net-ssh 7.2.3 → 8.0.4

data/lib/net/ssh/transport/gcm_cipher.rb

@@ -0,0 +1,228 @@
+require 'net/ssh/loggable'
+
+module Net
+  module SSH
+    module Transport
+      ## Extension module for aes(128|256)gcm ciphers
+      module GCMCipher
+        BLOCK_SIZE = 16
+        IV_BYTES = 12
+        AUTH_TAG_BYTES = 16
+
+        # rubocop:disable Metrics/AbcSize, Metrics/MethodLength
+        def self.extended(orig)
+          # rubocop:disable Metrics/BlockLength
+          orig.class_eval do
+            include Net::SSH::Loggable
+
+            attr_reader   :cipher
+            attr_reader   :key
+            attr_reader   :nonce
+
+            #
+            # Semantically gcm cipher supplies the OpenSSL iv interface with a nonce
+            #   as it is not randomly generated due to being supplied from a counter.
+            # The RFC's use IV and nonce interchangeably.
+            #
+            def initialize(encrypt:, key:)
+              @cipher = OpenSSL::Cipher.new(algo_name)
+              @key    = key
+              key_len = @cipher.key_len
+              if key.size != key_len
+                error_message = "#{cipher_name}: keylength does not match"
+                error { error_message }
+                raise error_message
+              end
+              encrypt ? @cipher.encrypt : @cipher.decrypt
+              @cipher.key = key
+
+              @nonce = {
+                fixed: nil,
+                invocation_counter: 0
+              }
+            end
+
+            def update_cipher_mac(payload, _sequence_number)
+              #
+              # --- RFC 5647 7.3 ---
+              # When using AES-GCM with secure shell, the packet_length field is to
+              # be treated as additional authenticated data, not as plaintext.
+              #
+              length_data      = [payload.bytesize].pack('N')
+
+              cipher.auth_data = length_data
+
+              encrypted_data   = cipher.update(payload) << cipher.final
+
+              mac              = cipher.auth_tag
+
+              incr_nonce
+              length_data + encrypted_data + mac
+            end
+
+            #
+            # --- RFC 5647 ---
+            # uint32    packet_length;  // 0 <= packet_length < 2^32
+            #
+            def read_length(data, _sequence_number)
+              data.unpack1('N')
+            end
+
+            #
+            # --- RFC 5647 ---
+            # In AES-GCM secure shell, the inputs to the authenticated encryption
+            # are:
+            #  PT (Plain Text)
+            #      byte      padding_length; // 4 <= padding_length < 256
+            #      byte[n1]  payload;        // n1 = packet_length-padding_length-1
+            #      byte[n2]  random_padding; // n2 = padding_length
+            #  AAD (Additional Authenticated Data)
+            #      uint32    packet_length;  // 0 <= packet_length < 2^32
+            #  IV (Initialization Vector)
+            #      As described in section 7.1.
+            #  BK (Block Cipher Key)
+            #      The appropriate Encryption Key formed during the Key Exchange.
+            #
+            def read_and_mac(data, mac, _sequence_number)
+              # The authentication tag will be placed in the MAC field at the end of the packet
+
+              # OpenSSL does not verify auth tag length
+              # GCM mode allows arbitrary sizes for the auth_tag up to 128 bytes and a single
+              #   byte allows authentication to pass. If single byte auth tags are possible
+              #   an attacker would require no more than 256 attempts to forge a valid tag.
+              #
+              raise 'incorrect auth_tag length' unless mac.to_s.length == mac_length
+
+              packet_length    = data.unpack1('N')
+
+              cipher.auth_tag  = mac.to_s
+              cipher.auth_data = [packet_length].pack('N')
+
+              result = cipher.update(data[4...]) << cipher.final
+              incr_nonce
+              result
+            end
+
+            def mac_length
+              GCMCipher::AUTH_TAG_BYTES
+            end
+
+            def block_size
+              GCMCipher::BLOCK_SIZE
+            end
+
+            def self.block_size
+              GCMCipher::BLOCK_SIZE
+            end
+
+            def self.iv_len
+              GCMCipher::IV_BYTES
+            end
+
+            def self.auth_length
+              GCMCipher::AUTH_TAG_BYTES
+            end
+
+            def self.decrypt_private_key(ciphertext, auth_tag, key, initialization_vector)
+              cipher = new(encrypt: false, key: key)
+
+              cipher.nonce = initialization_vector
+              cipher.cipher.auth_tag = auth_tag.to_s
+              cipher.cipher.auth_data = ''
+              cipher.cipher.update(ciphertext.to_s) << cipher.cipher.final
+            end
+
+            #
+            # --- RFC 5647 ---
+            # N_MIN       minimum nonce (IV) length        12 octets
+            # N_MAX       maximum nonce (IV) length        12 octets
+            #
+            def iv_len
+              GCMCipher::IV_BYTES
+            end
+
+            #
+            # --- RFC 5288 ---
+            # Each value of the nonce_explicit MUST be distinct for each distinct
+            # invocation of the GCM encrypt function for any fixed key. Failure to
+            # meet this uniqueness requirement can significantly degrade security.
+            # The nonce_explicit MAY be the 64-bit sequence number.
+            #
+            # --- RFC 5116 ---
+            # (2.1) Applications that can generate distinct nonces SHOULD use the nonce
+            # formation method defined in Section 3.2, and MAY use any
+            # other method that meets the uniqueness requirement.
+            #
+            # (3.2) The following method to construct nonces is RECOMMENDED.
+            #
+            #  <- variable -> <- variable ->
+            #  - - - - - - -  - - - - - - -
+            # |    fixed     |    counter   |
+            #
+            # Initial octets consist of a fixed field and final octets consist of a
+            # Counter field. Implementations SHOULD support 12-octet nonces in which
+            # the Counter field is four octets long.
+            # The Counter fields of successive nonces form a monotonically increasing
+            # sequence, when those fields are regarded as unsignd integers in network
+            # byte order.
+            # The Counter part SHOULD be equal to zero for the first nonce and increment
+            # by one for each successive nonce that is generated.
+            # The Fixed field MUST remain constant for all nonces that are generated for
+            # a given encryption device.
+            #
+            # --- RFC 5647 ---
+            # The invocation field is treated as a 64-bit integer and is increment after
+            # each invocation of AES-GCM to process a binary packet.
+            # AES-GCM produces a keystream in blocks of 16-octets that is used to
+            # encrypt the plaintext. This keystream is produced by encrypting the
+            # following 16-octet data structure:
+            #
+            # uint32 fixed;              // 4 octets
+            # uint64 invocation_counter; // 8 octets
+            # unit32 block_counter;      // 4 octets
+            #
+            # The block_counter is initially set to one (1) and increment as each block
+            # of key is produced.
+            #
+            # The reader is reminded that SSH requires that the data to be encrypted
+            # MUST be padded out to a multiple of the block size (16-octets for AES-GCM).
+            #
+            def incr_nonce
+              return if nonce[:fixed].nil?
+
+              nonce[:invocation_counter] = [nonce[:invocation_counter].to_s.unpack1('B*').to_i(2) + 1].pack('Q>*')
+
+              apply_nonce
+            end
+
+            def nonce=(iv_s)
+              return if nonce[:fixed]
+
+              nonce[:fixed]              = iv_s[0...4]
+              nonce[:invocation_counter] = iv_s[4...12]
+
+              apply_nonce
+            end
+
+            def apply_nonce
+              cipher.iv = "#{nonce[:fixed]}#{nonce[:invocation_counter]}"
+            end
+
+            #
+            # --- RFC 5647 ---
+            # If AES-GCM is selected as the encryption algorithm for a given
+            # tunnel, AES-GCM MUST also be selected as the Message Authentication
+            # Code (MAC) algorithm.  Conversely, if AES-GCM is selected as the MAC
+            # algorithm, it MUST also be selected as the encryption algorithm.
+            #
+            def implicit_mac?
+              true
+            end
+          end
+        end
+        # rubocop:enable Metrics/BlockLength
+      end
+      # rubocop:enable Metrics/AbcSize, Metrics/MethodLength
+    end
+  end
+end

data/lib/net/ssh/transport/hmac/abstract.rb

@@ -8,6 +8,18 @@ module Net
         # The base class of all OpenSSL-based HMAC algorithm wrappers.
         class Abstract
           class << self
+            def aead(*v)
+              @aead = false if !defined?(@aead)
+              if v.empty?
+                @aead = superclass.aead if @aead.nil? && superclass.respond_to?(:aead)
+                return @aead
+              elsif v.length == 1
+                @aead = v.first
+              else
+                raise ArgumentError, "wrong number of arguments (#{v.length} for 1)"
+              end
+            end
+
             def etm(*v)
               @etm = false if !defined?(@etm)
               if v.empty?
@@ -57,6 +69,10 @@ module Net
             end
           end
 
+          def aead
+            self.class.aead
+          end
+
           def etm
             self.class.etm
           end

data/lib/net/ssh/transport/hmac/sha1_etm.rb

@@ -0,0 +1,12 @@
+require 'net/ssh/transport/hmac/abstract'
+
+module Net::SSH::Transport::HMAC
+  # The SHA1 Encrypt-Then-Mac HMAC algorithm. This has a mac and
+  # key length of 20, and uses the SHA1 digest algorithm.
+  class SHA1_Etm < Abstract
+    etm          true
+    mac_length   20
+    key_length   20
+    digest_class OpenSSL::Digest::SHA1
+  end
+end

data/lib/net/ssh/transport/hmac.rb

@@ -9,6 +9,7 @@ require 'net/ssh/transport/hmac/sha2_512'
 require 'net/ssh/transport/hmac/sha2_512_96'
 require 'net/ssh/transport/hmac/sha2_256_etm'
 require 'net/ssh/transport/hmac/sha2_512_etm'
+require 'net/ssh/transport/hmac/sha1_etm'
 require 'net/ssh/transport/hmac/ripemd160'
 require 'net/ssh/transport/hmac/none'
 
@@ -27,6 +28,7 @@ module Net::SSH::Transport::HMAC
     'hmac-sha2-512-96' => SHA2_512_96,
     'hmac-sha2-256-etm@openssh.com' => SHA2_256_Etm,
     'hmac-sha2-512-etm@openssh.com' => SHA2_512_Etm,
+    'hmac-sha1-etm@openssh.com' => SHA1_Etm,
     'hmac-ripemd160' => RIPEMD160,
     'hmac-ripemd160@openssh.com' => RIPEMD160,
     'none' => None

data/lib/net/ssh/transport/kex/curve25519_sha256.rb

@@ -1,7 +1,4 @@
-gem 'x25519' # raise if the gem x25519 is not installed
-
-require 'x25519'
-
+require 'openssl'
 require 'net/ssh/transport/constants'
 require 'net/ssh/transport/kex/abstract5656'
 
@@ -12,25 +9,60 @@ module Net
         # A key-exchange service implementing the "curve25519-sha256@libssh.org"
         # key-exchange algorithm. (defined in https://tools.ietf.org/html/draft-ietf-curdle-ssh-curves-06)
         class Curve25519Sha256 < Abstract5656
+          ALGORITHM = "X25519"
+          KEY_BYTES = 32
+
+          class UnsupportedError < StandardError; end
+
+          def self.ensure_supported!
+            unless OpenSSL::PKey.respond_to?(:generate_key) && OpenSSL::PKey.respond_to?(:new_raw_public_key)
+              raise UnsupportedError, "OpenSSL::PKey raw public key APIs are unavailable"
+            end
+
+            key = generate_x25519_key
+            public_key = new_raw_public_key(key.raw_public_key)
+            validate_key_bytes!(key.derive(public_key), "shared secret", KEY_BYTES)
+          rescue OpenSSL::PKey::PKeyError => e
+            raise UnsupportedError, e.message
+          end
+
+          def self.generate_x25519_key
+            OpenSSL::PKey.generate_key(ALGORITHM)
+          end
+
+          def self.new_raw_public_key(key)
+            validate_key_bytes!(key, "public key", KEY_BYTES)
+            OpenSSL::PKey.new_raw_public_key(ALGORITHM, binary_string(key))
+          end
+
+          def self.validate_key_bytes!(key, label, expected_bytes)
+            raise ArgumentError, "invalid X25519 #{label}" unless key.respond_to?(:bytesize) && key.bytesize == expected_bytes
+          end
+
+          def self.binary_string(string)
+            string.dup.force_encoding('BINARY')
+          end
+          private_class_method :binary_string
+
           def digester
             OpenSSL::Digest::SHA256
           end
 
           private
 
-          def generate_key # :nodoc:
-            ::X25519::Scalar.generate
+          def generate_key
+            self.class.generate_x25519_key
           end
 
           ## string   Q_C, client's ephemeral public key octet string
           def ecdh_public_key_bytes
-            ecdh.public_key.to_bytes
+            ecdh.raw_public_key
           end
 
           # compute shared secret from server's public key and client's private key
           def compute_shared_secret(server_ecdh_pubkey)
-            pk = ::X25519::MontgomeryU.new(server_ecdh_pubkey)
-            OpenSSL::BN.new(ecdh.diffie_hellman(pk).to_bytes, 2)
+            pk = self.class.new_raw_public_key(server_ecdh_pubkey)
+            OpenSSL::BN.new(ecdh.derive(pk), 2)
           end
         end
       end

data/lib/net/ssh/transport/kex/curve25519_sha256_loader.rb

@@ -2,26 +2,34 @@ module Net
   module SSH
     module Transport
       module Kex
-        # Loads Curve25519Sha256 support which requires optinal dependencies
+        # Loads Curve25519Sha256 support backed by Ruby OpenSSL X25519 APIs.
         module Curve25519Sha256Loader
           begin
             require 'net/ssh/transport/kex/curve25519_sha256'
+            Net::SSH::Transport::Kex::Curve25519Sha256.ensure_supported!
             LOADED = true
             ERROR = nil
           rescue LoadError => e
             ERROR = e
             LOADED = false
+          rescue StandardError => e
+            if defined?(Net::SSH::Transport::Kex::Curve25519Sha256::UnsupportedError) &&
+               e.is_a?(Net::SSH::Transport::Kex::Curve25519Sha256::UnsupportedError)
+              ERROR = e
+              LOADED = false
+            else
+              raise
+            end
           end
 
           def self.raiseUnlessLoaded(message)
-            description = ERROR.is_a?(LoadError) ? dependenciesRequiredForX25519 : ''
-            description << "#{ERROR.class} : \"#{ERROR.message}\"\n" if ERROR
+            description = LOADED ? '' : x25519SupportRequired
+            description += "#{ERROR.class} : \"#{ERROR.message}\"\n" if ERROR
             raise NotImplementedError, "#{message}\n#{description}" unless LOADED
           end
 
-          def self.dependenciesRequiredForX25519
-            result = "net-ssh requires the following gems for x25519 support:\n"
-            result << " * x25519\n"
+          def self.x25519SupportRequired
+            "net-ssh requires openssl >= 3.2.0 and a crypto backend with X25519 enabled for curve25519-sha256 support.\n"
           end
         end
       end

data/lib/net/ssh/transport/kex/diffie_hellman_group1_sha1.rb

@@ -102,6 +102,7 @@ module Net
             result[:key_blob] = buffer.read_string
             result[:server_key] = Net::SSH::Buffer.new(result[:key_blob]).read_key
             result[:server_dh_pubkey] = buffer.read_bignum
+            validate_server_dh_pubkey(result[:server_dh_pubkey])
             result[:shared_secret] = OpenSSL::BN.new(dh.compute_key(result[:server_dh_pubkey]), 2)
 
             sig_buffer = Net::SSH::Buffer.new(buffer.read_string)
@@ -115,6 +116,13 @@ module Net
 
             return result
           end
+
+          # Rejects degenerate values that would let the server force a
+          # predictable shared secret, as OpenSSH's dh_pub_is_valid.
+          def validate_server_dh_pubkey(pub)
+            valid = pub > 1 && pub < dh.p - 1 && pub.to_i.to_s(2).count("1") >= 4
+            raise Net::SSH::Exception, "server's DH public value is invalid" unless valid
+          end
         end
       end
     end

data/lib/net/ssh/transport/kex/diffie_hellman_group_exchange_sha1.rb

@@ -6,26 +6,43 @@ module Net::SSH::Transport::Kex
   # A key-exchange service implementing the
   # "diffie-hellman-group-exchange-sha1" key-exchange algorithm.
   class DiffieHellmanGroupExchangeSHA1 < DiffieHellmanGroup1SHA1
-    MINIMUM_BITS      = 1024
+    MINIMUM_BITS      = 2048
     MAXIMUM_BITS      = 8192
+    CISCO_MAXIMUM_NEED_BITS = 4096
 
     private
 
-    # Compute the number of bits needed for the given number of bytes.
+    # Computes the minimum, preferred and maximum group sizes to request,
+    # like OpenSSH's kexgex_client.
     def compute_need_bits
-      # for Compatibility: OpenSSH requires (need_bits * 2 + 1) length of parameter
-      need_bits = data[:need_bytes] * 8 * 2 + 1
-
       data[:minimum_dh_bits] ||= MINIMUM_BITS
+      data[:maximum_dh_bits] = [MAXIMUM_BITS, data[:minimum_dh_bits]].max
+      data[:need_bits] = estimate_group_bits(data[:need_bytes] * 8).clamp(data[:minimum_dh_bits], maximum_need_bits)
+    end
 
-      if need_bits < data[:minimum_dh_bits]
-        need_bits = data[:minimum_dh_bits]
-      elsif need_bits > MAXIMUM_BITS
-        need_bits = MAXIMUM_BITS
-      end
+    # Some Cisco servers fail instead of returning their 4096-bit group when asked for more (OpenSSH bz#2209).
+    def maximum_need_bits
+      return data[:maximum_dh_bits] unless cisco_server?
+
+      [CISCO_MAXIMUM_NEED_BITS, data[:minimum_dh_bits]].max
+    end
+
+    def cisco_server?
+      data[:server_version_string].to_s.match?(/\ASSH-[\d.]+-Cisco-1\./)
+    end
 
-      data[:need_bits] = need_bits
-      data[:need_bytes] = need_bits / 8
+    # Group size giving at least the given bits of security (NIST SP 800-57),
+    # as OpenSSH's dh_estimate.
+    def estimate_group_bits(security_bits)
+      if security_bits <= 112
+        2048
+      elsif security_bits <= 128
+        3072
+      elsif security_bits <= 192
+        7680
+      else
+        8192
+      end
     end
 
     # Returns the DH key parameters for the given session.
@@ -34,7 +51,7 @@ module Net::SSH::Transport::Kex
 
       # request the DH key parameters for the given number of bits.
       buffer = Net::SSH::Buffer.from(:byte, KEXDH_GEX_REQUEST, :long, data[:minimum_dh_bits],
-                                     :long, data[:need_bits], :long, MAXIMUM_BITS)
+                                     :long, data[:need_bits], :long, data[:maximum_dh_bits])
       connection.send_message(buffer)
 
       buffer = connection.next_message
@@ -43,9 +60,22 @@ module Net::SSH::Transport::Kex
       p = buffer.read_bignum
       g = buffer.read_bignum
 
+      validate_group(p, g)
+
       [p, g]
     end
 
+    def validate_group(prime, generator)
+      bits = prime.num_bits
+      if bits < data[:minimum_dh_bits]
+        raise Net::SSH::Exception,
+              "server's DH group is #{bits} bits, below the minimum of #{data[:minimum_dh_bits]}; " \
+              "pass minimum_dh_bits: #{bits} to allow it"
+      end
+      raise Net::SSH::Exception, "server's DH group is #{bits} bits, above the maximum of #{data[:maximum_dh_bits]}" if bits > data[:maximum_dh_bits]
+      raise Net::SSH::Exception, "server's DH group generator is invalid" unless generator > 1 && generator < prime - 1
+    end
+
     # Returns the INIT/REPLY constants used by this algorithm.
     def get_message_types
       [KEXDH_GEX_INIT, KEXDH_GEX_REPLY]
@@ -60,9 +90,9 @@ module Net::SSH::Transport::Kex
                             data[:client_algorithm_packet],
                             data[:server_algorithm_packet],
                             result[:key_blob]
-      response.write_long MINIMUM_BITS,
+      response.write_long data[:minimum_dh_bits],
                           data[:need_bits],
-                          MAXIMUM_BITS
+                          data[:maximum_dh_bits]
       response.write_bignum dh.p, dh.g, dh.pub_key,
                             result[:server_dh_pubkey],
                             result[:shared_secret]

data/lib/net/ssh/transport/openssl.rb

@@ -1,4 +1,5 @@
 require 'openssl'
+require 'net/ssh/errors'
 require 'net/ssh/authentication/pub_key_fingerprint'
 
 module OpenSSL
@@ -178,7 +179,7 @@ module OpenSSL
 
           return key
         rescue OpenSSL::PKey::ECError
-          raise NotImplementedError, "unsupported key type `#{type}'"
+          raise Net::SSH::UnsupportedKeyType, "unsupported key type `ecdsa-sha2-#{curve_name_in_type}'"
         end
       end
 

data/lib/net/ssh/transport/packet_stream.rb

@@ -15,6 +15,9 @@ module Net
       module PacketStream # rubocop:disable Metrics/ModuleLength
         PROXY_COMMAND_HOST_IP = '<no hostip for proxy command>'.freeze
 
+        # Same limit as OpenSSH; a larger length would make us buffer whatever the server streams (GHSA-pfqh-p9vh-wx4p).
+        PACKET_MAX_SIZE = 256 * 1024
+
         include BufferedIo
 
         def self.extended(object)
@@ -128,7 +131,7 @@ module Net
           payload = client.compress(payload)
 
           # the length of the packet, minus the padding
-          actual_length = (client.hmac.etm ? 0 : 4) + payload.bytesize + 1
+          actual_length = (client.hmac.etm || client.hmac.aead ? 0 : 4) + payload.bytesize + 1
 
           # compute the padding length
           padding_length = client.block_size - (actual_length % client.block_size)
@@ -151,7 +154,7 @@ module Net
             debug { "using encrypt-then-mac" }
 
             # Encrypt padding_length, payload, and padding. Take MAC
-            # from the unencrypted packet_lenght and the encrypted
+            # from the unencrypted packet_length and the encrypted
             # data.
             length_data = [packet_length].pack("N")
 
@@ -187,6 +190,7 @@ module Net
         def cleanup
           client.cleanup
           server.cleanup
+          hang_up_proxy_command
         end
 
         # If the IO object requires a rekey operation (as indicated by either its
@@ -202,6 +206,17 @@ module Net
 
         protected
 
+        # Like OpenSSH, hang up a ProxyCommand child: tunnels such as EC2 Instance
+        # Connect don't exit on their own, and IO#close waits for them.
+        def hang_up_proxy_command
+          return unless respond_to?(:pid)
+
+          child = pid
+          Process.kill('HUP', child) if child
+        rescue IOError, Errno::ESRCH
+          # already closed, or the child has already been reaped
+        end
+
         # Called when this module is used to extend an object. It initializes
         # the states and generally prepares the object for use as a packet stream.
         def initialize_ssh
@@ -219,7 +234,7 @@ module Net
         # new Packet object.
         # rubocop:disable Metrics/AbcSize
         def poll_next_packet
-          aad_length = server.hmac.etm ? 4 : 0
+          aad_length = server.hmac.etm || server.hmac.aead ? 4 : 0
 
           if @packet.nil?
             minimum = server.block_size < 4 ? 4 : server.block_size
@@ -240,6 +255,7 @@ module Net
               @packet = Net::SSH::Buffer.new(server.update_cipher(data))
               @packet_length = @packet.read_long
             end
+            raise Net::SSH::Exception, "bad packet length #{@packet_length}" if @packet_length < 5 || @packet_length > PACKET_MAX_SIZE
           end
 
           need = @packet_length + 4 - aad_length - server.block_size

data/lib/net/ssh/transport/server_version.rb

@@ -18,6 +18,10 @@ module Net
         # The SSH version string as reported by Net::SSH
         PROTO_VERSION = "SSH-2.0-Ruby/Net::SSH_#{Net::SSH::Version::CURRENT} #{RUBY_PLATFORM}"
 
+        # Same limits as OpenSSH, so a server can't make us buffer its banner without bound (GHSA-r75w-7fhp-84w8).
+        MAX_LINE_LENGTH = 8192
+        MAX_HEADER_LINES = 1024
+
         # Any header text sent by the server prior to sending the version.
         attr_reader :header
 
@@ -45,24 +49,15 @@ module Net
           socket.write "#{PROTO_VERSION}\r\n"
           socket.flush
 
-          raise Net::SSH::ConnectionTimeout, "timeout during server version negotiating" if timeout && !IO.select([socket], nil, nil, timeout)
+          deadline = timeout && (Process.clock_gettime(Process::CLOCK_MONOTONIC) + timeout)
 
-          loop do
-            @version = String.new
-            loop do
-              begin
-                b = socket.readpartial(1)
-                raise Net::SSH::Disconnect, "connection closed by remote host" if b.nil?
-              rescue EOFError
-                raise Net::SSH::Disconnect, "connection closed by remote host"
-              end
-              @version << b
-              break if b == "\n"
-            end
+          MAX_HEADER_LINES.times do
+            @version = read_line(socket, deadline)
             break if @version.match(/^SSH-/)
 
             @header << @version
           end
+          raise Net::SSH::Exception, "no SSH version received in the first #{MAX_HEADER_LINES} lines" unless @version.match(/^SSH-/)
 
           @version.chomp!
           debug { "remote is `#{@version}'" }
@@ -71,6 +66,31 @@ module Net
 
           raise Net::SSH::ConnectionTimeout, "timeout during client version negotiating" if timeout && !IO.select(nil, [socket], nil, timeout)
         end
+
+        def read_line(socket, deadline)
+          line = String.new
+          loop do
+            wait_readable(socket, deadline)
+            begin
+              b = socket.readpartial(1)
+              raise Net::SSH::Disconnect, "connection closed by remote host" if b.nil?
+            rescue EOFError
+              raise Net::SSH::Disconnect, "connection closed by remote host"
+            end
+            line << b
+            return line if b == "\n"
+            raise Net::SSH::Exception, "server version line exceeds #{MAX_LINE_LENGTH} bytes" if line.bytesize > MAX_LINE_LENGTH
+          end
+        end
+
+        def wait_readable(socket, deadline)
+          return unless deadline
+
+          remaining = deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
+          return if remaining > 0 && IO.select([socket], nil, nil, remaining)
+
+          raise Net::SSH::ConnectionTimeout, "timeout during server version negotiating"
+        end
       end
     end
   end