net-ssh 7.3.2 → 7.3.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 983f78775fdcd17276a42cd4747d2e27f8354b64098542b64659190298168af6
-  data.tar.gz: 6c2ba541c39041d884b8049f75f05a511c4fa7c03fd57abc0846aeb5bcd0d64e
+  metadata.gz: 266fc4529dfdc0019be7f3f24cad0a04fc227a9a928331fbe308fc9b6e61dd2d
+  data.tar.gz: b17aca117814cbe3076639b016f316b35ecbdd32e7f31b8ef1693cddb0292604
 SHA512:
-  metadata.gz: 81158647d2f34129b4191b61884ab07bff67e5f1b607818a2dda147d6e5b1c8da4c2791ed1c0d6e9ff38ff75e72b35006c43ed254e705d2212a82e946782a4bd
-  data.tar.gz: 0ce48f61ee297eddbc0d44950c19db774c7aa309b72e97ed840a932fdc7a81d73255c5e3e0d51c05f15a3a1a5abd94df4eefe2e8d2dd76e32d9f6e3b0b5c1b45
+  metadata.gz: a2dab75570a4fc5173a97b6622fc4420da55b56b93ab75e984017d57162b23b8d3cca677f8abddb24169e82ddd3c24984e193a1aa914a3e6f76e2088e67f3031
+  data.tar.gz: 76f38fb763930c2d88faaac257920c7c648d20e3fde474ac16cf2aad02b2cf4244cb0cdb52ae4467379491d3c8cf9e8ad3cc322af1902a49a90f5d3920fcea2f

data/.dockerignore

@@ -2,5 +2,8 @@
 .git/
 .gitignore
 
+# Vagrant
+test/integration/.vagrant
+
 docker-compose.yml
 README.md

data/.rubocop_todo.yml

@@ -235,7 +235,7 @@ Lint/UselessTimes:
 # Offense count: 205
 # Configuration parameters: IgnoredMethods, CountRepeatedAttributes.
 Metrics/AbcSize:
-  Max: 75
+  Max: 76
 
 # Offense count: 16
 # Configuration parameters: CountComments, CountAsOne, ExcludedMethods, IgnoredMethods.
@@ -758,10 +758,12 @@ Style/OpenStructUse:
   Exclude:
     - 'test/authentication/test_ed25519.rb'
     - 'test/common.rb'
+    - 'test/test_known_hosts.rb'
     - 'test/transport/kex/test_curve25519_sha256.rb'
     - 'test/transport/kex/test_diffie_hellman_group1_sha1.rb'
     - 'test/transport/kex/test_ecdh_sha2_nistp256.rb'
     - 'test/verifiers/test_always.rb'
+    - 'test/verifiers/test_cert_authority_checks.rb'
 
 # Offense count: 16
 # Configuration parameters: AllowedMethods.

data/CHANGES.txt

@@ -1,3 +1,16 @@
+=== 7.3.4
+
+  * Verify @cert-authority host certificate constraints — principals (shell-glob, matching OpenSSH), validity window, host type, and critical options — instead of trusting any CA-signed certificate for any host [#1010]
+
+=== 7.3.3
+
+  * Support .pub file as IdentityFile to filter/prioritize agent keys (1Password SSH agent use case) [#942]
+  * Fix cert signing regression when using a .pub companion file without an agent [#1006]
+  * Fix unreadable .pub IdentityFile silently skipped instead of raising [#1006]
+  * Allow multiple UserKnownHostsFile entries (space-separated, matching ssh_config(5)) [#979]
+  * Stop mutating ENV['HOME'] at require time [#997]
+  * Fix ED25519 loader with frozen string literals [#995]
+
 === 7.3.2 rc2
 
  * Fix Ruby 2.6 compat: use public_to_der fallback for EC public keys [#993]

data/lib/net/ssh/authentication/ed25519_loader.rb

@@ -14,13 +14,13 @@ module Net
         end
 
         def self.raiseUnlessLoaded(message)
-          description = ERROR.is_a?(LoadError) ? dependenciesRequiredForED25519 : ''
+          description = ERROR.is_a?(LoadError) ? dependenciesRequiredForED25519 : +''
           description << "#{ERROR.class} : \"#{ERROR.message}\"\n" if ERROR
           raise NotImplementedError, "#{message}\n#{description}" unless LOADED
         end
 
         def self.dependenciesRequiredForED25519
-          result = "net-ssh requires the following gems for ed25519 support:\n"
+          result = +"net-ssh requires the following gems for ed25519 support:\n"
           result << " * ed25519 (>= 1.2, < 2.0)\n"
           result << " * bcrypt_pbkdf (>= 1.0, < 2.0)\n" unless RUBY_PLATFORM == "java"
           result << "See https://github.com/net-ssh/net-ssh/issues/565 for more information\n"

data/lib/net/ssh/authentication/key_manager.rb

@@ -72,12 +72,16 @@ module Net
         def add(key_file)
           key_files.push(File.expand_path(key_file)).uniq!
           self
+        rescue ArgumentError
+          self
         end
 
         # Add the given keycert_file to the list of keycert files that will be used.
         def add_keycert(keycert_file)
           keycert_files.push(File.expand_path(keycert_file)).uniq!
           self
+        rescue ArgumentError
+          self
         end
 
         # Add the given keycert_data to the list of keycerts that will be used.
@@ -172,7 +176,11 @@ module Net
         def sign(identity, data, sig_alg = nil)
           info = known_identities[identity] or raise KeyManagerError, "the given identity is unknown to the key manager"
 
-          if info[:key].nil? && info[:from] == :file
+          if info[:from] == :pubkey_file_only
+            raise KeyManagerError, "the given identity is a public key only and cannot be used for signing without an agent"
+          end
+
+          if info[:key].nil? && (info[:from] == :file || info[:from] == :pubkey_file)
             begin
               info[:key] = KeyFactory.load_private_key(info[:file], options[:passphrase], !options[:non_interactive], options[:password_prompt])
             rescue OpenSSL::OpenSSLError, Exception => e
@@ -248,10 +256,14 @@ module Net
         def prepare_identities_from_files
           key_files.map do |file|
             if readable_file?(file)
-              identity = {}
+              identity = { privkey_file: file }
               cert_file = file + "-cert.pub"
               public_key_file = file + ".pub"
-              if readable_file?(cert_file)
+              if file.end_with?(".pub")
+                identity[:load_from] = :pubkey_file_only
+                identity[:pubkey_file] = file
+                identity.delete(:privkey_file)
+              elsif readable_file?(cert_file)
                 identity[:load_from] = :pubkey_file
                 identity[:pubkey_file] = cert_file
               elsif readable_file?(public_key_file)
@@ -260,7 +272,7 @@ module Net
               else
                 identity[:load_from] = :privkey_file
               end
-              identity.merge(privkey_file: file)
+              identity
             end
           end.compact
         end
@@ -282,7 +294,10 @@ module Net
             case identity[:load_from]
             when :pubkey_file
               key = KeyFactory.load_public_key(identity[:pubkey_file])
-              { public_key: key, from: :file, file: identity[:privkey_file] }
+              { public_key: key, from: :pubkey_file, file: identity[:privkey_file] }
+            when :pubkey_file_only
+              key = KeyFactory.load_public_key(identity[:pubkey_file])
+              { public_key: key, from: :pubkey_file_only, file: identity[:privkey_file] }
             when :privkey_file
               private_key = KeyFactory.load_private_key(
                 identity[:privkey_file], options[:passphrase], ask_passphrase, options[:password_prompt]
@@ -313,7 +328,7 @@ module Net
 
         def process_identity_loading_error(identity, e)
           case identity[:load_from]
-          when :pubkey_file
+          when :pubkey_file, :pubkey_file_only
             error { "could not load public key file `#{identity[:pubkey_file]}': #{e.class} (#{e.message})" }
           when :privkey_file
             error { "could not load private key file `#{identity[:privkey_file]}': #{e.class} (#{e.message})" }

data/lib/net/ssh/config.rb

@@ -229,7 +229,6 @@ module Net
           fingerprinthash: :fingerprint_hash,
           port: :port,
           user: :user,
-          userknownhostsfile: :user_known_hosts_file,
           checkhostip: :check_host_ip
         }.freeze
         def translate_config_key(hash, key, value, settings)
@@ -293,6 +292,8 @@ module Net
             hash[:set_env] = Shellwords.split(value.to_s).map { |e| e.split '=', 2 }.to_h
           when :numberofpasswordprompts
             hash[:number_of_password_prompts] = value.to_i
+          when :userknownhostsfile
+            hash[:user_known_hosts_file] = value.split(/\s+/)
           when *TRANSLATE_CONFIG_KEY_RENAME_MAP.keys
             hash[TRANSLATE_CONFIG_KEY_RENAME_MAP[key]] = value
           end

data/lib/net/ssh/known_hosts.rb

@@ -61,6 +61,37 @@ module Net
             false
           end
         end
+
+        # Returns true if the certificate lists no principals (unrestricted) or
+        # if the given hostname matches a listed principal. Host-certificate
+        # principals are shell-glob patterns, matching OpenSSH, whose
+        # sshkey_cert_check_host passes wildcard_pattern=1 so principals like
+        # "*.example.com" are matched with match_pattern rather than strcmp.
+        def matches_principal?(server_key, hostname)
+          server_key.valid_principals.empty? ||
+            server_key.valid_principals.any? { |principal| File.fnmatch(principal, hostname) }
+        end
+
+        # Returns true if the certificate's validity window covers the current time.
+        def matches_validity?(server_key)
+          return false if server_key.valid_after && server_key.valid_after > Time.now
+          return false if server_key.valid_before && server_key.valid_before < Time.now
+
+          true
+        end
+
+        # Returns true if the certificate is a host certificate. A user
+        # certificate (type :user) must never authenticate a host.
+        def matches_type?(server_key)
+          server_key.type == :host
+        end
+
+        # Returns true if every critical option in the certificate is one we can
+        # enforce. net-ssh enforces none, so any critical option is unsupported
+        # and, as OpenSSH does, must cause the certificate to be rejected.
+        def critical_options_supported?(server_key)
+          server_key.critical_options.empty?
+        end
       end
     end
 
@@ -89,6 +120,17 @@ module Net
       def empty?
         @host_keys.empty?
       end
+
+      # Returns the bare hostname, stripping port and IP portions from the
+      # comma-separated host string used internally.
+      #
+      # Examples:
+      #   "server.example.com"            => "server.example.com"
+      #   "server.example.com,1.2.3.4"    => "server.example.com"
+      #   "[server.example.com]:2222"      => "server.example.com"
+      def hostname
+        @host.split(",").first.gsub(/\[|\]:\d+/, "")
+      end
     end
 
     # Searches an OpenSSH-style known-host file for a given host, and returns all
@@ -160,6 +202,8 @@ module Net
       # file. The path is expanded file File.expand_path.
       def initialize(source)
         @source = File.expand_path(source)
+      rescue ArgumentError
+        @source = source
       end
 
       # Returns an array of all keys that are known to be associatd with the

data/lib/net/ssh/service/forward.rb

@@ -48,9 +48,9 @@ module Net
         # If three arguments are given, it is as if the local bind address is
         # "127.0.0.1", and the rest are applied as above.
         #
-        # To request an ephemeral port on the remote server, provide 0 (zero) for
-        # the port number. In all cases, this method will return the port that
-        # has been assigned.
+        # To request an ephemeral port on the local server, provide 0 (zero) for
+        # the local port number. In all cases, this method will return the port
+        # that has been assigned.
         #
         #   ssh.forward.local(1234, "www.capify.org", 80)
         #   assigned_port = ssh.forward.local("0.0.0.0", 0, "www.capify.org", 80)

data/lib/net/ssh/verifiers/always.rb

@@ -19,10 +19,8 @@ module Net
           # We've never seen this host before, so raise an exception.
           process_cache_miss(host_keys, arguments, HostKeyUnknown, "is unknown") if host_keys.empty?
 
-          # If we found any matches, check to see that the key type and
-          # blob also match.
-
-          found = host_keys.any? do |key|
+          # Find the known-hosts entry whose key matches the presented certificate.
+          found_key = host_keys.find do |key|
             if key.respond_to?(:matches_key?)
               key.matches_key?(arguments[:key])
             else
@@ -30,11 +28,17 @@ module Net
             end
           end
 
-          # If a match was found, return true. Otherwise, raise an exception
-          # indicating that the key was not recognized.
-          process_cache_miss(host_keys, arguments, HostKeyMismatch, "does not match") unless found
+          # No matching entry found — key is not recognized.
+          process_cache_miss(host_keys, arguments, HostKeyMismatch, "does not match") unless found_key
+
+          # For @cert-authority entries, enforce the certificate constraints
+          # OpenSSH checks in sshkey_cert_check_authority. A certificate signed by
+          # the trusted CA but failing any of these is rejected with
+          # HostKeyMismatch (not HostKeyUnknown) so AcceptNew does not swallow the
+          # failure and remember the rejected certificate.
+          verify_certificate!(found_key, host_keys, arguments)
 
-          found
+          true
         end
 
         def verify_signature(&block)
@@ -43,6 +47,37 @@ module Net
 
         private
 
+        # Enforces the @cert-authority certificate constraints for entries that
+        # implement them (Net::SSH::HostKeyEntries::CertAuthority). Non-certificate
+        # entries do not respond to these predicates and are left untouched.
+        def verify_certificate!(entry, host_keys, arguments)
+          cert = arguments[:key]
+
+          if entry.respond_to?(:matches_validity?) && !entry.matches_validity?(cert)
+            reason = if cert.valid_before && cert.valid_before < Time.now
+                       "Certificate has expired"
+                     else
+                       "Certificate is not yet valid"
+                     end
+            process_cache_miss(host_keys, arguments, HostKeyMismatch, reason)
+          end
+
+          if entry.respond_to?(:matches_principal?) && !entry.matches_principal?(cert, host_keys.hostname)
+            process_cache_miss(host_keys, arguments, HostKeyMismatch,
+                               "Certificate invalid: name is not a listed principal")
+          end
+
+          if entry.respond_to?(:matches_type?) && !entry.matches_type?(cert)
+            process_cache_miss(host_keys, arguments, HostKeyMismatch,
+                               "Certificate invalid: not a host certificate")
+          end
+
+          return unless entry.respond_to?(:critical_options_supported?) && !entry.critical_options_supported?(cert)
+
+          process_cache_miss(host_keys, arguments, HostKeyMismatch,
+                             "Certificate invalid: unsupported critical option")
+        end
+
         def process_cache_miss(host_keys, args, exc_class, message)
           exception = exc_class.new("fingerprint #{args[:fingerprint]} " +
                                     "#{message} for #{host_keys.host.inspect}")

data/lib/net/ssh/version.rb

@@ -52,7 +52,7 @@ module Net
       MINOR = 3
 
       # The tiny component of this version of the Net::SSH library
-      TINY  = 2
+      TINY  = 4
 
       # The prerelease component of this version of the Net::SSH library
       # nil allowed

data/lib/net/ssh.rb

@@ -1,7 +1,3 @@
-# Make sure HOME is set, regardless of OS, so that File.expand_path works
-# as expected with tilde characters.
-ENV['HOME'] ||= ENV['HOMEPATH'] ? "#{ENV['HOMEDRIVE']}#{ENV['HOMEPATH']}" : Dir.pwd
-
 require 'logger'
 require 'etc'
 require 'shellwords'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: net-ssh
 version: !ruby/object:Gem::Version
-  version: 7.3.2
+  version: 7.3.4
 platform: ruby
 authors:
 - Jamis Buck
@@ -32,7 +32,7 @@ cert_chain:
   ufHf4AX2UIkJbh7zCPkiNCqIr7MSWLNFG/9lOlHYsEJM8XujT1ofPobYx6YSFx/C
   7HBrI7UX7awt6UvBZebhcHzyMHxg/B5PVQllPA==
   -----END CERTIFICATE-----
-date: 2026-03-22 00:00:00.000000000 Z
+date: 2026-10-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bcrypt_pbkdf