twisted.conch.ssh.transport.SSHTransportBase

Known subclasses: twisted.conch.ssh.transport.SSHClientTransport, twisted.conch.ssh.transport.SSHServerTransport

Protocol supporting basic SSH functionality: sending/receiving packets and message dispatch. To connect to or run a server, you must use SSHClientTransport or SSHServerTransport.

Instance Variable	protocolVersion	A string representing the version of the SSH protocol we support. Currently defaults to '2.0'.
Instance Variable	version	A string representing the version of the server or client. Currently defaults to 'Twisted'.
Instance Variable	comment	An optional string giving more information about the server or client.
Instance Variable	supportedCiphers	A list of strings representing the encryption algorithms supported, in order from most-preferred to least.
Instance Variable	supportedMACs	A list of strings representing the message authentication codes (hashes) supported, in order from most-preferred to least. Both this and supportedCiphers can include 'none' to use no encryption or authentication, but that must be done manually,
Instance Variable	supportedKeyExchanges	A list of strings representing the key exchanges supported, in order from most-preferred to least.
Instance Variable	supportedPublicKeys	A list of strings representing the public key types supported, in order from most-preferred to least.
Instance Variable	supportedCompressions	A list of strings representing compression types supported, from most-preferred to least.
Instance Variable	supportedLanguages	A list of strings representing languages supported, from most-preferred to least.
Instance Variable	supportedVersions	A container of strings representing supported ssh protocol version numbers.
Instance Variable	isClient	A boolean indicating whether this is a client or server.
Instance Variable	gotVersion	A boolean indicating whether we have received the version string from the other side.
Instance Variable	buf	Data we've received but hasn't been parsed into a packet.
Instance Variable	outgoingPacketSequence	the sequence number of the next packet we will send.
Instance Variable	incomingPacketSequence	the sequence number of the next packet we are expecting from the other side.
Instance Variable	outgoingCompression	an object supporting the .compress(str) and .flush() methods, or None if there is no outgoing compression. Used to compress outgoing data.
Instance Variable	outgoingCompressionType	A string representing the outgoing compression type.
Instance Variable	incomingCompression	an object supporting the .decompress(str) method, or None if there is no incoming compression. Used to decompress incoming data.
Instance Variable	incomingCompressionType	A string representing the incoming compression type.
Instance Variable	ourVersionString	the version string that we sent to the other side. Used in the key exchange.
Instance Variable	otherVersionString	the version string sent by the other side. Used in the key exchange.
Instance Variable	ourKexInitPayload	the MSG_KEXINIT payload we sent. Used in the key exchange.
Instance Variable	otherKexInitPayload	the MSG_KEXINIT payload we received. Used in the key exchange
Instance Variable	sessionID	a string that is unique to this SSH session. Created as part of the key exchange, sessionID is used to generate the various encryption and authentication keys.
Instance Variable	service	an SSHService instance, or None. If it's set to an object, it's the currently running service.
Instance Variable	kexAlg 0	the agreed-upon key exchange algorithm.
Instance Variable	keyAlg	the agreed-upon public key type for the key exchange.
Instance Variable	currentEncryptions	an SSHCiphers instance. It represents the current encryption and authentication options for the transport.
Instance Variable	nextEncryptions	an SSHCiphers instance. Held here until the MSG_NEWKEYS messages are exchanged, when nextEncryptions is transitioned to currentEncryptions.
Instance Variable	first	the first bytes of the next packet. In order to avoid decrypting data twice, the first bytes are decrypted and stored until the whole packet is available.
Method	connectionLost	When the underlying connection is closed, stop the running service (if any), and log out the avatar (if any).
Method	connectionMade	Called when the connection is made to the other side. We sent our version and the MSG_KEXINIT packet.
Method	sendKexInit	Send a KEXINIT message to initiate key exchange or to respond to a key exchange initiated by the peer.
Method	sendPacket	Sends a packet. If it's been set up, compress the data, encrypt it, and authenticate it before sending. If key exchange is in progress and the message is not part of key exchange, queue it to be sent later.
Method	getPacket	Try to return a decrypted, authenticated, and decompressed packet out of the buffer. If there is not enough data, return None.
Method	dataReceived	First, check for the version string (SSH-2.0-*). After that has been received, this method adds data to the buffer, and pulls out any packets.
Method	dispatchMessage	Send a received message to the appropriate method.
Method	getPeer	Returns an `SSHTransportAddress` corresponding to the other (peer) side of this transport.
Method	getHost	Returns an `SSHTransportAddress` corresponding to the this side of transport.
Method	kexAlg 1	The key exchange algorithm name agreed between client and server.
Method	kexAlg	Set the key exchange algorithm name.
Method	ssh_KEXINIT	No summary
Method	ssh_DISCONNECT	Called when we receive a MSG_DISCONNECT message. Payload:: long code string description
Method	ssh_IGNORE	Called when we receive a MSG_IGNORE message. No payload. This means nothing; we simply return.
Method	ssh_UNIMPLEMENTED	Called when we receive a MSG_UNIMPLEMENTED message. Payload:: long packet
Method	ssh_DEBUG	No summary
Method	setService	Set our service to service and start it running. If we were running a service previously, stop it first.
Method	sendDebug	Send a debug message to the other side.
Method	sendIgnore	Send a message that will be ignored by the other side. This is useful to fool attacks based on guessing packet sizes in the encrypted stream.
Method	sendUnimplemented	Send a message to the other side that the last packet was not understood.
Method	sendDisconnect	Send a disconnect message to the other side and then disconnect.
Method	isEncrypted	Check if the connection is encrypted in the given direction.
Method	isVerified	Check if the connection is verified/authentication in the given direction.
Method	loseConnection	Lose the connection to the other side, sending a DISCONNECT_CONNECTION_LOST message.
Method	receiveError	Called when we receive a disconnect error message from the other side.
Method	receiveUnimplemented	Called when we receive an unimplemented packet message from the other side.
Method	receiveDebug	Called when we receive a debug message from the other side.
Instance Variable	_keyExchangeState	The current protocol state with respect to key exchange. This is either `_KEY_EXCHANGE_NONE` if no key exchange is in progress (and returns to this value after any key exchange completqes), `_KEY_EXCHANGE_REQUESTED` if this side of the connection initiated a key exchange, and `_KEY_EXCHANGE_PROGRESSING` if the other side of the connection initiated a key exchange. `_KEY_EXCHANGE_NONE` is the initial value (however SSH connections begin with key exchange, so it will quickly change to another state).
Instance Variable	_blockedByKeyExchange	Whenever `_keyExchangeState` is not `_KEY_EXCHANGE_NONE`, this is a `list` of pending messages which were passed to `sendPacket` but could not be sent because it is not legal to send them while a key exchange is in progress. When the key exchange completes, another attempt is made to send these messages.
Method	_allowedKeyExchangeMessageType	Determine if the given message type may be sent while key exchange is in progress.
Method	_unsupportedVersionReceived	Called when an unsupported version of the ssh protocol is received from the remote endpoint.
Method	_startEphemeralDH	Prepares for a Diffie-Hellman key agreement exchange.
Method	_finishEphemeralDH	Completes the Diffie-Hellman key agreement started by _startEphemeralDH, and forgets the ephemeral secret key.
Method	_getKey	Get one of the keys for authentication/encryption.
Method	_keySetup	Set up the keys for the connection and sends MSG_NEWKEYS when finished,
Method	_newKeys	No summary
Method	_generateECPrivateKey	Generate an private key for ECDH key exchange.
Method	_encodeECPublicKey	Encode an elliptic curve public key to bytes.
Method	_generateECSharedSecret	Generate a shared secret for ECDH key exchange.

Inherited from Protocol:

Method

logPrefix

Return a prefix matching the class name, to identify log messages related to this protocol instance.

Inherited from BaseProtocol (via Protocol):

Method

makeConnection

Make a connection to a transport and a server.

protocolVersion =

A string representing the version of the SSH protocol we support. Currently defaults to '2.0'.

version =

A string representing the version of the server or client. Currently defaults to 'Twisted'.

comment =

An optional string giving more information about the server or client.

supportedCiphers =

A list of strings representing the encryption algorithms supported, in order from most-preferred to least.

supportedMACs =

A list of strings representing the message authentication codes (hashes) supported, in order from most-preferred to least. Both this and supportedCiphers can include 'none' to use no encryption or authentication, but that must be done manually,

supportedKeyExchanges =

A list of strings representing the key exchanges supported, in order from most-preferred to least.

supportedPublicKeys =

A list of strings representing the public key types supported, in order from most-preferred to least.

supportedCompressions =

A list of strings representing compression types supported, from most-preferred to least.

supportedLanguages =

A list of strings representing languages supported, from most-preferred to least.

supportedVersions =

A container of strings representing supported ssh protocol version numbers.

isClient =

A boolean indicating whether this is a client or server.

gotVersion =

A boolean indicating whether we have received the version string from the other side.

buf =

Data we've received but hasn't been parsed into a packet.

outgoingPacketSequence =

the sequence number of the next packet we will send.

incomingPacketSequence =

the sequence number of the next packet we are expecting from the other side.

outgoingCompression =

an object supporting the .compress(str) and .flush() methods, or None if there is no outgoing compression. Used to compress outgoing data.

outgoingCompressionType =

A string representing the outgoing compression type.

incomingCompression =

an object supporting the .decompress(str) method, or None if there is no incoming compression. Used to decompress incoming data.

incomingCompressionType =

A string representing the incoming compression type.

ourVersionString =

the version string that we sent to the other side. Used in the key exchange.

otherVersionString =

the version string sent by the other side. Used in the key exchange.

ourKexInitPayload =

the MSG_KEXINIT payload we sent. Used in the key exchange.

otherKexInitPayload =

the MSG_KEXINIT payload we received. Used in the key exchange

sessionID =

a string that is unique to this SSH session. Created as part of the key exchange, sessionID is used to generate the various encryption and authentication keys.

service =

an SSHService instance, or None. If it's set to an object, it's the currently running service.

kexAlg 0 =

the agreed-upon key exchange algorithm.

keyAlg =

the agreed-upon public key type for the key exchange.

currentEncryptions =

an SSHCiphers instance. It represents the current encryption and authentication options for the transport.

nextEncryptions =

an SSHCiphers instance. Held here until the MSG_NEWKEYS messages are exchanged, when nextEncryptions is transitioned to currentEncryptions.

first =

the first bytes of the next packet. In order to avoid decrypting data twice, the first bytes are decrypted and stored until the whole packet is available.

_keyExchangeState =

The current protocol state with respect to key exchange. This is either _KEY_EXCHANGE_NONE if no key exchange is in progress (and returns to this value after any key exchange completqes), _KEY_EXCHANGE_REQUESTED if this side of the connection initiated a key exchange, and _KEY_EXCHANGE_PROGRESSING if the other side of the connection initiated a key exchange. _KEY_EXCHANGE_NONE is the initial value (however SSH connections begin with key exchange, so it will quickly change to another state).

_blockedByKeyExchange =

Whenever _keyExchangeState is not _KEY_EXCHANGE_NONE, this is a list of pending messages which were passed to sendPacket but could not be sent because it is not legal to send them while a key exchange is in progress. When the key exchange completes, another attempt is made to send these messages.

def connectionLost(self, reason):

from twisted.internet.interfaces.IProtocol

overrides twisted.internet.protocol.Protocol.connectionLost

overridden in twisted.conch.client.direct.SSHClientTransport, twisted.conch.endpoints._CommandTransport, twisted.conch.test.test_ssh.ConchTestClient, twisted.conch.test.test_ssh.ConchTestServer

When the underlying connection is closed, stop the running service (if any), and log out the avatar (if any).

Parameters reason The cause of the connection being closed. (type: twisted.python.failure.Failure)

def connectionMade(self):

from twisted.internet.interfaces.IProtocol

overrides twisted.internet.protocol.BaseProtocol.connectionMade

overridden in twisted.conch.ssh.transport.SSHClientTransport

Called when the connection is made to the other side. We sent our version and the MSG_KEXINIT packet.

def sendKexInit(self):

Send a KEXINIT message to initiate key exchange or to respond to a key exchange initiated by the peer.

Returns	`None`
Raises	RuntimeError	If a key exchange has already been started and it is not appropriate to send a KEXINIT message at this time.

def _allowedKeyExchangeMessageType(self, messageType):

Determine if the given message type may be sent while key exchange is in progress.

Parameters	messageType	The type of message (type: `int`)
Returns	`True` if the given type of message may be sent while key exchange is in progress, `False` if it may not. (type: `bool`)
See Also	http://tools.ietf.org/html/rfc4253#section-7.1

def sendPacket(self, messageType, payload):

Sends a packet. If it's been set up, compress the data, encrypt it, and authenticate it before sending. If key exchange is in progress and the message is not part of key exchange, queue it to be sent later.

Parameters	messageType	The type of the packet; generally one of the MSG_* values. (type: `int`)
	payload	The payload for the message. (type: `str`)

def getPacket(self):

Try to return a decrypted, authenticated, and decompressed packet out of the buffer. If there is not enough data, return None.

Returns The decoded packet, if any. (type: str or None)

def _unsupportedVersionReceived(self, remoteVersion):

Called when an unsupported version of the ssh protocol is received from the remote endpoint.

Parameters remoteVersion remote ssh protocol version which is unsupported by us. (type: str)

def dataReceived(self, data):

from twisted.internet.interfaces.IProtocol

overrides twisted.internet.protocol.Protocol.dataReceived

First, check for the version string (SSH-2.0-*). After that has been received, this method adds data to the buffer, and pulls out any packets.

Parameters data The data that was received. (type: bytes)

def dispatchMessage(self, messageNum, payload):

Send a received message to the appropriate method.

Parameters	messageNum	The message number. (type: `int`)
	payload	The message payload. (type: `bytes`)

def getPeer(self):

Returns an SSHTransportAddress corresponding to the other (peer) side of this transport.

Returns	`SSHTransportAddress` for the peer (type: `SSHTransportAddress`)
Present Since	12.1

def getHost(self):

Returns an SSHTransportAddress corresponding to the this side of transport.

Returns	`SSHTransportAddress` for the peer (type: `SSHTransportAddress`)
Present Since	12.1

@property
def kexAlg 1(self):

The key exchange algorithm name agreed between client and server.

@kexAlg.setter
def kexAlg(self, value):

Set the key exchange algorithm name.

def ssh_KEXINIT(self, packet):

overridden in twisted.conch.ssh.transport.SSHClientTransport, twisted.conch.ssh.transport.SSHServerTransport

Called when we receive a MSG_KEXINIT message. Payload:

   bytes[16] cookie
   string keyExchangeAlgorithms
   string keyAlgorithms
   string incomingEncryptions
   string outgoingEncryptions
   string incomingAuthentications
   string outgoingAuthentications
   string incomingCompressions
   string outgoingCompressions
   string incomingLanguages
   string outgoingLanguages
   bool firstPacketFollows
   unit32 0 (reserved)

Starts setting up the key exchange, keys, encryptions, and authentications. Extended by ssh_KEXINIT in SSHServerTransport and SSHClientTransport.

Parameters	packet	The message data. (type: `bytes`)
Returns	A `tuple` of negotiated key exchange algorithms, key algorithms, and unhandled data, or `None` if something went wrong.

def ssh_DISCONNECT(self, packet):

Called when we receive a MSG_DISCONNECT message. Payload:

   long code
   string description

This means that the other side has disconnected. Pass the message up and disconnect ourselves.

Parameters packet The message data. (type: bytes)

def ssh_IGNORE(self, packet):

Called when we receive a MSG_IGNORE message. No payload. This means nothing; we simply return.

Parameters packet The message data. (type: bytes)

def ssh_UNIMPLEMENTED(self, packet):

Called when we receive a MSG_UNIMPLEMENTED message. Payload:

   long packet

This means that the other side did not implement one of our packets.

Parameters packet The message data. (type: bytes)

def ssh_DEBUG(self, packet):

Called when we receive a MSG_DEBUG message. Payload:

   bool alwaysDisplay
   string message
   string language

This means the other side has passed along some debugging info.

Parameters packet The message data. (type: bytes)

def setService(self, service):

overridden in twisted.conch.client.direct.SSHClientTransport

Set our service to service and start it running. If we were running a service previously, stop it first.

Parameters service The service to attach. (type: SSHService)

def sendDebug(self, message, alwaysDisplay=False, language=''):

Send a debug message to the other side.

Parameters	message	the message to send. (type: `str`)
	alwaysDisplay	if True, tell the other side to always display this message. (type: `bool`)
	language	optionally, the language the message is in. (type: `str`)

def sendIgnore(self, message):

Send a message that will be ignored by the other side. This is useful to fool attacks based on guessing packet sizes in the encrypted stream.

Parameters message data to send with the message (type: str)

def sendUnimplemented(self):

Send a message to the other side that the last packet was not understood.

def sendDisconnect(self, reason, desc):

overridden in twisted.conch.client.direct.SSHClientTransport, twisted.conch.scripts.tkconch.SSHClientTransport

Send a disconnect message to the other side and then disconnect.

Parameters	reason	the reason for the disconnect. Should be one of the DISCONNECT_* values. (type: `int`)
	desc	a descrption of the reason for the disconnection. (type: `str`)

def _startEphemeralDH(self):

Prepares for a Diffie-Hellman key agreement exchange.

Creates an ephemeral keypair in the group defined by (self.g, self.p) and stores it.

def _finishEphemeralDH(self, remoteDHpublicKey):

Completes the Diffie-Hellman key agreement started by _startEphemeralDH, and forgets the ephemeral secret key.

Returns The new shared secret, in SSH mpint format. (type: bytes)

def _getKey(self, c, sharedSecret, exchangeHash):

Get one of the keys for authentication/encryption.

Parameters	c	The letter identifying which key this is. (type: `bytes`)
	sharedSecret	The shared secret K. (type: `bytes`)
	exchangeHash	The hash H from key exchange. (type: `bytes`)
Returns	The derived key. (type: `bytes`)

def _keySetup(self, sharedSecret, exchangeHash):

overridden in twisted.conch.ssh.transport.SSHClientTransport

Set up the keys for the connection and sends MSG_NEWKEYS when finished,

Parameters	sharedSecret	a secret string agreed upon using a Diffie- Hellman exchange, so it is only shared between the server and the client. (type: `str`)
	exchangeHash	A hash of various data known by both sides. (type: `str`)

def _newKeys(self):

Called back by a subclass once a MSG_NEWKEYS message has been received. This indicates key exchange has completed and new encryption and compression parameters should be adopted. Any messages which were queued during key exchange will also be flushed.

def isEncrypted(self, direction='out'):

Check if the connection is encrypted in the given direction.

Parameters	direction	The direction: one of 'out', 'in', or 'both'. (type: `str`)
Returns	`True` if it is encrypted. (type: `bool`)

def isVerified(self, direction='out'):

Check if the connection is verified/authentication in the given direction.

Parameters	direction	The direction: one of 'out', 'in', or 'both'. (type: `str`)
Returns	`True` if it is verified. (type: `bool`)

def loseConnection(self):

Lose the connection to the other side, sending a DISCONNECT_CONNECTION_LOST message.

def receiveError(self, reasonCode, description):

overridden in twisted.conch.client.direct.SSHClientTransport, twisted.conch.scripts.tkconch.SSHClientTransport

Called when we receive a disconnect error message from the other side.

Parameters	reasonCode	the reason for the disconnect, one of the DISCONNECT_ values. (type: `int`)
	description	a human-readable description of the disconnection. (type: `str`)

def receiveUnimplemented(self, seqnum):

Called when we receive an unimplemented packet message from the other side.

Parameters seqnum the sequence number that was not understood. (type: int)

def receiveDebug(self, alwaysDisplay, message, lang):

overridden in twisted.conch.client.direct.SSHClientTransport, twisted.conch.scripts.tkconch.SSHClientTransport

Called when we receive a debug message from the other side.

Parameters	alwaysDisplay	if True, this message should always be displayed. (type: `bool`)
	message	the debug message (type: `str`)
	lang	optionally the language the message is in. (type: `str`)

def _generateECPrivateKey(self):

Generate an private key for ECDH key exchange.

Returns The generated private key. (type: The appropriate private key type matching self.kexAlg: EllipticCurvePrivateKey for ecdh-sha2-nistp*, or X25519PrivateKey for curve25519-sha256.)

def _encodeECPublicKey(self, ecPub):

Encode an elliptic curve public key to bytes.

Parameters	ecPub	The public key to encode. (type: The appropriate public key type matching `self.kexAlg`: `EllipticCurvePublicKey` for `ecdh-sha2-nistp*`, or `X25519PublicKey` for `curve25519-sha256`.)
Returns	The encoded public key. (type: `bytes`)

def _generateECSharedSecret(self, ecPriv, theirECPubBytes):

Generate a shared secret for ECDH key exchange.

Parameters	ecPriv	Our private key. (type: The appropriate private key type matching `self.kexAlg`: `EllipticCurvePrivateKey` for `ecdh-sha2-nistp*`, or `X25519PrivateKey` for `curve25519-sha256`.)
Returns	The generated shared secret, as an SSH multiple-precision integer. (type: `bytes`)

API Documentation for twisted, generated by pydoctor at 2020-03-25 17:34:30.

twisted.conch.ssh.transport.SSHTransportBase(protocol.Protocol) class documentation

`twisted.conch.ssh.transport.SSHTransportBase(protocol.Protocol)` class documentation