net-ssh 7.2.3 → 8.0.4

data/lib/net/ssh/multiplex.rb

@@ -0,0 +1,126 @@
+require 'socket'
+
+require 'net/ssh/errors'
+require 'net/ssh/connection/session'
+require 'net/ssh/multiplex/client'
+require 'net/ssh/multiplex/control_path'
+require 'net/ssh/multiplex/proxy_transport'
+
+module Net
+  module SSH
+    # Reuse of an existing OpenSSH ControlMaster connection, enabled by the
+    # :control_master option of Net::SSH.start. Net::SSH only ever connects to
+    # a master someone else started (e.g. with ssh -M or ControlMaster auto);
+    # it never becomes one.
+    module Multiplex
+      # Used for the mux handshake when the :timeout option isn't set.
+      DEFAULT_TIMEOUT = 5
+
+      # Options for setting up a connection, which the master already did
+      # with its own settings.
+      MASTER_OWNED_OPTIONS = %i[
+        agent_socket_factory append_all_supported_algorithms auth_methods
+        bind_address check_host_ip compression compression_level encryption
+        fingerprint_hash global_known_hosts_file hmac host_key identity_agent
+        keepalive keepalive_interval keepalive_maxcount kex key_data keycert_data
+        keycerts keys keys_only known_hosts languages minimum_dh_bits no_delay
+        non_interactive number_of_password_prompts passphrase password
+        password_prompt proxy pubkey_algorithms rekey_blocks_limit rekey_limit
+        rekey_packet_limit use_agent user_known_hosts_file verify_host_key
+      ].freeze
+
+      VALUES = [:auto, false, nil].freeze
+
+      def self.validate_options!(options)
+        return if VALUES.include?(options[:control_master])
+
+        raise ArgumentError, "control_master must be :auto or false, got #{options[:control_master].inspect}"
+      end
+
+      # Returns a Connection::Session running through the ControlMaster for
+      # this connection, or nil (after logging why) when there is no usable
+      # master, in which case the caller connects as usual. +explicit+ are
+      # the option names the caller passed to Net::SSH.start. Raises
+      # ArgumentError for an invalid ControlPath, as ssh does.
+      def self.connect(host_arg, host, user, options, explicit: [])
+        logger = options[:logger]
+        path = socket_path(host_arg, host, user, options)
+        return nil unless path
+
+        socket = open_proxy(path, options)
+        return nil unless socket
+
+        logger.info { "control_master: using ControlMaster at #{path}" }
+        log_master_owned(logger, explicit)
+        begin
+          transport = ProxyTransport.new(socket, host: host, control_path: path, options: options)
+          Connection::Session.new(transport, session_options(logger, options))
+        rescue StandardError
+          socket.close
+          raise
+        end
+      end
+
+      # ENOENT and ECONNREFUSED just mean no master is running, while the
+      # other errors mean a socket is there but can't be used.
+      def self.open_proxy(path, options)
+        Client.new(path, timeout: options[:timeout] || DEFAULT_TIMEOUT, logger: options[:logger]).connect_proxy
+      rescue Errno::ENOENT, Errno::ECONNREFUSED => e
+        options[:logger].info { "control_master: no ControlMaster at #{path}: #{e.message} (#{e.class})" }
+        nil
+      rescue Multiplex::Error, SystemCallError, IOError, SocketError => e
+        options[:logger].warn { "control_master: not using ControlMaster at #{path}: #{e.message} (#{e.class})" }
+        nil
+      end
+
+      def self.socket_path(host_arg, host, user, options)
+        if Gem.win_platform? || !defined?(UNIXSocket)
+          options[:logger].debug { "control_master: UNIX sockets are not available on this platform" }
+          return nil
+        end
+
+        control_path = options[:control_path]
+        if control_path.nil? || control_path.to_s == 'none'
+          options[:logger].debug { "control_master: no ControlPath set" }
+          return nil
+        end
+
+        expander = ControlPath.new(
+          host_arg: host_arg, host: host, port: options[:port] || ProxyTransport::DEFAULT_PORT, remote_user: user,
+          jump_host: jump_host(options[:proxy]), host_key_alias: options[:host_key_alias]
+        )
+        begin
+          path = expander.expand(control_path.to_s)
+          Socket.sockaddr_un(path)
+        rescue ArgumentError => e
+          raise ArgumentError, "invalid control_path #{control_path.to_s.inspect}: #{e.message}"
+        end
+        path
+      end
+
+      def self.jump_host(proxy)
+        return '' unless defined?(Net::SSH::Proxy::Jump) && proxy.is_a?(Net::SSH::Proxy::Jump)
+
+        ControlPath.jump_host(proxy.jump_proxies)
+      end
+
+      def self.log_master_owned(logger, explicit)
+        bypassed = explicit & MASTER_OWNED_OPTIONS
+        return if bypassed.empty?
+
+        logger.info { "control_master: ignoring #{bypassed.join(', ')}, the ControlMaster's own settings apply" }
+      end
+
+      # Keepalive is a global request, which the master doesn't allow; it
+      # watches its own connection anyway. The master serves agent requests
+      # from its own agent only if it has ForwardAgent enabled itself.
+      def self.session_options(logger, options)
+        logger.info { "control_master: keepalive is left to the ControlMaster" } if options[:keepalive]
+        logger.info { "control_master: ignoring ForwardAgent, the ControlMaster's own ForwardAgent setting applies" } if options[:forward_agent]
+        options.merge(keepalive: false, forward_agent: false)
+      end
+
+      private_class_method :open_proxy, :socket_path, :jump_host, :log_master_owned, :session_options
+    end
+  end
+end

data/lib/net/ssh/prompt.rb

@@ -41,9 +41,9 @@ module Net
         def ask(prompt, echo = true)
           $stdout.print(prompt)
           $stdout.flush
-          ret = $stdin.noecho(&:gets).chomp
-          $stdout.print("\n")
-          ret
+          ret = echo ? $stdin.gets : $stdin.noecho(&:gets)
+          $stdout.print("\n") unless echo
+          ret.chomp
         end
 
         # success method will be called when the password was accepted

data/lib/net/ssh/proxy/command.rb

@@ -16,6 +16,11 @@ module Net
       #     ...
       #   end
       class Command
+        # The command line is run by the shell, so like OpenSSH 9.6 (CVE-2023-51385) we refuse
+        # host and user names containing shell metacharacters rather than substituting them.
+        INVALID_HOST_NAME = /\A-|[[:space:][:cntrl:]'`"$\\;&<>|(){},]/.freeze
+        INVALID_USER_NAME = /\A-|[[:cntrl:]'`";&<>|(){}]|[[:space:]]-|\\\z/.freeze
+
         # The command line template
         attr_reader :command_line_template
 
@@ -41,13 +46,13 @@ module Net
           command_line = @command_line_template.gsub(/%(.)/) {
             case $1
             when 'h'
-              host
+              validate_host_name!(host)
             when 'p'
-              port.to_s
+              validate_port!(port)
             when 'r'
               remote_user = connection_options && connection_options[:remote_user]
               if remote_user
-                remote_user
+                validate_user_name!(remote_user)
               else
                 raise ArgumentError, "remote user name not available"
               end
@@ -117,6 +122,26 @@ module Net
           Process.kill('TERM', io.pid)
           Thread.new { io.close }
         end
+
+        private
+
+        def validate_host_name!(host)
+          raise ArgumentError, "host name contains invalid characters: #{host.inspect}" if host.to_s.match?(INVALID_HOST_NAME)
+
+          host
+        end
+
+        def validate_user_name!(user)
+          raise ArgumentError, "user name contains invalid characters: #{user.inspect}" if user.to_s.match?(INVALID_USER_NAME)
+
+          user
+        end
+
+        def validate_port!(port)
+          raise ArgumentError, "port is not a number: #{port.inspect}" unless port.to_s.match?(/\A\d+\z/)
+
+          port.to_s
+        end
       end
     end
   end

data/lib/net/ssh/proxy/jump.rb

@@ -1,3 +1,4 @@
+require 'shellwords'
 require 'uri'
 require 'net/ssh/proxy/command'
 
@@ -14,14 +15,33 @@ module Net
       #   Net::SSH.start('host', 'user', :proxy => proxy) do |ssh|
       #     ...
       #   end
+      #
+      # ssh_config options for the jump host can be given as a Hash via
+      # +options:+; each is passed to the ssh command as +-o Key=value+:
+      #
+      #   proxy = Net::SSH::Proxy::Jump.new('user@proxy', options: { 'StrictHostKeyChecking' => 'no' })
+      #
+      # Options that ssh_config allows more than once (+IdentityFile+,
+      # +CertificateFile+ and +SendEnv+) take an Array and are passed once per
+      # element; an empty Array passes nothing:
+      #
+      #   proxy = Net::SSH::Proxy::Jump.new('user@proxy', options: { 'IdentityFile' => ['~/.ssh/jump', '~/.ssh/jump_old'] })
+      #
+      # A +nil+ value, alone or in an Array, raises ArgumentError, as it does
+      # for the options passed to Net::SSH.start; omit the option instead.
+      #
+      # The options apply to the first jump host only; any further hosts in
+      # the chain are connected to by that host's own ssh.
       class Jump < Command
         # The jump proxies
         attr_reader :jump_proxies
 
         # Create a new socket factory that tunnels via multiple jump proxes as
         # [user@]host[:port].
-        def initialize(jump_proxies)
+        def initialize(jump_proxies, options: {})
           @jump_proxies = jump_proxies
+          @options = options
+          validate_options!
         end
 
         # Return a new socket connected to the given host and port via the jump
@@ -34,20 +54,63 @@ module Net
         # We cannot build the ProxyCommand template until we know if the :config
         # option was specified during `Net::SSH.start`.
         def build_proxy_command_equivalent(connection_options = nil)
-          first_jump, extra_jumps = jump_proxies.split(",", 2)
+          raise ArgumentError, "no jump host given" if jump_proxies.empty?
+
           config = connection_options && connection_options[:config]
-          uri = URI.parse("ssh://#{first_jump}")
+          uri, *extra_jumps = jump_proxies.split(",", -1).map { |jump| validate_jump!(jump) }
 
           template = "ssh".dup
-          template << " -l #{uri.user}"    if uri.user
-          template << " -p #{uri.port}"    if uri.port
-          template << " -J #{extra_jumps}" if extra_jumps
-          template << " -F #{config}" if config != true && config
+          template << " -l #{escape(uri.user)}" if uri.user
+          template << " -p #{uri.port}" if uri.port
+          template << " -J #{escape(extra_jumps.map { |jump| jump_spec(jump) }.join(','))}" unless extra_jumps.empty?
+          template << " -F #{escape(config)}" if config != true && config
+          @options.each do |key, values|
+            Array(values).each { |value| template << " -o #{escape(key)}=#{escape(value)}" }
+          end
           template << " -W %h:%p "
-          template << uri.host
+          template << escape(uri.host)
 
           @command_line_template = template
         end
+
+        private
+
+        # Like Net::SSH.start, reject nil option values (alone or in an Array)
+        # rather than silently passing nothing or an empty value to ssh.
+        def validate_options!
+          nil_keys = @options.select { |_key, value| value.nil? || (value.is_a?(Array) && value.include?(nil)) }.keys
+          return if nil_keys.empty?
+
+          raise ArgumentError, "nil is not allowed for #{nil_keys.map(&:inspect).join(', ')} in Net::SSH::Proxy::Jump options; " \
+                               "omit the option to use the default or ssh_config value"
+        end
+
+        # Escape for the shell, and double any % so it survives the %h/%p
+        # substitution done on the template in Command#open.
+        def escape(value)
+          Shellwords.escape(value).gsub("%", "%%")
+        end
+
+        # Only [user@]host[:port] is checked, so anything else URI accepts (a path,
+        # query, fragment or password) must be refused before it reaches the shell.
+        def validate_jump!(jump)
+          uri = URI.parse("ssh://#{jump}")
+          raise URI::InvalidURIError if uri.host.to_s.empty? || jump_spec(uri) != jump
+
+          validate_user_name!(uri.user) if uri.user
+          validate_host_name!(uri.host)
+          validate_port!(uri.port) if uri.port
+          uri
+        rescue URI::InvalidURIError
+          raise ArgumentError, "jump host is not [user@]host[:port]: #{jump.inspect}"
+        end
+
+        def jump_spec(uri)
+          spec = uri.host.dup
+          spec.prepend("#{uri.user}@") if uri.user
+          spec << ":#{uri.port}" if uri.port
+          spec
+        end
       end
     end
   end

data/lib/net/ssh/service/forward.rb

@@ -48,9 +48,9 @@ module Net
         # If three arguments are given, it is as if the local bind address is
         # "127.0.0.1", and the rest are applied as above.
         #
-        # To request an ephemeral port on the remote server, provide 0 (zero) for
-        # the port number. In all cases, this method will return the port that
-        # has been assigned.
+        # To request an ephemeral port on the local server, provide 0 (zero) for
+        # the local port number. In all cases, this method will return the port
+        # that has been assigned.
         #
         #   ssh.forward.local(1234, "www.capify.org", 80)
         #   assigned_port = ssh.forward.local("0.0.0.0", 0, "www.capify.org", 80)
@@ -320,6 +320,11 @@ module Net
           session.listen_to(client)
           channel[:socket] = client
 
+          # Grant window only for data the local end has accepted, so a slow
+          # reader stalls the remote sender instead of filling our memory.
+          channel.grant_window_on_consume!
+          client.on_sent { |bytes| channel.consumed(bytes) }
+
           channel.on_data do |ch, data|
             debug { "data:#{data.length} on #{type} forwarded channel" }
             ch[:socket].enqueue(data)
@@ -327,36 +332,40 @@ module Net
 
           channel.on_eof do |ch|
             debug { "eof #{type} on #{type} forwarded channel" }
-            begin
-              ch[:socket].send_pending
-              ch[:socket].shutdown Socket::SHUT_WR
-            rescue IOError => e
-              if e.message =~ /closed/ then
-                debug { "epipe in on_eof => shallowing exception:#{e}" }
-              else
-                raise
-              end
-            rescue Errno::EPIPE => e
-              debug { "epipe in on_eof => shallowing exception:#{e}" }
-            rescue Errno::ENOTCONN => e
-              debug { "enotconn in on_eof => shallowing exception:#{e}" }
-            end
+            ch[:socket].shutdown_write_when_drained
           end
 
           channel.on_close do |ch|
             debug { "closing #{type} forwarded channel" }
-            ch[:socket].close if !client.closed?
-            session.stop_listening_to(ch[:socket])
+            session.close_when_drained(ch[:socket])
           end
 
           channel.on_process do |ch|
-            if ch[:socket].closed?
+            socket = ch[:socket]
+            if socket.closed?
               ch.info { "#{type} forwarded connection closed" }
+              session.stop_listening_to(socket)
               ch.close
-            elsif ch[:socket].available > 0
-              data = ch[:socket].read_available(8192)
-              ch.debug { "read #{data.length} bytes from client, sending over #{type} forwarded connection" }
-              ch.send_data(data)
+            elsif ch.eof?
+              # Like OpenSSH's chan_shutdown_read: data already read still goes out before CHANNEL_EOF, the rest is dropped.
+              ch.output.append(socket.read_available) if socket.available > 0
+              session.pause_reading(socket)
+            else
+              if socket.available > 0
+                data = socket.read_available(8192)
+                ch.debug { "read #{data.length} bytes from client, sending over #{type} forwarded connection" }
+                ch.send_data(data)
+              end
+
+              # Like OpenSSH's channel_pre_open, only read more once the remote
+              # window can take what is already queued; writes to the socket keep
+              # flowing. ch.output is still unsent here because Channel#process
+              # runs this block before enqueue_pending_output.
+              if ch.output.length + socket.available < ch.remote_window_size.to_i
+                session.resume_reading(socket)
+              else
+                session.pause_reading(socket)
+              end
             end
           end
         end
@@ -371,6 +380,8 @@ module Net
           end
 
           channel.on_process do |ch|
+            next if ch.eof?
+
             data = ch[:socket].read(8192)
             if data
               ch.debug { "read #{data.length} bytes from client, sending over #{type} forwarded connection" }
@@ -388,13 +399,13 @@ module Net
           originator_address = packet.read_string
           originator_port    = packet.read_long
 
-          puts "REMOTE 0: #{connected_port} #{connected_address} #{originator_address} #{originator_port}"
+          debug { "REMOTE 0: #{connected_port} #{connected_address} #{originator_address} #{originator_port}" }
           remote = @remote_forwarded_ports[[connected_port, connected_address]]
           if remote.nil?
             raise Net::SSH::ChannelOpenFailed.new(1, "unknown request from remote forwarded connection on #{connected_address}:#{connected_port}")
           end
 
-          puts "REMOTE: #{remote.host} #{remote.port}"
+          debug { "REMOTE: #{remote.host} #{remote.port}" }
           client = TCPSocket.new(remote.host, remote.port)
           info { "connected #{connected_address}:#{connected_port} originator #{originator_address}:#{originator_port}" }
 
@@ -405,11 +416,17 @@ module Net
 
         # The callback used when an auth-agent channel is requested by the server.
         def auth_agent_channel(session, channel, packet)
+          # Like OpenSSH, only relay the local agent when forwarding was requested (GHSA-qpg5-fx6p-8cq3).
+          unless session.options[:forward_agent] || @agent_forwarded
+            error { "server tried agent forwarding, which was not requested; refusing" }
+            raise Net::SSH::ChannelOpenFailed.new(1, "agent forwarding was not requested")
+          end
+
           info { "opening auth-agent channel" }
           channel[:invisible] = true
 
           begin
-            agent = Authentication::Agent.connect(logger, session.options[:agent_socket_factory])
+            agent = Authentication::Agent.connect(logger, session.options[:agent_socket_factory], session.options[:identity_agent])
             if (agent.socket.is_a? ::IO)
               prepare_client(agent.socket, channel, :agent)
             else

data/lib/net/ssh/test/extensions.rb

@@ -57,8 +57,9 @@ module Net
             return false unless script.next(:first)
 
             if script.next(:first).remote?
-              self.string << script.next.to_s
-              self.pos = pos
+              current_pos = pos
+              self.string = "#{self.string}#{script.next}"
+              self.pos = current_pos
             end
 
             return true

data/lib/net/ssh/test/socket.rb

@@ -22,7 +22,7 @@ module Net
         # connection.
         def initialize
           extend(Net::SSH::Transport::PacketStream)
-          super "SSH-2.0-Test\r\n"
+          super(+"SSH-2.0-Test\r\n")
 
           @script = Script.new
 

data/lib/net/ssh/test.rb

@@ -73,7 +73,8 @@ module Net
       def transport(options = {})
         @transport ||= Net::SSH::Transport::Session.new(
           options[:host] || "localhost",
-          options.merge(kex: "test", host_key: "ssh-rsa", append_all_supported_algorithms: true, verify_host_key: :never, proxy: socket(options))
+          options.merge(kex: "test", host_key: "ssh-rsa", encryption: "+none", hmac: "+none",
+                        append_all_supported_algorithms: true, verify_host_key: :never, proxy: socket(options))
         )
       end
 

data/lib/net/ssh/transport/aes128_gcm.rb

@@ -0,0 +1,40 @@
+require 'net/ssh/transport/hmac/abstract'
+require 'net/ssh/transport/gcm_cipher'
+
+module Net::SSH::Transport
+  ## Implements the aes128-gcm@openssh cipher
+  class AES128_GCM
+    extend ::Net::SSH::Transport::GCMCipher
+
+    ## Implicit HMAC, do need to do anything
+    class ImplicitHMac < ::Net::SSH::Transport::HMAC::Abstract
+      def aead
+        true
+      end
+
+      def key_length
+        16
+      end
+    end
+
+    def implicit_mac
+      ImplicitHMac.new
+    end
+
+    def algo_name
+      'aes-128-gcm'
+    end
+
+    def name
+      'aes128-gcm@openssh.com'
+    end
+
+    #
+    # --- RFC 5647 ---
+    # K_LEN       AES key length                   16 octets
+    #
+    def self.key_length
+      16
+    end
+  end
+end

data/lib/net/ssh/transport/aes256_gcm.rb

@@ -0,0 +1,40 @@
+require 'net/ssh/transport/hmac/abstract'
+require 'net/ssh/transport/gcm_cipher'
+
+module Net::SSH::Transport
+  ## Implements the aes256-gcm@openssh cipher
+  class AES256_GCM
+    extend ::Net::SSH::Transport::GCMCipher
+
+    ## Implicit HMAC, do need to do anything
+    class ImplicitHMac < ::Net::SSH::Transport::HMAC::Abstract
+      def aead
+        true
+      end
+
+      def key_length
+        32
+      end
+    end
+
+    def implicit_mac
+      ImplicitHMac.new
+    end
+
+    def algo_name
+      'aes-256-gcm'
+    end
+
+    def name
+      'aes256-gcm@openssh.com'
+    end
+
+    #
+    # --- RFC 5647 ---
+    # K_LEN       AES key length                   32 octets
+    #
+    def self.key_length
+      32
+    end
+  end
+end