net-ssh 7.2.0 → 8.0.0

data/README.md

@@ -28,67 +28,75 @@ It allows you to write programs that invoke and interact with processes on remot
 
 ## Supported Algorithms
 
-Net::SSH 6.0 disables by default the usage of weak algorithms.
-We strongly recommend that you install a servers's version that supports the latest algorithms.
+Net::SSH only offers secure algorithms by default.
+We strongly recommend that you install a server version that supports the latest algorithms.
 
-It is possible to return to the previous behavior by adding the option : `append_all_supported_algorithms: true`
-
-Unsecure algoritms will definitely be removed in Net::SSH 8.*.
+Weak algorithms are still supported as opt-ins, so legacy servers such as embedded routers and old network gear stay reachable. To enable one, prefix it with `+` in the matching option, e.g. `encryption: '+aes256-cbc'`, `hmac: '+hmac-sha1-96'`, `kex: '+diffie-hellman-group1-sha1'`, `host_key: '+ssh-dss'`, or in ssh_config with `Ciphers`, `MACs`, `KexAlgorithms`, `HostKeyAlgorithms` and `PubkeyAcceptedAlgorithms` (e.g. `Ciphers +aes256-cbc`). Passing `append_all_supported_algorithms: true` appends every supported algorithm except the `none` cipher and MAC, which are only used when named explicitly (e.g. `encryption: '+none'`, `hmac: '+none'`).
 
 ### Host Keys
 
-| Name                 | Support               | Details  |
-|----------------------|-----------------------|----------|
-| ssh-rsa              | OK                    |          |
-| ssh-ed25519          | OK                    | Require the gem `ed25519` |
-| ecdsa-sha2-nistp521  | OK                    | [using weak elliptic curves](https://safecurves.cr.yp.to/) |
-| ecdsa-sha2-nistp384  | OK                    | [using weak elliptic curves](https://safecurves.cr.yp.to/) |
-| ecdsa-sha2-nistp256  | OK                    | [using weak elliptic curves](https://safecurves.cr.yp.to/) |
-| ssh-dss              | Deprecated in 6.0     | unsecure, will be removed in 8.0 |
+| Name                                     | Support                | Details  |
+|------------------------------------------|------------------------|----------|
+| ssh-ed25519                              | OK                     | Backed by Ruby OpenSSL raw Ed25519 APIs (`openssl >= 3.2.0`) |
+| ssh-ed25519-cert-v01@openssh.com         | OK                     | Backed by Ruby OpenSSL raw Ed25519 APIs (`openssl >= 3.2.0`) |
+| ecdsa-sha2-nistp521/384/256              | OK                     | [using weak elliptic curves](https://safecurves.cr.yp.to/) |
+| ecdsa-sha2-nistp521/384/256-cert-v01@openssh.com | OK             | [using weak elliptic curves](https://safecurves.cr.yp.to/) |
+| rsa-sha2-512                             | OK                     |          |
+| rsa-sha2-256                             | OK                     |          |
+| ssh-rsa                                  | Not offered by default | SHA-1 signatures, off by default as in OpenSSH 8.8; opt-in for legacy servers with `HostKeyAlgorithms +ssh-rsa` or `host_key: '+ssh-rsa'` |
+| ssh-rsa-cert-v01@openssh.com             | Not offered by default | SHA-1 signatures; opt-in for legacy servers |
+| ssh-rsa-cert-v00@openssh.com             | Deprecated             | not offered by default, warns when used and will be removed; net-ssh cannot parse v00 certificates, use ssh-rsa-cert-v01@openssh.com or a modern key type |
+| ssh-dss                                  | Not offered by default | unsecure, off by default as in OpenSSH 7.0; opt-in for legacy servers |
+
+RSA public key authentication likewise uses rsa-sha2-512 or rsa-sha2-256 by default; ssh-rsa and ssh-dss keys are only offered when enabled, e.g. with `PubkeyAcceptedAlgorithms +ssh-rsa` or `pubkey_algorithms: %w[+ssh-rsa]`.
 
 ### Key Exchange
 
-| Name                                 | Support               | Details  |
-|--------------------------------------|-----------------------|----------|
-| curve25519-sha256                    | OK                    | Require the gem `x25519` |
-| ecdh-sha2-nistp521                   | OK                    | [using weak elliptic curves](https://safecurves.cr.yp.to/) |
-| ecdh-sha2-nistp384                   | OK                    | [using weak elliptic curves](https://safecurves.cr.yp.to/) |
-| ecdh-sha2-nistp256                   | OK                    | [using weak elliptic curves](https://safecurves.cr.yp.to/) |
-| diffie-hellman-group1-sha1           | Deprecated in 6.0     | unsecure, will be removed in 8.0 |
-| diffie-hellman-group14-sha1          | OK                    |          |
-| diffie-hellman-group-exchange-sha1   | Deprecated in 6.0     | unsecure, will be removed in 8.0 |
-| diffie-hellman-group-exchange-sha256 | OK                    |          |
+| Name                                 | Support                | Details  |
+|--------------------------------------|------------------------|----------|
+| curve25519-sha256                    | OK                     | Backed by Ruby OpenSSL raw X25519 APIs (`openssl >= 3.2.0`) |
+| curve25519-sha256@libssh.org         | OK                     | Backed by Ruby OpenSSL raw X25519 APIs (`openssl >= 3.2.0`) |
+| ecdh-sha2-nistp521                   | OK                     | [using weak elliptic curves](https://safecurves.cr.yp.to/) |
+| ecdh-sha2-nistp384                   | OK                     | [using weak elliptic curves](https://safecurves.cr.yp.to/) |
+| ecdh-sha2-nistp256                   | OK                     | [using weak elliptic curves](https://safecurves.cr.yp.to/) |
+| diffie-hellman-group-exchange-sha256 | OK                     |          |
+| diffie-hellman-group14-sha256        | OK                     |          |
+| diffie-hellman-group14-sha1          | Not offered by default | SHA-1, off by default as in OpenSSH 8.2; opt-in for legacy servers with `KexAlgorithms +diffie-hellman-group14-sha1` or `kex: '+diffie-hellman-group14-sha1'` |
+| diffie-hellman-group-exchange-sha1   | Not offered by default | unsecure; opt-in for legacy servers |
+| diffie-hellman-group1-sha1           | Not offered by default | unsecure; opt-in for legacy servers |
 
 ### Encryption algorithms (ciphers)
 
-| Name                                 | Support               | Details  |
-|--------------------------------------|-----------------------|----------|
-| aes256-ctr / aes192-ctr / aes128-ctr | OK                    |          |
-| chacha20-poly1305@openssh.com        | OK.                   | Requires the gem `rbnacl` |
-| aes256-cbc / aes192-cbc / aes128-cbc | Deprecated in 6.0     | unsecure, will be removed in 8.0 |
-| rijndael-cbc@lysator.liu.se          | Deprecated in 6.0     | unsecure, will be removed in 8.0 |
-| blowfish-ctr blowfish-cbc            | Deprecated in 6.0     | unsecure, will be removed in 8.0 |
-| cast128-ctr cast128-cbc              | Deprecated in 6.0     | unsecure, will be removed in 8.0 |
-| 3des-ctr 3des-cbc                    | Deprecated in 6.0     | unsecure, will be removed in 8.0 |
-| idea-cbc                             | Deprecated in 6.0     | unsecure, will be removed in 8.0 |
-| none                                 | Deprecated in 6.0     | unsecure, will be removed in 8.0 |
+| Name                                    | Support                | Details  |
+|-----------------------------------------|------------------------|----------|
+| chacha20-poly1305@openssh.com           | OK                     | Backed by Ruby OpenSSL ChaCha20 and Poly1305 APIs (`openssl >= 3.2.0`) |
+| aes256-ctr / aes192-ctr / aes128-ctr    | OK                     |          |
+| aes256-gcm@openssh.com / aes128-gcm@openssh.com | OK              |          |
+| aes256-cbc / aes192-cbc / aes128-cbc    | Not offered by default | unsecure; opt-in for legacy servers |
+| rijndael-cbc@lysator.liu.se             | Not offered by default | unsecure; opt-in for legacy servers |
+| blowfish-ctr blowfish-cbc               | Not offered by default | unsecure; opt-in for legacy servers |
+| cast128-ctr cast128-cbc                 | Not offered by default | unsecure; opt-in for legacy servers |
+| 3des-ctr 3des-cbc                       | Not offered by default | unsecure; opt-in for legacy servers |
+| idea-cbc                                | Not offered by default | unsecure; opt-in for legacy servers |
+| none                                    | Not offered by default | no encryption; only used when named explicitly, not added by `append_all_supported_algorithms` |
 
 ### Message Authentication Code algorithms
 
-| Name                 | Support               | Details  |
-|----------------------|-----------------------|----------|
-| hmac-sha2-512-etm    | OK                    |          |
-| hmac-sha2-256-etm    | OK                    |          |
-| hmac-sha2-512        | OK                    |          |
-| hmac-sha2-256        | OK                    |          |
-| hmac-sha2-512-96     | Deprecated in 6.0     | removed from the specification, will be removed in 8.0 |
-| hmac-sha2-256-96     | Deprecated in 6.0     | removed from the specification, will be removed in 8.0 |
-| hmac-sha1            | OK                    | for backward compatibility      |
-| hmac-sha1-96         | Deprecated in 6.0     | unsecure, will be removed in 8.0 |
-| hmac-ripemd160       | Deprecated in 6.0     | unsecure, will be removed in 8.0 |
-| hmac-md5             | Deprecated in 6.0     | unsecure, will be removed in 8.0 |
-| hmac-md5-96          | Deprecated in 6.0     | unsecure, will be removed in 8.0 |
-| none                 | Deprecated in 6.0     | unsecure, will be removed in 8.0 |
+| Name                          | Support                | Details  |
+|-------------------------------|------------------------|----------|
+| hmac-sha2-512-etm@openssh.com | OK                     |          |
+| hmac-sha2-256-etm@openssh.com | OK                     |          |
+| hmac-sha1-etm@openssh.com     | OK                     | for backward compatibility |
+| hmac-sha2-512                 | OK                     |          |
+| hmac-sha2-256                 | OK                     |          |
+| hmac-sha1                     | OK                     | for backward compatibility |
+| hmac-sha2-512-96              | Not offered by default | removed from the specification; opt-in for legacy servers |
+| hmac-sha2-256-96              | Not offered by default | removed from the specification; opt-in for legacy servers |
+| hmac-sha1-96                  | Not offered by default | unsecure; opt-in for legacy servers |
+| hmac-ripemd160 / hmac-ripemd160@openssh.com | Not offered by default | unsecure; opt-in for legacy servers |
+| hmac-md5                      | Not offered by default | unsecure; opt-in for legacy servers |
+| hmac-md5-96                   | Not offered by default | unsecure; opt-in for legacy servers |
+| none                          | Not offered by default | no integrity protection; only used when named explicitly, not added by `append_all_supported_algorithms` |
 
 ## SYNOPSIS:
 
@@ -148,16 +156,16 @@ See Net::SSH for more documentation, and links to further information.
 
 ## REQUIREMENTS:
 
-The only requirement you might be missing is the OpenSSL bindings for Ruby with a version greather than `1.0.1`.
-These are built by default on most platforms, but you can verify that they're built and installed on your system by running the following command line:
+Net::SSH requires Ruby 2.7 or newer and the Ruby `openssl` gem version `3.2.0` or newer.
+The `openssl` gem uses the OpenSSL library Ruby is built against. You can verify the loaded gem and library with:
 
 ```sh
-ruby -ropenssl -e 'puts OpenSSL::OPENSSL_VERSION'
+ruby -ropenssl -e 'puts OpenSSL::VERSION; puts OpenSSL::OPENSSL_VERSION'
 ```
 
-If that spits out something like `OpenSSL 1.0.1 14 Mar 2012`, then you're set.
-If you get an error, then you'll need to see about rebuilding ruby with OpenSSL support,
-or (if your platform supports it) installing the OpenSSL bindings separately.
+If `openssl` cannot be required, rebuild Ruby with OpenSSL support or install the Ruby `openssl` gem separately.
+
+Ed25519, curve25519-sha256, and chacha20-poly1305@openssh.com support also require an OpenSSL backend with Ed25519, X25519, ChaCha20, and Poly1305 enabled.
 
 ## INSTALL:
 
@@ -188,14 +196,16 @@ gem install net-ssh -P HighSecurity
 If you don't add the public key, you'll see an error like "Couldn't verify data signature".
 If you're still having trouble let me know and I'll give you a hand.
 
-For ed25519 public key auth support your bundle file should contain `ed25519`, `bcrypt_pbkdf` dependencies.
+Ed25519 public key auth is backed by Ruby OpenSSL. The `bcrypt_pbkdf` gem is only needed when loading bcrypt-encrypted OpenSSH private keys.
 
 ```sh
-gem install ed25519
 gem install bcrypt_pbkdf
 ```
 
-For curve25519-sha256 kex exchange support your bundle file should contain `x25519` dependency.
+### FIDO/U2F security keys
+
+`sk-ecdsa-sha2-nistp256@openssh.com` and `sk-ssh-ed25519@openssh.com` keys work when held in `ssh-agent`.
+Loading `sk-*` private key files from disk is not supported.
 
 ## RUBY SUPPORT
 
@@ -248,6 +258,12 @@ mv gem-public_cert.pem net-ssh-public_cert.pem
 gem cert --add net-ssh-public_cert.pem
 ```
 
+or `rake cert:update_public_when_expired`
+
+## CONTRIBUTING
+
+See [CONTRIBUTING.md](CONTRIBUTING.md), including how to add a changelog entry.
+
 ## Security contact information
 
 See [SECURITY.md](SECURITY.md)
@@ -272,6 +288,9 @@ Support this project by becoming a sponsor. Your logo will show up here with a l
 
 [![Sponsor](https://opencollective.com/net-ssh/sponsor/0/avatar.svg)](https://opencollective.com/net-ssh/sponsor/0/website)
 
+[<img src="https://github.com/net-ssh/net-ssh/assets/52435/9690bf3e-34ea-4c52-8aea-1cc4cb5bcb6d" width="320">](https://ubicloud.com)
+
+
 ## LICENSE:
 
 (The MIT License)

data/Rakefile

@@ -9,7 +9,11 @@ require "rake"
 require "rake/clean"
 require "bundler/gem_tasks"
 
-require "rdoc/task"
+begin
+  require "rdoc/task"
+rescue LoadError
+  # rdoc is no longer a default gem as of Ruby 4.0; the rest of the Rakefile works without it.
+end
 
 desc "When releasing make sure NET_SSH_BUILDGEM_SIGNED is set"
 task :check_NET_SSH_BUILDGEM_SIGNED do
@@ -24,20 +28,23 @@ CLEAN.include ['pkg', 'rdoc']
 name = "net-ssh"
 
 require_relative "lib/net/ssh/version"
+require_relative "rakelib/changelog"
 version = Net::SSH::Version::CURRENT
 
 extra_files = %w[LICENSE.txt THANKS.txt CHANGES.txt]
-RDoc::Task.new do |rdoc|
-  rdoc.rdoc_dir = "rdoc"
-  rdoc.title = "#{name} #{version}"
-  rdoc.generator = 'hanna' # gem install hanna-nouveau
-  rdoc.main = 'README.md'
-  rdoc.rdoc_files.include("README*")
-  rdoc.rdoc_files.include("bin/*.rb")
-  rdoc.rdoc_files.include("lib/**/*.rb")
-  extra_files.each { |file|
-    rdoc.rdoc_files.include(file) if File.exist?(file)
-  }
+if defined?(RDoc::Task)
+  RDoc::Task.new do |rdoc|
+    rdoc.rdoc_dir = "rdoc"
+    rdoc.title = "#{name} #{version}"
+    rdoc.generator = 'hanna' # gem install hanna-nouveau
+    rdoc.main = 'README.md'
+    rdoc.rdoc_files.include("README*")
+    rdoc.rdoc_files.include("bin/*.rb")
+    rdoc.rdoc_files.include("lib/**/*.rb")
+    extra_files.each { |file|
+      rdoc.rdoc_files.include(file) if File.exist?(file)
+    }
+  end
 end
 
 namespace :cert do
@@ -59,30 +66,58 @@ def change_version(&block)
   version_file = 'lib/net/ssh/version.rb'
   require_relative version_file
   pre = Net::SSH::Version::PRE
-  result = block[pre: pre]
-  raise "Version change logic should always return a pre", ArgumentError unless result.key?(:pre)
+  tiny = Net::SSH::Version::TINY
+  result = block[pre: pre, tiny: Net::SSH::Version::TINY]
+  raise ArgumentError, "Version change logic should always return a pre" unless result.key?(:pre)
 
   new_pre = result[:pre]
-  found = false
+  new_tiny = result[:tiny] || tiny
+  found = { pre: false, tiny: false }
   File.open("#{version_file}.new", "w") do |f|
     File.readlines(version_file).each do |line|
-      match = /^(\s+PRE\s+=\s+")#{pre}("\s*)$/.match(line)
+      match =
+        if pre.nil?
+          /^(\s+PRE\s+=\s+)nil(\s*)$/.match(line)
+        else
+          /^(\s+PRE\s+=\s+")#{pre}("\s*)$/.match(line)
+        end
       if match
         prefix = match[1]
         postfix = match[2]
-        if new_pre.nil?
-          prefix.delete_suffix!('"')
-          postfix.delete_prefix!('"')
-        end
+        prefix.delete_suffix!('"')
+        postfix.delete_prefix!('"')
         new_line = "#{prefix}#{new_pre.inspect}#{postfix}"
         puts "Changing:\n  - #{line}  + #{new_line}"
         line = new_line
-        found = true
+        found[:pre] = true
+      end
+
+      if new_tiny != tiny
+        match = /^(\s+TINY\s+=\s+)#{tiny}(\s*)$/.match(line)
+        if match
+          prefix = match[1]
+          postfix = match[2]
+          new_line = "#{prefix}#{new_tiny}#{postfix}"
+          puts "Changing:\n  - #{line}  + #{new_line}"
+          line = new_line
+          found[:tiny] = true
+        end
       end
+
       f.write(line)
     end
-    raise ArugmentError, "Cound not find line: PRE = \"#{pre}\" in #{version_file}" unless found
+    raise ArgumentError, "Cound not find line: PRE = \"#{pre}\" in #{version_file}" unless found[:pre]
+    raise ArgumentError, "Cound not find line: TINY = \"#{tiny}\" in #{version_file}" unless found[:tiny] || new_tiny == tiny
+  end
+
+  begin
+    heading = Changelog.heading(Net::SSH::Version::MAJOR, Net::SSH::Version::MINOR, new_tiny, new_pre)
+    section = Changelog.new(__dir__).release(heading)
+  rescue StandardError
+    FileUtils.rm_f "#{version_file}.new"
+    raise
   end
+  puts section ? "Added to CHANGES.txt:\n#{section}" : "Nothing to release for a pre-release, CHANGES.txt unchanged"
 
   FileUtils.mv version_file, "#{version_file}.old"
   FileUtils.mv "#{version_file}.new", version_file
@@ -91,24 +126,76 @@ end
 namespace :vbump do
   desc "Final release"
   task :final do
-    change_version do |pre:|
-      raise ArgumentError, "Unexpected pre: #{pre}" if pre.nil?
-
-      { pre: nil }
+    change_version do |pre:, tiny:|
+      _ = tiny
+      if pre.nil?
+        { tiny: tiny + 1, pre: nil }
+      else
+        raise ArgumentError, "Unexpected pre: #{pre}" if pre.nil?
+
+        { pre: nil }
+      end
     end
   end
 
   desc "Increment prerelease"
-  task :pre do
-    change_version do |pre:|
+  task :pre, [:type] do |_t, args|
+    change_version do |pre:, tiny:|
+      puts " PRE => #{pre.inspect}"
       match = /^([a-z]+)(\d+)/.match(pre)
-      raise ArgumentError, "Unexpected pre: #{pre}" if match.nil?
+      raise ArgumentError, "Unexpected pre: #{pre}" if match.nil? && args[:type].nil?
 
-      { pre: "#{match[1]}#{match[2].to_i + 1}" }
+      if match.nil? || (!args[:type].nil? && args[:type] != match[1])
+        if pre.nil?
+          { pre: "#{args[:type]}1", tiny: tiny + 1 }
+        else
+          { pre: "#{args[:type]}1" }
+        end
+      else
+        { pre: "#{match[1]}#{match[2].to_i + 1}" }
+      end
     end
   end
 end
 
+namespace :changelog do
+  changelog = Changelog.new(__dir__)
+
+  desc "Validate the fragments in changelog.d/"
+  task :check do
+    count = changelog.check.size
+    puts "#{count} valid changelog fragment#{'s' unless count == 1}"
+  rescue Changelog::Error => e
+    abort e.message
+  end
+
+  desc "Print the CHANGES.txt section the next version bump would write"
+  task :preview, [:heading] do |_t, args|
+    puts changelog.section(args[:heading] || "Unreleased") || "Nothing to release"
+  rescue Changelog::Error => e
+    abort e.message
+  end
+
+  desc "Create a fragment: rake \"changelog:new[1234,change,Text of the entry]\""
+  task :new, [:number, :type] do |_t, args|
+    abort "Usage: rake \"changelog:new[<PR number>,<#{Changelog::TYPES.keys.join('|')}>,<text>]\"" unless args[:number] && args[:type]
+    # Rake splits arguments on commas and strips the spaces around them, so take the text from the raw task string.
+    raw = Rake.application.top_level_tasks.find { |t| t.start_with?("changelog:new[") }
+    text = raw&.[](/\A[^\[]*\[[^,]*,[^,]*,\s*(.*)\]\z/m, 1) || args.extras.join(", ")
+    puts "Created #{changelog.new_fragment(args[:number], args[:type], text)}"
+  rescue Changelog::Error => e
+    abort e.message
+  end
+
+  desc "Write the fragments to CHANGES.txt under a heading, e.g. rake \"changelog:release[7.3.4]\" (vbump does this)"
+  task :release, [:heading] do |_t, args|
+    abort "Usage: rake \"changelog:release[<version heading>]\"" unless args[:heading]
+    puts changelog.release(args[:heading]) || "Nothing to release"
+  rescue Changelog::Error => e
+    abort e.message
+  end
+end
+
 namespace :rdoc do
   desc "Update gh-pages branch"
   task :publish do

data/appveyor.yml

@@ -4,16 +4,9 @@ skip_tags: true
 
 environment:
   matrix:
-    - ruby_version: "jruby-9.1.2.0"
-    - ruby_version: "26-x64"
-    - ruby_version: "25-x64"
-    - ruby_version: "24-x64"
-    - ruby_version: "23"
-    - ruby_version: "23-x64"
-
-matrix:
-  allow_failures:
-    - ruby_version: "jruby-9.1.2.0"
+    - ruby_version: "31-x64"
+    - ruby_version: "30-x64"
+    - ruby_version: "27-x64"
 
 #init:
 #  - ps: iex ((new-object net.webclient).DownloadString('https://raw.githubusercontent.com/appveyor/ci/master/scripts/enable-rdp.ps1'))
@@ -27,12 +20,8 @@ platform:
 
 install:
   - SET PATH=C:\Ruby%ruby_version%\bin;%PATH%
-  - if "%ruby_version%" == "jruby-9.1.2.0" ( cinst javaruntime -i )
-  - if "%ruby_version%" == "jruby-9.1.2.0" ( cinst jruby --version 9.1.2.0 -i --allow-empty-checksums )
-  - if "%ruby_version%" == "jruby-9.1.2.0" ( SET "PATH=C:\jruby-9.1.2.0\bin\;%PATH%" )
   - ruby --version
-  - gem install bundler --no-document --user-install -v 1.17
-  - SET BUNDLE_GEMFILE=Gemfile.noed25519
+  - gem install bundler --no-document --user-install -v 2.4.22
   - bundle install --retry=3
   - cinst freesshd
   - cinst putty --allow-empty-checksums
@@ -51,7 +40,6 @@ install:
           }
 
 test_script:
-  - SET BUNDLE_GEMFILE=Gemfile.noed25519
   - SET NET_SSH_RUN_WIN_INTEGRATION_TESTS=YES
   - bundle exec rake test
 

data/changelog.d/README.md

@@ -0,0 +1 @@
+Changelog fragments: one `<PR number>.<type>.txt` file per user-visible change, assembled into `CHANGES.txt` when the version is bumped. See [CONTRIBUTING.md](../CONTRIBUTING.md#changelog).

data/docker-compose.yml

@@ -1,5 +1,3 @@
-version: '3'
-
 services:
   ruby-3.1:
     build:
@@ -15,9 +13,5 @@ services:
     build:
       context: .
       args: 
-        RUBY_VERSION: 2.7
-  ruby-2.6:
-    build:
-      context: .
-      args: 
-        RUBY_VERSION: 2.6
+        RUBY_VERSION: 2.7.8
+        BUNDLERV: "-v 2.2.28"

data/lib/net/ssh/authentication/agent.rb

@@ -17,6 +17,9 @@ module Net
       # An exception for indicating that the SSH agent is not available.
       class AgentNotAvailable < AgentError; end
 
+      # Raised when the agent closes the connection before replying.
+      class AgentClosedConnection < AgentError; end
+
       # This class implements a simple client for the ssh-agent protocol. It
       # does not implement any specific protocol, but instead copies the
       # behavior of the ssh-agent functions in the OpenSSH library (3.8).
@@ -83,12 +86,18 @@ module Net
         # socket reports that it is an SSH2-compatible agent, this will fail
         # (it only supports the ssh-agent distributed by OpenSSH).
         def connect!(agent_socket_factory = nil, identity_agent = nil)
+          @agent_socket_factory = agent_socket_factory
+          @identity_agent = identity_agent
+          open_agent_socket!
+        end
+
+        def open_agent_socket!
           debug { "connecting to ssh-agent" }
           @socket =
-            if agent_socket_factory
-              agent_socket_factory.call
-            elsif identity_agent
-              unix_socket_class.open(File.expand_path(identity_agent))
+            if @agent_socket_factory
+              @agent_socket_factory.call
+            elsif @identity_agent
+              unix_socket_class.open(File.expand_path(@identity_agent))
             elsif ENV['SSH_AUTH_SOCK'] && unix_socket_class
               unix_socket_class.open(File.expand_path(ENV['SSH_AUTH_SOCK']))
             elsif Gem.win_platform? && RUBY_ENGINE != "jruby"
@@ -100,6 +109,7 @@ module Net
           error { "could not connect to ssh-agent: #{e.message}" }
           raise AgentNotAvailable, $!.message
         end
+        private :open_agent_socket!
 
         # Attempts to negotiate the SSH agent protocol version. Raises an error
         # if the version could not be negotiated successfully.
@@ -114,6 +124,11 @@ module Net
           elsif type != SSH_AGENT_RSA_IDENTITIES_ANSWER1 && type != SSH_AGENT_RSA_IDENTITIES_ANSWER2
             raise AgentNotAvailable, "unknown response from agent: #{type}, #{body.to_s.inspect}"
           end
+        rescue AgentClosedConnection
+          # Agents built on ssh-agent-lib <= 0.6.0 (e.g. older Proton Pass) drop the connection on
+          # this legacy request but handle the rest of the protocol (#1008).
+          debug { "ssh-agent closed the connection on the version request; assuming a modern agent and reconnecting" }
+          open_agent_socket!
         end
 
         # Return an array of all identities (public keys) known to the agent.
@@ -137,7 +152,7 @@ module Net
               key.extend(Comment)
               key.comment = comment_str
               identities.push key
-            rescue NotImplementedError => e
+            rescue Net::SSH::UnsupportedKeyType, NotImplementedError => e
               error { "ignoring unimplemented key:#{e.message} #{comment_str}" }
             end
           end
@@ -223,8 +238,14 @@ module Net
         # tuple consisting of the packet type, and the packet's body (which
         # is returned as a Net::SSH::Buffer).
         def read_packet
-          buffer = Net::SSH::Buffer.new(@socket.read(4))
-          buffer.append(@socket.read(buffer.read_long))
+          header = @socket.read(4)
+          raise AgentClosedConnection, "agent closed the connection" if header.nil?
+
+          buffer = Net::SSH::Buffer.new(header)
+          body = @socket.read(buffer.read_long)
+          raise AgentClosedConnection, "agent closed the connection" if body.nil?
+
+          buffer.append(body)
           type = buffer.read_byte
           debug { "received agent packet #{type} len #{buffer.length - 4}" }
           return type, buffer
@@ -235,6 +256,9 @@ module Net
         def send_and_wait(type, *args)
           send_packet(type, *args)
           read_packet
+        rescue Errno::ECONNRESET, Errno::EPIPE => e
+          # Linux reports an agent that closes with our request unread as a reset, not EOF.
+          raise AgentClosedConnection, "agent closed the connection (#{e.class})"
         end
 
         # Returns +true+ if the parameter indicates a "failure" response from
@@ -261,13 +285,13 @@ module Net
           when /^ecdsa\-sha2\-(\w*)-cert-v01@openssh\.com$/
             Net::SSH::Buffer.from(:string, priv_key.to_blob, :bignum, priv_key.key.private_key).to_s
           when /^ssh-ed25519$/
-            Net::SSH::Buffer.from(:string, priv_key.public_key.verify_key.to_bytes,
-                                  :string, priv_key.sign_key.keypair).to_s
+            Net::SSH::Buffer.from(:string, priv_key.public_key_bytes,
+                                  :string, priv_key.private_key_bytes_for_agent).to_s
           when /^ssh-ed25519-cert-v01@openssh\.com$/
             # Unlike the other certificate types, the public key is included after the certifiate.
             Net::SSH::Buffer.from(:string, priv_key.to_blob,
-                                  :string, priv_key.key.public_key.verify_key.to_bytes,
-                                  :string, priv_key.key.sign_key.keypair).to_s
+                                  :string, priv_key.key.public_key_bytes,
+                                  :string, priv_key.key.private_key_bytes_for_agent).to_s
           when /^ssh-rsa$/
             # `n` and `e` are reversed compared to the ordering in `OpenSSL::PKey::RSA#to_blob`.
             Net::SSH::Buffer.from(:bignum, priv_key.n, :bignum, priv_key.e, :bignum, priv_key.d,