net-ssh 7.3.6 → 8.0.0

data/lib/net/ssh/proxy/jump.rb

@@ -15,14 +15,33 @@ module Net
       #   Net::SSH.start('host', 'user', :proxy => proxy) do |ssh|
       #     ...
       #   end
+      #
+      # ssh_config options for the jump host can be given as a Hash via
+      # +options:+; each is passed to the ssh command as +-o Key=value+:
+      #
+      #   proxy = Net::SSH::Proxy::Jump.new('user@proxy', options: { 'StrictHostKeyChecking' => 'no' })
+      #
+      # Options that ssh_config allows more than once (+IdentityFile+,
+      # +CertificateFile+ and +SendEnv+) take an Array and are passed once per
+      # element; an empty Array passes nothing:
+      #
+      #   proxy = Net::SSH::Proxy::Jump.new('user@proxy', options: { 'IdentityFile' => ['~/.ssh/jump', '~/.ssh/jump_old'] })
+      #
+      # A +nil+ value, alone or in an Array, raises ArgumentError, as it does
+      # for the options passed to Net::SSH.start; omit the option instead.
+      #
+      # The options apply to the first jump host only; any further hosts in
+      # the chain are connected to by that host's own ssh.
       class Jump < Command
         # The jump proxies
         attr_reader :jump_proxies
 
         # Create a new socket factory that tunnels via multiple jump proxes as
         # [user@]host[:port].
-        def initialize(jump_proxies)
+        def initialize(jump_proxies, options: {})
           @jump_proxies = jump_proxies
+          @options = options
+          validate_options!
         end
 
         # Return a new socket connected to the given host and port via the jump
@@ -43,7 +62,10 @@ module Net
           template << " -l #{uri.user}"    if uri.user
           template << " -p #{uri.port}"    if uri.port
           template << " -J #{extra_jumps}" if extra_jumps
-          template << " -F #{Shellwords.escape(config)}" if config != true && config
+          template << " -F #{escape(config)}" if config != true && config
+          @options.each do |key, values|
+            Array(values).each { |value| template << " -o #{escape(key)}=#{escape(value)}" }
+          end
           template << " -W %h:%p "
           template << uri.host
 
@@ -52,6 +74,22 @@ module Net
 
         private
 
+        # Like Net::SSH.start, reject nil option values (alone or in an Array)
+        # rather than silently passing nothing or an empty value to ssh.
+        def validate_options!
+          nil_keys = @options.select { |_key, value| value.nil? || (value.is_a?(Array) && value.include?(nil)) }.keys
+          return if nil_keys.empty?
+
+          raise ArgumentError, "nil is not allowed for #{nil_keys.map(&:inspect).join(', ')} in Net::SSH::Proxy::Jump options; " \
+                               "omit the option to use the default or ssh_config value"
+        end
+
+        # Escape for the shell, and double any % so it survives the %h/%p
+        # substitution done on the template in Command#open.
+        def escape(value)
+          Shellwords.escape(value).gsub("%", "%%")
+        end
+
         def validate_jump!(jump)
           uri = URI.parse("ssh://#{jump}")
           validate_user_name!(uri.user) if uri.user

data/lib/net/ssh/service/forward.rb

@@ -320,6 +320,11 @@ module Net
           session.listen_to(client)
           channel[:socket] = client
 
+          # Grant window only for data the local end has accepted, so a slow
+          # reader stalls the remote sender instead of filling our memory.
+          channel.grant_window_on_consume!
+          client.on_sent { |bytes| channel.consumed(bytes) }
+
           channel.on_data do |ch, data|
             debug { "data:#{data.length} on #{type} forwarded channel" }
             ch[:socket].enqueue(data)
@@ -327,36 +332,36 @@ module Net
 
           channel.on_eof do |ch|
             debug { "eof #{type} on #{type} forwarded channel" }
-            begin
-              ch[:socket].send_pending
-              ch[:socket].shutdown Socket::SHUT_WR
-            rescue IOError => e
-              if e.message =~ /closed/ then
-                debug { "epipe in on_eof => shallowing exception:#{e}" }
-              else
-                raise
-              end
-            rescue Errno::EPIPE => e
-              debug { "epipe in on_eof => shallowing exception:#{e}" }
-            rescue Errno::ENOTCONN => e
-              debug { "enotconn in on_eof => shallowing exception:#{e}" }
-            end
+            ch[:socket].shutdown_write_when_drained
           end
 
           channel.on_close do |ch|
             debug { "closing #{type} forwarded channel" }
-            ch[:socket].close if !client.closed?
-            session.stop_listening_to(ch[:socket])
+            session.close_when_drained(ch[:socket])
           end
 
           channel.on_process do |ch|
-            if ch[:socket].closed?
+            socket = ch[:socket]
+            if socket.closed?
               ch.info { "#{type} forwarded connection closed" }
+              session.stop_listening_to(socket)
               ch.close
-            elsif ch[:socket].available > 0
-              data = ch[:socket].read_available(8192)
-              ch.debug { "read #{data.length} bytes from client, sending over #{type} forwarded connection" }
-              ch.send_data(data)
+            else
+              if socket.available > 0
+                data = socket.read_available(8192)
+                ch.debug { "read #{data.length} bytes from client, sending over #{type} forwarded connection" }
+                ch.send_data(data)
+              end
+
+              # Like OpenSSH's channel_pre_open, only read more once the remote
+              # window can take what is already queued; writes to the socket keep
+              # flowing. ch.output is still unsent here because Channel#process
+              # runs this block before enqueue_pending_output.
+              if ch.output.length + socket.available < ch.remote_window_size.to_i
+                session.resume_reading(socket)
+              else
+                session.pause_reading(socket)
+              end
             end
           end
         end
@@ -388,13 +393,13 @@ module Net
           originator_address = packet.read_string
           originator_port    = packet.read_long
 
-          puts "REMOTE 0: #{connected_port} #{connected_address} #{originator_address} #{originator_port}"
+          debug { "REMOTE 0: #{connected_port} #{connected_address} #{originator_address} #{originator_port}" }
           remote = @remote_forwarded_ports[[connected_port, connected_address]]
           if remote.nil?
             raise Net::SSH::ChannelOpenFailed.new(1, "unknown request from remote forwarded connection on #{connected_address}:#{connected_port}")
           end
 
-          puts "REMOTE: #{remote.host} #{remote.port}"
+          debug { "REMOTE: #{remote.host} #{remote.port}" }
           client = TCPSocket.new(remote.host, remote.port)
           info { "connected #{connected_address}:#{connected_port} originator #{originator_address}:#{originator_port}" }
 
@@ -415,7 +420,7 @@ module Net
           channel[:invisible] = true
 
           begin
-            agent = Authentication::Agent.connect(logger, session.options[:agent_socket_factory])
+            agent = Authentication::Agent.connect(logger, session.options[:agent_socket_factory], session.options[:identity_agent])
             if (agent.socket.is_a? ::IO)
               prepare_client(agent.socket, channel, :agent)
             else

data/lib/net/ssh/test.rb

@@ -73,7 +73,8 @@ module Net
       def transport(options = {})
         @transport ||= Net::SSH::Transport::Session.new(
           options[:host] || "localhost",
-          options.merge(kex: "test", host_key: "ssh-rsa", append_all_supported_algorithms: true, verify_host_key: :never, proxy: socket(options))
+          options.merge(kex: "test", host_key: "ssh-rsa", encryption: "+none", hmac: "+none",
+                        append_all_supported_algorithms: true, verify_host_key: :never, proxy: socket(options))
         )
       end
 

data/lib/net/ssh/transport/algorithms.rb

@@ -8,6 +8,7 @@ require 'net/ssh/transport/kex'
 require 'net/ssh/transport/kex/curve25519_sha256_loader'
 require 'net/ssh/transport/server_version'
 require 'net/ssh/authentication/ed25519_loader'
+require 'net/ssh/authentication/security_key'
 
 module Net
   module SSH
@@ -19,7 +20,7 @@ module Net
       #
       # You will never instantiate or reference this directly. It is used
       # internally by the transport layer.
-      class Algorithms
+      class Algorithms # rubocop:disable Metrics/ClassLength
         include Loggable
         include Constants
 
@@ -31,18 +32,14 @@ module Net
                        ecdsa-sha2-nistp521
                        ecdsa-sha2-nistp384
                        ecdsa-sha2-nistp256
-                       ssh-rsa-cert-v01@openssh.com
-                       ssh-rsa-cert-v00@openssh.com
-                       ssh-rsa
-                       rsa-sha2-256
-                       rsa-sha2-512],
+                       rsa-sha2-512
+                       rsa-sha2-256],
 
           kex: %w[ecdh-sha2-nistp521
                   ecdh-sha2-nistp384
                   ecdh-sha2-nistp256
                   diffie-hellman-group-exchange-sha256
-                  diffie-hellman-group14-sha256
-                  diffie-hellman-group14-sha1],
+                  diffie-hellman-group14-sha256],
 
           encryption: %w[aes256-ctr
                          aes192-ctr
@@ -51,8 +48,18 @@ module Net
                          aes128-gcm@openssh.com],
 
           hmac: %w[hmac-sha2-512-etm@openssh.com hmac-sha2-256-etm@openssh.com
+                   hmac-sha1-etm@openssh.com
                    hmac-sha2-512 hmac-sha2-256
-                   hmac-sha1]
+                   hmac-sha1],
+
+          pubkey_algorithms: %w[ssh-ed25519-cert-v01@openssh.com
+                                ecdsa-sha2-nistp256-cert-v01@openssh.com ecdsa-sha2-nistp384-cert-v01@openssh.com
+                                ecdsa-sha2-nistp521-cert-v01@openssh.com
+                                rsa-sha2-512-cert-v01@openssh.com rsa-sha2-256-cert-v01@openssh.com
+                                ssh-ed25519
+                                ecdsa-sha2-nistp256 ecdsa-sha2-nistp384 ecdsa-sha2-nistp521] +
+                             [Authentication::SecurityKey::SK_SSH_ED25519, Authentication::SecurityKey::SK_ECDSA_SHA2_NISTP256] +
+                             %w[rsa-sha2-512 rsa-sha2-256]
         }.freeze
 
         if Net::SSH::Transport::ChaCha20Poly1305CipherLoader::LOADED
@@ -76,10 +83,12 @@ module Net
 
         # Define all algorithms, with the deprecated, supported by Net::SSH.
         ALGORITHMS = {
-          host_key: DEFAULT_ALGORITHMS[:host_key] + %w[ssh-dss],
+          host_key: DEFAULT_ALGORITHMS[:host_key] +
+                    %w[ssh-rsa-cert-v01@openssh.com ssh-rsa-cert-v00@openssh.com ssh-rsa ssh-dss],
 
           kex: DEFAULT_ALGORITHMS[:kex] +
-               %w[diffie-hellman-group-exchange-sha1
+               %w[diffie-hellman-group14-sha1
+                  diffie-hellman-group-exchange-sha1
                   diffie-hellman-group1-sha1],
 
           encryption: DEFAULT_ALGORITHMS[:encryption] +
@@ -98,10 +107,20 @@ module Net
                    hmac-md5 hmac-md5-96
                    none],
 
+          pubkey_algorithms: DEFAULT_ALGORITHMS[:pubkey_algorithms] + %w[ssh-rsa-cert-v01@openssh.com ssh-rsa ssh-dss],
+
           compression: %w[none zlib@openssh.com zlib],
           language: %w[]
         }.freeze
 
+        # Not added by append_all_supported_algorithms; only used when named explicitly.
+        EXPLICIT_ONLY_ALGORITHMS = {
+          encryption: %w[none],
+          hmac: %w[none]
+        }.freeze
+
+        DEPRECATED_HOST_KEY = 'ssh-rsa-cert-v00@openssh.com'.freeze
+
         # The underlying transport layer session that supports this object
         attr_reader :session
 
@@ -269,11 +288,16 @@ module Net
 
           ALGORITHMS.each do |algorithm, supported|
             algorithms[algorithm] = compose_algorithm_list(
-              supported, options[algorithm] || DEFAULT_ALGORITHMS[algorithm],
-              options[:append_all_supported_algorithms]
+              supported,
+              DEFAULT_ALGORITHMS[algorithm],
+              options[algorithm] || DEFAULT_ALGORITHMS[algorithm],
+              options[:append_all_supported_algorithms],
+              supported - EXPLICIT_ONLY_ALGORITHMS.fetch(algorithm, [])
             )
           end
 
+          warn_deprecated_host_key if host_key_explicitly_named?(DEPRECATED_HOST_KEY)
+
           # for convention, make sure our list has the same keys as the server
           # list
 
@@ -287,7 +311,11 @@ module Net
             # existing known key for the host has preference.
 
             existing_keys = session.host_keys
-            host_keys = existing_keys.flat_map { |key| key.respond_to?(:ssh_types) ? key.ssh_types : [key.ssh_type] }.uniq
+            host_keys = existing_keys.flat_map { |key| key.respond_to?(:ssh_types) ? key.ssh_types : [key.ssh_type] }
+            # A known ssh-rsa key also verifies with rsa-sha2-*, and must not re-enable disabled SHA-1 algorithms.
+            disabled_sha1 = %w[ssh-rsa ssh-rsa-cert-v01@openssh.com ssh-rsa-cert-v00@openssh.com] - algorithms[:host_key]
+            host_keys = host_keys.flat_map { |type| type == 'ssh-rsa' ? %w[rsa-sha2-512 rsa-sha2-256 ssh-rsa] : [type] }
+            host_keys = (host_keys - disabled_sha1).uniq
             algorithms[:host_key].each do |name|
               host_keys << name unless host_keys.include?(name)
             end
@@ -296,21 +324,27 @@ module Net
         end
 
         # Composes the list of algorithms by taking supported algorithms and matching with supplied options.
-        def compose_algorithm_list(supported, option, append_all_supported_algorithms = false)
+        def compose_algorithm_list(supported, defaults, option, append_all_supported_algorithms = false, appendable = supported)
           return supported.dup unless option
 
           list = []
           option = Array(option).compact.uniq
 
-          if option.first && option.first.start_with?('+', '-')
-            list = supported.dup
-
-            appends = option.select { |opt| opt.start_with?('+') }.map { |opt| opt[1..-1] }
-            deletions = option.select { |opt| opt.start_with?('-') }.map { |opt| opt[1..-1] }
+          if option.first && option.first.start_with?('+', '-', '^')
+            ops = { '^' => [], '+' => [], '-' => [] }
+            cur_list = nil
+            option.each do |cur_opt|
+              if ops.key?(cur_opt[0])
+                cur_list = ops[cur_opt[0]]
+                cur_opt = cur_opt[1..-1]
+              end
+              cur_list << cur_opt
+            end
 
-            list.concat(appends)
+            list = ops['^'] + defaults + ops['+']
+            list.concat(appendable) if append_all_supported_algorithms
 
-            deletions.each do |opt|
+            ops['-'].each do |opt|
               if opt.include?('*')
                 opt_escaped = Regexp.escape(opt)
                 algo_re = /\A#{opt_escaped.gsub('\*', '[A-Za-z\d\-@\.]*')}\z/
@@ -325,7 +359,7 @@ module Net
             list = option
 
             if append_all_supported_algorithms
-              supported.each { |name| list << name unless list.include?(name) }
+              appendable.each { |name| list << name unless list.include?(name) }
             end
           end
 
@@ -341,22 +375,35 @@ module Net
           list
         end
 
+        def host_key_explicitly_named?(name)
+          algorithms[:host_key].include?(name) &&
+            Array(options[:host_key]).any? { |opt| opt.to_s.delete_prefix('+').delete_prefix('^') == name }
+        end
+
+        def warn_deprecated_host_key
+          return if @deprecated_host_key_warned
+
+          @deprecated_host_key_warned = true
+          Kernel.warn("#{DEPRECATED_HOST_KEY} is deprecated and will be removed in a future version; " \
+                      "net-ssh cannot parse v00 certificates, use ssh-rsa-cert-v01@openssh.com or a modern host key type instead")
+        end
+
         # Parses a KEXINIT packet from the server.
         def parse_server_algorithm_packet(packet)
           data = { raw: packet.content }
 
           packet.read(16) # skip the cookie value
 
-          data[:kex]                = packet.read_string.split(/,/)
-          data[:host_key]           = packet.read_string.split(/,/)
-          data[:encryption_client]  = packet.read_string.split(/,/)
-          data[:encryption_server]  = packet.read_string.split(/,/)
-          data[:hmac_client]        = packet.read_string.split(/,/)
-          data[:hmac_server]        = packet.read_string.split(/,/)
-          data[:compression_client] = packet.read_string.split(/,/)
-          data[:compression_server] = packet.read_string.split(/,/)
-          data[:language_client]    = packet.read_string.split(/,/)
-          data[:language_server]    = packet.read_string.split(/,/)
+          data[:kex]                = read_name_list(packet)
+          data[:host_key]           = read_name_list(packet)
+          data[:encryption_client]  = read_name_list(packet)
+          data[:encryption_server]  = read_name_list(packet)
+          data[:hmac_client]        = read_name_list(packet)
+          data[:hmac_server]        = read_name_list(packet)
+          data[:compression_client] = read_name_list(packet)
+          data[:compression_server] = read_name_list(packet)
+          data[:language_client]    = read_name_list(packet)
+          data[:language_server]    = read_name_list(packet)
 
           # TODO: if first_kex_packet_follows, we need to try to skip the
           # actual kexinit stuff and try to guess what the server is doing...
@@ -366,6 +413,13 @@ module Net
           return data
         end
 
+        # Reads one comma-separated algorithm name-list from a KEXINIT packet.
+        def read_name_list(packet)
+          list = packet.read_string or raise Net::SSH::Exception, "malformed KEXINIT packet from server"
+
+          list.split(/,/)
+        end
+
         # Given the #algorithms map of preferred algorithm types, this constructs
         # a KEXINIT packet to send to the server. It does not actually send it,
         # it simply builds the packet and returns it.
@@ -391,6 +445,7 @@ module Net
         def negotiate_algorithms
           @kex                = negotiate(:kex)
           @host_key           = negotiate(:host_key)
+          warn_deprecated_host_key if @host_key == DEPRECATED_HOST_KEY
           @encryption_client  = negotiate(:encryption_client)
           @encryption_server  = negotiate(:encryption_server)
           @hmac_client        = negotiate(:hmac_client)

data/lib/net/ssh/transport/chacha20_poly1305_cipher.rb

@@ -1,4 +1,4 @@
-require 'rbnacl'
+require 'openssl'
 require 'net/ssh/loggable'
 
 module Net
@@ -8,6 +8,15 @@ module Net
       class ChaCha20Poly1305Cipher
         include Net::SSH::Loggable
 
+        POLY1305_ALGORITHM = "POLY1305"
+        POLY1305_KEY_BYTES = 32
+        POLY1305_TAG_BYTES = 16
+        NAME = "chacha20-poly1305@openssh.com"
+        ZERO_BLOCK = "\x00".b * POLY1305_KEY_BYTES
+        ZERO_IV = "\x00".b * 16
+
+        class UnsupportedError < StandardError; end
+
         # Implicit HMAC, no need to do anything
         class ImplicitHMac
           def etm
@@ -24,7 +33,6 @@ module Net
           @chacha_hdr = OpenSSL::Cipher.new("chacha20")
           key_len = @chacha_hdr.key_len
           @chacha_main = OpenSSL::Cipher.new("chacha20")
-          @poly = RbNaCl::OneTimeAuths::Poly1305
           if key.size < key_len * 2
             error { "chacha20_poly1305: keylength doesn't match" }
             raise "chacha20_poly1305: keylength doesn't match"
@@ -43,9 +51,9 @@ module Net
         end
 
         def update_cipher_mac(payload, sequence_number)
-          iv_data = [0, 0, 0, sequence_number].pack("NNNN")
+          iv_data = packet_iv(sequence_number)
           @chacha_main.iv = iv_data
-          poly_key = @chacha_main.update(([0] * 32).pack('C32'))
+          poly_key = @chacha_main.update(ZERO_BLOCK)
 
           packet_length = payload.size
           length_data = [packet_length].pack("N")
@@ -57,35 +65,36 @@ module Net
           unencrypted_data = payload
           packet += @chacha_main.update(unencrypted_data)
 
-          packet += @poly.auth(poly_key, packet)
+          packet += self.class.poly1305_auth(poly_key, packet)
           return packet
         end
 
         def read_length(data, sequence_number)
-          iv_data = [0, 0, 0, sequence_number].pack("NNNN")
+          iv_data = packet_iv(sequence_number)
           @chacha_hdr.iv = iv_data
           @chacha_hdr.update(data).unpack1("N")
         end
 
         def read_and_mac(data, mac, sequence_number)
-          iv_data = [0, 0, 0, sequence_number].pack("NNNN")
+          iv_data = packet_iv(sequence_number)
           @chacha_main.iv = iv_data
-          poly_key = @chacha_main.update(([0] * 32).pack('C32'))
+          poly_key = @chacha_main.update(ZERO_BLOCK)
 
           iv_data[0] = 1.chr
           @chacha_main.iv = iv_data
           unencrypted_data = @chacha_main.update(data[4..])
-          begin
-            ok = @poly.verify(poly_key, mac, data[0..])
-            raise Net::SSH::Exception, "corrupted hmac detected #{name}" unless ok
-          rescue RbNaCl::BadAuthenticatorError
-            raise Net::SSH::Exception, "corrupted hmac detected #{name}"
-          end
+
+          expected_mac = self.class.poly1305_auth(poly_key, data[0..])
+          valid_mac = mac.respond_to?(:bytesize) &&
+                      mac.bytesize == POLY1305_TAG_BYTES &&
+                      OpenSSL.fixed_length_secure_compare(expected_mac, mac)
+          raise Net::SSH::Exception, "corrupted hmac detected #{name}" unless valid_mac
+
           return unencrypted_data
         end
 
         def mac_length
-          16
+          POLY1305_TAG_BYTES
         end
 
         def block_size
@@ -93,7 +102,7 @@ module Net
         end
 
         def name
-          "chacha20-poly1305@openssh.com"
+          NAME
         end
 
         def implicit_mac?
@@ -111,6 +120,70 @@ module Net
         def self.key_length
           64
         end
+
+        def self.iv_len
+          0
+        end
+
+        def self.auth_length
+          POLY1305_TAG_BYTES
+        end
+
+        def self.decrypt_private_key(ciphertext, auth_tag, key, _initialization_vector)
+          raise ArgumentError, "chacha20_poly1305: keylength doesn't match" unless
+            key.respond_to?(:bytesize) && key.bytesize == key_length
+
+          ciphertext = binary_string(ciphertext)
+          chacha = OpenSSL::Cipher.new("chacha20")
+          chacha.decrypt
+          chacha.key = binary_string(key[0...POLY1305_KEY_BYTES])
+
+          iv_data = ZERO_IV.dup
+          chacha.iv = iv_data
+          poly_key = chacha.update(ZERO_BLOCK)
+
+          valid_mac = OpenSSL.fixed_length_secure_compare(poly1305_auth(poly_key, ciphertext), auth_tag)
+          raise Net::SSH::Exception, "corrupted hmac detected #{NAME}" unless valid_mac
+
+          iv_data.setbyte(0, 1)
+          chacha.iv = iv_data
+          chacha.update(ciphertext)
+        end
+
+        def self.ensure_supported!
+          raise UnsupportedError, "OpenSSL::PKey raw private key APIs are unavailable" unless OpenSSL::PKey.respond_to?(:new_raw_private_key)
+
+          OpenSSL::Cipher.new("chacha20")
+
+          tag = poly1305_auth("\x00" * POLY1305_KEY_BYTES, "")
+          raise UnsupportedError, "OpenSSL Poly1305 authentication failed" unless tag.bytesize == POLY1305_TAG_BYTES
+        rescue OpenSSL::Cipher::CipherError, OpenSSL::PKey::PKeyError => e
+          raise UnsupportedError, e.message
+        end
+
+        def self.poly1305_auth(poly_key, data)
+          validate_poly1305_key!(poly_key)
+          OpenSSL::PKey.new_raw_private_key(POLY1305_ALGORITHM, binary_string(poly_key)).sign(nil, binary_string(data))
+        end
+
+        def self.validate_poly1305_key!(poly_key)
+          raise ArgumentError, "invalid Poly1305 key" unless poly_key.respond_to?(:bytesize) && poly_key.bytesize == POLY1305_KEY_BYTES
+        end
+
+        def self.binary_string(string)
+          string.dup.force_encoding('BINARY')
+        end
+        private_class_method :binary_string
+
+        def packet_iv(sequence_number)
+          iv_data = ZERO_IV.dup
+          iv_data.setbyte(12, (sequence_number >> 24) & 0xff)
+          iv_data.setbyte(13, (sequence_number >> 16) & 0xff)
+          iv_data.setbyte(14, (sequence_number >> 8) & 0xff)
+          iv_data.setbyte(15, sequence_number & 0xff)
+          iv_data
+        end
+        private :packet_iv
       end
     end
   end

data/lib/net/ssh/transport/chacha20_poly1305_cipher_loader.rb

@@ -1,15 +1,34 @@
 module Net
   module SSH
     module Transport
-      # Loads chacha20 poly1305 support which requires optinal dependency rbnacl
+      # Loads chacha20-poly1305 support backed by Ruby OpenSSL APIs.
       module ChaCha20Poly1305CipherLoader
         begin
           require 'net/ssh/transport/chacha20_poly1305_cipher'
+          Net::SSH::Transport::ChaCha20Poly1305Cipher.ensure_supported!
           LOADED = true
           ERROR = nil
         rescue LoadError => e
           ERROR = e
           LOADED = false
+        rescue StandardError => e
+          if defined?(Net::SSH::Transport::ChaCha20Poly1305Cipher::UnsupportedError) &&
+             e.is_a?(Net::SSH::Transport::ChaCha20Poly1305Cipher::UnsupportedError)
+            ERROR = e
+            LOADED = false
+          else
+            raise
+          end
+        end
+
+        def self.raiseUnlessLoaded(message)
+          description = LOADED ? '' : chacha20_poly1305_support_required
+          description += "#{ERROR.class} : \"#{ERROR.message}\"\n" if ERROR
+          raise NotImplementedError, "#{message}\n#{description}" unless LOADED
+        end
+
+        def self.chacha20_poly1305_support_required
+          "net-ssh requires openssl >= 3.2.0 and a crypto backend with ChaCha20 and Poly1305 enabled for chacha20-poly1305@openssh.com support.\n"
         end
       end
     end

data/lib/net/ssh/transport/cipher_factory.rb

@@ -100,7 +100,11 @@ module Net
         # if :iv_len option is supplied the third return value will be ivlen
         def self.get_lengths(name, options = {})
           klass = SSH_TO_CLASS[name]
-          return [klass.key_length, klass.block_size] unless klass.nil?
+          unless klass.nil?
+            result = [klass.key_length, klass.block_size]
+            result << klass.iv_len if options[:iv_len]
+            return result
+          end
 
           ossl_name = SSH_TO_OSSL[name]
           if ossl_name.nil? || ossl_name == "none"
@@ -124,6 +128,24 @@ module Net
           end
           result
         end
+
+        def self.auth_length(name)
+          klass = SSH_TO_CLASS[name]
+          return klass.auth_length if klass.respond_to?(:auth_length)
+
+          0
+        end
+
+        def self.decrypt_private_key(name, ciphertext, auth_tag, key, initialization_vector)
+          klass = SSH_TO_CLASS[name]
+          raise Net::SSH::Exception, "#{name} does not support private key decryption" unless
+            klass.respond_to?(:decrypt_private_key)
+
+          raise Net::SSH::Exception, "incorrect auth_tag length" unless
+            auth_tag.respond_to?(:bytesize) && auth_tag.bytesize == klass.auth_length
+
+          klass.decrypt_private_key(ciphertext, auth_tag, key, initialization_vector)
+        end
       end
     end
   end

data/lib/net/ssh/transport/constants.rb

@@ -12,6 +12,7 @@ module Net
         DEBUG                     = 4
         SERVICE_REQUEST           = 5
         SERVICE_ACCEPT            = 6
+        EXT_INFO                  = 7
 
         #--
         # Algorithm negotiation messages