net-ssh 7.2.3 → 7.3.8

data/lib/net/ssh/verifiers/always.rb

@@ -19,10 +19,8 @@ module Net
           # We've never seen this host before, so raise an exception.
           process_cache_miss(host_keys, arguments, HostKeyUnknown, "is unknown") if host_keys.empty?
 
-          # If we found any matches, check to see that the key type and
-          # blob also match.
-
-          found = host_keys.any? do |key|
+          # Find the known-hosts entry whose key matches the presented certificate.
+          found_key = host_keys.find do |key|
             if key.respond_to?(:matches_key?)
               key.matches_key?(arguments[:key])
             else
@@ -30,11 +28,17 @@ module Net
             end
           end
 
-          # If a match was found, return true. Otherwise, raise an exception
-          # indicating that the key was not recognized.
-          process_cache_miss(host_keys, arguments, HostKeyMismatch, "does not match") unless found
+          # No matching entry found — key is not recognized.
+          process_cache_miss(host_keys, arguments, HostKeyMismatch, "does not match") unless found_key
+
+          # For @cert-authority entries, enforce the certificate constraints
+          # OpenSSH checks in sshkey_cert_check_authority. A certificate signed by
+          # the trusted CA but failing any of these is rejected with
+          # HostKeyMismatch (not HostKeyUnknown) so AcceptNew does not swallow the
+          # failure and remember the rejected certificate.
+          verify_certificate!(found_key, host_keys, arguments)
 
-          found
+          true
         end
 
         def verify_signature(&block)
@@ -43,6 +47,40 @@ module Net
 
         private
 
+        # Enforces the @cert-authority certificate constraints for entries that
+        # implement them (Net::SSH::HostKeyEntries::CertAuthority). Non-certificate
+        # entries do not respond to these predicates and are left untouched.
+        def verify_certificate!(entry, host_keys, arguments)
+          # Plain keys carry no certificate constraints, and respond_to? on this delegator prints a deprecation warning (#1026).
+          return if entry.is_a?(Net::SSH::HostKeyEntries::PubKey)
+
+          cert = arguments[:key]
+
+          if entry.respond_to?(:matches_validity?) && !entry.matches_validity?(cert)
+            reason = if cert.valid_before && cert.valid_before < Time.now
+                       "Certificate has expired"
+                     else
+                       "Certificate is not yet valid"
+                     end
+            process_cache_miss(host_keys, arguments, HostKeyMismatch, reason)
+          end
+
+          if entry.respond_to?(:matches_principal?) && !entry.matches_principal?(cert, host_keys.hostname)
+            process_cache_miss(host_keys, arguments, HostKeyMismatch,
+                               "Certificate invalid: name is not a listed principal")
+          end
+
+          if entry.respond_to?(:matches_type?) && !entry.matches_type?(cert)
+            process_cache_miss(host_keys, arguments, HostKeyMismatch,
+                               "Certificate invalid: not a host certificate")
+          end
+
+          return unless entry.respond_to?(:critical_options_supported?) && !entry.critical_options_supported?(cert)
+
+          process_cache_miss(host_keys, arguments, HostKeyMismatch,
+                             "Certificate invalid: unsupported critical option")
+        end
+
         def process_cache_miss(host_keys, args, exc_class, message)
           exception = exc_class.new("fingerprint #{args[:fingerprint]} " +
                                     "#{message} for #{host_keys.host.inspect}")

data/lib/net/ssh/version.rb

@@ -49,10 +49,10 @@ module Net
       MAJOR = 7
 
       # The minor component of this version of the Net::SSH library
-      MINOR = 2
+      MINOR = 3
 
       # The tiny component of this version of the Net::SSH library
-      TINY  = 3
+      TINY  = 8
 
       # The prerelease component of this version of the Net::SSH library
       # nil allowed

data/lib/net/ssh.rb

@@ -1,7 +1,3 @@
-# Make sure HOME is set, regardless of OS, so that File.expand_path works
-# as expected with tilde characters.
-ENV['HOME'] ||= ENV['HOMEPATH'] ? "#{ENV['HOMEDRIVE']}#{ENV['HOMEPATH']}" : Dir.pwd
-
 require 'logger'
 require 'etc'
 require 'shellwords'
@@ -108,7 +104,7 @@ module Net
     # * :bind_address => the IP address on the connecting machine to use in
     #   establishing connection. (:bind_address is discarded if :proxy
     #   is set.)
-    # * :check_host_ip => Also ckeck IP address when connecting to remote host.
+    # * :check_host_ip => Also check IP address when connecting to remote host.
     #   Defaults to +true+.
     # * :compression => the compression algorithm to use, or +true+ to use
     #   whatever is supported.

data/net-ssh-public_cert.pem

@@ -1,7 +1,7 @@
 -----BEGIN CERTIFICATE-----
 MIIDeDCCAmCgAwIBAgIBATANBgkqhkiG9w0BAQsFADBBMQ8wDQYDVQQDDAZuZXRz
 c2gxGTAXBgoJkiaJk/IsZAEZFglzb2x1dGlvdXMxEzARBgoJkiaJk/IsZAEZFgNj
-b20wHhcNMjQwNDAxMDk1NjIxWhcNMjUwNDAxMDk1NjIxWjBBMQ8wDQYDVQQDDAZu
+b20wHhcNMjYwMjE1MTAxNzUyWhcNMjcwMjE1MTAxNzUyWjBBMQ8wDQYDVQQDDAZu
 ZXRzc2gxGTAXBgoJkiaJk/IsZAEZFglzb2x1dGlvdXMxEzARBgoJkiaJk/IsZAEZ
 FgNjb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDGJ4TbZ9H+qZ08
 pQfJhPJTHaDCyQvCsKTFrL5O9z3tllQ7B/zksMMM+qFBpNYu9HCcg4yBATacE/PB
@@ -12,10 +12,10 @@ KP4yMn+TzaXijyjRg7gECfJr3TGASaA4bQsILFGG5dAWcwO4OMrZedR7SHj/o0Kf
 3gL7P0axAgMBAAGjezB5MAkGA1UdEwQCMAAwCwYDVR0PBAQDAgSwMB0GA1UdDgQW
 BBQF8qLA7Z4zg0SJGtUbv3eoQ8tjIzAfBgNVHREEGDAWgRRuZXRzc2hAc29sdXRp
 b3VzLmNvbTAfBgNVHRIEGDAWgRRuZXRzc2hAc29sdXRpb3VzLmNvbTANBgkqhkiG
-9w0BAQsFAAOCAQEAfY2WbsBKwRtBep4l+Y2/84H1BKH9UVOsFxqQzYkvM2LFDyup
-UkjYf8nPSjg3mquhaiA5KSoSVUPpNDfQo+UvY3+mlxRs96ttWiUGwz27fy82rx1B
-ZnfKjsWOntemNON6asOD0mtv0xsNBfOB2VNIKW/uqHsiPpa0OaVy5uENhX+5OFan
-2P1Uy+WcMiv38RlRkn4cdEIZUFupDgKFsguYlaJy473/wsae4exUgc5bvi3Splob
-1uE/LmB/qWBVSNW8e9KDtJynhDDZBlpESyQHFQCZj6UapzxlnC46LaDncPoAtJPc
-MlWxJ8mKghIcyXc5y4cSyGypNG5BralqnvQUyg==
+9w0BAQsFAAOCAQEASsiVybehJLRPztFeFV8+SKa2BwbBSNJoAkhARVJKhpJxCfeY
+gO7Kqb7JCykzb0anb1s6xTrzD03cWRNGE2YaoBLqnzeUqW1LPqVwmcySmnSIGH9F
+DlFYlHaAn3oSqglyDxQx9bLngKatetx+tSfB3bLAb7Tr9PO8/lhBENbjlD4+UUwD
+gApoZuD9pknWDH3KsITgzphswETBdo0hd9aLnRNR3EifD0lUIEit/0Yx6euSxWtI
+ufHf4AX2UIkJbh7zCPkiNCqIr7MSWLNFG/9lOlHYsEJM8XujT1ofPobYx6YSFx/C
+7HBrI7UX7awt6UvBZebhcHzyMHxg/B5PVQllPA==
 -----END CERTIFICATE-----

data/net-ssh.gemspec

@@ -30,6 +30,8 @@ Gem::Specification.new do |spec|
   spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
   spec.require_paths = ["lib"]
 
+  spec.add_dependency("logger")
+
   unless ENV['NET_SSH_NO_ED25519']
     spec.add_development_dependency("bcrypt_pbkdf", "~> 1.0") unless RUBY_PLATFORM == "java"
     spec.add_development_dependency("ed25519", "~> 1.2")
@@ -42,6 +44,7 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency "bundler", ">= 1.17"
   spec.add_development_dependency "minitest", "~> 5.19"
   spec.add_development_dependency "mocha", "~> 2.1.0"
+  spec.add_development_dependency "ostruct"
   spec.add_development_dependency "rake", "~> 12.0"
   spec.add_development_dependency "rubocop", "~> 1.28.0"
 end

metadata

@@ -1,20 +1,20 @@
 --- !ruby/object:Gem::Specification
 name: net-ssh
 version: !ruby/object:Gem::Version
-  version: 7.2.3
+  version: 7.3.8
 platform: ruby
 authors:
 - Jamis Buck
 - Delano Mandelbaum
 - Miklós Fazekas
-autorequire: 
+autorequire:
 bindir: exe
 cert_chain:
 - |
   -----BEGIN CERTIFICATE-----
   MIIDeDCCAmCgAwIBAgIBATANBgkqhkiG9w0BAQsFADBBMQ8wDQYDVQQDDAZuZXRz
   c2gxGTAXBgoJkiaJk/IsZAEZFglzb2x1dGlvdXMxEzARBgoJkiaJk/IsZAEZFgNj
-  b20wHhcNMjQwNDAxMDk1NjIxWhcNMjUwNDAxMDk1NjIxWjBBMQ8wDQYDVQQDDAZu
+  b20wHhcNMjYwMjE1MTAxNzUyWhcNMjcwMjE1MTAxNzUyWjBBMQ8wDQYDVQQDDAZu
   ZXRzc2gxGTAXBgoJkiaJk/IsZAEZFglzb2x1dGlvdXMxEzARBgoJkiaJk/IsZAEZ
   FgNjb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDGJ4TbZ9H+qZ08
   pQfJhPJTHaDCyQvCsKTFrL5O9z3tllQ7B/zksMMM+qFBpNYu9HCcg4yBATacE/PB
@@ -25,15 +25,29 @@ cert_chain:
   3gL7P0axAgMBAAGjezB5MAkGA1UdEwQCMAAwCwYDVR0PBAQDAgSwMB0GA1UdDgQW
   BBQF8qLA7Z4zg0SJGtUbv3eoQ8tjIzAfBgNVHREEGDAWgRRuZXRzc2hAc29sdXRp
   b3VzLmNvbTAfBgNVHRIEGDAWgRRuZXRzc2hAc29sdXRpb3VzLmNvbTANBgkqhkiG
-  9w0BAQsFAAOCAQEAfY2WbsBKwRtBep4l+Y2/84H1BKH9UVOsFxqQzYkvM2LFDyup
-  UkjYf8nPSjg3mquhaiA5KSoSVUPpNDfQo+UvY3+mlxRs96ttWiUGwz27fy82rx1B
-  ZnfKjsWOntemNON6asOD0mtv0xsNBfOB2VNIKW/uqHsiPpa0OaVy5uENhX+5OFan
-  2P1Uy+WcMiv38RlRkn4cdEIZUFupDgKFsguYlaJy473/wsae4exUgc5bvi3Splob
-  1uE/LmB/qWBVSNW8e9KDtJynhDDZBlpESyQHFQCZj6UapzxlnC46LaDncPoAtJPc
-  MlWxJ8mKghIcyXc5y4cSyGypNG5BralqnvQUyg==
+  9w0BAQsFAAOCAQEASsiVybehJLRPztFeFV8+SKa2BwbBSNJoAkhARVJKhpJxCfeY
+  gO7Kqb7JCykzb0anb1s6xTrzD03cWRNGE2YaoBLqnzeUqW1LPqVwmcySmnSIGH9F
+  DlFYlHaAn3oSqglyDxQx9bLngKatetx+tSfB3bLAb7Tr9PO8/lhBENbjlD4+UUwD
+  gApoZuD9pknWDH3KsITgzphswETBdo0hd9aLnRNR3EifD0lUIEit/0Yx6euSxWtI
+  ufHf4AX2UIkJbh7zCPkiNCqIr7MSWLNFG/9lOlHYsEJM8XujT1ofPobYx6YSFx/C
+  7HBrI7UX7awt6UvBZebhcHzyMHxg/B5PVQllPA==
   -----END CERTIFICATE-----
-date: 2024-04-02 00:00:00.000000000 Z
+date: 2026-10-25 00:00:00.000000000 Z
 dependencies:
+- !ruby/object:Gem::Dependency
+  name: logger
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: bcrypt_pbkdf
   requirement: !ruby/object:Gem::Requirement
@@ -146,6 +160,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: 2.1.0
+- !ruby/object:Gem::Dependency
+  name: ostruct
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
@@ -198,6 +226,7 @@ files:
 - DEVELOPMENT.md
 - Dockerfile
 - Dockerfile.openssl3
+- Dockerfile.zlib_ng
 - Gemfile
 - Gemfile.noed25519
 - Gemfile.norbnacl
@@ -258,12 +287,15 @@ files:
 - lib/net/ssh/test/remote_packet.rb
 - lib/net/ssh/test/script.rb
 - lib/net/ssh/test/socket.rb
+- lib/net/ssh/transport/aes128_gcm.rb
+- lib/net/ssh/transport/aes256_gcm.rb
 - lib/net/ssh/transport/algorithms.rb
 - lib/net/ssh/transport/chacha20_poly1305_cipher.rb
 - lib/net/ssh/transport/chacha20_poly1305_cipher_loader.rb
 - lib/net/ssh/transport/cipher_factory.rb
 - lib/net/ssh/transport/constants.rb
 - lib/net/ssh/transport/ctr.rb
+- lib/net/ssh/transport/gcm_cipher.rb
 - lib/net/ssh/transport/hmac.rb
 - lib/net/ssh/transport/hmac/abstract.rb
 - lib/net/ssh/transport/hmac/md5.rb
@@ -312,7 +344,7 @@ licenses:
 - MIT
 metadata:
   changelog_uri: https://github.com/net-ssh/net-ssh/blob/master/CHANGES.txt
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -328,7 +360,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubygems_version: 3.3.3
-signing_key: 
+signing_key:
 specification_version: 4
 summary: 'Net::SSH: a pure-Ruby implementation of the SSH2 client protocol.'
 test_files: []