Merge branch 'maint'

* maint:
  Correct access flag handling in sftpd
  Client fallbacks to ipv4 if connection is refused with ipv6
  Cleaned up code so that ssh_file can become a template for a documented ssh_keys behavior
  Test case maintenance
  Better handling of IPv6
  Ssh daemon handles RSA host keys
  Removed no longer needed code
  Use the public_key application for all public key handling

1 files changed, 82 insertions, 184 deletions

diff --git a/lib/ssh/src/ssh_transport.erl b/lib/ssh/src/ssh_transport.erl
index de3e29e2f1..6140c87f6e 100644
--- a/lib/ssh/src/ssh_transport.erl
+++ b/lib/ssh/src/ssh_transport.erl
@@ -1,7 +1,7 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2004-2011. All Rights Reserved.
+%% Copyright Ericsson AB 2004-2012. All Rights Reserved.
 %%
 %% The contents of this file are subject to the Erlang Public License,
 %% Version 1.1, (the "License"); you may not use this file except in
@@ -23,10 +23,11 @@
 
 -module(ssh_transport).
 
--include("ssh_transport.hrl").
+-include_lib("public_key/include/public_key.hrl").
+-include_lib("kernel/include/inet.hrl").
 
+-include("ssh_transport.hrl").
 -include("ssh.hrl").
--include_lib("kernel/include/inet.hrl").
 
 -export([connect/5, accept/4]). 
 -export([versions/2, hello_version_msg/1]).
@@ -38,17 +39,8 @@
 	 handle_kex_dh_gex_group/2, handle_kex_dh_gex_reply/2,
 	 handle_new_keys/2, handle_kex_dh_gex_request/2,
 	 handle_kexdh_reply/2, 
-	 unpack/3, decompress/2, ssh_packet/2, pack/2, msg_data/1]).
-
-%% debug flagso
--define(DBG_ALG,     true).
--define(DBG_KEX,     true).
--define(DBG_CRYPTO,  false).
--define(DBG_PACKET,  false).
--define(DBG_MESSAGE, true).
--define(DBG_BIN_MESSAGE, true).
--define(DBG_MAC,     false).
--define(DBG_ZLIB,    true).
+	 unpack/3, decompress/2, ssh_packet/2, pack/2, msg_data/1,
+	 sign/3, verify/4]).
 
 versions(client, Options)->
     Vsn = proplists:get_value(vsn, Options, ?DEFAULT_CLIENT_VERSION),
@@ -212,24 +204,24 @@ key_exchange_init_msg(Ssh0) ->
     {SshPacket, Ssh} = ssh_packet(Msg, Ssh0),
     {Msg, SshPacket, Ssh}.
 
-kex_init(#ssh{role = Role, opts = Opts}) ->
+kex_init(#ssh{role = Role, opts = Opts, available_host_keys = HostKeyAlgs}) ->
     Random = ssh_bits:random(16),
     Compression = case proplists:get_value(compression, Opts, none) of
 		      zlib -> ["zlib", "none"];
 		      none -> ["none", "zlib"]
 		  end,
-    kexinit_messsage(Role, Random, Compression).
+    kexinit_messsage(Role, Random, Compression, HostKeyAlgs).
 
 key_init(client, Ssh, Value) ->
     Ssh#ssh{c_keyinit = Value};
 key_init(server, Ssh, Value) ->
     Ssh#ssh{s_keyinit = Value}.
 
-kexinit_messsage(client, Random, Compression) ->
+kexinit_messsage(client, Random, Compression, HostKeyAlgs) ->
     #ssh_msg_kexinit{ 
 		  cookie = Random,
 		  kex_algorithms = ["diffie-hellman-group1-sha1"],
-		  server_host_key_algorithms = ["ssh-rsa", "ssh-dss"],
+		  server_host_key_algorithms = HostKeyAlgs,
 		  encryption_algorithms_client_to_server = ["aes128-cbc","3des-cbc"],
 		  encryption_algorithms_server_to_client = ["aes128-cbc","3des-cbc"],
 		  mac_algorithms_client_to_server = ["hmac-sha1"],
@@ -240,11 +232,11 @@ kexinit_messsage(client, Random, Compression) ->
 		  languages_server_to_client = []
 		 };
 
-kexinit_messsage(server, Random, Compression) ->
+kexinit_messsage(server, Random, Compression, HostKeyAlgs) ->
     #ssh_msg_kexinit{
 		  cookie = Random,
 		  kex_algorithms = ["diffie-hellman-group1-sha1"],
-		  server_host_key_algorithms = ["ssh-dss"],
+		  server_host_key_algorithms = HostKeyAlgs,
 		  encryption_algorithms_client_to_server = ["aes128-cbc","3des-cbc"],
 		  encryption_algorithms_server_to_client = ["aes128-cbc","3des-cbc"],
 		  mac_algorithms_client_to_server = ["hmac-sha1"],
@@ -300,7 +292,6 @@ install_messages('diffie-hellman-group-exchange-sha1') ->
 key_exchange_first_msg('diffie-hellman-group1-sha1', Ssh0) ->
     {G, P} = dh_group1(),
     {Private, Public} = dh_gen_key(G, P, 1024),
-    %%?dbg(?DBG_KEX, "public: ~p~n", [Public]),
     {SshPacket, Ssh1} = ssh_packet(#ssh_msg_kexdh_init{e = Public}, Ssh0),
     {ok, SshPacket, 
      Ssh1#ssh{keyex_key = {{Private, Public}, {G, P}}}};
@@ -320,7 +311,6 @@ key_exchange_first_msg('diffie-hellman-group-exchange-sha1', Ssh0) ->
 handle_kexdh_init(#ssh_msg_kexdh_init{e = E}, Ssh0) ->
     {G, P} = dh_group1(),
     {Private, Public} = dh_gen_key(G, P, 1024),
-    %%?dbg(?DBG_KEX, "public: ~p~n", [Public]),
     K = ssh_math:ipow(E, Private, P),
     {Key, K_S} = get_host_key(Ssh0),
     H = kex_h(Ssh0, K_S, E, Public, K),
@@ -329,8 +319,7 @@ handle_kexdh_init(#ssh_msg_kexdh_init{e = E}, Ssh0) ->
 							f = Public,
 							h_sig = H_SIG
 						       }, Ssh0),
-    %%?dbg(?DBG_KEX, "shared_secret: ~s ~n", [fmt_binary(K, 16, 4)]),
-    %%?dbg(?DBG_KEX, "hash: ~s ~n", [fmt_binary(H, 16, 4)]),
+
     {ok, SshPacket, Ssh1#ssh{keyex_key = {{Private, Public}, {G, P}},
 			     shared_secret = K,
 			     exchanged_hash = H,
@@ -338,7 +327,6 @@ handle_kexdh_init(#ssh_msg_kexdh_init{e = E}, Ssh0) ->
 
 handle_kex_dh_gex_group(#ssh_msg_kex_dh_gex_group{p = P, g = G}, Ssh0) ->
     {Private, Public} = dh_gen_key(G,P,1024),
-    %%?dbg(?DBG_KEX, "public: ~p ~n", [Public]),
     {SshPacket, Ssh1} = 
 	ssh_packet(#ssh_msg_kex_dh_gex_init{e = Public}, Ssh0),
     {ok, SshPacket, 
@@ -362,8 +350,7 @@ handle_kexdh_reply(#ssh_msg_kexdh_reply{public_host_key = HostKey, f = F,
 		   #ssh{keyex_key = {{Private, Public}, {_G, P}}} = Ssh0) ->
     K = ssh_math:ipow(F, Private, P),
     H = kex_h(Ssh0, HostKey, Public, F, K),
-    %%?dbg(?DBG_KEX, "shared_secret: ~s ~n", [fmt_binary(K, 16, 4)]),
-    %%?dbg(?DBG_KEX, "hash: ~s ~n", [fmt_binary(H, 16, 4)]),
+
     case verify_host_key(Ssh0, HostKey, H, H_SIG) of
 	ok ->
 	    {SshPacket, Ssh} = ssh_packet(#ssh_msg_newkeys{}, Ssh0),
@@ -396,8 +383,7 @@ handle_kex_dh_gex_reply(#ssh_msg_kex_dh_gex_reply{public_host_key = HostKey,
 		 	Ssh0) ->
     K = ssh_math:ipow(F, Private, P),
     H = kex_h(Ssh0, HostKey, Min, NBits, Max, P, G, Public, F, K),
-    %%?dbg(?DBG_KEX, "shared_secret: ~s ~n", [fmt_binary(K, 16, 4)]),
-    %%?dbg(?DBG_KEX, "hash: ~s ~n", [fmt_binary(H, 16, 4)]),
+
     case verify_host_key(Ssh0, HostKey, H, H_SIG) of
 	ok ->
 	    {SshPacket, Ssh} = ssh_packet(#ssh_msg_newkeys{}, Ssh0),
@@ -423,83 +409,68 @@ sid(#ssh{session_id = Id}, _) ->
 %%
 get_host_key(SSH) ->
     #ssh{key_cb = Mod, opts = Opts, algorithms = ALG} = SSH,
-    Scope = proplists:get_value(key_scope, Opts, system),
-    case ALG#alg.hkey of
-	'ssh-rsa' ->
-	    case Mod:private_host_rsa_key(Scope, Opts) of
-		{ok,Key=#ssh_key { public={N,E}} } ->
-		    %%?dbg(true, "x~n", []),
-		    {Key,
-		     ssh_bits:encode(["ssh-rsa",E,N],[string,mpint,mpint])};
-		Error ->
-		    %%?dbg(true, "y~n", []),
-		    exit(Error)
-	    end;
-	'ssh-dss' ->
-	    case Mod:private_host_dsa_key(Scope, Opts) of
-		{ok,Key=#ssh_key { public={P,Q,G,Y}}} ->
-		    {Key, ssh_bits:encode(["ssh-dss",P,Q,G,Y],
-					  [string,mpint,mpint,mpint,mpint])};
-		Error ->
-		    exit(Error)
-	    end;
-	_ ->
-	    exit({error, bad_key_type})
+
+    case Mod:host_key(ALG#alg.hkey, Opts) of
+	{ok, #'RSAPrivateKey'{modulus = N, publicExponent = E} = Key} ->
+	    {Key,
+	     ssh_bits:encode(["ssh-rsa",E,N],[string,mpint,mpint])};
+	{ok, #'DSAPrivateKey'{y = Y, p = P, q = Q, g = G} = Key} ->
+	    {Key, ssh_bits:encode(["ssh-dss",P,Q,G,Y],
+				  [string,mpint,mpint,mpint,mpint])};
+	Result ->
+	    exit({error, {Result, unsupported_key_type}})
     end.
 
-sign_host_key(Ssh, Private, H) ->
-    ALG = Ssh#ssh.algorithms,
-    Module = case ALG#alg.hkey of
-		 'ssh-rsa' -> 
-		     ssh_rsa;
-		 'ssh-dss' -> 
-		     ssh_dsa
-	     end,
-    case catch Module:sign(Private, H) of
-	{'EXIT', Reason} ->
-	    error_logger:format("SIGN FAILED: ~p\n", [Reason]),
-	    {error, Reason};
-	SIG ->
-	    ssh_bits:encode([Module:alg_name() ,SIG],[string,binary])
-    end.    
+sign_host_key(_Ssh, #'RSAPrivateKey'{} = Private, H) ->
+    Hash = sha, %% Option ?!
+    Signature = sign(H, Hash, Private),
+    ssh_bits:encode(["ssh-rsa", Signature],[string, binary]);
+sign_host_key(_Ssh, #'DSAPrivateKey'{} = Private, H) ->
+    Hash = sha, %% Option ?!
+    RawSignature = sign(H, Hash, Private),
+    ssh_bits:encode(["ssh-dss", RawSignature],[string, binary]).
 
 verify_host_key(SSH, K_S, H, H_SIG) ->
     ALG = SSH#ssh.algorithms,
     case ALG#alg.hkey of
 	'ssh-rsa' ->
-	    case ssh_bits:decode(K_S,[string,mpint,mpint]) of
-		["ssh-rsa", E, N] ->
-		    ["ssh-rsa",SIG] = ssh_bits:decode(H_SIG,[string,binary]),
-		    Public = #ssh_key { type=rsa, public={N,E} },
-		    case catch ssh_rsa:verify(Public, H, SIG) of
-			{'EXIT', Reason} ->
-			    error_logger:format("VERIFY FAILED: ~p\n", [Reason]),
-			    {error, bad_signature};
-			ok ->
-			    known_host_key(SSH, Public, "ssh-rsa")
-		    end;
-		_ ->
-		    {error, bad_format}
-	    end;
+	    verify_host_key_rsa(SSH, K_S, H, H_SIG);
 	'ssh-dss' ->
-	    case ssh_bits:decode(K_S,[string,mpint,mpint,mpint,mpint]) of
-		["ssh-dss",P,Q,G,Y] ->
-		    ["ssh-dss",SIG] = ssh_bits:decode(H_SIG,[string,binary]),
-		    Public = #ssh_key { type=dsa, public={P,Q,G,Y} },
-		    case catch ssh_dsa:verify(Public, H, SIG) of
-			{'EXIT', Reason} ->
-			    error_logger:format("VERIFY FAILED: ~p\n", [Reason]),
-			    {error, bad_signature};
-			ok ->
-			    known_host_key(SSH, Public, "ssh-dss")
-		    end;
-		_ ->
-		    {error, bad_host_key_format}
-	    end;
+	    verify_host_key_dss(SSH, K_S, H, H_SIG);
 	_ ->
 	    {error, bad_host_key_algorithm}
     end.
 
+verify_host_key_rsa(SSH, K_S, H, H_SIG) ->
+    case ssh_bits:decode(K_S,[string,mpint,mpint]) of
+	["ssh-rsa", E, N] ->
+	    ["ssh-rsa",SIG] = ssh_bits:decode(H_SIG,[string,binary]),
+	    Public = #'RSAPublicKey'{publicExponent = E, modulus = N},
+	    case verify(H, sha, SIG, Public) of
+		false ->
+		    {error, bad_signature};
+		true ->
+		    known_host_key(SSH, Public, "ssh-rsa")
+	    end;
+	_ ->
+	    {error, bad_format}
+    end.
+
+verify_host_key_dss(SSH, K_S, H, H_SIG) ->
+    case ssh_bits:decode(K_S,[string,mpint,mpint,mpint,mpint]) of
+	["ssh-dss",P,Q,G,Y] ->
+	    ["ssh-dss",SIG] = ssh_bits:decode(H_SIG,[string,binary]),
+	    Public = {Y,  #'Dss-Parms'{p = P, q = Q, g = G}},
+	    case verify(H, sha, SIG, Public) of
+		false ->
+		    {error, bad_signature};
+		true ->
+		    known_host_key(SSH, Public, "ssh-dss")
+	    end;
+	_ ->
+	    {error, bad_host_key_format}
+    end.
+
 accepted_host(Ssh, PeerName, Opts) ->
     case proplists:get_value(silently_accept_hosts, Opts, false) of
 	true ->
@@ -511,14 +482,10 @@ accepted_host(Ssh, PeerName, Opts) ->
 known_host_key(#ssh{opts = Opts, key_cb = Mod, peer = Peer} = Ssh, 
 	       Public, Alg) ->
     PeerName = peer_name(Peer),
-    case Mod:lookup_host_key(PeerName, Alg, Opts) of
-	{ok, Public} ->
+    case Mod:is_host_key(Public, PeerName, Alg, Opts) of
+	true ->
 	    ok;
-	{ok, BadPublic} ->
-	    error_logger:format("known_host_key: Public ~p BadPublic ~p\n", 
-				[Public, BadPublic]),
-	    {error, bad_public_key};
-	{error, not_found} ->
+	false ->
 	    case accepted_host(Ssh, PeerName, Opts) of
 		yes ->
 		    Mod:add_host_key(PeerName, Public, Opts);
@@ -621,7 +588,6 @@ install_alg(SSH) ->
 
 alg_setup(SSH) ->
     ALG = SSH#ssh.algorithms,
-    %%?dbg(?DBG_ALG, "ALG: setup ~p ~n", [ALG]),
     SSH#ssh{kex = ALG#alg.kex,
 	    hkey = ALG#alg.hkey,
 	    encrypt = ALG#alg.encrypt,
@@ -638,7 +604,6 @@ alg_setup(SSH) ->
 	   }.
 
 alg_init(SSH0) ->
-    %%?dbg(?DBG_ALG, "ALG: init~n", []),    
     {ok,SSH1} = send_mac_init(SSH0),
     {ok,SSH2} = recv_mac_init(SSH1),
     {ok,SSH3} = encrypt_init(SSH2),
@@ -648,7 +613,6 @@ alg_init(SSH0) ->
     SSH6.
 
 alg_final(SSH0) ->
-    %%?dbg(?DBG_ALG, "ALG: final ~n", []),
     {ok,SSH1} = send_mac_final(SSH0),
     {ok,SSH2} = recv_mac_final(SSH1),
     {ok,SSH3} = encrypt_final(SSH2),
@@ -669,19 +633,15 @@ select(CL, SL) ->
 	    [] -> undefined;
 	    [ALG|_] -> ALG
 	end,
-    %%?dbg(?DBG_ALG, "ALG: select: ~p ~p = ~p~n", [CL, SL, C]),
     C.
 	    
 ssh_packet(#ssh_msg_kexinit{} = Msg, Ssh0) ->
     BinMsg = ssh_bits:encode(Msg),
     Ssh = key_init(Ssh0#ssh.role, Ssh0, BinMsg),
-    %%?dbg(?DBG_MESSAGE, "SEND_MSG: ~p~n", [Msg]),
     pack(BinMsg, Ssh);
 
 ssh_packet(Msg, Ssh) ->
     BinMsg = ssh_bits:encode(Msg),
-    %%?dbg(?DBG_MESSAGE, "SEND_MSG: ~p~n", [Msg]),
-    %%?dbg(?DBG_BIN_MESSAGE, "Encoded: ~p~n", [BinMsg]),
     pack(BinMsg, Ssh).
 
 pack(Data0, #ssh{encrypt_block_size = BlockSize, 
@@ -732,17 +692,20 @@ msg_data(PacketData) ->
      _:PaddingLen/binary>> = PacketData,
     Data.
 
+sign(SigData, Hash,  #'DSAPrivateKey'{} = Key) ->
+    DerSignature = public_key:sign(SigData, Hash, Key),
+    #'Dss-Sig-Value'{r = R, s = S} = public_key:der_decode('Dss-Sig-Value', DerSignature),
+    <<R:160/big-unsigned-integer, S:160/big-unsigned-integer>>;
+sign(SigData, Hash, Key) ->
+    public_key:sign(SigData, Hash, Key).
 
-%% Send a disconnect message
-%% terminate(S, SSH, Code, Message) ->
-%%     M = #ssh_msg_disconnect{code=Code, 
-%% 			    description = Message,
-%% 			    language = "en"},
-%%     send_msg(S, SSH, M),
-%%     gen_tcp:close(S),
-%%     {error, M}.
+verify(PlainText, Hash, Sig, {_,  #'Dss-Parms'{}} = Key) ->
+    <<R:160/big-unsigned-integer, S:160/big-unsigned-integer>> = Sig,
+    Signature = public_key:der_encode('Dss-Sig-Value', #'Dss-Sig-Value'{r = R, s = S}),
+    public_key:verify(PlainText, Hash, Signature, Key);
+verify(PlainText, Hash, Sig, Key) ->
+    public_key:verify(PlainText, Hash, Sig, Key).
 
-   
 %% public key algorithms
 %%
 %%   ssh-dss              REQUIRED     sign    Raw DSS Key
@@ -761,9 +724,6 @@ msg_data(PacketData) ->
 %%
 %%
 
-    
-
-
 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
 %% Encryption
 %%
@@ -833,19 +793,13 @@ encrypt(#ssh{encrypt = none} = Ssh, Data) ->
 encrypt(#ssh{encrypt = '3des-cbc',
 	     encrypt_keys = {K1,K2,K3},
 	     encrypt_ctx = IV0} = Ssh, Data) ->
-    %%?dbg(?DBG_CRYPTO, "encrypt: IV=~p K1=~p, K2=~p, K3=~p ~n",
-    %%	 [IV0,K1,K2,K3]),
     Enc = crypto:des3_cbc_encrypt(K1,K2,K3,IV0,Data),
-    %%?dbg(?DBG_CRYPTO, "encrypt: ~p -> ~p ~n", [Data, Enc]),
     IV = crypto:des_cbc_ivec(Enc),
     {Ssh#ssh{encrypt_ctx = IV}, Enc};
 encrypt(#ssh{encrypt = 'aes128-cbc',
             encrypt_keys = K,
             encrypt_ctx = IV0} = Ssh, Data) ->
-    %%?dbg(?DBG_CRYPTO, "encrypt: IV=~p K=~p ~n",
-    %%     [IV0,K]),
     Enc = crypto:aes_cbc_128_encrypt(K,IV0,Data),
-    %%?dbg(?DBG_CRYPTO, "encrypt: ~p -> ~p ~n", [Data, Enc]),
     IV = crypto:aes_cbc_ivec(Enc),
     {Ssh#ssh{encrypt_ctx = IV}, Enc}.
   
@@ -893,18 +847,12 @@ decrypt(#ssh{decrypt = none} = Ssh, Data) ->
 decrypt(#ssh{decrypt = '3des-cbc', decrypt_keys = Keys,
 	     decrypt_ctx = IV0} = Ssh, Data) ->
     {K1, K2, K3} = Keys,
-    %%?dbg(?DBG_CRYPTO, "decrypt: IV=~p K1=~p, K2=~p, K3=~p ~n",
-    %%[IV0,K1,K2,K3]),
     Dec = crypto:des3_cbc_decrypt(K1,K2,K3,IV0,Data),
-    %%?dbg(?DBG_CRYPTO, "decrypt: ~p -> ~p ~n", [Data, Dec]),
     IV = crypto:des_cbc_ivec(Data),
     {Ssh#ssh{decrypt_ctx = IV}, Dec};
 decrypt(#ssh{decrypt = 'aes128-cbc', decrypt_keys = Key,
 	     decrypt_ctx = IV0} = Ssh, Data) ->
-    %%?dbg(?DBG_CRYPTO, "decrypt: IV=~p Key=~p ~n",
-    %%     [IV0,Key]),
     Dec = crypto:aes_cbc_128_decrypt(Key,IV0,Data),
-    %%?dbg(?DBG_CRYPTO, "decrypt: ~p -> ~p ~n", [Data, Dec]),
     IV = crypto:aes_cbc_ivec(Data),
     {Ssh#ssh{decrypt_ctx = IV}, Dec}.
 
@@ -936,7 +884,6 @@ compress(#ssh{compress = none} = Ssh, Data) ->
     {Ssh, Data};
 compress(#ssh{compress = zlib, compress_ctx = Context} = Ssh, Data) ->
     Compressed = zlib:deflate(Context, Data, sync),
-    %%?dbg(?DBG_ZLIB, "deflate: ~p -> ~p ~n", [Data, Compressed]),
     {Ssh, list_to_binary(Compressed)}.
 
 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
@@ -960,7 +907,6 @@ decompress(#ssh{decompress = none} = Ssh, Data) ->
     {Ssh, Data};
 decompress(#ssh{decompress = zlib, decompress_ctx = Context} = Ssh, Data) ->
     Decompressed = zlib:inflate(Context, Data),
-    %%?dbg(?DBG_ZLIB, "inflate: ~p -> ~p ~n", [Data, Decompressed]),
     {Ssh, list_to_binary(Decompressed)}.
 
 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
@@ -1039,7 +985,6 @@ hash(SSH, Char, N, HASH) ->
     K1 = HASH([K, H, Char, SessionID]),
     Sz = N div 8,
     <<Key:Sz/binary, _/binary>> = hash(K, H, K1, N-128, HASH),
-    %%?dbg(?DBG_KEX, "Key ~s: ~s ~n", [Char, fmt_binary(Key, 16, 4)]),
     Key.
 
 hash(_K, _H, Ki, N, _HASH) when N =< 0 ->
@@ -1055,6 +1000,7 @@ kex_h(SSH, K_S, E, F, K) ->
 			[string,string,binary,binary,binary,
 			 mpint,mpint,mpint]),
     crypto:sha(L).
+ 
 
 kex_h(SSH, K_S, Min, NBits, Max, Prime, Gen, E, F, K) ->
     L = if Min==-1; Max==-1 ->
@@ -1075,7 +1021,7 @@ kex_h(SSH, K_S, Min, NBits, Max, Prime, Gen, E, F, K) ->
 				 Prime, Gen, E,F,K], Ts)
 	end,
     crypto:sha(L).
-    
+  
 mac_key_size('hmac-sha1')    -> 20*8;
 mac_key_size('hmac-sha1-96') -> 20*8;
 mac_key_size('hmac-md5')     -> 16*8;
@@ -1105,9 +1051,6 @@ dh_gen_key(G, P, _Bits) ->
     Public = ssh_math:ipow(G, Private, P),
     {Private,Public}.
 
-%% trim(Str) ->
-%%     lists:reverse(trim_head(lists:reverse(trim_head(Str)))).
-
 trim_tail(Str) ->
     lists:reverse(trim_head(lists:reverse(Str))).
 
@@ -1116,48 +1059,3 @@ trim_head([$\t|Cs]) -> trim_head(Cs);
 trim_head([$\n|Cs]) -> trim_head(Cs);
 trim_head([$\r|Cs]) -> trim_head(Cs);
 trim_head(Cs) -> Cs.
-
-%% Retrieve session_id from ssh, needed by public-key auth
-%get_session_id(SSH) ->
-%    {ok, SessionID} = call(SSH, get_session_id),
-    
-%% DEBUG utils
-%% Format integers and binaries as hex blocks
-%%
-%% -ifdef(debug).
-%% fmt_binary(B, BlockSize, GroupSize) ->
-%%     fmt_block(fmt_bin(B), BlockSize, GroupSize).
-
-%% fmt_block(Bin, BlockSize, GroupSize) ->
-%%     fmt_block(Bin, BlockSize, 0, GroupSize).
-    
-
-%% fmt_block(Bin, 0, _I, _G) ->
-%%     binary_to_list(Bin);
-%% fmt_block(Bin, Sz, G, G) when G =/= 0 ->
-%%     ["~n#" | fmt_block(Bin, Sz, 0, G)];
-%% fmt_block(Bin, Sz, I, G) ->
-%%     case Bin of
-%% 	<<Block:Sz/binary, Tail/binary>> ->
-%% 	    if Tail == <<>> ->
-%% 		    [binary_to_list(Block)];
-%% 	       true ->
-%% 		    [binary_to_list(Block), " " | fmt_block(Tail, Sz, I+1, G)]
-%% 	    end;
-%% 	<<>> ->
-%% 	    [];
-%% 	_ -> 
-%% 	    [binary_to_list(Bin)]
-%%     end.
-
-%% %% Format integer or binary as hex
-%% fmt_bin(X) when integer(X) ->
-%%     list_to_binary(io_lib:format("~p", [X]));
-%% fmt_bin(X) when binary(X) ->
-%%     Sz = size(X)*8,
-%%     <<Y:Sz/unsigned-big>> = X,
-%%     %%Fmt = "~"++integer_to_list(size(X)*2)++"~p",
-%%     list_to_binary(io_lib:format("~p", [Y])).
-
-%% -endif.
-