net-ssh 7.3.6 → 8.1.2

data/lib/net/ssh/authentication/session.rb

@@ -69,27 +69,22 @@ module Net
 
           attempted = []
 
-          @auth_methods.each do |name|
-            next unless @allowed_auth_methods.include?(name)
-
-            attempted << name
-
-            debug { "trying #{name}" }
-            begin
-              auth_class = Methods.const_get(name.split(/\W+/).map { |p| p.capitalize }.join)
-              method = auth_class.new(self,
-                                      key_manager: key_manager, password_prompt: options[:password_prompt],
-                                      pubkey_algorithms: options[:pubkey_algorithms] || nil)
-            rescue NameError
-              debug {"Mechanism #{name} was requested, but isn't a known type.  Ignoring it."}
-              next
+          # After a partial success (sshd AuthenticationMethods) restart from the most preferred method the server now allows, as OpenSSH does.
+          loop do
+            @partial_success = false
+
+            @auth_methods.each do |name|
+              next unless @allowed_auth_methods.include?(name)
+
+              attempted << name
+              return true if try_authenticate(name, next_service, username, password, key_manager)
+              break if @partial_success
             end
 
-            return true if method.authenticate(next_service, username, password)
-          rescue Net::SSH::Authentication::DisallowedMethod
+            break unless @partial_success
           end
 
-          error { "all authorization methods failed (tried #{attempted.join(', ')})" }
+          error { "all authorization methods failed (tried #{attempted.uniq.join(', ')})" }
           return false
         ensure
           key_manager.finish if key_manager
@@ -109,6 +104,7 @@ module Net
 
             when USERAUTH_FAILURE
               @allowed_auth_methods = packet[:authentications].split(/,/)
+              @partial_success ||= packet[:partial_success]
               debug { "allowed methods: #{packet[:authentications]}" }
               return packet
 
@@ -136,6 +132,23 @@ module Net
 
         private
 
+        def try_authenticate(method_name, next_service, username, password, key_manager)
+          debug { "trying #{method_name}" }
+          begin
+            auth_class = Methods.const_get(method_name.split(/\W+/).map { |p| p.capitalize }.join)
+            method = auth_class.new(self,
+                                    key_manager: key_manager, password_prompt: options[:password_prompt],
+                                    fingerprint_hash: options[:fingerprint_hash])
+          rescue NameError
+            debug {"Mechanism #{method_name} was requested, but isn't a known type.  Ignoring it."}
+            return false
+          end
+
+          method.authenticate(next_service, username, password)
+        rescue Net::SSH::Authentication::DisallowedMethod
+          false
+        end
+
         # Returns an array of paths to the key files usually defined
         # by system default.
         def default_keys

data/lib/net/ssh/buffer.rb

@@ -1,7 +1,9 @@
+require 'net/ssh/errors'
 require 'net/ssh/transport/openssl'
 
 require 'net/ssh/authentication/certificate'
 require 'net/ssh/authentication/ed25519_loader'
+require 'net/ssh/authentication/security_key'
 
 module Net
   module SSH
@@ -143,7 +145,7 @@ module Net
       # Appends the given text to the end of the buffer. Does not alter the
       # read position. Returns the buffer object itself.
       def append(text)
-        @content << text
+        @content << text.b
         self
       end
 
@@ -338,8 +340,11 @@ module Net
           key = Net::SSH::Authentication::ED25519::PubKey.read_keyblob(self)
         when /^ecdsa\-sha2\-(\w*)$/
           key = OpenSSL::PKey::EC.read_keyblob($1, self)
+        when Net::SSH::Authentication::SecurityKey::SK_ECDSA_SHA2_NISTP256,
+          Net::SSH::Authentication::SecurityKey::SK_SSH_ED25519
+          key = Net::SSH::Authentication::SecurityKey::PubKey.read_keyblob(type, self)
         else
-          raise NotImplementedError, "unsupported key type `#{type}'"
+          raise Net::SSH::UnsupportedKeyType, "unsupported key type `#{type}'"
         end
 
         return key
@@ -354,7 +359,7 @@ module Net
       # Writes the given data literally into the string. Does not alter the
       # read position. Returns the buffer object.
       def write(*data)
-        data.each { |datum| @content << datum.dup.force_encoding('BINARY') }
+        data.each { |datum| @content << datum.b }
         self
       end
 

data/lib/net/ssh/buffered_io.rb

@@ -166,6 +166,11 @@ module Net
     #    http://github.com/net-ssh/net-ssh/tree/portfwfix
     #
     module ForwardedBufferedIo
+      def self.extended(object) # :nodoc:
+        object.instance_variable_set(:@on_sent, nil)
+        object.instance_variable_set(:@shutdown_write_when_drained, false)
+      end
+
       def fill(n = 8192)
         begin
           super(n)
@@ -182,11 +187,25 @@ module Net
         end
       end
 
+      # Internal and experimental: registers a block called with the number of
+      # bytes each #send_pending wrote to the socket.
+      def on_sent(&block) # :nodoc:
+        @on_sent = block
+      end
+
       def send_pending
         begin
-          super
-        rescue Errno::ECONNRESET => e
-          debug { "connection was reset => shallowing exception:#{e}" }
+          pending = output.length
+          result = super
+          @on_sent.call(pending - output.length) if @on_sent && output.length < pending
+          shutdown_write_if_drained
+          result
+        rescue Errno::EPIPE, Errno::ECONNRESET => e
+          # Like OpenSSH's chan_write_failed: the peer is gone, so drop what it
+          # will never read and close, letting the forwarded channel close too.
+          debug { "write failed => discarding #{output.length} bytes and closing:#{e}" }
+          output.clear!
+          close
           return 0
         rescue IOError => e
           if e.message =~ /closed/ then
@@ -197,6 +216,24 @@ module Net
           end
         end
       end
+
+      # Internal: shuts down the write side once pending output has been sent,
+      # as OpenSSH does on CHANNEL_EOF (chan_rcvd_ieof, chan_obuf_empty).
+      def shutdown_write_when_drained # :nodoc:
+        @shutdown_write_when_drained = true
+        shutdown_write_if_drained
+      end
+
+      private
+
+      def shutdown_write_if_drained
+        return unless @shutdown_write_when_drained && output.empty? && !closed?
+
+        @shutdown_write_when_drained = false
+        shutdown(Socket::SHUT_WR)
+      rescue Errno::EPIPE, Errno::ENOTCONN => e
+        debug { "shutdown failed => shallowing exception:#{e}" }
+      end
     end
   end
 end

data/lib/net/ssh/config.rb

@@ -1,3 +1,6 @@
+require 'etc'
+require 'set'
+
 module Net
   module SSH
     # The Net::SSH::Config class is used to parse OpenSSH configuration files,
@@ -15,6 +18,8 @@ module Net
     # * Compression => :compression
     # * CompressionLevel => :compression_level
     # * ConnectTimeout => maps to the :timeout option
+    # * ControlPath => :control_path, used only when Net::SSH.start is given
+    #   control_master: :auto; ControlMaster itself is not read
     # * ForwardAgent => :forward_agent
     # * GlobalKnownHostsFile => :global_known_hosts_file
     # * HostBasedAuthentication => maps to the :auth_methods option
@@ -24,6 +29,7 @@ module Net
     # * IdentityFile => maps to the :keys option
     # * IdentityAgent => :identity_agent
     # * IdentitiesOnly => :keys_only
+    # * KexAlgorithms => maps to the :kex option
     # * CheckHostIP => :check_host_ip
     # * Macs => maps to the :hmac option
     # * PasswordAuthentication => maps to the :auth_methods option password
@@ -31,6 +37,7 @@ module Net
     # * PreferredAuthentications => maps to the :auth_methods option
     # * ProxyCommand => maps to the :proxy option
     # * ProxyJump => maps to the :proxy option
+    # * PubkeyAcceptedAlgorithms (or PubkeyAcceptedKeyTypes) => maps to :pubkey_algorithms
     # * PubKeyAuthentication => maps to the :auth_methods option
     # * RekeyLimit => :rekey_limit
     # * StrictHostKeyChecking => :verify_host_key
@@ -65,9 +72,19 @@ module Net
         # given +files+ (defaulting to the list of files returned by
         # #default_files), translates the resulting hash into the options
         # recognized by Net::SSH, and returns them.
-        def for(host, files = expandable_default_files)
+        #
+        # +user+ is the remote user given explicitly (e.g. to Net::SSH.start),
+        # used by <tt>Match User</tt>; when nil, the User set so far by the
+        # config, then the local user name, is used, as in OpenSSH.
+        #
+        # Match supports +all+, +Host+, +OriginalHost+, +User+ and +LocalUser+,
+        # each optionally negated with a leading "!". A Match block with any
+        # other condition (+exec+, +canonical+, +final+, +localnetwork+,
+        # +tagged+, ...) never matches, and a warning naming the condition is
+        # printed with Kernel#warn once per config line.
+        def for(host, files = expandable_default_files, user: nil)
           translate(files.inject({}) { |settings, file|
-            load(file, host, settings)
+            load(file, host, settings, user: user)
           })
         end
 
@@ -77,27 +94,26 @@ module Net
         # ones. Returns a hash containing the OpenSSH options. (See
         # #translate for how to convert the OpenSSH options into Net::SSH
         # options.)
-        def load(path, host, settings = {}, base_dir = nil)
+        def load(path, host, settings = {}, base_dir = nil, user: nil)
           file = File.expand_path(path)
           base_dir ||= File.dirname(file)
           return settings unless File.readable?(file)
 
           globals = {}
-          block_matched = false
-          block_seen = false
+          block_matched = block_seen = false
+          lineno = 0
           IO.foreach(file) do |line|
+            lineno += 1
             next if line =~ /^\s*(?:#.*)?$/
 
-            if line =~ /^\s*(\S+)\s*=(.*)$/
-              key, value = $1, $2
-            else
-              key, value = line.strip.split(/\s+/, 2)
-            end
+            # As in OpenSSH, the keyword ends at the first whitespace or "=".
+            key, value = line.strip.split(/\s*=\s*|\s+/, 2)
 
             # silently ignore malformed entries
             next if value.nil?
 
             key.downcase!
+            value = uncomment(value)
             value = unquote(value)
 
             value = case value.strip
@@ -125,7 +141,7 @@ module Net
               block_seen = true
               settings[key] = host
             elsif key == 'match'
-              block_matched = eval_match_conditions(value, host, settings)
+              block_matched = eval_match_conditions(value, host, [user, settings['user'], globals['user']].compact.first, "#{file} line #{lineno}")
               block_seen = true
             elsif !block_seen
               case key
@@ -133,7 +149,7 @@ module Net
                 (globals[key] ||= []) << value
               when 'include'
                 included_file_paths(base_dir, value).each do |file_path|
-                  globals = load(file_path, host, globals, base_dir)
+                  globals = load(file_path, host, globals, base_dir, user: user)
                 end
               else
                 globals[key] = value unless settings.key?(key)
@@ -144,7 +160,7 @@ module Net
                 (settings[key] ||= []) << value
               when 'include'
                 included_file_paths(base_dir, value).each do |file_path|
-                  settings = load(file_path, host, settings, base_dir)
+                  settings = load(file_path, host, settings, base_dir, user: user)
                 end
               else
                 settings[key] = value unless settings.key?(key)
@@ -152,9 +168,11 @@ module Net
             end
 
             # ProxyCommand and ProxyJump override each other so they need to be tracked togeather
-            %w[proxyjump proxycommand].each do |proxy_key|
-              if (proxy_value = settings.delete(proxy_key))
-                settings['proxy'] ||= [proxy_key, proxy_value]
+            [globals, settings].each do |hash|
+              %w[proxyjump proxycommand].each do |proxy_key|
+                if (proxy_value = hash.delete(proxy_key))
+                  hash['proxy'] ||= [proxy_key, proxy_value]
+                end
               end
             end
           end
@@ -218,6 +236,7 @@ module Net
           bindaddress: :bind_address,
           compression: :compression,
           compressionlevel: :compression_level,
+          controlpath: :control_path,
           certificatefile: :keycerts,
           connecttimeout: :timeout,
           forwardagent: :forward_agent,
@@ -231,7 +250,7 @@ module Net
           user: :user,
           checkhostip: :check_host_ip
         }.freeze
-        def translate_config_key(hash, key, value, settings)
+        def translate_config_key(hash, key, value, settings) # rubocop:disable Metrics/AbcSize
           case key
           when :stricthostkeychecking
             hash[:verify_host_key] = translate_verify_host_key(value)
@@ -247,6 +266,8 @@ module Net
             hash[:host_key] = value.split(/,/)
           when :hostname
             hash[:host_name] = value.gsub(/%h/, settings['host'])
+          when :kexalgorithms
+            hash[:kex] = value.split(/,/)
           when :macs
             hash[:hmac] = value.split(/,/)
           when :serveralivecountmax
@@ -277,6 +298,8 @@ module Net
             if (proxy = setup_proxy(*value))
               hash[:proxy] = proxy
             end
+          when :pubkeyacceptedalgorithms, :pubkeyacceptedkeytypes
+            hash[:pubkey_algorithms] = value.split(/,/)
           when :pubkeyauthentication
             if value
               (hash[:auth_methods] << 'publickey').uniq!
@@ -302,19 +325,21 @@ module Net
         def setup_proxy(type, value)
           case type
           when 'proxycommand'
-            if value !~ /^none$/
+            if value !~ /^none$/i
               require 'net/ssh/proxy/command'
               Net::SSH::Proxy::Command.new(value)
             end
           when 'proxyjump'
-            require 'net/ssh/proxy/jump'
-            Net::SSH::Proxy::Jump.new(value)
+            if value !~ /^none$/i
+              require 'net/ssh/proxy/jump'
+              Net::SSH::Proxy::Jump.new(value)
+            end
           end
         end
 
         # Converts an ssh_config pattern into a regex for matching against
         # host names.
-        def pattern2regex(pattern)
+        def pattern2regex(pattern, ignore_case: true)
           tail = pattern
           prefix = String.new
           while !tail.empty? do
@@ -330,7 +355,7 @@ module Net
               fail "Unpexpcted sep:#{sep}"
             end
           end
-          Regexp.new("^" + prefix + "$", true)
+          Regexp.new("^" + prefix + "$", ignore_case)
         end
 
         # Converts the given size into an integer number of bytes.
@@ -363,39 +388,87 @@ module Net
           str.scan(/([^"\s]+)?(?:"([^"]+)")?\s*/).map(&:join)
         end
 
-        def eval_match_conditions(condition, host, settings)
+        MATCH_CONDITIONS_WITHOUT_ARGUMENT = %w[all canonical final].freeze
+        SUPPORTED_MATCH_CONDITIONS = %w[all host originalhost user localuser].freeze
+
+        def eval_match_conditions(condition, host, remote_user, location)
           # Not using `\s` for whitespace matching as canonical
           # ssh_config parser implementation (OpenSSH) has specific character set.
           # Ref: https://github.com/openssh/openssh-portable/blob/2581333d564d8697837729b3d07d45738eaf5a54/misc.c#L237-L239
-          conditions = condition.split(/[ \t\r\n]+|(?<!=)=(?!=)/).reject(&:empty?)
-          return true if conditions == ["all"]
-
-          conditions = conditions.each_slice(2)
-          condition_matches = []
-          conditions.each do |(kind, exprs)|
-            exprs = unquote(exprs)
-
-            case kind.downcase
-            when "all"
-              raise "all cannot be mixed with other conditions"
-            when "host"
-              if exprs.start_with?('!')
-                negated = true
-                exprs = exprs[1..-1]
-              else
-                negated = false
-              end
-              condition_met = false
-              exprs.split(",").each do |expr|
-                condition_met = condition_met || host =~ pattern2regex(expr)
-              end
-              condition_matches << (true && negated ^ condition_met)
-              # else
-              # warn "net-ssh: Unsupported expr in Match block: #{kind}"
-            end
+          tokens = condition.split(/[ \t\r\n]+|(?<!=)=(?!=)/).reject(&:empty?)
+          return true if tokens == ["all"]
+
+          conditions = parse_match_conditions(tokens)
+          unsupported = conditions.find { |_kind, name, exprs|
+            !SUPPORTED_MATCH_CONDITIONS.include?(name) || (name != 'all' && exprs.nil?)
+          }
+          if unsupported
+            warn_unsupported_match(unsupported[0], location)
+            return false
+          end
+
+          !conditions.empty? && conditions.all? do |kind, name, exprs|
+            kind.start_with?('!') ^ match_condition?(name, exprs, host, remote_user || local_user, conditions.size)
+          end
+        end
+
+        def parse_match_conditions(tokens)
+          conditions = []
+          until tokens.empty?
+            kind = tokens.shift
+            name = kind.delete_prefix('!').downcase
+            exprs = tokens.shift unless MATCH_CONDITIONS_WITHOUT_ARGUMENT.include?(name)
+            conditions << [kind, name, exprs && unquote(exprs)]
           end
+          conditions
+        end
+
+        def match_condition?(name, exprs, host, remote_user, condition_count)
+          case name
+          when "all"
+            raise "all cannot be mixed with other conditions" if condition_count > 1
+
+            true
+          when "host"
+            negated = exprs.start_with?('!')
+            exprs = exprs[1..-1] if negated
+            negated ^ exprs.split(",").any? { |expr| host =~ pattern2regex(expr) }
+          when "originalhost"
+            match_pattern_list(host, exprs)
+          when "user"
+            match_pattern_list(remote_user, exprs, ignore_case: false)
+          when "localuser"
+            match_pattern_list(local_user, exprs, ignore_case: false)
+          end
+        end
+
+        # OpenSSH's match_pattern_list: true if any pattern matches and no "!pattern" does.
+        def match_pattern_list(string, list, ignore_case: true)
+          matched = false
+          list.split(",").each do |pattern|
+            negated = pattern.start_with?('!')
+            next unless string =~ pattern2regex(negated ? pattern[1..-1] : pattern, ignore_case: ignore_case)
+            return false if negated
+
+            matched = true
+          end
+          matched
+        end
+
+        def warn_unsupported_match(kind, location)
+          @warned_unsupported_matches ||= Set.new
+          return unless @warned_unsupported_matches.add?([location, kind])
+
+          Kernel.warn("net-ssh: #{location}: unsupported Match condition '#{kind}', the Match block is skipped")
+        end
+
+        def local_user
+          Etc.getpwuid&.name || Etc.getlogin
+        end
 
-          !condition_matches.empty? && condition_matches.all?
+        # As in OpenSSH's argv_split, "#" starts a comment only at the start of a token and outside quotes.
+        def uncomment(string)
+          string[/\A(?:\s*(?!#)(?:\\.|"[^"]*"?|'[^']*'?|[^\s"'])+)*/]
         end
 
         def unquote(string)

data/lib/net/ssh/connection/channel.rb

@@ -55,6 +55,9 @@ module Net
         include Loggable
         include Constants
 
+        # OpenSSH's CHAN_SES_WINDOW_DEFAULT; some servers (e.g. Mikrotik) truncate output with smaller windows (#726).
+        DEFAULT_MAX_WIN_SIZE = 0x200000
+
         # The local id for this channel, assigned by the Net::SSH::Connection::Session instance.
         attr_reader :local_id
 
@@ -109,7 +112,7 @@ module Net
         # that time (see #do_open_confirmation).
         #
         # This also sets the default maximum packet size and maximum window size.
-        def initialize(connection, type, local_id, max_pkt_size = 0x8000, max_win_size = 0x20000, &on_confirm_open)
+        def initialize(connection, type, local_id, max_pkt_size = 0x8000, max_win_size = DEFAULT_MAX_WIN_SIZE, &on_confirm_open)
           self.logger = connection.logger
 
           @connection = connection
@@ -118,6 +121,8 @@ module Net
 
           @local_maximum_packet_size = max_pkt_size
           @local_window_size = @local_maximum_window_size = max_win_size
+          @local_consumed = 0
+          @grant_window_on_consume = false
 
           @on_confirm_open = on_confirm_open
 
@@ -254,6 +259,26 @@ module Net
           output.append(data.to_s)
         end
 
+        # Internal and experimental, used by port forwarding: from now on window
+        # is granted only for bytes reported via #consumed, so a slow consumer
+        # stalls the remote sender instead of buffering everything it sends.
+        # Must be called before any data is received.
+        def grant_window_on_consume! # :nodoc:
+          raise ArgumentError, "grant_window_on_consume! must be called before any data is received" if local_window_size != local_maximum_window_size
+
+          @grant_window_on_consume = true
+        end
+
+        # Internal and experimental: reports that +bytes+ of received data have
+        # been processed, letting the remote end send that much more.
+        def consumed(bytes) # :nodoc:
+          raise ArgumentError, "consumed requires grant_window_on_consume!" unless @grant_window_on_consume
+          raise ArgumentError, "consumed bytes must not be negative" if bytes.negative?
+
+          @local_consumed += bytes
+          adjust_window_for_consumed
+        end
+
         # Returns true if the channel exists in the channel list of the session,
         # and false otherwise. This can be used to determine whether a channel has
         # been closed or not.
@@ -598,7 +623,12 @@ module Net
         # type, and data.
         def do_extended_data(type, data)
           update_local_window_size(data.length)
-          @on_extended_data.call(self, type, data) if @on_extended_data
+          if @on_extended_data
+            @on_extended_data.call(self, type, data)
+          elsif @grant_window_on_consume
+            # Nothing will ever consume it, so don't let it shrink the window.
+            consumed(data.length)
+          end
         end
 
         # Invokes the #on_eof callback when the server indicates that no
@@ -651,6 +681,8 @@ module Net
         # server telling it that the window size has grown.
         def update_local_window_size(size)
           @local_window_size -= size
+          return adjust_window_for_consumed if @grant_window_on_consume
+
           if local_window_size < local_maximum_window_size / 2
             connection.send_message(
               Buffer.from(:byte, CHANNEL_WINDOW_ADJUST, :long, remote_id, :long, LOCAL_WINDOW_SIZE_INCREMENT)
@@ -663,6 +695,21 @@ module Net
           end
         end
 
+        # Mirrors OpenSSH's channel_check_window: once the window is below half,
+        # give back what was consumed, growing the maximum window the same way
+        # #update_local_window_size does.
+        def adjust_window_for_consumed
+          return if @local_consumed.zero? || local_window_size >= local_maximum_window_size / 2
+          return if remote_id.nil? || local_closed? || remote_closed?
+
+          growth = (GOOD_LOCAL_MAXIUMUM_WINDOW_SIZE - local_maximum_window_size).clamp(0, LOCAL_WINDOW_SIZE_INCREMENT)
+          adjust = @local_consumed + growth
+          connection.send_message(Buffer.from(:byte, CHANNEL_WINDOW_ADJUST, :long, remote_id, :long, adjust))
+          @local_window_size += adjust
+          @local_maximum_window_size += growth
+          @local_consumed = 0
+        end
+
         # Gets an +Array+ of local environment variables in the remote process'
         # environment.
         # A variable name can either be described by a +Regexp+ or +String+.