Ei kuvausta

Agent.php 8.4KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308
  1. <?php
  2. /**
  3. * Pure-PHP ssh-agent client.
  4. *
  5. * PHP version 5
  6. *
  7. * Here are some examples of how to use this library:
  8. * <code>
  9. * <?php
  10. * include 'vendor/autoload.php';
  11. *
  12. * $agent = new \phpseclib\System\SSH\Agent();
  13. *
  14. * $ssh = new \phpseclib\Net\SSH2('www.domain.tld');
  15. * if (!$ssh->login('username', $agent)) {
  16. * exit('Login Failed');
  17. * }
  18. *
  19. * echo $ssh->exec('pwd');
  20. * echo $ssh->exec('ls -la');
  21. * ?>
  22. * </code>
  23. *
  24. * @category System
  25. * @package SSH\Agent
  26. * @author Jim Wigginton <terrafrost@php.net>
  27. * @copyright 2014 Jim Wigginton
  28. * @license http://www.opensource.org/licenses/mit-license.html MIT License
  29. * @link http://phpseclib.sourceforge.net
  30. * @internal See http://api.libssh.org/rfc/PROTOCOL.agent
  31. */
  32. namespace phpseclib\System\SSH;
  33. use phpseclib\Crypt\RSA;
  34. use phpseclib\System\SSH\Agent\Identity;
  35. /**
  36. * Pure-PHP ssh-agent client identity factory
  37. *
  38. * requestIdentities() method pumps out \phpseclib\System\SSH\Agent\Identity objects
  39. *
  40. * @package SSH\Agent
  41. * @author Jim Wigginton <terrafrost@php.net>
  42. * @access internal
  43. */
  44. class Agent
  45. {
  46. /**#@+
  47. * Message numbers
  48. *
  49. * @access private
  50. */
  51. // to request SSH1 keys you have to use SSH_AGENTC_REQUEST_RSA_IDENTITIES (1)
  52. const SSH_AGENTC_REQUEST_IDENTITIES = 11;
  53. // this is the SSH2 response; the SSH1 response is SSH_AGENT_RSA_IDENTITIES_ANSWER (2).
  54. const SSH_AGENT_IDENTITIES_ANSWER = 12;
  55. // the SSH1 request is SSH_AGENTC_RSA_CHALLENGE (3)
  56. const SSH_AGENTC_SIGN_REQUEST = 13;
  57. // the SSH1 response is SSH_AGENT_RSA_RESPONSE (4)
  58. const SSH_AGENT_SIGN_RESPONSE = 14;
  59. /**#@-*/
  60. /**@+
  61. * Agent forwarding status
  62. *
  63. * @access private
  64. */
  65. // no forwarding requested and not active
  66. const FORWARD_NONE = 0;
  67. // request agent forwarding when opportune
  68. const FORWARD_REQUEST = 1;
  69. // forwarding has been request and is active
  70. const FORWARD_ACTIVE = 2;
  71. /**#@-*/
  72. /**
  73. * Unused
  74. */
  75. const SSH_AGENT_FAILURE = 5;
  76. /**
  77. * Socket Resource
  78. *
  79. * @var resource
  80. * @access private
  81. */
  82. var $fsock;
  83. /**
  84. * Agent forwarding status
  85. *
  86. * @access private
  87. */
  88. var $forward_status = self::FORWARD_NONE;
  89. /**
  90. * Buffer for accumulating forwarded authentication
  91. * agent data arriving on SSH data channel destined
  92. * for agent unix socket
  93. *
  94. * @access private
  95. */
  96. var $socket_buffer = '';
  97. /**
  98. * Tracking the number of bytes we are expecting
  99. * to arrive for the agent socket on the SSH data
  100. * channel
  101. */
  102. var $expected_bytes = 0;
  103. /**
  104. * Default Constructor
  105. *
  106. * @return \phpseclib\System\SSH\Agent
  107. * @access public
  108. */
  109. function __construct()
  110. {
  111. switch (true) {
  112. case isset($_SERVER['SSH_AUTH_SOCK']):
  113. $address = $_SERVER['SSH_AUTH_SOCK'];
  114. break;
  115. case isset($_ENV['SSH_AUTH_SOCK']):
  116. $address = $_ENV['SSH_AUTH_SOCK'];
  117. break;
  118. default:
  119. user_error('SSH_AUTH_SOCK not found');
  120. return false;
  121. }
  122. $this->fsock = fsockopen('unix://' . $address, 0, $errno, $errstr);
  123. if (!$this->fsock) {
  124. user_error("Unable to connect to ssh-agent (Error $errno: $errstr)");
  125. }
  126. }
  127. /**
  128. * Request Identities
  129. *
  130. * See "2.5.2 Requesting a list of protocol 2 keys"
  131. * Returns an array containing zero or more \phpseclib\System\SSH\Agent\Identity objects
  132. *
  133. * @return array
  134. * @access public
  135. */
  136. function requestIdentities()
  137. {
  138. if (!$this->fsock) {
  139. return array();
  140. }
  141. $packet = pack('NC', 1, self::SSH_AGENTC_REQUEST_IDENTITIES);
  142. if (strlen($packet) != fputs($this->fsock, $packet)) {
  143. user_error('Connection closed while requesting identities');
  144. }
  145. $length = current(unpack('N', fread($this->fsock, 4)));
  146. $type = ord(fread($this->fsock, 1));
  147. if ($type != self::SSH_AGENT_IDENTITIES_ANSWER) {
  148. user_error('Unable to request identities');
  149. }
  150. $identities = array();
  151. $keyCount = current(unpack('N', fread($this->fsock, 4)));
  152. for ($i = 0; $i < $keyCount; $i++) {
  153. $length = current(unpack('N', fread($this->fsock, 4)));
  154. $key_blob = fread($this->fsock, $length);
  155. $key_str = 'ssh-rsa ' . base64_encode($key_blob);
  156. $length = current(unpack('N', fread($this->fsock, 4)));
  157. if ($length) {
  158. $key_str.= ' ' . fread($this->fsock, $length);
  159. }
  160. $length = current(unpack('N', substr($key_blob, 0, 4)));
  161. $key_type = substr($key_blob, 4, $length);
  162. switch ($key_type) {
  163. case 'ssh-rsa':
  164. $key = new RSA();
  165. $key->loadKey($key_str);
  166. break;
  167. case 'ssh-dss':
  168. // not currently supported
  169. break;
  170. }
  171. // resources are passed by reference by default
  172. if (isset($key)) {
  173. $identity = new Identity($this->fsock);
  174. $identity->setPublicKey($key);
  175. $identity->setPublicKeyBlob($key_blob);
  176. $identities[] = $identity;
  177. unset($key);
  178. }
  179. }
  180. return $identities;
  181. }
  182. /**
  183. * Signal that agent forwarding should
  184. * be requested when a channel is opened
  185. *
  186. * @param Net_SSH2 $ssh
  187. * @return bool
  188. * @access public
  189. */
  190. function startSSHForwarding($ssh)
  191. {
  192. if ($this->forward_status == self::FORWARD_NONE) {
  193. $this->forward_status = self::FORWARD_REQUEST;
  194. }
  195. }
  196. /**
  197. * Request agent forwarding of remote server
  198. *
  199. * @param Net_SSH2 $ssh
  200. * @return bool
  201. * @access private
  202. */
  203. function _request_forwarding($ssh)
  204. {
  205. $request_channel = $ssh->_get_open_channel();
  206. if ($request_channel === false) {
  207. return false;
  208. }
  209. $packet = pack(
  210. 'CNNa*C',
  211. NET_SSH2_MSG_CHANNEL_REQUEST,
  212. $ssh->server_channels[$request_channel],
  213. strlen('auth-agent-req@openssh.com'),
  214. 'auth-agent-req@openssh.com',
  215. 1
  216. );
  217. $ssh->channel_status[$request_channel] = NET_SSH2_MSG_CHANNEL_REQUEST;
  218. if (!$ssh->_send_binary_packet($packet)) {
  219. return false;
  220. }
  221. $response = $ssh->_get_channel_packet($request_channel);
  222. if ($response === false) {
  223. return false;
  224. }
  225. $ssh->channel_status[$request_channel] = NET_SSH2_MSG_CHANNEL_OPEN;
  226. $this->forward_status = self::FORWARD_ACTIVE;
  227. return true;
  228. }
  229. /**
  230. * On successful channel open
  231. *
  232. * This method is called upon successful channel
  233. * open to give the SSH Agent an opportunity
  234. * to take further action. i.e. request agent forwarding
  235. *
  236. * @param Net_SSH2 $ssh
  237. * @access private
  238. */
  239. function _on_channel_open($ssh)
  240. {
  241. if ($this->forward_status == self::FORWARD_REQUEST) {
  242. $this->_request_forwarding($ssh);
  243. }
  244. }
  245. /**
  246. * Forward data to SSH Agent and return data reply
  247. *
  248. * @param string $data
  249. * @return data from SSH Agent
  250. * @access private
  251. */
  252. function _forward_data($data)
  253. {
  254. if ($this->expected_bytes > 0) {
  255. $this->socket_buffer.= $data;
  256. $this->expected_bytes -= strlen($data);
  257. } else {
  258. $agent_data_bytes = current(unpack('N', $data));
  259. $current_data_bytes = strlen($data);
  260. $this->socket_buffer = $data;
  261. if ($current_data_bytes != $agent_data_bytes + 4) {
  262. $this->expected_bytes = ($agent_data_bytes + 4) - $current_data_bytes;
  263. return false;
  264. }
  265. }
  266. if (strlen($this->socket_buffer) != fwrite($this->fsock, $this->socket_buffer)) {
  267. user_error('Connection closed attempting to forward data to SSH agent');
  268. }
  269. $this->socket_buffer = '';
  270. $this->expected_bytes = 0;
  271. $agent_reply_bytes = current(unpack('N', fread($this->fsock, 4)));
  272. $agent_reply_data = fread($this->fsock, $agent_reply_bytes);
  273. $agent_reply_data = current(unpack('a*', $agent_reply_data));
  274. return pack('Na*', $agent_reply_bytes, $agent_reply_data);
  275. }
  276. }