feat: implement SSH algorithms mapping and refactor cipher usage acro…

src/backend/database/routes/snippets.ts

@@ -6,6 +6,7 @@ import { eq, and, desc, asc, sql } from "drizzle-orm";
 import type { Request, Response } from "express";
 import { authLogger, databaseLogger } from "../../utils/logger.js";
 import { AuthManager } from "../../utils/auth-manager.js";
+import { SSH_ALGORITHMS } from "../../utils/ssh-algorithms.js";
 
 const router = express.Router();
 
@@ -775,18 +776,7 @@ router.post(
               "ssh-rsa",
               "ssh-dss",
             ],
-            cipher: [
-              "chacha20-poly1305@openssh.com",
-              "aes256-gcm@openssh.com",
-              "aes128-gcm@openssh.com",
-              "aes256-ctr",
-              "aes192-ctr",
-              "aes128-ctr",
-              "aes256-cbc",
-              "aes192-cbc",
-              "aes128-cbc",
-              "3des-cbc",
-            ],
+            cipher: SSH_ALGORITHMS.cipher,
             hmac: [
               "hmac-sha2-512-etm@openssh.com",
               "hmac-sha2-256-etm@openssh.com",

src/backend/ssh/file-manager.ts

@@ -3,6 +3,7 @@ import cors from "cors";
 import cookieParser from "cookie-parser";
 import axios from "axios";
 import { Client as SSHClient } from "ssh2";
+import { SSH_ALGORITHMS } from "../utils/ssh-algorithms.js";
 import { getDb } from "../database/db/index.js";
 import { sshCredentials, hosts } from "../database/db/schema.js";
 import { eq, and } from "drizzle-orm";
@@ -1001,18 +1002,7 @@ app.post("/ssh/file_manager/ssh/connect", async (req, res) => {
         "ssh-rsa",
         "ssh-dss",
       ],
-      cipher: [
-        "chacha20-poly1305@openssh.com",
-        "aes256-gcm@openssh.com",
-        "aes128-gcm@openssh.com",
-        "aes256-ctr",
-        "aes192-ctr",
-        "aes128-ctr",
-        "aes256-cbc",
-        "aes192-cbc",
-        "aes128-cbc",
-        "3des-cbc",
-      ],
+      cipher: SSH_ALGORITHMS.cipher,
       hmac: [
         "hmac-sha2-512-etm@openssh.com",
         "hmac-sha2-256-etm@openssh.com",

src/backend/ssh/server-stats.ts

@@ -3,6 +3,7 @@ import net from "net";
 import cors from "cors";
 import cookieParser from "cookie-parser";
 import { Client, type ConnectConfig } from "ssh2";
+import { SSH_ALGORITHMS } from "../utils/ssh-algorithms.js";
 import { getDb } from "../database/db/index.js";
 import { hosts, sshCredentials } from "../database/db/schema.js";
 import { eq, and } from "drizzle-orm";
@@ -1485,18 +1486,7 @@ async function buildSshConfig(
         "ssh-rsa",
         "ssh-dss",
       ],
-      cipher: [
-        "chacha20-poly1305@openssh.com",
-        "aes256-gcm@openssh.com",
-        "aes128-gcm@openssh.com",
-        "aes256-ctr",
-        "aes192-ctr",
-        "aes128-ctr",
-        "aes256-cbc",
-        "aes192-cbc",
-        "aes128-cbc",
-        "3des-cbc",
-      ],
+      cipher: SSH_ALGORITHMS.cipher,
       hmac: [
         "hmac-sha2-512-etm@openssh.com",
         "hmac-sha2-256-etm@openssh.com",

src/backend/ssh/terminal.ts

@@ -1,5 +1,6 @@
 import { WebSocketServer, WebSocket, type RawData } from "ws";
 import { Client, type ClientChannel, type PseudoTtyOptions } from "ssh2";
+import { SSH_ALGORITHMS } from "../utils/ssh-algorithms.js";
 import { parse as parseUrl } from "url";
 import axios from "axios";
 import { getDb } from "../database/db/index.js";
@@ -1859,18 +1860,7 @@ wss.on("connection", async (ws: WebSocket, req) => {
           "ssh-rsa",
           "ssh-dss",
         ],
-        cipher: [
-          "chacha20-poly1305@openssh.com",
-          "aes256-gcm@openssh.com",
-          "aes128-gcm@openssh.com",
-          "aes256-ctr",
-          "aes192-ctr",
-          "aes128-ctr",
-          "aes256-cbc",
-          "aes192-cbc",
-          "aes128-cbc",
-          "3des-cbc",
-        ],
+        cipher: SSH_ALGORITHMS.cipher,
         hmac: [
           "hmac-sha2-512-etm@openssh.com",
           "hmac-sha2-256-etm@openssh.com",

src/backend/ssh/tunnel.ts

@@ -2,6 +2,7 @@ import express, { type Response } from "express";
 import cors from "cors";
 import cookieParser from "cookie-parser";
 import { Client } from "ssh2";
+import { SSH_ALGORITHMS } from "../utils/ssh-algorithms.js";
 import { ChildProcess } from "child_process";
 import axios from "axios";
 import { getDb } from "../database/db/index.js";
@@ -1152,18 +1153,7 @@ async function connectSSHTunnel(
         "ssh-rsa",
         "ssh-dss",
       ],
-      cipher: [
-        "chacha20-poly1305@openssh.com",
-        "aes256-gcm@openssh.com",
-        "aes128-gcm@openssh.com",
-        "aes256-ctr",
-        "aes192-ctr",
-        "aes128-ctr",
-        "aes256-cbc",
-        "aes192-cbc",
-        "aes128-cbc",
-        "3des-cbc",
-      ],
+      cipher: SSH_ALGORITHMS.cipher,
       hmac: [
         "hmac-sha2-512-etm@openssh.com",
         "hmac-sha2-256-etm@openssh.com",

src/backend/utils/ssh-algorithms.ts

@@ -0,0 +1,71 @@
+import crypto from "crypto";
+import type { ConnectConfig, CipherAlgorithm } from "ssh2";
+
+// Maps SSH cipher names to their OpenSSL equivalents (as used by ssh2 internally)
+const SSH_CIPHER_SSL_NAME: Partial<Record<CipherAlgorithm, string>> = {
+  "chacha20-poly1305@openssh.com": "chacha20",
+  "aes256-gcm@openssh.com": "aes-256-gcm",
+  "aes128-gcm@openssh.com": "aes-128-gcm",
+  "aes256-ctr": "aes-256-ctr",
+  "aes192-ctr": "aes-192-ctr",
+  "aes128-ctr": "aes-128-ctr",
+  "aes256-cbc": "aes-256-cbc",
+  "aes192-cbc": "aes-192-cbc",
+  "aes128-cbc": "aes-128-cbc",
+  "3des-cbc": "des-ede3-cbc",
+};
+
+const availableCiphers = new Set(crypto.getCiphers());
+
+function filterCiphers(list: CipherAlgorithm[]): CipherAlgorithm[] {
+  return list.filter((name) => {
+    const sslName = SSH_CIPHER_SSL_NAME[name];
+    return !sslName || availableCiphers.has(sslName);
+  });
+}
+
+export const SSH_ALGORITHMS: NonNullable<ConnectConfig["algorithms"]> = {
+  kex: [
+    "curve25519-sha256",
+    "curve25519-sha256@libssh.org",
+    "ecdh-sha2-nistp521",
+    "ecdh-sha2-nistp384",
+    "ecdh-sha2-nistp256",
+    "diffie-hellman-group-exchange-sha256",
+    "diffie-hellman-group14-sha256",
+    "diffie-hellman-group14-sha1",
+    "diffie-hellman-group-exchange-sha1",
+    "diffie-hellman-group1-sha1",
+  ],
+  serverHostKey: [
+    "ssh-ed25519",
+    "ecdsa-sha2-nistp521",
+    "ecdsa-sha2-nistp384",
+    "ecdsa-sha2-nistp256",
+    "rsa-sha2-512",
+    "rsa-sha2-256",
+    "ssh-rsa",
+    "ssh-dss",
+  ],
+  cipher: filterCiphers([
+    "chacha20-poly1305@openssh.com",
+    "aes256-gcm@openssh.com",
+    "aes128-gcm@openssh.com",
+    "aes256-ctr",
+    "aes192-ctr",
+    "aes128-ctr",
+    "aes256-cbc",
+    "aes192-cbc",
+    "aes128-cbc",
+    "3des-cbc",
+  ]),
+  hmac: [
+    "hmac-sha2-512-etm@openssh.com",
+    "hmac-sha2-256-etm@openssh.com",
+    "hmac-sha2-512",
+    "hmac-sha2-256",
+    "hmac-sha1",
+    "hmac-md5",
+  ],
+  compress: ["none", "zlib@openssh.com", "zlib"],
+};