Merge ~cjwatson/lazr.sshserver:rsa-sha2 into lazr.sshserver:main

[Colin Watson]

Add support for RSA keys with SHA-2 signatures

This parallels a change in https://github.com/twisted/twisted/pull/1692, and requires a version of Twisted with that PR in order to actually provide this support (although it will still work as before with older versions of Twisted).

[Ioana Lasc (ilasc)]

review: Approve

diff --git a/NEWS.txt b/NEWS.txt
index 821a9cc..32da7e1 100644
--- a/NEWS.txt
+++ b/NEWS.txt
@@ -10,6 +10,8 @@ NEWS for lazr.sshserver
 - Apply black code formatter.
 - Add isort pre-commit hook.
 - Apply inclusive naming via the woke pre-commit hook.
+- Add support for RSA keys with SHA-2 signatures (given corresponding
+  Twisted support).
 
 0.1.12 (2021-09-13)
 ===================
diff --git a/src/lazr/sshserver/auth.py b/src/lazr/sshserver/auth.py
index 3d88930..f0dee0e 100644
--- a/src/lazr/sshserver/auth.py
+++ b/src/lazr/sshserver/auth.py
@@ -273,7 +273,7 @@ class SSHUserAuthServer(userauth.SSHUserAuthServer):
             # Work around a bug in paramiko < 2.0.0: if the most significant
             # byte of an RSA signature is zero, then it strips leading zero
             # bytes rather than zero-padding it to the correct length.
-            if algName == b"ssh-rsa":
+            if algName in (b"ssh-rsa", b"rsa-sha2-256", b"rsa-sha2-512"):
                 signatureType, rawSignature, rest = getNS(signature, 2)
                 pubKeyLen = (pubKey.size() + 7) // 8
                 if len(rawSignature) < pubKeyLen:
@@ -289,7 +289,7 @@ class SSHUserAuthServer(userauth.SSHUserAuthServer):
                 + NS(self.nextService)
                 + NS(b"publickey")
                 + _bytesChr(hasSig)
-                + NS(pubKey.sshType())
+                + NS(algName)
                 + NS(blob)
             )
             # The next three lines are different from the original.
@@ -366,7 +366,8 @@ class PublicKeyFromLaunchpadChecker:
         """Check the key data in credentials against the keys found in LP."""
         if credentials.algName == b"ssh-dss":
             wantKeyType = "DSA"
-        elif credentials.algName == b"ssh-rsa":
+        elif credentials.algName in (
+                b"ssh-rsa", b"rsa-sha2-256", b"rsa-sha2-512"):
             wantKeyType = "RSA"
         elif credentials.algName.startswith(b"ecdsa-sha2-"):
             wantKeyType = "ECDSA"