From c9769b3609e90a738d64731e494c598479c82e77 Mon Sep 17 00:00:00 2001
From: Daniel Lenski <daniel.lenski@sandboxaq.com>
Date: Fri, 28 Jun 2024 17:29:35 -0700
Subject: [PATCH] Recognize LANcom LCOS software and support extraction of
 ssh-ed448 key type

LANcom router devices appear to be primarily used in Germany (see [1]
for examples on the public Internet), and they appear to support the
`ssh-ed448` key type which is documented in [2], but which has never
been supported by any as-yet-released version of OpenSSH.

[1] https://www.shodan.io/search?query=ssh+%22ed448%22
[2] https://datatracker.ietf.org/doc/html/rfc8709#name-public-key-format
---
 src/ssh_audit/hostkeytest.py | 3 +++
 src/ssh_audit/kexdh.py       | 3 +++
 src/ssh_audit/software.py    | 4 ++++
 3 files changed, 10 insertions(+)

diff --git a/src/ssh_audit/hostkeytest.py b/src/ssh_audit/hostkeytest.py
index b4dfe0b..2f91ac2 100644
--- a/src/ssh_audit/hostkeytest.py
+++ b/src/ssh_audit/hostkeytest.py
@@ -52,6 +52,9 @@ class HostKeyTest:
 
         'ssh-ed25519':                      {'cert': False, 'variable_key_len': False},
         'ssh-ed25519-cert-v01@openssh.com': {'cert': True, 'variable_key_len': False},
+
+        'ssh-ed448':                      {'cert': False, 'variable_key_len': False},
+        # 'ssh-ed448-cert-v01@openssh.com': {'cert': True,  'variable_key_len': False},
     }
 
     TWO2K_MODULUS_WARNING = '2048-bit modulus only provides 112-bits of symmetric strength'
diff --git a/src/ssh_audit/kexdh.py b/src/ssh_audit/kexdh.py
index 85beb8e..7335334 100644
--- a/src/ssh_audit/kexdh.py
+++ b/src/ssh_audit/kexdh.py
@@ -134,6 +134,9 @@ class KexDH:  # pragma: nocover
         if self.__hostkey_type == 'ssh-ed25519':
             self.out.d("%s has a fixed host key modulus of 32." % self.__hostkey_type)
             self.__hostkey_n_len = 32
+        elif self.__hostkey_type == 'ssh-ed448':
+            self.out.d("%s has a fixed host key modulus of 57." % self.__hostkey_type)
+            self.__hostkey_n_len = 57
         else:
             # Here is the modulus size & actual modulus of the host key public key.
             hostkey_n, self.__hostkey_n_len, ptr = KexDH.__get_bytes(hostkey, ptr)
diff --git a/src/ssh_audit/software.py b/src/ssh_audit/software.py
index f13ebeb..21e22ca 100644
--- a/src/ssh_audit/software.py
+++ b/src/ssh_audit/software.py
@@ -224,4 +224,8 @@ class Software:
         mx = re.match(r'^PuTTY_Release_(.*)', software)
         if mx:
             return cls(None, Product.PuTTY, mx.group(1), None, None)
+        mx = re.match(r'^lancom(.*)', software)
+        if mx:
+            v, p = 'LANcom', 'LCOS sshd'
+            return cls(v, p, mx.group(1), None, None)
         return None