danog/phpseclib
1
0
Fork 0
mirror of https://github.com/danog/phpseclib.git synced 2024-12-02 09:38:06 +01:00
Code Issues Projects Releases Wiki Activity

Merge branch '2.0' into 3.0

Browse Source
This commit is contained in:
terrafrost 2022-12-11 08:59:36 -06:00
commit 1a201dd131
1 changed files with 19 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
phpseclib/Net/SSH2.php
View File

@ -267,6 +267,18 @@ class SSH2
*/
private $server_host_key_algorithms = false;
/**
* Supported Private Key Algorithms
*
* In theory this should be the same as the Server Host Key Algorithms but, in practice,
* some servers (eg. Azure) will support rsa-sha2-512 as a server host key algorithm but
* not a private key algorithm
*
* @see self::privatekey_login()
* @var array|false
*/
private $supported_private_key_algorithms = false;
/**
* Encryption Algorithms: Client to Server
*
@ -1546,6 +1558,8 @@ class SSH2
$first_kex_packet_follows
) = Strings::unpackSSH2('L10C', $response);
$this->supported_private_key_algorithms = $this->server_host_key_algorithms;
if ($send_kex) {
$this->send_binary_packet($kexinit_payload_client);
}
@ -2533,7 +2547,7 @@ class SSH2
if (isset($this->preferred['hostkey'])) {
$algos = array_intersect($this->preferred['hostkey'], $algos);
}
$algo = self::array_intersect_first($algos, $this->server_host_key_algorithms);
$algo = self::array_intersect_first($algos, $this->supported_private_key_algorithms);
switch ($algo) {
case 'rsa-sha2-512':
$hash = 'sha512';
@ -2602,6 +2616,10 @@ class SSH2
switch ($type) {
case NET_SSH2_MSG_USERAUTH_FAILURE:
list($auth_methods) = Strings::unpackSSH2('L', $response);
if (in_array('publickey', $auth_methods) && substr($signatureType, 0, 9) == 'rsa-sha2-') {
$this->supported_private_key_algorithms = array_diff($this->supported_private_key_algorithms, ['rsa-sha2-256', 'rsa-sha2-512']);
return $this->privatekey_login($username, $privatekey);
}
$this->auth_methods_to_continue = $auth_methods;
$this->errors[] = 'SSH_MSG_USERAUTH_FAILURE';
return false;