net-ssh 7.3.3 → 7.3.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0d9097275f7c3c0123783d9c29f8c4c4bfe3a3c8d68410357078e91859950f3f
-  data.tar.gz: b5a1013faa8b1cfbe5645e849329c99b62db9d944894287747a12c33f5356d9a
+  metadata.gz: a32034e7f363bc87196ff8a13b8c79bd7e9b246e98375c8e8d505cd52ea0b19a
+  data.tar.gz: d98d516fa2ddc9a8e2718e60ea4367da99ae49b5082ec0b4897db24cc86a625f
 SHA512:
-  metadata.gz: 04ceefc617349311ddceebb606aa003dec8c6aa671363a13f939486d1bdfa5b55c49a56096651d8667f30f57ea109728e3cdae1f25545aa3c1c892b1db2948bf
-  data.tar.gz: 3a9f23ad8a0843628f5dc500c83ceabca815756f925fbddc9725a12e0e19a9eeacf42f26f924b9c038edf8e95f832720c2297b0d0c8fdfcd6844f94d72f834b9
+  metadata.gz: d5d09d26af82a639bb793453e27f95b89cb1dbcc15a2bd22ccad8bc7e7106d848008927dbee29b5a8f7c280a15a5bd9eced464c45f004f0c1b64ee2bb1bb8eee
+  data.tar.gz: 5b97d998e035e0c3a499ae89168f10b7e484cbf87ef551d16a11ddef1cf9d1f729b26a204d9cdabb7e1ea7b99de0e4322d9e71cba384c3d47ac0db85ccc2b8ac

data/.github/workflows/ci.yml

@@ -7,7 +7,7 @@ jobs:
     runs-on: ubuntu-22.04
     strategy:
       matrix:
-        ruby-version: [2.6.10, 2.7.7, 3.0.6, 3.1.3, 3.2.1, 3.3.0, 3.4]
+        ruby-version: [2.6.10, 2.7.7, 3.0.6, 3.1.3, 3.2.1, 3.3, 3.4, '4.0']
     steps:
       - uses: actions/checkout@v3
 

data/.rubocop_todo.yml

@@ -758,10 +758,12 @@ Style/OpenStructUse:
   Exclude:
     - 'test/authentication/test_ed25519.rb'
     - 'test/common.rb'
+    - 'test/test_known_hosts.rb'
     - 'test/transport/kex/test_curve25519_sha256.rb'
     - 'test/transport/kex/test_diffie_hellman_group1_sha1.rb'
     - 'test/transport/kex/test_ecdh_sha2_nistp256.rb'
     - 'test/verifiers/test_always.rb'
+    - 'test/verifiers/test_cert_authority_checks.rb'
 
 # Offense count: 16
 # Configuration parameters: AllowedMethods.

data/CHANGES.txt

@@ -1,3 +1,28 @@
+=== 7.3.8
+
+  * Security: validate every ProxyJump hop, not only the first, as [user@]host[:port] (refusing a path, query, fragment or password) and shell-escape the hops passed to ssh -J; a hop such as `evil/x&$(cmd)` ran `cmd` through the shell [GHSA-g2r2-x3p2-5677]
+
+=== 7.3.7
+
+  * Fixed `unexpected packet type 94 during initial key exchange` (or 93) when channel data arrives during a client-initiated re-key, which broke bulk transfers at the first re-key (e.g. with `rekey_limit`, or after about 1 GB); a regression in 7.3.5 [#1063]
+
+=== 7.3.6
+
+  * Fix "Calling Net::SSH::Buffer methods on HostKeyEntries PubKey is deprecated" warnings printed on every connection to a host in known_hosts since 7.3.4 [#1026, #1028]
+
+=== 7.3.5
+
+  * Security: refuse agent channels opened by the server unless agent forwarding was requested (`forward_agent`, ForwardAgent, or `Forward#agent`); any use of port forwarding let a malicious server use the local ssh-agent [GHSA-qpg5-fx6p-8cq3]
+  * Security: reject host and user names containing shell metacharacters, and non-numeric ports, before substituting them into ProxyCommand/ProxyJump commands, as OpenSSH does since 9.6 [GHSA-3x7f-q7wf-fp73]
+  * Security: reject OpenSSH private keys claiming more than 2**20 bcrypt rounds, and only run the KDF once a passphrase is given [GHSA-rpq3-v334-f5pm]
+  * Security: bound the server's identification banner like OpenSSH (8192-byte lines, 1024 lines), and apply `:timeout` to the whole version exchange instead of only its first byte [GHSA-r75w-7fhp-84w8]
+  * Security: reject packet lengths below 5 or above 256 KB, as OpenSSH does [GHSA-pfqh-p9vh-wx4p]
+  * Security: treat unexpected packets during the initial key exchange as a protocol error, and bound packets queued during a re-key [GHSA-ggxh-cfwq-5xqc]
+
+=== 7.3.4
+
+  * Verify @cert-authority host certificate constraints — principals (shell-glob, matching OpenSSH), validity window, host type, and critical options — instead of trusting any CA-signed certificate for any host [#1010]
+
 === 7.3.3
 
   * Support .pub file as IdentityFile to filter/prioritize agent keys (1Password SSH agent use case) [#942]

data/Dockerfile

@@ -3,6 +3,9 @@ FROM ruby:${RUBY_VERSION}
 
 ARG BUNDLERV=
 
+# Ruby 2.6 to 3.0 images are built on Debian bullseye, which only archive.debian.org still serves.
+RUN if grep -q bullseye /etc/os-release; then sed -i 's|deb.debian.org|archive.debian.org|; s|security.debian.org|archive.debian.org|' /etc/apt/sources.list; fi
+
 RUN apt update && apt install -y openssh-server sudo netcat-openbsd \
   && useradd --create-home --shell '/bin/bash' --comment 'NetSSH' 'net_ssh_1' \
   && useradd --create-home --shell '/bin/bash' --comment 'NetSSH' 'net_ssh_2' \

data/Dockerfile.zlib_ng

@@ -11,7 +11,7 @@ ENV INSTALL_PATH="/netssh"
 # Ruby/OpenSSL initialises — setting it in the Rakefile is too late.
 ENV OPENSSL_CONF="/netssh/test/openssl3.conf"
 
-RUN dnf install -y openssl ruby ruby-devel git make gcc zlib-ng crypto-policies-scripts && \
+RUN dnf install -y openssl ruby ruby-devel git make gcc redhat-rpm-config zlib-ng crypto-policies-scripts && \
     update-crypto-policies --set LEGACY
 
 WORKDIR $INSTALL_PATH

data/Rakefile

@@ -9,7 +9,13 @@ require "rake"
 require "rake/clean"
 require "bundler/gem_tasks"
 
-require "rdoc/task"
+# rdoc is no longer a default gem as of Ruby 4.0; keep the rest of the
+# Rakefile usable when it is not installed.
+begin
+  require "rdoc/task"
+rescue LoadError
+  # rdoc tasks are optional
+end
 
 desc "When releasing make sure NET_SSH_BUILDGEM_SIGNED is set"
 task :check_NET_SSH_BUILDGEM_SIGNED do
@@ -27,17 +33,19 @@ require_relative "lib/net/ssh/version"
 version = Net::SSH::Version::CURRENT
 
 extra_files = %w[LICENSE.txt THANKS.txt CHANGES.txt]
-RDoc::Task.new do |rdoc|
-  rdoc.rdoc_dir = "rdoc"
-  rdoc.title = "#{name} #{version}"
-  rdoc.generator = 'hanna' # gem install hanna-nouveau
-  rdoc.main = 'README.md'
-  rdoc.rdoc_files.include("README*")
-  rdoc.rdoc_files.include("bin/*.rb")
-  rdoc.rdoc_files.include("lib/**/*.rb")
-  extra_files.each { |file|
-    rdoc.rdoc_files.include(file) if File.exist?(file)
-  }
+if defined?(RDoc::Task)
+  RDoc::Task.new do |rdoc|
+    rdoc.rdoc_dir = "rdoc"
+    rdoc.title = "#{name} #{version}"
+    rdoc.generator = 'hanna' # gem install hanna-nouveau
+    rdoc.main = 'README.md'
+    rdoc.rdoc_files.include("README*")
+    rdoc.rdoc_files.include("bin/*.rb")
+    rdoc.rdoc_files.include("lib/**/*.rb")
+    extra_files.each { |file|
+      rdoc.rdoc_files.include(file) if File.exist?(file)
+    }
+  end
 end
 
 namespace :cert do

data/lib/net/ssh/authentication/ed25519.rb

@@ -27,6 +27,9 @@ module Net
           MEND = "-----END OPENSSH PRIVATE KEY-----"
           MAGIC = "openssh-key-v1"
 
+          # Same limit as OpenSSH; bcrypt_pbkdf with 2**32 rounds would run for months (GHSA-rpq3-v334-f5pm).
+          MAX_KDF_ROUNDS = 1 << 20
+
           class DecryptError < ArgumentError
             def initialize(message, encrypted_key: false)
               super(message)
@@ -38,6 +41,11 @@ module Net
             end
           end
 
+          def self.check_bcrypt_kdf!(rounds, password)
+            raise ArgumentError.new("Private key bcrypt rounds #{rounds} exceeds #{MAX_KDF_ROUNDS}") if rounds > MAX_KDF_ROUNDS
+            raise DecryptError.new("Passphrase required for encrypted private key", encrypted_key: true) if password.nil? || password.empty?
+          end
+
           def self.read(datafull, password)
             datafull = datafull.strip
             raise ArgumentError.new("Expected #{MBEGIN} at start of private key") unless datafull.start_with?(MBEGIN)
@@ -74,6 +82,8 @@ module Net
 
               raise "BCryptPbkdf is not implemented for jruby" if RUBY_PLATFORM == "java"
 
+              check_bcrypt_kdf!(rounds, password)
+
               key = BCryptPbkdf::key(password, salt, keylen + ivlen, rounds)
               raise DecryptError.new("BCyryptPbkdf failed", encrypted_key: true) unless key
             else

data/lib/net/ssh/key_factory.rb

@@ -55,7 +55,7 @@ module Net
           prompter = nil
           result =
             begin
-              key_type.read(data, passphrase || 'invalid')
+              key_type.read(data, passphrase)
             rescue *key_type.error_classes => e
               encrypted_key = !!key_type.encrypted_key?(data, e) if encrypted_key.nil?
               if encrypted_key && ask_passphrase
@@ -138,8 +138,9 @@ module Net
             raise Exception, "TODO: subclasses should implement"
           end
 
+          # A nil passphrase would make OpenSSL prompt on the terminal itself.
           def self.read(key_data, passphrase)
-            open_ssl_class.new(key_data, passphrase)
+            open_ssl_class.new(key_data, passphrase || 'invalid')
           end
 
           def self.encrypted_key?(key_data, error)
@@ -149,7 +150,7 @@ module Net
 
         class OpenSSLPKeyType < OpenSSLKeyTypeBase
           def self.read(key_data, passphrase)
-            open_ssl_class.read(key_data, passphrase)
+            open_ssl_class.read(key_data, passphrase || 'invalid')
           end
 
           def self.open_ssl_class

data/lib/net/ssh/known_hosts.rb

@@ -61,6 +61,37 @@ module Net
             false
           end
         end
+
+        # Returns true if the certificate lists no principals (unrestricted) or
+        # if the given hostname matches a listed principal. Host-certificate
+        # principals are shell-glob patterns, matching OpenSSH, whose
+        # sshkey_cert_check_host passes wildcard_pattern=1 so principals like
+        # "*.example.com" are matched with match_pattern rather than strcmp.
+        def matches_principal?(server_key, hostname)
+          server_key.valid_principals.empty? ||
+            server_key.valid_principals.any? { |principal| File.fnmatch(principal, hostname) }
+        end
+
+        # Returns true if the certificate's validity window covers the current time.
+        def matches_validity?(server_key)
+          return false if server_key.valid_after && server_key.valid_after > Time.now
+          return false if server_key.valid_before && server_key.valid_before < Time.now
+
+          true
+        end
+
+        # Returns true if the certificate is a host certificate. A user
+        # certificate (type :user) must never authenticate a host.
+        def matches_type?(server_key)
+          server_key.type == :host
+        end
+
+        # Returns true if every critical option in the certificate is one we can
+        # enforce. net-ssh enforces none, so any critical option is unsupported
+        # and, as OpenSSH does, must cause the certificate to be rejected.
+        def critical_options_supported?(server_key)
+          server_key.critical_options.empty?
+        end
       end
     end
 
@@ -89,6 +120,17 @@ module Net
       def empty?
         @host_keys.empty?
       end
+
+      # Returns the bare hostname, stripping port and IP portions from the
+      # comma-separated host string used internally.
+      #
+      # Examples:
+      #   "server.example.com"            => "server.example.com"
+      #   "server.example.com,1.2.3.4"    => "server.example.com"
+      #   "[server.example.com]:2222"      => "server.example.com"
+      def hostname
+        @host.split(",").first.gsub(/\[|\]:\d+/, "")
+      end
     end
 
     # Searches an OpenSSH-style known-host file for a given host, and returns all

data/lib/net/ssh/proxy/command.rb

@@ -16,6 +16,11 @@ module Net
       #     ...
       #   end
       class Command
+        # The command line is run by the shell, so like OpenSSH 9.6 (CVE-2023-51385) we refuse
+        # host and user names containing shell metacharacters rather than substituting them.
+        INVALID_HOST_NAME = /\A-|[[:space:][:cntrl:]'`"$\\;&<>|(){},]/.freeze
+        INVALID_USER_NAME = /\A-|[[:cntrl:]'`";&<>|(){}]|[[:space:]]-|\\\z/.freeze
+
         # The command line template
         attr_reader :command_line_template
 
@@ -41,13 +46,13 @@ module Net
           command_line = @command_line_template.gsub(/%(.)/) {
             case $1
             when 'h'
-              host
+              validate_host_name!(host)
             when 'p'
-              port.to_s
+              validate_port!(port)
             when 'r'
               remote_user = connection_options && connection_options[:remote_user]
               if remote_user
-                remote_user
+                validate_user_name!(remote_user)
               else
                 raise ArgumentError, "remote user name not available"
               end
@@ -117,6 +122,26 @@ module Net
           Process.kill('TERM', io.pid)
           Thread.new { io.close }
         end
+
+        private
+
+        def validate_host_name!(host)
+          raise ArgumentError, "host name contains invalid characters: #{host.inspect}" if host.to_s.match?(INVALID_HOST_NAME)
+
+          host
+        end
+
+        def validate_user_name!(user)
+          raise ArgumentError, "user name contains invalid characters: #{user.inspect}" if user.to_s.match?(INVALID_USER_NAME)
+
+          user
+        end
+
+        def validate_port!(port)
+          raise ArgumentError, "port is not a number: #{port.inspect}" unless port.to_s.match?(/\A\d+\z/)
+
+          port.to_s
+        end
       end
     end
   end

data/lib/net/ssh/proxy/jump.rb

@@ -1,3 +1,4 @@
+require 'shellwords'
 require 'uri'
 require 'net/ssh/proxy/command'
 
@@ -34,20 +35,50 @@ module Net
         # We cannot build the ProxyCommand template until we know if the :config
         # option was specified during `Net::SSH.start`.
         def build_proxy_command_equivalent(connection_options = nil)
-          first_jump, extra_jumps = jump_proxies.split(",", 2)
+          raise ArgumentError, "no jump host given" if jump_proxies.empty?
+
           config = connection_options && connection_options[:config]
-          uri = URI.parse("ssh://#{first_jump}")
+          uri, *extra_jumps = jump_proxies.split(",", -1).map { |jump| validate_jump!(jump) }
 
           template = "ssh".dup
-          template << " -l #{uri.user}"    if uri.user
-          template << " -p #{uri.port}"    if uri.port
-          template << " -J #{extra_jumps}" if extra_jumps
-          template << " -F #{config}" if config != true && config
+          template << " -l #{escape(uri.user)}" if uri.user
+          template << " -p #{uri.port}" if uri.port
+          template << " -J #{escape(extra_jumps.map { |jump| jump_spec(jump) }.join(','))}" unless extra_jumps.empty?
+          template << " -F #{Shellwords.escape(config)}" if config != true && config
           template << " -W %h:%p "
-          template << uri.host
+          template << escape(uri.host)
 
           @command_line_template = template
         end
+
+        private
+
+        # Escape for the shell, and double any % so it survives the %h/%p
+        # substitution done on the template in Command#open.
+        def escape(value)
+          Shellwords.escape(value).gsub("%", "%%")
+        end
+
+        # Only [user@]host[:port] is checked, so anything else URI accepts (a path,
+        # query, fragment or password) must be refused before it reaches the shell.
+        def validate_jump!(jump)
+          uri = URI.parse("ssh://#{jump}")
+          raise URI::InvalidURIError if uri.host.to_s.empty? || jump_spec(uri) != jump
+
+          validate_user_name!(uri.user) if uri.user
+          validate_host_name!(uri.host)
+          validate_port!(uri.port) if uri.port
+          uri
+        rescue URI::InvalidURIError
+          raise ArgumentError, "jump host is not [user@]host[:port]: #{jump.inspect}"
+        end
+
+        def jump_spec(uri)
+          spec = uri.host.dup
+          spec.prepend("#{uri.user}@") if uri.user
+          spec << ":#{uri.port}" if uri.port
+          spec
+        end
       end
     end
   end

data/lib/net/ssh/service/forward.rb

@@ -405,6 +405,12 @@ module Net
 
         # The callback used when an auth-agent channel is requested by the server.
         def auth_agent_channel(session, channel, packet)
+          # Like OpenSSH, only relay the local agent when forwarding was requested (GHSA-qpg5-fx6p-8cq3).
+          unless session.options[:forward_agent] || @agent_forwarded
+            error { "server tried agent forwarding, which was not requested; refusing" }
+            raise Net::SSH::ChannelOpenFailed.new(1, "agent forwarding was not requested")
+          end
+
           info { "opening auth-agent channel" }
           channel[:invisible] = true
 

data/lib/net/ssh/transport/packet_stream.rb

@@ -15,6 +15,9 @@ module Net
       module PacketStream # rubocop:disable Metrics/ModuleLength
         PROXY_COMMAND_HOST_IP = '<no hostip for proxy command>'.freeze
 
+        # Same limit as OpenSSH; a larger length would make us buffer whatever the server streams (GHSA-pfqh-p9vh-wx4p).
+        PACKET_MAX_SIZE = 256 * 1024
+
         include BufferedIo
 
         def self.extended(object)
@@ -240,6 +243,7 @@ module Net
               @packet = Net::SSH::Buffer.new(server.update_cipher(data))
               @packet_length = @packet.read_long
             end
+            raise Net::SSH::Exception, "bad packet length #{@packet_length}" if @packet_length < 5 || @packet_length > PACKET_MAX_SIZE
           end
 
           need = @packet_length + 4 - aad_length - server.block_size

data/lib/net/ssh/transport/server_version.rb

@@ -18,6 +18,10 @@ module Net
         # The SSH version string as reported by Net::SSH
         PROTO_VERSION = "SSH-2.0-Ruby/Net::SSH_#{Net::SSH::Version::CURRENT} #{RUBY_PLATFORM}"
 
+        # Same limits as OpenSSH, so a server can't make us buffer its banner without bound (GHSA-r75w-7fhp-84w8).
+        MAX_LINE_LENGTH = 8192
+        MAX_HEADER_LINES = 1024
+
         # Any header text sent by the server prior to sending the version.
         attr_reader :header
 
@@ -45,24 +49,15 @@ module Net
           socket.write "#{PROTO_VERSION}\r\n"
           socket.flush
 
-          raise Net::SSH::ConnectionTimeout, "timeout during server version negotiating" if timeout && !IO.select([socket], nil, nil, timeout)
+          deadline = timeout && (Process.clock_gettime(Process::CLOCK_MONOTONIC) + timeout)
 
-          loop do
-            @version = String.new
-            loop do
-              begin
-                b = socket.readpartial(1)
-                raise Net::SSH::Disconnect, "connection closed by remote host" if b.nil?
-              rescue EOFError
-                raise Net::SSH::Disconnect, "connection closed by remote host"
-              end
-              @version << b
-              break if b == "\n"
-            end
+          MAX_HEADER_LINES.times do
+            @version = read_line(socket, deadline)
             break if @version.match(/^SSH-/)
 
             @header << @version
           end
+          raise Net::SSH::Exception, "no SSH version received in the first #{MAX_HEADER_LINES} lines" unless @version.match(/^SSH-/)
 
           @version.chomp!
           debug { "remote is `#{@version}'" }
@@ -71,6 +66,31 @@ module Net
 
           raise Net::SSH::ConnectionTimeout, "timeout during client version negotiating" if timeout && !IO.select(nil, [socket], nil, timeout)
         end
+
+        def read_line(socket, deadline)
+          line = String.new
+          loop do
+            wait_readable(socket, deadline)
+            begin
+              b = socket.readpartial(1)
+              raise Net::SSH::Disconnect, "connection closed by remote host" if b.nil?
+            rescue EOFError
+              raise Net::SSH::Disconnect, "connection closed by remote host"
+            end
+            line << b
+            return line if b == "\n"
+            raise Net::SSH::Exception, "server version line exceeds #{MAX_LINE_LENGTH} bytes" if line.bytesize > MAX_LINE_LENGTH
+          end
+        end
+
+        def wait_readable(socket, deadline)
+          return unless deadline
+
+          remaining = deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
+          return if remaining > 0 && IO.select([socket], nil, nil, remaining)
+
+          raise Net::SSH::ConnectionTimeout, "timeout during server version negotiating"
+        end
       end
     end
   end

data/lib/net/ssh/transport/session.rb

@@ -27,6 +27,10 @@ module Net
         # The standard port for the SSH protocol.
         DEFAULT_PORT = 22
 
+        # Packets held back during a re-key are bounded so a server can't exhaust memory (GHSA-ggxh-cfwq-5xqc).
+        MAX_QUEUED_PACKETS = 16_384
+        MAX_QUEUED_BYTES = 32 * 1024 * 1024
+
         # The host to connect to, as given to the constructor.
         attr_reader :host
 
@@ -79,6 +83,7 @@ module Net
           debug { "connection established" }
 
           @queue = []
+          @queued_bytes = 0
 
           @host_key_verifier = select_host_key_verifier(options[:verify_host_key])
 
@@ -188,7 +193,7 @@ module Net
         # read from the queue before the socket is queried.
         def poll_message(mode = :nonblock, consume_queue = true)
           loop do
-            return @queue.shift if consume_queue && @queue.any? && algorithms.allow?(@queue.first)
+            return shift_queue if consume_queue && @queue.any? && algorithms.allow?(@queue.first)
 
             packet = socket.next_packet(mode, options[:timeout])
             return nil if packet.nil?
@@ -211,6 +216,8 @@ module Net
 
             else
               return packet if algorithms.allow?(packet)
+              # Algorithms#rekey! clears initialized?, so the session id is what marks the first key exchange as done.
+              raise Net::SSH::Exception, "unexpected packet type #{packet.type} during initial key exchange" unless algorithms.session_id
 
               push(packet)
             end
@@ -234,6 +241,11 @@ module Net
         # #poll_message will return packets from the queue in the order they
         # were received.
         def push(packet)
+          @queued_bytes += packet.length
+          if @queue.size >= MAX_QUEUED_PACKETS || @queued_bytes > MAX_QUEUED_BYTES
+            raise Net::SSH::Exception, "too many packets queued during key exchange"
+          end
+
           @queue.push(packet)
         end
 
@@ -276,6 +288,12 @@ module Net
 
         private
 
+        def shift_queue
+          packet = @queue.shift
+          @queued_bytes -= packet.length
+          packet
+        end
+
         # Compatibility verifier which allows users to keep using
         # custom verifier code without adding new :verify_signature
         # method.

data/lib/net/ssh/verifiers/always.rb

@@ -19,10 +19,8 @@ module Net
           # We've never seen this host before, so raise an exception.
           process_cache_miss(host_keys, arguments, HostKeyUnknown, "is unknown") if host_keys.empty?
 
-          # If we found any matches, check to see that the key type and
-          # blob also match.
-
-          found = host_keys.any? do |key|
+          # Find the known-hosts entry whose key matches the presented certificate.
+          found_key = host_keys.find do |key|
             if key.respond_to?(:matches_key?)
               key.matches_key?(arguments[:key])
             else
@@ -30,11 +28,17 @@ module Net
             end
           end
 
-          # If a match was found, return true. Otherwise, raise an exception
-          # indicating that the key was not recognized.
-          process_cache_miss(host_keys, arguments, HostKeyMismatch, "does not match") unless found
+          # No matching entry found — key is not recognized.
+          process_cache_miss(host_keys, arguments, HostKeyMismatch, "does not match") unless found_key
+
+          # For @cert-authority entries, enforce the certificate constraints
+          # OpenSSH checks in sshkey_cert_check_authority. A certificate signed by
+          # the trusted CA but failing any of these is rejected with
+          # HostKeyMismatch (not HostKeyUnknown) so AcceptNew does not swallow the
+          # failure and remember the rejected certificate.
+          verify_certificate!(found_key, host_keys, arguments)
 
-          found
+          true
         end
 
         def verify_signature(&block)
@@ -43,6 +47,40 @@ module Net
 
         private
 
+        # Enforces the @cert-authority certificate constraints for entries that
+        # implement them (Net::SSH::HostKeyEntries::CertAuthority). Non-certificate
+        # entries do not respond to these predicates and are left untouched.
+        def verify_certificate!(entry, host_keys, arguments)
+          # Plain keys carry no certificate constraints, and respond_to? on this delegator prints a deprecation warning (#1026).
+          return if entry.is_a?(Net::SSH::HostKeyEntries::PubKey)
+
+          cert = arguments[:key]
+
+          if entry.respond_to?(:matches_validity?) && !entry.matches_validity?(cert)
+            reason = if cert.valid_before && cert.valid_before < Time.now
+                       "Certificate has expired"
+                     else
+                       "Certificate is not yet valid"
+                     end
+            process_cache_miss(host_keys, arguments, HostKeyMismatch, reason)
+          end
+
+          if entry.respond_to?(:matches_principal?) && !entry.matches_principal?(cert, host_keys.hostname)
+            process_cache_miss(host_keys, arguments, HostKeyMismatch,
+                               "Certificate invalid: name is not a listed principal")
+          end
+
+          if entry.respond_to?(:matches_type?) && !entry.matches_type?(cert)
+            process_cache_miss(host_keys, arguments, HostKeyMismatch,
+                               "Certificate invalid: not a host certificate")
+          end
+
+          return unless entry.respond_to?(:critical_options_supported?) && !entry.critical_options_supported?(cert)
+
+          process_cache_miss(host_keys, arguments, HostKeyMismatch,
+                             "Certificate invalid: unsupported critical option")
+        end
+
         def process_cache_miss(host_keys, args, exc_class, message)
           exception = exc_class.new("fingerprint #{args[:fingerprint]} " +
                                     "#{message} for #{host_keys.host.inspect}")

data/lib/net/ssh/version.rb

@@ -52,7 +52,7 @@ module Net
       MINOR = 3
 
       # The tiny component of this version of the Net::SSH library
-      TINY  = 3
+      TINY  = 8
 
       # The prerelease component of this version of the Net::SSH library
       # nil allowed

data/net-ssh.gemspec

@@ -30,6 +30,8 @@ Gem::Specification.new do |spec|
   spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
   spec.require_paths = ["lib"]
 
+  spec.add_dependency("logger")
+
   unless ENV['NET_SSH_NO_ED25519']
     spec.add_development_dependency("bcrypt_pbkdf", "~> 1.0") unless RUBY_PLATFORM == "java"
     spec.add_development_dependency("ed25519", "~> 1.2")

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: net-ssh
 version: !ruby/object:Gem::Version
-  version: 7.3.3
+  version: 7.3.8
 platform: ruby
 authors:
 - Jamis Buck
@@ -32,8 +32,22 @@ cert_chain:
   ufHf4AX2UIkJbh7zCPkiNCqIr7MSWLNFG/9lOlHYsEJM8XujT1ofPobYx6YSFx/C
   7HBrI7UX7awt6UvBZebhcHzyMHxg/B5PVQllPA==
   -----END CERTIFICATE-----
-date: 2026-06-27 00:00:00.000000000 Z
+date: 2026-10-25 00:00:00.000000000 Z
 dependencies:
+- !ruby/object:Gem::Dependency
+  name: logger
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: bcrypt_pbkdf
   requirement: !ruby/object:Gem::Requirement

metadata.gz.sig

@@ -1,2 +1 @@
-6l���o�GBާ|����3�p���Ks�Lc��!!�vt|�Eq�"��Y�_��j�͆�GRT�b��0�Y����S
-c�urO4�0�HS켮��p�+s#���
��S��2T4�;T���Z�}����7��`�jO���֯�0H�Ӑ���TM�@�,(�?���@)^s2���A�!�>� �|k3k�)4��>�����l���Ew���g
+`WL�,�r_t�|ͧ�'���dJ|W�dYO�7Y;R�d�<9/b(�z؝0mF��7Z7d��}���V���m��
�-��(�u��$p�]���Uf��Nq�ʂ�yW�>���(i������?7���2<�̂��
9j井�s�V�:>%�k=��xt���$�