/ + + /**#@+ + * @access private + * @see \phpseclib\Crypt\RSA::__construct() + */ + /** + * To use the pure-PHP implementation + */ + const MODE_INTERNAL = 1; + /** + * To use the OpenSSL library + * + * (if enabled; otherwise, the internal implementation will be used) + */ + const MODE_OPENSSL = 2; + /**#@-*/ + + /**#@+ + * @access public + * @see \phpseclib\Crypt\RSA::createKey() + * @see \phpseclib\Crypt\RSA::setPrivateKeyFormat() + */ + /** + * PKCS#1 formatted private key + * + * Used by OpenSSH + */ + const PRIVATE_FORMAT_PKCS1 = 0; + /** + * PuTTY formatted private key + */ + const PRIVATE_FORMAT_PUTTY = 1; + /** + * XML formatted private key + */ + const PRIVATE_FORMAT_XML = 2; + /** + * PKCS#8 formatted private key + */ + const PRIVATE_FORMAT_PKCS8 = 8; + /**#@-*/ + + /**#@+ + * @access public + * @see \phpseclib\Crypt\RSA::createKey() + * @see \phpseclib\Crypt\RSA::setPublicKeyFormat() + */ + /** + * Raw public key + * + * An array containing two \phpseclib\Math\BigInteger objects. + * + * The exponent can be indexed with any of the following: + * + * 0, e, exponent, publicExponent + * + * The modulus can be indexed with any of the following: + * + * 1, n, modulo, modulus + */ + const PUBLIC_FORMAT_RAW = 3; + /** + * PKCS#1 formatted public key (raw) + * + * Used by File/X509.php + * + * Has the following header: + * + * -----BEGIN RSA PUBLIC KEY----- + * + * Analogous to ssh-keygen's pem format (as specified by -m) + */ + const PUBLIC_FORMAT_PKCS1 = 4; + const PUBLIC_FORMAT_PKCS1_RAW = 4; + /** + * XML formatted public key + */ + const PUBLIC_FORMAT_XML = 5; + /** + * OpenSSH formatted public key + * + * Place in $HOME/.ssh/authorized_keys + */ + const PUBLIC_FORMAT_OPENSSH = 6; + /** + * PKCS#1 formatted public key (encapsulated) + * + * Used by PHP's openssl_public_encrypt() and openssl's rsautl (when -pubin is set) + * + * Has the following header: + * + * -----BEGIN PUBLIC KEY----- + * + * Analogous to ssh-keygen's pkcs8 format (as specified by -m). Although PKCS8 + * is specific to private keys it's basically creating a DER-encoded wrapper + * for keys. This just extends that same concept to public keys (much like ssh-keygen) + */ + const PUBLIC_FORMAT_PKCS8 = 7; + /**#@-*/ + /** * Precomputed Zero * - * @var Array + * @var \phpseclib\Math\BigInteger * @access private */ var $zero; @@ -283,7 +253,7 @@ class Crypt_RSA /** * Precomputed One * - * @var Array + * @var \phpseclib\Math\BigInteger * @access private */ var $one; @@ -291,23 +261,23 @@ class Crypt_RSA /** * Private Key Format * - * @var Integer + * @var int * @access private */ - var $privateKeyFormat = CRYPT_RSA_PRIVATE_FORMAT_PKCS1; + var $privateKeyFormat = self::PRIVATE_FORMAT_PKCS1; /** * Public Key Format * - * @var Integer + * @var int * @access public */ - var $publicKeyFormat = CRYPT_RSA_PUBLIC_FORMAT_PKCS8; + var $publicKeyFormat = self::PUBLIC_FORMAT_PKCS8; /** * Modulus (ie. n) * - * @var Math_BigInteger + * @var \phpseclib\Math\BigInteger * @access private */ var $modulus; @@ -315,7 +285,7 @@ class Crypt_RSA /** * Modulus length * - * @var Math_BigInteger + * @var \phpseclib\Math\BigInteger * @access private */ var $k; @@ -323,7 +293,7 @@ class Crypt_RSA /** * Exponent (ie. e or d) * - * @var Math_BigInteger + * @var \phpseclib\Math\BigInteger * @access private */ var $exponent; @@ -331,7 +301,7 @@ class Crypt_RSA /** * Primes for Chinese Remainder Theorem (ie. p and q) * - * @var Array + * @var array * @access private */ var $primes; @@ -339,7 +309,7 @@ class Crypt_RSA /** * Exponents for Chinese Remainder Theorem (ie. dP and dQ) * - * @var Array + * @var array * @access private */ var $exponents; @@ -347,7 +317,7 @@ class Crypt_RSA /** * Coefficients for Chinese Remainder Theorem (ie. qInv) * - * @var Array + * @var array * @access private */ var $coefficients; @@ -355,7 +325,7 @@ class Crypt_RSA /** * Hash name * - * @var String + * @var string * @access private */ var $hashName; @@ -363,7 +333,7 @@ class Crypt_RSA /** * Hash function * - * @var Crypt_Hash + * @var \phpseclib\Crypt\Hash * @access private */ var $hash; @@ -371,7 +341,7 @@ class Crypt_RSA /** * Length of hash function output * - * @var Integer + * @var int * @access private */ var $hLen; @@ -379,7 +349,7 @@ class Crypt_RSA /** * Length of salt * - * @var Integer + * @var int * @access private */ var $sLen; @@ -387,7 +357,7 @@ class Crypt_RSA /** * Hash function for the Mask Generation Function * - * @var Crypt_Hash + * @var \phpseclib\Crypt\Hash * @access private */ var $mgfHash; @@ -395,7 +365,7 @@ class Crypt_RSA /** * Length of MGF hash function output * - * @var Integer + * @var int * @access private */ var $mgfHLen; @@ -403,23 +373,23 @@ class Crypt_RSA /** * Encryption mode * - * @var Integer + * @var int * @access private */ - var $encryptionMode = CRYPT_RSA_ENCRYPTION_OAEP; + var $encryptionMode = self::ENCRYPTION_OAEP; /** * Signature mode * - * @var Integer + * @var int * @access private */ - var $signatureMode = CRYPT_RSA_SIGNATURE_PSS; + var $signatureMode = self::SIGNATURE_PSS; /** * Public Exponent * - * @var Mixed + * @var mixed * @access private */ var $publicExponent = false; @@ -427,7 +397,7 @@ class Crypt_RSA /** * Password * - * @var String + * @var string * @access private */ var $password = false; @@ -438,8 +408,8 @@ class Crypt_RSA * For use with parsing XML formatted keys. PHP's XML Parser functions use utilized - instead of PHP's DOM functions - * because PHP's XML Parser functions work on PHP4 whereas PHP's DOM functions - although surperior - don't. * - * @see Crypt_RSA::_start_element_handler() - * @var Array + * @see self::_start_element_handler() + * @var array * @access private */ var $components = array(); @@ -449,9 +419,9 @@ class Crypt_RSA * * For use with parsing XML formatted keys. * - * @see Crypt_RSA::_character_handler() - * @see Crypt_RSA::_stop_element_handler() - * @var Mixed + * @see self::_character_handler() + * @see self::_stop_element_handler() + * @var mixed * @access private */ var $current; @@ -460,8 +430,8 @@ class Crypt_RSA * OpenSSL configuration file name. * * Set to null to use system configuration file. - * @see Crypt_RSA::createKey() - * @var Mixed + * @see self::createKey() + * @var mixed * @Access public */ var $configFile; @@ -469,7 +439,7 @@ class Crypt_RSA /** * Public key comment field. * - * @var String + * @var string * @access private */ var $comment = 'phpseclib-generated-key'; @@ -478,33 +448,25 @@ class Crypt_RSA * The constructor * * If you want to make use of the openssl extension, you'll need to set the mode manually, yourself. The reason - * Crypt_RSA doesn't do it is because OpenSSL doesn't fail gracefully. openssl_pkey_new(), in particular, requires + * \phpseclib\Crypt\RSA doesn't do it is because OpenSSL doesn't fail gracefully. openssl_pkey_new(), in particular, requires * openssl.cnf be present somewhere and, unfortunately, the only real way to find out is too late. * - * @return Crypt_RSA + * @return \phpseclib\Crypt\RSA * @access public */ - function Crypt_RSA() + function __construct() { - if (!class_exists('Math_BigInteger')) { - include_once 'Math/BigInteger.php'; - } + $this->configFile = dirname(__FILE__) . '/../openssl.cnf'; - $this->configFile = CRYPT_RSA_OPENSSL_CONFIG; - - if ( !defined('CRYPT_RSA_MODE') ) { + if (!defined('CRYPT_RSA_MODE')) { switch (true) { // Math/BigInteger's openssl requirements are a little less stringent than Crypt/RSA's. in particular, // Math/BigInteger doesn't require an openssl.cfg file whereas Crypt/RSA does. so if Math/BigInteger // can't use OpenSSL it can be pretty trivially assumed, then, that Crypt/RSA can't either. case defined('MATH_BIGINTEGER_OPENSSL_DISABLE'): - define('CRYPT_RSA_MODE', CRYPT_RSA_MODE_INTERNAL); + define('CRYPT_RSA_MODE', self::MODE_INTERNAL); break; - // openssl_pkey_get_details - which is used in the only place Crypt/RSA.php uses OpenSSL - was introduced in PHP 5.2.0 - case !function_exists('openssl_pkey_get_details'): - define('CRYPT_RSA_MODE', CRYPT_RSA_MODE_INTERNAL); - break; - case extension_loaded('openssl') && version_compare(PHP_VERSION, '4.2.0', '>=') && file_exists($this->configFile): + case extension_loaded('openssl') && file_exists($this->configFile): // some versions of XAMPP have mismatched versions of OpenSSL which causes it not to work ob_start(); @phpinfo(); @@ -532,25 +494,26 @@ class Crypt_RSA case !isset($versions['Header']): case !isset($versions['Library']): case $versions['Header'] == $versions['Library']: - define('CRYPT_RSA_MODE', CRYPT_RSA_MODE_OPENSSL); + case version_compare($versions['Header'], '1.0.0') >= 0 && version_compare($versions['Library'], '1.0.0') >= 0: + define('CRYPT_RSA_MODE', self::MODE_OPENSSL); break; default: - define('CRYPT_RSA_MODE', CRYPT_RSA_MODE_INTERNAL); + define('CRYPT_RSA_MODE', self::MODE_INTERNAL); define('MATH_BIGINTEGER_OPENSSL_DISABLE', true); } break; default: - define('CRYPT_RSA_MODE', CRYPT_RSA_MODE_INTERNAL); + define('CRYPT_RSA_MODE', self::MODE_INTERNAL); } } - $this->zero = new Math_BigInteger(); - $this->one = new Math_BigInteger(1); + $this->zero = new BigInteger(); + $this->one = new BigInteger(1); - $this->hash = new Crypt_Hash('sha1'); + $this->hash = new Hash('sha1'); $this->hLen = $this->hash->getLength(); $this->hashName = 'sha1'; - $this->mgfHash = new Crypt_Hash('sha1'); + $this->mgfHash = new Hash('sha1'); $this->mgfHLen = $this->mgfHash->getLength(); } @@ -561,12 +524,12 @@ class Crypt_RSA * - 'privatekey': The private key. * - 'publickey': The public key. * - 'partialkey': A partially computed key (if the execution time exceeded $timeout). - * Will need to be passed back to Crypt_RSA::createKey() as the third parameter for further processing. + * Will need to be passed back to \phpseclib\Crypt\RSA::createKey() as the third parameter for further processing. * * @access public - * @param optional Integer $bits - * @param optional Integer $timeout - * @param optional Math_BigInteger $p + * @param int $bits + * @param int $timeout + * @param array $p */ function createKey($bits = 1024, $timeout = false, $partial = array()) { @@ -577,7 +540,7 @@ class Crypt_RSA // per , this number ought not result in primes smaller // than 256 bits. as a consequence if the key you're trying to create is 1024 bits and you've set CRYPT_RSA_SMALLEST_PRIME // to 384 bits then you're going to get a 384 bit prime and a 640 bit prime (384 + 1024 % 384). at least if - // CRYPT_RSA_MODE is set to CRYPT_RSA_MODE_INTERNAL. if CRYPT_RSA_MODE is set to CRYPT_RSA_MODE_OPENSSL then + // CRYPT_RSA_MODE is set to self::MODE_INTERNAL. if CRYPT_RSA_MODE is set to self::MODE_OPENSSL then // CRYPT_RSA_SMALLEST_PRIME is ignored (ie. multi-prime RSA support is more intended as a way to speed up RSA key // generation when there's a chance neither gmp nor OpenSSL are installed) if (!defined('CRYPT_RSA_SMALLEST_PRIME')) { @@ -585,7 +548,7 @@ class Crypt_RSA } // OpenSSL uses 65537 as the exponent and requires RSA keys be 384 bits minimum - if ( CRYPT_RSA_MODE == CRYPT_RSA_MODE_OPENSSL && $bits >= 384 && CRYPT_RSA_EXPONENT == 65537) { + if (CRYPT_RSA_MODE == self::MODE_OPENSSL && $bits >= 384 && CRYPT_RSA_EXPONENT == 65537) { $config = array(); if (isset($this->configFile)) { $config['config'] = $this->configFile; @@ -595,11 +558,12 @@ class Crypt_RSA $publickey = openssl_pkey_get_details($rsa); $publickey = $publickey['key']; - $privatekey = call_user_func_array(array($this, '_convertPrivateKey'), array_values($this->_parseKey($privatekey, CRYPT_RSA_PRIVATE_FORMAT_PKCS1))); - $publickey = call_user_func_array(array($this, '_convertPublicKey'), array_values($this->_parseKey($publickey, CRYPT_RSA_PUBLIC_FORMAT_PKCS1))); + $privatekey = call_user_func_array(array($this, '_convertPrivateKey'), array_values($this->_parseKey($privatekey, self::PRIVATE_FORMAT_PKCS1))); + $publickey = call_user_func_array(array($this, '_convertPublicKey'), array_values($this->_parseKey($publickey, self::PUBLIC_FORMAT_PKCS1))); // clear the buffer of error strings stemming from a minimalistic openssl.cnf - while (openssl_error_string() !== false); + while (openssl_error_string() !== false) { + } return array( 'privatekey' => $privatekey, @@ -610,7 +574,7 @@ class Crypt_RSA static $e; if (!isset($e)) { - $e = new Math_BigInteger(CRYPT_RSA_EXPONENT); + $e = new BigInteger(CRYPT_RSA_EXPONENT); } extract($this->_generateMinMax($bits)); @@ -626,7 +590,7 @@ class Crypt_RSA $finalMax = $max; extract($this->_generateMinMax($temp)); - $generator = new Math_BigInteger(); + $generator = new BigInteger(); $n = $this->one->copy(); if (!empty($partial)) { @@ -743,13 +707,13 @@ class Crypt_RSA * Convert a private key to the appropriate format. * * @access private - * @see setPrivateKeyFormat() - * @param String $RSAPrivateKey - * @return String + * @see self::setPrivateKeyFormat() + * @param string $RSAPrivateKey + * @return string */ function _convertPrivateKey($n, $e, $d, $primes, $exponents, $coefficients) { - $signed = $this->privateKeyFormat != CRYPT_RSA_PRIVATE_FORMAT_XML; + $signed = $this->privateKeyFormat != self::PRIVATE_FORMAT_XML; $num_primes = count($primes); $raw = array( 'version' => $num_primes == 2 ? chr(0) : chr(1), // two-prime vs. multi @@ -766,7 +730,7 @@ class Crypt_RSA // if the format in question does not support multi-prime rsa and multi-prime rsa was used, // call _convertPublicKey() instead. switch ($this->privateKeyFormat) { - case CRYPT_RSA_PRIVATE_FORMAT_XML: + case self::PRIVATE_FORMAT_XML: if ($num_primes != 2) { return false; } @@ -781,7 +745,7 @@ class Crypt_RSA ' ' . base64_encode($raw['privateExponent']) . "\r\n" . ''; break; - case CRYPT_RSA_PRIVATE_FORMAT_PUTTY: + case self::PRIVATE_FORMAT_PUTTY: if ($num_primes != 2) { return false; } @@ -789,29 +753,46 @@ class Crypt_RSA $encryption = (!empty($this->password) || is_string($this->password)) ? 'aes256-cbc' : 'none'; $key.= $encryption; $key.= "\r\nComment: " . $this->comment . "\r\n"; - $public = pack('Na*Na*Na*', - strlen('ssh-rsa'), 'ssh-rsa', strlen($raw['publicExponent']), $raw['publicExponent'], strlen($raw['modulus']), $raw['modulus'] + $public = pack( + 'Na*Na*Na*', + strlen('ssh-rsa'), + 'ssh-rsa', + strlen($raw['publicExponent']), + $raw['publicExponent'], + strlen($raw['modulus']), + $raw['modulus'] ); - $source = pack('Na*Na*Na*Na*', - strlen('ssh-rsa'), 'ssh-rsa', strlen($encryption), $encryption, - strlen($this->comment), $this->comment, strlen($public), $public + $source = pack( + 'Na*Na*Na*Na*', + strlen('ssh-rsa'), + 'ssh-rsa', + strlen($encryption), + $encryption, + strlen($this->comment), + $this->comment, + strlen($public), + $public ); $public = base64_encode($public); $key.= "Public-Lines: " . ((strlen($public) + 63) >> 6) . "\r\n"; $key.= chunk_split($public, 64); - $private = pack('Na*Na*Na*Na*', - strlen($raw['privateExponent']), $raw['privateExponent'], strlen($raw['prime1']), $raw['prime1'], - strlen($raw['prime2']), $raw['prime2'], strlen($raw['coefficient']), $raw['coefficient'] + $private = pack( + 'Na*Na*Na*Na*', + strlen($raw['privateExponent']), + $raw['privateExponent'], + strlen($raw['prime1']), + $raw['prime1'], + strlen($raw['prime2']), + $raw['prime2'], + strlen($raw['coefficient']), + $raw['coefficient'] ); if (empty($this->password) && !is_string($this->password)) { $source.= pack('Na*', strlen($private), $private); $hashkey = 'putty-private-key-file-mac-key'; } else { - $private.= crypt_random_string(16 - (strlen($private) & 15)); + $private.= Random::string(16 - (strlen($private) & 15)); $source.= pack('Na*', strlen($private), $private); - if (!class_exists('Crypt_AES')) { - include_once 'Crypt/AES.php'; - } $sequence = 0; $symkey = ''; while (strlen($symkey) < 32) { @@ -819,7 +800,7 @@ class Crypt_RSA $symkey.= pack('H*', sha1($temp)); } $symkey = substr($symkey, 0, 32); - $crypto = new Crypt_AES(); + $crypto = new AES(); $crypto->setKey($symkey); $crypto->disablePadding(); @@ -830,18 +811,15 @@ class Crypt_RSA $private = base64_encode($private); $key.= 'Private-Lines: ' . ((strlen($private) + 63) >> 6) . "\r\n"; $key.= chunk_split($private, 64); - if (!class_exists('Crypt_Hash')) { - include_once 'Crypt/Hash.php'; - } - $hash = new Crypt_Hash('sha1'); + $hash = new Hash('sha1'); $hash->setKey(pack('H*', sha1($hashkey))); $key.= 'Private-MAC: ' . bin2hex($hash->hash($source)) . "\r\n"; return $key; - default: // eg. CRYPT_RSA_PRIVATE_FORMAT_PKCS1 + default: // eg. self::PRIVATE_FORMAT_PKCS1 $components = array(); foreach ($raw as $name => $value) { - $components[$name] = pack('Ca*a*', CRYPT_RSA_ASN1_INTEGER, $this->_encodeLength(strlen($value)), $value); + $components[$name] = pack('Ca*a*', self::ASN1_INTEGER, $this->_encodeLength(strlen($value)), $value); } $RSAPrivateKey = implode('', $components); @@ -856,50 +834,68 @@ class Crypt_RSA // exponent INTEGER, -- di // coefficient INTEGER -- ti // } - $OtherPrimeInfo = pack('Ca*a*', CRYPT_RSA_ASN1_INTEGER, $this->_encodeLength(strlen($primes[$i]->toBytes(true))), $primes[$i]->toBytes(true)); - $OtherPrimeInfo.= pack('Ca*a*', CRYPT_RSA_ASN1_INTEGER, $this->_encodeLength(strlen($exponents[$i]->toBytes(true))), $exponents[$i]->toBytes(true)); - $OtherPrimeInfo.= pack('Ca*a*', CRYPT_RSA_ASN1_INTEGER, $this->_encodeLength(strlen($coefficients[$i]->toBytes(true))), $coefficients[$i]->toBytes(true)); - $OtherPrimeInfos.= pack('Ca*a*', CRYPT_RSA_ASN1_SEQUENCE, $this->_encodeLength(strlen($OtherPrimeInfo)), $OtherPrimeInfo); + $OtherPrimeInfo = pack('Ca*a*', self::ASN1_INTEGER, $this->_encodeLength(strlen($primes[$i]->toBytes(true))), $primes[$i]->toBytes(true)); + $OtherPrimeInfo.= pack('Ca*a*', self::ASN1_INTEGER, $this->_encodeLength(strlen($exponents[$i]->toBytes(true))), $exponents[$i]->toBytes(true)); + $OtherPrimeInfo.= pack('Ca*a*', self::ASN1_INTEGER, $this->_encodeLength(strlen($coefficients[$i]->toBytes(true))), $coefficients[$i]->toBytes(true)); + $OtherPrimeInfos.= pack('Ca*a*', self::ASN1_SEQUENCE, $this->_encodeLength(strlen($OtherPrimeInfo)), $OtherPrimeInfo); } - $RSAPrivateKey.= pack('Ca*a*', CRYPT_RSA_ASN1_SEQUENCE, $this->_encodeLength(strlen($OtherPrimeInfos)), $OtherPrimeInfos); + $RSAPrivateKey.= pack('Ca*a*', self::ASN1_SEQUENCE, $this->_encodeLength(strlen($OtherPrimeInfos)), $OtherPrimeInfos); } - $RSAPrivateKey = pack('Ca*a*', CRYPT_RSA_ASN1_SEQUENCE, $this->_encodeLength(strlen($RSAPrivateKey)), $RSAPrivateKey); + $RSAPrivateKey = pack('Ca*a*', self::ASN1_SEQUENCE, $this->_encodeLength(strlen($RSAPrivateKey)), $RSAPrivateKey); - if ($this->privateKeyFormat == CRYPT_RSA_PRIVATE_FORMAT_PKCS8) { + if ($this->privateKeyFormat == self::PRIVATE_FORMAT_PKCS8) { $rsaOID = pack('H*', '300d06092a864886f70d0101010500'); // hex version of MA0GCSqGSIb3DQEBAQUA - $RSAPrivateKey = pack('Ca*a*Ca*a*', - CRYPT_RSA_ASN1_INTEGER, "\01\00", $rsaOID, 4, $this->_encodeLength(strlen($RSAPrivateKey)), $RSAPrivateKey + $RSAPrivateKey = pack( + 'Ca*a*Ca*a*', + self::ASN1_INTEGER, + "\01\00", + $rsaOID, + 4, + $this->_encodeLength(strlen($RSAPrivateKey)), + $RSAPrivateKey ); - $RSAPrivateKey = pack('Ca*a*', CRYPT_RSA_ASN1_SEQUENCE, $this->_encodeLength(strlen($RSAPrivateKey)), $RSAPrivateKey); + $RSAPrivateKey = pack('Ca*a*', self::ASN1_SEQUENCE, $this->_encodeLength(strlen($RSAPrivateKey)), $RSAPrivateKey); if (!empty($this->password) || is_string($this->password)) { - $salt = crypt_random_string(8); + $salt = Random::string(8); $iterationCount = 2048; - if (!class_exists('Crypt_DES')) { - include_once 'Crypt/DES.php'; - } - $crypto = new Crypt_DES(); + $crypto = new DES(); $crypto->setPassword($this->password, 'pbkdf1', 'md5', $salt, $iterationCount); $RSAPrivateKey = $crypto->encrypt($RSAPrivateKey); - $parameters = pack('Ca*a*Ca*N', - CRYPT_RSA_ASN1_OCTETSTRING, $this->_encodeLength(strlen($salt)), $salt, - CRYPT_RSA_ASN1_INTEGER, $this->_encodeLength(4), $iterationCount + $parameters = pack( + 'Ca*a*Ca*N', + self::ASN1_OCTETSTRING, + $this->_encodeLength(strlen($salt)), + $salt, + self::ASN1_INTEGER, + $this->_encodeLength(4), + $iterationCount ); $pbeWithMD5AndDES_CBC = "\x2a\x86\x48\x86\xf7\x0d\x01\x05\x03"; - $encryptionAlgorithm = pack('Ca*a*Ca*a*', - CRYPT_RSA_ASN1_OBJECT, $this->_encodeLength(strlen($pbeWithMD5AndDES_CBC)), $pbeWithMD5AndDES_CBC, - CRYPT_RSA_ASN1_SEQUENCE, $this->_encodeLength(strlen($parameters)), $parameters + $encryptionAlgorithm = pack( + 'Ca*a*Ca*a*', + self::ASN1_OBJECT, + $this->_encodeLength(strlen($pbeWithMD5AndDES_CBC)), + $pbeWithMD5AndDES_CBC, + self::ASN1_SEQUENCE, + $this->_encodeLength(strlen($parameters)), + $parameters ); - $RSAPrivateKey = pack('Ca*a*Ca*a*', - CRYPT_RSA_ASN1_SEQUENCE, $this->_encodeLength(strlen($encryptionAlgorithm)), $encryptionAlgorithm, - CRYPT_RSA_ASN1_OCTETSTRING, $this->_encodeLength(strlen($RSAPrivateKey)), $RSAPrivateKey + $RSAPrivateKey = pack( + 'Ca*a*Ca*a*', + self::ASN1_SEQUENCE, + $this->_encodeLength(strlen($encryptionAlgorithm)), + $encryptionAlgorithm, + self::ASN1_OCTETSTRING, + $this->_encodeLength(strlen($RSAPrivateKey)), + $RSAPrivateKey ); - $RSAPrivateKey = pack('Ca*a*', CRYPT_RSA_ASN1_SEQUENCE, $this->_encodeLength(strlen($RSAPrivateKey)), $RSAPrivateKey); + $RSAPrivateKey = pack('Ca*a*', self::ASN1_SEQUENCE, $this->_encodeLength(strlen($RSAPrivateKey)), $RSAPrivateKey); $RSAPrivateKey = "-----BEGIN ENCRYPTED PRIVATE KEY-----\r\n" . chunk_split(base64_encode($RSAPrivateKey), 64) . @@ -913,13 +909,10 @@ class Crypt_RSA } if (!empty($this->password) || is_string($this->password)) { - $iv = crypt_random_string(8); + $iv = Random::string(8); $symkey = pack('H*', md5($this->password . $iv)); // symkey is short for symmetric key $symkey.= substr(pack('H*', md5($symkey . $this->password . $iv)), 0, 8); - if (!class_exists('Crypt_TripleDES')) { - include_once 'Crypt/TripleDES.php'; - } - $des = new Crypt_TripleDES(); + $des = new TripleDES(); $des->setKey($symkey); $des->setIV($iv); $iv = strtoupper(bin2hex($iv)); @@ -943,27 +936,27 @@ class Crypt_RSA * Convert a public key to the appropriate format * * @access private - * @see setPublicKeyFormat() - * @param String $RSAPrivateKey - * @return String + * @see self::setPublicKeyFormat() + * @param string $RSAPrivateKey + * @return string */ function _convertPublicKey($n, $e) { - $signed = $this->publicKeyFormat != CRYPT_RSA_PUBLIC_FORMAT_XML; + $signed = $this->publicKeyFormat != self::PUBLIC_FORMAT_XML; $modulus = $n->toBytes($signed); $publicExponent = $e->toBytes($signed); switch ($this->publicKeyFormat) { - case CRYPT_RSA_PUBLIC_FORMAT_RAW: + case self::PUBLIC_FORMAT_RAW: return array('e' => $e->copy(), 'n' => $n->copy()); - case CRYPT_RSA_PUBLIC_FORMAT_XML: + case self::PUBLIC_FORMAT_XML: return "\r\n" . ' ' . base64_encode($modulus) . "\r\n" . ' ' . base64_encode($publicExponent) . "\r\n" . ''; break; - case CRYPT_RSA_PUBLIC_FORMAT_OPENSSH: + case self::PUBLIC_FORMAT_OPENSSH: // from : // string "ssh-rsa" // mpint e @@ -972,23 +965,26 @@ class Crypt_RSA $RSAPublicKey = 'ssh-rsa ' . base64_encode($RSAPublicKey) . ' ' . $this->comment; return $RSAPublicKey; - default: // eg. CRYPT_RSA_PUBLIC_FORMAT_PKCS1_RAW or CRYPT_RSA_PUBLIC_FORMAT_PKCS1 + default: // eg. self::PUBLIC_FORMAT_PKCS1_RAW or self::PUBLIC_FORMAT_PKCS1 // from : // RSAPublicKey ::= SEQUENCE { // modulus INTEGER, -- n // publicExponent INTEGER -- e // } $components = array( - 'modulus' => pack('Ca*a*', CRYPT_RSA_ASN1_INTEGER, $this->_encodeLength(strlen($modulus)), $modulus), - 'publicExponent' => pack('Ca*a*', CRYPT_RSA_ASN1_INTEGER, $this->_encodeLength(strlen($publicExponent)), $publicExponent) + 'modulus' => pack('Ca*a*', self::ASN1_INTEGER, $this->_encodeLength(strlen($modulus)), $modulus), + 'publicExponent' => pack('Ca*a*', self::ASN1_INTEGER, $this->_encodeLength(strlen($publicExponent)), $publicExponent) ); - $RSAPublicKey = pack('Ca*a*a*', - CRYPT_RSA_ASN1_SEQUENCE, $this->_encodeLength(strlen($components['modulus']) + strlen($components['publicExponent'])), - $components['modulus'], $components['publicExponent'] + $RSAPublicKey = pack( + 'Ca*a*a*', + self::ASN1_SEQUENCE, + $this->_encodeLength(strlen($components['modulus']) + strlen($components['publicExponent'])), + $components['modulus'], + $components['publicExponent'] ); - if ($this->publicKeyFormat == CRYPT_RSA_PUBLIC_FORMAT_PKCS1_RAW) { + if ($this->publicKeyFormat == self::PUBLIC_FORMAT_PKCS1_RAW) { $RSAPublicKey = "-----BEGIN RSA PUBLIC KEY-----\r\n" . chunk_split(base64_encode($RSAPublicKey), 64) . '-----END RSA PUBLIC KEY-----'; @@ -998,8 +994,11 @@ class Crypt_RSA $RSAPublicKey = chr(0) . $RSAPublicKey; $RSAPublicKey = chr(3) . $this->_encodeLength(strlen($RSAPublicKey)) . $RSAPublicKey; - $RSAPublicKey = pack('Ca*a*', - CRYPT_RSA_ASN1_SEQUENCE, $this->_encodeLength(strlen($rsaOID . $RSAPublicKey)), $rsaOID . $RSAPublicKey + $RSAPublicKey = pack( + 'Ca*a*', + self::ASN1_SEQUENCE, + $this->_encodeLength(strlen($rsaOID . $RSAPublicKey)), + $rsaOID . $RSAPublicKey ); $RSAPublicKey = "-----BEGIN PUBLIC KEY-----\r\n" . @@ -1015,20 +1014,20 @@ class Crypt_RSA * Break a public or private key down into its constituant components * * @access private - * @see _convertPublicKey() - * @see _convertPrivateKey() - * @param String $key - * @param Integer $type - * @return Array + * @see self::_convertPublicKey() + * @see self::_convertPrivateKey() + * @param string $key + * @param int $type + * @return array */ function _parseKey($key, $type) { - if ($type != CRYPT_RSA_PUBLIC_FORMAT_RAW && !is_string($key)) { + if ($type != self::PUBLIC_FORMAT_RAW && !is_string($key)) { return false; } switch ($type) { - case CRYPT_RSA_PUBLIC_FORMAT_RAW: + case self::PUBLIC_FORMAT_RAW: if (!is_array($key)) { return false; } @@ -1060,9 +1059,9 @@ class Crypt_RSA $components['modulus'] = $key[1]->copy(); } return isset($components['modulus']) && isset($components['publicExponent']) ? $components : false; - case CRYPT_RSA_PRIVATE_FORMAT_PKCS1: - case CRYPT_RSA_PRIVATE_FORMAT_PKCS8: - case CRYPT_RSA_PUBLIC_FORMAT_PKCS1: + case self::PRIVATE_FORMAT_PKCS1: + case self::PRIVATE_FORMAT_PKCS8: + case self::PUBLIC_FORMAT_PKCS1: /* Although PKCS#1 proposes a format that public and private keys can use, encrypting them is "outside the scope" of PKCS#1. PKCS#1 then refers you to PKCS#12 and PKCS#15 if you're wanting to protect private keys, however, that's not what OpenSSL* does. OpenSSL protects private keys by adding @@ -1090,36 +1089,21 @@ class Crypt_RSA } switch ($matches[1]) { case 'AES-256-CBC': - if (!class_exists('Crypt_AES')) { - include_once 'Crypt/AES.php'; - } - $crypto = new Crypt_AES(); + $crypto = new AES(); break; case 'AES-128-CBC': - if (!class_exists('Crypt_AES')) { - include_once 'Crypt/AES.php'; - } $symkey = substr($symkey, 0, 16); - $crypto = new Crypt_AES(); + $crypto = new AES(); break; case 'DES-EDE3-CFB': - if (!class_exists('Crypt_TripleDES')) { - include_once 'Crypt/TripleDES.php'; - } - $crypto = new Crypt_TripleDES(CRYPT_DES_MODE_CFB); + $crypto = new TripleDES(Base::MODE_CFB); break; case 'DES-EDE3-CBC': - if (!class_exists('Crypt_TripleDES')) { - include_once 'Crypt/TripleDES.php'; - } $symkey = substr($symkey, 0, 24); - $crypto = new Crypt_TripleDES(); + $crypto = new TripleDES(); break; case 'DES-CBC': - if (!class_exists('Crypt_DES')) { - include_once 'Crypt/DES.php'; - } - $crypto = new Crypt_DES(); + $crypto = new DES(); break; default: return false; @@ -1137,7 +1121,7 @@ class Crypt_RSA $components = array(); - if (ord($this->_string_shift($key)) != CRYPT_RSA_ASN1_SEQUENCE) { + if (ord($this->_string_shift($key)) != self::ASN1_SEQUENCE) { return false; } if ($this->_decodeLength($key) != strlen($key)) { @@ -1156,14 +1140,14 @@ class Crypt_RSA ie. PKCS8 keys*/ - if ($tag == CRYPT_RSA_ASN1_INTEGER && substr($key, 0, 3) == "\x01\x00\x30") { + if ($tag == self::ASN1_INTEGER && substr($key, 0, 3) == "\x01\x00\x30") { $this->_string_shift($key, 3); - $tag = CRYPT_RSA_ASN1_SEQUENCE; + $tag = self::ASN1_SEQUENCE; } - if ($tag == CRYPT_RSA_ASN1_SEQUENCE) { + if ($tag == self::ASN1_SEQUENCE) { $temp = $this->_string_shift($key, $this->_decodeLength($key)); - if (ord($this->_string_shift($temp)) != CRYPT_RSA_ASN1_OBJECT) { + if (ord($this->_string_shift($temp)) != self::ASN1_OBJECT) { return false; } $length = $this->_decodeLength($temp); @@ -1176,7 +1160,7 @@ class Crypt_RSA salt OCTET STRING (SIZE(8)), iterationCount INTEGER } */ - if (ord($this->_string_shift($temp)) != CRYPT_RSA_ASN1_SEQUENCE) { + if (ord($this->_string_shift($temp)) != self::ASN1_SEQUENCE) { return false; } if ($this->_decodeLength($temp) != strlen($temp)) { @@ -1184,7 +1168,7 @@ class Crypt_RSA } $this->_string_shift($temp); // assume it's an octet string $salt = $this->_string_shift($temp, $this->_decodeLength($temp)); - if (ord($this->_string_shift($temp)) != CRYPT_RSA_ASN1_INTEGER) { + if (ord($this->_string_shift($temp)) != self::ASN1_INTEGER) { return false; } $this->_decodeLength($temp); @@ -1195,16 +1179,13 @@ class Crypt_RSA return false; } - if (!class_exists('Crypt_DES')) { - include_once 'Crypt/DES.php'; - } - $crypto = new Crypt_DES(); + $crypto = new DES(); $crypto->setPassword($this->password, 'pbkdf1', 'md5', $salt, $iterationCount); $key = $crypto->decrypt($key); if ($key === false) { return false; } - return $this->_parseKey($key, CRYPT_RSA_PRIVATE_FORMAT_PKCS1); + return $this->_parseKey($key, self::PRIVATE_FORMAT_PKCS1); default: return false; } @@ -1220,10 +1201,10 @@ class Crypt_RSA // "The initial octet shall encode, as an unsigned binary integer wtih bit 1 as the least significant bit, the number of // unused bits in the final subsequent octet. The number shall be in the range zero to seven." // -- http://www.itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf (section 8.6.2.2) - if ($tag == CRYPT_RSA_ASN1_BITSTRING) { + if ($tag == self::ASN1_BITSTRING) { $this->_string_shift($key); } - if (ord($this->_string_shift($key)) != CRYPT_RSA_ASN1_SEQUENCE) { + if (ord($this->_string_shift($key)) != self::ASN1_SEQUENCE) { return false; } if ($this->_decodeLength($key) != strlen($key)) { @@ -1231,71 +1212,71 @@ class Crypt_RSA } $tag = ord($this->_string_shift($key)); } - if ($tag != CRYPT_RSA_ASN1_INTEGER) { + if ($tag != self::ASN1_INTEGER) { return false; } $length = $this->_decodeLength($key); $temp = $this->_string_shift($key, $length); if (strlen($temp) != 1 || ord($temp) > 2) { - $components['modulus'] = new Math_BigInteger($temp, 256); - $this->_string_shift($key); // skip over CRYPT_RSA_ASN1_INTEGER + $components['modulus'] = new BigInteger($temp, 256); + $this->_string_shift($key); // skip over self::ASN1_INTEGER $length = $this->_decodeLength($key); - $components[$type == CRYPT_RSA_PUBLIC_FORMAT_PKCS1 ? 'publicExponent' : 'privateExponent'] = new Math_BigInteger($this->_string_shift($key, $length), 256); + $components[$type == self::PUBLIC_FORMAT_PKCS1 ? 'publicExponent' : 'privateExponent'] = new BigInteger($this->_string_shift($key, $length), 256); return $components; } - if (ord($this->_string_shift($key)) != CRYPT_RSA_ASN1_INTEGER) { + if (ord($this->_string_shift($key)) != self::ASN1_INTEGER) { return false; } $length = $this->_decodeLength($key); - $components['modulus'] = new Math_BigInteger($this->_string_shift($key, $length), 256); + $components['modulus'] = new BigInteger($this->_string_shift($key, $length), 256); $this->_string_shift($key); $length = $this->_decodeLength($key); - $components['publicExponent'] = new Math_BigInteger($this->_string_shift($key, $length), 256); + $components['publicExponent'] = new BigInteger($this->_string_shift($key, $length), 256); $this->_string_shift($key); $length = $this->_decodeLength($key); - $components['privateExponent'] = new Math_BigInteger($this->_string_shift($key, $length), 256); + $components['privateExponent'] = new BigInteger($this->_string_shift($key, $length), 256); $this->_string_shift($key); $length = $this->_decodeLength($key); - $components['primes'] = array(1 => new Math_BigInteger($this->_string_shift($key, $length), 256)); + $components['primes'] = array(1 => new BigInteger($this->_string_shift($key, $length), 256)); $this->_string_shift($key); $length = $this->_decodeLength($key); - $components['primes'][] = new Math_BigInteger($this->_string_shift($key, $length), 256); + $components['primes'][] = new BigInteger($this->_string_shift($key, $length), 256); $this->_string_shift($key); $length = $this->_decodeLength($key); - $components['exponents'] = array(1 => new Math_BigInteger($this->_string_shift($key, $length), 256)); + $components['exponents'] = array(1 => new BigInteger($this->_string_shift($key, $length), 256)); $this->_string_shift($key); $length = $this->_decodeLength($key); - $components['exponents'][] = new Math_BigInteger($this->_string_shift($key, $length), 256); + $components['exponents'][] = new BigInteger($this->_string_shift($key, $length), 256); $this->_string_shift($key); $length = $this->_decodeLength($key); - $components['coefficients'] = array(2 => new Math_BigInteger($this->_string_shift($key, $length), 256)); + $components['coefficients'] = array(2 => new BigInteger($this->_string_shift($key, $length), 256)); if (!empty($key)) { - if (ord($this->_string_shift($key)) != CRYPT_RSA_ASN1_SEQUENCE) { + if (ord($this->_string_shift($key)) != self::ASN1_SEQUENCE) { return false; } $this->_decodeLength($key); while (!empty($key)) { - if (ord($this->_string_shift($key)) != CRYPT_RSA_ASN1_SEQUENCE) { + if (ord($this->_string_shift($key)) != self::ASN1_SEQUENCE) { return false; } $this->_decodeLength($key); $key = substr($key, 1); $length = $this->_decodeLength($key); - $components['primes'][] = new Math_BigInteger($this->_string_shift($key, $length), 256); + $components['primes'][] = new BigInteger($this->_string_shift($key, $length), 256); $this->_string_shift($key); $length = $this->_decodeLength($key); - $components['exponents'][] = new Math_BigInteger($this->_string_shift($key, $length), 256); + $components['exponents'][] = new BigInteger($this->_string_shift($key, $length), 256); $this->_string_shift($key); $length = $this->_decodeLength($key); - $components['coefficients'][] = new Math_BigInteger($this->_string_shift($key, $length), 256); + $components['coefficients'][] = new BigInteger($this->_string_shift($key, $length), 256); } } return $components; - case CRYPT_RSA_PUBLIC_FORMAT_OPENSSH: + case self::PUBLIC_FORMAT_OPENSSH: $parts = explode(' ', $key, 3); $key = isset($parts[1]) ? base64_decode($parts[1]) : false; @@ -1311,19 +1292,19 @@ class Crypt_RSA return false; } extract(unpack('Nlength', $this->_string_shift($key, 4))); - $publicExponent = new Math_BigInteger($this->_string_shift($key, $length), -256); + $publicExponent = new BigInteger($this->_string_shift($key, $length), -256); if (strlen($key) <= 4) { return false; } extract(unpack('Nlength', $this->_string_shift($key, 4))); - $modulus = new Math_BigInteger($this->_string_shift($key, $length), -256); + $modulus = new BigInteger($this->_string_shift($key, $length), -256); if ($cleanup && strlen($key)) { if (strlen($key) <= 4) { return false; } extract(unpack('Nlength', $this->_string_shift($key, 4))); - $realModulus = new Math_BigInteger($this->_string_shift($key, $length), -256); + $realModulus = new BigInteger($this->_string_shift($key, $length), -256); return strlen($key) ? false : array( 'modulus' => $realModulus, 'publicExponent' => $modulus, @@ -1338,8 +1319,8 @@ class Crypt_RSA } // http://www.w3.org/TR/xmldsig-core/#sec-RSAKeyValue // http://en.wikipedia.org/wiki/XML_Signature - case CRYPT_RSA_PRIVATE_FORMAT_XML: - case CRYPT_RSA_PUBLIC_FORMAT_XML: + case self::PRIVATE_FORMAT_XML: + case self::PUBLIC_FORMAT_XML: $this->components = array(); $xml = xml_parser_create('UTF-8'); @@ -1353,7 +1334,7 @@ class Crypt_RSA return isset($this->components['modulus']) && isset($this->components['publicExponent']) ? $this->components : false; // from PuTTY's SSHPUBK.C - case CRYPT_RSA_PRIVATE_FORMAT_PUTTY: + case self::PRIVATE_FORMAT_PUTTY: $components = array(); $key = preg_split('#\r\n|\r|\n#', $key); $type = trim(preg_replace('#PuTTY-User-Key-File-2: (.+)#', '$1', $key[0])); @@ -1367,18 +1348,15 @@ class Crypt_RSA $public = base64_decode(implode('', array_map('trim', array_slice($key, 4, $publicLength)))); $public = substr($public, 11); extract(unpack('Nlength', $this->_string_shift($public, 4))); - $components['publicExponent'] = new Math_BigInteger($this->_string_shift($public, $length), -256); + $components['publicExponent'] = new BigInteger($this->_string_shift($public, $length), -256); extract(unpack('Nlength', $this->_string_shift($public, 4))); - $components['modulus'] = new Math_BigInteger($this->_string_shift($public, $length), -256); + $components['modulus'] = new BigInteger($this->_string_shift($public, $length), -256); $privateLength = trim(preg_replace('#Private-Lines: (\d+)#', '$1', $key[$publicLength + 4])); $private = base64_decode(implode('', array_map('trim', array_slice($key, $publicLength + 5, $privateLength)))); switch ($encryption) { case 'aes256-cbc': - if (!class_exists('Crypt_AES')) { - include_once 'Crypt/AES.php'; - } $symkey = ''; $sequence = 0; while (strlen($symkey) < 32) { @@ -1386,7 +1364,7 @@ class Crypt_RSA $symkey.= pack('H*', sha1($temp)); } $symkey = substr($symkey, 0, 32); - $crypto = new Crypt_AES(); + $crypto = new AES(); } if ($encryption != 'none') { @@ -1402,17 +1380,17 @@ class Crypt_RSA if (strlen($private) < $length) { return false; } - $components['privateExponent'] = new Math_BigInteger($this->_string_shift($private, $length), -256); + $components['privateExponent'] = new BigInteger($this->_string_shift($private, $length), -256); extract(unpack('Nlength', $this->_string_shift($private, 4))); if (strlen($private) < $length) { return false; } - $components['primes'] = array(1 => new Math_BigInteger($this->_string_shift($private, $length), -256)); + $components['primes'] = array(1 => new BigInteger($this->_string_shift($private, $length), -256)); extract(unpack('Nlength', $this->_string_shift($private, 4))); if (strlen($private) < $length) { return false; } - $components['primes'][] = new Math_BigInteger($this->_string_shift($private, $length), -256); + $components['primes'][] = new BigInteger($this->_string_shift($private, $length), -256); $temp = $components['primes'][1]->subtract($this->one); $components['exponents'] = array(1 => $components['publicExponent']->modInverse($temp)); @@ -1423,7 +1401,7 @@ class Crypt_RSA if (strlen($private) < $length) { return false; } - $components['coefficients'] = array(2 => new Math_BigInteger($this->_string_shift($private, $length), -256)); + $components['coefficients'] = array(2 => new BigInteger($this->_string_shift($private, $length), -256)); return $components; } @@ -1435,7 +1413,7 @@ class Crypt_RSA * More specifically, this returns the size of the modulo in bits. * * @access public - * @return Integer + * @return int */ function getSize() { @@ -1448,9 +1426,9 @@ class Crypt_RSA * Called by xml_set_element_handler() * * @access private - * @param Resource $parser - * @param String $name - * @param Array $attribs + * @param resource $parser + * @param string $name + * @param array $attribs */ function _start_element_handler($parser, $name, $attribs) { @@ -1489,13 +1467,13 @@ class Crypt_RSA * Called by xml_set_element_handler() * * @access private - * @param Resource $parser - * @param String $name + * @param resource $parser + * @param string $name */ function _stop_element_handler($parser, $name) { if (isset($this->current)) { - $this->current = new Math_BigInteger(base64_decode($this->current), 256); + $this->current = new BigInteger(base64_decode($this->current), 256); unset($this->current); } } @@ -1506,8 +1484,8 @@ class Crypt_RSA * Called by xml_set_character_data_handler() * * @access private - * @param Resource $parser - * @param String $data + * @param resource $parser + * @param string $data */ function _data_handler($parser, $data) { @@ -1523,12 +1501,12 @@ class Crypt_RSA * Returns true on success and false on failure (ie. an incorrect password was provided or the key was malformed) * * @access public - * @param String $key - * @param Integer $type optional + * @param string $key + * @param int $type optional */ function loadKey($key, $type = false) { - if (is_object($key) && strtolower(get_class($key)) == 'crypt_rsa') { + if ($key instanceof RSA) { $this->privateKeyFormat = $key->privateKeyFormat; $this->publicKeyFormat = $key->publicKeyFormat; $this->k = $key->k; @@ -1542,10 +1520,10 @@ class Crypt_RSA $this->comment = $key->comment; if (is_object($key->hash)) { - $this->hash = new Crypt_Hash($key->hash->getHash()); + $this->hash = new Hash($key->hash->getHash()); } if (is_object($key->mgfHash)) { - $this->mgfHash = new Crypt_Hash($key->mgfHash->getHash()); + $this->mgfHash = new Hash($key->mgfHash->getHash()); } if (is_object($key->modulus)) { @@ -1577,11 +1555,11 @@ class Crypt_RSA if ($type === false) { $types = array( - CRYPT_RSA_PUBLIC_FORMAT_RAW, - CRYPT_RSA_PRIVATE_FORMAT_PKCS1, - CRYPT_RSA_PRIVATE_FORMAT_XML, - CRYPT_RSA_PRIVATE_FORMAT_PUTTY, - CRYPT_RSA_PUBLIC_FORMAT_OPENSSH + self::PUBLIC_FORMAT_RAW, + self::PRIVATE_FORMAT_PKCS1, + self::PRIVATE_FORMAT_XML, + self::PRIVATE_FORMAT_PUTTY, + self::PUBLIC_FORMAT_OPENSSH ); foreach ($types as $type) { $components = $this->_parseKey($key, $type); @@ -1589,7 +1567,6 @@ class Crypt_RSA break; } } - } else { $components = $this->_parseKey($key, $type); } @@ -1617,11 +1594,11 @@ class Crypt_RSA } switch ($type) { - case CRYPT_RSA_PUBLIC_FORMAT_OPENSSH: - case CRYPT_RSA_PUBLIC_FORMAT_RAW: + case self::PUBLIC_FORMAT_OPENSSH: + case self::PUBLIC_FORMAT_RAW: $this->setPublicKey(); break; - case CRYPT_RSA_PRIVATE_FORMAT_PKCS1: + case self::PRIVATE_FORMAT_PKCS1: switch (true) { case strpos($key, '-BEGIN PUBLIC KEY-') !== false: case strpos($key, '-BEGIN RSA PUBLIC KEY-') !== false: @@ -1638,10 +1615,10 @@ class Crypt_RSA * Private keys can be encrypted with a password. To unset the password, pass in the empty string or false. * Or rather, pass in $password such that empty($password) && !is_string($password) is true. * - * @see createKey() - * @see loadKey() + * @see self::createKey() + * @see self::loadKey() * @access public - * @param String $password + * @param string $password */ function setPassword($password = false) { @@ -1663,11 +1640,11 @@ class Crypt_RSA * * Returns true on success, false on failure * - * @see getPublicKey() + * @see self::getPublicKey() * @access public - * @param String $key optional - * @param Integer $type optional - * @return Boolean + * @param string $key optional + * @param int $type optional + * @return bool */ function setPublicKey($key = false, $type = false) { @@ -1683,10 +1660,10 @@ class Crypt_RSA if ($type === false) { $types = array( - CRYPT_RSA_PUBLIC_FORMAT_RAW, - CRYPT_RSA_PUBLIC_FORMAT_PKCS1, - CRYPT_RSA_PUBLIC_FORMAT_XML, - CRYPT_RSA_PUBLIC_FORMAT_OPENSSH + self::PUBLIC_FORMAT_RAW, + self::PUBLIC_FORMAT_PKCS1, + self::PUBLIC_FORMAT_XML, + self::PUBLIC_FORMAT_OPENSSH ); foreach ($types as $type) { $components = $this->_parseKey($key, $type); @@ -1723,24 +1700,24 @@ class Crypt_RSA * * Returns true on success, false on failure * - * @see getPublicKey() + * @see self::getPublicKey() * @access public - * @param String $key optional - * @param Integer $type optional - * @return Boolean + * @param string $key optional + * @param int $type optional + * @return bool */ function setPrivateKey($key = false, $type = false) { if ($key === false && !empty($this->publicExponent)) { - unset($this->publicExponent); + $this->publicExponent = false; return true; } - $rsa = new Crypt_RSA(); + $rsa = new RSA(); if (!$rsa->loadKey($key, $type)) { return false; } - unset($rsa->publicExponent); + $rsa->publicExponent = false; // don't overwrite the old key if the new key is invalid $this->loadKey($rsa); @@ -1754,12 +1731,12 @@ class Crypt_RSA * or if the public key was set via setPublicKey(). If the currently loaded key is supposed to be the public key this * function won't return it since this library, for the most part, doesn't distinguish between public and private keys. * - * @see getPublicKey() + * @see self::getPublicKey() * @access public - * @param String $key - * @param Integer $type optional + * @param string $key + * @param int $type optional */ - function getPublicKey($type = CRYPT_RSA_PUBLIC_FORMAT_PKCS8) + function getPublicKey($type = self::PUBLIC_FORMAT_PKCS8) { if (empty($this->modulus) || empty($this->publicExponent)) { return false; @@ -1772,17 +1749,53 @@ class Crypt_RSA return $temp; } + /** + * Returns the public key's fingerprint + * + * The public key's fingerprint is returned, which is equivalent to running `ssh-keygen -lf rsa.pub`. If there is + * no public key currently loaded, false is returned. + * Example output (md5): "c1:b1:30:29:d7:b8:de:6c:97:77:10:d7:46:41:63:87" (as specified by RFC 4716) + * + * @access public + * @param string $algorithm The hashing algorithm to be used. Valid options are 'md5' and 'sha256'. False is returned + * for invalid values. + * @return mixed + */ + function getPublicKeyFingerprint($algorithm = 'md5') + { + if (empty($this->modulus) || empty($this->publicExponent)) { + return false; + } + + $modulus = $this->modulus->toBytes(true); + $publicExponent = $this->publicExponent->toBytes(true); + + $RSAPublicKey = pack('Na*Na*Na*', strlen('ssh-rsa'), 'ssh-rsa', strlen($publicExponent), $publicExponent, strlen($modulus), $modulus); + + switch ($algorithm) { + case 'sha256': + $hash = new Hash('sha256'); + $base = base64_encode($hash->hash($RSAPublicKey)); + return substr($base, 0, strlen($base) - 1); + case 'md5': + return substr(chunk_split(md5($RSAPublicKey), 2, ':'), 0, -1); + default: + return false; + } + } + /** * Returns the private key * * The private key is only returned if the currently loaded key contains the constituent prime numbers. * - * @see getPublicKey() + * @see self::getPublicKey() * @access public - * @param String $key - * @param Integer $type optional + * @param string $key + * @param int $type optional + * @return mixed */ - function getPrivateKey($type = CRYPT_RSA_PUBLIC_FORMAT_PKCS1) + function getPrivateKey($type = self::PUBLIC_FORMAT_PKCS1) { if (empty($this->primes)) { return false; @@ -1801,12 +1814,12 @@ class Crypt_RSA * Returns the private key without the prime number constituants. Structurally identical to a public key that * hasn't been set as the public key * - * @see getPrivateKey() + * @see self::getPrivateKey() * @access private - * @param String $key - * @param Integer $type optional + * @param string $key + * @param int $type optional */ - function _getPrivatePublicKey($mode = CRYPT_RSA_PUBLIC_FORMAT_PKCS8) + function _getPrivatePublicKey($mode = self::PUBLIC_FORMAT_PKCS8) { if (empty($this->modulus) || empty($this->exponent)) { return false; @@ -1823,6 +1836,7 @@ class Crypt_RSA * __toString() magic method * * @access public + * @return string */ function __toString() { @@ -1838,10 +1852,11 @@ class Crypt_RSA * __clone() magic method * * @access public + * @return Crypt_RSA */ function __clone() { - $key = new Crypt_RSA(); + $key = new RSA(); $key->loadKey($this); return $key; } @@ -1850,8 +1865,8 @@ class Crypt_RSA * Generates the smallest and largest numbers requiring $bits bits * * @access private - * @param Integer $bits - * @return Array + * @param int $bits + * @return array */ function _generateMinMax($bits) { @@ -1867,8 +1882,8 @@ class Crypt_RSA } return array( - 'min' => new Math_BigInteger($min, 256), - 'max' => new Math_BigInteger($max, 256) + 'min' => new BigInteger($min, 256), + 'max' => new BigInteger($max, 256) ); } @@ -1879,13 +1894,13 @@ class Crypt_RSA * {@link http://itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf#p=13 X.690 paragraph 8.1.3} for more information. * * @access private - * @param String $string - * @return Integer + * @param string $string + * @return int */ function _decodeLength(&$string) { $length = ord($this->_string_shift($string)); - if ( $length & 0x80 ) { // definite length, long form + if ($length & 0x80) { // definite length, long form $length&= 0x7F; $temp = $this->_string_shift($string, $length); list(, $length) = unpack('N', substr(str_pad($temp, 4, chr(0), STR_PAD_LEFT), -4)); @@ -1900,8 +1915,8 @@ class Crypt_RSA * {@link http://itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf#p=13 X.690 paragraph 8.1.3} for more information. * * @access private - * @param Integer $length - * @return String + * @param int $length + * @return string */ function _encodeLength($length) { @@ -1918,9 +1933,9 @@ class Crypt_RSA * * Inspired by array_shift * - * @param String $string - * @param optional Integer $index - * @return String + * @param string $string + * @param int $index + * @return string * @access private */ function _string_shift(&$string, $index = 1) @@ -1933,9 +1948,9 @@ class Crypt_RSA /** * Determines the private key format * - * @see createKey() + * @see self::createKey() * @access public - * @param Integer $format + * @param int $format */ function setPrivateKeyFormat($format) { @@ -1945,9 +1960,9 @@ class Crypt_RSA /** * Determines the public key format * - * @see createKey() + * @see self::createKey() * @access public - * @param Integer $format + * @param int $format */ function setPublicKeyFormat($format) { @@ -1957,15 +1972,15 @@ class Crypt_RSA /** * Determines which hashing function should be used * - * Used with signature production / verification and (if the encryption mode is CRYPT_RSA_ENCRYPTION_OAEP) encryption and + * Used with signature production / verification and (if the encryption mode is self::ENCRYPTION_OAEP) encryption and * decryption. If $hash isn't supported, sha1 is used. * * @access public - * @param String $hash + * @param string $hash */ function setHash($hash) { - // Crypt_Hash supports algorithms that PKCS#1 doesn't support. md5-96 and sha1-96, for example. + // \phpseclib\Crypt\Hash supports algorithms that PKCS#1 doesn't support. md5-96 and sha1-96, for example. switch ($hash) { case 'md2': case 'md5': @@ -1973,11 +1988,11 @@ class Crypt_RSA case 'sha256': case 'sha384': case 'sha512': - $this->hash = new Crypt_Hash($hash); + $this->hash = new Hash($hash); $this->hashName = $hash; break; default: - $this->hash = new Crypt_Hash('sha1'); + $this->hash = new Hash('sha1'); $this->hashName = 'sha1'; } $this->hLen = $this->hash->getLength(); @@ -1986,15 +2001,15 @@ class Crypt_RSA /** * Determines which hashing function should be used for the mask generation function * - * The mask generation function is used by CRYPT_RSA_ENCRYPTION_OAEP and CRYPT_RSA_SIGNATURE_PSS and although it's + * The mask generation function is used by self::ENCRYPTION_OAEP and self::SIGNATURE_PSS and although it's * best if Hash and MGFHash are set to the same thing this is not a requirement. * * @access public - * @param String $hash + * @param string $hash */ function setMGFHash($hash) { - // Crypt_Hash supports algorithms that PKCS#1 doesn't support. md5-96 and sha1-96, for example. + // \phpseclib\Crypt\Hash supports algorithms that PKCS#1 doesn't support. md5-96 and sha1-96, for example. switch ($hash) { case 'md2': case 'md5': @@ -2002,10 +2017,10 @@ class Crypt_RSA case 'sha256': case 'sha384': case 'sha512': - $this->mgfHash = new Crypt_Hash($hash); + $this->mgfHash = new Hash($hash); break; default: - $this->mgfHash = new Crypt_Hash('sha1'); + $this->mgfHash = new Hash('sha1'); } $this->mgfHLen = $this->mgfHash->getLength(); } @@ -2019,7 +2034,7 @@ class Crypt_RSA * of the hash function Hash) and 0. * * @access public - * @param Integer $format + * @param int $format */ function setSaltLength($sLen) { @@ -2032,9 +2047,9 @@ class Crypt_RSA * See {@link http://tools.ietf.org/html/rfc3447#section-4.1 RFC3447#section-4.1}. * * @access private - * @param Math_BigInteger $x - * @param Integer $xLen - * @return String + * @param \phpseclib\Math\BigInteger $x + * @param int $xLen + * @return string */ function _i2osp($x, $xLen) { @@ -2052,12 +2067,12 @@ class Crypt_RSA * See {@link http://tools.ietf.org/html/rfc3447#section-4.2 RFC3447#section-4.2}. * * @access private - * @param String $x - * @return Math_BigInteger + * @param string $x + * @return \phpseclib\Math\BigInteger */ function _os2ip($x) { - return new Math_BigInteger($x, 256); + return new BigInteger($x, 256); } /** @@ -2066,13 +2081,19 @@ class Crypt_RSA * See {@link http://tools.ietf.org/html/rfc3447#section-5.1.1 RFC3447#section-5.1.2}. * * @access private - * @param Math_BigInteger $x - * @return Math_BigInteger + * @param \phpseclib\Math\BigInteger $x + * @return \phpseclib\Math\BigInteger */ function _exponentiate($x) { - if (empty($this->primes) || empty($this->coefficients) || empty($this->exponents)) { - return $x->modPow($this->exponent, $this->modulus); + switch (true) { + case empty($this->primes): + case $this->primes[1]->equals($this->zero): + case empty($this->coefficients): + case $this->coefficients[2]->equals($this->zero): + case empty($this->exponents): + case $this->exponents[1]->equals($this->zero): + return $x->modPow($this->exponent, $this->modulus); } $num_primes = count($this->primes); @@ -2107,7 +2128,7 @@ class Crypt_RSA } } - $one = new Math_BigInteger(1); + $one = new BigInteger(1); $r = $one->random($one, $smallest->subtract($one)); @@ -2144,10 +2165,10 @@ class Crypt_RSA * Returns $x->modPow($this->exponents[$i], $this->primes[$i]) * * @access private - * @param Math_BigInteger $x - * @param Math_BigInteger $r - * @param Integer $i - * @return Math_BigInteger + * @param \phpseclib\Math\BigInteger $x + * @param \phpseclib\Math\BigInteger $r + * @param int $i + * @return \phpseclib\Math\BigInteger */ function _blind($x, $r, $i) { @@ -2171,9 +2192,9 @@ class Crypt_RSA * Thanks for the heads up singpolyma! * * @access private - * @param String $x - * @param String $y - * @return Boolean + * @param string $x + * @param string $y + * @return bool */ function _equals($x, $y) { @@ -2195,8 +2216,8 @@ class Crypt_RSA * See {@link http://tools.ietf.org/html/rfc3447#section-5.1.1 RFC3447#section-5.1.1}. * * @access private - * @param Math_BigInteger $m - * @return Math_BigInteger + * @param \phpseclib\Math\BigInteger $m + * @return \phpseclib\Math\BigInteger */ function _rsaep($m) { @@ -2213,8 +2234,8 @@ class Crypt_RSA * See {@link http://tools.ietf.org/html/rfc3447#section-5.1.2 RFC3447#section-5.1.2}. * * @access private - * @param Math_BigInteger $c - * @return Math_BigInteger + * @param \phpseclib\Math\BigInteger $c + * @return \phpseclib\Math\BigInteger */ function _rsadp($c) { @@ -2231,8 +2252,8 @@ class Crypt_RSA * See {@link http://tools.ietf.org/html/rfc3447#section-5.2.1 RFC3447#section-5.2.1}. * * @access private - * @param Math_BigInteger $m - * @return Math_BigInteger + * @param \phpseclib\Math\BigInteger $m + * @return \phpseclib\Math\BigInteger */ function _rsasp1($m) { @@ -2249,8 +2270,8 @@ class Crypt_RSA * See {@link http://tools.ietf.org/html/rfc3447#section-5.2.2 RFC3447#section-5.2.2}. * * @access private - * @param Math_BigInteger $s - * @return Math_BigInteger + * @param \phpseclib\Math\BigInteger $s + * @return \phpseclib\Math\BigInteger */ function _rsavp1($s) { @@ -2267,9 +2288,9 @@ class Crypt_RSA * See {@link http://tools.ietf.org/html/rfc3447#appendix-B.2.1 RFC3447#appendix-B.2.1}. * * @access private - * @param String $mgfSeed - * @param Integer $mgfLen - * @return String + * @param string $mgfSeed + * @param int $mgfLen + * @return string */ function _mgf1($mgfSeed, $maskLen) { @@ -2292,9 +2313,9 @@ class Crypt_RSA * {http://en.wikipedia.org/wiki/Optimal_Asymmetric_Encryption_Padding OAES}. * * @access private - * @param String $m - * @param String $l - * @return String + * @param string $m + * @param string $l + * @return string */ function _rsaes_oaep_encrypt($m, $l = '') { @@ -2315,7 +2336,7 @@ class Crypt_RSA $lHash = $this->hash->hash($l); $ps = str_repeat(chr(0), $this->k - $mLen - 2 * $this->hLen - 2); $db = $lHash . $ps . chr(1) . $m; - $seed = crypt_random_string($this->hLen); + $seed = Random::string($this->hLen); $dbMask = $this->_mgf1($seed, $this->k - $this->hLen - 1); $maskedDB = $db ^ $dbMask; $seedMask = $this->_mgf1($maskedDB, $this->hLen); @@ -2355,9 +2376,9 @@ class Crypt_RSA * this document. * * @access private - * @param String $c - * @param String $l - * @return String + * @param string $c + * @param string $l + * @return string */ function _rsaes_oaep_decrypt($c, $l = '') { @@ -2408,14 +2429,30 @@ class Crypt_RSA return substr($m, 1); } + /** + * Raw Encryption / Decryption + * + * Doesn't use padding and is not recommended. + * + * @access private + * @param string $m + * @return string + */ + function _raw_encrypt($m) + { + $temp = $this->_os2ip($m); + $temp = $this->_rsaep($temp); + return $this->_i2osp($temp, $this->k); + } + /** * RSAES-PKCS1-V1_5-ENCRYPT * * See {@link http://tools.ietf.org/html/rfc3447#section-7.2.1 RFC3447#section-7.2.1}. * * @access private - * @param String $m - * @return String + * @param string $m + * @return string */ function _rsaes_pkcs1_v1_5_encrypt($m) { @@ -2433,7 +2470,7 @@ class Crypt_RSA $psLen = $this->k - $mLen - 3; $ps = ''; while (strlen($ps) != $psLen) { - $temp = crypt_random_string($psLen - strlen($ps)); + $temp = Random::string($psLen - strlen($ps)); $temp = str_replace("\x00", '', $temp); $ps.= $temp; } @@ -2468,13 +2505,13 @@ class Crypt_RSA * to be 2 regardless of which key is used. For compatibility purposes, we'll just check to make sure the * second byte is 2 or less. If it is, we'll accept the decrypted string as valid. * - * As a consequence of this, a private key encrypted ciphertext produced with Crypt_RSA may not decrypt + * As a consequence of this, a private key encrypted ciphertext produced with \phpseclib\Crypt\RSA may not decrypt * with a strictly PKCS#1 v1.5 compliant RSA implementation. Public key encrypted ciphertext's should but * not private key encrypted ciphertext's. * * @access private - * @param String $c - * @return String + * @param string $c + * @return string */ function _rsaes_pkcs1_v1_5_decrypt($c) { @@ -2522,8 +2559,8 @@ class Crypt_RSA * See {@link http://tools.ietf.org/html/rfc3447#section-9.1.1 RFC3447#section-9.1.1}. * * @access private - * @param String $m - * @param Integer $emBits + * @param string $m + * @param int $emBits */ function _emsa_pss_encode($m, $emBits) { @@ -2531,7 +2568,7 @@ class Crypt_RSA // be output. $emLen = ($emBits + 1) >> 3; // ie. ceil($emBits / 8) - $sLen = $this->sLen == false ? $this->hLen : $this->sLen; + $sLen = $this->sLen !== null ? $this->sLen : $this->hLen; $mHash = $this->hash->hash($m); if ($emLen < $this->hLen + $sLen + 2) { @@ -2539,7 +2576,7 @@ class Crypt_RSA return false; } - $salt = crypt_random_string($sLen); + $salt = Random::string($sLen); $m2 = "\0\0\0\0\0\0\0\0" . $mHash . $salt; $h = $this->hash->hash($m2); $ps = str_repeat(chr(0), $emLen - $sLen - $this->hLen - 2); @@ -2558,10 +2595,10 @@ class Crypt_RSA * See {@link http://tools.ietf.org/html/rfc3447#section-9.1.2 RFC3447#section-9.1.2}. * * @access private - * @param String $m - * @param String $em - * @param Integer $emBits - * @return String + * @param string $m + * @param string $em + * @param int $emBits + * @return string */ function _emsa_pss_verify($m, $em, $emBits) { @@ -2569,7 +2606,7 @@ class Crypt_RSA // be output. $emLen = ($emBits + 1) >> 3; // ie. ceil($emBits / 8); - $sLen = $this->sLen == false ? $this->hLen : $this->sLen; + $sLen = $this->sLen !== null ? $this->sLen : $this->hLen; $mHash = $this->hash->hash($m); if ($emLen < $this->hLen + $sLen + 2) { @@ -2605,8 +2642,8 @@ class Crypt_RSA * See {@link http://tools.ietf.org/html/rfc3447#section-8.1.1 RFC3447#section-8.1.1}. * * @access private - * @param String $m - * @return String + * @param string $m + * @return string */ function _rsassa_pss_sign($m) { @@ -2631,9 +2668,9 @@ class Crypt_RSA * See {@link http://tools.ietf.org/html/rfc3447#section-8.1.2 RFC3447#section-8.1.2}. * * @access private - * @param String $m - * @param String $s - * @return String + * @param string $m + * @param string $s + * @return string */ function _rsassa_pss_verify($m, $s) { @@ -2671,9 +2708,9 @@ class Crypt_RSA * See {@link http://tools.ietf.org/html/rfc3447#section-9.2 RFC3447#section-9.2}. * * @access private - * @param String $m - * @param Integer $emLen - * @return String + * @param string $m + * @param int $emLen + * @return string */ function _emsa_pkcs1_v1_5_encode($m, $emLen) { @@ -2723,8 +2760,8 @@ class Crypt_RSA * See {@link http://tools.ietf.org/html/rfc3447#section-8.2.1 RFC3447#section-8.2.1}. * * @access private - * @param String $m - * @return String + * @param string $m + * @return string */ function _rsassa_pkcs1_v1_5_sign($m) { @@ -2753,8 +2790,8 @@ class Crypt_RSA * See {@link http://tools.ietf.org/html/rfc3447#section-8.2.2 RFC3447#section-8.2.2}. * * @access private - * @param String $m - * @return String + * @param string $m + * @return string */ function _rsassa_pkcs1_v1_5_verify($m, $s) { @@ -2794,10 +2831,10 @@ class Crypt_RSA /** * Set Encryption Mode * - * Valid values include CRYPT_RSA_ENCRYPTION_OAEP and CRYPT_RSA_ENCRYPTION_PKCS1. + * Valid values include self::ENCRYPTION_OAEP and self::ENCRYPTION_PKCS1. * * @access public - * @param Integer $mode + * @param int $mode */ function setEncryptionMode($mode) { @@ -2807,10 +2844,10 @@ class Crypt_RSA /** * Set Signature Mode * - * Valid values include CRYPT_RSA_SIGNATURE_PSS and CRYPT_RSA_SIGNATURE_PKCS1 + * Valid values include self::SIGNATURE_PSS and self::SIGNATURE_PKCS1 * * @access public - * @param Integer $mode + * @param int $mode */ function setSignatureMode($mode) { @@ -2821,7 +2858,7 @@ class Crypt_RSA * Set public key comment. * * @access public - * @param String $comment + * @param string $comment */ function setComment($comment) { @@ -2832,7 +2869,7 @@ class Crypt_RSA * Get public key comment. * * @access public - * @return String + * @return string */ function getComment() { @@ -2842,19 +2879,26 @@ class Crypt_RSA /** * Encryption * - * Both CRYPT_RSA_ENCRYPTION_OAEP and CRYPT_RSA_ENCRYPTION_PKCS1 both place limits on how long $plaintext can be. + * Both self::ENCRYPTION_OAEP and self::ENCRYPTION_PKCS1 both place limits on how long $plaintext can be. * If $plaintext exceeds those limits it will be broken up so that it does and the resultant ciphertext's will * be concatenated together. * - * @see decrypt() + * @see self::decrypt() * @access public - * @param String $plaintext - * @return String + * @param string $plaintext + * @return string */ function encrypt($plaintext) { switch ($this->encryptionMode) { - case CRYPT_RSA_ENCRYPTION_PKCS1: + case self::ENCRYPTION_NONE: + $plaintext = str_split($plaintext, $this->k); + $ciphertext = ''; + foreach ($plaintext as $m) { + $ciphertext.= $this->_raw_encrypt($m); + } + return $ciphertext; + case self::ENCRYPTION_PKCS1: $length = $this->k - 11; if ($length <= 0) { return false; @@ -2866,7 +2910,7 @@ class Crypt_RSA $ciphertext.= $this->_rsaes_pkcs1_v1_5_encrypt($m); } return $ciphertext; - //case CRYPT_RSA_ENCRYPTION_OAEP: + //case self::ENCRYPTION_OAEP: default: $length = $this->k - 2 * $this->hLen - 2; if ($length <= 0) { @@ -2885,10 +2929,10 @@ class Crypt_RSA /** * Decryption * - * @see encrypt() + * @see self::encrypt() * @access public - * @param String $plaintext - * @return String + * @param string $plaintext + * @return string */ function decrypt($ciphertext) { @@ -2902,10 +2946,13 @@ class Crypt_RSA $plaintext = ''; switch ($this->encryptionMode) { - case CRYPT_RSA_ENCRYPTION_PKCS1: + case self::ENCRYPTION_NONE: + $decrypt = '_raw_encrypt'; + break; + case self::ENCRYPTION_PKCS1: $decrypt = '_rsaes_pkcs1_v1_5_decrypt'; break; - //case CRYPT_RSA_ENCRYPTION_OAEP: + //case self::ENCRYPTION_OAEP: default: $decrypt = '_rsaes_oaep_decrypt'; } @@ -2924,10 +2971,10 @@ class Crypt_RSA /** * Create a signature * - * @see verify() + * @see self::verify() * @access public - * @param String $message - * @return String + * @param string $message + * @return string */ function sign($message) { @@ -2936,9 +2983,9 @@ class Crypt_RSA } switch ($this->signatureMode) { - case CRYPT_RSA_SIGNATURE_PKCS1: + case self::SIGNATURE_PKCS1: return $this->_rsassa_pkcs1_v1_5_sign($message); - //case CRYPT_RSA_SIGNATURE_PSS: + //case self::SIGNATURE_PSS: default: return $this->_rsassa_pss_sign($message); } @@ -2947,11 +2994,11 @@ class Crypt_RSA /** * Verifies a signature * - * @see sign() + * @see self::sign() * @access public - * @param String $message - * @param String $signature - * @return Boolean + * @param string $message + * @param string $signature + * @return bool */ function verify($message, $signature) { @@ -2960,9 +3007,9 @@ class Crypt_RSA } switch ($this->signatureMode) { - case CRYPT_RSA_SIGNATURE_PKCS1: + case self::SIGNATURE_PKCS1: return $this->_rsassa_pkcs1_v1_5_verify($message, $signature); - //case CRYPT_RSA_SIGNATURE_PSS: + //case self::SIGNATURE_PSS: default: return $this->_rsassa_pss_verify($message, $signature); } @@ -2972,8 +3019,8 @@ class Crypt_RSA * Extract raw BER from Base64 encoding * * @access private - * @param String $str - * @return String + * @param string $str + * @return string */ function _extractBER($str) { @@ -2986,7 +3033,7 @@ class Crypt_RSA * subject=/O=organization/OU=org unit/CN=common name * issuer=/O=organization/CN=common name */ - $temp = preg_replace('#.*?^-+[^-]+-+#ms', '', $str, 1); + $temp = preg_replace('#.*?^-+[^-]+-+[\r\n ]*$#ms', '', $str, 1); // remove the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- stuff $temp = preg_replace('#-+[^-]+-+#', '', $temp); // remove new lines diff --git a/securemail/vendor/phpseclib/phpseclib/phpseclib/Crypt/Random.php b/securemail/vendor/phpseclib/phpseclib/phpseclib/Crypt/Random.php index 918b97bf..170d1c37 100644 --- a/securemail/vendor/phpseclib/phpseclib/phpseclib/Crypt/Random.php +++ b/securemail/vendor/phpseclib/phpseclib/phpseclib/Crypt/Random.php @@ -3,57 +3,36 @@ /** * Random Number Generator * - * The idea behind this function is that it can be easily replaced with your own crypt_random_string() - * function. eg. maybe you have a better source of entropy for creating the initial states or whatever. - * - * PHP versions 4 and 5 + * PHP version 5 * * Here's a short example of how to use this library: * * * * - * LICENSE: Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in - * all copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN - * THE SOFTWARE. - * * @category Crypt - * @package Crypt_Random + * @package Random * @author Jim Wigginton * @copyright 2007 Jim Wigginton * @license http://www.opensource.org/licenses/mit-license.html MIT License * @link http://phpseclib.sourceforge.net */ -// laravel is a PHP framework that utilizes phpseclib. laravel workbenches may, independently, -// have phpseclib as a requirement as well. if you're developing such a program you may encounter -// a "Cannot redeclare crypt_random_string()" error. -if (!function_exists('crypt_random_string')) { - /** - * "Is Windows" test - * - * @access private - */ - define('CRYPT_RANDOM_IS_WINDOWS', strtoupper(substr(PHP_OS, 0, 3)) === 'WIN'); +namespace phpseclib\Crypt; +/** + * Pure-PHP Random Number Generator + * + * @package Random + * @author Jim Wigginton + * @access public + */ +class Random +{ /** * Generate a random string. * @@ -61,16 +40,28 @@ if (!function_exists('crypt_random_string')) { * microoptimizations because this function has the potential of being called a huge number of times. * eg. for RSA key generation. * - * @param Integer $length - * @return String - * @access public + * @param int $length + * @return string */ - function crypt_random_string($length) + static function string($length) { - if (CRYPT_RANDOM_IS_WINDOWS) { + if (version_compare(PHP_VERSION, '7.0.0', '>=')) { + try { + return \random_bytes($length); + } catch (\Throwable $e) { + // If a sufficient source of randomness is unavailable, random_bytes() will throw an + // object that implements the Throwable interface (Exception, TypeError, Error). + // We don't actually need to do anything here. The string() method should just continue + // as normal. Note, however, that if we don't have a sufficient source of randomness for + // random_bytes(), most of the other calls here will fail too, so we'll end up using + // the PHP implementation. + } + } + + if (strtoupper(substr(PHP_OS, 0, 3)) === 'WIN') { // method 1. prior to PHP 5.3 this would call rand() on windows hence the function_exists('class_alias') call. // ie. class_alias is a function that was introduced in PHP 5.3 - if (function_exists('mcrypt_create_iv') && function_exists('class_alias')) { + if (extension_loaded('mcrypt') && function_exists('class_alias')) { return mcrypt_create_iv($length); } // method 2. openssl_random_pseudo_bytes was introduced in PHP 5.3.0 but prior to PHP 5.3.4 there was, @@ -86,12 +77,12 @@ if (!function_exists('crypt_random_string')) { // https://github.com/php/php-src/blob/7014a0eb6d1611151a286c0ff4f2238f92c120d6/win32/winutil.c#L80 // // we're calling it, all the same, in the off chance that the mcrypt extension is not available - if (function_exists('openssl_random_pseudo_bytes') && version_compare(PHP_VERSION, '5.3.4', '>=')) { + if (extension_loaded('openssl') && version_compare(PHP_VERSION, '5.3.4', '>=')) { return openssl_random_pseudo_bytes($length); } } else { // method 1. the fastest - if (function_exists('openssl_random_pseudo_bytes')) { + if (extension_loaded('openssl')) { return openssl_random_pseudo_bytes($length); } // method 2 @@ -109,7 +100,7 @@ if (!function_exists('crypt_random_string')) { // surprisingly slower than method 2. maybe that's because mcrypt_create_iv does a bunch of error checking that we're // not doing. regardless, this'll only be called if this PHP script couldn't open /dev/urandom due to open_basedir // restrictions or some such - if (function_exists('mcrypt_create_iv')) { + if (extension_loaded('mcrypt')) { return mcrypt_create_iv($length, MCRYPT_DEV_URANDOM); } } @@ -149,13 +140,13 @@ if (!function_exists('crypt_random_string')) { session_start(); $v = $seed = $_SESSION['seed'] = pack('H*', sha1( - serialize($_SERVER) . - serialize($_POST) . - serialize($_GET) . - serialize($_COOKIE) . - serialize($GLOBALS) . - serialize($_SESSION) . - serialize($_OLD_SESSION) + (isset($_SERVER) ? phpseclib_safe_serialize($_SERVER) : '') . + (isset($_POST) ? phpseclib_safe_serialize($_POST) : '') . + (isset($_GET) ? phpseclib_safe_serialize($_GET) : '') . + (isset($_COOKIE) ? phpseclib_safe_serialize($_COOKIE) : '') . + phpseclib_safe_serialize($GLOBALS) . + phpseclib_safe_serialize($_SESSION) . + phpseclib_safe_serialize($_OLD_SESSION) )); if (!isset($_SESSION['count'])) { $_SESSION['count'] = 0; @@ -171,9 +162,9 @@ if (!function_exists('crypt_random_string')) { ini_set('session.use_cookies', $old_use_cookies); session_cache_limiter($old_session_cache_limiter); } else { - if ($_OLD_SESSION !== false) { - $_SESSION = $_OLD_SESSION; - unset($_OLD_SESSION); + if ($_OLD_SESSION !== false) { + $_SESSION = $_OLD_SESSION; + unset($_OLD_SESSION); } else { unset($_SESSION); } @@ -194,44 +185,26 @@ if (!function_exists('crypt_random_string')) { // // http://en.wikipedia.org/wiki/Cryptographically_secure_pseudorandom_number_generator#Designs_based_on_cryptographic_primitives switch (true) { - case phpseclib_resolve_include_path('Crypt/AES.php'): - if (!class_exists('Crypt_AES')) { - include_once 'AES.php'; - } - $crypto = new Crypt_AES(CRYPT_AES_MODE_CTR); + case class_exists('\phpseclib\Crypt\AES'): + $crypto = new AES(Base::MODE_CTR); break; - case phpseclib_resolve_include_path('Crypt/Twofish.php'): - if (!class_exists('Crypt_Twofish')) { - include_once 'Twofish.php'; - } - $crypto = new Crypt_Twofish(CRYPT_TWOFISH_MODE_CTR); + case class_exists('\phpseclib\Crypt\Twofish'): + $crypto = new Twofish(Base::MODE_CTR); break; - case phpseclib_resolve_include_path('Crypt/Blowfish.php'): - if (!class_exists('Crypt_Blowfish')) { - include_once 'Blowfish.php'; - } - $crypto = new Crypt_Blowfish(CRYPT_BLOWFISH_MODE_CTR); + case class_exists('\phpseclib\Crypt\Blowfish'): + $crypto = new Blowfish(Base::MODE_CTR); break; - case phpseclib_resolve_include_path('Crypt/TripleDES.php'): - if (!class_exists('Crypt_TripleDES')) { - include_once 'TripleDES.php'; - } - $crypto = new Crypt_TripleDES(CRYPT_DES_MODE_CTR); + case class_exists('\phpseclib\Crypt\TripleDES'): + $crypto = new TripleDES(Base::MODE_CTR); break; - case phpseclib_resolve_include_path('Crypt/DES.php'): - if (!class_exists('Crypt_DES')) { - include_once 'DES.php'; - } - $crypto = new Crypt_DES(CRYPT_DES_MODE_CTR); + case class_exists('\phpseclib\Crypt\DES'): + $crypto = new DES(Base::MODE_CTR); break; - case phpseclib_resolve_include_path('Crypt/RC4.php'): - if (!class_exists('Crypt_RC4')) { - include_once 'RC4.php'; - } - $crypto = new Crypt_RC4(); + case class_exists('\phpseclib\Crypt\RC4'): + $crypto = new RC4(); break; default: - user_error('crypt_random_string requires at least one symmetric cipher be loaded'); + user_error(__CLASS__ . ' requires at least one symmetric cipher be loaded'); return false; } @@ -261,40 +234,37 @@ if (!function_exists('crypt_random_string')) { } } -if (!function_exists('phpseclib_resolve_include_path')) { +if (!function_exists('phpseclib_safe_serialize')) { /** - * Resolve filename against the include path. + * Safely serialize variables * - * Wrapper around stream_resolve_include_path() (which was introduced in - * PHP 5.3.2) with fallback implementation for earlier PHP versions. + * If a class has a private __sleep() method it'll give a fatal error on PHP 5.2 and earlier. + * PHP 5.3 will emit a warning. * - * @param string $filename - * @return mixed Filename (string) on success, false otherwise. + * @param mixed $arr * @access public */ - function phpseclib_resolve_include_path($filename) + function phpseclib_safe_serialize(&$arr) { - if (function_exists('stream_resolve_include_path')) { - return stream_resolve_include_path($filename); + if (is_object($arr)) { + return ''; } - - // handle non-relative paths - if (file_exists($filename)) { - return realpath($filename); + if (!is_array($arr)) { + return serialize($arr); } - - $paths = PATH_SEPARATOR == ':' ? - preg_split('#(? * setKey('abcdefghijklmnop'); * @@ -44,134 +44,37 @@ * ?> *
* createKey()); * * $plaintext = 'terrafrost'; @@ -41,241 +41,211 @@ * ?> *
* *
* setKey('abcdefghijklmnopqrstuvwx'); * @@ -26,99 +26,64 @@ * ?> *
' . $this->_getScreen() . '
' . $scrollback . '
* add($b); * @@ -42,143 +40,153 @@ * ?> *
* toString(); // outputs 50 * ?> *
* toBytes(); // outputs chr(65) * ?> *
* toHex(); // outputs '41' * ?> *
* toBits(); // outputs '1000001' * ?> *
* add($b); * @@ -842,21 +852,21 @@ class Math_BigInteger * ?> *
* subtract($b); * @@ -973,21 +981,21 @@ class Math_BigInteger * ?> *
* multiply($b); * @@ -1109,20 +1115,20 @@ class Math_BigInteger * ?> *
* divide($b); * @@ -1395,17 +1399,17 @@ class Math_BigInteger * ?> *
* modPow($b, $c); * @@ -1613,9 +1615,9 @@ class Math_BigInteger * ?> *
* modInverse($b); * echo $c->toString(); // outputs 4 @@ -2422,25 +2430,25 @@ class Math_BigInteger * ?> *
* extendedGCD($b)); * @@ -2486,8 +2492,8 @@ class Math_BigInteger * ?> *
* extendedGCD($b); * @@ -2620,8 +2624,8 @@ class Math_BigInteger * ?> *
* login('username', 'password')) { * exit('bad login'); * } - - * $scp = new Net_SCP($ssh); + * $scp = new \phpseclib\Net\SCP($ssh); + * * $scp->put('abcd', str_repeat('x', 1024*1024)); * ?> *
* login('username', 'password')) { * exit('Login Failed'); * } @@ -27,105 +27,69 @@ * ?> *
* login('username', 'password')) { * exit('Login Failed'); * } @@ -22,9 +22,9 @@ * Here's another short example: * * login('username', 'password')) { * exit('Login Failed'); * } @@ -38,204 +38,193 @@ * More information on the SSHv1 specification can be found by reading * {@link http://www.snailbook.com/docs/protocol-1.5.txt protocol-1.5.txt}. * - * LICENSE: Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in - * all copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN - * THE SOFTWARE. - * * @category Net - * @package Net_SSH1 + * @package SSH1 * @author Jim Wigginton * @copyright 2007 Jim Wigginton * @license http://www.opensource.org/licenses/mit-license.html MIT License * @link http://phpseclib.sourceforge.net */ -/**#@+ - * Encryption Methods - * - * @see Net_SSH1::getSupportedCiphers() - * @access public - */ -/** - * No encryption - * - * Not supported. - */ -define('NET_SSH1_CIPHER_NONE', 0); -/** - * IDEA in CFB mode - * - * Not supported. - */ -define('NET_SSH1_CIPHER_IDEA', 1); -/** - * DES in CBC mode - */ -define('NET_SSH1_CIPHER_DES', 2); -/** - * Triple-DES in CBC mode - * - * All implementations are required to support this - */ -define('NET_SSH1_CIPHER_3DES', 3); -/** - * TRI's Simple Stream encryption CBC - * - * Not supported nor is it defined in the official SSH1 specs. OpenSSH, however, does define it (see cipher.h), - * although it doesn't use it (see cipher.c) - */ -define('NET_SSH1_CIPHER_BROKEN_TSS', 4); -/** - * RC4 - * - * Not supported. - * - * @internal According to the SSH1 specs: - * - * "The first 16 bytes of the session key are used as the key for - * the server to client direction. The remaining 16 bytes are used - * as the key for the client to server direction. This gives - * independent 128-bit keys for each direction." - * - * This library currently only supports encryption when the same key is being used for both directions. This is - * because there's only one $crypto object. Two could be added ($encrypt and $decrypt, perhaps). - */ -define('NET_SSH1_CIPHER_RC4', 5); -/** - * Blowfish - * - * Not supported nor is it defined in the official SSH1 specs. OpenSSH, however, defines it (see cipher.h) and - * uses it (see cipher.c) - */ -define('NET_SSH1_CIPHER_BLOWFISH', 6); -/**#@-*/ +namespace phpseclib\Net; -/**#@+ - * Authentication Methods - * - * @see Net_SSH1::getSupportedAuthentications() - * @access public - */ -/** - * .rhosts or /etc/hosts.equiv - */ -define('NET_SSH1_AUTH_RHOSTS', 1); -/** - * pure RSA authentication - */ -define('NET_SSH1_AUTH_RSA', 2); -/** - * password authentication - * - * This is the only method that is supported by this library. - */ -define('NET_SSH1_AUTH_PASSWORD', 3); -/** - * .rhosts with RSA host authentication - */ -define('NET_SSH1_AUTH_RHOSTS_RSA', 4); -/**#@-*/ - -/**#@+ - * Terminal Modes - * - * @link http://3sp.com/content/developer/maverick-net/docs/Maverick.SSH.PseudoTerminalModesMembers.html - * @access private - */ -define('NET_SSH1_TTY_OP_END', 0); -/**#@-*/ - -/** - * The Response Type - * - * @see Net_SSH1::_get_binary_packet() - * @access private - */ -define('NET_SSH1_RESPONSE_TYPE', 1); - -/** - * The Response Data - * - * @see Net_SSH1::_get_binary_packet() - * @access private - */ -define('NET_SSH1_RESPONSE_DATA', 2); - -/**#@+ - * Execution Bitmap Masks - * - * @see Net_SSH1::bitmap - * @access private - */ -define('NET_SSH1_MASK_CONSTRUCTOR', 0x00000001); -define('NET_SSH1_MASK_CONNECTED', 0x00000002); -define('NET_SSH1_MASK_LOGIN', 0x00000004); -define('NET_SSH1_MASK_SHELL', 0x00000008); -/**#@-*/ - -/**#@+ - * @access public - * @see Net_SSH1::getLog() - */ -/** - * Returns the message numbers - */ -define('NET_SSH1_LOG_SIMPLE', 1); -/** - * Returns the message content - */ -define('NET_SSH1_LOG_COMPLEX', 2); -/** - * Outputs the content real-time - */ -define('NET_SSH1_LOG_REALTIME', 3); -/** - * Dumps the content real-time to a file - */ -define('NET_SSH1_LOG_REALTIME_FILE', 4); -/**#@-*/ - -/**#@+ - * @access public - * @see Net_SSH1::read() - */ -/** - * Returns when a string matching $expect exactly is found - */ -define('NET_SSH1_READ_SIMPLE', 1); -/** - * Returns when a string matching the regular expression $expect is found - */ -define('NET_SSH1_READ_REGEX', 2); -/**#@-*/ +use phpseclib\Crypt\DES; +use phpseclib\Crypt\Random; +use phpseclib\Crypt\TripleDES; +use phpseclib\Math\BigInteger; /** * Pure-PHP implementation of SSHv1. * - * @package Net_SSH1 + * @package SSH1 * @author Jim Wigginton * @access public */ -class Net_SSH1 +class SSH1 { + /**#@+ + * Encryption Methods + * + * @see \phpseclib\Net\SSH1::getSupportedCiphers() + * @access public + */ + /** + * No encryption + * + * Not supported. + */ + const CIPHER_NONE = 0; + /** + * IDEA in CFB mode + * + * Not supported. + */ + const CIPHER_IDEA = 1; + /** + * DES in CBC mode + */ + const CIPHER_DES = 2; + /** + * Triple-DES in CBC mode + * + * All implementations are required to support this + */ + const CIPHER_3DES = 3; + /** + * TRI's Simple Stream encryption CBC + * + * Not supported nor is it defined in the official SSH1 specs. OpenSSH, however, does define it (see cipher.h), + * although it doesn't use it (see cipher.c) + */ + const CIPHER_BROKEN_TSS = 4; + /** + * RC4 + * + * Not supported. + * + * @internal According to the SSH1 specs: + * + * "The first 16 bytes of the session key are used as the key for + * the server to client direction. The remaining 16 bytes are used + * as the key for the client to server direction. This gives + * independent 128-bit keys for each direction." + * + * This library currently only supports encryption when the same key is being used for both directions. This is + * because there's only one $crypto object. Two could be added ($encrypt and $decrypt, perhaps). + */ + const CIPHER_RC4 = 5; + /** + * Blowfish + * + * Not supported nor is it defined in the official SSH1 specs. OpenSSH, however, defines it (see cipher.h) and + * uses it (see cipher.c) + */ + const CIPHER_BLOWFISH = 6; + /**#@-*/ + + /**#@+ + * Authentication Methods + * + * @see \phpseclib\Net\SSH1::getSupportedAuthentications() + * @access public + */ + /** + * .rhosts or /etc/hosts.equiv + */ + const AUTH_RHOSTS = 1; + /** + * pure RSA authentication + */ + const AUTH_RSA = 2; + /** + * password authentication + * + * This is the only method that is supported by this library. + */ + const AUTH_PASSWORD = 3; + /** + * .rhosts with RSA host authentication + */ + const AUTH_RHOSTS_RSA = 4; + /**#@-*/ + + /**#@+ + * Terminal Modes + * + * @link http://3sp.com/content/developer/maverick-net/docs/Maverick.SSH.PseudoTerminalModesMembers.html + * @access private + */ + const TTY_OP_END = 0; + /**#@-*/ + + /** + * The Response Type + * + * @see \phpseclib\Net\SSH1::_get_binary_packet() + * @access private + */ + const RESPONSE_TYPE = 1; + + /** + * The Response Data + * + * @see \phpseclib\Net\SSH1::_get_binary_packet() + * @access private + */ + const RESPONSE_DATA = 2; + + /**#@+ + * Execution Bitmap Masks + * + * @see \phpseclib\Net\SSH1::bitmap + * @access private + */ + const MASK_CONSTRUCTOR = 0x00000001; + const MASK_CONNECTED = 0x00000002; + const MASK_LOGIN = 0x00000004; + const MASK_SHELL = 0x00000008; + /**#@-*/ + + /**#@+ + * @access public + * @see \phpseclib\Net\SSH1::getLog() + */ + /** + * Returns the message numbers + */ + const LOG_SIMPLE = 1; + /** + * Returns the message content + */ + const LOG_COMPLEX = 2; + /** + * Outputs the content real-time + */ + const LOG_REALTIME = 3; + /** + * Dumps the content real-time to a file + */ + const LOG_REALTIME_FILE = 4; + /**#@-*/ + + /**#@+ + * @access public + * @see \phpseclib\Net\SSH1::read() + */ + /** + * Returns when a string matching $expect exactly is found + */ + const READ_SIMPLE = 1; + /** + * Returns when a string matching the regular expression $expect is found + */ + const READ_REGEX = 2; + /**#@-*/ + /** * The SSH identifier * - * @var String + * @var string * @access private */ var $identifier = 'SSH-1.5-phpseclib'; @@ -243,7 +232,7 @@ class Net_SSH1 /** * The Socket Object * - * @var Object + * @var object * @access private */ var $fsock; @@ -251,7 +240,7 @@ class Net_SSH1 /** * The cryptography object * - * @var Object + * @var object * @access private */ var $crypto = false; @@ -262,7 +251,7 @@ class Net_SSH1 * The bits that are set represent functions that have been called already. This is used to determine * if a requisite function has been successfully executed. If not, an error should be thrown. * - * @var Integer + * @var int * @access private */ var $bitmap = 0; @@ -272,8 +261,8 @@ class Net_SSH1 * * Logged for debug purposes * - * @see Net_SSH1::getServerKeyPublicExponent() - * @var String + * @see self::getServerKeyPublicExponent() + * @var string * @access private */ var $server_key_public_exponent; @@ -283,8 +272,8 @@ class Net_SSH1 * * Logged for debug purposes * - * @see Net_SSH1::getServerKeyPublicModulus() - * @var String + * @see self::getServerKeyPublicModulus() + * @var string * @access private */ var $server_key_public_modulus; @@ -294,8 +283,8 @@ class Net_SSH1 * * Logged for debug purposes * - * @see Net_SSH1::getHostKeyPublicExponent() - * @var String + * @see self::getHostKeyPublicExponent() + * @var string * @access private */ var $host_key_public_exponent; @@ -305,8 +294,8 @@ class Net_SSH1 * * Logged for debug purposes * - * @see Net_SSH1::getHostKeyPublicModulus() - * @var String + * @see self::getHostKeyPublicModulus() + * @var string * @access private */ var $host_key_public_modulus; @@ -316,18 +305,18 @@ class Net_SSH1 * * Logged for debug purposes * - * @see Net_SSH1::getSupportedCiphers() - * @var Array + * @see self::getSupportedCiphers() + * @var array * @access private */ var $supported_ciphers = array( - NET_SSH1_CIPHER_NONE => 'No encryption', - NET_SSH1_CIPHER_IDEA => 'IDEA in CFB mode', - NET_SSH1_CIPHER_DES => 'DES in CBC mode', - NET_SSH1_CIPHER_3DES => 'Triple-DES in CBC mode', - NET_SSH1_CIPHER_BROKEN_TSS => 'TRI\'s Simple Stream encryption CBC', - NET_SSH1_CIPHER_RC4 => 'RC4', - NET_SSH1_CIPHER_BLOWFISH => 'Blowfish' + self::CIPHER_NONE => 'No encryption', + self::CIPHER_IDEA => 'IDEA in CFB mode', + self::CIPHER_DES => 'DES in CBC mode', + self::CIPHER_3DES => 'Triple-DES in CBC mode', + self::CIPHER_BROKEN_TSS => 'TRI\'s Simple Stream encryption CBC', + self::CIPHER_RC4 => 'RC4', + self::CIPHER_BLOWFISH => 'Blowfish' ); /** @@ -335,22 +324,22 @@ class Net_SSH1 * * Logged for debug purposes * - * @see Net_SSH1::getSupportedAuthentications() - * @var Array + * @see self::getSupportedAuthentications() + * @var array * @access private */ var $supported_authentications = array( - NET_SSH1_AUTH_RHOSTS => '.rhosts or /etc/hosts.equiv', - NET_SSH1_AUTH_RSA => 'pure RSA authentication', - NET_SSH1_AUTH_PASSWORD => 'password authentication', - NET_SSH1_AUTH_RHOSTS_RSA => '.rhosts with RSA host authentication' + self::AUTH_RHOSTS => '.rhosts or /etc/hosts.equiv', + self::AUTH_RSA => 'pure RSA authentication', + self::AUTH_PASSWORD => 'password authentication', + self::AUTH_RHOSTS_RSA => '.rhosts with RSA host authentication' ); /** * Server Identification * - * @see Net_SSH1::getServerIdentification() - * @var String + * @see self::getServerIdentification() + * @var string * @access private */ var $server_identification = ''; @@ -358,8 +347,8 @@ class Net_SSH1 /** * Protocol Flags * - * @see Net_SSH1::Net_SSH1() - * @var Array + * @see self::__construct() + * @var array * @access private */ var $protocol_flags = array(); @@ -367,8 +356,8 @@ class Net_SSH1 /** * Protocol Flag Log * - * @see Net_SSH1::getLog() - * @var Array + * @see self::getLog() + * @var array * @access private */ var $protocol_flag_log = array(); @@ -376,8 +365,8 @@ class Net_SSH1 /** * Message Log * - * @see Net_SSH1::getLog() - * @var Array + * @see self::getLog() + * @var array * @access private */ var $message_log = array(); @@ -385,8 +374,8 @@ class Net_SSH1 /** * Real-time log file pointer * - * @see Net_SSH1::_append_log() - * @var Resource + * @see self::_append_log() + * @var resource * @access private */ var $realtime_log_file; @@ -394,8 +383,8 @@ class Net_SSH1 /** * Real-time log file size * - * @see Net_SSH1::_append_log() - * @var Integer + * @see self::_append_log() + * @var int * @access private */ var $realtime_log_size; @@ -403,8 +392,8 @@ class Net_SSH1 /** * Real-time log file wrap boolean * - * @see Net_SSH1::_append_log() - * @var Boolean + * @see self::_append_log() + * @var bool * @access private */ var $realtime_log_wrap; @@ -412,8 +401,8 @@ class Net_SSH1 /** * Interactive Buffer * - * @see Net_SSH1::read() - * @var Array + * @see self::read() + * @var array * @access private */ var $interactiveBuffer = ''; @@ -421,7 +410,7 @@ class Net_SSH1 /** * Timeout * - * @see Net_SSH1::setTimeout() + * @see self::setTimeout() * @access private */ var $timeout; @@ -429,7 +418,7 @@ class Net_SSH1 /** * Current Timeout * - * @see Net_SSH1::_get_channel_packet() + * @see self::_get_channel_packet() * @access private */ var $curTimeout; @@ -437,7 +426,7 @@ class Net_SSH1 /** * Log Boundary * - * @see Net_SSH1::_format_log + * @see self::_format_log() * @access private */ var $log_boundary = ':'; @@ -445,7 +434,7 @@ class Net_SSH1 /** * Log Long Width * - * @see Net_SSH1::_format_log + * @see self::_format_log() * @access private */ var $log_long_width = 65; @@ -453,7 +442,7 @@ class Net_SSH1 /** * Log Short Width * - * @see Net_SSH1::_format_log + * @see self::_format_log() * @access private */ var $log_short_width = 16; @@ -461,9 +450,9 @@ class Net_SSH1 /** * Hostname * - * @see Net_SSH1::Net_SSH1() - * @see Net_SSH1::_connect() - * @var String + * @see self::__construct() + * @see self::_connect() + * @var string * @access private */ var $host; @@ -471,9 +460,9 @@ class Net_SSH1 /** * Port Number * - * @see Net_SSH1::Net_SSH1() - * @see Net_SSH1::_connect() - * @var Integer + * @see self::__construct() + * @see self::_connect() + * @var int * @access private */ var $port; @@ -486,9 +475,9 @@ class Net_SSH1 * however, is non-optional. There will be a timeout, whether or not you set it. If you don't it'll be * 10 seconds. It is used by fsockopen() in that function. * - * @see Net_SSH1::Net_SSH1() - * @see Net_SSH1::_connect() - * @var Integer + * @see self::__construct() + * @see self::_connect() + * @var int * @access private */ var $connectionTimeout; @@ -496,9 +485,9 @@ class Net_SSH1 /** * Default cipher * - * @see Net_SSH1::Net_SSH1() - * @see Net_SSH1::_connect() - * @var Integer + * @see self::__construct() + * @see self::_connect() + * @var int * @access private */ var $cipher; @@ -508,28 +497,15 @@ class Net_SSH1 * * Connects to an SSHv1 server * - * @param String $host - * @param optional Integer $port - * @param optional Integer $timeout - * @param optional Integer $cipher - * @return Net_SSH1 + * @param string $host + * @param int $port + * @param int $timeout + * @param int $cipher + * @return \phpseclib\Net\SSH1 * @access public */ - function Net_SSH1($host, $port = 22, $timeout = 10, $cipher = NET_SSH1_CIPHER_3DES) + function __construct($host, $port = 22, $timeout = 10, $cipher = self::CIPHER_3DES) { - if (!class_exists('Math_BigInteger')) { - include_once 'Math/BigInteger.php'; - } - - // Include Crypt_Random - // the class_exists() will only be called if the crypt_random_string function hasn't been defined and - // will trigger a call to __autoload() if you're wanting to auto-load classes - // call function_exists() a second time to stop the include_once from being called outside - // of the auto loader - if (!function_exists('crypt_random_string') && !class_exists('Crypt_Random') && !function_exists('crypt_random_string')) { - include_once 'Crypt/Random.php'; - } - $this->protocol_flags = array( 1 => 'NET_SSH1_MSG_DISCONNECT', 2 => 'NET_SSH1_SMSG_PUBLIC_KEY', @@ -560,7 +536,7 @@ class Net_SSH1 /** * Connect to an SSHv1 server * - * @return Boolean + * @return bool * @access private */ function _connect() @@ -590,46 +566,46 @@ class Net_SSH1 fputs($this->fsock, $this->identifier."\r\n"); $response = $this->_get_binary_packet(); - if ($response[NET_SSH1_RESPONSE_TYPE] != NET_SSH1_SMSG_PUBLIC_KEY) { + if ($response[self::RESPONSE_TYPE] != NET_SSH1_SMSG_PUBLIC_KEY) { user_error('Expected SSH_SMSG_PUBLIC_KEY'); return false; } - $anti_spoofing_cookie = $this->_string_shift($response[NET_SSH1_RESPONSE_DATA], 8); + $anti_spoofing_cookie = $this->_string_shift($response[self::RESPONSE_DATA], 8); - $this->_string_shift($response[NET_SSH1_RESPONSE_DATA], 4); + $this->_string_shift($response[self::RESPONSE_DATA], 4); - $temp = unpack('nlen', $this->_string_shift($response[NET_SSH1_RESPONSE_DATA], 2)); - $server_key_public_exponent = new Math_BigInteger($this->_string_shift($response[NET_SSH1_RESPONSE_DATA], ceil($temp['len'] / 8)), 256); + $temp = unpack('nlen', $this->_string_shift($response[self::RESPONSE_DATA], 2)); + $server_key_public_exponent = new BigInteger($this->_string_shift($response[self::RESPONSE_DATA], ceil($temp['len'] / 8)), 256); $this->server_key_public_exponent = $server_key_public_exponent; - $temp = unpack('nlen', $this->_string_shift($response[NET_SSH1_RESPONSE_DATA], 2)); - $server_key_public_modulus = new Math_BigInteger($this->_string_shift($response[NET_SSH1_RESPONSE_DATA], ceil($temp['len'] / 8)), 256); + $temp = unpack('nlen', $this->_string_shift($response[self::RESPONSE_DATA], 2)); + $server_key_public_modulus = new BigInteger($this->_string_shift($response[self::RESPONSE_DATA], ceil($temp['len'] / 8)), 256); $this->server_key_public_modulus = $server_key_public_modulus; - $this->_string_shift($response[NET_SSH1_RESPONSE_DATA], 4); + $this->_string_shift($response[self::RESPONSE_DATA], 4); - $temp = unpack('nlen', $this->_string_shift($response[NET_SSH1_RESPONSE_DATA], 2)); - $host_key_public_exponent = new Math_BigInteger($this->_string_shift($response[NET_SSH1_RESPONSE_DATA], ceil($temp['len'] / 8)), 256); + $temp = unpack('nlen', $this->_string_shift($response[self::RESPONSE_DATA], 2)); + $host_key_public_exponent = new BigInteger($this->_string_shift($response[self::RESPONSE_DATA], ceil($temp['len'] / 8)), 256); $this->host_key_public_exponent = $host_key_public_exponent; - $temp = unpack('nlen', $this->_string_shift($response[NET_SSH1_RESPONSE_DATA], 2)); - $host_key_public_modulus = new Math_BigInteger($this->_string_shift($response[NET_SSH1_RESPONSE_DATA], ceil($temp['len'] / 8)), 256); + $temp = unpack('nlen', $this->_string_shift($response[self::RESPONSE_DATA], 2)); + $host_key_public_modulus = new BigInteger($this->_string_shift($response[self::RESPONSE_DATA], ceil($temp['len'] / 8)), 256); $this->host_key_public_modulus = $host_key_public_modulus; - $this->_string_shift($response[NET_SSH1_RESPONSE_DATA], 4); + $this->_string_shift($response[self::RESPONSE_DATA], 4); // get a list of the supported ciphers - extract(unpack('Nsupported_ciphers_mask', $this->_string_shift($response[NET_SSH1_RESPONSE_DATA], 4))); - foreach ($this->supported_ciphers as $mask=>$name) { + extract(unpack('Nsupported_ciphers_mask', $this->_string_shift($response[self::RESPONSE_DATA], 4))); + foreach ($this->supported_ciphers as $mask => $name) { if (($supported_ciphers_mask & (1 << $mask)) == 0) { unset($this->supported_ciphers[$mask]); } } // get a list of the supported authentications - extract(unpack('Nsupported_authentications_mask', $this->_string_shift($response[NET_SSH1_RESPONSE_DATA], 4))); - foreach ($this->supported_authentications as $mask=>$name) { + extract(unpack('Nsupported_authentications_mask', $this->_string_shift($response[self::RESPONSE_DATA], 4))); + foreach ($this->supported_authentications as $mask => $name) { if (($supported_authentications_mask & (1 << $mask)) == 0) { unset($this->supported_authentications[$mask]); } @@ -637,7 +613,7 @@ class Net_SSH1 $session_id = pack('H*', md5($host_key_public_modulus->toBytes() . $server_key_public_modulus->toBytes() . $anti_spoofing_cookie)); - $session_key = crypt_random_string(32); + $session_key = Random::string(32); $double_encrypted_session_key = $session_key ^ str_pad($session_id, 32, chr(0)); if ($server_key_public_modulus->compare($host_key_public_modulus) < 0) { @@ -672,7 +648,7 @@ class Net_SSH1 ); } - $cipher = isset($this->supported_ciphers[$this->cipher]) ? $this->cipher : NET_SSH1_CIPHER_3DES; + $cipher = isset($this->supported_ciphers[$this->cipher]) ? $this->cipher : self::CIPHER_3DES; $data = pack('C2a*na*N', NET_SSH1_CMSG_SESSION_KEY, $cipher, $anti_spoofing_cookie, 8 * strlen($double_encrypted_session_key), $double_encrypted_session_key, 0); if (!$this->_send_binary_packet($data)) { @@ -681,32 +657,23 @@ class Net_SSH1 } switch ($cipher) { - //case NET_SSH1_CIPHER_NONE: - // $this->crypto = new Crypt_Null(); + //case self::CIPHER_NONE: + // $this->crypto = new \phpseclib\Crypt\Null(); // break; - case NET_SSH1_CIPHER_DES: - if (!class_exists('Crypt_DES')) { - include_once 'Crypt/DES.php'; - } - $this->crypto = new Crypt_DES(); + case self::CIPHER_DES: + $this->crypto = new DES(); $this->crypto->disablePadding(); $this->crypto->enableContinuousBuffer(); $this->crypto->setKey(substr($session_key, 0, 8)); break; - case NET_SSH1_CIPHER_3DES: - if (!class_exists('Crypt_TripleDES')) { - include_once 'Crypt/TripleDES.php'; - } - $this->crypto = new Crypt_TripleDES(CRYPT_DES_MODE_3CBC); + case self::CIPHER_3DES: + $this->crypto = new TripleDES(TripleDES::MODE_3CBC); $this->crypto->disablePadding(); $this->crypto->enableContinuousBuffer(); $this->crypto->setKey(substr($session_key, 0, 24)); break; - //case NET_SSH1_CIPHER_RC4: - // if (!class_exists('Crypt_RC4')) { - // include_once 'Crypt/RC4.php'; - // } - // $this->crypto = new Crypt_RC4(); + //case self::CIPHER_RC4: + // $this->crypto = new RC4(); // $this->crypto->enableContinuousBuffer(); // $this->crypto->setKey(substr($session_key, 0, 16)); // break; @@ -714,12 +681,12 @@ class Net_SSH1 $response = $this->_get_binary_packet(); - if ($response[NET_SSH1_RESPONSE_TYPE] != NET_SSH1_SMSG_SUCCESS) { + if ($response[self::RESPONSE_TYPE] != NET_SSH1_SMSG_SUCCESS) { user_error('Expected SSH_SMSG_SUCCESS'); return false; } - $this->bitmap = NET_SSH1_MASK_CONNECTED; + $this->bitmap = self::MASK_CONNECTED; return true; } @@ -727,21 +694,21 @@ class Net_SSH1 /** * Login * - * @param String $username - * @param optional String $password - * @return Boolean + * @param string $username + * @param string $password + * @return bool * @access public */ function login($username, $password = '') { - if (!($this->bitmap & NET_SSH1_MASK_CONSTRUCTOR)) { - $this->bitmap |= NET_SSH1_MASK_CONSTRUCTOR; + if (!($this->bitmap & self::MASK_CONSTRUCTOR)) { + $this->bitmap |= self::MASK_CONSTRUCTOR; if (!$this->_connect()) { return false; } } - if (!($this->bitmap & NET_SSH1_MASK_CONNECTED)) { + if (!($this->bitmap & self::MASK_CONNECTED)) { return false; } @@ -757,10 +724,10 @@ class Net_SSH1 if ($response === true) { return false; } - if ($response[NET_SSH1_RESPONSE_TYPE] == NET_SSH1_SMSG_SUCCESS) { - $this->bitmap |= NET_SSH1_MASK_LOGIN; + if ($response[self::RESPONSE_TYPE] == NET_SSH1_SMSG_SUCCESS) { + $this->bitmap |= self::MASK_LOGIN; return true; - } else if ($response[NET_SSH1_RESPONSE_TYPE] != NET_SSH1_SMSG_FAILURE) { + } elseif ($response[self::RESPONSE_TYPE] != NET_SSH1_SMSG_FAILURE) { user_error('Expected SSH_SMSG_SUCCESS or SSH_SMSG_FAILURE'); return false; } @@ -773,7 +740,7 @@ class Net_SSH1 } // remove the username and password from the last logged packet - if (defined('NET_SSH1_LOGGING') && NET_SSH1_LOGGING == NET_SSH1_LOG_COMPLEX) { + if (defined('NET_SSH1_LOGGING') && NET_SSH1_LOGGING == self::LOG_COMPLEX) { $data = pack('CNa*', NET_SSH1_CMSG_AUTH_PASSWORD, strlen('password'), 'password'); $this->message_log[count($this->message_log) - 1] = $data; } @@ -783,10 +750,10 @@ class Net_SSH1 if ($response === true) { return false; } - if ($response[NET_SSH1_RESPONSE_TYPE] == NET_SSH1_SMSG_SUCCESS) { - $this->bitmap |= NET_SSH1_MASK_LOGIN; + if ($response[self::RESPONSE_TYPE] == NET_SSH1_SMSG_SUCCESS) { + $this->bitmap |= self::MASK_LOGIN; return true; - } else if ($response[NET_SSH1_RESPONSE_TYPE] == NET_SSH1_SMSG_FAILURE) { + } elseif ($response[self::RESPONSE_TYPE] == NET_SSH1_SMSG_FAILURE) { return false; } else { user_error('Expected SSH_SMSG_SUCCESS or SSH_SMSG_FAILURE'); @@ -800,7 +767,7 @@ class Net_SSH1 * $ssh->exec('ping 127.0.0.1'); on a Linux host will never return and will run indefinitely. setTimeout() makes it so it'll timeout. * Setting $timeout to false or 0 will mean there is no timeout. * - * @param Mixed $timeout + * @param mixed $timeout */ function setTimeout($timeout) { @@ -817,19 +784,19 @@ class Net_SSH1 * {@link http://www.faqs.org/docs/bashman/bashref_65.html http://www.faqs.org/docs/bashman/bashref_65.html} * {@link http://www.faqs.org/docs/bashman/bashref_62.html http://www.faqs.org/docs/bashman/bashref_62.html} * - * To execute further commands, a new Net_SSH1 object will need to be created. + * To execute further commands, a new \phpseclib\Net\SSH1 object will need to be created. * * Returns false on failure and the output, otherwise. * - * @see Net_SSH1::interactiveRead() - * @see Net_SSH1::interactiveWrite() - * @param String $cmd + * @see self::interactiveRead() + * @see self::interactiveWrite() + * @param string $cmd * @return mixed * @access public */ function exec($cmd, $block = true) { - if (!($this->bitmap & NET_SSH1_MASK_LOGIN)) { + if (!($this->bitmap & self::MASK_LOGIN)) { user_error('Operation disallowed prior to login()'); return false; } @@ -850,9 +817,9 @@ class Net_SSH1 if ($response !== false) { do { - $output.= substr($response[NET_SSH1_RESPONSE_DATA], 4); + $output.= substr($response[self::RESPONSE_DATA], 4); $response = $this->_get_binary_packet(); - } while (is_array($response) && $response[NET_SSH1_RESPONSE_TYPE] != NET_SSH1_SMSG_EXITSTATUS); + } while (is_array($response) && $response[self::RESPONSE_TYPE] != NET_SSH1_SMSG_EXITSTATUS); } $data = pack('C', NET_SSH1_CMSG_EXIT_CONFIRMATION); @@ -862,7 +829,7 @@ class Net_SSH1 fclose($this->fsock); - // reset the execution bitmap - a new Net_SSH1 object needs to be created. + // reset the execution bitmap - a new \phpseclib\Net\SSH1 object needs to be created. $this->bitmap = 0; return $output; @@ -871,9 +838,9 @@ class Net_SSH1 /** * Creates an interactive shell * - * @see Net_SSH1::interactiveRead() - * @see Net_SSH1::interactiveWrite() - * @return Boolean + * @see self::interactiveRead() + * @see self::interactiveWrite() + * @return bool * @access private */ function _initShell() @@ -881,7 +848,7 @@ class Net_SSH1 // connect using the sample parameters in protocol-1.5.txt. // according to wikipedia.org's entry on text terminals, "the fundamental type of application running on a text // terminal is a command line interpreter or shell". thus, opening a terminal session to run the shell. - $data = pack('CNa*N4C', NET_SSH1_CMSG_REQUEST_PTY, strlen('vt100'), 'vt100', 24, 80, 0, 0, NET_SSH1_TTY_OP_END); + $data = pack('CNa*N4C', NET_SSH1_CMSG_REQUEST_PTY, strlen('vt100'), 'vt100', 24, 80, 0, 0, self::TTY_OP_END); if (!$this->_send_binary_packet($data)) { user_error('Error sending SSH_CMSG_REQUEST_PTY'); @@ -893,7 +860,7 @@ class Net_SSH1 if ($response === true) { return false; } - if ($response[NET_SSH1_RESPONSE_TYPE] != NET_SSH1_SMSG_SUCCESS) { + if ($response[self::RESPONSE_TYPE] != NET_SSH1_SMSG_SUCCESS) { user_error('Expected SSH_SMSG_SUCCESS'); return false; } @@ -905,7 +872,7 @@ class Net_SSH1 return false; } - $this->bitmap |= NET_SSH1_MASK_SHELL; + $this->bitmap |= self::MASK_SHELL; //stream_set_blocking($this->fsock, 0); @@ -915,9 +882,9 @@ class Net_SSH1 /** * Inputs a command into an interactive shell. * - * @see Net_SSH1::interactiveWrite() - * @param String $cmd - * @return Boolean + * @see self::interactiveWrite() + * @param string $cmd + * @return bool * @access public */ function write($cmd) @@ -928,30 +895,30 @@ class Net_SSH1 /** * Returns the output of an interactive shell when there's a match for $expect * - * $expect can take the form of a string literal or, if $mode == NET_SSH1_READ_REGEX, + * $expect can take the form of a string literal or, if $mode == self::READ__REGEX, * a regular expression. * - * @see Net_SSH1::write() - * @param String $expect - * @param Integer $mode - * @return Boolean + * @see self::write() + * @param string $expect + * @param int $mode + * @return bool * @access public */ - function read($expect, $mode = NET_SSH1_READ_SIMPLE) + function read($expect, $mode = self::READ__SIMPLE) { - if (!($this->bitmap & NET_SSH1_MASK_LOGIN)) { + if (!($this->bitmap & self::MASK_LOGIN)) { user_error('Operation disallowed prior to login()'); return false; } - if (!($this->bitmap & NET_SSH1_MASK_SHELL) && !$this->_initShell()) { + if (!($this->bitmap & self::MASK_SHELL) && !$this->_initShell()) { user_error('Unable to initiate an interactive shell session'); return false; } $match = $expect; while (true) { - if ($mode == NET_SSH1_READ_REGEX) { + if ($mode == self::READ__REGEX) { preg_match($expect, $this->interactiveBuffer, $matches); $match = isset($matches[0]) ? $matches[0] : ''; } @@ -964,26 +931,26 @@ class Net_SSH1 if ($response === true) { return $this->_string_shift($this->interactiveBuffer, strlen($this->interactiveBuffer)); } - $this->interactiveBuffer.= substr($response[NET_SSH1_RESPONSE_DATA], 4); + $this->interactiveBuffer.= substr($response[self::RESPONSE_DATA], 4); } } /** * Inputs a command into an interactive shell. * - * @see Net_SSH1::interactiveRead() - * @param String $cmd - * @return Boolean + * @see self::interactiveRead() + * @param string $cmd + * @return bool * @access public */ function interactiveWrite($cmd) { - if (!($this->bitmap & NET_SSH1_MASK_LOGIN)) { + if (!($this->bitmap & self::MASK_LOGIN)) { user_error('Operation disallowed prior to login()'); return false; } - if (!($this->bitmap & NET_SSH1_MASK_SHELL) && !$this->_initShell()) { + if (!($this->bitmap & self::MASK_SHELL) && !$this->_initShell()) { user_error('Unable to initiate an interactive shell session'); return false; } @@ -1007,18 +974,18 @@ class Net_SSH1 * does not support ANSI escape sequences in Win32 Console applications", so if you're a Windows user, * there's not going to be much recourse. * - * @see Net_SSH1::interactiveRead() - * @return String + * @see self::interactiveRead() + * @return string * @access public */ function interactiveRead() { - if (!($this->bitmap & NET_SSH1_MASK_LOGIN)) { + if (!($this->bitmap & self::MASK_LOGIN)) { user_error('Operation disallowed prior to login()'); return false; } - if (!($this->bitmap & NET_SSH1_MASK_SHELL) && !$this->_initShell()) { + if (!($this->bitmap & self::MASK_SHELL) && !$this->_initShell()) { user_error('Unable to initiate an interactive shell session'); return false; } @@ -1027,7 +994,7 @@ class Net_SSH1 $write = $except = null; if (stream_select($read, $write, $except, 0)) { $response = $this->_get_binary_packet(); - return substr($response[NET_SSH1_RESPONSE_DATA], 4); + return substr($response[self::RESPONSE_DATA], 4); } else { return ''; } @@ -1059,7 +1026,7 @@ class Net_SSH1 /** * Disconnect * - * @param String $msg + * @param string $msg * @access private */ function _disconnect($msg = 'Client Quit') @@ -1070,9 +1037,9 @@ class Net_SSH1 /* $response = $this->_get_binary_packet(); if ($response === true) { - $response = array(NET_SSH1_RESPONSE_TYPE => -1); + $response = array(self::RESPONSE_TYPE => -1); } - switch ($response[NET_SSH1_RESPONSE_TYPE]) { + switch ($response[self::RESPONSE_TYPE]) { case NET_SSH1_SMSG_EXITSTATUS: $data = pack('C', NET_SSH1_CMSG_EXIT_CONFIRMATION); break; @@ -1096,8 +1063,8 @@ class Net_SSH1 * Also, this function could be improved upon by adding detection for the following exploit: * http://www.securiteam.com/securitynews/5LP042K3FY.html * - * @see Net_SSH1::_send_binary_packet() - * @return Array + * @see self::_send_binary_packet() + * @return array * @access private */ function _get_binary_packet() @@ -1162,8 +1129,8 @@ class Net_SSH1 } return array( - NET_SSH1_RESPONSE_TYPE => $type, - NET_SSH1_RESPONSE_DATA => $data + self::RESPONSE_TYPE => $type, + self::RESPONSE_DATA => $data ); } @@ -1172,9 +1139,9 @@ class Net_SSH1 * * Returns true on success, false on failure. * - * @see Net_SSH1::_get_binary_packet() - * @param String $data - * @return Boolean + * @see self::_get_binary_packet() + * @param string $data + * @return bool * @access private */ function _send_binary_packet($data) @@ -1186,7 +1153,7 @@ class Net_SSH1 $length = strlen($data) + 4; - $padding = crypt_random_string(8 - ($length & 7)); + $padding = Random::string(8 - ($length & 7)); $orig = $data; $data = $padding . $data; @@ -1219,10 +1186,10 @@ class Net_SSH1 * we've reimplemented it. A more detailed discussion of the differences can be found after * $crc_lookup_table's initialization. * - * @see Net_SSH1::_get_binary_packet() - * @see Net_SSH1::_send_binary_packet() - * @param String $data - * @return Integer + * @see self::_get_binary_packet() + * @see self::_send_binary_packet() + * @param string $data + * @return int * @access private */ function _crc($data) @@ -1299,7 +1266,7 @@ class Net_SSH1 $crc = 0x00000000; $length = strlen($data); - for ($i=0;$i<$length;$i++) { + for ($i=0; $i<$length; $i++) { // We AND $crc >> 8 with 0x00FFFFFF because we want the eight newly added bits to all // be zero. PHP, unfortunately, doesn't always do this. 0x80000000 >> 8, as an example, // yields 0xFF800000 - not 0x00800000. The following link elaborates: @@ -1317,9 +1284,9 @@ class Net_SSH1 * * Inspired by array_shift * - * @param String $string - * @param optional Integer $index - * @return String + * @param string $string + * @param int $index + * @return string * @access private */ function _string_shift(&$string, $index = 1) @@ -1336,22 +1303,18 @@ class Net_SSH1 * should be a number with the property that gcd($e, ($p - 1) * ($q - 1)) == 1. Could just make anything that * calls this call modexp, instead, but I think this makes things clearer, maybe... * - * @see Net_SSH1::Net_SSH1() - * @param Math_BigInteger $m - * @param Array $key - * @return Math_BigInteger + * @see self::__construct() + * @param BigInteger $m + * @param array $key + * @return BigInteger * @access private */ function _rsa_crypt($m, $key) { /* - if (!class_exists('Crypt_RSA')) { - include_once 'Crypt/RSA.php'; - } - - $rsa = new Crypt_RSA(); - $rsa->loadKey($key, CRYPT_RSA_PUBLIC_FORMAT_RAW); - $rsa->setEncryptionMode(CRYPT_RSA_ENCRYPTION_PKCS1); + $rsa = new RSA(); + $rsa->loadKey($key, RSA::PUBLIC_FORMAT_RAW); + $rsa->setEncryptionMode(RSA::ENCRYPTION_PKCS1); return $rsa->encrypt($m); */ @@ -1372,13 +1335,13 @@ class Net_SSH1 $length = strlen($modulus) - strlen($m) - 3; $random = ''; while (strlen($random) != $length) { - $block = crypt_random_string($length - strlen($random)); + $block = Random::string($length - strlen($random)); $block = str_replace("\x00", '', $block); $random.= $block; } $temp = chr(0) . chr(2) . $random . chr(0) . $m; - $m = new Math_BigInteger($temp, 256); + $m = new BigInteger($temp, 256); $m = $m->modPow($key[0], $key[1]); return $m->toBytes(); @@ -1391,14 +1354,14 @@ class Net_SSH1 * named constants from it, using the value as the name of the constant and the index as the value of the constant. * If any of the constants that would be defined already exists, none of the constants will be defined. * - * @param Array $array + * @param array $array * @access private */ function _define_array() { $args = func_get_args(); foreach ($args as $arg) { - foreach ($arg as $key=>$value) { + foreach ($arg as $key => $value) { if (!defined($value)) { define($value, $key); } else { @@ -1411,10 +1374,10 @@ class Net_SSH1 /** * Returns a log of the packets that have been sent and received. * - * Returns a string if NET_SSH1_LOGGING == NET_SSH1_LOG_COMPLEX, an array if NET_SSH1_LOGGING == NET_SSH1_LOG_SIMPLE and false if !defined('NET_SSH1_LOGGING') + * Returns a string if NET_SSH1_LOGGING == self::LOG_COMPLEX, an array if NET_SSH1_LOGGING == self::LOG_SIMPLE and false if !defined('NET_SSH1_LOGGING') * * @access public - * @return String or Array + * @return array|false|string */ function getLog() { @@ -1423,10 +1386,10 @@ class Net_SSH1 } switch (NET_SSH1_LOGGING) { - case NET_SSH1_LOG_SIMPLE: + case self::LOG_SIMPLE: return $this->message_number_log; break; - case NET_SSH1_LOG_COMPLEX: + case self::LOG_COMPLEX: return $this->_format_log($this->message_log, $this->protocol_flags_log); break; default: @@ -1437,10 +1400,10 @@ class Net_SSH1 /** * Formats a log for printing * - * @param Array $message_log - * @param Array $message_number_log + * @param array $message_log + * @param array $message_number_log * @access private - * @return String + * @return string */ function _format_log($message_log, $message_number_log) { @@ -1473,9 +1436,9 @@ class Net_SSH1 * * For use with preg_replace_callback() * - * @param Array $matches + * @param array $matches * @access private - * @return String + * @return string */ function _format_log_helper($matches) { @@ -1488,8 +1451,8 @@ class Net_SSH1 * Returns, by default, the base-10 representation. If $raw_output is set to true, returns, instead, * the raw bytes. This behavior is similar to PHP's md5() function. * - * @param optional Boolean $raw_output - * @return String + * @param bool $raw_output + * @return string * @access public */ function getServerKeyPublicExponent($raw_output = false) @@ -1503,8 +1466,8 @@ class Net_SSH1 * Returns, by default, the base-10 representation. If $raw_output is set to true, returns, instead, * the raw bytes. This behavior is similar to PHP's md5() function. * - * @param optional Boolean $raw_output - * @return String + * @param bool $raw_output + * @return string * @access public */ function getServerKeyPublicModulus($raw_output = false) @@ -1518,8 +1481,8 @@ class Net_SSH1 * Returns, by default, the base-10 representation. If $raw_output is set to true, returns, instead, * the raw bytes. This behavior is similar to PHP's md5() function. * - * @param optional Boolean $raw_output - * @return String + * @param bool $raw_output + * @return string * @access public */ function getHostKeyPublicExponent($raw_output = false) @@ -1533,8 +1496,8 @@ class Net_SSH1 * Returns, by default, the base-10 representation. If $raw_output is set to true, returns, instead, * the raw bytes. This behavior is similar to PHP's md5() function. * - * @param optional Boolean $raw_output - * @return String + * @param bool $raw_output + * @return string * @access public */ function getHostKeyPublicModulus($raw_output = false) @@ -1547,10 +1510,10 @@ class Net_SSH1 * * Just because a cipher is supported by an SSH1 server doesn't mean it's supported by this library. If $raw_output * is set to true, returns, instead, an array of constants. ie. instead of array('Triple-DES in CBC mode'), you'll - * get array(NET_SSH1_CIPHER_3DES). + * get array(self::CIPHER_3DES). * - * @param optional Boolean $raw_output - * @return Array + * @param bool $raw_output + * @return array * @access public */ function getSupportedCiphers($raw_output = false) @@ -1563,10 +1526,10 @@ class Net_SSH1 * * Just because a cipher is supported by an SSH1 server doesn't mean it's supported by this library. If $raw_output * is set to true, returns, instead, an array of constants. ie. instead of array('password authentication'), you'll - * get array(NET_SSH1_AUTH_PASSWORD). + * get array(self::AUTH_PASSWORD). * - * @param optional Boolean $raw_output - * @return Array + * @param bool $raw_output + * @return array * @access public */ function getSupportedAuthentications($raw_output = false) @@ -1577,7 +1540,7 @@ class Net_SSH1 /** * Return the server identification. * - * @return String + * @return string * @access public */ function getServerIdentification() @@ -1590,23 +1553,23 @@ class Net_SSH1 * * Makes sure that only the last 1MB worth of packets will be logged * - * @param String $data + * @param string $data * @access private */ function _append_log($protocol_flags, $message) { switch (NET_SSH1_LOGGING) { // useful for benchmarks - case NET_SSH1_LOG_SIMPLE: + case self::LOG_SIMPLE: $this->protocol_flags_log[] = $protocol_flags; break; // the most useful log for SSH1 - case NET_SSH1_LOG_COMPLEX: + case self::LOG_COMPLEX: $this->protocol_flags_log[] = $protocol_flags; $this->_string_shift($message); $this->log_size+= strlen($message); $this->message_log[] = $message; - while ($this->log_size > NET_SSH1_LOG_MAX_SIZE) { + while ($this->log_size > self::LOG_MAX_SIZE) { $this->log_size-= strlen(array_shift($this->message_log)); array_shift($this->protocol_flags_log); } @@ -1614,19 +1577,19 @@ class Net_SSH1 // dump the output out realtime; packets may be interspersed with non packets, // passwords won't be filtered out and select other packets may not be correctly // identified - case NET_SSH1_LOG_REALTIME: + case self::LOG_REALTIME: echo "\r\n" . $this->_format_log(array($message), array($protocol_flags)) . "\r\n\r\n"; @flush(); @ob_flush(); break; - // basically the same thing as NET_SSH1_LOG_REALTIME with the caveat that NET_SSH1_LOG_REALTIME_FILE - // needs to be defined and that the resultant log file will be capped out at NET_SSH1_LOG_MAX_SIZE. + // basically the same thing as self::LOG_REALTIME with the caveat that self::LOG_REALTIME_FILE + // needs to be defined and that the resultant log file will be capped out at self::LOG_MAX_SIZE. // the earliest part of the log file is denoted by the first <<< START >>> and is not going to necessarily // at the beginning of the file - case NET_SSH1_LOG_REALTIME_FILE: + case self::LOG_REALTIME_FILE: if (!isset($this->realtime_log_file)) { // PHP doesn't seem to like using constants in fopen() - $filename = NET_SSH1_LOG_REALTIME_FILE; + $filename = self::LOG_REALTIME_FILE; $fp = fopen($filename, 'w'); $this->realtime_log_file = $fp; } @@ -1640,7 +1603,7 @@ class Net_SSH1 fseek($this->realtime_log_file, ftell($this->realtime_log_file) - strlen($temp)); } $this->realtime_log_size+= strlen($entry); - if ($this->realtime_log_size > NET_SSH1_LOG_MAX_SIZE) { + if ($this->realtime_log_size > self::LOG_MAX_SIZE) { fseek($this->realtime_log_file, 0); $this->realtime_log_size = strlen($entry); $this->realtime_log_wrap = true; diff --git a/securemail/vendor/phpseclib/phpseclib/phpseclib/Net/SSH2.php b/securemail/vendor/phpseclib/phpseclib/phpseclib/Net/SSH2.php index d6134562..11580755 100644 --- a/securemail/vendor/phpseclib/phpseclib/phpseclib/Net/SSH2.php +++ b/securemail/vendor/phpseclib/phpseclib/phpseclib/Net/SSH2.php @@ -3,14 +3,14 @@ /** * Pure-PHP implementation of SSHv2. * - * PHP versions 4 and 5 + * PHP version 5 * * Here are some examples of how to use this library: * * login('username', 'password')) { * exit('Login Failed'); * } @@ -22,14 +22,13 @@ * * * setPassword('whatever'); * $key->loadKey(file_get_contents('privatekey')); * - * $ssh = new Net_SSH2('www.domain.tld'); + * $ssh = new \phpseclib\Net\SSH2('www.domain.tld'); * if (!$ssh->login('username', $key)) { * exit('Login Failed'); * } @@ -40,120 +39,117 @@ * ?> * * - * LICENSE: Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in - * all copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN - * THE SOFTWARE. - * * @category Net - * @package Net_SSH2 + * @package SSH2 * @author Jim Wigginton * @copyright 2007 Jim Wigginton * @license http://www.opensource.org/licenses/mit-license.html MIT License * @link http://phpseclib.sourceforge.net */ -/**#@+ - * Execution Bitmap Masks - * - * @see Net_SSH2::bitmap - * @access private - */ -define('NET_SSH2_MASK_CONSTRUCTOR', 0x00000001); -define('NET_SSH2_MASK_CONNECTED', 0x00000002); -define('NET_SSH2_MASK_LOGIN_REQ', 0x00000004); -define('NET_SSH2_MASK_LOGIN', 0x00000008); -define('NET_SSH2_MASK_SHELL', 0x00000010); -define('NET_SSH2_MASK_WINDOW_ADJUST', 0x00000020); -/**#@-*/ +namespace phpseclib\Net; -/**#@+ - * Channel constants - * - * RFC4254 refers not to client and server channels but rather to sender and recipient channels. we don't refer - * to them in that way because RFC4254 toggles the meaning. the client sends a SSH_MSG_CHANNEL_OPEN message with - * a sender channel and the server sends a SSH_MSG_CHANNEL_OPEN_CONFIRMATION in response, with a sender and a - * recepient channel. at first glance, you might conclude that SSH_MSG_CHANNEL_OPEN_CONFIRMATION's sender channel - * would be the same thing as SSH_MSG_CHANNEL_OPEN's sender channel, but it's not, per this snipet: - * The 'recipient channel' is the channel number given in the original - * open request, and 'sender channel' is the channel number allocated by - * the other side. - * - * @see Net_SSH2::_send_channel_packet() - * @see Net_SSH2::_get_channel_packet() - * @access private - */ -define('NET_SSH2_CHANNEL_EXEC', 0); // PuTTy uses 0x100 -define('NET_SSH2_CHANNEL_SHELL', 1); -define('NET_SSH2_CHANNEL_SUBSYSTEM', 2); -/**#@-*/ - -/**#@+ - * @access public - * @see Net_SSH2::getLog() - */ -/** - * Returns the message numbers - */ -define('NET_SSH2_LOG_SIMPLE', 1); -/** - * Returns the message content - */ -define('NET_SSH2_LOG_COMPLEX', 2); -/** - * Outputs the content real-time - */ -define('NET_SSH2_LOG_REALTIME', 3); -/** - * Dumps the content real-time to a file - */ -define('NET_SSH2_LOG_REALTIME_FILE', 4); -/**#@-*/ - -/**#@+ - * @access public - * @see Net_SSH2::read() - */ -/** - * Returns when a string matching $expect exactly is found - */ -define('NET_SSH2_READ_SIMPLE', 1); -/** - * Returns when a string matching the regular expression $expect is found - */ -define('NET_SSH2_READ_REGEX', 2); -/** - * Make sure that the log never gets larger than this - */ -define('NET_SSH2_LOG_MAX_SIZE', 1024 * 1024); -/**#@-*/ +use phpseclib\Crypt\Base; +use phpseclib\Crypt\Blowfish; +use phpseclib\Crypt\Hash; +use phpseclib\Crypt\Random; +use phpseclib\Crypt\RC4; +use phpseclib\Crypt\Rijndael; +use phpseclib\Crypt\RSA; +use phpseclib\Crypt\TripleDES; +use phpseclib\Crypt\Twofish; +use phpseclib\Math\BigInteger; // Used to do Diffie-Hellman key exchange and DSA/RSA signature verification. +use phpseclib\System\SSH\Agent; /** * Pure-PHP implementation of SSHv2. * - * @package Net_SSH2 + * @package SSH2 * @author Jim Wigginton * @access public */ -class Net_SSH2 +class SSH2 { + /**#@+ + * Execution Bitmap Masks + * + * @see \phpseclib\Net\SSH2::bitmap + * @access private + */ + const MASK_CONSTRUCTOR = 0x00000001; + const MASK_CONNECTED = 0x00000002; + const MASK_LOGIN_REQ = 0x00000004; + const MASK_LOGIN = 0x00000008; + const MASK_SHELL = 0x00000010; + const MASK_WINDOW_ADJUST = 0x00000020; + /**#@-*/ + + /**#@+ + * Channel constants + * + * RFC4254 refers not to client and server channels but rather to sender and recipient channels. we don't refer + * to them in that way because RFC4254 toggles the meaning. the client sends a SSH_MSG_CHANNEL_OPEN message with + * a sender channel and the server sends a SSH_MSG_CHANNEL_OPEN_CONFIRMATION in response, with a sender and a + * recepient channel. at first glance, you might conclude that SSH_MSG_CHANNEL_OPEN_CONFIRMATION's sender channel + * would be the same thing as SSH_MSG_CHANNEL_OPEN's sender channel, but it's not, per this snipet: + * The 'recipient channel' is the channel number given in the original + * open request, and 'sender channel' is the channel number allocated by + * the other side. + * + * @see \phpseclib\Net\SSH2::_send_channel_packet() + * @see \phpseclib\Net\SSH2::_get_channel_packet() + * @access private + */ + const CHANNEL_EXEC = 0; // PuTTy uses 0x100 + const CHANNEL_SHELL = 1; + const CHANNEL_SUBSYSTEM = 2; + const CHANNEL_AGENT_FORWARD = 3; + /**#@-*/ + + /**#@+ + * @access public + * @see \phpseclib\Net\SSH2::getLog() + */ + /** + * Returns the message numbers + */ + const LOG_SIMPLE = 1; + /** + * Returns the message content + */ + const LOG_COMPLEX = 2; + /** + * Outputs the content real-time + */ + const LOG_REALTIME = 3; + /** + * Dumps the content real-time to a file + */ + const LOG_REALTIME_FILE = 4; + /**#@-*/ + + /**#@+ + * @access public + * @see \phpseclib\Net\SSH2::read() + */ + /** + * Returns when a string matching $expect exactly is found + */ + const READ_SIMPLE = 1; + /** + * Returns when a string matching the regular expression $expect is found + */ + const READ_REGEX = 2; + /** + * Make sure that the log never gets larger than this + */ + const LOG_MAX_SIZE = 1048576; // 1024 * 1024 + /**#@-*/ + /** * The SSH identifier * - * @var String + * @var string * @access private */ var $identifier; @@ -161,7 +157,7 @@ class Net_SSH2 /** * The Socket Object * - * @var Object + * @var object * @access private */ var $fsock; @@ -172,7 +168,7 @@ class Net_SSH2 * The bits that are set represent functions that have been called already. This is used to determine * if a requisite function has been successfully executed. If not, an error should be thrown. * - * @var Integer + * @var int * @access private */ var $bitmap = 0; @@ -180,9 +176,9 @@ class Net_SSH2 /** * Error information * - * @see Net_SSH2::getErrors() - * @see Net_SSH2::getLastError() - * @var String + * @see self::getErrors() + * @see self::getLastError() + * @var string * @access private */ var $errors = array(); @@ -190,8 +186,8 @@ class Net_SSH2 /** * Server Identifier * - * @see Net_SSH2::getServerIdentification() - * @var mixed false or Array + * @see self::getServerIdentification() + * @var array|false * @access private */ var $server_identifier = false; @@ -199,17 +195,44 @@ class Net_SSH2 /** * Key Exchange Algorithms * - * @see Net_SSH2::getKexAlgorithims() - * @var mixed false or Array + * @see self::getKexAlgorithims() + * @var array|false * @access private */ var $kex_algorithms = false; + /** + * Minimum Diffie-Hellman Group Bit Size in RFC 4419 Key Exchange Methods + * + * @see self::_key_exchange() + * @var int + * @access private + */ + var $kex_dh_group_size_min = 1536; + + /** + * Preferred Diffie-Hellman Group Bit Size in RFC 4419 Key Exchange Methods + * + * @see self::_key_exchange() + * @var int + * @access private + */ + var $kex_dh_group_size_preferred = 2048; + + /** + * Maximum Diffie-Hellman Group Bit Size in RFC 4419 Key Exchange Methods + * + * @see self::_key_exchange() + * @var int + * @access private + */ + var $kex_dh_group_size_max = 4096; + /** * Server Host Key Algorithms * - * @see Net_SSH2::getServerHostKeyAlgorithms() - * @var mixed false or Array + * @see self::getServerHostKeyAlgorithms() + * @var array|false * @access private */ var $server_host_key_algorithms = false; @@ -217,8 +240,8 @@ class Net_SSH2 /** * Encryption Algorithms: Client to Server * - * @see Net_SSH2::getEncryptionAlgorithmsClient2Server() - * @var mixed false or Array + * @see self::getEncryptionAlgorithmsClient2Server() + * @var array|false * @access private */ var $encryption_algorithms_client_to_server = false; @@ -226,8 +249,8 @@ class Net_SSH2 /** * Encryption Algorithms: Server to Client * - * @see Net_SSH2::getEncryptionAlgorithmsServer2Client() - * @var mixed false or Array + * @see self::getEncryptionAlgorithmsServer2Client() + * @var array|false * @access private */ var $encryption_algorithms_server_to_client = false; @@ -235,8 +258,8 @@ class Net_SSH2 /** * MAC Algorithms: Client to Server * - * @see Net_SSH2::getMACAlgorithmsClient2Server() - * @var mixed false or Array + * @see self::getMACAlgorithmsClient2Server() + * @var array|false * @access private */ var $mac_algorithms_client_to_server = false; @@ -244,8 +267,8 @@ class Net_SSH2 /** * MAC Algorithms: Server to Client * - * @see Net_SSH2::getMACAlgorithmsServer2Client() - * @var mixed false or Array + * @see self::getMACAlgorithmsServer2Client() + * @var array|false * @access private */ var $mac_algorithms_server_to_client = false; @@ -253,8 +276,8 @@ class Net_SSH2 /** * Compression Algorithms: Client to Server * - * @see Net_SSH2::getCompressionAlgorithmsClient2Server() - * @var mixed false or Array + * @see self::getCompressionAlgorithmsClient2Server() + * @var array|false * @access private */ var $compression_algorithms_client_to_server = false; @@ -262,8 +285,8 @@ class Net_SSH2 /** * Compression Algorithms: Server to Client * - * @see Net_SSH2::getCompressionAlgorithmsServer2Client() - * @var mixed false or Array + * @see self::getCompressionAlgorithmsServer2Client() + * @var array|false * @access private */ var $compression_algorithms_server_to_client = false; @@ -271,8 +294,8 @@ class Net_SSH2 /** * Languages: Server to Client * - * @see Net_SSH2::getLanguagesServer2Client() - * @var mixed false or Array + * @see self::getLanguagesServer2Client() + * @var array|false * @access private */ var $languages_server_to_client = false; @@ -280,8 +303,8 @@ class Net_SSH2 /** * Languages: Client to Server * - * @see Net_SSH2::getLanguagesClient2Server() - * @var mixed false or Array + * @see self::getLanguagesClient2Server() + * @var array|false * @access private */ var $languages_client_to_server = false; @@ -296,9 +319,9 @@ class Net_SSH2 * * -- http://tools.ietf.org/html/rfc4253#section-6 * - * @see Net_SSH2::Net_SSH2() - * @see Net_SSH2::_send_binary_packet() - * @var Integer + * @see self::__construct() + * @see self::_send_binary_packet() + * @var int * @access private */ var $encrypt_block_size = 8; @@ -306,9 +329,9 @@ class Net_SSH2 /** * Block Size for Client to Server Encryption * - * @see Net_SSH2::Net_SSH2() - * @see Net_SSH2::_get_binary_packet() - * @var Integer + * @see self::__construct() + * @see self::_get_binary_packet() + * @var int * @access private */ var $decrypt_block_size = 8; @@ -316,8 +339,8 @@ class Net_SSH2 /** * Server to Client Encryption Object * - * @see Net_SSH2::_get_binary_packet() - * @var Object + * @see self::_get_binary_packet() + * @var object * @access private */ var $decrypt = false; @@ -325,8 +348,8 @@ class Net_SSH2 /** * Client to Server Encryption Object * - * @see Net_SSH2::_send_binary_packet() - * @var Object + * @see self::_send_binary_packet() + * @var object * @access private */ var $encrypt = false; @@ -334,8 +357,8 @@ class Net_SSH2 /** * Client to Server HMAC Object * - * @see Net_SSH2::_send_binary_packet() - * @var Object + * @see self::_send_binary_packet() + * @var object * @access private */ var $hmac_create = false; @@ -343,8 +366,8 @@ class Net_SSH2 /** * Server to Client HMAC Object * - * @see Net_SSH2::_get_binary_packet() - * @var Object + * @see self::_get_binary_packet() + * @var object * @access private */ var $hmac_check = false; @@ -356,8 +379,8 @@ class Net_SSH2 * For the client to server side, the HMAC object will make the HMAC as long as it needs to be. All we need to do is * append it. * - * @see Net_SSH2::_get_binary_packet() - * @var Integer + * @see self::_get_binary_packet() + * @var int * @access private */ var $hmac_size = false; @@ -365,14 +388,14 @@ class Net_SSH2 /** * Server Public Host Key * - * @see Net_SSH2::getServerPublicHostKey() - * @var String + * @see self::getServerPublicHostKey() + * @var string * @access private */ var $server_public_host_key; /** - * Session identifer + * Session identifier * * "The exchange hash H from the first key exchange is additionally * used as the session identifier, which is a unique identifier for @@ -380,8 +403,8 @@ class Net_SSH2 * * -- http://tools.ietf.org/html/rfc4253#section-7.2 * - * @see Net_SSH2::_key_exchange() - * @var String + * @see self::_key_exchange() + * @var string * @access private */ var $session_id = false; @@ -391,8 +414,8 @@ class Net_SSH2 * * The current exchange hash * - * @see Net_SSH2::_key_exchange() - * @var String + * @see self::_key_exchange() + * @var string * @access private */ var $exchange_hash = false; @@ -400,8 +423,8 @@ class Net_SSH2 /** * Message Numbers * - * @see Net_SSH2::Net_SSH2() - * @var Array + * @see self::__construct() + * @var array * @access private */ var $message_numbers = array(); @@ -409,8 +432,8 @@ class Net_SSH2 /** * Disconnection Message 'reason codes' defined in RFC4253 * - * @see Net_SSH2::Net_SSH2() - * @var Array + * @see self::__construct() + * @var array * @access private */ var $disconnect_reasons = array(); @@ -418,8 +441,8 @@ class Net_SSH2 /** * SSH_MSG_CHANNEL_OPEN_FAILURE 'reason codes', defined in RFC4254 * - * @see Net_SSH2::Net_SSH2() - * @var Array + * @see self::__construct() + * @var array * @access private */ var $channel_open_failure_reasons = array(); @@ -428,8 +451,8 @@ class Net_SSH2 * Terminal Modes * * @link http://tools.ietf.org/html/rfc4254#section-8 - * @see Net_SSH2::Net_SSH2() - * @var Array + * @see self::__construct() + * @var array * @access private */ var $terminal_modes = array(); @@ -438,8 +461,8 @@ class Net_SSH2 * SSH_MSG_CHANNEL_EXTENDED_DATA's data_type_codes * * @link http://tools.ietf.org/html/rfc4254#section-5.2 - * @see Net_SSH2::Net_SSH2() - * @var Array + * @see self::__construct() + * @var array * @access private */ var $channel_extended_data_type_codes = array(); @@ -449,8 +472,8 @@ class Net_SSH2 * * See 'Section 6.4. Data Integrity' of rfc4253 for more info. * - * @see Net_SSH2::_send_binary_packet() - * @var Integer + * @see self::_send_binary_packet() + * @var int * @access private */ var $send_seq_no = 0; @@ -460,8 +483,8 @@ class Net_SSH2 * * See 'Section 6.4. Data Integrity' of rfc4253 for more info. * - * @see Net_SSH2::_get_binary_packet() - * @var Integer + * @see self::_get_binary_packet() + * @var int * @access private */ var $get_seq_no = 0; @@ -471,9 +494,9 @@ class Net_SSH2 * * Maps client channels to server channels * - * @see Net_SSH2::_get_channel_packet() - * @see Net_SSH2::exec() - * @var Array + * @see self::_get_channel_packet() + * @see self::exec() + * @var array * @access private */ var $server_channels = array(); @@ -484,9 +507,9 @@ class Net_SSH2 * If a client requests a packet from one channel but receives two packets from another those packets should * be placed in a buffer * - * @see Net_SSH2::_get_channel_packet() - * @see Net_SSH2::exec() - * @var Array + * @see self::_get_channel_packet() + * @see self::exec() + * @var array * @access private */ var $channel_buffers = array(); @@ -496,8 +519,8 @@ class Net_SSH2 * * Contains the type of the last sent message * - * @see Net_SSH2::_get_channel_packet() - * @var Array + * @see self::_get_channel_packet() + * @var array * @access private */ var $channel_status = array(); @@ -507,8 +530,8 @@ class Net_SSH2 * * Maximum packet size indexed by channel * - * @see Net_SSH2::_send_channel_packet() - * @var Array + * @see self::_send_channel_packet() + * @var array * @access private */ var $packet_size_client_to_server = array(); @@ -516,8 +539,8 @@ class Net_SSH2 /** * Message Number Log * - * @see Net_SSH2::getLog() - * @var Array + * @see self::getLog() + * @var array * @access private */ var $message_number_log = array(); @@ -525,8 +548,8 @@ class Net_SSH2 /** * Message Log * - * @see Net_SSH2::getLog() - * @var Array + * @see self::getLog() + * @var array * @access private */ var $message_log = array(); @@ -536,9 +559,9 @@ class Net_SSH2 * * Bytes the other party can send before it must wait for the window to be adjusted (0x7FFFFFFF = 2GB) * - * @var Integer - * @see Net_SSH2::_send_channel_packet() - * @see Net_SSH2::exec() + * @var int + * @see self::_send_channel_packet() + * @see self::exec() * @access private */ var $window_size = 0x7FFFFFFF; @@ -548,8 +571,8 @@ class Net_SSH2 * * Window size indexed by channel * - * @see Net_SSH2::_send_channel_packet() - * @var Array + * @see self::_send_channel_packet() + * @var array * @access private */ var $window_size_server_to_client = array(); @@ -559,8 +582,8 @@ class Net_SSH2 * * Window size indexed by channel * - * @see Net_SSH2::_get_channel_packet() - * @var Array + * @see self::_get_channel_packet() + * @var array * @access private */ var $window_size_client_to_server = array(); @@ -570,8 +593,8 @@ class Net_SSH2 * * Verified against $this->session_id * - * @see Net_SSH2::getServerPublicHostKey() - * @var String + * @see self::getServerPublicHostKey() + * @var string * @access private */ var $signature = ''; @@ -581,8 +604,8 @@ class Net_SSH2 * * ssh-rsa or ssh-dss. * - * @see Net_SSH2::getServerPublicHostKey() - * @var String + * @see self::getServerPublicHostKey() + * @var string * @access private */ var $signature_format = ''; @@ -590,8 +613,8 @@ class Net_SSH2 /** * Interactive Buffer * - * @see Net_SSH2::read() - * @var Array + * @see self::read() + * @var array * @access private */ var $interactiveBuffer = ''; @@ -599,11 +622,11 @@ class Net_SSH2 /** * Current log size * - * Should never exceed NET_SSH2_LOG_MAX_SIZE + * Should never exceed self::LOG_MAX_SIZE * - * @see Net_SSH2::_send_binary_packet() - * @see Net_SSH2::_get_binary_packet() - * @var Integer + * @see self::_send_binary_packet() + * @see self::_get_binary_packet() + * @var int * @access private */ var $log_size; @@ -611,7 +634,7 @@ class Net_SSH2 /** * Timeout * - * @see Net_SSH2::setTimeout() + * @see self::setTimeout() * @access private */ var $timeout; @@ -619,7 +642,7 @@ class Net_SSH2 /** * Current Timeout * - * @see Net_SSH2::_get_channel_packet() + * @see self::_get_channel_packet() * @access private */ var $curTimeout; @@ -627,8 +650,8 @@ class Net_SSH2 /** * Real-time log file pointer * - * @see Net_SSH2::_append_log() - * @var Resource + * @see self::_append_log() + * @var resource * @access private */ var $realtime_log_file; @@ -636,8 +659,8 @@ class Net_SSH2 /** * Real-time log file size * - * @see Net_SSH2::_append_log() - * @var Integer + * @see self::_append_log() + * @var int * @access private */ var $realtime_log_size; @@ -645,8 +668,8 @@ class Net_SSH2 /** * Has the signature been validated? * - * @see Net_SSH2::getServerPublicHostKey() - * @var Boolean + * @see self::getServerPublicHostKey() + * @var bool * @access private */ var $signature_validated = false; @@ -654,7 +677,7 @@ class Net_SSH2 /** * Real-time log file wrap boolean * - * @see Net_SSH2::_append_log() + * @see self::_append_log() * @access private */ var $realtime_log_wrap; @@ -662,7 +685,7 @@ class Net_SSH2 /** * Flag to suppress stderr from output * - * @see Net_SSH2::enableQuietMode() + * @see self::enableQuietMode() * @access private */ var $quiet_mode = false; @@ -670,7 +693,7 @@ class Net_SSH2 /** * Time of first network activity * - * @var Integer + * @var int * @access private */ var $last_packet; @@ -678,7 +701,7 @@ class Net_SSH2 /** * Exit status returned from ssh if any * - * @var Integer + * @var int * @access private */ var $exit_status; @@ -686,8 +709,8 @@ class Net_SSH2 /** * Flag to request a PTY when using exec() * - * @var Boolean - * @see Net_SSH2::enablePTY() + * @var bool + * @see self::enablePTY() * @access private */ var $request_pty = false; @@ -695,7 +718,7 @@ class Net_SSH2 /** * Flag set while exec() is running when using enablePTY() * - * @var Boolean + * @var bool * @access private */ var $in_request_pty_exec = false; @@ -703,7 +726,7 @@ class Net_SSH2 /** * Flag set after startSubsystem() is called * - * @var Boolean + * @var bool * @access private */ var $in_subsystem; @@ -711,7 +734,7 @@ class Net_SSH2 /** * Contents of stdError * - * @var String + * @var string * @access private */ var $stdErrorLog; @@ -719,8 +742,8 @@ class Net_SSH2 /** * The Last Interactive Response * - * @see Net_SSH2::_keyboard_interactive_process() - * @var String + * @see self::_keyboard_interactive_process() + * @var string * @access private */ var $last_interactive_response = ''; @@ -728,8 +751,8 @@ class Net_SSH2 /** * Keyboard Interactive Request / Responses * - * @see Net_SSH2::_keyboard_interactive_process() - * @var Array + * @see self::_keyboard_interactive_process() + * @var array * @access private */ var $keyboard_requests_responses = array(); @@ -740,9 +763,9 @@ class Net_SSH2 * Quoting from the RFC, "in some jurisdictions, sending a warning message before * authentication may be relevant for getting legal protection." * - * @see Net_SSH2::_filter() - * @see Net_SSH2::getBannerMessage() - * @var String + * @see self::_filter() + * @see self::getBannerMessage() + * @var string * @access private */ var $banner_message = ''; @@ -750,8 +773,8 @@ class Net_SSH2 /** * Did read() timeout or return normally? * - * @see Net_SSH2::isTimeout() - * @var Boolean + * @see self::isTimeout() + * @var bool * @access private */ var $is_timeout = false; @@ -759,8 +782,8 @@ class Net_SSH2 /** * Log Boundary * - * @see Net_SSH2::_format_log() - * @var String + * @see self::_format_log() + * @var string * @access private */ var $log_boundary = ':'; @@ -768,8 +791,8 @@ class Net_SSH2 /** * Log Long Width * - * @see Net_SSH2::_format_log() - * @var Integer + * @see self::_format_log() + * @var int * @access private */ var $log_long_width = 65; @@ -777,8 +800,8 @@ class Net_SSH2 /** * Log Short Width * - * @see Net_SSH2::_format_log() - * @var Integer + * @see self::_format_log() + * @var int * @access private */ var $log_short_width = 16; @@ -786,9 +809,9 @@ class Net_SSH2 /** * Hostname * - * @see Net_SSH2::Net_SSH2() - * @see Net_SSH2::_connect() - * @var String + * @see self::__construct() + * @see self::_connect() + * @var string * @access private */ var $host; @@ -796,35 +819,20 @@ class Net_SSH2 /** * Port Number * - * @see Net_SSH2::Net_SSH2() - * @see Net_SSH2::_connect() - * @var Integer + * @see self::__construct() + * @see self::_connect() + * @var int * @access private */ var $port; - /** - * Timeout for initial connection - * - * Set by the constructor call. Calling setTimeout() is optional. If it's not called functions like - * exec() won't timeout unless some PHP setting forces it too. The timeout specified in the constructor, - * however, is non-optional. There will be a timeout, whether or not you set it. If you don't it'll be - * 10 seconds. It is used by fsockopen() and the initial stream_select in that function. - * - * @see Net_SSH2::Net_SSH2() - * @see Net_SSH2::_connect() - * @var Integer - * @access private - */ - var $connectionTimeout; - /** * Number of columns for terminal window size * - * @see Net_SSH2::getWindowColumns() - * @see Net_SSH2::setWindowColumns() - * @see Net_SSH2::setWindowSize() - * @var Integer + * @see self::getWindowColumns() + * @see self::setWindowColumns() + * @see self::setWindowSize() + * @var int * @access private */ var $windowColumns = 80; @@ -832,40 +840,46 @@ class Net_SSH2 /** * Number of columns for terminal window size * - * @see Net_SSH2::getWindowRows() - * @see Net_SSH2::setWindowRows() - * @see Net_SSH2::setWindowSize() - * @var Integer + * @see self::getWindowRows() + * @see self::setWindowRows() + * @see self::setWindowSize() + * @var int * @access private */ var $windowRows = 24; + /** + * Crypto Engine + * + * @see self::setCryptoEngine() + * @see self::_key_exchange() + * @var int + * @access private + */ + var $crypto_engine = false; + + /** + * A System_SSH_Agent for use in the SSH2 Agent Forwarding scenario + * + * @var System_SSH_Agent + * @access private + */ + var $agent; + /** * Default Constructor. * - * @param String $host - * @param optional Integer $port - * @param optional Integer $timeout - * @see Net_SSH2::login() - * @return Net_SSH2 + * $host can either be a string, representing the host, or a stream resource. + * + * @param mixed $host + * @param int $port + * @param int $timeout + * @see self::login() + * @return \phpseclib\Net\SSH2 * @access public */ - function Net_SSH2($host, $port = 22, $timeout = 10) + function __construct($host, $port = 22, $timeout = 10) { - // Include Math_BigInteger - // Used to do Diffie-Hellman key exchange and DSA/RSA signature verification. - if (!class_exists('Math_BigInteger')) { - include_once 'Math/BigInteger.php'; - } - - if (!function_exists('crypt_random_string')) { - include_once 'Crypt/Random.php'; - } - - if (!class_exists('Crypt_Hash')) { - include_once 'Crypt/Hash.php'; - } - $this->message_numbers = array( 1 => 'NET_SSH2_MSG_DISCONNECT', 2 => 'NET_SSH2_MSG_IGNORE', @@ -933,59 +947,78 @@ class Net_SSH2 array(60 => 'NET_SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ'), array(60 => 'NET_SSH2_MSG_USERAUTH_PK_OK'), array(60 => 'NET_SSH2_MSG_USERAUTH_INFO_REQUEST', - 61 => 'NET_SSH2_MSG_USERAUTH_INFO_RESPONSE') + 61 => 'NET_SSH2_MSG_USERAUTH_INFO_RESPONSE'), + // RFC 4419 - diffie-hellman-group-exchange-sha{1,256} + array(30 => 'NET_SSH2_MSG_KEXDH_GEX_REQUEST_OLD', + 31 => 'NET_SSH2_MSG_KEXDH_GEX_GROUP', + 32 => 'NET_SSH2_MSG_KEXDH_GEX_INIT', + 33 => 'NET_SSH2_MSG_KEXDH_GEX_REPLY', + 34 => 'NET_SSH2_MSG_KEXDH_GEX_REQUEST'), + // RFC 5656 - Elliptic Curves (for curve25519-sha256@libssh.org) + array(30 => 'NET_SSH2_MSG_KEX_ECDH_INIT', + 31 => 'NET_SSH2_MSG_KEX_ECDH_REPLY') ); - $this->host = $host; - $this->port = $port; - $this->connectionTimeout = $timeout; + if (is_resource($host)) { + $this->fsock = $host; + return; + } + + if (is_string($host)) { + $this->host = $host; + $this->port = $port; + $this->timeout = $timeout; + } + } + + /** + * Set Crypto Engine Mode + * + * Possible $engine values: + * CRYPT_MODE_INTERNAL, CRYPT_MODE_MCRYPT + * + * @param int $engine + * @access private + */ + function setCryptoEngine($engine) + { + $this->crypto_engine = $engine; } /** * Connect to an SSHv2 server * - * @return Boolean + * @return bool * @access private */ function _connect() { - if ($this->bitmap & NET_SSH2_MASK_CONSTRUCTOR) { + if ($this->bitmap & self::MASK_CONSTRUCTOR) { return false; } - $this->bitmap |= NET_SSH2_MASK_CONSTRUCTOR; + $this->bitmap |= self::MASK_CONSTRUCTOR; - $timeout = $this->connectionTimeout; - $host = $this->host . ':' . $this->port; + $this->curTimeout = $this->timeout; - $this->last_packet = strtok(microtime(), ' ') + strtok(''); // == microtime(true) in PHP5 + $this->last_packet = microtime(true); - $start = strtok(microtime(), ' ') + strtok(''); // http://php.net/microtime#61838 - $this->fsock = @fsockopen($this->host, $this->port, $errno, $errstr, $timeout); - if (!$this->fsock) { - user_error(rtrim("Cannot connect to $host. Error $errno. $errstr")); - return false; - } - $elapsed = strtok(microtime(), ' ') + strtok('') - $start; + if (!is_resource($this->fsock)) { + $start = microtime(true); + $this->fsock = @fsockopen($this->host, $this->port, $errno, $errstr, $this->curTimeout); + if (!$this->fsock) { + $host = $this->host . ':' . $this->port; + user_error(rtrim("Cannot connect to $host. Error $errno. $errstr")); + return false; + } + $elapsed = microtime(true) - $start; - $timeout-= $elapsed; + $this->curTimeout-= $elapsed; - if ($timeout <= 0) { - user_error("Cannot connect to $host. Timeout error"); - return false; - } - - $read = array($this->fsock); - $write = $except = null; - - $sec = floor($timeout); - $usec = 1000000 * ($timeout - $sec); - - // on windows this returns a "Warning: Invalid CRT parameters detected" error - // the !count() is done as a workaround for - if (!@stream_select($read, $write, $except, $sec, $usec) && !count($read)) { - user_error("Cannot connect to $host. Banner timeout"); - return false; + if ($this->curTimeout <= 0) { + $this->is_timeout = true; + return false; + } } /* According to the SSH2 specs, @@ -995,14 +1028,51 @@ class Net_SSH2 Feed. Such lines MUST NOT begin with "SSH-", and SHOULD be encoded in ISO-10646 UTF-8 [RFC3629] (language is not specified). Clients MUST be able to process such lines." */ - $temp = ''; - $extra = ''; - while (!feof($this->fsock) && !preg_match('#^SSH-(\d\.\d+)#', $temp, $matches)) { - if (substr($temp, -2) == "\r\n") { - $extra.= $temp; - $temp = ''; + $data = ''; + while (!feof($this->fsock) && !preg_match('#(.*)^(SSH-(\d\.\d+).*)#ms', $data, $matches)) { + $line = ''; + while (true) { + if ($this->curTimeout) { + if ($this->curTimeout < 0) { + $this->is_timeout = true; + return false; + } + $read = array($this->fsock); + $write = $except = null; + $start = microtime(true); + $sec = floor($this->curTimeout); + $usec = 1000000 * ($this->curTimeout - $sec); + // on windows this returns a "Warning: Invalid CRT parameters detected" error + // the !count() is done as a workaround for + if (!@stream_select($read, $write, $except, $sec, $usec) && !count($read)) { + $this->is_timeout = true; + return false; + } + $elapsed = microtime(true) - $start; + $this->curTimeout-= $elapsed; + } + + $temp = stream_get_line($this->fsock, 255, "\n"); + if (strlen($temp) == 255) { + continue; + } + + $line.= "$temp\n"; + + // quoting RFC4253, "Implementers who wish to maintain + // compatibility with older, undocumented versions of this protocol may + // want to process the identification string without expecting the + // presence of the carriage return character for reasons described in + // Section 5 of this document." + + //if (substr($line, -2) == "\r\n") { + // break; + //} + + break; } - $temp.= fgets($this->fsock, 255); + + $data.= $line; } if (feof($this->fsock)) { @@ -1010,20 +1080,22 @@ class Net_SSH2 return false; } + $extra = $matches[1]; + $this->identifier = $this->_generate_identifier(); if (defined('NET_SSH2_LOGGING')) { - $this->_append_log('<-', $extra . $temp); + $this->_append_log('<-', $matches[0]); $this->_append_log('->', $this->identifier . "\r\n"); } $this->server_identifier = trim($temp, "\r\n"); if (strlen($extra)) { - $this->errors[] = utf8_decode($extra); + $this->errors[] = utf8_decode($data); } - if ($matches[1] != '1.99' && $matches[1] != '2.0') { - user_error("Cannot connect to SSH $matches[1] servers"); + if ($matches[3] != '1.99' && $matches[3] != '2.0') { + user_error("Cannot connect to SSH $matches[3] servers"); return false; } @@ -1044,7 +1116,7 @@ class Net_SSH2 return false; } - $this->bitmap|= NET_SSH2_MASK_CONNECTED; + $this->bitmap|= self::MASK_CONNECTED; return true; } @@ -1055,14 +1127,20 @@ class Net_SSH2 * You should overwrite this method in your own class if you want to use another identifier * * @access protected - * @return String + * @return string */ function _generate_identifier() { - $identifier = 'SSH-2.0-phpseclib_0.3'; + $identifier = 'SSH-2.0-phpseclib_2.0'; $ext = array(); - if (extension_loaded('mcrypt')) { + if (extension_loaded('libsodium')) { + $ext[] = 'libsodium'; + } + + if (extension_loaded('openssl')) { + $ext[] = 'openssl'; + } elseif (extension_loaded('mcrypt')) { $ext[] = 'mcrypt'; } @@ -1082,92 +1160,113 @@ class Net_SSH2 /** * Key Exchange * - * @param String $kexinit_payload_server + * @param string $kexinit_payload_server * @access private */ function _key_exchange($kexinit_payload_server) { - static $kex_algorithms = array( - 'diffie-hellman-group1-sha1', // REQUIRED - 'diffie-hellman-group14-sha1' // REQUIRED - ); + $kex_algorithms = array( + // Elliptic Curve Diffie-Hellman Key Agreement (ECDH) using + // Curve25519. See doc/curve25519-sha256@libssh.org.txt in the + // libssh repository for more information. + 'curve25519-sha256@libssh.org', - static $server_host_key_algorithms = array( + // Diffie-Hellman Key Agreement (DH) using integer modulo prime + // groups. + 'diffie-hellman-group1-sha1', // REQUIRED + 'diffie-hellman-group14-sha1', // REQUIRED + 'diffie-hellman-group-exchange-sha1', // RFC 4419 + 'diffie-hellman-group-exchange-sha256', // RFC 4419 + ); + if (!function_exists('\\Sodium\\library_version_major')) { + $kex_algorithms = array_diff( + $kex_algorithms, + array('curve25519-sha256@libssh.org') + ); + } + + $server_host_key_algorithms = array( 'ssh-rsa', // RECOMMENDED sign Raw RSA Key 'ssh-dss' // REQUIRED sign Raw DSS Key ); - static $encryption_algorithms = false; - if ($encryption_algorithms === false) { - $encryption_algorithms = array( - // from : - 'arcfour256', - 'arcfour128', + $encryption_algorithms = array( + // from : + 'arcfour256', + 'arcfour128', - //'arcfour', // OPTIONAL the ARCFOUR stream cipher with a 128-bit key + //'arcfour', // OPTIONAL the ARCFOUR stream cipher with a 128-bit key - // CTR modes from : - 'aes128-ctr', // RECOMMENDED AES (Rijndael) in SDCTR mode, with 128-bit key - 'aes192-ctr', // RECOMMENDED AES with 192-bit key - 'aes256-ctr', // RECOMMENDED AES with 256-bit key + // CTR modes from : + 'aes128-ctr', // RECOMMENDED AES (Rijndael) in SDCTR mode, with 128-bit key + 'aes192-ctr', // RECOMMENDED AES with 192-bit key + 'aes256-ctr', // RECOMMENDED AES with 256-bit key - 'twofish128-ctr', // OPTIONAL Twofish in SDCTR mode, with 128-bit key - 'twofish192-ctr', // OPTIONAL Twofish with 192-bit key - 'twofish256-ctr', // OPTIONAL Twofish with 256-bit key + 'twofish128-ctr', // OPTIONAL Twofish in SDCTR mode, with 128-bit key + 'twofish192-ctr', // OPTIONAL Twofish with 192-bit key + 'twofish256-ctr', // OPTIONAL Twofish with 256-bit key - 'aes128-cbc', // RECOMMENDED AES with a 128-bit key - 'aes192-cbc', // OPTIONAL AES with a 192-bit key - 'aes256-cbc', // OPTIONAL AES in CBC mode, with a 256-bit key + 'aes128-cbc', // RECOMMENDED AES with a 128-bit key + 'aes192-cbc', // OPTIONAL AES with a 192-bit key + 'aes256-cbc', // OPTIONAL AES in CBC mode, with a 256-bit key - 'twofish128-cbc', // OPTIONAL Twofish with a 128-bit key - 'twofish192-cbc', // OPTIONAL Twofish with a 192-bit key - 'twofish256-cbc', - 'twofish-cbc', // OPTIONAL alias for "twofish256-cbc" - // (this is being retained for historical reasons) + 'twofish128-cbc', // OPTIONAL Twofish with a 128-bit key + 'twofish192-cbc', // OPTIONAL Twofish with a 192-bit key + 'twofish256-cbc', + 'twofish-cbc', // OPTIONAL alias for "twofish256-cbc" + // (this is being retained for historical reasons) - 'blowfish-ctr', // OPTIONAL Blowfish in SDCTR mode + 'blowfish-ctr', // OPTIONAL Blowfish in SDCTR mode - 'blowfish-cbc', // OPTIONAL Blowfish in CBC mode + 'blowfish-cbc', // OPTIONAL Blowfish in CBC mode - '3des-ctr', // RECOMMENDED Three-key 3DES in SDCTR mode + '3des-ctr', // RECOMMENDED Three-key 3DES in SDCTR mode - '3des-cbc', // REQUIRED three-key 3DES in CBC mode - //'none' // OPTIONAL no encryption; NOT RECOMMENDED + '3des-cbc', // REQUIRED three-key 3DES in CBC mode + //'none' // OPTIONAL no encryption; NOT RECOMMENDED + ); + + if (extension_loaded('openssl') && !extension_loaded('mcrypt')) { + // OpenSSL does not support arcfour256 in any capacity and arcfour128 / arcfour support is limited to + // instances that do not use continuous buffers + $encryption_algorithms = array_diff( + $encryption_algorithms, + array('arcfour256', 'arcfour128', 'arcfour') ); - - if (phpseclib_resolve_include_path('Crypt/RC4.php') === false) { - $encryption_algorithms = array_diff( - $encryption_algorithms, - array('arcfour256', 'arcfour128', 'arcfour') - ); - } - if (phpseclib_resolve_include_path('Crypt/Rijndael.php') === false) { - $encryption_algorithms = array_diff( - $encryption_algorithms, - array('aes128-ctr', 'aes192-ctr', 'aes256-ctr', 'aes128-cbc', 'aes192-cbc', 'aes256-cbc') - ); - } - if (phpseclib_resolve_include_path('Crypt/Twofish.php') === false) { - $encryption_algorithms = array_diff( - $encryption_algorithms, - array('twofish128-ctr', 'twofish192-ctr', 'twofish256-ctr', 'twofish128-cbc', 'twofish192-cbc', 'twofish256-cbc', 'twofish-cbc') - ); - } - if (phpseclib_resolve_include_path('Crypt/Blowfish.php') === false) { - $encryption_algorithms = array_diff( - $encryption_algorithms, - array('blowfish-ctr', 'blowfish-cbc') - ); - } - if (phpseclib_resolve_include_path('Crypt/TripleDES.php') === false) { - $encryption_algorithms = array_diff( - $encryption_algorithms, - array('3des-ctr', '3des-cbc') - ); - } - $encryption_algorithms = array_values($encryption_algorithms); } + if (class_exists('\phpseclib\Crypt\RC4') === false) { + $encryption_algorithms = array_diff( + $encryption_algorithms, + array('arcfour256', 'arcfour128', 'arcfour') + ); + } + if (class_exists('\phpseclib\Crypt\Rijndael') === false) { + $encryption_algorithms = array_diff( + $encryption_algorithms, + array('aes128-ctr', 'aes192-ctr', 'aes256-ctr', 'aes128-cbc', 'aes192-cbc', 'aes256-cbc') + ); + } + if (class_exists('\phpseclib\Crypt\Twofish') === false) { + $encryption_algorithms = array_diff( + $encryption_algorithms, + array('twofish128-ctr', 'twofish192-ctr', 'twofish256-ctr', 'twofish128-cbc', 'twofish192-cbc', 'twofish256-cbc', 'twofish-cbc') + ); + } + if (class_exists('\phpseclib\Crypt\Blowfish') === false) { + $encryption_algorithms = array_diff( + $encryption_algorithms, + array('blowfish-ctr', 'blowfish-cbc') + ); + } + if (class_exists('\phpseclib\Crypt\TripleDES') === false) { + $encryption_algorithms = array_diff( + $encryption_algorithms, + array('3des-ctr', '3des-cbc') + ); + } + $encryption_algorithms = array_values($encryption_algorithms); + $mac_algorithms = array( // from : 'hmac-sha2-256',// RECOMMENDED HMAC-SHA256 (digest length = key length = 32) @@ -1179,7 +1278,7 @@ class Net_SSH2 //'none' // OPTIONAL no MAC; NOT RECOMMENDED ); - static $compression_algorithms = array( + $compression_algorithms = array( 'none' // REQUIRED no compression //'zlib' // OPTIONAL ZLIB (LZ77) compression ); @@ -1193,19 +1292,13 @@ class Net_SSH2 )); } - static $str_kex_algorithms, $str_server_host_key_algorithms, - $encryption_algorithms_server_to_client, $mac_algorithms_server_to_client, $compression_algorithms_server_to_client, - $encryption_algorithms_client_to_server, $mac_algorithms_client_to_server, $compression_algorithms_client_to_server; + $str_kex_algorithms = implode(',', $kex_algorithms); + $str_server_host_key_algorithms = implode(',', $server_host_key_algorithms); + $encryption_algorithms_server_to_client = $encryption_algorithms_client_to_server = implode(',', $encryption_algorithms); + $mac_algorithms_server_to_client = $mac_algorithms_client_to_server = implode(',', $mac_algorithms); + $compression_algorithms_server_to_client = $compression_algorithms_client_to_server = implode(',', $compression_algorithms); - if (empty($str_kex_algorithms)) { - $str_kex_algorithms = implode(',', $kex_algorithms); - $str_server_host_key_algorithms = implode(',', $server_host_key_algorithms); - $encryption_algorithms_server_to_client = $encryption_algorithms_client_to_server = implode(',', $encryption_algorithms); - $mac_algorithms_server_to_client = $mac_algorithms_client_to_server = implode(',', $mac_algorithms); - $compression_algorithms_server_to_client = $compression_algorithms_client_to_server = implode(',', $compression_algorithms); - } - - $client_cookie = crypt_random_string(16); + $client_cookie = Random::string(16); $response = $kexinit_payload_server; $this->_string_shift($response, 1); // skip past the message number (it should be SSH_MSG_KEXINIT) @@ -1245,14 +1338,32 @@ class Net_SSH2 $first_kex_packet_follows = $first_kex_packet_follows != 0; // the sending of SSH2_MSG_KEXINIT could go in one of two places. this is the second place. - $kexinit_payload_client = pack('Ca*Na*Na*Na*Na*Na*Na*Na*Na*Na*Na*CN', - NET_SSH2_MSG_KEXINIT, $client_cookie, strlen($str_kex_algorithms), $str_kex_algorithms, - strlen($str_server_host_key_algorithms), $str_server_host_key_algorithms, strlen($encryption_algorithms_client_to_server), - $encryption_algorithms_client_to_server, strlen($encryption_algorithms_server_to_client), $encryption_algorithms_server_to_client, - strlen($mac_algorithms_client_to_server), $mac_algorithms_client_to_server, strlen($mac_algorithms_server_to_client), - $mac_algorithms_server_to_client, strlen($compression_algorithms_client_to_server), $compression_algorithms_client_to_server, - strlen($compression_algorithms_server_to_client), $compression_algorithms_server_to_client, 0, '', 0, '', - 0, 0 + $kexinit_payload_client = pack( + 'Ca*Na*Na*Na*Na*Na*Na*Na*Na*Na*Na*CN', + NET_SSH2_MSG_KEXINIT, + $client_cookie, + strlen($str_kex_algorithms), + $str_kex_algorithms, + strlen($str_server_host_key_algorithms), + $str_server_host_key_algorithms, + strlen($encryption_algorithms_client_to_server), + $encryption_algorithms_client_to_server, + strlen($encryption_algorithms_server_to_client), + $encryption_algorithms_server_to_client, + strlen($mac_algorithms_client_to_server), + $mac_algorithms_client_to_server, + strlen($mac_algorithms_server_to_client), + $mac_algorithms_server_to_client, + strlen($compression_algorithms_client_to_server), + $compression_algorithms_client_to_server, + strlen($compression_algorithms_server_to_client), + $compression_algorithms_server_to_client, + 0, + '', + 0, + '', + 0, + 0 ); if (!$this->_send_binary_packet($kexinit_payload_client)) { @@ -1261,151 +1372,141 @@ class Net_SSH2 // here ends the second place. // we need to decide upon the symmetric encryption algorithms before we do the diffie-hellman key exchange - for ($i = 0; $i < count($encryption_algorithms) && !in_array($encryption_algorithms[$i], $this->encryption_algorithms_server_to_client); $i++); - if ($i == count($encryption_algorithms)) { + // we don't initialize any crypto-objects, yet - we do that, later. for now, we need the lengths to make the + // diffie-hellman key exchange as fast as possible + $decrypt = $this->_array_intersect_first($encryption_algorithms, $this->encryption_algorithms_server_to_client); + $decryptKeyLength = $this->_encryption_algorithm_to_key_size($decrypt); + if ($decryptKeyLength === null) { user_error('No compatible server to client encryption algorithms found'); return $this->_disconnect(NET_SSH2_DISCONNECT_KEY_EXCHANGE_FAILED); } - // we don't initialize any crypto-objects, yet - we do that, later. for now, we need the lengths to make the - // diffie-hellman key exchange as fast as possible - $decrypt = $encryption_algorithms[$i]; - switch ($decrypt) { - case '3des-cbc': - case '3des-ctr': - $decryptKeyLength = 24; // eg. 192 / 8 - break; - case 'aes256-cbc': - case 'aes256-ctr': - case 'twofish-cbc': - case 'twofish256-cbc': - case 'twofish256-ctr': - $decryptKeyLength = 32; // eg. 256 / 8 - break; - case 'aes192-cbc': - case 'aes192-ctr': - case 'twofish192-cbc': - case 'twofish192-ctr': - $decryptKeyLength = 24; // eg. 192 / 8 - break; - case 'aes128-cbc': - case 'aes128-ctr': - case 'twofish128-cbc': - case 'twofish128-ctr': - case 'blowfish-cbc': - case 'blowfish-ctr': - $decryptKeyLength = 16; // eg. 128 / 8 - break; - case 'arcfour': - case 'arcfour128': - $decryptKeyLength = 16; // eg. 128 / 8 - break; - case 'arcfour256': - $decryptKeyLength = 32; // eg. 128 / 8 - break; - case 'none'; - $decryptKeyLength = 0; - } - - for ($i = 0; $i < count($encryption_algorithms) && !in_array($encryption_algorithms[$i], $this->encryption_algorithms_client_to_server); $i++); - if ($i == count($encryption_algorithms)) { + $encrypt = $this->_array_intersect_first($encryption_algorithms, $this->encryption_algorithms_client_to_server); + $encryptKeyLength = $this->_encryption_algorithm_to_key_size($encrypt); + if ($encryptKeyLength === null) { user_error('No compatible client to server encryption algorithms found'); return $this->_disconnect(NET_SSH2_DISCONNECT_KEY_EXCHANGE_FAILED); } - $encrypt = $encryption_algorithms[$i]; - switch ($encrypt) { - case '3des-cbc': - case '3des-ctr': - $encryptKeyLength = 24; - break; - case 'aes256-cbc': - case 'aes256-ctr': - case 'twofish-cbc': - case 'twofish256-cbc': - case 'twofish256-ctr': - $encryptKeyLength = 32; - break; - case 'aes192-cbc': - case 'aes192-ctr': - case 'twofish192-cbc': - case 'twofish192-ctr': - $encryptKeyLength = 24; - break; - case 'aes128-cbc': - case 'aes128-ctr': - case 'twofish128-cbc': - case 'twofish128-ctr': - case 'blowfish-cbc': - case 'blowfish-ctr': - $encryptKeyLength = 16; - break; - case 'arcfour': - case 'arcfour128': - $encryptKeyLength = 16; - break; - case 'arcfour256': - $encryptKeyLength = 32; - break; - case 'none'; - $encryptKeyLength = 0; - } - - $keyLength = $decryptKeyLength > $encryptKeyLength ? $decryptKeyLength : $encryptKeyLength; - // through diffie-hellman key exchange a symmetric key is obtained - for ($i = 0; $i < count($kex_algorithms) && !in_array($kex_algorithms[$i], $this->kex_algorithms); $i++); - if ($i == count($kex_algorithms)) { + $kex_algorithm = $this->_array_intersect_first($kex_algorithms, $this->kex_algorithms); + if ($kex_algorithm === false) { user_error('No compatible key exchange algorithms found'); return $this->_disconnect(NET_SSH2_DISCONNECT_KEY_EXCHANGE_FAILED); } - switch ($kex_algorithms[$i]) { - // see http://tools.ietf.org/html/rfc2409#section-6.2 and - // http://tools.ietf.org/html/rfc2412, appendex E - case 'diffie-hellman-group1-sha1': - $prime = 'FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74' . - '020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F1437' . - '4FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7ED' . - 'EE386BFB5A899FA5AE9F24117C4B1FE649286651ECE65381FFFFFFFFFFFFFFFF'; - break; - // see http://tools.ietf.org/html/rfc3526#section-3 - case 'diffie-hellman-group14-sha1': - $prime = 'FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74' . - '020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F1437' . - '4FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7ED' . - 'EE386BFB5A899FA5AE9F24117C4B1FE649286651ECE45B3DC2007CB8A163BF05' . - '98DA48361C55D39A69163FA8FD24CF5F83655D23DCA3AD961C62F356208552BB' . - '9ED529077096966D670C354E4ABC9804F1746C08CA18217C32905E462E36CE3B' . - 'E39E772C180E86039B2783A2EC07A28FB5C55DF06F4C52C9DE2BCBF695581718' . - '3995497CEA956AE515D2261898FA051015728E5A8AACAA68FFFFFFFFFFFFFFFF'; - break; + // Only relevant in diffie-hellman-group-exchange-sha{1,256}, otherwise empty. + $exchange_hash_rfc4419 = ''; + + if ($kex_algorithm === 'curve25519-sha256@libssh.org') { + $x = Random::string(32); + $eBytes = \Sodium\crypto_box_publickey_from_secretkey($x); + $clientKexInitMessage = NET_SSH2_MSG_KEX_ECDH_INIT; + $serverKexReplyMessage = NET_SSH2_MSG_KEX_ECDH_REPLY; + $kexHash = new Hash('sha256'); + } else { + if (strpos($kex_algorithm, 'diffie-hellman-group-exchange') === 0) { + $dh_group_sizes_packed = pack( + 'NNN', + $this->kex_dh_group_size_min, + $this->kex_dh_group_size_preferred, + $this->kex_dh_group_size_max + ); + $packet = pack( + 'Ca*', + NET_SSH2_MSG_KEXDH_GEX_REQUEST, + $dh_group_sizes_packed + ); + if (!$this->_send_binary_packet($packet)) { + return false; + } + + $response = $this->_get_binary_packet(); + if ($response === false) { + user_error('Connection closed by server'); + return false; + } + extract(unpack('Ctype', $this->_string_shift($response, 1))); + if ($type != NET_SSH2_MSG_KEXDH_GEX_GROUP) { + user_error('Expected SSH_MSG_KEX_DH_GEX_GROUP'); + return false; + } + + extract(unpack('NprimeLength', $this->_string_shift($response, 4))); + $primeBytes = $this->_string_shift($response, $primeLength); + $prime = new BigInteger($primeBytes, -256); + + extract(unpack('NgLength', $this->_string_shift($response, 4))); + $gBytes = $this->_string_shift($response, $gLength); + $g = new BigInteger($gBytes, -256); + + $exchange_hash_rfc4419 = pack( + 'a*Na*Na*', + $dh_group_sizes_packed, + $primeLength, + $primeBytes, + $gLength, + $gBytes + ); + + $clientKexInitMessage = NET_SSH2_MSG_KEXDH_GEX_INIT; + $serverKexReplyMessage = NET_SSH2_MSG_KEXDH_GEX_REPLY; + } else { + switch ($kex_algorithm) { + // see http://tools.ietf.org/html/rfc2409#section-6.2 and + // http://tools.ietf.org/html/rfc2412, appendex E + case 'diffie-hellman-group1-sha1': + $prime = 'FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74' . + '020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F1437' . + '4FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7ED' . + 'EE386BFB5A899FA5AE9F24117C4B1FE649286651ECE65381FFFFFFFFFFFFFFFF'; + break; + // see http://tools.ietf.org/html/rfc3526#section-3 + case 'diffie-hellman-group14-sha1': + $prime = 'FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74' . + '020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F1437' . + '4FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7ED' . + 'EE386BFB5A899FA5AE9F24117C4B1FE649286651ECE45B3DC2007CB8A163BF05' . + '98DA48361C55D39A69163FA8FD24CF5F83655D23DCA3AD961C62F356208552BB' . + '9ED529077096966D670C354E4ABC9804F1746C08CA18217C32905E462E36CE3B' . + 'E39E772C180E86039B2783A2EC07A28FB5C55DF06F4C52C9DE2BCBF695581718' . + '3995497CEA956AE515D2261898FA051015728E5A8AACAA68FFFFFFFFFFFFFFFF'; + break; + } + // For both diffie-hellman-group1-sha1 and diffie-hellman-group14-sha1 + // the generator field element is 2 (decimal) and the hash function is sha1. + $g = new BigInteger(2); + $prime = new BigInteger($prime, 16); + $clientKexInitMessage = NET_SSH2_MSG_KEXDH_INIT; + $serverKexReplyMessage = NET_SSH2_MSG_KEXDH_REPLY; + } + + switch ($kex_algorithm) { + case 'diffie-hellman-group-exchange-sha256': + $kexHash = new Hash('sha256'); + break; + default: + $kexHash = new Hash('sha1'); + } + + /* To increase the speed of the key exchange, both client and server may + reduce the size of their private exponents. It should be at least + twice as long as the key material that is generated from the shared + secret. For more details, see the paper by van Oorschot and Wiener + [VAN-OORSCHOT]. + + -- http://tools.ietf.org/html/rfc4419#section-6.2 */ + $one = new BigInteger(1); + $keyLength = min($kexHash->getLength(), max($encryptKeyLength, $decryptKeyLength)); + $max = $one->bitwise_leftShift(16 * $keyLength); // 2 * 8 * $keyLength + $max = $max->subtract($one); + + $x = $one->random($one, $max); + $e = $g->modPow($x, $prime); + + $eBytes = $e->toBytes(true); } - - // For both diffie-hellman-group1-sha1 and diffie-hellman-group14-sha1 - // the generator field element is 2 (decimal) and the hash function is sha1. - $g = new Math_BigInteger(2); - $prime = new Math_BigInteger($prime, 16); - $kexHash = new Crypt_Hash('sha1'); - //$q = $p->bitwise_rightShift(1); - - /* To increase the speed of the key exchange, both client and server may - reduce the size of their private exponents. It should be at least - twice as long as the key material that is generated from the shared - secret. For more details, see the paper by van Oorschot and Wiener - [VAN-OORSCHOT]. - - -- http://tools.ietf.org/html/rfc4419#section-6.2 */ - $one = new Math_BigInteger(1); - $keyLength = min($keyLength, $kexHash->getLength()); - $max = $one->bitwise_leftShift(16 * $keyLength); // 2 * 8 * $keyLength - $max = $max->subtract($one); - - $x = $one->random($one, $max); - $e = $g->modPow($x, $prime); - - $eBytes = $e->toBytes(true); - $data = pack('CNa*', NET_SSH2_MSG_KEXDH_INIT, strlen($eBytes), $eBytes); + $data = pack('CNa*', $clientKexInitMessage, strlen($eBytes), $eBytes); if (!$this->_send_binary_packet($data)) { user_error('Connection closed by server'); @@ -1419,7 +1520,7 @@ class Net_SSH2 } extract(unpack('Ctype', $this->_string_shift($response, 1))); - if ($type != NET_SSH2_MSG_KEXDH_REPLY) { + if ($type != $serverKexReplyMessage) { user_error('Expected SSH_MSG_KEXDH_REPLY'); return false; } @@ -1432,7 +1533,6 @@ class Net_SSH2 $temp = unpack('Nlength', $this->_string_shift($response, 4)); $fBytes = $this->_string_shift($response, $temp['length']); - $f = new Math_BigInteger($fBytes, -256); $temp = unpack('Nlength', $this->_string_shift($response, 4)); $this->signature = $this->_string_shift($response, $temp['length']); @@ -1440,14 +1540,38 @@ class Net_SSH2 $temp = unpack('Nlength', $this->_string_shift($this->signature, 4)); $this->signature_format = $this->_string_shift($this->signature, $temp['length']); - $key = $f->modPow($x, $prime); + if ($kex_algorithm === 'curve25519-sha256@libssh.org') { + if (strlen($fBytes) !== 32) { + user_error('Received curve25519 public key of invalid length.'); + return false; + } + $key = new BigInteger(\Sodium\crypto_scalarmult($x, $fBytes), 256); + \Sodium\memzero($x); + } else { + $f = new BigInteger($fBytes, -256); + $key = $f->modPow($x, $prime); + } $keyBytes = $key->toBytes(true); - $this->exchange_hash = pack('Na*Na*Na*Na*Na*Na*Na*Na*', - strlen($this->identifier), $this->identifier, strlen($this->server_identifier), $this->server_identifier, - strlen($kexinit_payload_client), $kexinit_payload_client, strlen($kexinit_payload_server), - $kexinit_payload_server, strlen($this->server_public_host_key), $this->server_public_host_key, strlen($eBytes), - $eBytes, strlen($fBytes), $fBytes, strlen($keyBytes), $keyBytes + $this->exchange_hash = pack( + 'Na*Na*Na*Na*Na*a*Na*Na*Na*', + strlen($this->identifier), + $this->identifier, + strlen($this->server_identifier), + $this->server_identifier, + strlen($kexinit_payload_client), + $kexinit_payload_client, + strlen($kexinit_payload_server), + $kexinit_payload_server, + strlen($this->server_public_host_key), + $this->server_public_host_key, + $exchange_hash_rfc4419, + strlen($eBytes), + $eBytes, + strlen($fBytes), + $fBytes, + strlen($keyBytes), + $keyBytes ); $this->exchange_hash = $kexHash->hash($this->exchange_hash); @@ -1456,18 +1580,19 @@ class Net_SSH2 $this->session_id = $this->exchange_hash; } - for ($i = 0; $i < count($server_host_key_algorithms) && !in_array($server_host_key_algorithms[$i], $this->server_host_key_algorithms); $i++); - if ($i == count($server_host_key_algorithms)) { + $server_host_key_algorithm = $this->_array_intersect_first($server_host_key_algorithms, $this->server_host_key_algorithms); + if ($server_host_key_algorithm === false) { user_error('No compatible server host key algorithms found'); return $this->_disconnect(NET_SSH2_DISCONNECT_KEY_EXCHANGE_FAILED); } - if ($public_key_format != $server_host_key_algorithms[$i] || $this->signature_format != $server_host_key_algorithms[$i]) { + if ($public_key_format != $server_host_key_algorithm || $this->signature_format != $server_host_key_algorithm) { user_error('Server Host Key Algorithm Mismatch'); return $this->_disconnect(NET_SSH2_DISCONNECT_KEY_EXCHANGE_FAILED); } - $packet = pack('C', + $packet = pack( + 'C', NET_SSH2_MSG_NEWKEYS ); @@ -1489,163 +1614,16 @@ class Net_SSH2 return false; } - switch ($encrypt) { - case '3des-cbc': - if (!class_exists('Crypt_TripleDES')) { - include_once 'Crypt/TripleDES.php'; - } - $this->encrypt = new Crypt_TripleDES(); - // $this->encrypt_block_size = 64 / 8 == the default - break; - case '3des-ctr': - if (!class_exists('Crypt_TripleDES')) { - include_once 'Crypt/TripleDES.php'; - } - $this->encrypt = new Crypt_TripleDES(CRYPT_DES_MODE_CTR); - // $this->encrypt_block_size = 64 / 8 == the default - break; - case 'aes256-cbc': - case 'aes192-cbc': - case 'aes128-cbc': - if (!class_exists('Crypt_Rijndael')) { - include_once 'Crypt/Rijndael.php'; - } - $this->encrypt = new Crypt_Rijndael(); - $this->encrypt_block_size = 16; // eg. 128 / 8 - break; - case 'aes256-ctr': - case 'aes192-ctr': - case 'aes128-ctr': - if (!class_exists('Crypt_Rijndael')) { - include_once 'Crypt/Rijndael.php'; - } - $this->encrypt = new Crypt_Rijndael(CRYPT_RIJNDAEL_MODE_CTR); - $this->encrypt_block_size = 16; // eg. 128 / 8 - break; - case 'blowfish-cbc': - if (!class_exists('Crypt_Blowfish')) { - include_once 'Crypt/Blowfish.php'; - } - $this->encrypt = new Crypt_Blowfish(); - $this->encrypt_block_size = 8; - break; - case 'blowfish-ctr': - if (!class_exists('Crypt_Blowfish')) { - include_once 'Crypt/Blowfish.php'; - } - $this->encrypt = new Crypt_Blowfish(CRYPT_BLOWFISH_MODE_CTR); - $this->encrypt_block_size = 8; - break; - case 'twofish128-cbc': - case 'twofish192-cbc': - case 'twofish256-cbc': - case 'twofish-cbc': - if (!class_exists('Crypt_Twofish')) { - include_once 'Crypt/Twofish.php'; - } - $this->encrypt = new Crypt_Twofish(); - $this->encrypt_block_size = 16; - break; - case 'twofish128-ctr': - case 'twofish192-ctr': - case 'twofish256-ctr': - if (!class_exists('Crypt_Twofish')) { - include_once 'Crypt/Twofish.php'; - } - $this->encrypt = new Crypt_Twofish(CRYPT_TWOFISH_MODE_CTR); - $this->encrypt_block_size = 16; - break; - case 'arcfour': - case 'arcfour128': - case 'arcfour256': - if (!class_exists('Crypt_RC4')) { - include_once 'Crypt/RC4.php'; - } - $this->encrypt = new Crypt_RC4(); - break; - case 'none'; - //$this->encrypt = new Crypt_Null(); - } - - switch ($decrypt) { - case '3des-cbc': - if (!class_exists('Crypt_TripleDES')) { - include_once 'Crypt/TripleDES.php'; - } - $this->decrypt = new Crypt_TripleDES(); - break; - case '3des-ctr': - if (!class_exists('Crypt_TripleDES')) { - include_once 'Crypt/TripleDES.php'; - } - $this->decrypt = new Crypt_TripleDES(CRYPT_DES_MODE_CTR); - break; - case 'aes256-cbc': - case 'aes192-cbc': - case 'aes128-cbc': - if (!class_exists('Crypt_Rijndael')) { - include_once 'Crypt/Rijndael.php'; - } - $this->decrypt = new Crypt_Rijndael(); - $this->decrypt_block_size = 16; - break; - case 'aes256-ctr': - case 'aes192-ctr': - case 'aes128-ctr': - if (!class_exists('Crypt_Rijndael')) { - include_once 'Crypt/Rijndael.php'; - } - $this->decrypt = new Crypt_Rijndael(CRYPT_RIJNDAEL_MODE_CTR); - $this->decrypt_block_size = 16; - break; - case 'blowfish-cbc': - if (!class_exists('Crypt_Blowfish')) { - include_once 'Crypt/Blowfish.php'; - } - $this->decrypt = new Crypt_Blowfish(); - $this->decrypt_block_size = 8; - break; - case 'blowfish-ctr': - if (!class_exists('Crypt_Blowfish')) { - include_once 'Crypt/Blowfish.php'; - } - $this->decrypt = new Crypt_Blowfish(CRYPT_BLOWFISH_MODE_CTR); - $this->decrypt_block_size = 8; - break; - case 'twofish128-cbc': - case 'twofish192-cbc': - case 'twofish256-cbc': - case 'twofish-cbc': - if (!class_exists('Crypt_Twofish')) { - include_once 'Crypt/Twofish.php'; - } - $this->decrypt = new Crypt_Twofish(); - $this->decrypt_block_size = 16; - break; - case 'twofish128-ctr': - case 'twofish192-ctr': - case 'twofish256-ctr': - if (!class_exists('Crypt_Twofish')) { - include_once 'Crypt/Twofish.php'; - } - $this->decrypt = new Crypt_Twofish(CRYPT_TWOFISH_MODE_CTR); - $this->decrypt_block_size = 16; - break; - case 'arcfour': - case 'arcfour128': - case 'arcfour256': - if (!class_exists('Crypt_RC4')) { - include_once 'Crypt/RC4.php'; - } - $this->decrypt = new Crypt_RC4(); - break; - case 'none'; - //$this->decrypt = new Crypt_Null(); - } - $keyBytes = pack('Na*', strlen($keyBytes), $keyBytes); + $this->encrypt = $this->_encryption_algorithm_to_crypt_instance($encrypt); if ($this->encrypt) { + if ($this->crypto_engine) { + $this->encrypt->setEngine($this->crypto_engine); + } + if ($this->encrypt->block_size) { + $this->encrypt_block_size = $this->encrypt->block_size; + } $this->encrypt->enableContinuousBuffer(); $this->encrypt->disablePadding(); @@ -1662,7 +1640,14 @@ class Net_SSH2 $this->encrypt->setKey(substr($key, 0, $encryptKeyLength)); } + $this->decrypt = $this->_encryption_algorithm_to_crypt_instance($decrypt); if ($this->decrypt) { + if ($this->crypto_engine) { + $this->decrypt->setEngine($this->crypto_engine); + } + if ($this->decrypt->block_size) { + $this->decrypt_block_size = $this->decrypt->block_size; + } $this->decrypt->enableContinuousBuffer(); $this->decrypt->disablePadding(); @@ -1693,66 +1678,66 @@ class Net_SSH2 $this->decrypt->decrypt(str_repeat("\0", 1536)); } - for ($i = 0; $i < count($mac_algorithms) && !in_array($mac_algorithms[$i], $this->mac_algorithms_client_to_server); $i++); - if ($i == count($mac_algorithms)) { + $mac_algorithm = $this->_array_intersect_first($mac_algorithms, $this->mac_algorithms_client_to_server); + if ($mac_algorithm === false) { user_error('No compatible client to server message authentication algorithms found'); return $this->_disconnect(NET_SSH2_DISCONNECT_KEY_EXCHANGE_FAILED); } - $createKeyLength = 0; // ie. $mac_algorithms[$i] == 'none' - switch ($mac_algorithms[$i]) { + $createKeyLength = 0; // ie. $mac_algorithm == 'none' + switch ($mac_algorithm) { case 'hmac-sha2-256': - $this->hmac_create = new Crypt_Hash('sha256'); + $this->hmac_create = new Hash('sha256'); $createKeyLength = 32; break; case 'hmac-sha1': - $this->hmac_create = new Crypt_Hash('sha1'); + $this->hmac_create = new Hash('sha1'); $createKeyLength = 20; break; case 'hmac-sha1-96': - $this->hmac_create = new Crypt_Hash('sha1-96'); + $this->hmac_create = new Hash('sha1-96'); $createKeyLength = 20; break; case 'hmac-md5': - $this->hmac_create = new Crypt_Hash('md5'); + $this->hmac_create = new Hash('md5'); $createKeyLength = 16; break; case 'hmac-md5-96': - $this->hmac_create = new Crypt_Hash('md5-96'); + $this->hmac_create = new Hash('md5-96'); $createKeyLength = 16; } - for ($i = 0; $i < count($mac_algorithms) && !in_array($mac_algorithms[$i], $this->mac_algorithms_server_to_client); $i++); - if ($i == count($mac_algorithms)) { + $mac_algorithm = $this->_array_intersect_first($mac_algorithms, $this->mac_algorithms_server_to_client); + if ($mac_algorithm === false) { user_error('No compatible server to client message authentication algorithms found'); return $this->_disconnect(NET_SSH2_DISCONNECT_KEY_EXCHANGE_FAILED); } $checkKeyLength = 0; $this->hmac_size = 0; - switch ($mac_algorithms[$i]) { + switch ($mac_algorithm) { case 'hmac-sha2-256': - $this->hmac_check = new Crypt_Hash('sha256'); + $this->hmac_check = new Hash('sha256'); $checkKeyLength = 32; $this->hmac_size = 32; break; case 'hmac-sha1': - $this->hmac_check = new Crypt_Hash('sha1'); + $this->hmac_check = new Hash('sha1'); $checkKeyLength = 20; $this->hmac_size = 20; break; case 'hmac-sha1-96': - $this->hmac_check = new Crypt_Hash('sha1-96'); + $this->hmac_check = new Hash('sha1-96'); $checkKeyLength = 20; $this->hmac_size = 12; break; case 'hmac-md5': - $this->hmac_check = new Crypt_Hash('md5'); + $this->hmac_check = new Hash('md5'); $checkKeyLength = 16; $this->hmac_size = 16; break; case 'hmac-md5-96': - $this->hmac_check = new Crypt_Hash('md5-96'); + $this->hmac_check = new Hash('md5-96'); $checkKeyLength = 16; $this->hmac_size = 12; } @@ -1769,33 +1754,116 @@ class Net_SSH2 } $this->hmac_check->setKey(substr($key, 0, $checkKeyLength)); - for ($i = 0; $i < count($compression_algorithms) && !in_array($compression_algorithms[$i], $this->compression_algorithms_server_to_client); $i++); - if ($i == count($compression_algorithms)) { + $compression_algorithm = $this->_array_intersect_first($compression_algorithms, $this->compression_algorithms_server_to_client); + if ($compression_algorithm === false) { user_error('No compatible server to client compression algorithms found'); return $this->_disconnect(NET_SSH2_DISCONNECT_KEY_EXCHANGE_FAILED); } - $this->decompress = $compression_algorithms[$i] == 'zlib'; + $this->decompress = $compression_algorithm == 'zlib'; - for ($i = 0; $i < count($compression_algorithms) && !in_array($compression_algorithms[$i], $this->compression_algorithms_client_to_server); $i++); - if ($i == count($compression_algorithms)) { + $compression_algorithm = $this->_array_intersect_first($compression_algorithms, $this->compression_algorithms_client_to_server); + if ($compression_algorithm === false) { user_error('No compatible client to server compression algorithms found'); return $this->_disconnect(NET_SSH2_DISCONNECT_KEY_EXCHANGE_FAILED); } - $this->compress = $compression_algorithms[$i] == 'zlib'; + $this->compress = $compression_algorithm == 'zlib'; return true; } + /** + * Maps an encryption algorithm name to the number of key bytes. + * + * @param string $algorithm Name of the encryption algorithm + * @return int|null Number of bytes as an integer or null for unknown + * @access private + */ + function _encryption_algorithm_to_key_size($algorithm) + { + switch ($algorithm) { + case 'none': + return 0; + case 'aes128-cbc': + case 'aes128-ctr': + case 'arcfour': + case 'arcfour128': + case 'blowfish-cbc': + case 'blowfish-ctr': + case 'twofish128-cbc': + case 'twofish128-ctr': + return 16; + case '3des-cbc': + case '3des-ctr': + case 'aes192-cbc': + case 'aes192-ctr': + case 'twofish192-cbc': + case 'twofish192-ctr': + return 24; + case 'aes256-cbc': + case 'aes256-ctr': + case 'arcfour256': + case 'twofish-cbc': + case 'twofish256-cbc': + case 'twofish256-ctr': + return 32; + } + return null; + } + + /** + * Maps an encryption algorithm name to an instance of a subclass of + * \phpseclib\Crypt\Base. + * + * @param string $algorithm Name of the encryption algorithm + * @return mixed Instance of \phpseclib\Crypt\Base or null for unknown + * @access private + */ + function _encryption_algorithm_to_crypt_instance($algorithm) + { + switch ($algorithm) { + case '3des-cbc': + return new TripleDES(); + case '3des-ctr': + return new TripleDES(Base::MODE_CTR); + case 'aes256-cbc': + case 'aes192-cbc': + case 'aes128-cbc': + return new Rijndael(); + case 'aes256-ctr': + case 'aes192-ctr': + case 'aes128-ctr': + return new Rijndael(Base::MODE_CTR); + case 'blowfish-cbc': + return new Blowfish(); + case 'blowfish-ctr': + return new Blowfish(Base::MODE_CTR); + case 'twofish128-cbc': + case 'twofish192-cbc': + case 'twofish256-cbc': + case 'twofish-cbc': + return new Twofish(); + case 'twofish128-ctr': + case 'twofish192-ctr': + case 'twofish256-ctr': + return new Twofish(Base::MODE_CTR); + case 'arcfour': + case 'arcfour128': + case 'arcfour256': + return new RC4(); + } + return null; + } + /** * Login * - * The $password parameter can be a plaintext password, a Crypt_RSA object or an array + * The $password parameter can be a plaintext password, a \phpseclib\Crypt\RSA object or an array * - * @param String $username - * @param Mixed $password - * @param Mixed $... - * @return Boolean - * @see _login + * @param string $username + * @param mixed $password + * @param mixed $... + * @return bool + * @see self::_login() * @access public */ function login($username) @@ -1807,16 +1875,16 @@ class Net_SSH2 /** * Login Helper * - * @param String $username - * @param Mixed $password - * @param Mixed $... - * @return Boolean - * @see _login_helper + * @param string $username + * @param mixed $password + * @param mixed $... + * @return bool + * @see self::_login_helper() * @access private */ function _login($username) { - if (!($this->bitmap & NET_SSH2_MASK_CONSTRUCTOR)) { + if (!($this->bitmap & self::MASK_CONSTRUCTOR)) { if (!$this->_connect()) { return false; } @@ -1838,22 +1906,25 @@ class Net_SSH2 /** * Login Helper * - * @param String $username - * @param optional String $password - * @return Boolean + * @param string $username + * @param string $password + * @return bool * @access private * @internal It might be worthwhile, at some point, to protect against {@link http://tools.ietf.org/html/rfc4251#section-9.3.9 traffic analysis} * by sending dummy SSH_MSG_IGNORE messages. */ function _login_helper($username, $password = null) { - if (!($this->bitmap & NET_SSH2_MASK_CONNECTED)) { + if (!($this->bitmap & self::MASK_CONNECTED)) { return false; } - if (!($this->bitmap & NET_SSH2_MASK_LOGIN_REQ)) { - $packet = pack('CNa*', - NET_SSH2_MSG_SERVICE_REQUEST, strlen('ssh-userauth'), 'ssh-userauth' + if (!($this->bitmap & self::MASK_LOGIN_REQ)) { + $packet = pack( + 'CNa*', + NET_SSH2_MSG_SERVICE_REQUEST, + strlen('ssh-userauth'), + 'ssh-userauth' ); if (!$this->_send_binary_packet($packet)) { @@ -1872,35 +1943,37 @@ class Net_SSH2 user_error('Expected SSH_MSG_SERVICE_ACCEPT'); return false; } - $this->bitmap |= NET_SSH2_MASK_LOGIN_REQ; + $this->bitmap |= self::MASK_LOGIN_REQ; } if (strlen($this->last_interactive_response)) { return !is_string($password) && !is_array($password) ? false : $this->_keyboard_interactive_process($password); } - // although PHP5's get_class() preserves the case, PHP4's does not - if (is_object($password)) { - switch (strtolower(get_class($password))) { - case 'crypt_rsa': - return $this->_privatekey_login($username, $password); - case 'system_ssh_agent': - return $this->_ssh_agent_login($username, $password); - } + if ($password instanceof RSA) { + return $this->_privatekey_login($username, $password); + } elseif ($password instanceof Agent) { + return $this->_ssh_agent_login($username, $password); } if (is_array($password)) { if ($this->_keyboard_interactive_login($username, $password)) { - $this->bitmap |= NET_SSH2_MASK_LOGIN; + $this->bitmap |= self::MASK_LOGIN; return true; } return false; } if (!isset($password)) { - $packet = pack('CNa*Na*Na*', - NET_SSH2_MSG_USERAUTH_REQUEST, strlen($username), $username, strlen('ssh-connection'), 'ssh-connection', - strlen('none'), 'none' + $packet = pack( + 'CNa*Na*Na*', + NET_SSH2_MSG_USERAUTH_REQUEST, + strlen($username), + $username, + strlen('ssh-connection'), + 'ssh-connection', + strlen('none'), + 'none' ); if (!$this->_send_binary_packet($packet)) { @@ -1917,7 +1990,7 @@ class Net_SSH2 switch ($type) { case NET_SSH2_MSG_USERAUTH_SUCCESS: - $this->bitmap |= NET_SSH2_MASK_LOGIN; + $this->bitmap |= self::MASK_LOGIN; return true; //case NET_SSH2_MSG_USERAUTH_FAILURE: default: @@ -1925,18 +1998,36 @@ class Net_SSH2 } } - $packet = pack('CNa*Na*Na*CNa*', - NET_SSH2_MSG_USERAUTH_REQUEST, strlen($username), $username, strlen('ssh-connection'), 'ssh-connection', - strlen('password'), 'password', 0, strlen($password), $password + $packet = pack( + 'CNa*Na*Na*CNa*', + NET_SSH2_MSG_USERAUTH_REQUEST, + strlen($username), + $username, + strlen('ssh-connection'), + 'ssh-connection', + strlen('password'), + 'password', + 0, + strlen($password), + $password ); // remove the username and password from the logged packet if (!defined('NET_SSH2_LOGGING')) { $logged = null; } else { - $logged = pack('CNa*Na*Na*CNa*', - NET_SSH2_MSG_USERAUTH_REQUEST, strlen('username'), 'username', strlen('ssh-connection'), 'ssh-connection', - strlen('password'), 'password', 0, strlen('password'), 'password' + $logged = pack( + 'CNa*Na*Na*CNa*', + NET_SSH2_MSG_USERAUTH_REQUEST, + strlen('username'), + 'username', + strlen('ssh-connection'), + 'ssh-connection', + strlen('password'), + 'password', + 0, + strlen('password'), + 'password' ); } @@ -1970,14 +2061,14 @@ class Net_SSH2 if (!$partial_success && in_array('keyboard-interactive', $auth_methods)) { if ($this->_keyboard_interactive_login($username, $password)) { - $this->bitmap |= NET_SSH2_MASK_LOGIN; + $this->bitmap |= self::MASK_LOGIN; return true; } return false; } return false; case NET_SSH2_MSG_USERAUTH_SUCCESS: - $this->bitmap |= NET_SSH2_MASK_LOGIN; + $this->bitmap |= self::MASK_LOGIN; return true; } @@ -1989,16 +2080,26 @@ class Net_SSH2 * * See {@link http://tools.ietf.org/html/rfc4256 RFC4256} for details. This is not a full-featured keyboard-interactive authenticator. * - * @param String $username - * @param String $password - * @return Boolean + * @param string $username + * @param string $password + * @return bool * @access private */ function _keyboard_interactive_login($username, $password) { - $packet = pack('CNa*Na*Na*Na*Na*', - NET_SSH2_MSG_USERAUTH_REQUEST, strlen($username), $username, strlen('ssh-connection'), 'ssh-connection', - strlen('keyboard-interactive'), 'keyboard-interactive', 0, '', 0, '' + $packet = pack( + 'CNa*Na*Na*Na*Na*', + NET_SSH2_MSG_USERAUTH_REQUEST, + strlen($username), + $username, + strlen('ssh-connection'), + 'ssh-connection', + strlen('keyboard-interactive'), + 'keyboard-interactive', + 0, + '', + 0, + '' ); if (!$this->_send_binary_packet($packet)) { @@ -2011,8 +2112,8 @@ class Net_SSH2 /** * Handle the keyboard-interactive requests / responses. * - * @param String $responses... - * @return Boolean + * @param string $responses... + * @return bool * @access private */ function _keyboard_interactive_process() @@ -2069,7 +2170,7 @@ class Net_SSH2 // see http://tools.ietf.org/html/rfc4256#section-3.2 if (strlen($this->last_interactive_response)) { $this->last_interactive_response = ''; - } else if (defined('NET_SSH2_LOGGING')) { + } elseif (defined('NET_SSH2_LOGGING')) { $this->message_number_log[count($this->message_number_log) - 1] = str_replace( 'UNKNOWN', 'NET_SSH2_MSG_USERAUTH_INFO_REQUEST', @@ -2097,7 +2198,7 @@ class Net_SSH2 return false; } - if (defined('NET_SSH2_LOGGING') && NET_SSH2_LOGGING == NET_SSH2_LOG_COMPLEX) { + if (defined('NET_SSH2_LOGGING') && NET_SSH2_LOGGING == self::LOG_COMPLEX) { $this->message_number_log[count($this->message_number_log) - 1] = str_replace( 'UNKNOWN', 'NET_SSH2_MSG_USERAUTH_INFO_RESPONSE', @@ -2125,13 +2226,14 @@ class Net_SSH2 /** * Login with an ssh-agent provided key * - * @param String $username - * @param System_SSH_Agent $agent - * @return Boolean + * @param string $username + * @param \phpseclib\System\SSH\Agent $agent + * @return bool * @access private */ function _ssh_agent_login($username, $agent) { + $this->agent = $agent; $keys = $agent->requestIdentities(); foreach ($keys as $key) { if ($this->_privatekey_login($username, $key)) { @@ -2145,9 +2247,9 @@ class Net_SSH2 /** * Login with an RSA private key * - * @param String $username - * @param Crypt_RSA $password - * @return Boolean + * @param string $username + * @param \phpseclib\Crypt\RSA $password + * @return bool * @access private * @internal It might be worthwhile, at some point, to protect against {@link http://tools.ietf.org/html/rfc4251#section-9.3.9 traffic analysis} * by sending dummy SSH_MSG_IGNORE messages. @@ -2155,7 +2257,7 @@ class Net_SSH2 function _privatekey_login($username, $privatekey) { // see http://tools.ietf.org/html/rfc4253#page-15 - $publickey = $privatekey->getPublicKey(CRYPT_RSA_PUBLIC_FORMAT_RAW); + $publickey = $privatekey->getPublicKey(RSA::PUBLIC_FORMAT_RAW); if ($publickey === false) { return false; } @@ -2164,13 +2266,25 @@ class Net_SSH2 'e' => $publickey['e']->toBytes(true), 'n' => $publickey['n']->toBytes(true) ); - $publickey = pack('Na*Na*Na*', - strlen('ssh-rsa'), 'ssh-rsa', strlen($publickey['e']), $publickey['e'], strlen($publickey['n']), $publickey['n'] + $publickey = pack( + 'Na*Na*Na*', + strlen('ssh-rsa'), + 'ssh-rsa', + strlen($publickey['e']), + $publickey['e'], + strlen($publickey['n']), + $publickey['n'] ); - $part1 = pack('CNa*Na*Na*', - NET_SSH2_MSG_USERAUTH_REQUEST, strlen($username), $username, strlen('ssh-connection'), 'ssh-connection', - strlen('publickey'), 'publickey' + $part1 = pack( + 'CNa*Na*Na*', + NET_SSH2_MSG_USERAUTH_REQUEST, + strlen($username), + $username, + strlen('ssh-connection'), + 'ssh-connection', + strlen('publickey'), + 'publickey' ); $part2 = pack('Na*Na*', strlen('ssh-rsa'), 'ssh-rsa', strlen($publickey), $publickey); @@ -2195,7 +2309,7 @@ class Net_SSH2 case NET_SSH2_MSG_USERAUTH_PK_OK: // we'll just take it on faith that the public key blob and the public key algorithm name are as // they should be - if (defined('NET_SSH2_LOGGING') && NET_SSH2_LOGGING == NET_SSH2_LOG_COMPLEX) { + if (defined('NET_SSH2_LOGGING') && NET_SSH2_LOGGING == self::LOG_COMPLEX) { $this->message_number_log[count($this->message_number_log) - 1] = str_replace( 'UNKNOWN', 'NET_SSH2_MSG_USERAUTH_PK_OK', @@ -2205,7 +2319,7 @@ class Net_SSH2 } $packet = $part1 . chr(1) . $part2; - $privatekey->setSignatureMode(CRYPT_RSA_SIGNATURE_PKCS1); + $privatekey->setSignatureMode(RSA::SIGNATURE_PKCS1); $signature = $privatekey->sign(pack('Na*a*', strlen($this->session_id), $this->session_id, $packet)); $signature = pack('Na*Na*', strlen('ssh-rsa'), 'ssh-rsa', strlen($signature), $signature); $packet.= pack('Na*', strlen($signature), $signature); @@ -2227,7 +2341,7 @@ class Net_SSH2 // either the login is bad or the server employs multi-factor authentication return false; case NET_SSH2_MSG_USERAUTH_SUCCESS: - $this->bitmap |= NET_SSH2_MASK_LOGIN; + $this->bitmap |= self::MASK_LOGIN; return true; } @@ -2240,7 +2354,7 @@ class Net_SSH2 * $ssh->exec('ping 127.0.0.1'); on a Linux host will never return and will run indefinitely. setTimeout() makes it so it'll timeout. * Setting $timeout to false or 0 will mean there is no timeout. * - * @param Mixed $timeout + * @param mixed $timeout * @access public */ function setTimeout($timeout) @@ -2261,12 +2375,12 @@ class Net_SSH2 /** * Execute Command * - * If $callback is set to false then Net_SSH2::_get_channel_packet(NET_SSH2_CHANNEL_EXEC) will need to be called manually. + * If $callback is set to false then \phpseclib\Net\SSH2::_get_channel_packet(self::CHANNEL_EXEC) will need to be called manually. * In all likelihood, this is not a feature you want to be taking advantage of. * - * @param String $command - * @param optional Callback $callback - * @return String + * @param string $command + * @param Callback $callback + * @return string * @access public */ function exec($command, $callback = null) @@ -2275,42 +2389,63 @@ class Net_SSH2 $this->is_timeout = false; $this->stdErrorLog = ''; - if (!($this->bitmap & NET_SSH2_MASK_LOGIN)) { + if (!($this->bitmap & self::MASK_LOGIN)) { return false; } // RFC4254 defines the (client) window size as "bytes the other party can send before it must wait for the window to // be adjusted". 0x7FFFFFFF is, at 2GB, the max size. technically, it should probably be decremented, but, - // honestly, if you're transfering more than 2GB, you probably shouldn't be using phpseclib, anyway. + // honestly, if you're transferring more than 2GB, you probably shouldn't be using phpseclib, anyway. // see http://tools.ietf.org/html/rfc4254#section-5.2 for more info - $this->window_size_server_to_client[NET_SSH2_CHANNEL_EXEC] = $this->window_size; + $this->window_size_server_to_client[self::CHANNEL_EXEC] = $this->window_size; // 0x8000 is the maximum max packet size, per http://tools.ietf.org/html/rfc4253#section-6.1, although since PuTTy // uses 0x4000, that's what will be used here, as well. $packet_size = 0x4000; - $packet = pack('CNa*N3', - NET_SSH2_MSG_CHANNEL_OPEN, strlen('session'), 'session', NET_SSH2_CHANNEL_EXEC, $this->window_size_server_to_client[NET_SSH2_CHANNEL_EXEC], $packet_size); + $packet = pack( + 'CNa*N3', + NET_SSH2_MSG_CHANNEL_OPEN, + strlen('session'), + 'session', + self::CHANNEL_EXEC, + $this->window_size_server_to_client[self::CHANNEL_EXEC], + $packet_size + ); if (!$this->_send_binary_packet($packet)) { return false; } - $this->channel_status[NET_SSH2_CHANNEL_EXEC] = NET_SSH2_MSG_CHANNEL_OPEN; + $this->channel_status[self::CHANNEL_EXEC] = NET_SSH2_MSG_CHANNEL_OPEN; - $response = $this->_get_channel_packet(NET_SSH2_CHANNEL_EXEC); + $response = $this->_get_channel_packet(self::CHANNEL_EXEC); if ($response === false) { return false; } if ($this->request_pty === true) { $terminal_modes = pack('C', NET_SSH2_TTY_OP_END); - $packet = pack('CNNa*CNa*N5a*', - NET_SSH2_MSG_CHANNEL_REQUEST, $this->server_channels[NET_SSH2_CHANNEL_EXEC], strlen('pty-req'), 'pty-req', 1, strlen('vt100'), 'vt100', - $this->windowColumns, $this->windowRows, 0, 0, strlen($terminal_modes), $terminal_modes); + $packet = pack( + 'CNNa*CNa*N5a*', + NET_SSH2_MSG_CHANNEL_REQUEST, + $this->server_channels[self::CHANNEL_EXEC], + strlen('pty-req'), + 'pty-req', + 1, + strlen('vt100'), + 'vt100', + $this->windowColumns, + $this->windowRows, + 0, + 0, + strlen($terminal_modes), + $terminal_modes + ); if (!$this->_send_binary_packet($packet)) { return false; } + $response = $this->_get_binary_packet(); if ($response === false) { user_error('Connection closed by server'); @@ -2331,7 +2466,7 @@ class Net_SSH2 } // sending a pty-req SSH_MSG_CHANNEL_REQUEST message is unnecessary and, in fact, in most cases, slows things - // down. the one place where it might be desirable is if you're doing something like Net_SSH2::exec('ping localhost &'). + // down. the one place where it might be desirable is if you're doing something like \phpseclib\Net\SSH2::exec('ping localhost &'). // with a pty-req SSH_MSG_CHANNEL_REQUEST, exec() will return immediately and the ping process will then // then immediately terminate. without such a request exec() will loop indefinitely. the ping process won't end but // neither will your script. @@ -2339,20 +2474,28 @@ class Net_SSH2 // although, in theory, the size of SSH_MSG_CHANNEL_REQUEST could exceed the maximum packet size established by // SSH_MSG_CHANNEL_OPEN_CONFIRMATION, RFC4254#section-5.1 states that the "maximum packet size" refers to the // "maximum size of an individual data packet". ie. SSH_MSG_CHANNEL_DATA. RFC4254#section-5.2 corroborates. - $packet = pack('CNNa*CNa*', - NET_SSH2_MSG_CHANNEL_REQUEST, $this->server_channels[NET_SSH2_CHANNEL_EXEC], strlen('exec'), 'exec', 1, strlen($command), $command); + $packet = pack( + 'CNNa*CNa*', + NET_SSH2_MSG_CHANNEL_REQUEST, + $this->server_channels[self::CHANNEL_EXEC], + strlen('exec'), + 'exec', + 1, + strlen($command), + $command + ); if (!$this->_send_binary_packet($packet)) { return false; } - $this->channel_status[NET_SSH2_CHANNEL_EXEC] = NET_SSH2_MSG_CHANNEL_REQUEST; + $this->channel_status[self::CHANNEL_EXEC] = NET_SSH2_MSG_CHANNEL_REQUEST; - $response = $this->_get_channel_packet(NET_SSH2_CHANNEL_EXEC); + $response = $this->_get_channel_packet(self::CHANNEL_EXEC); if ($response === false) { return false; } - $this->channel_status[NET_SSH2_CHANNEL_EXEC] = NET_SSH2_MSG_CHANNEL_DATA; + $this->channel_status[self::CHANNEL_EXEC] = NET_SSH2_MSG_CHANNEL_DATA; if ($callback === false || $this->in_request_pty_exec) { return true; @@ -2360,7 +2503,7 @@ class Net_SSH2 $output = ''; while (true) { - $temp = $this->_get_channel_packet(NET_SSH2_CHANNEL_EXEC); + $temp = $this->_get_channel_packet(self::CHANNEL_EXEC); switch (true) { case $temp === true: return is_callable($callback) ? true : $output; @@ -2369,7 +2512,7 @@ class Net_SSH2 default: if (is_callable($callback)) { if (call_user_func($callback, $temp) === true) { - $this->_close_channel(NET_SSH2_CHANNEL_EXEC); + $this->_close_channel(self::CHANNEL_EXEC); return true; } } else { @@ -2382,9 +2525,9 @@ class Net_SSH2 /** * Creates an interactive shell * - * @see Net_SSH2::read() - * @see Net_SSH2::write() - * @return Boolean + * @see self::read() + * @see self::write() + * @return bool * @access private */ function _initShell() @@ -2393,27 +2536,47 @@ class Net_SSH2 return true; } - $this->window_size_server_to_client[NET_SSH2_CHANNEL_SHELL] = $this->window_size; + $this->window_size_server_to_client[self::CHANNEL_SHELL] = $this->window_size; $packet_size = 0x4000; - $packet = pack('CNa*N3', - NET_SSH2_MSG_CHANNEL_OPEN, strlen('session'), 'session', NET_SSH2_CHANNEL_SHELL, $this->window_size_server_to_client[NET_SSH2_CHANNEL_SHELL], $packet_size); + $packet = pack( + 'CNa*N3', + NET_SSH2_MSG_CHANNEL_OPEN, + strlen('session'), + 'session', + self::CHANNEL_SHELL, + $this->window_size_server_to_client[self::CHANNEL_SHELL], + $packet_size + ); if (!$this->_send_binary_packet($packet)) { return false; } - $this->channel_status[NET_SSH2_CHANNEL_SHELL] = NET_SSH2_MSG_CHANNEL_OPEN; + $this->channel_status[self::CHANNEL_SHELL] = NET_SSH2_MSG_CHANNEL_OPEN; - $response = $this->_get_channel_packet(NET_SSH2_CHANNEL_SHELL); + $response = $this->_get_channel_packet(self::CHANNEL_SHELL); if ($response === false) { return false; } $terminal_modes = pack('C', NET_SSH2_TTY_OP_END); - $packet = pack('CNNa*CNa*N5a*', - NET_SSH2_MSG_CHANNEL_REQUEST, $this->server_channels[NET_SSH2_CHANNEL_SHELL], strlen('pty-req'), 'pty-req', 1, strlen('vt100'), 'vt100', - $this->windowColumns, $this->windowRows, 0, 0, strlen($terminal_modes), $terminal_modes); + $packet = pack( + 'CNNa*CNa*N5a*', + NET_SSH2_MSG_CHANNEL_REQUEST, + $this->server_channels[self::CHANNEL_SHELL], + strlen('pty-req'), + 'pty-req', + 1, + strlen('vt100'), + 'vt100', + $this->windowColumns, + $this->windowRows, + 0, + 0, + strlen($terminal_modes), + $terminal_modes + ); if (!$this->_send_binary_packet($packet)) { return false; @@ -2437,22 +2600,28 @@ class Net_SSH2 return $this->_disconnect(NET_SSH2_DISCONNECT_BY_APPLICATION); } - $packet = pack('CNNa*C', - NET_SSH2_MSG_CHANNEL_REQUEST, $this->server_channels[NET_SSH2_CHANNEL_SHELL], strlen('shell'), 'shell', 1); + $packet = pack( + 'CNNa*C', + NET_SSH2_MSG_CHANNEL_REQUEST, + $this->server_channels[self::CHANNEL_SHELL], + strlen('shell'), + 'shell', + 1 + ); if (!$this->_send_binary_packet($packet)) { return false; } - $this->channel_status[NET_SSH2_CHANNEL_SHELL] = NET_SSH2_MSG_CHANNEL_REQUEST; + $this->channel_status[self::CHANNEL_SHELL] = NET_SSH2_MSG_CHANNEL_REQUEST; - $response = $this->_get_channel_packet(NET_SSH2_CHANNEL_SHELL); + $response = $this->_get_channel_packet(self::CHANNEL_SHELL); if ($response === false) { return false; } - $this->channel_status[NET_SSH2_CHANNEL_SHELL] = NET_SSH2_MSG_CHANNEL_DATA; + $this->channel_status[self::CHANNEL_SHELL] = NET_SSH2_MSG_CHANNEL_DATA; - $this->bitmap |= NET_SSH2_MASK_SHELL; + $this->bitmap |= self::MASK_SHELL; return true; } @@ -2460,46 +2629,64 @@ class Net_SSH2 /** * Return the channel to be used with read() / write() * - * @see Net_SSH2::read() - * @see Net_SSH2::write() - * @return Integer + * @see self::read() + * @see self::write() + * @return int * @access public */ function _get_interactive_channel() { switch (true) { case $this->in_subsystem: - return NET_SSH2_CHANNEL_SUBSYSTEM; + return self::CHANNEL_SUBSYSTEM; case $this->in_request_pty_exec: - return NET_SSH2_CHANNEL_EXEC; + return self::CHANNEL_EXEC; default: - return NET_SSH2_CHANNEL_SHELL; + return self::CHANNEL_SHELL; } } + /** + * Return an available open channel + * + * @return int + * @access public + */ + function _get_open_channel() + { + $channel = self::CHANNEL_EXEC; + do { + if (isset($this->channel_status[$channel]) && $this->channel_status[$channel] == NET_SSH2_MSG_CHANNEL_OPEN) { + return $channel; + } + } while ($channel++ < self::CHANNEL_SUBSYSTEM); + + return false; + } + /** * Returns the output of an interactive shell * * Returns when there's a match for $expect, which can take the form of a string literal or, - * if $mode == NET_SSH2_READ_REGEX, a regular expression. + * if $mode == self::READ_REGEX, a regular expression. * - * @see Net_SSH2::write() - * @param String $expect - * @param Integer $mode - * @return String + * @see self::write() + * @param string $expect + * @param int $mode + * @return string * @access public */ - function read($expect = '', $mode = NET_SSH2_READ_SIMPLE) + function read($expect = '', $mode = self::READ_SIMPLE) { $this->curTimeout = $this->timeout; $this->is_timeout = false; - if (!($this->bitmap & NET_SSH2_MASK_LOGIN)) { + if (!($this->bitmap & self::MASK_LOGIN)) { user_error('Operation disallowed prior to login()'); return false; } - if (!($this->bitmap & NET_SSH2_MASK_SHELL) && !$this->_initShell()) { + if (!($this->bitmap & self::MASK_SHELL) && !$this->_initShell()) { user_error('Unable to initiate an interactive shell session'); return false; } @@ -2508,8 +2695,8 @@ class Net_SSH2 $match = $expect; while (true) { - if ($mode == NET_SSH2_READ_REGEX) { - preg_match($expect, $this->interactiveBuffer, $matches); + if ($mode == self::READ_REGEX) { + preg_match($expect, substr($this->interactiveBuffer, -1024), $matches); $match = isset($matches[0]) ? $matches[0] : ''; } $pos = strlen($match) ? strpos($this->interactiveBuffer, $match) : false; @@ -2529,19 +2716,19 @@ class Net_SSH2 /** * Inputs a command into an interactive shell. * - * @see Net_SSH2::read() - * @param String $cmd - * @return Boolean + * @see self::read() + * @param string $cmd + * @return bool * @access public */ function write($cmd) { - if (!($this->bitmap & NET_SSH2_MASK_LOGIN)) { + if (!($this->bitmap & self::MASK_LOGIN)) { user_error('Operation disallowed prior to login()'); return false; } - if (!($this->bitmap & NET_SSH2_MASK_SHELL) && !$this->_initShell()) { + if (!($this->bitmap & self::MASK_SHELL) && !$this->_initShell()) { user_error('Unable to initiate an interactive shell session'); return false; } @@ -2558,46 +2745,61 @@ class Net_SSH2 * returns that and then that that was passed into stopSubsystem() but that'll be saved for a future date and implemented * if there's sufficient demand for such a feature. * - * @see Net_SSH2::stopSubsystem() - * @param String $subsystem - * @return Boolean + * @see self::stopSubsystem() + * @param string $subsystem + * @return bool * @access public */ function startSubsystem($subsystem) { - $this->window_size_server_to_client[NET_SSH2_CHANNEL_SUBSYSTEM] = $this->window_size; + $this->window_size_server_to_client[self::CHANNEL_SUBSYSTEM] = $this->window_size; - $packet = pack('CNa*N3', - NET_SSH2_MSG_CHANNEL_OPEN, strlen('session'), 'session', NET_SSH2_CHANNEL_SUBSYSTEM, $this->window_size, 0x4000); + $packet = pack( + 'CNa*N3', + NET_SSH2_MSG_CHANNEL_OPEN, + strlen('session'), + 'session', + self::CHANNEL_SUBSYSTEM, + $this->window_size, + 0x4000 + ); if (!$this->_send_binary_packet($packet)) { return false; } - $this->channel_status[NET_SSH2_CHANNEL_SUBSYSTEM] = NET_SSH2_MSG_CHANNEL_OPEN; + $this->channel_status[self::CHANNEL_SUBSYSTEM] = NET_SSH2_MSG_CHANNEL_OPEN; - $response = $this->_get_channel_packet(NET_SSH2_CHANNEL_SUBSYSTEM); + $response = $this->_get_channel_packet(self::CHANNEL_SUBSYSTEM); if ($response === false) { return false; } - $packet = pack('CNNa*CNa*', - NET_SSH2_MSG_CHANNEL_REQUEST, $this->server_channels[NET_SSH2_CHANNEL_SUBSYSTEM], strlen('subsystem'), 'subsystem', 1, strlen($subsystem), $subsystem); + $packet = pack( + 'CNNa*CNa*', + NET_SSH2_MSG_CHANNEL_REQUEST, + $this->server_channels[self::CHANNEL_SUBSYSTEM], + strlen('subsystem'), + 'subsystem', + 1, + strlen($subsystem), + $subsystem + ); if (!$this->_send_binary_packet($packet)) { return false; } - $this->channel_status[NET_SSH2_CHANNEL_SUBSYSTEM] = NET_SSH2_MSG_CHANNEL_REQUEST; + $this->channel_status[self::CHANNEL_SUBSYSTEM] = NET_SSH2_MSG_CHANNEL_REQUEST; - $response = $this->_get_channel_packet(NET_SSH2_CHANNEL_SUBSYSTEM); + $response = $this->_get_channel_packet(self::CHANNEL_SUBSYSTEM); if ($response === false) { - return false; + return false; } - $this->channel_status[NET_SSH2_CHANNEL_SUBSYSTEM] = NET_SSH2_MSG_CHANNEL_DATA; + $this->channel_status[self::CHANNEL_SUBSYSTEM] = NET_SSH2_MSG_CHANNEL_DATA; - $this->bitmap |= NET_SSH2_MASK_SHELL; + $this->bitmap |= self::MASK_SHELL; $this->in_subsystem = true; return true; @@ -2606,14 +2808,14 @@ class Net_SSH2 /** * Stops a subsystem. * - * @see Net_SSH2::startSubsystem() - * @return Boolean + * @see self::startSubsystem() + * @return bool * @access public */ function stopSubsystem() { $this->in_subsystem = false; - $this->_close_channel(NET_SSH2_CHANNEL_SUBSYSTEM); + $this->_close_channel(self::CHANNEL_SUBSYSTEM); return true; } @@ -2670,12 +2872,23 @@ class Net_SSH2 /** * Is the connection still active? * - * @return boolean + * @return bool * @access public */ function isConnected() { - return (bool) ($this->bitmap & NET_SSH2_MASK_CONNECTED); + return (bool) ($this->bitmap & self::MASK_CONNECTED); + } + + /** + * Have you successfully been logged in? + * + * @return bool + * @access public + */ + function isAuthenticated() + { + return (bool) ($this->bitmap & self::MASK_LOGIN); } /** @@ -2683,8 +2896,8 @@ class Net_SSH2 * * See '6. Binary Packet Protocol' of rfc4253 for more info. * - * @see Net_SSH2::_send_binary_packet() - * @return String + * @see self::_send_binary_packet() + * @return string * @access private */ function _get_binary_packet() @@ -2695,8 +2908,8 @@ class Net_SSH2 return false; } - $start = strtok(microtime(), ' ') + strtok(''); // http://php.net/microtime#61838 - $raw = fread($this->fsock, $this->decrypt_block_size); + $start = microtime(true); + $raw = stream_get_contents($this->fsock, $this->decrypt_block_size); if (!strlen($raw)) { return ''; @@ -2724,7 +2937,7 @@ class Net_SSH2 $buffer = ''; while ($remaining_length > 0) { - $temp = fread($this->fsock, $remaining_length); + $temp = stream_get_contents($this->fsock, $remaining_length); if ($temp === false || feof($this->fsock)) { user_error('Error reading from socket'); $this->bitmap = 0; @@ -2733,7 +2946,7 @@ class Net_SSH2 $buffer.= $temp; $remaining_length-= strlen($temp); } - $stop = strtok(microtime(), ' ') + strtok(''); + $stop = microtime(true); if (strlen($buffer)) { $raw.= $this->decrypt !== false ? $this->decrypt->decrypt($buffer) : $buffer; } @@ -2742,7 +2955,7 @@ class Net_SSH2 $padding = $this->_string_shift($raw, $padding_length); // should leave $raw empty if ($this->hmac_check !== false) { - $hmac = fread($this->fsock, $this->hmac_size); + $hmac = stream_get_contents($this->fsock, $this->hmac_size); if ($hmac === false || strlen($hmac) != $this->hmac_size) { user_error('Error reading socket'); $this->bitmap = 0; @@ -2760,7 +2973,7 @@ class Net_SSH2 $this->get_seq_no++; if (defined('NET_SSH2_LOGGING')) { - $current = strtok(microtime(), ' ') + strtok(''); + $current = microtime(true); $message_number = isset($this->message_numbers[ord($payload[0])]) ? $this->message_numbers[ord($payload[0])] : 'UNKNOWN (' . ord($payload[0]) . ')'; $message_number = '<- ' . $message_number . ' (since last: ' . round($current - $this->last_packet, 4) . ', network: ' . round($stop - $start, 4) . 's)'; @@ -2776,8 +2989,8 @@ class Net_SSH2 * * Because some binary packets need to be ignored... * - * @see Net_SSH2::_get_binary_packet() - * @return String + * @see self::_get_binary_packet() + * @return string * @access private */ function _filter($payload) @@ -2811,7 +3024,7 @@ class Net_SSH2 } // see http://tools.ietf.org/html/rfc4252#section-5.4; only called when the encryption has been activated and when we haven't already logged in - if (($this->bitmap & NET_SSH2_MASK_CONNECTED) && !($this->bitmap & NET_SSH2_MASK_LOGIN) && ord($payload[0]) == NET_SSH2_MSG_USERAUTH_BANNER) { + if (($this->bitmap & self::MASK_CONNECTED) && !($this->bitmap & self::MASK_LOGIN) && ord($payload[0]) == NET_SSH2_MSG_USERAUTH_BANNER) { $this->_string_shift($payload, 1); extract(unpack('Nlength', $this->_string_shift($payload, 4))); $this->banner_message = utf8_decode($this->_string_shift($payload, $length)); @@ -2819,12 +3032,11 @@ class Net_SSH2 } // only called when we've already logged in - if (($this->bitmap & NET_SSH2_MASK_CONNECTED) && ($this->bitmap & NET_SSH2_MASK_LOGIN)) { + if (($this->bitmap & self::MASK_CONNECTED) && ($this->bitmap & self::MASK_LOGIN)) { switch (ord($payload[0])) { case NET_SSH2_MSG_GLOBAL_REQUEST: // see http://tools.ietf.org/html/rfc4254#section-4 - $this->_string_shift($payload, 1); - extract(unpack('Nlength', $this->_string_shift($payload))); - $this->errors[] = 'SSH_MSG_GLOBAL_REQUEST: ' . utf8_decode($this->_string_shift($payload, $length)); + extract(unpack('Nlength', $this->_string_shift($payload, 4))); + $this->errors[] = 'SSH_MSG_GLOBAL_REQUEST: ' . $this->_string_shift($payload, $length); if (!$this->_send_binary_packet(pack('C', NET_SSH2_MSG_REQUEST_FAILURE))) { return $this->_disconnect(NET_SSH2_DISCONNECT_BY_APPLICATION); @@ -2835,18 +3047,55 @@ class Net_SSH2 case NET_SSH2_MSG_CHANNEL_OPEN: // see http://tools.ietf.org/html/rfc4254#section-5.1 $this->_string_shift($payload, 1); extract(unpack('Nlength', $this->_string_shift($payload, 4))); - $this->errors[] = 'SSH_MSG_CHANNEL_OPEN: ' . utf8_decode($this->_string_shift($payload, $length)); - - $this->_string_shift($payload, 4); // skip over client channel + $data = $this->_string_shift($payload, $length); extract(unpack('Nserver_channel', $this->_string_shift($payload, 4))); + switch ($data) { + case 'auth-agent': + case 'auth-agent@openssh.com': + if (isset($this->agent)) { + $new_channel = self::CHANNEL_AGENT_FORWARD; - $packet = pack('CN3a*Na*', - NET_SSH2_MSG_REQUEST_FAILURE, $server_channel, NET_SSH2_OPEN_ADMINISTRATIVELY_PROHIBITED, 0, '', 0, ''); + extract(unpack('Nremote_window_size', $this->_string_shift($payload, 4))); + extract(unpack('Nremote_maximum_packet_size', $this->_string_shift($payload, 4))); - if (!$this->_send_binary_packet($packet)) { - return $this->_disconnect(NET_SSH2_DISCONNECT_BY_APPLICATION); + $this->packet_size_client_to_server[$new_channel] = $remote_window_size; + $this->window_size_server_to_client[$new_channel] = $remote_maximum_packet_size; + $this->window_size_client_to_server[$new_channel] = $this->window_size; + + $packet_size = 0x4000; + + $packet = pack( + 'CN4', + NET_SSH2_MSG_CHANNEL_OPEN_CONFIRMATION, + $server_channel, + $new_channel, + $packet_size, + $packet_size + ); + + $this->server_channels[$new_channel] = $server_channel; + $this->channel_status[$new_channel] = NET_SSH2_MSG_CHANNEL_OPEN_CONFIRMATION; + if (!$this->_send_binary_packet($packet)) { + return false; + } + } + break; + default: + $packet = pack( + 'CN3a*Na*', + NET_SSH2_MSG_REQUEST_FAILURE, + $server_channel, + NET_SSH2_OPEN_ADMINISTRATIVELY_PROHIBITED, + 0, + '', + 0, + '' + ); + + if (!$this->_send_binary_packet($packet)) { + return $this->_disconnect(NET_SSH2_DISCONNECT_BY_APPLICATION); + } } - $payload = $this->_get_binary_packet(); break; case NET_SSH2_MSG_CHANNEL_WINDOW_ADJUST: @@ -2855,7 +3104,7 @@ class Net_SSH2 extract(unpack('Nwindow_size', $this->_string_shift($payload, 4))); $this->window_size_client_to_server[$channel]+= $window_size; - $payload = ($this->bitmap & NET_SSH2_MASK_WINDOW_ADJUST) ? true : $this->_get_binary_packet(); + $payload = ($this->bitmap & self::MASK_WINDOW_ADJUST) ? true : $this->_get_binary_packet(); } } @@ -2889,11 +3138,10 @@ class Net_SSH2 /** * Returns whether Quiet Mode is enabled or not * - * @see Net_SSH2::enableQuietMode() - * @see Net_SSH2::disableQuietMode() - * + * @see self::enableQuietMode() + * @see self::disableQuietMode() * @access public - * @return boolean + * @return bool */ function isQuietModeEnabled() { @@ -2923,11 +3171,10 @@ class Net_SSH2 /** * Returns whether request-pty is enabled or not * - * @see Net_SSH2::enablePTY() - * @see Net_SSH2::disablePTY() - * + * @see self::enablePTY() + * @see self::disablePTY() * @access public - * @return boolean + * @return bool */ function isPTYEnabled() { @@ -2940,7 +3187,7 @@ class Net_SSH2 * Returns the data as a string if it's available and false if not. * * @param $client_channel - * @return Mixed + * @return mixed * @access private */ function _get_channel_packet($client_channel, $skip_extended = false) @@ -2959,7 +3206,7 @@ class Net_SSH2 $read = array($this->fsock); $write = $except = null; - $start = strtok(microtime(), ' ') + strtok(''); // http://php.net/microtime#61838 + $start = microtime(true); $sec = floor($this->curTimeout); $usec = 1000000 * ($this->curTimeout - $sec); // on windows this returns a "Warning: Invalid CRT parameters detected" error @@ -2967,7 +3214,7 @@ class Net_SSH2 $this->is_timeout = true; return true; } - $elapsed = strtok(microtime(), ' ') + strtok('') - $start; + $elapsed = microtime(true) - $start; $this->curTimeout-= $elapsed; } @@ -2983,48 +3230,63 @@ class Net_SSH2 return ''; } - extract(unpack('Ctype/Nchannel', $this->_string_shift($response, 5))); + extract(unpack('Ctype', $this->_string_shift($response, 1))); - $this->window_size_server_to_client[$channel]-= strlen($response); - - // resize the window, if appropriate - if ($this->window_size_server_to_client[$channel] < 0) { - $packet = pack('CNN', NET_SSH2_MSG_CHANNEL_WINDOW_ADJUST, $this->server_channels[$channel], $this->window_size); - if (!$this->_send_binary_packet($packet)) { - return false; - } - $this->window_size_server_to_client[$channel]+= $this->window_size; + if ($type == NET_SSH2_MSG_CHANNEL_OPEN) { + extract(unpack('Nlength', $this->_string_shift($response, 4))); + } else { + extract(unpack('Nchannel', $this->_string_shift($response, 4))); } - switch ($this->channel_status[$channel]) { - case NET_SSH2_MSG_CHANNEL_OPEN: - switch ($type) { - case NET_SSH2_MSG_CHANNEL_OPEN_CONFIRMATION: - extract(unpack('Nserver_channel', $this->_string_shift($response, 4))); - $this->server_channels[$channel] = $server_channel; - extract(unpack('Nwindow_size', $this->_string_shift($response, 4))); - $this->window_size_client_to_server[$channel] = $window_size; - $temp = unpack('Npacket_size_client_to_server', $this->_string_shift($response, 4)); - $this->packet_size_client_to_server[$channel] = $temp['packet_size_client_to_server']; - return $client_channel == $channel ? true : $this->_get_channel_packet($client_channel, $skip_extended); - //case NET_SSH2_MSG_CHANNEL_OPEN_FAILURE: - default: - user_error('Unable to open channel'); - return $this->_disconnect(NET_SSH2_DISCONNECT_BY_APPLICATION); + // will not be setup yet on incoming channel open request + if (isset($channel) && isset($this->channel_status[$channel]) && isset($this->window_size_server_to_client[$channel])) { + $this->window_size_server_to_client[$channel]-= strlen($response); + + // resize the window, if appropriate + if ($this->window_size_server_to_client[$channel] < 0) { + $packet = pack('CNN', NET_SSH2_MSG_CHANNEL_WINDOW_ADJUST, $this->server_channels[$channel], $this->window_size); + if (!$this->_send_binary_packet($packet)) { + return false; } - break; - case NET_SSH2_MSG_CHANNEL_REQUEST: - switch ($type) { - case NET_SSH2_MSG_CHANNEL_SUCCESS: - return true; - case NET_SSH2_MSG_CHANNEL_FAILURE: - return false; - default: - user_error('Unable to fulfill channel request'); - return $this->_disconnect(NET_SSH2_DISCONNECT_BY_APPLICATION); - } - case NET_SSH2_MSG_CHANNEL_CLOSE: - return $type == NET_SSH2_MSG_CHANNEL_CLOSE ? true : $this->_get_channel_packet($client_channel, $skip_extended); + $this->window_size_server_to_client[$channel]+= $this->window_size; + } + + switch ($this->channel_status[$channel]) { + case NET_SSH2_MSG_CHANNEL_OPEN: + switch ($type) { + case NET_SSH2_MSG_CHANNEL_OPEN_CONFIRMATION: + extract(unpack('Nserver_channel', $this->_string_shift($response, 4))); + $this->server_channels[$channel] = $server_channel; + extract(unpack('Nwindow_size', $this->_string_shift($response, 4))); + if ($window_size < 0) { + $window_size&= 0x7FFFFFFF; + $window_size+= 0x80000000; + } + $this->window_size_client_to_server[$channel] = $window_size; + $temp = unpack('Npacket_size_client_to_server', $this->_string_shift($response, 4)); + $this->packet_size_client_to_server[$channel] = $temp['packet_size_client_to_server']; + $result = $client_channel == $channel ? true : $this->_get_channel_packet($client_channel, $skip_extended); + $this->_on_channel_open(); + return $result; + //case NET_SSH2_MSG_CHANNEL_OPEN_FAILURE: + default: + user_error('Unable to open channel'); + return $this->_disconnect(NET_SSH2_DISCONNECT_BY_APPLICATION); + } + break; + case NET_SSH2_MSG_CHANNEL_REQUEST: + switch ($type) { + case NET_SSH2_MSG_CHANNEL_SUCCESS: + return true; + case NET_SSH2_MSG_CHANNEL_FAILURE: + return false; + default: + user_error('Unable to fulfill channel request'); + return $this->_disconnect(NET_SSH2_DISCONNECT_BY_APPLICATION); + } + case NET_SSH2_MSG_CHANNEL_CLOSE: + return $type == NET_SSH2_MSG_CHANNEL_CLOSE ? true : $this->_get_channel_packet($client_channel, $skip_extended); + } } // ie. $this->channel_status[$channel] == NET_SSH2_MSG_CHANNEL_DATA @@ -3032,7 +3294,7 @@ class Net_SSH2 switch ($type) { case NET_SSH2_MSG_CHANNEL_DATA: /* - if ($channel == NET_SSH2_CHANNEL_EXEC) { + if ($channel == self::CHANNEL_EXEC) { // SCP requires null packets, such as this, be sent. further, in the case of the ssh.com SSH server // this actually seems to make things twice as fast. more to the point, the message right after // SSH_MSG_CHANNEL_DATA (usually SSH_MSG_IGNORE) won't block for as long as it would have otherwise. @@ -3042,6 +3304,15 @@ class Net_SSH2 */ extract(unpack('Nlength', $this->_string_shift($response, 4))); $data = $this->_string_shift($response, $length); + + if ($channel == self::CHANNEL_AGENT_FORWARD) { + $agent_response = $this->agent->_forward_data($data); + if (!is_bool($agent_response)) { + $this->_send_channel_packet($channel, $agent_response); + } + break; + } + if ($client_channel == $channel) { return $data; } @@ -3052,7 +3323,7 @@ class Net_SSH2 break; case NET_SSH2_MSG_CHANNEL_EXTENDED_DATA: /* - if ($client_channel == NET_SSH2_CHANNEL_EXEC) { + if ($client_channel == self::CHANNEL_EXEC) { $this->_send_channel_packet($client_channel, chr(0)); } */ @@ -3108,15 +3379,17 @@ class Net_SSH2 case NET_SSH2_MSG_CHANNEL_CLOSE: $this->curTimeout = 0; - if ($this->bitmap & NET_SSH2_MASK_SHELL) { - $this->bitmap&= ~NET_SSH2_MASK_SHELL; + if ($this->bitmap & self::MASK_SHELL) { + $this->bitmap&= ~self::MASK_SHELL; } if ($this->channel_status[$channel] != NET_SSH2_MSG_CHANNEL_EOF) { $this->_send_binary_packet(pack('CN', NET_SSH2_MSG_CHANNEL_CLOSE, $this->server_channels[$channel])); } $this->channel_status[$channel] = NET_SSH2_MSG_CHANNEL_CLOSE; - return true; + if ($client_channel == $channel) { + return true; + } case NET_SSH2_MSG_CHANNEL_EOF: break; default: @@ -3131,10 +3404,10 @@ class Net_SSH2 * * See '6. Binary Packet Protocol' of rfc4253 for more info. * - * @param String $data - * @param optional String $logged - * @see Net_SSH2::_get_binary_packet() - * @return Boolean + * @param string $data + * @param string $logged + * @see self::_get_binary_packet() + * @return bool * @access private */ function _send_binary_packet($data, $logged = null) @@ -3157,7 +3430,7 @@ class Net_SSH2 $packet_length+= (($this->encrypt_block_size - 1) * $packet_length) % $this->encrypt_block_size; // subtracting strlen($data) is obvious - subtracting 5 is necessary because of packet_length and padding_length $padding_length = $packet_length - strlen($data) - 5; - $padding = crypt_random_string($padding_length); + $padding = Random::string($padding_length); // we subtract 4 from packet_length because the packet_length field isn't supposed to include itself $packet = pack('NCa*', $packet_length - 4, $padding_length, $data . $padding); @@ -3171,12 +3444,12 @@ class Net_SSH2 $packet.= $hmac; - $start = strtok(microtime(), ' ') + strtok(''); // http://php.net/microtime#61838 + $start = microtime(true); $result = strlen($packet) == fputs($this->fsock, $packet); - $stop = strtok(microtime(), ' ') + strtok(''); + $stop = microtime(true); if (defined('NET_SSH2_LOGGING')) { - $current = strtok(microtime(), ' ') + strtok(''); + $current = microtime(true); $message_number = isset($this->message_numbers[ord($data[0])]) ? $this->message_numbers[ord($data[0])] : 'UNKNOWN (' . ord($data[0]) . ')'; $message_number = '-> ' . $message_number . ' (since last: ' . round($current - $this->last_packet, 4) . ', network: ' . round($stop - $start, 4) . 's)'; @@ -3192,7 +3465,7 @@ class Net_SSH2 * * Makes sure that only the last 1MB worth of packets will be logged * - * @param String $data + * @param string $data * @access private */ function _append_log($message_number, $message) @@ -3204,15 +3477,15 @@ class Net_SSH2 switch (NET_SSH2_LOGGING) { // useful for benchmarks - case NET_SSH2_LOG_SIMPLE: + case self::LOG_SIMPLE: $this->message_number_log[] = $message_number; break; // the most useful log for SSH2 - case NET_SSH2_LOG_COMPLEX: + case self::LOG_COMPLEX: $this->message_number_log[] = $message_number; $this->log_size+= strlen($message); $this->message_log[] = $message; - while ($this->log_size > NET_SSH2_LOG_MAX_SIZE) { + while ($this->log_size > self::LOG_MAX_SIZE) { $this->log_size-= strlen(array_shift($this->message_log)); array_shift($this->message_number_log); } @@ -3220,7 +3493,7 @@ class Net_SSH2 // dump the output out realtime; packets may be interspersed with non packets, // passwords won't be filtered out and select other packets may not be correctly // identified - case NET_SSH2_LOG_REALTIME: + case self::LOG_REALTIME: switch (PHP_SAPI) { case 'cli': $start = $stop = "\r\n"; @@ -3233,14 +3506,14 @@ class Net_SSH2 @flush(); @ob_flush(); break; - // basically the same thing as NET_SSH2_LOG_REALTIME with the caveat that NET_SSH2_LOG_REALTIME_FILE - // needs to be defined and that the resultant log file will be capped out at NET_SSH2_LOG_MAX_SIZE. + // basically the same thing as self::LOG_REALTIME with the caveat that self::LOG_REALTIME_FILE + // needs to be defined and that the resultant log file will be capped out at self::LOG_MAX_SIZE. // the earliest part of the log file is denoted by the first <<< START >>> and is not going to necessarily // at the beginning of the file - case NET_SSH2_LOG_REALTIME_FILE: + case self::LOG_REALTIME_FILE: if (!isset($this->realtime_log_file)) { // PHP doesn't seem to like using constants in fopen() - $filename = NET_SSH2_LOG_REALTIME_FILENAME; + $filename = self::LOG_REALTIME_FILENAME; $fp = fopen($filename, 'w'); $this->realtime_log_file = $fp; } @@ -3254,7 +3527,7 @@ class Net_SSH2 fseek($this->realtime_log_file, ftell($this->realtime_log_file) - strlen($temp)); } $this->realtime_log_size+= strlen($entry); - if ($this->realtime_log_size > NET_SSH2_LOG_MAX_SIZE) { + if ($this->realtime_log_size > self::LOG_MAX_SIZE) { fseek($this->realtime_log_file, 0); $this->realtime_log_size = strlen($entry); $this->realtime_log_wrap = true; @@ -3268,19 +3541,19 @@ class Net_SSH2 * * Spans multiple SSH_MSG_CHANNEL_DATAs if appropriate * - * @param Integer $client_channel - * @param String $data - * @return Boolean + * @param int $client_channel + * @param string $data + * @return bool * @access private */ function _send_channel_packet($client_channel, $data) { while (strlen($data)) { if (!$this->window_size_client_to_server[$client_channel]) { - $this->bitmap^= NET_SSH2_MASK_WINDOW_ADJUST; + $this->bitmap^= self::MASK_WINDOW_ADJUST; // using an invalid channel will let the buffers be built up for the valid channels $this->_get_channel_packet(-1); - $this->bitmap^= NET_SSH2_MASK_WINDOW_ADJUST; + $this->bitmap^= self::MASK_WINDOW_ADJUST; } /* The maximum amount of data allowed is determined by the maximum @@ -3293,7 +3566,8 @@ class Net_SSH2 ); $temp = $this->_string_shift($data, $max_size); - $packet = pack('CN2a*', + $packet = pack( + 'CN2a*', NET_SSH2_MSG_CHANNEL_DATA, $this->server_channels[$client_channel], strlen($temp), @@ -3311,13 +3585,13 @@ class Net_SSH2 /** * Closes and flushes a channel * - * Net_SSH2 doesn't properly close most channels. For exec() channels are normally closed by the server + * \phpseclib\Net\SSH2 doesn't properly close most channels. For exec() channels are normally closed by the server * and for SFTP channels are presumably closed when the client disconnects. This functions is intended * for SCP more than anything. * - * @param Integer $client_channel - * @param Boolean $want_reply - * @return Boolean + * @param int $client_channel + * @param bool $want_reply + * @return bool * @access private */ function _close_channel($client_channel, $want_reply = false) @@ -3334,27 +3608,28 @@ class Net_SSH2 $this->curTimeout = 0; - while (!is_bool($this->_get_channel_packet($client_channel))); + while (!is_bool($this->_get_channel_packet($client_channel))) { + } if ($want_reply) { $this->_send_binary_packet(pack('CN', NET_SSH2_MSG_CHANNEL_CLOSE, $this->server_channels[$client_channel])); } - if ($this->bitmap & NET_SSH2_MASK_SHELL) { - $this->bitmap&= ~NET_SSH2_MASK_SHELL; + if ($this->bitmap & self::MASK_SHELL) { + $this->bitmap&= ~self::MASK_SHELL; } } /** * Disconnect * - * @param Integer $reason - * @return Boolean + * @param int $reason + * @return bool * @access private */ function _disconnect($reason) { - if ($this->bitmap & NET_SSH2_MASK_CONNECTED) { + if ($this->bitmap & self::MASK_CONNECTED) { $data = pack('CNNa*Na*', NET_SSH2_MSG_DISCONNECT, $reason, 0, '', 0, ''); $this->_send_binary_packet($data); $this->bitmap = 0; @@ -3368,9 +3643,9 @@ class Net_SSH2 * * Inspired by array_shift * - * @param String $string - * @param optional Integer $index - * @return String + * @param string $string + * @param int $index + * @return string * @access private */ function _string_shift(&$string, $index = 1) @@ -3387,14 +3662,14 @@ class Net_SSH2 * named constants from it, using the value as the name of the constant and the index as the value of the constant. * If any of the constants that would be defined already exists, none of the constants will be defined. * - * @param Array $array + * @param array $array * @access private */ function _define_array() { $args = func_get_args(); foreach ($args as $arg) { - foreach ($arg as $key=>$value) { + foreach ($arg as $key => $value) { if (!defined($value)) { define($value, $key); } else { @@ -3407,10 +3682,10 @@ class Net_SSH2 /** * Returns a log of the packets that have been sent and received. * - * Returns a string if NET_SSH2_LOGGING == NET_SSH2_LOG_COMPLEX, an array if NET_SSH2_LOGGING == NET_SSH2_LOG_SIMPLE and false if !defined('NET_SSH2_LOGGING') + * Returns a string if NET_SSH2_LOGGING == self::LOG_COMPLEX, an array if NET_SSH2_LOGGING == self::LOG_SIMPLE and false if !defined('NET_SSH2_LOGGING') * * @access public - * @return String or Array + * @return array|false|string */ function getLog() { @@ -3419,10 +3694,10 @@ class Net_SSH2 } switch (NET_SSH2_LOGGING) { - case NET_SSH2_LOG_SIMPLE: + case self::LOG_SIMPLE: return $this->message_number_log; break; - case NET_SSH2_LOG_COMPLEX: + case self::LOG_COMPLEX: return $this->_format_log($this->message_log, $this->message_number_log); break; default: @@ -3433,10 +3708,10 @@ class Net_SSH2 /** * Formats a log for printing * - * @param Array $message_log - * @param Array $message_number_log + * @param array $message_log + * @param array $message_number_log * @access private - * @return String + * @return string */ function _format_log($message_log, $message_number_log) { @@ -3469,19 +3744,54 @@ class Net_SSH2 * * For use with preg_replace_callback() * - * @param Array $matches + * @param array $matches * @access private - * @return String + * @return string */ function _format_log_helper($matches) { return $this->log_boundary . str_pad(dechex(ord($matches[0])), 2, '0', STR_PAD_LEFT); } + /** + * Helper function for agent->_on_channel_open() + * + * Used when channels are created to inform agent + * of said channel opening. Must be called after + * channel open confirmation received + * + * @access private + */ + function _on_channel_open() + { + if (isset($this->agent)) { + $this->agent->_on_channel_open($this); + } + } + + /** + * Returns the first value of the intersection of two arrays or false if + * the intersection is empty. The order is defined by the first parameter. + * + * @param array $array1 + * @param array $array2 + * @return mixed False if intersection is empty, else intersected value. + * @access private + */ + function _array_intersect_first($array1, $array2) + { + foreach ($array1 as $value) { + if (in_array($value, $array2)) { + return $value; + } + } + return false; + } + /** * Returns all errors * - * @return String + * @return string[] * @access public */ function getErrors() @@ -3492,18 +3802,22 @@ class Net_SSH2 /** * Returns the last error * - * @return String + * @return string * @access public */ function getLastError() { - return $this->errors[count($this->errors) - 1]; + $count = count($this->errors); + + if ($count > 0) { + return $this->errors[$count - 1]; + } } /** * Return the server identification. * - * @return String + * @return string * @access public */ function getServerIdentification() @@ -3516,7 +3830,7 @@ class Net_SSH2 /** * Return a list of the key exchange algorithms the server supports. * - * @return Array + * @return array * @access public */ function getKexAlgorithms() @@ -3529,7 +3843,7 @@ class Net_SSH2 /** * Return a list of the host key (public key) algorithms the server supports. * - * @return Array + * @return array * @access public */ function getServerHostKeyAlgorithms() @@ -3542,7 +3856,7 @@ class Net_SSH2 /** * Return a list of the (symmetric key) encryption algorithms the server supports, when receiving stuff from the client. * - * @return Array + * @return array * @access public */ function getEncryptionAlgorithmsClient2Server() @@ -3555,7 +3869,7 @@ class Net_SSH2 /** * Return a list of the (symmetric key) encryption algorithms the server supports, when sending stuff to the client. * - * @return Array + * @return array * @access public */ function getEncryptionAlgorithmsServer2Client() @@ -3568,7 +3882,7 @@ class Net_SSH2 /** * Return a list of the MAC algorithms the server supports, when receiving stuff from the client. * - * @return Array + * @return array * @access public */ function getMACAlgorithmsClient2Server() @@ -3581,7 +3895,7 @@ class Net_SSH2 /** * Return a list of the MAC algorithms the server supports, when sending stuff to the client. * - * @return Array + * @return array * @access public */ function getMACAlgorithmsServer2Client() @@ -3594,7 +3908,7 @@ class Net_SSH2 /** * Return a list of the compression algorithms the server supports, when receiving stuff from the client. * - * @return Array + * @return array * @access public */ function getCompressionAlgorithmsClient2Server() @@ -3607,7 +3921,7 @@ class Net_SSH2 /** * Return a list of the compression algorithms the server supports, when sending stuff to the client. * - * @return Array + * @return array * @access public */ function getCompressionAlgorithmsServer2Client() @@ -3620,7 +3934,7 @@ class Net_SSH2 /** * Return a list of the languages the server supports, when sending stuff to the client. * - * @return Array + * @return array * @access public */ function getLanguagesServer2Client() @@ -3633,7 +3947,7 @@ class Net_SSH2 /** * Return a list of the languages the server supports, when receiving stuff from the client. * - * @return Array + * @return array * @access public */ function getLanguagesClient2Server() @@ -3649,7 +3963,7 @@ class Net_SSH2 * Quoting from the RFC, "in some jurisdictions, sending a warning message before * authentication may be relevant for getting legal protection." * - * @return String + * @return string * @access public */ function getBannerMessage() @@ -3663,12 +3977,12 @@ class Net_SSH2 * Caching this the first time you connect to a server and checking the result on subsequent connections * is recommended. Returns false if the server signature is not signed correctly with the public host key. * - * @return Mixed + * @return mixed * @access public */ function getServerPublicHostKey() { - if (!($this->bitmap & NET_SSH2_MASK_CONSTRUCTOR)) { + if (!($this->bitmap & self::MASK_CONSTRUCTOR)) { if (!$this->_connect()) { return false; } @@ -3690,19 +4004,19 @@ class Net_SSH2 switch ($this->signature_format) { case 'ssh-dss': - $zero = new Math_BigInteger(); + $zero = new BigInteger(); $temp = unpack('Nlength', $this->_string_shift($server_public_host_key, 4)); - $p = new Math_BigInteger($this->_string_shift($server_public_host_key, $temp['length']), -256); + $p = new BigInteger($this->_string_shift($server_public_host_key, $temp['length']), -256); $temp = unpack('Nlength', $this->_string_shift($server_public_host_key, 4)); - $q = new Math_BigInteger($this->_string_shift($server_public_host_key, $temp['length']), -256); + $q = new BigInteger($this->_string_shift($server_public_host_key, $temp['length']), -256); $temp = unpack('Nlength', $this->_string_shift($server_public_host_key, 4)); - $g = new Math_BigInteger($this->_string_shift($server_public_host_key, $temp['length']), -256); + $g = new BigInteger($this->_string_shift($server_public_host_key, $temp['length']), -256); $temp = unpack('Nlength', $this->_string_shift($server_public_host_key, 4)); - $y = new Math_BigInteger($this->_string_shift($server_public_host_key, $temp['length']), -256); + $y = new BigInteger($this->_string_shift($server_public_host_key, $temp['length']), -256); /* The value for 'dss_signature_blob' is encoded as a string containing r, followed by s (which are 160-bit integers, without lengths or @@ -3713,8 +4027,8 @@ class Net_SSH2 return $this->_disconnect(NET_SSH2_DISCONNECT_KEY_EXCHANGE_FAILED); } - $r = new Math_BigInteger($this->_string_shift($signature, 20), 256); - $s = new Math_BigInteger($this->_string_shift($signature, 20), 256); + $r = new BigInteger($this->_string_shift($signature, 20), 256); + $s = new BigInteger($this->_string_shift($signature, 20), 256); switch (true) { case $r->equals($zero): @@ -3727,7 +4041,7 @@ class Net_SSH2 $w = $s->modInverse($q); - $u1 = $w->multiply(new Math_BigInteger(sha1($this->exchange_hash), 16)); + $u1 = $w->multiply(new BigInteger(sha1($this->exchange_hash), 16)); list(, $u1) = $u1->divide($q); $u2 = $w->multiply($r); @@ -3748,24 +4062,20 @@ class Net_SSH2 break; case 'ssh-rsa': $temp = unpack('Nlength', $this->_string_shift($server_public_host_key, 4)); - $e = new Math_BigInteger($this->_string_shift($server_public_host_key, $temp['length']), -256); + $e = new BigInteger($this->_string_shift($server_public_host_key, $temp['length']), -256); $temp = unpack('Nlength', $this->_string_shift($server_public_host_key, 4)); $rawN = $this->_string_shift($server_public_host_key, $temp['length']); - $n = new Math_BigInteger($rawN, -256); + $n = new BigInteger($rawN, -256); $nLength = strlen(ltrim($rawN, "\0")); /* $temp = unpack('Nlength', $this->_string_shift($signature, 4)); $signature = $this->_string_shift($signature, $temp['length']); - if (!class_exists('Crypt_RSA')) { - include_once 'Crypt/RSA.php'; - } - - $rsa = new Crypt_RSA(); - $rsa->setSignatureMode(CRYPT_RSA_SIGNATURE_PKCS1); - $rsa->loadKey(array('e' => $e, 'n' => $n), CRYPT_RSA_PUBLIC_FORMAT_RAW); + $rsa = new RSA(); + $rsa->setSignatureMode(RSA::SIGNATURE_PKCS1); + $rsa->loadKey(array('e' => $e, 'n' => $n), RSA::PUBLIC_FORMAT_RAW); if (!$rsa->verify($this->exchange_hash, $signature)) { user_error('Bad server signature'); return $this->_disconnect(NET_SSH2_DISCONNECT_HOST_KEY_NOT_VERIFIABLE); @@ -3773,7 +4083,7 @@ class Net_SSH2 */ $temp = unpack('Nlength', $this->_string_shift($signature, 4)); - $s = new Math_BigInteger($this->_string_shift($signature, $temp['length']), 256); + $s = new BigInteger($this->_string_shift($signature, $temp['length']), 256); // validate an RSA signature per "8.2 RSASSA-PKCS1-v1_5", "5.2.2 RSAVP1", and "9.1 EMSA-PSS" in the // following URL: @@ -3781,7 +4091,7 @@ class Net_SSH2 // also, see SSHRSA.c (rsa2_verifysig) in PuTTy's source. - if ($s->compare(new Math_BigInteger()) < 0 || $s->compare($n->subtract(new Math_BigInteger(1))) > 0) { + if ($s->compare(new BigInteger()) < 0 || $s->compare($n->subtract(new BigInteger(1))) > 0) { user_error('Invalid signature'); return $this->_disconnect(NET_SSH2_DISCONNECT_KEY_EXCHANGE_FAILED); } @@ -3808,7 +4118,7 @@ class Net_SSH2 /** * Returns the exit status of an SSH command or false. * - * @return Integer or false + * @return false|int * @access public */ function getExitStatus() @@ -3822,7 +4132,7 @@ class Net_SSH2 /** * Returns the number of columns for the terminal window size. * - * @return Integer + * @return int * @access public */ function getWindowColumns() @@ -3833,7 +4143,7 @@ class Net_SSH2 /** * Returns the number of rows for the terminal window size. * - * @return Integer + * @return int * @access public */ function getWindowRows() @@ -3844,7 +4154,7 @@ class Net_SSH2 /** * Sets the number of columns for the terminal window size. * - * @param Integer $value + * @param int $value * @access public */ function setWindowColumns($value) @@ -3855,7 +4165,7 @@ class Net_SSH2 /** * Sets the number of rows for the terminal window size. * - * @param Integer $value + * @param int $value * @access public */ function setWindowRows($value) @@ -3866,8 +4176,8 @@ class Net_SSH2 /** * Sets the number of columns and rows for the terminal window size. * - * @param Integer $columns - * @param Integer $rows + * @param int $columns + * @param int $rows * @access public */ function setWindowSize($columns = 80, $rows = 24) diff --git a/securemail/vendor/phpseclib/phpseclib/phpseclib/System/SSH/Agent.php b/securemail/vendor/phpseclib/phpseclib/phpseclib/System/SSH/Agent.php index 4c0ef733..a4ff0549 100644 --- a/securemail/vendor/phpseclib/phpseclib/phpseclib/System/SSH/Agent.php +++ b/securemail/vendor/phpseclib/phpseclib/phpseclib/System/SSH/Agent.php @@ -1,18 +1,18 @@ * login('username', $agent)) { * exit('Login Failed'); * } @@ -22,26 +22,8 @@ * ?> * * - * LICENSE: Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in - * all copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN - * THE SOFTWARE. - * * @category System - * @package System_SSH_Agent + * @package SSH\Agent * @author Jim Wigginton * @copyright 2014 Jim Wigginton * @license http://www.opensource.org/licenses/mit-license.html MIT License @@ -49,189 +31,93 @@ * @internal See http://api.libssh.org/rfc/PROTOCOL.agent */ -/**#@+ - * Message numbers - * - * @access private - */ -// to request SSH1 keys you have to use SSH_AGENTC_REQUEST_RSA_IDENTITIES (1) -define('SYSTEM_SSH_AGENTC_REQUEST_IDENTITIES', 11); -// this is the SSH2 response; the SSH1 response is SSH_AGENT_RSA_IDENTITIES_ANSWER (2). -define('SYSTEM_SSH_AGENT_IDENTITIES_ANSWER', 12); -define('SYSTEM_SSH_AGENT_FAILURE', 5); -// the SSH1 request is SSH_AGENTC_RSA_CHALLENGE (3) -define('SYSTEM_SSH_AGENTC_SIGN_REQUEST', 13); -// the SSH1 response is SSH_AGENT_RSA_RESPONSE (4) -define('SYSTEM_SSH_AGENT_SIGN_RESPONSE', 14); -/**#@-*/ +namespace phpseclib\System\SSH; -/** - * Pure-PHP ssh-agent client identity object - * - * Instantiation should only be performed by System_SSH_Agent class. - * This could be thought of as implementing an interface that Crypt_RSA - * implements. ie. maybe a Net_SSH_Auth_PublicKey interface or something. - * The methods in this interface would be getPublicKey, setSignatureMode - * and sign since those are the methods phpseclib looks for to perform - * public key authentication. - * - * @package System_SSH_Agent - * @author Jim Wigginton - * @access internal - */ -class System_SSH_Agent_Identity -{ - /** - * Key Object - * - * @var Crypt_RSA - * @access private - * @see System_SSH_Agent_Identity::getPublicKey() - */ - var $key; - - /** - * Key Blob - * - * @var String - * @access private - * @see System_SSH_Agent_Identity::sign() - */ - var $key_blob; - - /** - * Socket Resource - * - * @var Resource - * @access private - * @see System_SSH_Agent_Identity::sign() - */ - var $fsock; - - /** - * Default Constructor. - * - * @param Resource $fsock - * @return System_SSH_Agent_Identity - * @access private - */ - function System_SSH_Agent_Identity($fsock) - { - $this->fsock = $fsock; - } - - /** - * Set Public Key - * - * Called by System_SSH_Agent::requestIdentities() - * - * @param Crypt_RSA $key - * @access private - */ - function setPublicKey($key) - { - $this->key = $key; - $this->key->setPublicKey(); - } - - /** - * Set Public Key - * - * Called by System_SSH_Agent::requestIdentities(). The key blob could be extracted from $this->key - * but this saves a small amount of computation. - * - * @param String $key_blob - * @access private - */ - function setPublicKeyBlob($key_blob) - { - $this->key_blob = $key_blob; - } - - /** - * Get Public Key - * - * Wrapper for $this->key->getPublicKey() - * - * @param Integer $format optional - * @return Mixed - * @access public - */ - function getPublicKey($format = null) - { - return !isset($format) ? $this->key->getPublicKey() : $this->key->getPublicKey($format); - } - - /** - * Set Signature Mode - * - * Doesn't do anything as ssh-agent doesn't let you pick and choose the signature mode. ie. - * ssh-agent's only supported mode is CRYPT_RSA_SIGNATURE_PKCS1 - * - * @param Integer $mode - * @access public - */ - function setSignatureMode($mode) - { - } - - /** - * Create a signature - * - * See "2.6.2 Protocol 2 private key signature request" - * - * @param String $message - * @return String - * @access public - */ - function sign($message) - { - // the last parameter (currently 0) is for flags and ssh-agent only defines one flag (for ssh-dss): SSH_AGENT_OLD_SIGNATURE - $packet = pack('CNa*Na*N', SYSTEM_SSH_AGENTC_SIGN_REQUEST, strlen($this->key_blob), $this->key_blob, strlen($message), $message, 0); - $packet = pack('Na*', strlen($packet), $packet); - if (strlen($packet) != fputs($this->fsock, $packet)) { - user_error('Connection closed during signing'); - } - - $length = current(unpack('N', fread($this->fsock, 4))); - $type = ord(fread($this->fsock, 1)); - if ($type != SYSTEM_SSH_AGENT_SIGN_RESPONSE) { - user_error('Unable to retreive signature'); - } - - $signature_blob = fread($this->fsock, $length - 1); - // the only other signature format defined - ssh-dss - is the same length as ssh-rsa - // the + 12 is for the other various SSH added length fields - return substr($signature_blob, strlen('ssh-rsa') + 12); - } -} +use phpseclib\Crypt\RSA; +use phpseclib\System\SSH\Agent\Identity; /** * Pure-PHP ssh-agent client identity factory * - * requestIdentities() method pumps out System_SSH_Agent_Identity objects + * requestIdentities() method pumps out \phpseclib\System\SSH\Agent\Identity objects * - * @package System_SSH_Agent + * @package SSH\Agent * @author Jim Wigginton * @access internal */ -class System_SSH_Agent +class Agent { + /**#@+ + * Message numbers + * + * @access private + */ + // to request SSH1 keys you have to use SSH_AGENTC_REQUEST_RSA_IDENTITIES (1) + const SSH_AGENTC_REQUEST_IDENTITIES = 11; + // this is the SSH2 response; the SSH1 response is SSH_AGENT_RSA_IDENTITIES_ANSWER (2). + const SSH_AGENT_IDENTITIES_ANSWER = 12; + // the SSH1 request is SSH_AGENTC_RSA_CHALLENGE (3) + const SSH_AGENTC_SIGN_REQUEST = 13; + // the SSH1 response is SSH_AGENT_RSA_RESPONSE (4) + const SSH_AGENT_SIGN_RESPONSE = 14; + /**#@-*/ + + /**@+ + * Agent forwarding status + * + * @access private + */ + // no forwarding requested and not active + const FORWARD_NONE = 0; + // request agent forwarding when opportune + const FORWARD_REQUEST = 1; + // forwarding has been request and is active + const FORWARD_ACTIVE = 2; + /**#@-*/ + + /** + * Unused + */ + const SSH_AGENT_FAILURE = 5; + /** * Socket Resource * - * @var Resource + * @var resource * @access private */ var $fsock; + /** + * Agent forwarding status + * + * @access private + */ + var $forward_status = self::FORWARD_NONE; + + /** + * Buffer for accumulating forwarded authentication + * agent data arriving on SSH data channel destined + * for agent unix socket + * + * @access private + */ + var $socket_buffer = ''; + + /** + * Tracking the number of bytes we are expecting + * to arrive for the agent socket on the SSH data + * channel + */ + var $expected_bytes = 0; + /** * Default Constructor * - * @return System_SSH_Agent + * @return \phpseclib\System\SSH\Agent * @access public */ - function System_SSH_Agent() + function __construct() { switch (true) { case isset($_SERVER['SSH_AUTH_SOCK']): @@ -255,9 +141,9 @@ class System_SSH_Agent * Request Identities * * See "2.5.2 Requesting a list of protocol 2 keys" - * Returns an array containing zero or more System_SSH_Agent_Identity objects + * Returns an array containing zero or more \phpseclib\System\SSH\Agent\Identity objects * - * @return Array + * @return array * @access public */ function requestIdentities() @@ -266,14 +152,14 @@ class System_SSH_Agent return array(); } - $packet = pack('NC', 1, SYSTEM_SSH_AGENTC_REQUEST_IDENTITIES); + $packet = pack('NC', 1, self::SSH_AGENTC_REQUEST_IDENTITIES); if (strlen($packet) != fputs($this->fsock, $packet)) { user_error('Connection closed while requesting identities'); } $length = current(unpack('N', fread($this->fsock, 4))); $type = ord(fread($this->fsock, 1)); - if ($type != SYSTEM_SSH_AGENT_IDENTITIES_ANSWER) { + if ($type != self::SSH_AGENT_IDENTITIES_ANSWER) { user_error('Unable to request identities'); } @@ -282,17 +168,17 @@ class System_SSH_Agent for ($i = 0; $i < $keyCount; $i++) { $length = current(unpack('N', fread($this->fsock, 4))); $key_blob = fread($this->fsock, $length); + $key_str = 'ssh-rsa ' . base64_encode($key_blob); $length = current(unpack('N', fread($this->fsock, 4))); - $key_comment = fread($this->fsock, $length); + if ($length) { + $key_str.= ' ' . fread($this->fsock, $length); + } $length = current(unpack('N', substr($key_blob, 0, 4))); $key_type = substr($key_blob, 4, $length); switch ($key_type) { case 'ssh-rsa': - if (!class_exists('Crypt_RSA')) { - include_once 'Crypt/RSA.php'; - } - $key = new Crypt_RSA(); - $key->loadKey('ssh-rsa ' . base64_encode($key_blob) . ' ' . $key_comment); + $key = new RSA(); + $key->loadKey($key_str); break; case 'ssh-dss': // not currently supported @@ -300,7 +186,7 @@ class System_SSH_Agent } // resources are passed by reference by default if (isset($key)) { - $identity = new System_SSH_Agent_Identity($this->fsock); + $identity = new Identity($this->fsock); $identity->setPublicKey($key); $identity->setPublicKeyBlob($key_blob); $identities[] = $identity; @@ -310,4 +196,113 @@ class System_SSH_Agent return $identities; } + + /** + * Signal that agent forwarding should + * be requested when a channel is opened + * + * @param Net_SSH2 $ssh + * @return bool + * @access public + */ + function startSSHForwarding($ssh) + { + if ($this->forward_status == self::FORWARD_NONE) { + $this->forward_status = self::FORWARD_REQUEST; + } + } + + /** + * Request agent forwarding of remote server + * + * @param Net_SSH2 $ssh + * @return bool + * @access private + */ + function _request_forwarding($ssh) + { + $request_channel = $ssh->_get_open_channel(); + if ($request_channel === false) { + return false; + } + + $packet = pack( + 'CNNa*C', + NET_SSH2_MSG_CHANNEL_REQUEST, + $ssh->server_channels[$request_channel], + strlen('auth-agent-req@openssh.com'), + 'auth-agent-req@openssh.com', + 1 + ); + + $ssh->channel_status[$request_channel] = NET_SSH2_MSG_CHANNEL_REQUEST; + + if (!$ssh->_send_binary_packet($packet)) { + return false; + } + + $response = $ssh->_get_channel_packet($request_channel); + if ($response === false) { + return false; + } + + $ssh->channel_status[$request_channel] = NET_SSH2_MSG_CHANNEL_OPEN; + $this->forward_status = self::FORWARD_ACTIVE; + + return true; + } + + /** + * On successful channel open + * + * This method is called upon successful channel + * open to give the SSH Agent an opportunity + * to take further action. i.e. request agent forwarding + * + * @param Net_SSH2 $ssh + * @access private + */ + function _on_channel_open($ssh) + { + if ($this->forward_status == self::FORWARD_REQUEST) { + $this->_request_forwarding($ssh); + } + } + + /** + * Forward data to SSH Agent and return data reply + * + * @param string $data + * @return data from SSH Agent + * @access private + */ + function _forward_data($data) + { + if ($this->expected_bytes > 0) { + $this->socket_buffer.= $data; + $this->expected_bytes -= strlen($data); + } else { + $agent_data_bytes = current(unpack('N', $data)); + $current_data_bytes = strlen($data); + $this->socket_buffer = $data; + if ($current_data_bytes != $agent_data_bytes + 4) { + $this->expected_bytes = ($agent_data_bytes + 4) - $current_data_bytes; + return false; + } + } + + if (strlen($this->socket_buffer) != fwrite($this->fsock, $this->socket_buffer)) { + user_error('Connection closed attempting to forward data to SSH agent'); + } + + $this->socket_buffer = ''; + $this->expected_bytes = 0; + + $agent_reply_bytes = current(unpack('N', fread($this->fsock, 4))); + + $agent_reply_data = fread($this->fsock, $agent_reply_bytes); + $agent_reply_data = current(unpack('a*', $agent_reply_data)); + + return pack('Na*', $agent_reply_bytes, $agent_reply_data); + } } diff --git a/securemail/vendor/phpseclib/phpseclib/phpseclib/System/SSH/Agent/Identity.php b/securemail/vendor/phpseclib/phpseclib/phpseclib/System/SSH/Agent/Identity.php new file mode 100644 index 00000000..b8cc6cde --- /dev/null +++ b/securemail/vendor/phpseclib/phpseclib/phpseclib/System/SSH/Agent/Identity.php @@ -0,0 +1,158 @@ + + * @copyright 2009 Jim Wigginton + * @license http://www.opensource.org/licenses/mit-license.html MIT License + * @link http://phpseclib.sourceforge.net + * @internal See http://api.libssh.org/rfc/PROTOCOL.agent + */ + +namespace phpseclib\System\SSH\Agent; + +use phpseclib\System\SSH\Agent; + +/** + * Pure-PHP ssh-agent client identity object + * + * Instantiation should only be performed by \phpseclib\System\SSH\Agent class. + * This could be thought of as implementing an interface that phpseclib\Crypt\RSA + * implements. ie. maybe a Net_SSH_Auth_PublicKey interface or something. + * The methods in this interface would be getPublicKey and sign since those are the + * methods phpseclib looks for to perform public key authentication. + * + * @package SSH\Agent + * @author Jim Wigginton + * @access internal + */ +class Identity +{ + /** + * Key Object + * + * @var \phpseclib\Crypt\RSA + * @access private + * @see self::getPublicKey() + */ + var $key; + + /** + * Key Blob + * + * @var string + * @access private + * @see self::sign() + */ + var $key_blob; + + /** + * Socket Resource + * + * @var resource + * @access private + * @see self::sign() + */ + var $fsock; + + /** + * Default Constructor. + * + * @param resource $fsock + * @return \phpseclib\System\SSH\Agent\Identity + * @access private + */ + function __construct($fsock) + { + $this->fsock = $fsock; + } + + /** + * Set Public Key + * + * Called by \phpseclib\System\SSH\Agent::requestIdentities() + * + * @param \phpseclib\Crypt\RSA $key + * @access private + */ + function setPublicKey($key) + { + $this->key = $key; + $this->key->setPublicKey(); + } + + /** + * Set Public Key + * + * Called by \phpseclib\System\SSH\Agent::requestIdentities(). The key blob could be extracted from $this->key + * but this saves a small amount of computation. + * + * @param string $key_blob + * @access private + */ + function setPublicKeyBlob($key_blob) + { + $this->key_blob = $key_blob; + } + + /** + * Get Public Key + * + * Wrapper for $this->key->getPublicKey() + * + * @param int $format optional + * @return mixed + * @access public + */ + function getPublicKey($format = null) + { + return !isset($format) ? $this->key->getPublicKey() : $this->key->getPublicKey($format); + } + + /** + * Set Signature Mode + * + * Doesn't do anything as ssh-agent doesn't let you pick and choose the signature mode. ie. + * ssh-agent's only supported mode is \phpseclib\Crypt\RSA::SIGNATURE_PKCS1 + * + * @param int $mode + * @access public + */ + function setSignatureMode($mode) + { + } + + /** + * Create a signature + * + * See "2.6.2 Protocol 2 private key signature request" + * + * @param string $message + * @return string + * @access public + */ + function sign($message) + { + // the last parameter (currently 0) is for flags and ssh-agent only defines one flag (for ssh-dss): SSH_AGENT_OLD_SIGNATURE + $packet = pack('CNa*Na*N', Agent::SSH_AGENTC_SIGN_REQUEST, strlen($this->key_blob), $this->key_blob, strlen($message), $message, 0); + $packet = pack('Na*', strlen($packet), $packet); + if (strlen($packet) != fputs($this->fsock, $packet)) { + user_error('Connection closed during signing'); + } + + $length = current(unpack('N', fread($this->fsock, 4))); + $type = ord(fread($this->fsock, 1)); + if ($type != Agent::SSH_AGENT_SIGN_RESPONSE) { + user_error('Unable to retrieve signature'); + } + + $signature_blob = fread($this->fsock, $length - 1); + // the only other signature format defined - ssh-dss - is the same length as ssh-rsa + // the + 12 is for the other various SSH added length fields + return substr($signature_blob, strlen('ssh-rsa') + 12); + } +} diff --git a/securemail/vendor/phpseclib/phpseclib/phpseclib/System/SSH_Agent.php b/securemail/vendor/phpseclib/phpseclib/phpseclib/System/SSH_Agent.php deleted file mode 100644 index ea434b9c..00000000 --- a/securemail/vendor/phpseclib/phpseclib/phpseclib/System/SSH_Agent.php +++ /dev/null @@ -1,39 +0,0 @@ - - * @copyright 2014 Jim Wigginton - * @license http://www.opensource.org/licenses/mit-license.html MIT License - * @link http://phpseclib.sourceforge.net - * @internal See http://api.libssh.org/rfc/PROTOCOL.agent - */ - -require_once 'SSH/Agent.php'; diff --git a/securemail/vendor/phpseclib/phpseclib/phpseclib/bootstrap.php b/securemail/vendor/phpseclib/phpseclib/phpseclib/bootstrap.php new file mode 100644 index 00000000..0da0999f --- /dev/null +++ b/securemail/vendor/phpseclib/phpseclib/phpseclib/bootstrap.php @@ -0,0 +1,16 @@ + , where is the value of +# the FILE_VERSION_FILTER tag, and is the name of an input file +# provided by doxygen. Whatever the program writes to standard output +# is used as the file version. See the manual for examples. + +FILE_VERSION_FILTER = "git log --pretty=\"format:%ci, author:%aN <%aE>, commit:%h\" -1" + +# The LAYOUT_FILE tag can be used to specify a layout file which will be parsed +# by doxygen. The layout file controls the global structure of the generated +# output files in an output format independent way. To create the layout file +# that represents doxygen's defaults, run doxygen with the -l option. +# You can optionally specify a file name after the option, if omitted +# DoxygenLayout.xml will be used as the name of the layout file. + +LAYOUT_FILE = + +# The CITE_BIB_FILES tag can be used to specify one or more bib files +# containing the references data. This must be a list of .bib files. The +# .bib extension is automatically appended if omitted. Using this command +# requires the bibtex tool to be installed. See also +# http://en.wikipedia.org/wiki/BibTeX for more info. For LaTeX the style +# of the bibliography can be controlled using LATEX_BIB_STYLE. To use this +# feature you need bibtex and perl available in the search path. Do not use +# file names with spaces, bibtex cannot handle them. + +CITE_BIB_FILES = + +#--------------------------------------------------------------------------- +# configuration options related to warning and progress messages +#--------------------------------------------------------------------------- + +# The QUIET tag can be used to turn on/off the messages that are generated +# by doxygen. Possible values are YES and NO. If left blank NO is used. + +QUIET = NO + +# The WARNINGS tag can be used to turn on/off the warning messages that are +# generated by doxygen. Possible values are YES and NO. If left blank +# NO is used. + +WARNINGS = YES + +# If WARN_IF_UNDOCUMENTED is set to YES, then doxygen will generate warnings +# for undocumented members. If EXTRACT_ALL is set to YES then this flag will +# automatically be disabled. + +WARN_IF_UNDOCUMENTED = YES + +# If WARN_IF_DOC_ERROR is set to YES, doxygen will generate warnings for +# potential errors in the documentation, such as not documenting some +# parameters in a documented function, or documenting parameters that +# don't exist or using markup commands wrongly. + +WARN_IF_DOC_ERROR = YES + +# The WARN_NO_PARAMDOC option can be enabled to get warnings for +# functions that are documented, but have no documentation for their parameters +# or return value. If set to NO (the default) doxygen will only warn about +# wrong or incomplete parameter documentation, but not about the absence of +# documentation. + +WARN_NO_PARAMDOC = NO + +# The WARN_FORMAT tag determines the format of the warning messages that +# doxygen can produce. The string should contain the $file, $line, and $text +# tags, which will be replaced by the file and line number from which the +# warning originated and the warning text. Optionally the format may contain +# $version, which will be replaced by the version of the file (if it could +# be obtained via FILE_VERSION_FILTER) + +WARN_FORMAT = "$file:$line: $text" + +# The WARN_LOGFILE tag can be used to specify a file to which warning +# and error messages should be written. If left blank the output is written +# to stderr. + +WARN_LOGFILE = + +#--------------------------------------------------------------------------- +# configuration options related to the input files +#--------------------------------------------------------------------------- + +# The INPUT tag can be used to specify the files and/or directories that contain +# documented source files. You may enter file names like "myfile.cpp" or +# directories like "/usr/src/myproject". Separate the files or directories +# with spaces. + +INPUT = lib/ README.md + +# This tag can be used to specify the character encoding of the source files +# that doxygen parses. Internally doxygen uses the UTF-8 encoding, which is +# also the default input encoding. Doxygen uses libiconv (or the iconv built +# into libc) for the transcoding. See http://www.gnu.org/software/libiconv for +# the list of possible encodings. + +INPUT_ENCODING = UTF-8 + +# If the value of the INPUT tag contains directories, you can use the +# FILE_PATTERNS tag to specify one or more wildcard pattern (like *.cpp +# and *.h) to filter out the source-files in the directories. If left +# blank the following patterns are tested: +# *.c *.cc *.cxx *.cpp *.c++ *.d *.java *.ii *.ixx *.ipp *.i++ *.inl *.h *.hh +# *.hxx *.hpp *.h++ *.idl *.odl *.cs *.php *.php3 *.inc *.m *.mm *.dox *.py +# *.f90 *.f *.for *.vhd *.vhdl + +FILE_PATTERNS = + +# The RECURSIVE tag can be used to turn specify whether or not subdirectories +# should be searched for input files as well. Possible values are YES and NO. +# If left blank NO is used. + +RECURSIVE = YES + +# The EXCLUDE tag can be used to specify files and/or directories that should be +# excluded from the INPUT source files. This way you can easily exclude a +# subdirectory from a directory tree whose root is specified with the INPUT tag. +# Note that relative paths are relative to the directory from which doxygen is +# run. + +EXCLUDE = + +# The EXCLUDE_SYMLINKS tag can be used to select whether or not files or +# directories that are symbolic links (a Unix file system feature) are excluded +# from the input. + +EXCLUDE_SYMLINKS = NO + +# If the value of the INPUT tag contains directories, you can use the +# EXCLUDE_PATTERNS tag to specify one or more wildcard patterns to exclude +# certain files from those directories. Note that the wildcards are matched +# against the file with absolute path, so to exclude all test directories +# for example use the pattern */test/* + +EXCLUDE_PATTERNS = + +# The EXCLUDE_SYMBOLS tag can be used to specify one or more symbol names +# (namespaces, classes, functions, etc.) that should be excluded from the +# output. The symbol name can be a fully qualified name, a word, or if the +# wildcard * is used, a substring. Examples: ANamespace, AClass, +# AClass::ANamespace, ANamespace::*Test + +EXCLUDE_SYMBOLS = + +# The EXAMPLE_PATH tag can be used to specify one or more files or +# directories that contain example code fragments that are included (see +# the \include command). + +EXAMPLE_PATH = examples/ + +# If the value of the EXAMPLE_PATH tag contains directories, you can use the +# EXAMPLE_PATTERNS tag to specify one or more wildcard pattern (like *.cpp +# and *.h) to filter out the source-files in the directories. If left +# blank all files are included. + +EXAMPLE_PATTERNS = + +# If the EXAMPLE_RECURSIVE tag is set to YES then subdirectories will be +# searched for input files to be used with the \include or \dontinclude +# commands irrespective of the value of the RECURSIVE tag. +# Possible values are YES and NO. If left blank NO is used. + +EXAMPLE_RECURSIVE = NO + +# The IMAGE_PATH tag can be used to specify one or more files or +# directories that contain image that are included in the documentation (see +# the \image command). + +IMAGE_PATH = + +# The INPUT_FILTER tag can be used to specify a program that doxygen should +# invoke to filter for each input file. Doxygen will invoke the filter program +# by executing (via popen()) the command , where +# is the value of the INPUT_FILTER tag, and is the name of an +# input file. Doxygen will then use the output that the filter program writes +# to standard output. +# If FILTER_PATTERNS is specified, this tag will be ignored. +# Note that the filter must not add or remove lines; it is applied before the +# code is scanned, but not when the output code is generated. If lines are added +# or removed, the anchors will not be placed correctly. + +INPUT_FILTER = + +# The FILTER_PATTERNS tag can be used to specify filters on a per file pattern +# basis. +# Doxygen will compare the file name with each pattern and apply the +# filter if there is a match. +# The filters are a list of the form: +# pattern=filter (like *.cpp=my_cpp_filter). See INPUT_FILTER for further +# info on how filters are used. If FILTER_PATTERNS is empty or if +# non of the patterns match the file name, INPUT_FILTER is applied. + +FILTER_PATTERNS = + +# If the FILTER_SOURCE_FILES tag is set to YES, the input filter (if set using +# INPUT_FILTER) will be used to filter the input files when producing source +# files to browse (i.e. when SOURCE_BROWSER is set to YES). + +FILTER_SOURCE_FILES = NO + +# The FILTER_SOURCE_PATTERNS tag can be used to specify source filters per file +# pattern. A pattern will override the setting for FILTER_PATTERN (if any) +# and it is also possible to disable source filtering for a specific pattern +# using *.ext= (so without naming a filter). This option only has effect when +# FILTER_SOURCE_FILES is enabled. + +FILTER_SOURCE_PATTERNS = + +# If the USE_MDFILE_AS_MAINPAGE tag refers to the name of a markdown file that +# is part of the input, its contents will be placed on the main page +# (index.html). This can be useful if you have a project on for instance GitHub +# and want reuse the introduction page also for the doxygen output. + +USE_MDFILE_AS_MAINPAGE = README.md + +#--------------------------------------------------------------------------- +# configuration options related to source browsing +#--------------------------------------------------------------------------- + +# If the SOURCE_BROWSER tag is set to YES then a list of source files will +# be generated. Documented entities will be cross-referenced with these sources. +# Note: To get rid of all source code in the generated output, make sure also +# VERBATIM_HEADERS is set to NO. + +SOURCE_BROWSER = YES + +# Setting the INLINE_SOURCES tag to YES will include the body +# of functions and classes directly in the documentation. + +INLINE_SOURCES = NO + +# Setting the STRIP_CODE_COMMENTS tag to YES (the default) will instruct +# doxygen to hide any special comment blocks from generated source code +# fragments. Normal C, C++ and Fortran comments will always remain visible. + +STRIP_CODE_COMMENTS = YES + +# If the REFERENCED_BY_RELATION tag is set to YES +# then for each documented function all documented +# functions referencing it will be listed. + +REFERENCED_BY_RELATION = NO + +# If the REFERENCES_RELATION tag is set to YES +# then for each documented function all documented entities +# called/used by that function will be listed. + +REFERENCES_RELATION = NO + +# If the REFERENCES_LINK_SOURCE tag is set to YES (the default) +# and SOURCE_BROWSER tag is set to YES, then the hyperlinks from +# functions in REFERENCES_RELATION and REFERENCED_BY_RELATION lists will +# link to the source code. +# Otherwise they will link to the documentation. + +REFERENCES_LINK_SOURCE = YES + +# If the USE_HTAGS tag is set to YES then the references to source code +# will point to the HTML generated by the htags(1) tool instead of doxygen +# built-in source browser. The htags tool is part of GNU's global source +# tagging system (see http://www.gnu.org/software/global/global.html). You +# will need version 4.8.6 or higher. + +USE_HTAGS = NO + +# If the VERBATIM_HEADERS tag is set to YES (the default) then Doxygen +# will generate a verbatim copy of the header file for each class for +# which an include is specified. Set to NO to disable this. + +VERBATIM_HEADERS = YES + +#--------------------------------------------------------------------------- +# configuration options related to the alphabetical class index +#--------------------------------------------------------------------------- + +# If the ALPHABETICAL_INDEX tag is set to YES, an alphabetical index +# of all compounds will be generated. Enable this if the project +# contains a lot of classes, structs, unions or interfaces. + +ALPHABETICAL_INDEX = YES + +# If the alphabetical index is enabled (see ALPHABETICAL_INDEX) then +# the COLS_IN_ALPHA_INDEX tag can be used to specify the number of columns +# in which this list will be split (can be a number in the range [1..20]) + +COLS_IN_ALPHA_INDEX = 5 + +# In case all classes in a project start with a common prefix, all +# classes will be put under the same header in the alphabetical index. +# The IGNORE_PREFIX tag can be used to specify one or more prefixes that +# should be ignored while generating the index headers. + +IGNORE_PREFIX = + +#--------------------------------------------------------------------------- +# configuration options related to the HTML output +#--------------------------------------------------------------------------- + +# If the GENERATE_HTML tag is set to YES (the default) Doxygen will +# generate HTML output. + +GENERATE_HTML = YES + +# The HTML_OUTPUT tag is used to specify where the HTML docs will be put. +# If a relative path is entered the value of OUTPUT_DIRECTORY will be +# put in front of it. If left blank `html' will be used as the default path. + +HTML_OUTPUT = html + +# The HTML_FILE_EXTENSION tag can be used to specify the file extension for +# each generated HTML page (for example: .htm,.php,.asp). If it is left blank +# doxygen will generate files with .html extension. + +HTML_FILE_EXTENSION = .html + +# The HTML_HEADER tag can be used to specify a personal HTML header for +# each generated HTML page. If it is left blank doxygen will generate a +# standard header. Note that when using a custom header you are responsible +# for the proper inclusion of any scripts and style sheets that doxygen +# needs, which is dependent on the configuration options used. +# It is advised to generate a default header using "doxygen -w html +# header.html footer.html stylesheet.css YourConfigFile" and then modify +# that header. Note that the header is subject to change so you typically +# have to redo this when upgrading to a newer version of doxygen or when +# changing the value of configuration settings such as GENERATE_TREEVIEW! + +HTML_HEADER = + +# The HTML_FOOTER tag can be used to specify a personal HTML footer for +# each generated HTML page. If it is left blank doxygen will generate a +# standard footer. + +HTML_FOOTER = + +# The HTML_STYLESHEET tag can be used to specify a user-defined cascading +# style sheet that is used by each HTML page. It can be used to +# fine-tune the look of the HTML output. If left blank doxygen will +# generate a default style sheet. Note that it is recommended to use +# HTML_EXTRA_STYLESHEET instead of this one, as it is more robust and this +# tag will in the future become obsolete. + +HTML_STYLESHEET = + +# The HTML_EXTRA_STYLESHEET tag can be used to specify an additional +# user-defined cascading style sheet that is included after the standard +# style sheets created by doxygen. Using this option one can overrule +# certain style aspects. This is preferred over using HTML_STYLESHEET +# since it does not replace the standard style sheet and is therefor more +# robust against future updates. Doxygen will copy the style sheet file to +# the output directory. + +HTML_EXTRA_STYLESHEET = + +# The HTML_EXTRA_FILES tag can be used to specify one or more extra images or +# other source files which should be copied to the HTML output directory. Note +# that these files will be copied to the base HTML output directory. Use the +# $relpath^ marker in the HTML_HEADER and/or HTML_FOOTER files to load these +# files. In the HTML_STYLESHEET file, use the file name only. Also note that +# the files will be copied as-is; there are no commands or markers available. + +HTML_EXTRA_FILES = + +# The HTML_COLORSTYLE_HUE tag controls the color of the HTML output. +# Doxygen will adjust the colors in the style sheet and background images +# according to this color. Hue is specified as an angle on a colorwheel, +# see http://en.wikipedia.org/wiki/Hue for more information. +# For instance the value 0 represents red, 60 is yellow, 120 is green, +# 180 is cyan, 240 is blue, 300 purple, and 360 is red again. +# The allowed range is 0 to 359. + +HTML_COLORSTYLE_HUE = 220 + +# The HTML_COLORSTYLE_SAT tag controls the purity (or saturation) of +# the colors in the HTML output. For a value of 0 the output will use +# grayscales only. A value of 255 will produce the most vivid colors. + +HTML_COLORSTYLE_SAT = 100 + +# The HTML_COLORSTYLE_GAMMA tag controls the gamma correction applied to +# the luminance component of the colors in the HTML output. Values below +# 100 gradually make the output lighter, whereas values above 100 make +# the output darker. The value divided by 100 is the actual gamma applied, +# so 80 represents a gamma of 0.8, The value 220 represents a gamma of 2.2, +# and 100 does not change the gamma. + +HTML_COLORSTYLE_GAMMA = 80 + +# If the HTML_TIMESTAMP tag is set to YES then the footer of each generated HTML +# page will contain the date and time when the page was generated. Setting +# this to NO can help when comparing the output of multiple runs. + +HTML_TIMESTAMP = YES + +# If the HTML_DYNAMIC_SECTIONS tag is set to YES then the generated HTML +# documentation will contain sections that can be hidden and shown after the +# page has loaded. + +HTML_DYNAMIC_SECTIONS = NO + +# With HTML_INDEX_NUM_ENTRIES one can control the preferred number of +# entries shown in the various tree structured indices initially; the user +# can expand and collapse entries dynamically later on. Doxygen will expand +# the tree to such a level that at most the specified number of entries are +# visible (unless a fully collapsed tree already exceeds this amount). +# So setting the number of entries 1 will produce a full collapsed tree by +# default. 0 is a special value representing an infinite number of entries +# and will result in a full expanded tree by default. + +HTML_INDEX_NUM_ENTRIES = 100 + +# If the GENERATE_DOCSET tag is set to YES, additional index files +# will be generated that can be used as input for Apple's Xcode 3 +# integrated development environment, introduced with OSX 10.5 (Leopard). +# To create a documentation set, doxygen will generate a Makefile in the +# HTML output directory. Running make will produce the docset in that +# directory and running "make install" will install the docset in +# ~/Library/Developer/Shared/Documentation/DocSets so that Xcode will find +# it at startup. +# See http://developer.apple.com/tools/creatingdocsetswithdoxygen.html +# for more information. + +GENERATE_DOCSET = NO + +# When GENERATE_DOCSET tag is set to YES, this tag determines the name of the +# feed. A documentation feed provides an umbrella under which multiple +# documentation sets from a single provider (such as a company or product suite) +# can be grouped. + +DOCSET_FEEDNAME = "Doxygen generated docs" + +# When GENERATE_DOCSET tag is set to YES, this tag specifies a string that +# should uniquely identify the documentation set bundle. This should be a +# reverse domain-name style string, e.g. com.mycompany.MyDocSet. Doxygen +# will append .docset to the name. + +DOCSET_BUNDLE_ID = org.doxygen.Project + +# When GENERATE_PUBLISHER_ID tag specifies a string that should uniquely +# identify the documentation publisher. This should be a reverse domain-name +# style string, e.g. com.mycompany.MyDocSet.documentation. + +DOCSET_PUBLISHER_ID = org.doxygen.Publisher + +# The GENERATE_PUBLISHER_NAME tag identifies the documentation publisher. + +DOCSET_PUBLISHER_NAME = Publisher + +# If the GENERATE_HTMLHELP tag is set to YES, additional index files +# will be generated that can be used as input for tools like the +# Microsoft HTML help workshop to generate a compiled HTML help file (.chm) +# of the generated HTML documentation. + +GENERATE_HTMLHELP = NO + +# If the GENERATE_HTMLHELP tag is set to YES, the CHM_FILE tag can +# be used to specify the file name of the resulting .chm file. You +# can add a path in front of the file if the result should not be +# written to the html output directory. + +CHM_FILE = + +# If the GENERATE_HTMLHELP tag is set to YES, the HHC_LOCATION tag can +# be used to specify the location (absolute path including file name) of +# the HTML help compiler (hhc.exe). If non-empty doxygen will try to run +# the HTML help compiler on the generated index.hhp. + +HHC_LOCATION = + +# If the GENERATE_HTMLHELP tag is set to YES, the GENERATE_CHI flag +# controls if a separate .chi index file is generated (YES) or that +# it should be included in the master .chm file (NO). + +GENERATE_CHI = NO + +# If the GENERATE_HTMLHELP tag is set to YES, the CHM_INDEX_ENCODING +# is used to encode HtmlHelp index (hhk), content (hhc) and project file +# content. + +CHM_INDEX_ENCODING = + +# If the GENERATE_HTMLHELP tag is set to YES, the BINARY_TOC flag +# controls whether a binary table of contents is generated (YES) or a +# normal table of contents (NO) in the .chm file. + +BINARY_TOC = NO + +# The TOC_EXPAND flag can be set to YES to add extra items for group members +# to the contents of the HTML help documentation and to the tree view. + +TOC_EXPAND = NO + +# If the GENERATE_QHP tag is set to YES and both QHP_NAMESPACE and +# QHP_VIRTUAL_FOLDER are set, an additional index file will be generated +# that can be used as input for Qt's qhelpgenerator to generate a +# Qt Compressed Help (.qch) of the generated HTML documentation. + +GENERATE_QHP = NO + +# If the QHG_LOCATION tag is specified, the QCH_FILE tag can +# be used to specify the file name of the resulting .qch file. +# The path specified is relative to the HTML output folder. + +QCH_FILE = + +# The QHP_NAMESPACE tag specifies the namespace to use when generating +# Qt Help Project output. For more information please see +# http://doc.trolltech.com/qthelpproject.html#namespace + +QHP_NAMESPACE = org.doxygen.Project + +# The QHP_VIRTUAL_FOLDER tag specifies the namespace to use when generating +# Qt Help Project output. For more information please see +# http://doc.trolltech.com/qthelpproject.html#virtual-folders + +QHP_VIRTUAL_FOLDER = doc + +# If QHP_CUST_FILTER_NAME is set, it specifies the name of a custom filter to +# add. For more information please see +# http://doc.trolltech.com/qthelpproject.html#custom-filters + +QHP_CUST_FILTER_NAME = + +# The QHP_CUST_FILT_ATTRS tag specifies the list of the attributes of the +# custom filter to add. For more information please see +# +# Qt Help Project / Custom Filters. + +QHP_CUST_FILTER_ATTRS = + +# The QHP_SECT_FILTER_ATTRS tag specifies the list of the attributes this +# project's +# filter section matches. +# +# Qt Help Project / Filter Attributes. + +QHP_SECT_FILTER_ATTRS = + +# If the GENERATE_QHP tag is set to YES, the QHG_LOCATION tag can +# be used to specify the location of Qt's qhelpgenerator. +# If non-empty doxygen will try to run qhelpgenerator on the generated +# .qhp file. + +QHG_LOCATION = + +# If the GENERATE_ECLIPSEHELP tag is set to YES, additional index files +# will be generated, which together with the HTML files, form an Eclipse help +# plugin. To install this plugin and make it available under the help contents +# menu in Eclipse, the contents of the directory containing the HTML and XML +# files needs to be copied into the plugins directory of eclipse. The name of +# the directory within the plugins directory should be the same as +# the ECLIPSE_DOC_ID value. After copying Eclipse needs to be restarted before +# the help appears. + +GENERATE_ECLIPSEHELP = NO + +# A unique identifier for the eclipse help plugin. When installing the plugin +# the directory name containing the HTML and XML files should also have +# this name. + +ECLIPSE_DOC_ID = org.doxygen.Project + +# The DISABLE_INDEX tag can be used to turn on/off the condensed index (tabs) +# at top of each HTML page. The value NO (the default) enables the index and +# the value YES disables it. Since the tabs have the same information as the +# navigation tree you can set this option to NO if you already set +# GENERATE_TREEVIEW to YES. + +DISABLE_INDEX = NO + +# The GENERATE_TREEVIEW tag is used to specify whether a tree-like index +# structure should be generated to display hierarchical information. +# If the tag value is set to YES, a side panel will be generated +# containing a tree-like index structure (just like the one that +# is generated for HTML Help). For this to work a browser that supports +# JavaScript, DHTML, CSS and frames is required (i.e. any modern browser). +# Windows users are probably better off using the HTML help feature. +# Since the tree basically has the same information as the tab index you +# could consider to set DISABLE_INDEX to NO when enabling this option. + +GENERATE_TREEVIEW = NO + +# The ENUM_VALUES_PER_LINE tag can be used to set the number of enum values +# (range [0,1..20]) that doxygen will group on one line in the generated HTML +# documentation. Note that a value of 0 will completely suppress the enum +# values from appearing in the overview section. + +ENUM_VALUES_PER_LINE = 4 + +# If the treeview is enabled (see GENERATE_TREEVIEW) then this tag can be +# used to set the initial width (in pixels) of the frame in which the tree +# is shown. + +TREEVIEW_WIDTH = 250 + +# When the EXT_LINKS_IN_WINDOW option is set to YES doxygen will open +# links to external symbols imported via tag files in a separate window. + +EXT_LINKS_IN_WINDOW = NO + +# Use this tag to change the font size of Latex formulas included +# as images in the HTML documentation. The default is 10. Note that +# when you change the font size after a successful doxygen run you need +# to manually remove any form_*.png images from the HTML output directory +# to force them to be regenerated. + +FORMULA_FONTSIZE = 10 + +# Use the FORMULA_TRANPARENT tag to determine whether or not the images +# generated for formulas are transparent PNGs. Transparent PNGs are +# not supported properly for IE 6.0, but are supported on all modern browsers. +# Note that when changing this option you need to delete any form_*.png files +# in the HTML output before the changes have effect. + +FORMULA_TRANSPARENT = YES + +# Enable the USE_MATHJAX option to render LaTeX formulas using MathJax +# (see http://www.mathjax.org) which uses client side Javascript for the +# rendering instead of using prerendered bitmaps. Use this if you do not +# have LaTeX installed or if you want to formulas look prettier in the HTML +# output. When enabled you may also need to install MathJax separately and +# configure the path to it using the MATHJAX_RELPATH option. + +USE_MATHJAX = NO + +# When MathJax is enabled you can set the default output format to be used for +# the MathJax output. Supported types are HTML-CSS, NativeMML (i.e. MathML) and +# SVG. The default value is HTML-CSS, which is slower, but has the best +# compatibility. + +MATHJAX_FORMAT = HTML-CSS + +# When MathJax is enabled you need to specify the location relative to the +# HTML output directory using the MATHJAX_RELPATH option. The destination +# directory should contain the MathJax.js script. For instance, if the mathjax +# directory is located at the same level as the HTML output directory, then +# MATHJAX_RELPATH should be ../mathjax. The default value points to +# the MathJax Content Delivery Network so you can quickly see the result without +# installing MathJax. +# However, it is strongly recommended to install a local +# copy of MathJax from http://www.mathjax.org before deployment. + +MATHJAX_RELPATH = http://cdn.mathjax.org/mathjax/latest + +# The MATHJAX_EXTENSIONS tag can be used to specify one or MathJax extension +# names that should be enabled during MathJax rendering. + +MATHJAX_EXTENSIONS = + +# The MATHJAX_CODEFILE tag can be used to specify a file with javascript +# pieces of code that will be used on startup of the MathJax code. + +MATHJAX_CODEFILE = + +# When the SEARCHENGINE tag is enabled doxygen will generate a search box +# for the HTML output. The underlying search engine uses javascript +# and DHTML and should work on any modern browser. Note that when using +# HTML help (GENERATE_HTMLHELP), Qt help (GENERATE_QHP), or docsets +# (GENERATE_DOCSET) there is already a search function so this one should +# typically be disabled. For large projects the javascript based search engine +# can be slow, then enabling SERVER_BASED_SEARCH may provide a better solution. + +SEARCHENGINE = YES + +# When the SERVER_BASED_SEARCH tag is enabled the search engine will be +# implemented using a web server instead of a web client using Javascript. +# There are two flavours of web server based search depending on the +# EXTERNAL_SEARCH setting. When disabled, doxygen will generate a PHP script for +# searching and an index file used by the script. When EXTERNAL_SEARCH is +# enabled the indexing and searching needs to be provided by external tools. +# See the manual for details. + +SERVER_BASED_SEARCH = NO + +# When EXTERNAL_SEARCH is enabled doxygen will no longer generate the PHP +# script for searching. Instead the search results are written to an XML file +# which needs to be processed by an external indexer. Doxygen will invoke an +# external search engine pointed to by the SEARCHENGINE_URL option to obtain +# the search results. Doxygen ships with an example indexer (doxyindexer) and +# search engine (doxysearch.cgi) which are based on the open source search +# engine library Xapian. See the manual for configuration details. + +EXTERNAL_SEARCH = NO + +# The SEARCHENGINE_URL should point to a search engine hosted by a web server +# which will returned the search results when EXTERNAL_SEARCH is enabled. +# Doxygen ships with an example search engine (doxysearch) which is based on +# the open source search engine library Xapian. See the manual for configuration +# details. + +SEARCHENGINE_URL = + +# When SERVER_BASED_SEARCH and EXTERNAL_SEARCH are both enabled the unindexed +# search data is written to a file for indexing by an external tool. With the +# SEARCHDATA_FILE tag the name of this file can be specified. + +SEARCHDATA_FILE = searchdata.xml + +# When SERVER_BASED_SEARCH AND EXTERNAL_SEARCH are both enabled the +# EXTERNAL_SEARCH_ID tag can be used as an identifier for the project. This is +# useful in combination with EXTRA_SEARCH_MAPPINGS to search through multiple +# projects and redirect the results back to the right project. + +EXTERNAL_SEARCH_ID = + +# The EXTRA_SEARCH_MAPPINGS tag can be used to enable searching through doxygen +# projects other than the one defined by this configuration file, but that are +# all added to the same external search index. Each project needs to have a +# unique id set via EXTERNAL_SEARCH_ID. The search mapping then maps the id +# of to a relative location where the documentation can be found. +# The format is: EXTRA_SEARCH_MAPPINGS = id1=loc1 id2=loc2 ... + +EXTRA_SEARCH_MAPPINGS = + +#--------------------------------------------------------------------------- +# configuration options related to the LaTeX output +#--------------------------------------------------------------------------- + +# If the GENERATE_LATEX tag is set to YES (the default) Doxygen will +# generate Latex output. + +GENERATE_LATEX = NO + +# The LATEX_OUTPUT tag is used to specify where the LaTeX docs will be put. +# If a relative path is entered the value of OUTPUT_DIRECTORY will be +# put in front of it. If left blank `latex' will be used as the default path. + +LATEX_OUTPUT = latex + +# The LATEX_CMD_NAME tag can be used to specify the LaTeX command name to be +# invoked. If left blank `latex' will be used as the default command name. +# Note that when enabling USE_PDFLATEX this option is only used for +# generating bitmaps for formulas in the HTML output, but not in the +# Makefile that is written to the output directory. + +LATEX_CMD_NAME = latex + +# The MAKEINDEX_CMD_NAME tag can be used to specify the command name to +# generate index for LaTeX. If left blank `makeindex' will be used as the +# default command name. + +MAKEINDEX_CMD_NAME = makeindex + +# If the COMPACT_LATEX tag is set to YES Doxygen generates more compact +# LaTeX documents. This may be useful for small projects and may help to +# save some trees in general. + +COMPACT_LATEX = NO + +# The PAPER_TYPE tag can be used to set the paper type that is used +# by the printer. Possible values are: a4, letter, legal and +# executive. If left blank a4 will be used. + +PAPER_TYPE = a4 + +# The EXTRA_PACKAGES tag can be to specify one or more names of LaTeX +# packages that should be included in the LaTeX output. + +EXTRA_PACKAGES = + +# The LATEX_HEADER tag can be used to specify a personal LaTeX header for +# the generated latex document. The header should contain everything until +# the first chapter. If it is left blank doxygen will generate a +# standard header. Notice: only use this tag if you know what you are doing! + +LATEX_HEADER = + +# The LATEX_FOOTER tag can be used to specify a personal LaTeX footer for +# the generated latex document. The footer should contain everything after +# the last chapter. If it is left blank doxygen will generate a +# standard footer. Notice: only use this tag if you know what you are doing! + +LATEX_FOOTER = + +# The LATEX_EXTRA_FILES tag can be used to specify one or more extra images +# or other source files which should be copied to the LaTeX output directory. +# Note that the files will be copied as-is; there are no commands or markers +# available. + +LATEX_EXTRA_FILES = + +# If the PDF_HYPERLINKS tag is set to YES, the LaTeX that is generated +# is prepared for conversion to pdf (using ps2pdf). The pdf file will +# contain links (just like the HTML output) instead of page references +# This makes the output suitable for online browsing using a pdf viewer. + +PDF_HYPERLINKS = YES + +# If the USE_PDFLATEX tag is set to YES, pdflatex will be used instead of +# plain latex in the generated Makefile. Set this option to YES to get a +# higher quality PDF documentation. + +USE_PDFLATEX = YES + +# If the LATEX_BATCHMODE tag is set to YES, doxygen will add the \\batchmode. +# command to the generated LaTeX files. This will instruct LaTeX to keep +# running if errors occur, instead of asking the user for help. +# This option is also used when generating formulas in HTML. + +LATEX_BATCHMODE = NO + +# If LATEX_HIDE_INDICES is set to YES then doxygen will not +# include the index chapters (such as File Index, Compound Index, etc.) +# in the output. + +LATEX_HIDE_INDICES = NO + +# If LATEX_SOURCE_CODE is set to YES then doxygen will include +# source code with syntax highlighting in the LaTeX output. +# Note that which sources are shown also depends on other settings +# such as SOURCE_BROWSER. + +LATEX_SOURCE_CODE = NO + +# The LATEX_BIB_STYLE tag can be used to specify the style to use for the +# bibliography, e.g. plainnat, or ieeetr. The default style is "plain". See +# http://en.wikipedia.org/wiki/BibTeX for more info. + +LATEX_BIB_STYLE = plain + +#--------------------------------------------------------------------------- +# configuration options related to the RTF output +#--------------------------------------------------------------------------- + +# If the GENERATE_RTF tag is set to YES Doxygen will generate RTF output +# The RTF output is optimized for Word 97 and may not look very pretty with +# other RTF readers or editors. + +GENERATE_RTF = NO + +# The RTF_OUTPUT tag is used to specify where the RTF docs will be put. +# If a relative path is entered the value of OUTPUT_DIRECTORY will be +# put in front of it. If left blank `rtf' will be used as the default path. + +RTF_OUTPUT = rtf + +# If the COMPACT_RTF tag is set to YES Doxygen generates more compact +# RTF documents. This may be useful for small projects and may help to +# save some trees in general. + +COMPACT_RTF = NO + +# If the RTF_HYPERLINKS tag is set to YES, the RTF that is generated +# will contain hyperlink fields. The RTF file will +# contain links (just like the HTML output) instead of page references. +# This makes the output suitable for online browsing using WORD or other +# programs which support those fields. +# Note: wordpad (write) and others do not support links. + +RTF_HYPERLINKS = NO + +# Load style sheet definitions from file. Syntax is similar to doxygen's +# config file, i.e. a series of assignments. You only have to provide +# replacements, missing definitions are set to their default value. + +RTF_STYLESHEET_FILE = + +# Set optional variables used in the generation of an rtf document. +# Syntax is similar to doxygen's config file. + +RTF_EXTENSIONS_FILE = + +#--------------------------------------------------------------------------- +# configuration options related to the man page output +#--------------------------------------------------------------------------- + +# If the GENERATE_MAN tag is set to YES (the default) Doxygen will +# generate man pages + +GENERATE_MAN = NO + +# The MAN_OUTPUT tag is used to specify where the man pages will be put. +# If a relative path is entered the value of OUTPUT_DIRECTORY will be +# put in front of it. If left blank `man' will be used as the default path. + +MAN_OUTPUT = man + +# The MAN_EXTENSION tag determines the extension that is added to +# the generated man pages (default is the subroutine's section .3) + +MAN_EXTENSION = .3 + +# If the MAN_LINKS tag is set to YES and Doxygen generates man output, +# then it will generate one additional man file for each entity +# documented in the real man page(s). These additional files +# only source the real man page, but without them the man command +# would be unable to find the correct page. The default is NO. + +MAN_LINKS = NO + +#--------------------------------------------------------------------------- +# configuration options related to the XML output +#--------------------------------------------------------------------------- + +# If the GENERATE_XML tag is set to YES Doxygen will +# generate an XML file that captures the structure of +# the code including all documentation. + +GENERATE_XML = NO + +# The XML_OUTPUT tag is used to specify where the XML pages will be put. +# If a relative path is entered the value of OUTPUT_DIRECTORY will be +# put in front of it. If left blank `xml' will be used as the default path. + +XML_OUTPUT = xml + +# The XML_SCHEMA tag can be used to specify an XML schema, +# which can be used by a validating XML parser to check the +# syntax of the XML files. + +XML_SCHEMA = + +# The XML_DTD tag can be used to specify an XML DTD, +# which can be used by a validating XML parser to check the +# syntax of the XML files. + +XML_DTD = + +# If the XML_PROGRAMLISTING tag is set to YES Doxygen will +# dump the program listings (including syntax highlighting +# and cross-referencing information) to the XML output. Note that +# enabling this will significantly increase the size of the XML output. + +XML_PROGRAMLISTING = YES + +#--------------------------------------------------------------------------- +# configuration options related to the DOCBOOK output +#--------------------------------------------------------------------------- + +# If the GENERATE_DOCBOOK tag is set to YES Doxygen will generate DOCBOOK files +# that can be used to generate PDF. + +GENERATE_DOCBOOK = NO + +# The DOCBOOK_OUTPUT tag is used to specify where the DOCBOOK pages will be put. +# If a relative path is entered the value of OUTPUT_DIRECTORY will be put in +# front of it. If left blank docbook will be used as the default path. + +DOCBOOK_OUTPUT = docbook + +#--------------------------------------------------------------------------- +# configuration options for the AutoGen Definitions output +#--------------------------------------------------------------------------- + +# If the GENERATE_AUTOGEN_DEF tag is set to YES Doxygen will +# generate an AutoGen Definitions (see autogen.sf.net) file +# that captures the structure of the code including all +# documentation. Note that this feature is still experimental +# and incomplete at the moment. + +GENERATE_AUTOGEN_DEF = NO + +#--------------------------------------------------------------------------- +# configuration options related to the Perl module output +#--------------------------------------------------------------------------- + +# If the GENERATE_PERLMOD tag is set to YES Doxygen will +# generate a Perl module file that captures the structure of +# the code including all documentation. Note that this +# feature is still experimental and incomplete at the +# moment. + +GENERATE_PERLMOD = NO + +# If the PERLMOD_LATEX tag is set to YES Doxygen will generate +# the necessary Makefile rules, Perl scripts and LaTeX code to be able +# to generate PDF and DVI output from the Perl module output. + +PERLMOD_LATEX = NO + +# If the PERLMOD_PRETTY tag is set to YES the Perl module output will be +# nicely formatted so it can be parsed by a human reader. +# This is useful +# if you want to understand what is going on. +# On the other hand, if this +# tag is set to NO the size of the Perl module output will be much smaller +# and Perl will parse it just the same. + +PERLMOD_PRETTY = YES + +# The names of the make variables in the generated doxyrules.make file +# are prefixed with the string contained in PERLMOD_MAKEVAR_PREFIX. +# This is useful so different doxyrules.make files included by the same +# Makefile don't overwrite each other's variables. + +PERLMOD_MAKEVAR_PREFIX = + +#--------------------------------------------------------------------------- +# Configuration options related to the preprocessor +#--------------------------------------------------------------------------- + +# If the ENABLE_PREPROCESSING tag is set to YES (the default) Doxygen will +# evaluate all C-preprocessor directives found in the sources and include +# files. + +ENABLE_PREPROCESSING = YES + +# If the MACRO_EXPANSION tag is set to YES Doxygen will expand all macro +# names in the source code. If set to NO (the default) only conditional +# compilation will be performed. Macro expansion can be done in a controlled +# way by setting EXPAND_ONLY_PREDEF to YES. + +MACRO_EXPANSION = NO + +# If the EXPAND_ONLY_PREDEF and MACRO_EXPANSION tags are both set to YES +# then the macro expansion is limited to the macros specified with the +# PREDEFINED and EXPAND_AS_DEFINED tags. + +EXPAND_ONLY_PREDEF = NO + +# If the SEARCH_INCLUDES tag is set to YES (the default) the includes files +# pointed to by INCLUDE_PATH will be searched when a #include is found. + +SEARCH_INCLUDES = YES + +# The INCLUDE_PATH tag can be used to specify one or more directories that +# contain include files that are not input files but should be processed by +# the preprocessor. + +INCLUDE_PATH = + +# You can use the INCLUDE_FILE_PATTERNS tag to specify one or more wildcard +# patterns (like *.h and *.hpp) to filter out the header-files in the +# directories. If left blank, the patterns specified with FILE_PATTERNS will +# be used. + +INCLUDE_FILE_PATTERNS = + +# The PREDEFINED tag can be used to specify one or more macro names that +# are defined before the preprocessor is started (similar to the -D option of +# gcc). The argument of the tag is a list of macros of the form: name +# or name=definition (no spaces). If the definition and the = are +# omitted =1 is assumed. To prevent a macro definition from being +# undefined via #undef or recursively expanded use the := operator +# instead of the = operator. + +PREDEFINED = + +# If the MACRO_EXPANSION and EXPAND_ONLY_PREDEF tags are set to YES then +# this tag can be used to specify a list of macro names that should be expanded. +# The macro definition that is found in the sources will be used. +# Use the PREDEFINED tag if you want to use a different macro definition that +# overrules the definition found in the source code. + +EXPAND_AS_DEFINED = + +# If the SKIP_FUNCTION_MACROS tag is set to YES (the default) then +# doxygen's preprocessor will remove all references to function-like macros +# that are alone on a line, have an all uppercase name, and do not end with a +# semicolon, because these will confuse the parser if not removed. + +SKIP_FUNCTION_MACROS = YES + +#--------------------------------------------------------------------------- +# Configuration::additions related to external references +#--------------------------------------------------------------------------- + +# The TAGFILES option can be used to specify one or more tagfiles. For each +# tag file the location of the external documentation should be added. The +# format of a tag file without this location is as follows: +# +# TAGFILES = file1 file2 ... +# Adding location for the tag files is done as follows: +# +# TAGFILES = file1=loc1 "file2 = loc2" ... +# where "loc1" and "loc2" can be relative or absolute paths +# or URLs. Note that each tag file must have a unique name (where the name does +# NOT include the path). If a tag file is not located in the directory in which +# doxygen is run, you must also specify the path to the tagfile here. + +TAGFILES = + +# When a file name is specified after GENERATE_TAGFILE, doxygen will create +# a tag file that is based on the input files it reads. + +GENERATE_TAGFILE = + +# If the ALLEXTERNALS tag is set to YES all external classes will be listed +# in the class index. If set to NO only the inherited external classes +# will be listed. + +ALLEXTERNALS = NO + +# If the EXTERNAL_GROUPS tag is set to YES all external groups will be listed +# in the modules index. If set to NO, only the current project's groups will +# be listed. + +EXTERNAL_GROUPS = YES + +# If the EXTERNAL_PAGES tag is set to YES all external pages will be listed +# in the related pages index. If set to NO, only the current project's +# pages will be listed. + +EXTERNAL_PAGES = YES + +# The PERL_PATH should be the absolute path and name of the perl script +# interpreter (i.e. the result of `which perl'). + +PERL_PATH = /usr/bin/perl + +#--------------------------------------------------------------------------- +# Configuration options related to the dot tool +#--------------------------------------------------------------------------- + +# If the CLASS_DIAGRAMS tag is set to YES (the default) Doxygen will +# generate a inheritance diagram (in HTML, RTF and LaTeX) for classes with base +# or super classes. Setting the tag to NO turns the diagrams off. Note that +# this option also works with HAVE_DOT disabled, but it is recommended to +# install and use dot, since it yields more powerful graphs. + +CLASS_DIAGRAMS = YES + +# You can define message sequence charts within doxygen comments using the \msc +# command. Doxygen will then run the mscgen tool (see +# http://www.mcternan.me.uk/mscgen/) to produce the chart and insert it in the +# documentation. The MSCGEN_PATH tag allows you to specify the directory where +# the mscgen tool resides. If left empty the tool is assumed to be found in the +# default search path. + +MSCGEN_PATH = + +# If set to YES, the inheritance and collaboration graphs will hide +# inheritance and usage relations if the target is undocumented +# or is not a class. + +HIDE_UNDOC_RELATIONS = YES + +# If you set the HAVE_DOT tag to YES then doxygen will assume the dot tool is +# available from the path. This tool is part of Graphviz, a graph visualization +# toolkit from AT&T and Lucent Bell Labs. The other options in this section +# have no effect if this option is set to NO (the default) + +HAVE_DOT = NO + +# The DOT_NUM_THREADS specifies the number of dot invocations doxygen is +# allowed to run in parallel. When set to 0 (the default) doxygen will +# base this on the number of processors available in the system. You can set it +# explicitly to a value larger than 0 to get control over the balance +# between CPU load and processing speed. + +DOT_NUM_THREADS = 0 + +# By default doxygen will use the Helvetica font for all dot files that +# doxygen generates. When you want a differently looking font you can specify +# the font name using DOT_FONTNAME. You need to make sure dot is able to find +# the font, which can be done by putting it in a standard location or by setting +# the DOTFONTPATH environment variable or by setting DOT_FONTPATH to the +# directory containing the font. + +DOT_FONTNAME = Helvetica + +# The DOT_FONTSIZE tag can be used to set the size of the font of dot graphs. +# The default size is 10pt. + +DOT_FONTSIZE = 10 + +# By default doxygen will tell dot to use the Helvetica font. +# If you specify a different font using DOT_FONTNAME you can use DOT_FONTPATH to +# set the path where dot can find it. + +DOT_FONTPATH = + +# If the CLASS_GRAPH and HAVE_DOT tags are set to YES then doxygen +# will generate a graph for each documented class showing the direct and +# indirect inheritance relations. Setting this tag to YES will force the +# CLASS_DIAGRAMS tag to NO. + +CLASS_GRAPH = YES + +# If the COLLABORATION_GRAPH and HAVE_DOT tags are set to YES then doxygen +# will generate a graph for each documented class showing the direct and +# indirect implementation dependencies (inheritance, containment, and +# class references variables) of the class with other documented classes. + +COLLABORATION_GRAPH = YES + +# If the GROUP_GRAPHS and HAVE_DOT tags are set to YES then doxygen +# will generate a graph for groups, showing the direct groups dependencies + +GROUP_GRAPHS = YES + +# If the UML_LOOK tag is set to YES doxygen will generate inheritance and +# collaboration diagrams in a style similar to the OMG's Unified Modeling +# Language. + +UML_LOOK = NO + +# If the UML_LOOK tag is enabled, the fields and methods are shown inside +# the class node. If there are many fields or methods and many nodes the +# graph may become too big to be useful. The UML_LIMIT_NUM_FIELDS +# threshold limits the number of items for each type to make the size more +# manageable. Set this to 0 for no limit. Note that the threshold may be +# exceeded by 50% before the limit is enforced. + +UML_LIMIT_NUM_FIELDS = 10 + +# If set to YES, the inheritance and collaboration graphs will show the +# relations between templates and their instances. + +TEMPLATE_RELATIONS = NO + +# If the ENABLE_PREPROCESSING, SEARCH_INCLUDES, INCLUDE_GRAPH, and HAVE_DOT +# tags are set to YES then doxygen will generate a graph for each documented +# file showing the direct and indirect include dependencies of the file with +# other documented files. + +INCLUDE_GRAPH = YES + +# If the ENABLE_PREPROCESSING, SEARCH_INCLUDES, INCLUDED_BY_GRAPH, and +# HAVE_DOT tags are set to YES then doxygen will generate a graph for each +# documented header file showing the documented files that directly or +# indirectly include this file. + +INCLUDED_BY_GRAPH = YES + +# If the CALL_GRAPH and HAVE_DOT options are set to YES then +# doxygen will generate a call dependency graph for every global function +# or class method. Note that enabling this option will significantly increase +# the time of a run. So in most cases it will be better to enable call graphs +# for selected functions only using the \callgraph command. + +CALL_GRAPH = NO + +# If the CALLER_GRAPH and HAVE_DOT tags are set to YES then +# doxygen will generate a caller dependency graph for every global function +# or class method. Note that enabling this option will significantly increase +# the time of a run. So in most cases it will be better to enable caller +# graphs for selected functions only using the \callergraph command. + +CALLER_GRAPH = NO + +# If the GRAPHICAL_HIERARCHY and HAVE_DOT tags are set to YES then doxygen +# will generate a graphical hierarchy of all classes instead of a textual one. + +GRAPHICAL_HIERARCHY = YES + +# If the DIRECTORY_GRAPH and HAVE_DOT tags are set to YES +# then doxygen will show the dependencies a directory has on other directories +# in a graphical way. The dependency relations are determined by the #include +# relations between the files in the directories. + +DIRECTORY_GRAPH = YES + +# The DOT_IMAGE_FORMAT tag can be used to set the image format of the images +# generated by dot. Possible values are svg, png, jpg, or gif. +# If left blank png will be used. If you choose svg you need to set +# HTML_FILE_EXTENSION to xhtml in order to make the SVG files +# visible in IE 9+ (other browsers do not have this requirement). + +DOT_IMAGE_FORMAT = png + +# If DOT_IMAGE_FORMAT is set to svg, then this option can be set to YES to +# enable generation of interactive SVG images that allow zooming and panning. +# Note that this requires a modern browser other than Internet Explorer. +# Tested and working are Firefox, Chrome, Safari, and Opera. For IE 9+ you +# need to set HTML_FILE_EXTENSION to xhtml in order to make the SVG files +# visible. Older versions of IE do not have SVG support. + +INTERACTIVE_SVG = NO + +# The tag DOT_PATH can be used to specify the path where the dot tool can be +# found. If left blank, it is assumed the dot tool can be found in the path. + +DOT_PATH = + +# The DOTFILE_DIRS tag can be used to specify one or more directories that +# contain dot files that are included in the documentation (see the +# \dotfile command). + +DOTFILE_DIRS = + +# The MSCFILE_DIRS tag can be used to specify one or more directories that +# contain msc files that are included in the documentation (see the +# \mscfile command). + +MSCFILE_DIRS = + +# The DOT_GRAPH_MAX_NODES tag can be used to set the maximum number of +# nodes that will be shown in the graph. If the number of nodes in a graph +# becomes larger than this value, doxygen will truncate the graph, which is +# visualized by representing a node as a red box. Note that doxygen if the +# number of direct children of the root node in a graph is already larger than +# DOT_GRAPH_MAX_NODES then the graph will not be shown at all. Also note +# that the size of a graph can be further restricted by MAX_DOT_GRAPH_DEPTH. + +DOT_GRAPH_MAX_NODES = 50 + +# The MAX_DOT_GRAPH_DEPTH tag can be used to set the maximum depth of the +# graphs generated by dot. A depth value of 3 means that only nodes reachable +# from the root by following a path via at most 3 edges will be shown. Nodes +# that lay further from the root node will be omitted. Note that setting this +# option to 1 or 2 may greatly reduce the computation time needed for large +# code bases. Also note that the size of a graph can be further restricted by +# DOT_GRAPH_MAX_NODES. Using a depth of 0 means no depth restriction. + +MAX_DOT_GRAPH_DEPTH = 0 + +# Set the DOT_TRANSPARENT tag to YES to generate images with a transparent +# background. This is disabled by default, because dot on Windows does not +# seem to support this out of the box. Warning: Depending on the platform used, +# enabling this option may lead to badly anti-aliased labels on the edges of +# a graph (i.e. they become hard to read). + +DOT_TRANSPARENT = NO + +# Set the DOT_MULTI_TARGETS tag to YES allow dot to generate multiple output +# files in one run (i.e. multiple -o and -T options on the command line). This +# makes dot run faster, but since only newer versions of dot (>1.8.10) +# support this, this feature is disabled by default. + +DOT_MULTI_TARGETS = YES + +# If the GENERATE_LEGEND tag is set to YES (the default) Doxygen will +# generate a legend page explaining the meaning of the various boxes and +# arrows in the dot generated graphs. + +GENERATE_LEGEND = YES + +# If the DOT_CLEANUP tag is set to YES (the default) Doxygen will +# remove the intermediate dot files that are used to generate +# the various graphs. + +DOT_CLEANUP = YES diff --git a/securemail/vendor/singpolyma/openpgp-php/README b/securemail/vendor/singpolyma/openpgp-php/README new file mode 100644 index 00000000..42061c01 --- /dev/null +++ b/securemail/vendor/singpolyma/openpgp-php/README @@ -0,0 +1 @@ +README.md \ No newline at end of file diff --git a/securemail/vendor/singpolyma/openpgp-php/README.md b/securemail/vendor/singpolyma/openpgp-php/README.md index 302b502d..099f520a 100644 --- a/securemail/vendor/singpolyma/openpgp-php/README.md +++ b/securemail/vendor/singpolyma/openpgp-php/README.md @@ -30,7 +30,8 @@ Users OpenPGP.php is currently being used in the following projects: -* +* +* Download -------- diff --git a/securemail/vendor/singpolyma/openpgp-php/VERSION b/securemail/vendor/singpolyma/openpgp-php/VERSION index 8acdd82b..0d91a54c 100644 --- a/securemail/vendor/singpolyma/openpgp-php/VERSION +++ b/securemail/vendor/singpolyma/openpgp-php/VERSION @@ -1 +1 @@ -0.0.1 +0.3.0 diff --git a/securemail/vendor/singpolyma/openpgp-php/composer.json b/securemail/vendor/singpolyma/openpgp-php/composer.json new file mode 100644 index 00000000..6acc8c46 --- /dev/null +++ b/securemail/vendor/singpolyma/openpgp-php/composer.json @@ -0,0 +1,24 @@ +{ + "name": "singpolyma/openpgp-php", + "description": "Pure-PHP implementation of the OpenPGP Message Format (RFC 4880)", + "license": "Unlicense", + "authors": [ + { + "name": "Arto Bendiken", + "email": "arto.bendiken@gmail.com" + }, + { + "name": "Stephen Paul Weber", + "email": "singpolyma@singpolyma.net" + } + ], + "require": { + "phpseclib/phpseclib": ">=2.0.0 <=2.0.4" + }, + "require-dev": { + "phpunit/phpunit": "~4.0" + }, + "autoload": { + "classmap": ["lib/"] + } +} diff --git a/securemail/vendor/singpolyma/openpgp-php/examples/clearsign.php b/securemail/vendor/singpolyma/openpgp-php/examples/clearsign.php new file mode 100644 index 00000000..686af02f --- /dev/null +++ b/securemail/vendor/singpolyma/openpgp-php/examples/clearsign.php @@ -0,0 +1,31 @@ + 'u', 'filename' => 'stuff.txt')); +$data->normalize(true); // Clearsign-style normalization of the LiteralDataPacket + +/* Create a signer from the key */ +$sign = new OpenPGP_Crypt_RSA($wkey); + +/* The message is the signed data packet */ +$m = $sign->sign($data); + +/* Generate clearsigned data */ +$packets = $m->signatures()[0]; +echo "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\n"; +// Output normalised data. You could convert line endings here +// without breaking the signature, but do not add any +// trailing whitespace to lines. +echo preg_replace("/^-/", "- -", $packets[0]->data)."\n"; +echo OpenPGP::enarmor($packets[1][0]->to_bytes(), "PGP SIGNATURE"); + +?> diff --git a/securemail/vendor/singpolyma/openpgp-php/examples/deASCIIdeCrypt.php b/securemail/vendor/singpolyma/openpgp-php/examples/deASCIIdeCrypt.php new file mode 100644 index 00000000..9ab6cdd2 --- /dev/null +++ b/securemail/vendor/singpolyma/openpgp-php/examples/deASCIIdeCrypt.php @@ -0,0 +1,27 @@ +decrypt($msg); + + var_dump($decrypted); +} diff --git a/securemail/vendor/singpolyma/openpgp-php/examples/encryptDecrypt.php b/securemail/vendor/singpolyma/openpgp-php/examples/encryptDecrypt.php new file mode 100644 index 00000000..7804967f --- /dev/null +++ b/securemail/vendor/singpolyma/openpgp-php/examples/encryptDecrypt.php @@ -0,0 +1,15 @@ + 'u', 'filename' => 'stuff.txt')); +$encrypted = OpenPGP_Crypt_Symmetric::encrypt($key, new OpenPGP_Message(array($data))); + +// Now decrypt it with the same key +$decryptor = new OpenPGP_Crypt_RSA($key); +$decrypted = $decryptor->decrypt($encrypted); + +var_dump($decrypted); diff --git a/securemail/vendor/singpolyma/openpgp-php/examples/keygen.php b/securemail/vendor/singpolyma/openpgp-php/examples/keygen.php new file mode 100644 index 00000000..1bc03afd --- /dev/null +++ b/securemail/vendor/singpolyma/openpgp-php/examples/keygen.php @@ -0,0 +1,31 @@ +createKey(512); +$rsa->loadKey($k['privatekey']); + +$nkey = new OpenPGP_SecretKeyPacket(array( + 'n' => $rsa->modulus->toBytes(), + 'e' => $rsa->publicExponent->toBytes(), + 'd' => $rsa->exponent->toBytes(), + 'p' => $rsa->primes[2]->toBytes(), + 'q' => $rsa->primes[1]->toBytes(), + 'u' => $rsa->coefficients[2]->toBytes() +)); + +$uid = new OpenPGP_UserIDPacket('Test '); + +$wkey = new OpenPGP_Crypt_RSA($nkey); +$m = $wkey->sign_key_userid(array($nkey, $uid)); + +// Serialize private key +print $m->to_bytes(); + +// Serialize public key message +$pubm = clone($m); +$pubm[0] = new OpenPGP_PublicKeyPacket($pubm[0]); + +$public_bytes = $pubm->to_bytes(); diff --git a/securemail/vendor/singpolyma/openpgp-php/examples/sign.php b/securemail/vendor/singpolyma/openpgp-php/examples/sign.php new file mode 100644 index 00000000..5e68d642 --- /dev/null +++ b/securemail/vendor/singpolyma/openpgp-php/examples/sign.php @@ -0,0 +1,22 @@ + 'u', 'filename' => 'stuff.txt')); + +/* Create a signer from the key */ +$sign = new OpenPGP_Crypt_RSA($wkey); + +/* The message is the signed data packet */ +$m = $sign->sign($data); + +/* Output the raw message bytes to STDOUT */ +echo $m->to_bytes(); + +?> diff --git a/securemail/vendor/singpolyma/openpgp-php/examples/verify.php b/securemail/vendor/singpolyma/openpgp-php/examples/verify.php new file mode 100644 index 00000000..86501996 --- /dev/null +++ b/securemail/vendor/singpolyma/openpgp-php/examples/verify.php @@ -0,0 +1,18 @@ +verify($m)); + +?> diff --git a/securemail/vendor/singpolyma/openpgp-php/lib/openpgp.php b/securemail/vendor/singpolyma/openpgp-php/lib/openpgp.php index 360fc797..dc659d79 100644 --- a/securemail/vendor/singpolyma/openpgp-php/lib/openpgp.php +++ b/securemail/vendor/singpolyma/openpgp-php/lib/openpgp.php @@ -5,7 +5,7 @@ * (RFC 4880). * * @package OpenPGP - * @version 0.0.1 + * @version 0.3.0 * @author Arto Bendiken * @author Stephen Paul Weber * @see http://github.com/bendiken/openpgp-php @@ -1327,15 +1327,32 @@ class OpenPGP_PublicKeyPacket extends OpenPGP_Packet { function __construct($key=array(), $algorithm='RSA', $timestamp=NULL, $version=4) { parent::__construct(); - $this->key = $key; - if(is_string($this->algorithm = $algorithm)) { - $this->algorithm = array_search($this->algorithm, self::$algorithms); - } - $this->timestamp = $timestamp ? $timestamp : time(); - $this->version = $version; - if(count($this->key) > 0) { - $this->key_id = substr($this->fingerprint(), -8); + if($key instanceof OpenPGP_PublicKeyPacket) { + $this->algorithm = $key->algorithm; + $this->key = array(); + + // Restrict to only the fields we need + foreach (self::$key_fields[$this->algorithm] as $field) { + $this->key[$field] = $key->key[$field]; + } + + $this->key_id = $key->key_id; + $this->fingerprint = $key->fingerprint; + $this->timestamp = $key->timestamp; + $this->version = $key->version; + $this->v3_days_of_validity = $key->v3_days_of_validity; + } else { + $this->key = $key; + if(is_string($this->algorithm = $algorithm)) { + $this->algorithm = array_search($this->algorithm, self::$algorithms); + } + $this->timestamp = $timestamp ? $timestamp : time(); + $this->version = $version; + + if(count($this->key) > 0) { + $this->key_id = substr($this->fingerprint(), -8); + } } } @@ -1685,10 +1702,19 @@ class OpenPGP_LiteralDataPacket extends OpenPGP_Packet { $this->timestamp = isset($opt['timestamp']) ? $opt['timestamp'] : time(); } - function normalize() { + function normalize($clearsign=false) { + if($clearsign && ($this->format != 'u' && $this->format != 't')) { + $this->format = 'u'; // Clearsign must be text + } + if($this->format == 'u' || $this->format == 't') { // Normalize line endings $this->data = str_replace("\n", "\r\n", str_replace("\r", "\n", str_replace("\r\n", "\n", $this->data))); } + + if($clearsign) { + // When clearsigning, do not sign over trailing whitespace + $this->data = preg_replace('/\s+\r/', "\r", $this->data); + } } function read() { diff --git a/securemail/vendor/singpolyma/openpgp-php/lib/openpgp_crypt_rsa.php b/securemail/vendor/singpolyma/openpgp-php/lib/openpgp_crypt_rsa.php index db6156f3..bce11e18 100644 --- a/securemail/vendor/singpolyma/openpgp-php/lib/openpgp_crypt_rsa.php +++ b/securemail/vendor/singpolyma/openpgp-php/lib/openpgp_crypt_rsa.php @@ -7,7 +7,11 @@ */ // From http://phpseclib.sourceforge.net/ -require_once 'Crypt/RSA.php'; +use phpseclib\Crypt\RSA as Crypt_RSA; +use phpseclib\Math\BigInteger as Math_BigInteger; + +define('CRYPT_RSA_ENCRYPTION_PKCS1', Crypt_RSA::ENCRYPTION_PKCS1); +define('CRYPT_RSA_SIGNATURE_PKCS1', Crypt_RSA::SIGNATURE_PKCS1); require_once dirname(__FILE__).'/openpgp.php'; @include_once dirname(__FILE__).'/openpgp_crypt_symmetric.php'; /* For encrypt/decrypt */ @@ -150,7 +154,7 @@ class OpenPGP_Crypt_RSA { if(!$sig) { $sig = new OpenPGP_SignaturePacket($packet, 'RSA', strtoupper($hash)); $sig->signature_type = 0x13; - $sig->hashed_subpackets[] = new OpenPGP_SignaturePacket_KeyFlagsPacket(array(0x01, 0x02)); + $sig->hashed_subpackets[] = new OpenPGP_SignaturePacket_KeyFlagsPacket(array(0x01 | 0x02)); $sig->hashed_subpackets[] = new OpenPGP_SignaturePacket_IssuerPacket($keyid); $packet[] = $sig; } @@ -241,8 +245,18 @@ class OpenPGP_Crypt_RSA { $rsa = self::crypt_rsa_key($mod, $exp); if($private) { - if($packet->key['p'] && $packet->key['q']) $rsa->primes = array($packet->key['p'], $packet->key['q']); - if($packet->key['u']) $rsa->coefficients = array($packet->key['u']); + /** + * @see https://github.com/phpseclib/phpseclib/issues/1113 + * Primes and coefficients now use BigIntegers. + **/ + //set the primes + if($packet->key['p'] && $packet->key['q']) + $rsa->primes = array( + 1 => new Math_BigInteger($packet->key['p'], 256), + 2 => new Math_BigInteger($packet->key['q'], 256) + ); + // set the coefficients + if($packet->key['u']) $rsa->coefficients = array(2 => new Math_BigInteger($packet->key['u'], 256)); } return $rsa; diff --git a/securemail/vendor/singpolyma/openpgp-php/lib/openpgp_crypt_symmetric.php b/securemail/vendor/singpolyma/openpgp-php/lib/openpgp_crypt_symmetric.php index 9833a46c..844c53b2 100644 --- a/securemail/vendor/singpolyma/openpgp-php/lib/openpgp_crypt_symmetric.php +++ b/securemail/vendor/singpolyma/openpgp-php/lib/openpgp_crypt_symmetric.php @@ -1,20 +1,24 @@ setKey($key); $to_encrypt = $prefix . $message->to_bytes(); @@ -36,7 +40,7 @@ class OpenPGP_Crypt_Symmetric { $esk = pack('n', OpenPGP::bitlength($esk)) . $esk; array_unshift($encrypted, new OpenPGP_AsymmetricSessionKeyPacket($pass->algorithm, $pass->fingerprint(), $esk)); } else if(is_string($pass)) { - $s2k = new OpenPGP_S2K(crypt_random_string(10)); + $s2k = new OpenPGP_S2K(Random::string(10)); $cipher->setKey($s2k->make_key($pass, $key_bytes)); $esk = $cipher->encrypt(chr($symmetric_algorithm) . $key); array_unshift($encrypted, new OpenPGP_SymmetricSessionKeyPacket($s2k, $esk, $symmetric_algorithm)); @@ -143,38 +147,32 @@ class OpenPGP_Crypt_Symmetric { $cipher = NULL; switch($algo) { case 2: - if(class_exists('Crypt_TripleDES')) { $cipher = new Crypt_TripleDES(CRYPT_DES_MODE_CFB); $key_bytes = 24; $key_block_bytes = 8; - } break; case 3: if(defined('MCRYPT_CAST_128')) { $cipher = new MCryptWrapper(MCRYPT_CAST_128); + } else { + throw new Exception("Unsupported cipher: you must have mcrypt installed to use CAST5"); } break; case 7: - if(class_exists('Crypt_AES')) { $cipher = new Crypt_AES(CRYPT_AES_MODE_CFB); $cipher->setKeyLength(128); - } break; case 8: - if(class_exists('Crypt_AES')) { $cipher = new Crypt_AES(CRYPT_AES_MODE_CFB); $cipher->setKeyLength(192); - } break; case 9: - if(class_exists('Crypt_AES')) { $cipher = new Crypt_AES(CRYPT_AES_MODE_CFB); $cipher->setKeyLength(256); - } break; } if(!$cipher) return array(NULL, NULL, NULL); // Unsupported cipher - if(!isset($key_bytes)) $key_bytes = $cipher->key_size; + if(!isset($key_bytes)) $key_bytes = isset($cipher->key_size)?$cipher->key_size:$cipher->key_length; if(!isset($key_block_bytes)) $key_block_bytes = $cipher->block_size; return array($cipher, $key_bytes, $key_block_bytes); } diff --git a/securemail/vendor/singpolyma/openpgp-php/phpunit.xml b/securemail/vendor/singpolyma/openpgp-php/phpunit.xml new file mode 100644 index 00000000..a38403e1 --- /dev/null +++ b/securemail/vendor/singpolyma/openpgp-php/phpunit.xml @@ -0,0 +1,27 @@ + + + + tests/suite.php + + + + tests/suite.php + + + + tests/phpseclib_suite.php + + + + tests/phpseclib_suite.php + + + + tests/phpseclib_suite.php + + + + tests/phpseclib_suite.php + + + diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/bootstrap.php b/securemail/vendor/singpolyma/openpgp-php/tests/bootstrap.php new file mode 100644 index 00000000..9635a9c0 --- /dev/null +++ b/securemail/vendor/singpolyma/openpgp-php/tests/bootstrap.php @@ -0,0 +1,2 @@ + \ No newline at end of file diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000003-002.sig b/securemail/vendor/singpolyma/openpgp-php/tests/data/000003-002.sig new file mode 100644 index 00000000..1e0656d2 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000003-002.sig differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000004-012.ring_trust b/securemail/vendor/singpolyma/openpgp-php/tests/data/000004-012.ring_trust new file mode 100644 index 00000000..ffa57e57 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000004-012.ring_trust differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000005-002.sig b/securemail/vendor/singpolyma/openpgp-php/tests/data/000005-002.sig new file mode 100644 index 00000000..108b9984 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000005-002.sig differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000006-012.ring_trust b/securemail/vendor/singpolyma/openpgp-php/tests/data/000006-012.ring_trust new file mode 100644 index 00000000..ffa57e57 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000006-012.ring_trust differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000007-002.sig b/securemail/vendor/singpolyma/openpgp-php/tests/data/000007-002.sig new file mode 100644 index 00000000..14276d0a Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000007-002.sig differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000008-012.ring_trust b/securemail/vendor/singpolyma/openpgp-php/tests/data/000008-012.ring_trust new file mode 100644 index 00000000..ffa57e57 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000008-012.ring_trust differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000009-002.sig b/securemail/vendor/singpolyma/openpgp-php/tests/data/000009-002.sig new file mode 100644 index 00000000..4a282dd6 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000009-002.sig differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000010-012.ring_trust b/securemail/vendor/singpolyma/openpgp-php/tests/data/000010-012.ring_trust new file mode 100644 index 00000000..ffa57e57 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000010-012.ring_trust differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000011-002.sig b/securemail/vendor/singpolyma/openpgp-php/tests/data/000011-002.sig new file mode 100644 index 00000000..cae1b739 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000011-002.sig differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000012-012.ring_trust b/securemail/vendor/singpolyma/openpgp-php/tests/data/000012-012.ring_trust new file mode 100644 index 00000000..ffa57e57 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000012-012.ring_trust differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000013-014.public_subkey b/securemail/vendor/singpolyma/openpgp-php/tests/data/000013-014.public_subkey new file mode 100644 index 00000000..08676d06 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000013-014.public_subkey differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000014-002.sig b/securemail/vendor/singpolyma/openpgp-php/tests/data/000014-002.sig new file mode 100644 index 00000000..dd601807 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000014-002.sig differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000015-012.ring_trust b/securemail/vendor/singpolyma/openpgp-php/tests/data/000015-012.ring_trust new file mode 100644 index 00000000..ffa57e57 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000015-012.ring_trust differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000016-006.public_key b/securemail/vendor/singpolyma/openpgp-php/tests/data/000016-006.public_key new file mode 100644 index 00000000..c9dccbf1 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000016-006.public_key differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000017-002.sig b/securemail/vendor/singpolyma/openpgp-php/tests/data/000017-002.sig new file mode 100644 index 00000000..e734505a Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000017-002.sig differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000018-012.ring_trust b/securemail/vendor/singpolyma/openpgp-php/tests/data/000018-012.ring_trust new file mode 100644 index 00000000..ffa57e57 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000018-012.ring_trust differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000019-013.user_id b/securemail/vendor/singpolyma/openpgp-php/tests/data/000019-013.user_id new file mode 100644 index 00000000..ab3f51d9 --- /dev/null +++ b/securemail/vendor/singpolyma/openpgp-php/tests/data/000019-013.user_id @@ -0,0 +1 @@ +$Test Key (DSA) \ No newline at end of file diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000020-002.sig b/securemail/vendor/singpolyma/openpgp-php/tests/data/000020-002.sig new file mode 100644 index 00000000..8588489a Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000020-002.sig differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000021-012.ring_trust b/securemail/vendor/singpolyma/openpgp-php/tests/data/000021-012.ring_trust new file mode 100644 index 00000000..ffa57e57 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000021-012.ring_trust differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000022-002.sig b/securemail/vendor/singpolyma/openpgp-php/tests/data/000022-002.sig new file mode 100644 index 00000000..fefcb5fe Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000022-002.sig differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000023-012.ring_trust b/securemail/vendor/singpolyma/openpgp-php/tests/data/000023-012.ring_trust new file mode 100644 index 00000000..ffa57e57 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000023-012.ring_trust differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000024-014.public_subkey b/securemail/vendor/singpolyma/openpgp-php/tests/data/000024-014.public_subkey new file mode 100644 index 00000000..2e8deea2 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000024-014.public_subkey differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000025-002.sig b/securemail/vendor/singpolyma/openpgp-php/tests/data/000025-002.sig new file mode 100644 index 00000000..a3eea0a2 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000025-002.sig differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000026-012.ring_trust b/securemail/vendor/singpolyma/openpgp-php/tests/data/000026-012.ring_trust new file mode 100644 index 00000000..ffa57e57 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000026-012.ring_trust differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000027-006.public_key b/securemail/vendor/singpolyma/openpgp-php/tests/data/000027-006.public_key new file mode 100644 index 00000000..5817e003 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000027-006.public_key differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000028-002.sig b/securemail/vendor/singpolyma/openpgp-php/tests/data/000028-002.sig new file mode 100644 index 00000000..5194b784 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000028-002.sig differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000029-012.ring_trust b/securemail/vendor/singpolyma/openpgp-php/tests/data/000029-012.ring_trust new file mode 100644 index 00000000..ffa57e57 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000029-012.ring_trust differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000030-013.user_id b/securemail/vendor/singpolyma/openpgp-php/tests/data/000030-013.user_id new file mode 100644 index 00000000..fb3f49e0 --- /dev/null +++ b/securemail/vendor/singpolyma/openpgp-php/tests/data/000030-013.user_id @@ -0,0 +1 @@ ++Test Key (DSA sign-only) \ No newline at end of file diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000031-002.sig b/securemail/vendor/singpolyma/openpgp-php/tests/data/000031-002.sig new file mode 100644 index 00000000..f69f6875 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000031-002.sig differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000032-012.ring_trust b/securemail/vendor/singpolyma/openpgp-php/tests/data/000032-012.ring_trust new file mode 100644 index 00000000..ffa57e57 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000032-012.ring_trust differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000033-002.sig b/securemail/vendor/singpolyma/openpgp-php/tests/data/000033-002.sig new file mode 100644 index 00000000..2bb55d4f Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000033-002.sig differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000034-012.ring_trust b/securemail/vendor/singpolyma/openpgp-php/tests/data/000034-012.ring_trust new file mode 100644 index 00000000..ffa57e57 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000034-012.ring_trust differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000035-006.public_key b/securemail/vendor/singpolyma/openpgp-php/tests/data/000035-006.public_key new file mode 100644 index 00000000..5980638c Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000035-006.public_key differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000036-013.user_id b/securemail/vendor/singpolyma/openpgp-php/tests/data/000036-013.user_id new file mode 100644 index 00000000..5d0d46e5 --- /dev/null +++ b/securemail/vendor/singpolyma/openpgp-php/tests/data/000036-013.user_id @@ -0,0 +1 @@ +.Test Key (RSA sign-only) \ No newline at end of file diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000037-002.sig b/securemail/vendor/singpolyma/openpgp-php/tests/data/000037-002.sig new file mode 100644 index 00000000..833b563b Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000037-002.sig differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000038-012.ring_trust b/securemail/vendor/singpolyma/openpgp-php/tests/data/000038-012.ring_trust new file mode 100644 index 00000000..ffa57e57 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000038-012.ring_trust differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000039-002.sig b/securemail/vendor/singpolyma/openpgp-php/tests/data/000039-002.sig new file mode 100644 index 00000000..89c34fa5 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000039-002.sig differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000040-012.ring_trust b/securemail/vendor/singpolyma/openpgp-php/tests/data/000040-012.ring_trust new file mode 100644 index 00000000..ffa57e57 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000040-012.ring_trust differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000041-017.attribute b/securemail/vendor/singpolyma/openpgp-php/tests/data/000041-017.attribute new file mode 100644 index 00000000..a21a82fb Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000041-017.attribute differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000042-002.sig b/securemail/vendor/singpolyma/openpgp-php/tests/data/000042-002.sig new file mode 100644 index 00000000..fc6267fd Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000042-002.sig differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000043-012.ring_trust b/securemail/vendor/singpolyma/openpgp-php/tests/data/000043-012.ring_trust new file mode 100644 index 00000000..ffa57e57 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000043-012.ring_trust differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000044-014.public_subkey b/securemail/vendor/singpolyma/openpgp-php/tests/data/000044-014.public_subkey new file mode 100644 index 00000000..06bf50e4 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000044-014.public_subkey differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000045-002.sig b/securemail/vendor/singpolyma/openpgp-php/tests/data/000045-002.sig new file mode 100644 index 00000000..336eb0f2 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000045-002.sig differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000046-012.ring_trust b/securemail/vendor/singpolyma/openpgp-php/tests/data/000046-012.ring_trust new file mode 100644 index 00000000..ffa57e57 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000046-012.ring_trust differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000047-005.secret_key b/securemail/vendor/singpolyma/openpgp-php/tests/data/000047-005.secret_key new file mode 100644 index 00000000..77b5d428 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000047-005.secret_key differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000048-013.user_id b/securemail/vendor/singpolyma/openpgp-php/tests/data/000048-013.user_id new file mode 100644 index 00000000..759449bb --- /dev/null +++ b/securemail/vendor/singpolyma/openpgp-php/tests/data/000048-013.user_id @@ -0,0 +1 @@ +$Test Key (RSA) \ No newline at end of file diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000049-002.sig b/securemail/vendor/singpolyma/openpgp-php/tests/data/000049-002.sig new file mode 100644 index 00000000..14276d0a Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000049-002.sig differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000050-012.ring_trust b/securemail/vendor/singpolyma/openpgp-php/tests/data/000050-012.ring_trust new file mode 100644 index 00000000..b1eeabb9 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000050-012.ring_trust differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000051-007.secret_subkey b/securemail/vendor/singpolyma/openpgp-php/tests/data/000051-007.secret_subkey new file mode 100644 index 00000000..b4e65c92 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000051-007.secret_subkey differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000052-002.sig b/securemail/vendor/singpolyma/openpgp-php/tests/data/000052-002.sig new file mode 100644 index 00000000..dd601807 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000052-002.sig differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000053-012.ring_trust b/securemail/vendor/singpolyma/openpgp-php/tests/data/000053-012.ring_trust new file mode 100644 index 00000000..b1eeabb9 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000053-012.ring_trust differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000054-005.secret_key b/securemail/vendor/singpolyma/openpgp-php/tests/data/000054-005.secret_key new file mode 100644 index 00000000..f153e593 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000054-005.secret_key differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000055-002.sig b/securemail/vendor/singpolyma/openpgp-php/tests/data/000055-002.sig new file mode 100644 index 00000000..e734505a Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000055-002.sig differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000056-012.ring_trust b/securemail/vendor/singpolyma/openpgp-php/tests/data/000056-012.ring_trust new file mode 100644 index 00000000..b1eeabb9 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000056-012.ring_trust differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000057-013.user_id b/securemail/vendor/singpolyma/openpgp-php/tests/data/000057-013.user_id new file mode 100644 index 00000000..ab3f51d9 --- /dev/null +++ b/securemail/vendor/singpolyma/openpgp-php/tests/data/000057-013.user_id @@ -0,0 +1 @@ +$Test Key (DSA) \ No newline at end of file diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000058-002.sig b/securemail/vendor/singpolyma/openpgp-php/tests/data/000058-002.sig new file mode 100644 index 00000000..8588489a Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000058-002.sig differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000059-012.ring_trust b/securemail/vendor/singpolyma/openpgp-php/tests/data/000059-012.ring_trust new file mode 100644 index 00000000..b1eeabb9 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000059-012.ring_trust differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000060-007.secret_subkey b/securemail/vendor/singpolyma/openpgp-php/tests/data/000060-007.secret_subkey new file mode 100644 index 00000000..9df45f39 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000060-007.secret_subkey differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000061-002.sig b/securemail/vendor/singpolyma/openpgp-php/tests/data/000061-002.sig new file mode 100644 index 00000000..63949422 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000061-002.sig differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000062-012.ring_trust b/securemail/vendor/singpolyma/openpgp-php/tests/data/000062-012.ring_trust new file mode 100644 index 00000000..b1eeabb9 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000062-012.ring_trust differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000063-005.secret_key b/securemail/vendor/singpolyma/openpgp-php/tests/data/000063-005.secret_key new file mode 100644 index 00000000..2f4268ee Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000063-005.secret_key differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000064-002.sig b/securemail/vendor/singpolyma/openpgp-php/tests/data/000064-002.sig new file mode 100644 index 00000000..5194b784 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000064-002.sig differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000065-012.ring_trust b/securemail/vendor/singpolyma/openpgp-php/tests/data/000065-012.ring_trust new file mode 100644 index 00000000..b1eeabb9 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000065-012.ring_trust differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000066-013.user_id b/securemail/vendor/singpolyma/openpgp-php/tests/data/000066-013.user_id new file mode 100644 index 00000000..fb3f49e0 --- /dev/null +++ b/securemail/vendor/singpolyma/openpgp-php/tests/data/000066-013.user_id @@ -0,0 +1 @@ ++Test Key (DSA sign-only) \ No newline at end of file diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000067-002.sig b/securemail/vendor/singpolyma/openpgp-php/tests/data/000067-002.sig new file mode 100644 index 00000000..d354e79d Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000067-002.sig differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000068-012.ring_trust b/securemail/vendor/singpolyma/openpgp-php/tests/data/000068-012.ring_trust new file mode 100644 index 00000000..b1eeabb9 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000068-012.ring_trust differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000069-005.secret_key b/securemail/vendor/singpolyma/openpgp-php/tests/data/000069-005.secret_key new file mode 100644 index 00000000..17a2c354 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000069-005.secret_key differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000070-013.user_id b/securemail/vendor/singpolyma/openpgp-php/tests/data/000070-013.user_id new file mode 100644 index 00000000..5d0d46e5 --- /dev/null +++ b/securemail/vendor/singpolyma/openpgp-php/tests/data/000070-013.user_id @@ -0,0 +1 @@ +.Test Key (RSA sign-only) \ No newline at end of file diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000071-002.sig b/securemail/vendor/singpolyma/openpgp-php/tests/data/000071-002.sig new file mode 100644 index 00000000..833b563b Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000071-002.sig differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000072-012.ring_trust b/securemail/vendor/singpolyma/openpgp-php/tests/data/000072-012.ring_trust new file mode 100644 index 00000000..b1eeabb9 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000072-012.ring_trust differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000073-017.attribute b/securemail/vendor/singpolyma/openpgp-php/tests/data/000073-017.attribute new file mode 100644 index 00000000..a21a82fb Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000073-017.attribute differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000074-002.sig b/securemail/vendor/singpolyma/openpgp-php/tests/data/000074-002.sig new file mode 100644 index 00000000..fc6267fd Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000074-002.sig differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000075-012.ring_trust b/securemail/vendor/singpolyma/openpgp-php/tests/data/000075-012.ring_trust new file mode 100644 index 00000000..b1eeabb9 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000075-012.ring_trust differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000076-007.secret_subkey b/securemail/vendor/singpolyma/openpgp-php/tests/data/000076-007.secret_subkey new file mode 100644 index 00000000..b380339a Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000076-007.secret_subkey differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000077-002.sig b/securemail/vendor/singpolyma/openpgp-php/tests/data/000077-002.sig new file mode 100644 index 00000000..336eb0f2 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000077-002.sig differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000078-012.ring_trust b/securemail/vendor/singpolyma/openpgp-php/tests/data/000078-012.ring_trust new file mode 100644 index 00000000..b1eeabb9 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000078-012.ring_trust differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/002182-002.sig b/securemail/vendor/singpolyma/openpgp-php/tests/data/002182-002.sig new file mode 100644 index 00000000..2bc6679f Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/002182-002.sig differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/compressedsig-bzip2.gpg b/securemail/vendor/singpolyma/openpgp-php/tests/data/compressedsig-bzip2.gpg new file mode 100644 index 00000000..87539dbe Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/compressedsig-bzip2.gpg differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/compressedsig-zlib.gpg b/securemail/vendor/singpolyma/openpgp-php/tests/data/compressedsig-zlib.gpg new file mode 100644 index 00000000..4da4dfa9 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/compressedsig-zlib.gpg differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/compressedsig.gpg b/securemail/vendor/singpolyma/openpgp-php/tests/data/compressedsig.gpg new file mode 100644 index 00000000..dd617de1 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/compressedsig.gpg differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/encryptedSecretKey.gpg b/securemail/vendor/singpolyma/openpgp-php/tests/data/encryptedSecretKey.gpg new file mode 100644 index 00000000..af700e80 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/encryptedSecretKey.gpg differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/hello.gpg b/securemail/vendor/singpolyma/openpgp-php/tests/data/hello.gpg new file mode 100644 index 00000000..986de95f Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/hello.gpg differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/helloKey.gpg b/securemail/vendor/singpolyma/openpgp-php/tests/data/helloKey.gpg new file mode 100644 index 00000000..b1dd0780 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/helloKey.gpg differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/onepass_sig b/securemail/vendor/singpolyma/openpgp-php/tests/data/onepass_sig new file mode 100644 index 00000000..87b2895e Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/onepass_sig differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/pubring.gpg b/securemail/vendor/singpolyma/openpgp-php/tests/data/pubring.gpg new file mode 100644 index 00000000..a1519ee7 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/pubring.gpg differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/secring.gpg b/securemail/vendor/singpolyma/openpgp-php/tests/data/secring.gpg new file mode 100644 index 00000000..9e43912b Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/secring.gpg differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/symmetric-3des.gpg b/securemail/vendor/singpolyma/openpgp-php/tests/data/symmetric-3des.gpg new file mode 100644 index 00000000..0029caec Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/symmetric-3des.gpg differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/symmetric-aes.gpg b/securemail/vendor/singpolyma/openpgp-php/tests/data/symmetric-aes.gpg new file mode 100644 index 00000000..f148ada1 --- /dev/null +++ b/securemail/vendor/singpolyma/openpgp-php/tests/data/symmetric-aes.gpg @@ -0,0 +1 @@ + FyD`>~iXaMM7*WK1I&U]-axsn֎jUǕ%ԩe \ No newline at end of file diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/symmetric-cast5.gpg b/securemail/vendor/singpolyma/openpgp-php/tests/data/symmetric-cast5.gpg new file mode 100644 index 00000000..950b7917 --- /dev/null +++ b/securemail/vendor/singpolyma/openpgp-php/tests/data/symmetric-cast5.gpg @@ -0,0 +1 @@ + 9F-`2萗wD0q,z}Zϲ֣# ־ aٛ!! \ No newline at end of file diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/symmetric-no-mdc.gpg b/securemail/vendor/singpolyma/openpgp-php/tests/data/symmetric-no-mdc.gpg new file mode 100644 index 00000000..40d31b0b --- /dev/null +++ b/securemail/vendor/singpolyma/openpgp-php/tests/data/symmetric-no-mdc.gpg @@ -0,0 +1,2 @@ + [JHB`#{%|6buC g+ +H \ No newline at end of file diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/symmetric-with-session-key.gpg b/securemail/vendor/singpolyma/openpgp-php/tests/data/symmetric-with-session-key.gpg new file mode 100644 index 00000000..0b623f1e Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/symmetric-with-session-key.gpg differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/symmetrically_encrypted b/securemail/vendor/singpolyma/openpgp-php/tests/data/symmetrically_encrypted new file mode 100644 index 00000000..129155aa Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/symmetrically_encrypted differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/uncompressed-ops-dsa-sha384.txt.gpg b/securemail/vendor/singpolyma/openpgp-php/tests/data/uncompressed-ops-dsa-sha384.txt.gpg new file mode 100644 index 00000000..39828fca Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/uncompressed-ops-dsa-sha384.txt.gpg differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/uncompressed-ops-dsa.gpg b/securemail/vendor/singpolyma/openpgp-php/tests/data/uncompressed-ops-dsa.gpg new file mode 100644 index 00000000..97e7a267 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/uncompressed-ops-dsa.gpg differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/uncompressed-ops-rsa.gpg b/securemail/vendor/singpolyma/openpgp-php/tests/data/uncompressed-ops-rsa.gpg new file mode 100644 index 00000000..7ae453da Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/uncompressed-ops-rsa.gpg differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/phpseclib_suite.php b/securemail/vendor/singpolyma/openpgp-php/tests/phpseclib_suite.php new file mode 100644 index 00000000..0f6ae30f --- /dev/null +++ b/securemail/vendor/singpolyma/openpgp-php/tests/phpseclib_suite.php @@ -0,0 +1,135 @@ +assertSame($verify->verify($m), $m->signatures()); + } + + public function testUncompressedOpsRSA() { + $this->oneMessageRSA('pubring.gpg', 'uncompressed-ops-rsa.gpg'); + } + + public function testCompressedSig() { + $this->oneMessageRSA('pubring.gpg', 'compressedsig.gpg'); + } + + public function testCompressedSigZLIB() { + $this->oneMessageRSA('pubring.gpg', 'compressedsig-zlib.gpg'); + } + + public function testCompressedSigBzip2() { + $this->oneMessageRSA('pubring.gpg', 'compressedsig-bzip2.gpg'); + } + + public function testSigningMessages() { + $wkey = OpenPGP_Message::parse(file_get_contents(dirname(__FILE__) . '/data/helloKey.gpg')); + $data = new OpenPGP_LiteralDataPacket('This is text.', array('format' => 'u', 'filename' => 'stuff.txt')); + $sign = new OpenPGP_Crypt_RSA($wkey); + $m = $sign->sign($data)->to_bytes(); + $reparsedM = OpenPGP_Message::parse($m); + $this->assertSame($sign->verify($reparsedM), $reparsedM->signatures()); + } + +/* + public function testUncompressedOpsDSA() { + $this->oneMessageDSA('pubring.gpg', 'uncompressed-ops-dsa.gpg'); + } + + public function testUncompressedOpsDSAsha384() { + $this->oneMessageDSA('pubring.gpg', 'uncompressed-ops-dsa-sha384.gpg'); + } +*/ +} + + +class KeyVerification extends PHPUnit_Framework_TestCase { + public function oneKeyRSA($path) { + $m = OpenPGP_Message::parse(file_get_contents(dirname(__FILE__) . '/data/' . $path)); + $verify = new OpenPGP_Crypt_RSA($m); + $this->assertSame($verify->verify($m), $m->signatures()); + } + + public function testHelloKey() { + $this->oneKeyRSA("helloKey.gpg"); + } +} + + +class Decryption extends PHPUnit_Framework_TestCase { + public function oneSymmetric($pass, $cnt, $path) { + $m = OpenPGP_Message::parse(file_get_contents(dirname(__FILE__) . '/data/' . $path)); + $m2 = OpenPGP_Crypt_Symmetric::decryptSymmetric($pass, $m); + while($m2[0] instanceof OpenPGP_CompressedDataPacket) $m2 = $m2[0]->data; + foreach($m2 as $p) { + if($p instanceof OpenPGP_LiteralDataPacket) { + $this->assertEquals($p->data, $cnt); + } + } + } + + public function testDecryptAES() { + $this->oneSymmetric("hello", "PGP\n", "symmetric-aes.gpg"); + } + + public function testDecrypt3DES() { + $this->oneSymmetric("hello", "PGP\n", "symmetric-3des.gpg"); + } + + public function testDecryptCAST5() { // Requires mcrypt + $this->oneSymmetric("hello", "PGP\n", "symmetric-cast5.gpg"); + } + + public function testDecryptSessionKey() { + $this->oneSymmetric("hello", "PGP\n", "symmetric-with-session-key.gpg"); + } + + public function testDecryptNoMDC() { + $this->oneSymmetric("hello", "PGP\n", "symmetric-no-mdc.gpg"); + } + + public function testDecryptAsymmetric() { + $m = OpenPGP_Message::parse(file_get_contents(dirname(__FILE__) . '/data/hello.gpg')); + $key = OpenPGP_Message::parse(file_get_contents(dirname(__FILE__) . '/data/helloKey.gpg')); + $decryptor = new OpenPGP_Crypt_RSA($key); + $m2 = $decryptor->decrypt($m); + while($m2[0] instanceof OpenPGP_CompressedDataPacket) $m2 = $m2[0]->data; + foreach($m2 as $p) { + if($p instanceof OpenPGP_LiteralDataPacket) { + $this->assertEquals($p->data, "hello\n"); + } + } + } + + public function testDecryptSecretKey() { + $key = OpenPGP_Message::parse(file_get_contents(dirname(__FILE__) . '/data/encryptedSecretKey.gpg')); + $skey = OpenPGP_Crypt_Symmetric::decryptSecretKey("hello", $key[0]); + $this->assertSame(!!$skey, true); + } +} + +class Encryption extends PHPUnit_Framework_TestCase { + public function testEncryptSymmetric() { + $data = new OpenPGP_LiteralDataPacket('This is text.', array('format' => 'u', 'filename' => 'stuff.txt')); + $encrypted = OpenPGP_Crypt_Symmetric::encrypt('secret', new OpenPGP_Message(array($data))); + $decrypted = OpenPGP_Crypt_Symmetric::decryptSymmetric('secret', $encrypted); + $this->assertEquals($decrypted[0]->data, 'This is text.'); + } + + public function testEncryptAsymmetric() { + $key = OpenPGP_Message::parse(file_get_contents(dirname(__FILE__) . '/data/helloKey.gpg')); + $data = new OpenPGP_LiteralDataPacket('This is text.', array('format' => 'u', 'filename' => 'stuff.txt')); + $encrypted = OpenPGP_Crypt_Symmetric::encrypt($key, new OpenPGP_Message(array($data))); + $decryptor = new OpenPGP_Crypt_RSA($key); + $decrypted = $decryptor->decrypt($encrypted); + $this->assertEquals($decrypted[0]->data, 'This is text.'); + } +} diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/suite.php b/securemail/vendor/singpolyma/openpgp-php/tests/suite.php new file mode 100644 index 00000000..1752d0b6 --- /dev/null +++ b/securemail/vendor/singpolyma/openpgp-php/tests/suite.php @@ -0,0 +1,400 @@ +to_bytes(); + $out = OpenPGP_Message::parse($mid); + $this->assertEquals($in, $out); + } + + public function test000001006public_key() { + $this->oneSerialization("000001-006.public_key"); + } + + + public function test000002013user_id() { + $this->oneSerialization("000002-013.user_id"); + } + + public function test000003002sig() { + $this->oneSerialization("000003-002.sig"); + } + + public function test000004012ring_trust() { + $this->oneSerialization("000004-012.ring_trust"); + } + + public function test000005002sig() { + $this->oneSerialization("000005-002.sig"); + } + + public function test000006012ring_trust() { + $this->oneSerialization("000006-012.ring_trust"); + } + + public function test000007002sig() { + $this->oneSerialization("000007-002.sig"); + } + + public function test000008012ring_trust() { + $this->oneSerialization("000008-012.ring_trust"); + } + + public function test000009002sig() { + $this->oneSerialization("000009-002.sig"); + } + + public function test000010012ring_trust() { + $this->oneSerialization("000010-012.ring_trust"); + } + + public function test000011002sig() { + $this->oneSerialization("000011-002.sig"); + } + + public function test000012012ring_trust() { + $this->oneSerialization("000012-012.ring_trust"); + } + + public function test000013014public_subkey() { + $this->oneSerialization("000013-014.public_subkey"); + } + + public function test000014002sig() { + $this->oneSerialization("000014-002.sig"); + } + + public function test000015012ring_trust() { + $this->oneSerialization("000015-012.ring_trust"); + } + + public function test000016006public_key() { + $this->oneSerialization("000016-006.public_key"); + } + + public function test000017002sig() { + $this->oneSerialization("000017-002.sig"); + } + + public function test000018012ring_trust() { + $this->oneSerialization("000018-012.ring_trust"); + } + + public function test000019013user_id() { + $this->oneSerialization("000019-013.user_id"); + } + + public function test000020002sig() { + $this->oneSerialization("000020-002.sig"); + } + + public function test000021012ring_trust() { + $this->oneSerialization("000021-012.ring_trust"); + } + + public function test000022002sig() { + $this->oneSerialization("000022-002.sig"); + } + + public function test000023012ring_trust() { + $this->oneSerialization("000023-012.ring_trust"); + } + + public function test000024014public_subkey() { + $this->oneSerialization("000024-014.public_subkey"); + } + + public function test000025002sig() { + $this->oneSerialization("000025-002.sig"); + } + + public function test000026012ring_trust() { + $this->oneSerialization("000026-012.ring_trust"); + } + + public function test000027006public_key() { + $this->oneSerialization("000027-006.public_key"); + } + + public function test000028002sig() { + $this->oneSerialization("000028-002.sig"); + } + + public function test000029012ring_trust() { + $this->oneSerialization("000029-012.ring_trust"); + } + + public function test000030013user_id() { + $this->oneSerialization("000030-013.user_id"); + } + + public function test000031002sig() { + $this->oneSerialization("000031-002.sig"); + } + + public function test000032012ring_trust() { + $this->oneSerialization("000032-012.ring_trust"); + } + + public function test000033002sig() { + $this->oneSerialization("000033-002.sig"); + } + + public function test000034012ring_trust() { + $this->oneSerialization("000034-012.ring_trust"); + } + + public function test000035006public_key() { + $this->oneSerialization("000035-006.public_key"); + } + + public function test000036013user_id() { + $this->oneSerialization("000036-013.user_id"); + } + + public function test000037002sig() { + $this->oneSerialization("000037-002.sig"); + } + + public function test000038012ring_trust() { + $this->oneSerialization("000038-012.ring_trust"); + } + + public function test000039002sig() { + $this->oneSerialization("000039-002.sig"); + } + + public function test000040012ring_trust() { + $this->oneSerialization("000040-012.ring_trust"); + } + + public function test000041017attribute() { + $this->oneSerialization("000041-017.attribute"); + } + + public function test000042002sig() { + $this->oneSerialization("000042-002.sig"); + } + + public function test000043012ring_trust() { + $this->oneSerialization("000043-012.ring_trust"); + } + + public function test000044014public_subkey() { + $this->oneSerialization("000044-014.public_subkey"); + } + + public function test000045002sig() { + $this->oneSerialization("000045-002.sig"); + } + + public function test000046012ring_trust() { + $this->oneSerialization("000046-012.ring_trust"); + } + + public function test000047005secret_key() { + $this->oneSerialization("000047-005.secret_key"); + } + + public function test000048013user_id() { + $this->oneSerialization("000048-013.user_id"); + } + + public function test000049002sig() { + $this->oneSerialization("000049-002.sig"); + } + + public function test000050012ring_trust() { + $this->oneSerialization("000050-012.ring_trust"); + } + + public function test000051007secret_subkey() { + $this->oneSerialization("000051-007.secret_subkey"); + } + + public function test000052002sig() { + $this->oneSerialization("000052-002.sig"); + } + + public function test000053012ring_trust() { + $this->oneSerialization("000053-012.ring_trust"); + } + + public function test000054005secret_key() { + $this->oneSerialization("000054-005.secret_key"); + } + + public function test000055002sig() { + $this->oneSerialization("000055-002.sig"); + } + + public function test000056012ring_trust() { + $this->oneSerialization("000056-012.ring_trust"); + } + + public function test000057013user_id() { + $this->oneSerialization("000057-013.user_id"); + } + + public function test000058002sig() { + $this->oneSerialization("000058-002.sig"); + } + + public function test000059012ring_trust() { + $this->oneSerialization("000059-012.ring_trust"); + } + + public function test000060007secret_subkey() { + $this->oneSerialization("000060-007.secret_subkey"); + } + + public function test000061002sig() { + $this->oneSerialization("000061-002.sig"); + } + + public function test000062012ring_trust() { + $this->oneSerialization("000062-012.ring_trust"); + } + + public function test000063005secret_key() { + $this->oneSerialization("000063-005.secret_key"); + } + + public function test000064002sig() { + $this->oneSerialization("000064-002.sig"); + } + + public function test000065012ring_trust() { + $this->oneSerialization("000065-012.ring_trust"); + } + + public function test000066013user_id() { + $this->oneSerialization("000066-013.user_id"); + } + + public function test000067002sig() { + $this->oneSerialization("000067-002.sig"); + } + + public function test000068012ring_trust() { + $this->oneSerialization("000068-012.ring_trust"); + } + + public function test000069005secret_key() { + $this->oneSerialization("000069-005.secret_key"); + } + + public function test000070013user_id() { + $this->oneSerialization("000070-013.user_id"); + } + + public function test000071002sig() { + $this->oneSerialization("000071-002.sig"); + } + + public function test000072012ring_trust() { + $this->oneSerialization("000072-012.ring_trust"); + } + + public function test000073017attribute() { + $this->oneSerialization("000073-017.attribute"); + } + + public function test000074002sig() { + $this->oneSerialization("000074-002.sig"); + } + + public function test000075012ring_trust() { + $this->oneSerialization("000075-012.ring_trust"); + } + + public function test000076007secret_subkey() { + $this->oneSerialization("000076-007.secret_subkey"); + } + + public function test000077002sig() { + $this->oneSerialization("000077-002.sig"); + } + + public function test000078012ring_trust() { + $this->oneSerialization("000078-012.ring_trust"); + } + + public function test002182002sig() { + $this->oneSerialization("002182-002.sig"); + } + + public function testpubringgpg() { + $this->oneSerialization("pubring.gpg"); + } + + public function testsecringgpg() { + $this->oneSerialization("secring.gpg"); + } + + public function testcompressedsiggpg() { + $this->oneSerialization("compressedsig.gpg"); + } + + public function testcompressedsigzlibgpg() { + $this->oneSerialization("compressedsig-zlib.gpg"); + } + + public function testcompressedsigbzip2gpg() { + $this->oneSerialization("compressedsig-bzip2.gpg"); + } + + public function testonepass_sig() { + $this->oneSerialization("onepass_sig"); + } + + public function testsymmetrically_encrypted() { + $this->oneSerialization("symmetrically_encrypted"); + } + + public function testuncompressedopsdsagpg() { + $this->oneSerialization("uncompressed-ops-dsa.gpg"); + } + + public function testuncompressedopsdsasha384txtgpg() { + $this->oneSerialization("uncompressed-ops-dsa-sha384.txt.gpg"); + } + + public function testuncompressedopsrsagpg() { + $this->oneSerialization("uncompressed-ops-rsa.gpg"); + } + + public function testSymmetricAES() { + $this->oneSerialization("symmetric-aes.gpg"); + } + + public function testSymmetricNoMDC() { + $this->oneSerialization("symmetric-no-mdc.gpg"); + } +} + +class Fingerprint extends PHPUnit_Framework_TestCase { + public function oneFingerprint($path, $kf) { + $m = OpenPGP_Message::parse(file_get_contents(dirname(__FILE__) . '/data/' . $path)); + $this->assertEquals($m[0]->fingerprint(), $kf); + } + + public function test000001006public_key() { + $this->oneFingerprint("000001-006.public_key", "421F28FEAAD222F856C8FFD5D4D54EA16F87040E"); + } + + public function test000016006public_key() { + $this->oneFingerprint("000016-006.public_key", "AF95E4D7BAC521EE9740BED75E9F1523413262DC"); + } + + public function test000027006public_key() { + $this->oneFingerprint("000027-006.public_key", "1EB20B2F5A5CC3BEAFD6E5CB7732CF988A63EA86"); + } + + public function test000035006public_key() { + $this->oneFingerprint("000035-006.public_key", "CB7933459F59C70DF1C3FBEEDEDC3ECF689AF56D"); + } +}
* login('username', 'password')) { * exit('Login Failed'); * } @@ -38,204 +38,193 @@ * More information on the SSHv1 specification can be found by reading * {@link http://www.snailbook.com/docs/protocol-1.5.txt protocol-1.5.txt}. * - * LICENSE: Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in - * all copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN - * THE SOFTWARE. - * * @category Net - * @package Net_SSH1 + * @package SSH1 * @author Jim Wigginton * @copyright 2007 Jim Wigginton * @license http://www.opensource.org/licenses/mit-license.html MIT License * @link http://phpseclib.sourceforge.net */ -/**#@+ - * Encryption Methods - * - * @see Net_SSH1::getSupportedCiphers() - * @access public - */ -/** - * No encryption - * - * Not supported. - */ -define('NET_SSH1_CIPHER_NONE', 0); -/** - * IDEA in CFB mode - * - * Not supported. - */ -define('NET_SSH1_CIPHER_IDEA', 1); -/** - * DES in CBC mode - */ -define('NET_SSH1_CIPHER_DES', 2); -/** - * Triple-DES in CBC mode - * - * All implementations are required to support this - */ -define('NET_SSH1_CIPHER_3DES', 3); -/** - * TRI's Simple Stream encryption CBC - * - * Not supported nor is it defined in the official SSH1 specs. OpenSSH, however, does define it (see cipher.h), - * although it doesn't use it (see cipher.c) - */ -define('NET_SSH1_CIPHER_BROKEN_TSS', 4); -/** - * RC4 - * - * Not supported. - * - * @internal According to the SSH1 specs: - * - * "The first 16 bytes of the session key are used as the key for - * the server to client direction. The remaining 16 bytes are used - * as the key for the client to server direction. This gives - * independent 128-bit keys for each direction." - * - * This library currently only supports encryption when the same key is being used for both directions. This is - * because there's only one $crypto object. Two could be added ($encrypt and $decrypt, perhaps). - */ -define('NET_SSH1_CIPHER_RC4', 5); -/** - * Blowfish - * - * Not supported nor is it defined in the official SSH1 specs. OpenSSH, however, defines it (see cipher.h) and - * uses it (see cipher.c) - */ -define('NET_SSH1_CIPHER_BLOWFISH', 6); -/**#@-*/ +namespace phpseclib\Net; -/**#@+ - * Authentication Methods - * - * @see Net_SSH1::getSupportedAuthentications() - * @access public - */ -/** - * .rhosts or /etc/hosts.equiv - */ -define('NET_SSH1_AUTH_RHOSTS', 1); -/** - * pure RSA authentication - */ -define('NET_SSH1_AUTH_RSA', 2); -/** - * password authentication - * - * This is the only method that is supported by this library. - */ -define('NET_SSH1_AUTH_PASSWORD', 3); -/** - * .rhosts with RSA host authentication - */ -define('NET_SSH1_AUTH_RHOSTS_RSA', 4); -/**#@-*/ - -/**#@+ - * Terminal Modes - * - * @link http://3sp.com/content/developer/maverick-net/docs/Maverick.SSH.PseudoTerminalModesMembers.html - * @access private - */ -define('NET_SSH1_TTY_OP_END', 0); -/**#@-*/ - -/** - * The Response Type - * - * @see Net_SSH1::_get_binary_packet() - * @access private - */ -define('NET_SSH1_RESPONSE_TYPE', 1); - -/** - * The Response Data - * - * @see Net_SSH1::_get_binary_packet() - * @access private - */ -define('NET_SSH1_RESPONSE_DATA', 2); - -/**#@+ - * Execution Bitmap Masks - * - * @see Net_SSH1::bitmap - * @access private - */ -define('NET_SSH1_MASK_CONSTRUCTOR', 0x00000001); -define('NET_SSH1_MASK_CONNECTED', 0x00000002); -define('NET_SSH1_MASK_LOGIN', 0x00000004); -define('NET_SSH1_MASK_SHELL', 0x00000008); -/**#@-*/ - -/**#@+ - * @access public - * @see Net_SSH1::getLog() - */ -/** - * Returns the message numbers - */ -define('NET_SSH1_LOG_SIMPLE', 1); -/** - * Returns the message content - */ -define('NET_SSH1_LOG_COMPLEX', 2); -/** - * Outputs the content real-time - */ -define('NET_SSH1_LOG_REALTIME', 3); -/** - * Dumps the content real-time to a file - */ -define('NET_SSH1_LOG_REALTIME_FILE', 4); -/**#@-*/ - -/**#@+ - * @access public - * @see Net_SSH1::read() - */ -/** - * Returns when a string matching $expect exactly is found - */ -define('NET_SSH1_READ_SIMPLE', 1); -/** - * Returns when a string matching the regular expression $expect is found - */ -define('NET_SSH1_READ_REGEX', 2); -/**#@-*/ +use phpseclib\Crypt\DES; +use phpseclib\Crypt\Random; +use phpseclib\Crypt\TripleDES; +use phpseclib\Math\BigInteger; /** * Pure-PHP implementation of SSHv1. * - * @package Net_SSH1 + * @package SSH1 * @author Jim Wigginton * @access public */ -class Net_SSH1 +class SSH1 { + /**#@+ + * Encryption Methods + * + * @see \phpseclib\Net\SSH1::getSupportedCiphers() + * @access public + */ + /** + * No encryption + * + * Not supported. + */ + const CIPHER_NONE = 0; + /** + * IDEA in CFB mode + * + * Not supported. + */ + const CIPHER_IDEA = 1; + /** + * DES in CBC mode + */ + const CIPHER_DES = 2; + /** + * Triple-DES in CBC mode + * + * All implementations are required to support this + */ + const CIPHER_3DES = 3; + /** + * TRI's Simple Stream encryption CBC + * + * Not supported nor is it defined in the official SSH1 specs. OpenSSH, however, does define it (see cipher.h), + * although it doesn't use it (see cipher.c) + */ + const CIPHER_BROKEN_TSS = 4; + /** + * RC4 + * + * Not supported. + * + * @internal According to the SSH1 specs: + * + * "The first 16 bytes of the session key are used as the key for + * the server to client direction. The remaining 16 bytes are used + * as the key for the client to server direction. This gives + * independent 128-bit keys for each direction." + * + * This library currently only supports encryption when the same key is being used for both directions. This is + * because there's only one $crypto object. Two could be added ($encrypt and $decrypt, perhaps). + */ + const CIPHER_RC4 = 5; + /** + * Blowfish + * + * Not supported nor is it defined in the official SSH1 specs. OpenSSH, however, defines it (see cipher.h) and + * uses it (see cipher.c) + */ + const CIPHER_BLOWFISH = 6; + /**#@-*/ + + /**#@+ + * Authentication Methods + * + * @see \phpseclib\Net\SSH1::getSupportedAuthentications() + * @access public + */ + /** + * .rhosts or /etc/hosts.equiv + */ + const AUTH_RHOSTS = 1; + /** + * pure RSA authentication + */ + const AUTH_RSA = 2; + /** + * password authentication + * + * This is the only method that is supported by this library. + */ + const AUTH_PASSWORD = 3; + /** + * .rhosts with RSA host authentication + */ + const AUTH_RHOSTS_RSA = 4; + /**#@-*/ + + /**#@+ + * Terminal Modes + * + * @link http://3sp.com/content/developer/maverick-net/docs/Maverick.SSH.PseudoTerminalModesMembers.html + * @access private + */ + const TTY_OP_END = 0; + /**#@-*/ + + /** + * The Response Type + * + * @see \phpseclib\Net\SSH1::_get_binary_packet() + * @access private + */ + const RESPONSE_TYPE = 1; + + /** + * The Response Data + * + * @see \phpseclib\Net\SSH1::_get_binary_packet() + * @access private + */ + const RESPONSE_DATA = 2; + + /**#@+ + * Execution Bitmap Masks + * + * @see \phpseclib\Net\SSH1::bitmap + * @access private + */ + const MASK_CONSTRUCTOR = 0x00000001; + const MASK_CONNECTED = 0x00000002; + const MASK_LOGIN = 0x00000004; + const MASK_SHELL = 0x00000008; + /**#@-*/ + + /**#@+ + * @access public + * @see \phpseclib\Net\SSH1::getLog() + */ + /** + * Returns the message numbers + */ + const LOG_SIMPLE = 1; + /** + * Returns the message content + */ + const LOG_COMPLEX = 2; + /** + * Outputs the content real-time + */ + const LOG_REALTIME = 3; + /** + * Dumps the content real-time to a file + */ + const LOG_REALTIME_FILE = 4; + /**#@-*/ + + /**#@+ + * @access public + * @see \phpseclib\Net\SSH1::read() + */ + /** + * Returns when a string matching $expect exactly is found + */ + const READ_SIMPLE = 1; + /** + * Returns when a string matching the regular expression $expect is found + */ + const READ_REGEX = 2; + /**#@-*/ + /** * The SSH identifier * - * @var String + * @var string * @access private */ var $identifier = 'SSH-1.5-phpseclib'; @@ -243,7 +232,7 @@ class Net_SSH1 /** * The Socket Object * - * @var Object + * @var object * @access private */ var $fsock; @@ -251,7 +240,7 @@ class Net_SSH1 /** * The cryptography object * - * @var Object + * @var object * @access private */ var $crypto = false; @@ -262,7 +251,7 @@ class Net_SSH1 * The bits that are set represent functions that have been called already. This is used to determine * if a requisite function has been successfully executed. If not, an error should be thrown. * - * @var Integer + * @var int * @access private */ var $bitmap = 0; @@ -272,8 +261,8 @@ class Net_SSH1 * * Logged for debug purposes * - * @see Net_SSH1::getServerKeyPublicExponent() - * @var String + * @see self::getServerKeyPublicExponent() + * @var string * @access private */ var $server_key_public_exponent; @@ -283,8 +272,8 @@ class Net_SSH1 * * Logged for debug purposes * - * @see Net_SSH1::getServerKeyPublicModulus() - * @var String + * @see self::getServerKeyPublicModulus() + * @var string * @access private */ var $server_key_public_modulus; @@ -294,8 +283,8 @@ class Net_SSH1 * * Logged for debug purposes * - * @see Net_SSH1::getHostKeyPublicExponent() - * @var String + * @see self::getHostKeyPublicExponent() + * @var string * @access private */ var $host_key_public_exponent; @@ -305,8 +294,8 @@ class Net_SSH1 * * Logged for debug purposes * - * @see Net_SSH1::getHostKeyPublicModulus() - * @var String + * @see self::getHostKeyPublicModulus() + * @var string * @access private */ var $host_key_public_modulus; @@ -316,18 +305,18 @@ class Net_SSH1 * * Logged for debug purposes * - * @see Net_SSH1::getSupportedCiphers() - * @var Array + * @see self::getSupportedCiphers() + * @var array * @access private */ var $supported_ciphers = array( - NET_SSH1_CIPHER_NONE => 'No encryption', - NET_SSH1_CIPHER_IDEA => 'IDEA in CFB mode', - NET_SSH1_CIPHER_DES => 'DES in CBC mode', - NET_SSH1_CIPHER_3DES => 'Triple-DES in CBC mode', - NET_SSH1_CIPHER_BROKEN_TSS => 'TRI\'s Simple Stream encryption CBC', - NET_SSH1_CIPHER_RC4 => 'RC4', - NET_SSH1_CIPHER_BLOWFISH => 'Blowfish' + self::CIPHER_NONE => 'No encryption', + self::CIPHER_IDEA => 'IDEA in CFB mode', + self::CIPHER_DES => 'DES in CBC mode', + self::CIPHER_3DES => 'Triple-DES in CBC mode', + self::CIPHER_BROKEN_TSS => 'TRI\'s Simple Stream encryption CBC', + self::CIPHER_RC4 => 'RC4', + self::CIPHER_BLOWFISH => 'Blowfish' ); /** @@ -335,22 +324,22 @@ class Net_SSH1 * * Logged for debug purposes * - * @see Net_SSH1::getSupportedAuthentications() - * @var Array + * @see self::getSupportedAuthentications() + * @var array * @access private */ var $supported_authentications = array( - NET_SSH1_AUTH_RHOSTS => '.rhosts or /etc/hosts.equiv', - NET_SSH1_AUTH_RSA => 'pure RSA authentication', - NET_SSH1_AUTH_PASSWORD => 'password authentication', - NET_SSH1_AUTH_RHOSTS_RSA => '.rhosts with RSA host authentication' + self::AUTH_RHOSTS => '.rhosts or /etc/hosts.equiv', + self::AUTH_RSA => 'pure RSA authentication', + self::AUTH_PASSWORD => 'password authentication', + self::AUTH_RHOSTS_RSA => '.rhosts with RSA host authentication' ); /** * Server Identification * - * @see Net_SSH1::getServerIdentification() - * @var String + * @see self::getServerIdentification() + * @var string * @access private */ var $server_identification = ''; @@ -358,8 +347,8 @@ class Net_SSH1 /** * Protocol Flags * - * @see Net_SSH1::Net_SSH1() - * @var Array + * @see self::__construct() + * @var array * @access private */ var $protocol_flags = array(); @@ -367,8 +356,8 @@ class Net_SSH1 /** * Protocol Flag Log * - * @see Net_SSH1::getLog() - * @var Array + * @see self::getLog() + * @var array * @access private */ var $protocol_flag_log = array(); @@ -376,8 +365,8 @@ class Net_SSH1 /** * Message Log * - * @see Net_SSH1::getLog() - * @var Array + * @see self::getLog() + * @var array * @access private */ var $message_log = array(); @@ -385,8 +374,8 @@ class Net_SSH1 /** * Real-time log file pointer * - * @see Net_SSH1::_append_log() - * @var Resource + * @see self::_append_log() + * @var resource * @access private */ var $realtime_log_file; @@ -394,8 +383,8 @@ class Net_SSH1 /** * Real-time log file size * - * @see Net_SSH1::_append_log() - * @var Integer + * @see self::_append_log() + * @var int * @access private */ var $realtime_log_size; @@ -403,8 +392,8 @@ class Net_SSH1 /** * Real-time log file wrap boolean * - * @see Net_SSH1::_append_log() - * @var Boolean + * @see self::_append_log() + * @var bool * @access private */ var $realtime_log_wrap; @@ -412,8 +401,8 @@ class Net_SSH1 /** * Interactive Buffer * - * @see Net_SSH1::read() - * @var Array + * @see self::read() + * @var array * @access private */ var $interactiveBuffer = ''; @@ -421,7 +410,7 @@ class Net_SSH1 /** * Timeout * - * @see Net_SSH1::setTimeout() + * @see self::setTimeout() * @access private */ var $timeout; @@ -429,7 +418,7 @@ class Net_SSH1 /** * Current Timeout * - * @see Net_SSH1::_get_channel_packet() + * @see self::_get_channel_packet() * @access private */ var $curTimeout; @@ -437,7 +426,7 @@ class Net_SSH1 /** * Log Boundary * - * @see Net_SSH1::_format_log + * @see self::_format_log() * @access private */ var $log_boundary = ':'; @@ -445,7 +434,7 @@ class Net_SSH1 /** * Log Long Width * - * @see Net_SSH1::_format_log + * @see self::_format_log() * @access private */ var $log_long_width = 65; @@ -453,7 +442,7 @@ class Net_SSH1 /** * Log Short Width * - * @see Net_SSH1::_format_log + * @see self::_format_log() * @access private */ var $log_short_width = 16; @@ -461,9 +450,9 @@ class Net_SSH1 /** * Hostname * - * @see Net_SSH1::Net_SSH1() - * @see Net_SSH1::_connect() - * @var String + * @see self::__construct() + * @see self::_connect() + * @var string * @access private */ var $host; @@ -471,9 +460,9 @@ class Net_SSH1 /** * Port Number * - * @see Net_SSH1::Net_SSH1() - * @see Net_SSH1::_connect() - * @var Integer + * @see self::__construct() + * @see self::_connect() + * @var int * @access private */ var $port; @@ -486,9 +475,9 @@ class Net_SSH1 * however, is non-optional. There will be a timeout, whether or not you set it. If you don't it'll be * 10 seconds. It is used by fsockopen() in that function. * - * @see Net_SSH1::Net_SSH1() - * @see Net_SSH1::_connect() - * @var Integer + * @see self::__construct() + * @see self::_connect() + * @var int * @access private */ var $connectionTimeout; @@ -496,9 +485,9 @@ class Net_SSH1 /** * Default cipher * - * @see Net_SSH1::Net_SSH1() - * @see Net_SSH1::_connect() - * @var Integer + * @see self::__construct() + * @see self::_connect() + * @var int * @access private */ var $cipher; @@ -508,28 +497,15 @@ class Net_SSH1 * * Connects to an SSHv1 server * - * @param String $host - * @param optional Integer $port - * @param optional Integer $timeout - * @param optional Integer $cipher - * @return Net_SSH1 + * @param string $host + * @param int $port + * @param int $timeout + * @param int $cipher + * @return \phpseclib\Net\SSH1 * @access public */ - function Net_SSH1($host, $port = 22, $timeout = 10, $cipher = NET_SSH1_CIPHER_3DES) + function __construct($host, $port = 22, $timeout = 10, $cipher = self::CIPHER_3DES) { - if (!class_exists('Math_BigInteger')) { - include_once 'Math/BigInteger.php'; - } - - // Include Crypt_Random - // the class_exists() will only be called if the crypt_random_string function hasn't been defined and - // will trigger a call to __autoload() if you're wanting to auto-load classes - // call function_exists() a second time to stop the include_once from being called outside - // of the auto loader - if (!function_exists('crypt_random_string') && !class_exists('Crypt_Random') && !function_exists('crypt_random_string')) { - include_once 'Crypt/Random.php'; - } - $this->protocol_flags = array( 1 => 'NET_SSH1_MSG_DISCONNECT', 2 => 'NET_SSH1_SMSG_PUBLIC_KEY', @@ -560,7 +536,7 @@ class Net_SSH1 /** * Connect to an SSHv1 server * - * @return Boolean + * @return bool * @access private */ function _connect() @@ -590,46 +566,46 @@ class Net_SSH1 fputs($this->fsock, $this->identifier."\r\n"); $response = $this->_get_binary_packet(); - if ($response[NET_SSH1_RESPONSE_TYPE] != NET_SSH1_SMSG_PUBLIC_KEY) { + if ($response[self::RESPONSE_TYPE] != NET_SSH1_SMSG_PUBLIC_KEY) { user_error('Expected SSH_SMSG_PUBLIC_KEY'); return false; } - $anti_spoofing_cookie = $this->_string_shift($response[NET_SSH1_RESPONSE_DATA], 8); + $anti_spoofing_cookie = $this->_string_shift($response[self::RESPONSE_DATA], 8); - $this->_string_shift($response[NET_SSH1_RESPONSE_DATA], 4); + $this->_string_shift($response[self::RESPONSE_DATA], 4); - $temp = unpack('nlen', $this->_string_shift($response[NET_SSH1_RESPONSE_DATA], 2)); - $server_key_public_exponent = new Math_BigInteger($this->_string_shift($response[NET_SSH1_RESPONSE_DATA], ceil($temp['len'] / 8)), 256); + $temp = unpack('nlen', $this->_string_shift($response[self::RESPONSE_DATA], 2)); + $server_key_public_exponent = new BigInteger($this->_string_shift($response[self::RESPONSE_DATA], ceil($temp['len'] / 8)), 256); $this->server_key_public_exponent = $server_key_public_exponent; - $temp = unpack('nlen', $this->_string_shift($response[NET_SSH1_RESPONSE_DATA], 2)); - $server_key_public_modulus = new Math_BigInteger($this->_string_shift($response[NET_SSH1_RESPONSE_DATA], ceil($temp['len'] / 8)), 256); + $temp = unpack('nlen', $this->_string_shift($response[self::RESPONSE_DATA], 2)); + $server_key_public_modulus = new BigInteger($this->_string_shift($response[self::RESPONSE_DATA], ceil($temp['len'] / 8)), 256); $this->server_key_public_modulus = $server_key_public_modulus; - $this->_string_shift($response[NET_SSH1_RESPONSE_DATA], 4); + $this->_string_shift($response[self::RESPONSE_DATA], 4); - $temp = unpack('nlen', $this->_string_shift($response[NET_SSH1_RESPONSE_DATA], 2)); - $host_key_public_exponent = new Math_BigInteger($this->_string_shift($response[NET_SSH1_RESPONSE_DATA], ceil($temp['len'] / 8)), 256); + $temp = unpack('nlen', $this->_string_shift($response[self::RESPONSE_DATA], 2)); + $host_key_public_exponent = new BigInteger($this->_string_shift($response[self::RESPONSE_DATA], ceil($temp['len'] / 8)), 256); $this->host_key_public_exponent = $host_key_public_exponent; - $temp = unpack('nlen', $this->_string_shift($response[NET_SSH1_RESPONSE_DATA], 2)); - $host_key_public_modulus = new Math_BigInteger($this->_string_shift($response[NET_SSH1_RESPONSE_DATA], ceil($temp['len'] / 8)), 256); + $temp = unpack('nlen', $this->_string_shift($response[self::RESPONSE_DATA], 2)); + $host_key_public_modulus = new BigInteger($this->_string_shift($response[self::RESPONSE_DATA], ceil($temp['len'] / 8)), 256); $this->host_key_public_modulus = $host_key_public_modulus; - $this->_string_shift($response[NET_SSH1_RESPONSE_DATA], 4); + $this->_string_shift($response[self::RESPONSE_DATA], 4); // get a list of the supported ciphers - extract(unpack('Nsupported_ciphers_mask', $this->_string_shift($response[NET_SSH1_RESPONSE_DATA], 4))); - foreach ($this->supported_ciphers as $mask=>$name) { + extract(unpack('Nsupported_ciphers_mask', $this->_string_shift($response[self::RESPONSE_DATA], 4))); + foreach ($this->supported_ciphers as $mask => $name) { if (($supported_ciphers_mask & (1 << $mask)) == 0) { unset($this->supported_ciphers[$mask]); } } // get a list of the supported authentications - extract(unpack('Nsupported_authentications_mask', $this->_string_shift($response[NET_SSH1_RESPONSE_DATA], 4))); - foreach ($this->supported_authentications as $mask=>$name) { + extract(unpack('Nsupported_authentications_mask', $this->_string_shift($response[self::RESPONSE_DATA], 4))); + foreach ($this->supported_authentications as $mask => $name) { if (($supported_authentications_mask & (1 << $mask)) == 0) { unset($this->supported_authentications[$mask]); } @@ -637,7 +613,7 @@ class Net_SSH1 $session_id = pack('H*', md5($host_key_public_modulus->toBytes() . $server_key_public_modulus->toBytes() . $anti_spoofing_cookie)); - $session_key = crypt_random_string(32); + $session_key = Random::string(32); $double_encrypted_session_key = $session_key ^ str_pad($session_id, 32, chr(0)); if ($server_key_public_modulus->compare($host_key_public_modulus) < 0) { @@ -672,7 +648,7 @@ class Net_SSH1 ); } - $cipher = isset($this->supported_ciphers[$this->cipher]) ? $this->cipher : NET_SSH1_CIPHER_3DES; + $cipher = isset($this->supported_ciphers[$this->cipher]) ? $this->cipher : self::CIPHER_3DES; $data = pack('C2a*na*N', NET_SSH1_CMSG_SESSION_KEY, $cipher, $anti_spoofing_cookie, 8 * strlen($double_encrypted_session_key), $double_encrypted_session_key, 0); if (!$this->_send_binary_packet($data)) { @@ -681,32 +657,23 @@ class Net_SSH1 } switch ($cipher) { - //case NET_SSH1_CIPHER_NONE: - // $this->crypto = new Crypt_Null(); + //case self::CIPHER_NONE: + // $this->crypto = new \phpseclib\Crypt\Null(); // break; - case NET_SSH1_CIPHER_DES: - if (!class_exists('Crypt_DES')) { - include_once 'Crypt/DES.php'; - } - $this->crypto = new Crypt_DES(); + case self::CIPHER_DES: + $this->crypto = new DES(); $this->crypto->disablePadding(); $this->crypto->enableContinuousBuffer(); $this->crypto->setKey(substr($session_key, 0, 8)); break; - case NET_SSH1_CIPHER_3DES: - if (!class_exists('Crypt_TripleDES')) { - include_once 'Crypt/TripleDES.php'; - } - $this->crypto = new Crypt_TripleDES(CRYPT_DES_MODE_3CBC); + case self::CIPHER_3DES: + $this->crypto = new TripleDES(TripleDES::MODE_3CBC); $this->crypto->disablePadding(); $this->crypto->enableContinuousBuffer(); $this->crypto->setKey(substr($session_key, 0, 24)); break; - //case NET_SSH1_CIPHER_RC4: - // if (!class_exists('Crypt_RC4')) { - // include_once 'Crypt/RC4.php'; - // } - // $this->crypto = new Crypt_RC4(); + //case self::CIPHER_RC4: + // $this->crypto = new RC4(); // $this->crypto->enableContinuousBuffer(); // $this->crypto->setKey(substr($session_key, 0, 16)); // break; @@ -714,12 +681,12 @@ class Net_SSH1 $response = $this->_get_binary_packet(); - if ($response[NET_SSH1_RESPONSE_TYPE] != NET_SSH1_SMSG_SUCCESS) { + if ($response[self::RESPONSE_TYPE] != NET_SSH1_SMSG_SUCCESS) { user_error('Expected SSH_SMSG_SUCCESS'); return false; } - $this->bitmap = NET_SSH1_MASK_CONNECTED; + $this->bitmap = self::MASK_CONNECTED; return true; } @@ -727,21 +694,21 @@ class Net_SSH1 /** * Login * - * @param String $username - * @param optional String $password - * @return Boolean + * @param string $username + * @param string $password + * @return bool * @access public */ function login($username, $password = '') { - if (!($this->bitmap & NET_SSH1_MASK_CONSTRUCTOR)) { - $this->bitmap |= NET_SSH1_MASK_CONSTRUCTOR; + if (!($this->bitmap & self::MASK_CONSTRUCTOR)) { + $this->bitmap |= self::MASK_CONSTRUCTOR; if (!$this->_connect()) { return false; } } - if (!($this->bitmap & NET_SSH1_MASK_CONNECTED)) { + if (!($this->bitmap & self::MASK_CONNECTED)) { return false; } @@ -757,10 +724,10 @@ class Net_SSH1 if ($response === true) { return false; } - if ($response[NET_SSH1_RESPONSE_TYPE] == NET_SSH1_SMSG_SUCCESS) { - $this->bitmap |= NET_SSH1_MASK_LOGIN; + if ($response[self::RESPONSE_TYPE] == NET_SSH1_SMSG_SUCCESS) { + $this->bitmap |= self::MASK_LOGIN; return true; - } else if ($response[NET_SSH1_RESPONSE_TYPE] != NET_SSH1_SMSG_FAILURE) { + } elseif ($response[self::RESPONSE_TYPE] != NET_SSH1_SMSG_FAILURE) { user_error('Expected SSH_SMSG_SUCCESS or SSH_SMSG_FAILURE'); return false; } @@ -773,7 +740,7 @@ class Net_SSH1 } // remove the username and password from the last logged packet - if (defined('NET_SSH1_LOGGING') && NET_SSH1_LOGGING == NET_SSH1_LOG_COMPLEX) { + if (defined('NET_SSH1_LOGGING') && NET_SSH1_LOGGING == self::LOG_COMPLEX) { $data = pack('CNa*', NET_SSH1_CMSG_AUTH_PASSWORD, strlen('password'), 'password'); $this->message_log[count($this->message_log) - 1] = $data; } @@ -783,10 +750,10 @@ class Net_SSH1 if ($response === true) { return false; } - if ($response[NET_SSH1_RESPONSE_TYPE] == NET_SSH1_SMSG_SUCCESS) { - $this->bitmap |= NET_SSH1_MASK_LOGIN; + if ($response[self::RESPONSE_TYPE] == NET_SSH1_SMSG_SUCCESS) { + $this->bitmap |= self::MASK_LOGIN; return true; - } else if ($response[NET_SSH1_RESPONSE_TYPE] == NET_SSH1_SMSG_FAILURE) { + } elseif ($response[self::RESPONSE_TYPE] == NET_SSH1_SMSG_FAILURE) { return false; } else { user_error('Expected SSH_SMSG_SUCCESS or SSH_SMSG_FAILURE'); @@ -800,7 +767,7 @@ class Net_SSH1 * $ssh->exec('ping 127.0.0.1'); on a Linux host will never return and will run indefinitely. setTimeout() makes it so it'll timeout. * Setting $timeout to false or 0 will mean there is no timeout. * - * @param Mixed $timeout + * @param mixed $timeout */ function setTimeout($timeout) { @@ -817,19 +784,19 @@ class Net_SSH1 * {@link http://www.faqs.org/docs/bashman/bashref_65.html http://www.faqs.org/docs/bashman/bashref_65.html} * {@link http://www.faqs.org/docs/bashman/bashref_62.html http://www.faqs.org/docs/bashman/bashref_62.html} * - * To execute further commands, a new Net_SSH1 object will need to be created. + * To execute further commands, a new \phpseclib\Net\SSH1 object will need to be created. * * Returns false on failure and the output, otherwise. * - * @see Net_SSH1::interactiveRead() - * @see Net_SSH1::interactiveWrite() - * @param String $cmd + * @see self::interactiveRead() + * @see self::interactiveWrite() + * @param string $cmd * @return mixed * @access public */ function exec($cmd, $block = true) { - if (!($this->bitmap & NET_SSH1_MASK_LOGIN)) { + if (!($this->bitmap & self::MASK_LOGIN)) { user_error('Operation disallowed prior to login()'); return false; } @@ -850,9 +817,9 @@ class Net_SSH1 if ($response !== false) { do { - $output.= substr($response[NET_SSH1_RESPONSE_DATA], 4); + $output.= substr($response[self::RESPONSE_DATA], 4); $response = $this->_get_binary_packet(); - } while (is_array($response) && $response[NET_SSH1_RESPONSE_TYPE] != NET_SSH1_SMSG_EXITSTATUS); + } while (is_array($response) && $response[self::RESPONSE_TYPE] != NET_SSH1_SMSG_EXITSTATUS); } $data = pack('C', NET_SSH1_CMSG_EXIT_CONFIRMATION); @@ -862,7 +829,7 @@ class Net_SSH1 fclose($this->fsock); - // reset the execution bitmap - a new Net_SSH1 object needs to be created. + // reset the execution bitmap - a new \phpseclib\Net\SSH1 object needs to be created. $this->bitmap = 0; return $output; @@ -871,9 +838,9 @@ class Net_SSH1 /** * Creates an interactive shell * - * @see Net_SSH1::interactiveRead() - * @see Net_SSH1::interactiveWrite() - * @return Boolean + * @see self::interactiveRead() + * @see self::interactiveWrite() + * @return bool * @access private */ function _initShell() @@ -881,7 +848,7 @@ class Net_SSH1 // connect using the sample parameters in protocol-1.5.txt. // according to wikipedia.org's entry on text terminals, "the fundamental type of application running on a text // terminal is a command line interpreter or shell". thus, opening a terminal session to run the shell. - $data = pack('CNa*N4C', NET_SSH1_CMSG_REQUEST_PTY, strlen('vt100'), 'vt100', 24, 80, 0, 0, NET_SSH1_TTY_OP_END); + $data = pack('CNa*N4C', NET_SSH1_CMSG_REQUEST_PTY, strlen('vt100'), 'vt100', 24, 80, 0, 0, self::TTY_OP_END); if (!$this->_send_binary_packet($data)) { user_error('Error sending SSH_CMSG_REQUEST_PTY'); @@ -893,7 +860,7 @@ class Net_SSH1 if ($response === true) { return false; } - if ($response[NET_SSH1_RESPONSE_TYPE] != NET_SSH1_SMSG_SUCCESS) { + if ($response[self::RESPONSE_TYPE] != NET_SSH1_SMSG_SUCCESS) { user_error('Expected SSH_SMSG_SUCCESS'); return false; } @@ -905,7 +872,7 @@ class Net_SSH1 return false; } - $this->bitmap |= NET_SSH1_MASK_SHELL; + $this->bitmap |= self::MASK_SHELL; //stream_set_blocking($this->fsock, 0); @@ -915,9 +882,9 @@ class Net_SSH1 /** * Inputs a command into an interactive shell. * - * @see Net_SSH1::interactiveWrite() - * @param String $cmd - * @return Boolean + * @see self::interactiveWrite() + * @param string $cmd + * @return bool * @access public */ function write($cmd) @@ -928,30 +895,30 @@ class Net_SSH1 /** * Returns the output of an interactive shell when there's a match for $expect * - * $expect can take the form of a string literal or, if $mode == NET_SSH1_READ_REGEX, + * $expect can take the form of a string literal or, if $mode == self::READ__REGEX, * a regular expression. * - * @see Net_SSH1::write() - * @param String $expect - * @param Integer $mode - * @return Boolean + * @see self::write() + * @param string $expect + * @param int $mode + * @return bool * @access public */ - function read($expect, $mode = NET_SSH1_READ_SIMPLE) + function read($expect, $mode = self::READ__SIMPLE) { - if (!($this->bitmap & NET_SSH1_MASK_LOGIN)) { + if (!($this->bitmap & self::MASK_LOGIN)) { user_error('Operation disallowed prior to login()'); return false; } - if (!($this->bitmap & NET_SSH1_MASK_SHELL) && !$this->_initShell()) { + if (!($this->bitmap & self::MASK_SHELL) && !$this->_initShell()) { user_error('Unable to initiate an interactive shell session'); return false; } $match = $expect; while (true) { - if ($mode == NET_SSH1_READ_REGEX) { + if ($mode == self::READ__REGEX) { preg_match($expect, $this->interactiveBuffer, $matches); $match = isset($matches[0]) ? $matches[0] : ''; } @@ -964,26 +931,26 @@ class Net_SSH1 if ($response === true) { return $this->_string_shift($this->interactiveBuffer, strlen($this->interactiveBuffer)); } - $this->interactiveBuffer.= substr($response[NET_SSH1_RESPONSE_DATA], 4); + $this->interactiveBuffer.= substr($response[self::RESPONSE_DATA], 4); } } /** * Inputs a command into an interactive shell. * - * @see Net_SSH1::interactiveRead() - * @param String $cmd - * @return Boolean + * @see self::interactiveRead() + * @param string $cmd + * @return bool * @access public */ function interactiveWrite($cmd) { - if (!($this->bitmap & NET_SSH1_MASK_LOGIN)) { + if (!($this->bitmap & self::MASK_LOGIN)) { user_error('Operation disallowed prior to login()'); return false; } - if (!($this->bitmap & NET_SSH1_MASK_SHELL) && !$this->_initShell()) { + if (!($this->bitmap & self::MASK_SHELL) && !$this->_initShell()) { user_error('Unable to initiate an interactive shell session'); return false; } @@ -1007,18 +974,18 @@ class Net_SSH1 * does not support ANSI escape sequences in Win32 Console applications", so if you're a Windows user, * there's not going to be much recourse. * - * @see Net_SSH1::interactiveRead() - * @return String + * @see self::interactiveRead() + * @return string * @access public */ function interactiveRead() { - if (!($this->bitmap & NET_SSH1_MASK_LOGIN)) { + if (!($this->bitmap & self::MASK_LOGIN)) { user_error('Operation disallowed prior to login()'); return false; } - if (!($this->bitmap & NET_SSH1_MASK_SHELL) && !$this->_initShell()) { + if (!($this->bitmap & self::MASK_SHELL) && !$this->_initShell()) { user_error('Unable to initiate an interactive shell session'); return false; } @@ -1027,7 +994,7 @@ class Net_SSH1 $write = $except = null; if (stream_select($read, $write, $except, 0)) { $response = $this->_get_binary_packet(); - return substr($response[NET_SSH1_RESPONSE_DATA], 4); + return substr($response[self::RESPONSE_DATA], 4); } else { return ''; } @@ -1059,7 +1026,7 @@ class Net_SSH1 /** * Disconnect * - * @param String $msg + * @param string $msg * @access private */ function _disconnect($msg = 'Client Quit') @@ -1070,9 +1037,9 @@ class Net_SSH1 /* $response = $this->_get_binary_packet(); if ($response === true) { - $response = array(NET_SSH1_RESPONSE_TYPE => -1); + $response = array(self::RESPONSE_TYPE => -1); } - switch ($response[NET_SSH1_RESPONSE_TYPE]) { + switch ($response[self::RESPONSE_TYPE]) { case NET_SSH1_SMSG_EXITSTATUS: $data = pack('C', NET_SSH1_CMSG_EXIT_CONFIRMATION); break; @@ -1096,8 +1063,8 @@ class Net_SSH1 * Also, this function could be improved upon by adding detection for the following exploit: * http://www.securiteam.com/securitynews/5LP042K3FY.html * - * @see Net_SSH1::_send_binary_packet() - * @return Array + * @see self::_send_binary_packet() + * @return array * @access private */ function _get_binary_packet() @@ -1162,8 +1129,8 @@ class Net_SSH1 } return array( - NET_SSH1_RESPONSE_TYPE => $type, - NET_SSH1_RESPONSE_DATA => $data + self::RESPONSE_TYPE => $type, + self::RESPONSE_DATA => $data ); } @@ -1172,9 +1139,9 @@ class Net_SSH1 * * Returns true on success, false on failure. * - * @see Net_SSH1::_get_binary_packet() - * @param String $data - * @return Boolean + * @see self::_get_binary_packet() + * @param string $data + * @return bool * @access private */ function _send_binary_packet($data) @@ -1186,7 +1153,7 @@ class Net_SSH1 $length = strlen($data) + 4; - $padding = crypt_random_string(8 - ($length & 7)); + $padding = Random::string(8 - ($length & 7)); $orig = $data; $data = $padding . $data; @@ -1219,10 +1186,10 @@ class Net_SSH1 * we've reimplemented it. A more detailed discussion of the differences can be found after * $crc_lookup_table's initialization. * - * @see Net_SSH1::_get_binary_packet() - * @see Net_SSH1::_send_binary_packet() - * @param String $data - * @return Integer + * @see self::_get_binary_packet() + * @see self::_send_binary_packet() + * @param string $data + * @return int * @access private */ function _crc($data) @@ -1299,7 +1266,7 @@ class Net_SSH1 $crc = 0x00000000; $length = strlen($data); - for ($i=0;$i<$length;$i++) { + for ($i=0; $i<$length; $i++) { // We AND $crc >> 8 with 0x00FFFFFF because we want the eight newly added bits to all // be zero. PHP, unfortunately, doesn't always do this. 0x80000000 >> 8, as an example, // yields 0xFF800000 - not 0x00800000. The following link elaborates: @@ -1317,9 +1284,9 @@ class Net_SSH1 * * Inspired by array_shift * - * @param String $string - * @param optional Integer $index - * @return String + * @param string $string + * @param int $index + * @return string * @access private */ function _string_shift(&$string, $index = 1) @@ -1336,22 +1303,18 @@ class Net_SSH1 * should be a number with the property that gcd($e, ($p - 1) * ($q - 1)) == 1. Could just make anything that * calls this call modexp, instead, but I think this makes things clearer, maybe... * - * @see Net_SSH1::Net_SSH1() - * @param Math_BigInteger $m - * @param Array $key - * @return Math_BigInteger + * @see self::__construct() + * @param BigInteger $m + * @param array $key + * @return BigInteger * @access private */ function _rsa_crypt($m, $key) { /* - if (!class_exists('Crypt_RSA')) { - include_once 'Crypt/RSA.php'; - } - - $rsa = new Crypt_RSA(); - $rsa->loadKey($key, CRYPT_RSA_PUBLIC_FORMAT_RAW); - $rsa->setEncryptionMode(CRYPT_RSA_ENCRYPTION_PKCS1); + $rsa = new RSA(); + $rsa->loadKey($key, RSA::PUBLIC_FORMAT_RAW); + $rsa->setEncryptionMode(RSA::ENCRYPTION_PKCS1); return $rsa->encrypt($m); */ @@ -1372,13 +1335,13 @@ class Net_SSH1 $length = strlen($modulus) - strlen($m) - 3; $random = ''; while (strlen($random) != $length) { - $block = crypt_random_string($length - strlen($random)); + $block = Random::string($length - strlen($random)); $block = str_replace("\x00", '', $block); $random.= $block; } $temp = chr(0) . chr(2) . $random . chr(0) . $m; - $m = new Math_BigInteger($temp, 256); + $m = new BigInteger($temp, 256); $m = $m->modPow($key[0], $key[1]); return $m->toBytes(); @@ -1391,14 +1354,14 @@ class Net_SSH1 * named constants from it, using the value as the name of the constant and the index as the value of the constant. * If any of the constants that would be defined already exists, none of the constants will be defined. * - * @param Array $array + * @param array $array * @access private */ function _define_array() { $args = func_get_args(); foreach ($args as $arg) { - foreach ($arg as $key=>$value) { + foreach ($arg as $key => $value) { if (!defined($value)) { define($value, $key); } else { @@ -1411,10 +1374,10 @@ class Net_SSH1 /** * Returns a log of the packets that have been sent and received. * - * Returns a string if NET_SSH1_LOGGING == NET_SSH1_LOG_COMPLEX, an array if NET_SSH1_LOGGING == NET_SSH1_LOG_SIMPLE and false if !defined('NET_SSH1_LOGGING') + * Returns a string if NET_SSH1_LOGGING == self::LOG_COMPLEX, an array if NET_SSH1_LOGGING == self::LOG_SIMPLE and false if !defined('NET_SSH1_LOGGING') * * @access public - * @return String or Array + * @return array|false|string */ function getLog() { @@ -1423,10 +1386,10 @@ class Net_SSH1 } switch (NET_SSH1_LOGGING) { - case NET_SSH1_LOG_SIMPLE: + case self::LOG_SIMPLE: return $this->message_number_log; break; - case NET_SSH1_LOG_COMPLEX: + case self::LOG_COMPLEX: return $this->_format_log($this->message_log, $this->protocol_flags_log); break; default: @@ -1437,10 +1400,10 @@ class Net_SSH1 /** * Formats a log for printing * - * @param Array $message_log - * @param Array $message_number_log + * @param array $message_log + * @param array $message_number_log * @access private - * @return String + * @return string */ function _format_log($message_log, $message_number_log) { @@ -1473,9 +1436,9 @@ class Net_SSH1 * * For use with preg_replace_callback() * - * @param Array $matches + * @param array $matches * @access private - * @return String + * @return string */ function _format_log_helper($matches) { @@ -1488,8 +1451,8 @@ class Net_SSH1 * Returns, by default, the base-10 representation. If $raw_output is set to true, returns, instead, * the raw bytes. This behavior is similar to PHP's md5() function. * - * @param optional Boolean $raw_output - * @return String + * @param bool $raw_output + * @return string * @access public */ function getServerKeyPublicExponent($raw_output = false) @@ -1503,8 +1466,8 @@ class Net_SSH1 * Returns, by default, the base-10 representation. If $raw_output is set to true, returns, instead, * the raw bytes. This behavior is similar to PHP's md5() function. * - * @param optional Boolean $raw_output - * @return String + * @param bool $raw_output + * @return string * @access public */ function getServerKeyPublicModulus($raw_output = false) @@ -1518,8 +1481,8 @@ class Net_SSH1 * Returns, by default, the base-10 representation. If $raw_output is set to true, returns, instead, * the raw bytes. This behavior is similar to PHP's md5() function. * - * @param optional Boolean $raw_output - * @return String + * @param bool $raw_output + * @return string * @access public */ function getHostKeyPublicExponent($raw_output = false) @@ -1533,8 +1496,8 @@ class Net_SSH1 * Returns, by default, the base-10 representation. If $raw_output is set to true, returns, instead, * the raw bytes. This behavior is similar to PHP's md5() function. * - * @param optional Boolean $raw_output - * @return String + * @param bool $raw_output + * @return string * @access public */ function getHostKeyPublicModulus($raw_output = false) @@ -1547,10 +1510,10 @@ class Net_SSH1 * * Just because a cipher is supported by an SSH1 server doesn't mean it's supported by this library. If $raw_output * is set to true, returns, instead, an array of constants. ie. instead of array('Triple-DES in CBC mode'), you'll - * get array(NET_SSH1_CIPHER_3DES). + * get array(self::CIPHER_3DES). * - * @param optional Boolean $raw_output - * @return Array + * @param bool $raw_output + * @return array * @access public */ function getSupportedCiphers($raw_output = false) @@ -1563,10 +1526,10 @@ class Net_SSH1 * * Just because a cipher is supported by an SSH1 server doesn't mean it's supported by this library. If $raw_output * is set to true, returns, instead, an array of constants. ie. instead of array('password authentication'), you'll - * get array(NET_SSH1_AUTH_PASSWORD). + * get array(self::AUTH_PASSWORD). * - * @param optional Boolean $raw_output - * @return Array + * @param bool $raw_output + * @return array * @access public */ function getSupportedAuthentications($raw_output = false) @@ -1577,7 +1540,7 @@ class Net_SSH1 /** * Return the server identification. * - * @return String + * @return string * @access public */ function getServerIdentification() @@ -1590,23 +1553,23 @@ class Net_SSH1 * * Makes sure that only the last 1MB worth of packets will be logged * - * @param String $data + * @param string $data * @access private */ function _append_log($protocol_flags, $message) { switch (NET_SSH1_LOGGING) { // useful for benchmarks - case NET_SSH1_LOG_SIMPLE: + case self::LOG_SIMPLE: $this->protocol_flags_log[] = $protocol_flags; break; // the most useful log for SSH1 - case NET_SSH1_LOG_COMPLEX: + case self::LOG_COMPLEX: $this->protocol_flags_log[] = $protocol_flags; $this->_string_shift($message); $this->log_size+= strlen($message); $this->message_log[] = $message; - while ($this->log_size > NET_SSH1_LOG_MAX_SIZE) { + while ($this->log_size > self::LOG_MAX_SIZE) { $this->log_size-= strlen(array_shift($this->message_log)); array_shift($this->protocol_flags_log); } @@ -1614,19 +1577,19 @@ class Net_SSH1 // dump the output out realtime; packets may be interspersed with non packets, // passwords won't be filtered out and select other packets may not be correctly // identified - case NET_SSH1_LOG_REALTIME: + case self::LOG_REALTIME: echo "\r\n" . $this->_format_log(array($message), array($protocol_flags)) . "\r\n\r\n"; @flush(); @ob_flush(); break; - // basically the same thing as NET_SSH1_LOG_REALTIME with the caveat that NET_SSH1_LOG_REALTIME_FILE - // needs to be defined and that the resultant log file will be capped out at NET_SSH1_LOG_MAX_SIZE. + // basically the same thing as self::LOG_REALTIME with the caveat that self::LOG_REALTIME_FILE + // needs to be defined and that the resultant log file will be capped out at self::LOG_MAX_SIZE. // the earliest part of the log file is denoted by the first <<< START >>> and is not going to necessarily // at the beginning of the file - case NET_SSH1_LOG_REALTIME_FILE: + case self::LOG_REALTIME_FILE: if (!isset($this->realtime_log_file)) { // PHP doesn't seem to like using constants in fopen() - $filename = NET_SSH1_LOG_REALTIME_FILE; + $filename = self::LOG_REALTIME_FILE; $fp = fopen($filename, 'w'); $this->realtime_log_file = $fp; } @@ -1640,7 +1603,7 @@ class Net_SSH1 fseek($this->realtime_log_file, ftell($this->realtime_log_file) - strlen($temp)); } $this->realtime_log_size+= strlen($entry); - if ($this->realtime_log_size > NET_SSH1_LOG_MAX_SIZE) { + if ($this->realtime_log_size > self::LOG_MAX_SIZE) { fseek($this->realtime_log_file, 0); $this->realtime_log_size = strlen($entry); $this->realtime_log_wrap = true; diff --git a/securemail/vendor/phpseclib/phpseclib/phpseclib/Net/SSH2.php b/securemail/vendor/phpseclib/phpseclib/phpseclib/Net/SSH2.php index d6134562..11580755 100644 --- a/securemail/vendor/phpseclib/phpseclib/phpseclib/Net/SSH2.php +++ b/securemail/vendor/phpseclib/phpseclib/phpseclib/Net/SSH2.php @@ -3,14 +3,14 @@ /** * Pure-PHP implementation of SSHv2. * - * PHP versions 4 and 5 + * PHP version 5 * * Here are some examples of how to use this library: * * login('username', 'password')) { * exit('Login Failed'); * } @@ -22,14 +22,13 @@ * * * setPassword('whatever'); * $key->loadKey(file_get_contents('privatekey')); * - * $ssh = new Net_SSH2('www.domain.tld'); + * $ssh = new \phpseclib\Net\SSH2('www.domain.tld'); * if (!$ssh->login('username', $key)) { * exit('Login Failed'); * } @@ -40,120 +39,117 @@ * ?> * * - * LICENSE: Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in - * all copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN - * THE SOFTWARE. - * * @category Net - * @package Net_SSH2 + * @package SSH2 * @author Jim Wigginton * @copyright 2007 Jim Wigginton * @license http://www.opensource.org/licenses/mit-license.html MIT License * @link http://phpseclib.sourceforge.net */ -/**#@+ - * Execution Bitmap Masks - * - * @see Net_SSH2::bitmap - * @access private - */ -define('NET_SSH2_MASK_CONSTRUCTOR', 0x00000001); -define('NET_SSH2_MASK_CONNECTED', 0x00000002); -define('NET_SSH2_MASK_LOGIN_REQ', 0x00000004); -define('NET_SSH2_MASK_LOGIN', 0x00000008); -define('NET_SSH2_MASK_SHELL', 0x00000010); -define('NET_SSH2_MASK_WINDOW_ADJUST', 0x00000020); -/**#@-*/ +namespace phpseclib\Net; -/**#@+ - * Channel constants - * - * RFC4254 refers not to client and server channels but rather to sender and recipient channels. we don't refer - * to them in that way because RFC4254 toggles the meaning. the client sends a SSH_MSG_CHANNEL_OPEN message with - * a sender channel and the server sends a SSH_MSG_CHANNEL_OPEN_CONFIRMATION in response, with a sender and a - * recepient channel. at first glance, you might conclude that SSH_MSG_CHANNEL_OPEN_CONFIRMATION's sender channel - * would be the same thing as SSH_MSG_CHANNEL_OPEN's sender channel, but it's not, per this snipet: - * The 'recipient channel' is the channel number given in the original - * open request, and 'sender channel' is the channel number allocated by - * the other side. - * - * @see Net_SSH2::_send_channel_packet() - * @see Net_SSH2::_get_channel_packet() - * @access private - */ -define('NET_SSH2_CHANNEL_EXEC', 0); // PuTTy uses 0x100 -define('NET_SSH2_CHANNEL_SHELL', 1); -define('NET_SSH2_CHANNEL_SUBSYSTEM', 2); -/**#@-*/ - -/**#@+ - * @access public - * @see Net_SSH2::getLog() - */ -/** - * Returns the message numbers - */ -define('NET_SSH2_LOG_SIMPLE', 1); -/** - * Returns the message content - */ -define('NET_SSH2_LOG_COMPLEX', 2); -/** - * Outputs the content real-time - */ -define('NET_SSH2_LOG_REALTIME', 3); -/** - * Dumps the content real-time to a file - */ -define('NET_SSH2_LOG_REALTIME_FILE', 4); -/**#@-*/ - -/**#@+ - * @access public - * @see Net_SSH2::read() - */ -/** - * Returns when a string matching $expect exactly is found - */ -define('NET_SSH2_READ_SIMPLE', 1); -/** - * Returns when a string matching the regular expression $expect is found - */ -define('NET_SSH2_READ_REGEX', 2); -/** - * Make sure that the log never gets larger than this - */ -define('NET_SSH2_LOG_MAX_SIZE', 1024 * 1024); -/**#@-*/ +use phpseclib\Crypt\Base; +use phpseclib\Crypt\Blowfish; +use phpseclib\Crypt\Hash; +use phpseclib\Crypt\Random; +use phpseclib\Crypt\RC4; +use phpseclib\Crypt\Rijndael; +use phpseclib\Crypt\RSA; +use phpseclib\Crypt\TripleDES; +use phpseclib\Crypt\Twofish; +use phpseclib\Math\BigInteger; // Used to do Diffie-Hellman key exchange and DSA/RSA signature verification. +use phpseclib\System\SSH\Agent; /** * Pure-PHP implementation of SSHv2. * - * @package Net_SSH2 + * @package SSH2 * @author Jim Wigginton * @access public */ -class Net_SSH2 +class SSH2 { + /**#@+ + * Execution Bitmap Masks + * + * @see \phpseclib\Net\SSH2::bitmap + * @access private + */ + const MASK_CONSTRUCTOR = 0x00000001; + const MASK_CONNECTED = 0x00000002; + const MASK_LOGIN_REQ = 0x00000004; + const MASK_LOGIN = 0x00000008; + const MASK_SHELL = 0x00000010; + const MASK_WINDOW_ADJUST = 0x00000020; + /**#@-*/ + + /**#@+ + * Channel constants + * + * RFC4254 refers not to client and server channels but rather to sender and recipient channels. we don't refer + * to them in that way because RFC4254 toggles the meaning. the client sends a SSH_MSG_CHANNEL_OPEN message with + * a sender channel and the server sends a SSH_MSG_CHANNEL_OPEN_CONFIRMATION in response, with a sender and a + * recepient channel. at first glance, you might conclude that SSH_MSG_CHANNEL_OPEN_CONFIRMATION's sender channel + * would be the same thing as SSH_MSG_CHANNEL_OPEN's sender channel, but it's not, per this snipet: + * The 'recipient channel' is the channel number given in the original + * open request, and 'sender channel' is the channel number allocated by + * the other side. + * + * @see \phpseclib\Net\SSH2::_send_channel_packet() + * @see \phpseclib\Net\SSH2::_get_channel_packet() + * @access private + */ + const CHANNEL_EXEC = 0; // PuTTy uses 0x100 + const CHANNEL_SHELL = 1; + const CHANNEL_SUBSYSTEM = 2; + const CHANNEL_AGENT_FORWARD = 3; + /**#@-*/ + + /**#@+ + * @access public + * @see \phpseclib\Net\SSH2::getLog() + */ + /** + * Returns the message numbers + */ + const LOG_SIMPLE = 1; + /** + * Returns the message content + */ + const LOG_COMPLEX = 2; + /** + * Outputs the content real-time + */ + const LOG_REALTIME = 3; + /** + * Dumps the content real-time to a file + */ + const LOG_REALTIME_FILE = 4; + /**#@-*/ + + /**#@+ + * @access public + * @see \phpseclib\Net\SSH2::read() + */ + /** + * Returns when a string matching $expect exactly is found + */ + const READ_SIMPLE = 1; + /** + * Returns when a string matching the regular expression $expect is found + */ + const READ_REGEX = 2; + /** + * Make sure that the log never gets larger than this + */ + const LOG_MAX_SIZE = 1048576; // 1024 * 1024 + /**#@-*/ + /** * The SSH identifier * - * @var String + * @var string * @access private */ var $identifier; @@ -161,7 +157,7 @@ class Net_SSH2 /** * The Socket Object * - * @var Object + * @var object * @access private */ var $fsock; @@ -172,7 +168,7 @@ class Net_SSH2 * The bits that are set represent functions that have been called already. This is used to determine * if a requisite function has been successfully executed. If not, an error should be thrown. * - * @var Integer + * @var int * @access private */ var $bitmap = 0; @@ -180,9 +176,9 @@ class Net_SSH2 /** * Error information * - * @see Net_SSH2::getErrors() - * @see Net_SSH2::getLastError() - * @var String + * @see self::getErrors() + * @see self::getLastError() + * @var string * @access private */ var $errors = array(); @@ -190,8 +186,8 @@ class Net_SSH2 /** * Server Identifier * - * @see Net_SSH2::getServerIdentification() - * @var mixed false or Array + * @see self::getServerIdentification() + * @var array|false * @access private */ var $server_identifier = false; @@ -199,17 +195,44 @@ class Net_SSH2 /** * Key Exchange Algorithms * - * @see Net_SSH2::getKexAlgorithims() - * @var mixed false or Array + * @see self::getKexAlgorithims() + * @var array|false * @access private */ var $kex_algorithms = false; + /** + * Minimum Diffie-Hellman Group Bit Size in RFC 4419 Key Exchange Methods + * + * @see self::_key_exchange() + * @var int + * @access private + */ + var $kex_dh_group_size_min = 1536; + + /** + * Preferred Diffie-Hellman Group Bit Size in RFC 4419 Key Exchange Methods + * + * @see self::_key_exchange() + * @var int + * @access private + */ + var $kex_dh_group_size_preferred = 2048; + + /** + * Maximum Diffie-Hellman Group Bit Size in RFC 4419 Key Exchange Methods + * + * @see self::_key_exchange() + * @var int + * @access private + */ + var $kex_dh_group_size_max = 4096; + /** * Server Host Key Algorithms * - * @see Net_SSH2::getServerHostKeyAlgorithms() - * @var mixed false or Array + * @see self::getServerHostKeyAlgorithms() + * @var array|false * @access private */ var $server_host_key_algorithms = false; @@ -217,8 +240,8 @@ class Net_SSH2 /** * Encryption Algorithms: Client to Server * - * @see Net_SSH2::getEncryptionAlgorithmsClient2Server() - * @var mixed false or Array + * @see self::getEncryptionAlgorithmsClient2Server() + * @var array|false * @access private */ var $encryption_algorithms_client_to_server = false; @@ -226,8 +249,8 @@ class Net_SSH2 /** * Encryption Algorithms: Server to Client * - * @see Net_SSH2::getEncryptionAlgorithmsServer2Client() - * @var mixed false or Array + * @see self::getEncryptionAlgorithmsServer2Client() + * @var array|false * @access private */ var $encryption_algorithms_server_to_client = false; @@ -235,8 +258,8 @@ class Net_SSH2 /** * MAC Algorithms: Client to Server * - * @see Net_SSH2::getMACAlgorithmsClient2Server() - * @var mixed false or Array + * @see self::getMACAlgorithmsClient2Server() + * @var array|false * @access private */ var $mac_algorithms_client_to_server = false; @@ -244,8 +267,8 @@ class Net_SSH2 /** * MAC Algorithms: Server to Client * - * @see Net_SSH2::getMACAlgorithmsServer2Client() - * @var mixed false or Array + * @see self::getMACAlgorithmsServer2Client() + * @var array|false * @access private */ var $mac_algorithms_server_to_client = false; @@ -253,8 +276,8 @@ class Net_SSH2 /** * Compression Algorithms: Client to Server * - * @see Net_SSH2::getCompressionAlgorithmsClient2Server() - * @var mixed false or Array + * @see self::getCompressionAlgorithmsClient2Server() + * @var array|false * @access private */ var $compression_algorithms_client_to_server = false; @@ -262,8 +285,8 @@ class Net_SSH2 /** * Compression Algorithms: Server to Client * - * @see Net_SSH2::getCompressionAlgorithmsServer2Client() - * @var mixed false or Array + * @see self::getCompressionAlgorithmsServer2Client() + * @var array|false * @access private */ var $compression_algorithms_server_to_client = false; @@ -271,8 +294,8 @@ class Net_SSH2 /** * Languages: Server to Client * - * @see Net_SSH2::getLanguagesServer2Client() - * @var mixed false or Array + * @see self::getLanguagesServer2Client() + * @var array|false * @access private */ var $languages_server_to_client = false; @@ -280,8 +303,8 @@ class Net_SSH2 /** * Languages: Client to Server * - * @see Net_SSH2::getLanguagesClient2Server() - * @var mixed false or Array + * @see self::getLanguagesClient2Server() + * @var array|false * @access private */ var $languages_client_to_server = false; @@ -296,9 +319,9 @@ class Net_SSH2 * * -- http://tools.ietf.org/html/rfc4253#section-6 * - * @see Net_SSH2::Net_SSH2() - * @see Net_SSH2::_send_binary_packet() - * @var Integer + * @see self::__construct() + * @see self::_send_binary_packet() + * @var int * @access private */ var $encrypt_block_size = 8; @@ -306,9 +329,9 @@ class Net_SSH2 /** * Block Size for Client to Server Encryption * - * @see Net_SSH2::Net_SSH2() - * @see Net_SSH2::_get_binary_packet() - * @var Integer + * @see self::__construct() + * @see self::_get_binary_packet() + * @var int * @access private */ var $decrypt_block_size = 8; @@ -316,8 +339,8 @@ class Net_SSH2 /** * Server to Client Encryption Object * - * @see Net_SSH2::_get_binary_packet() - * @var Object + * @see self::_get_binary_packet() + * @var object * @access private */ var $decrypt = false; @@ -325,8 +348,8 @@ class Net_SSH2 /** * Client to Server Encryption Object * - * @see Net_SSH2::_send_binary_packet() - * @var Object + * @see self::_send_binary_packet() + * @var object * @access private */ var $encrypt = false; @@ -334,8 +357,8 @@ class Net_SSH2 /** * Client to Server HMAC Object * - * @see Net_SSH2::_send_binary_packet() - * @var Object + * @see self::_send_binary_packet() + * @var object * @access private */ var $hmac_create = false; @@ -343,8 +366,8 @@ class Net_SSH2 /** * Server to Client HMAC Object * - * @see Net_SSH2::_get_binary_packet() - * @var Object + * @see self::_get_binary_packet() + * @var object * @access private */ var $hmac_check = false; @@ -356,8 +379,8 @@ class Net_SSH2 * For the client to server side, the HMAC object will make the HMAC as long as it needs to be. All we need to do is * append it. * - * @see Net_SSH2::_get_binary_packet() - * @var Integer + * @see self::_get_binary_packet() + * @var int * @access private */ var $hmac_size = false; @@ -365,14 +388,14 @@ class Net_SSH2 /** * Server Public Host Key * - * @see Net_SSH2::getServerPublicHostKey() - * @var String + * @see self::getServerPublicHostKey() + * @var string * @access private */ var $server_public_host_key; /** - * Session identifer + * Session identifier * * "The exchange hash H from the first key exchange is additionally * used as the session identifier, which is a unique identifier for @@ -380,8 +403,8 @@ class Net_SSH2 * * -- http://tools.ietf.org/html/rfc4253#section-7.2 * - * @see Net_SSH2::_key_exchange() - * @var String + * @see self::_key_exchange() + * @var string * @access private */ var $session_id = false; @@ -391,8 +414,8 @@ class Net_SSH2 * * The current exchange hash * - * @see Net_SSH2::_key_exchange() - * @var String + * @see self::_key_exchange() + * @var string * @access private */ var $exchange_hash = false; @@ -400,8 +423,8 @@ class Net_SSH2 /** * Message Numbers * - * @see Net_SSH2::Net_SSH2() - * @var Array + * @see self::__construct() + * @var array * @access private */ var $message_numbers = array(); @@ -409,8 +432,8 @@ class Net_SSH2 /** * Disconnection Message 'reason codes' defined in RFC4253 * - * @see Net_SSH2::Net_SSH2() - * @var Array + * @see self::__construct() + * @var array * @access private */ var $disconnect_reasons = array(); @@ -418,8 +441,8 @@ class Net_SSH2 /** * SSH_MSG_CHANNEL_OPEN_FAILURE 'reason codes', defined in RFC4254 * - * @see Net_SSH2::Net_SSH2() - * @var Array + * @see self::__construct() + * @var array * @access private */ var $channel_open_failure_reasons = array(); @@ -428,8 +451,8 @@ class Net_SSH2 * Terminal Modes * * @link http://tools.ietf.org/html/rfc4254#section-8 - * @see Net_SSH2::Net_SSH2() - * @var Array + * @see self::__construct() + * @var array * @access private */ var $terminal_modes = array(); @@ -438,8 +461,8 @@ class Net_SSH2 * SSH_MSG_CHANNEL_EXTENDED_DATA's data_type_codes * * @link http://tools.ietf.org/html/rfc4254#section-5.2 - * @see Net_SSH2::Net_SSH2() - * @var Array + * @see self::__construct() + * @var array * @access private */ var $channel_extended_data_type_codes = array(); @@ -449,8 +472,8 @@ class Net_SSH2 * * See 'Section 6.4. Data Integrity' of rfc4253 for more info. * - * @see Net_SSH2::_send_binary_packet() - * @var Integer + * @see self::_send_binary_packet() + * @var int * @access private */ var $send_seq_no = 0; @@ -460,8 +483,8 @@ class Net_SSH2 * * See 'Section 6.4. Data Integrity' of rfc4253 for more info. * - * @see Net_SSH2::_get_binary_packet() - * @var Integer + * @see self::_get_binary_packet() + * @var int * @access private */ var $get_seq_no = 0; @@ -471,9 +494,9 @@ class Net_SSH2 * * Maps client channels to server channels * - * @see Net_SSH2::_get_channel_packet() - * @see Net_SSH2::exec() - * @var Array + * @see self::_get_channel_packet() + * @see self::exec() + * @var array * @access private */ var $server_channels = array(); @@ -484,9 +507,9 @@ class Net_SSH2 * If a client requests a packet from one channel but receives two packets from another those packets should * be placed in a buffer * - * @see Net_SSH2::_get_channel_packet() - * @see Net_SSH2::exec() - * @var Array + * @see self::_get_channel_packet() + * @see self::exec() + * @var array * @access private */ var $channel_buffers = array(); @@ -496,8 +519,8 @@ class Net_SSH2 * * Contains the type of the last sent message * - * @see Net_SSH2::_get_channel_packet() - * @var Array + * @see self::_get_channel_packet() + * @var array * @access private */ var $channel_status = array(); @@ -507,8 +530,8 @@ class Net_SSH2 * * Maximum packet size indexed by channel * - * @see Net_SSH2::_send_channel_packet() - * @var Array + * @see self::_send_channel_packet() + * @var array * @access private */ var $packet_size_client_to_server = array(); @@ -516,8 +539,8 @@ class Net_SSH2 /** * Message Number Log * - * @see Net_SSH2::getLog() - * @var Array + * @see self::getLog() + * @var array * @access private */ var $message_number_log = array(); @@ -525,8 +548,8 @@ class Net_SSH2 /** * Message Log * - * @see Net_SSH2::getLog() - * @var Array + * @see self::getLog() + * @var array * @access private */ var $message_log = array(); @@ -536,9 +559,9 @@ class Net_SSH2 * * Bytes the other party can send before it must wait for the window to be adjusted (0x7FFFFFFF = 2GB) * - * @var Integer - * @see Net_SSH2::_send_channel_packet() - * @see Net_SSH2::exec() + * @var int + * @see self::_send_channel_packet() + * @see self::exec() * @access private */ var $window_size = 0x7FFFFFFF; @@ -548,8 +571,8 @@ class Net_SSH2 * * Window size indexed by channel * - * @see Net_SSH2::_send_channel_packet() - * @var Array + * @see self::_send_channel_packet() + * @var array * @access private */ var $window_size_server_to_client = array(); @@ -559,8 +582,8 @@ class Net_SSH2 * * Window size indexed by channel * - * @see Net_SSH2::_get_channel_packet() - * @var Array + * @see self::_get_channel_packet() + * @var array * @access private */ var $window_size_client_to_server = array(); @@ -570,8 +593,8 @@ class Net_SSH2 * * Verified against $this->session_id * - * @see Net_SSH2::getServerPublicHostKey() - * @var String + * @see self::getServerPublicHostKey() + * @var string * @access private */ var $signature = ''; @@ -581,8 +604,8 @@ class Net_SSH2 * * ssh-rsa or ssh-dss. * - * @see Net_SSH2::getServerPublicHostKey() - * @var String + * @see self::getServerPublicHostKey() + * @var string * @access private */ var $signature_format = ''; @@ -590,8 +613,8 @@ class Net_SSH2 /** * Interactive Buffer * - * @see Net_SSH2::read() - * @var Array + * @see self::read() + * @var array * @access private */ var $interactiveBuffer = ''; @@ -599,11 +622,11 @@ class Net_SSH2 /** * Current log size * - * Should never exceed NET_SSH2_LOG_MAX_SIZE + * Should never exceed self::LOG_MAX_SIZE * - * @see Net_SSH2::_send_binary_packet() - * @see Net_SSH2::_get_binary_packet() - * @var Integer + * @see self::_send_binary_packet() + * @see self::_get_binary_packet() + * @var int * @access private */ var $log_size; @@ -611,7 +634,7 @@ class Net_SSH2 /** * Timeout * - * @see Net_SSH2::setTimeout() + * @see self::setTimeout() * @access private */ var $timeout; @@ -619,7 +642,7 @@ class Net_SSH2 /** * Current Timeout * - * @see Net_SSH2::_get_channel_packet() + * @see self::_get_channel_packet() * @access private */ var $curTimeout; @@ -627,8 +650,8 @@ class Net_SSH2 /** * Real-time log file pointer * - * @see Net_SSH2::_append_log() - * @var Resource + * @see self::_append_log() + * @var resource * @access private */ var $realtime_log_file; @@ -636,8 +659,8 @@ class Net_SSH2 /** * Real-time log file size * - * @see Net_SSH2::_append_log() - * @var Integer + * @see self::_append_log() + * @var int * @access private */ var $realtime_log_size; @@ -645,8 +668,8 @@ class Net_SSH2 /** * Has the signature been validated? * - * @see Net_SSH2::getServerPublicHostKey() - * @var Boolean + * @see self::getServerPublicHostKey() + * @var bool * @access private */ var $signature_validated = false; @@ -654,7 +677,7 @@ class Net_SSH2 /** * Real-time log file wrap boolean * - * @see Net_SSH2::_append_log() + * @see self::_append_log() * @access private */ var $realtime_log_wrap; @@ -662,7 +685,7 @@ class Net_SSH2 /** * Flag to suppress stderr from output * - * @see Net_SSH2::enableQuietMode() + * @see self::enableQuietMode() * @access private */ var $quiet_mode = false; @@ -670,7 +693,7 @@ class Net_SSH2 /** * Time of first network activity * - * @var Integer + * @var int * @access private */ var $last_packet; @@ -678,7 +701,7 @@ class Net_SSH2 /** * Exit status returned from ssh if any * - * @var Integer + * @var int * @access private */ var $exit_status; @@ -686,8 +709,8 @@ class Net_SSH2 /** * Flag to request a PTY when using exec() * - * @var Boolean - * @see Net_SSH2::enablePTY() + * @var bool + * @see self::enablePTY() * @access private */ var $request_pty = false; @@ -695,7 +718,7 @@ class Net_SSH2 /** * Flag set while exec() is running when using enablePTY() * - * @var Boolean + * @var bool * @access private */ var $in_request_pty_exec = false; @@ -703,7 +726,7 @@ class Net_SSH2 /** * Flag set after startSubsystem() is called * - * @var Boolean + * @var bool * @access private */ var $in_subsystem; @@ -711,7 +734,7 @@ class Net_SSH2 /** * Contents of stdError * - * @var String + * @var string * @access private */ var $stdErrorLog; @@ -719,8 +742,8 @@ class Net_SSH2 /** * The Last Interactive Response * - * @see Net_SSH2::_keyboard_interactive_process() - * @var String + * @see self::_keyboard_interactive_process() + * @var string * @access private */ var $last_interactive_response = ''; @@ -728,8 +751,8 @@ class Net_SSH2 /** * Keyboard Interactive Request / Responses * - * @see Net_SSH2::_keyboard_interactive_process() - * @var Array + * @see self::_keyboard_interactive_process() + * @var array * @access private */ var $keyboard_requests_responses = array(); @@ -740,9 +763,9 @@ class Net_SSH2 * Quoting from the RFC, "in some jurisdictions, sending a warning message before * authentication may be relevant for getting legal protection." * - * @see Net_SSH2::_filter() - * @see Net_SSH2::getBannerMessage() - * @var String + * @see self::_filter() + * @see self::getBannerMessage() + * @var string * @access private */ var $banner_message = ''; @@ -750,8 +773,8 @@ class Net_SSH2 /** * Did read() timeout or return normally? * - * @see Net_SSH2::isTimeout() - * @var Boolean + * @see self::isTimeout() + * @var bool * @access private */ var $is_timeout = false; @@ -759,8 +782,8 @@ class Net_SSH2 /** * Log Boundary * - * @see Net_SSH2::_format_log() - * @var String + * @see self::_format_log() + * @var string * @access private */ var $log_boundary = ':'; @@ -768,8 +791,8 @@ class Net_SSH2 /** * Log Long Width * - * @see Net_SSH2::_format_log() - * @var Integer + * @see self::_format_log() + * @var int * @access private */ var $log_long_width = 65; @@ -777,8 +800,8 @@ class Net_SSH2 /** * Log Short Width * - * @see Net_SSH2::_format_log() - * @var Integer + * @see self::_format_log() + * @var int * @access private */ var $log_short_width = 16; @@ -786,9 +809,9 @@ class Net_SSH2 /** * Hostname * - * @see Net_SSH2::Net_SSH2() - * @see Net_SSH2::_connect() - * @var String + * @see self::__construct() + * @see self::_connect() + * @var string * @access private */ var $host; @@ -796,35 +819,20 @@ class Net_SSH2 /** * Port Number * - * @see Net_SSH2::Net_SSH2() - * @see Net_SSH2::_connect() - * @var Integer + * @see self::__construct() + * @see self::_connect() + * @var int * @access private */ var $port; - /** - * Timeout for initial connection - * - * Set by the constructor call. Calling setTimeout() is optional. If it's not called functions like - * exec() won't timeout unless some PHP setting forces it too. The timeout specified in the constructor, - * however, is non-optional. There will be a timeout, whether or not you set it. If you don't it'll be - * 10 seconds. It is used by fsockopen() and the initial stream_select in that function. - * - * @see Net_SSH2::Net_SSH2() - * @see Net_SSH2::_connect() - * @var Integer - * @access private - */ - var $connectionTimeout; - /** * Number of columns for terminal window size * - * @see Net_SSH2::getWindowColumns() - * @see Net_SSH2::setWindowColumns() - * @see Net_SSH2::setWindowSize() - * @var Integer + * @see self::getWindowColumns() + * @see self::setWindowColumns() + * @see self::setWindowSize() + * @var int * @access private */ var $windowColumns = 80; @@ -832,40 +840,46 @@ class Net_SSH2 /** * Number of columns for terminal window size * - * @see Net_SSH2::getWindowRows() - * @see Net_SSH2::setWindowRows() - * @see Net_SSH2::setWindowSize() - * @var Integer + * @see self::getWindowRows() + * @see self::setWindowRows() + * @see self::setWindowSize() + * @var int * @access private */ var $windowRows = 24; + /** + * Crypto Engine + * + * @see self::setCryptoEngine() + * @see self::_key_exchange() + * @var int + * @access private + */ + var $crypto_engine = false; + + /** + * A System_SSH_Agent for use in the SSH2 Agent Forwarding scenario + * + * @var System_SSH_Agent + * @access private + */ + var $agent; + /** * Default Constructor. * - * @param String $host - * @param optional Integer $port - * @param optional Integer $timeout - * @see Net_SSH2::login() - * @return Net_SSH2 + * $host can either be a string, representing the host, or a stream resource. + * + * @param mixed $host + * @param int $port + * @param int $timeout + * @see self::login() + * @return \phpseclib\Net\SSH2 * @access public */ - function Net_SSH2($host, $port = 22, $timeout = 10) + function __construct($host, $port = 22, $timeout = 10) { - // Include Math_BigInteger - // Used to do Diffie-Hellman key exchange and DSA/RSA signature verification. - if (!class_exists('Math_BigInteger')) { - include_once 'Math/BigInteger.php'; - } - - if (!function_exists('crypt_random_string')) { - include_once 'Crypt/Random.php'; - } - - if (!class_exists('Crypt_Hash')) { - include_once 'Crypt/Hash.php'; - } - $this->message_numbers = array( 1 => 'NET_SSH2_MSG_DISCONNECT', 2 => 'NET_SSH2_MSG_IGNORE', @@ -933,59 +947,78 @@ class Net_SSH2 array(60 => 'NET_SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ'), array(60 => 'NET_SSH2_MSG_USERAUTH_PK_OK'), array(60 => 'NET_SSH2_MSG_USERAUTH_INFO_REQUEST', - 61 => 'NET_SSH2_MSG_USERAUTH_INFO_RESPONSE') + 61 => 'NET_SSH2_MSG_USERAUTH_INFO_RESPONSE'), + // RFC 4419 - diffie-hellman-group-exchange-sha{1,256} + array(30 => 'NET_SSH2_MSG_KEXDH_GEX_REQUEST_OLD', + 31 => 'NET_SSH2_MSG_KEXDH_GEX_GROUP', + 32 => 'NET_SSH2_MSG_KEXDH_GEX_INIT', + 33 => 'NET_SSH2_MSG_KEXDH_GEX_REPLY', + 34 => 'NET_SSH2_MSG_KEXDH_GEX_REQUEST'), + // RFC 5656 - Elliptic Curves (for curve25519-sha256@libssh.org) + array(30 => 'NET_SSH2_MSG_KEX_ECDH_INIT', + 31 => 'NET_SSH2_MSG_KEX_ECDH_REPLY') ); - $this->host = $host; - $this->port = $port; - $this->connectionTimeout = $timeout; + if (is_resource($host)) { + $this->fsock = $host; + return; + } + + if (is_string($host)) { + $this->host = $host; + $this->port = $port; + $this->timeout = $timeout; + } + } + + /** + * Set Crypto Engine Mode + * + * Possible $engine values: + * CRYPT_MODE_INTERNAL, CRYPT_MODE_MCRYPT + * + * @param int $engine + * @access private + */ + function setCryptoEngine($engine) + { + $this->crypto_engine = $engine; } /** * Connect to an SSHv2 server * - * @return Boolean + * @return bool * @access private */ function _connect() { - if ($this->bitmap & NET_SSH2_MASK_CONSTRUCTOR) { + if ($this->bitmap & self::MASK_CONSTRUCTOR) { return false; } - $this->bitmap |= NET_SSH2_MASK_CONSTRUCTOR; + $this->bitmap |= self::MASK_CONSTRUCTOR; - $timeout = $this->connectionTimeout; - $host = $this->host . ':' . $this->port; + $this->curTimeout = $this->timeout; - $this->last_packet = strtok(microtime(), ' ') + strtok(''); // == microtime(true) in PHP5 + $this->last_packet = microtime(true); - $start = strtok(microtime(), ' ') + strtok(''); // http://php.net/microtime#61838 - $this->fsock = @fsockopen($this->host, $this->port, $errno, $errstr, $timeout); - if (!$this->fsock) { - user_error(rtrim("Cannot connect to $host. Error $errno. $errstr")); - return false; - } - $elapsed = strtok(microtime(), ' ') + strtok('') - $start; + if (!is_resource($this->fsock)) { + $start = microtime(true); + $this->fsock = @fsockopen($this->host, $this->port, $errno, $errstr, $this->curTimeout); + if (!$this->fsock) { + $host = $this->host . ':' . $this->port; + user_error(rtrim("Cannot connect to $host. Error $errno. $errstr")); + return false; + } + $elapsed = microtime(true) - $start; - $timeout-= $elapsed; + $this->curTimeout-= $elapsed; - if ($timeout <= 0) { - user_error("Cannot connect to $host. Timeout error"); - return false; - } - - $read = array($this->fsock); - $write = $except = null; - - $sec = floor($timeout); - $usec = 1000000 * ($timeout - $sec); - - // on windows this returns a "Warning: Invalid CRT parameters detected" error - // the !count() is done as a workaround for - if (!@stream_select($read, $write, $except, $sec, $usec) && !count($read)) { - user_error("Cannot connect to $host. Banner timeout"); - return false; + if ($this->curTimeout <= 0) { + $this->is_timeout = true; + return false; + } } /* According to the SSH2 specs, @@ -995,14 +1028,51 @@ class Net_SSH2 Feed. Such lines MUST NOT begin with "SSH-", and SHOULD be encoded in ISO-10646 UTF-8 [RFC3629] (language is not specified). Clients MUST be able to process such lines." */ - $temp = ''; - $extra = ''; - while (!feof($this->fsock) && !preg_match('#^SSH-(\d\.\d+)#', $temp, $matches)) { - if (substr($temp, -2) == "\r\n") { - $extra.= $temp; - $temp = ''; + $data = ''; + while (!feof($this->fsock) && !preg_match('#(.*)^(SSH-(\d\.\d+).*)#ms', $data, $matches)) { + $line = ''; + while (true) { + if ($this->curTimeout) { + if ($this->curTimeout < 0) { + $this->is_timeout = true; + return false; + } + $read = array($this->fsock); + $write = $except = null; + $start = microtime(true); + $sec = floor($this->curTimeout); + $usec = 1000000 * ($this->curTimeout - $sec); + // on windows this returns a "Warning: Invalid CRT parameters detected" error + // the !count() is done as a workaround for + if (!@stream_select($read, $write, $except, $sec, $usec) && !count($read)) { + $this->is_timeout = true; + return false; + } + $elapsed = microtime(true) - $start; + $this->curTimeout-= $elapsed; + } + + $temp = stream_get_line($this->fsock, 255, "\n"); + if (strlen($temp) == 255) { + continue; + } + + $line.= "$temp\n"; + + // quoting RFC4253, "Implementers who wish to maintain + // compatibility with older, undocumented versions of this protocol may + // want to process the identification string without expecting the + // presence of the carriage return character for reasons described in + // Section 5 of this document." + + //if (substr($line, -2) == "\r\n") { + // break; + //} + + break; } - $temp.= fgets($this->fsock, 255); + + $data.= $line; } if (feof($this->fsock)) { @@ -1010,20 +1080,22 @@ class Net_SSH2 return false; } + $extra = $matches[1]; + $this->identifier = $this->_generate_identifier(); if (defined('NET_SSH2_LOGGING')) { - $this->_append_log('<-', $extra . $temp); + $this->_append_log('<-', $matches[0]); $this->_append_log('->', $this->identifier . "\r\n"); } $this->server_identifier = trim($temp, "\r\n"); if (strlen($extra)) { - $this->errors[] = utf8_decode($extra); + $this->errors[] = utf8_decode($data); } - if ($matches[1] != '1.99' && $matches[1] != '2.0') { - user_error("Cannot connect to SSH $matches[1] servers"); + if ($matches[3] != '1.99' && $matches[3] != '2.0') { + user_error("Cannot connect to SSH $matches[3] servers"); return false; } @@ -1044,7 +1116,7 @@ class Net_SSH2 return false; } - $this->bitmap|= NET_SSH2_MASK_CONNECTED; + $this->bitmap|= self::MASK_CONNECTED; return true; } @@ -1055,14 +1127,20 @@ class Net_SSH2 * You should overwrite this method in your own class if you want to use another identifier * * @access protected - * @return String + * @return string */ function _generate_identifier() { - $identifier = 'SSH-2.0-phpseclib_0.3'; + $identifier = 'SSH-2.0-phpseclib_2.0'; $ext = array(); - if (extension_loaded('mcrypt')) { + if (extension_loaded('libsodium')) { + $ext[] = 'libsodium'; + } + + if (extension_loaded('openssl')) { + $ext[] = 'openssl'; + } elseif (extension_loaded('mcrypt')) { $ext[] = 'mcrypt'; } @@ -1082,92 +1160,113 @@ class Net_SSH2 /** * Key Exchange * - * @param String $kexinit_payload_server + * @param string $kexinit_payload_server * @access private */ function _key_exchange($kexinit_payload_server) { - static $kex_algorithms = array( - 'diffie-hellman-group1-sha1', // REQUIRED - 'diffie-hellman-group14-sha1' // REQUIRED - ); + $kex_algorithms = array( + // Elliptic Curve Diffie-Hellman Key Agreement (ECDH) using + // Curve25519. See doc/curve25519-sha256@libssh.org.txt in the + // libssh repository for more information. + 'curve25519-sha256@libssh.org', - static $server_host_key_algorithms = array( + // Diffie-Hellman Key Agreement (DH) using integer modulo prime + // groups. + 'diffie-hellman-group1-sha1', // REQUIRED + 'diffie-hellman-group14-sha1', // REQUIRED + 'diffie-hellman-group-exchange-sha1', // RFC 4419 + 'diffie-hellman-group-exchange-sha256', // RFC 4419 + ); + if (!function_exists('\\Sodium\\library_version_major')) { + $kex_algorithms = array_diff( + $kex_algorithms, + array('curve25519-sha256@libssh.org') + ); + } + + $server_host_key_algorithms = array( 'ssh-rsa', // RECOMMENDED sign Raw RSA Key 'ssh-dss' // REQUIRED sign Raw DSS Key ); - static $encryption_algorithms = false; - if ($encryption_algorithms === false) { - $encryption_algorithms = array( - // from : - 'arcfour256', - 'arcfour128', + $encryption_algorithms = array( + // from : + 'arcfour256', + 'arcfour128', - //'arcfour', // OPTIONAL the ARCFOUR stream cipher with a 128-bit key + //'arcfour', // OPTIONAL the ARCFOUR stream cipher with a 128-bit key - // CTR modes from : - 'aes128-ctr', // RECOMMENDED AES (Rijndael) in SDCTR mode, with 128-bit key - 'aes192-ctr', // RECOMMENDED AES with 192-bit key - 'aes256-ctr', // RECOMMENDED AES with 256-bit key + // CTR modes from : + 'aes128-ctr', // RECOMMENDED AES (Rijndael) in SDCTR mode, with 128-bit key + 'aes192-ctr', // RECOMMENDED AES with 192-bit key + 'aes256-ctr', // RECOMMENDED AES with 256-bit key - 'twofish128-ctr', // OPTIONAL Twofish in SDCTR mode, with 128-bit key - 'twofish192-ctr', // OPTIONAL Twofish with 192-bit key - 'twofish256-ctr', // OPTIONAL Twofish with 256-bit key + 'twofish128-ctr', // OPTIONAL Twofish in SDCTR mode, with 128-bit key + 'twofish192-ctr', // OPTIONAL Twofish with 192-bit key + 'twofish256-ctr', // OPTIONAL Twofish with 256-bit key - 'aes128-cbc', // RECOMMENDED AES with a 128-bit key - 'aes192-cbc', // OPTIONAL AES with a 192-bit key - 'aes256-cbc', // OPTIONAL AES in CBC mode, with a 256-bit key + 'aes128-cbc', // RECOMMENDED AES with a 128-bit key + 'aes192-cbc', // OPTIONAL AES with a 192-bit key + 'aes256-cbc', // OPTIONAL AES in CBC mode, with a 256-bit key - 'twofish128-cbc', // OPTIONAL Twofish with a 128-bit key - 'twofish192-cbc', // OPTIONAL Twofish with a 192-bit key - 'twofish256-cbc', - 'twofish-cbc', // OPTIONAL alias for "twofish256-cbc" - // (this is being retained for historical reasons) + 'twofish128-cbc', // OPTIONAL Twofish with a 128-bit key + 'twofish192-cbc', // OPTIONAL Twofish with a 192-bit key + 'twofish256-cbc', + 'twofish-cbc', // OPTIONAL alias for "twofish256-cbc" + // (this is being retained for historical reasons) - 'blowfish-ctr', // OPTIONAL Blowfish in SDCTR mode + 'blowfish-ctr', // OPTIONAL Blowfish in SDCTR mode - 'blowfish-cbc', // OPTIONAL Blowfish in CBC mode + 'blowfish-cbc', // OPTIONAL Blowfish in CBC mode - '3des-ctr', // RECOMMENDED Three-key 3DES in SDCTR mode + '3des-ctr', // RECOMMENDED Three-key 3DES in SDCTR mode - '3des-cbc', // REQUIRED three-key 3DES in CBC mode - //'none' // OPTIONAL no encryption; NOT RECOMMENDED + '3des-cbc', // REQUIRED three-key 3DES in CBC mode + //'none' // OPTIONAL no encryption; NOT RECOMMENDED + ); + + if (extension_loaded('openssl') && !extension_loaded('mcrypt')) { + // OpenSSL does not support arcfour256 in any capacity and arcfour128 / arcfour support is limited to + // instances that do not use continuous buffers + $encryption_algorithms = array_diff( + $encryption_algorithms, + array('arcfour256', 'arcfour128', 'arcfour') ); - - if (phpseclib_resolve_include_path('Crypt/RC4.php') === false) { - $encryption_algorithms = array_diff( - $encryption_algorithms, - array('arcfour256', 'arcfour128', 'arcfour') - ); - } - if (phpseclib_resolve_include_path('Crypt/Rijndael.php') === false) { - $encryption_algorithms = array_diff( - $encryption_algorithms, - array('aes128-ctr', 'aes192-ctr', 'aes256-ctr', 'aes128-cbc', 'aes192-cbc', 'aes256-cbc') - ); - } - if (phpseclib_resolve_include_path('Crypt/Twofish.php') === false) { - $encryption_algorithms = array_diff( - $encryption_algorithms, - array('twofish128-ctr', 'twofish192-ctr', 'twofish256-ctr', 'twofish128-cbc', 'twofish192-cbc', 'twofish256-cbc', 'twofish-cbc') - ); - } - if (phpseclib_resolve_include_path('Crypt/Blowfish.php') === false) { - $encryption_algorithms = array_diff( - $encryption_algorithms, - array('blowfish-ctr', 'blowfish-cbc') - ); - } - if (phpseclib_resolve_include_path('Crypt/TripleDES.php') === false) { - $encryption_algorithms = array_diff( - $encryption_algorithms, - array('3des-ctr', '3des-cbc') - ); - } - $encryption_algorithms = array_values($encryption_algorithms); } + if (class_exists('\phpseclib\Crypt\RC4') === false) { + $encryption_algorithms = array_diff( + $encryption_algorithms, + array('arcfour256', 'arcfour128', 'arcfour') + ); + } + if (class_exists('\phpseclib\Crypt\Rijndael') === false) { + $encryption_algorithms = array_diff( + $encryption_algorithms, + array('aes128-ctr', 'aes192-ctr', 'aes256-ctr', 'aes128-cbc', 'aes192-cbc', 'aes256-cbc') + ); + } + if (class_exists('\phpseclib\Crypt\Twofish') === false) { + $encryption_algorithms = array_diff( + $encryption_algorithms, + array('twofish128-ctr', 'twofish192-ctr', 'twofish256-ctr', 'twofish128-cbc', 'twofish192-cbc', 'twofish256-cbc', 'twofish-cbc') + ); + } + if (class_exists('\phpseclib\Crypt\Blowfish') === false) { + $encryption_algorithms = array_diff( + $encryption_algorithms, + array('blowfish-ctr', 'blowfish-cbc') + ); + } + if (class_exists('\phpseclib\Crypt\TripleDES') === false) { + $encryption_algorithms = array_diff( + $encryption_algorithms, + array('3des-ctr', '3des-cbc') + ); + } + $encryption_algorithms = array_values($encryption_algorithms); + $mac_algorithms = array( // from : 'hmac-sha2-256',// RECOMMENDED HMAC-SHA256 (digest length = key length = 32) @@ -1179,7 +1278,7 @@ class Net_SSH2 //'none' // OPTIONAL no MAC; NOT RECOMMENDED ); - static $compression_algorithms = array( + $compression_algorithms = array( 'none' // REQUIRED no compression //'zlib' // OPTIONAL ZLIB (LZ77) compression ); @@ -1193,19 +1292,13 @@ class Net_SSH2 )); } - static $str_kex_algorithms, $str_server_host_key_algorithms, - $encryption_algorithms_server_to_client, $mac_algorithms_server_to_client, $compression_algorithms_server_to_client, - $encryption_algorithms_client_to_server, $mac_algorithms_client_to_server, $compression_algorithms_client_to_server; + $str_kex_algorithms = implode(',', $kex_algorithms); + $str_server_host_key_algorithms = implode(',', $server_host_key_algorithms); + $encryption_algorithms_server_to_client = $encryption_algorithms_client_to_server = implode(',', $encryption_algorithms); + $mac_algorithms_server_to_client = $mac_algorithms_client_to_server = implode(',', $mac_algorithms); + $compression_algorithms_server_to_client = $compression_algorithms_client_to_server = implode(',', $compression_algorithms); - if (empty($str_kex_algorithms)) { - $str_kex_algorithms = implode(',', $kex_algorithms); - $str_server_host_key_algorithms = implode(',', $server_host_key_algorithms); - $encryption_algorithms_server_to_client = $encryption_algorithms_client_to_server = implode(',', $encryption_algorithms); - $mac_algorithms_server_to_client = $mac_algorithms_client_to_server = implode(',', $mac_algorithms); - $compression_algorithms_server_to_client = $compression_algorithms_client_to_server = implode(',', $compression_algorithms); - } - - $client_cookie = crypt_random_string(16); + $client_cookie = Random::string(16); $response = $kexinit_payload_server; $this->_string_shift($response, 1); // skip past the message number (it should be SSH_MSG_KEXINIT) @@ -1245,14 +1338,32 @@ class Net_SSH2 $first_kex_packet_follows = $first_kex_packet_follows != 0; // the sending of SSH2_MSG_KEXINIT could go in one of two places. this is the second place. - $kexinit_payload_client = pack('Ca*Na*Na*Na*Na*Na*Na*Na*Na*Na*Na*CN', - NET_SSH2_MSG_KEXINIT, $client_cookie, strlen($str_kex_algorithms), $str_kex_algorithms, - strlen($str_server_host_key_algorithms), $str_server_host_key_algorithms, strlen($encryption_algorithms_client_to_server), - $encryption_algorithms_client_to_server, strlen($encryption_algorithms_server_to_client), $encryption_algorithms_server_to_client, - strlen($mac_algorithms_client_to_server), $mac_algorithms_client_to_server, strlen($mac_algorithms_server_to_client), - $mac_algorithms_server_to_client, strlen($compression_algorithms_client_to_server), $compression_algorithms_client_to_server, - strlen($compression_algorithms_server_to_client), $compression_algorithms_server_to_client, 0, '', 0, '', - 0, 0 + $kexinit_payload_client = pack( + 'Ca*Na*Na*Na*Na*Na*Na*Na*Na*Na*Na*CN', + NET_SSH2_MSG_KEXINIT, + $client_cookie, + strlen($str_kex_algorithms), + $str_kex_algorithms, + strlen($str_server_host_key_algorithms), + $str_server_host_key_algorithms, + strlen($encryption_algorithms_client_to_server), + $encryption_algorithms_client_to_server, + strlen($encryption_algorithms_server_to_client), + $encryption_algorithms_server_to_client, + strlen($mac_algorithms_client_to_server), + $mac_algorithms_client_to_server, + strlen($mac_algorithms_server_to_client), + $mac_algorithms_server_to_client, + strlen($compression_algorithms_client_to_server), + $compression_algorithms_client_to_server, + strlen($compression_algorithms_server_to_client), + $compression_algorithms_server_to_client, + 0, + '', + 0, + '', + 0, + 0 ); if (!$this->_send_binary_packet($kexinit_payload_client)) { @@ -1261,151 +1372,141 @@ class Net_SSH2 // here ends the second place. // we need to decide upon the symmetric encryption algorithms before we do the diffie-hellman key exchange - for ($i = 0; $i < count($encryption_algorithms) && !in_array($encryption_algorithms[$i], $this->encryption_algorithms_server_to_client); $i++); - if ($i == count($encryption_algorithms)) { + // we don't initialize any crypto-objects, yet - we do that, later. for now, we need the lengths to make the + // diffie-hellman key exchange as fast as possible + $decrypt = $this->_array_intersect_first($encryption_algorithms, $this->encryption_algorithms_server_to_client); + $decryptKeyLength = $this->_encryption_algorithm_to_key_size($decrypt); + if ($decryptKeyLength === null) { user_error('No compatible server to client encryption algorithms found'); return $this->_disconnect(NET_SSH2_DISCONNECT_KEY_EXCHANGE_FAILED); } - // we don't initialize any crypto-objects, yet - we do that, later. for now, we need the lengths to make the - // diffie-hellman key exchange as fast as possible - $decrypt = $encryption_algorithms[$i]; - switch ($decrypt) { - case '3des-cbc': - case '3des-ctr': - $decryptKeyLength = 24; // eg. 192 / 8 - break; - case 'aes256-cbc': - case 'aes256-ctr': - case 'twofish-cbc': - case 'twofish256-cbc': - case 'twofish256-ctr': - $decryptKeyLength = 32; // eg. 256 / 8 - break; - case 'aes192-cbc': - case 'aes192-ctr': - case 'twofish192-cbc': - case 'twofish192-ctr': - $decryptKeyLength = 24; // eg. 192 / 8 - break; - case 'aes128-cbc': - case 'aes128-ctr': - case 'twofish128-cbc': - case 'twofish128-ctr': - case 'blowfish-cbc': - case 'blowfish-ctr': - $decryptKeyLength = 16; // eg. 128 / 8 - break; - case 'arcfour': - case 'arcfour128': - $decryptKeyLength = 16; // eg. 128 / 8 - break; - case 'arcfour256': - $decryptKeyLength = 32; // eg. 128 / 8 - break; - case 'none'; - $decryptKeyLength = 0; - } - - for ($i = 0; $i < count($encryption_algorithms) && !in_array($encryption_algorithms[$i], $this->encryption_algorithms_client_to_server); $i++); - if ($i == count($encryption_algorithms)) { + $encrypt = $this->_array_intersect_first($encryption_algorithms, $this->encryption_algorithms_client_to_server); + $encryptKeyLength = $this->_encryption_algorithm_to_key_size($encrypt); + if ($encryptKeyLength === null) { user_error('No compatible client to server encryption algorithms found'); return $this->_disconnect(NET_SSH2_DISCONNECT_KEY_EXCHANGE_FAILED); } - $encrypt = $encryption_algorithms[$i]; - switch ($encrypt) { - case '3des-cbc': - case '3des-ctr': - $encryptKeyLength = 24; - break; - case 'aes256-cbc': - case 'aes256-ctr': - case 'twofish-cbc': - case 'twofish256-cbc': - case 'twofish256-ctr': - $encryptKeyLength = 32; - break; - case 'aes192-cbc': - case 'aes192-ctr': - case 'twofish192-cbc': - case 'twofish192-ctr': - $encryptKeyLength = 24; - break; - case 'aes128-cbc': - case 'aes128-ctr': - case 'twofish128-cbc': - case 'twofish128-ctr': - case 'blowfish-cbc': - case 'blowfish-ctr': - $encryptKeyLength = 16; - break; - case 'arcfour': - case 'arcfour128': - $encryptKeyLength = 16; - break; - case 'arcfour256': - $encryptKeyLength = 32; - break; - case 'none'; - $encryptKeyLength = 0; - } - - $keyLength = $decryptKeyLength > $encryptKeyLength ? $decryptKeyLength : $encryptKeyLength; - // through diffie-hellman key exchange a symmetric key is obtained - for ($i = 0; $i < count($kex_algorithms) && !in_array($kex_algorithms[$i], $this->kex_algorithms); $i++); - if ($i == count($kex_algorithms)) { + $kex_algorithm = $this->_array_intersect_first($kex_algorithms, $this->kex_algorithms); + if ($kex_algorithm === false) { user_error('No compatible key exchange algorithms found'); return $this->_disconnect(NET_SSH2_DISCONNECT_KEY_EXCHANGE_FAILED); } - switch ($kex_algorithms[$i]) { - // see http://tools.ietf.org/html/rfc2409#section-6.2 and - // http://tools.ietf.org/html/rfc2412, appendex E - case 'diffie-hellman-group1-sha1': - $prime = 'FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74' . - '020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F1437' . - '4FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7ED' . - 'EE386BFB5A899FA5AE9F24117C4B1FE649286651ECE65381FFFFFFFFFFFFFFFF'; - break; - // see http://tools.ietf.org/html/rfc3526#section-3 - case 'diffie-hellman-group14-sha1': - $prime = 'FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74' . - '020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F1437' . - '4FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7ED' . - 'EE386BFB5A899FA5AE9F24117C4B1FE649286651ECE45B3DC2007CB8A163BF05' . - '98DA48361C55D39A69163FA8FD24CF5F83655D23DCA3AD961C62F356208552BB' . - '9ED529077096966D670C354E4ABC9804F1746C08CA18217C32905E462E36CE3B' . - 'E39E772C180E86039B2783A2EC07A28FB5C55DF06F4C52C9DE2BCBF695581718' . - '3995497CEA956AE515D2261898FA051015728E5A8AACAA68FFFFFFFFFFFFFFFF'; - break; + // Only relevant in diffie-hellman-group-exchange-sha{1,256}, otherwise empty. + $exchange_hash_rfc4419 = ''; + + if ($kex_algorithm === 'curve25519-sha256@libssh.org') { + $x = Random::string(32); + $eBytes = \Sodium\crypto_box_publickey_from_secretkey($x); + $clientKexInitMessage = NET_SSH2_MSG_KEX_ECDH_INIT; + $serverKexReplyMessage = NET_SSH2_MSG_KEX_ECDH_REPLY; + $kexHash = new Hash('sha256'); + } else { + if (strpos($kex_algorithm, 'diffie-hellman-group-exchange') === 0) { + $dh_group_sizes_packed = pack( + 'NNN', + $this->kex_dh_group_size_min, + $this->kex_dh_group_size_preferred, + $this->kex_dh_group_size_max + ); + $packet = pack( + 'Ca*', + NET_SSH2_MSG_KEXDH_GEX_REQUEST, + $dh_group_sizes_packed + ); + if (!$this->_send_binary_packet($packet)) { + return false; + } + + $response = $this->_get_binary_packet(); + if ($response === false) { + user_error('Connection closed by server'); + return false; + } + extract(unpack('Ctype', $this->_string_shift($response, 1))); + if ($type != NET_SSH2_MSG_KEXDH_GEX_GROUP) { + user_error('Expected SSH_MSG_KEX_DH_GEX_GROUP'); + return false; + } + + extract(unpack('NprimeLength', $this->_string_shift($response, 4))); + $primeBytes = $this->_string_shift($response, $primeLength); + $prime = new BigInteger($primeBytes, -256); + + extract(unpack('NgLength', $this->_string_shift($response, 4))); + $gBytes = $this->_string_shift($response, $gLength); + $g = new BigInteger($gBytes, -256); + + $exchange_hash_rfc4419 = pack( + 'a*Na*Na*', + $dh_group_sizes_packed, + $primeLength, + $primeBytes, + $gLength, + $gBytes + ); + + $clientKexInitMessage = NET_SSH2_MSG_KEXDH_GEX_INIT; + $serverKexReplyMessage = NET_SSH2_MSG_KEXDH_GEX_REPLY; + } else { + switch ($kex_algorithm) { + // see http://tools.ietf.org/html/rfc2409#section-6.2 and + // http://tools.ietf.org/html/rfc2412, appendex E + case 'diffie-hellman-group1-sha1': + $prime = 'FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74' . + '020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F1437' . + '4FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7ED' . + 'EE386BFB5A899FA5AE9F24117C4B1FE649286651ECE65381FFFFFFFFFFFFFFFF'; + break; + // see http://tools.ietf.org/html/rfc3526#section-3 + case 'diffie-hellman-group14-sha1': + $prime = 'FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74' . + '020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F1437' . + '4FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7ED' . + 'EE386BFB5A899FA5AE9F24117C4B1FE649286651ECE45B3DC2007CB8A163BF05' . + '98DA48361C55D39A69163FA8FD24CF5F83655D23DCA3AD961C62F356208552BB' . + '9ED529077096966D670C354E4ABC9804F1746C08CA18217C32905E462E36CE3B' . + 'E39E772C180E86039B2783A2EC07A28FB5C55DF06F4C52C9DE2BCBF695581718' . + '3995497CEA956AE515D2261898FA051015728E5A8AACAA68FFFFFFFFFFFFFFFF'; + break; + } + // For both diffie-hellman-group1-sha1 and diffie-hellman-group14-sha1 + // the generator field element is 2 (decimal) and the hash function is sha1. + $g = new BigInteger(2); + $prime = new BigInteger($prime, 16); + $clientKexInitMessage = NET_SSH2_MSG_KEXDH_INIT; + $serverKexReplyMessage = NET_SSH2_MSG_KEXDH_REPLY; + } + + switch ($kex_algorithm) { + case 'diffie-hellman-group-exchange-sha256': + $kexHash = new Hash('sha256'); + break; + default: + $kexHash = new Hash('sha1'); + } + + /* To increase the speed of the key exchange, both client and server may + reduce the size of their private exponents. It should be at least + twice as long as the key material that is generated from the shared + secret. For more details, see the paper by van Oorschot and Wiener + [VAN-OORSCHOT]. + + -- http://tools.ietf.org/html/rfc4419#section-6.2 */ + $one = new BigInteger(1); + $keyLength = min($kexHash->getLength(), max($encryptKeyLength, $decryptKeyLength)); + $max = $one->bitwise_leftShift(16 * $keyLength); // 2 * 8 * $keyLength + $max = $max->subtract($one); + + $x = $one->random($one, $max); + $e = $g->modPow($x, $prime); + + $eBytes = $e->toBytes(true); } - - // For both diffie-hellman-group1-sha1 and diffie-hellman-group14-sha1 - // the generator field element is 2 (decimal) and the hash function is sha1. - $g = new Math_BigInteger(2); - $prime = new Math_BigInteger($prime, 16); - $kexHash = new Crypt_Hash('sha1'); - //$q = $p->bitwise_rightShift(1); - - /* To increase the speed of the key exchange, both client and server may - reduce the size of their private exponents. It should be at least - twice as long as the key material that is generated from the shared - secret. For more details, see the paper by van Oorschot and Wiener - [VAN-OORSCHOT]. - - -- http://tools.ietf.org/html/rfc4419#section-6.2 */ - $one = new Math_BigInteger(1); - $keyLength = min($keyLength, $kexHash->getLength()); - $max = $one->bitwise_leftShift(16 * $keyLength); // 2 * 8 * $keyLength - $max = $max->subtract($one); - - $x = $one->random($one, $max); - $e = $g->modPow($x, $prime); - - $eBytes = $e->toBytes(true); - $data = pack('CNa*', NET_SSH2_MSG_KEXDH_INIT, strlen($eBytes), $eBytes); + $data = pack('CNa*', $clientKexInitMessage, strlen($eBytes), $eBytes); if (!$this->_send_binary_packet($data)) { user_error('Connection closed by server'); @@ -1419,7 +1520,7 @@ class Net_SSH2 } extract(unpack('Ctype', $this->_string_shift($response, 1))); - if ($type != NET_SSH2_MSG_KEXDH_REPLY) { + if ($type != $serverKexReplyMessage) { user_error('Expected SSH_MSG_KEXDH_REPLY'); return false; } @@ -1432,7 +1533,6 @@ class Net_SSH2 $temp = unpack('Nlength', $this->_string_shift($response, 4)); $fBytes = $this->_string_shift($response, $temp['length']); - $f = new Math_BigInteger($fBytes, -256); $temp = unpack('Nlength', $this->_string_shift($response, 4)); $this->signature = $this->_string_shift($response, $temp['length']); @@ -1440,14 +1540,38 @@ class Net_SSH2 $temp = unpack('Nlength', $this->_string_shift($this->signature, 4)); $this->signature_format = $this->_string_shift($this->signature, $temp['length']); - $key = $f->modPow($x, $prime); + if ($kex_algorithm === 'curve25519-sha256@libssh.org') { + if (strlen($fBytes) !== 32) { + user_error('Received curve25519 public key of invalid length.'); + return false; + } + $key = new BigInteger(\Sodium\crypto_scalarmult($x, $fBytes), 256); + \Sodium\memzero($x); + } else { + $f = new BigInteger($fBytes, -256); + $key = $f->modPow($x, $prime); + } $keyBytes = $key->toBytes(true); - $this->exchange_hash = pack('Na*Na*Na*Na*Na*Na*Na*Na*', - strlen($this->identifier), $this->identifier, strlen($this->server_identifier), $this->server_identifier, - strlen($kexinit_payload_client), $kexinit_payload_client, strlen($kexinit_payload_server), - $kexinit_payload_server, strlen($this->server_public_host_key), $this->server_public_host_key, strlen($eBytes), - $eBytes, strlen($fBytes), $fBytes, strlen($keyBytes), $keyBytes + $this->exchange_hash = pack( + 'Na*Na*Na*Na*Na*a*Na*Na*Na*', + strlen($this->identifier), + $this->identifier, + strlen($this->server_identifier), + $this->server_identifier, + strlen($kexinit_payload_client), + $kexinit_payload_client, + strlen($kexinit_payload_server), + $kexinit_payload_server, + strlen($this->server_public_host_key), + $this->server_public_host_key, + $exchange_hash_rfc4419, + strlen($eBytes), + $eBytes, + strlen($fBytes), + $fBytes, + strlen($keyBytes), + $keyBytes ); $this->exchange_hash = $kexHash->hash($this->exchange_hash); @@ -1456,18 +1580,19 @@ class Net_SSH2 $this->session_id = $this->exchange_hash; } - for ($i = 0; $i < count($server_host_key_algorithms) && !in_array($server_host_key_algorithms[$i], $this->server_host_key_algorithms); $i++); - if ($i == count($server_host_key_algorithms)) { + $server_host_key_algorithm = $this->_array_intersect_first($server_host_key_algorithms, $this->server_host_key_algorithms); + if ($server_host_key_algorithm === false) { user_error('No compatible server host key algorithms found'); return $this->_disconnect(NET_SSH2_DISCONNECT_KEY_EXCHANGE_FAILED); } - if ($public_key_format != $server_host_key_algorithms[$i] || $this->signature_format != $server_host_key_algorithms[$i]) { + if ($public_key_format != $server_host_key_algorithm || $this->signature_format != $server_host_key_algorithm) { user_error('Server Host Key Algorithm Mismatch'); return $this->_disconnect(NET_SSH2_DISCONNECT_KEY_EXCHANGE_FAILED); } - $packet = pack('C', + $packet = pack( + 'C', NET_SSH2_MSG_NEWKEYS ); @@ -1489,163 +1614,16 @@ class Net_SSH2 return false; } - switch ($encrypt) { - case '3des-cbc': - if (!class_exists('Crypt_TripleDES')) { - include_once 'Crypt/TripleDES.php'; - } - $this->encrypt = new Crypt_TripleDES(); - // $this->encrypt_block_size = 64 / 8 == the default - break; - case '3des-ctr': - if (!class_exists('Crypt_TripleDES')) { - include_once 'Crypt/TripleDES.php'; - } - $this->encrypt = new Crypt_TripleDES(CRYPT_DES_MODE_CTR); - // $this->encrypt_block_size = 64 / 8 == the default - break; - case 'aes256-cbc': - case 'aes192-cbc': - case 'aes128-cbc': - if (!class_exists('Crypt_Rijndael')) { - include_once 'Crypt/Rijndael.php'; - } - $this->encrypt = new Crypt_Rijndael(); - $this->encrypt_block_size = 16; // eg. 128 / 8 - break; - case 'aes256-ctr': - case 'aes192-ctr': - case 'aes128-ctr': - if (!class_exists('Crypt_Rijndael')) { - include_once 'Crypt/Rijndael.php'; - } - $this->encrypt = new Crypt_Rijndael(CRYPT_RIJNDAEL_MODE_CTR); - $this->encrypt_block_size = 16; // eg. 128 / 8 - break; - case 'blowfish-cbc': - if (!class_exists('Crypt_Blowfish')) { - include_once 'Crypt/Blowfish.php'; - } - $this->encrypt = new Crypt_Blowfish(); - $this->encrypt_block_size = 8; - break; - case 'blowfish-ctr': - if (!class_exists('Crypt_Blowfish')) { - include_once 'Crypt/Blowfish.php'; - } - $this->encrypt = new Crypt_Blowfish(CRYPT_BLOWFISH_MODE_CTR); - $this->encrypt_block_size = 8; - break; - case 'twofish128-cbc': - case 'twofish192-cbc': - case 'twofish256-cbc': - case 'twofish-cbc': - if (!class_exists('Crypt_Twofish')) { - include_once 'Crypt/Twofish.php'; - } - $this->encrypt = new Crypt_Twofish(); - $this->encrypt_block_size = 16; - break; - case 'twofish128-ctr': - case 'twofish192-ctr': - case 'twofish256-ctr': - if (!class_exists('Crypt_Twofish')) { - include_once 'Crypt/Twofish.php'; - } - $this->encrypt = new Crypt_Twofish(CRYPT_TWOFISH_MODE_CTR); - $this->encrypt_block_size = 16; - break; - case 'arcfour': - case 'arcfour128': - case 'arcfour256': - if (!class_exists('Crypt_RC4')) { - include_once 'Crypt/RC4.php'; - } - $this->encrypt = new Crypt_RC4(); - break; - case 'none'; - //$this->encrypt = new Crypt_Null(); - } - - switch ($decrypt) { - case '3des-cbc': - if (!class_exists('Crypt_TripleDES')) { - include_once 'Crypt/TripleDES.php'; - } - $this->decrypt = new Crypt_TripleDES(); - break; - case '3des-ctr': - if (!class_exists('Crypt_TripleDES')) { - include_once 'Crypt/TripleDES.php'; - } - $this->decrypt = new Crypt_TripleDES(CRYPT_DES_MODE_CTR); - break; - case 'aes256-cbc': - case 'aes192-cbc': - case 'aes128-cbc': - if (!class_exists('Crypt_Rijndael')) { - include_once 'Crypt/Rijndael.php'; - } - $this->decrypt = new Crypt_Rijndael(); - $this->decrypt_block_size = 16; - break; - case 'aes256-ctr': - case 'aes192-ctr': - case 'aes128-ctr': - if (!class_exists('Crypt_Rijndael')) { - include_once 'Crypt/Rijndael.php'; - } - $this->decrypt = new Crypt_Rijndael(CRYPT_RIJNDAEL_MODE_CTR); - $this->decrypt_block_size = 16; - break; - case 'blowfish-cbc': - if (!class_exists('Crypt_Blowfish')) { - include_once 'Crypt/Blowfish.php'; - } - $this->decrypt = new Crypt_Blowfish(); - $this->decrypt_block_size = 8; - break; - case 'blowfish-ctr': - if (!class_exists('Crypt_Blowfish')) { - include_once 'Crypt/Blowfish.php'; - } - $this->decrypt = new Crypt_Blowfish(CRYPT_BLOWFISH_MODE_CTR); - $this->decrypt_block_size = 8; - break; - case 'twofish128-cbc': - case 'twofish192-cbc': - case 'twofish256-cbc': - case 'twofish-cbc': - if (!class_exists('Crypt_Twofish')) { - include_once 'Crypt/Twofish.php'; - } - $this->decrypt = new Crypt_Twofish(); - $this->decrypt_block_size = 16; - break; - case 'twofish128-ctr': - case 'twofish192-ctr': - case 'twofish256-ctr': - if (!class_exists('Crypt_Twofish')) { - include_once 'Crypt/Twofish.php'; - } - $this->decrypt = new Crypt_Twofish(CRYPT_TWOFISH_MODE_CTR); - $this->decrypt_block_size = 16; - break; - case 'arcfour': - case 'arcfour128': - case 'arcfour256': - if (!class_exists('Crypt_RC4')) { - include_once 'Crypt/RC4.php'; - } - $this->decrypt = new Crypt_RC4(); - break; - case 'none'; - //$this->decrypt = new Crypt_Null(); - } - $keyBytes = pack('Na*', strlen($keyBytes), $keyBytes); + $this->encrypt = $this->_encryption_algorithm_to_crypt_instance($encrypt); if ($this->encrypt) { + if ($this->crypto_engine) { + $this->encrypt->setEngine($this->crypto_engine); + } + if ($this->encrypt->block_size) { + $this->encrypt_block_size = $this->encrypt->block_size; + } $this->encrypt->enableContinuousBuffer(); $this->encrypt->disablePadding(); @@ -1662,7 +1640,14 @@ class Net_SSH2 $this->encrypt->setKey(substr($key, 0, $encryptKeyLength)); } + $this->decrypt = $this->_encryption_algorithm_to_crypt_instance($decrypt); if ($this->decrypt) { + if ($this->crypto_engine) { + $this->decrypt->setEngine($this->crypto_engine); + } + if ($this->decrypt->block_size) { + $this->decrypt_block_size = $this->decrypt->block_size; + } $this->decrypt->enableContinuousBuffer(); $this->decrypt->disablePadding(); @@ -1693,66 +1678,66 @@ class Net_SSH2 $this->decrypt->decrypt(str_repeat("\0", 1536)); } - for ($i = 0; $i < count($mac_algorithms) && !in_array($mac_algorithms[$i], $this->mac_algorithms_client_to_server); $i++); - if ($i == count($mac_algorithms)) { + $mac_algorithm = $this->_array_intersect_first($mac_algorithms, $this->mac_algorithms_client_to_server); + if ($mac_algorithm === false) { user_error('No compatible client to server message authentication algorithms found'); return $this->_disconnect(NET_SSH2_DISCONNECT_KEY_EXCHANGE_FAILED); } - $createKeyLength = 0; // ie. $mac_algorithms[$i] == 'none' - switch ($mac_algorithms[$i]) { + $createKeyLength = 0; // ie. $mac_algorithm == 'none' + switch ($mac_algorithm) { case 'hmac-sha2-256': - $this->hmac_create = new Crypt_Hash('sha256'); + $this->hmac_create = new Hash('sha256'); $createKeyLength = 32; break; case 'hmac-sha1': - $this->hmac_create = new Crypt_Hash('sha1'); + $this->hmac_create = new Hash('sha1'); $createKeyLength = 20; break; case 'hmac-sha1-96': - $this->hmac_create = new Crypt_Hash('sha1-96'); + $this->hmac_create = new Hash('sha1-96'); $createKeyLength = 20; break; case 'hmac-md5': - $this->hmac_create = new Crypt_Hash('md5'); + $this->hmac_create = new Hash('md5'); $createKeyLength = 16; break; case 'hmac-md5-96': - $this->hmac_create = new Crypt_Hash('md5-96'); + $this->hmac_create = new Hash('md5-96'); $createKeyLength = 16; } - for ($i = 0; $i < count($mac_algorithms) && !in_array($mac_algorithms[$i], $this->mac_algorithms_server_to_client); $i++); - if ($i == count($mac_algorithms)) { + $mac_algorithm = $this->_array_intersect_first($mac_algorithms, $this->mac_algorithms_server_to_client); + if ($mac_algorithm === false) { user_error('No compatible server to client message authentication algorithms found'); return $this->_disconnect(NET_SSH2_DISCONNECT_KEY_EXCHANGE_FAILED); } $checkKeyLength = 0; $this->hmac_size = 0; - switch ($mac_algorithms[$i]) { + switch ($mac_algorithm) { case 'hmac-sha2-256': - $this->hmac_check = new Crypt_Hash('sha256'); + $this->hmac_check = new Hash('sha256'); $checkKeyLength = 32; $this->hmac_size = 32; break; case 'hmac-sha1': - $this->hmac_check = new Crypt_Hash('sha1'); + $this->hmac_check = new Hash('sha1'); $checkKeyLength = 20; $this->hmac_size = 20; break; case 'hmac-sha1-96': - $this->hmac_check = new Crypt_Hash('sha1-96'); + $this->hmac_check = new Hash('sha1-96'); $checkKeyLength = 20; $this->hmac_size = 12; break; case 'hmac-md5': - $this->hmac_check = new Crypt_Hash('md5'); + $this->hmac_check = new Hash('md5'); $checkKeyLength = 16; $this->hmac_size = 16; break; case 'hmac-md5-96': - $this->hmac_check = new Crypt_Hash('md5-96'); + $this->hmac_check = new Hash('md5-96'); $checkKeyLength = 16; $this->hmac_size = 12; } @@ -1769,33 +1754,116 @@ class Net_SSH2 } $this->hmac_check->setKey(substr($key, 0, $checkKeyLength)); - for ($i = 0; $i < count($compression_algorithms) && !in_array($compression_algorithms[$i], $this->compression_algorithms_server_to_client); $i++); - if ($i == count($compression_algorithms)) { + $compression_algorithm = $this->_array_intersect_first($compression_algorithms, $this->compression_algorithms_server_to_client); + if ($compression_algorithm === false) { user_error('No compatible server to client compression algorithms found'); return $this->_disconnect(NET_SSH2_DISCONNECT_KEY_EXCHANGE_FAILED); } - $this->decompress = $compression_algorithms[$i] == 'zlib'; + $this->decompress = $compression_algorithm == 'zlib'; - for ($i = 0; $i < count($compression_algorithms) && !in_array($compression_algorithms[$i], $this->compression_algorithms_client_to_server); $i++); - if ($i == count($compression_algorithms)) { + $compression_algorithm = $this->_array_intersect_first($compression_algorithms, $this->compression_algorithms_client_to_server); + if ($compression_algorithm === false) { user_error('No compatible client to server compression algorithms found'); return $this->_disconnect(NET_SSH2_DISCONNECT_KEY_EXCHANGE_FAILED); } - $this->compress = $compression_algorithms[$i] == 'zlib'; + $this->compress = $compression_algorithm == 'zlib'; return true; } + /** + * Maps an encryption algorithm name to the number of key bytes. + * + * @param string $algorithm Name of the encryption algorithm + * @return int|null Number of bytes as an integer or null for unknown + * @access private + */ + function _encryption_algorithm_to_key_size($algorithm) + { + switch ($algorithm) { + case 'none': + return 0; + case 'aes128-cbc': + case 'aes128-ctr': + case 'arcfour': + case 'arcfour128': + case 'blowfish-cbc': + case 'blowfish-ctr': + case 'twofish128-cbc': + case 'twofish128-ctr': + return 16; + case '3des-cbc': + case '3des-ctr': + case 'aes192-cbc': + case 'aes192-ctr': + case 'twofish192-cbc': + case 'twofish192-ctr': + return 24; + case 'aes256-cbc': + case 'aes256-ctr': + case 'arcfour256': + case 'twofish-cbc': + case 'twofish256-cbc': + case 'twofish256-ctr': + return 32; + } + return null; + } + + /** + * Maps an encryption algorithm name to an instance of a subclass of + * \phpseclib\Crypt\Base. + * + * @param string $algorithm Name of the encryption algorithm + * @return mixed Instance of \phpseclib\Crypt\Base or null for unknown + * @access private + */ + function _encryption_algorithm_to_crypt_instance($algorithm) + { + switch ($algorithm) { + case '3des-cbc': + return new TripleDES(); + case '3des-ctr': + return new TripleDES(Base::MODE_CTR); + case 'aes256-cbc': + case 'aes192-cbc': + case 'aes128-cbc': + return new Rijndael(); + case 'aes256-ctr': + case 'aes192-ctr': + case 'aes128-ctr': + return new Rijndael(Base::MODE_CTR); + case 'blowfish-cbc': + return new Blowfish(); + case 'blowfish-ctr': + return new Blowfish(Base::MODE_CTR); + case 'twofish128-cbc': + case 'twofish192-cbc': + case 'twofish256-cbc': + case 'twofish-cbc': + return new Twofish(); + case 'twofish128-ctr': + case 'twofish192-ctr': + case 'twofish256-ctr': + return new Twofish(Base::MODE_CTR); + case 'arcfour': + case 'arcfour128': + case 'arcfour256': + return new RC4(); + } + return null; + } + /** * Login * - * The $password parameter can be a plaintext password, a Crypt_RSA object or an array + * The $password parameter can be a plaintext password, a \phpseclib\Crypt\RSA object or an array * - * @param String $username - * @param Mixed $password - * @param Mixed $... - * @return Boolean - * @see _login + * @param string $username + * @param mixed $password + * @param mixed $... + * @return bool + * @see self::_login() * @access public */ function login($username) @@ -1807,16 +1875,16 @@ class Net_SSH2 /** * Login Helper * - * @param String $username - * @param Mixed $password - * @param Mixed $... - * @return Boolean - * @see _login_helper + * @param string $username + * @param mixed $password + * @param mixed $... + * @return bool + * @see self::_login_helper() * @access private */ function _login($username) { - if (!($this->bitmap & NET_SSH2_MASK_CONSTRUCTOR)) { + if (!($this->bitmap & self::MASK_CONSTRUCTOR)) { if (!$this->_connect()) { return false; } @@ -1838,22 +1906,25 @@ class Net_SSH2 /** * Login Helper * - * @param String $username - * @param optional String $password - * @return Boolean + * @param string $username + * @param string $password + * @return bool * @access private * @internal It might be worthwhile, at some point, to protect against {@link http://tools.ietf.org/html/rfc4251#section-9.3.9 traffic analysis} * by sending dummy SSH_MSG_IGNORE messages. */ function _login_helper($username, $password = null) { - if (!($this->bitmap & NET_SSH2_MASK_CONNECTED)) { + if (!($this->bitmap & self::MASK_CONNECTED)) { return false; } - if (!($this->bitmap & NET_SSH2_MASK_LOGIN_REQ)) { - $packet = pack('CNa*', - NET_SSH2_MSG_SERVICE_REQUEST, strlen('ssh-userauth'), 'ssh-userauth' + if (!($this->bitmap & self::MASK_LOGIN_REQ)) { + $packet = pack( + 'CNa*', + NET_SSH2_MSG_SERVICE_REQUEST, + strlen('ssh-userauth'), + 'ssh-userauth' ); if (!$this->_send_binary_packet($packet)) { @@ -1872,35 +1943,37 @@ class Net_SSH2 user_error('Expected SSH_MSG_SERVICE_ACCEPT'); return false; } - $this->bitmap |= NET_SSH2_MASK_LOGIN_REQ; + $this->bitmap |= self::MASK_LOGIN_REQ; } if (strlen($this->last_interactive_response)) { return !is_string($password) && !is_array($password) ? false : $this->_keyboard_interactive_process($password); } - // although PHP5's get_class() preserves the case, PHP4's does not - if (is_object($password)) { - switch (strtolower(get_class($password))) { - case 'crypt_rsa': - return $this->_privatekey_login($username, $password); - case 'system_ssh_agent': - return $this->_ssh_agent_login($username, $password); - } + if ($password instanceof RSA) { + return $this->_privatekey_login($username, $password); + } elseif ($password instanceof Agent) { + return $this->_ssh_agent_login($username, $password); } if (is_array($password)) { if ($this->_keyboard_interactive_login($username, $password)) { - $this->bitmap |= NET_SSH2_MASK_LOGIN; + $this->bitmap |= self::MASK_LOGIN; return true; } return false; } if (!isset($password)) { - $packet = pack('CNa*Na*Na*', - NET_SSH2_MSG_USERAUTH_REQUEST, strlen($username), $username, strlen('ssh-connection'), 'ssh-connection', - strlen('none'), 'none' + $packet = pack( + 'CNa*Na*Na*', + NET_SSH2_MSG_USERAUTH_REQUEST, + strlen($username), + $username, + strlen('ssh-connection'), + 'ssh-connection', + strlen('none'), + 'none' ); if (!$this->_send_binary_packet($packet)) { @@ -1917,7 +1990,7 @@ class Net_SSH2 switch ($type) { case NET_SSH2_MSG_USERAUTH_SUCCESS: - $this->bitmap |= NET_SSH2_MASK_LOGIN; + $this->bitmap |= self::MASK_LOGIN; return true; //case NET_SSH2_MSG_USERAUTH_FAILURE: default: @@ -1925,18 +1998,36 @@ class Net_SSH2 } } - $packet = pack('CNa*Na*Na*CNa*', - NET_SSH2_MSG_USERAUTH_REQUEST, strlen($username), $username, strlen('ssh-connection'), 'ssh-connection', - strlen('password'), 'password', 0, strlen($password), $password + $packet = pack( + 'CNa*Na*Na*CNa*', + NET_SSH2_MSG_USERAUTH_REQUEST, + strlen($username), + $username, + strlen('ssh-connection'), + 'ssh-connection', + strlen('password'), + 'password', + 0, + strlen($password), + $password ); // remove the username and password from the logged packet if (!defined('NET_SSH2_LOGGING')) { $logged = null; } else { - $logged = pack('CNa*Na*Na*CNa*', - NET_SSH2_MSG_USERAUTH_REQUEST, strlen('username'), 'username', strlen('ssh-connection'), 'ssh-connection', - strlen('password'), 'password', 0, strlen('password'), 'password' + $logged = pack( + 'CNa*Na*Na*CNa*', + NET_SSH2_MSG_USERAUTH_REQUEST, + strlen('username'), + 'username', + strlen('ssh-connection'), + 'ssh-connection', + strlen('password'), + 'password', + 0, + strlen('password'), + 'password' ); } @@ -1970,14 +2061,14 @@ class Net_SSH2 if (!$partial_success && in_array('keyboard-interactive', $auth_methods)) { if ($this->_keyboard_interactive_login($username, $password)) { - $this->bitmap |= NET_SSH2_MASK_LOGIN; + $this->bitmap |= self::MASK_LOGIN; return true; } return false; } return false; case NET_SSH2_MSG_USERAUTH_SUCCESS: - $this->bitmap |= NET_SSH2_MASK_LOGIN; + $this->bitmap |= self::MASK_LOGIN; return true; } @@ -1989,16 +2080,26 @@ class Net_SSH2 * * See {@link http://tools.ietf.org/html/rfc4256 RFC4256} for details. This is not a full-featured keyboard-interactive authenticator. * - * @param String $username - * @param String $password - * @return Boolean + * @param string $username + * @param string $password + * @return bool * @access private */ function _keyboard_interactive_login($username, $password) { - $packet = pack('CNa*Na*Na*Na*Na*', - NET_SSH2_MSG_USERAUTH_REQUEST, strlen($username), $username, strlen('ssh-connection'), 'ssh-connection', - strlen('keyboard-interactive'), 'keyboard-interactive', 0, '', 0, '' + $packet = pack( + 'CNa*Na*Na*Na*Na*', + NET_SSH2_MSG_USERAUTH_REQUEST, + strlen($username), + $username, + strlen('ssh-connection'), + 'ssh-connection', + strlen('keyboard-interactive'), + 'keyboard-interactive', + 0, + '', + 0, + '' ); if (!$this->_send_binary_packet($packet)) { @@ -2011,8 +2112,8 @@ class Net_SSH2 /** * Handle the keyboard-interactive requests / responses. * - * @param String $responses... - * @return Boolean + * @param string $responses... + * @return bool * @access private */ function _keyboard_interactive_process() @@ -2069,7 +2170,7 @@ class Net_SSH2 // see http://tools.ietf.org/html/rfc4256#section-3.2 if (strlen($this->last_interactive_response)) { $this->last_interactive_response = ''; - } else if (defined('NET_SSH2_LOGGING')) { + } elseif (defined('NET_SSH2_LOGGING')) { $this->message_number_log[count($this->message_number_log) - 1] = str_replace( 'UNKNOWN', 'NET_SSH2_MSG_USERAUTH_INFO_REQUEST', @@ -2097,7 +2198,7 @@ class Net_SSH2 return false; } - if (defined('NET_SSH2_LOGGING') && NET_SSH2_LOGGING == NET_SSH2_LOG_COMPLEX) { + if (defined('NET_SSH2_LOGGING') && NET_SSH2_LOGGING == self::LOG_COMPLEX) { $this->message_number_log[count($this->message_number_log) - 1] = str_replace( 'UNKNOWN', 'NET_SSH2_MSG_USERAUTH_INFO_RESPONSE', @@ -2125,13 +2226,14 @@ class Net_SSH2 /** * Login with an ssh-agent provided key * - * @param String $username - * @param System_SSH_Agent $agent - * @return Boolean + * @param string $username + * @param \phpseclib\System\SSH\Agent $agent + * @return bool * @access private */ function _ssh_agent_login($username, $agent) { + $this->agent = $agent; $keys = $agent->requestIdentities(); foreach ($keys as $key) { if ($this->_privatekey_login($username, $key)) { @@ -2145,9 +2247,9 @@ class Net_SSH2 /** * Login with an RSA private key * - * @param String $username - * @param Crypt_RSA $password - * @return Boolean + * @param string $username + * @param \phpseclib\Crypt\RSA $password + * @return bool * @access private * @internal It might be worthwhile, at some point, to protect against {@link http://tools.ietf.org/html/rfc4251#section-9.3.9 traffic analysis} * by sending dummy SSH_MSG_IGNORE messages. @@ -2155,7 +2257,7 @@ class Net_SSH2 function _privatekey_login($username, $privatekey) { // see http://tools.ietf.org/html/rfc4253#page-15 - $publickey = $privatekey->getPublicKey(CRYPT_RSA_PUBLIC_FORMAT_RAW); + $publickey = $privatekey->getPublicKey(RSA::PUBLIC_FORMAT_RAW); if ($publickey === false) { return false; } @@ -2164,13 +2266,25 @@ class Net_SSH2 'e' => $publickey['e']->toBytes(true), 'n' => $publickey['n']->toBytes(true) ); - $publickey = pack('Na*Na*Na*', - strlen('ssh-rsa'), 'ssh-rsa', strlen($publickey['e']), $publickey['e'], strlen($publickey['n']), $publickey['n'] + $publickey = pack( + 'Na*Na*Na*', + strlen('ssh-rsa'), + 'ssh-rsa', + strlen($publickey['e']), + $publickey['e'], + strlen($publickey['n']), + $publickey['n'] ); - $part1 = pack('CNa*Na*Na*', - NET_SSH2_MSG_USERAUTH_REQUEST, strlen($username), $username, strlen('ssh-connection'), 'ssh-connection', - strlen('publickey'), 'publickey' + $part1 = pack( + 'CNa*Na*Na*', + NET_SSH2_MSG_USERAUTH_REQUEST, + strlen($username), + $username, + strlen('ssh-connection'), + 'ssh-connection', + strlen('publickey'), + 'publickey' ); $part2 = pack('Na*Na*', strlen('ssh-rsa'), 'ssh-rsa', strlen($publickey), $publickey); @@ -2195,7 +2309,7 @@ class Net_SSH2 case NET_SSH2_MSG_USERAUTH_PK_OK: // we'll just take it on faith that the public key blob and the public key algorithm name are as // they should be - if (defined('NET_SSH2_LOGGING') && NET_SSH2_LOGGING == NET_SSH2_LOG_COMPLEX) { + if (defined('NET_SSH2_LOGGING') && NET_SSH2_LOGGING == self::LOG_COMPLEX) { $this->message_number_log[count($this->message_number_log) - 1] = str_replace( 'UNKNOWN', 'NET_SSH2_MSG_USERAUTH_PK_OK', @@ -2205,7 +2319,7 @@ class Net_SSH2 } $packet = $part1 . chr(1) . $part2; - $privatekey->setSignatureMode(CRYPT_RSA_SIGNATURE_PKCS1); + $privatekey->setSignatureMode(RSA::SIGNATURE_PKCS1); $signature = $privatekey->sign(pack('Na*a*', strlen($this->session_id), $this->session_id, $packet)); $signature = pack('Na*Na*', strlen('ssh-rsa'), 'ssh-rsa', strlen($signature), $signature); $packet.= pack('Na*', strlen($signature), $signature); @@ -2227,7 +2341,7 @@ class Net_SSH2 // either the login is bad or the server employs multi-factor authentication return false; case NET_SSH2_MSG_USERAUTH_SUCCESS: - $this->bitmap |= NET_SSH2_MASK_LOGIN; + $this->bitmap |= self::MASK_LOGIN; return true; } @@ -2240,7 +2354,7 @@ class Net_SSH2 * $ssh->exec('ping 127.0.0.1'); on a Linux host will never return and will run indefinitely. setTimeout() makes it so it'll timeout. * Setting $timeout to false or 0 will mean there is no timeout. * - * @param Mixed $timeout + * @param mixed $timeout * @access public */ function setTimeout($timeout) @@ -2261,12 +2375,12 @@ class Net_SSH2 /** * Execute Command * - * If $callback is set to false then Net_SSH2::_get_channel_packet(NET_SSH2_CHANNEL_EXEC) will need to be called manually. + * If $callback is set to false then \phpseclib\Net\SSH2::_get_channel_packet(self::CHANNEL_EXEC) will need to be called manually. * In all likelihood, this is not a feature you want to be taking advantage of. * - * @param String $command - * @param optional Callback $callback - * @return String + * @param string $command + * @param Callback $callback + * @return string * @access public */ function exec($command, $callback = null) @@ -2275,42 +2389,63 @@ class Net_SSH2 $this->is_timeout = false; $this->stdErrorLog = ''; - if (!($this->bitmap & NET_SSH2_MASK_LOGIN)) { + if (!($this->bitmap & self::MASK_LOGIN)) { return false; } // RFC4254 defines the (client) window size as "bytes the other party can send before it must wait for the window to // be adjusted". 0x7FFFFFFF is, at 2GB, the max size. technically, it should probably be decremented, but, - // honestly, if you're transfering more than 2GB, you probably shouldn't be using phpseclib, anyway. + // honestly, if you're transferring more than 2GB, you probably shouldn't be using phpseclib, anyway. // see http://tools.ietf.org/html/rfc4254#section-5.2 for more info - $this->window_size_server_to_client[NET_SSH2_CHANNEL_EXEC] = $this->window_size; + $this->window_size_server_to_client[self::CHANNEL_EXEC] = $this->window_size; // 0x8000 is the maximum max packet size, per http://tools.ietf.org/html/rfc4253#section-6.1, although since PuTTy // uses 0x4000, that's what will be used here, as well. $packet_size = 0x4000; - $packet = pack('CNa*N3', - NET_SSH2_MSG_CHANNEL_OPEN, strlen('session'), 'session', NET_SSH2_CHANNEL_EXEC, $this->window_size_server_to_client[NET_SSH2_CHANNEL_EXEC], $packet_size); + $packet = pack( + 'CNa*N3', + NET_SSH2_MSG_CHANNEL_OPEN, + strlen('session'), + 'session', + self::CHANNEL_EXEC, + $this->window_size_server_to_client[self::CHANNEL_EXEC], + $packet_size + ); if (!$this->_send_binary_packet($packet)) { return false; } - $this->channel_status[NET_SSH2_CHANNEL_EXEC] = NET_SSH2_MSG_CHANNEL_OPEN; + $this->channel_status[self::CHANNEL_EXEC] = NET_SSH2_MSG_CHANNEL_OPEN; - $response = $this->_get_channel_packet(NET_SSH2_CHANNEL_EXEC); + $response = $this->_get_channel_packet(self::CHANNEL_EXEC); if ($response === false) { return false; } if ($this->request_pty === true) { $terminal_modes = pack('C', NET_SSH2_TTY_OP_END); - $packet = pack('CNNa*CNa*N5a*', - NET_SSH2_MSG_CHANNEL_REQUEST, $this->server_channels[NET_SSH2_CHANNEL_EXEC], strlen('pty-req'), 'pty-req', 1, strlen('vt100'), 'vt100', - $this->windowColumns, $this->windowRows, 0, 0, strlen($terminal_modes), $terminal_modes); + $packet = pack( + 'CNNa*CNa*N5a*', + NET_SSH2_MSG_CHANNEL_REQUEST, + $this->server_channels[self::CHANNEL_EXEC], + strlen('pty-req'), + 'pty-req', + 1, + strlen('vt100'), + 'vt100', + $this->windowColumns, + $this->windowRows, + 0, + 0, + strlen($terminal_modes), + $terminal_modes + ); if (!$this->_send_binary_packet($packet)) { return false; } + $response = $this->_get_binary_packet(); if ($response === false) { user_error('Connection closed by server'); @@ -2331,7 +2466,7 @@ class Net_SSH2 } // sending a pty-req SSH_MSG_CHANNEL_REQUEST message is unnecessary and, in fact, in most cases, slows things - // down. the one place where it might be desirable is if you're doing something like Net_SSH2::exec('ping localhost &'). + // down. the one place where it might be desirable is if you're doing something like \phpseclib\Net\SSH2::exec('ping localhost &'). // with a pty-req SSH_MSG_CHANNEL_REQUEST, exec() will return immediately and the ping process will then // then immediately terminate. without such a request exec() will loop indefinitely. the ping process won't end but // neither will your script. @@ -2339,20 +2474,28 @@ class Net_SSH2 // although, in theory, the size of SSH_MSG_CHANNEL_REQUEST could exceed the maximum packet size established by // SSH_MSG_CHANNEL_OPEN_CONFIRMATION, RFC4254#section-5.1 states that the "maximum packet size" refers to the // "maximum size of an individual data packet". ie. SSH_MSG_CHANNEL_DATA. RFC4254#section-5.2 corroborates. - $packet = pack('CNNa*CNa*', - NET_SSH2_MSG_CHANNEL_REQUEST, $this->server_channels[NET_SSH2_CHANNEL_EXEC], strlen('exec'), 'exec', 1, strlen($command), $command); + $packet = pack( + 'CNNa*CNa*', + NET_SSH2_MSG_CHANNEL_REQUEST, + $this->server_channels[self::CHANNEL_EXEC], + strlen('exec'), + 'exec', + 1, + strlen($command), + $command + ); if (!$this->_send_binary_packet($packet)) { return false; } - $this->channel_status[NET_SSH2_CHANNEL_EXEC] = NET_SSH2_MSG_CHANNEL_REQUEST; + $this->channel_status[self::CHANNEL_EXEC] = NET_SSH2_MSG_CHANNEL_REQUEST; - $response = $this->_get_channel_packet(NET_SSH2_CHANNEL_EXEC); + $response = $this->_get_channel_packet(self::CHANNEL_EXEC); if ($response === false) { return false; } - $this->channel_status[NET_SSH2_CHANNEL_EXEC] = NET_SSH2_MSG_CHANNEL_DATA; + $this->channel_status[self::CHANNEL_EXEC] = NET_SSH2_MSG_CHANNEL_DATA; if ($callback === false || $this->in_request_pty_exec) { return true; @@ -2360,7 +2503,7 @@ class Net_SSH2 $output = ''; while (true) { - $temp = $this->_get_channel_packet(NET_SSH2_CHANNEL_EXEC); + $temp = $this->_get_channel_packet(self::CHANNEL_EXEC); switch (true) { case $temp === true: return is_callable($callback) ? true : $output; @@ -2369,7 +2512,7 @@ class Net_SSH2 default: if (is_callable($callback)) { if (call_user_func($callback, $temp) === true) { - $this->_close_channel(NET_SSH2_CHANNEL_EXEC); + $this->_close_channel(self::CHANNEL_EXEC); return true; } } else { @@ -2382,9 +2525,9 @@ class Net_SSH2 /** * Creates an interactive shell * - * @see Net_SSH2::read() - * @see Net_SSH2::write() - * @return Boolean + * @see self::read() + * @see self::write() + * @return bool * @access private */ function _initShell() @@ -2393,27 +2536,47 @@ class Net_SSH2 return true; } - $this->window_size_server_to_client[NET_SSH2_CHANNEL_SHELL] = $this->window_size; + $this->window_size_server_to_client[self::CHANNEL_SHELL] = $this->window_size; $packet_size = 0x4000; - $packet = pack('CNa*N3', - NET_SSH2_MSG_CHANNEL_OPEN, strlen('session'), 'session', NET_SSH2_CHANNEL_SHELL, $this->window_size_server_to_client[NET_SSH2_CHANNEL_SHELL], $packet_size); + $packet = pack( + 'CNa*N3', + NET_SSH2_MSG_CHANNEL_OPEN, + strlen('session'), + 'session', + self::CHANNEL_SHELL, + $this->window_size_server_to_client[self::CHANNEL_SHELL], + $packet_size + ); if (!$this->_send_binary_packet($packet)) { return false; } - $this->channel_status[NET_SSH2_CHANNEL_SHELL] = NET_SSH2_MSG_CHANNEL_OPEN; + $this->channel_status[self::CHANNEL_SHELL] = NET_SSH2_MSG_CHANNEL_OPEN; - $response = $this->_get_channel_packet(NET_SSH2_CHANNEL_SHELL); + $response = $this->_get_channel_packet(self::CHANNEL_SHELL); if ($response === false) { return false; } $terminal_modes = pack('C', NET_SSH2_TTY_OP_END); - $packet = pack('CNNa*CNa*N5a*', - NET_SSH2_MSG_CHANNEL_REQUEST, $this->server_channels[NET_SSH2_CHANNEL_SHELL], strlen('pty-req'), 'pty-req', 1, strlen('vt100'), 'vt100', - $this->windowColumns, $this->windowRows, 0, 0, strlen($terminal_modes), $terminal_modes); + $packet = pack( + 'CNNa*CNa*N5a*', + NET_SSH2_MSG_CHANNEL_REQUEST, + $this->server_channels[self::CHANNEL_SHELL], + strlen('pty-req'), + 'pty-req', + 1, + strlen('vt100'), + 'vt100', + $this->windowColumns, + $this->windowRows, + 0, + 0, + strlen($terminal_modes), + $terminal_modes + ); if (!$this->_send_binary_packet($packet)) { return false; @@ -2437,22 +2600,28 @@ class Net_SSH2 return $this->_disconnect(NET_SSH2_DISCONNECT_BY_APPLICATION); } - $packet = pack('CNNa*C', - NET_SSH2_MSG_CHANNEL_REQUEST, $this->server_channels[NET_SSH2_CHANNEL_SHELL], strlen('shell'), 'shell', 1); + $packet = pack( + 'CNNa*C', + NET_SSH2_MSG_CHANNEL_REQUEST, + $this->server_channels[self::CHANNEL_SHELL], + strlen('shell'), + 'shell', + 1 + ); if (!$this->_send_binary_packet($packet)) { return false; } - $this->channel_status[NET_SSH2_CHANNEL_SHELL] = NET_SSH2_MSG_CHANNEL_REQUEST; + $this->channel_status[self::CHANNEL_SHELL] = NET_SSH2_MSG_CHANNEL_REQUEST; - $response = $this->_get_channel_packet(NET_SSH2_CHANNEL_SHELL); + $response = $this->_get_channel_packet(self::CHANNEL_SHELL); if ($response === false) { return false; } - $this->channel_status[NET_SSH2_CHANNEL_SHELL] = NET_SSH2_MSG_CHANNEL_DATA; + $this->channel_status[self::CHANNEL_SHELL] = NET_SSH2_MSG_CHANNEL_DATA; - $this->bitmap |= NET_SSH2_MASK_SHELL; + $this->bitmap |= self::MASK_SHELL; return true; } @@ -2460,46 +2629,64 @@ class Net_SSH2 /** * Return the channel to be used with read() / write() * - * @see Net_SSH2::read() - * @see Net_SSH2::write() - * @return Integer + * @see self::read() + * @see self::write() + * @return int * @access public */ function _get_interactive_channel() { switch (true) { case $this->in_subsystem: - return NET_SSH2_CHANNEL_SUBSYSTEM; + return self::CHANNEL_SUBSYSTEM; case $this->in_request_pty_exec: - return NET_SSH2_CHANNEL_EXEC; + return self::CHANNEL_EXEC; default: - return NET_SSH2_CHANNEL_SHELL; + return self::CHANNEL_SHELL; } } + /** + * Return an available open channel + * + * @return int + * @access public + */ + function _get_open_channel() + { + $channel = self::CHANNEL_EXEC; + do { + if (isset($this->channel_status[$channel]) && $this->channel_status[$channel] == NET_SSH2_MSG_CHANNEL_OPEN) { + return $channel; + } + } while ($channel++ < self::CHANNEL_SUBSYSTEM); + + return false; + } + /** * Returns the output of an interactive shell * * Returns when there's a match for $expect, which can take the form of a string literal or, - * if $mode == NET_SSH2_READ_REGEX, a regular expression. + * if $mode == self::READ_REGEX, a regular expression. * - * @see Net_SSH2::write() - * @param String $expect - * @param Integer $mode - * @return String + * @see self::write() + * @param string $expect + * @param int $mode + * @return string * @access public */ - function read($expect = '', $mode = NET_SSH2_READ_SIMPLE) + function read($expect = '', $mode = self::READ_SIMPLE) { $this->curTimeout = $this->timeout; $this->is_timeout = false; - if (!($this->bitmap & NET_SSH2_MASK_LOGIN)) { + if (!($this->bitmap & self::MASK_LOGIN)) { user_error('Operation disallowed prior to login()'); return false; } - if (!($this->bitmap & NET_SSH2_MASK_SHELL) && !$this->_initShell()) { + if (!($this->bitmap & self::MASK_SHELL) && !$this->_initShell()) { user_error('Unable to initiate an interactive shell session'); return false; } @@ -2508,8 +2695,8 @@ class Net_SSH2 $match = $expect; while (true) { - if ($mode == NET_SSH2_READ_REGEX) { - preg_match($expect, $this->interactiveBuffer, $matches); + if ($mode == self::READ_REGEX) { + preg_match($expect, substr($this->interactiveBuffer, -1024), $matches); $match = isset($matches[0]) ? $matches[0] : ''; } $pos = strlen($match) ? strpos($this->interactiveBuffer, $match) : false; @@ -2529,19 +2716,19 @@ class Net_SSH2 /** * Inputs a command into an interactive shell. * - * @see Net_SSH2::read() - * @param String $cmd - * @return Boolean + * @see self::read() + * @param string $cmd + * @return bool * @access public */ function write($cmd) { - if (!($this->bitmap & NET_SSH2_MASK_LOGIN)) { + if (!($this->bitmap & self::MASK_LOGIN)) { user_error('Operation disallowed prior to login()'); return false; } - if (!($this->bitmap & NET_SSH2_MASK_SHELL) && !$this->_initShell()) { + if (!($this->bitmap & self::MASK_SHELL) && !$this->_initShell()) { user_error('Unable to initiate an interactive shell session'); return false; } @@ -2558,46 +2745,61 @@ class Net_SSH2 * returns that and then that that was passed into stopSubsystem() but that'll be saved for a future date and implemented * if there's sufficient demand for such a feature. * - * @see Net_SSH2::stopSubsystem() - * @param String $subsystem - * @return Boolean + * @see self::stopSubsystem() + * @param string $subsystem + * @return bool * @access public */ function startSubsystem($subsystem) { - $this->window_size_server_to_client[NET_SSH2_CHANNEL_SUBSYSTEM] = $this->window_size; + $this->window_size_server_to_client[self::CHANNEL_SUBSYSTEM] = $this->window_size; - $packet = pack('CNa*N3', - NET_SSH2_MSG_CHANNEL_OPEN, strlen('session'), 'session', NET_SSH2_CHANNEL_SUBSYSTEM, $this->window_size, 0x4000); + $packet = pack( + 'CNa*N3', + NET_SSH2_MSG_CHANNEL_OPEN, + strlen('session'), + 'session', + self::CHANNEL_SUBSYSTEM, + $this->window_size, + 0x4000 + ); if (!$this->_send_binary_packet($packet)) { return false; } - $this->channel_status[NET_SSH2_CHANNEL_SUBSYSTEM] = NET_SSH2_MSG_CHANNEL_OPEN; + $this->channel_status[self::CHANNEL_SUBSYSTEM] = NET_SSH2_MSG_CHANNEL_OPEN; - $response = $this->_get_channel_packet(NET_SSH2_CHANNEL_SUBSYSTEM); + $response = $this->_get_channel_packet(self::CHANNEL_SUBSYSTEM); if ($response === false) { return false; } - $packet = pack('CNNa*CNa*', - NET_SSH2_MSG_CHANNEL_REQUEST, $this->server_channels[NET_SSH2_CHANNEL_SUBSYSTEM], strlen('subsystem'), 'subsystem', 1, strlen($subsystem), $subsystem); + $packet = pack( + 'CNNa*CNa*', + NET_SSH2_MSG_CHANNEL_REQUEST, + $this->server_channels[self::CHANNEL_SUBSYSTEM], + strlen('subsystem'), + 'subsystem', + 1, + strlen($subsystem), + $subsystem + ); if (!$this->_send_binary_packet($packet)) { return false; } - $this->channel_status[NET_SSH2_CHANNEL_SUBSYSTEM] = NET_SSH2_MSG_CHANNEL_REQUEST; + $this->channel_status[self::CHANNEL_SUBSYSTEM] = NET_SSH2_MSG_CHANNEL_REQUEST; - $response = $this->_get_channel_packet(NET_SSH2_CHANNEL_SUBSYSTEM); + $response = $this->_get_channel_packet(self::CHANNEL_SUBSYSTEM); if ($response === false) { - return false; + return false; } - $this->channel_status[NET_SSH2_CHANNEL_SUBSYSTEM] = NET_SSH2_MSG_CHANNEL_DATA; + $this->channel_status[self::CHANNEL_SUBSYSTEM] = NET_SSH2_MSG_CHANNEL_DATA; - $this->bitmap |= NET_SSH2_MASK_SHELL; + $this->bitmap |= self::MASK_SHELL; $this->in_subsystem = true; return true; @@ -2606,14 +2808,14 @@ class Net_SSH2 /** * Stops a subsystem. * - * @see Net_SSH2::startSubsystem() - * @return Boolean + * @see self::startSubsystem() + * @return bool * @access public */ function stopSubsystem() { $this->in_subsystem = false; - $this->_close_channel(NET_SSH2_CHANNEL_SUBSYSTEM); + $this->_close_channel(self::CHANNEL_SUBSYSTEM); return true; } @@ -2670,12 +2872,23 @@ class Net_SSH2 /** * Is the connection still active? * - * @return boolean + * @return bool * @access public */ function isConnected() { - return (bool) ($this->bitmap & NET_SSH2_MASK_CONNECTED); + return (bool) ($this->bitmap & self::MASK_CONNECTED); + } + + /** + * Have you successfully been logged in? + * + * @return bool + * @access public + */ + function isAuthenticated() + { + return (bool) ($this->bitmap & self::MASK_LOGIN); } /** @@ -2683,8 +2896,8 @@ class Net_SSH2 * * See '6. Binary Packet Protocol' of rfc4253 for more info. * - * @see Net_SSH2::_send_binary_packet() - * @return String + * @see self::_send_binary_packet() + * @return string * @access private */ function _get_binary_packet() @@ -2695,8 +2908,8 @@ class Net_SSH2 return false; } - $start = strtok(microtime(), ' ') + strtok(''); // http://php.net/microtime#61838 - $raw = fread($this->fsock, $this->decrypt_block_size); + $start = microtime(true); + $raw = stream_get_contents($this->fsock, $this->decrypt_block_size); if (!strlen($raw)) { return ''; @@ -2724,7 +2937,7 @@ class Net_SSH2 $buffer = ''; while ($remaining_length > 0) { - $temp = fread($this->fsock, $remaining_length); + $temp = stream_get_contents($this->fsock, $remaining_length); if ($temp === false || feof($this->fsock)) { user_error('Error reading from socket'); $this->bitmap = 0; @@ -2733,7 +2946,7 @@ class Net_SSH2 $buffer.= $temp; $remaining_length-= strlen($temp); } - $stop = strtok(microtime(), ' ') + strtok(''); + $stop = microtime(true); if (strlen($buffer)) { $raw.= $this->decrypt !== false ? $this->decrypt->decrypt($buffer) : $buffer; } @@ -2742,7 +2955,7 @@ class Net_SSH2 $padding = $this->_string_shift($raw, $padding_length); // should leave $raw empty if ($this->hmac_check !== false) { - $hmac = fread($this->fsock, $this->hmac_size); + $hmac = stream_get_contents($this->fsock, $this->hmac_size); if ($hmac === false || strlen($hmac) != $this->hmac_size) { user_error('Error reading socket'); $this->bitmap = 0; @@ -2760,7 +2973,7 @@ class Net_SSH2 $this->get_seq_no++; if (defined('NET_SSH2_LOGGING')) { - $current = strtok(microtime(), ' ') + strtok(''); + $current = microtime(true); $message_number = isset($this->message_numbers[ord($payload[0])]) ? $this->message_numbers[ord($payload[0])] : 'UNKNOWN (' . ord($payload[0]) . ')'; $message_number = '<- ' . $message_number . ' (since last: ' . round($current - $this->last_packet, 4) . ', network: ' . round($stop - $start, 4) . 's)'; @@ -2776,8 +2989,8 @@ class Net_SSH2 * * Because some binary packets need to be ignored... * - * @see Net_SSH2::_get_binary_packet() - * @return String + * @see self::_get_binary_packet() + * @return string * @access private */ function _filter($payload) @@ -2811,7 +3024,7 @@ class Net_SSH2 } // see http://tools.ietf.org/html/rfc4252#section-5.4; only called when the encryption has been activated and when we haven't already logged in - if (($this->bitmap & NET_SSH2_MASK_CONNECTED) && !($this->bitmap & NET_SSH2_MASK_LOGIN) && ord($payload[0]) == NET_SSH2_MSG_USERAUTH_BANNER) { + if (($this->bitmap & self::MASK_CONNECTED) && !($this->bitmap & self::MASK_LOGIN) && ord($payload[0]) == NET_SSH2_MSG_USERAUTH_BANNER) { $this->_string_shift($payload, 1); extract(unpack('Nlength', $this->_string_shift($payload, 4))); $this->banner_message = utf8_decode($this->_string_shift($payload, $length)); @@ -2819,12 +3032,11 @@ class Net_SSH2 } // only called when we've already logged in - if (($this->bitmap & NET_SSH2_MASK_CONNECTED) && ($this->bitmap & NET_SSH2_MASK_LOGIN)) { + if (($this->bitmap & self::MASK_CONNECTED) && ($this->bitmap & self::MASK_LOGIN)) { switch (ord($payload[0])) { case NET_SSH2_MSG_GLOBAL_REQUEST: // see http://tools.ietf.org/html/rfc4254#section-4 - $this->_string_shift($payload, 1); - extract(unpack('Nlength', $this->_string_shift($payload))); - $this->errors[] = 'SSH_MSG_GLOBAL_REQUEST: ' . utf8_decode($this->_string_shift($payload, $length)); + extract(unpack('Nlength', $this->_string_shift($payload, 4))); + $this->errors[] = 'SSH_MSG_GLOBAL_REQUEST: ' . $this->_string_shift($payload, $length); if (!$this->_send_binary_packet(pack('C', NET_SSH2_MSG_REQUEST_FAILURE))) { return $this->_disconnect(NET_SSH2_DISCONNECT_BY_APPLICATION); @@ -2835,18 +3047,55 @@ class Net_SSH2 case NET_SSH2_MSG_CHANNEL_OPEN: // see http://tools.ietf.org/html/rfc4254#section-5.1 $this->_string_shift($payload, 1); extract(unpack('Nlength', $this->_string_shift($payload, 4))); - $this->errors[] = 'SSH_MSG_CHANNEL_OPEN: ' . utf8_decode($this->_string_shift($payload, $length)); - - $this->_string_shift($payload, 4); // skip over client channel + $data = $this->_string_shift($payload, $length); extract(unpack('Nserver_channel', $this->_string_shift($payload, 4))); + switch ($data) { + case 'auth-agent': + case 'auth-agent@openssh.com': + if (isset($this->agent)) { + $new_channel = self::CHANNEL_AGENT_FORWARD; - $packet = pack('CN3a*Na*', - NET_SSH2_MSG_REQUEST_FAILURE, $server_channel, NET_SSH2_OPEN_ADMINISTRATIVELY_PROHIBITED, 0, '', 0, ''); + extract(unpack('Nremote_window_size', $this->_string_shift($payload, 4))); + extract(unpack('Nremote_maximum_packet_size', $this->_string_shift($payload, 4))); - if (!$this->_send_binary_packet($packet)) { - return $this->_disconnect(NET_SSH2_DISCONNECT_BY_APPLICATION); + $this->packet_size_client_to_server[$new_channel] = $remote_window_size; + $this->window_size_server_to_client[$new_channel] = $remote_maximum_packet_size; + $this->window_size_client_to_server[$new_channel] = $this->window_size; + + $packet_size = 0x4000; + + $packet = pack( + 'CN4', + NET_SSH2_MSG_CHANNEL_OPEN_CONFIRMATION, + $server_channel, + $new_channel, + $packet_size, + $packet_size + ); + + $this->server_channels[$new_channel] = $server_channel; + $this->channel_status[$new_channel] = NET_SSH2_MSG_CHANNEL_OPEN_CONFIRMATION; + if (!$this->_send_binary_packet($packet)) { + return false; + } + } + break; + default: + $packet = pack( + 'CN3a*Na*', + NET_SSH2_MSG_REQUEST_FAILURE, + $server_channel, + NET_SSH2_OPEN_ADMINISTRATIVELY_PROHIBITED, + 0, + '', + 0, + '' + ); + + if (!$this->_send_binary_packet($packet)) { + return $this->_disconnect(NET_SSH2_DISCONNECT_BY_APPLICATION); + } } - $payload = $this->_get_binary_packet(); break; case NET_SSH2_MSG_CHANNEL_WINDOW_ADJUST: @@ -2855,7 +3104,7 @@ class Net_SSH2 extract(unpack('Nwindow_size', $this->_string_shift($payload, 4))); $this->window_size_client_to_server[$channel]+= $window_size; - $payload = ($this->bitmap & NET_SSH2_MASK_WINDOW_ADJUST) ? true : $this->_get_binary_packet(); + $payload = ($this->bitmap & self::MASK_WINDOW_ADJUST) ? true : $this->_get_binary_packet(); } } @@ -2889,11 +3138,10 @@ class Net_SSH2 /** * Returns whether Quiet Mode is enabled or not * - * @see Net_SSH2::enableQuietMode() - * @see Net_SSH2::disableQuietMode() - * + * @see self::enableQuietMode() + * @see self::disableQuietMode() * @access public - * @return boolean + * @return bool */ function isQuietModeEnabled() { @@ -2923,11 +3171,10 @@ class Net_SSH2 /** * Returns whether request-pty is enabled or not * - * @see Net_SSH2::enablePTY() - * @see Net_SSH2::disablePTY() - * + * @see self::enablePTY() + * @see self::disablePTY() * @access public - * @return boolean + * @return bool */ function isPTYEnabled() { @@ -2940,7 +3187,7 @@ class Net_SSH2 * Returns the data as a string if it's available and false if not. * * @param $client_channel - * @return Mixed + * @return mixed * @access private */ function _get_channel_packet($client_channel, $skip_extended = false) @@ -2959,7 +3206,7 @@ class Net_SSH2 $read = array($this->fsock); $write = $except = null; - $start = strtok(microtime(), ' ') + strtok(''); // http://php.net/microtime#61838 + $start = microtime(true); $sec = floor($this->curTimeout); $usec = 1000000 * ($this->curTimeout - $sec); // on windows this returns a "Warning: Invalid CRT parameters detected" error @@ -2967,7 +3214,7 @@ class Net_SSH2 $this->is_timeout = true; return true; } - $elapsed = strtok(microtime(), ' ') + strtok('') - $start; + $elapsed = microtime(true) - $start; $this->curTimeout-= $elapsed; } @@ -2983,48 +3230,63 @@ class Net_SSH2 return ''; } - extract(unpack('Ctype/Nchannel', $this->_string_shift($response, 5))); + extract(unpack('Ctype', $this->_string_shift($response, 1))); - $this->window_size_server_to_client[$channel]-= strlen($response); - - // resize the window, if appropriate - if ($this->window_size_server_to_client[$channel] < 0) { - $packet = pack('CNN', NET_SSH2_MSG_CHANNEL_WINDOW_ADJUST, $this->server_channels[$channel], $this->window_size); - if (!$this->_send_binary_packet($packet)) { - return false; - } - $this->window_size_server_to_client[$channel]+= $this->window_size; + if ($type == NET_SSH2_MSG_CHANNEL_OPEN) { + extract(unpack('Nlength', $this->_string_shift($response, 4))); + } else { + extract(unpack('Nchannel', $this->_string_shift($response, 4))); } - switch ($this->channel_status[$channel]) { - case NET_SSH2_MSG_CHANNEL_OPEN: - switch ($type) { - case NET_SSH2_MSG_CHANNEL_OPEN_CONFIRMATION: - extract(unpack('Nserver_channel', $this->_string_shift($response, 4))); - $this->server_channels[$channel] = $server_channel; - extract(unpack('Nwindow_size', $this->_string_shift($response, 4))); - $this->window_size_client_to_server[$channel] = $window_size; - $temp = unpack('Npacket_size_client_to_server', $this->_string_shift($response, 4)); - $this->packet_size_client_to_server[$channel] = $temp['packet_size_client_to_server']; - return $client_channel == $channel ? true : $this->_get_channel_packet($client_channel, $skip_extended); - //case NET_SSH2_MSG_CHANNEL_OPEN_FAILURE: - default: - user_error('Unable to open channel'); - return $this->_disconnect(NET_SSH2_DISCONNECT_BY_APPLICATION); + // will not be setup yet on incoming channel open request + if (isset($channel) && isset($this->channel_status[$channel]) && isset($this->window_size_server_to_client[$channel])) { + $this->window_size_server_to_client[$channel]-= strlen($response); + + // resize the window, if appropriate + if ($this->window_size_server_to_client[$channel] < 0) { + $packet = pack('CNN', NET_SSH2_MSG_CHANNEL_WINDOW_ADJUST, $this->server_channels[$channel], $this->window_size); + if (!$this->_send_binary_packet($packet)) { + return false; } - break; - case NET_SSH2_MSG_CHANNEL_REQUEST: - switch ($type) { - case NET_SSH2_MSG_CHANNEL_SUCCESS: - return true; - case NET_SSH2_MSG_CHANNEL_FAILURE: - return false; - default: - user_error('Unable to fulfill channel request'); - return $this->_disconnect(NET_SSH2_DISCONNECT_BY_APPLICATION); - } - case NET_SSH2_MSG_CHANNEL_CLOSE: - return $type == NET_SSH2_MSG_CHANNEL_CLOSE ? true : $this->_get_channel_packet($client_channel, $skip_extended); + $this->window_size_server_to_client[$channel]+= $this->window_size; + } + + switch ($this->channel_status[$channel]) { + case NET_SSH2_MSG_CHANNEL_OPEN: + switch ($type) { + case NET_SSH2_MSG_CHANNEL_OPEN_CONFIRMATION: + extract(unpack('Nserver_channel', $this->_string_shift($response, 4))); + $this->server_channels[$channel] = $server_channel; + extract(unpack('Nwindow_size', $this->_string_shift($response, 4))); + if ($window_size < 0) { + $window_size&= 0x7FFFFFFF; + $window_size+= 0x80000000; + } + $this->window_size_client_to_server[$channel] = $window_size; + $temp = unpack('Npacket_size_client_to_server', $this->_string_shift($response, 4)); + $this->packet_size_client_to_server[$channel] = $temp['packet_size_client_to_server']; + $result = $client_channel == $channel ? true : $this->_get_channel_packet($client_channel, $skip_extended); + $this->_on_channel_open(); + return $result; + //case NET_SSH2_MSG_CHANNEL_OPEN_FAILURE: + default: + user_error('Unable to open channel'); + return $this->_disconnect(NET_SSH2_DISCONNECT_BY_APPLICATION); + } + break; + case NET_SSH2_MSG_CHANNEL_REQUEST: + switch ($type) { + case NET_SSH2_MSG_CHANNEL_SUCCESS: + return true; + case NET_SSH2_MSG_CHANNEL_FAILURE: + return false; + default: + user_error('Unable to fulfill channel request'); + return $this->_disconnect(NET_SSH2_DISCONNECT_BY_APPLICATION); + } + case NET_SSH2_MSG_CHANNEL_CLOSE: + return $type == NET_SSH2_MSG_CHANNEL_CLOSE ? true : $this->_get_channel_packet($client_channel, $skip_extended); + } } // ie. $this->channel_status[$channel] == NET_SSH2_MSG_CHANNEL_DATA @@ -3032,7 +3294,7 @@ class Net_SSH2 switch ($type) { case NET_SSH2_MSG_CHANNEL_DATA: /* - if ($channel == NET_SSH2_CHANNEL_EXEC) { + if ($channel == self::CHANNEL_EXEC) { // SCP requires null packets, such as this, be sent. further, in the case of the ssh.com SSH server // this actually seems to make things twice as fast. more to the point, the message right after // SSH_MSG_CHANNEL_DATA (usually SSH_MSG_IGNORE) won't block for as long as it would have otherwise. @@ -3042,6 +3304,15 @@ class Net_SSH2 */ extract(unpack('Nlength', $this->_string_shift($response, 4))); $data = $this->_string_shift($response, $length); + + if ($channel == self::CHANNEL_AGENT_FORWARD) { + $agent_response = $this->agent->_forward_data($data); + if (!is_bool($agent_response)) { + $this->_send_channel_packet($channel, $agent_response); + } + break; + } + if ($client_channel == $channel) { return $data; } @@ -3052,7 +3323,7 @@ class Net_SSH2 break; case NET_SSH2_MSG_CHANNEL_EXTENDED_DATA: /* - if ($client_channel == NET_SSH2_CHANNEL_EXEC) { + if ($client_channel == self::CHANNEL_EXEC) { $this->_send_channel_packet($client_channel, chr(0)); } */ @@ -3108,15 +3379,17 @@ class Net_SSH2 case NET_SSH2_MSG_CHANNEL_CLOSE: $this->curTimeout = 0; - if ($this->bitmap & NET_SSH2_MASK_SHELL) { - $this->bitmap&= ~NET_SSH2_MASK_SHELL; + if ($this->bitmap & self::MASK_SHELL) { + $this->bitmap&= ~self::MASK_SHELL; } if ($this->channel_status[$channel] != NET_SSH2_MSG_CHANNEL_EOF) { $this->_send_binary_packet(pack('CN', NET_SSH2_MSG_CHANNEL_CLOSE, $this->server_channels[$channel])); } $this->channel_status[$channel] = NET_SSH2_MSG_CHANNEL_CLOSE; - return true; + if ($client_channel == $channel) { + return true; + } case NET_SSH2_MSG_CHANNEL_EOF: break; default: @@ -3131,10 +3404,10 @@ class Net_SSH2 * * See '6. Binary Packet Protocol' of rfc4253 for more info. * - * @param String $data - * @param optional String $logged - * @see Net_SSH2::_get_binary_packet() - * @return Boolean + * @param string $data + * @param string $logged + * @see self::_get_binary_packet() + * @return bool * @access private */ function _send_binary_packet($data, $logged = null) @@ -3157,7 +3430,7 @@ class Net_SSH2 $packet_length+= (($this->encrypt_block_size - 1) * $packet_length) % $this->encrypt_block_size; // subtracting strlen($data) is obvious - subtracting 5 is necessary because of packet_length and padding_length $padding_length = $packet_length - strlen($data) - 5; - $padding = crypt_random_string($padding_length); + $padding = Random::string($padding_length); // we subtract 4 from packet_length because the packet_length field isn't supposed to include itself $packet = pack('NCa*', $packet_length - 4, $padding_length, $data . $padding); @@ -3171,12 +3444,12 @@ class Net_SSH2 $packet.= $hmac; - $start = strtok(microtime(), ' ') + strtok(''); // http://php.net/microtime#61838 + $start = microtime(true); $result = strlen($packet) == fputs($this->fsock, $packet); - $stop = strtok(microtime(), ' ') + strtok(''); + $stop = microtime(true); if (defined('NET_SSH2_LOGGING')) { - $current = strtok(microtime(), ' ') + strtok(''); + $current = microtime(true); $message_number = isset($this->message_numbers[ord($data[0])]) ? $this->message_numbers[ord($data[0])] : 'UNKNOWN (' . ord($data[0]) . ')'; $message_number = '-> ' . $message_number . ' (since last: ' . round($current - $this->last_packet, 4) . ', network: ' . round($stop - $start, 4) . 's)'; @@ -3192,7 +3465,7 @@ class Net_SSH2 * * Makes sure that only the last 1MB worth of packets will be logged * - * @param String $data + * @param string $data * @access private */ function _append_log($message_number, $message) @@ -3204,15 +3477,15 @@ class Net_SSH2 switch (NET_SSH2_LOGGING) { // useful for benchmarks - case NET_SSH2_LOG_SIMPLE: + case self::LOG_SIMPLE: $this->message_number_log[] = $message_number; break; // the most useful log for SSH2 - case NET_SSH2_LOG_COMPLEX: + case self::LOG_COMPLEX: $this->message_number_log[] = $message_number; $this->log_size+= strlen($message); $this->message_log[] = $message; - while ($this->log_size > NET_SSH2_LOG_MAX_SIZE) { + while ($this->log_size > self::LOG_MAX_SIZE) { $this->log_size-= strlen(array_shift($this->message_log)); array_shift($this->message_number_log); } @@ -3220,7 +3493,7 @@ class Net_SSH2 // dump the output out realtime; packets may be interspersed with non packets, // passwords won't be filtered out and select other packets may not be correctly // identified - case NET_SSH2_LOG_REALTIME: + case self::LOG_REALTIME: switch (PHP_SAPI) { case 'cli': $start = $stop = "\r\n"; @@ -3233,14 +3506,14 @@ class Net_SSH2 @flush(); @ob_flush(); break; - // basically the same thing as NET_SSH2_LOG_REALTIME with the caveat that NET_SSH2_LOG_REALTIME_FILE - // needs to be defined and that the resultant log file will be capped out at NET_SSH2_LOG_MAX_SIZE. + // basically the same thing as self::LOG_REALTIME with the caveat that self::LOG_REALTIME_FILE + // needs to be defined and that the resultant log file will be capped out at self::LOG_MAX_SIZE. // the earliest part of the log file is denoted by the first <<< START >>> and is not going to necessarily // at the beginning of the file - case NET_SSH2_LOG_REALTIME_FILE: + case self::LOG_REALTIME_FILE: if (!isset($this->realtime_log_file)) { // PHP doesn't seem to like using constants in fopen() - $filename = NET_SSH2_LOG_REALTIME_FILENAME; + $filename = self::LOG_REALTIME_FILENAME; $fp = fopen($filename, 'w'); $this->realtime_log_file = $fp; } @@ -3254,7 +3527,7 @@ class Net_SSH2 fseek($this->realtime_log_file, ftell($this->realtime_log_file) - strlen($temp)); } $this->realtime_log_size+= strlen($entry); - if ($this->realtime_log_size > NET_SSH2_LOG_MAX_SIZE) { + if ($this->realtime_log_size > self::LOG_MAX_SIZE) { fseek($this->realtime_log_file, 0); $this->realtime_log_size = strlen($entry); $this->realtime_log_wrap = true; @@ -3268,19 +3541,19 @@ class Net_SSH2 * * Spans multiple SSH_MSG_CHANNEL_DATAs if appropriate * - * @param Integer $client_channel - * @param String $data - * @return Boolean + * @param int $client_channel + * @param string $data + * @return bool * @access private */ function _send_channel_packet($client_channel, $data) { while (strlen($data)) { if (!$this->window_size_client_to_server[$client_channel]) { - $this->bitmap^= NET_SSH2_MASK_WINDOW_ADJUST; + $this->bitmap^= self::MASK_WINDOW_ADJUST; // using an invalid channel will let the buffers be built up for the valid channels $this->_get_channel_packet(-1); - $this->bitmap^= NET_SSH2_MASK_WINDOW_ADJUST; + $this->bitmap^= self::MASK_WINDOW_ADJUST; } /* The maximum amount of data allowed is determined by the maximum @@ -3293,7 +3566,8 @@ class Net_SSH2 ); $temp = $this->_string_shift($data, $max_size); - $packet = pack('CN2a*', + $packet = pack( + 'CN2a*', NET_SSH2_MSG_CHANNEL_DATA, $this->server_channels[$client_channel], strlen($temp), @@ -3311,13 +3585,13 @@ class Net_SSH2 /** * Closes and flushes a channel * - * Net_SSH2 doesn't properly close most channels. For exec() channels are normally closed by the server + * \phpseclib\Net\SSH2 doesn't properly close most channels. For exec() channels are normally closed by the server * and for SFTP channels are presumably closed when the client disconnects. This functions is intended * for SCP more than anything. * - * @param Integer $client_channel - * @param Boolean $want_reply - * @return Boolean + * @param int $client_channel + * @param bool $want_reply + * @return bool * @access private */ function _close_channel($client_channel, $want_reply = false) @@ -3334,27 +3608,28 @@ class Net_SSH2 $this->curTimeout = 0; - while (!is_bool($this->_get_channel_packet($client_channel))); + while (!is_bool($this->_get_channel_packet($client_channel))) { + } if ($want_reply) { $this->_send_binary_packet(pack('CN', NET_SSH2_MSG_CHANNEL_CLOSE, $this->server_channels[$client_channel])); } - if ($this->bitmap & NET_SSH2_MASK_SHELL) { - $this->bitmap&= ~NET_SSH2_MASK_SHELL; + if ($this->bitmap & self::MASK_SHELL) { + $this->bitmap&= ~self::MASK_SHELL; } } /** * Disconnect * - * @param Integer $reason - * @return Boolean + * @param int $reason + * @return bool * @access private */ function _disconnect($reason) { - if ($this->bitmap & NET_SSH2_MASK_CONNECTED) { + if ($this->bitmap & self::MASK_CONNECTED) { $data = pack('CNNa*Na*', NET_SSH2_MSG_DISCONNECT, $reason, 0, '', 0, ''); $this->_send_binary_packet($data); $this->bitmap = 0; @@ -3368,9 +3643,9 @@ class Net_SSH2 * * Inspired by array_shift * - * @param String $string - * @param optional Integer $index - * @return String + * @param string $string + * @param int $index + * @return string * @access private */ function _string_shift(&$string, $index = 1) @@ -3387,14 +3662,14 @@ class Net_SSH2 * named constants from it, using the value as the name of the constant and the index as the value of the constant. * If any of the constants that would be defined already exists, none of the constants will be defined. * - * @param Array $array + * @param array $array * @access private */ function _define_array() { $args = func_get_args(); foreach ($args as $arg) { - foreach ($arg as $key=>$value) { + foreach ($arg as $key => $value) { if (!defined($value)) { define($value, $key); } else { @@ -3407,10 +3682,10 @@ class Net_SSH2 /** * Returns a log of the packets that have been sent and received. * - * Returns a string if NET_SSH2_LOGGING == NET_SSH2_LOG_COMPLEX, an array if NET_SSH2_LOGGING == NET_SSH2_LOG_SIMPLE and false if !defined('NET_SSH2_LOGGING') + * Returns a string if NET_SSH2_LOGGING == self::LOG_COMPLEX, an array if NET_SSH2_LOGGING == self::LOG_SIMPLE and false if !defined('NET_SSH2_LOGGING') * * @access public - * @return String or Array + * @return array|false|string */ function getLog() { @@ -3419,10 +3694,10 @@ class Net_SSH2 } switch (NET_SSH2_LOGGING) { - case NET_SSH2_LOG_SIMPLE: + case self::LOG_SIMPLE: return $this->message_number_log; break; - case NET_SSH2_LOG_COMPLEX: + case self::LOG_COMPLEX: return $this->_format_log($this->message_log, $this->message_number_log); break; default: @@ -3433,10 +3708,10 @@ class Net_SSH2 /** * Formats a log for printing * - * @param Array $message_log - * @param Array $message_number_log + * @param array $message_log + * @param array $message_number_log * @access private - * @return String + * @return string */ function _format_log($message_log, $message_number_log) { @@ -3469,19 +3744,54 @@ class Net_SSH2 * * For use with preg_replace_callback() * - * @param Array $matches + * @param array $matches * @access private - * @return String + * @return string */ function _format_log_helper($matches) { return $this->log_boundary . str_pad(dechex(ord($matches[0])), 2, '0', STR_PAD_LEFT); } + /** + * Helper function for agent->_on_channel_open() + * + * Used when channels are created to inform agent + * of said channel opening. Must be called after + * channel open confirmation received + * + * @access private + */ + function _on_channel_open() + { + if (isset($this->agent)) { + $this->agent->_on_channel_open($this); + } + } + + /** + * Returns the first value of the intersection of two arrays or false if + * the intersection is empty. The order is defined by the first parameter. + * + * @param array $array1 + * @param array $array2 + * @return mixed False if intersection is empty, else intersected value. + * @access private + */ + function _array_intersect_first($array1, $array2) + { + foreach ($array1 as $value) { + if (in_array($value, $array2)) { + return $value; + } + } + return false; + } + /** * Returns all errors * - * @return String + * @return string[] * @access public */ function getErrors() @@ -3492,18 +3802,22 @@ class Net_SSH2 /** * Returns the last error * - * @return String + * @return string * @access public */ function getLastError() { - return $this->errors[count($this->errors) - 1]; + $count = count($this->errors); + + if ($count > 0) { + return $this->errors[$count - 1]; + } } /** * Return the server identification. * - * @return String + * @return string * @access public */ function getServerIdentification() @@ -3516,7 +3830,7 @@ class Net_SSH2 /** * Return a list of the key exchange algorithms the server supports. * - * @return Array + * @return array * @access public */ function getKexAlgorithms() @@ -3529,7 +3843,7 @@ class Net_SSH2 /** * Return a list of the host key (public key) algorithms the server supports. * - * @return Array + * @return array * @access public */ function getServerHostKeyAlgorithms() @@ -3542,7 +3856,7 @@ class Net_SSH2 /** * Return a list of the (symmetric key) encryption algorithms the server supports, when receiving stuff from the client. * - * @return Array + * @return array * @access public */ function getEncryptionAlgorithmsClient2Server() @@ -3555,7 +3869,7 @@ class Net_SSH2 /** * Return a list of the (symmetric key) encryption algorithms the server supports, when sending stuff to the client. * - * @return Array + * @return array * @access public */ function getEncryptionAlgorithmsServer2Client() @@ -3568,7 +3882,7 @@ class Net_SSH2 /** * Return a list of the MAC algorithms the server supports, when receiving stuff from the client. * - * @return Array + * @return array * @access public */ function getMACAlgorithmsClient2Server() @@ -3581,7 +3895,7 @@ class Net_SSH2 /** * Return a list of the MAC algorithms the server supports, when sending stuff to the client. * - * @return Array + * @return array * @access public */ function getMACAlgorithmsServer2Client() @@ -3594,7 +3908,7 @@ class Net_SSH2 /** * Return a list of the compression algorithms the server supports, when receiving stuff from the client. * - * @return Array + * @return array * @access public */ function getCompressionAlgorithmsClient2Server() @@ -3607,7 +3921,7 @@ class Net_SSH2 /** * Return a list of the compression algorithms the server supports, when sending stuff to the client. * - * @return Array + * @return array * @access public */ function getCompressionAlgorithmsServer2Client() @@ -3620,7 +3934,7 @@ class Net_SSH2 /** * Return a list of the languages the server supports, when sending stuff to the client. * - * @return Array + * @return array * @access public */ function getLanguagesServer2Client() @@ -3633,7 +3947,7 @@ class Net_SSH2 /** * Return a list of the languages the server supports, when receiving stuff from the client. * - * @return Array + * @return array * @access public */ function getLanguagesClient2Server() @@ -3649,7 +3963,7 @@ class Net_SSH2 * Quoting from the RFC, "in some jurisdictions, sending a warning message before * authentication may be relevant for getting legal protection." * - * @return String + * @return string * @access public */ function getBannerMessage() @@ -3663,12 +3977,12 @@ class Net_SSH2 * Caching this the first time you connect to a server and checking the result on subsequent connections * is recommended. Returns false if the server signature is not signed correctly with the public host key. * - * @return Mixed + * @return mixed * @access public */ function getServerPublicHostKey() { - if (!($this->bitmap & NET_SSH2_MASK_CONSTRUCTOR)) { + if (!($this->bitmap & self::MASK_CONSTRUCTOR)) { if (!$this->_connect()) { return false; } @@ -3690,19 +4004,19 @@ class Net_SSH2 switch ($this->signature_format) { case 'ssh-dss': - $zero = new Math_BigInteger(); + $zero = new BigInteger(); $temp = unpack('Nlength', $this->_string_shift($server_public_host_key, 4)); - $p = new Math_BigInteger($this->_string_shift($server_public_host_key, $temp['length']), -256); + $p = new BigInteger($this->_string_shift($server_public_host_key, $temp['length']), -256); $temp = unpack('Nlength', $this->_string_shift($server_public_host_key, 4)); - $q = new Math_BigInteger($this->_string_shift($server_public_host_key, $temp['length']), -256); + $q = new BigInteger($this->_string_shift($server_public_host_key, $temp['length']), -256); $temp = unpack('Nlength', $this->_string_shift($server_public_host_key, 4)); - $g = new Math_BigInteger($this->_string_shift($server_public_host_key, $temp['length']), -256); + $g = new BigInteger($this->_string_shift($server_public_host_key, $temp['length']), -256); $temp = unpack('Nlength', $this->_string_shift($server_public_host_key, 4)); - $y = new Math_BigInteger($this->_string_shift($server_public_host_key, $temp['length']), -256); + $y = new BigInteger($this->_string_shift($server_public_host_key, $temp['length']), -256); /* The value for 'dss_signature_blob' is encoded as a string containing r, followed by s (which are 160-bit integers, without lengths or @@ -3713,8 +4027,8 @@ class Net_SSH2 return $this->_disconnect(NET_SSH2_DISCONNECT_KEY_EXCHANGE_FAILED); } - $r = new Math_BigInteger($this->_string_shift($signature, 20), 256); - $s = new Math_BigInteger($this->_string_shift($signature, 20), 256); + $r = new BigInteger($this->_string_shift($signature, 20), 256); + $s = new BigInteger($this->_string_shift($signature, 20), 256); switch (true) { case $r->equals($zero): @@ -3727,7 +4041,7 @@ class Net_SSH2 $w = $s->modInverse($q); - $u1 = $w->multiply(new Math_BigInteger(sha1($this->exchange_hash), 16)); + $u1 = $w->multiply(new BigInteger(sha1($this->exchange_hash), 16)); list(, $u1) = $u1->divide($q); $u2 = $w->multiply($r); @@ -3748,24 +4062,20 @@ class Net_SSH2 break; case 'ssh-rsa': $temp = unpack('Nlength', $this->_string_shift($server_public_host_key, 4)); - $e = new Math_BigInteger($this->_string_shift($server_public_host_key, $temp['length']), -256); + $e = new BigInteger($this->_string_shift($server_public_host_key, $temp['length']), -256); $temp = unpack('Nlength', $this->_string_shift($server_public_host_key, 4)); $rawN = $this->_string_shift($server_public_host_key, $temp['length']); - $n = new Math_BigInteger($rawN, -256); + $n = new BigInteger($rawN, -256); $nLength = strlen(ltrim($rawN, "\0")); /* $temp = unpack('Nlength', $this->_string_shift($signature, 4)); $signature = $this->_string_shift($signature, $temp['length']); - if (!class_exists('Crypt_RSA')) { - include_once 'Crypt/RSA.php'; - } - - $rsa = new Crypt_RSA(); - $rsa->setSignatureMode(CRYPT_RSA_SIGNATURE_PKCS1); - $rsa->loadKey(array('e' => $e, 'n' => $n), CRYPT_RSA_PUBLIC_FORMAT_RAW); + $rsa = new RSA(); + $rsa->setSignatureMode(RSA::SIGNATURE_PKCS1); + $rsa->loadKey(array('e' => $e, 'n' => $n), RSA::PUBLIC_FORMAT_RAW); if (!$rsa->verify($this->exchange_hash, $signature)) { user_error('Bad server signature'); return $this->_disconnect(NET_SSH2_DISCONNECT_HOST_KEY_NOT_VERIFIABLE); @@ -3773,7 +4083,7 @@ class Net_SSH2 */ $temp = unpack('Nlength', $this->_string_shift($signature, 4)); - $s = new Math_BigInteger($this->_string_shift($signature, $temp['length']), 256); + $s = new BigInteger($this->_string_shift($signature, $temp['length']), 256); // validate an RSA signature per "8.2 RSASSA-PKCS1-v1_5", "5.2.2 RSAVP1", and "9.1 EMSA-PSS" in the // following URL: @@ -3781,7 +4091,7 @@ class Net_SSH2 // also, see SSHRSA.c (rsa2_verifysig) in PuTTy's source. - if ($s->compare(new Math_BigInteger()) < 0 || $s->compare($n->subtract(new Math_BigInteger(1))) > 0) { + if ($s->compare(new BigInteger()) < 0 || $s->compare($n->subtract(new BigInteger(1))) > 0) { user_error('Invalid signature'); return $this->_disconnect(NET_SSH2_DISCONNECT_KEY_EXCHANGE_FAILED); } @@ -3808,7 +4118,7 @@ class Net_SSH2 /** * Returns the exit status of an SSH command or false. * - * @return Integer or false + * @return false|int * @access public */ function getExitStatus() @@ -3822,7 +4132,7 @@ class Net_SSH2 /** * Returns the number of columns for the terminal window size. * - * @return Integer + * @return int * @access public */ function getWindowColumns() @@ -3833,7 +4143,7 @@ class Net_SSH2 /** * Returns the number of rows for the terminal window size. * - * @return Integer + * @return int * @access public */ function getWindowRows() @@ -3844,7 +4154,7 @@ class Net_SSH2 /** * Sets the number of columns for the terminal window size. * - * @param Integer $value + * @param int $value * @access public */ function setWindowColumns($value) @@ -3855,7 +4165,7 @@ class Net_SSH2 /** * Sets the number of rows for the terminal window size. * - * @param Integer $value + * @param int $value * @access public */ function setWindowRows($value) @@ -3866,8 +4176,8 @@ class Net_SSH2 /** * Sets the number of columns and rows for the terminal window size. * - * @param Integer $columns - * @param Integer $rows + * @param int $columns + * @param int $rows * @access public */ function setWindowSize($columns = 80, $rows = 24) diff --git a/securemail/vendor/phpseclib/phpseclib/phpseclib/System/SSH/Agent.php b/securemail/vendor/phpseclib/phpseclib/phpseclib/System/SSH/Agent.php index 4c0ef733..a4ff0549 100644 --- a/securemail/vendor/phpseclib/phpseclib/phpseclib/System/SSH/Agent.php +++ b/securemail/vendor/phpseclib/phpseclib/phpseclib/System/SSH/Agent.php @@ -1,18 +1,18 @@ * login('username', $agent)) { * exit('Login Failed'); * } @@ -22,26 +22,8 @@ * ?> * * - * LICENSE: Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in - * all copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN - * THE SOFTWARE. - * * @category System - * @package System_SSH_Agent + * @package SSH\Agent * @author Jim Wigginton * @copyright 2014 Jim Wigginton * @license http://www.opensource.org/licenses/mit-license.html MIT License @@ -49,189 +31,93 @@ * @internal See http://api.libssh.org/rfc/PROTOCOL.agent */ -/**#@+ - * Message numbers - * - * @access private - */ -// to request SSH1 keys you have to use SSH_AGENTC_REQUEST_RSA_IDENTITIES (1) -define('SYSTEM_SSH_AGENTC_REQUEST_IDENTITIES', 11); -// this is the SSH2 response; the SSH1 response is SSH_AGENT_RSA_IDENTITIES_ANSWER (2). -define('SYSTEM_SSH_AGENT_IDENTITIES_ANSWER', 12); -define('SYSTEM_SSH_AGENT_FAILURE', 5); -// the SSH1 request is SSH_AGENTC_RSA_CHALLENGE (3) -define('SYSTEM_SSH_AGENTC_SIGN_REQUEST', 13); -// the SSH1 response is SSH_AGENT_RSA_RESPONSE (4) -define('SYSTEM_SSH_AGENT_SIGN_RESPONSE', 14); -/**#@-*/ +namespace phpseclib\System\SSH; -/** - * Pure-PHP ssh-agent client identity object - * - * Instantiation should only be performed by System_SSH_Agent class. - * This could be thought of as implementing an interface that Crypt_RSA - * implements. ie. maybe a Net_SSH_Auth_PublicKey interface or something. - * The methods in this interface would be getPublicKey, setSignatureMode - * and sign since those are the methods phpseclib looks for to perform - * public key authentication. - * - * @package System_SSH_Agent - * @author Jim Wigginton - * @access internal - */ -class System_SSH_Agent_Identity -{ - /** - * Key Object - * - * @var Crypt_RSA - * @access private - * @see System_SSH_Agent_Identity::getPublicKey() - */ - var $key; - - /** - * Key Blob - * - * @var String - * @access private - * @see System_SSH_Agent_Identity::sign() - */ - var $key_blob; - - /** - * Socket Resource - * - * @var Resource - * @access private - * @see System_SSH_Agent_Identity::sign() - */ - var $fsock; - - /** - * Default Constructor. - * - * @param Resource $fsock - * @return System_SSH_Agent_Identity - * @access private - */ - function System_SSH_Agent_Identity($fsock) - { - $this->fsock = $fsock; - } - - /** - * Set Public Key - * - * Called by System_SSH_Agent::requestIdentities() - * - * @param Crypt_RSA $key - * @access private - */ - function setPublicKey($key) - { - $this->key = $key; - $this->key->setPublicKey(); - } - - /** - * Set Public Key - * - * Called by System_SSH_Agent::requestIdentities(). The key blob could be extracted from $this->key - * but this saves a small amount of computation. - * - * @param String $key_blob - * @access private - */ - function setPublicKeyBlob($key_blob) - { - $this->key_blob = $key_blob; - } - - /** - * Get Public Key - * - * Wrapper for $this->key->getPublicKey() - * - * @param Integer $format optional - * @return Mixed - * @access public - */ - function getPublicKey($format = null) - { - return !isset($format) ? $this->key->getPublicKey() : $this->key->getPublicKey($format); - } - - /** - * Set Signature Mode - * - * Doesn't do anything as ssh-agent doesn't let you pick and choose the signature mode. ie. - * ssh-agent's only supported mode is CRYPT_RSA_SIGNATURE_PKCS1 - * - * @param Integer $mode - * @access public - */ - function setSignatureMode($mode) - { - } - - /** - * Create a signature - * - * See "2.6.2 Protocol 2 private key signature request" - * - * @param String $message - * @return String - * @access public - */ - function sign($message) - { - // the last parameter (currently 0) is for flags and ssh-agent only defines one flag (for ssh-dss): SSH_AGENT_OLD_SIGNATURE - $packet = pack('CNa*Na*N', SYSTEM_SSH_AGENTC_SIGN_REQUEST, strlen($this->key_blob), $this->key_blob, strlen($message), $message, 0); - $packet = pack('Na*', strlen($packet), $packet); - if (strlen($packet) != fputs($this->fsock, $packet)) { - user_error('Connection closed during signing'); - } - - $length = current(unpack('N', fread($this->fsock, 4))); - $type = ord(fread($this->fsock, 1)); - if ($type != SYSTEM_SSH_AGENT_SIGN_RESPONSE) { - user_error('Unable to retreive signature'); - } - - $signature_blob = fread($this->fsock, $length - 1); - // the only other signature format defined - ssh-dss - is the same length as ssh-rsa - // the + 12 is for the other various SSH added length fields - return substr($signature_blob, strlen('ssh-rsa') + 12); - } -} +use phpseclib\Crypt\RSA; +use phpseclib\System\SSH\Agent\Identity; /** * Pure-PHP ssh-agent client identity factory * - * requestIdentities() method pumps out System_SSH_Agent_Identity objects + * requestIdentities() method pumps out \phpseclib\System\SSH\Agent\Identity objects * - * @package System_SSH_Agent + * @package SSH\Agent * @author Jim Wigginton * @access internal */ -class System_SSH_Agent +class Agent { + /**#@+ + * Message numbers + * + * @access private + */ + // to request SSH1 keys you have to use SSH_AGENTC_REQUEST_RSA_IDENTITIES (1) + const SSH_AGENTC_REQUEST_IDENTITIES = 11; + // this is the SSH2 response; the SSH1 response is SSH_AGENT_RSA_IDENTITIES_ANSWER (2). + const SSH_AGENT_IDENTITIES_ANSWER = 12; + // the SSH1 request is SSH_AGENTC_RSA_CHALLENGE (3) + const SSH_AGENTC_SIGN_REQUEST = 13; + // the SSH1 response is SSH_AGENT_RSA_RESPONSE (4) + const SSH_AGENT_SIGN_RESPONSE = 14; + /**#@-*/ + + /**@+ + * Agent forwarding status + * + * @access private + */ + // no forwarding requested and not active + const FORWARD_NONE = 0; + // request agent forwarding when opportune + const FORWARD_REQUEST = 1; + // forwarding has been request and is active + const FORWARD_ACTIVE = 2; + /**#@-*/ + + /** + * Unused + */ + const SSH_AGENT_FAILURE = 5; + /** * Socket Resource * - * @var Resource + * @var resource * @access private */ var $fsock; + /** + * Agent forwarding status + * + * @access private + */ + var $forward_status = self::FORWARD_NONE; + + /** + * Buffer for accumulating forwarded authentication + * agent data arriving on SSH data channel destined + * for agent unix socket + * + * @access private + */ + var $socket_buffer = ''; + + /** + * Tracking the number of bytes we are expecting + * to arrive for the agent socket on the SSH data + * channel + */ + var $expected_bytes = 0; + /** * Default Constructor * - * @return System_SSH_Agent + * @return \phpseclib\System\SSH\Agent * @access public */ - function System_SSH_Agent() + function __construct() { switch (true) { case isset($_SERVER['SSH_AUTH_SOCK']): @@ -255,9 +141,9 @@ class System_SSH_Agent * Request Identities * * See "2.5.2 Requesting a list of protocol 2 keys" - * Returns an array containing zero or more System_SSH_Agent_Identity objects + * Returns an array containing zero or more \phpseclib\System\SSH\Agent\Identity objects * - * @return Array + * @return array * @access public */ function requestIdentities() @@ -266,14 +152,14 @@ class System_SSH_Agent return array(); } - $packet = pack('NC', 1, SYSTEM_SSH_AGENTC_REQUEST_IDENTITIES); + $packet = pack('NC', 1, self::SSH_AGENTC_REQUEST_IDENTITIES); if (strlen($packet) != fputs($this->fsock, $packet)) { user_error('Connection closed while requesting identities'); } $length = current(unpack('N', fread($this->fsock, 4))); $type = ord(fread($this->fsock, 1)); - if ($type != SYSTEM_SSH_AGENT_IDENTITIES_ANSWER) { + if ($type != self::SSH_AGENT_IDENTITIES_ANSWER) { user_error('Unable to request identities'); } @@ -282,17 +168,17 @@ class System_SSH_Agent for ($i = 0; $i < $keyCount; $i++) { $length = current(unpack('N', fread($this->fsock, 4))); $key_blob = fread($this->fsock, $length); + $key_str = 'ssh-rsa ' . base64_encode($key_blob); $length = current(unpack('N', fread($this->fsock, 4))); - $key_comment = fread($this->fsock, $length); + if ($length) { + $key_str.= ' ' . fread($this->fsock, $length); + } $length = current(unpack('N', substr($key_blob, 0, 4))); $key_type = substr($key_blob, 4, $length); switch ($key_type) { case 'ssh-rsa': - if (!class_exists('Crypt_RSA')) { - include_once 'Crypt/RSA.php'; - } - $key = new Crypt_RSA(); - $key->loadKey('ssh-rsa ' . base64_encode($key_blob) . ' ' . $key_comment); + $key = new RSA(); + $key->loadKey($key_str); break; case 'ssh-dss': // not currently supported @@ -300,7 +186,7 @@ class System_SSH_Agent } // resources are passed by reference by default if (isset($key)) { - $identity = new System_SSH_Agent_Identity($this->fsock); + $identity = new Identity($this->fsock); $identity->setPublicKey($key); $identity->setPublicKeyBlob($key_blob); $identities[] = $identity; @@ -310,4 +196,113 @@ class System_SSH_Agent return $identities; } + + /** + * Signal that agent forwarding should + * be requested when a channel is opened + * + * @param Net_SSH2 $ssh + * @return bool + * @access public + */ + function startSSHForwarding($ssh) + { + if ($this->forward_status == self::FORWARD_NONE) { + $this->forward_status = self::FORWARD_REQUEST; + } + } + + /** + * Request agent forwarding of remote server + * + * @param Net_SSH2 $ssh + * @return bool + * @access private + */ + function _request_forwarding($ssh) + { + $request_channel = $ssh->_get_open_channel(); + if ($request_channel === false) { + return false; + } + + $packet = pack( + 'CNNa*C', + NET_SSH2_MSG_CHANNEL_REQUEST, + $ssh->server_channels[$request_channel], + strlen('auth-agent-req@openssh.com'), + 'auth-agent-req@openssh.com', + 1 + ); + + $ssh->channel_status[$request_channel] = NET_SSH2_MSG_CHANNEL_REQUEST; + + if (!$ssh->_send_binary_packet($packet)) { + return false; + } + + $response = $ssh->_get_channel_packet($request_channel); + if ($response === false) { + return false; + } + + $ssh->channel_status[$request_channel] = NET_SSH2_MSG_CHANNEL_OPEN; + $this->forward_status = self::FORWARD_ACTIVE; + + return true; + } + + /** + * On successful channel open + * + * This method is called upon successful channel + * open to give the SSH Agent an opportunity + * to take further action. i.e. request agent forwarding + * + * @param Net_SSH2 $ssh + * @access private + */ + function _on_channel_open($ssh) + { + if ($this->forward_status == self::FORWARD_REQUEST) { + $this->_request_forwarding($ssh); + } + } + + /** + * Forward data to SSH Agent and return data reply + * + * @param string $data + * @return data from SSH Agent + * @access private + */ + function _forward_data($data) + { + if ($this->expected_bytes > 0) { + $this->socket_buffer.= $data; + $this->expected_bytes -= strlen($data); + } else { + $agent_data_bytes = current(unpack('N', $data)); + $current_data_bytes = strlen($data); + $this->socket_buffer = $data; + if ($current_data_bytes != $agent_data_bytes + 4) { + $this->expected_bytes = ($agent_data_bytes + 4) - $current_data_bytes; + return false; + } + } + + if (strlen($this->socket_buffer) != fwrite($this->fsock, $this->socket_buffer)) { + user_error('Connection closed attempting to forward data to SSH agent'); + } + + $this->socket_buffer = ''; + $this->expected_bytes = 0; + + $agent_reply_bytes = current(unpack('N', fread($this->fsock, 4))); + + $agent_reply_data = fread($this->fsock, $agent_reply_bytes); + $agent_reply_data = current(unpack('a*', $agent_reply_data)); + + return pack('Na*', $agent_reply_bytes, $agent_reply_data); + } } diff --git a/securemail/vendor/phpseclib/phpseclib/phpseclib/System/SSH/Agent/Identity.php b/securemail/vendor/phpseclib/phpseclib/phpseclib/System/SSH/Agent/Identity.php new file mode 100644 index 00000000..b8cc6cde --- /dev/null +++ b/securemail/vendor/phpseclib/phpseclib/phpseclib/System/SSH/Agent/Identity.php @@ -0,0 +1,158 @@ + + * @copyright 2009 Jim Wigginton + * @license http://www.opensource.org/licenses/mit-license.html MIT License + * @link http://phpseclib.sourceforge.net + * @internal See http://api.libssh.org/rfc/PROTOCOL.agent + */ + +namespace phpseclib\System\SSH\Agent; + +use phpseclib\System\SSH\Agent; + +/** + * Pure-PHP ssh-agent client identity object + * + * Instantiation should only be performed by \phpseclib\System\SSH\Agent class. + * This could be thought of as implementing an interface that phpseclib\Crypt\RSA + * implements. ie. maybe a Net_SSH_Auth_PublicKey interface or something. + * The methods in this interface would be getPublicKey and sign since those are the + * methods phpseclib looks for to perform public key authentication. + * + * @package SSH\Agent + * @author Jim Wigginton + * @access internal + */ +class Identity +{ + /** + * Key Object + * + * @var \phpseclib\Crypt\RSA + * @access private + * @see self::getPublicKey() + */ + var $key; + + /** + * Key Blob + * + * @var string + * @access private + * @see self::sign() + */ + var $key_blob; + + /** + * Socket Resource + * + * @var resource + * @access private + * @see self::sign() + */ + var $fsock; + + /** + * Default Constructor. + * + * @param resource $fsock + * @return \phpseclib\System\SSH\Agent\Identity + * @access private + */ + function __construct($fsock) + { + $this->fsock = $fsock; + } + + /** + * Set Public Key + * + * Called by \phpseclib\System\SSH\Agent::requestIdentities() + * + * @param \phpseclib\Crypt\RSA $key + * @access private + */ + function setPublicKey($key) + { + $this->key = $key; + $this->key->setPublicKey(); + } + + /** + * Set Public Key + * + * Called by \phpseclib\System\SSH\Agent::requestIdentities(). The key blob could be extracted from $this->key + * but this saves a small amount of computation. + * + * @param string $key_blob + * @access private + */ + function setPublicKeyBlob($key_blob) + { + $this->key_blob = $key_blob; + } + + /** + * Get Public Key + * + * Wrapper for $this->key->getPublicKey() + * + * @param int $format optional + * @return mixed + * @access public + */ + function getPublicKey($format = null) + { + return !isset($format) ? $this->key->getPublicKey() : $this->key->getPublicKey($format); + } + + /** + * Set Signature Mode + * + * Doesn't do anything as ssh-agent doesn't let you pick and choose the signature mode. ie. + * ssh-agent's only supported mode is \phpseclib\Crypt\RSA::SIGNATURE_PKCS1 + * + * @param int $mode + * @access public + */ + function setSignatureMode($mode) + { + } + + /** + * Create a signature + * + * See "2.6.2 Protocol 2 private key signature request" + * + * @param string $message + * @return string + * @access public + */ + function sign($message) + { + // the last parameter (currently 0) is for flags and ssh-agent only defines one flag (for ssh-dss): SSH_AGENT_OLD_SIGNATURE + $packet = pack('CNa*Na*N', Agent::SSH_AGENTC_SIGN_REQUEST, strlen($this->key_blob), $this->key_blob, strlen($message), $message, 0); + $packet = pack('Na*', strlen($packet), $packet); + if (strlen($packet) != fputs($this->fsock, $packet)) { + user_error('Connection closed during signing'); + } + + $length = current(unpack('N', fread($this->fsock, 4))); + $type = ord(fread($this->fsock, 1)); + if ($type != Agent::SSH_AGENT_SIGN_RESPONSE) { + user_error('Unable to retrieve signature'); + } + + $signature_blob = fread($this->fsock, $length - 1); + // the only other signature format defined - ssh-dss - is the same length as ssh-rsa + // the + 12 is for the other various SSH added length fields + return substr($signature_blob, strlen('ssh-rsa') + 12); + } +} diff --git a/securemail/vendor/phpseclib/phpseclib/phpseclib/System/SSH_Agent.php b/securemail/vendor/phpseclib/phpseclib/phpseclib/System/SSH_Agent.php deleted file mode 100644 index ea434b9c..00000000 --- a/securemail/vendor/phpseclib/phpseclib/phpseclib/System/SSH_Agent.php +++ /dev/null @@ -1,39 +0,0 @@ - - * @copyright 2014 Jim Wigginton - * @license http://www.opensource.org/licenses/mit-license.html MIT License - * @link http://phpseclib.sourceforge.net - * @internal See http://api.libssh.org/rfc/PROTOCOL.agent - */ - -require_once 'SSH/Agent.php'; diff --git a/securemail/vendor/phpseclib/phpseclib/phpseclib/bootstrap.php b/securemail/vendor/phpseclib/phpseclib/phpseclib/bootstrap.php new file mode 100644 index 00000000..0da0999f --- /dev/null +++ b/securemail/vendor/phpseclib/phpseclib/phpseclib/bootstrap.php @@ -0,0 +1,16 @@ + , where is the value of +# the FILE_VERSION_FILTER tag, and is the name of an input file +# provided by doxygen. Whatever the program writes to standard output +# is used as the file version. See the manual for examples. + +FILE_VERSION_FILTER = "git log --pretty=\"format:%ci, author:%aN <%aE>, commit:%h\" -1" + +# The LAYOUT_FILE tag can be used to specify a layout file which will be parsed +# by doxygen. The layout file controls the global structure of the generated +# output files in an output format independent way. To create the layout file +# that represents doxygen's defaults, run doxygen with the -l option. +# You can optionally specify a file name after the option, if omitted +# DoxygenLayout.xml will be used as the name of the layout file. + +LAYOUT_FILE = + +# The CITE_BIB_FILES tag can be used to specify one or more bib files +# containing the references data. This must be a list of .bib files. The +# .bib extension is automatically appended if omitted. Using this command +# requires the bibtex tool to be installed. See also +# http://en.wikipedia.org/wiki/BibTeX for more info. For LaTeX the style +# of the bibliography can be controlled using LATEX_BIB_STYLE. To use this +# feature you need bibtex and perl available in the search path. Do not use +# file names with spaces, bibtex cannot handle them. + +CITE_BIB_FILES = + +#--------------------------------------------------------------------------- +# configuration options related to warning and progress messages +#--------------------------------------------------------------------------- + +# The QUIET tag can be used to turn on/off the messages that are generated +# by doxygen. Possible values are YES and NO. If left blank NO is used. + +QUIET = NO + +# The WARNINGS tag can be used to turn on/off the warning messages that are +# generated by doxygen. Possible values are YES and NO. If left blank +# NO is used. + +WARNINGS = YES + +# If WARN_IF_UNDOCUMENTED is set to YES, then doxygen will generate warnings +# for undocumented members. If EXTRACT_ALL is set to YES then this flag will +# automatically be disabled. + +WARN_IF_UNDOCUMENTED = YES + +# If WARN_IF_DOC_ERROR is set to YES, doxygen will generate warnings for +# potential errors in the documentation, such as not documenting some +# parameters in a documented function, or documenting parameters that +# don't exist or using markup commands wrongly. + +WARN_IF_DOC_ERROR = YES + +# The WARN_NO_PARAMDOC option can be enabled to get warnings for +# functions that are documented, but have no documentation for their parameters +# or return value. If set to NO (the default) doxygen will only warn about +# wrong or incomplete parameter documentation, but not about the absence of +# documentation. + +WARN_NO_PARAMDOC = NO + +# The WARN_FORMAT tag determines the format of the warning messages that +# doxygen can produce. The string should contain the $file, $line, and $text +# tags, which will be replaced by the file and line number from which the +# warning originated and the warning text. Optionally the format may contain +# $version, which will be replaced by the version of the file (if it could +# be obtained via FILE_VERSION_FILTER) + +WARN_FORMAT = "$file:$line: $text" + +# The WARN_LOGFILE tag can be used to specify a file to which warning +# and error messages should be written. If left blank the output is written +# to stderr. + +WARN_LOGFILE = + +#--------------------------------------------------------------------------- +# configuration options related to the input files +#--------------------------------------------------------------------------- + +# The INPUT tag can be used to specify the files and/or directories that contain +# documented source files. You may enter file names like "myfile.cpp" or +# directories like "/usr/src/myproject". Separate the files or directories +# with spaces. + +INPUT = lib/ README.md + +# This tag can be used to specify the character encoding of the source files +# that doxygen parses. Internally doxygen uses the UTF-8 encoding, which is +# also the default input encoding. Doxygen uses libiconv (or the iconv built +# into libc) for the transcoding. See http://www.gnu.org/software/libiconv for +# the list of possible encodings. + +INPUT_ENCODING = UTF-8 + +# If the value of the INPUT tag contains directories, you can use the +# FILE_PATTERNS tag to specify one or more wildcard pattern (like *.cpp +# and *.h) to filter out the source-files in the directories. If left +# blank the following patterns are tested: +# *.c *.cc *.cxx *.cpp *.c++ *.d *.java *.ii *.ixx *.ipp *.i++ *.inl *.h *.hh +# *.hxx *.hpp *.h++ *.idl *.odl *.cs *.php *.php3 *.inc *.m *.mm *.dox *.py +# *.f90 *.f *.for *.vhd *.vhdl + +FILE_PATTERNS = + +# The RECURSIVE tag can be used to turn specify whether or not subdirectories +# should be searched for input files as well. Possible values are YES and NO. +# If left blank NO is used. + +RECURSIVE = YES + +# The EXCLUDE tag can be used to specify files and/or directories that should be +# excluded from the INPUT source files. This way you can easily exclude a +# subdirectory from a directory tree whose root is specified with the INPUT tag. +# Note that relative paths are relative to the directory from which doxygen is +# run. + +EXCLUDE = + +# The EXCLUDE_SYMLINKS tag can be used to select whether or not files or +# directories that are symbolic links (a Unix file system feature) are excluded +# from the input. + +EXCLUDE_SYMLINKS = NO + +# If the value of the INPUT tag contains directories, you can use the +# EXCLUDE_PATTERNS tag to specify one or more wildcard patterns to exclude +# certain files from those directories. Note that the wildcards are matched +# against the file with absolute path, so to exclude all test directories +# for example use the pattern */test/* + +EXCLUDE_PATTERNS = + +# The EXCLUDE_SYMBOLS tag can be used to specify one or more symbol names +# (namespaces, classes, functions, etc.) that should be excluded from the +# output. The symbol name can be a fully qualified name, a word, or if the +# wildcard * is used, a substring. Examples: ANamespace, AClass, +# AClass::ANamespace, ANamespace::*Test + +EXCLUDE_SYMBOLS = + +# The EXAMPLE_PATH tag can be used to specify one or more files or +# directories that contain example code fragments that are included (see +# the \include command). + +EXAMPLE_PATH = examples/ + +# If the value of the EXAMPLE_PATH tag contains directories, you can use the +# EXAMPLE_PATTERNS tag to specify one or more wildcard pattern (like *.cpp +# and *.h) to filter out the source-files in the directories. If left +# blank all files are included. + +EXAMPLE_PATTERNS = + +# If the EXAMPLE_RECURSIVE tag is set to YES then subdirectories will be +# searched for input files to be used with the \include or \dontinclude +# commands irrespective of the value of the RECURSIVE tag. +# Possible values are YES and NO. If left blank NO is used. + +EXAMPLE_RECURSIVE = NO + +# The IMAGE_PATH tag can be used to specify one or more files or +# directories that contain image that are included in the documentation (see +# the \image command). + +IMAGE_PATH = + +# The INPUT_FILTER tag can be used to specify a program that doxygen should +# invoke to filter for each input file. Doxygen will invoke the filter program +# by executing (via popen()) the command , where +# is the value of the INPUT_FILTER tag, and is the name of an +# input file. Doxygen will then use the output that the filter program writes +# to standard output. +# If FILTER_PATTERNS is specified, this tag will be ignored. +# Note that the filter must not add or remove lines; it is applied before the +# code is scanned, but not when the output code is generated. If lines are added +# or removed, the anchors will not be placed correctly. + +INPUT_FILTER = + +# The FILTER_PATTERNS tag can be used to specify filters on a per file pattern +# basis. +# Doxygen will compare the file name with each pattern and apply the +# filter if there is a match. +# The filters are a list of the form: +# pattern=filter (like *.cpp=my_cpp_filter). See INPUT_FILTER for further +# info on how filters are used. If FILTER_PATTERNS is empty or if +# non of the patterns match the file name, INPUT_FILTER is applied. + +FILTER_PATTERNS = + +# If the FILTER_SOURCE_FILES tag is set to YES, the input filter (if set using +# INPUT_FILTER) will be used to filter the input files when producing source +# files to browse (i.e. when SOURCE_BROWSER is set to YES). + +FILTER_SOURCE_FILES = NO + +# The FILTER_SOURCE_PATTERNS tag can be used to specify source filters per file +# pattern. A pattern will override the setting for FILTER_PATTERN (if any) +# and it is also possible to disable source filtering for a specific pattern +# using *.ext= (so without naming a filter). This option only has effect when +# FILTER_SOURCE_FILES is enabled. + +FILTER_SOURCE_PATTERNS = + +# If the USE_MDFILE_AS_MAINPAGE tag refers to the name of a markdown file that +# is part of the input, its contents will be placed on the main page +# (index.html). This can be useful if you have a project on for instance GitHub +# and want reuse the introduction page also for the doxygen output. + +USE_MDFILE_AS_MAINPAGE = README.md + +#--------------------------------------------------------------------------- +# configuration options related to source browsing +#--------------------------------------------------------------------------- + +# If the SOURCE_BROWSER tag is set to YES then a list of source files will +# be generated. Documented entities will be cross-referenced with these sources. +# Note: To get rid of all source code in the generated output, make sure also +# VERBATIM_HEADERS is set to NO. + +SOURCE_BROWSER = YES + +# Setting the INLINE_SOURCES tag to YES will include the body +# of functions and classes directly in the documentation. + +INLINE_SOURCES = NO + +# Setting the STRIP_CODE_COMMENTS tag to YES (the default) will instruct +# doxygen to hide any special comment blocks from generated source code +# fragments. Normal C, C++ and Fortran comments will always remain visible. + +STRIP_CODE_COMMENTS = YES + +# If the REFERENCED_BY_RELATION tag is set to YES +# then for each documented function all documented +# functions referencing it will be listed. + +REFERENCED_BY_RELATION = NO + +# If the REFERENCES_RELATION tag is set to YES +# then for each documented function all documented entities +# called/used by that function will be listed. + +REFERENCES_RELATION = NO + +# If the REFERENCES_LINK_SOURCE tag is set to YES (the default) +# and SOURCE_BROWSER tag is set to YES, then the hyperlinks from +# functions in REFERENCES_RELATION and REFERENCED_BY_RELATION lists will +# link to the source code. +# Otherwise they will link to the documentation. + +REFERENCES_LINK_SOURCE = YES + +# If the USE_HTAGS tag is set to YES then the references to source code +# will point to the HTML generated by the htags(1) tool instead of doxygen +# built-in source browser. The htags tool is part of GNU's global source +# tagging system (see http://www.gnu.org/software/global/global.html). You +# will need version 4.8.6 or higher. + +USE_HTAGS = NO + +# If the VERBATIM_HEADERS tag is set to YES (the default) then Doxygen +# will generate a verbatim copy of the header file for each class for +# which an include is specified. Set to NO to disable this. + +VERBATIM_HEADERS = YES + +#--------------------------------------------------------------------------- +# configuration options related to the alphabetical class index +#--------------------------------------------------------------------------- + +# If the ALPHABETICAL_INDEX tag is set to YES, an alphabetical index +# of all compounds will be generated. Enable this if the project +# contains a lot of classes, structs, unions or interfaces. + +ALPHABETICAL_INDEX = YES + +# If the alphabetical index is enabled (see ALPHABETICAL_INDEX) then +# the COLS_IN_ALPHA_INDEX tag can be used to specify the number of columns +# in which this list will be split (can be a number in the range [1..20]) + +COLS_IN_ALPHA_INDEX = 5 + +# In case all classes in a project start with a common prefix, all +# classes will be put under the same header in the alphabetical index. +# The IGNORE_PREFIX tag can be used to specify one or more prefixes that +# should be ignored while generating the index headers. + +IGNORE_PREFIX = + +#--------------------------------------------------------------------------- +# configuration options related to the HTML output +#--------------------------------------------------------------------------- + +# If the GENERATE_HTML tag is set to YES (the default) Doxygen will +# generate HTML output. + +GENERATE_HTML = YES + +# The HTML_OUTPUT tag is used to specify where the HTML docs will be put. +# If a relative path is entered the value of OUTPUT_DIRECTORY will be +# put in front of it. If left blank `html' will be used as the default path. + +HTML_OUTPUT = html + +# The HTML_FILE_EXTENSION tag can be used to specify the file extension for +# each generated HTML page (for example: .htm,.php,.asp). If it is left blank +# doxygen will generate files with .html extension. + +HTML_FILE_EXTENSION = .html + +# The HTML_HEADER tag can be used to specify a personal HTML header for +# each generated HTML page. If it is left blank doxygen will generate a +# standard header. Note that when using a custom header you are responsible +# for the proper inclusion of any scripts and style sheets that doxygen +# needs, which is dependent on the configuration options used. +# It is advised to generate a default header using "doxygen -w html +# header.html footer.html stylesheet.css YourConfigFile" and then modify +# that header. Note that the header is subject to change so you typically +# have to redo this when upgrading to a newer version of doxygen or when +# changing the value of configuration settings such as GENERATE_TREEVIEW! + +HTML_HEADER = + +# The HTML_FOOTER tag can be used to specify a personal HTML footer for +# each generated HTML page. If it is left blank doxygen will generate a +# standard footer. + +HTML_FOOTER = + +# The HTML_STYLESHEET tag can be used to specify a user-defined cascading +# style sheet that is used by each HTML page. It can be used to +# fine-tune the look of the HTML output. If left blank doxygen will +# generate a default style sheet. Note that it is recommended to use +# HTML_EXTRA_STYLESHEET instead of this one, as it is more robust and this +# tag will in the future become obsolete. + +HTML_STYLESHEET = + +# The HTML_EXTRA_STYLESHEET tag can be used to specify an additional +# user-defined cascading style sheet that is included after the standard +# style sheets created by doxygen. Using this option one can overrule +# certain style aspects. This is preferred over using HTML_STYLESHEET +# since it does not replace the standard style sheet and is therefor more +# robust against future updates. Doxygen will copy the style sheet file to +# the output directory. + +HTML_EXTRA_STYLESHEET = + +# The HTML_EXTRA_FILES tag can be used to specify one or more extra images or +# other source files which should be copied to the HTML output directory. Note +# that these files will be copied to the base HTML output directory. Use the +# $relpath^ marker in the HTML_HEADER and/or HTML_FOOTER files to load these +# files. In the HTML_STYLESHEET file, use the file name only. Also note that +# the files will be copied as-is; there are no commands or markers available. + +HTML_EXTRA_FILES = + +# The HTML_COLORSTYLE_HUE tag controls the color of the HTML output. +# Doxygen will adjust the colors in the style sheet and background images +# according to this color. Hue is specified as an angle on a colorwheel, +# see http://en.wikipedia.org/wiki/Hue for more information. +# For instance the value 0 represents red, 60 is yellow, 120 is green, +# 180 is cyan, 240 is blue, 300 purple, and 360 is red again. +# The allowed range is 0 to 359. + +HTML_COLORSTYLE_HUE = 220 + +# The HTML_COLORSTYLE_SAT tag controls the purity (or saturation) of +# the colors in the HTML output. For a value of 0 the output will use +# grayscales only. A value of 255 will produce the most vivid colors. + +HTML_COLORSTYLE_SAT = 100 + +# The HTML_COLORSTYLE_GAMMA tag controls the gamma correction applied to +# the luminance component of the colors in the HTML output. Values below +# 100 gradually make the output lighter, whereas values above 100 make +# the output darker. The value divided by 100 is the actual gamma applied, +# so 80 represents a gamma of 0.8, The value 220 represents a gamma of 2.2, +# and 100 does not change the gamma. + +HTML_COLORSTYLE_GAMMA = 80 + +# If the HTML_TIMESTAMP tag is set to YES then the footer of each generated HTML +# page will contain the date and time when the page was generated. Setting +# this to NO can help when comparing the output of multiple runs. + +HTML_TIMESTAMP = YES + +# If the HTML_DYNAMIC_SECTIONS tag is set to YES then the generated HTML +# documentation will contain sections that can be hidden and shown after the +# page has loaded. + +HTML_DYNAMIC_SECTIONS = NO + +# With HTML_INDEX_NUM_ENTRIES one can control the preferred number of +# entries shown in the various tree structured indices initially; the user +# can expand and collapse entries dynamically later on. Doxygen will expand +# the tree to such a level that at most the specified number of entries are +# visible (unless a fully collapsed tree already exceeds this amount). +# So setting the number of entries 1 will produce a full collapsed tree by +# default. 0 is a special value representing an infinite number of entries +# and will result in a full expanded tree by default. + +HTML_INDEX_NUM_ENTRIES = 100 + +# If the GENERATE_DOCSET tag is set to YES, additional index files +# will be generated that can be used as input for Apple's Xcode 3 +# integrated development environment, introduced with OSX 10.5 (Leopard). +# To create a documentation set, doxygen will generate a Makefile in the +# HTML output directory. Running make will produce the docset in that +# directory and running "make install" will install the docset in +# ~/Library/Developer/Shared/Documentation/DocSets so that Xcode will find +# it at startup. +# See http://developer.apple.com/tools/creatingdocsetswithdoxygen.html +# for more information. + +GENERATE_DOCSET = NO + +# When GENERATE_DOCSET tag is set to YES, this tag determines the name of the +# feed. A documentation feed provides an umbrella under which multiple +# documentation sets from a single provider (such as a company or product suite) +# can be grouped. + +DOCSET_FEEDNAME = "Doxygen generated docs" + +# When GENERATE_DOCSET tag is set to YES, this tag specifies a string that +# should uniquely identify the documentation set bundle. This should be a +# reverse domain-name style string, e.g. com.mycompany.MyDocSet. Doxygen +# will append .docset to the name. + +DOCSET_BUNDLE_ID = org.doxygen.Project + +# When GENERATE_PUBLISHER_ID tag specifies a string that should uniquely +# identify the documentation publisher. This should be a reverse domain-name +# style string, e.g. com.mycompany.MyDocSet.documentation. + +DOCSET_PUBLISHER_ID = org.doxygen.Publisher + +# The GENERATE_PUBLISHER_NAME tag identifies the documentation publisher. + +DOCSET_PUBLISHER_NAME = Publisher + +# If the GENERATE_HTMLHELP tag is set to YES, additional index files +# will be generated that can be used as input for tools like the +# Microsoft HTML help workshop to generate a compiled HTML help file (.chm) +# of the generated HTML documentation. + +GENERATE_HTMLHELP = NO + +# If the GENERATE_HTMLHELP tag is set to YES, the CHM_FILE tag can +# be used to specify the file name of the resulting .chm file. You +# can add a path in front of the file if the result should not be +# written to the html output directory. + +CHM_FILE = + +# If the GENERATE_HTMLHELP tag is set to YES, the HHC_LOCATION tag can +# be used to specify the location (absolute path including file name) of +# the HTML help compiler (hhc.exe). If non-empty doxygen will try to run +# the HTML help compiler on the generated index.hhp. + +HHC_LOCATION = + +# If the GENERATE_HTMLHELP tag is set to YES, the GENERATE_CHI flag +# controls if a separate .chi index file is generated (YES) or that +# it should be included in the master .chm file (NO). + +GENERATE_CHI = NO + +# If the GENERATE_HTMLHELP tag is set to YES, the CHM_INDEX_ENCODING +# is used to encode HtmlHelp index (hhk), content (hhc) and project file +# content. + +CHM_INDEX_ENCODING = + +# If the GENERATE_HTMLHELP tag is set to YES, the BINARY_TOC flag +# controls whether a binary table of contents is generated (YES) or a +# normal table of contents (NO) in the .chm file. + +BINARY_TOC = NO + +# The TOC_EXPAND flag can be set to YES to add extra items for group members +# to the contents of the HTML help documentation and to the tree view. + +TOC_EXPAND = NO + +# If the GENERATE_QHP tag is set to YES and both QHP_NAMESPACE and +# QHP_VIRTUAL_FOLDER are set, an additional index file will be generated +# that can be used as input for Qt's qhelpgenerator to generate a +# Qt Compressed Help (.qch) of the generated HTML documentation. + +GENERATE_QHP = NO + +# If the QHG_LOCATION tag is specified, the QCH_FILE tag can +# be used to specify the file name of the resulting .qch file. +# The path specified is relative to the HTML output folder. + +QCH_FILE = + +# The QHP_NAMESPACE tag specifies the namespace to use when generating +# Qt Help Project output. For more information please see +# http://doc.trolltech.com/qthelpproject.html#namespace + +QHP_NAMESPACE = org.doxygen.Project + +# The QHP_VIRTUAL_FOLDER tag specifies the namespace to use when generating +# Qt Help Project output. For more information please see +# http://doc.trolltech.com/qthelpproject.html#virtual-folders + +QHP_VIRTUAL_FOLDER = doc + +# If QHP_CUST_FILTER_NAME is set, it specifies the name of a custom filter to +# add. For more information please see +# http://doc.trolltech.com/qthelpproject.html#custom-filters + +QHP_CUST_FILTER_NAME = + +# The QHP_CUST_FILT_ATTRS tag specifies the list of the attributes of the +# custom filter to add. For more information please see +# +# Qt Help Project / Custom Filters. + +QHP_CUST_FILTER_ATTRS = + +# The QHP_SECT_FILTER_ATTRS tag specifies the list of the attributes this +# project's +# filter section matches. +# +# Qt Help Project / Filter Attributes. + +QHP_SECT_FILTER_ATTRS = + +# If the GENERATE_QHP tag is set to YES, the QHG_LOCATION tag can +# be used to specify the location of Qt's qhelpgenerator. +# If non-empty doxygen will try to run qhelpgenerator on the generated +# .qhp file. + +QHG_LOCATION = + +# If the GENERATE_ECLIPSEHELP tag is set to YES, additional index files +# will be generated, which together with the HTML files, form an Eclipse help +# plugin. To install this plugin and make it available under the help contents +# menu in Eclipse, the contents of the directory containing the HTML and XML +# files needs to be copied into the plugins directory of eclipse. The name of +# the directory within the plugins directory should be the same as +# the ECLIPSE_DOC_ID value. After copying Eclipse needs to be restarted before +# the help appears. + +GENERATE_ECLIPSEHELP = NO + +# A unique identifier for the eclipse help plugin. When installing the plugin +# the directory name containing the HTML and XML files should also have +# this name. + +ECLIPSE_DOC_ID = org.doxygen.Project + +# The DISABLE_INDEX tag can be used to turn on/off the condensed index (tabs) +# at top of each HTML page. The value NO (the default) enables the index and +# the value YES disables it. Since the tabs have the same information as the +# navigation tree you can set this option to NO if you already set +# GENERATE_TREEVIEW to YES. + +DISABLE_INDEX = NO + +# The GENERATE_TREEVIEW tag is used to specify whether a tree-like index +# structure should be generated to display hierarchical information. +# If the tag value is set to YES, a side panel will be generated +# containing a tree-like index structure (just like the one that +# is generated for HTML Help). For this to work a browser that supports +# JavaScript, DHTML, CSS and frames is required (i.e. any modern browser). +# Windows users are probably better off using the HTML help feature. +# Since the tree basically has the same information as the tab index you +# could consider to set DISABLE_INDEX to NO when enabling this option. + +GENERATE_TREEVIEW = NO + +# The ENUM_VALUES_PER_LINE tag can be used to set the number of enum values +# (range [0,1..20]) that doxygen will group on one line in the generated HTML +# documentation. Note that a value of 0 will completely suppress the enum +# values from appearing in the overview section. + +ENUM_VALUES_PER_LINE = 4 + +# If the treeview is enabled (see GENERATE_TREEVIEW) then this tag can be +# used to set the initial width (in pixels) of the frame in which the tree +# is shown. + +TREEVIEW_WIDTH = 250 + +# When the EXT_LINKS_IN_WINDOW option is set to YES doxygen will open +# links to external symbols imported via tag files in a separate window. + +EXT_LINKS_IN_WINDOW = NO + +# Use this tag to change the font size of Latex formulas included +# as images in the HTML documentation. The default is 10. Note that +# when you change the font size after a successful doxygen run you need +# to manually remove any form_*.png images from the HTML output directory +# to force them to be regenerated. + +FORMULA_FONTSIZE = 10 + +# Use the FORMULA_TRANPARENT tag to determine whether or not the images +# generated for formulas are transparent PNGs. Transparent PNGs are +# not supported properly for IE 6.0, but are supported on all modern browsers. +# Note that when changing this option you need to delete any form_*.png files +# in the HTML output before the changes have effect. + +FORMULA_TRANSPARENT = YES + +# Enable the USE_MATHJAX option to render LaTeX formulas using MathJax +# (see http://www.mathjax.org) which uses client side Javascript for the +# rendering instead of using prerendered bitmaps. Use this if you do not +# have LaTeX installed or if you want to formulas look prettier in the HTML +# output. When enabled you may also need to install MathJax separately and +# configure the path to it using the MATHJAX_RELPATH option. + +USE_MATHJAX = NO + +# When MathJax is enabled you can set the default output format to be used for +# the MathJax output. Supported types are HTML-CSS, NativeMML (i.e. MathML) and +# SVG. The default value is HTML-CSS, which is slower, but has the best +# compatibility. + +MATHJAX_FORMAT = HTML-CSS + +# When MathJax is enabled you need to specify the location relative to the +# HTML output directory using the MATHJAX_RELPATH option. The destination +# directory should contain the MathJax.js script. For instance, if the mathjax +# directory is located at the same level as the HTML output directory, then +# MATHJAX_RELPATH should be ../mathjax. The default value points to +# the MathJax Content Delivery Network so you can quickly see the result without +# installing MathJax. +# However, it is strongly recommended to install a local +# copy of MathJax from http://www.mathjax.org before deployment. + +MATHJAX_RELPATH = http://cdn.mathjax.org/mathjax/latest + +# The MATHJAX_EXTENSIONS tag can be used to specify one or MathJax extension +# names that should be enabled during MathJax rendering. + +MATHJAX_EXTENSIONS = + +# The MATHJAX_CODEFILE tag can be used to specify a file with javascript +# pieces of code that will be used on startup of the MathJax code. + +MATHJAX_CODEFILE = + +# When the SEARCHENGINE tag is enabled doxygen will generate a search box +# for the HTML output. The underlying search engine uses javascript +# and DHTML and should work on any modern browser. Note that when using +# HTML help (GENERATE_HTMLHELP), Qt help (GENERATE_QHP), or docsets +# (GENERATE_DOCSET) there is already a search function so this one should +# typically be disabled. For large projects the javascript based search engine +# can be slow, then enabling SERVER_BASED_SEARCH may provide a better solution. + +SEARCHENGINE = YES + +# When the SERVER_BASED_SEARCH tag is enabled the search engine will be +# implemented using a web server instead of a web client using Javascript. +# There are two flavours of web server based search depending on the +# EXTERNAL_SEARCH setting. When disabled, doxygen will generate a PHP script for +# searching and an index file used by the script. When EXTERNAL_SEARCH is +# enabled the indexing and searching needs to be provided by external tools. +# See the manual for details. + +SERVER_BASED_SEARCH = NO + +# When EXTERNAL_SEARCH is enabled doxygen will no longer generate the PHP +# script for searching. Instead the search results are written to an XML file +# which needs to be processed by an external indexer. Doxygen will invoke an +# external search engine pointed to by the SEARCHENGINE_URL option to obtain +# the search results. Doxygen ships with an example indexer (doxyindexer) and +# search engine (doxysearch.cgi) which are based on the open source search +# engine library Xapian. See the manual for configuration details. + +EXTERNAL_SEARCH = NO + +# The SEARCHENGINE_URL should point to a search engine hosted by a web server +# which will returned the search results when EXTERNAL_SEARCH is enabled. +# Doxygen ships with an example search engine (doxysearch) which is based on +# the open source search engine library Xapian. See the manual for configuration +# details. + +SEARCHENGINE_URL = + +# When SERVER_BASED_SEARCH and EXTERNAL_SEARCH are both enabled the unindexed +# search data is written to a file for indexing by an external tool. With the +# SEARCHDATA_FILE tag the name of this file can be specified. + +SEARCHDATA_FILE = searchdata.xml + +# When SERVER_BASED_SEARCH AND EXTERNAL_SEARCH are both enabled the +# EXTERNAL_SEARCH_ID tag can be used as an identifier for the project. This is +# useful in combination with EXTRA_SEARCH_MAPPINGS to search through multiple +# projects and redirect the results back to the right project. + +EXTERNAL_SEARCH_ID = + +# The EXTRA_SEARCH_MAPPINGS tag can be used to enable searching through doxygen +# projects other than the one defined by this configuration file, but that are +# all added to the same external search index. Each project needs to have a +# unique id set via EXTERNAL_SEARCH_ID. The search mapping then maps the id +# of to a relative location where the documentation can be found. +# The format is: EXTRA_SEARCH_MAPPINGS = id1=loc1 id2=loc2 ... + +EXTRA_SEARCH_MAPPINGS = + +#--------------------------------------------------------------------------- +# configuration options related to the LaTeX output +#--------------------------------------------------------------------------- + +# If the GENERATE_LATEX tag is set to YES (the default) Doxygen will +# generate Latex output. + +GENERATE_LATEX = NO + +# The LATEX_OUTPUT tag is used to specify where the LaTeX docs will be put. +# If a relative path is entered the value of OUTPUT_DIRECTORY will be +# put in front of it. If left blank `latex' will be used as the default path. + +LATEX_OUTPUT = latex + +# The LATEX_CMD_NAME tag can be used to specify the LaTeX command name to be +# invoked. If left blank `latex' will be used as the default command name. +# Note that when enabling USE_PDFLATEX this option is only used for +# generating bitmaps for formulas in the HTML output, but not in the +# Makefile that is written to the output directory. + +LATEX_CMD_NAME = latex + +# The MAKEINDEX_CMD_NAME tag can be used to specify the command name to +# generate index for LaTeX. If left blank `makeindex' will be used as the +# default command name. + +MAKEINDEX_CMD_NAME = makeindex + +# If the COMPACT_LATEX tag is set to YES Doxygen generates more compact +# LaTeX documents. This may be useful for small projects and may help to +# save some trees in general. + +COMPACT_LATEX = NO + +# The PAPER_TYPE tag can be used to set the paper type that is used +# by the printer. Possible values are: a4, letter, legal and +# executive. If left blank a4 will be used. + +PAPER_TYPE = a4 + +# The EXTRA_PACKAGES tag can be to specify one or more names of LaTeX +# packages that should be included in the LaTeX output. + +EXTRA_PACKAGES = + +# The LATEX_HEADER tag can be used to specify a personal LaTeX header for +# the generated latex document. The header should contain everything until +# the first chapter. If it is left blank doxygen will generate a +# standard header. Notice: only use this tag if you know what you are doing! + +LATEX_HEADER = + +# The LATEX_FOOTER tag can be used to specify a personal LaTeX footer for +# the generated latex document. The footer should contain everything after +# the last chapter. If it is left blank doxygen will generate a +# standard footer. Notice: only use this tag if you know what you are doing! + +LATEX_FOOTER = + +# The LATEX_EXTRA_FILES tag can be used to specify one or more extra images +# or other source files which should be copied to the LaTeX output directory. +# Note that the files will be copied as-is; there are no commands or markers +# available. + +LATEX_EXTRA_FILES = + +# If the PDF_HYPERLINKS tag is set to YES, the LaTeX that is generated +# is prepared for conversion to pdf (using ps2pdf). The pdf file will +# contain links (just like the HTML output) instead of page references +# This makes the output suitable for online browsing using a pdf viewer. + +PDF_HYPERLINKS = YES + +# If the USE_PDFLATEX tag is set to YES, pdflatex will be used instead of +# plain latex in the generated Makefile. Set this option to YES to get a +# higher quality PDF documentation. + +USE_PDFLATEX = YES + +# If the LATEX_BATCHMODE tag is set to YES, doxygen will add the \\batchmode. +# command to the generated LaTeX files. This will instruct LaTeX to keep +# running if errors occur, instead of asking the user for help. +# This option is also used when generating formulas in HTML. + +LATEX_BATCHMODE = NO + +# If LATEX_HIDE_INDICES is set to YES then doxygen will not +# include the index chapters (such as File Index, Compound Index, etc.) +# in the output. + +LATEX_HIDE_INDICES = NO + +# If LATEX_SOURCE_CODE is set to YES then doxygen will include +# source code with syntax highlighting in the LaTeX output. +# Note that which sources are shown also depends on other settings +# such as SOURCE_BROWSER. + +LATEX_SOURCE_CODE = NO + +# The LATEX_BIB_STYLE tag can be used to specify the style to use for the +# bibliography, e.g. plainnat, or ieeetr. The default style is "plain". See +# http://en.wikipedia.org/wiki/BibTeX for more info. + +LATEX_BIB_STYLE = plain + +#--------------------------------------------------------------------------- +# configuration options related to the RTF output +#--------------------------------------------------------------------------- + +# If the GENERATE_RTF tag is set to YES Doxygen will generate RTF output +# The RTF output is optimized for Word 97 and may not look very pretty with +# other RTF readers or editors. + +GENERATE_RTF = NO + +# The RTF_OUTPUT tag is used to specify where the RTF docs will be put. +# If a relative path is entered the value of OUTPUT_DIRECTORY will be +# put in front of it. If left blank `rtf' will be used as the default path. + +RTF_OUTPUT = rtf + +# If the COMPACT_RTF tag is set to YES Doxygen generates more compact +# RTF documents. This may be useful for small projects and may help to +# save some trees in general. + +COMPACT_RTF = NO + +# If the RTF_HYPERLINKS tag is set to YES, the RTF that is generated +# will contain hyperlink fields. The RTF file will +# contain links (just like the HTML output) instead of page references. +# This makes the output suitable for online browsing using WORD or other +# programs which support those fields. +# Note: wordpad (write) and others do not support links. + +RTF_HYPERLINKS = NO + +# Load style sheet definitions from file. Syntax is similar to doxygen's +# config file, i.e. a series of assignments. You only have to provide +# replacements, missing definitions are set to their default value. + +RTF_STYLESHEET_FILE = + +# Set optional variables used in the generation of an rtf document. +# Syntax is similar to doxygen's config file. + +RTF_EXTENSIONS_FILE = + +#--------------------------------------------------------------------------- +# configuration options related to the man page output +#--------------------------------------------------------------------------- + +# If the GENERATE_MAN tag is set to YES (the default) Doxygen will +# generate man pages + +GENERATE_MAN = NO + +# The MAN_OUTPUT tag is used to specify where the man pages will be put. +# If a relative path is entered the value of OUTPUT_DIRECTORY will be +# put in front of it. If left blank `man' will be used as the default path. + +MAN_OUTPUT = man + +# The MAN_EXTENSION tag determines the extension that is added to +# the generated man pages (default is the subroutine's section .3) + +MAN_EXTENSION = .3 + +# If the MAN_LINKS tag is set to YES and Doxygen generates man output, +# then it will generate one additional man file for each entity +# documented in the real man page(s). These additional files +# only source the real man page, but without them the man command +# would be unable to find the correct page. The default is NO. + +MAN_LINKS = NO + +#--------------------------------------------------------------------------- +# configuration options related to the XML output +#--------------------------------------------------------------------------- + +# If the GENERATE_XML tag is set to YES Doxygen will +# generate an XML file that captures the structure of +# the code including all documentation. + +GENERATE_XML = NO + +# The XML_OUTPUT tag is used to specify where the XML pages will be put. +# If a relative path is entered the value of OUTPUT_DIRECTORY will be +# put in front of it. If left blank `xml' will be used as the default path. + +XML_OUTPUT = xml + +# The XML_SCHEMA tag can be used to specify an XML schema, +# which can be used by a validating XML parser to check the +# syntax of the XML files. + +XML_SCHEMA = + +# The XML_DTD tag can be used to specify an XML DTD, +# which can be used by a validating XML parser to check the +# syntax of the XML files. + +XML_DTD = + +# If the XML_PROGRAMLISTING tag is set to YES Doxygen will +# dump the program listings (including syntax highlighting +# and cross-referencing information) to the XML output. Note that +# enabling this will significantly increase the size of the XML output. + +XML_PROGRAMLISTING = YES + +#--------------------------------------------------------------------------- +# configuration options related to the DOCBOOK output +#--------------------------------------------------------------------------- + +# If the GENERATE_DOCBOOK tag is set to YES Doxygen will generate DOCBOOK files +# that can be used to generate PDF. + +GENERATE_DOCBOOK = NO + +# The DOCBOOK_OUTPUT tag is used to specify where the DOCBOOK pages will be put. +# If a relative path is entered the value of OUTPUT_DIRECTORY will be put in +# front of it. If left blank docbook will be used as the default path. + +DOCBOOK_OUTPUT = docbook + +#--------------------------------------------------------------------------- +# configuration options for the AutoGen Definitions output +#--------------------------------------------------------------------------- + +# If the GENERATE_AUTOGEN_DEF tag is set to YES Doxygen will +# generate an AutoGen Definitions (see autogen.sf.net) file +# that captures the structure of the code including all +# documentation. Note that this feature is still experimental +# and incomplete at the moment. + +GENERATE_AUTOGEN_DEF = NO + +#--------------------------------------------------------------------------- +# configuration options related to the Perl module output +#--------------------------------------------------------------------------- + +# If the GENERATE_PERLMOD tag is set to YES Doxygen will +# generate a Perl module file that captures the structure of +# the code including all documentation. Note that this +# feature is still experimental and incomplete at the +# moment. + +GENERATE_PERLMOD = NO + +# If the PERLMOD_LATEX tag is set to YES Doxygen will generate +# the necessary Makefile rules, Perl scripts and LaTeX code to be able +# to generate PDF and DVI output from the Perl module output. + +PERLMOD_LATEX = NO + +# If the PERLMOD_PRETTY tag is set to YES the Perl module output will be +# nicely formatted so it can be parsed by a human reader. +# This is useful +# if you want to understand what is going on. +# On the other hand, if this +# tag is set to NO the size of the Perl module output will be much smaller +# and Perl will parse it just the same. + +PERLMOD_PRETTY = YES + +# The names of the make variables in the generated doxyrules.make file +# are prefixed with the string contained in PERLMOD_MAKEVAR_PREFIX. +# This is useful so different doxyrules.make files included by the same +# Makefile don't overwrite each other's variables. + +PERLMOD_MAKEVAR_PREFIX = + +#--------------------------------------------------------------------------- +# Configuration options related to the preprocessor +#--------------------------------------------------------------------------- + +# If the ENABLE_PREPROCESSING tag is set to YES (the default) Doxygen will +# evaluate all C-preprocessor directives found in the sources and include +# files. + +ENABLE_PREPROCESSING = YES + +# If the MACRO_EXPANSION tag is set to YES Doxygen will expand all macro +# names in the source code. If set to NO (the default) only conditional +# compilation will be performed. Macro expansion can be done in a controlled +# way by setting EXPAND_ONLY_PREDEF to YES. + +MACRO_EXPANSION = NO + +# If the EXPAND_ONLY_PREDEF and MACRO_EXPANSION tags are both set to YES +# then the macro expansion is limited to the macros specified with the +# PREDEFINED and EXPAND_AS_DEFINED tags. + +EXPAND_ONLY_PREDEF = NO + +# If the SEARCH_INCLUDES tag is set to YES (the default) the includes files +# pointed to by INCLUDE_PATH will be searched when a #include is found. + +SEARCH_INCLUDES = YES + +# The INCLUDE_PATH tag can be used to specify one or more directories that +# contain include files that are not input files but should be processed by +# the preprocessor. + +INCLUDE_PATH = + +# You can use the INCLUDE_FILE_PATTERNS tag to specify one or more wildcard +# patterns (like *.h and *.hpp) to filter out the header-files in the +# directories. If left blank, the patterns specified with FILE_PATTERNS will +# be used. + +INCLUDE_FILE_PATTERNS = + +# The PREDEFINED tag can be used to specify one or more macro names that +# are defined before the preprocessor is started (similar to the -D option of +# gcc). The argument of the tag is a list of macros of the form: name +# or name=definition (no spaces). If the definition and the = are +# omitted =1 is assumed. To prevent a macro definition from being +# undefined via #undef or recursively expanded use the := operator +# instead of the = operator. + +PREDEFINED = + +# If the MACRO_EXPANSION and EXPAND_ONLY_PREDEF tags are set to YES then +# this tag can be used to specify a list of macro names that should be expanded. +# The macro definition that is found in the sources will be used. +# Use the PREDEFINED tag if you want to use a different macro definition that +# overrules the definition found in the source code. + +EXPAND_AS_DEFINED = + +# If the SKIP_FUNCTION_MACROS tag is set to YES (the default) then +# doxygen's preprocessor will remove all references to function-like macros +# that are alone on a line, have an all uppercase name, and do not end with a +# semicolon, because these will confuse the parser if not removed. + +SKIP_FUNCTION_MACROS = YES + +#--------------------------------------------------------------------------- +# Configuration::additions related to external references +#--------------------------------------------------------------------------- + +# The TAGFILES option can be used to specify one or more tagfiles. For each +# tag file the location of the external documentation should be added. The +# format of a tag file without this location is as follows: +# +# TAGFILES = file1 file2 ... +# Adding location for the tag files is done as follows: +# +# TAGFILES = file1=loc1 "file2 = loc2" ... +# where "loc1" and "loc2" can be relative or absolute paths +# or URLs. Note that each tag file must have a unique name (where the name does +# NOT include the path). If a tag file is not located in the directory in which +# doxygen is run, you must also specify the path to the tagfile here. + +TAGFILES = + +# When a file name is specified after GENERATE_TAGFILE, doxygen will create +# a tag file that is based on the input files it reads. + +GENERATE_TAGFILE = + +# If the ALLEXTERNALS tag is set to YES all external classes will be listed +# in the class index. If set to NO only the inherited external classes +# will be listed. + +ALLEXTERNALS = NO + +# If the EXTERNAL_GROUPS tag is set to YES all external groups will be listed +# in the modules index. If set to NO, only the current project's groups will +# be listed. + +EXTERNAL_GROUPS = YES + +# If the EXTERNAL_PAGES tag is set to YES all external pages will be listed +# in the related pages index. If set to NO, only the current project's +# pages will be listed. + +EXTERNAL_PAGES = YES + +# The PERL_PATH should be the absolute path and name of the perl script +# interpreter (i.e. the result of `which perl'). + +PERL_PATH = /usr/bin/perl + +#--------------------------------------------------------------------------- +# Configuration options related to the dot tool +#--------------------------------------------------------------------------- + +# If the CLASS_DIAGRAMS tag is set to YES (the default) Doxygen will +# generate a inheritance diagram (in HTML, RTF and LaTeX) for classes with base +# or super classes. Setting the tag to NO turns the diagrams off. Note that +# this option also works with HAVE_DOT disabled, but it is recommended to +# install and use dot, since it yields more powerful graphs. + +CLASS_DIAGRAMS = YES + +# You can define message sequence charts within doxygen comments using the \msc +# command. Doxygen will then run the mscgen tool (see +# http://www.mcternan.me.uk/mscgen/) to produce the chart and insert it in the +# documentation. The MSCGEN_PATH tag allows you to specify the directory where +# the mscgen tool resides. If left empty the tool is assumed to be found in the +# default search path. + +MSCGEN_PATH = + +# If set to YES, the inheritance and collaboration graphs will hide +# inheritance and usage relations if the target is undocumented +# or is not a class. + +HIDE_UNDOC_RELATIONS = YES + +# If you set the HAVE_DOT tag to YES then doxygen will assume the dot tool is +# available from the path. This tool is part of Graphviz, a graph visualization +# toolkit from AT&T and Lucent Bell Labs. The other options in this section +# have no effect if this option is set to NO (the default) + +HAVE_DOT = NO + +# The DOT_NUM_THREADS specifies the number of dot invocations doxygen is +# allowed to run in parallel. When set to 0 (the default) doxygen will +# base this on the number of processors available in the system. You can set it +# explicitly to a value larger than 0 to get control over the balance +# between CPU load and processing speed. + +DOT_NUM_THREADS = 0 + +# By default doxygen will use the Helvetica font for all dot files that +# doxygen generates. When you want a differently looking font you can specify +# the font name using DOT_FONTNAME. You need to make sure dot is able to find +# the font, which can be done by putting it in a standard location or by setting +# the DOTFONTPATH environment variable or by setting DOT_FONTPATH to the +# directory containing the font. + +DOT_FONTNAME = Helvetica + +# The DOT_FONTSIZE tag can be used to set the size of the font of dot graphs. +# The default size is 10pt. + +DOT_FONTSIZE = 10 + +# By default doxygen will tell dot to use the Helvetica font. +# If you specify a different font using DOT_FONTNAME you can use DOT_FONTPATH to +# set the path where dot can find it. + +DOT_FONTPATH = + +# If the CLASS_GRAPH and HAVE_DOT tags are set to YES then doxygen +# will generate a graph for each documented class showing the direct and +# indirect inheritance relations. Setting this tag to YES will force the +# CLASS_DIAGRAMS tag to NO. + +CLASS_GRAPH = YES + +# If the COLLABORATION_GRAPH and HAVE_DOT tags are set to YES then doxygen +# will generate a graph for each documented class showing the direct and +# indirect implementation dependencies (inheritance, containment, and +# class references variables) of the class with other documented classes. + +COLLABORATION_GRAPH = YES + +# If the GROUP_GRAPHS and HAVE_DOT tags are set to YES then doxygen +# will generate a graph for groups, showing the direct groups dependencies + +GROUP_GRAPHS = YES + +# If the UML_LOOK tag is set to YES doxygen will generate inheritance and +# collaboration diagrams in a style similar to the OMG's Unified Modeling +# Language. + +UML_LOOK = NO + +# If the UML_LOOK tag is enabled, the fields and methods are shown inside +# the class node. If there are many fields or methods and many nodes the +# graph may become too big to be useful. The UML_LIMIT_NUM_FIELDS +# threshold limits the number of items for each type to make the size more +# manageable. Set this to 0 for no limit. Note that the threshold may be +# exceeded by 50% before the limit is enforced. + +UML_LIMIT_NUM_FIELDS = 10 + +# If set to YES, the inheritance and collaboration graphs will show the +# relations between templates and their instances. + +TEMPLATE_RELATIONS = NO + +# If the ENABLE_PREPROCESSING, SEARCH_INCLUDES, INCLUDE_GRAPH, and HAVE_DOT +# tags are set to YES then doxygen will generate a graph for each documented +# file showing the direct and indirect include dependencies of the file with +# other documented files. + +INCLUDE_GRAPH = YES + +# If the ENABLE_PREPROCESSING, SEARCH_INCLUDES, INCLUDED_BY_GRAPH, and +# HAVE_DOT tags are set to YES then doxygen will generate a graph for each +# documented header file showing the documented files that directly or +# indirectly include this file. + +INCLUDED_BY_GRAPH = YES + +# If the CALL_GRAPH and HAVE_DOT options are set to YES then +# doxygen will generate a call dependency graph for every global function +# or class method. Note that enabling this option will significantly increase +# the time of a run. So in most cases it will be better to enable call graphs +# for selected functions only using the \callgraph command. + +CALL_GRAPH = NO + +# If the CALLER_GRAPH and HAVE_DOT tags are set to YES then +# doxygen will generate a caller dependency graph for every global function +# or class method. Note that enabling this option will significantly increase +# the time of a run. So in most cases it will be better to enable caller +# graphs for selected functions only using the \callergraph command. + +CALLER_GRAPH = NO + +# If the GRAPHICAL_HIERARCHY and HAVE_DOT tags are set to YES then doxygen +# will generate a graphical hierarchy of all classes instead of a textual one. + +GRAPHICAL_HIERARCHY = YES + +# If the DIRECTORY_GRAPH and HAVE_DOT tags are set to YES +# then doxygen will show the dependencies a directory has on other directories +# in a graphical way. The dependency relations are determined by the #include +# relations between the files in the directories. + +DIRECTORY_GRAPH = YES + +# The DOT_IMAGE_FORMAT tag can be used to set the image format of the images +# generated by dot. Possible values are svg, png, jpg, or gif. +# If left blank png will be used. If you choose svg you need to set +# HTML_FILE_EXTENSION to xhtml in order to make the SVG files +# visible in IE 9+ (other browsers do not have this requirement). + +DOT_IMAGE_FORMAT = png + +# If DOT_IMAGE_FORMAT is set to svg, then this option can be set to YES to +# enable generation of interactive SVG images that allow zooming and panning. +# Note that this requires a modern browser other than Internet Explorer. +# Tested and working are Firefox, Chrome, Safari, and Opera. For IE 9+ you +# need to set HTML_FILE_EXTENSION to xhtml in order to make the SVG files +# visible. Older versions of IE do not have SVG support. + +INTERACTIVE_SVG = NO + +# The tag DOT_PATH can be used to specify the path where the dot tool can be +# found. If left blank, it is assumed the dot tool can be found in the path. + +DOT_PATH = + +# The DOTFILE_DIRS tag can be used to specify one or more directories that +# contain dot files that are included in the documentation (see the +# \dotfile command). + +DOTFILE_DIRS = + +# The MSCFILE_DIRS tag can be used to specify one or more directories that +# contain msc files that are included in the documentation (see the +# \mscfile command). + +MSCFILE_DIRS = + +# The DOT_GRAPH_MAX_NODES tag can be used to set the maximum number of +# nodes that will be shown in the graph. If the number of nodes in a graph +# becomes larger than this value, doxygen will truncate the graph, which is +# visualized by representing a node as a red box. Note that doxygen if the +# number of direct children of the root node in a graph is already larger than +# DOT_GRAPH_MAX_NODES then the graph will not be shown at all. Also note +# that the size of a graph can be further restricted by MAX_DOT_GRAPH_DEPTH. + +DOT_GRAPH_MAX_NODES = 50 + +# The MAX_DOT_GRAPH_DEPTH tag can be used to set the maximum depth of the +# graphs generated by dot. A depth value of 3 means that only nodes reachable +# from the root by following a path via at most 3 edges will be shown. Nodes +# that lay further from the root node will be omitted. Note that setting this +# option to 1 or 2 may greatly reduce the computation time needed for large +# code bases. Also note that the size of a graph can be further restricted by +# DOT_GRAPH_MAX_NODES. Using a depth of 0 means no depth restriction. + +MAX_DOT_GRAPH_DEPTH = 0 + +# Set the DOT_TRANSPARENT tag to YES to generate images with a transparent +# background. This is disabled by default, because dot on Windows does not +# seem to support this out of the box. Warning: Depending on the platform used, +# enabling this option may lead to badly anti-aliased labels on the edges of +# a graph (i.e. they become hard to read). + +DOT_TRANSPARENT = NO + +# Set the DOT_MULTI_TARGETS tag to YES allow dot to generate multiple output +# files in one run (i.e. multiple -o and -T options on the command line). This +# makes dot run faster, but since only newer versions of dot (>1.8.10) +# support this, this feature is disabled by default. + +DOT_MULTI_TARGETS = YES + +# If the GENERATE_LEGEND tag is set to YES (the default) Doxygen will +# generate a legend page explaining the meaning of the various boxes and +# arrows in the dot generated graphs. + +GENERATE_LEGEND = YES + +# If the DOT_CLEANUP tag is set to YES (the default) Doxygen will +# remove the intermediate dot files that are used to generate +# the various graphs. + +DOT_CLEANUP = YES diff --git a/securemail/vendor/singpolyma/openpgp-php/README b/securemail/vendor/singpolyma/openpgp-php/README new file mode 100644 index 00000000..42061c01 --- /dev/null +++ b/securemail/vendor/singpolyma/openpgp-php/README @@ -0,0 +1 @@ +README.md \ No newline at end of file diff --git a/securemail/vendor/singpolyma/openpgp-php/README.md b/securemail/vendor/singpolyma/openpgp-php/README.md index 302b502d..099f520a 100644 --- a/securemail/vendor/singpolyma/openpgp-php/README.md +++ b/securemail/vendor/singpolyma/openpgp-php/README.md @@ -30,7 +30,8 @@ Users OpenPGP.php is currently being used in the following projects: -* +* +* Download -------- diff --git a/securemail/vendor/singpolyma/openpgp-php/VERSION b/securemail/vendor/singpolyma/openpgp-php/VERSION index 8acdd82b..0d91a54c 100644 --- a/securemail/vendor/singpolyma/openpgp-php/VERSION +++ b/securemail/vendor/singpolyma/openpgp-php/VERSION @@ -1 +1 @@ -0.0.1 +0.3.0 diff --git a/securemail/vendor/singpolyma/openpgp-php/composer.json b/securemail/vendor/singpolyma/openpgp-php/composer.json new file mode 100644 index 00000000..6acc8c46 --- /dev/null +++ b/securemail/vendor/singpolyma/openpgp-php/composer.json @@ -0,0 +1,24 @@ +{ + "name": "singpolyma/openpgp-php", + "description": "Pure-PHP implementation of the OpenPGP Message Format (RFC 4880)", + "license": "Unlicense", + "authors": [ + { + "name": "Arto Bendiken", + "email": "arto.bendiken@gmail.com" + }, + { + "name": "Stephen Paul Weber", + "email": "singpolyma@singpolyma.net" + } + ], + "require": { + "phpseclib/phpseclib": ">=2.0.0 <=2.0.4" + }, + "require-dev": { + "phpunit/phpunit": "~4.0" + }, + "autoload": { + "classmap": ["lib/"] + } +} diff --git a/securemail/vendor/singpolyma/openpgp-php/examples/clearsign.php b/securemail/vendor/singpolyma/openpgp-php/examples/clearsign.php new file mode 100644 index 00000000..686af02f --- /dev/null +++ b/securemail/vendor/singpolyma/openpgp-php/examples/clearsign.php @@ -0,0 +1,31 @@ + 'u', 'filename' => 'stuff.txt')); +$data->normalize(true); // Clearsign-style normalization of the LiteralDataPacket + +/* Create a signer from the key */ +$sign = new OpenPGP_Crypt_RSA($wkey); + +/* The message is the signed data packet */ +$m = $sign->sign($data); + +/* Generate clearsigned data */ +$packets = $m->signatures()[0]; +echo "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\n"; +// Output normalised data. You could convert line endings here +// without breaking the signature, but do not add any +// trailing whitespace to lines. +echo preg_replace("/^-/", "- -", $packets[0]->data)."\n"; +echo OpenPGP::enarmor($packets[1][0]->to_bytes(), "PGP SIGNATURE"); + +?> diff --git a/securemail/vendor/singpolyma/openpgp-php/examples/deASCIIdeCrypt.php b/securemail/vendor/singpolyma/openpgp-php/examples/deASCIIdeCrypt.php new file mode 100644 index 00000000..9ab6cdd2 --- /dev/null +++ b/securemail/vendor/singpolyma/openpgp-php/examples/deASCIIdeCrypt.php @@ -0,0 +1,27 @@ +decrypt($msg); + + var_dump($decrypted); +} diff --git a/securemail/vendor/singpolyma/openpgp-php/examples/encryptDecrypt.php b/securemail/vendor/singpolyma/openpgp-php/examples/encryptDecrypt.php new file mode 100644 index 00000000..7804967f --- /dev/null +++ b/securemail/vendor/singpolyma/openpgp-php/examples/encryptDecrypt.php @@ -0,0 +1,15 @@ + 'u', 'filename' => 'stuff.txt')); +$encrypted = OpenPGP_Crypt_Symmetric::encrypt($key, new OpenPGP_Message(array($data))); + +// Now decrypt it with the same key +$decryptor = new OpenPGP_Crypt_RSA($key); +$decrypted = $decryptor->decrypt($encrypted); + +var_dump($decrypted); diff --git a/securemail/vendor/singpolyma/openpgp-php/examples/keygen.php b/securemail/vendor/singpolyma/openpgp-php/examples/keygen.php new file mode 100644 index 00000000..1bc03afd --- /dev/null +++ b/securemail/vendor/singpolyma/openpgp-php/examples/keygen.php @@ -0,0 +1,31 @@ +createKey(512); +$rsa->loadKey($k['privatekey']); + +$nkey = new OpenPGP_SecretKeyPacket(array( + 'n' => $rsa->modulus->toBytes(), + 'e' => $rsa->publicExponent->toBytes(), + 'd' => $rsa->exponent->toBytes(), + 'p' => $rsa->primes[2]->toBytes(), + 'q' => $rsa->primes[1]->toBytes(), + 'u' => $rsa->coefficients[2]->toBytes() +)); + +$uid = new OpenPGP_UserIDPacket('Test '); + +$wkey = new OpenPGP_Crypt_RSA($nkey); +$m = $wkey->sign_key_userid(array($nkey, $uid)); + +// Serialize private key +print $m->to_bytes(); + +// Serialize public key message +$pubm = clone($m); +$pubm[0] = new OpenPGP_PublicKeyPacket($pubm[0]); + +$public_bytes = $pubm->to_bytes(); diff --git a/securemail/vendor/singpolyma/openpgp-php/examples/sign.php b/securemail/vendor/singpolyma/openpgp-php/examples/sign.php new file mode 100644 index 00000000..5e68d642 --- /dev/null +++ b/securemail/vendor/singpolyma/openpgp-php/examples/sign.php @@ -0,0 +1,22 @@ + 'u', 'filename' => 'stuff.txt')); + +/* Create a signer from the key */ +$sign = new OpenPGP_Crypt_RSA($wkey); + +/* The message is the signed data packet */ +$m = $sign->sign($data); + +/* Output the raw message bytes to STDOUT */ +echo $m->to_bytes(); + +?> diff --git a/securemail/vendor/singpolyma/openpgp-php/examples/verify.php b/securemail/vendor/singpolyma/openpgp-php/examples/verify.php new file mode 100644 index 00000000..86501996 --- /dev/null +++ b/securemail/vendor/singpolyma/openpgp-php/examples/verify.php @@ -0,0 +1,18 @@ +verify($m)); + +?> diff --git a/securemail/vendor/singpolyma/openpgp-php/lib/openpgp.php b/securemail/vendor/singpolyma/openpgp-php/lib/openpgp.php index 360fc797..dc659d79 100644 --- a/securemail/vendor/singpolyma/openpgp-php/lib/openpgp.php +++ b/securemail/vendor/singpolyma/openpgp-php/lib/openpgp.php @@ -5,7 +5,7 @@ * (RFC 4880). * * @package OpenPGP - * @version 0.0.1 + * @version 0.3.0 * @author Arto Bendiken * @author Stephen Paul Weber * @see http://github.com/bendiken/openpgp-php @@ -1327,15 +1327,32 @@ class OpenPGP_PublicKeyPacket extends OpenPGP_Packet { function __construct($key=array(), $algorithm='RSA', $timestamp=NULL, $version=4) { parent::__construct(); - $this->key = $key; - if(is_string($this->algorithm = $algorithm)) { - $this->algorithm = array_search($this->algorithm, self::$algorithms); - } - $this->timestamp = $timestamp ? $timestamp : time(); - $this->version = $version; - if(count($this->key) > 0) { - $this->key_id = substr($this->fingerprint(), -8); + if($key instanceof OpenPGP_PublicKeyPacket) { + $this->algorithm = $key->algorithm; + $this->key = array(); + + // Restrict to only the fields we need + foreach (self::$key_fields[$this->algorithm] as $field) { + $this->key[$field] = $key->key[$field]; + } + + $this->key_id = $key->key_id; + $this->fingerprint = $key->fingerprint; + $this->timestamp = $key->timestamp; + $this->version = $key->version; + $this->v3_days_of_validity = $key->v3_days_of_validity; + } else { + $this->key = $key; + if(is_string($this->algorithm = $algorithm)) { + $this->algorithm = array_search($this->algorithm, self::$algorithms); + } + $this->timestamp = $timestamp ? $timestamp : time(); + $this->version = $version; + + if(count($this->key) > 0) { + $this->key_id = substr($this->fingerprint(), -8); + } } } @@ -1685,10 +1702,19 @@ class OpenPGP_LiteralDataPacket extends OpenPGP_Packet { $this->timestamp = isset($opt['timestamp']) ? $opt['timestamp'] : time(); } - function normalize() { + function normalize($clearsign=false) { + if($clearsign && ($this->format != 'u' && $this->format != 't')) { + $this->format = 'u'; // Clearsign must be text + } + if($this->format == 'u' || $this->format == 't') { // Normalize line endings $this->data = str_replace("\n", "\r\n", str_replace("\r", "\n", str_replace("\r\n", "\n", $this->data))); } + + if($clearsign) { + // When clearsigning, do not sign over trailing whitespace + $this->data = preg_replace('/\s+\r/', "\r", $this->data); + } } function read() { diff --git a/securemail/vendor/singpolyma/openpgp-php/lib/openpgp_crypt_rsa.php b/securemail/vendor/singpolyma/openpgp-php/lib/openpgp_crypt_rsa.php index db6156f3..bce11e18 100644 --- a/securemail/vendor/singpolyma/openpgp-php/lib/openpgp_crypt_rsa.php +++ b/securemail/vendor/singpolyma/openpgp-php/lib/openpgp_crypt_rsa.php @@ -7,7 +7,11 @@ */ // From http://phpseclib.sourceforge.net/ -require_once 'Crypt/RSA.php'; +use phpseclib\Crypt\RSA as Crypt_RSA; +use phpseclib\Math\BigInteger as Math_BigInteger; + +define('CRYPT_RSA_ENCRYPTION_PKCS1', Crypt_RSA::ENCRYPTION_PKCS1); +define('CRYPT_RSA_SIGNATURE_PKCS1', Crypt_RSA::SIGNATURE_PKCS1); require_once dirname(__FILE__).'/openpgp.php'; @include_once dirname(__FILE__).'/openpgp_crypt_symmetric.php'; /* For encrypt/decrypt */ @@ -150,7 +154,7 @@ class OpenPGP_Crypt_RSA { if(!$sig) { $sig = new OpenPGP_SignaturePacket($packet, 'RSA', strtoupper($hash)); $sig->signature_type = 0x13; - $sig->hashed_subpackets[] = new OpenPGP_SignaturePacket_KeyFlagsPacket(array(0x01, 0x02)); + $sig->hashed_subpackets[] = new OpenPGP_SignaturePacket_KeyFlagsPacket(array(0x01 | 0x02)); $sig->hashed_subpackets[] = new OpenPGP_SignaturePacket_IssuerPacket($keyid); $packet[] = $sig; } @@ -241,8 +245,18 @@ class OpenPGP_Crypt_RSA { $rsa = self::crypt_rsa_key($mod, $exp); if($private) { - if($packet->key['p'] && $packet->key['q']) $rsa->primes = array($packet->key['p'], $packet->key['q']); - if($packet->key['u']) $rsa->coefficients = array($packet->key['u']); + /** + * @see https://github.com/phpseclib/phpseclib/issues/1113 + * Primes and coefficients now use BigIntegers. + **/ + //set the primes + if($packet->key['p'] && $packet->key['q']) + $rsa->primes = array( + 1 => new Math_BigInteger($packet->key['p'], 256), + 2 => new Math_BigInteger($packet->key['q'], 256) + ); + // set the coefficients + if($packet->key['u']) $rsa->coefficients = array(2 => new Math_BigInteger($packet->key['u'], 256)); } return $rsa; diff --git a/securemail/vendor/singpolyma/openpgp-php/lib/openpgp_crypt_symmetric.php b/securemail/vendor/singpolyma/openpgp-php/lib/openpgp_crypt_symmetric.php index 9833a46c..844c53b2 100644 --- a/securemail/vendor/singpolyma/openpgp-php/lib/openpgp_crypt_symmetric.php +++ b/securemail/vendor/singpolyma/openpgp-php/lib/openpgp_crypt_symmetric.php @@ -1,20 +1,24 @@ setKey($key); $to_encrypt = $prefix . $message->to_bytes(); @@ -36,7 +40,7 @@ class OpenPGP_Crypt_Symmetric { $esk = pack('n', OpenPGP::bitlength($esk)) . $esk; array_unshift($encrypted, new OpenPGP_AsymmetricSessionKeyPacket($pass->algorithm, $pass->fingerprint(), $esk)); } else if(is_string($pass)) { - $s2k = new OpenPGP_S2K(crypt_random_string(10)); + $s2k = new OpenPGP_S2K(Random::string(10)); $cipher->setKey($s2k->make_key($pass, $key_bytes)); $esk = $cipher->encrypt(chr($symmetric_algorithm) . $key); array_unshift($encrypted, new OpenPGP_SymmetricSessionKeyPacket($s2k, $esk, $symmetric_algorithm)); @@ -143,38 +147,32 @@ class OpenPGP_Crypt_Symmetric { $cipher = NULL; switch($algo) { case 2: - if(class_exists('Crypt_TripleDES')) { $cipher = new Crypt_TripleDES(CRYPT_DES_MODE_CFB); $key_bytes = 24; $key_block_bytes = 8; - } break; case 3: if(defined('MCRYPT_CAST_128')) { $cipher = new MCryptWrapper(MCRYPT_CAST_128); + } else { + throw new Exception("Unsupported cipher: you must have mcrypt installed to use CAST5"); } break; case 7: - if(class_exists('Crypt_AES')) { $cipher = new Crypt_AES(CRYPT_AES_MODE_CFB); $cipher->setKeyLength(128); - } break; case 8: - if(class_exists('Crypt_AES')) { $cipher = new Crypt_AES(CRYPT_AES_MODE_CFB); $cipher->setKeyLength(192); - } break; case 9: - if(class_exists('Crypt_AES')) { $cipher = new Crypt_AES(CRYPT_AES_MODE_CFB); $cipher->setKeyLength(256); - } break; } if(!$cipher) return array(NULL, NULL, NULL); // Unsupported cipher - if(!isset($key_bytes)) $key_bytes = $cipher->key_size; + if(!isset($key_bytes)) $key_bytes = isset($cipher->key_size)?$cipher->key_size:$cipher->key_length; if(!isset($key_block_bytes)) $key_block_bytes = $cipher->block_size; return array($cipher, $key_bytes, $key_block_bytes); } diff --git a/securemail/vendor/singpolyma/openpgp-php/phpunit.xml b/securemail/vendor/singpolyma/openpgp-php/phpunit.xml new file mode 100644 index 00000000..a38403e1 --- /dev/null +++ b/securemail/vendor/singpolyma/openpgp-php/phpunit.xml @@ -0,0 +1,27 @@ + + + + tests/suite.php + + + + tests/suite.php + + + + tests/phpseclib_suite.php + + + + tests/phpseclib_suite.php + + + + tests/phpseclib_suite.php + + + + tests/phpseclib_suite.php + + + diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/bootstrap.php b/securemail/vendor/singpolyma/openpgp-php/tests/bootstrap.php new file mode 100644 index 00000000..9635a9c0 --- /dev/null +++ b/securemail/vendor/singpolyma/openpgp-php/tests/bootstrap.php @@ -0,0 +1,2 @@ + \ No newline at end of file diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000003-002.sig b/securemail/vendor/singpolyma/openpgp-php/tests/data/000003-002.sig new file mode 100644 index 00000000..1e0656d2 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000003-002.sig differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000004-012.ring_trust b/securemail/vendor/singpolyma/openpgp-php/tests/data/000004-012.ring_trust new file mode 100644 index 00000000..ffa57e57 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000004-012.ring_trust differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000005-002.sig b/securemail/vendor/singpolyma/openpgp-php/tests/data/000005-002.sig new file mode 100644 index 00000000..108b9984 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000005-002.sig differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000006-012.ring_trust b/securemail/vendor/singpolyma/openpgp-php/tests/data/000006-012.ring_trust new file mode 100644 index 00000000..ffa57e57 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000006-012.ring_trust differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000007-002.sig b/securemail/vendor/singpolyma/openpgp-php/tests/data/000007-002.sig new file mode 100644 index 00000000..14276d0a Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000007-002.sig differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000008-012.ring_trust b/securemail/vendor/singpolyma/openpgp-php/tests/data/000008-012.ring_trust new file mode 100644 index 00000000..ffa57e57 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000008-012.ring_trust differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000009-002.sig b/securemail/vendor/singpolyma/openpgp-php/tests/data/000009-002.sig new file mode 100644 index 00000000..4a282dd6 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000009-002.sig differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000010-012.ring_trust b/securemail/vendor/singpolyma/openpgp-php/tests/data/000010-012.ring_trust new file mode 100644 index 00000000..ffa57e57 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000010-012.ring_trust differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000011-002.sig b/securemail/vendor/singpolyma/openpgp-php/tests/data/000011-002.sig new file mode 100644 index 00000000..cae1b739 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000011-002.sig differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000012-012.ring_trust b/securemail/vendor/singpolyma/openpgp-php/tests/data/000012-012.ring_trust new file mode 100644 index 00000000..ffa57e57 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000012-012.ring_trust differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000013-014.public_subkey b/securemail/vendor/singpolyma/openpgp-php/tests/data/000013-014.public_subkey new file mode 100644 index 00000000..08676d06 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000013-014.public_subkey differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000014-002.sig b/securemail/vendor/singpolyma/openpgp-php/tests/data/000014-002.sig new file mode 100644 index 00000000..dd601807 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000014-002.sig differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000015-012.ring_trust b/securemail/vendor/singpolyma/openpgp-php/tests/data/000015-012.ring_trust new file mode 100644 index 00000000..ffa57e57 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000015-012.ring_trust differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000016-006.public_key b/securemail/vendor/singpolyma/openpgp-php/tests/data/000016-006.public_key new file mode 100644 index 00000000..c9dccbf1 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000016-006.public_key differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000017-002.sig b/securemail/vendor/singpolyma/openpgp-php/tests/data/000017-002.sig new file mode 100644 index 00000000..e734505a Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000017-002.sig differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000018-012.ring_trust b/securemail/vendor/singpolyma/openpgp-php/tests/data/000018-012.ring_trust new file mode 100644 index 00000000..ffa57e57 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000018-012.ring_trust differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000019-013.user_id b/securemail/vendor/singpolyma/openpgp-php/tests/data/000019-013.user_id new file mode 100644 index 00000000..ab3f51d9 --- /dev/null +++ b/securemail/vendor/singpolyma/openpgp-php/tests/data/000019-013.user_id @@ -0,0 +1 @@ +$Test Key (DSA) \ No newline at end of file diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000020-002.sig b/securemail/vendor/singpolyma/openpgp-php/tests/data/000020-002.sig new file mode 100644 index 00000000..8588489a Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000020-002.sig differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000021-012.ring_trust b/securemail/vendor/singpolyma/openpgp-php/tests/data/000021-012.ring_trust new file mode 100644 index 00000000..ffa57e57 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000021-012.ring_trust differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000022-002.sig b/securemail/vendor/singpolyma/openpgp-php/tests/data/000022-002.sig new file mode 100644 index 00000000..fefcb5fe Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000022-002.sig differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000023-012.ring_trust b/securemail/vendor/singpolyma/openpgp-php/tests/data/000023-012.ring_trust new file mode 100644 index 00000000..ffa57e57 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000023-012.ring_trust differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000024-014.public_subkey b/securemail/vendor/singpolyma/openpgp-php/tests/data/000024-014.public_subkey new file mode 100644 index 00000000..2e8deea2 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000024-014.public_subkey differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000025-002.sig b/securemail/vendor/singpolyma/openpgp-php/tests/data/000025-002.sig new file mode 100644 index 00000000..a3eea0a2 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000025-002.sig differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000026-012.ring_trust b/securemail/vendor/singpolyma/openpgp-php/tests/data/000026-012.ring_trust new file mode 100644 index 00000000..ffa57e57 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000026-012.ring_trust differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000027-006.public_key b/securemail/vendor/singpolyma/openpgp-php/tests/data/000027-006.public_key new file mode 100644 index 00000000..5817e003 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000027-006.public_key differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000028-002.sig b/securemail/vendor/singpolyma/openpgp-php/tests/data/000028-002.sig new file mode 100644 index 00000000..5194b784 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000028-002.sig differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000029-012.ring_trust b/securemail/vendor/singpolyma/openpgp-php/tests/data/000029-012.ring_trust new file mode 100644 index 00000000..ffa57e57 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000029-012.ring_trust differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000030-013.user_id b/securemail/vendor/singpolyma/openpgp-php/tests/data/000030-013.user_id new file mode 100644 index 00000000..fb3f49e0 --- /dev/null +++ b/securemail/vendor/singpolyma/openpgp-php/tests/data/000030-013.user_id @@ -0,0 +1 @@ ++Test Key (DSA sign-only) \ No newline at end of file diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000031-002.sig b/securemail/vendor/singpolyma/openpgp-php/tests/data/000031-002.sig new file mode 100644 index 00000000..f69f6875 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000031-002.sig differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000032-012.ring_trust b/securemail/vendor/singpolyma/openpgp-php/tests/data/000032-012.ring_trust new file mode 100644 index 00000000..ffa57e57 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000032-012.ring_trust differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000033-002.sig b/securemail/vendor/singpolyma/openpgp-php/tests/data/000033-002.sig new file mode 100644 index 00000000..2bb55d4f Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000033-002.sig differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000034-012.ring_trust b/securemail/vendor/singpolyma/openpgp-php/tests/data/000034-012.ring_trust new file mode 100644 index 00000000..ffa57e57 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000034-012.ring_trust differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000035-006.public_key b/securemail/vendor/singpolyma/openpgp-php/tests/data/000035-006.public_key new file mode 100644 index 00000000..5980638c Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000035-006.public_key differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000036-013.user_id b/securemail/vendor/singpolyma/openpgp-php/tests/data/000036-013.user_id new file mode 100644 index 00000000..5d0d46e5 --- /dev/null +++ b/securemail/vendor/singpolyma/openpgp-php/tests/data/000036-013.user_id @@ -0,0 +1 @@ +.Test Key (RSA sign-only) \ No newline at end of file diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000037-002.sig b/securemail/vendor/singpolyma/openpgp-php/tests/data/000037-002.sig new file mode 100644 index 00000000..833b563b Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000037-002.sig differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000038-012.ring_trust b/securemail/vendor/singpolyma/openpgp-php/tests/data/000038-012.ring_trust new file mode 100644 index 00000000..ffa57e57 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000038-012.ring_trust differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000039-002.sig b/securemail/vendor/singpolyma/openpgp-php/tests/data/000039-002.sig new file mode 100644 index 00000000..89c34fa5 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000039-002.sig differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000040-012.ring_trust b/securemail/vendor/singpolyma/openpgp-php/tests/data/000040-012.ring_trust new file mode 100644 index 00000000..ffa57e57 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000040-012.ring_trust differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000041-017.attribute b/securemail/vendor/singpolyma/openpgp-php/tests/data/000041-017.attribute new file mode 100644 index 00000000..a21a82fb Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000041-017.attribute differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000042-002.sig b/securemail/vendor/singpolyma/openpgp-php/tests/data/000042-002.sig new file mode 100644 index 00000000..fc6267fd Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000042-002.sig differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000043-012.ring_trust b/securemail/vendor/singpolyma/openpgp-php/tests/data/000043-012.ring_trust new file mode 100644 index 00000000..ffa57e57 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000043-012.ring_trust differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000044-014.public_subkey b/securemail/vendor/singpolyma/openpgp-php/tests/data/000044-014.public_subkey new file mode 100644 index 00000000..06bf50e4 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000044-014.public_subkey differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000045-002.sig b/securemail/vendor/singpolyma/openpgp-php/tests/data/000045-002.sig new file mode 100644 index 00000000..336eb0f2 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000045-002.sig differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000046-012.ring_trust b/securemail/vendor/singpolyma/openpgp-php/tests/data/000046-012.ring_trust new file mode 100644 index 00000000..ffa57e57 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000046-012.ring_trust differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000047-005.secret_key b/securemail/vendor/singpolyma/openpgp-php/tests/data/000047-005.secret_key new file mode 100644 index 00000000..77b5d428 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000047-005.secret_key differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000048-013.user_id b/securemail/vendor/singpolyma/openpgp-php/tests/data/000048-013.user_id new file mode 100644 index 00000000..759449bb --- /dev/null +++ b/securemail/vendor/singpolyma/openpgp-php/tests/data/000048-013.user_id @@ -0,0 +1 @@ +$Test Key (RSA) \ No newline at end of file diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000049-002.sig b/securemail/vendor/singpolyma/openpgp-php/tests/data/000049-002.sig new file mode 100644 index 00000000..14276d0a Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000049-002.sig differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000050-012.ring_trust b/securemail/vendor/singpolyma/openpgp-php/tests/data/000050-012.ring_trust new file mode 100644 index 00000000..b1eeabb9 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000050-012.ring_trust differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000051-007.secret_subkey b/securemail/vendor/singpolyma/openpgp-php/tests/data/000051-007.secret_subkey new file mode 100644 index 00000000..b4e65c92 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000051-007.secret_subkey differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000052-002.sig b/securemail/vendor/singpolyma/openpgp-php/tests/data/000052-002.sig new file mode 100644 index 00000000..dd601807 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000052-002.sig differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000053-012.ring_trust b/securemail/vendor/singpolyma/openpgp-php/tests/data/000053-012.ring_trust new file mode 100644 index 00000000..b1eeabb9 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000053-012.ring_trust differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000054-005.secret_key b/securemail/vendor/singpolyma/openpgp-php/tests/data/000054-005.secret_key new file mode 100644 index 00000000..f153e593 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000054-005.secret_key differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000055-002.sig b/securemail/vendor/singpolyma/openpgp-php/tests/data/000055-002.sig new file mode 100644 index 00000000..e734505a Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000055-002.sig differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000056-012.ring_trust b/securemail/vendor/singpolyma/openpgp-php/tests/data/000056-012.ring_trust new file mode 100644 index 00000000..b1eeabb9 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000056-012.ring_trust differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000057-013.user_id b/securemail/vendor/singpolyma/openpgp-php/tests/data/000057-013.user_id new file mode 100644 index 00000000..ab3f51d9 --- /dev/null +++ b/securemail/vendor/singpolyma/openpgp-php/tests/data/000057-013.user_id @@ -0,0 +1 @@ +$Test Key (DSA) \ No newline at end of file diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000058-002.sig b/securemail/vendor/singpolyma/openpgp-php/tests/data/000058-002.sig new file mode 100644 index 00000000..8588489a Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000058-002.sig differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000059-012.ring_trust b/securemail/vendor/singpolyma/openpgp-php/tests/data/000059-012.ring_trust new file mode 100644 index 00000000..b1eeabb9 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000059-012.ring_trust differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000060-007.secret_subkey b/securemail/vendor/singpolyma/openpgp-php/tests/data/000060-007.secret_subkey new file mode 100644 index 00000000..9df45f39 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000060-007.secret_subkey differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000061-002.sig b/securemail/vendor/singpolyma/openpgp-php/tests/data/000061-002.sig new file mode 100644 index 00000000..63949422 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000061-002.sig differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000062-012.ring_trust b/securemail/vendor/singpolyma/openpgp-php/tests/data/000062-012.ring_trust new file mode 100644 index 00000000..b1eeabb9 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000062-012.ring_trust differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000063-005.secret_key b/securemail/vendor/singpolyma/openpgp-php/tests/data/000063-005.secret_key new file mode 100644 index 00000000..2f4268ee Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000063-005.secret_key differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000064-002.sig b/securemail/vendor/singpolyma/openpgp-php/tests/data/000064-002.sig new file mode 100644 index 00000000..5194b784 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000064-002.sig differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000065-012.ring_trust b/securemail/vendor/singpolyma/openpgp-php/tests/data/000065-012.ring_trust new file mode 100644 index 00000000..b1eeabb9 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000065-012.ring_trust differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000066-013.user_id b/securemail/vendor/singpolyma/openpgp-php/tests/data/000066-013.user_id new file mode 100644 index 00000000..fb3f49e0 --- /dev/null +++ b/securemail/vendor/singpolyma/openpgp-php/tests/data/000066-013.user_id @@ -0,0 +1 @@ ++Test Key (DSA sign-only) \ No newline at end of file diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000067-002.sig b/securemail/vendor/singpolyma/openpgp-php/tests/data/000067-002.sig new file mode 100644 index 00000000..d354e79d Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000067-002.sig differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000068-012.ring_trust b/securemail/vendor/singpolyma/openpgp-php/tests/data/000068-012.ring_trust new file mode 100644 index 00000000..b1eeabb9 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000068-012.ring_trust differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000069-005.secret_key b/securemail/vendor/singpolyma/openpgp-php/tests/data/000069-005.secret_key new file mode 100644 index 00000000..17a2c354 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000069-005.secret_key differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000070-013.user_id b/securemail/vendor/singpolyma/openpgp-php/tests/data/000070-013.user_id new file mode 100644 index 00000000..5d0d46e5 --- /dev/null +++ b/securemail/vendor/singpolyma/openpgp-php/tests/data/000070-013.user_id @@ -0,0 +1 @@ +.Test Key (RSA sign-only) \ No newline at end of file diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000071-002.sig b/securemail/vendor/singpolyma/openpgp-php/tests/data/000071-002.sig new file mode 100644 index 00000000..833b563b Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000071-002.sig differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000072-012.ring_trust b/securemail/vendor/singpolyma/openpgp-php/tests/data/000072-012.ring_trust new file mode 100644 index 00000000..b1eeabb9 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000072-012.ring_trust differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000073-017.attribute b/securemail/vendor/singpolyma/openpgp-php/tests/data/000073-017.attribute new file mode 100644 index 00000000..a21a82fb Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000073-017.attribute differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000074-002.sig b/securemail/vendor/singpolyma/openpgp-php/tests/data/000074-002.sig new file mode 100644 index 00000000..fc6267fd Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000074-002.sig differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000075-012.ring_trust b/securemail/vendor/singpolyma/openpgp-php/tests/data/000075-012.ring_trust new file mode 100644 index 00000000..b1eeabb9 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000075-012.ring_trust differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000076-007.secret_subkey b/securemail/vendor/singpolyma/openpgp-php/tests/data/000076-007.secret_subkey new file mode 100644 index 00000000..b380339a Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000076-007.secret_subkey differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000077-002.sig b/securemail/vendor/singpolyma/openpgp-php/tests/data/000077-002.sig new file mode 100644 index 00000000..336eb0f2 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000077-002.sig differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/000078-012.ring_trust b/securemail/vendor/singpolyma/openpgp-php/tests/data/000078-012.ring_trust new file mode 100644 index 00000000..b1eeabb9 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/000078-012.ring_trust differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/002182-002.sig b/securemail/vendor/singpolyma/openpgp-php/tests/data/002182-002.sig new file mode 100644 index 00000000..2bc6679f Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/002182-002.sig differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/compressedsig-bzip2.gpg b/securemail/vendor/singpolyma/openpgp-php/tests/data/compressedsig-bzip2.gpg new file mode 100644 index 00000000..87539dbe Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/compressedsig-bzip2.gpg differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/compressedsig-zlib.gpg b/securemail/vendor/singpolyma/openpgp-php/tests/data/compressedsig-zlib.gpg new file mode 100644 index 00000000..4da4dfa9 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/compressedsig-zlib.gpg differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/compressedsig.gpg b/securemail/vendor/singpolyma/openpgp-php/tests/data/compressedsig.gpg new file mode 100644 index 00000000..dd617de1 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/compressedsig.gpg differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/encryptedSecretKey.gpg b/securemail/vendor/singpolyma/openpgp-php/tests/data/encryptedSecretKey.gpg new file mode 100644 index 00000000..af700e80 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/encryptedSecretKey.gpg differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/hello.gpg b/securemail/vendor/singpolyma/openpgp-php/tests/data/hello.gpg new file mode 100644 index 00000000..986de95f Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/hello.gpg differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/helloKey.gpg b/securemail/vendor/singpolyma/openpgp-php/tests/data/helloKey.gpg new file mode 100644 index 00000000..b1dd0780 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/helloKey.gpg differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/onepass_sig b/securemail/vendor/singpolyma/openpgp-php/tests/data/onepass_sig new file mode 100644 index 00000000..87b2895e Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/onepass_sig differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/pubring.gpg b/securemail/vendor/singpolyma/openpgp-php/tests/data/pubring.gpg new file mode 100644 index 00000000..a1519ee7 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/pubring.gpg differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/secring.gpg b/securemail/vendor/singpolyma/openpgp-php/tests/data/secring.gpg new file mode 100644 index 00000000..9e43912b Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/secring.gpg differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/symmetric-3des.gpg b/securemail/vendor/singpolyma/openpgp-php/tests/data/symmetric-3des.gpg new file mode 100644 index 00000000..0029caec Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/symmetric-3des.gpg differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/symmetric-aes.gpg b/securemail/vendor/singpolyma/openpgp-php/tests/data/symmetric-aes.gpg new file mode 100644 index 00000000..f148ada1 --- /dev/null +++ b/securemail/vendor/singpolyma/openpgp-php/tests/data/symmetric-aes.gpg @@ -0,0 +1 @@ + FyD`>~iXaMM7*WK1I&U]-axsn֎jUǕ%ԩe \ No newline at end of file diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/symmetric-cast5.gpg b/securemail/vendor/singpolyma/openpgp-php/tests/data/symmetric-cast5.gpg new file mode 100644 index 00000000..950b7917 --- /dev/null +++ b/securemail/vendor/singpolyma/openpgp-php/tests/data/symmetric-cast5.gpg @@ -0,0 +1 @@ + 9F-`2萗wD0q,z}Zϲ֣# ־ aٛ!! \ No newline at end of file diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/symmetric-no-mdc.gpg b/securemail/vendor/singpolyma/openpgp-php/tests/data/symmetric-no-mdc.gpg new file mode 100644 index 00000000..40d31b0b --- /dev/null +++ b/securemail/vendor/singpolyma/openpgp-php/tests/data/symmetric-no-mdc.gpg @@ -0,0 +1,2 @@ + [JHB`#{%|6buC g+ +H \ No newline at end of file diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/symmetric-with-session-key.gpg b/securemail/vendor/singpolyma/openpgp-php/tests/data/symmetric-with-session-key.gpg new file mode 100644 index 00000000..0b623f1e Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/symmetric-with-session-key.gpg differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/symmetrically_encrypted b/securemail/vendor/singpolyma/openpgp-php/tests/data/symmetrically_encrypted new file mode 100644 index 00000000..129155aa Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/symmetrically_encrypted differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/uncompressed-ops-dsa-sha384.txt.gpg b/securemail/vendor/singpolyma/openpgp-php/tests/data/uncompressed-ops-dsa-sha384.txt.gpg new file mode 100644 index 00000000..39828fca Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/uncompressed-ops-dsa-sha384.txt.gpg differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/uncompressed-ops-dsa.gpg b/securemail/vendor/singpolyma/openpgp-php/tests/data/uncompressed-ops-dsa.gpg new file mode 100644 index 00000000..97e7a267 Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/uncompressed-ops-dsa.gpg differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/data/uncompressed-ops-rsa.gpg b/securemail/vendor/singpolyma/openpgp-php/tests/data/uncompressed-ops-rsa.gpg new file mode 100644 index 00000000..7ae453da Binary files /dev/null and b/securemail/vendor/singpolyma/openpgp-php/tests/data/uncompressed-ops-rsa.gpg differ diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/phpseclib_suite.php b/securemail/vendor/singpolyma/openpgp-php/tests/phpseclib_suite.php new file mode 100644 index 00000000..0f6ae30f --- /dev/null +++ b/securemail/vendor/singpolyma/openpgp-php/tests/phpseclib_suite.php @@ -0,0 +1,135 @@ +assertSame($verify->verify($m), $m->signatures()); + } + + public function testUncompressedOpsRSA() { + $this->oneMessageRSA('pubring.gpg', 'uncompressed-ops-rsa.gpg'); + } + + public function testCompressedSig() { + $this->oneMessageRSA('pubring.gpg', 'compressedsig.gpg'); + } + + public function testCompressedSigZLIB() { + $this->oneMessageRSA('pubring.gpg', 'compressedsig-zlib.gpg'); + } + + public function testCompressedSigBzip2() { + $this->oneMessageRSA('pubring.gpg', 'compressedsig-bzip2.gpg'); + } + + public function testSigningMessages() { + $wkey = OpenPGP_Message::parse(file_get_contents(dirname(__FILE__) . '/data/helloKey.gpg')); + $data = new OpenPGP_LiteralDataPacket('This is text.', array('format' => 'u', 'filename' => 'stuff.txt')); + $sign = new OpenPGP_Crypt_RSA($wkey); + $m = $sign->sign($data)->to_bytes(); + $reparsedM = OpenPGP_Message::parse($m); + $this->assertSame($sign->verify($reparsedM), $reparsedM->signatures()); + } + +/* + public function testUncompressedOpsDSA() { + $this->oneMessageDSA('pubring.gpg', 'uncompressed-ops-dsa.gpg'); + } + + public function testUncompressedOpsDSAsha384() { + $this->oneMessageDSA('pubring.gpg', 'uncompressed-ops-dsa-sha384.gpg'); + } +*/ +} + + +class KeyVerification extends PHPUnit_Framework_TestCase { + public function oneKeyRSA($path) { + $m = OpenPGP_Message::parse(file_get_contents(dirname(__FILE__) . '/data/' . $path)); + $verify = new OpenPGP_Crypt_RSA($m); + $this->assertSame($verify->verify($m), $m->signatures()); + } + + public function testHelloKey() { + $this->oneKeyRSA("helloKey.gpg"); + } +} + + +class Decryption extends PHPUnit_Framework_TestCase { + public function oneSymmetric($pass, $cnt, $path) { + $m = OpenPGP_Message::parse(file_get_contents(dirname(__FILE__) . '/data/' . $path)); + $m2 = OpenPGP_Crypt_Symmetric::decryptSymmetric($pass, $m); + while($m2[0] instanceof OpenPGP_CompressedDataPacket) $m2 = $m2[0]->data; + foreach($m2 as $p) { + if($p instanceof OpenPGP_LiteralDataPacket) { + $this->assertEquals($p->data, $cnt); + } + } + } + + public function testDecryptAES() { + $this->oneSymmetric("hello", "PGP\n", "symmetric-aes.gpg"); + } + + public function testDecrypt3DES() { + $this->oneSymmetric("hello", "PGP\n", "symmetric-3des.gpg"); + } + + public function testDecryptCAST5() { // Requires mcrypt + $this->oneSymmetric("hello", "PGP\n", "symmetric-cast5.gpg"); + } + + public function testDecryptSessionKey() { + $this->oneSymmetric("hello", "PGP\n", "symmetric-with-session-key.gpg"); + } + + public function testDecryptNoMDC() { + $this->oneSymmetric("hello", "PGP\n", "symmetric-no-mdc.gpg"); + } + + public function testDecryptAsymmetric() { + $m = OpenPGP_Message::parse(file_get_contents(dirname(__FILE__) . '/data/hello.gpg')); + $key = OpenPGP_Message::parse(file_get_contents(dirname(__FILE__) . '/data/helloKey.gpg')); + $decryptor = new OpenPGP_Crypt_RSA($key); + $m2 = $decryptor->decrypt($m); + while($m2[0] instanceof OpenPGP_CompressedDataPacket) $m2 = $m2[0]->data; + foreach($m2 as $p) { + if($p instanceof OpenPGP_LiteralDataPacket) { + $this->assertEquals($p->data, "hello\n"); + } + } + } + + public function testDecryptSecretKey() { + $key = OpenPGP_Message::parse(file_get_contents(dirname(__FILE__) . '/data/encryptedSecretKey.gpg')); + $skey = OpenPGP_Crypt_Symmetric::decryptSecretKey("hello", $key[0]); + $this->assertSame(!!$skey, true); + } +} + +class Encryption extends PHPUnit_Framework_TestCase { + public function testEncryptSymmetric() { + $data = new OpenPGP_LiteralDataPacket('This is text.', array('format' => 'u', 'filename' => 'stuff.txt')); + $encrypted = OpenPGP_Crypt_Symmetric::encrypt('secret', new OpenPGP_Message(array($data))); + $decrypted = OpenPGP_Crypt_Symmetric::decryptSymmetric('secret', $encrypted); + $this->assertEquals($decrypted[0]->data, 'This is text.'); + } + + public function testEncryptAsymmetric() { + $key = OpenPGP_Message::parse(file_get_contents(dirname(__FILE__) . '/data/helloKey.gpg')); + $data = new OpenPGP_LiteralDataPacket('This is text.', array('format' => 'u', 'filename' => 'stuff.txt')); + $encrypted = OpenPGP_Crypt_Symmetric::encrypt($key, new OpenPGP_Message(array($data))); + $decryptor = new OpenPGP_Crypt_RSA($key); + $decrypted = $decryptor->decrypt($encrypted); + $this->assertEquals($decrypted[0]->data, 'This is text.'); + } +} diff --git a/securemail/vendor/singpolyma/openpgp-php/tests/suite.php b/securemail/vendor/singpolyma/openpgp-php/tests/suite.php new file mode 100644 index 00000000..1752d0b6 --- /dev/null +++ b/securemail/vendor/singpolyma/openpgp-php/tests/suite.php @@ -0,0 +1,400 @@ +to_bytes(); + $out = OpenPGP_Message::parse($mid); + $this->assertEquals($in, $out); + } + + public function test000001006public_key() { + $this->oneSerialization("000001-006.public_key"); + } + + + public function test000002013user_id() { + $this->oneSerialization("000002-013.user_id"); + } + + public function test000003002sig() { + $this->oneSerialization("000003-002.sig"); + } + + public function test000004012ring_trust() { + $this->oneSerialization("000004-012.ring_trust"); + } + + public function test000005002sig() { + $this->oneSerialization("000005-002.sig"); + } + + public function test000006012ring_trust() { + $this->oneSerialization("000006-012.ring_trust"); + } + + public function test000007002sig() { + $this->oneSerialization("000007-002.sig"); + } + + public function test000008012ring_trust() { + $this->oneSerialization("000008-012.ring_trust"); + } + + public function test000009002sig() { + $this->oneSerialization("000009-002.sig"); + } + + public function test000010012ring_trust() { + $this->oneSerialization("000010-012.ring_trust"); + } + + public function test000011002sig() { + $this->oneSerialization("000011-002.sig"); + } + + public function test000012012ring_trust() { + $this->oneSerialization("000012-012.ring_trust"); + } + + public function test000013014public_subkey() { + $this->oneSerialization("000013-014.public_subkey"); + } + + public function test000014002sig() { + $this->oneSerialization("000014-002.sig"); + } + + public function test000015012ring_trust() { + $this->oneSerialization("000015-012.ring_trust"); + } + + public function test000016006public_key() { + $this->oneSerialization("000016-006.public_key"); + } + + public function test000017002sig() { + $this->oneSerialization("000017-002.sig"); + } + + public function test000018012ring_trust() { + $this->oneSerialization("000018-012.ring_trust"); + } + + public function test000019013user_id() { + $this->oneSerialization("000019-013.user_id"); + } + + public function test000020002sig() { + $this->oneSerialization("000020-002.sig"); + } + + public function test000021012ring_trust() { + $this->oneSerialization("000021-012.ring_trust"); + } + + public function test000022002sig() { + $this->oneSerialization("000022-002.sig"); + } + + public function test000023012ring_trust() { + $this->oneSerialization("000023-012.ring_trust"); + } + + public function test000024014public_subkey() { + $this->oneSerialization("000024-014.public_subkey"); + } + + public function test000025002sig() { + $this->oneSerialization("000025-002.sig"); + } + + public function test000026012ring_trust() { + $this->oneSerialization("000026-012.ring_trust"); + } + + public function test000027006public_key() { + $this->oneSerialization("000027-006.public_key"); + } + + public function test000028002sig() { + $this->oneSerialization("000028-002.sig"); + } + + public function test000029012ring_trust() { + $this->oneSerialization("000029-012.ring_trust"); + } + + public function test000030013user_id() { + $this->oneSerialization("000030-013.user_id"); + } + + public function test000031002sig() { + $this->oneSerialization("000031-002.sig"); + } + + public function test000032012ring_trust() { + $this->oneSerialization("000032-012.ring_trust"); + } + + public function test000033002sig() { + $this->oneSerialization("000033-002.sig"); + } + + public function test000034012ring_trust() { + $this->oneSerialization("000034-012.ring_trust"); + } + + public function test000035006public_key() { + $this->oneSerialization("000035-006.public_key"); + } + + public function test000036013user_id() { + $this->oneSerialization("000036-013.user_id"); + } + + public function test000037002sig() { + $this->oneSerialization("000037-002.sig"); + } + + public function test000038012ring_trust() { + $this->oneSerialization("000038-012.ring_trust"); + } + + public function test000039002sig() { + $this->oneSerialization("000039-002.sig"); + } + + public function test000040012ring_trust() { + $this->oneSerialization("000040-012.ring_trust"); + } + + public function test000041017attribute() { + $this->oneSerialization("000041-017.attribute"); + } + + public function test000042002sig() { + $this->oneSerialization("000042-002.sig"); + } + + public function test000043012ring_trust() { + $this->oneSerialization("000043-012.ring_trust"); + } + + public function test000044014public_subkey() { + $this->oneSerialization("000044-014.public_subkey"); + } + + public function test000045002sig() { + $this->oneSerialization("000045-002.sig"); + } + + public function test000046012ring_trust() { + $this->oneSerialization("000046-012.ring_trust"); + } + + public function test000047005secret_key() { + $this->oneSerialization("000047-005.secret_key"); + } + + public function test000048013user_id() { + $this->oneSerialization("000048-013.user_id"); + } + + public function test000049002sig() { + $this->oneSerialization("000049-002.sig"); + } + + public function test000050012ring_trust() { + $this->oneSerialization("000050-012.ring_trust"); + } + + public function test000051007secret_subkey() { + $this->oneSerialization("000051-007.secret_subkey"); + } + + public function test000052002sig() { + $this->oneSerialization("000052-002.sig"); + } + + public function test000053012ring_trust() { + $this->oneSerialization("000053-012.ring_trust"); + } + + public function test000054005secret_key() { + $this->oneSerialization("000054-005.secret_key"); + } + + public function test000055002sig() { + $this->oneSerialization("000055-002.sig"); + } + + public function test000056012ring_trust() { + $this->oneSerialization("000056-012.ring_trust"); + } + + public function test000057013user_id() { + $this->oneSerialization("000057-013.user_id"); + } + + public function test000058002sig() { + $this->oneSerialization("000058-002.sig"); + } + + public function test000059012ring_trust() { + $this->oneSerialization("000059-012.ring_trust"); + } + + public function test000060007secret_subkey() { + $this->oneSerialization("000060-007.secret_subkey"); + } + + public function test000061002sig() { + $this->oneSerialization("000061-002.sig"); + } + + public function test000062012ring_trust() { + $this->oneSerialization("000062-012.ring_trust"); + } + + public function test000063005secret_key() { + $this->oneSerialization("000063-005.secret_key"); + } + + public function test000064002sig() { + $this->oneSerialization("000064-002.sig"); + } + + public function test000065012ring_trust() { + $this->oneSerialization("000065-012.ring_trust"); + } + + public function test000066013user_id() { + $this->oneSerialization("000066-013.user_id"); + } + + public function test000067002sig() { + $this->oneSerialization("000067-002.sig"); + } + + public function test000068012ring_trust() { + $this->oneSerialization("000068-012.ring_trust"); + } + + public function test000069005secret_key() { + $this->oneSerialization("000069-005.secret_key"); + } + + public function test000070013user_id() { + $this->oneSerialization("000070-013.user_id"); + } + + public function test000071002sig() { + $this->oneSerialization("000071-002.sig"); + } + + public function test000072012ring_trust() { + $this->oneSerialization("000072-012.ring_trust"); + } + + public function test000073017attribute() { + $this->oneSerialization("000073-017.attribute"); + } + + public function test000074002sig() { + $this->oneSerialization("000074-002.sig"); + } + + public function test000075012ring_trust() { + $this->oneSerialization("000075-012.ring_trust"); + } + + public function test000076007secret_subkey() { + $this->oneSerialization("000076-007.secret_subkey"); + } + + public function test000077002sig() { + $this->oneSerialization("000077-002.sig"); + } + + public function test000078012ring_trust() { + $this->oneSerialization("000078-012.ring_trust"); + } + + public function test002182002sig() { + $this->oneSerialization("002182-002.sig"); + } + + public function testpubringgpg() { + $this->oneSerialization("pubring.gpg"); + } + + public function testsecringgpg() { + $this->oneSerialization("secring.gpg"); + } + + public function testcompressedsiggpg() { + $this->oneSerialization("compressedsig.gpg"); + } + + public function testcompressedsigzlibgpg() { + $this->oneSerialization("compressedsig-zlib.gpg"); + } + + public function testcompressedsigbzip2gpg() { + $this->oneSerialization("compressedsig-bzip2.gpg"); + } + + public function testonepass_sig() { + $this->oneSerialization("onepass_sig"); + } + + public function testsymmetrically_encrypted() { + $this->oneSerialization("symmetrically_encrypted"); + } + + public function testuncompressedopsdsagpg() { + $this->oneSerialization("uncompressed-ops-dsa.gpg"); + } + + public function testuncompressedopsdsasha384txtgpg() { + $this->oneSerialization("uncompressed-ops-dsa-sha384.txt.gpg"); + } + + public function testuncompressedopsrsagpg() { + $this->oneSerialization("uncompressed-ops-rsa.gpg"); + } + + public function testSymmetricAES() { + $this->oneSerialization("symmetric-aes.gpg"); + } + + public function testSymmetricNoMDC() { + $this->oneSerialization("symmetric-no-mdc.gpg"); + } +} + +class Fingerprint extends PHPUnit_Framework_TestCase { + public function oneFingerprint($path, $kf) { + $m = OpenPGP_Message::parse(file_get_contents(dirname(__FILE__) . '/data/' . $path)); + $this->assertEquals($m[0]->fingerprint(), $kf); + } + + public function test000001006public_key() { + $this->oneFingerprint("000001-006.public_key", "421F28FEAAD222F856C8FFD5D4D54EA16F87040E"); + } + + public function test000016006public_key() { + $this->oneFingerprint("000016-006.public_key", "AF95E4D7BAC521EE9740BED75E9F1523413262DC"); + } + + public function test000027006public_key() { + $this->oneFingerprint("000027-006.public_key", "1EB20B2F5A5CC3BEAFD6E5CB7732CF988A63EA86"); + } + + public function test000035006public_key() { + $this->oneFingerprint("000035-006.public_key", "CB7933459F59C70DF1C3FBEEDEDC3ECF689AF56D"); + } +}
\r\n" . $this->_format_log(array($message), array($protocol_flags)) . "\r\n
* login('username', 'password')) { * exit('Login Failed'); * } @@ -22,14 +22,13 @@ * * * setPassword('whatever'); * $key->loadKey(file_get_contents('privatekey')); * - * $ssh = new Net_SSH2('www.domain.tld'); + * $ssh = new \phpseclib\Net\SSH2('www.domain.tld'); * if (!$ssh->login('username', $key)) { * exit('Login Failed'); * } @@ -40,120 +39,117 @@ * ?> * * - * LICENSE: Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in - * all copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN - * THE SOFTWARE. - * * @category Net - * @package Net_SSH2 + * @package SSH2 * @author Jim Wigginton * @copyright 2007 Jim Wigginton * @license http://www.opensource.org/licenses/mit-license.html MIT License * @link http://phpseclib.sourceforge.net */ -/**#@+ - * Execution Bitmap Masks - * - * @see Net_SSH2::bitmap - * @access private - */ -define('NET_SSH2_MASK_CONSTRUCTOR', 0x00000001); -define('NET_SSH2_MASK_CONNECTED', 0x00000002); -define('NET_SSH2_MASK_LOGIN_REQ', 0x00000004); -define('NET_SSH2_MASK_LOGIN', 0x00000008); -define('NET_SSH2_MASK_SHELL', 0x00000010); -define('NET_SSH2_MASK_WINDOW_ADJUST', 0x00000020); -/**#@-*/ +namespace phpseclib\Net; -/**#@+ - * Channel constants - * - * RFC4254 refers not to client and server channels but rather to sender and recipient channels. we don't refer - * to them in that way because RFC4254 toggles the meaning. the client sends a SSH_MSG_CHANNEL_OPEN message with - * a sender channel and the server sends a SSH_MSG_CHANNEL_OPEN_CONFIRMATION in response, with a sender and a - * recepient channel. at first glance, you might conclude that SSH_MSG_CHANNEL_OPEN_CONFIRMATION's sender channel - * would be the same thing as SSH_MSG_CHANNEL_OPEN's sender channel, but it's not, per this snipet: - * The 'recipient channel' is the channel number given in the original - * open request, and 'sender channel' is the channel number allocated by - * the other side. - * - * @see Net_SSH2::_send_channel_packet() - * @see Net_SSH2::_get_channel_packet() - * @access private - */ -define('NET_SSH2_CHANNEL_EXEC', 0); // PuTTy uses 0x100 -define('NET_SSH2_CHANNEL_SHELL', 1); -define('NET_SSH2_CHANNEL_SUBSYSTEM', 2); -/**#@-*/ - -/**#@+ - * @access public - * @see Net_SSH2::getLog() - */ -/** - * Returns the message numbers - */ -define('NET_SSH2_LOG_SIMPLE', 1); -/** - * Returns the message content - */ -define('NET_SSH2_LOG_COMPLEX', 2); -/** - * Outputs the content real-time - */ -define('NET_SSH2_LOG_REALTIME', 3); -/** - * Dumps the content real-time to a file - */ -define('NET_SSH2_LOG_REALTIME_FILE', 4); -/**#@-*/ - -/**#@+ - * @access public - * @see Net_SSH2::read() - */ -/** - * Returns when a string matching $expect exactly is found - */ -define('NET_SSH2_READ_SIMPLE', 1); -/** - * Returns when a string matching the regular expression $expect is found - */ -define('NET_SSH2_READ_REGEX', 2); -/** - * Make sure that the log never gets larger than this - */ -define('NET_SSH2_LOG_MAX_SIZE', 1024 * 1024); -/**#@-*/ +use phpseclib\Crypt\Base; +use phpseclib\Crypt\Blowfish; +use phpseclib\Crypt\Hash; +use phpseclib\Crypt\Random; +use phpseclib\Crypt\RC4; +use phpseclib\Crypt\Rijndael; +use phpseclib\Crypt\RSA; +use phpseclib\Crypt\TripleDES; +use phpseclib\Crypt\Twofish; +use phpseclib\Math\BigInteger; // Used to do Diffie-Hellman key exchange and DSA/RSA signature verification. +use phpseclib\System\SSH\Agent; /** * Pure-PHP implementation of SSHv2. * - * @package Net_SSH2 + * @package SSH2 * @author Jim Wigginton * @access public */ -class Net_SSH2 +class SSH2 { + /**#@+ + * Execution Bitmap Masks + * + * @see \phpseclib\Net\SSH2::bitmap + * @access private + */ + const MASK_CONSTRUCTOR = 0x00000001; + const MASK_CONNECTED = 0x00000002; + const MASK_LOGIN_REQ = 0x00000004; + const MASK_LOGIN = 0x00000008; + const MASK_SHELL = 0x00000010; + const MASK_WINDOW_ADJUST = 0x00000020; + /**#@-*/ + + /**#@+ + * Channel constants + * + * RFC4254 refers not to client and server channels but rather to sender and recipient channels. we don't refer + * to them in that way because RFC4254 toggles the meaning. the client sends a SSH_MSG_CHANNEL_OPEN message with + * a sender channel and the server sends a SSH_MSG_CHANNEL_OPEN_CONFIRMATION in response, with a sender and a + * recepient channel. at first glance, you might conclude that SSH_MSG_CHANNEL_OPEN_CONFIRMATION's sender channel + * would be the same thing as SSH_MSG_CHANNEL_OPEN's sender channel, but it's not, per this snipet: + * The 'recipient channel' is the channel number given in the original + * open request, and 'sender channel' is the channel number allocated by + * the other side. + * + * @see \phpseclib\Net\SSH2::_send_channel_packet() + * @see \phpseclib\Net\SSH2::_get_channel_packet() + * @access private + */ + const CHANNEL_EXEC = 0; // PuTTy uses 0x100 + const CHANNEL_SHELL = 1; + const CHANNEL_SUBSYSTEM = 2; + const CHANNEL_AGENT_FORWARD = 3; + /**#@-*/ + + /**#@+ + * @access public + * @see \phpseclib\Net\SSH2::getLog() + */ + /** + * Returns the message numbers + */ + const LOG_SIMPLE = 1; + /** + * Returns the message content + */ + const LOG_COMPLEX = 2; + /** + * Outputs the content real-time + */ + const LOG_REALTIME = 3; + /** + * Dumps the content real-time to a file + */ + const LOG_REALTIME_FILE = 4; + /**#@-*/ + + /**#@+ + * @access public + * @see \phpseclib\Net\SSH2::read() + */ + /** + * Returns when a string matching $expect exactly is found + */ + const READ_SIMPLE = 1; + /** + * Returns when a string matching the regular expression $expect is found + */ + const READ_REGEX = 2; + /** + * Make sure that the log never gets larger than this + */ + const LOG_MAX_SIZE = 1048576; // 1024 * 1024 + /**#@-*/ + /** * The SSH identifier * - * @var String + * @var string * @access private */ var $identifier; @@ -161,7 +157,7 @@ class Net_SSH2 /** * The Socket Object * - * @var Object + * @var object * @access private */ var $fsock; @@ -172,7 +168,7 @@ class Net_SSH2 * The bits that are set represent functions that have been called already. This is used to determine * if a requisite function has been successfully executed. If not, an error should be thrown. * - * @var Integer + * @var int * @access private */ var $bitmap = 0; @@ -180,9 +176,9 @@ class Net_SSH2 /** * Error information * - * @see Net_SSH2::getErrors() - * @see Net_SSH2::getLastError() - * @var String + * @see self::getErrors() + * @see self::getLastError() + * @var string * @access private */ var $errors = array(); @@ -190,8 +186,8 @@ class Net_SSH2 /** * Server Identifier * - * @see Net_SSH2::getServerIdentification() - * @var mixed false or Array + * @see self::getServerIdentification() + * @var array|false * @access private */ var $server_identifier = false; @@ -199,17 +195,44 @@ class Net_SSH2 /** * Key Exchange Algorithms * - * @see Net_SSH2::getKexAlgorithims() - * @var mixed false or Array + * @see self::getKexAlgorithims() + * @var array|false * @access private */ var $kex_algorithms = false; + /** + * Minimum Diffie-Hellman Group Bit Size in RFC 4419 Key Exchange Methods + * + * @see self::_key_exchange() + * @var int + * @access private + */ + var $kex_dh_group_size_min = 1536; + + /** + * Preferred Diffie-Hellman Group Bit Size in RFC 4419 Key Exchange Methods + * + * @see self::_key_exchange() + * @var int + * @access private + */ + var $kex_dh_group_size_preferred = 2048; + + /** + * Maximum Diffie-Hellman Group Bit Size in RFC 4419 Key Exchange Methods + * + * @see self::_key_exchange() + * @var int + * @access private + */ + var $kex_dh_group_size_max = 4096; + /** * Server Host Key Algorithms * - * @see Net_SSH2::getServerHostKeyAlgorithms() - * @var mixed false or Array + * @see self::getServerHostKeyAlgorithms() + * @var array|false * @access private */ var $server_host_key_algorithms = false; @@ -217,8 +240,8 @@ class Net_SSH2 /** * Encryption Algorithms: Client to Server * - * @see Net_SSH2::getEncryptionAlgorithmsClient2Server() - * @var mixed false or Array + * @see self::getEncryptionAlgorithmsClient2Server() + * @var array|false * @access private */ var $encryption_algorithms_client_to_server = false; @@ -226,8 +249,8 @@ class Net_SSH2 /** * Encryption Algorithms: Server to Client * - * @see Net_SSH2::getEncryptionAlgorithmsServer2Client() - * @var mixed false or Array + * @see self::getEncryptionAlgorithmsServer2Client() + * @var array|false * @access private */ var $encryption_algorithms_server_to_client = false; @@ -235,8 +258,8 @@ class Net_SSH2 /** * MAC Algorithms: Client to Server * - * @see Net_SSH2::getMACAlgorithmsClient2Server() - * @var mixed false or Array + * @see self::getMACAlgorithmsClient2Server() + * @var array|false * @access private */ var $mac_algorithms_client_to_server = false; @@ -244,8 +267,8 @@ class Net_SSH2 /** * MAC Algorithms: Server to Client * - * @see Net_SSH2::getMACAlgorithmsServer2Client() - * @var mixed false or Array + * @see self::getMACAlgorithmsServer2Client() + * @var array|false * @access private */ var $mac_algorithms_server_to_client = false; @@ -253,8 +276,8 @@ class Net_SSH2 /** * Compression Algorithms: Client to Server * - * @see Net_SSH2::getCompressionAlgorithmsClient2Server() - * @var mixed false or Array + * @see self::getCompressionAlgorithmsClient2Server() + * @var array|false * @access private */ var $compression_algorithms_client_to_server = false; @@ -262,8 +285,8 @@ class Net_SSH2 /** * Compression Algorithms: Server to Client * - * @see Net_SSH2::getCompressionAlgorithmsServer2Client() - * @var mixed false or Array + * @see self::getCompressionAlgorithmsServer2Client() + * @var array|false * @access private */ var $compression_algorithms_server_to_client = false; @@ -271,8 +294,8 @@ class Net_SSH2 /** * Languages: Server to Client * - * @see Net_SSH2::getLanguagesServer2Client() - * @var mixed false or Array + * @see self::getLanguagesServer2Client() + * @var array|false * @access private */ var $languages_server_to_client = false; @@ -280,8 +303,8 @@ class Net_SSH2 /** * Languages: Client to Server * - * @see Net_SSH2::getLanguagesClient2Server() - * @var mixed false or Array + * @see self::getLanguagesClient2Server() + * @var array|false * @access private */ var $languages_client_to_server = false; @@ -296,9 +319,9 @@ class Net_SSH2 * * -- http://tools.ietf.org/html/rfc4253#section-6 * - * @see Net_SSH2::Net_SSH2() - * @see Net_SSH2::_send_binary_packet() - * @var Integer + * @see self::__construct() + * @see self::_send_binary_packet() + * @var int * @access private */ var $encrypt_block_size = 8; @@ -306,9 +329,9 @@ class Net_SSH2 /** * Block Size for Client to Server Encryption * - * @see Net_SSH2::Net_SSH2() - * @see Net_SSH2::_get_binary_packet() - * @var Integer + * @see self::__construct() + * @see self::_get_binary_packet() + * @var int * @access private */ var $decrypt_block_size = 8; @@ -316,8 +339,8 @@ class Net_SSH2 /** * Server to Client Encryption Object * - * @see Net_SSH2::_get_binary_packet() - * @var Object + * @see self::_get_binary_packet() + * @var object * @access private */ var $decrypt = false; @@ -325,8 +348,8 @@ class Net_SSH2 /** * Client to Server Encryption Object * - * @see Net_SSH2::_send_binary_packet() - * @var Object + * @see self::_send_binary_packet() + * @var object * @access private */ var $encrypt = false; @@ -334,8 +357,8 @@ class Net_SSH2 /** * Client to Server HMAC Object * - * @see Net_SSH2::_send_binary_packet() - * @var Object + * @see self::_send_binary_packet() + * @var object * @access private */ var $hmac_create = false; @@ -343,8 +366,8 @@ class Net_SSH2 /** * Server to Client HMAC Object * - * @see Net_SSH2::_get_binary_packet() - * @var Object + * @see self::_get_binary_packet() + * @var object * @access private */ var $hmac_check = false; @@ -356,8 +379,8 @@ class Net_SSH2 * For the client to server side, the HMAC object will make the HMAC as long as it needs to be. All we need to do is * append it. * - * @see Net_SSH2::_get_binary_packet() - * @var Integer + * @see self::_get_binary_packet() + * @var int * @access private */ var $hmac_size = false; @@ -365,14 +388,14 @@ class Net_SSH2 /** * Server Public Host Key * - * @see Net_SSH2::getServerPublicHostKey() - * @var String + * @see self::getServerPublicHostKey() + * @var string * @access private */ var $server_public_host_key; /** - * Session identifer + * Session identifier * * "The exchange hash H from the first key exchange is additionally * used as the session identifier, which is a unique identifier for @@ -380,8 +403,8 @@ class Net_SSH2 * * -- http://tools.ietf.org/html/rfc4253#section-7.2 * - * @see Net_SSH2::_key_exchange() - * @var String + * @see self::_key_exchange() + * @var string * @access private */ var $session_id = false; @@ -391,8 +414,8 @@ class Net_SSH2 * * The current exchange hash * - * @see Net_SSH2::_key_exchange() - * @var String + * @see self::_key_exchange() + * @var string * @access private */ var $exchange_hash = false; @@ -400,8 +423,8 @@ class Net_SSH2 /** * Message Numbers * - * @see Net_SSH2::Net_SSH2() - * @var Array + * @see self::__construct() + * @var array * @access private */ var $message_numbers = array(); @@ -409,8 +432,8 @@ class Net_SSH2 /** * Disconnection Message 'reason codes' defined in RFC4253 * - * @see Net_SSH2::Net_SSH2() - * @var Array + * @see self::__construct() + * @var array * @access private */ var $disconnect_reasons = array(); @@ -418,8 +441,8 @@ class Net_SSH2 /** * SSH_MSG_CHANNEL_OPEN_FAILURE 'reason codes', defined in RFC4254 * - * @see Net_SSH2::Net_SSH2() - * @var Array + * @see self::__construct() + * @var array * @access private */ var $channel_open_failure_reasons = array(); @@ -428,8 +451,8 @@ class Net_SSH2 * Terminal Modes * * @link http://tools.ietf.org/html/rfc4254#section-8 - * @see Net_SSH2::Net_SSH2() - * @var Array + * @see self::__construct() + * @var array * @access private */ var $terminal_modes = array(); @@ -438,8 +461,8 @@ class Net_SSH2 * SSH_MSG_CHANNEL_EXTENDED_DATA's data_type_codes * * @link http://tools.ietf.org/html/rfc4254#section-5.2 - * @see Net_SSH2::Net_SSH2() - * @var Array + * @see self::__construct() + * @var array * @access private */ var $channel_extended_data_type_codes = array(); @@ -449,8 +472,8 @@ class Net_SSH2 * * See 'Section 6.4. Data Integrity' of rfc4253 for more info. * - * @see Net_SSH2::_send_binary_packet() - * @var Integer + * @see self::_send_binary_packet() + * @var int * @access private */ var $send_seq_no = 0; @@ -460,8 +483,8 @@ class Net_SSH2 * * See 'Section 6.4. Data Integrity' of rfc4253 for more info. * - * @see Net_SSH2::_get_binary_packet() - * @var Integer + * @see self::_get_binary_packet() + * @var int * @access private */ var $get_seq_no = 0; @@ -471,9 +494,9 @@ class Net_SSH2 * * Maps client channels to server channels * - * @see Net_SSH2::_get_channel_packet() - * @see Net_SSH2::exec() - * @var Array + * @see self::_get_channel_packet() + * @see self::exec() + * @var array * @access private */ var $server_channels = array(); @@ -484,9 +507,9 @@ class Net_SSH2 * If a client requests a packet from one channel but receives two packets from another those packets should * be placed in a buffer * - * @see Net_SSH2::_get_channel_packet() - * @see Net_SSH2::exec() - * @var Array + * @see self::_get_channel_packet() + * @see self::exec() + * @var array * @access private */ var $channel_buffers = array(); @@ -496,8 +519,8 @@ class Net_SSH2 * * Contains the type of the last sent message * - * @see Net_SSH2::_get_channel_packet() - * @var Array + * @see self::_get_channel_packet() + * @var array * @access private */ var $channel_status = array(); @@ -507,8 +530,8 @@ class Net_SSH2 * * Maximum packet size indexed by channel * - * @see Net_SSH2::_send_channel_packet() - * @var Array + * @see self::_send_channel_packet() + * @var array * @access private */ var $packet_size_client_to_server = array(); @@ -516,8 +539,8 @@ class Net_SSH2 /** * Message Number Log * - * @see Net_SSH2::getLog() - * @var Array + * @see self::getLog() + * @var array * @access private */ var $message_number_log = array(); @@ -525,8 +548,8 @@ class Net_SSH2 /** * Message Log * - * @see Net_SSH2::getLog() - * @var Array + * @see self::getLog() + * @var array * @access private */ var $message_log = array(); @@ -536,9 +559,9 @@ class Net_SSH2 * * Bytes the other party can send before it must wait for the window to be adjusted (0x7FFFFFFF = 2GB) * - * @var Integer - * @see Net_SSH2::_send_channel_packet() - * @see Net_SSH2::exec() + * @var int + * @see self::_send_channel_packet() + * @see self::exec() * @access private */ var $window_size = 0x7FFFFFFF; @@ -548,8 +571,8 @@ class Net_SSH2 * * Window size indexed by channel * - * @see Net_SSH2::_send_channel_packet() - * @var Array + * @see self::_send_channel_packet() + * @var array * @access private */ var $window_size_server_to_client = array(); @@ -559,8 +582,8 @@ class Net_SSH2 * * Window size indexed by channel * - * @see Net_SSH2::_get_channel_packet() - * @var Array + * @see self::_get_channel_packet() + * @var array * @access private */ var $window_size_client_to_server = array(); @@ -570,8 +593,8 @@ class Net_SSH2 * * Verified against $this->session_id * - * @see Net_SSH2::getServerPublicHostKey() - * @var String + * @see self::getServerPublicHostKey() + * @var string * @access private */ var $signature = ''; @@ -581,8 +604,8 @@ class Net_SSH2 * * ssh-rsa or ssh-dss. * - * @see Net_SSH2::getServerPublicHostKey() - * @var String + * @see self::getServerPublicHostKey() + * @var string * @access private */ var $signature_format = ''; @@ -590,8 +613,8 @@ class Net_SSH2 /** * Interactive Buffer * - * @see Net_SSH2::read() - * @var Array + * @see self::read() + * @var array * @access private */ var $interactiveBuffer = ''; @@ -599,11 +622,11 @@ class Net_SSH2 /** * Current log size * - * Should never exceed NET_SSH2_LOG_MAX_SIZE + * Should never exceed self::LOG_MAX_SIZE * - * @see Net_SSH2::_send_binary_packet() - * @see Net_SSH2::_get_binary_packet() - * @var Integer + * @see self::_send_binary_packet() + * @see self::_get_binary_packet() + * @var int * @access private */ var $log_size; @@ -611,7 +634,7 @@ class Net_SSH2 /** * Timeout * - * @see Net_SSH2::setTimeout() + * @see self::setTimeout() * @access private */ var $timeout; @@ -619,7 +642,7 @@ class Net_SSH2 /** * Current Timeout * - * @see Net_SSH2::_get_channel_packet() + * @see self::_get_channel_packet() * @access private */ var $curTimeout; @@ -627,8 +650,8 @@ class Net_SSH2 /** * Real-time log file pointer * - * @see Net_SSH2::_append_log() - * @var Resource + * @see self::_append_log() + * @var resource * @access private */ var $realtime_log_file; @@ -636,8 +659,8 @@ class Net_SSH2 /** * Real-time log file size * - * @see Net_SSH2::_append_log() - * @var Integer + * @see self::_append_log() + * @var int * @access private */ var $realtime_log_size; @@ -645,8 +668,8 @@ class Net_SSH2 /** * Has the signature been validated? * - * @see Net_SSH2::getServerPublicHostKey() - * @var Boolean + * @see self::getServerPublicHostKey() + * @var bool * @access private */ var $signature_validated = false; @@ -654,7 +677,7 @@ class Net_SSH2 /** * Real-time log file wrap boolean * - * @see Net_SSH2::_append_log() + * @see self::_append_log() * @access private */ var $realtime_log_wrap; @@ -662,7 +685,7 @@ class Net_SSH2 /** * Flag to suppress stderr from output * - * @see Net_SSH2::enableQuietMode() + * @see self::enableQuietMode() * @access private */ var $quiet_mode = false; @@ -670,7 +693,7 @@ class Net_SSH2 /** * Time of first network activity * - * @var Integer + * @var int * @access private */ var $last_packet; @@ -678,7 +701,7 @@ class Net_SSH2 /** * Exit status returned from ssh if any * - * @var Integer + * @var int * @access private */ var $exit_status; @@ -686,8 +709,8 @@ class Net_SSH2 /** * Flag to request a PTY when using exec() * - * @var Boolean - * @see Net_SSH2::enablePTY() + * @var bool + * @see self::enablePTY() * @access private */ var $request_pty = false; @@ -695,7 +718,7 @@ class Net_SSH2 /** * Flag set while exec() is running when using enablePTY() * - * @var Boolean + * @var bool * @access private */ var $in_request_pty_exec = false; @@ -703,7 +726,7 @@ class Net_SSH2 /** * Flag set after startSubsystem() is called * - * @var Boolean + * @var bool * @access private */ var $in_subsystem; @@ -711,7 +734,7 @@ class Net_SSH2 /** * Contents of stdError * - * @var String + * @var string * @access private */ var $stdErrorLog; @@ -719,8 +742,8 @@ class Net_SSH2 /** * The Last Interactive Response * - * @see Net_SSH2::_keyboard_interactive_process() - * @var String + * @see self::_keyboard_interactive_process() + * @var string * @access private */ var $last_interactive_response = ''; @@ -728,8 +751,8 @@ class Net_SSH2 /** * Keyboard Interactive Request / Responses * - * @see Net_SSH2::_keyboard_interactive_process() - * @var Array + * @see self::_keyboard_interactive_process() + * @var array * @access private */ var $keyboard_requests_responses = array(); @@ -740,9 +763,9 @@ class Net_SSH2 * Quoting from the RFC, "in some jurisdictions, sending a warning message before * authentication may be relevant for getting legal protection." * - * @see Net_SSH2::_filter() - * @see Net_SSH2::getBannerMessage() - * @var String + * @see self::_filter() + * @see self::getBannerMessage() + * @var string * @access private */ var $banner_message = ''; @@ -750,8 +773,8 @@ class Net_SSH2 /** * Did read() timeout or return normally? * - * @see Net_SSH2::isTimeout() - * @var Boolean + * @see self::isTimeout() + * @var bool * @access private */ var $is_timeout = false; @@ -759,8 +782,8 @@ class Net_SSH2 /** * Log Boundary * - * @see Net_SSH2::_format_log() - * @var String + * @see self::_format_log() + * @var string * @access private */ var $log_boundary = ':'; @@ -768,8 +791,8 @@ class Net_SSH2 /** * Log Long Width * - * @see Net_SSH2::_format_log() - * @var Integer + * @see self::_format_log() + * @var int * @access private */ var $log_long_width = 65; @@ -777,8 +800,8 @@ class Net_SSH2 /** * Log Short Width * - * @see Net_SSH2::_format_log() - * @var Integer + * @see self::_format_log() + * @var int * @access private */ var $log_short_width = 16; @@ -786,9 +809,9 @@ class Net_SSH2 /** * Hostname * - * @see Net_SSH2::Net_SSH2() - * @see Net_SSH2::_connect() - * @var String + * @see self::__construct() + * @see self::_connect() + * @var string * @access private */ var $host; @@ -796,35 +819,20 @@ class Net_SSH2 /** * Port Number * - * @see Net_SSH2::Net_SSH2() - * @see Net_SSH2::_connect() - * @var Integer + * @see self::__construct() + * @see self::_connect() + * @var int * @access private */ var $port; - /** - * Timeout for initial connection - * - * Set by the constructor call. Calling setTimeout() is optional. If it's not called functions like - * exec() won't timeout unless some PHP setting forces it too. The timeout specified in the constructor, - * however, is non-optional. There will be a timeout, whether or not you set it. If you don't it'll be - * 10 seconds. It is used by fsockopen() and the initial stream_select in that function. - * - * @see Net_SSH2::Net_SSH2() - * @see Net_SSH2::_connect() - * @var Integer - * @access private - */ - var $connectionTimeout; - /** * Number of columns for terminal window size * - * @see Net_SSH2::getWindowColumns() - * @see Net_SSH2::setWindowColumns() - * @see Net_SSH2::setWindowSize() - * @var Integer + * @see self::getWindowColumns() + * @see self::setWindowColumns() + * @see self::setWindowSize() + * @var int * @access private */ var $windowColumns = 80; @@ -832,40 +840,46 @@ class Net_SSH2 /** * Number of columns for terminal window size * - * @see Net_SSH2::getWindowRows() - * @see Net_SSH2::setWindowRows() - * @see Net_SSH2::setWindowSize() - * @var Integer + * @see self::getWindowRows() + * @see self::setWindowRows() + * @see self::setWindowSize() + * @var int * @access private */ var $windowRows = 24; + /** + * Crypto Engine + * + * @see self::setCryptoEngine() + * @see self::_key_exchange() + * @var int + * @access private + */ + var $crypto_engine = false; + + /** + * A System_SSH_Agent for use in the SSH2 Agent Forwarding scenario + * + * @var System_SSH_Agent + * @access private + */ + var $agent; + /** * Default Constructor. * - * @param String $host - * @param optional Integer $port - * @param optional Integer $timeout - * @see Net_SSH2::login() - * @return Net_SSH2 + * $host can either be a string, representing the host, or a stream resource. + * + * @param mixed $host + * @param int $port + * @param int $timeout + * @see self::login() + * @return \phpseclib\Net\SSH2 * @access public */ - function Net_SSH2($host, $port = 22, $timeout = 10) + function __construct($host, $port = 22, $timeout = 10) { - // Include Math_BigInteger - // Used to do Diffie-Hellman key exchange and DSA/RSA signature verification. - if (!class_exists('Math_BigInteger')) { - include_once 'Math/BigInteger.php'; - } - - if (!function_exists('crypt_random_string')) { - include_once 'Crypt/Random.php'; - } - - if (!class_exists('Crypt_Hash')) { - include_once 'Crypt/Hash.php'; - } - $this->message_numbers = array( 1 => 'NET_SSH2_MSG_DISCONNECT', 2 => 'NET_SSH2_MSG_IGNORE', @@ -933,59 +947,78 @@ class Net_SSH2 array(60 => 'NET_SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ'), array(60 => 'NET_SSH2_MSG_USERAUTH_PK_OK'), array(60 => 'NET_SSH2_MSG_USERAUTH_INFO_REQUEST', - 61 => 'NET_SSH2_MSG_USERAUTH_INFO_RESPONSE') + 61 => 'NET_SSH2_MSG_USERAUTH_INFO_RESPONSE'), + // RFC 4419 - diffie-hellman-group-exchange-sha{1,256} + array(30 => 'NET_SSH2_MSG_KEXDH_GEX_REQUEST_OLD', + 31 => 'NET_SSH2_MSG_KEXDH_GEX_GROUP', + 32 => 'NET_SSH2_MSG_KEXDH_GEX_INIT', + 33 => 'NET_SSH2_MSG_KEXDH_GEX_REPLY', + 34 => 'NET_SSH2_MSG_KEXDH_GEX_REQUEST'), + // RFC 5656 - Elliptic Curves (for curve25519-sha256@libssh.org) + array(30 => 'NET_SSH2_MSG_KEX_ECDH_INIT', + 31 => 'NET_SSH2_MSG_KEX_ECDH_REPLY') ); - $this->host = $host; - $this->port = $port; - $this->connectionTimeout = $timeout; + if (is_resource($host)) { + $this->fsock = $host; + return; + } + + if (is_string($host)) { + $this->host = $host; + $this->port = $port; + $this->timeout = $timeout; + } + } + + /** + * Set Crypto Engine Mode + * + * Possible $engine values: + * CRYPT_MODE_INTERNAL, CRYPT_MODE_MCRYPT + * + * @param int $engine + * @access private + */ + function setCryptoEngine($engine) + { + $this->crypto_engine = $engine; } /** * Connect to an SSHv2 server * - * @return Boolean + * @return bool * @access private */ function _connect() { - if ($this->bitmap & NET_SSH2_MASK_CONSTRUCTOR) { + if ($this->bitmap & self::MASK_CONSTRUCTOR) { return false; } - $this->bitmap |= NET_SSH2_MASK_CONSTRUCTOR; + $this->bitmap |= self::MASK_CONSTRUCTOR; - $timeout = $this->connectionTimeout; - $host = $this->host . ':' . $this->port; + $this->curTimeout = $this->timeout; - $this->last_packet = strtok(microtime(), ' ') + strtok(''); // == microtime(true) in PHP5 + $this->last_packet = microtime(true); - $start = strtok(microtime(), ' ') + strtok(''); // http://php.net/microtime#61838 - $this->fsock = @fsockopen($this->host, $this->port, $errno, $errstr, $timeout); - if (!$this->fsock) { - user_error(rtrim("Cannot connect to $host. Error $errno. $errstr")); - return false; - } - $elapsed = strtok(microtime(), ' ') + strtok('') - $start; + if (!is_resource($this->fsock)) { + $start = microtime(true); + $this->fsock = @fsockopen($this->host, $this->port, $errno, $errstr, $this->curTimeout); + if (!$this->fsock) { + $host = $this->host . ':' . $this->port; + user_error(rtrim("Cannot connect to $host. Error $errno. $errstr")); + return false; + } + $elapsed = microtime(true) - $start; - $timeout-= $elapsed; + $this->curTimeout-= $elapsed; - if ($timeout <= 0) { - user_error("Cannot connect to $host. Timeout error"); - return false; - } - - $read = array($this->fsock); - $write = $except = null; - - $sec = floor($timeout); - $usec = 1000000 * ($timeout - $sec); - - // on windows this returns a "Warning: Invalid CRT parameters detected" error - // the !count() is done as a workaround for - if (!@stream_select($read, $write, $except, $sec, $usec) && !count($read)) { - user_error("Cannot connect to $host. Banner timeout"); - return false; + if ($this->curTimeout <= 0) { + $this->is_timeout = true; + return false; + } } /* According to the SSH2 specs, @@ -995,14 +1028,51 @@ class Net_SSH2 Feed. Such lines MUST NOT begin with "SSH-", and SHOULD be encoded in ISO-10646 UTF-8 [RFC3629] (language is not specified). Clients MUST be able to process such lines." */ - $temp = ''; - $extra = ''; - while (!feof($this->fsock) && !preg_match('#^SSH-(\d\.\d+)#', $temp, $matches)) { - if (substr($temp, -2) == "\r\n") { - $extra.= $temp; - $temp = ''; + $data = ''; + while (!feof($this->fsock) && !preg_match('#(.*)^(SSH-(\d\.\d+).*)#ms', $data, $matches)) { + $line = ''; + while (true) { + if ($this->curTimeout) { + if ($this->curTimeout < 0) { + $this->is_timeout = true; + return false; + } + $read = array($this->fsock); + $write = $except = null; + $start = microtime(true); + $sec = floor($this->curTimeout); + $usec = 1000000 * ($this->curTimeout - $sec); + // on windows this returns a "Warning: Invalid CRT parameters detected" error + // the !count() is done as a workaround for + if (!@stream_select($read, $write, $except, $sec, $usec) && !count($read)) { + $this->is_timeout = true; + return false; + } + $elapsed = microtime(true) - $start; + $this->curTimeout-= $elapsed; + } + + $temp = stream_get_line($this->fsock, 255, "\n"); + if (strlen($temp) == 255) { + continue; + } + + $line.= "$temp\n"; + + // quoting RFC4253, "Implementers who wish to maintain + // compatibility with older, undocumented versions of this protocol may + // want to process the identification string without expecting the + // presence of the carriage return character for reasons described in + // Section 5 of this document." + + //if (substr($line, -2) == "\r\n") { + // break; + //} + + break; } - $temp.= fgets($this->fsock, 255); + + $data.= $line; } if (feof($this->fsock)) { @@ -1010,20 +1080,22 @@ class Net_SSH2 return false; } + $extra = $matches[1]; + $this->identifier = $this->_generate_identifier(); if (defined('NET_SSH2_LOGGING')) { - $this->_append_log('<-', $extra . $temp); + $this->_append_log('<-', $matches[0]); $this->_append_log('->', $this->identifier . "\r\n"); } $this->server_identifier = trim($temp, "\r\n"); if (strlen($extra)) { - $this->errors[] = utf8_decode($extra); + $this->errors[] = utf8_decode($data); } - if ($matches[1] != '1.99' && $matches[1] != '2.0') { - user_error("Cannot connect to SSH $matches[1] servers"); + if ($matches[3] != '1.99' && $matches[3] != '2.0') { + user_error("Cannot connect to SSH $matches[3] servers"); return false; } @@ -1044,7 +1116,7 @@ class Net_SSH2 return false; } - $this->bitmap|= NET_SSH2_MASK_CONNECTED; + $this->bitmap|= self::MASK_CONNECTED; return true; } @@ -1055,14 +1127,20 @@ class Net_SSH2 * You should overwrite this method in your own class if you want to use another identifier * * @access protected - * @return String + * @return string */ function _generate_identifier() { - $identifier = 'SSH-2.0-phpseclib_0.3'; + $identifier = 'SSH-2.0-phpseclib_2.0'; $ext = array(); - if (extension_loaded('mcrypt')) { + if (extension_loaded('libsodium')) { + $ext[] = 'libsodium'; + } + + if (extension_loaded('openssl')) { + $ext[] = 'openssl'; + } elseif (extension_loaded('mcrypt')) { $ext[] = 'mcrypt'; } @@ -1082,92 +1160,113 @@ class Net_SSH2 /** * Key Exchange * - * @param String $kexinit_payload_server + * @param string $kexinit_payload_server * @access private */ function _key_exchange($kexinit_payload_server) { - static $kex_algorithms = array( - 'diffie-hellman-group1-sha1', // REQUIRED - 'diffie-hellman-group14-sha1' // REQUIRED - ); + $kex_algorithms = array( + // Elliptic Curve Diffie-Hellman Key Agreement (ECDH) using + // Curve25519. See doc/curve25519-sha256@libssh.org.txt in the + // libssh repository for more information. + 'curve25519-sha256@libssh.org', - static $server_host_key_algorithms = array( + // Diffie-Hellman Key Agreement (DH) using integer modulo prime + // groups. + 'diffie-hellman-group1-sha1', // REQUIRED + 'diffie-hellman-group14-sha1', // REQUIRED + 'diffie-hellman-group-exchange-sha1', // RFC 4419 + 'diffie-hellman-group-exchange-sha256', // RFC 4419 + ); + if (!function_exists('\\Sodium\\library_version_major')) { + $kex_algorithms = array_diff( + $kex_algorithms, + array('curve25519-sha256@libssh.org') + ); + } + + $server_host_key_algorithms = array( 'ssh-rsa', // RECOMMENDED sign Raw RSA Key 'ssh-dss' // REQUIRED sign Raw DSS Key ); - static $encryption_algorithms = false; - if ($encryption_algorithms === false) { - $encryption_algorithms = array( - // from : - 'arcfour256', - 'arcfour128', + $encryption_algorithms = array( + // from : + 'arcfour256', + 'arcfour128', - //'arcfour', // OPTIONAL the ARCFOUR stream cipher with a 128-bit key + //'arcfour', // OPTIONAL the ARCFOUR stream cipher with a 128-bit key - // CTR modes from : - 'aes128-ctr', // RECOMMENDED AES (Rijndael) in SDCTR mode, with 128-bit key - 'aes192-ctr', // RECOMMENDED AES with 192-bit key - 'aes256-ctr', // RECOMMENDED AES with 256-bit key + // CTR modes from : + 'aes128-ctr', // RECOMMENDED AES (Rijndael) in SDCTR mode, with 128-bit key + 'aes192-ctr', // RECOMMENDED AES with 192-bit key + 'aes256-ctr', // RECOMMENDED AES with 256-bit key - 'twofish128-ctr', // OPTIONAL Twofish in SDCTR mode, with 128-bit key - 'twofish192-ctr', // OPTIONAL Twofish with 192-bit key - 'twofish256-ctr', // OPTIONAL Twofish with 256-bit key + 'twofish128-ctr', // OPTIONAL Twofish in SDCTR mode, with 128-bit key + 'twofish192-ctr', // OPTIONAL Twofish with 192-bit key + 'twofish256-ctr', // OPTIONAL Twofish with 256-bit key - 'aes128-cbc', // RECOMMENDED AES with a 128-bit key - 'aes192-cbc', // OPTIONAL AES with a 192-bit key - 'aes256-cbc', // OPTIONAL AES in CBC mode, with a 256-bit key + 'aes128-cbc', // RECOMMENDED AES with a 128-bit key + 'aes192-cbc', // OPTIONAL AES with a 192-bit key + 'aes256-cbc', // OPTIONAL AES in CBC mode, with a 256-bit key - 'twofish128-cbc', // OPTIONAL Twofish with a 128-bit key - 'twofish192-cbc', // OPTIONAL Twofish with a 192-bit key - 'twofish256-cbc', - 'twofish-cbc', // OPTIONAL alias for "twofish256-cbc" - // (this is being retained for historical reasons) + 'twofish128-cbc', // OPTIONAL Twofish with a 128-bit key + 'twofish192-cbc', // OPTIONAL Twofish with a 192-bit key + 'twofish256-cbc', + 'twofish-cbc', // OPTIONAL alias for "twofish256-cbc" + // (this is being retained for historical reasons) - 'blowfish-ctr', // OPTIONAL Blowfish in SDCTR mode + 'blowfish-ctr', // OPTIONAL Blowfish in SDCTR mode - 'blowfish-cbc', // OPTIONAL Blowfish in CBC mode + 'blowfish-cbc', // OPTIONAL Blowfish in CBC mode - '3des-ctr', // RECOMMENDED Three-key 3DES in SDCTR mode + '3des-ctr', // RECOMMENDED Three-key 3DES in SDCTR mode - '3des-cbc', // REQUIRED three-key 3DES in CBC mode - //'none' // OPTIONAL no encryption; NOT RECOMMENDED + '3des-cbc', // REQUIRED three-key 3DES in CBC mode + //'none' // OPTIONAL no encryption; NOT RECOMMENDED + ); + + if (extension_loaded('openssl') && !extension_loaded('mcrypt')) { + // OpenSSL does not support arcfour256 in any capacity and arcfour128 / arcfour support is limited to + // instances that do not use continuous buffers + $encryption_algorithms = array_diff( + $encryption_algorithms, + array('arcfour256', 'arcfour128', 'arcfour') ); - - if (phpseclib_resolve_include_path('Crypt/RC4.php') === false) { - $encryption_algorithms = array_diff( - $encryption_algorithms, - array('arcfour256', 'arcfour128', 'arcfour') - ); - } - if (phpseclib_resolve_include_path('Crypt/Rijndael.php') === false) { - $encryption_algorithms = array_diff( - $encryption_algorithms, - array('aes128-ctr', 'aes192-ctr', 'aes256-ctr', 'aes128-cbc', 'aes192-cbc', 'aes256-cbc') - ); - } - if (phpseclib_resolve_include_path('Crypt/Twofish.php') === false) { - $encryption_algorithms = array_diff( - $encryption_algorithms, - array('twofish128-ctr', 'twofish192-ctr', 'twofish256-ctr', 'twofish128-cbc', 'twofish192-cbc', 'twofish256-cbc', 'twofish-cbc') - ); - } - if (phpseclib_resolve_include_path('Crypt/Blowfish.php') === false) { - $encryption_algorithms = array_diff( - $encryption_algorithms, - array('blowfish-ctr', 'blowfish-cbc') - ); - } - if (phpseclib_resolve_include_path('Crypt/TripleDES.php') === false) { - $encryption_algorithms = array_diff( - $encryption_algorithms, - array('3des-ctr', '3des-cbc') - ); - } - $encryption_algorithms = array_values($encryption_algorithms); } + if (class_exists('\phpseclib\Crypt\RC4') === false) { + $encryption_algorithms = array_diff( + $encryption_algorithms, + array('arcfour256', 'arcfour128', 'arcfour') + ); + } + if (class_exists('\phpseclib\Crypt\Rijndael') === false) { + $encryption_algorithms = array_diff( + $encryption_algorithms, + array('aes128-ctr', 'aes192-ctr', 'aes256-ctr', 'aes128-cbc', 'aes192-cbc', 'aes256-cbc') + ); + } + if (class_exists('\phpseclib\Crypt\Twofish') === false) { + $encryption_algorithms = array_diff( + $encryption_algorithms, + array('twofish128-ctr', 'twofish192-ctr', 'twofish256-ctr', 'twofish128-cbc', 'twofish192-cbc', 'twofish256-cbc', 'twofish-cbc') + ); + } + if (class_exists('\phpseclib\Crypt\Blowfish') === false) { + $encryption_algorithms = array_diff( + $encryption_algorithms, + array('blowfish-ctr', 'blowfish-cbc') + ); + } + if (class_exists('\phpseclib\Crypt\TripleDES') === false) { + $encryption_algorithms = array_diff( + $encryption_algorithms, + array('3des-ctr', '3des-cbc') + ); + } + $encryption_algorithms = array_values($encryption_algorithms); + $mac_algorithms = array( // from : 'hmac-sha2-256',// RECOMMENDED HMAC-SHA256 (digest length = key length = 32) @@ -1179,7 +1278,7 @@ class Net_SSH2 //'none' // OPTIONAL no MAC; NOT RECOMMENDED ); - static $compression_algorithms = array( + $compression_algorithms = array( 'none' // REQUIRED no compression //'zlib' // OPTIONAL ZLIB (LZ77) compression ); @@ -1193,19 +1292,13 @@ class Net_SSH2 )); } - static $str_kex_algorithms, $str_server_host_key_algorithms, - $encryption_algorithms_server_to_client, $mac_algorithms_server_to_client, $compression_algorithms_server_to_client, - $encryption_algorithms_client_to_server, $mac_algorithms_client_to_server, $compression_algorithms_client_to_server; + $str_kex_algorithms = implode(',', $kex_algorithms); + $str_server_host_key_algorithms = implode(',', $server_host_key_algorithms); + $encryption_algorithms_server_to_client = $encryption_algorithms_client_to_server = implode(',', $encryption_algorithms); + $mac_algorithms_server_to_client = $mac_algorithms_client_to_server = implode(',', $mac_algorithms); + $compression_algorithms_server_to_client = $compression_algorithms_client_to_server = implode(',', $compression_algorithms); - if (empty($str_kex_algorithms)) { - $str_kex_algorithms = implode(',', $kex_algorithms); - $str_server_host_key_algorithms = implode(',', $server_host_key_algorithms); - $encryption_algorithms_server_to_client = $encryption_algorithms_client_to_server = implode(',', $encryption_algorithms); - $mac_algorithms_server_to_client = $mac_algorithms_client_to_server = implode(',', $mac_algorithms); - $compression_algorithms_server_to_client = $compression_algorithms_client_to_server = implode(',', $compression_algorithms); - } - - $client_cookie = crypt_random_string(16); + $client_cookie = Random::string(16); $response = $kexinit_payload_server; $this->_string_shift($response, 1); // skip past the message number (it should be SSH_MSG_KEXINIT) @@ -1245,14 +1338,32 @@ class Net_SSH2 $first_kex_packet_follows = $first_kex_packet_follows != 0; // the sending of SSH2_MSG_KEXINIT could go in one of two places. this is the second place. - $kexinit_payload_client = pack('Ca*Na*Na*Na*Na*Na*Na*Na*Na*Na*Na*CN', - NET_SSH2_MSG_KEXINIT, $client_cookie, strlen($str_kex_algorithms), $str_kex_algorithms, - strlen($str_server_host_key_algorithms), $str_server_host_key_algorithms, strlen($encryption_algorithms_client_to_server), - $encryption_algorithms_client_to_server, strlen($encryption_algorithms_server_to_client), $encryption_algorithms_server_to_client, - strlen($mac_algorithms_client_to_server), $mac_algorithms_client_to_server, strlen($mac_algorithms_server_to_client), - $mac_algorithms_server_to_client, strlen($compression_algorithms_client_to_server), $compression_algorithms_client_to_server, - strlen($compression_algorithms_server_to_client), $compression_algorithms_server_to_client, 0, '', 0, '', - 0, 0 + $kexinit_payload_client = pack( + 'Ca*Na*Na*Na*Na*Na*Na*Na*Na*Na*Na*CN', + NET_SSH2_MSG_KEXINIT, + $client_cookie, + strlen($str_kex_algorithms), + $str_kex_algorithms, + strlen($str_server_host_key_algorithms), + $str_server_host_key_algorithms, + strlen($encryption_algorithms_client_to_server), + $encryption_algorithms_client_to_server, + strlen($encryption_algorithms_server_to_client), + $encryption_algorithms_server_to_client, + strlen($mac_algorithms_client_to_server), + $mac_algorithms_client_to_server, + strlen($mac_algorithms_server_to_client), + $mac_algorithms_server_to_client, + strlen($compression_algorithms_client_to_server), + $compression_algorithms_client_to_server, + strlen($compression_algorithms_server_to_client), + $compression_algorithms_server_to_client, + 0, + '', + 0, + '', + 0, + 0 ); if (!$this->_send_binary_packet($kexinit_payload_client)) { @@ -1261,151 +1372,141 @@ class Net_SSH2 // here ends the second place. // we need to decide upon the symmetric encryption algorithms before we do the diffie-hellman key exchange - for ($i = 0; $i < count($encryption_algorithms) && !in_array($encryption_algorithms[$i], $this->encryption_algorithms_server_to_client); $i++); - if ($i == count($encryption_algorithms)) { + // we don't initialize any crypto-objects, yet - we do that, later. for now, we need the lengths to make the + // diffie-hellman key exchange as fast as possible + $decrypt = $this->_array_intersect_first($encryption_algorithms, $this->encryption_algorithms_server_to_client); + $decryptKeyLength = $this->_encryption_algorithm_to_key_size($decrypt); + if ($decryptKeyLength === null) { user_error('No compatible server to client encryption algorithms found'); return $this->_disconnect(NET_SSH2_DISCONNECT_KEY_EXCHANGE_FAILED); } - // we don't initialize any crypto-objects, yet - we do that, later. for now, we need the lengths to make the - // diffie-hellman key exchange as fast as possible - $decrypt = $encryption_algorithms[$i]; - switch ($decrypt) { - case '3des-cbc': - case '3des-ctr': - $decryptKeyLength = 24; // eg. 192 / 8 - break; - case 'aes256-cbc': - case 'aes256-ctr': - case 'twofish-cbc': - case 'twofish256-cbc': - case 'twofish256-ctr': - $decryptKeyLength = 32; // eg. 256 / 8 - break; - case 'aes192-cbc': - case 'aes192-ctr': - case 'twofish192-cbc': - case 'twofish192-ctr': - $decryptKeyLength = 24; // eg. 192 / 8 - break; - case 'aes128-cbc': - case 'aes128-ctr': - case 'twofish128-cbc': - case 'twofish128-ctr': - case 'blowfish-cbc': - case 'blowfish-ctr': - $decryptKeyLength = 16; // eg. 128 / 8 - break; - case 'arcfour': - case 'arcfour128': - $decryptKeyLength = 16; // eg. 128 / 8 - break; - case 'arcfour256': - $decryptKeyLength = 32; // eg. 128 / 8 - break; - case 'none'; - $decryptKeyLength = 0; - } - - for ($i = 0; $i < count($encryption_algorithms) && !in_array($encryption_algorithms[$i], $this->encryption_algorithms_client_to_server); $i++); - if ($i == count($encryption_algorithms)) { + $encrypt = $this->_array_intersect_first($encryption_algorithms, $this->encryption_algorithms_client_to_server); + $encryptKeyLength = $this->_encryption_algorithm_to_key_size($encrypt); + if ($encryptKeyLength === null) { user_error('No compatible client to server encryption algorithms found'); return $this->_disconnect(NET_SSH2_DISCONNECT_KEY_EXCHANGE_FAILED); } - $encrypt = $encryption_algorithms[$i]; - switch ($encrypt) { - case '3des-cbc': - case '3des-ctr': - $encryptKeyLength = 24; - break; - case 'aes256-cbc': - case 'aes256-ctr': - case 'twofish-cbc': - case 'twofish256-cbc': - case 'twofish256-ctr': - $encryptKeyLength = 32; - break; - case 'aes192-cbc': - case 'aes192-ctr': - case 'twofish192-cbc': - case 'twofish192-ctr': - $encryptKeyLength = 24; - break; - case 'aes128-cbc': - case 'aes128-ctr': - case 'twofish128-cbc': - case 'twofish128-ctr': - case 'blowfish-cbc': - case 'blowfish-ctr': - $encryptKeyLength = 16; - break; - case 'arcfour': - case 'arcfour128': - $encryptKeyLength = 16; - break; - case 'arcfour256': - $encryptKeyLength = 32; - break; - case 'none'; - $encryptKeyLength = 0; - } - - $keyLength = $decryptKeyLength > $encryptKeyLength ? $decryptKeyLength : $encryptKeyLength; - // through diffie-hellman key exchange a symmetric key is obtained - for ($i = 0; $i < count($kex_algorithms) && !in_array($kex_algorithms[$i], $this->kex_algorithms); $i++); - if ($i == count($kex_algorithms)) { + $kex_algorithm = $this->_array_intersect_first($kex_algorithms, $this->kex_algorithms); + if ($kex_algorithm === false) { user_error('No compatible key exchange algorithms found'); return $this->_disconnect(NET_SSH2_DISCONNECT_KEY_EXCHANGE_FAILED); } - switch ($kex_algorithms[$i]) { - // see http://tools.ietf.org/html/rfc2409#section-6.2 and - // http://tools.ietf.org/html/rfc2412, appendex E - case 'diffie-hellman-group1-sha1': - $prime = 'FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74' . - '020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F1437' . - '4FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7ED' . - 'EE386BFB5A899FA5AE9F24117C4B1FE649286651ECE65381FFFFFFFFFFFFFFFF'; - break; - // see http://tools.ietf.org/html/rfc3526#section-3 - case 'diffie-hellman-group14-sha1': - $prime = 'FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74' . - '020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F1437' . - '4FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7ED' . - 'EE386BFB5A899FA5AE9F24117C4B1FE649286651ECE45B3DC2007CB8A163BF05' . - '98DA48361C55D39A69163FA8FD24CF5F83655D23DCA3AD961C62F356208552BB' . - '9ED529077096966D670C354E4ABC9804F1746C08CA18217C32905E462E36CE3B' . - 'E39E772C180E86039B2783A2EC07A28FB5C55DF06F4C52C9DE2BCBF695581718' . - '3995497CEA956AE515D2261898FA051015728E5A8AACAA68FFFFFFFFFFFFFFFF'; - break; + // Only relevant in diffie-hellman-group-exchange-sha{1,256}, otherwise empty. + $exchange_hash_rfc4419 = ''; + + if ($kex_algorithm === 'curve25519-sha256@libssh.org') { + $x = Random::string(32); + $eBytes = \Sodium\crypto_box_publickey_from_secretkey($x); + $clientKexInitMessage = NET_SSH2_MSG_KEX_ECDH_INIT; + $serverKexReplyMessage = NET_SSH2_MSG_KEX_ECDH_REPLY; + $kexHash = new Hash('sha256'); + } else { + if (strpos($kex_algorithm, 'diffie-hellman-group-exchange') === 0) { + $dh_group_sizes_packed = pack( + 'NNN', + $this->kex_dh_group_size_min, + $this->kex_dh_group_size_preferred, + $this->kex_dh_group_size_max + ); + $packet = pack( + 'Ca*', + NET_SSH2_MSG_KEXDH_GEX_REQUEST, + $dh_group_sizes_packed + ); + if (!$this->_send_binary_packet($packet)) { + return false; + } + + $response = $this->_get_binary_packet(); + if ($response === false) { + user_error('Connection closed by server'); + return false; + } + extract(unpack('Ctype', $this->_string_shift($response, 1))); + if ($type != NET_SSH2_MSG_KEXDH_GEX_GROUP) { + user_error('Expected SSH_MSG_KEX_DH_GEX_GROUP'); + return false; + } + + extract(unpack('NprimeLength', $this->_string_shift($response, 4))); + $primeBytes = $this->_string_shift($response, $primeLength); + $prime = new BigInteger($primeBytes, -256); + + extract(unpack('NgLength', $this->_string_shift($response, 4))); + $gBytes = $this->_string_shift($response, $gLength); + $g = new BigInteger($gBytes, -256); + + $exchange_hash_rfc4419 = pack( + 'a*Na*Na*', + $dh_group_sizes_packed, + $primeLength, + $primeBytes, + $gLength, + $gBytes + ); + + $clientKexInitMessage = NET_SSH2_MSG_KEXDH_GEX_INIT; + $serverKexReplyMessage = NET_SSH2_MSG_KEXDH_GEX_REPLY; + } else { + switch ($kex_algorithm) { + // see http://tools.ietf.org/html/rfc2409#section-6.2 and + // http://tools.ietf.org/html/rfc2412, appendex E + case 'diffie-hellman-group1-sha1': + $prime = 'FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74' . + '020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F1437' . + '4FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7ED' . + 'EE386BFB5A899FA5AE9F24117C4B1FE649286651ECE65381FFFFFFFFFFFFFFFF'; + break; + // see http://tools.ietf.org/html/rfc3526#section-3 + case 'diffie-hellman-group14-sha1': + $prime = 'FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74' . + '020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F1437' . + '4FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7ED' . + 'EE386BFB5A899FA5AE9F24117C4B1FE649286651ECE45B3DC2007CB8A163BF05' . + '98DA48361C55D39A69163FA8FD24CF5F83655D23DCA3AD961C62F356208552BB' . + '9ED529077096966D670C354E4ABC9804F1746C08CA18217C32905E462E36CE3B' . + 'E39E772C180E86039B2783A2EC07A28FB5C55DF06F4C52C9DE2BCBF695581718' . + '3995497CEA956AE515D2261898FA051015728E5A8AACAA68FFFFFFFFFFFFFFFF'; + break; + } + // For both diffie-hellman-group1-sha1 and diffie-hellman-group14-sha1 + // the generator field element is 2 (decimal) and the hash function is sha1. + $g = new BigInteger(2); + $prime = new BigInteger($prime, 16); + $clientKexInitMessage = NET_SSH2_MSG_KEXDH_INIT; + $serverKexReplyMessage = NET_SSH2_MSG_KEXDH_REPLY; + } + + switch ($kex_algorithm) { + case 'diffie-hellman-group-exchange-sha256': + $kexHash = new Hash('sha256'); + break; + default: + $kexHash = new Hash('sha1'); + } + + /* To increase the speed of the key exchange, both client and server may + reduce the size of their private exponents. It should be at least + twice as long as the key material that is generated from the shared + secret. For more details, see the paper by van Oorschot and Wiener + [VAN-OORSCHOT]. + + -- http://tools.ietf.org/html/rfc4419#section-6.2 */ + $one = new BigInteger(1); + $keyLength = min($kexHash->getLength(), max($encryptKeyLength, $decryptKeyLength)); + $max = $one->bitwise_leftShift(16 * $keyLength); // 2 * 8 * $keyLength + $max = $max->subtract($one); + + $x = $one->random($one, $max); + $e = $g->modPow($x, $prime); + + $eBytes = $e->toBytes(true); } - - // For both diffie-hellman-group1-sha1 and diffie-hellman-group14-sha1 - // the generator field element is 2 (decimal) and the hash function is sha1. - $g = new Math_BigInteger(2); - $prime = new Math_BigInteger($prime, 16); - $kexHash = new Crypt_Hash('sha1'); - //$q = $p->bitwise_rightShift(1); - - /* To increase the speed of the key exchange, both client and server may - reduce the size of their private exponents. It should be at least - twice as long as the key material that is generated from the shared - secret. For more details, see the paper by van Oorschot and Wiener - [VAN-OORSCHOT]. - - -- http://tools.ietf.org/html/rfc4419#section-6.2 */ - $one = new Math_BigInteger(1); - $keyLength = min($keyLength, $kexHash->getLength()); - $max = $one->bitwise_leftShift(16 * $keyLength); // 2 * 8 * $keyLength - $max = $max->subtract($one); - - $x = $one->random($one, $max); - $e = $g->modPow($x, $prime); - - $eBytes = $e->toBytes(true); - $data = pack('CNa*', NET_SSH2_MSG_KEXDH_INIT, strlen($eBytes), $eBytes); + $data = pack('CNa*', $clientKexInitMessage, strlen($eBytes), $eBytes); if (!$this->_send_binary_packet($data)) { user_error('Connection closed by server'); @@ -1419,7 +1520,7 @@ class Net_SSH2 } extract(unpack('Ctype', $this->_string_shift($response, 1))); - if ($type != NET_SSH2_MSG_KEXDH_REPLY) { + if ($type != $serverKexReplyMessage) { user_error('Expected SSH_MSG_KEXDH_REPLY'); return false; } @@ -1432,7 +1533,6 @@ class Net_SSH2 $temp = unpack('Nlength', $this->_string_shift($response, 4)); $fBytes = $this->_string_shift($response, $temp['length']); - $f = new Math_BigInteger($fBytes, -256); $temp = unpack('Nlength', $this->_string_shift($response, 4)); $this->signature = $this->_string_shift($response, $temp['length']); @@ -1440,14 +1540,38 @@ class Net_SSH2 $temp = unpack('Nlength', $this->_string_shift($this->signature, 4)); $this->signature_format = $this->_string_shift($this->signature, $temp['length']); - $key = $f->modPow($x, $prime); + if ($kex_algorithm === 'curve25519-sha256@libssh.org') { + if (strlen($fBytes) !== 32) { + user_error('Received curve25519 public key of invalid length.'); + return false; + } + $key = new BigInteger(\Sodium\crypto_scalarmult($x, $fBytes), 256); + \Sodium\memzero($x); + } else { + $f = new BigInteger($fBytes, -256); + $key = $f->modPow($x, $prime); + } $keyBytes = $key->toBytes(true); - $this->exchange_hash = pack('Na*Na*Na*Na*Na*Na*Na*Na*', - strlen($this->identifier), $this->identifier, strlen($this->server_identifier), $this->server_identifier, - strlen($kexinit_payload_client), $kexinit_payload_client, strlen($kexinit_payload_server), - $kexinit_payload_server, strlen($this->server_public_host_key), $this->server_public_host_key, strlen($eBytes), - $eBytes, strlen($fBytes), $fBytes, strlen($keyBytes), $keyBytes + $this->exchange_hash = pack( + 'Na*Na*Na*Na*Na*a*Na*Na*Na*', + strlen($this->identifier), + $this->identifier, + strlen($this->server_identifier), + $this->server_identifier, + strlen($kexinit_payload_client), + $kexinit_payload_client, + strlen($kexinit_payload_server), + $kexinit_payload_server, + strlen($this->server_public_host_key), + $this->server_public_host_key, + $exchange_hash_rfc4419, + strlen($eBytes), + $eBytes, + strlen($fBytes), + $fBytes, + strlen($keyBytes), + $keyBytes ); $this->exchange_hash = $kexHash->hash($this->exchange_hash); @@ -1456,18 +1580,19 @@ class Net_SSH2 $this->session_id = $this->exchange_hash; } - for ($i = 0; $i < count($server_host_key_algorithms) && !in_array($server_host_key_algorithms[$i], $this->server_host_key_algorithms); $i++); - if ($i == count($server_host_key_algorithms)) { + $server_host_key_algorithm = $this->_array_intersect_first($server_host_key_algorithms, $this->server_host_key_algorithms); + if ($server_host_key_algorithm === false) { user_error('No compatible server host key algorithms found'); return $this->_disconnect(NET_SSH2_DISCONNECT_KEY_EXCHANGE_FAILED); } - if ($public_key_format != $server_host_key_algorithms[$i] || $this->signature_format != $server_host_key_algorithms[$i]) { + if ($public_key_format != $server_host_key_algorithm || $this->signature_format != $server_host_key_algorithm) { user_error('Server Host Key Algorithm Mismatch'); return $this->_disconnect(NET_SSH2_DISCONNECT_KEY_EXCHANGE_FAILED); } - $packet = pack('C', + $packet = pack( + 'C', NET_SSH2_MSG_NEWKEYS ); @@ -1489,163 +1614,16 @@ class Net_SSH2 return false; } - switch ($encrypt) { - case '3des-cbc': - if (!class_exists('Crypt_TripleDES')) { - include_once 'Crypt/TripleDES.php'; - } - $this->encrypt = new Crypt_TripleDES(); - // $this->encrypt_block_size = 64 / 8 == the default - break; - case '3des-ctr': - if (!class_exists('Crypt_TripleDES')) { - include_once 'Crypt/TripleDES.php'; - } - $this->encrypt = new Crypt_TripleDES(CRYPT_DES_MODE_CTR); - // $this->encrypt_block_size = 64 / 8 == the default - break; - case 'aes256-cbc': - case 'aes192-cbc': - case 'aes128-cbc': - if (!class_exists('Crypt_Rijndael')) { - include_once 'Crypt/Rijndael.php'; - } - $this->encrypt = new Crypt_Rijndael(); - $this->encrypt_block_size = 16; // eg. 128 / 8 - break; - case 'aes256-ctr': - case 'aes192-ctr': - case 'aes128-ctr': - if (!class_exists('Crypt_Rijndael')) { - include_once 'Crypt/Rijndael.php'; - } - $this->encrypt = new Crypt_Rijndael(CRYPT_RIJNDAEL_MODE_CTR); - $this->encrypt_block_size = 16; // eg. 128 / 8 - break; - case 'blowfish-cbc': - if (!class_exists('Crypt_Blowfish')) { - include_once 'Crypt/Blowfish.php'; - } - $this->encrypt = new Crypt_Blowfish(); - $this->encrypt_block_size = 8; - break; - case 'blowfish-ctr': - if (!class_exists('Crypt_Blowfish')) { - include_once 'Crypt/Blowfish.php'; - } - $this->encrypt = new Crypt_Blowfish(CRYPT_BLOWFISH_MODE_CTR); - $this->encrypt_block_size = 8; - break; - case 'twofish128-cbc': - case 'twofish192-cbc': - case 'twofish256-cbc': - case 'twofish-cbc': - if (!class_exists('Crypt_Twofish')) { - include_once 'Crypt/Twofish.php'; - } - $this->encrypt = new Crypt_Twofish(); - $this->encrypt_block_size = 16; - break; - case 'twofish128-ctr': - case 'twofish192-ctr': - case 'twofish256-ctr': - if (!class_exists('Crypt_Twofish')) { - include_once 'Crypt/Twofish.php'; - } - $this->encrypt = new Crypt_Twofish(CRYPT_TWOFISH_MODE_CTR); - $this->encrypt_block_size = 16; - break; - case 'arcfour': - case 'arcfour128': - case 'arcfour256': - if (!class_exists('Crypt_RC4')) { - include_once 'Crypt/RC4.php'; - } - $this->encrypt = new Crypt_RC4(); - break; - case 'none'; - //$this->encrypt = new Crypt_Null(); - } - - switch ($decrypt) { - case '3des-cbc': - if (!class_exists('Crypt_TripleDES')) { - include_once 'Crypt/TripleDES.php'; - } - $this->decrypt = new Crypt_TripleDES(); - break; - case '3des-ctr': - if (!class_exists('Crypt_TripleDES')) { - include_once 'Crypt/TripleDES.php'; - } - $this->decrypt = new Crypt_TripleDES(CRYPT_DES_MODE_CTR); - break; - case 'aes256-cbc': - case 'aes192-cbc': - case 'aes128-cbc': - if (!class_exists('Crypt_Rijndael')) { - include_once 'Crypt/Rijndael.php'; - } - $this->decrypt = new Crypt_Rijndael(); - $this->decrypt_block_size = 16; - break; - case 'aes256-ctr': - case 'aes192-ctr': - case 'aes128-ctr': - if (!class_exists('Crypt_Rijndael')) { - include_once 'Crypt/Rijndael.php'; - } - $this->decrypt = new Crypt_Rijndael(CRYPT_RIJNDAEL_MODE_CTR); - $this->decrypt_block_size = 16; - break; - case 'blowfish-cbc': - if (!class_exists('Crypt_Blowfish')) { - include_once 'Crypt/Blowfish.php'; - } - $this->decrypt = new Crypt_Blowfish(); - $this->decrypt_block_size = 8; - break; - case 'blowfish-ctr': - if (!class_exists('Crypt_Blowfish')) { - include_once 'Crypt/Blowfish.php'; - } - $this->decrypt = new Crypt_Blowfish(CRYPT_BLOWFISH_MODE_CTR); - $this->decrypt_block_size = 8; - break; - case 'twofish128-cbc': - case 'twofish192-cbc': - case 'twofish256-cbc': - case 'twofish-cbc': - if (!class_exists('Crypt_Twofish')) { - include_once 'Crypt/Twofish.php'; - } - $this->decrypt = new Crypt_Twofish(); - $this->decrypt_block_size = 16; - break; - case 'twofish128-ctr': - case 'twofish192-ctr': - case 'twofish256-ctr': - if (!class_exists('Crypt_Twofish')) { - include_once 'Crypt/Twofish.php'; - } - $this->decrypt = new Crypt_Twofish(CRYPT_TWOFISH_MODE_CTR); - $this->decrypt_block_size = 16; - break; - case 'arcfour': - case 'arcfour128': - case 'arcfour256': - if (!class_exists('Crypt_RC4')) { - include_once 'Crypt/RC4.php'; - } - $this->decrypt = new Crypt_RC4(); - break; - case 'none'; - //$this->decrypt = new Crypt_Null(); - } - $keyBytes = pack('Na*', strlen($keyBytes), $keyBytes); + $this->encrypt = $this->_encryption_algorithm_to_crypt_instance($encrypt); if ($this->encrypt) { + if ($this->crypto_engine) { + $this->encrypt->setEngine($this->crypto_engine); + } + if ($this->encrypt->block_size) { + $this->encrypt_block_size = $this->encrypt->block_size; + } $this->encrypt->enableContinuousBuffer(); $this->encrypt->disablePadding(); @@ -1662,7 +1640,14 @@ class Net_SSH2 $this->encrypt->setKey(substr($key, 0, $encryptKeyLength)); } + $this->decrypt = $this->_encryption_algorithm_to_crypt_instance($decrypt); if ($this->decrypt) { + if ($this->crypto_engine) { + $this->decrypt->setEngine($this->crypto_engine); + } + if ($this->decrypt->block_size) { + $this->decrypt_block_size = $this->decrypt->block_size; + } $this->decrypt->enableContinuousBuffer(); $this->decrypt->disablePadding(); @@ -1693,66 +1678,66 @@ class Net_SSH2 $this->decrypt->decrypt(str_repeat("\0", 1536)); } - for ($i = 0; $i < count($mac_algorithms) && !in_array($mac_algorithms[$i], $this->mac_algorithms_client_to_server); $i++); - if ($i == count($mac_algorithms)) { + $mac_algorithm = $this->_array_intersect_first($mac_algorithms, $this->mac_algorithms_client_to_server); + if ($mac_algorithm === false) { user_error('No compatible client to server message authentication algorithms found'); return $this->_disconnect(NET_SSH2_DISCONNECT_KEY_EXCHANGE_FAILED); } - $createKeyLength = 0; // ie. $mac_algorithms[$i] == 'none' - switch ($mac_algorithms[$i]) { + $createKeyLength = 0; // ie. $mac_algorithm == 'none' + switch ($mac_algorithm) { case 'hmac-sha2-256': - $this->hmac_create = new Crypt_Hash('sha256'); + $this->hmac_create = new Hash('sha256'); $createKeyLength = 32; break; case 'hmac-sha1': - $this->hmac_create = new Crypt_Hash('sha1'); + $this->hmac_create = new Hash('sha1'); $createKeyLength = 20; break; case 'hmac-sha1-96': - $this->hmac_create = new Crypt_Hash('sha1-96'); + $this->hmac_create = new Hash('sha1-96'); $createKeyLength = 20; break; case 'hmac-md5': - $this->hmac_create = new Crypt_Hash('md5'); + $this->hmac_create = new Hash('md5'); $createKeyLength = 16; break; case 'hmac-md5-96': - $this->hmac_create = new Crypt_Hash('md5-96'); + $this->hmac_create = new Hash('md5-96'); $createKeyLength = 16; } - for ($i = 0; $i < count($mac_algorithms) && !in_array($mac_algorithms[$i], $this->mac_algorithms_server_to_client); $i++); - if ($i == count($mac_algorithms)) { + $mac_algorithm = $this->_array_intersect_first($mac_algorithms, $this->mac_algorithms_server_to_client); + if ($mac_algorithm === false) { user_error('No compatible server to client message authentication algorithms found'); return $this->_disconnect(NET_SSH2_DISCONNECT_KEY_EXCHANGE_FAILED); } $checkKeyLength = 0; $this->hmac_size = 0; - switch ($mac_algorithms[$i]) { + switch ($mac_algorithm) { case 'hmac-sha2-256': - $this->hmac_check = new Crypt_Hash('sha256'); + $this->hmac_check = new Hash('sha256'); $checkKeyLength = 32; $this->hmac_size = 32; break; case 'hmac-sha1': - $this->hmac_check = new Crypt_Hash('sha1'); + $this->hmac_check = new Hash('sha1'); $checkKeyLength = 20; $this->hmac_size = 20; break; case 'hmac-sha1-96': - $this->hmac_check = new Crypt_Hash('sha1-96'); + $this->hmac_check = new Hash('sha1-96'); $checkKeyLength = 20; $this->hmac_size = 12; break; case 'hmac-md5': - $this->hmac_check = new Crypt_Hash('md5'); + $this->hmac_check = new Hash('md5'); $checkKeyLength = 16; $this->hmac_size = 16; break; case 'hmac-md5-96': - $this->hmac_check = new Crypt_Hash('md5-96'); + $this->hmac_check = new Hash('md5-96'); $checkKeyLength = 16; $this->hmac_size = 12; } @@ -1769,33 +1754,116 @@ class Net_SSH2 } $this->hmac_check->setKey(substr($key, 0, $checkKeyLength)); - for ($i = 0; $i < count($compression_algorithms) && !in_array($compression_algorithms[$i], $this->compression_algorithms_server_to_client); $i++); - if ($i == count($compression_algorithms)) { + $compression_algorithm = $this->_array_intersect_first($compression_algorithms, $this->compression_algorithms_server_to_client); + if ($compression_algorithm === false) { user_error('No compatible server to client compression algorithms found'); return $this->_disconnect(NET_SSH2_DISCONNECT_KEY_EXCHANGE_FAILED); } - $this->decompress = $compression_algorithms[$i] == 'zlib'; + $this->decompress = $compression_algorithm == 'zlib'; - for ($i = 0; $i < count($compression_algorithms) && !in_array($compression_algorithms[$i], $this->compression_algorithms_client_to_server); $i++); - if ($i == count($compression_algorithms)) { + $compression_algorithm = $this->_array_intersect_first($compression_algorithms, $this->compression_algorithms_client_to_server); + if ($compression_algorithm === false) { user_error('No compatible client to server compression algorithms found'); return $this->_disconnect(NET_SSH2_DISCONNECT_KEY_EXCHANGE_FAILED); } - $this->compress = $compression_algorithms[$i] == 'zlib'; + $this->compress = $compression_algorithm == 'zlib'; return true; } + /** + * Maps an encryption algorithm name to the number of key bytes. + * + * @param string $algorithm Name of the encryption algorithm + * @return int|null Number of bytes as an integer or null for unknown + * @access private + */ + function _encryption_algorithm_to_key_size($algorithm) + { + switch ($algorithm) { + case 'none': + return 0; + case 'aes128-cbc': + case 'aes128-ctr': + case 'arcfour': + case 'arcfour128': + case 'blowfish-cbc': + case 'blowfish-ctr': + case 'twofish128-cbc': + case 'twofish128-ctr': + return 16; + case '3des-cbc': + case '3des-ctr': + case 'aes192-cbc': + case 'aes192-ctr': + case 'twofish192-cbc': + case 'twofish192-ctr': + return 24; + case 'aes256-cbc': + case 'aes256-ctr': + case 'arcfour256': + case 'twofish-cbc': + case 'twofish256-cbc': + case 'twofish256-ctr': + return 32; + } + return null; + } + + /** + * Maps an encryption algorithm name to an instance of a subclass of + * \phpseclib\Crypt\Base. + * + * @param string $algorithm Name of the encryption algorithm + * @return mixed Instance of \phpseclib\Crypt\Base or null for unknown + * @access private + */ + function _encryption_algorithm_to_crypt_instance($algorithm) + { + switch ($algorithm) { + case '3des-cbc': + return new TripleDES(); + case '3des-ctr': + return new TripleDES(Base::MODE_CTR); + case 'aes256-cbc': + case 'aes192-cbc': + case 'aes128-cbc': + return new Rijndael(); + case 'aes256-ctr': + case 'aes192-ctr': + case 'aes128-ctr': + return new Rijndael(Base::MODE_CTR); + case 'blowfish-cbc': + return new Blowfish(); + case 'blowfish-ctr': + return new Blowfish(Base::MODE_CTR); + case 'twofish128-cbc': + case 'twofish192-cbc': + case 'twofish256-cbc': + case 'twofish-cbc': + return new Twofish(); + case 'twofish128-ctr': + case 'twofish192-ctr': + case 'twofish256-ctr': + return new Twofish(Base::MODE_CTR); + case 'arcfour': + case 'arcfour128': + case 'arcfour256': + return new RC4(); + } + return null; + } + /** * Login * - * The $password parameter can be a plaintext password, a Crypt_RSA object or an array + * The $password parameter can be a plaintext password, a \phpseclib\Crypt\RSA object or an array * - * @param String $username - * @param Mixed $password - * @param Mixed $... - * @return Boolean - * @see _login + * @param string $username + * @param mixed $password + * @param mixed $... + * @return bool + * @see self::_login() * @access public */ function login($username) @@ -1807,16 +1875,16 @@ class Net_SSH2 /** * Login Helper * - * @param String $username - * @param Mixed $password - * @param Mixed $... - * @return Boolean - * @see _login_helper + * @param string $username + * @param mixed $password + * @param mixed $... + * @return bool + * @see self::_login_helper() * @access private */ function _login($username) { - if (!($this->bitmap & NET_SSH2_MASK_CONSTRUCTOR)) { + if (!($this->bitmap & self::MASK_CONSTRUCTOR)) { if (!$this->_connect()) { return false; } @@ -1838,22 +1906,25 @@ class Net_SSH2 /** * Login Helper * - * @param String $username - * @param optional String $password - * @return Boolean + * @param string $username + * @param string $password + * @return bool * @access private * @internal It might be worthwhile, at some point, to protect against {@link http://tools.ietf.org/html/rfc4251#section-9.3.9 traffic analysis} * by sending dummy SSH_MSG_IGNORE messages. */ function _login_helper($username, $password = null) { - if (!($this->bitmap & NET_SSH2_MASK_CONNECTED)) { + if (!($this->bitmap & self::MASK_CONNECTED)) { return false; } - if (!($this->bitmap & NET_SSH2_MASK_LOGIN_REQ)) { - $packet = pack('CNa*', - NET_SSH2_MSG_SERVICE_REQUEST, strlen('ssh-userauth'), 'ssh-userauth' + if (!($this->bitmap & self::MASK_LOGIN_REQ)) { + $packet = pack( + 'CNa*', + NET_SSH2_MSG_SERVICE_REQUEST, + strlen('ssh-userauth'), + 'ssh-userauth' ); if (!$this->_send_binary_packet($packet)) { @@ -1872,35 +1943,37 @@ class Net_SSH2 user_error('Expected SSH_MSG_SERVICE_ACCEPT'); return false; } - $this->bitmap |= NET_SSH2_MASK_LOGIN_REQ; + $this->bitmap |= self::MASK_LOGIN_REQ; } if (strlen($this->last_interactive_response)) { return !is_string($password) && !is_array($password) ? false : $this->_keyboard_interactive_process($password); } - // although PHP5's get_class() preserves the case, PHP4's does not - if (is_object($password)) { - switch (strtolower(get_class($password))) { - case 'crypt_rsa': - return $this->_privatekey_login($username, $password); - case 'system_ssh_agent': - return $this->_ssh_agent_login($username, $password); - } + if ($password instanceof RSA) { + return $this->_privatekey_login($username, $password); + } elseif ($password instanceof Agent) { + return $this->_ssh_agent_login($username, $password); } if (is_array($password)) { if ($this->_keyboard_interactive_login($username, $password)) { - $this->bitmap |= NET_SSH2_MASK_LOGIN; + $this->bitmap |= self::MASK_LOGIN; return true; } return false; } if (!isset($password)) { - $packet = pack('CNa*Na*Na*', - NET_SSH2_MSG_USERAUTH_REQUEST, strlen($username), $username, strlen('ssh-connection'), 'ssh-connection', - strlen('none'), 'none' + $packet = pack( + 'CNa*Na*Na*', + NET_SSH2_MSG_USERAUTH_REQUEST, + strlen($username), + $username, + strlen('ssh-connection'), + 'ssh-connection', + strlen('none'), + 'none' ); if (!$this->_send_binary_packet($packet)) { @@ -1917,7 +1990,7 @@ class Net_SSH2 switch ($type) { case NET_SSH2_MSG_USERAUTH_SUCCESS: - $this->bitmap |= NET_SSH2_MASK_LOGIN; + $this->bitmap |= self::MASK_LOGIN; return true; //case NET_SSH2_MSG_USERAUTH_FAILURE: default: @@ -1925,18 +1998,36 @@ class Net_SSH2 } } - $packet = pack('CNa*Na*Na*CNa*', - NET_SSH2_MSG_USERAUTH_REQUEST, strlen($username), $username, strlen('ssh-connection'), 'ssh-connection', - strlen('password'), 'password', 0, strlen($password), $password + $packet = pack( + 'CNa*Na*Na*CNa*', + NET_SSH2_MSG_USERAUTH_REQUEST, + strlen($username), + $username, + strlen('ssh-connection'), + 'ssh-connection', + strlen('password'), + 'password', + 0, + strlen($password), + $password ); // remove the username and password from the logged packet if (!defined('NET_SSH2_LOGGING')) { $logged = null; } else { - $logged = pack('CNa*Na*Na*CNa*', - NET_SSH2_MSG_USERAUTH_REQUEST, strlen('username'), 'username', strlen('ssh-connection'), 'ssh-connection', - strlen('password'), 'password', 0, strlen('password'), 'password' + $logged = pack( + 'CNa*Na*Na*CNa*', + NET_SSH2_MSG_USERAUTH_REQUEST, + strlen('username'), + 'username', + strlen('ssh-connection'), + 'ssh-connection', + strlen('password'), + 'password', + 0, + strlen('password'), + 'password' ); } @@ -1970,14 +2061,14 @@ class Net_SSH2 if (!$partial_success && in_array('keyboard-interactive', $auth_methods)) { if ($this->_keyboard_interactive_login($username, $password)) { - $this->bitmap |= NET_SSH2_MASK_LOGIN; + $this->bitmap |= self::MASK_LOGIN; return true; } return false; } return false; case NET_SSH2_MSG_USERAUTH_SUCCESS: - $this->bitmap |= NET_SSH2_MASK_LOGIN; + $this->bitmap |= self::MASK_LOGIN; return true; } @@ -1989,16 +2080,26 @@ class Net_SSH2 * * See {@link http://tools.ietf.org/html/rfc4256 RFC4256} for details. This is not a full-featured keyboard-interactive authenticator. * - * @param String $username - * @param String $password - * @return Boolean + * @param string $username + * @param string $password + * @return bool * @access private */ function _keyboard_interactive_login($username, $password) { - $packet = pack('CNa*Na*Na*Na*Na*', - NET_SSH2_MSG_USERAUTH_REQUEST, strlen($username), $username, strlen('ssh-connection'), 'ssh-connection', - strlen('keyboard-interactive'), 'keyboard-interactive', 0, '', 0, '' + $packet = pack( + 'CNa*Na*Na*Na*Na*', + NET_SSH2_MSG_USERAUTH_REQUEST, + strlen($username), + $username, + strlen('ssh-connection'), + 'ssh-connection', + strlen('keyboard-interactive'), + 'keyboard-interactive', + 0, + '', + 0, + '' ); if (!$this->_send_binary_packet($packet)) { @@ -2011,8 +2112,8 @@ class Net_SSH2 /** * Handle the keyboard-interactive requests / responses. * - * @param String $responses... - * @return Boolean + * @param string $responses... + * @return bool * @access private */ function _keyboard_interactive_process() @@ -2069,7 +2170,7 @@ class Net_SSH2 // see http://tools.ietf.org/html/rfc4256#section-3.2 if (strlen($this->last_interactive_response)) { $this->last_interactive_response = ''; - } else if (defined('NET_SSH2_LOGGING')) { + } elseif (defined('NET_SSH2_LOGGING')) { $this->message_number_log[count($this->message_number_log) - 1] = str_replace( 'UNKNOWN', 'NET_SSH2_MSG_USERAUTH_INFO_REQUEST', @@ -2097,7 +2198,7 @@ class Net_SSH2 return false; } - if (defined('NET_SSH2_LOGGING') && NET_SSH2_LOGGING == NET_SSH2_LOG_COMPLEX) { + if (defined('NET_SSH2_LOGGING') && NET_SSH2_LOGGING == self::LOG_COMPLEX) { $this->message_number_log[count($this->message_number_log) - 1] = str_replace( 'UNKNOWN', 'NET_SSH2_MSG_USERAUTH_INFO_RESPONSE', @@ -2125,13 +2226,14 @@ class Net_SSH2 /** * Login with an ssh-agent provided key * - * @param String $username - * @param System_SSH_Agent $agent - * @return Boolean + * @param string $username + * @param \phpseclib\System\SSH\Agent $agent + * @return bool * @access private */ function _ssh_agent_login($username, $agent) { + $this->agent = $agent; $keys = $agent->requestIdentities(); foreach ($keys as $key) { if ($this->_privatekey_login($username, $key)) { @@ -2145,9 +2247,9 @@ class Net_SSH2 /** * Login with an RSA private key * - * @param String $username - * @param Crypt_RSA $password - * @return Boolean + * @param string $username + * @param \phpseclib\Crypt\RSA $password + * @return bool * @access private * @internal It might be worthwhile, at some point, to protect against {@link http://tools.ietf.org/html/rfc4251#section-9.3.9 traffic analysis} * by sending dummy SSH_MSG_IGNORE messages. @@ -2155,7 +2257,7 @@ class Net_SSH2 function _privatekey_login($username, $privatekey) { // see http://tools.ietf.org/html/rfc4253#page-15 - $publickey = $privatekey->getPublicKey(CRYPT_RSA_PUBLIC_FORMAT_RAW); + $publickey = $privatekey->getPublicKey(RSA::PUBLIC_FORMAT_RAW); if ($publickey === false) { return false; } @@ -2164,13 +2266,25 @@ class Net_SSH2 'e' => $publickey['e']->toBytes(true), 'n' => $publickey['n']->toBytes(true) ); - $publickey = pack('Na*Na*Na*', - strlen('ssh-rsa'), 'ssh-rsa', strlen($publickey['e']), $publickey['e'], strlen($publickey['n']), $publickey['n'] + $publickey = pack( + 'Na*Na*Na*', + strlen('ssh-rsa'), + 'ssh-rsa', + strlen($publickey['e']), + $publickey['e'], + strlen($publickey['n']), + $publickey['n'] ); - $part1 = pack('CNa*Na*Na*', - NET_SSH2_MSG_USERAUTH_REQUEST, strlen($username), $username, strlen('ssh-connection'), 'ssh-connection', - strlen('publickey'), 'publickey' + $part1 = pack( + 'CNa*Na*Na*', + NET_SSH2_MSG_USERAUTH_REQUEST, + strlen($username), + $username, + strlen('ssh-connection'), + 'ssh-connection', + strlen('publickey'), + 'publickey' ); $part2 = pack('Na*Na*', strlen('ssh-rsa'), 'ssh-rsa', strlen($publickey), $publickey); @@ -2195,7 +2309,7 @@ class Net_SSH2 case NET_SSH2_MSG_USERAUTH_PK_OK: // we'll just take it on faith that the public key blob and the public key algorithm name are as // they should be - if (defined('NET_SSH2_LOGGING') && NET_SSH2_LOGGING == NET_SSH2_LOG_COMPLEX) { + if (defined('NET_SSH2_LOGGING') && NET_SSH2_LOGGING == self::LOG_COMPLEX) { $this->message_number_log[count($this->message_number_log) - 1] = str_replace( 'UNKNOWN', 'NET_SSH2_MSG_USERAUTH_PK_OK', @@ -2205,7 +2319,7 @@ class Net_SSH2 } $packet = $part1 . chr(1) . $part2; - $privatekey->setSignatureMode(CRYPT_RSA_SIGNATURE_PKCS1); + $privatekey->setSignatureMode(RSA::SIGNATURE_PKCS1); $signature = $privatekey->sign(pack('Na*a*', strlen($this->session_id), $this->session_id, $packet)); $signature = pack('Na*Na*', strlen('ssh-rsa'), 'ssh-rsa', strlen($signature), $signature); $packet.= pack('Na*', strlen($signature), $signature); @@ -2227,7 +2341,7 @@ class Net_SSH2 // either the login is bad or the server employs multi-factor authentication return false; case NET_SSH2_MSG_USERAUTH_SUCCESS: - $this->bitmap |= NET_SSH2_MASK_LOGIN; + $this->bitmap |= self::MASK_LOGIN; return true; } @@ -2240,7 +2354,7 @@ class Net_SSH2 * $ssh->exec('ping 127.0.0.1'); on a Linux host will never return and will run indefinitely. setTimeout() makes it so it'll timeout. * Setting $timeout to false or 0 will mean there is no timeout. * - * @param Mixed $timeout + * @param mixed $timeout * @access public */ function setTimeout($timeout) @@ -2261,12 +2375,12 @@ class Net_SSH2 /** * Execute Command * - * If $callback is set to false then Net_SSH2::_get_channel_packet(NET_SSH2_CHANNEL_EXEC) will need to be called manually. + * If $callback is set to false then \phpseclib\Net\SSH2::_get_channel_packet(self::CHANNEL_EXEC) will need to be called manually. * In all likelihood, this is not a feature you want to be taking advantage of. * - * @param String $command - * @param optional Callback $callback - * @return String + * @param string $command + * @param Callback $callback + * @return string * @access public */ function exec($command, $callback = null) @@ -2275,42 +2389,63 @@ class Net_SSH2 $this->is_timeout = false; $this->stdErrorLog = ''; - if (!($this->bitmap & NET_SSH2_MASK_LOGIN)) { + if (!($this->bitmap & self::MASK_LOGIN)) { return false; } // RFC4254 defines the (client) window size as "bytes the other party can send before it must wait for the window to // be adjusted". 0x7FFFFFFF is, at 2GB, the max size. technically, it should probably be decremented, but, - // honestly, if you're transfering more than 2GB, you probably shouldn't be using phpseclib, anyway. + // honestly, if you're transferring more than 2GB, you probably shouldn't be using phpseclib, anyway. // see http://tools.ietf.org/html/rfc4254#section-5.2 for more info - $this->window_size_server_to_client[NET_SSH2_CHANNEL_EXEC] = $this->window_size; + $this->window_size_server_to_client[self::CHANNEL_EXEC] = $this->window_size; // 0x8000 is the maximum max packet size, per http://tools.ietf.org/html/rfc4253#section-6.1, although since PuTTy // uses 0x4000, that's what will be used here, as well. $packet_size = 0x4000; - $packet = pack('CNa*N3', - NET_SSH2_MSG_CHANNEL_OPEN, strlen('session'), 'session', NET_SSH2_CHANNEL_EXEC, $this->window_size_server_to_client[NET_SSH2_CHANNEL_EXEC], $packet_size); + $packet = pack( + 'CNa*N3', + NET_SSH2_MSG_CHANNEL_OPEN, + strlen('session'), + 'session', + self::CHANNEL_EXEC, + $this->window_size_server_to_client[self::CHANNEL_EXEC], + $packet_size + ); if (!$this->_send_binary_packet($packet)) { return false; } - $this->channel_status[NET_SSH2_CHANNEL_EXEC] = NET_SSH2_MSG_CHANNEL_OPEN; + $this->channel_status[self::CHANNEL_EXEC] = NET_SSH2_MSG_CHANNEL_OPEN; - $response = $this->_get_channel_packet(NET_SSH2_CHANNEL_EXEC); + $response = $this->_get_channel_packet(self::CHANNEL_EXEC); if ($response === false) { return false; } if ($this->request_pty === true) { $terminal_modes = pack('C', NET_SSH2_TTY_OP_END); - $packet = pack('CNNa*CNa*N5a*', - NET_SSH2_MSG_CHANNEL_REQUEST, $this->server_channels[NET_SSH2_CHANNEL_EXEC], strlen('pty-req'), 'pty-req', 1, strlen('vt100'), 'vt100', - $this->windowColumns, $this->windowRows, 0, 0, strlen($terminal_modes), $terminal_modes); + $packet = pack( + 'CNNa*CNa*N5a*', + NET_SSH2_MSG_CHANNEL_REQUEST, + $this->server_channels[self::CHANNEL_EXEC], + strlen('pty-req'), + 'pty-req', + 1, + strlen('vt100'), + 'vt100', + $this->windowColumns, + $this->windowRows, + 0, + 0, + strlen($terminal_modes), + $terminal_modes + ); if (!$this->_send_binary_packet($packet)) { return false; } + $response = $this->_get_binary_packet(); if ($response === false) { user_error('Connection closed by server'); @@ -2331,7 +2466,7 @@ class Net_SSH2 } // sending a pty-req SSH_MSG_CHANNEL_REQUEST message is unnecessary and, in fact, in most cases, slows things - // down. the one place where it might be desirable is if you're doing something like Net_SSH2::exec('ping localhost &'). + // down. the one place where it might be desirable is if you're doing something like \phpseclib\Net\SSH2::exec('ping localhost &'). // with a pty-req SSH_MSG_CHANNEL_REQUEST, exec() will return immediately and the ping process will then // then immediately terminate. without such a request exec() will loop indefinitely. the ping process won't end but // neither will your script. @@ -2339,20 +2474,28 @@ class Net_SSH2 // although, in theory, the size of SSH_MSG_CHANNEL_REQUEST could exceed the maximum packet size established by // SSH_MSG_CHANNEL_OPEN_CONFIRMATION, RFC4254#section-5.1 states that the "maximum packet size" refers to the // "maximum size of an individual data packet". ie. SSH_MSG_CHANNEL_DATA. RFC4254#section-5.2 corroborates. - $packet = pack('CNNa*CNa*', - NET_SSH2_MSG_CHANNEL_REQUEST, $this->server_channels[NET_SSH2_CHANNEL_EXEC], strlen('exec'), 'exec', 1, strlen($command), $command); + $packet = pack( + 'CNNa*CNa*', + NET_SSH2_MSG_CHANNEL_REQUEST, + $this->server_channels[self::CHANNEL_EXEC], + strlen('exec'), + 'exec', + 1, + strlen($command), + $command + ); if (!$this->_send_binary_packet($packet)) { return false; } - $this->channel_status[NET_SSH2_CHANNEL_EXEC] = NET_SSH2_MSG_CHANNEL_REQUEST; + $this->channel_status[self::CHANNEL_EXEC] = NET_SSH2_MSG_CHANNEL_REQUEST; - $response = $this->_get_channel_packet(NET_SSH2_CHANNEL_EXEC); + $response = $this->_get_channel_packet(self::CHANNEL_EXEC); if ($response === false) { return false; } - $this->channel_status[NET_SSH2_CHANNEL_EXEC] = NET_SSH2_MSG_CHANNEL_DATA; + $this->channel_status[self::CHANNEL_EXEC] = NET_SSH2_MSG_CHANNEL_DATA; if ($callback === false || $this->in_request_pty_exec) { return true; @@ -2360,7 +2503,7 @@ class Net_SSH2 $output = ''; while (true) { - $temp = $this->_get_channel_packet(NET_SSH2_CHANNEL_EXEC); + $temp = $this->_get_channel_packet(self::CHANNEL_EXEC); switch (true) { case $temp === true: return is_callable($callback) ? true : $output; @@ -2369,7 +2512,7 @@ class Net_SSH2 default: if (is_callable($callback)) { if (call_user_func($callback, $temp) === true) { - $this->_close_channel(NET_SSH2_CHANNEL_EXEC); + $this->_close_channel(self::CHANNEL_EXEC); return true; } } else { @@ -2382,9 +2525,9 @@ class Net_SSH2 /** * Creates an interactive shell * - * @see Net_SSH2::read() - * @see Net_SSH2::write() - * @return Boolean + * @see self::read() + * @see self::write() + * @return bool * @access private */ function _initShell() @@ -2393,27 +2536,47 @@ class Net_SSH2 return true; } - $this->window_size_server_to_client[NET_SSH2_CHANNEL_SHELL] = $this->window_size; + $this->window_size_server_to_client[self::CHANNEL_SHELL] = $this->window_size; $packet_size = 0x4000; - $packet = pack('CNa*N3', - NET_SSH2_MSG_CHANNEL_OPEN, strlen('session'), 'session', NET_SSH2_CHANNEL_SHELL, $this->window_size_server_to_client[NET_SSH2_CHANNEL_SHELL], $packet_size); + $packet = pack( + 'CNa*N3', + NET_SSH2_MSG_CHANNEL_OPEN, + strlen('session'), + 'session', + self::CHANNEL_SHELL, + $this->window_size_server_to_client[self::CHANNEL_SHELL], + $packet_size + ); if (!$this->_send_binary_packet($packet)) { return false; } - $this->channel_status[NET_SSH2_CHANNEL_SHELL] = NET_SSH2_MSG_CHANNEL_OPEN; + $this->channel_status[self::CHANNEL_SHELL] = NET_SSH2_MSG_CHANNEL_OPEN; - $response = $this->_get_channel_packet(NET_SSH2_CHANNEL_SHELL); + $response = $this->_get_channel_packet(self::CHANNEL_SHELL); if ($response === false) { return false; } $terminal_modes = pack('C', NET_SSH2_TTY_OP_END); - $packet = pack('CNNa*CNa*N5a*', - NET_SSH2_MSG_CHANNEL_REQUEST, $this->server_channels[NET_SSH2_CHANNEL_SHELL], strlen('pty-req'), 'pty-req', 1, strlen('vt100'), 'vt100', - $this->windowColumns, $this->windowRows, 0, 0, strlen($terminal_modes), $terminal_modes); + $packet = pack( + 'CNNa*CNa*N5a*', + NET_SSH2_MSG_CHANNEL_REQUEST, + $this->server_channels[self::CHANNEL_SHELL], + strlen('pty-req'), + 'pty-req', + 1, + strlen('vt100'), + 'vt100', + $this->windowColumns, + $this->windowRows, + 0, + 0, + strlen($terminal_modes), + $terminal_modes + ); if (!$this->_send_binary_packet($packet)) { return false; @@ -2437,22 +2600,28 @@ class Net_SSH2 return $this->_disconnect(NET_SSH2_DISCONNECT_BY_APPLICATION); } - $packet = pack('CNNa*C', - NET_SSH2_MSG_CHANNEL_REQUEST, $this->server_channels[NET_SSH2_CHANNEL_SHELL], strlen('shell'), 'shell', 1); + $packet = pack( + 'CNNa*C', + NET_SSH2_MSG_CHANNEL_REQUEST, + $this->server_channels[self::CHANNEL_SHELL], + strlen('shell'), + 'shell', + 1 + ); if (!$this->_send_binary_packet($packet)) { return false; } - $this->channel_status[NET_SSH2_CHANNEL_SHELL] = NET_SSH2_MSG_CHANNEL_REQUEST; + $this->channel_status[self::CHANNEL_SHELL] = NET_SSH2_MSG_CHANNEL_REQUEST; - $response = $this->_get_channel_packet(NET_SSH2_CHANNEL_SHELL); + $response = $this->_get_channel_packet(self::CHANNEL_SHELL); if ($response === false) { return false; } - $this->channel_status[NET_SSH2_CHANNEL_SHELL] = NET_SSH2_MSG_CHANNEL_DATA; + $this->channel_status[self::CHANNEL_SHELL] = NET_SSH2_MSG_CHANNEL_DATA; - $this->bitmap |= NET_SSH2_MASK_SHELL; + $this->bitmap |= self::MASK_SHELL; return true; } @@ -2460,46 +2629,64 @@ class Net_SSH2 /** * Return the channel to be used with read() / write() * - * @see Net_SSH2::read() - * @see Net_SSH2::write() - * @return Integer + * @see self::read() + * @see self::write() + * @return int * @access public */ function _get_interactive_channel() { switch (true) { case $this->in_subsystem: - return NET_SSH2_CHANNEL_SUBSYSTEM; + return self::CHANNEL_SUBSYSTEM; case $this->in_request_pty_exec: - return NET_SSH2_CHANNEL_EXEC; + return self::CHANNEL_EXEC; default: - return NET_SSH2_CHANNEL_SHELL; + return self::CHANNEL_SHELL; } } + /** + * Return an available open channel + * + * @return int + * @access public + */ + function _get_open_channel() + { + $channel = self::CHANNEL_EXEC; + do { + if (isset($this->channel_status[$channel]) && $this->channel_status[$channel] == NET_SSH2_MSG_CHANNEL_OPEN) { + return $channel; + } + } while ($channel++ < self::CHANNEL_SUBSYSTEM); + + return false; + } + /** * Returns the output of an interactive shell * * Returns when there's a match for $expect, which can take the form of a string literal or, - * if $mode == NET_SSH2_READ_REGEX, a regular expression. + * if $mode == self::READ_REGEX, a regular expression. * - * @see Net_SSH2::write() - * @param String $expect - * @param Integer $mode - * @return String + * @see self::write() + * @param string $expect + * @param int $mode + * @return string * @access public */ - function read($expect = '', $mode = NET_SSH2_READ_SIMPLE) + function read($expect = '', $mode = self::READ_SIMPLE) { $this->curTimeout = $this->timeout; $this->is_timeout = false; - if (!($this->bitmap & NET_SSH2_MASK_LOGIN)) { + if (!($this->bitmap & self::MASK_LOGIN)) { user_error('Operation disallowed prior to login()'); return false; } - if (!($this->bitmap & NET_SSH2_MASK_SHELL) && !$this->_initShell()) { + if (!($this->bitmap & self::MASK_SHELL) && !$this->_initShell()) { user_error('Unable to initiate an interactive shell session'); return false; } @@ -2508,8 +2695,8 @@ class Net_SSH2 $match = $expect; while (true) { - if ($mode == NET_SSH2_READ_REGEX) { - preg_match($expect, $this->interactiveBuffer, $matches); + if ($mode == self::READ_REGEX) { + preg_match($expect, substr($this->interactiveBuffer, -1024), $matches); $match = isset($matches[0]) ? $matches[0] : ''; } $pos = strlen($match) ? strpos($this->interactiveBuffer, $match) : false; @@ -2529,19 +2716,19 @@ class Net_SSH2 /** * Inputs a command into an interactive shell. * - * @see Net_SSH2::read() - * @param String $cmd - * @return Boolean + * @see self::read() + * @param string $cmd + * @return bool * @access public */ function write($cmd) { - if (!($this->bitmap & NET_SSH2_MASK_LOGIN)) { + if (!($this->bitmap & self::MASK_LOGIN)) { user_error('Operation disallowed prior to login()'); return false; } - if (!($this->bitmap & NET_SSH2_MASK_SHELL) && !$this->_initShell()) { + if (!($this->bitmap & self::MASK_SHELL) && !$this->_initShell()) { user_error('Unable to initiate an interactive shell session'); return false; } @@ -2558,46 +2745,61 @@ class Net_SSH2 * returns that and then that that was passed into stopSubsystem() but that'll be saved for a future date and implemented * if there's sufficient demand for such a feature. * - * @see Net_SSH2::stopSubsystem() - * @param String $subsystem - * @return Boolean + * @see self::stopSubsystem() + * @param string $subsystem + * @return bool * @access public */ function startSubsystem($subsystem) { - $this->window_size_server_to_client[NET_SSH2_CHANNEL_SUBSYSTEM] = $this->window_size; + $this->window_size_server_to_client[self::CHANNEL_SUBSYSTEM] = $this->window_size; - $packet = pack('CNa*N3', - NET_SSH2_MSG_CHANNEL_OPEN, strlen('session'), 'session', NET_SSH2_CHANNEL_SUBSYSTEM, $this->window_size, 0x4000); + $packet = pack( + 'CNa*N3', + NET_SSH2_MSG_CHANNEL_OPEN, + strlen('session'), + 'session', + self::CHANNEL_SUBSYSTEM, + $this->window_size, + 0x4000 + ); if (!$this->_send_binary_packet($packet)) { return false; } - $this->channel_status[NET_SSH2_CHANNEL_SUBSYSTEM] = NET_SSH2_MSG_CHANNEL_OPEN; + $this->channel_status[self::CHANNEL_SUBSYSTEM] = NET_SSH2_MSG_CHANNEL_OPEN; - $response = $this->_get_channel_packet(NET_SSH2_CHANNEL_SUBSYSTEM); + $response = $this->_get_channel_packet(self::CHANNEL_SUBSYSTEM); if ($response === false) { return false; } - $packet = pack('CNNa*CNa*', - NET_SSH2_MSG_CHANNEL_REQUEST, $this->server_channels[NET_SSH2_CHANNEL_SUBSYSTEM], strlen('subsystem'), 'subsystem', 1, strlen($subsystem), $subsystem); + $packet = pack( + 'CNNa*CNa*', + NET_SSH2_MSG_CHANNEL_REQUEST, + $this->server_channels[self::CHANNEL_SUBSYSTEM], + strlen('subsystem'), + 'subsystem', + 1, + strlen($subsystem), + $subsystem + ); if (!$this->_send_binary_packet($packet)) { return false; } - $this->channel_status[NET_SSH2_CHANNEL_SUBSYSTEM] = NET_SSH2_MSG_CHANNEL_REQUEST; + $this->channel_status[self::CHANNEL_SUBSYSTEM] = NET_SSH2_MSG_CHANNEL_REQUEST; - $response = $this->_get_channel_packet(NET_SSH2_CHANNEL_SUBSYSTEM); + $response = $this->_get_channel_packet(self::CHANNEL_SUBSYSTEM); if ($response === false) { - return false; + return false; } - $this->channel_status[NET_SSH2_CHANNEL_SUBSYSTEM] = NET_SSH2_MSG_CHANNEL_DATA; + $this->channel_status[self::CHANNEL_SUBSYSTEM] = NET_SSH2_MSG_CHANNEL_DATA; - $this->bitmap |= NET_SSH2_MASK_SHELL; + $this->bitmap |= self::MASK_SHELL; $this->in_subsystem = true; return true; @@ -2606,14 +2808,14 @@ class Net_SSH2 /** * Stops a subsystem. * - * @see Net_SSH2::startSubsystem() - * @return Boolean + * @see self::startSubsystem() + * @return bool * @access public */ function stopSubsystem() { $this->in_subsystem = false; - $this->_close_channel(NET_SSH2_CHANNEL_SUBSYSTEM); + $this->_close_channel(self::CHANNEL_SUBSYSTEM); return true; } @@ -2670,12 +2872,23 @@ class Net_SSH2 /** * Is the connection still active? * - * @return boolean + * @return bool * @access public */ function isConnected() { - return (bool) ($this->bitmap & NET_SSH2_MASK_CONNECTED); + return (bool) ($this->bitmap & self::MASK_CONNECTED); + } + + /** + * Have you successfully been logged in? + * + * @return bool + * @access public + */ + function isAuthenticated() + { + return (bool) ($this->bitmap & self::MASK_LOGIN); } /** @@ -2683,8 +2896,8 @@ class Net_SSH2 * * See '6. Binary Packet Protocol' of rfc4253 for more info. * - * @see Net_SSH2::_send_binary_packet() - * @return String + * @see self::_send_binary_packet() + * @return string * @access private */ function _get_binary_packet() @@ -2695,8 +2908,8 @@ class Net_SSH2 return false; } - $start = strtok(microtime(), ' ') + strtok(''); // http://php.net/microtime#61838 - $raw = fread($this->fsock, $this->decrypt_block_size); + $start = microtime(true); + $raw = stream_get_contents($this->fsock, $this->decrypt_block_size); if (!strlen($raw)) { return ''; @@ -2724,7 +2937,7 @@ class Net_SSH2 $buffer = ''; while ($remaining_length > 0) { - $temp = fread($this->fsock, $remaining_length); + $temp = stream_get_contents($this->fsock, $remaining_length); if ($temp === false || feof($this->fsock)) { user_error('Error reading from socket'); $this->bitmap = 0; @@ -2733,7 +2946,7 @@ class Net_SSH2 $buffer.= $temp; $remaining_length-= strlen($temp); } - $stop = strtok(microtime(), ' ') + strtok(''); + $stop = microtime(true); if (strlen($buffer)) { $raw.= $this->decrypt !== false ? $this->decrypt->decrypt($buffer) : $buffer; } @@ -2742,7 +2955,7 @@ class Net_SSH2 $padding = $this->_string_shift($raw, $padding_length); // should leave $raw empty if ($this->hmac_check !== false) { - $hmac = fread($this->fsock, $this->hmac_size); + $hmac = stream_get_contents($this->fsock, $this->hmac_size); if ($hmac === false || strlen($hmac) != $this->hmac_size) { user_error('Error reading socket'); $this->bitmap = 0; @@ -2760,7 +2973,7 @@ class Net_SSH2 $this->get_seq_no++; if (defined('NET_SSH2_LOGGING')) { - $current = strtok(microtime(), ' ') + strtok(''); + $current = microtime(true); $message_number = isset($this->message_numbers[ord($payload[0])]) ? $this->message_numbers[ord($payload[0])] : 'UNKNOWN (' . ord($payload[0]) . ')'; $message_number = '<- ' . $message_number . ' (since last: ' . round($current - $this->last_packet, 4) . ', network: ' . round($stop - $start, 4) . 's)'; @@ -2776,8 +2989,8 @@ class Net_SSH2 * * Because some binary packets need to be ignored... * - * @see Net_SSH2::_get_binary_packet() - * @return String + * @see self::_get_binary_packet() + * @return string * @access private */ function _filter($payload) @@ -2811,7 +3024,7 @@ class Net_SSH2 } // see http://tools.ietf.org/html/rfc4252#section-5.4; only called when the encryption has been activated and when we haven't already logged in - if (($this->bitmap & NET_SSH2_MASK_CONNECTED) && !($this->bitmap & NET_SSH2_MASK_LOGIN) && ord($payload[0]) == NET_SSH2_MSG_USERAUTH_BANNER) { + if (($this->bitmap & self::MASK_CONNECTED) && !($this->bitmap & self::MASK_LOGIN) && ord($payload[0]) == NET_SSH2_MSG_USERAUTH_BANNER) { $this->_string_shift($payload, 1); extract(unpack('Nlength', $this->_string_shift($payload, 4))); $this->banner_message = utf8_decode($this->_string_shift($payload, $length)); @@ -2819,12 +3032,11 @@ class Net_SSH2 } // only called when we've already logged in - if (($this->bitmap & NET_SSH2_MASK_CONNECTED) && ($this->bitmap & NET_SSH2_MASK_LOGIN)) { + if (($this->bitmap & self::MASK_CONNECTED) && ($this->bitmap & self::MASK_LOGIN)) { switch (ord($payload[0])) { case NET_SSH2_MSG_GLOBAL_REQUEST: // see http://tools.ietf.org/html/rfc4254#section-4 - $this->_string_shift($payload, 1); - extract(unpack('Nlength', $this->_string_shift($payload))); - $this->errors[] = 'SSH_MSG_GLOBAL_REQUEST: ' . utf8_decode($this->_string_shift($payload, $length)); + extract(unpack('Nlength', $this->_string_shift($payload, 4))); + $this->errors[] = 'SSH_MSG_GLOBAL_REQUEST: ' . $this->_string_shift($payload, $length); if (!$this->_send_binary_packet(pack('C', NET_SSH2_MSG_REQUEST_FAILURE))) { return $this->_disconnect(NET_SSH2_DISCONNECT_BY_APPLICATION); @@ -2835,18 +3047,55 @@ class Net_SSH2 case NET_SSH2_MSG_CHANNEL_OPEN: // see http://tools.ietf.org/html/rfc4254#section-5.1 $this->_string_shift($payload, 1); extract(unpack('Nlength', $this->_string_shift($payload, 4))); - $this->errors[] = 'SSH_MSG_CHANNEL_OPEN: ' . utf8_decode($this->_string_shift($payload, $length)); - - $this->_string_shift($payload, 4); // skip over client channel + $data = $this->_string_shift($payload, $length); extract(unpack('Nserver_channel', $this->_string_shift($payload, 4))); + switch ($data) { + case 'auth-agent': + case 'auth-agent@openssh.com': + if (isset($this->agent)) { + $new_channel = self::CHANNEL_AGENT_FORWARD; - $packet = pack('CN3a*Na*', - NET_SSH2_MSG_REQUEST_FAILURE, $server_channel, NET_SSH2_OPEN_ADMINISTRATIVELY_PROHIBITED, 0, '', 0, ''); + extract(unpack('Nremote_window_size', $this->_string_shift($payload, 4))); + extract(unpack('Nremote_maximum_packet_size', $this->_string_shift($payload, 4))); - if (!$this->_send_binary_packet($packet)) { - return $this->_disconnect(NET_SSH2_DISCONNECT_BY_APPLICATION); + $this->packet_size_client_to_server[$new_channel] = $remote_window_size; + $this->window_size_server_to_client[$new_channel] = $remote_maximum_packet_size; + $this->window_size_client_to_server[$new_channel] = $this->window_size; + + $packet_size = 0x4000; + + $packet = pack( + 'CN4', + NET_SSH2_MSG_CHANNEL_OPEN_CONFIRMATION, + $server_channel, + $new_channel, + $packet_size, + $packet_size + ); + + $this->server_channels[$new_channel] = $server_channel; + $this->channel_status[$new_channel] = NET_SSH2_MSG_CHANNEL_OPEN_CONFIRMATION; + if (!$this->_send_binary_packet($packet)) { + return false; + } + } + break; + default: + $packet = pack( + 'CN3a*Na*', + NET_SSH2_MSG_REQUEST_FAILURE, + $server_channel, + NET_SSH2_OPEN_ADMINISTRATIVELY_PROHIBITED, + 0, + '', + 0, + '' + ); + + if (!$this->_send_binary_packet($packet)) { + return $this->_disconnect(NET_SSH2_DISCONNECT_BY_APPLICATION); + } } - $payload = $this->_get_binary_packet(); break; case NET_SSH2_MSG_CHANNEL_WINDOW_ADJUST: @@ -2855,7 +3104,7 @@ class Net_SSH2 extract(unpack('Nwindow_size', $this->_string_shift($payload, 4))); $this->window_size_client_to_server[$channel]+= $window_size; - $payload = ($this->bitmap & NET_SSH2_MASK_WINDOW_ADJUST) ? true : $this->_get_binary_packet(); + $payload = ($this->bitmap & self::MASK_WINDOW_ADJUST) ? true : $this->_get_binary_packet(); } } @@ -2889,11 +3138,10 @@ class Net_SSH2 /** * Returns whether Quiet Mode is enabled or not * - * @see Net_SSH2::enableQuietMode() - * @see Net_SSH2::disableQuietMode() - * + * @see self::enableQuietMode() + * @see self::disableQuietMode() * @access public - * @return boolean + * @return bool */ function isQuietModeEnabled() { @@ -2923,11 +3171,10 @@ class Net_SSH2 /** * Returns whether request-pty is enabled or not * - * @see Net_SSH2::enablePTY() - * @see Net_SSH2::disablePTY() - * + * @see self::enablePTY() + * @see self::disablePTY() * @access public - * @return boolean + * @return bool */ function isPTYEnabled() { @@ -2940,7 +3187,7 @@ class Net_SSH2 * Returns the data as a string if it's available and false if not. * * @param $client_channel - * @return Mixed + * @return mixed * @access private */ function _get_channel_packet($client_channel, $skip_extended = false) @@ -2959,7 +3206,7 @@ class Net_SSH2 $read = array($this->fsock); $write = $except = null; - $start = strtok(microtime(), ' ') + strtok(''); // http://php.net/microtime#61838 + $start = microtime(true); $sec = floor($this->curTimeout); $usec = 1000000 * ($this->curTimeout - $sec); // on windows this returns a "Warning: Invalid CRT parameters detected" error @@ -2967,7 +3214,7 @@ class Net_SSH2 $this->is_timeout = true; return true; } - $elapsed = strtok(microtime(), ' ') + strtok('') - $start; + $elapsed = microtime(true) - $start; $this->curTimeout-= $elapsed; } @@ -2983,48 +3230,63 @@ class Net_SSH2 return ''; } - extract(unpack('Ctype/Nchannel', $this->_string_shift($response, 5))); + extract(unpack('Ctype', $this->_string_shift($response, 1))); - $this->window_size_server_to_client[$channel]-= strlen($response); - - // resize the window, if appropriate - if ($this->window_size_server_to_client[$channel] < 0) { - $packet = pack('CNN', NET_SSH2_MSG_CHANNEL_WINDOW_ADJUST, $this->server_channels[$channel], $this->window_size); - if (!$this->_send_binary_packet($packet)) { - return false; - } - $this->window_size_server_to_client[$channel]+= $this->window_size; + if ($type == NET_SSH2_MSG_CHANNEL_OPEN) { + extract(unpack('Nlength', $this->_string_shift($response, 4))); + } else { + extract(unpack('Nchannel', $this->_string_shift($response, 4))); } - switch ($this->channel_status[$channel]) { - case NET_SSH2_MSG_CHANNEL_OPEN: - switch ($type) { - case NET_SSH2_MSG_CHANNEL_OPEN_CONFIRMATION: - extract(unpack('Nserver_channel', $this->_string_shift($response, 4))); - $this->server_channels[$channel] = $server_channel; - extract(unpack('Nwindow_size', $this->_string_shift($response, 4))); - $this->window_size_client_to_server[$channel] = $window_size; - $temp = unpack('Npacket_size_client_to_server', $this->_string_shift($response, 4)); - $this->packet_size_client_to_server[$channel] = $temp['packet_size_client_to_server']; - return $client_channel == $channel ? true : $this->_get_channel_packet($client_channel, $skip_extended); - //case NET_SSH2_MSG_CHANNEL_OPEN_FAILURE: - default: - user_error('Unable to open channel'); - return $this->_disconnect(NET_SSH2_DISCONNECT_BY_APPLICATION); + // will not be setup yet on incoming channel open request + if (isset($channel) && isset($this->channel_status[$channel]) && isset($this->window_size_server_to_client[$channel])) { + $this->window_size_server_to_client[$channel]-= strlen($response); + + // resize the window, if appropriate + if ($this->window_size_server_to_client[$channel] < 0) { + $packet = pack('CNN', NET_SSH2_MSG_CHANNEL_WINDOW_ADJUST, $this->server_channels[$channel], $this->window_size); + if (!$this->_send_binary_packet($packet)) { + return false; } - break; - case NET_SSH2_MSG_CHANNEL_REQUEST: - switch ($type) { - case NET_SSH2_MSG_CHANNEL_SUCCESS: - return true; - case NET_SSH2_MSG_CHANNEL_FAILURE: - return false; - default: - user_error('Unable to fulfill channel request'); - return $this->_disconnect(NET_SSH2_DISCONNECT_BY_APPLICATION); - } - case NET_SSH2_MSG_CHANNEL_CLOSE: - return $type == NET_SSH2_MSG_CHANNEL_CLOSE ? true : $this->_get_channel_packet($client_channel, $skip_extended); + $this->window_size_server_to_client[$channel]+= $this->window_size; + } + + switch ($this->channel_status[$channel]) { + case NET_SSH2_MSG_CHANNEL_OPEN: + switch ($type) { + case NET_SSH2_MSG_CHANNEL_OPEN_CONFIRMATION: + extract(unpack('Nserver_channel', $this->_string_shift($response, 4))); + $this->server_channels[$channel] = $server_channel; + extract(unpack('Nwindow_size', $this->_string_shift($response, 4))); + if ($window_size < 0) { + $window_size&= 0x7FFFFFFF; + $window_size+= 0x80000000; + } + $this->window_size_client_to_server[$channel] = $window_size; + $temp = unpack('Npacket_size_client_to_server', $this->_string_shift($response, 4)); + $this->packet_size_client_to_server[$channel] = $temp['packet_size_client_to_server']; + $result = $client_channel == $channel ? true : $this->_get_channel_packet($client_channel, $skip_extended); + $this->_on_channel_open(); + return $result; + //case NET_SSH2_MSG_CHANNEL_OPEN_FAILURE: + default: + user_error('Unable to open channel'); + return $this->_disconnect(NET_SSH2_DISCONNECT_BY_APPLICATION); + } + break; + case NET_SSH2_MSG_CHANNEL_REQUEST: + switch ($type) { + case NET_SSH2_MSG_CHANNEL_SUCCESS: + return true; + case NET_SSH2_MSG_CHANNEL_FAILURE: + return false; + default: + user_error('Unable to fulfill channel request'); + return $this->_disconnect(NET_SSH2_DISCONNECT_BY_APPLICATION); + } + case NET_SSH2_MSG_CHANNEL_CLOSE: + return $type == NET_SSH2_MSG_CHANNEL_CLOSE ? true : $this->_get_channel_packet($client_channel, $skip_extended); + } } // ie. $this->channel_status[$channel] == NET_SSH2_MSG_CHANNEL_DATA @@ -3032,7 +3294,7 @@ class Net_SSH2 switch ($type) { case NET_SSH2_MSG_CHANNEL_DATA: /* - if ($channel == NET_SSH2_CHANNEL_EXEC) { + if ($channel == self::CHANNEL_EXEC) { // SCP requires null packets, such as this, be sent. further, in the case of the ssh.com SSH server // this actually seems to make things twice as fast. more to the point, the message right after // SSH_MSG_CHANNEL_DATA (usually SSH_MSG_IGNORE) won't block for as long as it would have otherwise. @@ -3042,6 +3304,15 @@ class Net_SSH2 */ extract(unpack('Nlength', $this->_string_shift($response, 4))); $data = $this->_string_shift($response, $length); + + if ($channel == self::CHANNEL_AGENT_FORWARD) { + $agent_response = $this->agent->_forward_data($data); + if (!is_bool($agent_response)) { + $this->_send_channel_packet($channel, $agent_response); + } + break; + } + if ($client_channel == $channel) { return $data; } @@ -3052,7 +3323,7 @@ class Net_SSH2 break; case NET_SSH2_MSG_CHANNEL_EXTENDED_DATA: /* - if ($client_channel == NET_SSH2_CHANNEL_EXEC) { + if ($client_channel == self::CHANNEL_EXEC) { $this->_send_channel_packet($client_channel, chr(0)); } */ @@ -3108,15 +3379,17 @@ class Net_SSH2 case NET_SSH2_MSG_CHANNEL_CLOSE: $this->curTimeout = 0; - if ($this->bitmap & NET_SSH2_MASK_SHELL) { - $this->bitmap&= ~NET_SSH2_MASK_SHELL; + if ($this->bitmap & self::MASK_SHELL) { + $this->bitmap&= ~self::MASK_SHELL; } if ($this->channel_status[$channel] != NET_SSH2_MSG_CHANNEL_EOF) { $this->_send_binary_packet(pack('CN', NET_SSH2_MSG_CHANNEL_CLOSE, $this->server_channels[$channel])); } $this->channel_status[$channel] = NET_SSH2_MSG_CHANNEL_CLOSE; - return true; + if ($client_channel == $channel) { + return true; + } case NET_SSH2_MSG_CHANNEL_EOF: break; default: @@ -3131,10 +3404,10 @@ class Net_SSH2 * * See '6. Binary Packet Protocol' of rfc4253 for more info. * - * @param String $data - * @param optional String $logged - * @see Net_SSH2::_get_binary_packet() - * @return Boolean + * @param string $data + * @param string $logged + * @see self::_get_binary_packet() + * @return bool * @access private */ function _send_binary_packet($data, $logged = null) @@ -3157,7 +3430,7 @@ class Net_SSH2 $packet_length+= (($this->encrypt_block_size - 1) * $packet_length) % $this->encrypt_block_size; // subtracting strlen($data) is obvious - subtracting 5 is necessary because of packet_length and padding_length $padding_length = $packet_length - strlen($data) - 5; - $padding = crypt_random_string($padding_length); + $padding = Random::string($padding_length); // we subtract 4 from packet_length because the packet_length field isn't supposed to include itself $packet = pack('NCa*', $packet_length - 4, $padding_length, $data . $padding); @@ -3171,12 +3444,12 @@ class Net_SSH2 $packet.= $hmac; - $start = strtok(microtime(), ' ') + strtok(''); // http://php.net/microtime#61838 + $start = microtime(true); $result = strlen($packet) == fputs($this->fsock, $packet); - $stop = strtok(microtime(), ' ') + strtok(''); + $stop = microtime(true); if (defined('NET_SSH2_LOGGING')) { - $current = strtok(microtime(), ' ') + strtok(''); + $current = microtime(true); $message_number = isset($this->message_numbers[ord($data[0])]) ? $this->message_numbers[ord($data[0])] : 'UNKNOWN (' . ord($data[0]) . ')'; $message_number = '-> ' . $message_number . ' (since last: ' . round($current - $this->last_packet, 4) . ', network: ' . round($stop - $start, 4) . 's)'; @@ -3192,7 +3465,7 @@ class Net_SSH2 * * Makes sure that only the last 1MB worth of packets will be logged * - * @param String $data + * @param string $data * @access private */ function _append_log($message_number, $message) @@ -3204,15 +3477,15 @@ class Net_SSH2 switch (NET_SSH2_LOGGING) { // useful for benchmarks - case NET_SSH2_LOG_SIMPLE: + case self::LOG_SIMPLE: $this->message_number_log[] = $message_number; break; // the most useful log for SSH2 - case NET_SSH2_LOG_COMPLEX: + case self::LOG_COMPLEX: $this->message_number_log[] = $message_number; $this->log_size+= strlen($message); $this->message_log[] = $message; - while ($this->log_size > NET_SSH2_LOG_MAX_SIZE) { + while ($this->log_size > self::LOG_MAX_SIZE) { $this->log_size-= strlen(array_shift($this->message_log)); array_shift($this->message_number_log); } @@ -3220,7 +3493,7 @@ class Net_SSH2 // dump the output out realtime; packets may be interspersed with non packets, // passwords won't be filtered out and select other packets may not be correctly // identified - case NET_SSH2_LOG_REALTIME: + case self::LOG_REALTIME: switch (PHP_SAPI) { case 'cli': $start = $stop = "\r\n"; @@ -3233,14 +3506,14 @@ class Net_SSH2 @flush(); @ob_flush(); break; - // basically the same thing as NET_SSH2_LOG_REALTIME with the caveat that NET_SSH2_LOG_REALTIME_FILE - // needs to be defined and that the resultant log file will be capped out at NET_SSH2_LOG_MAX_SIZE. + // basically the same thing as self::LOG_REALTIME with the caveat that self::LOG_REALTIME_FILE + // needs to be defined and that the resultant log file will be capped out at self::LOG_MAX_SIZE. // the earliest part of the log file is denoted by the first <<< START >>> and is not going to necessarily // at the beginning of the file - case NET_SSH2_LOG_REALTIME_FILE: + case self::LOG_REALTIME_FILE: if (!isset($this->realtime_log_file)) { // PHP doesn't seem to like using constants in fopen() - $filename = NET_SSH2_LOG_REALTIME_FILENAME; + $filename = self::LOG_REALTIME_FILENAME; $fp = fopen($filename, 'w'); $this->realtime_log_file = $fp; } @@ -3254,7 +3527,7 @@ class Net_SSH2 fseek($this->realtime_log_file, ftell($this->realtime_log_file) - strlen($temp)); } $this->realtime_log_size+= strlen($entry); - if ($this->realtime_log_size > NET_SSH2_LOG_MAX_SIZE) { + if ($this->realtime_log_size > self::LOG_MAX_SIZE) { fseek($this->realtime_log_file, 0); $this->realtime_log_size = strlen($entry); $this->realtime_log_wrap = true; @@ -3268,19 +3541,19 @@ class Net_SSH2 * * Spans multiple SSH_MSG_CHANNEL_DATAs if appropriate * - * @param Integer $client_channel - * @param String $data - * @return Boolean + * @param int $client_channel + * @param string $data + * @return bool * @access private */ function _send_channel_packet($client_channel, $data) { while (strlen($data)) { if (!$this->window_size_client_to_server[$client_channel]) { - $this->bitmap^= NET_SSH2_MASK_WINDOW_ADJUST; + $this->bitmap^= self::MASK_WINDOW_ADJUST; // using an invalid channel will let the buffers be built up for the valid channels $this->_get_channel_packet(-1); - $this->bitmap^= NET_SSH2_MASK_WINDOW_ADJUST; + $this->bitmap^= self::MASK_WINDOW_ADJUST; } /* The maximum amount of data allowed is determined by the maximum @@ -3293,7 +3566,8 @@ class Net_SSH2 ); $temp = $this->_string_shift($data, $max_size); - $packet = pack('CN2a*', + $packet = pack( + 'CN2a*', NET_SSH2_MSG_CHANNEL_DATA, $this->server_channels[$client_channel], strlen($temp), @@ -3311,13 +3585,13 @@ class Net_SSH2 /** * Closes and flushes a channel * - * Net_SSH2 doesn't properly close most channels. For exec() channels are normally closed by the server + * \phpseclib\Net\SSH2 doesn't properly close most channels. For exec() channels are normally closed by the server * and for SFTP channels are presumably closed when the client disconnects. This functions is intended * for SCP more than anything. * - * @param Integer $client_channel - * @param Boolean $want_reply - * @return Boolean + * @param int $client_channel + * @param bool $want_reply + * @return bool * @access private */ function _close_channel($client_channel, $want_reply = false) @@ -3334,27 +3608,28 @@ class Net_SSH2 $this->curTimeout = 0; - while (!is_bool($this->_get_channel_packet($client_channel))); + while (!is_bool($this->_get_channel_packet($client_channel))) { + } if ($want_reply) { $this->_send_binary_packet(pack('CN', NET_SSH2_MSG_CHANNEL_CLOSE, $this->server_channels[$client_channel])); } - if ($this->bitmap & NET_SSH2_MASK_SHELL) { - $this->bitmap&= ~NET_SSH2_MASK_SHELL; + if ($this->bitmap & self::MASK_SHELL) { + $this->bitmap&= ~self::MASK_SHELL; } } /** * Disconnect * - * @param Integer $reason - * @return Boolean + * @param int $reason + * @return bool * @access private */ function _disconnect($reason) { - if ($this->bitmap & NET_SSH2_MASK_CONNECTED) { + if ($this->bitmap & self::MASK_CONNECTED) { $data = pack('CNNa*Na*', NET_SSH2_MSG_DISCONNECT, $reason, 0, '', 0, ''); $this->_send_binary_packet($data); $this->bitmap = 0; @@ -3368,9 +3643,9 @@ class Net_SSH2 * * Inspired by array_shift * - * @param String $string - * @param optional Integer $index - * @return String + * @param string $string + * @param int $index + * @return string * @access private */ function _string_shift(&$string, $index = 1) @@ -3387,14 +3662,14 @@ class Net_SSH2 * named constants from it, using the value as the name of the constant and the index as the value of the constant. * If any of the constants that would be defined already exists, none of the constants will be defined. * - * @param Array $array + * @param array $array * @access private */ function _define_array() { $args = func_get_args(); foreach ($args as $arg) { - foreach ($arg as $key=>$value) { + foreach ($arg as $key => $value) { if (!defined($value)) { define($value, $key); } else { @@ -3407,10 +3682,10 @@ class Net_SSH2 /** * Returns a log of the packets that have been sent and received. * - * Returns a string if NET_SSH2_LOGGING == NET_SSH2_LOG_COMPLEX, an array if NET_SSH2_LOGGING == NET_SSH2_LOG_SIMPLE and false if !defined('NET_SSH2_LOGGING') + * Returns a string if NET_SSH2_LOGGING == self::LOG_COMPLEX, an array if NET_SSH2_LOGGING == self::LOG_SIMPLE and false if !defined('NET_SSH2_LOGGING') * * @access public - * @return String or Array + * @return array|false|string */ function getLog() { @@ -3419,10 +3694,10 @@ class Net_SSH2 } switch (NET_SSH2_LOGGING) { - case NET_SSH2_LOG_SIMPLE: + case self::LOG_SIMPLE: return $this->message_number_log; break; - case NET_SSH2_LOG_COMPLEX: + case self::LOG_COMPLEX: return $this->_format_log($this->message_log, $this->message_number_log); break; default: @@ -3433,10 +3708,10 @@ class Net_SSH2 /** * Formats a log for printing * - * @param Array $message_log - * @param Array $message_number_log + * @param array $message_log + * @param array $message_number_log * @access private - * @return String + * @return string */ function _format_log($message_log, $message_number_log) { @@ -3469,19 +3744,54 @@ class Net_SSH2 * * For use with preg_replace_callback() * - * @param Array $matches + * @param array $matches * @access private - * @return String + * @return string */ function _format_log_helper($matches) { return $this->log_boundary . str_pad(dechex(ord($matches[0])), 2, '0', STR_PAD_LEFT); } + /** + * Helper function for agent->_on_channel_open() + * + * Used when channels are created to inform agent + * of said channel opening. Must be called after + * channel open confirmation received + * + * @access private + */ + function _on_channel_open() + { + if (isset($this->agent)) { + $this->agent->_on_channel_open($this); + } + } + + /** + * Returns the first value of the intersection of two arrays or false if + * the intersection is empty. The order is defined by the first parameter. + * + * @param array $array1 + * @param array $array2 + * @return mixed False if intersection is empty, else intersected value. + * @access private + */ + function _array_intersect_first($array1, $array2) + { + foreach ($array1 as $value) { + if (in_array($value, $array2)) { + return $value; + } + } + return false; + } + /** * Returns all errors * - * @return String + * @return string[] * @access public */ function getErrors() @@ -3492,18 +3802,22 @@ class Net_SSH2 /** * Returns the last error * - * @return String + * @return string * @access public */ function getLastError() { - return $this->errors[count($this->errors) - 1]; + $count = count($this->errors); + + if ($count > 0) { + return $this->errors[$count - 1]; + } } /** * Return the server identification. * - * @return String + * @return string * @access public */ function getServerIdentification() @@ -3516,7 +3830,7 @@ class Net_SSH2 /** * Return a list of the key exchange algorithms the server supports. * - * @return Array + * @return array * @access public */ function getKexAlgorithms() @@ -3529,7 +3843,7 @@ class Net_SSH2 /** * Return a list of the host key (public key) algorithms the server supports. * - * @return Array + * @return array * @access public */ function getServerHostKeyAlgorithms() @@ -3542,7 +3856,7 @@ class Net_SSH2 /** * Return a list of the (symmetric key) encryption algorithms the server supports, when receiving stuff from the client. * - * @return Array + * @return array * @access public */ function getEncryptionAlgorithmsClient2Server() @@ -3555,7 +3869,7 @@ class Net_SSH2 /** * Return a list of the (symmetric key) encryption algorithms the server supports, when sending stuff to the client. * - * @return Array + * @return array * @access public */ function getEncryptionAlgorithmsServer2Client() @@ -3568,7 +3882,7 @@ class Net_SSH2 /** * Return a list of the MAC algorithms the server supports, when receiving stuff from the client. * - * @return Array + * @return array * @access public */ function getMACAlgorithmsClient2Server() @@ -3581,7 +3895,7 @@ class Net_SSH2 /** * Return a list of the MAC algorithms the server supports, when sending stuff to the client. * - * @return Array + * @return array * @access public */ function getMACAlgorithmsServer2Client() @@ -3594,7 +3908,7 @@ class Net_SSH2 /** * Return a list of the compression algorithms the server supports, when receiving stuff from the client. * - * @return Array + * @return array * @access public */ function getCompressionAlgorithmsClient2Server() @@ -3607,7 +3921,7 @@ class Net_SSH2 /** * Return a list of the compression algorithms the server supports, when sending stuff to the client. * - * @return Array + * @return array * @access public */ function getCompressionAlgorithmsServer2Client() @@ -3620,7 +3934,7 @@ class Net_SSH2 /** * Return a list of the languages the server supports, when sending stuff to the client. * - * @return Array + * @return array * @access public */ function getLanguagesServer2Client() @@ -3633,7 +3947,7 @@ class Net_SSH2 /** * Return a list of the languages the server supports, when receiving stuff from the client. * - * @return Array + * @return array * @access public */ function getLanguagesClient2Server() @@ -3649,7 +3963,7 @@ class Net_SSH2 * Quoting from the RFC, "in some jurisdictions, sending a warning message before * authentication may be relevant for getting legal protection." * - * @return String + * @return string * @access public */ function getBannerMessage() @@ -3663,12 +3977,12 @@ class Net_SSH2 * Caching this the first time you connect to a server and checking the result on subsequent connections * is recommended. Returns false if the server signature is not signed correctly with the public host key. * - * @return Mixed + * @return mixed * @access public */ function getServerPublicHostKey() { - if (!($this->bitmap & NET_SSH2_MASK_CONSTRUCTOR)) { + if (!($this->bitmap & self::MASK_CONSTRUCTOR)) { if (!$this->_connect()) { return false; } @@ -3690,19 +4004,19 @@ class Net_SSH2 switch ($this->signature_format) { case 'ssh-dss': - $zero = new Math_BigInteger(); + $zero = new BigInteger(); $temp = unpack('Nlength', $this->_string_shift($server_public_host_key, 4)); - $p = new Math_BigInteger($this->_string_shift($server_public_host_key, $temp['length']), -256); + $p = new BigInteger($this->_string_shift($server_public_host_key, $temp['length']), -256); $temp = unpack('Nlength', $this->_string_shift($server_public_host_key, 4)); - $q = new Math_BigInteger($this->_string_shift($server_public_host_key, $temp['length']), -256); + $q = new BigInteger($this->_string_shift($server_public_host_key, $temp['length']), -256); $temp = unpack('Nlength', $this->_string_shift($server_public_host_key, 4)); - $g = new Math_BigInteger($this->_string_shift($server_public_host_key, $temp['length']), -256); + $g = new BigInteger($this->_string_shift($server_public_host_key, $temp['length']), -256); $temp = unpack('Nlength', $this->_string_shift($server_public_host_key, 4)); - $y = new Math_BigInteger($this->_string_shift($server_public_host_key, $temp['length']), -256); + $y = new BigInteger($this->_string_shift($server_public_host_key, $temp['length']), -256); /* The value for 'dss_signature_blob' is encoded as a string containing r, followed by s (which are 160-bit integers, without lengths or @@ -3713,8 +4027,8 @@ class Net_SSH2 return $this->_disconnect(NET_SSH2_DISCONNECT_KEY_EXCHANGE_FAILED); } - $r = new Math_BigInteger($this->_string_shift($signature, 20), 256); - $s = new Math_BigInteger($this->_string_shift($signature, 20), 256); + $r = new BigInteger($this->_string_shift($signature, 20), 256); + $s = new BigInteger($this->_string_shift($signature, 20), 256); switch (true) { case $r->equals($zero): @@ -3727,7 +4041,7 @@ class Net_SSH2 $w = $s->modInverse($q); - $u1 = $w->multiply(new Math_BigInteger(sha1($this->exchange_hash), 16)); + $u1 = $w->multiply(new BigInteger(sha1($this->exchange_hash), 16)); list(, $u1) = $u1->divide($q); $u2 = $w->multiply($r); @@ -3748,24 +4062,20 @@ class Net_SSH2 break; case 'ssh-rsa': $temp = unpack('Nlength', $this->_string_shift($server_public_host_key, 4)); - $e = new Math_BigInteger($this->_string_shift($server_public_host_key, $temp['length']), -256); + $e = new BigInteger($this->_string_shift($server_public_host_key, $temp['length']), -256); $temp = unpack('Nlength', $this->_string_shift($server_public_host_key, 4)); $rawN = $this->_string_shift($server_public_host_key, $temp['length']); - $n = new Math_BigInteger($rawN, -256); + $n = new BigInteger($rawN, -256); $nLength = strlen(ltrim($rawN, "\0")); /* $temp = unpack('Nlength', $this->_string_shift($signature, 4)); $signature = $this->_string_shift($signature, $temp['length']); - if (!class_exists('Crypt_RSA')) { - include_once 'Crypt/RSA.php'; - } - - $rsa = new Crypt_RSA(); - $rsa->setSignatureMode(CRYPT_RSA_SIGNATURE_PKCS1); - $rsa->loadKey(array('e' => $e, 'n' => $n), CRYPT_RSA_PUBLIC_FORMAT_RAW); + $rsa = new RSA(); + $rsa->setSignatureMode(RSA::SIGNATURE_PKCS1); + $rsa->loadKey(array('e' => $e, 'n' => $n), RSA::PUBLIC_FORMAT_RAW); if (!$rsa->verify($this->exchange_hash, $signature)) { user_error('Bad server signature'); return $this->_disconnect(NET_SSH2_DISCONNECT_HOST_KEY_NOT_VERIFIABLE); @@ -3773,7 +4083,7 @@ class Net_SSH2 */ $temp = unpack('Nlength', $this->_string_shift($signature, 4)); - $s = new Math_BigInteger($this->_string_shift($signature, $temp['length']), 256); + $s = new BigInteger($this->_string_shift($signature, $temp['length']), 256); // validate an RSA signature per "8.2 RSASSA-PKCS1-v1_5", "5.2.2 RSAVP1", and "9.1 EMSA-PSS" in the // following URL: @@ -3781,7 +4091,7 @@ class Net_SSH2 // also, see SSHRSA.c (rsa2_verifysig) in PuTTy's source. - if ($s->compare(new Math_BigInteger()) < 0 || $s->compare($n->subtract(new Math_BigInteger(1))) > 0) { + if ($s->compare(new BigInteger()) < 0 || $s->compare($n->subtract(new BigInteger(1))) > 0) { user_error('Invalid signature'); return $this->_disconnect(NET_SSH2_DISCONNECT_KEY_EXCHANGE_FAILED); } @@ -3808,7 +4118,7 @@ class Net_SSH2 /** * Returns the exit status of an SSH command or false. * - * @return Integer or false + * @return false|int * @access public */ function getExitStatus() @@ -3822,7 +4132,7 @@ class Net_SSH2 /** * Returns the number of columns for the terminal window size. * - * @return Integer + * @return int * @access public */ function getWindowColumns() @@ -3833,7 +4143,7 @@ class Net_SSH2 /** * Returns the number of rows for the terminal window size. * - * @return Integer + * @return int * @access public */ function getWindowRows() @@ -3844,7 +4154,7 @@ class Net_SSH2 /** * Sets the number of columns for the terminal window size. * - * @param Integer $value + * @param int $value * @access public */ function setWindowColumns($value) @@ -3855,7 +4165,7 @@ class Net_SSH2 /** * Sets the number of rows for the terminal window size. * - * @param Integer $value + * @param int $value * @access public */ function setWindowRows($value) @@ -3866,8 +4176,8 @@ class Net_SSH2 /** * Sets the number of columns and rows for the terminal window size. * - * @param Integer $columns - * @param Integer $rows + * @param int $columns + * @param int $rows * @access public */ function setWindowSize($columns = 80, $rows = 24) diff --git a/securemail/vendor/phpseclib/phpseclib/phpseclib/System/SSH/Agent.php b/securemail/vendor/phpseclib/phpseclib/phpseclib/System/SSH/Agent.php index 4c0ef733..a4ff0549 100644 --- a/securemail/vendor/phpseclib/phpseclib/phpseclib/System/SSH/Agent.php +++ b/securemail/vendor/phpseclib/phpseclib/phpseclib/System/SSH/Agent.php @@ -1,18 +1,18 @@ * login('username', $agent)) { * exit('Login Failed'); * } @@ -22,26 +22,8 @@ * ?> *
* setPassword('whatever'); * $key->loadKey(file_get_contents('privatekey')); * - * $ssh = new Net_SSH2('www.domain.tld'); + * $ssh = new \phpseclib\Net\SSH2('www.domain.tld'); * if (!$ssh->login('username', $key)) { * exit('Login Failed'); * } @@ -40,120 +39,117 @@ * ?> *
PEAR Channel: [phpseclib.sourceforge.net](http://phpseclib.sourceforge.net/pear.htm)
@@ -16,7 +16,7 @@ PEAR Channel: [phpseclib.sourceforge.net](http://phpseclib.sourceforge.net/pear.
## Documentation
* [Documentation / Manual](http://phpseclib.sourceforge.net/)
-* [API Documentation](http://phpseclib.bantux.org/api/master/) (generated by Sami)
+* [API Documentation](http://phpseclib.bantux.org/api/2.0/) (generated by Sami)
## Support
@@ -40,7 +40,7 @@ Dependencies are managed via Composer.
2. Install Dependencies
``` sh
- php composer.phar install --dev
+ php composer.phar install
```
## Contributing
diff --git a/securemail/vendor/phpseclib/phpseclib/composer.json b/securemail/vendor/phpseclib/phpseclib/composer.json
new file mode 100644
index 00000000..4b84b110
--- /dev/null
+++ b/securemail/vendor/phpseclib/phpseclib/composer.json
@@ -0,0 +1,76 @@
+{
+ "name": "phpseclib/phpseclib",
+ "type": "library",
+ "description": "PHP Secure Communications Library - Pure-PHP implementations of RSA, AES, SSH2, SFTP, X.509 etc.",
+ "keywords": [
+ "security",
+ "crypto",
+ "cryptography",
+ "encryption",
+ "signature",
+ "signing",
+ "rsa",
+ "aes",
+ "blowfish",
+ "twofish",
+ "ssh",
+ "sftp",
+ "x509",
+ "x.509",
+ "asn1",
+ "asn.1",
+ "BigInteger"
+ ],
+ "homepage": "http://phpseclib.sourceforge.net",
+ "license": "MIT",
+ "authors": [
+ {
+ "name": "Jim Wigginton",
+ "email": "terrafrost@php.net",
+ "role": "Lead Developer"
+ },
+ {
+ "name": "Patrick Monnerat",
+ "email": "pm@datasphere.ch",
+ "role": "Developer"
+ },
+ {
+ "name": "Andreas Fischer",
+ "email": "bantu@phpbb.com",
+ "role": "Developer"
+ },
+ {
+ "name": "Hans-Jürgen Petrich",
+ "email": "petrich@tronic-media.com",
+ "role": "Developer"
+ },
+ {
+ "name": "Graham Campbell",
+ "email": "graham@alt-three.com",
+ "role": "Developer"
+ }
+ ],
+ "require": {
+ "php": ">=5.3.3"
+ },
+ "require-dev": {
+ "phing/phing": "~2.7",
+ "phpunit/phpunit": "~4.0",
+ "sami/sami": "~2.0",
+ "squizlabs/php_codesniffer": "~2.0"
+ },
+ "suggest": {
+ "ext-libsodium": "SSH2/SFTP can make use of some algorithms provided by the libsodium-php extension.",
+ "ext-openssl": "Install the OpenSSL extension in order to speed up a wide variety of cryptographic operations.",
+ "ext-mcrypt": "Install the Mcrypt extension in order to speed up a few other cryptographic operations.",
+ "ext-gmp": "Install the GMP (GNU Multiple Precision) extension in order to speed up arbitrary precision integer arithmetic operations."
+ },
+ "autoload": {
+ "files": [
+ "phpseclib/bootstrap.php"
+ ],
+ "psr-4": {
+ "phpseclib\\": "phpseclib/"
+ }
+ }
+}
diff --git a/securemail/vendor/phpseclib/phpseclib/composer.lock b/securemail/vendor/phpseclib/phpseclib/composer.lock
new file mode 100644
index 00000000..beda2d64
--- /dev/null
+++ b/securemail/vendor/phpseclib/phpseclib/composer.lock
@@ -0,0 +1,1819 @@
+{
+ "_readme": [
+ "This file locks the dependencies of your project to a known state",
+ "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#composer-lock-the-lock-file",
+ "This file is @generated automatically"
+ ],
+ "hash": "8599992bf6058a9da82372eb8bcae2c2",
+ "content-hash": "fde47c84178c55c06de858a2128e3d07",
+ "packages": [],
+ "packages-dev": [
+ {
+ "name": "doctrine/instantiator",
+ "version": "1.0.5",
+ "source": {
+ "type": "git",
+ "url": "https://github.com/doctrine/instantiator.git",
+ "reference": "8e884e78f9f0eb1329e445619e04456e64d8051d"
+ },
+ "dist": {
+ "type": "zip",
+ "url": "https://api.github.com/repos/doctrine/instantiator/zipball/8e884e78f9f0eb1329e445619e04456e64d8051d",
+ "reference": "8e884e78f9f0eb1329e445619e04456e64d8051d",
+ "shasum": ""
+ },
+ "require": {
+ "php": ">=5.3,<8.0-DEV"
+ },
+ "require-dev": {
+ "athletic/athletic": "~0.1.8",
+ "ext-pdo": "*",
+ "ext-phar": "*",
+ "phpunit/phpunit": "~4.0",
+ "squizlabs/php_codesniffer": "~2.0"
+ },
+ "type": "library",
+ "extra": {
+ "branch-alias": {
+ "dev-master": "1.0.x-dev"
+ }
+ },
+ "autoload": {
+ "psr-4": {
+ "Doctrine\\Instantiator\\": "src/Doctrine/Instantiator/"
+ }
+ },
+ "notification-url": "https://packagist.org/downloads/",
+ "license": [
+ "MIT"
+ ],
+ "authors": [
+ {
+ "name": "Marco Pivetta",
+ "email": "ocramius@gmail.com",
+ "homepage": "http://ocramius.github.com/"
+ }
+ ],
+ "description": "A small, lightweight utility to instantiate objects in PHP without invoking their constructors",
+ "homepage": "https://github.com/doctrine/instantiator",
+ "keywords": [
+ "constructor",
+ "instantiate"
+ ],
+ "time": "2015-06-14 21:17:01"
+ },
+ {
+ "name": "michelf/php-markdown",
+ "version": "1.6.0",
+ "source": {
+ "type": "git",
+ "url": "https://github.com/michelf/php-markdown.git",
+ "reference": "156e56ee036505ec637d761ee62dc425d807183c"
+ },
+ "dist": {
+ "type": "zip",
+ "url": "https://api.github.com/repos/michelf/php-markdown/zipball/156e56ee036505ec637d761ee62dc425d807183c",
+ "reference": "156e56ee036505ec637d761ee62dc425d807183c",
+ "shasum": ""
+ },
+ "require": {
+ "php": ">=5.3.0"
+ },
+ "type": "library",
+ "extra": {
+ "branch-alias": {
+ "dev-lib": "1.4.x-dev"
+ }
+ },
+ "autoload": {
+ "psr-0": {
+ "Michelf": ""
+ }
+ },
+ "notification-url": "https://packagist.org/downloads/",
+ "license": [
+ "BSD-3-Clause"
+ ],
+ "authors": [
+ {
+ "name": "Michel Fortin",
+ "email": "michel.fortin@michelf.ca",
+ "homepage": "https://michelf.ca/",
+ "role": "Developer"
+ },
+ {
+ "name": "John Gruber",
+ "homepage": "https://daringfireball.net/"
+ }
+ ],
+ "description": "PHP Markdown",
+ "homepage": "https://michelf.ca/projects/php-markdown/",
+ "keywords": [
+ "markdown"
+ ],
+ "time": "2015-12-24 01:37:31"
+ },
+ {
+ "name": "nikic/php-parser",
+ "version": "v0.9.5",
+ "source": {
+ "type": "git",
+ "url": "https://github.com/nikic/PHP-Parser.git",
+ "reference": "ef70767475434bdb3615b43c327e2cae17ef12eb"
+ },
+ "dist": {
+ "type": "zip",
+ "url": "https://api.github.com/repos/nikic/PHP-Parser/zipball/ef70767475434bdb3615b43c327e2cae17ef12eb",
+ "reference": "ef70767475434bdb3615b43c327e2cae17ef12eb",
+ "shasum": ""
+ },
+ "require": {
+ "ext-tokenizer": "*",
+ "php": ">=5.2"
+ },
+ "type": "library",
+ "extra": {
+ "branch-alias": {
+ "dev-master": "0.9-dev"
+ }
+ },
+ "autoload": {
+ "psr-0": {
+ "PHPParser": "lib/"
+ }
+ },
+ "notification-url": "https://packagist.org/downloads/",
+ "license": [
+ "BSD-3-Clause"
+ ],
+ "authors": [
+ {
+ "name": "Nikita Popov"
+ }
+ ],
+ "description": "A PHP parser written in PHP",
+ "keywords": [
+ "parser",
+ "php"
+ ],
+ "time": "2014-07-23 18:24:17"
+ },
+ {
+ "name": "phing/phing",
+ "version": "2.14.0",
+ "source": {
+ "type": "git",
+ "url": "https://github.com/phingofficial/phing.git",
+ "reference": "7dd73c83c377623def54b58121f46b4dcb35dd61"
+ },
+ "dist": {
+ "type": "zip",
+ "url": "https://api.github.com/repos/phingofficial/phing/zipball/7dd73c83c377623def54b58121f46b4dcb35dd61",
+ "reference": "7dd73c83c377623def54b58121f46b4dcb35dd61",
+ "shasum": ""
+ },
+ "require": {
+ "php": ">=5.2.0"
+ },
+ "require-dev": {
+ "ext-pdo_sqlite": "*",
+ "lastcraft/simpletest": "@dev",
+ "mikey179/vfsstream": "^1.6",
+ "pdepend/pdepend": "2.x",
+ "pear/archive_tar": "1.4.x",
+ "pear/http_request2": "dev-trunk",
+ "pear/net_growl": "dev-trunk",
+ "pear/pear-core-minimal": "1.10.1",
+ "pear/versioncontrol_git": "@dev",
+ "pear/versioncontrol_svn": "~0.5",
+ "phpdocumentor/phpdocumentor": "2.x",
+ "phploc/phploc": "~2.0.6",
+ "phpmd/phpmd": "~2.2",
+ "phpunit/phpunit": ">=3.7",
+ "sebastian/git": "~1.0",
+ "sebastian/phpcpd": "2.x",
+ "squizlabs/php_codesniffer": "~2.2",
+ "symfony/yaml": "~2.7"
+ },
+ "suggest": {
+ "pdepend/pdepend": "PHP version of JDepend",
+ "pear/archive_tar": "Tar file management class",
+ "pear/versioncontrol_git": "A library that provides OO interface to handle Git repository",
+ "pear/versioncontrol_svn": "A simple OO-style interface for Subversion, the free/open-source version control system",
+ "phpdocumentor/phpdocumentor": "Documentation Generator for PHP",
+ "phploc/phploc": "A tool for quickly measuring the size of a PHP project",
+ "phpmd/phpmd": "PHP version of PMD tool",
+ "phpunit/php-code-coverage": "Library that provides collection, processing, and rendering functionality for PHP code coverage information",
+ "phpunit/phpunit": "The PHP Unit Testing Framework",
+ "sebastian/phpcpd": "Copy/Paste Detector (CPD) for PHP code",
+ "tedivm/jshrink": "Javascript Minifier built in PHP"
+ },
+ "bin": [
+ "bin/phing"
+ ],
+ "type": "library",
+ "extra": {
+ "branch-alias": {
+ "dev-master": "2.14.x-dev"
+ }
+ },
+ "autoload": {
+ "classmap": [
+ "classes/phing/"
+ ]
+ },
+ "notification-url": "https://packagist.org/downloads/",
+ "include-path": [
+ "classes"
+ ],
+ "license": [
+ "LGPL-3.0"
+ ],
+ "authors": [
+ {
+ "name": "Michiel Rook",
+ "email": "mrook@php.net"
+ },
+ {
+ "name": "Phing Community",
+ "homepage": "https://www.phing.info/trac/wiki/Development/Contributors"
+ }
+ ],
+ "description": "PHing Is Not GNU make; it's a PHP project build system or build tool based on Apache Ant.",
+ "homepage": "https://www.phing.info/",
+ "keywords": [
+ "build",
+ "phing",
+ "task",
+ "tool"
+ ],
+ "time": "2016-03-10 21:39:23"
+ },
+ {
+ "name": "phpdocumentor/reflection-common",
+ "version": "1.0",
+ "source": {
+ "type": "git",
+ "url": "https://github.com/phpDocumentor/ReflectionCommon.git",
+ "reference": "144c307535e82c8fdcaacbcfc1d6d8eeb896687c"
+ },
+ "dist": {
+ "type": "zip",
+ "url": "https://api.github.com/repos/phpDocumentor/ReflectionCommon/zipball/144c307535e82c8fdcaacbcfc1d6d8eeb896687c",
+ "reference": "144c307535e82c8fdcaacbcfc1d6d8eeb896687c",
+ "shasum": ""
+ },
+ "require": {
+ "php": ">=5.5"
+ },
+ "require-dev": {
+ "phpunit/phpunit": "^4.6"
+ },
+ "type": "library",
+ "extra": {
+ "branch-alias": {
+ "dev-master": "1.0.x-dev"
+ }
+ },
+ "autoload": {
+ "psr-4": {
+ "phpDocumentor\\Reflection\\": [
+ "src"
+ ]
+ }
+ },
+ "notification-url": "https://packagist.org/downloads/",
+ "license": [
+ "MIT"
+ ],
+ "authors": [
+ {
+ "name": "Jaap van Otterdijk",
+ "email": "opensource@ijaap.nl"
+ }
+ ],
+ "description": "Common reflection classes used by phpdocumentor to reflect the code structure",
+ "homepage": "http://www.phpdoc.org",
+ "keywords": [
+ "FQSEN",
+ "phpDocumentor",
+ "phpdoc",
+ "reflection",
+ "static analysis"
+ ],
+ "time": "2015-12-27 11:43:31"
+ },
+ {
+ "name": "phpdocumentor/reflection-docblock",
+ "version": "3.1.0",
+ "source": {
+ "type": "git",
+ "url": "https://github.com/phpDocumentor/ReflectionDocBlock.git",
+ "reference": "9270140b940ff02e58ec577c237274e92cd40cdd"
+ },
+ "dist": {
+ "type": "zip",
+ "url": "https://api.github.com/repos/phpDocumentor/ReflectionDocBlock/zipball/9270140b940ff02e58ec577c237274e92cd40cdd",
+ "reference": "9270140b940ff02e58ec577c237274e92cd40cdd",
+ "shasum": ""
+ },
+ "require": {
+ "php": ">=5.5",
+ "phpdocumentor/reflection-common": "^1.0@dev",
+ "phpdocumentor/type-resolver": "^0.2.0",
+ "webmozart/assert": "^1.0"
+ },
+ "require-dev": {
+ "mockery/mockery": "^0.9.4",
+ "phpunit/phpunit": "^4.4"
+ },
+ "type": "library",
+ "autoload": {
+ "psr-4": {
+ "phpDocumentor\\Reflection\\": [
+ "src/"
+ ]
+ }
+ },
+ "notification-url": "https://packagist.org/downloads/",
+ "license": [
+ "MIT"
+ ],
+ "authors": [
+ {
+ "name": "Mike van Riel",
+ "email": "me@mikevanriel.com"
+ }
+ ],
+ "description": "With this component, a library can provide support for annotations via DocBlocks or otherwise retrieve information that is embedded in a DocBlock.",
+ "time": "2016-06-10 09:48:41"
+ },
+ {
+ "name": "phpdocumentor/type-resolver",
+ "version": "0.2",
+ "source": {
+ "type": "git",
+ "url": "https://github.com/phpDocumentor/TypeResolver.git",
+ "reference": "b39c7a5b194f9ed7bd0dd345c751007a41862443"
+ },
+ "dist": {
+ "type": "zip",
+ "url": "https://api.github.com/repos/phpDocumentor/TypeResolver/zipball/b39c7a5b194f9ed7bd0dd345c751007a41862443",
+ "reference": "b39c7a5b194f9ed7bd0dd345c751007a41862443",
+ "shasum": ""
+ },
+ "require": {
+ "php": ">=5.5",
+ "phpdocumentor/reflection-common": "^1.0"
+ },
+ "require-dev": {
+ "mockery/mockery": "^0.9.4",
+ "phpunit/phpunit": "^5.2||^4.8.24"
+ },
+ "type": "library",
+ "extra": {
+ "branch-alias": {
+ "dev-master": "1.0.x-dev"
+ }
+ },
+ "autoload": {
+ "psr-4": {
+ "phpDocumentor\\Reflection\\": [
+ "src/"
+ ]
+ }
+ },
+ "notification-url": "https://packagist.org/downloads/",
+ "license": [
+ "MIT"
+ ],
+ "authors": [
+ {
+ "name": "Mike van Riel",
+ "email": "me@mikevanriel.com"
+ }
+ ],
+ "time": "2016-06-10 07:14:17"
+ },
+ {
+ "name": "phpspec/prophecy",
+ "version": "v1.6.1",
+ "source": {
+ "type": "git",
+ "url": "https://github.com/phpspec/prophecy.git",
+ "reference": "58a8137754bc24b25740d4281399a4a3596058e0"
+ },
+ "dist": {
+ "type": "zip",
+ "url": "https://api.github.com/repos/phpspec/prophecy/zipball/58a8137754bc24b25740d4281399a4a3596058e0",
+ "reference": "58a8137754bc24b25740d4281399a4a3596058e0",
+ "shasum": ""
+ },
+ "require": {
+ "doctrine/instantiator": "^1.0.2",
+ "php": "^5.3|^7.0",
+ "phpdocumentor/reflection-docblock": "^2.0|^3.0.2",
+ "sebastian/comparator": "^1.1",
+ "sebastian/recursion-context": "^1.0"
+ },
+ "require-dev": {
+ "phpspec/phpspec": "^2.0"
+ },
+ "type": "library",
+ "extra": {
+ "branch-alias": {
+ "dev-master": "1.6.x-dev"
+ }
+ },
+ "autoload": {
+ "psr-0": {
+ "Prophecy\\": "src/"
+ }
+ },
+ "notification-url": "https://packagist.org/downloads/",
+ "license": [
+ "MIT"
+ ],
+ "authors": [
+ {
+ "name": "Konstantin Kudryashov",
+ "email": "ever.zet@gmail.com",
+ "homepage": "http://everzet.com"
+ },
+ {
+ "name": "Marcello Duarte",
+ "email": "marcello.duarte@gmail.com"
+ }
+ ],
+ "description": "Highly opinionated mocking framework for PHP 5.3+",
+ "homepage": "https://github.com/phpspec/prophecy",
+ "keywords": [
+ "Double",
+ "Dummy",
+ "fake",
+ "mock",
+ "spy",
+ "stub"
+ ],
+ "time": "2016-06-07 08:13:47"
+ },
+ {
+ "name": "phpunit/php-code-coverage",
+ "version": "2.2.4",
+ "source": {
+ "type": "git",
+ "url": "https://github.com/sebastianbergmann/php-code-coverage.git",
+ "reference": "eabf68b476ac7d0f73793aada060f1c1a9bf8979"
+ },
+ "dist": {
+ "type": "zip",
+ "url": "https://api.github.com/repos/sebastianbergmann/php-code-coverage/zipball/eabf68b476ac7d0f73793aada060f1c1a9bf8979",
+ "reference": "eabf68b476ac7d0f73793aada060f1c1a9bf8979",
+ "shasum": ""
+ },
+ "require": {
+ "php": ">=5.3.3",
+ "phpunit/php-file-iterator": "~1.3",
+ "phpunit/php-text-template": "~1.2",
+ "phpunit/php-token-stream": "~1.3",
+ "sebastian/environment": "^1.3.2",
+ "sebastian/version": "~1.0"
+ },
+ "require-dev": {
+ "ext-xdebug": ">=2.1.4",
+ "phpunit/phpunit": "~4"
+ },
+ "suggest": {
+ "ext-dom": "*",
+ "ext-xdebug": ">=2.2.1",
+ "ext-xmlwriter": "*"
+ },
+ "type": "library",
+ "extra": {
+ "branch-alias": {
+ "dev-master": "2.2.x-dev"
+ }
+ },
+ "autoload": {
+ "classmap": [
+ "src/"
+ ]
+ },
+ "notification-url": "https://packagist.org/downloads/",
+ "license": [
+ "BSD-3-Clause"
+ ],
+ "authors": [
+ {
+ "name": "Sebastian Bergmann",
+ "email": "sb@sebastian-bergmann.de",
+ "role": "lead"
+ }
+ ],
+ "description": "Library that provides collection, processing, and rendering functionality for PHP code coverage information.",
+ "homepage": "https://github.com/sebastianbergmann/php-code-coverage",
+ "keywords": [
+ "coverage",
+ "testing",
+ "xunit"
+ ],
+ "time": "2015-10-06 15:47:00"
+ },
+ {
+ "name": "phpunit/php-file-iterator",
+ "version": "1.4.1",
+ "source": {
+ "type": "git",
+ "url": "https://github.com/sebastianbergmann/php-file-iterator.git",
+ "reference": "6150bf2c35d3fc379e50c7602b75caceaa39dbf0"
+ },
+ "dist": {
+ "type": "zip",
+ "url": "https://api.github.com/repos/sebastianbergmann/php-file-iterator/zipball/6150bf2c35d3fc379e50c7602b75caceaa39dbf0",
+ "reference": "6150bf2c35d3fc379e50c7602b75caceaa39dbf0",
+ "shasum": ""
+ },
+ "require": {
+ "php": ">=5.3.3"
+ },
+ "type": "library",
+ "extra": {
+ "branch-alias": {
+ "dev-master": "1.4.x-dev"
+ }
+ },
+ "autoload": {
+ "classmap": [
+ "src/"
+ ]
+ },
+ "notification-url": "https://packagist.org/downloads/",
+ "license": [
+ "BSD-3-Clause"
+ ],
+ "authors": [
+ {
+ "name": "Sebastian Bergmann",
+ "email": "sb@sebastian-bergmann.de",
+ "role": "lead"
+ }
+ ],
+ "description": "FilterIterator implementation that filters files based on a list of suffixes.",
+ "homepage": "https://github.com/sebastianbergmann/php-file-iterator/",
+ "keywords": [
+ "filesystem",
+ "iterator"
+ ],
+ "time": "2015-06-21 13:08:43"
+ },
+ {
+ "name": "phpunit/php-text-template",
+ "version": "1.2.1",
+ "source": {
+ "type": "git",
+ "url": "https://github.com/sebastianbergmann/php-text-template.git",
+ "reference": "31f8b717e51d9a2afca6c9f046f5d69fc27c8686"
+ },
+ "dist": {
+ "type": "zip",
+ "url": "https://api.github.com/repos/sebastianbergmann/php-text-template/zipball/31f8b717e51d9a2afca6c9f046f5d69fc27c8686",
+ "reference": "31f8b717e51d9a2afca6c9f046f5d69fc27c8686",
+ "shasum": ""
+ },
+ "require": {
+ "php": ">=5.3.3"
+ },
+ "type": "library",
+ "autoload": {
+ "classmap": [
+ "src/"
+ ]
+ },
+ "notification-url": "https://packagist.org/downloads/",
+ "license": [
+ "BSD-3-Clause"
+ ],
+ "authors": [
+ {
+ "name": "Sebastian Bergmann",
+ "email": "sebastian@phpunit.de",
+ "role": "lead"
+ }
+ ],
+ "description": "Simple template engine.",
+ "homepage": "https://github.com/sebastianbergmann/php-text-template/",
+ "keywords": [
+ "template"
+ ],
+ "time": "2015-06-21 13:50:34"
+ },
+ {
+ "name": "phpunit/php-timer",
+ "version": "1.0.8",
+ "source": {
+ "type": "git",
+ "url": "https://github.com/sebastianbergmann/php-timer.git",
+ "reference": "38e9124049cf1a164f1e4537caf19c99bf1eb260"
+ },
+ "dist": {
+ "type": "zip",
+ "url": "https://api.github.com/repos/sebastianbergmann/php-timer/zipball/38e9124049cf1a164f1e4537caf19c99bf1eb260",
+ "reference": "38e9124049cf1a164f1e4537caf19c99bf1eb260",
+ "shasum": ""
+ },
+ "require": {
+ "php": ">=5.3.3"
+ },
+ "require-dev": {
+ "phpunit/phpunit": "~4|~5"
+ },
+ "type": "library",
+ "autoload": {
+ "classmap": [
+ "src/"
+ ]
+ },
+ "notification-url": "https://packagist.org/downloads/",
+ "license": [
+ "BSD-3-Clause"
+ ],
+ "authors": [
+ {
+ "name": "Sebastian Bergmann",
+ "email": "sb@sebastian-bergmann.de",
+ "role": "lead"
+ }
+ ],
+ "description": "Utility class for timing",
+ "homepage": "https://github.com/sebastianbergmann/php-timer/",
+ "keywords": [
+ "timer"
+ ],
+ "time": "2016-05-12 18:03:57"
+ },
+ {
+ "name": "phpunit/php-token-stream",
+ "version": "1.4.8",
+ "source": {
+ "type": "git",
+ "url": "https://github.com/sebastianbergmann/php-token-stream.git",
+ "reference": "3144ae21711fb6cac0b1ab4cbe63b75ce3d4e8da"
+ },
+ "dist": {
+ "type": "zip",
+ "url": "https://api.github.com/repos/sebastianbergmann/php-token-stream/zipball/3144ae21711fb6cac0b1ab4cbe63b75ce3d4e8da",
+ "reference": "3144ae21711fb6cac0b1ab4cbe63b75ce3d4e8da",
+ "shasum": ""
+ },
+ "require": {
+ "ext-tokenizer": "*",
+ "php": ">=5.3.3"
+ },
+ "require-dev": {
+ "phpunit/phpunit": "~4.2"
+ },
+ "type": "library",
+ "extra": {
+ "branch-alias": {
+ "dev-master": "1.4-dev"
+ }
+ },
+ "autoload": {
+ "classmap": [
+ "src/"
+ ]
+ },
+ "notification-url": "https://packagist.org/downloads/",
+ "license": [
+ "BSD-3-Clause"
+ ],
+ "authors": [
+ {
+ "name": "Sebastian Bergmann",
+ "email": "sebastian@phpunit.de"
+ }
+ ],
+ "description": "Wrapper around PHP's tokenizer extension.",
+ "homepage": "https://github.com/sebastianbergmann/php-token-stream/",
+ "keywords": [
+ "tokenizer"
+ ],
+ "time": "2015-09-15 10:49:45"
+ },
+ {
+ "name": "phpunit/phpunit",
+ "version": "4.8.26",
+ "source": {
+ "type": "git",
+ "url": "https://github.com/sebastianbergmann/phpunit.git",
+ "reference": "fc1d8cd5b5de11625979125c5639347896ac2c74"
+ },
+ "dist": {
+ "type": "zip",
+ "url": "https://api.github.com/repos/sebastianbergmann/phpunit/zipball/fc1d8cd5b5de11625979125c5639347896ac2c74",
+ "reference": "fc1d8cd5b5de11625979125c5639347896ac2c74",
+ "shasum": ""
+ },
+ "require": {
+ "ext-dom": "*",
+ "ext-json": "*",
+ "ext-pcre": "*",
+ "ext-reflection": "*",
+ "ext-spl": "*",
+ "php": ">=5.3.3",
+ "phpspec/prophecy": "^1.3.1",
+ "phpunit/php-code-coverage": "~2.1",
+ "phpunit/php-file-iterator": "~1.4",
+ "phpunit/php-text-template": "~1.2",
+ "phpunit/php-timer": "^1.0.6",
+ "phpunit/phpunit-mock-objects": "~2.3",
+ "sebastian/comparator": "~1.1",
+ "sebastian/diff": "~1.2",
+ "sebastian/environment": "~1.3",
+ "sebastian/exporter": "~1.2",
+ "sebastian/global-state": "~1.0",
+ "sebastian/version": "~1.0",
+ "symfony/yaml": "~2.1|~3.0"
+ },
+ "suggest": {
+ "phpunit/php-invoker": "~1.1"
+ },
+ "bin": [
+ "phpunit"
+ ],
+ "type": "library",
+ "extra": {
+ "branch-alias": {
+ "dev-master": "4.8.x-dev"
+ }
+ },
+ "autoload": {
+ "classmap": [
+ "src/"
+ ]
+ },
+ "notification-url": "https://packagist.org/downloads/",
+ "license": [
+ "BSD-3-Clause"
+ ],
+ "authors": [
+ {
+ "name": "Sebastian Bergmann",
+ "email": "sebastian@phpunit.de",
+ "role": "lead"
+ }
+ ],
+ "description": "The PHP Unit Testing framework.",
+ "homepage": "https://phpunit.de/",
+ "keywords": [
+ "phpunit",
+ "testing",
+ "xunit"
+ ],
+ "time": "2016-05-17 03:09:28"
+ },
+ {
+ "name": "phpunit/phpunit-mock-objects",
+ "version": "2.3.8",
+ "source": {
+ "type": "git",
+ "url": "https://github.com/sebastianbergmann/phpunit-mock-objects.git",
+ "reference": "ac8e7a3db35738d56ee9a76e78a4e03d97628983"
+ },
+ "dist": {
+ "type": "zip",
+ "url": "https://api.github.com/repos/sebastianbergmann/phpunit-mock-objects/zipball/ac8e7a3db35738d56ee9a76e78a4e03d97628983",
+ "reference": "ac8e7a3db35738d56ee9a76e78a4e03d97628983",
+ "shasum": ""
+ },
+ "require": {
+ "doctrine/instantiator": "^1.0.2",
+ "php": ">=5.3.3",
+ "phpunit/php-text-template": "~1.2",
+ "sebastian/exporter": "~1.2"
+ },
+ "require-dev": {
+ "phpunit/phpunit": "~4.4"
+ },
+ "suggest": {
+ "ext-soap": "*"
+ },
+ "type": "library",
+ "extra": {
+ "branch-alias": {
+ "dev-master": "2.3.x-dev"
+ }
+ },
+ "autoload": {
+ "classmap": [
+ "src/"
+ ]
+ },
+ "notification-url": "https://packagist.org/downloads/",
+ "license": [
+ "BSD-3-Clause"
+ ],
+ "authors": [
+ {
+ "name": "Sebastian Bergmann",
+ "email": "sb@sebastian-bergmann.de",
+ "role": "lead"
+ }
+ ],
+ "description": "Mock Object library for PHPUnit",
+ "homepage": "https://github.com/sebastianbergmann/phpunit-mock-objects/",
+ "keywords": [
+ "mock",
+ "xunit"
+ ],
+ "time": "2015-10-02 06:51:40"
+ },
+ {
+ "name": "pimple/pimple",
+ "version": "v2.1.1",
+ "source": {
+ "type": "git",
+ "url": "https://github.com/silexphp/Pimple.git",
+ "reference": "ea22fb2880faf7b7b0e17c9809c6fe25b071fd76"
+ },
+ "dist": {
+ "type": "zip",
+ "url": "https://api.github.com/repos/silexphp/Pimple/zipball/ea22fb2880faf7b7b0e17c9809c6fe25b071fd76",
+ "reference": "ea22fb2880faf7b7b0e17c9809c6fe25b071fd76",
+ "shasum": ""
+ },
+ "require": {
+ "php": ">=5.3.0"
+ },
+ "type": "library",
+ "extra": {
+ "branch-alias": {
+ "dev-master": "2.1.x-dev"
+ }
+ },
+ "autoload": {
+ "psr-0": {
+ "Pimple": "src/"
+ }
+ },
+ "notification-url": "https://packagist.org/downloads/",
+ "license": [
+ "MIT"
+ ],
+ "authors": [
+ {
+ "name": "Fabien Potencier",
+ "email": "fabien@symfony.com"
+ }
+ ],
+ "description": "Pimple is a simple Dependency Injection Container for PHP 5.3",
+ "homepage": "http://pimple.sensiolabs.org",
+ "keywords": [
+ "container",
+ "dependency injection"
+ ],
+ "time": "2014-07-24 07:10:08"
+ },
+ {
+ "name": "sami/sami",
+ "version": "v2.0.0",
+ "source": {
+ "type": "git",
+ "url": "https://github.com/FriendsOfPHP/Sami.git",
+ "reference": "fa58b324f41aa2aefe21dac4f22d8c98965fc012"
+ },
+ "dist": {
+ "type": "zip",
+ "url": "https://api.github.com/repos/FriendsOfPHP/Sami/zipball/fa58b324f41aa2aefe21dac4f22d8c98965fc012",
+ "reference": "fa58b324f41aa2aefe21dac4f22d8c98965fc012",
+ "shasum": ""
+ },
+ "require": {
+ "michelf/php-markdown": "~1.3",
+ "nikic/php-parser": "0.9.*",
+ "php": ">=5.3.0",
+ "pimple/pimple": "2.*",
+ "symfony/console": "~2.1",
+ "symfony/filesystem": "~2.1",
+ "symfony/finder": "~2.1",
+ "symfony/process": "~2.1",
+ "symfony/yaml": "~2.1",
+ "twig/twig": "1.*"
+ },
+ "bin": [
+ "sami.php"
+ ],
+ "type": "application",
+ "extra": {
+ "branch-alias": {
+ "dev-master": "2.0-dev"
+ }
+ },
+ "autoload": {
+ "psr-0": {
+ "Sami": "."
+ }
+ },
+ "notification-url": "https://packagist.org/downloads/",
+ "license": [
+ "MIT"
+ ],
+ "authors": [
+ {
+ "name": "Fabien Potencier",
+ "email": "fabien@symfony.com"
+ }
+ ],
+ "description": "Sami, an API documentation generator",
+ "homepage": "http://sami.sensiolabs.org",
+ "keywords": [
+ "phpdoc"
+ ],
+ "time": "2014-06-25 12:05:18"
+ },
+ {
+ "name": "sebastian/comparator",
+ "version": "1.2.0",
+ "source": {
+ "type": "git",
+ "url": "https://github.com/sebastianbergmann/comparator.git",
+ "reference": "937efb279bd37a375bcadf584dec0726f84dbf22"
+ },
+ "dist": {
+ "type": "zip",
+ "url": "https://api.github.com/repos/sebastianbergmann/comparator/zipball/937efb279bd37a375bcadf584dec0726f84dbf22",
+ "reference": "937efb279bd37a375bcadf584dec0726f84dbf22",
+ "shasum": ""
+ },
+ "require": {
+ "php": ">=5.3.3",
+ "sebastian/diff": "~1.2",
+ "sebastian/exporter": "~1.2"
+ },
+ "require-dev": {
+ "phpunit/phpunit": "~4.4"
+ },
+ "type": "library",
+ "extra": {
+ "branch-alias": {
+ "dev-master": "1.2.x-dev"
+ }
+ },
+ "autoload": {
+ "classmap": [
+ "src/"
+ ]
+ },
+ "notification-url": "https://packagist.org/downloads/",
+ "license": [
+ "BSD-3-Clause"
+ ],
+ "authors": [
+ {
+ "name": "Jeff Welch",
+ "email": "whatthejeff@gmail.com"
+ },
+ {
+ "name": "Volker Dusch",
+ "email": "github@wallbash.com"
+ },
+ {
+ "name": "Bernhard Schussek",
+ "email": "bschussek@2bepublished.at"
+ },
+ {
+ "name": "Sebastian Bergmann",
+ "email": "sebastian@phpunit.de"
+ }
+ ],
+ "description": "Provides the functionality to compare PHP values for equality",
+ "homepage": "http://www.github.com/sebastianbergmann/comparator",
+ "keywords": [
+ "comparator",
+ "compare",
+ "equality"
+ ],
+ "time": "2015-07-26 15:48:44"
+ },
+ {
+ "name": "sebastian/diff",
+ "version": "1.4.1",
+ "source": {
+ "type": "git",
+ "url": "https://github.com/sebastianbergmann/diff.git",
+ "reference": "13edfd8706462032c2f52b4b862974dd46b71c9e"
+ },
+ "dist": {
+ "type": "zip",
+ "url": "https://api.github.com/repos/sebastianbergmann/diff/zipball/13edfd8706462032c2f52b4b862974dd46b71c9e",
+ "reference": "13edfd8706462032c2f52b4b862974dd46b71c9e",
+ "shasum": ""
+ },
+ "require": {
+ "php": ">=5.3.3"
+ },
+ "require-dev": {
+ "phpunit/phpunit": "~4.8"
+ },
+ "type": "library",
+ "extra": {
+ "branch-alias": {
+ "dev-master": "1.4-dev"
+ }
+ },
+ "autoload": {
+ "classmap": [
+ "src/"
+ ]
+ },
+ "notification-url": "https://packagist.org/downloads/",
+ "license": [
+ "BSD-3-Clause"
+ ],
+ "authors": [
+ {
+ "name": "Kore Nordmann",
+ "email": "mail@kore-nordmann.de"
+ },
+ {
+ "name": "Sebastian Bergmann",
+ "email": "sebastian@phpunit.de"
+ }
+ ],
+ "description": "Diff implementation",
+ "homepage": "https://github.com/sebastianbergmann/diff",
+ "keywords": [
+ "diff"
+ ],
+ "time": "2015-12-08 07:14:41"
+ },
+ {
+ "name": "sebastian/environment",
+ "version": "1.3.7",
+ "source": {
+ "type": "git",
+ "url": "https://github.com/sebastianbergmann/environment.git",
+ "reference": "4e8f0da10ac5802913afc151413bc8c53b6c2716"
+ },
+ "dist": {
+ "type": "zip",
+ "url": "https://api.github.com/repos/sebastianbergmann/environment/zipball/4e8f0da10ac5802913afc151413bc8c53b6c2716",
+ "reference": "4e8f0da10ac5802913afc151413bc8c53b6c2716",
+ "shasum": ""
+ },
+ "require": {
+ "php": ">=5.3.3"
+ },
+ "require-dev": {
+ "phpunit/phpunit": "~4.4"
+ },
+ "type": "library",
+ "extra": {
+ "branch-alias": {
+ "dev-master": "1.3.x-dev"
+ }
+ },
+ "autoload": {
+ "classmap": [
+ "src/"
+ ]
+ },
+ "notification-url": "https://packagist.org/downloads/",
+ "license": [
+ "BSD-3-Clause"
+ ],
+ "authors": [
+ {
+ "name": "Sebastian Bergmann",
+ "email": "sebastian@phpunit.de"
+ }
+ ],
+ "description": "Provides functionality to handle HHVM/PHP environments",
+ "homepage": "http://www.github.com/sebastianbergmann/environment",
+ "keywords": [
+ "Xdebug",
+ "environment",
+ "hhvm"
+ ],
+ "time": "2016-05-17 03:18:57"
+ },
+ {
+ "name": "sebastian/exporter",
+ "version": "1.2.2",
+ "source": {
+ "type": "git",
+ "url": "https://github.com/sebastianbergmann/exporter.git",
+ "reference": "42c4c2eec485ee3e159ec9884f95b431287edde4"
+ },
+ "dist": {
+ "type": "zip",
+ "url": "https://api.github.com/repos/sebastianbergmann/exporter/zipball/42c4c2eec485ee3e159ec9884f95b431287edde4",
+ "reference": "42c4c2eec485ee3e159ec9884f95b431287edde4",
+ "shasum": ""
+ },
+ "require": {
+ "php": ">=5.3.3",
+ "sebastian/recursion-context": "~1.0"
+ },
+ "require-dev": {
+ "ext-mbstring": "*",
+ "phpunit/phpunit": "~4.4"
+ },
+ "type": "library",
+ "extra": {
+ "branch-alias": {
+ "dev-master": "1.3.x-dev"
+ }
+ },
+ "autoload": {
+ "classmap": [
+ "src/"
+ ]
+ },
+ "notification-url": "https://packagist.org/downloads/",
+ "license": [
+ "BSD-3-Clause"
+ ],
+ "authors": [
+ {
+ "name": "Jeff Welch",
+ "email": "whatthejeff@gmail.com"
+ },
+ {
+ "name": "Volker Dusch",
+ "email": "github@wallbash.com"
+ },
+ {
+ "name": "Bernhard Schussek",
+ "email": "bschussek@2bepublished.at"
+ },
+ {
+ "name": "Sebastian Bergmann",
+ "email": "sebastian@phpunit.de"
+ },
+ {
+ "name": "Adam Harvey",
+ "email": "aharvey@php.net"
+ }
+ ],
+ "description": "Provides the functionality to export PHP variables for visualization",
+ "homepage": "http://www.github.com/sebastianbergmann/exporter",
+ "keywords": [
+ "export",
+ "exporter"
+ ],
+ "time": "2016-06-17 09:04:28"
+ },
+ {
+ "name": "sebastian/global-state",
+ "version": "1.1.1",
+ "source": {
+ "type": "git",
+ "url": "https://github.com/sebastianbergmann/global-state.git",
+ "reference": "bc37d50fea7d017d3d340f230811c9f1d7280af4"
+ },
+ "dist": {
+ "type": "zip",
+ "url": "https://api.github.com/repos/sebastianbergmann/global-state/zipball/bc37d50fea7d017d3d340f230811c9f1d7280af4",
+ "reference": "bc37d50fea7d017d3d340f230811c9f1d7280af4",
+ "shasum": ""
+ },
+ "require": {
+ "php": ">=5.3.3"
+ },
+ "require-dev": {
+ "phpunit/phpunit": "~4.2"
+ },
+ "suggest": {
+ "ext-uopz": "*"
+ },
+ "type": "library",
+ "extra": {
+ "branch-alias": {
+ "dev-master": "1.0-dev"
+ }
+ },
+ "autoload": {
+ "classmap": [
+ "src/"
+ ]
+ },
+ "notification-url": "https://packagist.org/downloads/",
+ "license": [
+ "BSD-3-Clause"
+ ],
+ "authors": [
+ {
+ "name": "Sebastian Bergmann",
+ "email": "sebastian@phpunit.de"
+ }
+ ],
+ "description": "Snapshotting of global state",
+ "homepage": "http://www.github.com/sebastianbergmann/global-state",
+ "keywords": [
+ "global state"
+ ],
+ "time": "2015-10-12 03:26:01"
+ },
+ {
+ "name": "sebastian/recursion-context",
+ "version": "1.0.2",
+ "source": {
+ "type": "git",
+ "url": "https://github.com/sebastianbergmann/recursion-context.git",
+ "reference": "913401df809e99e4f47b27cdd781f4a258d58791"
+ },
+ "dist": {
+ "type": "zip",
+ "url": "https://api.github.com/repos/sebastianbergmann/recursion-context/zipball/913401df809e99e4f47b27cdd781f4a258d58791",
+ "reference": "913401df809e99e4f47b27cdd781f4a258d58791",
+ "shasum": ""
+ },
+ "require": {
+ "php": ">=5.3.3"
+ },
+ "require-dev": {
+ "phpunit/phpunit": "~4.4"
+ },
+ "type": "library",
+ "extra": {
+ "branch-alias": {
+ "dev-master": "1.0.x-dev"
+ }
+ },
+ "autoload": {
+ "classmap": [
+ "src/"
+ ]
+ },
+ "notification-url": "https://packagist.org/downloads/",
+ "license": [
+ "BSD-3-Clause"
+ ],
+ "authors": [
+ {
+ "name": "Jeff Welch",
+ "email": "whatthejeff@gmail.com"
+ },
+ {
+ "name": "Sebastian Bergmann",
+ "email": "sebastian@phpunit.de"
+ },
+ {
+ "name": "Adam Harvey",
+ "email": "aharvey@php.net"
+ }
+ ],
+ "description": "Provides functionality to recursively process PHP variables",
+ "homepage": "http://www.github.com/sebastianbergmann/recursion-context",
+ "time": "2015-11-11 19:50:13"
+ },
+ {
+ "name": "sebastian/version",
+ "version": "1.0.6",
+ "source": {
+ "type": "git",
+ "url": "https://github.com/sebastianbergmann/version.git",
+ "reference": "58b3a85e7999757d6ad81c787a1fbf5ff6c628c6"
+ },
+ "dist": {
+ "type": "zip",
+ "url": "https://api.github.com/repos/sebastianbergmann/version/zipball/58b3a85e7999757d6ad81c787a1fbf5ff6c628c6",
+ "reference": "58b3a85e7999757d6ad81c787a1fbf5ff6c628c6",
+ "shasum": ""
+ },
+ "type": "library",
+ "autoload": {
+ "classmap": [
+ "src/"
+ ]
+ },
+ "notification-url": "https://packagist.org/downloads/",
+ "license": [
+ "BSD-3-Clause"
+ ],
+ "authors": [
+ {
+ "name": "Sebastian Bergmann",
+ "email": "sebastian@phpunit.de",
+ "role": "lead"
+ }
+ ],
+ "description": "Library that helps with managing the version number of Git-hosted PHP projects",
+ "homepage": "https://github.com/sebastianbergmann/version",
+ "time": "2015-06-21 13:59:46"
+ },
+ {
+ "name": "squizlabs/php_codesniffer",
+ "version": "2.6.1",
+ "source": {
+ "type": "git",
+ "url": "https://github.com/squizlabs/PHP_CodeSniffer.git",
+ "reference": "fb72ed32f8418db5e7770be1653e62e0d6f5dd3d"
+ },
+ "dist": {
+ "type": "zip",
+ "url": "https://api.github.com/repos/squizlabs/PHP_CodeSniffer/zipball/fb72ed32f8418db5e7770be1653e62e0d6f5dd3d",
+ "reference": "fb72ed32f8418db5e7770be1653e62e0d6f5dd3d",
+ "shasum": ""
+ },
+ "require": {
+ "ext-simplexml": "*",
+ "ext-tokenizer": "*",
+ "ext-xmlwriter": "*",
+ "php": ">=5.1.2"
+ },
+ "require-dev": {
+ "phpunit/phpunit": "~4.0"
+ },
+ "bin": [
+ "scripts/phpcs",
+ "scripts/phpcbf"
+ ],
+ "type": "library",
+ "extra": {
+ "branch-alias": {
+ "dev-master": "2.x-dev"
+ }
+ },
+ "autoload": {
+ "classmap": [
+ "CodeSniffer.php",
+ "CodeSniffer/CLI.php",
+ "CodeSniffer/Exception.php",
+ "CodeSniffer/File.php",
+ "CodeSniffer/Fixer.php",
+ "CodeSniffer/Report.php",
+ "CodeSniffer/Reporting.php",
+ "CodeSniffer/Sniff.php",
+ "CodeSniffer/Tokens.php",
+ "CodeSniffer/Reports/",
+ "CodeSniffer/Tokenizers/",
+ "CodeSniffer/DocGenerators/",
+ "CodeSniffer/Standards/AbstractPatternSniff.php",
+ "CodeSniffer/Standards/AbstractScopeSniff.php",
+ "CodeSniffer/Standards/AbstractVariableSniff.php",
+ "CodeSniffer/Standards/IncorrectPatternException.php",
+ "CodeSniffer/Standards/Generic/Sniffs/",
+ "CodeSniffer/Standards/MySource/Sniffs/",
+ "CodeSniffer/Standards/PEAR/Sniffs/",
+ "CodeSniffer/Standards/PSR1/Sniffs/",
+ "CodeSniffer/Standards/PSR2/Sniffs/",
+ "CodeSniffer/Standards/Squiz/Sniffs/",
+ "CodeSniffer/Standards/Zend/Sniffs/"
+ ]
+ },
+ "notification-url": "https://packagist.org/downloads/",
+ "license": [
+ "BSD-3-Clause"
+ ],
+ "authors": [
+ {
+ "name": "Greg Sherwood",
+ "role": "lead"
+ }
+ ],
+ "description": "PHP_CodeSniffer tokenizes PHP, JavaScript and CSS files and detects violations of a defined set of coding standards.",
+ "homepage": "http://www.squizlabs.com/php-codesniffer",
+ "keywords": [
+ "phpcs",
+ "standards"
+ ],
+ "time": "2016-05-30 22:24:32"
+ },
+ {
+ "name": "symfony/console",
+ "version": "v2.8.7",
+ "source": {
+ "type": "git",
+ "url": "https://github.com/symfony/console.git",
+ "reference": "5ac8bc9aa77bb2edf06af3a1bb6bc1020d23acd3"
+ },
+ "dist": {
+ "type": "zip",
+ "url": "https://api.github.com/repos/symfony/console/zipball/5ac8bc9aa77bb2edf06af3a1bb6bc1020d23acd3",
+ "reference": "5ac8bc9aa77bb2edf06af3a1bb6bc1020d23acd3",
+ "shasum": ""
+ },
+ "require": {
+ "php": ">=5.3.9",
+ "symfony/polyfill-mbstring": "~1.0"
+ },
+ "require-dev": {
+ "psr/log": "~1.0",
+ "symfony/event-dispatcher": "~2.1|~3.0.0",
+ "symfony/process": "~2.1|~3.0.0"
+ },
+ "suggest": {
+ "psr/log": "For using the console logger",
+ "symfony/event-dispatcher": "",
+ "symfony/process": ""
+ },
+ "type": "library",
+ "extra": {
+ "branch-alias": {
+ "dev-master": "2.8-dev"
+ }
+ },
+ "autoload": {
+ "psr-4": {
+ "Symfony\\Component\\Console\\": ""
+ },
+ "exclude-from-classmap": [
+ "/Tests/"
+ ]
+ },
+ "notification-url": "https://packagist.org/downloads/",
+ "license": [
+ "MIT"
+ ],
+ "authors": [
+ {
+ "name": "Fabien Potencier",
+ "email": "fabien@symfony.com"
+ },
+ {
+ "name": "Symfony Community",
+ "homepage": "https://symfony.com/contributors"
+ }
+ ],
+ "description": "Symfony Console Component",
+ "homepage": "https://symfony.com",
+ "time": "2016-06-06 15:06:25"
+ },
+ {
+ "name": "symfony/filesystem",
+ "version": "v2.8.7",
+ "source": {
+ "type": "git",
+ "url": "https://github.com/symfony/filesystem.git",
+ "reference": "dee379131dceed90a429e951546b33edfe7dccbb"
+ },
+ "dist": {
+ "type": "zip",
+ "url": "https://api.github.com/repos/symfony/filesystem/zipball/dee379131dceed90a429e951546b33edfe7dccbb",
+ "reference": "dee379131dceed90a429e951546b33edfe7dccbb",
+ "shasum": ""
+ },
+ "require": {
+ "php": ">=5.3.9"
+ },
+ "type": "library",
+ "extra": {
+ "branch-alias": {
+ "dev-master": "2.8-dev"
+ }
+ },
+ "autoload": {
+ "psr-4": {
+ "Symfony\\Component\\Filesystem\\": ""
+ },
+ "exclude-from-classmap": [
+ "/Tests/"
+ ]
+ },
+ "notification-url": "https://packagist.org/downloads/",
+ "license": [
+ "MIT"
+ ],
+ "authors": [
+ {
+ "name": "Fabien Potencier",
+ "email": "fabien@symfony.com"
+ },
+ {
+ "name": "Symfony Community",
+ "homepage": "https://symfony.com/contributors"
+ }
+ ],
+ "description": "Symfony Filesystem Component",
+ "homepage": "https://symfony.com",
+ "time": "2016-04-12 18:01:21"
+ },
+ {
+ "name": "symfony/finder",
+ "version": "v2.8.7",
+ "source": {
+ "type": "git",
+ "url": "https://github.com/symfony/finder.git",
+ "reference": "3ec095fab1800222732ca522a95dce8fa124007b"
+ },
+ "dist": {
+ "type": "zip",
+ "url": "https://api.github.com/repos/symfony/finder/zipball/3ec095fab1800222732ca522a95dce8fa124007b",
+ "reference": "3ec095fab1800222732ca522a95dce8fa124007b",
+ "shasum": ""
+ },
+ "require": {
+ "php": ">=5.3.9"
+ },
+ "type": "library",
+ "extra": {
+ "branch-alias": {
+ "dev-master": "2.8-dev"
+ }
+ },
+ "autoload": {
+ "psr-4": {
+ "Symfony\\Component\\Finder\\": ""
+ },
+ "exclude-from-classmap": [
+ "/Tests/"
+ ]
+ },
+ "notification-url": "https://packagist.org/downloads/",
+ "license": [
+ "MIT"
+ ],
+ "authors": [
+ {
+ "name": "Fabien Potencier",
+ "email": "fabien@symfony.com"
+ },
+ {
+ "name": "Symfony Community",
+ "homepage": "https://symfony.com/contributors"
+ }
+ ],
+ "description": "Symfony Finder Component",
+ "homepage": "https://symfony.com",
+ "time": "2016-06-06 11:11:27"
+ },
+ {
+ "name": "symfony/polyfill-mbstring",
+ "version": "v1.2.0",
+ "source": {
+ "type": "git",
+ "url": "https://github.com/symfony/polyfill-mbstring.git",
+ "reference": "dff51f72b0706335131b00a7f49606168c582594"
+ },
+ "dist": {
+ "type": "zip",
+ "url": "https://api.github.com/repos/symfony/polyfill-mbstring/zipball/dff51f72b0706335131b00a7f49606168c582594",
+ "reference": "dff51f72b0706335131b00a7f49606168c582594",
+ "shasum": ""
+ },
+ "require": {
+ "php": ">=5.3.3"
+ },
+ "suggest": {
+ "ext-mbstring": "For best performance"
+ },
+ "type": "library",
+ "extra": {
+ "branch-alias": {
+ "dev-master": "1.2-dev"
+ }
+ },
+ "autoload": {
+ "psr-4": {
+ "Symfony\\Polyfill\\Mbstring\\": ""
+ },
+ "files": [
+ "bootstrap.php"
+ ]
+ },
+ "notification-url": "https://packagist.org/downloads/",
+ "license": [
+ "MIT"
+ ],
+ "authors": [
+ {
+ "name": "Nicolas Grekas",
+ "email": "p@tchwork.com"
+ },
+ {
+ "name": "Symfony Community",
+ "homepage": "https://symfony.com/contributors"
+ }
+ ],
+ "description": "Symfony polyfill for the Mbstring extension",
+ "homepage": "https://symfony.com",
+ "keywords": [
+ "compatibility",
+ "mbstring",
+ "polyfill",
+ "portable",
+ "shim"
+ ],
+ "time": "2016-05-18 14:26:46"
+ },
+ {
+ "name": "symfony/process",
+ "version": "v2.8.7",
+ "source": {
+ "type": "git",
+ "url": "https://github.com/symfony/process.git",
+ "reference": "115347d00c342198cdc52a7bd8bc15b5ab43500c"
+ },
+ "dist": {
+ "type": "zip",
+ "url": "https://api.github.com/repos/symfony/process/zipball/115347d00c342198cdc52a7bd8bc15b5ab43500c",
+ "reference": "115347d00c342198cdc52a7bd8bc15b5ab43500c",
+ "shasum": ""
+ },
+ "require": {
+ "php": ">=5.3.9"
+ },
+ "type": "library",
+ "extra": {
+ "branch-alias": {
+ "dev-master": "2.8-dev"
+ }
+ },
+ "autoload": {
+ "psr-4": {
+ "Symfony\\Component\\Process\\": ""
+ },
+ "exclude-from-classmap": [
+ "/Tests/"
+ ]
+ },
+ "notification-url": "https://packagist.org/downloads/",
+ "license": [
+ "MIT"
+ ],
+ "authors": [
+ {
+ "name": "Fabien Potencier",
+ "email": "fabien@symfony.com"
+ },
+ {
+ "name": "Symfony Community",
+ "homepage": "https://symfony.com/contributors"
+ }
+ ],
+ "description": "Symfony Process Component",
+ "homepage": "https://symfony.com",
+ "time": "2016-06-06 11:11:27"
+ },
+ {
+ "name": "symfony/yaml",
+ "version": "v2.8.7",
+ "source": {
+ "type": "git",
+ "url": "https://github.com/symfony/yaml.git",
+ "reference": "815fabf3f48c7d1df345a69d1ad1a88f59757b34"
+ },
+ "dist": {
+ "type": "zip",
+ "url": "https://api.github.com/repos/symfony/yaml/zipball/815fabf3f48c7d1df345a69d1ad1a88f59757b34",
+ "reference": "815fabf3f48c7d1df345a69d1ad1a88f59757b34",
+ "shasum": ""
+ },
+ "require": {
+ "php": ">=5.3.9"
+ },
+ "type": "library",
+ "extra": {
+ "branch-alias": {
+ "dev-master": "2.8-dev"
+ }
+ },
+ "autoload": {
+ "psr-4": {
+ "Symfony\\Component\\Yaml\\": ""
+ },
+ "exclude-from-classmap": [
+ "/Tests/"
+ ]
+ },
+ "notification-url": "https://packagist.org/downloads/",
+ "license": [
+ "MIT"
+ ],
+ "authors": [
+ {
+ "name": "Fabien Potencier",
+ "email": "fabien@symfony.com"
+ },
+ {
+ "name": "Symfony Community",
+ "homepage": "https://symfony.com/contributors"
+ }
+ ],
+ "description": "Symfony Yaml Component",
+ "homepage": "https://symfony.com",
+ "time": "2016-06-06 11:11:27"
+ },
+ {
+ "name": "twig/twig",
+ "version": "v1.24.1",
+ "source": {
+ "type": "git",
+ "url": "https://github.com/twigphp/Twig.git",
+ "reference": "3566d311a92aae4deec6e48682dc5a4528c4a512"
+ },
+ "dist": {
+ "type": "zip",
+ "url": "https://api.github.com/repos/twigphp/Twig/zipball/3566d311a92aae4deec6e48682dc5a4528c4a512",
+ "reference": "3566d311a92aae4deec6e48682dc5a4528c4a512",
+ "shasum": ""
+ },
+ "require": {
+ "php": ">=5.2.7"
+ },
+ "require-dev": {
+ "symfony/debug": "~2.7",
+ "symfony/phpunit-bridge": "~2.7"
+ },
+ "type": "library",
+ "extra": {
+ "branch-alias": {
+ "dev-master": "1.24-dev"
+ }
+ },
+ "autoload": {
+ "psr-0": {
+ "Twig_": "lib/"
+ }
+ },
+ "notification-url": "https://packagist.org/downloads/",
+ "license": [
+ "BSD-3-Clause"
+ ],
+ "authors": [
+ {
+ "name": "Fabien Potencier",
+ "email": "fabien@symfony.com",
+ "homepage": "http://fabien.potencier.org",
+ "role": "Lead Developer"
+ },
+ {
+ "name": "Armin Ronacher",
+ "email": "armin.ronacher@active-4.com",
+ "role": "Project Founder"
+ },
+ {
+ "name": "Twig Team",
+ "homepage": "http://twig.sensiolabs.org/contributors",
+ "role": "Contributors"
+ }
+ ],
+ "description": "Twig, the flexible, fast, and secure template language for PHP",
+ "homepage": "http://twig.sensiolabs.org",
+ "keywords": [
+ "templating"
+ ],
+ "time": "2016-05-30 09:11:59"
+ },
+ {
+ "name": "webmozart/assert",
+ "version": "1.0.2",
+ "source": {
+ "type": "git",
+ "url": "https://github.com/webmozart/assert.git",
+ "reference": "30eed06dd6bc88410a4ff7f77b6d22f3ce13dbde"
+ },
+ "dist": {
+ "type": "zip",
+ "url": "https://api.github.com/repos/webmozart/assert/zipball/30eed06dd6bc88410a4ff7f77b6d22f3ce13dbde",
+ "reference": "30eed06dd6bc88410a4ff7f77b6d22f3ce13dbde",
+ "shasum": ""
+ },
+ "require": {
+ "php": ">=5.3.3"
+ },
+ "require-dev": {
+ "phpunit/phpunit": "^4.6"
+ },
+ "type": "library",
+ "extra": {
+ "branch-alias": {
+ "dev-master": "1.0-dev"
+ }
+ },
+ "autoload": {
+ "psr-4": {
+ "Webmozart\\Assert\\": "src/"
+ }
+ },
+ "notification-url": "https://packagist.org/downloads/",
+ "license": [
+ "MIT"
+ ],
+ "authors": [
+ {
+ "name": "Bernhard Schussek",
+ "email": "bschussek@gmail.com"
+ }
+ ],
+ "description": "Assertions to validate method input/output with nice error messages.",
+ "keywords": [
+ "assert",
+ "check",
+ "validate"
+ ],
+ "time": "2015-08-24 13:29:44"
+ }
+ ],
+ "aliases": [],
+ "minimum-stability": "stable",
+ "stability-flags": [],
+ "prefer-stable": false,
+ "prefer-lowest": false,
+ "platform": {
+ "php": ">=5.3.3"
+ },
+ "platform-dev": []
+}
diff --git a/securemail/vendor/phpseclib/phpseclib/phpseclib/Crypt/AES.php b/securemail/vendor/phpseclib/phpseclib/phpseclib/Crypt/AES.php
index 6b1f9daa..7d8cb8b0 100644
--- a/securemail/vendor/phpseclib/phpseclib/phpseclib/Crypt/AES.php
+++ b/securemail/vendor/phpseclib/phpseclib/phpseclib/Crypt/AES.php
@@ -5,23 +5,27 @@
*
* Uses mcrypt, if available/possible, and an internal implementation, otherwise.
*
- * PHP versions 4 and 5
+ * PHP version 5
*
- * If {@link Crypt_AES::setKeyLength() setKeyLength()} isn't called, it'll be calculated from
- * {@link Crypt_AES::setKey() setKey()}. ie. if the key is 128-bits, the key length will be 128-bits. If it's 136-bits
- * it'll be null-padded to 192-bits and 192 bits will be the key length until {@link Crypt_AES::setKey() setKey()}
+ * NOTE: Since AES.php is (for compatibility and phpseclib-historical reasons) virtually
+ * just a wrapper to Rijndael.php you may consider using Rijndael.php instead of
+ * to save one include_once().
+ *
+ * If {@link self::setKeyLength() setKeyLength()} isn't called, it'll be calculated from
+ * {@link self::setKey() setKey()}. ie. if the key is 128-bits, the key length will be 128-bits. If it's 136-bits
+ * it'll be null-padded to 192-bits and 192 bits will be the key length until {@link self::setKey() setKey()}
* is called, again, at which point, it'll be recalculated.
*
- * Since Crypt_AES extends Crypt_Rijndael, some functions are available to be called that, in the context of AES, don't
- * make a whole lot of sense. {@link Crypt_AES::setBlockLength() setBlockLength()}, for instance. Calling that function,
+ * Since \phpseclib\Crypt\AES extends \phpseclib\Crypt\Rijndael, some functions are available to be called that, in the context of AES, don't
+ * make a whole lot of sense. {@link self::setBlockLength() setBlockLength()}, for instance. Calling that function,
* however possible, won't do anything (AES has a fixed block length whereas Rijndael has a variable one).
*
* Here's a short example of how to use this library:
*