net-ssh 7.3.6 → 8.1.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a1fd91f862a832657da3941f813a7a7d2204b2b08cc0082db740d27e9a23e7cc
-  data.tar.gz: b6f84d4e0ff8391ca7ccaab236c0eda12fdc0d46d7f7751a19d355cbf2b4cd5d
+  metadata.gz: 66339496243d9984d49aeebce869255bb936e533280674b6a7aaf9de33381cfa
+  data.tar.gz: f2492cf09d1396dac5731fed8bd5b9def374d7900e30e5c03a7fcf00986bad05
 SHA512:
-  metadata.gz: 4b8edaf68052b8b828993179ee6f8a29df1e64ca63e1cad5228d4e58ec50c088b321deaf0ad8a202eb6fe27a9a923be2dbe1dc5569e049634379e64b1d4228d5
-  data.tar.gz: 6b2f300dab731967559d13d6ac18c756c27ff39222dd2370b1e32b4187475cb0103e5e2683dfbe03624d172756232066ee30dc84bed8bfaa7d032c3a9736dd69
+  metadata.gz: 54534ecfdc1ef2b0ae192fbdfee3255021100e182c8bec06d48b03d2ea7c669dfa8d626b724d2ccd1f99a3743956196242c13941c39e2363a33c24b2691dce22
+  data.tar.gz: c0c8bbc852f0ebc46f223668592a5b78484aa816ade2923f56f59552653fa893f683b2fe408ba9f19fc3391bc8d200bfcf90f12384d3bec812cbd62a776f5c1d

data/CHANGES.txt

@@ -1,8 +1,91 @@
-=== 7.3.6
+=== 8.1.2
 
-  * Fix "Calling Net::SSH::Buffer methods on HostKeyEntries PubKey is deprecated" warnings printed on every connection to a host in known_hosts since 7.3.4 [#1026, #1028]
+  * Security: verify the proxy's certificate and hostname in `Net::SSH::Proxy::HTTPS` by default, and the hostname with any verifying `:ssl_context`; any certificate was accepted, exposing the proxy credentials to a man-in-the-middle. A self-signed or private CA proxy now needs an `:ssl_context` that trusts it, or one with `verify_mode = OpenSSL::SSL::VERIFY_NONE` to skip verification. Thanks @fuzzyrichie [GHSA-qcf4-j55x-72hv]
 
-=== 7.3.5
+=== 8.1.1
+
+  * Security: refuse host keys marked `@revoked` in known_hosts, and certificates of such a key or signed by it, by raising the new `Net::SSH::HostKeyRevoked`, which `remember_host!` can't override; these lines were loaded as trusted keys, so every verifier except `:never` accepted the revoked key [GHSA-hjwv-j52r-xcg7]
+
+=== 8.1.0
+
+  * BREAKING: Publickey auth offers each RSA key and certificate once, with the first `pubkey_algorithms` entry the server lists in RFC 8308 `server-sig-algs`, as OpenSSH does, so refused RSA keys no longer use up `MaxAuthTries` two or three at a time. Servers that send no `server-sig-algs` (OpenSSH 7.1 and older, some other servers) are offered RSA keys only as `ssh-rsa`, and only when it's enabled (e.g. `pubkey_algorithms: %w[+ssh-rsa]`); by default RSA keys are skipped there instead of being tried with rsa-sha2-512/256; OpenSSH 7.2 to 9.5 servers that accept only `ssh-rsa` still list rsa-sha2-* in `server-sig-algs`, so they need `ssh-rsa` first (`pubkey_algorithms: %w[^ssh-rsa]`) [#886, #1077]
+  * BREAKING: A `Match` block containing a condition net-ssh does not support (`exec`, `canonical`, `final`, `localnetwork`, `tagged`, ...) no longer matches and prints a warning, where the condition used to be ignored; `Match User`, `OriginalHost` and `LocalUser` are now evaluated, so e.g. `Match User x Host y` no longer applies to every user [#782, #1076]
+  * BREAKING: Net::SSH.start no longer prompts for passwords, passphrases or keyboard-interactive responses when $stdin is not a TTY, matching OpenSSH; this fixes Errno::EPIPE in background jobs. Pass `prompt_without_tty: true` to prompt anyway, e.g. for a piped password [#967, #1073]
+  * Package only `lib`, `CHANGES.txt`, `LICENSE.txt` and `README.md` in the gem, about 10% smaller. Thanks @yuri-zubov [#1081]
+  * Buffer#append now forces BINARY encoding so Channel#send_data chunks multibyte UTF-8 data by bytes instead of characters and no longer exceeds the remote maximum packet size [#1080, #1079]
+  * The default password prompt runs the `SSH_ASKPASS` program when there is no terminal, following the OpenSSH `SSH_ASKPASS_REQUIRE` and `DISPLAY` rules [#1075]
+  * Publickey and hostbased authentication now log key fingerprints using `:fingerprint_hash` (default SHA256) instead of MD5, fixing a crash with debug logging on FIPS-enabled OpenSSL [#936, #1074]
+
+=== 8.0.4
+
+  * Security: validate every ProxyJump hop, not only the first, as [user@]host[:port] (refusing a path, query, fragment or password) and shell-escape the hops passed to ssh -J; a hop such as `evil/x&$(cmd)` ran `cmd` through the shell [GHSA-g2r2-x3p2-5677]
+
+=== 8.0.3
+
+  * Add `preopen_channels` option: keep a spare session channel open so each command saves a round trip [#1071]
+
+=== 8.0.2
+
+  * Fixed `Session#close` raising `EOFError: cannot send data if channel has declared eof` when a forwarded connection still had unread data from its local client; data net-ssh had already read is still sent before the EOF and, as in OpenSSH, the rest is dropped; a regression in 8.0.0 [#1066, #1067]
+
+=== 8.0.1
+
+  * Fixed `unexpected packet type 94 during initial key exchange` (or 93) when channel data arrives during a client-initiated re-key, which broke bulk transfers at the first re-key (e.g. with `rekey_limit`, or after about 1 GB); a regression in 7.3.5 and 8.0.0 [#1063]
+  * `control_master: :auto` now ignores `forward_agent` (logged at info level) instead of raising ArgumentError, and logs the ignored connection options at info instead of warn level, so it works with sshkit (Kamal, Capistrano), which always passes `forward_agent: true`, `keys`, `known_hosts` and `keepalive` [#1062]
+
+=== 8.0.0
+
+  * No changes since 8.0.0 rc5.
+
+=== 8.0.0 rc5
+
+  * BREAKING: Security: a custom `verify_host_key` verifier must now implement `verify_signature` (deprecated since 5.1.0) or ArgumentError is raised; such verifiers were previously wrapped so the server's host key signature was never checked [#1050]
+  * BREAKING: Unsupported key types now raise `Net::SSH::UnsupportedKeyType` (a `Net::SSH::Exception`) instead of `NotImplementedError`; code that rescued `NotImplementedError` around key loading or connecting should rescue the new class [#945, #1060]
+  * BREAKING: `Net::SSH.start` raises ArgumentError for option values that are `nil` or arrays containing `nil` (deprecated since 4.0.0); omit the option to use the default or ssh_config value, the error names a value that turns it off where one exists (e.g. `proxy: false`, `keys: []`, `config: false`). `password: nil` and `passphrase: nil` are still accepted [#458, #1053]
+  * BREAKING: removed the `:paranoid` option (deprecated since 4.2.0); use `:verify_host_key` with the same values. Passing `:paranoid` raises ArgumentError [#1050]
+  * BREAKING: removed the `verify_host_key` values `false`, `true`, `:very` and `:secure` (deprecated since 5.0.0); use `:never`, `:accept_new_or_local_tunnel`, `:accept_new` and `:always` respectively. The old values raise ArgumentError naming the replacement [#1050]
+  * BREAKING: `Net::SSH::HostKeyEntries::PubKey` (the known_hosts entries returned by `KnownHosts.search_for`) no longer forwards methods to the wrapped key (deprecated since 7.0.0); use `ssh_type`, `to_blob` or `matches_key?`, or the new `key` reader for the wrapped public key [#1050]
+  * Security: `append_all_supported_algorithms: true` no longer enables the `none` cipher and MAC; name them explicitly (`encryption: '+none'`, `hmac: '+none'`) to use them [#1051]
+  * Security: `diffie-hellman-group-exchange-sha1/sha256` now requires groups of at least 2048 bits and requests sizes from the negotiated ciphers, as OpenSSH since 7.2, and rejects invalid server groups and DH public values; like OpenSSH, the requested group size is capped at 4096 bits for Cisco servers. Pass `minimum_dh_bits: 1024` to connect to legacy servers that only offer 1024-bit groups. `minimum_dh_bits` values other than 1024 no longer fail key exchange with "could not verify server signature" [#1049]
+  * Security: `diffie-hellman-group14-sha1` is no longer offered by default for key exchange, as in OpenSSH since 8.2; add `KexAlgorithms +diffie-hellman-group14-sha1` in ssh_config (or `kex: '+diffie-hellman-group14-sha1'`) or pass `append_all_supported_algorithms: true` to re-enable [#705, #1042]
+  * Changelog entries are now added as `changelog.d/<PR number>.<type>.txt` fragment files instead of editing CHANGES.txt, and CI requires one per PR; see CONTRIBUTING.md [#1058]
+  * `Net::SSH.start(host, user, control_master: :auto)` reuses an already running OpenSSH ControlMaster found via `:control_path` or ssh_config `ControlPath`, falling back to a normal connection when there is none [#443, #1057]
+  * Default `max_win_size` is now 2 MB as in OpenSSH (was 128 KB), which avoids truncated output from some devices (e.g. Mikrotik); pass `max_win_size: 0x20000` for the old behaviour [#726, #1055]
+  * Added `hmac-sha1-etm@openssh.com`, offered by default after the SHA2 etm MACs as in OpenSSH [#985, #1056]
+  * `Net::SSH::Proxy::Jump` `options:` values may be an Array for ssh_config options that can be given more than once (`IdentityFile`, `CertificateFile`, `SendEnv`); each element is passed as its own `-o Key=value`, an empty Array passes nothing, and a `nil` value (alone or in an Array) raises ArgumentError as in `Net::SSH.start` [#1052]
+  * `ssh-rsa-cert-v00@openssh.com` host keys are deprecated and warn when named in `host_key`/`HostKeyAlgorithms` or negotiated; net-ssh cannot parse v00 certificates, use `ssh-rsa-cert-v01@openssh.com` or a modern key type [#1051]
+  * README: weak algorithms (CBC/3DES/Blowfish ciphers, `ssh-dss`, `diffie-hellman-group1-sha1`, old MACs, ...) stay available as opt-ins for legacy servers rather than being removed in 8.0 [#1051]
+  * An ssh-agent that fails while listing keys (e.g. closes the connection) is now skipped and key files are still tried, as in OpenSSH, instead of aborting authentication [#867, #1048]
+  * `%r` in a ProxyCommand now defaults to the connection's user, as in OpenSSH, instead of raising unless `:remote_user` is set [#881, #787, #1047]
+  * `Net::SSH.start` no longer modifies the options hash passed to it [#989, #1046]
+  * `Session#exec!` with a block now returns an empty string with `exitstatus` (like the non-block form) instead of `nil` [#848, #1045]
+  * ssh_config `KexAlgorithms` is now honoured and maps to `:kex`, including `+`, `-` and `^`; it was previously ignored [#1042]
+  * `Net::SSH::Proxy::Jump.new` accepts `options:`, a Hash of ssh_config options passed to the jump host's ssh command as escaped `-o Key=value` arguments, e.g. `options: { 'StrictHostKeyChecking' => 'no' }` [#915, #1041]
+  * `Net::SSH::Proxy::Jump` no longer fails with "unknown key" or substitutes the target host when the `config:` path contains `%` [#1041]
+
+=== 8.0.0 rc4
+
+  * Security: RSA signatures using SHA-1 (`ssh-rsa`, `ssh-rsa-cert-v01@openssh.com`) are no longer offered by default for host keys or public key authentication, as in OpenSSH since 8.8; RSA keys keep working via rsa-sha2-256/512. For servers that only support SHA-1 add `HostKeyAlgorithms +ssh-rsa` / `PubkeyAcceptedAlgorithms +ssh-rsa` in ssh_config (or `host_key: '+ssh-rsa'` / `pubkey_algorithms: %w[+ssh-rsa]`), or pass `append_all_supported_algorithms: true` [#1039]
+  * Security: ssh_config `PubkeyAcceptedAlgorithms` (and its old name `PubkeyAcceptedKeyTypes`) is now honoured, including `+`, `-` and `^`, and `pubkey_algorithms` now applies to all key types instead of only RSA, adding `rsa-sha2-512`; DSA (`ssh-dss`) keys are no longer offered by default, as in OpenSSH since 7.0 — add `+ssh-dss` or pass `append_all_supported_algorithms: true` to re-enable [#923]
+  * Security: ssh_config `Ciphers`, `MACs`, `KexAlgorithms` and `HostKeyAlgorithms` lists starting with `+`, `-` or `^` now append to, remove from or prepend to the default list, as in OpenSSH, instead of silently enabling every supported algorithm including weak ones that are off by default; every listed item is honoured and `-` accepts wildcards. Pass `append_all_supported_algorithms: true` to also get the full supported list [#925]
+  * Support agent-backed FIDO/U2F security keys (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) for publickey auth [#1007]
+  * Port forwarding no longer buffers a whole stream in memory when one side reads slowly: like OpenSSH, window is granted only as data is written to the local socket, and the local socket is read only while the remote window has room. An application that writes everything to a forwarded port before reading anything now blocks once the window fills, as it would with `ssh -L` or a direct TCP connection; the old unbounded buffering hid this [#1037, #1003]
+  * Data forwarded to a local socket just before the remote end sends EOF or closes the channel is no longer truncated or dropped: it is written out before the socket is shut down or closed, without blocking the event loop until the local application reads [#1037]
+  * Multi-factor authentication works when the server's AuthenticationMethods order differs from net-ssh's: after each partial success the allowed methods are tried again, as OpenSSH does [#873, #872]
+  * `HostKeyError#host`, `#port` and `#ip` now return the connected host, port and IP (`ip` is nil through a ProxyCommand) instead of always nil [#963]
+  * OpenSSH-format private keys with Windows (CRLF) line endings now load [#922, #921]
+  * Send CHANNEL_EOF before CHANNEL_CLOSE when closing a session's remaining channels, as OpenSSH does; fixes hangs at close with servers that wait for EOF, such as some SFTP servers [#672]
+  * ssh_config: trailing `# comments` are now ignored, as in OpenSSH; a `#` inside quotes or in the middle of a word is kept [#990]
+
+=== 8.0.0 rc3
+
+  * Fix "Calling Net::SSH::Buffer methods on HostKeyEntries PubKey is deprecated" warnings printed on every connection to a host in known_hosts [#1026, #1027]
+  * `ProxyJump none` now means no proxy instead of jumping through a host named "none", and `ProxyCommand none` is matched case-insensitively, as in OpenSSH [#893, #972, #1030]
+  * Send SIGHUP to the ProxyCommand process on close, as OpenSSH does, so tunnels such as EC2 Instance Connect Endpoint no longer hang at exit [#947]
+  * Reconnect when the ssh-agent closes the connection on the legacy version request (e.g. older Proton Pass) instead of raising FrozenError [#1008]
+  * ssh_config: parse `Key = value` lines like OpenSSH (the value no longer keeps the leading space, and the keyword ends at the first `=`), and honor ProxyJump/ProxyCommand before the first Host [#1034]
+
+=== 8.0.0 rc2
 
   * Security: refuse agent channels opened by the server unless agent forwarding was requested (`forward_agent`, ForwardAgent, or `Forward#agent`); any use of port forwarding let a malicious server use the local ssh-agent [GHSA-qpg5-fx6p-8cq3]
   * Security: reject host and user names containing shell metacharacters, and non-numeric ports, before substituting them into ProxyCommand/ProxyJump commands, as OpenSSH does since 9.6 [GHSA-3x7f-q7wf-fp73]
@@ -11,9 +94,27 @@
   * Security: reject packet lengths below 5 or above 256 KB, as OpenSSH does [GHSA-pfqh-p9vh-wx4p]
   * Security: treat unexpected packets during the initial key exchange as a protocol error, and bound packets queued during a re-key [GHSA-ggxh-cfwq-5xqc]
 
-=== 7.3.4
+=== 8.0.0 rc1
+
+  * BREAKING: TCP_NODELAY is now set on the connection socket by default, as OpenSSH does; pass `no_delay: false` to keep Nagle's algorithm on [#1017]
+  * Ruby 4.0 support: add `logger` as a runtime dependency; Windows Pageant users on Ruby 4.0 need `fiddle` in their Gemfile [#984, #1012]
+  * Close the socket when connection setup fails, e.g. on a server version timeout [#1013]
+  * Ignore SSH_MSG_EXT_INFO from servers that send it unrequested [#1020]
+  * Fix `undefined method 'to_pem'` for ECDSA key_data when an agent is running [#982]
+  * Agent forwarding connects to the agent set by `identity_agent`/IdentityAgent [#974]
+  * Keyboard-interactive prompts show input when the server asks for it to be echoed [#1014]
+  * Raise Net::SSH::Exception on a truncated KEXINIT [#1016]
+  * Remote forwarding no longer prints diagnostics to stdout [#953]
+
+=== 8.0.0 beta3
+
+  * Verify @cert-authority host certificate constraints — principals (shell-glob, matching OpenSSH), validity window, host type, and critical options — instead of trusting any CA-signed certificate for any host [#1009]
+
+=== 8.0.0 beta1
 
-  * Verify @cert-authority host certificate constraints — principals (shell-glob, matching OpenSSH), validity window, host type, and critical options — instead of trusting any CA-signed certificate for any host [#1010]
+  * BREAKING: require Ruby 2.7 and the openssl gem >= 3.2 [#1001]
+  * Use OpenSSL for Ed25519, X25519 and ChaCha20-Poly1305; the ed25519, x25519 and rbnacl gems are no longer needed [#1001]
+  * Support AEAD-encrypted OpenSSH private keys [#1001]
 
 === 7.3.3
 

data/README.md

@@ -28,67 +28,75 @@ It allows you to write programs that invoke and interact with processes on remot
 
 ## Supported Algorithms
 
-Net::SSH 6.0 disables by default the usage of weak algorithms.
-We strongly recommend that you install a servers's version that supports the latest algorithms.
+Net::SSH only offers secure algorithms by default.
+We strongly recommend that you install a server version that supports the latest algorithms.
 
-It is possible to return to the previous behavior by adding the option : `append_all_supported_algorithms: true`
-
-Unsecure algoritms will definitely be removed in Net::SSH 8.*.
+Weak algorithms are still supported as opt-ins, so legacy servers such as embedded routers and old network gear stay reachable. To enable one, prefix it with `+` in the matching option, e.g. `encryption: '+aes256-cbc'`, `hmac: '+hmac-sha1-96'`, `kex: '+diffie-hellman-group1-sha1'`, `host_key: '+ssh-dss'`, or in ssh_config with `Ciphers`, `MACs`, `KexAlgorithms`, `HostKeyAlgorithms` and `PubkeyAcceptedAlgorithms` (e.g. `Ciphers +aes256-cbc`). Passing `append_all_supported_algorithms: true` appends every supported algorithm except the `none` cipher and MAC, which are only used when named explicitly (e.g. `encryption: '+none'`, `hmac: '+none'`).
 
 ### Host Keys
 
-| Name                 | Support               | Details  |
-|----------------------|-----------------------|----------|
-| ssh-rsa              | OK                    |          |
-| ssh-ed25519          | OK                    | Require the gem `ed25519` |
-| ecdsa-sha2-nistp521  | OK                    | [using weak elliptic curves](https://safecurves.cr.yp.to/) |
-| ecdsa-sha2-nistp384  | OK                    | [using weak elliptic curves](https://safecurves.cr.yp.to/) |
-| ecdsa-sha2-nistp256  | OK                    | [using weak elliptic curves](https://safecurves.cr.yp.to/) |
-| ssh-dss              | Deprecated in 6.0     | unsecure, will be removed in 8.0 |
+| Name                                     | Support                | Details  |
+|------------------------------------------|------------------------|----------|
+| ssh-ed25519                              | OK                     | Backed by Ruby OpenSSL raw Ed25519 APIs (`openssl >= 3.2.0`) |
+| ssh-ed25519-cert-v01@openssh.com         | OK                     | Backed by Ruby OpenSSL raw Ed25519 APIs (`openssl >= 3.2.0`) |
+| ecdsa-sha2-nistp521/384/256              | OK                     | [using weak elliptic curves](https://safecurves.cr.yp.to/) |
+| ecdsa-sha2-nistp521/384/256-cert-v01@openssh.com | OK             | [using weak elliptic curves](https://safecurves.cr.yp.to/) |
+| rsa-sha2-512                             | OK                     |          |
+| rsa-sha2-256                             | OK                     |          |
+| ssh-rsa                                  | Not offered by default | SHA-1 signatures, off by default as in OpenSSH 8.8; opt-in for legacy servers with `HostKeyAlgorithms +ssh-rsa` or `host_key: '+ssh-rsa'` |
+| ssh-rsa-cert-v01@openssh.com             | Not offered by default | SHA-1 signatures; opt-in for legacy servers |
+| ssh-rsa-cert-v00@openssh.com             | Deprecated             | not offered by default, warns when used and will be removed; net-ssh cannot parse v00 certificates, use ssh-rsa-cert-v01@openssh.com or a modern key type |
+| ssh-dss                                  | Not offered by default | unsecure, off by default as in OpenSSH 7.0; opt-in for legacy servers |
+
+RSA public key authentication likewise uses rsa-sha2-512 or rsa-sha2-256 by default; ssh-rsa and ssh-dss keys are only offered when enabled, e.g. with `PubkeyAcceptedAlgorithms +ssh-rsa` or `pubkey_algorithms: %w[+ssh-rsa]`.
 
 ### Key Exchange
 
-| Name                                 | Support               | Details  |
-|--------------------------------------|-----------------------|----------|
-| curve25519-sha256                    | OK                    | Require the gem `x25519` |
-| ecdh-sha2-nistp521                   | OK                    | [using weak elliptic curves](https://safecurves.cr.yp.to/) |
-| ecdh-sha2-nistp384                   | OK                    | [using weak elliptic curves](https://safecurves.cr.yp.to/) |
-| ecdh-sha2-nistp256                   | OK                    | [using weak elliptic curves](https://safecurves.cr.yp.to/) |
-| diffie-hellman-group1-sha1           | Deprecated in 6.0     | unsecure, will be removed in 8.0 |
-| diffie-hellman-group14-sha1          | OK                    |          |
-| diffie-hellman-group-exchange-sha1   | Deprecated in 6.0     | unsecure, will be removed in 8.0 |
-| diffie-hellman-group-exchange-sha256 | OK                    |          |
+| Name                                 | Support                | Details  |
+|--------------------------------------|------------------------|----------|
+| curve25519-sha256                    | OK                     | Backed by Ruby OpenSSL raw X25519 APIs (`openssl >= 3.2.0`) |
+| curve25519-sha256@libssh.org         | OK                     | Backed by Ruby OpenSSL raw X25519 APIs (`openssl >= 3.2.0`) |
+| ecdh-sha2-nistp521                   | OK                     | [using weak elliptic curves](https://safecurves.cr.yp.to/) |
+| ecdh-sha2-nistp384                   | OK                     | [using weak elliptic curves](https://safecurves.cr.yp.to/) |
+| ecdh-sha2-nistp256                   | OK                     | [using weak elliptic curves](https://safecurves.cr.yp.to/) |
+| diffie-hellman-group-exchange-sha256 | OK                     |          |
+| diffie-hellman-group14-sha256        | OK                     |          |
+| diffie-hellman-group14-sha1          | Not offered by default | SHA-1, off by default as in OpenSSH 8.2; opt-in for legacy servers with `KexAlgorithms +diffie-hellman-group14-sha1` or `kex: '+diffie-hellman-group14-sha1'` |
+| diffie-hellman-group-exchange-sha1   | Not offered by default | unsecure; opt-in for legacy servers |
+| diffie-hellman-group1-sha1           | Not offered by default | unsecure; opt-in for legacy servers |
 
 ### Encryption algorithms (ciphers)
 
-| Name                                 | Support               | Details  |
-|--------------------------------------|-----------------------|----------|
-| aes256-ctr / aes192-ctr / aes128-ctr | OK                    |          |
-| chacha20-poly1305@openssh.com        | OK.                   | Requires the gem `rbnacl` |
-| aes256-cbc / aes192-cbc / aes128-cbc | Deprecated in 6.0     | unsecure, will be removed in 8.0 |
-| rijndael-cbc@lysator.liu.se          | Deprecated in 6.0     | unsecure, will be removed in 8.0 |
-| blowfish-ctr blowfish-cbc            | Deprecated in 6.0     | unsecure, will be removed in 8.0 |
-| cast128-ctr cast128-cbc              | Deprecated in 6.0     | unsecure, will be removed in 8.0 |
-| 3des-ctr 3des-cbc                    | Deprecated in 6.0     | unsecure, will be removed in 8.0 |
-| idea-cbc                             | Deprecated in 6.0     | unsecure, will be removed in 8.0 |
-| none                                 | Deprecated in 6.0     | unsecure, will be removed in 8.0 |
+| Name                                    | Support                | Details  |
+|-----------------------------------------|------------------------|----------|
+| chacha20-poly1305@openssh.com           | OK                     | Backed by Ruby OpenSSL ChaCha20 and Poly1305 APIs (`openssl >= 3.2.0`) |
+| aes256-ctr / aes192-ctr / aes128-ctr    | OK                     |          |
+| aes256-gcm@openssh.com / aes128-gcm@openssh.com | OK              |          |
+| aes256-cbc / aes192-cbc / aes128-cbc    | Not offered by default | unsecure; opt-in for legacy servers |
+| rijndael-cbc@lysator.liu.se             | Not offered by default | unsecure; opt-in for legacy servers |
+| blowfish-ctr blowfish-cbc               | Not offered by default | unsecure; opt-in for legacy servers |
+| cast128-ctr cast128-cbc                 | Not offered by default | unsecure; opt-in for legacy servers |
+| 3des-ctr 3des-cbc                       | Not offered by default | unsecure; opt-in for legacy servers |
+| idea-cbc                                | Not offered by default | unsecure; opt-in for legacy servers |
+| none                                    | Not offered by default | no encryption; only used when named explicitly, not added by `append_all_supported_algorithms` |
 
 ### Message Authentication Code algorithms
 
-| Name                 | Support               | Details  |
-|----------------------|-----------------------|----------|
-| hmac-sha2-512-etm    | OK                    |          |
-| hmac-sha2-256-etm    | OK                    |          |
-| hmac-sha2-512        | OK                    |          |
-| hmac-sha2-256        | OK                    |          |
-| hmac-sha2-512-96     | Deprecated in 6.0     | removed from the specification, will be removed in 8.0 |
-| hmac-sha2-256-96     | Deprecated in 6.0     | removed from the specification, will be removed in 8.0 |
-| hmac-sha1            | OK                    | for backward compatibility      |
-| hmac-sha1-96         | Deprecated in 6.0     | unsecure, will be removed in 8.0 |
-| hmac-ripemd160       | Deprecated in 6.0     | unsecure, will be removed in 8.0 |
-| hmac-md5             | Deprecated in 6.0     | unsecure, will be removed in 8.0 |
-| hmac-md5-96          | Deprecated in 6.0     | unsecure, will be removed in 8.0 |
-| none                 | Deprecated in 6.0     | unsecure, will be removed in 8.0 |
+| Name                          | Support                | Details  |
+|-------------------------------|------------------------|----------|
+| hmac-sha2-512-etm@openssh.com | OK                     |          |
+| hmac-sha2-256-etm@openssh.com | OK                     |          |
+| hmac-sha1-etm@openssh.com     | OK                     | for backward compatibility |
+| hmac-sha2-512                 | OK                     |          |
+| hmac-sha2-256                 | OK                     |          |
+| hmac-sha1                     | OK                     | for backward compatibility |
+| hmac-sha2-512-96              | Not offered by default | removed from the specification; opt-in for legacy servers |
+| hmac-sha2-256-96              | Not offered by default | removed from the specification; opt-in for legacy servers |
+| hmac-sha1-96                  | Not offered by default | unsecure; opt-in for legacy servers |
+| hmac-ripemd160 / hmac-ripemd160@openssh.com | Not offered by default | unsecure; opt-in for legacy servers |
+| hmac-md5                      | Not offered by default | unsecure; opt-in for legacy servers |
+| hmac-md5-96                   | Not offered by default | unsecure; opt-in for legacy servers |
+| none                          | Not offered by default | no integrity protection; only used when named explicitly, not added by `append_all_supported_algorithms` |
 
 ## SYNOPSIS:
 
@@ -148,16 +156,16 @@ See Net::SSH for more documentation, and links to further information.
 
 ## REQUIREMENTS:
 
-The only requirement you might be missing is the OpenSSL bindings for Ruby with a version greather than `1.0.1`.
-These are built by default on most platforms, but you can verify that they're built and installed on your system by running the following command line:
+Net::SSH requires Ruby 2.7 or newer and the Ruby `openssl` gem version `3.2.0` or newer.
+The `openssl` gem uses the OpenSSL library Ruby is built against. You can verify the loaded gem and library with:
 
 ```sh
-ruby -ropenssl -e 'puts OpenSSL::OPENSSL_VERSION'
+ruby -ropenssl -e 'puts OpenSSL::VERSION; puts OpenSSL::OPENSSL_VERSION'
 ```
 
-If that spits out something like `OpenSSL 1.0.1 14 Mar 2012`, then you're set.
-If you get an error, then you'll need to see about rebuilding ruby with OpenSSL support,
-or (if your platform supports it) installing the OpenSSL bindings separately.
+If `openssl` cannot be required, rebuild Ruby with OpenSSL support or install the Ruby `openssl` gem separately.
+
+Ed25519, curve25519-sha256, and chacha20-poly1305@openssh.com support also require an OpenSSL backend with Ed25519, X25519, ChaCha20, and Poly1305 enabled.
 
 ## INSTALL:
 
@@ -188,14 +196,16 @@ gem install net-ssh -P HighSecurity
 If you don't add the public key, you'll see an error like "Couldn't verify data signature".
 If you're still having trouble let me know and I'll give you a hand.
 
-For ed25519 public key auth support your bundle file should contain `ed25519`, `bcrypt_pbkdf` dependencies.
+Ed25519 public key auth is backed by Ruby OpenSSL. The `bcrypt_pbkdf` gem is only needed when loading bcrypt-encrypted OpenSSH private keys.
 
 ```sh
-gem install ed25519
 gem install bcrypt_pbkdf
 ```
 
-For curve25519-sha256 kex exchange support your bundle file should contain `x25519` dependency.
+### FIDO/U2F security keys
+
+`sk-ecdsa-sha2-nistp256@openssh.com` and `sk-ssh-ed25519@openssh.com` keys work when held in `ssh-agent`.
+Loading `sk-*` private key files from disk is not supported.
 
 ## RUBY SUPPORT
 
@@ -250,6 +260,10 @@ gem cert --add net-ssh-public_cert.pem
 
 or `rake cert:update_public_when_expired`
 
+## CONTRIBUTING
+
+See [CONTRIBUTING.md](CONTRIBUTING.md), including how to add a changelog entry.
+
 ## Security contact information
 
 See [SECURITY.md](SECURITY.md)

data/lib/net/ssh/authentication/agent.rb

@@ -17,6 +17,9 @@ module Net
       # An exception for indicating that the SSH agent is not available.
       class AgentNotAvailable < AgentError; end
 
+      # Raised when the agent closes the connection before replying.
+      class AgentClosedConnection < AgentError; end
+
       # This class implements a simple client for the ssh-agent protocol. It
       # does not implement any specific protocol, but instead copies the
       # behavior of the ssh-agent functions in the OpenSSH library (3.8).
@@ -83,12 +86,18 @@ module Net
         # socket reports that it is an SSH2-compatible agent, this will fail
         # (it only supports the ssh-agent distributed by OpenSSH).
         def connect!(agent_socket_factory = nil, identity_agent = nil)
+          @agent_socket_factory = agent_socket_factory
+          @identity_agent = identity_agent
+          open_agent_socket!
+        end
+
+        def open_agent_socket!
           debug { "connecting to ssh-agent" }
           @socket =
-            if agent_socket_factory
-              agent_socket_factory.call
-            elsif identity_agent
-              unix_socket_class.open(File.expand_path(identity_agent))
+            if @agent_socket_factory
+              @agent_socket_factory.call
+            elsif @identity_agent
+              unix_socket_class.open(File.expand_path(@identity_agent))
             elsif ENV['SSH_AUTH_SOCK'] && unix_socket_class
               unix_socket_class.open(File.expand_path(ENV['SSH_AUTH_SOCK']))
             elsif Gem.win_platform? && RUBY_ENGINE != "jruby"
@@ -100,6 +109,7 @@ module Net
           error { "could not connect to ssh-agent: #{e.message}" }
           raise AgentNotAvailable, $!.message
         end
+        private :open_agent_socket!
 
         # Attempts to negotiate the SSH agent protocol version. Raises an error
         # if the version could not be negotiated successfully.
@@ -114,6 +124,11 @@ module Net
           elsif type != SSH_AGENT_RSA_IDENTITIES_ANSWER1 && type != SSH_AGENT_RSA_IDENTITIES_ANSWER2
             raise AgentNotAvailable, "unknown response from agent: #{type}, #{body.to_s.inspect}"
           end
+        rescue AgentClosedConnection
+          # Agents built on ssh-agent-lib <= 0.6.0 (e.g. older Proton Pass) drop the connection on
+          # this legacy request but handle the rest of the protocol (#1008).
+          debug { "ssh-agent closed the connection on the version request; assuming a modern agent and reconnecting" }
+          open_agent_socket!
         end
 
         # Return an array of all identities (public keys) known to the agent.
@@ -137,7 +152,7 @@ module Net
               key.extend(Comment)
               key.comment = comment_str
               identities.push key
-            rescue NotImplementedError => e
+            rescue Net::SSH::UnsupportedKeyType, NotImplementedError => e
               error { "ignoring unimplemented key:#{e.message} #{comment_str}" }
             end
           end
@@ -223,8 +238,14 @@ module Net
         # tuple consisting of the packet type, and the packet's body (which
         # is returned as a Net::SSH::Buffer).
         def read_packet
-          buffer = Net::SSH::Buffer.new(@socket.read(4))
-          buffer.append(@socket.read(buffer.read_long))
+          header = @socket.read(4)
+          raise AgentClosedConnection, "agent closed the connection" if header.nil?
+
+          buffer = Net::SSH::Buffer.new(header)
+          body = @socket.read(buffer.read_long)
+          raise AgentClosedConnection, "agent closed the connection" if body.nil?
+
+          buffer.append(body)
           type = buffer.read_byte
           debug { "received agent packet #{type} len #{buffer.length - 4}" }
           return type, buffer
@@ -235,6 +256,9 @@ module Net
         def send_and_wait(type, *args)
           send_packet(type, *args)
           read_packet
+        rescue Errno::ECONNRESET, Errno::EPIPE => e
+          # Linux reports an agent that closes with our request unread as a reset, not EOF.
+          raise AgentClosedConnection, "agent closed the connection (#{e.class})"
         end
 
         # Returns +true+ if the parameter indicates a "failure" response from
@@ -261,13 +285,13 @@ module Net
           when /^ecdsa\-sha2\-(\w*)-cert-v01@openssh\.com$/
             Net::SSH::Buffer.from(:string, priv_key.to_blob, :bignum, priv_key.key.private_key).to_s
           when /^ssh-ed25519$/
-            Net::SSH::Buffer.from(:string, priv_key.public_key.verify_key.to_bytes,
-                                  :string, priv_key.sign_key.keypair).to_s
+            Net::SSH::Buffer.from(:string, priv_key.public_key_bytes,
+                                  :string, priv_key.private_key_bytes_for_agent).to_s
           when /^ssh-ed25519-cert-v01@openssh\.com$/
             # Unlike the other certificate types, the public key is included after the certifiate.
             Net::SSH::Buffer.from(:string, priv_key.to_blob,
-                                  :string, priv_key.key.public_key.verify_key.to_bytes,
-                                  :string, priv_key.key.sign_key.keypair).to_s
+                                  :string, priv_key.key.public_key_bytes,
+                                  :string, priv_key.key.private_key_bytes_for_agent).to_s
           when /^ssh-rsa$/
             # `n` and `e` are reversed compared to the ordering in `OpenSSL::PKey::RSA#to_blob`.
             Net::SSH::Buffer.from(:bignum, priv_key.n, :bignum, priv_key.e, :bignum, priv_key.d,

data/lib/net/ssh/authentication/certificate.rb

@@ -78,8 +78,8 @@ module Net
           key.to_pem
         end
 
-        def fingerprint
-          key.fingerprint
+        def fingerprint(algorithm = 'MD5')
+          key.fingerprint(algorithm)
         end
 
         # Signs the certificate with key.