ssh: add aes192-cbc and aes256-cbc cipher modes

Some legacy devices only offer AES-256 in CBC mode, which the package
did not implement. Register both the 192-bit and 256-bit variants of
the existing AES-CBC packet cipher so they can be enabled through a
custom Config. aes.NewCipher already handles 24- and 32-byte keys, so
both registrations reuse the existing implementation.

ssh/cipher.go

@@ -129,6 +129,10 @@ func init() {
 	// You should expect that an active attacker can recover plaintext if
 	// you do.
 	cipherModes[InsecureCipherAES128CBC] = &cipherMode{16, aes.BlockSize, newAESCBCCipher}
+	// AES-192 and AES-256 reuse the same CBC packet cipher; aes.NewCipher
+	// selects the key schedule from the key length.
+	cipherModes[InsecureCipherAES192CBC] = &cipherMode{24, aes.BlockSize, newAESCBCCipher}
+	cipherModes[InsecureCipherAES256CBC] = &cipherMode{32, aes.BlockSize, newAESCBCCipher}
 	cipherModes[InsecureCipherTripleDESCBC] = &cipherMode{24, des.BlockSize, newTripleDESCBCCipher}
 }
 

ssh/common.go

@@ -37,6 +37,8 @@ const (
 	CipherAES192CTR            = "aes192-ctr"
 	CipherAES256CTR            = "aes256-ctr"
 	InsecureCipherAES128CBC    = "aes128-cbc"
+	InsecureCipherAES192CBC    = "aes192-cbc"
+	InsecureCipherAES256CBC    = "aes256-cbc"
 	InsecureCipherTripleDESCBC = "3des-cbc"
 	InsecureCipherRC4          = "arcfour"
 	InsecureCipherRC4128       = "arcfour128"
@@ -128,6 +130,8 @@ var (
 	// package and which have security issues.
 	insecureCiphers = []string{
 		InsecureCipherAES128CBC,
+		InsecureCipherAES192CBC,
+		InsecureCipherAES256CBC,
 		InsecureCipherTripleDESCBC,
 		InsecureCipherRC4256,
 		InsecureCipherRC4128,
@@ -437,7 +441,7 @@ func (a *DirectionAlgorithms) rekeyBytes() int64 {
 	// 2^(BLOCKSIZE/4) blocks. For all AES flavors BLOCKSIZE is
 	// 128.
 	switch a.Cipher {
-	case CipherAES128CTR, CipherAES192CTR, CipherAES256CTR, CipherAES128GCM, CipherAES256GCM, InsecureCipherAES128CBC:
+	case CipherAES128CTR, CipherAES192CTR, CipherAES256CTR, CipherAES128GCM, CipherAES256GCM, InsecureCipherAES128CBC, InsecureCipherAES192CBC, InsecureCipherAES256CBC:
 		return 16 * (1 << 32)
 
 	}