net-ssh 8.0.0.rc3 → 8.0.0.rc5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 03f0ed4c48532bcfa337a176d655407155043de284d1428cd51a4bf2b7cb2f58
-  data.tar.gz: 49e8bbef56ac3139f5bb05cfad70afb33dda44227e9ce17f4424bd5aed749b95
+  metadata.gz: fc2758b484a06811ec2853426957b79679aa701a9d2f1c8eada66af175f4184b
+  data.tar.gz: a784146c91fadc72022221fe35a81dcbcefda0f4adcf49a54864209de8043335
 SHA512:
-  metadata.gz: 56ec747abdff1eb6a0cbfb03adb3f880246372afe864f421c4241881671b9ce49dc1dc37a30c9e75e52526284b7c05caab1f14d367f94a1cdd422e1cf4aea93d
-  data.tar.gz: df092fc1f9da4c85eaf3b305890e0635b9d16d72b3bf05711180a9c28652d97a987be3011bbf7610363d0a9412dafa056c527172519a92c2bf77e7f228bcade8
+  metadata.gz: 4e0068af7ac00f3cd3f6c5e4a704d85b4dc42970368c9a8882114c8430e01f0d8c8fcc288fd9a4c544995f83bbf17394f65476afedbc394bf3b23ad3db8e505a
+  data.tar.gz: 7af8864863409e1d4f3dbe15d51efd7eac78c28a19eb0c54306337c40becfcb5aa620e3c2672b0a45fc20814b1ec59a106c3414c9519a9bb762d3ea14139a739

checksums.yaml.gz.sig

@@ -1 +1,4 @@
-E��x��~o�$�>�d"W���f��WZ4���VE���[��*{dO�8F��dsd���E��I~���]�uԑL���=����= ]չ�Ӈ���I�>���J���Ç���;q=G�	�B=�s,��!���9�-M~����������~�J�V:�a�o�s(�7	D6r|z�+H>���y�=���QF�)��R�m��)�E݇AO�-o�c��d�q�.��j�0�t���]�r$�	���щ}5�=d����
+=�RR%�%���w�h�l� ��C�a��(�[�MJv�@tY��4!�A�>����h i�f
+)'��R,?�A�,D+FX��^h�q�섘C�s��Ex#x�q�b_��
�	�̌9N�f@
+����	��y���k
+w6Ղ�G������y|�XX���rmY4&K���2�42}�ż��~u��}�>�.G	��D�����X�@I6�=ߵr�	�}�����*�V��T�l~�@��{����4J�
�>��̜�T�_�

data/.github/pull_request_template.md

@@ -0,0 +1 @@
+<!-- After opening the PR, add a changelog.d/<PR number>.<type>.txt fragment (none, change, security, breaking or breaking-security) instead of editing CHANGES.txt; see CONTRIBUTING.md#changelog. -->

data/.github/workflows/changelog.yml

@@ -0,0 +1,43 @@
+name: Changelog
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, labeled, unlabeled]
+
+permissions:
+  contents: read
+
+jobs:
+  changelog:
+    if: ${{ github.event.pull_request.user.login != 'dependabot[bot]' }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # HEAD is the PR merged into the base branch; HEAD^1 is the base it was merged into.
+          fetch-depth: 2
+      - name: Set up Ruby 3.1
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: 3.1
+      - name: Validate fragments
+        run: rake changelog:check
+      - name: Require a fragment
+        if: ${{ !contains(github.event.pull_request.labels.*.name, 'skip-changelog') }}
+        env:
+          PR: ${{ github.event.number }}
+        run: |
+          changed=$(git diff --name-only HEAD^1 HEAD)
+          if echo "$changed" | grep -x 'CHANGES\.txt' > /dev/null; then
+            echo "::error::Don't edit CHANGES.txt, add a changelog.d/$PR.<type>.txt fragment instead, see CONTRIBUTING.md#changelog"
+            exit 1
+          fi
+          own=$(git diff --name-only --diff-filter=AMR HEAD^1 HEAD -- changelog.d/ | grep -E "^changelog\.d/$PR\.[a-z-]+(\.[0-9]+)?\.txt$" || true)
+          if [ -n "$own" ]; then
+            echo "Changelog fragments:"; echo "$own"
+          elif ! echo "$changed" | grep -v '^changelog\.d/' > /dev/null; then
+            echo "Only changelog.d/ changed, no fragment needed"
+          else
+            echo "::error::Add a changelog fragment named changelog.d/$PR.<type>.txt (use $PR.none.txt if nothing user-visible changed), see CONTRIBUTING.md#changelog"
+            exit 1
+          fi

data/CHANGES.txt

@@ -1,3 +1,43 @@
+=== 8.0.0 rc5
+
+  * BREAKING: Security: a custom `verify_host_key` verifier must now implement `verify_signature` (deprecated since 5.1.0) or ArgumentError is raised; such verifiers were previously wrapped so the server's host key signature was never checked [#1050]
+  * BREAKING: Unsupported key types now raise `Net::SSH::UnsupportedKeyType` (a `Net::SSH::Exception`) instead of `NotImplementedError`; code that rescued `NotImplementedError` around key loading or connecting should rescue the new class [#945, #1060]
+  * BREAKING: `Net::SSH.start` raises ArgumentError for option values that are `nil` or arrays containing `nil` (deprecated since 4.0.0); omit the option to use the default or ssh_config value, the error names a value that turns it off where one exists (e.g. `proxy: false`, `keys: []`, `config: false`). `password: nil` and `passphrase: nil` are still accepted [#458, #1053]
+  * BREAKING: removed the `:paranoid` option (deprecated since 4.2.0); use `:verify_host_key` with the same values. Passing `:paranoid` raises ArgumentError [#1050]
+  * BREAKING: removed the `verify_host_key` values `false`, `true`, `:very` and `:secure` (deprecated since 5.0.0); use `:never`, `:accept_new_or_local_tunnel`, `:accept_new` and `:always` respectively. The old values raise ArgumentError naming the replacement [#1050]
+  * BREAKING: `Net::SSH::HostKeyEntries::PubKey` (the known_hosts entries returned by `KnownHosts.search_for`) no longer forwards methods to the wrapped key (deprecated since 7.0.0); use `ssh_type`, `to_blob` or `matches_key?`, or the new `key` reader for the wrapped public key [#1050]
+  * Security: `append_all_supported_algorithms: true` no longer enables the `none` cipher and MAC; name them explicitly (`encryption: '+none'`, `hmac: '+none'`) to use them [#1051]
+  * Security: `diffie-hellman-group-exchange-sha1/sha256` now requires groups of at least 2048 bits and requests sizes from the negotiated ciphers, as OpenSSH since 7.2, and rejects invalid server groups and DH public values; like OpenSSH, the requested group size is capped at 4096 bits for Cisco servers. Pass `minimum_dh_bits: 1024` to connect to legacy servers that only offer 1024-bit groups. `minimum_dh_bits` values other than 1024 no longer fail key exchange with "could not verify server signature" [#1049]
+  * Security: `diffie-hellman-group14-sha1` is no longer offered by default for key exchange, as in OpenSSH since 8.2; add `KexAlgorithms +diffie-hellman-group14-sha1` in ssh_config (or `kex: '+diffie-hellman-group14-sha1'`) or pass `append_all_supported_algorithms: true` to re-enable [#705, #1042]
+  * Changelog entries are now added as `changelog.d/<PR number>.<type>.txt` fragment files instead of editing CHANGES.txt, and CI requires one per PR; see CONTRIBUTING.md [#1058]
+  * `Net::SSH.start(host, user, control_master: :auto)` reuses an already running OpenSSH ControlMaster found via `:control_path` or ssh_config `ControlPath`, falling back to a normal connection when there is none [#443, #1057]
+  * Default `max_win_size` is now 2 MB as in OpenSSH (was 128 KB), which avoids truncated output from some devices (e.g. Mikrotik); pass `max_win_size: 0x20000` for the old behaviour [#726, #1055]
+  * Added `hmac-sha1-etm@openssh.com`, offered by default after the SHA2 etm MACs as in OpenSSH [#985, #1056]
+  * `Net::SSH::Proxy::Jump` `options:` values may be an Array for ssh_config options that can be given more than once (`IdentityFile`, `CertificateFile`, `SendEnv`); each element is passed as its own `-o Key=value`, an empty Array passes nothing, and a `nil` value (alone or in an Array) raises ArgumentError as in `Net::SSH.start` [#1052]
+  * `ssh-rsa-cert-v00@openssh.com` host keys are deprecated and warn when named in `host_key`/`HostKeyAlgorithms` or negotiated; net-ssh cannot parse v00 certificates, use `ssh-rsa-cert-v01@openssh.com` or a modern key type [#1051]
+  * README: weak algorithms (CBC/3DES/Blowfish ciphers, `ssh-dss`, `diffie-hellman-group1-sha1`, old MACs, ...) stay available as opt-ins for legacy servers rather than being removed in 8.0 [#1051]
+  * An ssh-agent that fails while listing keys (e.g. closes the connection) is now skipped and key files are still tried, as in OpenSSH, instead of aborting authentication [#867, #1048]
+  * `%r` in a ProxyCommand now defaults to the connection's user, as in OpenSSH, instead of raising unless `:remote_user` is set [#881, #787, #1047]
+  * `Net::SSH.start` no longer modifies the options hash passed to it [#989, #1046]
+  * `Session#exec!` with a block now returns an empty string with `exitstatus` (like the non-block form) instead of `nil` [#848, #1045]
+  * ssh_config `KexAlgorithms` is now honoured and maps to `:kex`, including `+`, `-` and `^`; it was previously ignored [#1042]
+  * `Net::SSH::Proxy::Jump.new` accepts `options:`, a Hash of ssh_config options passed to the jump host's ssh command as escaped `-o Key=value` arguments, e.g. `options: { 'StrictHostKeyChecking' => 'no' }` [#915, #1041]
+  * `Net::SSH::Proxy::Jump` no longer fails with "unknown key" or substitutes the target host when the `config:` path contains `%` [#1041]
+
+=== 8.0.0 rc4
+
+  * Security: RSA signatures using SHA-1 (`ssh-rsa`, `ssh-rsa-cert-v01@openssh.com`) are no longer offered by default for host keys or public key authentication, as in OpenSSH since 8.8; RSA keys keep working via rsa-sha2-256/512. For servers that only support SHA-1 add `HostKeyAlgorithms +ssh-rsa` / `PubkeyAcceptedAlgorithms +ssh-rsa` in ssh_config (or `host_key: '+ssh-rsa'` / `pubkey_algorithms: %w[+ssh-rsa]`), or pass `append_all_supported_algorithms: true` [#1039]
+  * Security: ssh_config `PubkeyAcceptedAlgorithms` (and its old name `PubkeyAcceptedKeyTypes`) is now honoured, including `+`, `-` and `^`, and `pubkey_algorithms` now applies to all key types instead of only RSA, adding `rsa-sha2-512`; DSA (`ssh-dss`) keys are no longer offered by default, as in OpenSSH since 7.0 — add `+ssh-dss` or pass `append_all_supported_algorithms: true` to re-enable [#923]
+  * Security: ssh_config `Ciphers`, `MACs`, `KexAlgorithms` and `HostKeyAlgorithms` lists starting with `+`, `-` or `^` now append to, remove from or prepend to the default list, as in OpenSSH, instead of silently enabling every supported algorithm including weak ones that are off by default; every listed item is honoured and `-` accepts wildcards. Pass `append_all_supported_algorithms: true` to also get the full supported list [#925]
+  * Support agent-backed FIDO/U2F security keys (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) for publickey auth [#1007]
+  * Port forwarding no longer buffers a whole stream in memory when one side reads slowly: like OpenSSH, window is granted only as data is written to the local socket, and the local socket is read only while the remote window has room. An application that writes everything to a forwarded port before reading anything now blocks once the window fills, as it would with `ssh -L` or a direct TCP connection; the old unbounded buffering hid this [#1037, #1003]
+  * Data forwarded to a local socket just before the remote end sends EOF or closes the channel is no longer truncated or dropped: it is written out before the socket is shut down or closed, without blocking the event loop until the local application reads [#1037]
+  * Multi-factor authentication works when the server's AuthenticationMethods order differs from net-ssh's: after each partial success the allowed methods are tried again, as OpenSSH does [#873, #872]
+  * `HostKeyError#host`, `#port` and `#ip` now return the connected host, port and IP (`ip` is nil through a ProxyCommand) instead of always nil [#963]
+  * OpenSSH-format private keys with Windows (CRLF) line endings now load [#922, #921]
+  * Send CHANNEL_EOF before CHANNEL_CLOSE when closing a session's remaining channels, as OpenSSH does; fixes hangs at close with servers that wait for EOF, such as some SFTP servers [#672]
+  * ssh_config: trailing `# comments` are now ignored, as in OpenSSH; a `#` inside quotes or in the middle of a word is kept [#990]
+
 === 8.0.0 rc3
 
   * Fix "Calling Net::SSH::Buffer methods on HostKeyEntries PubKey is deprecated" warnings printed on every connection to a host in known_hosts [#1026, #1027]

data/CONTRIBUTING.md

@@ -0,0 +1,35 @@
+# Contributing to net-ssh
+
+Run the unit tests with `bundle exec rake test` and the linter with `bundle exec rubocop`; see [README.md](README.md) and [DEVELOPMENT.md](DEVELOPMENT.md) for integration tests and debugging tips.
+
+## Changelog
+
+Don't edit `CHANGES.txt`. Instead, add a fragment file to `changelog.d/` in your PR; the release's version bump (`rake vbump:*`) moves all fragments into a new `=== <version>` section at the top of `CHANGES.txt` and deletes them.
+
+A fragment is named `<number>.<type>.txt`, where `<number>` is the PR number (so open the PR first, then add the fragment), and contains a single UTF-8 paragraph: the entry as it should read in `CHANGES.txt`, without the bullet or prefix. Lines are joined, so it can be wrapped. If it doesn't end with a reference list such as `[#985, #1056]`, `[GHSA-xxxx-xxxx-xxxx]` or `[CVE-2024-12345, #1060]`, ` [#<number>]` is appended; write the list yourself to reference issues or advisories too.
+
+| Type                | Written as                     | Use for                                                      |
+| ------------------- | ------------------------------ | ------------------------------------------------------------ |
+| `breaking-security` | `* BREAKING: Security: <text>` | an incompatible change made for security                     |
+| `breaking`          | `* BREAKING: <text>`           | an incompatible change                                       |
+| `security`          | `* Security: <text>`           | a security fix or hardening                                  |
+| `change`            | `* <text>`                     | any other user-visible fix or feature                        |
+| `none`              | nothing                        | PRs with no user-visible change (tests, CI, docs, refactors) |
+
+Examples:
+
+```sh
+rake "changelog:new[1058,change,Session#exec! now returns the exit status]"
+# changelog.d/1058.change.txt -> * Session#exec! now returns the exit status [#1058]
+
+echo 'Removed the `:paranoid` option; use `:verify_host_key` [#1050]' > changelog.d/1050.breaking.txt
+echo 'Reject packet lengths above 256 KB, as OpenSSH does [GHSA-pfqh-p9vh-wx4p]' > changelog.d/1060.security.txt
+echo 'Custom verifiers must implement `verify_signature` [#1050]' > changelog.d/1050.breaking-security.txt
+touch changelog.d/1061.none.txt
+```
+
+For several entries from one PR add a suffix: `1050.breaking.txt`, `1050.breaking.2.txt` (`changelog:new` picks the next free one).
+
+In a release section, entries are grouped as `BREAKING: Security:`, `BREAKING:`, `Security:`, then the rest; within a group fragments are ordered by number, newest first, followed by any hand-written entries from an `=== Unreleased` section in their written order. A final release with nothing to report still gets a `=== <version>` section saying `No changes since <previous version>.`
+
+`rake changelog:check` validates the fragments and the `=== Unreleased` section, and `rake changelog:preview` prints the section the next release would add. CI fails a PR that edits `CHANGES.txt` or doesn't add or modify a `changelog.d/<PR number>.<type>.txt` fragment, unless it only touches `changelog.d/` or a maintainer adds the `skip-changelog` label; Dependabot PRs are skipped.

data/README.md

@@ -28,67 +28,75 @@ It allows you to write programs that invoke and interact with processes on remot
 
 ## Supported Algorithms
 
-Net::SSH 6.0 disables by default the usage of weak algorithms.
-We strongly recommend that you install a servers's version that supports the latest algorithms.
+Net::SSH only offers secure algorithms by default.
+We strongly recommend that you install a server version that supports the latest algorithms.
 
-It is possible to return to the previous behavior by adding the option : `append_all_supported_algorithms: true`
-
-Unsecure algoritms will definitely be removed in Net::SSH 8.*.
+Weak algorithms are still supported as opt-ins, so legacy servers such as embedded routers and old network gear stay reachable. To enable one, prefix it with `+` in the matching option, e.g. `encryption: '+aes256-cbc'`, `hmac: '+hmac-sha1-96'`, `kex: '+diffie-hellman-group1-sha1'`, `host_key: '+ssh-dss'`, or in ssh_config with `Ciphers`, `MACs`, `KexAlgorithms`, `HostKeyAlgorithms` and `PubkeyAcceptedAlgorithms` (e.g. `Ciphers +aes256-cbc`). Passing `append_all_supported_algorithms: true` appends every supported algorithm except the `none` cipher and MAC, which are only used when named explicitly (e.g. `encryption: '+none'`, `hmac: '+none'`).
 
 ### Host Keys
 
-| Name                 | Support               | Details  |
-|----------------------|-----------------------|----------|
-| ssh-rsa              | OK                    |          |
-| ssh-ed25519          | OK                    | Backed by Ruby OpenSSL raw Ed25519 APIs (`openssl >= 3.2.0`) |
-| ecdsa-sha2-nistp521  | OK                    | [using weak elliptic curves](https://safecurves.cr.yp.to/) |
-| ecdsa-sha2-nistp384  | OK                    | [using weak elliptic curves](https://safecurves.cr.yp.to/) |
-| ecdsa-sha2-nistp256  | OK                    | [using weak elliptic curves](https://safecurves.cr.yp.to/) |
-| ssh-dss              | Deprecated in 6.0     | unsecure, will be removed in 8.0 |
+| Name                                     | Support                | Details  |
+|------------------------------------------|------------------------|----------|
+| ssh-ed25519                              | OK                     | Backed by Ruby OpenSSL raw Ed25519 APIs (`openssl >= 3.2.0`) |
+| ssh-ed25519-cert-v01@openssh.com         | OK                     | Backed by Ruby OpenSSL raw Ed25519 APIs (`openssl >= 3.2.0`) |
+| ecdsa-sha2-nistp521/384/256              | OK                     | [using weak elliptic curves](https://safecurves.cr.yp.to/) |
+| ecdsa-sha2-nistp521/384/256-cert-v01@openssh.com | OK             | [using weak elliptic curves](https://safecurves.cr.yp.to/) |
+| rsa-sha2-512                             | OK                     |          |
+| rsa-sha2-256                             | OK                     |          |
+| ssh-rsa                                  | Not offered by default | SHA-1 signatures, off by default as in OpenSSH 8.8; opt-in for legacy servers with `HostKeyAlgorithms +ssh-rsa` or `host_key: '+ssh-rsa'` |
+| ssh-rsa-cert-v01@openssh.com             | Not offered by default | SHA-1 signatures; opt-in for legacy servers |
+| ssh-rsa-cert-v00@openssh.com             | Deprecated             | not offered by default, warns when used and will be removed; net-ssh cannot parse v00 certificates, use ssh-rsa-cert-v01@openssh.com or a modern key type |
+| ssh-dss                                  | Not offered by default | unsecure, off by default as in OpenSSH 7.0; opt-in for legacy servers |
+
+RSA public key authentication likewise uses rsa-sha2-512 or rsa-sha2-256 by default; ssh-rsa and ssh-dss keys are only offered when enabled, e.g. with `PubkeyAcceptedAlgorithms +ssh-rsa` or `pubkey_algorithms: %w[+ssh-rsa]`.
 
 ### Key Exchange
 
-| Name                                 | Support               | Details  |
-|--------------------------------------|-----------------------|----------|
-| curve25519-sha256                    | OK                    | Backed by Ruby OpenSSL raw X25519 APIs (`openssl >= 3.2.0`) |
-| ecdh-sha2-nistp521                   | OK                    | [using weak elliptic curves](https://safecurves.cr.yp.to/) |
-| ecdh-sha2-nistp384                   | OK                    | [using weak elliptic curves](https://safecurves.cr.yp.to/) |
-| ecdh-sha2-nistp256                   | OK                    | [using weak elliptic curves](https://safecurves.cr.yp.to/) |
-| diffie-hellman-group1-sha1           | Deprecated in 6.0     | unsecure, will be removed in 8.0 |
-| diffie-hellman-group14-sha1          | OK                    |          |
-| diffie-hellman-group-exchange-sha1   | Deprecated in 6.0     | unsecure, will be removed in 8.0 |
-| diffie-hellman-group-exchange-sha256 | OK                    |          |
+| Name                                 | Support                | Details  |
+|--------------------------------------|------------------------|----------|
+| curve25519-sha256                    | OK                     | Backed by Ruby OpenSSL raw X25519 APIs (`openssl >= 3.2.0`) |
+| curve25519-sha256@libssh.org         | OK                     | Backed by Ruby OpenSSL raw X25519 APIs (`openssl >= 3.2.0`) |
+| ecdh-sha2-nistp521                   | OK                     | [using weak elliptic curves](https://safecurves.cr.yp.to/) |
+| ecdh-sha2-nistp384                   | OK                     | [using weak elliptic curves](https://safecurves.cr.yp.to/) |
+| ecdh-sha2-nistp256                   | OK                     | [using weak elliptic curves](https://safecurves.cr.yp.to/) |
+| diffie-hellman-group-exchange-sha256 | OK                     |          |
+| diffie-hellman-group14-sha256        | OK                     |          |
+| diffie-hellman-group14-sha1          | Not offered by default | SHA-1, off by default as in OpenSSH 8.2; opt-in for legacy servers with `KexAlgorithms +diffie-hellman-group14-sha1` or `kex: '+diffie-hellman-group14-sha1'` |
+| diffie-hellman-group-exchange-sha1   | Not offered by default | unsecure; opt-in for legacy servers |
+| diffie-hellman-group1-sha1           | Not offered by default | unsecure; opt-in for legacy servers |
 
 ### Encryption algorithms (ciphers)
 
-| Name                                 | Support               | Details  |
-|--------------------------------------|-----------------------|----------|
-| aes256-ctr / aes192-ctr / aes128-ctr | OK                    |          |
-| chacha20-poly1305@openssh.com        | OK.                   | Backed by Ruby OpenSSL ChaCha20 and Poly1305 APIs (`openssl >= 3.2.0`) |
-| aes256-cbc / aes192-cbc / aes128-cbc | Deprecated in 6.0     | unsecure, will be removed in 8.0 |
-| rijndael-cbc@lysator.liu.se          | Deprecated in 6.0     | unsecure, will be removed in 8.0 |
-| blowfish-ctr blowfish-cbc            | Deprecated in 6.0     | unsecure, will be removed in 8.0 |
-| cast128-ctr cast128-cbc              | Deprecated in 6.0     | unsecure, will be removed in 8.0 |
-| 3des-ctr 3des-cbc                    | Deprecated in 6.0     | unsecure, will be removed in 8.0 |
-| idea-cbc                             | Deprecated in 6.0     | unsecure, will be removed in 8.0 |
-| none                                 | Deprecated in 6.0     | unsecure, will be removed in 8.0 |
+| Name                                    | Support                | Details  |
+|-----------------------------------------|------------------------|----------|
+| chacha20-poly1305@openssh.com           | OK                     | Backed by Ruby OpenSSL ChaCha20 and Poly1305 APIs (`openssl >= 3.2.0`) |
+| aes256-ctr / aes192-ctr / aes128-ctr    | OK                     |          |
+| aes256-gcm@openssh.com / aes128-gcm@openssh.com | OK              |          |
+| aes256-cbc / aes192-cbc / aes128-cbc    | Not offered by default | unsecure; opt-in for legacy servers |
+| rijndael-cbc@lysator.liu.se             | Not offered by default | unsecure; opt-in for legacy servers |
+| blowfish-ctr blowfish-cbc               | Not offered by default | unsecure; opt-in for legacy servers |
+| cast128-ctr cast128-cbc                 | Not offered by default | unsecure; opt-in for legacy servers |
+| 3des-ctr 3des-cbc                       | Not offered by default | unsecure; opt-in for legacy servers |
+| idea-cbc                                | Not offered by default | unsecure; opt-in for legacy servers |
+| none                                    | Not offered by default | no encryption; only used when named explicitly, not added by `append_all_supported_algorithms` |
 
 ### Message Authentication Code algorithms
 
-| Name                 | Support               | Details  |
-|----------------------|-----------------------|----------|
-| hmac-sha2-512-etm    | OK                    |          |
-| hmac-sha2-256-etm    | OK                    |          |
-| hmac-sha2-512        | OK                    |          |
-| hmac-sha2-256        | OK                    |          |
-| hmac-sha2-512-96     | Deprecated in 6.0     | removed from the specification, will be removed in 8.0 |
-| hmac-sha2-256-96     | Deprecated in 6.0     | removed from the specification, will be removed in 8.0 |
-| hmac-sha1            | OK                    | for backward compatibility      |
-| hmac-sha1-96         | Deprecated in 6.0     | unsecure, will be removed in 8.0 |
-| hmac-ripemd160       | Deprecated in 6.0     | unsecure, will be removed in 8.0 |
-| hmac-md5             | Deprecated in 6.0     | unsecure, will be removed in 8.0 |
-| hmac-md5-96          | Deprecated in 6.0     | unsecure, will be removed in 8.0 |
-| none                 | Deprecated in 6.0     | unsecure, will be removed in 8.0 |
+| Name                          | Support                | Details  |
+|-------------------------------|------------------------|----------|
+| hmac-sha2-512-etm@openssh.com | OK                     |          |
+| hmac-sha2-256-etm@openssh.com | OK                     |          |
+| hmac-sha1-etm@openssh.com     | OK                     | for backward compatibility |
+| hmac-sha2-512                 | OK                     |          |
+| hmac-sha2-256                 | OK                     |          |
+| hmac-sha1                     | OK                     | for backward compatibility |
+| hmac-sha2-512-96              | Not offered by default | removed from the specification; opt-in for legacy servers |
+| hmac-sha2-256-96              | Not offered by default | removed from the specification; opt-in for legacy servers |
+| hmac-sha1-96                  | Not offered by default | unsecure; opt-in for legacy servers |
+| hmac-ripemd160 / hmac-ripemd160@openssh.com | Not offered by default | unsecure; opt-in for legacy servers |
+| hmac-md5                      | Not offered by default | unsecure; opt-in for legacy servers |
+| hmac-md5-96                   | Not offered by default | unsecure; opt-in for legacy servers |
+| none                          | Not offered by default | no integrity protection; only used when named explicitly, not added by `append_all_supported_algorithms` |
 
 ## SYNOPSIS:
 
@@ -194,6 +202,11 @@ Ed25519 public key auth is backed by Ruby OpenSSL. The `bcrypt_pbkdf` gem is onl
 gem install bcrypt_pbkdf
 ```
 
+### FIDO/U2F security keys
+
+`sk-ecdsa-sha2-nistp256@openssh.com` and `sk-ssh-ed25519@openssh.com` keys work when held in `ssh-agent`.
+Loading `sk-*` private key files from disk is not supported.
+
 ## RUBY SUPPORT
 
 * See [net-ssh.gemspec](https://github.com/net-ssh/net-ssh/blob/master/net-ssh.gemspec) for current versions ruby requirements
@@ -247,6 +260,10 @@ gem cert --add net-ssh-public_cert.pem
 
 or `rake cert:update_public_when_expired`
 
+## CONTRIBUTING
+
+See [CONTRIBUTING.md](CONTRIBUTING.md), including how to add a changelog entry.
+
 ## Security contact information
 
 See [SECURITY.md](SECURITY.md)

data/Rakefile

@@ -28,6 +28,7 @@ CLEAN.include ['pkg', 'rdoc']
 name = "net-ssh"
 
 require_relative "lib/net/ssh/version"
+require_relative "rakelib/changelog"
 version = Net::SSH::Version::CURRENT
 
 extra_files = %w[LICENSE.txt THANKS.txt CHANGES.txt]
@@ -109,6 +110,15 @@ def change_version(&block)
     raise ArgumentError, "Cound not find line: TINY = \"#{tiny}\" in #{version_file}" unless found[:tiny] || new_tiny == tiny
   end
 
+  begin
+    heading = Changelog.heading(Net::SSH::Version::MAJOR, Net::SSH::Version::MINOR, new_tiny, new_pre)
+    section = Changelog.new(__dir__).release(heading)
+  rescue StandardError
+    FileUtils.rm_f "#{version_file}.new"
+    raise
+  end
+  puts section ? "Added to CHANGES.txt:\n#{section}" : "Nothing to release for a pre-release, CHANGES.txt unchanged"
+
   FileUtils.mv version_file, "#{version_file}.old"
   FileUtils.mv "#{version_file}.new", version_file
 end
@@ -148,6 +158,44 @@ namespace :vbump do
   end
 end
 
+namespace :changelog do
+  changelog = Changelog.new(__dir__)
+
+  desc "Validate the fragments in changelog.d/"
+  task :check do
+    count = changelog.check.size
+    puts "#{count} valid changelog fragment#{'s' unless count == 1}"
+  rescue Changelog::Error => e
+    abort e.message
+  end
+
+  desc "Print the CHANGES.txt section the next version bump would write"
+  task :preview, [:heading] do |_t, args|
+    puts changelog.section(args[:heading] || "Unreleased") || "Nothing to release"
+  rescue Changelog::Error => e
+    abort e.message
+  end
+
+  desc "Create a fragment: rake \"changelog:new[1234,change,Text of the entry]\""
+  task :new, [:number, :type] do |_t, args|
+    abort "Usage: rake \"changelog:new[<PR number>,<#{Changelog::TYPES.keys.join('|')}>,<text>]\"" unless args[:number] && args[:type]
+    # Rake splits arguments on commas and strips the spaces around them, so take the text from the raw task string.
+    raw = Rake.application.top_level_tasks.find { |t| t.start_with?("changelog:new[") }
+    text = raw&.[](/\A[^\[]*\[[^,]*,[^,]*,\s*(.*)\]\z/m, 1) || args.extras.join(", ")
+    puts "Created #{changelog.new_fragment(args[:number], args[:type], text)}"
+  rescue Changelog::Error => e
+    abort e.message
+  end
+
+  desc "Write the fragments to CHANGES.txt under a heading, e.g. rake \"changelog:release[7.3.4]\" (vbump does this)"
+  task :release, [:heading] do |_t, args|
+    abort "Usage: rake \"changelog:release[<version heading>]\"" unless args[:heading]
+    puts changelog.release(args[:heading]) || "Nothing to release"
+  rescue Changelog::Error => e
+    abort e.message
+  end
+end
+
 namespace :rdoc do
   desc "Update gh-pages branch"
   task :publish do

data/changelog.d/README.md

@@ -0,0 +1 @@
+Changelog fragments: one `<PR number>.<type>.txt` file per user-visible change, assembled into `CHANGES.txt` when the version is bumped. See [CONTRIBUTING.md](../CONTRIBUTING.md#changelog).

data/lib/net/ssh/authentication/agent.rb

@@ -152,7 +152,7 @@ module Net
               key.extend(Comment)
               key.comment = comment_str
               identities.push key
-            rescue NotImplementedError => e
+            rescue Net::SSH::UnsupportedKeyType, NotImplementedError => e
               error { "ignoring unimplemented key:#{e.message} #{comment_str}" }
             end
           end
@@ -256,6 +256,9 @@ module Net
         def send_and_wait(type, *args)
           send_packet(type, *args)
           read_packet
+        rescue Errno::ECONNRESET, Errno::EPIPE => e
+          # Linux reports an agent that closes with our request unread as a reset, not EOF.
+          raise AgentClosedConnection, "agent closed the connection (#{e.class})"
         end
 
         # Returns +true+ if the parameter indicates a "failure" response from

data/lib/net/ssh/authentication/ed25519.rb

@@ -74,7 +74,7 @@ module Net
           end
 
           def self.read(datafull, password)
-            datafull = datafull.strip
+            datafull = datafull.strip.encode(universal_newline: true)
             raise ArgumentError.new("Expected #{MBEGIN} at start of private key") unless datafull.start_with?(MBEGIN)
             raise ArgumentError.new("Expected #{MEND} at end of private key") unless datafull.end_with?(MEND)
 

data/lib/net/ssh/authentication/key_manager.rb

@@ -124,18 +124,16 @@ module Net
 
           user_identities = load_identities(prepared_identities, false, true)
 
-          if agent
-            agent.identities.each do |key|
-              corresponding_user_identity = user_identities.detect { |identity|
-                identity[:public_key] && identity[:public_key].to_blob == key.to_blob
-              }
-              # By identity: EC::Point#== raises TypeError when compared with other key types.
-              user_identities.reject! { |identity| identity.equal?(corresponding_user_identity) }
-
-              if !options[:keys_only] || corresponding_user_identity
-                known_identities[key] = { from: :agent, identity: key }
-                yield key
-              end
+          agent_identities.each do |key|
+            corresponding_user_identity = user_identities.detect { |identity|
+              identity[:public_key] && identity[:public_key].to_blob == key.to_blob
+            }
+            # By identity: EC::Point#== raises TypeError when compared with other key types.
+            user_identities.reject! { |identity| identity.equal?(corresponding_user_identity) }
+
+            if !options[:keys_only] || corresponding_user_identity
+              known_identities[key] = { from: :agent, identity: key }
+              yield key
             end
           end
 
@@ -247,6 +245,18 @@ module Net
 
         private
 
+        # Like OpenSSH's pubkey_prepare, an agent that fails to list its keys is
+        # dropped for the session so that key files are still tried.
+        def agent_identities
+          return [] unless agent
+
+          agent.identities
+        rescue AgentError => e
+          error { "could not get identities from agent: #{e.class} (#{e.message})" }
+          self.use_agent = false
+          []
+        end
+
         # Load keycerts from files and data.
         def keycerts
           keycert_files.map { |keycert_file| KeyFactory.load_public_key(keycert_file) } +

data/lib/net/ssh/authentication/methods/abstract.rb

@@ -20,9 +20,7 @@ module Net
           # this.
           attr_reader :key_manager
 
-          # So far only affects algorithms used for rsa keys, but can be
-          # extended to other keys, e.g after reading of
-          # PubkeyAcceptedAlgorithms option from ssh_config file is implemented.
+          # public key algorithms to be used
           attr_reader :pubkey_algorithms
 
           # Instantiates a new authentication method.
@@ -31,11 +29,7 @@ module Net
             @key_manager = options[:key_manager]
             @options = options
             @prompt = options[:password_prompt]
-            @pubkey_algorithms = options[:pubkey_algorithms] \
-              || %w[rsa-sha2-256-cert-v01@openssh.com
-                    ssh-rsa-cert-v01@openssh.com
-                    rsa-sha2-256
-                    ssh-rsa]
+            @pubkey_algorithms = session.transport.pubkey_algorithms
             self.logger = session.logger
           end
 

data/lib/net/ssh/authentication/methods/publickey.rb

@@ -15,6 +15,8 @@ module Net
           def authenticate(next_service, username, password = nil)
             return false unless key_manager
 
+            debug { "pubkey_algorithms: #{pubkey_algorithms.join(', ')}" }
+
             key_manager.each_identity do |identity|
               return true if authenticate_with(identity, next_service, username)
             end
@@ -123,7 +125,7 @@ module Net
                   end
                 end
               end
-            elsif authenticate_with_alg(identity, next_service, username, type)
+            elsif pubkey_algorithms.include?(type) && authenticate_with_alg(identity, next_service, username, type)
               # success
               return true
             end

data/lib/net/ssh/authentication/security_key.rb

@@ -0,0 +1,71 @@
+require 'net/ssh/errors'
+require 'net/ssh/authentication/pub_key_fingerprint'
+
+module Net
+  module SSH
+    module Authentication
+      # FIDO/U2F security keys held by ssh-agent. The agent does the signing (incl. user
+      # presence); net-ssh only parses and re-serialises the public key blob (see PROTOCOL.u2f).
+      module SecurityKey
+        SK_ECDSA_SHA2_NISTP256 = "sk-ecdsa-sha2-nistp256@openssh.com"
+        SK_SSH_ED25519 = "sk-ssh-ed25519@openssh.com"
+        TYPES = [SK_ECDSA_SHA2_NISTP256, SK_SSH_ED25519].freeze
+
+        def self.understands?(type)
+          TYPES.include?(type)
+        end
+
+        # Public key of an agent-held security key; signing is delegated to the agent.
+        class PubKey
+          include Net::SSH::Authentication::PubKeyFingerprint
+
+          attr_reader :ssh_type, :curve, :public_key_data, :application
+
+          # Wire formats:
+          #   sk-ecdsa-sha2-nistp256@openssh.com: string curve, string Q, string application
+          #   sk-ssh-ed25519@openssh.com:         string public_key, string application
+          def self.read_keyblob(type, buffer)
+            case type
+            when SK_ECDSA_SHA2_NISTP256
+              curve = buffer.read_string
+              public_key_data = buffer.read_string
+              application = buffer.read_string
+              new(type, public_key_data, application, curve: curve)
+            when SK_SSH_ED25519
+              public_key_data = buffer.read_string
+              application = buffer.read_string
+              new(type, public_key_data, application)
+            else
+              raise Net::SSH::UnsupportedKeyType, "unsupported security key type `#{type}'"
+            end
+          end
+
+          def initialize(ssh_type, public_key_data, application, curve: nil)
+            @ssh_type = ssh_type
+            @public_key_data = public_key_data
+            @application = application
+            @curve = curve
+          end
+
+          def to_blob
+            buffer = Net::SSH::Buffer.new
+            buffer.write_string(ssh_type)
+            buffer.write_string(curve) if curve
+            buffer.write_string(public_key_data)
+            buffer.write_string(application)
+            buffer.to_s
+          end
+
+          def ssh_signature_type
+            ssh_type
+          end
+
+          # Only used to de-duplicate identities, so a stable key-specific string suffices.
+          def to_pem
+            "#{ssh_type} #{[to_blob].pack('m0')}"
+          end
+        end
+      end
+    end
+  end
+end