fix

sha2.lua

@@ -0,0 +1,221 @@
+-- Copyright (c) 2018  Phil Leblanc  -- see LICENSE file
+------------------------------------------------------------------------
+
+--        SHA2-256 and SHA2-512 -- see RFC 6234
+
+
+-- sha2-256 initially based on code written by Roberto Ierusalimschy
+-- for an early Lua 5.3rc with (un)packint() functions.
+-- published by  Roberto on the Lua mailing list
+-- http://lua-users.org/lists/lua-l/2014-03/msg00851.html
+-- can be distributed under the MIT License terms. see:
+-- http://lua-users.org/lists/lua-l/2014-08/msg00628.html
+--
+-- adapted to 5.3 (string.(un)pack()) --phil, 150827
+--
+-- optimized for performance, 181008. The core permutation
+-- for sha2-256 and sha2-512 is lifted from the very good
+-- implementation by Egor Skriptunoff, also MIT-licensed. See
+-- https://github.com/Egor-Skriptunoff/pure_lua_SHA2
+
+
+------------------------------------------------------------
+-- local declarations
+
+local string, assert = string, assert
+local spack, sunpack = string.pack, string.unpack 
+
+------------------------------------------------------------------------
+-- sha256
+
+-- Initialize table of round constants
+-- (first 32 bits of the fractional parts of the cube roots of the first
+-- 64 primes 2..311)
+local k256 = {
+   0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5,
+   0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
+   0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3,
+   0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
+   0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc,
+   0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+   0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7,
+   0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
+   0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13,
+   0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
+   0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3,
+   0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+   0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5,
+   0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
+   0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208,
+   0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,
+}
+
+local function pad64(msg, len)
+	local extra = (64 - ((len + 1 + 8) % 64)) % 64
+	len = spack(">I8", len * 8)    -- original len in bits, coded
+	msg = msg .. "\128" .. string.rep("\0", extra) .. len
+	assert(#msg % 64 == 0)
+	return msg
+end
+
+local ww256 = {}
+	  
+local function sha256 (msg)
+	msg = pad64(msg, #msg)
+	local h1, h2, h3, h4, h5, h6, h7, h8 = 
+		0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a,
+		0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19
+	local k = k256
+	local w = ww256
+	local mlen = #msg
+  	-- Process the message in successive 512-bit (64 bytes) chunks:
+	for i = 1, mlen, 64 do
+		w[1], w[2], w[3], w[4], w[5], w[6], w[7], w[8], 
+		w[9], w[10], w[11], w[12], w[13], w[14], w[15], w[16]
+		= sunpack(">I4I4I4I4I4I4I4I4I4I4I4I4I4I4I4I4", msg, i)
+		-- mix msg block in state
+		for j = 17, 64 do
+			local x = w[j - 15]; x = (x << 32) | x
+			local y = w[j - 2]; y = (y << 32) | y
+			w[j] = (  ((x >> 7) ~ (x >> 18) ~ (x >> 35))
+				+ ((y >> 17) ~ (y >> 19) ~ (y >> 42))
+				+ w[j - 7] + w[j - 16]  ) & 0xffffffff
+		end
+		local a, b, c, d, e, f, g, h = h1, h2, h3, h4, h5, h6, h7, h8
+		-- main state permutation
+		for j = 1, 64 do
+			e = (e << 32) | (e & 0xffffffff)
+			local t1 = ((e >> 6) ~ (e >> 11) ~ (e >> 25))
+				+ (g ~ e & (f ~ g)) + h + k[j] + w[j]
+			h = g
+			g = f
+			f = e
+			e = (d + t1) 
+			d = c
+			c = b
+			b = a
+			a = (a << 32) | (a & 0xffffffff)
+			a = t1 	+ ((a ~ c) & d ~ a & c) 
+				+ ((a >> 2) ~ (a >> 13) ~ (a >> 22))
+		end
+		h1 = h1 + a
+		h2 = h2 + b 
+		h3 = h3 + c 
+		h4 = h4 + d 
+		h5 = h5 + e 
+		h6 = h6 + f 
+		h7 = h7 + g 
+		h8 = h8 + h 
+	end
+	-- clamp hash to 32-bit words
+	h1 = h1 & 0xffffffff
+	h2 = h2 & 0xffffffff
+	h3 = h3 & 0xffffffff
+	h4 = h4 & 0xffffffff
+	h5 = h5 & 0xffffffff
+	h6 = h6 & 0xffffffff
+	h7 = h7 & 0xffffffff
+	h8 = h8 & 0xffffffff
+	-- return hash as a binary string
+	return spack(">I4I4I4I4I4I4I4I4", h1, h2, h3, h4, h5, h6, h7, h8)
+end --sha256
+
+------------------------------------------------------------------------
+-- sha512
+
+local k512 = {
+0x428a2f98d728ae22,0x7137449123ef65cd,0xb5c0fbcfec4d3b2f,0xe9b5dba58189dbbc,
+0x3956c25bf348b538,0x59f111f1b605d019,0x923f82a4af194f9b,0xab1c5ed5da6d8118,
+0xd807aa98a3030242,0x12835b0145706fbe,0x243185be4ee4b28c,0x550c7dc3d5ffb4e2,
+0x72be5d74f27b896f,0x80deb1fe3b1696b1,0x9bdc06a725c71235,0xc19bf174cf692694,
+0xe49b69c19ef14ad2,0xefbe4786384f25e3,0x0fc19dc68b8cd5b5,0x240ca1cc77ac9c65,
+0x2de92c6f592b0275,0x4a7484aa6ea6e483,0x5cb0a9dcbd41fbd4,0x76f988da831153b5,
+0x983e5152ee66dfab,0xa831c66d2db43210,0xb00327c898fb213f,0xbf597fc7beef0ee4,
+0xc6e00bf33da88fc2,0xd5a79147930aa725,0x06ca6351e003826f,0x142929670a0e6e70,
+0x27b70a8546d22ffc,0x2e1b21385c26c926,0x4d2c6dfc5ac42aed,0x53380d139d95b3df,
+0x650a73548baf63de,0x766a0abb3c77b2a8,0x81c2c92e47edaee6,0x92722c851482353b,
+0xa2bfe8a14cf10364,0xa81a664bbc423001,0xc24b8b70d0f89791,0xc76c51a30654be30,
+0xd192e819d6ef5218,0xd69906245565a910,0xf40e35855771202a,0x106aa07032bbd1b8,
+0x19a4c116b8d2d0c8,0x1e376c085141ab53,0x2748774cdf8eeb99,0x34b0bcb5e19b48a8,
+0x391c0cb3c5c95a63,0x4ed8aa4ae3418acb,0x5b9cca4f7763e373,0x682e6ff3d6b2b8a3,
+0x748f82ee5defb2fc,0x78a5636f43172f60,0x84c87814a1f0ab72,0x8cc702081a6439ec,
+0x90befffa23631e28,0xa4506cebde82bde9,0xbef9a3f7b2c67915,0xc67178f2e372532b,
+0xca273eceea26619c,0xd186b8c721c0c207,0xeada7dd6cde0eb1e,0xf57d4f7fee6ed178,
+0x06f067aa72176fba,0x0a637dc5a2c898a6,0x113f9804bef90dae,0x1b710b35131c471b,
+0x28db77f523047d84,0x32caab7b40c72493,0x3c9ebe0a15c9bebc,0x431d67c49c100d4c,
+0x4cc5d4becb3e42b6,0x597f299cfc657e2a,0x5fcb6fab3ad6faec,0x6c44198c4a475817
+}
+
+local function pad128(msg, len)
+	local extra = (128 - ((len + 1 + 16) % 128)) % 128
+	-- msg length in bit is encoded as a **128**-bit big endian integer
+	len = spack(">I16", len * 8)    -- original len in bits, encoded
+	msg = msg .. "\128" .. string.rep("\0", extra) .. len
+	return msg
+end
+
+local ww512 = {}
+	  
+local function sha512 (msg)
+	msg = pad128(msg, #msg)
+	local h1, h2, h3, h4, h5, h6, h7, h8 = 
+		0x6a09e667f3bcc908, 0xbb67ae8584caa73b,
+		0x3c6ef372fe94f82b, 0xa54ff53a5f1d36f1,
+		0x510e527fade682d1, 0x9b05688c2b3e6c1f,
+		0x1f83d9abfb41bd6b, 0x5be0cd19137e2179
+	local k = k512
+	local w = ww512 -- 80 * i64 state
+	local mlen = #msg
+  	-- Process the message as 128-byte blocks:
+	-- (this is borrowed to Egor Skriptunoff's pure_lua_SHA2
+	-- https://github.com/Egor-Skriptunoff/pure_lua_SHA2)
+	for i = 1, mlen, 128 do
+		w[1], w[2], w[3], w[4], w[5], w[6], w[7], w[8], 
+		w[9], w[10], w[11], w[12], w[13], w[14], w[15], w[16]
+		= sunpack(">i8i8i8i8i8i8i8i8i8i8i8i8i8i8i8i8", msg, i)
+		-- mix msg block in state
+
+		for j = 17, 80 do
+			local a = w[j-15]
+			local b = w[j-2]
+			w[j] = (a >> 1 ~ a >> 7 ~ a >> 8 ~ a << 56 ~ a << 63)
+			  + (b >> 6 ~ b >> 19 ~ b >> 61 ~ b << 3 ~ b << 45) 
+			  + w[j-7] + w[j-16]
+		end
+		local a, b, c, d, e, f, g, h = h1, h2, h3, h4, h5, h6, h7, h8
+		-- main state permutation
+		for j = 1, 80 do
+			local z = (e >> 14 ~ e >> 18 ~ e >> 41 ~ e << 23 
+				   ~ e << 46 ~ e << 50) 
+				+ (g ~ e & (f ~ g)) + h + k[j] + w[j]
+			h = g
+			g = f
+			f = e
+			e = z + d
+			d = c
+			c = b
+			b = a
+			a = z + ((a ~ c) & d ~ a & c) 
+			      + (a >> 28 ~ a >> 34 ~ a >> 39 ~ a << 25 
+				~ a << 30 ~ a << 36)
+		end
+		h1 = h1 + a
+		h2 = h2 + b 
+		h3 = h3 + c 
+		h4 = h4 + d 
+		h5 = h5 + e 
+		h6 = h6 + f 
+		h7 = h7 + g 
+		h8 = h8 + h 
+	end
+	-- return hash as a binary string
+	return spack(">i8i8i8i8i8i8i8i8", h1, h2, h3, h4, h5, h6, h7, h8)
+end --sha512
+
+------------------------------------------------------------------------
+
+return {
+  sha256 = sha256,
+  sha512 = sha512,
+}
+

ssh.lua

@@ -4,9 +4,6 @@ local program_string = program_name .. "_" .. program_version
 
 local component = require("component")
 local internet = component.internet
-local event = require("event")
-local computer = require("computer")
-local serialize = require("serialize")
 
 local function lazy_require(name)
     local this = {}
@@ -24,7 +21,8 @@ local function lazy_require(name)
     return this
 end
 
-local curve25519 = lazy_require("curve25519")
+local x25519 = lazy_require("x25519")
+local sha2 = lazy_require("sha2")
 
 local function parse_ssh_version(str)
     local proto, software, comments = str:match("^SSH%-(%d+%.%d+)%-(%S+)%s?(.*)\r\n$")
@@ -58,6 +56,79 @@ local SSH_MSG_SERVICE_ACCEPT = 6
 local SSH_MSG_KEXINIT = 20
 local SSH_MSG_NEWKEYS = 21
 
+-- RFC 4253 7.1: first entry in client list that also appears in server_list wins
+local function negotiate_one(client_list, server_list)
+    local server_set = {}
+    for _, name in ipairs(server_list) do server_set[name] = true end
+    for _, name in ipairs(client_list) do
+        if server_set[name] then return name end
+    end
+    return nil
+end
+
+local function negotiate(client_algs, server_kex)
+    local chosen = {}
+    for field, _ in pairs(client_algs) do
+        chosen[field] = negotiate_one(client_algs[field] or {}, server_kex[field] or {})
+        local is_language_field = field:find("^languages_")
+        if not chosen[field] and not is_language_field then
+            return nil, "no agreement on " .. field
+        end
+    end
+    return chosen
+end
+
+local function xor_with_byte(s, b)
+    local out = {}
+    for i = 1, #s do
+        out[i] = string.char(string.byte(s, i) ~ b)
+    end
+    return table.concat(out)
+end
+
+local function hmac(hash_fn, block_size, key, message)
+    if #key > block_size then key = hash_fn(key) end
+    if #key < block_size then key = key .. string.rep('\0', block_size - #key) end
+    return hash_fn(xor_with_byte(key, 0x5c) .. hash_fn(xor_with_byte(key, 0x36) .. message))
+end
+
+local mac_algorithms_priority = {
+    "hmac-sha2-256",
+    "hmac-sha2-512",
+    --"hmac-sha1"
+}
+
+local mac_algorithms = {
+    ["hmac-sha2-256"] = function(key, message) return hmac(sha2.sha256, 64, key, message) end,
+    ["hmac-sha2-512"] = function(key, message) return hmac(sha2.sha512, 128, key, message) end,
+    --["hmac-sha1"] = function(key, message) return hmac(sha1, 64, key, message) end,
+}
+
+local encryption_algorithms_priority = {
+    "chacha20-poly1305@openssh.com",
+-- aes128-gcm@openssh.com
+-- aes256-gcm@openssh.com
+-- aes128-ctr
+-- aes192-ctr
+-- aes256-ctr
+}
+local encryption_algorithms = {
+    ["chacha20-poly1305@openssh.com"] = nil
+}
+
+local server_host_key_algorithms_priority = {
+    --[[
+    "rsa-sha2-512",
+    "rsa-sha2-256",
+    "ecdsa-sha2-nistp256",
+    "ssh-ed25519"
+    ]]
+}
+
+local server_host_key_algorithms = {
+
+}
+
 local function socket()
     local this = {}
     local _sock
@@ -89,8 +160,12 @@ local function socket()
         while #_read_buf < n do
             local chunk, err = _sock.read(n - #_read_buf)
             if chunk == nil then return nil, err end
+            if chunk == "" then
+                coroutine.yield()
+            else
                 _read_buf = _read_buf .. chunk
             end
+        end
         local to_return = _read_buf:sub(1, n);
         _read_buf = _read_buf:sub(n + 1, -1)
         return to_return
@@ -239,26 +314,47 @@ end
 local sock = socket()
 sock.connect("localhost", 22)
 -- RFC 4253: The maximum length of the string is 255 characters
-local server_protoversion, server_softwareversion, server_comments = parse_ssh_version(sock.read_until_crlf(255))
+local server_version_raw = sock.read_until_crlf(255)
+local server_protoversion, server_softwareversion, server_comments = parse_ssh_version(server_version_raw)
 if server_protoversion ~= "2.0" then
     return
 end
-sock.write(encode_ssh_version("2.0", program_string))
+
-print(sock.parse_kexinit(sock.read_packet()))
+local client_version_line = encode_ssh_version("2.0", program_string)
---[[
+sock.write(client_version_line)
+
+local V_C = client_version_line:gsub("\r\n$", "")
+local V_S = server_version_raw:gsub("\r\n$", "")
+
+local I_S, kerr = sock.read_packet()
+if not I_S then
+    print("failed to read server KEXINIT: " .. tostring(kerr))
+    return
+end
+local server_kex, perr = sock.parse_kexinit(I_S)
+if not server_kex then
+    print("failed to parse server KEXINIT: " .. tostring(perr))
+    return
+end
+
 local my_algs = {
-    kex_algorithms = {},
+    kex_algorithms = { "curve25519-sha256" },
-    server_host_key_algorithms = {},
+    server_host_key_algorithms = server_host_key_algorithms,
-    encryption_algorithms_client_to_server = {},
+    encryption_algorithms_client_to_server = encryption_algorithms_priority,
-    encryption_algorithms_server_to_client = {},
+    encryption_algorithms_server_to_client = encryption_algorithms_priority,
-    mac_algorithms_client_to_server = {},
+    mac_algorithms_client_to_server = mac_algorithms_priority,
-    mac_algorithms_server_to_client = {},
+    mac_algorithms_server_to_client = mac_algorithms_priority,
     compression_algorithms_client_to_server = { "none" },
     compression_algorithms_server_to_client = { "none" },
     languages_client_to_server = {},
     languages_server_to_client = {},
 }
 
-local my_kexinit_payload = sock.build_kexinit(my_algs)
+local I_C = sock.build_kexinit(my_algs)
-sock.write_packet(my_kexinit_payload)
+sock.write_packet(I_C)
-]]
+
+local chosen, nerr = negotiate(my_algs, server_kex)
+if not chosen then
+    print("algorithm negotiation failed: " .. tostring(nerr))
+    return
+end