PageRenderTime 37ms CodeModel.GetById 20ms RepoModel.GetById 0ms app.codeStats 1ms

/drupal/profiles/medienlabor/modules/contrib/aes/phpseclib/Net/SSH2.php

https://bitbucket.org/cbeier/test
PHP | 2901 lines | 1538 code | 348 blank | 1015 comment | 253 complexity | 96d43c659ee7f81da4d0b1a7ce4d3886 MD5 | raw file
Possible License(s): GPL-2.0, AGPL-1.0, LGPL-2.1 
    

  1. <?php

    2. 

  2. /* vim: set expandtab tabstop=4 shiftwidth=4 softtabstop=4: */

    3. 

  3. 

    4. 

  4. /**

    5. 

  5.  * Pure-PHP implementation of SSHv2.

    6. 

  6.  *

    7. 

  7.  * PHP versions 4 and 5

    8. 

  8.  *

    9. 

  9.  * Here are some examples of how to use this library:

    10. 

  10.  * <code>

    11. 

  11.  * <?php

    12. 

  12.  *    include('Net/SSH2.php');

    13. 

  13.  *

    14. 

  14.  *    $ssh = new Net_SSH2('www.domain.tld');

    15. 

  15.  *    if (!$ssh->login('username', 'password')) {

    16. 

  16.  *        exit('Login Failed');

    17. 

  17.  *    }

    18. 

  18.  *

    19. 

  19.  *    echo $ssh->exec('pwd');

    20. 

  20.  *    echo $ssh->exec('ls -la');

    21. 

  21.  * ?>

    22. 

  22.  * </code>

    23. 

  23.  *

    24. 

  24.  * <code>

    25. 

  25.  * <?php

    26. 

  26.  *    include('Crypt/RSA.php');

    27. 

  27.  *    include('Net/SSH2.php');

    28. 

  28.  *

    29. 

  29.  *    $key = new Crypt_RSA();

    30. 

  30.  *    //$key->setPassword('whatever');

    31. 

  31.  *    $key->loadKey(file_get_contents('privatekey'));

    32. 

  32.  *

    33. 

  33.  *    $ssh = new Net_SSH2('www.domain.tld');

    34. 

  34.  *    if (!$ssh->login('username', $key)) {

    35. 

  35.  *        exit('Login Failed');

    36. 

  36.  *    }

    37. 

  37.  *

    38. 

  38.  *    echo $ssh->read('username@username:~$');

    39. 

  39.  *    $ssh->write("ls -la\n");

    40. 

  40.  *    echo $ssh->read('username@username:~$');

    41. 

  41.  * ?>

    42. 

  42.  * </code>

    43. 

  43.  *

    44. 

  44.  * LICENSE: Permission is hereby granted, free of charge, to any person obtaining a copy

    45. 

  45.  * of this software and associated documentation files (the "Software"), to deal

    46. 

  46.  * in the Software without restriction, including without limitation the rights

    47. 

  47.  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell

    48. 

  48.  * copies of the Software, and to permit persons to whom the Software is

    49. 

  49.  * furnished to do so, subject to the following conditions:

    50. 

  50.  * 

    51. 

  51.  * The above copyright notice and this permission notice shall be included in

    52. 

  52.  * all copies or substantial portions of the Software.

    53. 

  53.  * 

    54. 

  54.  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR

    55. 

  55.  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,

    56. 

  56.  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE

    57. 

  57.  * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER

    58. 

  58.  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,

    59. 

  59.  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN

    60. 

  60.  * THE SOFTWARE.

    61. 

  61.  *

    62. 

  62.  * @category   Net

    63. 

  63.  * @package    Net_SSH2

    64. 

  64.  * @author     Jim Wigginton <terrafrost@php.net>

    65. 

  65.  * @copyright  MMVII Jim Wigginton

    66. 

  66.  * @license    http://www.opensource.org/licenses/mit-license.html  MIT License

    67. 

  67.  * @version    $Id: SSH2.php,v 1.53 2010-10-24 01:24:30 terrafrost Exp $

    68. 

  68.  * @link       http://phpseclib.sourceforge.net

    69. 

  69.  */

    70. 

  70. 

    71. 

  71. /**

    72. 

  72.  * Include Math_BigInteger

    73. 

  73.  *

    74. 

  74.  * Used to do Diffie-Hellman key exchange and DSA/RSA signature verification.

    75. 

  75.  */

    76. 

  76. if (!class_exists('Math_BigInteger')) {

    77. 

  77.     require_once('Math/BigInteger.php');

    78. 

  78. }

    79. 

  79. 

    80. 

  80. /**

    81. 

  81.  * Include Crypt_Random

    82. 

  82.  */

    83. 

  83. // the class_exists() will only be called if the crypt_random function hasn't been defined and

    84. 

  84. // will trigger a call to __autoload() if you're wanting to auto-load classes

    85. 

  85. // call function_exists() a second time to stop the require_once from being called outside

    86. 

  86. // of the auto loader

    87. 

  87. if (!function_exists('crypt_random') && !class_exists('Crypt_Random') && !function_exists('crypt_random')) {

    88. 

  88.     require_once('Crypt/Random.php');

    89. 

  89. }

    90. 

  90. 

    91. 

  91. /**

    92. 

  92.  * Include Crypt_Hash

    93. 

  93.  */

    94. 

  94. if (!class_exists('Crypt_Hash')) {

    95. 

  95.     require_once('Crypt/Hash.php');

    96. 

  96. }

    97. 

  97. 

    98. 

  98. /**

    99. 

  99.  * Include Crypt_TripleDES

    100. 

  100.  */

    101. 

  101. if (!class_exists('Crypt_TripleDES')) {

    102. 

  102.     require_once('Crypt/TripleDES.php');

    103. 

  103. }

    104. 

  104. 

    105. 

  105. /**

    106. 

  106.  * Include Crypt_RC4

    107. 

  107.  */

    108. 

  108. if (!class_exists('Crypt_RC4')) {

    109. 

  109.     require_once('Crypt/RC4.php');

    110. 

  110. }

    111. 

  111. 

    112. 

  112. /**

    113. 

  113.  * Include Crypt_AES

    114. 

  114.  */

    115. 

  115. if (!class_exists('Crypt_AES')) {

    116. 

  116.     require_once('Crypt/AES.php');

    117. 

  117. }

    118. 

  118. 

    119. 

  119. /**#@+

    120. 

  120.  * Execution Bitmap Masks

    121. 

  121.  *

    122. 

  122.  * @see Net_SSH2::bitmap

    123. 

  123.  * @access private

    124. 

  124.  */

    125. 

  125. define('NET_SSH2_MASK_CONSTRUCTOR', 0x00000001);

    126. 

  126. define('NET_SSH2_MASK_LOGIN',       0x00000002);

    127. 

  127. define('NET_SSH2_MASK_SHELL',       0x00000004);

    128. 

  128. /**#@-*/

    129. 

  129. 

    130. 

  130. /**#@+

    131. 

  131.  * Channel constants

    132. 

  132.  *

    133. 

  133.  * RFC4254 refers not to client and server channels but rather to sender and recipient channels.  we don't refer

    134. 

  134.  * to them in that way because RFC4254 toggles the meaning. the client sends a SSH_MSG_CHANNEL_OPEN message with

    135. 

  135.  * a sender channel and the server sends a SSH_MSG_CHANNEL_OPEN_CONFIRMATION in response, with a sender and a

    136. 

  136.  * recepient channel.  at first glance, you might conclude that SSH_MSG_CHANNEL_OPEN_CONFIRMATION's sender channel

    137. 

  137.  * would be the same thing as SSH_MSG_CHANNEL_OPEN's sender channel, but it's not, per this snipet:

    138. 

  138.  *     The 'recipient channel' is the channel number given in the original

    139. 

  139.  *     open request, and 'sender channel' is the channel number allocated by

    140. 

  140.  *     the other side.

    141. 

  141.  *

    142. 

  142.  * @see Net_SSH2::_send_channel_packet()

    143. 

  143.  * @see Net_SSH2::_get_channel_packet()

    144. 

  144.  * @access private

    145. 

  145.  */

    146. 

  146. define('NET_SSH2_CHANNEL_EXEC', 0); // PuTTy uses 0x100

    147. 

  147. define('NET_SSH2_CHANNEL_SHELL',1);

    148. 

  148. /**#@-*/

    149. 

  149. 

    150. 

  150. /**#@+

    151. 

  151.  * @access public

    152. 

  152.  * @see Net_SSH2::getLog()

    153. 

  153.  */

    154. 

  154. /**

    155. 

  155.  * Returns the message numbers

    156. 

  156.  */

    157. 

  157. define('NET_SSH2_LOG_SIMPLE',  1);

    158. 

  158. /**

    159. 

  159.  * Returns the message content

    160. 

  160.  */

    161. 

  161. define('NET_SSH2_LOG_COMPLEX', 2);

    162. 

  162. /**

    163. 

  163.  * Outputs the content real-time

    164. 

  164.  */

    165. 

  165. define('NET_SSH2_LOG_REALTIME', 3);

    166. 

  166. /**#@-*/

    167. 

  167. 

    168. 

  168. /**#@+

    169. 

  169.  * @access public

    170. 

  170.  * @see Net_SSH2::read()

    171. 

  171.  */

    172. 

  172. /**

    173. 

  173.  * Returns when a string matching $expect exactly is found

    174. 

  174.  */

    175. 

  175. define('NET_SSH2_READ_SIMPLE',  1);

    176. 

  176. /**

    177. 

  177.  * Returns when a string matching the regular expression $expect is found

    178. 

  178.  */

    179. 

  179. define('NET_SSH2_READ_REGEX', 2);

    180. 

  180. /**

    181. 

  181.  * Make sure that the log never gets larger than this

    182. 

  182.  */

    183. 

  183. define('NET_SSH2_LOG_MAX_SIZE', 1024 * 1024);

    184. 

  184. /**#@-*/

    185. 

  185. 

    186. 

  186. /**

    187. 

  187.  * Pure-PHP implementation of SSHv2.

    188. 

  188.  *

    189. 

  189.  * @author  Jim Wigginton <terrafrost@php.net>

    190. 

  190.  * @version 0.1.0

    191. 

  191.  * @access  public

    192. 

  192.  * @package Net_SSH2

    193. 

  193.  */

    194. 

  194. class Net_SSH2 {

    195. 

  195.     /**

    196. 

  196.      * The SSH identifier

    197. 

  197.      *

    198. 

  198.      * @var String

    199. 

  199.      * @access private

    200. 

  200.      */

    201. 

  201.     var $identifier = 'SSH-2.0-phpseclib_0.3';

    202. 

  202. 

    203. 

  203.     /**

    204. 

  204.      * The Socket Object

    205. 

  205.      *

    206. 

  206.      * @var Object

    207. 

  207.      * @access private

    208. 

  208.      */

    209. 

  209.     var $fsock;

    210. 

  210. 

    211. 

  211.     /**

    212. 

  212.      * Execution Bitmap

    213. 

  213.      *

    214. 

  214.      * The bits that are set reprsent functions that have been called already.  This is used to determine

    215. 

  215.      * if a requisite function has been successfully executed.  If not, an error should be thrown.

    216. 

  216.      *

    217. 

  217.      * @var Integer

    218. 

  218.      * @access private

    219. 

  219.      */

    220. 

  220.     var $bitmap = 0;

    221. 

  221. 

    222. 

  222.     /**

    223. 

  223.      * Error information

    224. 

  224.      *

    225. 

  225.      * @see Net_SSH2::getErrors()

    226. 

  226.      * @see Net_SSH2::getLastError()

    227. 

  227.      * @var String

    228. 

  228.      * @access private

    229. 

  229.      */

    230. 

  230.     var $errors = array();

    231. 

  231. 

    232. 

  232.     /**

    233. 

  233.      * Server Identifier

    234. 

  234.      *

    235. 

  235.      * @see Net_SSH2::getServerIdentification()

    236. 

  236.      * @var String

    237. 

  237.      * @access private

    238. 

  238.      */

    239. 

  239.     var $server_identifier = '';

    240. 

  240. 

    241. 

  241.     /**

    242. 

  242.      * Key Exchange Algorithms

    243. 

  243.      *

    244. 

  244.      * @see Net_SSH2::getKexAlgorithims()

    245. 

  245.      * @var Array

    246. 

  246.      * @access private

    247. 

  247.      */

    248. 

  248.     var $kex_algorithms;

    249. 

  249. 

    250. 

  250.     /**

    251. 

  251.      * Server Host Key Algorithms

    252. 

  252.      *

    253. 

  253.      * @see Net_SSH2::getServerHostKeyAlgorithms()

    254. 

  254.      * @var Array

    255. 

  255.      * @access private

    256. 

  256.      */

    257. 

  257.     var $server_host_key_algorithms;

    258. 

  258. 

    259. 

  259.     /**

    260. 

  260.      * Encryption Algorithms: Client to Server

    261. 

  261.      *

    262. 

  262.      * @see Net_SSH2::getEncryptionAlgorithmsClient2Server()

    263. 

  263.      * @var Array

    264. 

  264.      * @access private

    265. 

  265.      */

    266. 

  266.     var $encryption_algorithms_client_to_server;

    267. 

  267. 

    268. 

  268.     /**

    269. 

  269.      * Encryption Algorithms: Server to Client

    270. 

  270.      *

    271. 

  271.      * @see Net_SSH2::getEncryptionAlgorithmsServer2Client()

    272. 

  272.      * @var Array

    273. 

  273.      * @access private

    274. 

  274.      */

    275. 

  275.     var $encryption_algorithms_server_to_client;

    276. 

  276. 

    277. 

  277.     /**

    278. 

  278.      * MAC Algorithms: Client to Server

    279. 

  279.      *

    280. 

  280.      * @see Net_SSH2::getMACAlgorithmsClient2Server()

    281. 

  281.      * @var Array

    282. 

  282.      * @access private

    283. 

  283.      */

    284. 

  284.     var $mac_algorithms_client_to_server;

    285. 

  285. 

    286. 

  286.     /**

    287. 

  287.      * MAC Algorithms: Server to Client

    288. 

  288.      *

    289. 

  289.      * @see Net_SSH2::getMACAlgorithmsServer2Client()

    290. 

  290.      * @var Array

    291. 

  291.      * @access private

    292. 

  292.      */

    293. 

  293.     var $mac_algorithms_server_to_client;

    294. 

  294. 

    295. 

  295.     /**

    296. 

  296.      * Compression Algorithms: Client to Server

    297. 

  297.      *

    298. 

  298.      * @see Net_SSH2::getCompressionAlgorithmsClient2Server()

    299. 

  299.      * @var Array

    300. 

  300.      * @access private

    301. 

  301.      */

    302. 

  302.     var $compression_algorithms_client_to_server;

    303. 

  303. 

    304. 

  304.     /**

    305. 

  305.      * Compression Algorithms: Server to Client

    306. 

  306.      *

    307. 

  307.      * @see Net_SSH2::getCompressionAlgorithmsServer2Client()

    308. 

  308.      * @var Array

    309. 

  309.      * @access private

    310. 

  310.      */

    311. 

  311.     var $compression_algorithms_server_to_client;

    312. 

  312. 

    313. 

  313.     /**

    314. 

  314.      * Languages: Server to Client

    315. 

  315.      *

    316. 

  316.      * @see Net_SSH2::getLanguagesServer2Client()

    317. 

  317.      * @var Array

    318. 

  318.      * @access private

    319. 

  319.      */

    320. 

  320.     var $languages_server_to_client;

    321. 

  321. 

    322. 

  322.     /**

    323. 

  323.      * Languages: Client to Server

    324. 

  324.      *

    325. 

  325.      * @see Net_SSH2::getLanguagesClient2Server()

    326. 

  326.      * @var Array

    327. 

  327.      * @access private

    328. 

  328.      */

    329. 

  329.     var $languages_client_to_server;

    330. 

  330. 

    331. 

  331.     /**

    332. 

  332.      * Block Size for Server to Client Encryption

    333. 

  333.      *

    334. 

  334.      * "Note that the length of the concatenation of 'packet_length',

    335. 

  335.      *  'padding_length', 'payload', and 'random padding' MUST be a multiple

    336. 

  336.      *  of the cipher block size or 8, whichever is larger.  This constraint

    337. 

  337.      *  MUST be enforced, even when using stream ciphers."

    338. 

  338.      *

    339. 

  339.      *  -- http://tools.ietf.org/html/rfc4253#section-6

    340. 

  340.      *

    341. 

  341.      * @see Net_SSH2::Net_SSH2()

    342. 

  342.      * @see Net_SSH2::_send_binary_packet()

    343. 

  343.      * @var Integer

    344. 

  344.      * @access private

    345. 

  345.      */

    346. 

  346.     var $encrypt_block_size = 8;

    347. 

  347. 

    348. 

  348.     /**

    349. 

  349.      * Block Size for Client to Server Encryption

    350. 

  350.      *

    351. 

  351.      * @see Net_SSH2::Net_SSH2()

    352. 

  352.      * @see Net_SSH2::_get_binary_packet()

    353. 

  353.      * @var Integer

    354. 

  354.      * @access private

    355. 

  355.      */

    356. 

  356.     var $decrypt_block_size = 8;

    357. 

  357. 

    358. 

  358.     /**

    359. 

  359.      * Server to Client Encryption Object

    360. 

  360.      *

    361. 

  361.      * @see Net_SSH2::_get_binary_packet()

    362. 

  362.      * @var Object

    363. 

  363.      * @access private

    364. 

  364.      */

    365. 

  365.     var $decrypt = false;

    366. 

  366. 

    367. 

  367.     /**

    368. 

  368.      * Client to Server Encryption Object

    369. 

  369.      *

    370. 

  370.      * @see Net_SSH2::_send_binary_packet()

    371. 

  371.      * @var Object

    372. 

  372.      * @access private

    373. 

  373.      */

    374. 

  374.     var $encrypt = false;

    375. 

  375. 

    376. 

  376.     /**

    377. 

  377.      * Client to Server HMAC Object

    378. 

  378.      *

    379. 

  379.      * @see Net_SSH2::_send_binary_packet()

    380. 

  380.      * @var Object

    381. 

  381.      * @access private

    382. 

  382.      */

    383. 

  383.     var $hmac_create = false;

    384. 

  384. 

    385. 

  385.     /**

    386. 

  386.      * Server to Client HMAC Object

    387. 

  387.      *

    388. 

  388.      * @see Net_SSH2::_get_binary_packet()

    389. 

  389.      * @var Object

    390. 

  390.      * @access private

    391. 

  391.      */

    392. 

  392.     var $hmac_check = false;

    393. 

  393. 

    394. 

  394.     /**

    395. 

  395.      * Size of server to client HMAC

    396. 

  396.      *

    397. 

  397.      * We need to know how big the HMAC will be for the server to client direction so that we know how many bytes to read.

    398. 

  398.      * For the client to server side, the HMAC object will make the HMAC as long as it needs to be.  All we need to do is

    399. 

  399.      * append it.

    400. 

  400.      *

    401. 

  401.      * @see Net_SSH2::_get_binary_packet()

    402. 

  402.      * @var Integer

    403. 

  403.      * @access private

    404. 

  404.      */

    405. 

  405.     var $hmac_size = false;

    406. 

  406. 

    407. 

  407.     /**

    408. 

  408.      * Server Public Host Key

    409. 

  409.      *

    410. 

  410.      * @see Net_SSH2::getServerPublicHostKey()

    411. 

  411.      * @var String

    412. 

  412.      * @access private

    413. 

  413.      */

    414. 

  414.     var $server_public_host_key;

    415. 

  415. 

    416. 

  416.     /**

    417. 

  417.      * Session identifer

    418. 

  418.      *

    419. 

  419.      * "The exchange hash H from the first key exchange is additionally

    420. 

  420.      *  used as the session identifier, which is a unique identifier for

    421. 

  421.      *  this connection."

    422. 

  422.      *

    423. 

  423.      *  -- http://tools.ietf.org/html/rfc4253#section-7.2

    424. 

  424.      *

    425. 

  425.      * @see Net_SSH2::_key_exchange()

    426. 

  426.      * @var String

    427. 

  427.      * @access private

    428. 

  428.      */

    429. 

  429.     var $session_id = false;

    430. 

  430. 

    431. 

  431.     /**

    432. 

  432.      * Exchange hash

    433. 

  433.      *

    434. 

  434.      * The current exchange hash

    435. 

  435.      *

    436. 

  436.      * @see Net_SSH2::_key_exchange()

    437. 

  437.      * @var String

    438. 

  438.      * @access private

    439. 

  439.      */

    440. 

  440.     var $exchange_hash = false;

    441. 

  441. 

    442. 

  442.     /**

    443. 

  443.      * Message Numbers

    444. 

  444.      *

    445. 

  445.      * @see Net_SSH2::Net_SSH2()

    446. 

  446.      * @var Array

    447. 

  447.      * @access private

    448. 

  448.      */

    449. 

  449.     var $message_numbers = array();

    450. 

  450. 

    451. 

  451.     /**

    452. 

  452.      * Disconnection Message 'reason codes' defined in RFC4253

    453. 

  453.      *

    454. 

  454.      * @see Net_SSH2::Net_SSH2()

    455. 

  455.      * @var Array

    456. 

  456.      * @access private

    457. 

  457.      */

    458. 

  458.     var $disconnect_reasons = array();

    459. 

  459. 

    460. 

  460.     /**

    461. 

  461.      * SSH_MSG_CHANNEL_OPEN_FAILURE 'reason codes', defined in RFC4254

    462. 

  462.      *

    463. 

  463.      * @see Net_SSH2::Net_SSH2()

    464. 

  464.      * @var Array

    465. 

  465.      * @access private

    466. 

  466.      */

    467. 

  467.     var $channel_open_failure_reasons = array();

    468. 

  468. 

    469. 

  469.     /**

    470. 

  470.      * Terminal Modes

    471. 

  471.      *

    472. 

  472.      * @link http://tools.ietf.org/html/rfc4254#section-8

    473. 

  473.      * @see Net_SSH2::Net_SSH2()

    474. 

  474.      * @var Array

    475. 

  475.      * @access private

    476. 

  476.      */

    477. 

  477.     var $terminal_modes = array();

    478. 

  478. 

    479. 

  479.     /**

    480. 

  480.      * SSH_MSG_CHANNEL_EXTENDED_DATA's data_type_codes

    481. 

  481.      *

    482. 

  482.      * @link http://tools.ietf.org/html/rfc4254#section-5.2

    483. 

  483.      * @see Net_SSH2::Net_SSH2()

    484. 

  484.      * @var Array

    485. 

  485.      * @access private

    486. 

  486.      */

    487. 

  487.     var $channel_extended_data_type_codes = array();

    488. 

  488. 

    489. 

  489.     /**

    490. 

  490.      * Send Sequence Number

    491. 

  491.      *

    492. 

  492.      * See 'Section 6.4.  Data Integrity' of rfc4253 for more info.

    493. 

  493.      *

    494. 

  494.      * @see Net_SSH2::_send_binary_packet()

    495. 

  495.      * @var Integer

    496. 

  496.      * @access private

    497. 

  497.      */

    498. 

  498.     var $send_seq_no = 0;

    499. 

  499. 

    500. 

  500.     /**

    501. 

  501.      * Get Sequence Number

    502. 

  502.      *

    503. 

  503.      * See 'Section 6.4.  Data Integrity' of rfc4253 for more info.

    504. 

  504.      *

    505. 

  505.      * @see Net_SSH2::_get_binary_packet()

    506. 

  506.      * @var Integer

    507. 

  507.      * @access private

    508. 

  508.      */

    509. 

  509.     var $get_seq_no = 0;

    510. 

  510. 

    511. 

  511.     /**

    512. 

  512.      * Server Channels

    513. 

  513.      *

    514. 

  514.      * Maps client channels to server channels

    515. 

  515.      *

    516. 

  516.      * @see Net_SSH2::_get_channel_packet()

    517. 

  517.      * @see Net_SSH2::exec()

    518. 

  518.      * @var Array

    519. 

  519.      * @access private

    520. 

  520.      */

    521. 

  521.     var $server_channels = array();

    522. 

  522. 

    523. 

  523.     /**

    524. 

  524.      * Channel Buffers

    525. 

  525.      *

    526. 

  526.      * If a client requests a packet from one channel but receives two packets from another those packets should

    527. 

  527.      * be placed in a buffer

    528. 

  528.      *

    529. 

  529.      * @see Net_SSH2::_get_channel_packet()

    530. 

  530.      * @see Net_SSH2::exec()

    531. 

  531.      * @var Array

    532. 

  532.      * @access private

    533. 

  533.      */

    534. 

  534.     var $channel_buffers = array();

    535. 

  535. 

    536. 

  536.     /**

    537. 

  537.      * Channel Status

    538. 

  538.      *

    539. 

  539.      * Contains the type of the last sent message

    540. 

  540.      *

    541. 

  541.      * @see Net_SSH2::_get_channel_packet()

    542. 

  542.      * @var Array

    543. 

  543.      * @access private

    544. 

  544.      */

    545. 

  545.     var $channel_status = array();

    546. 

  546. 

    547. 

  547.     /**

    548. 

  548.      * Packet Size

    549. 

  549.      *

    550. 

  550.      * Maximum packet size indexed by channel

    551. 

  551.      *

    552. 

  552.      * @see Net_SSH2::_send_channel_packet()

    553. 

  553.      * @var Array

    554. 

  554.      * @access private

    555. 

  555.      */

    556. 

  556.     var $packet_size_client_to_server = array();

    557. 

  557. 

    558. 

  558.     /**

    559. 

  559.      * Message Number Log

    560. 

  560.      *

    561. 

  561.      * @see Net_SSH2::getLog()

    562. 

  562.      * @var Array

    563. 

  563.      * @access private

    564. 

  564.      */

    565. 

  565.     var $message_number_log = array();

    566. 

  566. 

    567. 

  567.     /**

    568. 

  568.      * Message Log

    569. 

  569.      *

    570. 

  570.      * @see Net_SSH2::getLog()

    571. 

  571.      * @var Array

    572. 

  572.      * @access private

    573. 

  573.      */

    574. 

  574.     var $message_log = array();

    575. 

  575. 

    576. 

  576.     /**

    577. 

  577.      * The Window Size

    578. 

  578.      *

    579. 

  579.      * Bytes the other party can send before it must wait for the window to be adjusted (0x7FFFFFFF = 4GB)

    580. 

  580.      *

    581. 

  581.      * @var Integer

    582. 

  582.      * @see Net_SSH2::_send_channel_packet()

    583. 

  583.      * @see Net_SSH2::exec()

    584. 

  584.      * @access private

    585. 

  585.      */

    586. 

  586.     var $window_size = 0x7FFFFFFF;

    587. 

  587. 

    588. 

  588.     /**

    589. 

  589.      * Window size

    590. 

  590.      *

    591. 

  591.      * Window size indexed by channel

    592. 

  592.      *

    593. 

  593.      * @see Net_SSH2::_send_channel_packet()

    594. 

  594.      * @var Array

    595. 

  595.      * @access private

    596. 

  596.      */

    597. 

  597.     var $window_size_client_to_server = array();

    598. 

  598. 

    599. 

  599.     /**

    600. 

  600.      * Server signature

    601. 

  601.      *

    602. 

  602.      * Verified against $this->session_id

    603. 

  603.      *

    604. 

  604.      * @see Net_SSH2::getServerPublicHostKey()

    605. 

  605.      * @var String

    606. 

  606.      * @access private

    607. 

  607.      */

    608. 

  608.     var $signature = '';

    609. 

  609. 

    610. 

  610.     /**

    611. 

  611.      * Server signature format

    612. 

  612.      *

    613. 

  613.      * ssh-rsa or ssh-dss.

    614. 

  614.      *

    615. 

  615.      * @see Net_SSH2::getServerPublicHostKey()

    616. 

  616.      * @var String

    617. 

  617.      * @access private

    618. 

  618.      */

    619. 

  619.     var $signature_format = '';

    620. 

  620. 

    621. 

  621.     /**

    622. 

  622.      * Interactive Buffer

    623. 

  623.      *

    624. 

  624.      * @see Net_SSH2::read()

    625. 

  625.      * @var Array

    626. 

  626.      * @access private

    627. 

  627.      */

    628. 

  628.     var $interactiveBuffer = '';

    629. 

  629. 

    630. 

  630.     /**

    631. 

  631.      * Current log size

    632. 

  632.      *

    633. 

  633.      * Should never exceed NET_SSH2_LOG_MAX_SIZE

    634. 

  634.      *

    635. 

  635.      * @see Net_SSH2::_send_binary_packet()

    636. 

  636.      * @see Net_SSH2::_get_binary_packet()

    637. 

  637.      * @var Integer

    638. 

  638.      * @access private

    639. 

  639.      */

    640. 

  640.     var $log_size;

    641. 

  641. 

    642. 

  642.     /**

    643. 

  643.      * Timeout

    644. 

  644.      *

    645. 

  645.      * @see Net_SSH2::setTimeout()

    646. 

  646.      * @access private

    647. 

  647.      */

    648. 

  648.     var $timeout;

    649. 

  649. 

    650. 

  650.     /**

    651. 

  651.      * Current Timeout

    652. 

  652.      *

    653. 

  653.      * @see Net_SSH2::_get_channel_packet()

    654. 

  654.      * @access private

    655. 

  655.      */

    656. 

  656.     var $curTimeout;

    657. 

  657. 

    658. 

  658.     /**

    659. 

  659.      * Real-time log file pointer

    660. 

  660.      *

    661. 

  661.      * @see Net_SSH2::_append_log()

    662. 

  662.      * @access private

    663. 

  663.      */

    664. 

  664.     var $realtime_log_file;

    665. 

  665. 

    666. 

  666.     /**

    667. 

  667.      * Real-time log file size

    668. 

  668.      *

    669. 

  669.      * @see Net_SSH2::_append_log()

    670. 

  670.      * @access private

    671. 

  671.      */

    672. 

  672.     var $realtime_log_size;

    673. 

  673. 

    674. 

  674.     /**

    675. 

  675.      * Has the signature been validated?

    676. 

  676.      *

    677. 

  677.      * @see Net_SSH2::getServerPublicHostKey()

    678. 

  678.      * @access private

    679. 

  679.      */

    680. 

  680.     var $signature_validated = false;

    681. 

  681. 

    682. 

  682.     /**

    683. 

  683.      * Real-time log file wrap boolean

    684. 

  684.      *

    685. 

  685.      * @see Net_SSH2::_append_log()

    686. 

  686.      * @access private

    687. 

  687.      */

    688. 

  688.     var $realtime_log_wrap;

    689. 

  689. 

    690. 

  690.     /**

    691. 

  691.      * Default Constructor.

    692. 

  692.      *

    693. 

  693.      * Connects to an SSHv2 server

    694. 

  694.      *

    695. 

  695.      * @param String $host

    696. 

  696.      * @param optional Integer $port

    697. 

  697.      * @param optional Integer $timeout

    698. 

  698.      * @return Net_SSH2

    699. 

  699.      * @access public

    700. 

  700.      */

    701. 

  701.     function Net_SSH2($host, $port = 22, $timeout = 10)

    702. 

  702.     {

    703. 

  703.         $this->message_numbers = array(

    704. 

  704.             1 => 'NET_SSH2_MSG_DISCONNECT',

    705. 

  705.             2 => 'NET_SSH2_MSG_IGNORE',

    706. 

  706.             3 => 'NET_SSH2_MSG_UNIMPLEMENTED',

    707. 

  707.             4 => 'NET_SSH2_MSG_DEBUG',

    708. 

  708.             5 => 'NET_SSH2_MSG_SERVICE_REQUEST',

    709. 

  709.             6 => 'NET_SSH2_MSG_SERVICE_ACCEPT',

    710. 

  710.             20 => 'NET_SSH2_MSG_KEXINIT',

    711. 

  711.             21 => 'NET_SSH2_MSG_NEWKEYS',

    712. 

  712.             30 => 'NET_SSH2_MSG_KEXDH_INIT',

    713. 

  713.             31 => 'NET_SSH2_MSG_KEXDH_REPLY',

    714. 

  714.             50 => 'NET_SSH2_MSG_USERAUTH_REQUEST',

    715. 

  715.             51 => 'NET_SSH2_MSG_USERAUTH_FAILURE',

    716. 

  716.             52 => 'NET_SSH2_MSG_USERAUTH_SUCCESS',

    717. 

  717.             53 => 'NET_SSH2_MSG_USERAUTH_BANNER',

    718. 

  718. 

    719. 

  719.             80 => 'NET_SSH2_MSG_GLOBAL_REQUEST',

    720. 

  720.             81 => 'NET_SSH2_MSG_REQUEST_SUCCESS',

    721. 

  721.             82 => 'NET_SSH2_MSG_REQUEST_FAILURE',

    722. 

  722.             90 => 'NET_SSH2_MSG_CHANNEL_OPEN',

    723. 

  723.             91 => 'NET_SSH2_MSG_CHANNEL_OPEN_CONFIRMATION',

    724. 

  724.             92 => 'NET_SSH2_MSG_CHANNEL_OPEN_FAILURE',

    725. 

  725.             93 => 'NET_SSH2_MSG_CHANNEL_WINDOW_ADJUST',

    726. 

  726.             94 => 'NET_SSH2_MSG_CHANNEL_DATA',

    727. 

  727.             95 => 'NET_SSH2_MSG_CHANNEL_EXTENDED_DATA',

    728. 

  728.             96 => 'NET_SSH2_MSG_CHANNEL_EOF',

    729. 

  729.             97 => 'NET_SSH2_MSG_CHANNEL_CLOSE',

    730. 

  730.             98 => 'NET_SSH2_MSG_CHANNEL_REQUEST',

    731. 

  731.             99 => 'NET_SSH2_MSG_CHANNEL_SUCCESS',

    732. 

  732.             100 => 'NET_SSH2_MSG_CHANNEL_FAILURE'

    733. 

  733.         );

    734. 

  734.         $this->disconnect_reasons = array(

    735. 

  735.             1 => 'NET_SSH2_DISCONNECT_HOST_NOT_ALLOWED_TO_CONNECT',

    736. 

  736.             2 => 'NET_SSH2_DISCONNECT_PROTOCOL_ERROR',

    737. 

  737.             3 => 'NET_SSH2_DISCONNECT_KEY_EXCHANGE_FAILED',

    738. 

  738.             4 => 'NET_SSH2_DISCONNECT_RESERVED',

    739. 

  739.             5 => 'NET_SSH2_DISCONNECT_MAC_ERROR',

    740. 

  740.             6 => 'NET_SSH2_DISCONNECT_COMPRESSION_ERROR',

    741. 

  741.             7 => 'NET_SSH2_DISCONNECT_SERVICE_NOT_AVAILABLE',

    742. 

  742.             8 => 'NET_SSH2_DISCONNECT_PROTOCOL_VERSION_NOT_SUPPORTED',

    743. 

  743.             9 => 'NET_SSH2_DISCONNECT_HOST_KEY_NOT_VERIFIABLE',

    744. 

  744.             10 => 'NET_SSH2_DISCONNECT_CONNECTION_LOST',

    745. 

  745.             11 => 'NET_SSH2_DISCONNECT_BY_APPLICATION',

    746. 

  746.             12 => 'NET_SSH2_DISCONNECT_TOO_MANY_CONNECTIONS',

    747. 

  747.             13 => 'NET_SSH2_DISCONNECT_AUTH_CANCELLED_BY_USER',

    748. 

  748.             14 => 'NET_SSH2_DISCONNECT_NO_MORE_AUTH_METHODS_AVAILABLE',

    749. 

  749.             15 => 'NET_SSH2_DISCONNECT_ILLEGAL_USER_NAME'

    750. 

  750.         );

    751. 

  751.         $this->channel_open_failure_reasons = array(

    752. 

  752.             1 => 'NET_SSH2_OPEN_ADMINISTRATIVELY_PROHIBITED'

    753. 

  753.         );

    754. 

  754.         $this->terminal_modes = array(

    755. 

  755.             0 => 'NET_SSH2_TTY_OP_END'

    756. 

  756.         );

    757. 

  757.         $this->channel_extended_data_type_codes = array(

    758. 

  758.             1 => 'NET_SSH2_EXTENDED_DATA_STDERR'

    759. 

  759.         );

    760. 

  760. 

    761. 

  761.         $this->_define_array(

    762. 

  762.             $this->message_numbers,

    763. 

  763.             $this->disconnect_reasons,

    764. 

  764.             $this->channel_open_failure_reasons,

    765. 

  765.             $this->terminal_modes,

    766. 

  766.             $this->channel_extended_data_type_codes,

    767. 

  767.             array(60 => 'NET_SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ'),

    768. 

  768.             array(60 => 'NET_SSH2_MSG_USERAUTH_PK_OK'),

    769. 

  769.             array(60 => 'NET_SSH2_MSG_USERAUTH_INFO_REQUEST',

    770. 

  770.                   61 => 'NET_SSH2_MSG_USERAUTH_INFO_RESPONSE')

    771. 

  771.         );

    772. 

  772. 

    773. 

  773.         $start = strtok(microtime(), ' ') + strtok(''); // http://php.net/microtime#61838

    774. 

  774.         $this->fsock = @fsockopen($host, $port, $errno, $errstr, $timeout);

    775. 

  775.         if (!$this->fsock) {

    776. 

  776.             user_error(rtrim("Cannot connect to $host. Error $errno. $errstr"), E_USER_NOTICE);

    777. 

  777.             return;

    778. 

  778.         }

    779. 

  779.         $elapsed = strtok(microtime(), ' ') + strtok('') - $start;

    780. 

  780. 

    781. 

  781.         if ($timeout - $elapsed <= 0) {

    782. 

  782.             user_error(rtrim("Cannot connect to $host. Timeout error"), E_USER_NOTICE);

    783. 

  783.             return;

    784. 

  784.         }

    785. 

  785. 

    786. 

  786.         $read = array($this->fsock);

    787. 

  787.         $write = $except = NULL;

    788. 

  788. 

    789. 

  789.         stream_set_blocking($this->fsock, false);

    790. 

  790. 

    791. 

  791.         // on windows this returns a "Warning: Invalid CRT parameters detected" error

    792. 

  792.         if (!@stream_select($read, $write, $except, $timeout - $elapsed)) {

    793. 

  793.             user_error(rtrim("Cannot connect to $host. Banner timeout"), E_USER_NOTICE);

    794. 

  794.             return;

    795. 

  795.         }

    796. 

  796. 

    797. 

  797.         stream_set_blocking($this->fsock, true);

    798. 

  798. 

    799. 

  799.         /* According to the SSH2 specs,

    800. 

  800. 

    801. 

  801.           "The server MAY send other lines of data before sending the version

    802. 

  802.            string.  Each line SHOULD be terminated by a Carriage Return and Line

    803. 

  803.            Feed.  Such lines MUST NOT begin with "SSH-", and SHOULD be encoded

    804. 

  804.            in ISO-10646 UTF-8 [RFC3629] (language is not specified).  Clients

    805. 

  805.            MUST be able to process such lines." */

    806. 

  806.         $temp = '';

    807. 

  807.         $extra = '';

    808. 

  808.         while (!feof($this->fsock) && !preg_match('#^SSH-(\d\.\d+)#', $temp, $matches)) {

    809. 

  809.             if (substr($temp, -2) == "\r\n") {

    810. 

  810.                 $extra.= $temp;

    811. 

  811.                 $temp = '';

    812. 

  812.             }

    813. 

  813.             $temp.= fgets($this->fsock, 255);

    814. 

  814.         }

    815. 

  815. 

    816. 

  816.         if (feof($this->fsock)) {

    817. 

  817.             user_error('Connection closed by server', E_USER_NOTICE);

    818. 

  818.             return false;

    819. 

  819.         }

    820. 

  820. 

    821. 

  821.         $ext = array();

    822. 

  822.         if (extension_loaded('mcrypt')) {

    823. 

  823.             $ext[] = 'mcrypt';

    824. 

  824.         }

    825. 

  825.         if (extension_loaded('gmp')) {

    826. 

  826.             $ext[] = 'gmp';

    827. 

  827.         } else if (extension_loaded('bcmath')) {

    828. 

  828.             $ext[] = 'bcmath';

    829. 

  829.         }

    830. 

  830. 

    831. 

  831.         if (!empty($ext)) {

    832. 

  832.             $this->identifier.= ' (' . implode(', ', $ext) . ')';

    833. 

  833.         }

    834. 

  834. 

    835. 

  835.         if (defined('NET_SSH2_LOGGING')) {

    836. 

  836.             $this->message_number_log[] = '<-';

    837. 

  837.             $this->message_number_log[] = '->';

    838. 

  838. 

    839. 

  839.             if (NET_SSH2_LOGGING == NET_SSH2_LOG_COMPLEX) {

    840. 

  840.                 $this->message_log[] = $temp;

    841. 

  841.                 $this->message_log[] = $this->identifier . "\r\n";

    842. 

  842.             }

    843. 

  843.         }

    844. 

  844. 

    845. 

  845.         $this->server_identifier = trim($temp, "\r\n");

    846. 

  846.         if (!empty($extra)) {

    847. 

  847.             $this->errors[] = utf8_decode($extra);

    848. 

  848.         }

    849. 

  849. 

    850. 

  850.         if ($matches[1] != '1.99' && $matches[1] != '2.0') {

    851. 

  851.             user_error("Cannot connect to SSH $matches[1] servers", E_USER_NOTICE);

    852. 

  852.             return;

    853. 

  853.         }

    854. 

  854. 

    855. 

  855.         fputs($this->fsock, $this->identifier . "\r\n");

    856. 

  856. 

    857. 

  857.         $response = $this->_get_binary_packet();

    858. 

  858.         if ($response === false) {

    859. 

  859.             user_error('Connection closed by server', E_USER_NOTICE);

    860. 

  860.             return;

    861. 

  861.         }

    862. 

  862. 

    863. 

  863.         if (ord($response[0]) != NET_SSH2_MSG_KEXINIT) {

    864. 

  864.             user_error('Expected SSH_MSG_KEXINIT', E_USER_NOTICE);

    865. 

  865.             return;

    866. 

  866.         }

    867. 

  867. 

    868. 

  868.         if (!$this->_key_exchange($response)) {

    869. 

  869.             return;

    870. 

  870.         }

    871. 

  871. 

    872. 

  872.         $this->bitmap = NET_SSH2_MASK_CONSTRUCTOR;

    873. 

  873.     }

    874. 

  874. 

    875. 

  875.     /**

    876. 

  876.      * Key Exchange

    877. 

  877.      *

    878. 

  878.      * @param String $kexinit_payload_server

    879. 

  879.      * @access private

    880. 

  880.      */

    881. 

  881.     function _key_exchange($kexinit_payload_server)

    882. 

  882.     {

    883. 

  883.         static $kex_algorithms = array(

    884. 

  884.             'diffie-hellman-group1-sha1', // REQUIRED

    885. 

  885.             'diffie-hellman-group14-sha1' // REQUIRED

    886. 

  886.         );

    887. 

  887. 

    888. 

  888.         static $server_host_key_algorithms = array(

    889. 

  889.             'ssh-rsa', // RECOMMENDED  sign   Raw RSA Key

    890. 

  890.             'ssh-dss'  // REQUIRED     sign   Raw DSS Key

    891. 

  891.         );

    892. 

  892. 

    893. 

  893.         static $encryption_algorithms = array(

    894. 

  894.             // from <http://tools.ietf.org/html/rfc4345#section-4>:

    895. 

  895.             'arcfour256',

    896. 

  896.             'arcfour128',

    897. 

  897. 

    898. 

  898.             'arcfour',    // OPTIONAL          the ARCFOUR stream cipher with a 128-bit key

    899. 

  899. 

    900. 

  900.             'aes128-cbc', // RECOMMENDED       AES with a 128-bit key

    901. 

  901.             'aes192-cbc', // OPTIONAL          AES with a 192-bit key

    902. 

  902.             'aes256-cbc', // OPTIONAL          AES in CBC mode, with a 256-bit key

    903. 

  903. 

    904. 

  904.             // from <http://tools.ietf.org/html/rfc4344#section-4>:

    905. 

  905.             'aes128-ctr', // RECOMMENDED       AES (Rijndael) in SDCTR mode, with 128-bit key

    906. 

  906.             'aes192-ctr', // RECOMMENDED       AES with 192-bit key

    907. 

  907.             'aes256-ctr', // RECOMMENDED       AES with 256-bit key

    908. 

  908.             '3des-ctr',   // RECOMMENDED       Three-key 3DES in SDCTR mode

    909. 

  909. 

    910. 

  910.             '3des-cbc',   // REQUIRED          three-key 3DES in CBC mode

    911. 

  911.             'none'        // OPTIONAL          no encryption; NOT RECOMMENDED

    912. 

  912.         );

    913. 

  913. 

    914. 

  914.         static $mac_algorithms = array(

    915. 

  915.             'hmac-sha1-96', // RECOMMENDED     first 96 bits of HMAC-SHA1 (digest length = 12, key length = 20)

    916. 

  916.             'hmac-sha1',    // REQUIRED        HMAC-SHA1 (digest length = key length = 20)

    917. 

  917.             'hmac-md5-96',  // OPTIONAL        first 96 bits of HMAC-MD5 (digest length = 12, key length = 16)

    918. 

  918.             'hmac-md5',     // OPTIONAL        HMAC-MD5 (digest length = key length = 16)

    919. 

  919.             'none'          // OPTIONAL        no MAC; NOT RECOMMENDED

    920. 

  920.         );

    921. 

  921. 

    922. 

  922.         static $compression_algorithms = array(

    923. 

  923.             'none'   // REQUIRED        no compression

    924. 

  924.             //'zlib' // OPTIONAL        ZLIB (LZ77) compression

    925. 

  925.         );

    926. 

  926. 

    927. 

  927.         static $str_kex_algorithms, $str_server_host_key_algorithms,

    928. 

  928.                $encryption_algorithms_server_to_client, $mac_algorithms_server_to_client, $compression_algorithms_server_to_client,

    929. 

  929.                $encryption_algorithms_client_to_server, $mac_algorithms_client_to_server, $compression_algorithms_client_to_server;

    930. 

  930. 

    931. 

  931.         if (empty($str_kex_algorithms)) {

    932. 

  932.             $str_kex_algorithms = implode(',', $kex_algorithms);

    933. 

  933.             $str_server_host_key_algorithms = implode(',', $server_host_key_algorithms);

    934. 

  934.             $encryption_algorithms_server_to_client = $encryption_algorithms_client_to_server = implode(',', $encryption_algorithms);

    935. 

  935.             $mac_algorithms_server_to_client = $mac_algorithms_client_to_server = implode(',', $mac_algorithms);

    936. 

  936.             $compression_algorithms_server_to_client = $compression_algorithms_client_to_server = implode(',', $compression_algorithms);

    937. 

  937.         }

    938. 

  938. 

    939. 

  939.         $client_cookie = '';

    940. 

  940.         for ($i = 0; $i < 16; $i++) {

    941. 

  941.             $client_cookie.= chr(crypt_random(0, 255));

    942. 

  942.         }

    943. 

  943. 

    944. 

  944.         $response = $kexinit_payload_server;

    945. 

  945.         $this->_string_shift($response, 1); // skip past the message number (it should be SSH_MSG_KEXINIT)

    946. 

  946.         $server_cookie = $this->_string_shift($response, 16);

    947. 

  947. 

    948. 

  948.         $temp = unpack('Nlength', $this->_string_shift($response, 4));

    949. 

  949.         $this->kex_algorithms = explode(',', $this->_string_shift($response, $temp['length']));

    950. 

  950. 

    951. 

  951.         $temp = unpack('Nlength', $this->_string_shift($response, 4));

    952. 

  952.         $this->server_host_key_algorithms = explode(',', $this->_string_shift($response, $temp['length']));

    953. 

  953. 

    954. 

  954.         $temp = unpack('Nlength', $this->_string_shift($response, 4));

    955. 

  955.         $this->encryption_algorithms_client_to_server = explode(',', $this->_string_shift($response, $temp['length']));

    956. 

  956. 

    957. 

  957.         $temp = unpack('Nlength', $this->_string_shift($response, 4));

    958. 

  958.         $this->encryption_algorithms_server_to_client = explode(',', $this->_string_shift($response, $temp['length']));

    959. 

  959. 

    960. 

  960.         $temp = unpack('Nlength', $this->_string_shift($response, 4));

    961. 

  961.         $this->mac_algorithms_client_to_server = explode(',', $this->_string_shift($response, $temp['length']));

    962. 

  962. 

    963. 

  963.         $temp = unpack('Nlength', $this->_string_shift($response, 4));

    964. 

  964.         $this->mac_algorithms_server_to_client = explode(',', $this->_string_shift($response, $temp['length']));

    965. 

  965. 

    966. 

  966.         $temp = unpack('Nlength', $this->_string_shift($response, 4));

    967. 

  967.         $this->compression_algorithms_client_to_server = explode(',', $this->_string_shift($response, $temp['length']));

    968. 

  968. 

    969. 

  969.         $temp = unpack('Nlength', $this->_string_shift($response, 4));

    970. 

  970.         $this->compression_algorithms_server_to_client = explode(',', $this->_string_shift($response, $temp['length']));

    971. 

  971. 

    972. 

  972.         $temp = unpack('Nlength', $this->_string_shift($response, 4));

    973. 

  973.         $this->languages_client_to_server = explode(',', $this->_string_shift($response, $temp['length']));

    974. 

  974. 

    975. 

  975.         $temp = unpack('Nlength', $this->_string_shift($response, 4));

    976. 

  976.         $this->languages_server_to_client = explode(',', $this->_string_shift($response, $temp['length']));

    977. 

  977. 

    978. 

  978.         extract(unpack('Cfirst_kex_packet_follows', $this->_string_shift($response, 1)));

    979. 

  979.         $first_kex_packet_follows = $first_kex_packet_follows != 0;

    980. 

  980. 

    981. 

  981.         // the sending of SSH2_MSG_KEXINIT could go in one of two places.  this is the second place.

    982. 

  982.         $kexinit_payload_client = pack('Ca*Na*Na*Na*Na*Na*Na*Na*Na*Na*Na*CN',

    983. 

  983.             NET_SSH2_MSG_KEXINIT, $client_cookie, strlen($str_kex_algorithms), $str_kex_algorithms,

    984. 

  984.             strlen($str_server_host_key_algorithms), $str_server_host_key_algorithms, strlen($encryption_algorithms_client_to_server),

    985. 

  985.             $encryption_algorithms_client_to_server, strlen($encryption_algorithms_server_to_client), $encryption_algorithms_server_to_client,

    986. 

  986.             strlen($mac_algorithms_client_to_server), $mac_algorithms_client_to_server, strlen($mac_algorithms_server_to_client),

    987. 

  987.             $mac_algorithms_server_to_client, strlen($compression_algorithms_client_to_server), $compression_algorithms_client_to_server,

    988. 

  988.             strlen($compression_algorithms_server_to_client), $compression_algorithms_server_to_client, 0, '', 0, '',

    989. 

  989.             0, 0

    990. 

  990.         );

    991. 

  991. 

    992. 

  992.         if (!$this->_send_binary_packet($kexinit_payload_client)) {

    993. 

  993.             return false;

    994. 

  994.         }

    995. 

  995.         // here ends the second place.

    996. 

  996. 

    997. 

  997.         // we need to decide upon the symmetric encryption algorithms before we do the diffie-hellman key exchange

    998. 

  998.         for ($i = 0; $i < count($encryption_algorithms) && !in_array($encryption_algorithms[$i], $this->encryption_algorithms_server_to_client); $i++);

    999. 

  999.         if ($i == count($encryption_algorithms)) {

    1000. 

  1000.             user_error('No compatible server to client encryption algorithms found', E_USER_NOTICE);

    1001. 

  1001.             return $this->_disconnect(NET_SSH2_DISCONNECT_KEY_EXCHANGE_FAILED);

    1002. 

  1002.         }

    1003. 

  1003. 

    1004. 

  1004.         // we don't initialize any crypto-objects, yet - we do that, later. for now, we need the lengths to make the

    1005. 

  1005.         // diffie-hellman key exchange as fast as possible

    1006. 

  1006.         $decrypt = $encryption_algorithms[$i];

    1007. 

  1007.         switch ($decrypt) {

    1008. 

  1008.             case '3des-cbc':

    1009. 

  1009.             case '3des-ctr':

    1010. 

  1010.                 $decryptKeyLength = 24; // eg. 192 / 8

    1011. 

  1011.                 break;

    1012. 

  1012.             case 'aes256-cbc':

    1013. 

  1013.             case 'aes256-ctr':

    1014. 

  1014.                 $decryptKeyLength = 32; // eg. 256 / 8

    1015. 

  1015.                 break;

    1016. 

  1016.             case 'aes192-cbc':

    1017. 

  1017.             case 'aes192-ctr':

    1018. 

  1018.                 $decryptKeyLength = 24; // eg. 192 / 8

    1019. 

  1019.                 break;

    1020. 

  1020.             case 'aes128-cbc':

    1021. 

  1021.             case 'aes128-ctr':

    1022. 

  1022.                 $decryptKeyLength = 16; // eg. 128 / 8

    1023. 

  1023.                 break;

    1024. 

  1024.             case 'arcfour':

    1025. 

  1025.             case 'arcfour128':

    1026. 

  1026.                 $decryptKeyLength = 16; // eg. 128 / 8

    1027. 

  1027.                 break;

    1028. 

  1028.             case 'arcfour256':

    1029. 

  1029.                 $decryptKeyLength = 32; // eg. 128 / 8

    1030. 

  1030.                 break;

    1031. 

  1031.             case 'none';

    1032. 

  1032.                 $decryptKeyLength = 0;

    1033. 

  1033.         }

    1034. 

  1034. 

    1035. 

  1035.         for ($i = 0; $i < count($encryption_algorithms) && !in_array($encryption_algorithms[$i], $this->encryption_algorithms_client_to_server); $i++);

    1036. 

  1036.         if ($i == count($encryption_algorithms)) {

    1037. 

  1037.             user_error('No compatible client to server encryption algorithms found', E_USER_NOTICE);

    1038. 

  1038.             return $this->_disconnect(NET_SSH2_DISCONNECT_KEY_EXCHANGE_FAILED);

    1039. 

  1039.         }

    1040. 

  1040. 

    1041. 

  1041.         $encrypt = $encryption_algorithms[$i];

    1042. 

  1042.         switch ($encrypt) {

    1043. 

  1043.             case '3des-cbc':

    1044. 

  1044.             case '3des-ctr':

    1045. 

  1045.                 $encryptKeyLength = 24;

    1046. 

  1046.                 break;

    1047. 

  1047.             case 'aes256-cbc':

    1048. 

  1048.             case 'aes256-ctr':

    1049. 

  1049.                 $encryptKeyLength = 32;

    1050. 

  1050.                 break;

    1051. 

  1051.             case 'aes192-cbc':

    1052. 

  1052.             case 'aes192-ctr':

    1053. 

  1053.                 $encryptKeyLength = 24;

    1054. 

  1054.                 break;

    1055. 

  1055.             case 'aes128-cbc':

    1056. 

  1056.             case 'aes128-ctr':

    1057. 

  1057.                 $encryptKeyLength = 16;

    1058. 

  1058.                 break;

    1059. 

  1059.             case 'arcfour':

    1060. 

  1060.             case 'arcfour128':

    1061. 

  1061.                 $encryptKeyLength = 16;

    1062. 

  1062.                 break;

    1063. 

  1063.             case 'arcfour256':

    1064. 

  1064.                 $encryptKeyLength = 32;

    1065. 

  1065.                 break;

    1066. 

  1066.             case 'none';

    1067. 

  1067.                 $encryptKeyLength = 0;

    1068. 

  1068.         }

    1069. 

  1069. 

    1070. 

  1070.         $keyLength = $decryptKeyLength > $encryptKeyLength ? $decryptKeyLength : $encryptKeyLength;

    1071. 

  1071. 

    1072. 

  1072.         // through diffie-hellman key exchange a symmetric key is obtained

    1073. 

  1073.         for ($i = 0; $i < count($kex_algorithms) && !in_array($kex_algorithms[$i], $this->kex_algorithms); $i++);

    1074. 

  1074.         if ($i == count($kex_algorithms)) {

    1075. 

  1075.             user_error('No compatible key exchange algorithms found', E_USER_NOTICE);

    1076. 

  1076.             return $this->_disconnect(NET_SSH2_DISCONNECT_KEY_EXCHANGE_FAILED);

    1077. 

  1077.         }

    1078. 

  1078. 

    1079. 

  1079.         switch ($kex_algorithms[$i]) {

    1080. 

  1080.             // see http://tools.ietf.org/html/rfc2409#section-6.2 and 

    1081. 

  1081.             // http://tools.ietf.org/html/rfc2412, appendex E

    1082. 

  1082.             case 'diffie-hellman-group1-sha1':

    1083. 

  1083.                 $p = pack('H256', 'FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74' . 

    1084. 

  1084.                                   '020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F1437' . 

    1085. 

  1085.                                   '4FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7ED' . 

    1086. 

  1086.                                   'EE386BFB5A899FA5AE9F24117C4B1FE649286651ECE65381FFFFFFFFFFFFFFFF');

    1087. 

  1087.                 $keyLength = $keyLength < 160 ? $keyLength : 160;

    1088. 

  1088.                 $hash = 'sha1';

    1089. 

  1089.                 break;

    1090. 

  1090.             // see http://tools.ietf.org/html/rfc3526#section-3

    1091. 

  1091.             case 'diffie-hellman-group14-sha1':

    1092. 

  1092.                 $p = pack('H512', 'FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74' . 

    1093. 

  1093.                                   '020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F1437' . 

    1094. 

  1094.                                   '4FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7ED' . 

    1095. 

  1095.                                   'EE386BFB5A899FA5AE9F24117C4B1FE649286651ECE45B3DC2007CB8A163BF05' . 

    1096. 

  1096.                                   '98DA48361C55D39A69163FA8FD24CF5F83655D23DCA3AD961C62F356208552BB' . 

    1097. 

  1097.                                   '9ED529077096966D670C354E4ABC9804F1746C08CA18217C32905E462E36CE3B' . 

    1098. 

  1098.                                   'E39E772C180E86039B2783A2EC07A28FB5C55DF06F4C52C9DE2BCBF695581718' . 

    1099. 

  1099.                                   '3995497CEA956AE515D2261898FA051015728E5A8AACAA68FFFFFFFFFFFFFFFF');

    1100. 

  1100.                 $keyLength = $keyLength < 160 ? $keyLength : 160;

    1101. 

  1101.                 $hash = 'sha1';

    1102. 

  1102.         }

    1103. 

  1103. 

    1104. 

  1104.         $p = new Math_BigInteger($p, 256);

    1105. 

  1105.         //$q = $p->bitwise_rightShift(1);

    1106. 

  1106. 

    1107. 

  1107.         /* To increase the speed of the key exchange, both client and server may

    1108. 

  1108.            reduce the size of their private exponents.  It should be at least

    1109. 

  1109.            twice as long as the key material that is generated from the shared

    1110. 

  1110.            secret.  For more details, see the paper by van Oorschot and Wiener

    1111. 

  1111.            [VAN-OORSCHOT].

    1112. 

  1112. 

    1113. 

  1113.            -- http://tools.ietf.org/html/rfc4419#section-6.2 */

    1114. 

  1114.         $q = new Math_BigInteger(1);

    1115. 

  1115.         $q = $q->bitwise_leftShift(2 * $keyLength);

    1116. 

  1116.         $q = $q->subtract(new Math_BigInteger(1));

    1117. 

  1117. 

    1118. 

  1118.         $g = new Math_BigInteger(2);

    1119. 

  1119.         $x = new Math_BigInteger();

    1120. 

  1120.         $x->setRandomGenerator('crypt_random');

    1121. 

  1121.         $x = $x->random(new Math_BigInteger(1), $q);

    1122. 

  1122.         $e = $g->modPow($x, $p);

    1123. 

  1123. 

    1124. 

  1124.         $eBytes = $e->toBytes(true);

    1125. 

  1125.         $data = pack('CNa*', NET_SSH2_MSG_KEXDH_INIT, strlen($eBytes), $eBytes);

    1126. 

  1126. 

    1127. 

  1127.         if (!$this->_send_binary_packet($data)) {

    1128. 

  1128.             user_error('Connection closed by server', E_USER_NOTICE);

    1129. 

  1129.             return false;

    1130. 

  1130.         }

    1131. 

  1131. 

    1132. 

  1132.         $response = $this->_get_binary_packet();

    1133. 

  1133.         if ($response === false) {

    1134. 

  1134.             user_error('Connection closed by server', E_USER_NOTICE);

    1135. 

  1135.             return false;

    1136. 

  1136.         }

    1137. 

  1137.         extract(unpack('Ctype', $this->_string_shift($response, 1)));

    1138. 

  1138. 

    1139. 

  1139.         if ($type != NET_SSH2_MSG_KEXDH_REPLY) {

    1140. 

  1140.             user_error('Expected SSH_MSG_KEXDH_REPLY', E_USER_NOTICE);

    1141. 

  1141.             return false;

    1142. 

  1142.         }

    1143. 

  1143. 

    1144. 

  1144.         $temp = unpack('Nlength', $this->_string_shift($response, 4));

    1145. 

  1145.         $this->server_public_host_key = $server_public_host_key = $this->_string_shift($response, $temp['length']);

    1146. 

  1146. 

    1147. 

  1147.         $temp = unpack('Nlength', $this->_string_shift($server_public_host_key, 4));

    1148. 

  1148.         $public_key_format = $this->_string_shift($server_public_host_key, $temp['length']);

    1149. 

  1149. 

    1150. 

  1150.         $temp = unpack('Nlength', $this->_string_shift($response, 4));

    1151. 

  1151.         $fBytes = $this->_string_shift($response, $temp['length']);

    1152. 

  1152.         $f = new Math_BigInteger($fBytes, -256);

    1153. 

  1153. 

    1154. 

  1154.         $temp = unpack('Nlength', $this->_string_shift($response, 4));

    1155. 

  1155.         $this->signature = $this->_string_shift($response, $temp['length']);

    1156. 

  1156. 

    1157. 

  1157.         $temp = unpack('Nlength', $this->_string_shift($this->signature, 4));

    1158. 

  1158.         $this->signature_format = $this->_string_shift($this->signature, $temp['length']);

    1159. 

  1159. 

    1160. 

  1160.         $key = $f->modPow($x, $p);

    1161. 

  1161.         $keyBytes = $key->toBytes(true);

    1162. 

  1162. 

    1163. 

  1163.         $this->exchange_hash = pack('Na*Na*Na*Na*Na*Na*Na*Na*',

    1164. 

  1164.             strlen($this->identifier), $this->identifier, strlen($this->server_identifier), $this->server_identifier,

    1165. 

  1165.             strlen($kexinit_payload_client), $kexinit_payload_client, strlen($kexinit_payload_server),

    1166. 

  1166.             $kexinit_payload_server, strlen($this->server_public_host_key), $this->server_public_host_key, strlen($eBytes),

    1167. 

  1167.             $eBytes, strlen($fBytes), $fBytes, strlen($keyBytes), $keyBytes

    1168. 

  1168.         );

    1169. 

  1169. 

    1170. 

  1170.         $this->exchange_hash = pack('H*', $hash($this->exchange_hash));

    1171. 

  1171. 

    1172. 

  1172.         if ($this->session_id === false) {

    1173. 

  1173.             $this->session_id = $this->exchange_hash;

    1174. 

  1174.         }

    1175. 

  1175. 

    1176. 

  1176.         for ($i = 0; $i < count($server_host_key_algorithms) && !in_array($server_host_key_algorithms[$i], $this->server_host_key_algorithms); $i++);

    1177. 

  1177.         if ($i == count($server_host_key_algorithms)) {

    1178. 

  1178.             user_error('No compatible server host key algorithms found', E_USER_NOTICE);

    1179. 

  1179.             return $this->_disconnect(NET_SSH2_DISCONNECT_KEY_EXCHANGE_FAILED);

    1180. 

  1180.         }

    1181. 

  1181. 

    1182. 

  1182.         if ($public_key_format != $server_host_key_algorithms[$i] || $this->signature_format != $server_host_key_algorithms[$i]) {

    1183. 

  1183.             user_error('Sever Host Key Algorithm Mismatch', E_USER_NOTICE);

    1184. 

  1184.             return $this->_disconnect(NET_SSH2_DISCONNECT_KEY_EXCHANGE_FAILED);

    1185. 

  1185.         }

    1186. 

  1186. 

    1187. 

  1187.         $packet = pack('C',

    1188. 

  1188.             NET_SSH2_MSG_NEWKEYS

    1189. 

  1189.         );

    1190. 

  1190. 

    1191. 

  1191.         if (!$this->_send_binary_packet($packet)) {

    1192. 

  1192.             return false;

    1193. 

  1193.         }

    1194. 

  1194. 

    1195. 

  1195.         $response = $this->_get_binary_packet();

    1196. 

  1196. 

    1197. 

  1197.         if ($response === false) {

    1198. 

  1198.             user_error('Connection closed by server', E_USER_NOTICE);

    1199. 

  1199.             return false;

    1200. 

  1200.         }

    1201. 

  1201. 

    1202. 

  1202.         extract(unpack('Ctype', $this->_string_shift($response, 1)));

    1203. 

  1203. 

    1204. 

  1204.         if ($type != NET_SSH2_MSG_NEWKEYS) {

    1205. 

  1205.             user_error('Expected SSH_MSG_NEWKEYS', E_USER_NOTICE);

    1206. 

  1206.             return false;

    1207. 

  1207.         }

    1208. 

  1208. 

    1209. 

  1209.         switch ($encrypt) {

    1210. 

  1210.             case '3des-cbc':

    1211. 

  1211.                 $this->encrypt = new Crypt_TripleDES();

    1212. 

  1212.                 // $this->encrypt_block_size = 64 / 8 == the default

    1213. 

  1213.                 break;

    1214. 

  1214.             case '3des-ctr':

    1215. 

  1215.                 $this->encrypt = new Crypt_TripleDES(CRYPT_DES_MODE_CTR);

    1216. 

  1216.                 // $this->encrypt_block_size = 64 / 8 == the default

    1217. 

  1217.                 break;

    1218. 

  1218.             case 'aes256-cbc':

    1219. 

  1219.             case 'aes192-cbc':

    1220. 

  1220.             case 'aes128-cbc':

    1221. 

  1221.                 $this->encrypt = new Crypt_AES();

    1222. 

  1222.                 $this->encrypt_block_size = 16; // eg. 128 / 8

    1223. 

  1223.                 break;

    1224. 

  1224.             case 'aes256-ctr':

    1225. 

  1225.             case 'aes192-ctr':

    1226. 

  1226.             case 'aes128-ctr':

    1227. 

  1227.                 $this->encrypt = new Crypt_AES(CRYPT_AES_MODE_CTR);

    1228. 

  1228.                 $this->encrypt_block_size = 16; // eg. 128 / 8

    1229. 

  1229.                 break;

    1230. 

  1230.             case 'arcfour':

    1231. 

  1231.             case 'arcfour128':

    1232. 

  1232.             case 'arcfour256':

    1233. 

  1233.                 $this->encrypt = new Crypt_RC4();

    1234. 

  1234.                 break;

    1235. 

  1235.             case 'none';

    1236. 

  1236.                 //$this->encrypt = new Crypt_Null();

    1237. 

  1237.         }

    1238. 

  1238. 

    1239. 

  1239.         switch ($decrypt) {

    1240. 

  1240.             case '3des-cbc':

    1241. 

  1241.                 $this->decrypt = new Crypt_TripleDES();

    1242. 

  1242.                 break;

    1243. 

  1243.             case '3des-ctr':

    1244. 

  1244.                 $this->decrypt = new Crypt_TripleDES(CRYPT_DES_MODE_CTR);

    1245. 

  1245.                 break;

    1246. 

  1246.             case 'aes256-cbc':

    1247. 

  1247.             case 'aes192-cbc':

    1248. 

  1248.             case 'aes128-cbc':

    1249. 

  1249.                 $this->decrypt = new Crypt_AES();

    1250. 

  1250.                 $this->decrypt_block_size = 16;

    1251. 

  1251.                 break;

    1252. 

  1252.             case 'aes256-ctr':

    1253. 

  1253.             case 'aes192-ctr':

    1254. 

  1254.             case 'aes128-ctr':

    1255. 

  1255.                 $this->decrypt = new Crypt_AES(CRYPT_AES_MODE_CTR);

    1256. 

  1256.                 $this->decrypt_block_size = 16;

    1257. 

  1257.                 break;

    1258. 

  1258.             case 'arcfour':

    1259. 

  1259.             case 'arcfour128':

    1260. 

  1260.             case 'arcfour256':

    1261. 

  1261.                 $this->decrypt = new Crypt_RC4();

    1262. 

  1262.                 break;

    1263. 

  1263.             case 'none';

    1264. 

  1264.                 //$this->decrypt = new Crypt_Null();

    1265. 

  1265.         }

    1266. 

  1266. 

    1267. 

  1267.         $keyBytes = pack('Na*', strlen($keyBytes), $keyBytes);

    1268. 

  1268. 

    1269. 

  1269.         if ($this->encrypt) {

    1270. 

  1270.             $this->encrypt->enableContinuousBuffer();

    1271. 

  1271.             $this->encrypt->disablePadding();

    1272. 

  1272. 

    1273. 

  1273.             $iv = pack('H*', $hash($keyBytes . $this->exchange_hash . 'A' . $this->session_id));

    1274. 

  1274.             while ($this->encrypt_block_size > strlen($iv)) {

    1275. 

  1275.                 $iv.= pack('H*', $hash($keyBytes . $this->exchange_hash . $iv));

    1276. 

  1276.             }

    1277. 

  1277.             $this->encrypt->setIV(substr($iv, 0, $this->encrypt_block_size));

    1278. 

  1278. 

    1279. 

  1279.             $key = pack('H*', $hash($keyBytes . $this->exchange_hash . 'C' . $this->session_id));

    1280. 

  1280.             while ($encryptKeyLength > strlen($key)) {

    1281. 

  1281.                 $key.= pack('H*', $hash($keyBytes . $this->exchange_hash . $key));

    1282. 

  1282.             }

    1283. 

  1283.             $this->encrypt->setKey(substr($key, 0, $encryptKeyLength));

    1284. 

  1284.         }

    1285. 

  1285. 

    1286. 

  1286.         if ($this->decrypt) {

    1287. 

  1287.             $this->decrypt->enableContinuousBuffer();

    1288. 

  1288.             $this->decrypt->disablePadding();

    1289. 

  1289. 

    1290. 

  1290.             $iv = pack('H*', $hash($keyBytes . $this->exchange_hash . 'B' . $this->session_id));

    1291. 

  1291.             while ($this->decrypt_block_size > strlen($iv)) {

    1292. 

  1292.                 $iv.= pack('H*', $hash($keyBytes . $this->exchange_hash . $iv));

    1293. 

  1293.             }

    1294. 

  1294.             $this->decrypt->setIV(substr($iv, 0, $this->decrypt_block_size));

    1295. 

  1295. 

    1296. 

  1296.             $key = pack('H*', $hash($keyBytes . $this->exchange_hash . 'D' . $this->session_id));

    1297. 

  1297.             while ($decryptKeyLength > strlen($key)) {

    1298. 

  1298.                 $key.= pack('H*', $hash($keyBytes . $this->exchange_hash . $key));

    1299. 

  1299.             }

    1300. 

  1300.             $this->decrypt->setKey(substr($key, 0, $decryptKeyLength));

    1301. 

  1301.         }

    1302. 

  1302. 

    1303. 

  1303.         /* The "arcfour128" algorithm is the RC4 cipher, as described in

    1304. 

  1304.            [SCHNEIER], using a 128-bit key.  The first 1536 bytes of keystream

    1305. 

  1305.            generated by the cipher MUST be discarded, and the first byte of the

    1306. 

  1306.            first encrypted packet MUST be encrypted using the 1537th byte of

    1307. 

  1307.            keystream.

    1308. 

  1308. 

    1309. 

  1309.            -- http://tools.ietf.org/html/rfc4345#section-4 */

    1310. 

  1310.         if ($encrypt == 'arcfour128' || $encrypt == 'arcfour256') {

    1311. 

  1311.             $this->encrypt->encrypt(str_repeat("\0", 1536));

    1312. 

  1312.         }

    1313. 

  1313.         if ($decrypt == 'arcfour128' || $decrypt == 'arcfour256') {

    1314. 

  1314.             $this->decrypt->decrypt(str_repeat("\0", 1536));

    1315. 

  1315.         }

    1316. 

  1316. 

    1317. 

  1317.         for ($i = 0; $i < count($mac_algorithms) && !in_array($mac_algorithms[$i], $this->mac_algorithms_client_to_server); $i++);

    1318. 

  1318.         if ($i == count($mac_algorithms)) {

    1319. 

  1319.             user_error('No compatible client to server message authentication algorithms found', E_USER_NOTICE);

    1320. 

  1320.             return $this->_disconnect(NET_SSH2_DISCONNECT_KEY_EXCHANGE_FAILED);

    1321. 

  1321.         }

    1322. 

  1322. 

    1323. 

  1323.         $createKeyLength = 0; // ie. $mac_algorithms[$i] == 'none'

    1324. 

  1324.         switch ($mac_algorithms[$i]) {

    1325. 

  1325.             case 'hmac-sha1':

    1326. 

  1326.                 $this->hmac_create = new Crypt_Hash('sha1');

    1327. 

  1327.                 $createKeyLength = 20;

    1328. 

  1328.                 break;

    1329. 

  1329.             case 'hmac-sha1-96':

    1330. 

  1330.                 $this->hmac_create = new Crypt_Hash('sha1-96');

    1331. 

  1331.                 $createKeyLength = 20;

    1332. 

  1332.                 break;

    1333. 

  1333.             case 'hmac-md5':

    1334. 

  1334.                 $this->hmac_create = new Crypt_Hash('md5');

    1335. 

  1335.                 $createKeyLength = 16;

    1336. 

  1336.                 break;

    1337. 

  1337.             case 'hmac-md5-96':

    1338. 

  1338.                 $this->hmac_create = new Crypt_Hash('md5-96');

    1339. 

  1339.                 $createKeyLength = 16;

    1340. 

  1340.         }

    1341. 

  1341. 

    1342. 

  1342.         for ($i = 0; $i < count($mac_algorithms) && !in_array($mac_algorithms[$i], $this->mac_algorithms_server_to_client); $i++);

    1343. 

  1343.         if ($i == count($mac_algorithms)) {

    1344. 

  1344.             user_error('No compatible server to client message authentication algorithms found', E_USER_NOTICE);

    1345. 

  1345.             return $this->_disconnect(NET_SSH2_DISCONNECT_KEY_EXCHANGE_FAILED);

    1346. 

  1346.         }

    1347. 

  1347. 

    1348. 

  1348.         $checkKeyLength = 0;

    1349. 

  1349.         $this->hmac_size = 0;

    1350. 

  1350.         switch ($mac_algorithms[$i]) {

    1351. 

  1351.             case 'hmac-sha1':

    1352. 

  1352.                 $this->hmac_check = new Crypt_Hash('sha1');

    1353. 

  1353.                 $checkKeyLength = 20;

    1354. 

  1354.                 $this->hmac_size = 20;

    1355. 

  1355.                 break;

    1356. 

  1356.             case 'hmac-sha1-96':

    1357. 

  1357.                 $this->hmac_check = new Crypt_Hash('sha1-96');

    1358. 

  1358.                 $checkKeyLength = 20;

    1359. 

  1359.                 $this->hmac_size = 12;

    1360. 

  1360.                 break;

    1361. 

  1361.             case 'hmac-md5':

    1362. 

  1362.                 $this->hmac_check = new Crypt_Hash('md5');

    1363. 

  1363.                 $checkKeyLength = 16;

    1364. 

  1364.                 $this->hmac_size = 16;

    1365. 

  1365.                 break;

    1366. 

  1366.             case 'hmac-md5-96':

    1367. 

  1367.                 $this->hmac_check = new Crypt_Hash('md5-96');

    1368. 

  1368.                 $checkKeyLength = 16;

    1369. 

  1369.                 $this->hmac_size = 12;

    1370. 

  1370.         }

    1371. 

  1371. 

    1372. 

  1372.         $key = pack('H*', $hash($keyBytes . $this->exchange_hash . 'E' . $this->session_id));

    1373. 

  1373.         while ($createKeyLength > strlen($key)) {

    1374. 

  1374.             $key.= pack('H*', $hash($keyBytes . $this->exchange_hash . $key));

    1375. 

  1375.         }

    1376. 

  1376.         $this->hmac_create->setKey(substr($key, 0, $createKeyLength));

    1377. 

  1377. 

    1378. 

  1378.         $key = pack('H*', $hash($keyBytes . $this->exchange_hash . 'F' . $this->session_id));

    1379. 

  1379.         while ($checkKeyLength > strlen($key)) {

    1380. 

  1380.             $key.= pack('H*', $hash($keyBytes . $this->exchange_hash . $key));

    1381. 

  1381.         }

    1382. 

  1382.         $this->hmac_check->setKey(substr($key, 0, $checkKeyLength));

    1383. 

  1383. 

    1384. 

  1384.         for ($i = 0; $i < count($compression_algorithms) && !in_array($compression_algorithms[$i], $this->compression_algorithms_server_to_client); $i++);

    1385. 

  1385.         if ($i == count($compression_algorithms)) {

    1386. 

  1386.             user_error('No compatible server to client compression algorithms found', E_USER_NOTICE);

    1387. 

  1387.             return $this->_disconnect(NET_SSH2_DISCONNECT_KEY_EXCHANGE_FAILED);

    1388. 

  1388.         }

    1389. 

  1389.         $this->decompress = $compression_algorithms[$i] == 'zlib';

    1390. 

  1390. 

    1391. 

  1391.         for ($i = 0; $i < count($compression_algorithms) && !in_array($compression_algorithms[$i], $this->compression_algorithms_client_to_server); $i++);

    1392. 

  1392.         if ($i == count($compression_algorithms)) {

    1393. 

  1393.             user_error('No compatible client to server compression algorithms found', E_USER_NOTICE);

    1394. 

  1394.             return $this->_disconnect(NET_SSH2_DISCONNECT_KEY_EXCHANGE_FAILED);

    1395. 

  1395.         }

    1396. 

  1396.         $this->compress = $compression_algorithms[$i] == 'zlib';

    1397. 

  1397. 

    1398. 

  1398.         return true;

    1399. 

  1399.     }

    1400. 

  1400. 

    1401. 

  1401.     /**

    1402. 

  1402.      * Login

    1403. 

  1403.      *

    1404. 

  1404.      * The $password parameter can be a plaintext password or a Crypt_RSA object.

    1405. 

  1405.      *

    1406. 

  1406.      * @param String $username

    1407. 

  1407.      * @param optional String $password

    1408. 

  1408.      * @return Boolean

    1409. 

  1409.      * @access public

    1410. 

  1410.      * @internal It might be worthwhile, at some point, to protect against {@link http://tools.ietf.org/html/rfc4251#section-9.3.9 traffic analysis}

    1411. 

  1411.      *           by sending dummy SSH_MSG_IGNORE messages.

    1412. 

  1412.      */

    1413. 

  1413.     function login($username, $password = '')

    1414. 

  1414.     {

    1415. 

  1415.         if (!($this->bitmap & NET_SSH2_MASK_CONSTRUCTOR)) {

    1416. 

  1416.             return false;

    1417. 

  1417.         }

    1418. 

  1418. 

    1419. 

  1419.         $packet = pack('CNa*',

    1420. 

  1420.             NET_SSH2_MSG_SERVICE_REQUEST, strlen('ssh-userauth'), 'ssh-userauth'

    1421. 

  1421.         );

    1422. 

  1422. 

    1423. 

  1423.         if (!$this->_send_binary_packet($packet)) {

    1424. 

  1424.             return false;

    1425. 

  1425.         }

    1426. 

  1426. 

    1427. 

  1427.         $response = $this->_get_binary_packet();

    1428. 

  1428.         if ($response === false) {

    1429. 

  1429.             user_error('Connection closed by server', E_USER_NOTICE);

    1430. 

  1430.             return false;

    1431. 

  1431.         }

    1432. 

  1432. 

    1433. 

  1433.         extract(unpack('Ctype', $this->_string_shift($response, 1)));

    1434. 

  1434. 

    1435. 

  1435.         if ($type != NET_SSH2_MSG_SERVICE_ACCEPT) {

    1436. 

  1436.             user_error('Expected SSH_MSG_SERVICE_ACCEPT', E_USER_NOTICE);

    1437. 

  1437.             return false;

    1438. 

  1438.         }

    1439. 

  1439. 

    1440. 

  1440.         // although PHP5's get_class() preserves the case, PHP4's does not

    1441. 

  1441.         if (is_object($password) && strtolower(get_class($password)) == 'crypt_rsa') {

    1442. 

  1442.             return $this->_privatekey_login($username, $password);

    1443. 

  1443.         }

    1444. 

  1444. 

    1445. 

  1445.         $packet = pack('CNa*Na*Na*CNa*',

    1446. 

  1446.             NET_SSH2_MSG_USERAUTH_REQUEST, strlen($username), $username, strlen('ssh-connection'), 'ssh-connection',

    1447. 

  1447.             strlen('password'), 'password', 0, strlen($password), $password

    1448. 

  1448.         );

    1449. 

  1449. 

    1450. 

  1450.         if (!$this->_send_binary_packet($packet)) {

    1451. 

  1451.             return false;

    1452. 

  1452.         }

    1453. 

  1453. 

    1454. 

  1454.         // remove the username and password from the last logged packet

    1455. 

  1455.         if (defined('NET_SSH2_LOGGING') && NET_SSH2_LOGGING == NET_SSH2_LOG_COMPLEX) {

    1456. 

  1456.             $packet = pack('CNa*Na*Na*CNa*',

    1457. 

  1457.                 NET_SSH2_MSG_USERAUTH_REQUEST, strlen('username'), 'username', strlen('ssh-connection'), 'ssh-connection',

    1458. 

  1458.                 strlen('password'), 'password', 0, strlen('password'), 'password'

    1459. 

  1459.             );

    1460. 

  1460.             $this->message_log[count($this->message_log) - 1] = $packet;

    1461. 

  1461.         }

    1462. 

  1462. 

    1463. 

  1463.         $response = $this->_get_binary_packet();

    1464. 

  1464.         if ($response === false) {

    1465. 

  1465.             user_error('Connection closed by server', E_USER_NOTICE);

    1466. 

  1466.             return false;

    1467. 

  1467.         }

    1468. 

  1468. 

    1469. 

  1469.         extract(unpack('Ctype', $this->_string_shift($response, 1)));

    1470. 

  1470. 

    1471. 

  1471.         switch ($type) {

    1472. 

  1472.             case NET_SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ: // in theory, the password can be changed

    1473. 

  1473.                 if (defined('NET_SSH2_LOGGING')) {

    1474. 

  1474.                     $this->message_number_log[count($this->message_number_log) - 1] = 'NET_SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ';

    1475. 

  1475.                 }

    1476. 

  1476.                 extract(unpack('Nlength', $this->_string_shift($response, 4)));

    1477. 

  1477.                 $this->errors[] = 'SSH_MSG_USERAUTH_PASSWD_CHANGEREQ: ' . utf8_decode($this->_string_shift($response, $length));

    1478. 

  1478.                 return $this->_disconnect(NET_SSH2_DISCONNECT_AUTH_CANCELLED_BY_USER);

    1479. 

  1479.             case NET_SSH2_MSG_USERAUTH_FAILURE:

    1480. 

  1480.                 // can we use keyboard-interactive authentication?  if not then either the login is bad or the server employees

    1481. 

  1481.                 // multi-factor authentication

    1482. 

  1482.                 extract(unpack('Nlength', $this->_string_shift($response, 4)));

    1483. 

  1483.                 $auth_methods = explode(',', $this->_string_shift($response, $length));

    1484. 

  1484.                 if (in_array('keyboard-interactive', $auth_methods)) {

    1485. 

  1485.                     if ($this->_keyboard_interactive_login($username, $password)) {

    1486. 

  1486.                         $this->bitmap |= NET_SSH2_MASK_LOGIN;

    1487. 

  1487.                         return true;

    1488. 

  1488.                     }

    1489. 

  1489.                     return false;

    1490. 

  1490.                 }

    1491. 

  1491.                 return false;

    1492. 

  1492.             case NET_SSH2_MSG_USERAUTH_SUCCESS:

    1493. 

  1493.                 $this->bitmap |= NET_SSH2_MASK_LOGIN;

    1494. 

  1494.                 return true;

    1495. 

  1495.         }

    1496. 

  1496. 

    1497. 

  1497.         return false;

    1498. 

  1498.     }

    1499. 

  1499. 

    1500. 

  1500.     /**

    1501. 

  1501.      * Login via keyboard-interactive authentication

    1502. 

  1502.      *

    1503. 

  1503.      * See {@link http://tools.ietf.org/html/rfc4256 RFC4256} for details.  This is not a full-featured keyboard-interactive authenticator.

    1504. 

  1504.      *

    1505. 

  1505.      * @param String $username

    1506. 

  1506.      * @param String $password

    1507. 

  1507.      * @return Boolean

    1508. 

  1508.      * @access private

    1509. 

  1509.      */

    1510. 

  1510.     function _keyboard_interactive_login($username, $password)

    1511. 

  1511.     {

    1512. 

  1512.         $packet = pack('CNa*Na*Na*Na*Na*', 

    1513. 

  1513.             NET_SSH2_MSG_USERAUTH_REQUEST, strlen($username), $username, strlen('ssh-connection'), 'ssh-connection',

    1514. 

  1514.             strlen('keyboard-interactive'), 'keyboard-interactive', 0, '', 0, ''

    1515. 

  1515.         );

    1516. 

  1516. 

    1517. 

  1517.         if (!$this->_send_binary_packet($packet)) {

    1518. 

  1518.             return false;

    1519. 

  1519.         }

    1520. 

  1520. 

    1521. 

  1521.         return $this->_keyboard_interactive_process($password);

    1522. 

  1522.     }

    1523. 

  1523. 

    1524. 

  1524.     /**

    1525. 

  1525.      * Handle the keyboard-interactive requests / responses.

    1526. 

  1526.      *

    1527. 

  1527.      * @param String $responses...

    1528. 

  1528.      * @return Boolean

    1529. 

  1529.      * @access private

    1530. 

  1530.      */

    1531. 

  1531.     function _keyboard_interactive_process()

    1532. 

  1532.     {

    1533. 

  1533.         $responses = func_get_args();

    1534. 

  1534. 

    1535. 

  1535.         $response = $this->_get_binary_packet();

    1536. 

  1536.         if ($response === false) {

    1537. 

  1537.             user_error('Connection closed by server', E_USER_NOTICE);

    1538. 

  1538.             return false;

    1539. 

  1539.         }

    1540. 

  1540. 

    1541. 

  1541.         extract(unpack('Ctype', $this->_string_shift($response, 1)));

    1542. 

  1542. 

    1543. 

  1543.         switch ($type) {

    1544. 

  1544.             case NET_SSH2_MSG_USERAUTH_INFO_REQUEST:

    1545. 

  1545.                 // see http://tools.ietf.org/html/rfc4256#section-3.2

    1546. 

  1546.                 if (defined('NET_SSH2_LOGGING')) {

    1547. 

  1547.                     $this->message_number_log[count($this->message_number_log) - 1] = str_replace(

    1548. 

  1548.                         'UNKNOWN',

    1549. 

  1549.                         'NET_SSH2_MSG_USERAUTH_INFO_REQUEST',

    1550. 

  1550.                         $this->message_number_log[count($this->message_number_log) - 1]

    1551. 

  1551.                     );

    1552. 

  1552.                 }

    1553. 

  1553. 

    1554. 

  1554.                 extract(unpack('Nlength', $this->_string_shift($response, 4)));

    1555. 

  1555.                 $this->_string_shift($response, $length); // name; may be empty

    1556. 

  1556.                 extract(unpack('Nlength', $this->_string_shift($response, 4)));

    1557. 

  1557.                 $this->_string_shift($response, $length); // instruction; may be empty

    1558. 

  1558.                 extract(unpack('Nlength', $this->_string_shift($response, 4)));

    1559. 

  1559.                 $this->_string_shift($response, $length); // language tag; may be empty

    1560. 

  1560.                 extract(unpack('Nnum_prompts', $this->_string_shift($response, 4)));

    1561. 

  1561.                 /*

    1562. 

  1562.                 for ($i = 0; $i < $num_prompts; $i++) {

    1563. 

  1563.                     extract(unpack('Nlength', $this->_string_shift($response, 4)));

    1564. 

  1564.                     // prompt - ie. "Password: "; must not be empty

    1565. 

  1565.                     $this->_string_shift($response, $length);

    1566. 

  1566.                     $echo = $this->_string_shift($response) != chr(0);

    1567. 

  1567.                 }

    1568. 

  1568.                 */

    1569. 

  1569. 

    1570. 

  1570.                 /*

    1571. 

  1571.                    After obtaining the requested information from the user, the client

    1572. 

  1572.                    MUST respond with an SSH_MSG_USERAUTH_INFO_RESPONSE message.

    1573. 

  1573.                 */

    1574. 

  1574.                 // see http://tools.ietf.org/html/rfc4256#section-3.4

    1575. 

  1575.                 $packet = $logged = pack('CN', NET_SSH2_MSG_USERAUTH_INFO_RESPONSE, count($responses));

    1576. 

  1576.                 for ($i = 0; $i < count($responses); $i++) {

    1577. 

  1577.                     $packet.= pack('Na*', strlen($responses[$i]), $responses[$i]);

    1578. 

  1578.                     $logged.= pack('Na*', strlen('dummy-answer'), 'dummy-answer');

    1579. 

  1579.                 }

    1580. 

  1580. 

    1581. 

  1581.                 if (!$this->_send_binary_packet($packet)) {

    1582. 

  1582.                     return false;

    1583. 

  1583.                 }

    1584. 

  1584. 

    1585. 

  1585.                 if (defined('NET_SSH2_LOGGING')) {

    1586. 

  1586.                     $this->message_number_log[count($this->message_number_log) - 1] = str_replace(

    1587. 

  1587.                         'UNKNOWN',

    1588. 

  1588.                         'NET_SSH2_MSG_USERAUTH_INFO_RESPONSE',

    1589. 

  1589.                         $this->message_number_log[count($this->message_number_log) - 1]

    1590. 

  1590.                     );

    1591. 

  1591.                     $this->message_log[count($this->message_log) - 1] = $logged;

    1592. 

  1592.                 }

    1593. 

  1593. 

    1594. 

  1594.                 /*

    1595. 

  1595.                    After receiving the response, the server MUST send either an

    1596. 

  1596.                    SSH_MSG_USERAUTH_SUCCESS, SSH_MSG_USERAUTH_FAILURE, or another

    1597. 

  1597.                    SSH_MSG_USERAUTH_INFO_REQUEST message.

    1598. 

  1598.                 */

    1599. 

  1599.                 // maybe phpseclib should force close the connection after x request / responses?  unless something like that is done

    1600. 

  1600.                 // there could be an infinite loop of request / responses.

    1601. 

  1601.                 return $this->_keyboard_interactive_process();

    1602. 

  1602.             case NET_SSH2_MSG_USERAUTH_SUCCESS:

    1603. 

  1603.                 return true;

    1604. 

  1604.             case NET_SSH2_MSG_USERAUTH_FAILURE:

    1605. 

  1605.                 return false;

    1606. 

  1606.         }

    1607. 

  1607. 

    1608. 

  1608.         return false;

    1609. 

  1609.     }

    1610. 

  1610. 

    1611. 

  1611.     /**

    1612. 

  1612.      * Login with an RSA private key

    1613. 

  1613.      *

    1614. 

  1614.      * @param String $username

    1615. 

  1615.      * @param Crypt_RSA $password

    1616. 

  1616.      * @return Boolean

    1617. 

  1617.      * @access private

    1618. 

  1618.      * @internal It might be worthwhile, at some point, to protect against {@link http://tools.ietf.org/html/rfc4251#section-9.3.9 traffic analysis}

    1619. 

  1619.      *           by sending dummy SSH_MSG_IGNORE messages.

    1620. 

  1620.      */

    1621. 

  1621.     function _privatekey_login($username, $privatekey)

    1622. 

  1622.     {

    1623. 

  1623.         // see http://tools.ietf.org/html/rfc4253#page-15

    1624. 

  1624.         $publickey = $privatekey->getPublicKey(CRYPT_RSA_PUBLIC_FORMAT_RAW);

    1625. 

  1625.         if ($publickey === false) {

    1626. 

  1626.             return false;

    1627. 

  1627.         }

    1628. 

  1628. 

    1629. 

  1629.         $publickey = array(

    1630. 

  1630.             'e' => $publickey['e']->toBytes(true),

    1631. 

  1631.             'n' => $publickey['n']->toBytes(true)

    1632. 

  1632.         );

    1633. 

  1633.         $publickey = pack('Na*Na*Na*',

    1634. 

  1634.             strlen('ssh-rsa'), 'ssh-rsa', strlen($publickey['e']), $publickey['e'], strlen($publickey['n']), $publickey['n']

    1635. 

  1635.         );

    1636. 

  1636. 

    1637. 

  1637.         $part1 = pack('CNa*Na*Na*',

    1638. 

  1638.             NET_SSH2_MSG_USERAUTH_REQUEST, strlen($username), $username, strlen('ssh-connection'), 'ssh-connection',

    1639. 

  1639.             strlen('publickey'), 'publickey'

    1640. 

  1640.         );

    1641. 

  1641.         $part2 = pack('Na*Na*', strlen('ssh-rsa'), 'ssh-rsa', strlen($publickey), $publickey);

    1642. 

  1642. 

    1643. 

  1643.         $packet = $part1 . chr(0) . $part2;

    1644. 

  1644.         if (!$this->_send_binary_packet($packet)) {

    1645. 

  1645.             return false;

    1646. 

  1646.         }

    1647. 

  1647. 

    1648. 

  1648.         $response = $this->_get_binary_packet();

    1649. 

  1649.         if ($response === false) {

    1650. 

  1650.             user_error('Connection closed by server', E_USER_NOTICE);

    1651. 

  1651.             return false;

    1652. 

  1652.         }

    1653. 

  1653. 

    1654. 

  1654.         extract(unpack('Ctype', $this->_string_shift($response, 1)));

    1655. 

  1655. 

    1656. 

  1656.         switch ($type) {

    1657. 

  1657.             case NET_SSH2_MSG_USERAUTH_FAILURE:

    1658. 

  1658.                 extract(unpack('Nlength', $this->_string_shift($response, 4)));

    1659. 

  1659.                 $this->errors[] = 'SSH_MSG_USERAUTH_FAILURE: ' . $this->_string_shift($response, $length);

    1660. 

  1660.                 return $this->_disconnect(NET_SSH2_DISCONNECT_AUTH_CANCELLED_BY_USER);

    1661. 

  1661.             case NET_SSH2_MSG_USERAUTH_PK_OK:

    1662. 

  1662.                 // we'll just take it on faith that the public key blob and the public key algorithm name are as

    1663. 

  1663.                 // they should be

    1664. 

  1664.                 if (defined('NET_SSH2_LOGGING')) {

    1665. 

  1665.                     $this->message_number_log[count($this->message_number_log) - 1] = str_replace(

    1666. 

  1666.                         'UNKNOWN',

    1667. 

  1667.                         'NET_SSH2_MSG_USERAUTH_PK_OK',

    1668. 

  1668.                         $this->message_number_log[count($this->message_number_log) - 1]

    1669. 

  1669.                     );

    1670. 

  1670.                 }

    1671. 

  1671.         }

    1672. 

  1672. 

    1673. 

  1673.         $packet = $part1 . chr(1) . $part2;

    1674. 

  1674.         $privatekey->setSignatureMode(CRYPT_RSA_SIGNATURE_PKCS1);

    1675. 

  1675.         $signature = $privatekey->sign(pack('Na*a*', strlen($this->session_id), $this->session_id, $packet));

    1676. 

  1676.         $signature = pack('Na*Na*', strlen('ssh-rsa'), 'ssh-rsa', strlen($signature), $signature);

    1677. 

  1677.         $packet.= pack('Na*', strlen($signature), $signature);

    1678. 

  1678. 

    1679. 

  1679.         if (!$this->_send_binary_packet($packet)) {

    1680. 

  1680.             return false;

    1681. 

  1681.         }

    1682. 

  1682. 

    1683. 

  1683.         $response = $this->_get_binary_packet();

    1684. 

  1684.         if ($response === false) {

    1685. 

  1685.             user_error('Connection closed by server', E_USER_NOTICE);

    1686. 

  1686.             return false;

    1687. 

  1687.         }

    1688. 

  1688. 

    1689. 

  1689.         extract(unpack('Ctype', $this->_string_shift($response, 1)));

    1690. 

  1690. 

    1691. 

  1691.         switch ($type) {

    1692. 

  1692.             case NET_SSH2_MSG_USERAUTH_FAILURE:

    1693. 

  1693.                 // either the login is bad or the server employees multi-factor authentication

    1694. 

  1694.                 return false;

    1695. 

  1695.             case NET_SSH2_MSG_USERAUTH_SUCCESS:

    1696. 

  1696.                 $this->bitmap |= NET_SSH2_MASK_LOGIN;

    1697. 

  1697.                 return true;

    1698. 

  1698.         }

    1699. 

  1699. 

    1700. 

  1700.         return false;

    1701. 

  1701.     }

    1702. 

  1702. 

    1703. 

  1703.     /**

    1704. 

  1704.      * Set Timeout

    1705. 

  1705.      *

    1706. 

  1706.      * $ssh->exec('ping 127.0.0.1'); on a Linux host will never return and will run indefinitely.  setTimeout() makes it so it'll timeout.

    1707. 

  1707.      * Setting $timeout to false or 0 will mean there is no timeout.

    1708. 

  1708.      *

    1709. 

  1709.      * @param Mixed $timeout

    1710. 

  1710.      */

    1711. 

  1711.     function setTimeout($timeout)

    1712. 

  1712.     {

    1713. 

  1713.         $this->timeout = $this->curTimeout = $timeout;

    1714. 

  1714.     }

    1715. 

  1715. 

    1716. 

  1716.     /**

    1717. 

  1717.      * Execute Command

    1718. 

  1718.      *

    1719. 

  1719.      * If $block is set to false then Net_SSH2::_get_channel_packet(NET_SSH2_CHANNEL_EXEC) will need to be called manually.

    1720. 

  1720.      * In all likelihood, this is not a feature you want to be taking advantage of.

    1721. 

  1721.      *

    1722. 

  1722.      * @param String $command

    1723. 

  1723.      * @param optional Boolean $block

    1724. 

  1724.      * @return String

    1725. 

  1725.      * @access public

    1726. 

  1726.      */

    1727. 

  1727.     function exec($command, $block = true)

    1728. 

  1728.     {

    1729. 

  1729.         $this->curTimeout = $this->timeout;

    1730. 

  1730. 

    1731. 

  1731.         if (!($this->bitmap & NET_SSH2_MASK_LOGIN)) {

    1732. 

  1732.             return false;

    1733. 

  1733.         }

    1734. 

  1734. 

    1735. 

  1735.         // RFC4254 defines the (client) window size as "bytes the other party can send before it must wait for the window to

    1736. 

  1736.         // be adjusted".  0x7FFFFFFF is, at 4GB, the max size.  technically, it should probably be decremented, but, 

    1737. 

  1737.         // honestly, if you're transfering more than 4GB, you probably shouldn't be using phpseclib, anyway.

    1738. 

  1738.         // see http://tools.ietf.org/html/rfc4254#section-5.2 for more info

    1739. 

  1739.         $this->window_size_client_to_server[NET_SSH2_CHANNEL_EXEC] = 0x7FFFFFFF;

    1740. 

  1740.         // 0x8000 is the maximum max packet size, per http://tools.ietf.org/html/rfc4253#section-6.1, although since PuTTy

    1741. 

  1741.         // uses 0x4000, that's what will be used here, as well.

    1742. 

  1742.         $packet_size = 0x4000;

    1743. 

  1743. 

    1744. 

  1744.         $packet = pack('CNa*N3',

    1745. 

  1745.             NET_SSH2_MSG_CHANNEL_OPEN, strlen('session'), 'session', NET_SSH2_CHANNEL_EXEC, $this->window_size_client_to_server[NET_SSH2_CHANNEL_EXEC], $packet_size);

    1746. 

  1746. 

    1747. 

  1747.         if (!$this->_send_binary_packet($packet)) {

    1748. 

  1748.             return false;

    1749. 

  1749.         }

    1750. 

  1750. 

    1751. 

  1751.         $this->channel_status[NET_SSH2_CHANNEL_EXEC] = NET_SSH2_MSG_CHANNEL_OPEN;

    1752. 

  1752. 

    1753. 

  1753.         $response = $this->_get_channel_packet(NET_SSH2_CHANNEL_EXEC);

    1754. 

  1754.         if ($response === false) {

    1755. 

  1755.             return false;

    1756. 

  1756.         }

    1757. 

  1757. 

    1758. 

  1758.         // sending a pty-req SSH_MSG_CHANNEL_REQUEST message is unnecessary and, in fact, in most cases, slows things

    1759. 

  1759.         // down.  the one place where it might be desirable is if you're doing something like Net_SSH2::exec('ping localhost &').

    1760. 

  1760.         // with a pty-req SSH_MSG_CHANNEL_REQUEST, exec() will return immediately and the ping process will then

    1761. 

  1761.         // then immediately terminate.  without such a request exec() will loop indefinitely.  the ping process won't end but

    1762. 

  1762.         // neither will your script.

    1763. 

  1763. 

    1764. 

  1764.         // although, in theory, the size of SSH_MSG_CHANNEL_REQUEST could exceed the maximum packet size established by

    1765. 

  1765.         // SSH_MSG_CHANNEL_OPEN_CONFIRMATION, RFC4254#section-5.1 states that the "maximum packet size" refers to the 

    1766. 

  1766.         // "maximum size of an individual data packet". ie. SSH_MSG_CHANNEL_DATA.  RFC4254#section-5.2 corroborates.

    1767. 

  1767.         $packet = pack('CNNa*CNa*',

    1768. 

  1768.             NET_SSH2_MSG_CHANNEL_REQUEST, $this->server_channels[NET_SSH2_CHANNEL_EXEC], strlen('exec'), 'exec', 1, strlen($command), $command);

    1769. 

  1769.         if (!$this->_send_binary_packet($packet)) {

    1770. 

  1770.             return false;

    1771. 

  1771.         }

    1772. 

  1772. 

    1773. 

  1773.         $this->channel_status[NET_SSH2_CHANNEL_EXEC] = NET_SSH2_MSG_CHANNEL_REQUEST;

    1774. 

  1774. 

    1775. 

  1775.         $response = $this->_get_channel_packet(NET_SSH2_CHANNEL_EXEC);

    1776. 

  1776.         if ($response === false) {

    1777. 

  1777.             return false;

    1778. 

  1778.         }

    1779. 

  1779. 

    1780. 

  1780.         $this->channel_status[NET_SSH2_CHANNEL_EXEC] = NET_SSH2_MSG_CHANNEL_DATA;

    1781. 

  1781. 

    1782. 

  1782.         if (!$block) {

    1783. 

  1783.             return true;

    1784. 

  1784.         }

    1785. 

  1785. 

    1786. 

  1786.         $output = '';

    1787. 

  1787.         while (true) {

    1788. 

  1788.             $temp = $this->_get_channel_packet(NET_SSH2_CHANNEL_EXEC);

    1789. 

  1789.             switch (true) {

    1790. 

  1790.                 case $temp === true:

    1791. 

  1791.                     return $output;

    1792. 

  1792.                 case $temp === false:

    1793. 

  1793.                     return false;

    1794. 

  1794.                 default:

    1795. 

  1795.                     $output.= $temp;

    1796. 

  1796.             }

    1797. 

  1797.         }

    1798. 

  1798.     }

    1799. 

  1799. 

    1800. 

  1800.     /**

    1801. 

  1801.      * Creates an interactive shell

    1802. 

  1802.      *

    1803. 

  1803.      * @see Net_SSH2::read()

    1804. 

  1804.      * @see Net_SSH2::write()

    1805. 

  1805.      * @return Boolean

    1806. 

  1806.      * @access private

    1807. 

  1807.      */

    1808. 

  1808.     function _initShell()

    1809. 

  1809.     {

    1810. 

  1810.         $this->window_size_client_to_server[NET_SSH2_CHANNEL_SHELL] = 0x7FFFFFFF;

    1811. 

  1811.         $packet_size = 0x4000;

    1812. 

  1812. 

    1813. 

  1813.         $packet = pack('CNa*N3',

    1814. 

  1814.             NET_SSH2_MSG_CHANNEL_OPEN, strlen('session'), 'session', NET_SSH2_CHANNEL_SHELL, $this->window_size_client_to_server[NET_SSH2_CHANNEL_SHELL], $packet_size);

    1815. 

  1815. 

    1816. 

  1816.         if (!$this->_send_binary_packet($packet)) {

    1817. 

  1817.             return false;

    1818. 

  1818.         }

    1819. 

  1819. 

    1820. 

  1820.         $this->channel_status[NET_SSH2_CHANNEL_SHELL] = NET_SSH2_MSG_CHANNEL_OPEN;

    1821. 

  1821. 

    1822. 

  1822.         $response = $this->_get_channel_packet(NET_SSH2_CHANNEL_SHELL);

    1823. 

  1823.         if ($response === false) {

    1824. 

  1824.             return false;

    1825. 

  1825.         }

    1826. 

  1826. 

    1827. 

  1827.         $terminal_modes = pack('C', NET_SSH2_TTY_OP_END);

    1828. 

  1828.         $packet = pack('CNNa*CNa*N5a*',

    1829. 

  1829.             NET_SSH2_MSG_CHANNEL_REQUEST, $this->server_channels[NET_SSH2_CHANNEL_SHELL], strlen('pty-req'), 'pty-req', 1, strlen('vt100'), 'vt100',

    1830. 

  1830.             80, 24, 0, 0, strlen($terminal_modes), $terminal_modes);

    1831. 

  1831. 

    1832. 

  1832.         if (!$this->_send_binary_packet($packet)) {

    1833. 

  1833.             return false;

    1834. 

  1834.         }

    1835. 

  1835. 

    1836. 

  1836.         $response = $this->_get_binary_packet();

    1837. 

  1837.         if ($response === false) {

    1838. 

  1838.             user_error('Connection closed by server', E_USER_NOTICE);

    1839. 

  1839.             return false;

    1840. 

  1840.         }

    1841. 

  1841. 

    1842. 

  1842.         list(, $type) = unpack('C', $this->_string_shift($response, 1));

    1843. 

  1843. 

    1844. 

  1844.         switch ($type) {

    1845. 

  1845.             case NET_SSH2_MSG_CHANNEL_SUCCESS:

    1846. 

  1846.                 break;

    1847. 

  1847.             case NET_SSH2_MSG_CHANNEL_FAILURE:

    1848. 

  1848.             default:

    1849. 

  1849.                 user_error('Unable to request pseudo-terminal', E_USER_NOTICE);

    1850. 

  1850.                 return $this->_disconnect(NET_SSH2_DISCONNECT_BY_APPLICATION);

    1851. 

  1851.         }

    1852. 

  1852. 

    1853. 

  1853.         $packet = pack('CNNa*C',

    1854. 

  1854.             NET_SSH2_MSG_CHANNEL_REQUEST, $this->server_channels[NET_SSH2_CHANNEL_SHELL], strlen('shell'), 'shell', 1);

    1855. 

  1855.         if (!$this->_send_binary_packet($packet)) {

    1856. 

  1856.             return false;

    1857. 

  1857.         }

    1858. 

  1858. 

    1859. 

  1859.         $this->channel_status[NET_SSH2_CHANNEL_SHELL] = NET_SSH2_MSG_CHANNEL_REQUEST;

    1860. 

  1860. 

    1861. 

  1861.         $response = $this->_get_channel_packet(NET_SSH2_CHANNEL_SHELL);

    1862. 

  1862.         if ($response === false) {

    1863. 

  1863.             return false;

    1864. 

  1864.         }

    1865. 

  1865. 

    1866. 

  1866.         $this->channel_status[NET_SSH2_CHANNEL_SHELL] = NET_SSH2_MSG_CHANNEL_DATA;

    1867. 

  1867. 

    1868. 

  1868.         $this->bitmap |= NET_SSH2_MASK_SHELL;

    1869. 

  1869. 

    1870. 

  1870.         return true;

    1871. 

  1871.     }

    1872. 

  1872. 

    1873. 

  1873.     /**

    1874. 

  1874.      * Returns the output of an interactive shell

    1875. 

  1875.      *

    1876. 

  1876.      * Returns when there's a match for $expect, which can take the form of a string literal or,

    1877. 

  1877.      * if $mode == NET_SSH2_READ_REGEX, a regular expression.

    1878. 

  1878.      *

    1879. 

  1879.      * @see Net_SSH2::read()

    1880. 

  1880.      * @param String $expect

    1881. 

  1881.      * @param Integer $mode

    1882. 

  1882.      * @return String

    1883. 

  1883.      * @access public

    1884. 

  1884.      */

    1885. 

  1885.     function read($expect = '', $mode = NET_SSH2_READ_SIMPLE)

    1886. 

  1886.     {

    1887. 

  1887.         $this->curTimeout = $this->timeout;

    1888. 

  1888. 

    1889. 

  1889.         if (!($this->bitmap & NET_SSH2_MASK_LOGIN)) {

    1890. 

  1890.             user_error('Operation disallowed prior to login()', E_USER_NOTICE);

    1891. 

  1891.             return false;

    1892. 

  1892.         }

    1893. 

  1893. 

    1894. 

  1894.         if (!($this->bitmap & NET_SSH2_MASK_SHELL) && !$this->_initShell()) {

    1895. 

  1895.             user_error('Unable to initiate an interactive shell session', E_USER_NOTICE);

    1896. 

  1896.             return false;

    1897. 

  1897.         }

    1898. 

  1898. 

    1899. 

  1899.         $match = $expect;

    1900. 

  1900.         while (true) {

    1901. 

  1901.             if ($mode == NET_SSH2_READ_REGEX) {

    1902. 

  1902.                 preg_match($expect, $this->interactiveBuffer, $matches);

    1903. 

  1903.                 $match = $matches[0];

    1904. 

  1904.             }

    1905. 

  1905.             $pos = !empty($match) ? strpos($this->interactiveBuffer, $match) : false;

    1906. 

  1906.             if ($pos !== false) {

    1907. 

  1907.                 return $this->_string_shift($this->interactiveBuffer, $pos + strlen($match));

    1908. 

  1908.             }

    1909. 

  1909.             $response = $this->_get_channel_packet(NET_SSH2_CHANNEL_SHELL);

    1910. 

  1910.             if (is_bool($response)) {

    1911. 

  1911.                 return $response ? $this->_string_shift($this->interactiveBuffer, strlen($this->interactiveBuffer)) : false;

    1912. 

  1912.             }

    1913. 

  1913. 

    1914. 

  1914.             $this->interactiveBuffer.= $response;

    1915. 

  1915.         }

    1916. 

  1916.     }

    1917. 

  1917. 

    1918. 

  1918.     /**

    1919. 

  1919.      * Inputs a command into an interactive shell.

    1920. 

  1920.      *

    1921. 

  1921.      * @see Net_SSH1::interactiveWrite()

    1922. 

  1922.      * @param String $cmd

    1923. 

  1923.      * @return Boolean

    1924. 

  1924.      * @access public

    1925. 

  1925.      */

    1926. 

  1926.     function write($cmd)

    1927. 

  1927.     {

    1928. 

  1928.         if (!($this->bitmap & NET_SSH2_MASK_LOGIN)) {

    1929. 

  1929.             user_error('Operation disallowed prior to login()', E_USER_NOTICE);

    1930. 

  1930.             return false;

    1931. 

  1931.         }

    1932. 

  1932. 

    1933. 

  1933.         if (!($this->bitmap & NET_SSH2_MASK_SHELL) && !$this->_initShell()) {

    1934. 

  1934.             user_error('Unable to initiate an interactive shell session', E_USER_NOTICE);

    1935. 

  1935.             return false;

    1936. 

  1936.         }

    1937. 

  1937. 

    1938. 

  1938.         return $this->_send_channel_packet(NET_SSH2_CHANNEL_SHELL, $cmd);

    1939. 

  1939.     }

    1940. 

  1940. 

    1941. 

  1941.     /**

    1942. 

  1942.      * Disconnect

    1943. 

  1943.      *

    1944. 

  1944.      * @access public

    1945. 

  1945.      */

    1946. 

  1946.     function disconnect()

    1947. 

  1947.     {

    1948. 

  1948.         $this->_disconnect(NET_SSH2_DISCONNECT_BY_APPLICATION);

    1949. 

  1949.         if (isset($this->realtime_log_file) && is_resource($this->realtime_log_file)) {

    1950. 

  1950.             fclose($this->realtime_log_file);

    1951. 

  1951.         }

    1952. 

  1952.     }

    1953. 

  1953. 

    1954. 

  1954.     /**

    1955. 

  1955.      * Destructor.

    1956. 

  1956.      *

    1957. 

  1957.      * Will be called, automatically, if you're supporting just PHP5.  If you're supporting PHP4, you'll need to call

    1958. 

  1958.      * disconnect().

    1959. 

  1959.      *

    1960. 

  1960.      * @access public

    1961. 

  1961.      */

    1962. 

  1962.     function __destruct()

    1963. 

  1963.     {

    1964. 

  1964.         $this->disconnect();

    1965. 

  1965.     }

    1966. 

  1966. 

    1967. 

  1967.     /**

    1968. 

  1968.      * Gets Binary Packets

    1969. 

  1969.      *

    1970. 

  1970.      * See '6. Binary Packet Protocol' of rfc4253 for more info.

    1971. 

  1971.      *

    1972. 

  1972.      * @see Net_SSH2::_send_binary_packet()

    1973. 

  1973.      * @return String

    1974. 

  1974.      * @access private

    1975. 

  1975.      */

    1976. 

  1976.     function _get_binary_packet()

    1977. 

  1977.     {

    1978. 

  1978.         if (!is_resource($this->fsock) || feof($this->fsock)) {

    1979. 

  1979.             user_error('Connection closed prematurely', E_USER_NOTICE);

    1980. 

  1980.             return false;

    1981. 

  1981.         }

    1982. 

  1982. 

    1983. 

  1983.         $start = strtok(microtime(), ' ') + strtok(''); // http://php.net/microtime#61838

    1984. 

  1984.         $raw = fread($this->fsock, $this->decrypt_block_size);

    1985. 

  1985.         $stop = strtok(microtime(), ' ') + strtok('');

    1986. 

  1986. 

    1987. 

  1987.         if (empty($raw)) {

    1988. 

  1988.             return '';

    1989. 

  1989.         }

    1990. 

  1990. 

    1991. 

  1991.         if ($this->decrypt !== false) {

    1992. 

  1992.             $raw = $this->decrypt->decrypt($raw);

    1993. 

  1993.         }

    1994. 

  1994.         if ($raw === false) {

    1995. 

  1995.             user_error('Unable to decrypt content', E_USER_NOTICE);

    1996. 

  1996.             return false;

    1997. 

  1997.         }

    1998. 

  1998. 

    1999. 

  1999.         extract(unpack('Npacket_length/Cpadding_length', $this->_string_shift($raw, 5)));

    2000. 

  2000. 

    2001. 

  2001.         $remaining_length = $packet_length + 4 - $this->decrypt_block_size;

    2002. 

  2002.         $buffer = '';

    2003. 

  2003.         while ($remaining_length > 0) {

    2004. 

  2004.             $temp = fread($this->fsock, $remaining_length);

    2005. 

  2005.             $buffer.= $temp;

    2006. 

  2006.             $remaining_length-= strlen($temp);

    2007. 

  2007.         }

    2008. 

  2008.         if (!empty($buffer)) {

    2009. 

  2009.             $raw.= $this->decrypt !== false ? $this->decrypt->decrypt($buffer) : $buffer;

    2010. 

  2010.             $buffer = $temp = '';

    2011. 

  2011.         }

    2012. 

  2012. 

    2013. 

  2013.         $payload = $this->_string_shift($raw, $packet_length - $padding_length - 1);

    2014. 

  2014.         $padding = $this->_string_shift($raw, $padding_length); // should leave $raw empty

    2015. 

  2015. 

    2016. 

  2016.         if ($this->hmac_check !== false) {

    2017. 

  2017.             $hmac = fread($this->fsock, $this->hmac_size);

    2018. 

  2018.             if ($hmac != $this->hmac_check->hash(pack('NNCa*', $this->get_seq_no, $packet_length, $padding_length, $payload . $padding))) {

    2019. 

  2019.                 user_error('Invalid HMAC', E_USER_NOTICE);

    2020. 

  2020.                 return false;

    2021. 

  2021.             }

    2022. 

  2022.         }

    2023. 

  2023. 

    2024. 

  2024.         //if ($this->decompress) {

    2025. 

  2025.         //    $payload = gzinflate(substr($payload, 2));

    2026. 

  2026.         //}

    2027. 

  2027. 

    2028. 

  2028.         $this->get_seq_no++;

    2029. 

  2029. 

    2030. 

  2030.         if (defined('NET_SSH2_LOGGING')) {

    2031. 

  2031.             $message_number = isset($this->message_numbers[ord($payload[0])]) ? $this->message_numbers[ord($payload[0])] : 'UNKNOWN (' . ord($payload[0]) . ')';

    2032. 

  2032.             $message_number = '<- ' . $message_number .

    2033. 

  2033.                               ' (' . round($stop - $start, 4) . 's)';

    2034. 

  2034.             $this->_append_log($message_number, $payload);

    2035. 

  2035.         }

    2036. 

  2036. 

    2037. 

  2037.         return $this->_filter($payload);

    2038. 

  2038.     }

    2039. 

  2039. 

    2040. 

  2040.     /**

    2041. 

  2041.      * Filter Binary Packets

    2042. 

  2042.      *

    2043. 

  2043.      * Because some binary packets need to be ignored...

    2044. 

  2044.      *

    2045. 

  2045.      * @see Net_SSH2::_get_binary_packet()

    2046. 

  2046.      * @return String

    2047. 

  2047.      * @access private

    2048. 

  2048.      */

    2049. 

  2049.     function _filter($payload)

    2050. 

  2050.     {

    2051. 

  2051.         switch (ord($payload[0])) {

    2052. 

  2052.             case NET_SSH2_MSG_DISCONNECT:

    2053. 

  2053.                 $this->_string_shift($payload, 1);

    2054. 

  2054.                 extract(unpack('Nreason_code/Nlength', $this->_string_shift($payload, 8)));

    2055. 

  2055.                 $this->errors[] = 'SSH_MSG_DISCONNECT: ' . $this->disconnect_reasons[$reason_code] . "\r\n" . utf8_decode($this->_string_shift($payload, $length));

    2056. 

  2056.                 $this->bitmask = 0;

    2057. 

  2057.                 return false;

    2058. 

  2058.             case NET_SSH2_MSG_IGNORE:

    2059. 

  2059.                 $payload = $this->_get_binary_packet();

    2060. 

  2060.                 break;

    2061. 

  2061.             case NET_SSH2_MSG_DEBUG:

    2062. 

  2062.                 $this->_string_shift($payload, 2);

    2063. 

  2063.                 extract(unpack('Nlength', $this->_string_shift($payload, 4)));

    2064. 

  2064.                 $this->errors[] = 'SSH_MSG_DEBUG: ' . utf8_decode($this->_string_shift($payload, $length));

    2065. 

  2065.                 $payload = $this->_get_binary_packet();

    2066. 

  2066.                 break;

    2067. 

  2067.             case NET_SSH2_MSG_UNIMPLEMENTED:

    2068. 

  2068.                 return false;

    2069. 

  2069.             case NET_SSH2_MSG_KEXINIT:

    2070. 

  2070.                 if ($this->session_id !== false) {

    2071. 

  2071.                     if (!$this->_key_exchange($payload)) {

    2072. 

  2072.                         $this->bitmask = 0;

    2073. 

  2073.                         return false;

    2074. 

  2074.                     }

    2075. 

  2075.                     $payload = $this->_get_binary_packet();

    2076. 

  2076.                 }

    2077. 

  2077.         }

    2078. 

  2078. 

    2079. 

  2079.         // see http://tools.ietf.org/html/rfc4252#section-5.4; only called when the encryption has been activated and when we haven't already logged in

    2080. 

  2080.         if (($this->bitmap & NET_SSH2_MASK_CONSTRUCTOR) && !($this->bitmap & NET_SSH2_MASK_LOGIN) && ord($payload[0]) == NET_SSH2_MSG_USERAUTH_BANNER) {

    2081. 

  2081.             $this->_string_shift($payload, 1);

    2082. 

  2082.             extract(unpack('Nlength', $this->_string_shift($payload, 4)));

    2083. 

  2083.             $this->errors[] = 'SSH_MSG_USERAUTH_BANNER: ' . utf8_decode($this->_string_shift($payload, $length));

    2084. 

  2084.             $payload = $this->_get_binary_packet();

    2085. 

  2085.         }

    2086. 

  2086. 

    2087. 

  2087.         // only called when we've already logged in

    2088. 

  2088.         if (($this->bitmap & NET_SSH2_MASK_CONSTRUCTOR) && ($this->bitmap & NET_SSH2_MASK_LOGIN)) {

    2089. 

  2089.             switch (ord($payload[0])) {

    2090. 

  2090.                 case NET_SSH2_MSG_GLOBAL_REQUEST: // see http://tools.ietf.org/html/rfc4254#section-4

    2091. 

  2091.                     $this->_string_shift($payload, 1);

    2092. 

  2092.                     extract(unpack('Nlength', $this->_string_shift($payload)));

    2093. 

  2093.                     $this->errors[] = 'SSH_MSG_GLOBAL_REQUEST: ' . utf8_decode($this->_string_shift($payload, $length));

    2094. 

  2094. 

    2095. 

  2095.                     if (!$this->_send_binary_packet(pack('C', NET_SSH2_MSG_REQUEST_FAILURE))) {

    2096. 

  2096.                         return $this->_disconnect(NET_SSH2_DISCONNECT_BY_APPLICATION);

    2097. 

  2097.                     }

    2098. 

  2098. 

    2099. 

  2099.                     $payload = $this->_get_binary_packet();

    2100. 

  2100.                     break;

    2101. 

  2101.                 case NET_SSH2_MSG_CHANNEL_OPEN: // see http://tools.ietf.org/html/rfc4254#section-5.1

    2102. 

  2102.                     $this->_string_shift($payload, 1);

    2103. 

  2103.                     extract(unpack('N', $this->_string_shift($payload, 4)));

    2104. 

  2104.                     $this->errors[] = 'SSH_MSG_CHANNEL_OPEN: ' . utf8_decode($this->_string_shift($payload, $length));

    2105. 

  2105. 

    2106. 

  2106.                     $this->_string_shift($payload, 4); // skip over client channel

    2107. 

  2107.                     extract(unpack('Nserver_channel', $this->_string_shift($payload, 4)));

    2108. 

  2108. 

    2109. 

  2109.                     $packet = pack('CN3a*Na*',

    2110. 

  2110.                         NET_SSH2_MSG_REQUEST_FAILURE, $server_channel, NET_SSH2_OPEN_ADMINISTRATIVELY_PROHIBITED, 0, '', 0, '');

    2111. 

  2111. 

    2112. 

  2112.                     if (!$this->_send_binary_packet($packet)) {

    2113. 

  2113.                         return $this->_disconnect(NET_SSH2_DISCONNECT_BY_APPLICATION);

    2114. 

  2114.                     }

    2115. 

  2115. 

    2116. 

  2116.                     $payload = $this->_get_binary_packet();

    2117. 

  2117.                     break;

    2118. 

  2118.                 case NET_SSH2_MSG_CHANNEL_WINDOW_ADJUST:

    2119. 

  2119.                     $payload = $this->_get_binary_packet();

    2120. 

  2120.             }

    2121. 

  2121.         }

    2122. 

  2122. 

    2123. 

  2123.         return $payload;

    2124. 

  2124.     }

    2125. 

  2125. 

    2126. 

  2126.     /**

    2127. 

  2127.      * Gets channel data

    2128. 

  2128.      *

    2129. 

  2129.      * Returns the data as a string if it's available and false if not.

    2130. 

  2130.      *

    2131. 

  2131.      * @param $client_channel

    2132. 

  2132.      * @return Mixed

    2133. 

  2133.      * @access private

    2134. 

  2134.      */

    2135. 

  2135.     function _get_channel_packet($client_channel, $skip_extended = false)

    2136. 

  2136.     {

    2137. 

  2137.         if (!empty($this->channel_buffers[$client_channel])) {

    2138. 

  2138.             return array_shift($this->channel_buffers[$client_channel]);

    2139. 

  2139.         }

    2140. 

  2140. 

    2141. 

  2141.         while (true) {

    2142. 

  2142.             if ($this->curTimeout) {

    2143. 

  2143.                 $read = array($this->fsock);

    2144. 

  2144.                 $write = $except = NULL;

    2145. 

  2145. 

    2146. 

  2146.                 stream_set_blocking($this->fsock, false);

    2147. 

  2147. 

    2148. 

  2148.                 $start = strtok(microtime(), ' ') + strtok(''); // http://php.net/microtime#61838

    2149. 

  2149.                 // on windows this returns a "Warning: Invalid CRT parameters detected" error

    2150. 

  2150.                 if (!@stream_select($read, $write, $except, $this->curTimeout)) {

    2151. 

  2151.                     stream_set_blocking($this->fsock, true);

    2152. 

  2152.                     $this->_close_channel($client_channel);

    2153. 

  2153.                     return true;

    2154. 

  2154.                 }

    2155. 

  2155.                 $elapsed = strtok(microtime(), ' ') + strtok('') - $start;

    2156. 

  2156.                 $this->curTimeout-= $elapsed;

    2157. 

  2157. 

    2158. 

  2158.                 stream_set_blocking($this->fsock, true);

    2159. 

  2159.             }

    2160. 

  2160. 

    2161. 

  2161.             $response = $this->_get_binary_packet();

    2162. 

  2162.             if ($response === false) {

    2163. 

  2163.                 user_error('Connection closed by server', E_USER_NOTICE);

    2164. 

  2164.                 return false;

    2165. 

  2165.             }

    2166. 

  2166. 

    2167. 

  2167.             if (empty($response)) {

    2168. 

  2168.                 return '';

    2169. 

  2169.             }

    2170. 

  2170. 

    2171. 

  2171.             extract(unpack('Ctype/Nchannel', $this->_string_shift($response, 5)));

    2172. 

  2172. 

    2173. 

  2173.             switch ($this->channel_status[$channel]) {

    2174. 

  2174.                 case NET_SSH2_MSG_CHANNEL_OPEN:

    2175. 

  2175.                     switch ($type) {

    2176. 

  2176.                         case NET_SSH2_MSG_CHANNEL_OPEN_CONFIRMATION:

    2177. 

  2177.                             extract(unpack('Nserver_channel', $this->_string_shift($response, 4)));

    2178. 

  2178.                             $this->server_channels[$channel] = $server_channel;

    2179. 

  2179.                             $this->_string_shift($response, 4); // skip over (server) window size

    2180. 

  2180.                             $temp = unpack('Npacket_size_client_to_server', $this->_string_shift($response, 4));

    2181. 

  2181.                             $this->packet_size_client_to_server[$channel] = $temp['packet_size_client_to_server'];

    2182. 

  2182.                             return $client_channel == $channel ? true : $this->_get_channel_packet($client_channel, $skip_extended);

    2183. 

  2183.                         //case NET_SSH2_MSG_CHANNEL_OPEN_FAILURE:

    2184. 

  2184.                         default:

    2185. 

  2185.                             user_error('Unable to open channel', E_USER_NOTICE);

    2186. 

  2186.                             return $this->_disconnect(NET_SSH2_DISCONNECT_BY_APPLICATION);

    2187. 

  2187.                     }

    2188. 

  2188.                     break;

    2189. 

  2189.                 case NET_SSH2_MSG_CHANNEL_REQUEST:

    2190. 

  2190.                     switch ($type) {

    2191. 

  2191.                         case NET_SSH2_MSG_CHANNEL_SUCCESS:

    2192. 

  2192.                             return true;

    2193. 

  2193.                         //case NET_SSH2_MSG_CHANNEL_FAILURE:

    2194. 

  2194.                         default:

    2195. 

  2195.                             user_error('Unable to request pseudo-terminal', E_USER_NOTICE);

    2196. 

  2196.                             return $this->_disconnect(NET_SSH2_DISCONNECT_BY_APPLICATION);

    2197. 

  2197.                     }

    2198. 

  2198.                 case NET_SSH2_MSG_CHANNEL_CLOSE:

    2199. 

  2199.                     return $type == NET_SSH2_MSG_CHANNEL_CLOSE ? true : $this->_get_channel_packet($client_channel, $skip_extended);

    2200. 

  2200.             }

    2201. 

  2201. 

    2202. 

  2202.             switch ($type) {

    2203. 

  2203.                 case NET_SSH2_MSG_CHANNEL_DATA:

    2204. 

  2204.                     /*

    2205. 

  2205.                     if ($client_channel == NET_SSH2_CHANNEL_EXEC) {

    2206. 

  2206.                         // SCP requires null packets, such as this, be sent.  further, in the case of the ssh.com SSH server

    2207. 

  2207.                         // this actually seems to make things twice as fast.  more to the point, the message right after 

    2208. 

  2208.                         // SSH_MSG_CHANNEL_DATA (usually SSH_MSG_IGNORE) won't block for as long as it would have otherwise.

    2209. 

  2209.                         // in OpenSSH it slows things down but only by a couple thousandths of a second.

    2210. 

  2210.                         $this->_send_channel_packet($client_channel, chr(0));

    2211. 

  2211.                     }

    2212. 

  2212.                     */

    2213. 

  2213.                     extract(unpack('Nlength', $this->_string_shift($response, 4)));

    2214. 

  2214.                     $data = $this->_string_shift($response, $length);

    2215. 

  2215.                     if ($client_channel == $channel) {

    2216. 

  2216.                         return $data;

    2217. 

  2217.                     }

    2218. 

  2218.                     if (!isset($this->channel_buffers[$client_channel])) {

    2219. 

  2219.                         $this->channel_buffers[$client_channel] = array();

    2220. 

  2220.                     }

    2221. 

  2221.                     $this->channel_buffers[$client_channel][] = $data;

    2222. 

  2222.                     break;

    2223. 

  2223.                 case NET_SSH2_MSG_CHANNEL_EXTENDED_DATA:

    2224. 

  2224.                     if ($skip_extended) {

    2225. 

  2225.                         break;

    2226. 

  2226.                     }

    2227. 

  2227.                     /*

    2228. 

  2228.                     if ($client_channel == NET_SSH2_CHANNEL_EXEC) {

    2229. 

  2229.                         $this->_send_channel_packet($client_channel, chr(0));

    2230. 

  2230.                     }

    2231. 

  2231.                     */

    2232. 

  2232.                     // currently, there's only one possible value for $data_type_code: NET_SSH2_EXTENDED_DATA_STDERR

    2233. 

  2233.                     extract(unpack('Ndata_type_code/Nlength', $this->_string_shift($response, 8)));

    2234. 

  2234.                     $data = $this->_string_shift($response, $length);

    2235. 

  2235.                     if ($client_channel == $channel) {

    2236. 

  2236.                         return $data;

    2237. 

  2237.                     }

    2238. 

  2238.                     if (!isset($this->channel_buffers[$client_channel])) {

    2239. 

  2239.                         $this->channel_buffers[$client_channel] = array();

    2240. 

  2240.                     }

    2241. 

  2241.                     $this->channel_buffers[$client_channel][] = $data;

    2242. 

  2242.                     break;

    2243. 

  2243.                 case NET_SSH2_MSG_CHANNEL_REQUEST:

    2244. 

  2244.                     extract(unpack('Nlength', $this->_string_shift($response, 4)));

    2245. 

  2245.                     $value = $this->_string_shift($response, $length);

    2246. 

  2246.                     switch ($value) {

    2247. 

  2247.                         case 'exit-signal':

    2248. 

  2248.                             $this->_string_shift($response, 1);

    2249. 

  2249.                             extract(unpack('Nlength', $this->_string_shift($response, 4)));

    2250. 

  2250.                             $this->errors[] = 'SSH_MSG_CHANNEL_REQUEST (exit-signal): ' . $this->_string_shift($response, $length);

    2251. 

  2251.                             $this->_string_shift($response, 1);

    2252. 

  2252.                             extract(unpack('Nlength', $this->_string_shift($response, 4)));

    2253. 

  2253.                             if ($length) {

    2254. 

  2254.                                 $this->errors[count($this->errors)].= "\r\n" . $this->_string_shift($response, $length);

    2255. 

  2255.                             }

    2256. 

  2256.                         case 'exit-status':

    2257. 

  2257.                             // "The channel needs to be closed with SSH_MSG_CHANNEL_CLOSE after this message."

    2258. 

  2258.                             // -- http://tools.ietf.org/html/rfc4254#section-6.10

    2259. 

  2259.                             $this->_send_binary_packet(pack('CN', NET_SSH2_MSG_CHANNEL_EOF, $this->server_channels[$client_channel]));

    2260. 

  2260.                             $this->_send_binary_packet(pack('CN', NET_SSH2_MSG_CHANNEL_CLOSE, $this->server_channels[$channel]));

    2261. 

  2261. 

    2262. 

  2262.                             $this->channel_status[$channel] = NET_SSH2_MSG_CHANNEL_EOF;

    2263. 

  2263.                         default:

    2264. 

  2264.                             // "Some systems may not implement signals, in which case they SHOULD ignore this message."

    2265. 

  2265.                             //  -- http://tools.ietf.org/html/rfc4254#section-6.9

    2266. 

  2266.                             break;

    2267. 

  2267.                     }

    2268. 

  2268.                     break;

    2269. 

  2269.                 case NET_SSH2_MSG_CHANNEL_CLOSE:

    2270. 

  2270.                     $this->curTimeout = 0;

    2271. 

  2271. 

    2272. 

  2272.                     if ($this->bitmap & NET_SSH2_MASK_SHELL) {

    2273. 

  2273.                         $this->bitmap&= ~NET_SSH2_MASK_SHELL;

    2274. 

  2274.                     }

    2275. 

  2275.                     if ($this->channel_status[$channel] != NET_SSH2_MSG_CHANNEL_EOF) {

    2276. 

  2276.                         $this->_send_binary_packet(pack('CN', NET_SSH2_MSG_CHANNEL_CLOSE, $this->server_channels[$channel]));

    2277. 

  2277.                     }

    2278. 

  2278. 

    2279. 

  2279.                     $this->channel_status[$channel] = NET_SSH2_MSG_CHANNEL_CLOSE;

    2280. 

  2280.                     return true;

    2281. 

  2281.                 case NET_SSH2_MSG_CHANNEL_EOF:

    2282. 

  2282.                     break;

    2283. 

  2283.                 default:

    2284. 

  2284.                     user_error('Error reading channel data', E_USER_NOTICE);

    2285. 

  2285.                     return $this->_disconnect(NET_SSH2_DISCONNECT_BY_APPLICATION);

    2286. 

  2286.             }

    2287. 

  2287.         }

    2288. 

  2288.     }

    2289. 

  2289. 

    2290. 

  2290.     /**

    2291. 

  2291.      * Sends Binary Packets

    2292. 

  2292.      *

    2293. 

  2293.      * See '6. Binary Packet Protocol' of rfc4253 for more info.

    2294. 

  2294.      *

    2295. 

  2295.      * @param String $data

    2296. 

  2296.      * @see Net_SSH2::_get_binary_packet()

    2297. 

  2297.      * @return Boolean

    2298. 

  2298.      * @access private

    2299. 

  2299.      */

    2300. 

  2300.     function _send_binary_packet($data)

    2301. 

  2301.     {

    2302. 

  2302.         if (!is_resource($this->fsock) || feof($this->fsock)) {

    2303. 

  2303.             user_error('Connection closed prematurely', E_USER_NOTICE);

    2304. 

  2304.             return false;

    2305. 

  2305.         }

    2306. 

  2306. 

    2307. 

  2307.         //if ($this->compress) {

    2308. 

  2308.         //    // the -4 removes the checksum:

    2309. 

  2309.         //    // http://php.net/function.gzcompress#57710

    2310. 

  2310.         //    $data = substr(gzcompress($data), 0, -4);

    2311. 

  2311.         //}

    2312. 

  2312. 

    2313. 

  2313.         // 4 (packet length) + 1 (padding length) + 4 (minimal padding amount) == 9

    2314. 

  2314.         $packet_length = strlen($data) + 9;

    2315. 

  2315.         // round up to the nearest $this->encrypt_block_size

    2316. 

  2316.         $packet_length+= (($this->encrypt_block_size - 1) * $packet_length) % $this->encrypt_block_size;

    2317. 

  2317.         // subtracting strlen($data) is obvious - subtracting 5 is necessary because of packet_length and padding_length

    2318. 

  2318.         $padding_length = $packet_length - strlen($data) - 5;

    2319. 

  2319. 

    2320. 

  2320.         $padding = '';

    2321. 

  2321.         for ($i = 0; $i < $padding_length; $i++) {

    2322. 

  2322.             $padding.= chr(crypt_random(0, 255));

    2323. 

  2323.         }

    2324. 

  2324. 

    2325. 

  2325.         // we subtract 4 from packet_length because the packet_length field isn't supposed to include itself

    2326. 

  2326.         $packet = pack('NCa*', $packet_length - 4, $padding_length, $data . $padding);

    2327. 

  2327. 

    2328. 

  2328.         $hmac = $this->hmac_create !== false ? $this->hmac_create->hash(pack('Na*', $this->send_seq_no, $packet)) : '';

    2329. 

  2329.         $this->send_seq_no++;

    2330. 

  2330. 

    2331. 

  2331.         if ($this->encrypt !== false) {

    2332. 

  2332.             $packet = $this->encrypt->encrypt($packet);

    2333. 

  2333.         }

    2334. 

  2334. 

    2335. 

  2335.         $packet.= $hmac;

    2336. 

  2336. 

    2337. 

  2337.         $start = strtok(microtime(), ' ') + strtok(''); // http://php.net/microtime#61838

    2338. 

  2338.         $result = strlen($packet) == fputs($this->fsock, $packet);

    2339. 

  2339.         $stop = strtok(microtime(), ' ') + strtok('');

    2340. 

  2340. 

    2341. 

  2341.         if (defined('NET_SSH2_LOGGING')) {

    2342. 

  2342.             $message_number = isset($this->message_numbers[ord($data[0])]) ? $this->message_numbers[ord($data[0])] : 'UNKNOWN (' . ord($data[0]) . ')';

    2343. 

  2343.             $message_number = '-> ' . $message_number .

    2344. 

  2344.                               ' (' . round($stop - $start, 4) . 's)';

    2345. 

  2345.             $this->_append_log($message_number, $data);

    2346. 

  2346.         }

    2347. 

  2347. 

    2348. 

  2348.         return $result;

    2349. 

  2349.     }

    2350. 

  2350. 

    2351. 

  2351.     /**

    2352. 

  2352.      * Logs data packets

    2353. 

  2353.      *

    2354. 

  2354.      * Makes sure that only the last 1MB worth of packets will be logged

    2355. 

  2355.      *

    2356. 

  2356.      * @param String $data

    2357. 

  2357.      * @access private

    2358. 

  2358.      */

    2359. 

  2359.     function _append_log($message_number, $message)

    2360. 

  2360.     {

    2361. 

  2361.             switch (NET_SSH2_LOGGING) {

    2362. 

  2362.                 // useful for benchmarks

    2363. 

  2363.                 case NET_SSH2_LOG_SIMPLE:

    2364. 

  2364.                     $this->message_number_log[] = $message_number;

    2365. 

  2365.                     break;

    2366. 

  2366.                 // the most useful log for SSH2

    2367. 

  2367.                 case NET_SSH2_LOG_COMPLEX:

    2368. 

  2368.                     $this->message_number_log[] = $message_number;

    2369. 

  2369.                     $this->_string_shift($message);

    2370. 

  2370.                     $this->log_size+= strlen($message);

    2371. 

  2371.                     $this->message_log[] = $message;

    2372. 

  2372.                     while ($this->log_size > NET_SSH2_LOG_MAX_SIZE) {

    2373. 

  2373.                         $this->log_size-= strlen(array_shift($this->message_log));

    2374. 

  2374.                         array_shift($this->message_number_log);

    2375. 

  2375.                     }

    2376. 

  2376.                     break;

    2377. 

  2377.                 // dump the output out realtime; packets may be interspersed with non packets,

    2378. 

  2378.                 // passwords won't be filtered out and select other packets may not be correctly

    2379. 

  2379.                 // identified

    2380. 

  2380.                 case NET_SSH2_LOG_REALTIME:

    2381. 

  2381.                     echo "<pre>\r\n" . $this->_format_log(array($message), array($message_number)) . "\r\n</pre>\r\n";

    2382. 

  2382.                     flush();

    2383. 

  2383.                     ob_flush();

    2384. 

  2384.                     break;

    2385. 

  2385.                 // basically the same thing as NET_SSH2_LOG_REALTIME with the caveat that NET_SSH2_LOG_REALTIME_FILE

    2386. 

  2386.                 // needs to be defined and that the resultant log file will be capped out at NET_SSH2_LOG_MAX_SIZE. 

    2387. 

  2387.                 // the earliest part of the log file is denoted by the first <<< START >>> and is not going to necessarily

    2388. 

  2388.                 // at the beginning of the file

    2389. 

  2389.                 case NET_SSH2_LOG_REALTIME_FILE:

    2390. 

  2390.                     if (!isset($this->realtime_log_file)) {

    2391. 

  2391.                         // PHP doesn't seem to like using constants in fopen()

    2392. 

  2392.                         $filename = NET_SSH2_LOG_REALTIME_FILE;

    2393. 

  2393.                         $fp = fopen($filename, 'w');

    2394. 

  2394.                         $this->realtime_log_file = $fp;

    2395. 

  2395.                     }

    2396. 

  2396.                     if (!is_resource($this->realtime_log_file)) {

    2397. 

  2397.                         break;

    2398. 

  2398.                     }

    2399. 

  2399.                     $entry = $this->_format_log(array($message), array($message_number));

    2400. 

  2400.                     if ($this->realtime_log_wrap) {

    2401. 

  2401.                         $temp = "<<< START >>>\r\n";

    2402. 

  2402.                         $entry.= $temp;

    2403. 

  2403.                         fseek($this->realtime_log_file, ftell($this->realtime_log_file) - strlen($temp));

    2404. 

  2404.                     }

    2405. 

  2405.                     $this->realtime_log_size+= strlen($entry);

    2406. 

  2406.                     if ($this->realtime_log_size > NET_SSH2_LOG_MAX_SIZE) {

    2407. 

  2407.                         fseek($this->realtime_log_file, 0);

    2408. 

  2408.                         $this->realtime_log_size = strlen($entry);

    2409. 

  2409.                         $this->realtime_log_wrap = true;

    2410. 

  2410.                     }

    2411. 

  2411.                     fputs($this->realtime_log_file, $entry);

    2412. 

  2412.             }

    2413. 

  2413.     }

    2414. 

  2414. 

    2415. 

  2415.     /**

    2416. 

  2416.      * Sends channel data

    2417. 

  2417.      *

    2418. 

  2418.      * Spans multiple SSH_MSG_CHANNEL_DATAs if appropriate

    2419. 

  2419.      *

    2420. 

  2420.      * @param Integer $client_channel

    2421. 

  2421.      * @param String $data

    2422. 

  2422.      * @return Boolean

    2423. 

  2423.      * @access private

    2424. 

  2424.      */

    2425. 

  2425.     function _send_channel_packet($client_channel, $data)

    2426. 

  2426.     {

    2427. 

  2427.         while (strlen($data) > $this->packet_size_client_to_server[$client_channel]) {

    2428. 

  2428.             // resize the window, if appropriate

    2429. 

  2429.             $this->window_size_client_to_server[$client_channel]-= $this->packet_size_client_to_server[$client_channel];

    2430. 

  2430.             if ($this->window_size_client_to_server[$client_channel] < 0) {

    2431. 

  2431.                 $packet = pack('CNN', NET_SSH2_MSG_CHANNEL_WINDOW_ADJUST, $this->server_channels[$client_channel], $this->window_size);

    2432. 

  2432.                 if (!$this->_send_binary_packet($packet)) {

    2433. 

  2433.                     return false;

    2434. 

  2434.                 }

    2435. 

  2435.                 $this->window_size_client_to_server[$client_channel]+= $this->window_size;

    2436. 

  2436.             }

    2437. 

  2437. 

    2438. 

  2438.             $packet = pack('CN2a*',

    2439. 

  2439.                 NET_SSH2_MSG_CHANNEL_DATA,

    2440. 

  2440.                 $this->server_channels[$client_channel],

    2441. 

  2441.                 $this->packet_size_client_to_server[$client_channel],

    2442. 

  2442.                 $this->_string_shift($data, $this->packet_size_client_to_server[$client_channel])

    2443. 

  2443.             );

    2444. 

  2444. 

    2445. 

  2445.             if (!$this->_send_binary_packet($packet)) {

    2446. 

  2446.                 return false;

    2447. 

  2447.             }

    2448. 

  2448.         }

    2449. 

  2449. 

    2450. 

  2450.         // resize the window, if appropriate

    2451. 

  2451.         $this->window_size_client_to_server[$client_channel]-= strlen($data);

    2452. 

  2452.         if ($this->window_size_client_to_server[$client_channel] < 0) {

    2453. 

  2453.             $packet = pack('CNN', NET_SSH2_MSG_CHANNEL_WINDOW_ADJUST, $this->server_channels[$client_channel], $this->window_size);

    2454. 

  2454.             if (!$this->_send_binary_packet($packet)) {

    2455. 

  2455.                 return false;

    2456. 

  2456.             }

    2457. 

  2457.             $this->window_size_client_to_server[$client_channel]+= $this->window_size;

    2458. 

  2458.         }

    2459. 

  2459. 

    2460. 

  2460.         return $this->_send_binary_packet(pack('CN2a*',

    2461. 

  2461.             NET_SSH2_MSG_CHANNEL_DATA,

    2462. 

  2462.             $this->server_channels[$client_channel],

    2463. 

  2463.             strlen($data),

    2464. 

  2464.             $data));

    2465. 

  2465.     }

    2466. 

  2466. 

    2467. 

  2467.     /**

    2468. 

  2468.      * Closes and flushes a channel

    2469. 

  2469.      *

    2470. 

  2470.      * Net_SSH2 doesn't properly close most channels.  For exec() channels are normally closed by the server

    2471. 

  2471.      * and for SFTP channels are presumably closed when the client disconnects.  This functions is intended

    2472. 

  2472.      * for SCP more than anything.

    2473. 

  2473.      *

    2474. 

  2474.      * @param Integer $client_channel

    2475. 

  2475.      * @return Boolean

    2476. 

  2476.      * @access private

    2477. 

  2477.      */

    2478. 

  2478.     function _close_channel($client_channel)

    2479. 

  2479.     {

    2480. 

  2480.         // see http://tools.ietf.org/html/rfc4254#section-5.3

    2481. 

  2481. 

    2482. 

  2482.         $this->_send_binary_packet(pack('CN', NET_SSH2_MSG_CHANNEL_EOF, $this->server_channels[$client_channel]));

    2483. 

  2483. 

    2484. 

  2484.         $this->_send_binary_packet(pack('CN', NET_SSH2_MSG_CHANNEL_CLOSE, $this->server_channels[$client_channel]));

    2485. 

  2485. 

    2486. 

  2486.         $this->channel_status[$client_channel] = NET_SSH2_MSG_CHANNEL_CLOSE;

    2487. 

  2487. 

    2488. 

  2488.         $this->curTimeout = 0;

    2489. 

  2489. 

    2490. 

  2490.         while (!is_bool($this->_get_channel_packet($client_channel)));

    2491. 

  2491. 

    2492. 

  2492.         if ($this->bitmap & NET_SSH2_MASK_SHELL) {

    2493. 

  2493.             $this->bitmap&= ~NET_SSH2_MASK_SHELL;

    2494. 

  2494.         }

    2495. 

  2495.     }

    2496. 

  2496. 

    2497. 

  2497.     /**

    2498. 

  2498.      * Disconnect

    2499. 

  2499.      *

    2500. 

  2500.      * @param Integer $reason

    2501. 

  2501.      * @return Boolean

    2502. 

  2502.      * @access private

    2503. 

  2503.      */

    2504. 

  2504.     function _disconnect($reason)

    2505. 

  2505.     {

    2506. 

  2506.         if ($this->bitmap) {

    2507. 

  2507.             $data = pack('CNNa*Na*', NET_SSH2_MSG_DISCONNECT, $reason, 0, '', 0, '');

    2508. 

  2508.             $this->_send_binary_packet($data);

    2509. 

  2509.             $this->bitmap = 0;

    2510. 

  2510.             fclose($this->fsock);

    2511. 

  2511.             return false;

    2512. 

  2512.         }

    2513. 

  2513.     }

    2514. 

  2514. 

    2515. 

  2515.     /**

    2516. 

  2516.      * String Shift

    2517. 

  2517.      *

    2518. 

  2518.      * Inspired by array_shift

    2519. 

  2519.      *

    2520. 

  2520.      * @param String $string

    2521. 

  2521.      * @param optional Integer $index

    2522. 

  2522.      * @return String

    2523. 

  2523.      * @access private

    2524. 

  2524.      */

    2525. 

  2525.     function _string_shift(&$string, $index = 1)

    2526. 

  2526.     {

    2527. 

  2527.         $substr = substr($string, 0, $index);

    2528. 

  2528.         $string = substr($string, $index);

    2529. 

  2529.         return $substr;

    2530. 

  2530.     }

    2531. 

  2531. 

    2532. 

  2532.     /**

    2533. 

  2533.      * Define Array

    2534. 

  2534.      *

    2535. 

  2535.      * Takes any number of arrays whose indices are integers and whose values are strings and defines a bunch of

    2536. 

  2536.      * named constants from it, using the value as the name of the constant and the index as the value of the constant.

    2537. 

  2537.      * If any of the constants that would be defined already exists, none of the constants will be defined.

    2538. 

  2538.      *

    2539. 

  2539.      * @param Array $array

    2540. 

  2540.      * @access private

    2541. 

  2541.      */

    2542. 

  2542.     function _define_array()

    2543. 

  2543.     {

    2544. 

  2544.         $args = func_get_args();

    2545. 

  2545.         foreach ($args as $arg) {

    2546. 

  2546.             foreach ($arg as $key=>$value) {

    2547. 

  2547.                 if (!defined($value)) {

    2548. 

  2548.                     define($value, $key);

    2549. 

  2549.                 } else {

    2550. 

  2550.                     break 2;

    2551. 

  2551.                 }

    2552. 

  2552.             }

    2553. 

  2553.         }

    2554. 

  2554.     }

    2555. 

  2555. 

    2556. 

  2556.     /**

    2557. 

  2557.      * Returns a log of the packets that have been sent and received.

    2558. 

  2558.      *

    2559. 

  2559.      * Returns a string if NET_SSH2_LOGGING == NET_SSH2_LOG_COMPLEX, an array if NET_SSH2_LOGGING == NET_SSH2_LOG_SIMPLE and false if !defined('NET_SSH2_LOGGING')

    2560. 

  2560.      *

    2561. 

  2561.      * @access public

    2562. 

  2562.      * @return String or Array

    2563. 

  2563.      */

    2564. 

  2564.     function getLog()

    2565. 

  2565.     {

    2566. 

  2566.         if (!defined('NET_SSH2_LOGGING')) {

    2567. 

  2567.             return false;

    2568. 

  2568.         }

    2569. 

  2569. 

    2570. 

  2570.         switch (NET_SSH2_LOGGING) {

    2571. 

  2571.             case NET_SSH2_LOG_SIMPLE:

    2572. 

  2572.                 return $this->message_number_log;

    2573. 

  2573.                 break;

    2574. 

  2574.             case NET_SSH2_LOG_COMPLEX:

    2575. 

  2575.                 return $this->_format_log($this->message_log, $this->message_number_log);

    2576. 

  2576.                 break;

    2577. 

  2577.             default:

    2578. 

  2578.                 return false;

    2579. 

  2579.         }

    2580. 

  2580.     }

    2581. 

  2581. 

    2582. 

  2582.     /**

    2583. 

  2583.      * Formats a log for printing

    2584. 

  2584.      *

    2585. 

  2585.      * @param Array $message_log

    2586. 

  2586.      * @param Array $message_number_log

    2587. 

  2587.      * @access private

    2588. 

  2588.      * @return String

    2589. 

  2589.      */

    2590. 

  2590.     function _format_log($message_log, $message_number_log)

    2591. 

  2591.     {

    2592. 

  2592.         static $boundary = ':', $long_width = 65, $short_width = 16;

    2593. 

  2593. 

    2594. 

  2594.         $output = '';

    2595. 

  2595.         for ($i = 0; $i < count($message_log); $i++) {

    2596. 

  2596.             $output.= $message_number_log[$i] . "\r\n";

    2597. 

  2597.             $current_log = $message_log[$i];

    2598. 

  2598.             $j = 0;

    2599. 

  2599.             do {

    2600. 

  2600.                 if (!empty($current_log)) {

    2601. 

  2601.                     $output.= str_pad(dechex($j), 7, '0', STR_PAD_LEFT) . '0  ';

    2602. 

  2602.                 }

    2603. 

  2603.                 $fragment = $this->_string_shift($current_log, $short_width);

    2604. 

  2604.                 $hex = substr(

    2605. 

  2605.                            preg_replace(

    2606. 

  2606.                                '#(.)#es',

    2607. 

  2607.                                '"' . $boundary . '" . str_pad(dechex(ord(substr("\\1", -1))), 2, "0", STR_PAD_LEFT)',

    2608. 

  2608.                                $fragment),

    2609. 

  2609.                            strlen($boundary)

    2610. 

  2610.                        );

    2611. 

  2611.                 // replace non ASCII printable characters with dots

    2612. 

  2612.                 // http://en.wikipedia.org/wiki/ASCII#ASCII_printable_characters

    2613. 

  2613.                 // also replace < with a . since < messes up the output on web browsers

    2614. 

  2614.                 $raw = preg_replace('#[^\x20-\x7E]|<#', '.', $fragment);

    2615. 

  2615.                 $output.= str_pad($hex, $long_width - $short_width, ' ') . $raw . "\r\n";

    2616. 

  2616.                 $j++;

    2617. 

  2617.             } while (!empty($current_log));

    2618. 

  2618.             $output.= "\r\n";

    2619. 

  2619.         }

    2620. 

  2620. 

    2621. 

  2621.         return $output;

    2622. 

  2622.     }

    2623. 

  2623. 

    2624. 

  2624.     /**

    2625. 

  2625.      * Returns all errors

    2626. 

  2626.      *

    2627. 

  2627.      * @return String

    2628. 

  2628.      * @access public

    2629. 

  2629.      */

    2630. 

  2630.     function getErrors()

    2631. 

  2631.     {

    2632. 

  2632.         return $this->errors;

    2633. 

  2633.     }

    2634. 

  2634. 

    2635. 

  2635.     /**

    2636. 

  2636.      * Returns the last error

    2637. 

  2637.      *

    2638. 

  2638.      * @return String

    2639. 

  2639.      * @access public

    2640. 

  2640.      */

    2641. 

  2641.     function getLastError()

    2642. 

  2642.     {

    2643. 

  2643.         return $this->errors[count($this->errors) - 1];

    2644. 

  2644.     }

    2645. 

  2645. 

    2646. 

  2646.     /**

    2647. 

  2647.      * Return the server identification.

    2648. 

  2648.      *

    2649. 

  2649.      * @return String

    2650. 

  2650.      * @access public

    2651. 

  2651.      */

    2652. 

  2652.     function getServerIdentification()

    2653. 

  2653.     {

    2654. 

  2654.         return $this->server_identifier;

    2655. 

  2655.     }

    2656. 

  2656. 

    2657. 

  2657.     /**

    2658. 

  2658.      * Return a list of the key exchange algorithms the server supports.

    2659. 

  2659.      *

    2660. 

  2660.      * @return Array

    2661. 

  2661.      * @access public

    2662. 

  2662.      */

    2663. 

  2663.     function getKexAlgorithms()

    2664. 

  2664.     {

    2665. 

  2665.         return $this->kex_algorithms;

    2666. 

  2666.     }

    2667. 

  2667. 

    2668. 

  2668.     /**

    2669. 

  2669.      * Return a list of the host key (public key) algorithms the server supports.

    2670. 

  2670.      *

    2671. 

  2671.      * @return Array

    2672. 

  2672.      * @access public

    2673. 

  2673.      */

    2674. 

  2674.     function getServerHostKeyAlgorithms()

    2675. 

  2675.     {

    2676. 

  2676.         return $this->server_host_key_algorithms;

    2677. 

  2677.     }

    2678. 

  2678. 

    2679. 

  2679.     /**

    2680. 

  2680.      * Return a list of the (symmetric key) encryption algorithms the server supports, when receiving stuff from the client.

    2681. 

  2681.      *

    2682. 

  2682.      * @return Array

    2683. 

  2683.      * @access public

    2684. 

  2684.      */

    2685. 

  2685.     function getEncryptionAlgorithmsClient2Server()

    2686. 

  2686.     {

    2687. 

  2687.         return $this->encryption_algorithms_client_to_server;

    2688. 

  2688.     }

    2689. 

  2689. 

    2690. 

  2690.     /**

    2691. 

  2691.      * Return a list of the (symmetric key) encryption algorithms the server supports, when sending stuff to the client.

    2692. 

  2692.      *

    2693. 

  2693.      * @return Array

    2694. 

  2694.      * @access public

    2695. 

  2695.      */

    2696. 

  2696.     function getEncryptionAlgorithmsServer2Client()

    2697. 

  2697.     {

    2698. 

  2698.         return $this->encryption_algorithms_server_to_client;

    2699. 

  2699.     }

    2700. 

  2700. 

    2701. 

  2701.     /**

    2702. 

  2702.      * Return a list of the MAC algorithms the server supports, when receiving stuff from the client.

    2703. 

  2703.      *

    2704. 

  2704.      * @return Array

    2705. 

  2705.      * @access public

    2706. 

  2706.      */

    2707. 

  2707.     function getMACAlgorithmsClient2Server()

    2708. 

  2708.     {

    2709. 

  2709.         return $this->mac_algorithms_client_to_server;

    2710. 

  2710.     }

    2711. 

  2711. 

    2712. 

  2712.     /**

    2713. 

  2713.      * Return a list of the MAC algorithms the server supports, when sending stuff to the client.

    2714. 

  2714.      *

    2715. 

  2715.      * @return Array

    2716. 

  2716.      * @access public

    2717. 

  2717.      */

    2718. 

  2718.     function getMACAlgorithmsServer2Client()

    2719. 

  2719.     {

    2720. 

  2720.         return $this->mac_algorithms_server_to_client;

    2721. 

  2721.     }

    2722. 

  2722. 

    2723. 

  2723.     /**

    2724. 

  2724.      * Return a list of the compression algorithms the server supports, when receiving stuff from the client.

    2725. 

  2725.      *

    2726. 

  2726.      * @return Array

    2727. 

  2727.      * @access public

    2728. 

  2728.      */

    2729. 

  2729.     function getCompressionAlgorithmsClient2Server()

    2730. 

  2730.     {

    2731. 

  2731.         return $this->compression_algorithms_client_to_server;

    2732. 

  2732.     }

    2733. 

  2733. 

    2734. 

  2734.     /**

    2735. 

  2735.      * Return a list of the compression algorithms the server supports, when sending stuff to the client.

    2736. 

  2736.      *

    2737. 

  2737.      * @return Array

    2738. 

  2738.      * @access public

    2739. 

  2739.      */

    2740. 

  2740.     function getCompressionAlgorithmsServer2Client()

    2741. 

  2741.     {

    2742. 

  2742.         return $this->compression_algorithms_server_to_client;

    2743. 

  2743.     }

    2744. 

  2744. 

    2745. 

  2745.     /**

    2746. 

  2746.      * Return a list of the languages the server supports, when sending stuff to the client.

    2747. 

  2747.      *

    2748. 

  2748.      * @return Array

    2749. 

  2749.      * @access public

    2750. 

  2750.      */

    2751. 

  2751.     function getLanguagesServer2Client()

    2752. 

  2752.     {

    2753. 

  2753.         return $this->languages_server_to_client;

    2754. 

  2754.     }

    2755. 

  2755. 

    2756. 

  2756.     /**

    2757. 

  2757.      * Return a list of the languages the server supports, when receiving stuff from the client.

    2758. 

  2758.      *

    2759. 

  2759.      * @return Array

    2760. 

  2760.      * @access public

    2761. 

  2761.      */

    2762. 

  2762.     function getLanguagesClient2Server()

    2763. 

  2763.     {

    2764. 

  2764.         return $this->languages_client_to_server;

    2765. 

  2765.     }

    2766. 

  2766. 

    2767. 

  2767.     /**

    2768. 

  2768.      * Returns the server public host key.

    2769. 

  2769.      *

    2770. 

  2770.      * Caching this the first time you connect to a server and checking the result on subsequent connections

    2771. 

  2771.      * is recommended.  Returns false if the server signature is not signed correctly with the public host key.

    2772. 

  2772.      *

    2773. 

  2773.      * @return Mixed

    2774. 

  2774.      * @access public

    2775. 

  2775.      */

    2776. 

  2776.     function getServerPublicHostKey()

    2777. 

  2777.     {

    2778. 

  2778.         $signature = $this->signature;

    2779. 

  2779.         $server_public_host_key = $this->server_public_host_key;

    2780. 

  2780. 

    2781. 

  2781.         extract(unpack('Nlength', $this->_string_shift($server_public_host_key, 4)));

    2782. 

  2782.         $this->_string_shift($server_public_host_key, $length);

    2783. 

  2783. 

    2784. 

  2784.         if ($this->signature_validated) {

    2785. 

  2785.             return $this->bitmap ?

    2786. 

  2786.                 $this->signature_format . ' ' . base64_encode($this->server_public_host_key) :

    2787. 

  2787.                 false;

    2788. 

  2788.         }

    2789. 

  2789. 

    2790. 

  2790.         $this->signature_validated = true;

    2791. 

  2791. 

    2792. 

  2792.         switch ($this->signature_format) {

    2793. 

  2793.             case 'ssh-dss':

    2794. 

  2794.                 $temp = unpack('Nlength', $this->_string_shift($server_public_host_key, 4));

    2795. 

  2795.                 $p = new Math_BigInteger($this->_string_shift($server_public_host_key, $temp['length']), -256);

    2796. 

  2796. 

    2797. 

  2797.                 $temp = unpack('Nlength', $this->_string_shift($server_public_host_key, 4));

    2798. 

  2798.                 $q = new Math_BigInteger($this->_string_shift($server_public_host_key, $temp['length']), -256);

    2799. 

  2799. 

    2800. 

  2800.                 $temp = unpack('Nlength', $this->_string_shift($server_public_host_key, 4));

    2801. 

  2801.                 $g = new Math_BigInteger($this->_string_shift($server_public_host_key, $temp['length']), -256);

    2802. 

  2802. 

    2803. 

  2803.                 $temp = unpack('Nlength', $this->_string_shift($server_public_host_key, 4));

    2804. 

  2804.                 $y = new Math_BigInteger($this->_string_shift($server_public_host_key, $temp['length']), -256);

    2805. 

  2805. 

    2806. 

  2806.                 /* The value for 'dss_signature_blob' is encoded as a string containing

    2807. 

  2807.                    r, followed by s (which are 160-bit integers, without lengths or

    2808. 

  2808.                    padding, unsigned, and in network byte order). */

    2809. 

  2809.                 $temp = unpack('Nlength', $this->_string_shift($signature, 4));

    2810. 

  2810.                 if ($temp['length'] != 40) {

    2811. 

  2811.                     user_error('Invalid signature', E_USER_NOTICE);

    2812. 

  2812.                     return $this->_disconnect(NET_SSH2_DISCONNECT_KEY_EXCHANGE_FAILED);

    2813. 

  2813.                 }

    2814. 

  2814. 

    2815. 

  2815.                 $r = new Math_BigInteger($this->_string_shift($signature, 20), 256);

    2816. 

  2816.                 $s = new Math_BigInteger($this->_string_shift($signature, 20), 256);

    2817. 

  2817. 

    2818. 

  2818.                 if ($r->compare($q) >= 0 || $s->compare($q) >= 0) {

    2819. 

  2819.                     user_error('Invalid signature', E_USER_NOTICE);

    2820. 

  2820.                     return $this->_disconnect(NET_SSH2_DISCONNECT_KEY_EXCHANGE_FAILED);

    2821. 

  2821.                 }

    2822. 

  2822. 

    2823. 

  2823.                 $w = $s->modInverse($q);

    2824. 

  2824. 

    2825. 

  2825.                 $u1 = $w->multiply(new Math_BigInteger(sha1($this->exchange_hash), 16));

    2826. 

  2826.                 list(, $u1) = $u1->divide($q);

    2827. 

  2827. 

    2828. 

  2828.                 $u2 = $w->multiply($r);

    2829. 

  2829.                 list(, $u2) = $u2->divide($q);

    2830. 

  2830. 

    2831. 

  2831.                 $g = $g->modPow($u1, $p);

    2832. 

  2832.                 $y = $y->modPow($u2, $p);

    2833. 

  2833. 

    2834. 

  2834.                 $v = $g->multiply($y);

    2835. 

  2835.                 list(, $v) = $v->divide($p);

    2836. 

  2836.                 list(, $v) = $v->divide($q);

    2837. 

  2837. 

    2838. 

  2838.                 if (!$v->equals($r)) {

    2839. 

  2839.                     user_error('Bad server signature', E_USER_NOTICE);

    2840. 

  2840.                     return $this->_disconnect(NET_SSH2_DISCONNECT_HOST_KEY_NOT_VERIFIABLE);

    2841. 

  2841.                 }

    2842. 

  2842. 

    2843. 

  2843.                 break;

    2844. 

  2844.             case 'ssh-rsa':

    2845. 

  2845.                 $temp = unpack('Nlength', $this->_string_shift($server_public_host_key, 4));

    2846. 

  2846.                 $e = new Math_BigInteger($this->_string_shift($server_public_host_key, $temp['length']), -256);

    2847. 

  2847. 

    2848. 

  2848.                 $temp = unpack('Nlength', $this->_string_shift($server_public_host_key, 4));

    2849. 

  2849.                 $n = new Math_BigInteger($this->_string_shift($server_public_host_key, $temp['length']), -256);

    2850. 

  2850.                 $nLength = $temp['length'];

    2851. 

  2851. 

    2852. 

  2852.                 /*

    2853. 

  2853.                 $temp = unpack('Nlength', $this->_string_shift($signature, 4));

    2854. 

  2854.                 $signature = $this->_string_shift($signature, $temp['length']);

    2855. 

  2855. 

    2856. 

  2856.                 if (!class_exists('Crypt_RSA')) {

    2857. 

  2857.                     require_once('Crypt/RSA.php');

    2858. 

  2858.                 }

    2859. 

  2859. 

    2860. 

  2860.                 $rsa = new Crypt_RSA();

    2861. 

  2861.                 $rsa->setSignatureMode(CRYPT_RSA_SIGNATURE_PKCS1);

    2862. 

  2862.                 $rsa->loadKey(array('e' => $e, 'n' => $n), CRYPT_RSA_PUBLIC_FORMAT_RAW);

    2863. 

  2863.                 if (!$rsa->verify($this->exchange_hash, $signature)) {

    2864. 

  2864.                     user_error('Bad server signature', E_USER_NOTICE);

    2865. 

  2865.                     return $this->_disconnect(NET_SSH2_DISCONNECT_HOST_KEY_NOT_VERIFIABLE);

    2866. 

  2866.                 }

    2867. 

  2867.                 */

    2868. 

  2868. 

    2869. 

  2869.                 $temp = unpack('Nlength', $this->_string_shift($signature, 4));

    2870. 

  2870.                 $s = new Math_BigInteger($this->_string_shift($signature, $temp['length']), 256);

    2871. 

  2871. 

    2872. 

  2872.                 // validate an RSA signature per "8.2 RSASSA-PKCS1-v1_5", "5.2.2 RSAVP1", and "9.1 EMSA-PSS" in the

    2873. 

  2873.                 // following URL:

    2874. 

  2874.                 // ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-1/pkcs-1v2-1.pdf

    2875. 

  2875. 

    2876. 

  2876.                 // also, see SSHRSA.c (rsa2_verifysig) in PuTTy's source.

    2877. 

  2877. 

    2878. 

  2878.                 if ($s->compare(new Math_BigInteger()) < 0 || $s->compare($n->subtract(new Math_BigInteger(1))) > 0) {

    2879. 

  2879.                     user_error('Invalid signature', E_USER_NOTICE);

    2880. 

  2880.                     return $this->_disconnect(NET_SSH2_DISCONNECT_KEY_EXCHANGE_FAILED);

    2881. 

  2881.                 }

    2882. 

  2882. 

    2883. 

  2883.                 $s = $s->modPow($e, $n);

    2884. 

  2884.                 $s = $s->toBytes();

    2885. 

  2885. 

    2886. 

  2886.                 $h = pack('N4H*', 0x00302130, 0x0906052B, 0x0E03021A, 0x05000414, sha1($this->exchange_hash));

    2887. 

  2887.                 $h = chr(0x01) . str_repeat(chr(0xFF), $nLength - 3 - strlen($h)) . $h;

    2888. 

  2888. 

    2889. 

  2889.                 if ($s != $h) {

    2890. 

  2890.                     user_error('Bad server signature', E_USER_NOTICE);

    2891. 

  2891.                     return $this->_disconnect(NET_SSH2_DISCONNECT_HOST_KEY_NOT_VERIFIABLE);

    2892. 

  2892.                 }

    2893. 

  2893.                 break;

    2894. 

  2894.             default:

    2895. 

  2895.                 user_error('Unsupported signature format', E_USER_NOTICE);

    2896. 

  2896.                 return $this->_disconnect(NET_SSH2_DISCONNECT_HOST_KEY_NOT_VERIFIABLE);

    2897. 

  2897.         }

    2898. 

  2898. 

    2899. 

  2899.         return $this->signature_format . ' ' . base64_encode($this->server_public_host_key);

    2900. 

  2900.     }

    2901. 

  2901. }
    2902.