ssh: add support for more ciphers and macs

ssh/cipher.go

@@ -125,6 +125,8 @@ var cipherModes = map[string]*cipherMode{
 	// You should expect that an active attacker can recover plaintext if
 	// you do.
 	aes128cbcID: {16, aes.BlockSize, newAESCBCCipher},
+	aes192cbcID: {24, aes.BlockSize, newAESCBCCipher},
+	aes256cbcID: {32, aes.BlockSize, newAESCBCCipher},
 
 	// 3des-cbc is insecure and is not included in the default
 	// config.

ssh/common.go

@@ -30,7 +30,7 @@ var supportedCiphers = []string{
 	"[email protected]", gcm256CipherID,
 	chacha20Poly1305ID,
 	"arcfour256", "arcfour128", "arcfour",
-	aes128cbcID,
+	aes128cbcID, aes192cbcID, aes256cbcID,
 	tripledescbcID,
 }
 
@@ -84,7 +84,8 @@ var supportedHostKeyAlgos = []string{
 // This is based on RFC 4253, section 6.4, but with hmac-md5 variants removed
 // because they have reached the end of their useful life.
 var supportedMACs = []string{
-	"[email protected]", "hmac-sha2-256", "hmac-sha1", "hmac-sha1-96",
+	"[email protected]", "hmac-sha2-256", "[email protected]", "hmac-sha2-512",
+	"hmac-sha1", "hmac-sha1-96",
 }
 
 var supportedCompressions = []string{compressionNone}
@@ -153,7 +154,7 @@ func (a *directionAlgorithms) rekeyBytes() int64 {
 	// 2^(BLOCKSIZE/4) blocks. For all AES flavors BLOCKSIZE is
 	// 128.
 	switch a.Cipher {
-	case "aes128-ctr", "aes192-ctr", "aes256-ctr", gcmCipherID, gcm256CipherID, aes128cbcID:
+	case "aes128-ctr", "aes192-ctr", "aes256-ctr", gcmCipherID, gcm256CipherID, aes128cbcID, aes192cbcID, aes256cbcID:
 		return 16 * (1 << 32)
 
 	}

ssh/mac.go

@@ -9,6 +9,7 @@ package ssh
 import (
 	"crypto/hmac"
 	"crypto/sha1"
+	"crypto/sha512"
 	"hash"
 )
 
@@ -45,9 +46,15 @@ func (t truncatingMAC) Size() int {
 func (t truncatingMAC) BlockSize() int { return t.hmac.BlockSize() }
 
 var macModes = map[string]*macMode{
+	"[email protected]": {64, true, func(key []byte) hash.Hash {
+		return hmac.New(sha512.New, key)
+	}},
 	"[email protected]": {32, true, func(key []byte) hash.Hash {
 		return hmac.New(sha256New, key)
 	}},
+	"hmac-sha2-512": {64, false, func(key []byte) hash.Hash {
+		return hmac.New(sha512.New, key)
+	}},
 	"hmac-sha2-256": {32, false, func(key []byte) hash.Hash {
 		return hmac.New(sha256New, key)
 	}},

ssh/test/session_test.go

@@ -357,7 +357,7 @@ func testOneCipher(t *testing.T, cipher string, cipherOrder []string) {
 }
 
 var deprecatedCiphers = []string{
-	"aes128-cbc", "3des-cbc",
+	"aes128-cbc", "aes192-cbc", "aes256-cbc", "3des-cbc",
 	"arcfour128", "arcfour256",
 }
 

ssh/transport.go

@@ -20,6 +20,8 @@ const (
 	gcmCipherID    = "[email protected]"
 	gcm256CipherID = "[email protected]"
 	aes128cbcID    = "aes128-cbc"
+	aes192cbcID    = "aes192-cbc"
+	aes256cbcID    = "aes256-cbc"
 	tripledescbcID = "3des-cbc"
 )