diff --git a/markbase-core/src/ssh_server/cipher.rs b/markbase-core/src/ssh_server/cipher.rs index a9b07f4..96b0f50 100644 --- a/markbase-core/src/ssh_server/cipher.rs +++ b/markbase-core/src/ssh_server/cipher.rs @@ -3,6 +3,7 @@ use super::crypto::SessionKeys; use super::sshbuf::SshBuf; +use super::compression::CompressionContext; // Phase 2: SSH Compression use aes::Aes128; // 改为AES-128(协商算法是aes128-ctr) use aes_gcm::{ aead::{Aead, KeyInit, Payload}, @@ -39,6 +40,8 @@ pub struct EncryptionContext { pub cipher_ctos: Option, // 客户端→服务器cipher实例(持久化,AES-CTR) pub cipher_stoc: Option, // 服务器→客户端cipher实例(持久化,AES-CTR) pub cipher_mode: CipherMode, // Phase 1: 区分 AES-CTR 和 AES-GCM 模式 + pub compression_ctos: CompressionContext, // Phase 2: 客户端→服务器压缩 + pub compression_stoc: CompressionContext, // Phase 2: 服务器→客户端压缩 } /// Phase 1: 加密模式选择(AES-CTR vs AES-GCM) @@ -64,6 +67,8 @@ impl Default for EncryptionContext { cipher_ctos: None, cipher_stoc: None, cipher_mode: CipherMode::AesCtr, // 默认使用 AES-CTR(兼容性) + compression_ctos: CompressionContext::new(6), // Phase 2 + compression_stoc: CompressionContext::new(6), // Phase 2 } } } @@ -113,6 +118,20 @@ impl EncryptionContext { cipher_ctos: Some(cipher_ctos), // 持久化cipher实例 cipher_stoc: Some(cipher_stoc), // 持久化cipher实例 cipher_mode: CipherMode::AesCtr, // 默认使用 AES-CTR(兼容性) + compression_ctos: CompressionContext::new(6), // Phase 2: 默认压缩级别6 + compression_stoc: CompressionContext::new(6), // Phase 2: 默认压缩级别6 + } + } + + /// Phase 2: 启用压缩(根据 KEX 协商结果) + pub fn enable_compression(&mut self, compression_ctos: &str, compression_stoc: &str) { + if compression_ctos == "zlib" { + info!("Enabling compression (client→server)"); + self.compression_ctos.enable(); + } + if compression_stoc == "zlib" { + info!("Enabling compression (server→client)"); + self.compression_stoc.enable(); } } diff --git a/markbase-core/src/ssh_server/server.rs b/markbase-core/src/ssh_server/server.rs index 5e1c314..1dfa741 100644 --- a/markbase-core/src/ssh_server/server.rs +++ b/markbase-core/src/ssh_server/server.rs @@ -321,6 +321,16 @@ fn perform_complete_kex_exchange( info!("Setting cipher mode to AES-CTR (MtE)"); encryption_ctx.set_cipher_mode(CipherMode::AesCtr)?; } + + // Phase 2: 根据 KEX 协商结果启用压缩(compression_ctos / compression_stoc) + let compression_ctos = &kex_result.compression_ctos; + let compression_stoc = &kex_result.compression_stoc; + info!("KEX negotiated compression algorithms: ctos={}, stoc={}", compression_ctos, compression_stoc); + + if compression_ctos != "none" || compression_stoc != "none" { + info!("Enabling SSH compression"); + encryption_ctx.enable_compression(compression_ctos, compression_stoc); + } Ok(encryption_ctx) }