net-ssh 7.2.3 → 7.3.8

data/lib/net/ssh/proxy/jump.rb

@@ -1,3 +1,4 @@
+require 'shellwords'
 require 'uri'
 require 'net/ssh/proxy/command'
 
@@ -34,20 +35,50 @@ module Net
         # We cannot build the ProxyCommand template until we know if the :config
         # option was specified during `Net::SSH.start`.
         def build_proxy_command_equivalent(connection_options = nil)
-          first_jump, extra_jumps = jump_proxies.split(",", 2)
+          raise ArgumentError, "no jump host given" if jump_proxies.empty?
+
           config = connection_options && connection_options[:config]
-          uri = URI.parse("ssh://#{first_jump}")
+          uri, *extra_jumps = jump_proxies.split(",", -1).map { |jump| validate_jump!(jump) }
 
           template = "ssh".dup
-          template << " -l #{uri.user}"    if uri.user
-          template << " -p #{uri.port}"    if uri.port
-          template << " -J #{extra_jumps}" if extra_jumps
-          template << " -F #{config}" if config != true && config
+          template << " -l #{escape(uri.user)}" if uri.user
+          template << " -p #{uri.port}" if uri.port
+          template << " -J #{escape(extra_jumps.map { |jump| jump_spec(jump) }.join(','))}" unless extra_jumps.empty?
+          template << " -F #{Shellwords.escape(config)}" if config != true && config
           template << " -W %h:%p "
-          template << uri.host
+          template << escape(uri.host)
 
           @command_line_template = template
         end
+
+        private
+
+        # Escape for the shell, and double any % so it survives the %h/%p
+        # substitution done on the template in Command#open.
+        def escape(value)
+          Shellwords.escape(value).gsub("%", "%%")
+        end
+
+        # Only [user@]host[:port] is checked, so anything else URI accepts (a path,
+        # query, fragment or password) must be refused before it reaches the shell.
+        def validate_jump!(jump)
+          uri = URI.parse("ssh://#{jump}")
+          raise URI::InvalidURIError if uri.host.to_s.empty? || jump_spec(uri) != jump
+
+          validate_user_name!(uri.user) if uri.user
+          validate_host_name!(uri.host)
+          validate_port!(uri.port) if uri.port
+          uri
+        rescue URI::InvalidURIError
+          raise ArgumentError, "jump host is not [user@]host[:port]: #{jump.inspect}"
+        end
+
+        def jump_spec(uri)
+          spec = uri.host.dup
+          spec.prepend("#{uri.user}@") if uri.user
+          spec << ":#{uri.port}" if uri.port
+          spec
+        end
       end
     end
   end

data/lib/net/ssh/service/forward.rb

@@ -48,9 +48,9 @@ module Net
         # If three arguments are given, it is as if the local bind address is
         # "127.0.0.1", and the rest are applied as above.
         #
-        # To request an ephemeral port on the remote server, provide 0 (zero) for
-        # the port number. In all cases, this method will return the port that
-        # has been assigned.
+        # To request an ephemeral port on the local server, provide 0 (zero) for
+        # the local port number. In all cases, this method will return the port
+        # that has been assigned.
         #
         #   ssh.forward.local(1234, "www.capify.org", 80)
         #   assigned_port = ssh.forward.local("0.0.0.0", 0, "www.capify.org", 80)
@@ -405,6 +405,12 @@ module Net
 
         # The callback used when an auth-agent channel is requested by the server.
         def auth_agent_channel(session, channel, packet)
+          # Like OpenSSH, only relay the local agent when forwarding was requested (GHSA-qpg5-fx6p-8cq3).
+          unless session.options[:forward_agent] || @agent_forwarded
+            error { "server tried agent forwarding, which was not requested; refusing" }
+            raise Net::SSH::ChannelOpenFailed.new(1, "agent forwarding was not requested")
+          end
+
           info { "opening auth-agent channel" }
           channel[:invisible] = true
 

data/lib/net/ssh/test/extensions.rb

@@ -57,8 +57,9 @@ module Net
             return false unless script.next(:first)
 
             if script.next(:first).remote?
-              self.string << script.next.to_s
-              self.pos = pos
+              current_pos = pos
+              self.string = "#{self.string}#{script.next}"
+              self.pos = current_pos
             end
 
             return true

data/lib/net/ssh/test/socket.rb

@@ -22,7 +22,7 @@ module Net
         # connection.
         def initialize
           extend(Net::SSH::Transport::PacketStream)
-          super "SSH-2.0-Test\r\n"
+          super(+"SSH-2.0-Test\r\n")
 
           @script = Script.new
 

data/lib/net/ssh/transport/aes128_gcm.rb

@@ -0,0 +1,40 @@
+require 'net/ssh/transport/hmac/abstract'
+require 'net/ssh/transport/gcm_cipher'
+
+module Net::SSH::Transport
+  ## Implements the aes128-gcm@openssh cipher
+  class AES128_GCM
+    extend ::Net::SSH::Transport::GCMCipher
+
+    ## Implicit HMAC, do need to do anything
+    class ImplicitHMac < ::Net::SSH::Transport::HMAC::Abstract
+      def aead
+        true
+      end
+
+      def key_length
+        16
+      end
+    end
+
+    def implicit_mac
+      ImplicitHMac.new
+    end
+
+    def algo_name
+      'aes-128-gcm'
+    end
+
+    def name
+      'aes128-gcm@openssh.com'
+    end
+
+    #
+    # --- RFC 5647 ---
+    # K_LEN       AES key length                   16 octets
+    #
+    def self.key_length
+      16
+    end
+  end
+end

data/lib/net/ssh/transport/aes256_gcm.rb

@@ -0,0 +1,40 @@
+require 'net/ssh/transport/hmac/abstract'
+require 'net/ssh/transport/gcm_cipher'
+
+module Net::SSH::Transport
+  ## Implements the aes256-gcm@openssh cipher
+  class AES256_GCM
+    extend ::Net::SSH::Transport::GCMCipher
+
+    ## Implicit HMAC, do need to do anything
+    class ImplicitHMac < ::Net::SSH::Transport::HMAC::Abstract
+      def aead
+        true
+      end
+
+      def key_length
+        32
+      end
+    end
+
+    def implicit_mac
+      ImplicitHMac.new
+    end
+
+    def algo_name
+      'aes-256-gcm'
+    end
+
+    def name
+      'aes256-gcm@openssh.com'
+    end
+
+    #
+    # --- RFC 5647 ---
+    # K_LEN       AES key length                   32 octets
+    #
+    def self.key_length
+      32
+    end
+  end
+end

data/lib/net/ssh/transport/algorithms.rb

@@ -44,7 +44,11 @@ module Net
                   diffie-hellman-group14-sha256
                   diffie-hellman-group14-sha1],
 
-          encryption: %w[aes256-ctr aes192-ctr aes128-ctr],
+          encryption: %w[aes256-ctr
+                         aes192-ctr
+                         aes128-ctr
+                         aes256-gcm@openssh.com
+                         aes128-gcm@openssh.com],
 
           hmac: %w[hmac-sha2-512-etm@openssh.com hmac-sha2-256-etm@openssh.com
                    hmac-sha2-512 hmac-sha2-256
@@ -492,6 +496,9 @@ module Net
               HMAC.get(hmac_server, mac_key_server, parameters)
             end
 
+          cipher_client.nonce = iv_client if mac_client.respond_to?(:aead) && mac_client.aead
+          cipher_server.nonce = iv_server if mac_server.respond_to?(:aead) && mac_client.aead
+
           session.configure_client cipher: cipher_client, hmac: mac_client,
                                    compression: normalize_compression_name(compression_client),
                                    compression_level: options[:compression_level],

data/lib/net/ssh/transport/cipher_factory.rb

@@ -1,5 +1,7 @@
 require 'openssl'
 require 'net/ssh/transport/ctr.rb'
+require 'net/ssh/transport/aes128_gcm'
+require 'net/ssh/transport/aes256_gcm'
 require 'net/ssh/transport/key_expander'
 require 'net/ssh/transport/identity_cipher'
 require 'net/ssh/transport/chacha20_poly1305_cipher_loader'
@@ -31,15 +33,15 @@ module Net
           'none' => 'none'
         }
 
-        SSH_TO_CLASS =
+        SSH_TO_CLASS = {
+          'aes256-gcm@openssh.com' => Net::SSH::Transport::AES256_GCM,
+          'aes128-gcm@openssh.com' => Net::SSH::Transport::AES128_GCM
+        }.tap do |hash|
           if Net::SSH::Transport::ChaCha20Poly1305CipherLoader::LOADED
-            {
-              'chacha20-poly1305@openssh.com' => Net::SSH::Transport::ChaCha20Poly1305Cipher
-            }
-          else
-            {
-            }
+            hash['chacha20-poly1305@openssh.com'] =
+              Net::SSH::Transport::ChaCha20Poly1305Cipher
           end
+        end
 
         # Returns true if the underlying OpenSSL library supports the given cipher,
         # and false otherwise.

data/lib/net/ssh/transport/gcm_cipher.rb

@@ -0,0 +1,207 @@
+require 'net/ssh/loggable'
+
+module Net
+  module SSH
+    module Transport
+      ## Extension module for aes(128|256)gcm ciphers
+      module GCMCipher
+        # rubocop:disable Metrics/AbcSize
+        def self.extended(orig)
+          # rubocop:disable Metrics/BlockLength
+          orig.class_eval do
+            include Net::SSH::Loggable
+
+            attr_reader   :cipher
+            attr_reader   :key
+            attr_reader   :nonce
+
+            #
+            # Semantically gcm cipher supplies the OpenSSL iv interface with a nonce
+            #   as it is not randomly generated due to being supplied from a counter.
+            # The RFC's use IV and nonce interchangeably.
+            #
+            def initialize(encrypt:, key:)
+              @cipher = OpenSSL::Cipher.new(algo_name)
+              @key    = key
+              key_len = @cipher.key_len
+              if key.size != key_len
+                error_message = "#{cipher_name}: keylength does not match"
+                error { error_message }
+                raise error_message
+              end
+              encrypt ? @cipher.encrypt : @cipher.decrypt
+              @cipher.key = key
+
+              @nonce = {
+                fixed: nil,
+                invocation_counter: 0
+              }
+            end
+
+            def update_cipher_mac(payload, _sequence_number)
+              #
+              # --- RFC 5647 7.3 ---
+              # When using AES-GCM with secure shell, the packet_length field is to
+              # be treated as additional authenticated data, not as plaintext.
+              #
+              length_data      = [payload.bytesize].pack('N')
+
+              cipher.auth_data = length_data
+
+              encrypted_data   = cipher.update(payload) << cipher.final
+
+              mac              = cipher.auth_tag
+
+              incr_nonce
+              length_data + encrypted_data + mac
+            end
+
+            #
+            # --- RFC 5647 ---
+            # uint32    packet_length;  // 0 <= packet_length < 2^32
+            #
+            def read_length(data, _sequence_number)
+              data.unpack1('N')
+            end
+
+            #
+            # --- RFC 5647 ---
+            # In AES-GCM secure shell, the inputs to the authenticated encryption
+            # are:
+            #  PT (Plain Text)
+            #      byte      padding_length; // 4 <= padding_length < 256
+            #      byte[n1]  payload;        // n1 = packet_length-padding_length-1
+            #      byte[n2]  random_padding; // n2 = padding_length
+            #  AAD (Additional Authenticated Data)
+            #      uint32    packet_length;  // 0 <= packet_length < 2^32
+            #  IV (Initialization Vector)
+            #      As described in section 7.1.
+            #  BK (Block Cipher Key)
+            #      The appropriate Encryption Key formed during the Key Exchange.
+            #
+            def read_and_mac(data, mac, _sequence_number)
+              # The authentication tag will be placed in the MAC field at the end of the packet
+
+              # OpenSSL does not verify auth tag length
+              # GCM mode allows arbitrary sizes for the auth_tag up to 128 bytes and a single
+              #   byte allows authentication to pass. If single byte auth tags are possible
+              #   an attacker would require no more than 256 attempts to forge a valid tag.
+              #
+              raise 'incorrect auth_tag length' unless mac.to_s.length == mac_length
+
+              packet_length    = data.unpack1('N')
+
+              cipher.auth_tag  = mac.to_s
+              cipher.auth_data = [packet_length].pack('N')
+
+              result = cipher.update(data[4...]) << cipher.final
+              incr_nonce
+              result
+            end
+
+            def mac_length
+              16
+            end
+
+            def block_size
+              16
+            end
+
+            def self.block_size
+              16
+            end
+
+            #
+            # --- RFC 5647 ---
+            # N_MIN       minimum nonce (IV) length        12 octets
+            # N_MAX       maximum nonce (IV) length        12 octets
+            #
+            def iv_len
+              12
+            end
+
+            #
+            # --- RFC 5288 ---
+            # Each value of the nonce_explicit MUST be distinct for each distinct
+            # invocation of the GCM encrypt function for any fixed key. Failure to
+            # meet this uniqueness requirement can significantly degrade security.
+            # The nonce_explicit MAY be the 64-bit sequence number.
+            #
+            # --- RFC 5116 ---
+            # (2.1) Applications that can generate distinct nonces SHOULD use the nonce
+            # formation method defined in Section 3.2, and MAY use any
+            # other method that meets the uniqueness requirement.
+            #
+            # (3.2) The following method to construct nonces is RECOMMENDED.
+            #
+            #  <- variable -> <- variable ->
+            #  - - - - - - -  - - - - - - -
+            # |    fixed     |    counter   |
+            #
+            # Initial octets consist of a fixed field and final octets consist of a
+            # Counter field. Implementations SHOULD support 12-octet nonces in which
+            # the Counter field is four octets long.
+            # The Counter fields of successive nonces form a monotonically increasing
+            # sequence, when those fields are regarded as unsignd integers in network
+            # byte order.
+            # The Counter part SHOULD be equal to zero for the first nonce and increment
+            # by one for each successive nonce that is generated.
+            # The Fixed field MUST remain constant for all nonces that are generated for
+            # a given encryption device.
+            #
+            # --- RFC 5647 ---
+            # The invocation field is treated as a 64-bit integer and is increment after
+            # each invocation of AES-GCM to process a binary packet.
+            # AES-GCM produces a keystream in blocks of 16-octets that is used to
+            # encrypt the plaintext. This keystream is produced by encrypting the
+            # following 16-octet data structure:
+            #
+            # uint32 fixed;              // 4 octets
+            # uint64 invocation_counter; // 8 octets
+            # unit32 block_counter;      // 4 octets
+            #
+            # The block_counter is initially set to one (1) and increment as each block
+            # of key is produced.
+            #
+            # The reader is reminded that SSH requires that the data to be encrypted
+            # MUST be padded out to a multiple of the block size (16-octets for AES-GCM).
+            #
+            def incr_nonce
+              return if nonce[:fixed].nil?
+
+              nonce[:invocation_counter] = [nonce[:invocation_counter].to_s.unpack1('B*').to_i(2) + 1].pack('Q>*')
+
+              apply_nonce
+            end
+
+            def nonce=(iv_s)
+              return if nonce[:fixed]
+
+              nonce[:fixed]              = iv_s[0...4]
+              nonce[:invocation_counter] = iv_s[4...12]
+
+              apply_nonce
+            end
+
+            def apply_nonce
+              cipher.iv = "#{nonce[:fixed]}#{nonce[:invocation_counter]}"
+            end
+
+            #
+            # --- RFC 5647 ---
+            # If AES-GCM is selected as the encryption algorithm for a given
+            # tunnel, AES-GCM MUST also be selected as the Message Authentication
+            # Code (MAC) algorithm.  Conversely, if AES-GCM is selected as the MAC
+            # algorithm, it MUST also be selected as the encryption algorithm.
+            #
+            def implicit_mac?
+              true
+            end
+          end
+        end
+        # rubocop:enable Metrics/BlockLength
+      end
+      # rubocop:enable Metrics/AbcSize
+    end
+  end
+end

data/lib/net/ssh/transport/hmac/abstract.rb

@@ -8,6 +8,18 @@ module Net
         # The base class of all OpenSSL-based HMAC algorithm wrappers.
         class Abstract
           class << self
+            def aead(*v)
+              @aead = false if !defined?(@aead)
+              if v.empty?
+                @aead = superclass.aead if @aead.nil? && superclass.respond_to?(:aead)
+                return @aead
+              elsif v.length == 1
+                @aead = v.first
+              else
+                raise ArgumentError, "wrong number of arguments (#{v.length} for 1)"
+              end
+            end
+
             def etm(*v)
               @etm = false if !defined?(@etm)
               if v.empty?
@@ -57,6 +69,10 @@ module Net
             end
           end
 
+          def aead
+            self.class.aead
+          end
+
           def etm
             self.class.etm
           end

data/lib/net/ssh/transport/packet_stream.rb

@@ -15,6 +15,9 @@ module Net
       module PacketStream # rubocop:disable Metrics/ModuleLength
         PROXY_COMMAND_HOST_IP = '<no hostip for proxy command>'.freeze
 
+        # Same limit as OpenSSH; a larger length would make us buffer whatever the server streams (GHSA-pfqh-p9vh-wx4p).
+        PACKET_MAX_SIZE = 256 * 1024
+
         include BufferedIo
 
         def self.extended(object)
@@ -128,7 +131,7 @@ module Net
           payload = client.compress(payload)
 
           # the length of the packet, minus the padding
-          actual_length = (client.hmac.etm ? 0 : 4) + payload.bytesize + 1
+          actual_length = (client.hmac.etm || client.hmac.aead ? 0 : 4) + payload.bytesize + 1
 
           # compute the padding length
           padding_length = client.block_size - (actual_length % client.block_size)
@@ -151,7 +154,7 @@ module Net
             debug { "using encrypt-then-mac" }
 
             # Encrypt padding_length, payload, and padding. Take MAC
-            # from the unencrypted packet_lenght and the encrypted
+            # from the unencrypted packet_length and the encrypted
             # data.
             length_data = [packet_length].pack("N")
 
@@ -219,7 +222,7 @@ module Net
         # new Packet object.
         # rubocop:disable Metrics/AbcSize
         def poll_next_packet
-          aad_length = server.hmac.etm ? 4 : 0
+          aad_length = server.hmac.etm || server.hmac.aead ? 4 : 0
 
           if @packet.nil?
             minimum = server.block_size < 4 ? 4 : server.block_size
@@ -240,6 +243,7 @@ module Net
               @packet = Net::SSH::Buffer.new(server.update_cipher(data))
               @packet_length = @packet.read_long
             end
+            raise Net::SSH::Exception, "bad packet length #{@packet_length}" if @packet_length < 5 || @packet_length > PACKET_MAX_SIZE
           end
 
           need = @packet_length + 4 - aad_length - server.block_size

data/lib/net/ssh/transport/server_version.rb

@@ -18,6 +18,10 @@ module Net
         # The SSH version string as reported by Net::SSH
         PROTO_VERSION = "SSH-2.0-Ruby/Net::SSH_#{Net::SSH::Version::CURRENT} #{RUBY_PLATFORM}"
 
+        # Same limits as OpenSSH, so a server can't make us buffer its banner without bound (GHSA-r75w-7fhp-84w8).
+        MAX_LINE_LENGTH = 8192
+        MAX_HEADER_LINES = 1024
+
         # Any header text sent by the server prior to sending the version.
         attr_reader :header
 
@@ -45,24 +49,15 @@ module Net
           socket.write "#{PROTO_VERSION}\r\n"
           socket.flush
 
-          raise Net::SSH::ConnectionTimeout, "timeout during server version negotiating" if timeout && !IO.select([socket], nil, nil, timeout)
+          deadline = timeout && (Process.clock_gettime(Process::CLOCK_MONOTONIC) + timeout)
 
-          loop do
-            @version = String.new
-            loop do
-              begin
-                b = socket.readpartial(1)
-                raise Net::SSH::Disconnect, "connection closed by remote host" if b.nil?
-              rescue EOFError
-                raise Net::SSH::Disconnect, "connection closed by remote host"
-              end
-              @version << b
-              break if b == "\n"
-            end
+          MAX_HEADER_LINES.times do
+            @version = read_line(socket, deadline)
             break if @version.match(/^SSH-/)
 
             @header << @version
           end
+          raise Net::SSH::Exception, "no SSH version received in the first #{MAX_HEADER_LINES} lines" unless @version.match(/^SSH-/)
 
           @version.chomp!
           debug { "remote is `#{@version}'" }
@@ -71,6 +66,31 @@ module Net
 
           raise Net::SSH::ConnectionTimeout, "timeout during client version negotiating" if timeout && !IO.select(nil, [socket], nil, timeout)
         end
+
+        def read_line(socket, deadline)
+          line = String.new
+          loop do
+            wait_readable(socket, deadline)
+            begin
+              b = socket.readpartial(1)
+              raise Net::SSH::Disconnect, "connection closed by remote host" if b.nil?
+            rescue EOFError
+              raise Net::SSH::Disconnect, "connection closed by remote host"
+            end
+            line << b
+            return line if b == "\n"
+            raise Net::SSH::Exception, "server version line exceeds #{MAX_LINE_LENGTH} bytes" if line.bytesize > MAX_LINE_LENGTH
+          end
+        end
+
+        def wait_readable(socket, deadline)
+          return unless deadline
+
+          remaining = deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
+          return if remaining > 0 && IO.select([socket], nil, nil, remaining)
+
+          raise Net::SSH::ConnectionTimeout, "timeout during server version negotiating"
+        end
       end
     end
   end

data/lib/net/ssh/transport/session.rb

@@ -27,6 +27,10 @@ module Net
         # The standard port for the SSH protocol.
         DEFAULT_PORT = 22
 
+        # Packets held back during a re-key are bounded so a server can't exhaust memory (GHSA-ggxh-cfwq-5xqc).
+        MAX_QUEUED_PACKETS = 16_384
+        MAX_QUEUED_BYTES = 32 * 1024 * 1024
+
         # The host to connect to, as given to the constructor.
         attr_reader :host
 
@@ -79,6 +83,7 @@ module Net
           debug { "connection established" }
 
           @queue = []
+          @queued_bytes = 0
 
           @host_key_verifier = select_host_key_verifier(options[:verify_host_key])
 
@@ -102,8 +107,8 @@ module Net
         # SSH known-host files.
         def host_as_string
           @host_as_string ||= begin
-            string = "#{host}"
-            string = "[#{string}]:#{port}" if port != DEFAULT_PORT
+            string = +"#{host}"
+            string = +"[#{string}]:#{port}" if port != DEFAULT_PORT
 
             peer_ip = socket.peer_ip
 
@@ -188,7 +193,7 @@ module Net
         # read from the queue before the socket is queried.
         def poll_message(mode = :nonblock, consume_queue = true)
           loop do
-            return @queue.shift if consume_queue && @queue.any? && algorithms.allow?(@queue.first)
+            return shift_queue if consume_queue && @queue.any? && algorithms.allow?(@queue.first)
 
             packet = socket.next_packet(mode, options[:timeout])
             return nil if packet.nil?
@@ -211,6 +216,8 @@ module Net
 
             else
               return packet if algorithms.allow?(packet)
+              # Algorithms#rekey! clears initialized?, so the session id is what marks the first key exchange as done.
+              raise Net::SSH::Exception, "unexpected packet type #{packet.type} during initial key exchange" unless algorithms.session_id
 
               push(packet)
             end
@@ -234,6 +241,11 @@ module Net
         # #poll_message will return packets from the queue in the order they
         # were received.
         def push(packet)
+          @queued_bytes += packet.length
+          if @queue.size >= MAX_QUEUED_PACKETS || @queued_bytes > MAX_QUEUED_BYTES
+            raise Net::SSH::Exception, "too many packets queued during key exchange"
+          end
+
           @queue.push(packet)
         end
 
@@ -276,6 +288,12 @@ module Net
 
         private
 
+        def shift_queue
+          packet = @queue.shift
+          @queued_bytes -= packet.length
+          packet
+        end
+
         # Compatibility verifier which allows users to keep using
         # custom verifier code without adding new :verify_signature
         # method.

data/lib/net/ssh/transport/state.rb

@@ -125,7 +125,7 @@ module Net
           compressor.deflate(data, Zlib::SYNC_FLUSH)
         end
 
-        # Deompresses the data. If no compression is in effect, this will just return
+        # Decompresses the data. If no compression is in effect, this will just return
         # the data unmodified, otherwise it uses #decompressor to decompress the data.
         def decompress(data)
           data = data.to_s