net-ssh 8.0.0.rc3 → 8.0.0.rc5

data/lib/net/ssh/service/forward.rb

@@ -320,6 +320,11 @@ module Net
           session.listen_to(client)
           channel[:socket] = client
 
+          # Grant window only for data the local end has accepted, so a slow
+          # reader stalls the remote sender instead of filling our memory.
+          channel.grant_window_on_consume!
+          client.on_sent { |bytes| channel.consumed(bytes) }
+
           channel.on_data do |ch, data|
             debug { "data:#{data.length} on #{type} forwarded channel" }
             ch[:socket].enqueue(data)
@@ -327,36 +332,36 @@ module Net
 
           channel.on_eof do |ch|
             debug { "eof #{type} on #{type} forwarded channel" }
-            begin
-              ch[:socket].send_pending
-              ch[:socket].shutdown Socket::SHUT_WR
-            rescue IOError => e
-              if e.message =~ /closed/ then
-                debug { "epipe in on_eof => shallowing exception:#{e}" }
-              else
-                raise
-              end
-            rescue Errno::EPIPE => e
-              debug { "epipe in on_eof => shallowing exception:#{e}" }
-            rescue Errno::ENOTCONN => e
-              debug { "enotconn in on_eof => shallowing exception:#{e}" }
-            end
+            ch[:socket].shutdown_write_when_drained
           end
 
           channel.on_close do |ch|
             debug { "closing #{type} forwarded channel" }
-            ch[:socket].close if !client.closed?
-            session.stop_listening_to(ch[:socket])
+            session.close_when_drained(ch[:socket])
           end
 
           channel.on_process do |ch|
-            if ch[:socket].closed?
+            socket = ch[:socket]
+            if socket.closed?
               ch.info { "#{type} forwarded connection closed" }
+              session.stop_listening_to(socket)
               ch.close
-            elsif ch[:socket].available > 0
-              data = ch[:socket].read_available(8192)
-              ch.debug { "read #{data.length} bytes from client, sending over #{type} forwarded connection" }
-              ch.send_data(data)
+            else
+              if socket.available > 0
+                data = socket.read_available(8192)
+                ch.debug { "read #{data.length} bytes from client, sending over #{type} forwarded connection" }
+                ch.send_data(data)
+              end
+
+              # Like OpenSSH's channel_pre_open, only read more once the remote
+              # window can take what is already queued; writes to the socket keep
+              # flowing. ch.output is still unsent here because Channel#process
+              # runs this block before enqueue_pending_output.
+              if ch.output.length + socket.available < ch.remote_window_size.to_i
+                session.resume_reading(socket)
+              else
+                session.pause_reading(socket)
+              end
             end
           end
         end

data/lib/net/ssh/test.rb

@@ -73,7 +73,8 @@ module Net
       def transport(options = {})
         @transport ||= Net::SSH::Transport::Session.new(
           options[:host] || "localhost",
-          options.merge(kex: "test", host_key: "ssh-rsa", append_all_supported_algorithms: true, verify_host_key: :never, proxy: socket(options))
+          options.merge(kex: "test", host_key: "ssh-rsa", encryption: "+none", hmac: "+none",
+                        append_all_supported_algorithms: true, verify_host_key: :never, proxy: socket(options))
         )
       end
 

data/lib/net/ssh/transport/algorithms.rb

@@ -8,6 +8,7 @@ require 'net/ssh/transport/kex'
 require 'net/ssh/transport/kex/curve25519_sha256_loader'
 require 'net/ssh/transport/server_version'
 require 'net/ssh/authentication/ed25519_loader'
+require 'net/ssh/authentication/security_key'
 
 module Net
   module SSH
@@ -19,7 +20,7 @@ module Net
       #
       # You will never instantiate or reference this directly. It is used
       # internally by the transport layer.
-      class Algorithms
+      class Algorithms # rubocop:disable Metrics/ClassLength
         include Loggable
         include Constants
 
@@ -31,18 +32,14 @@ module Net
                        ecdsa-sha2-nistp521
                        ecdsa-sha2-nistp384
                        ecdsa-sha2-nistp256
-                       ssh-rsa-cert-v01@openssh.com
-                       ssh-rsa-cert-v00@openssh.com
-                       ssh-rsa
-                       rsa-sha2-256
-                       rsa-sha2-512],
+                       rsa-sha2-512
+                       rsa-sha2-256],
 
           kex: %w[ecdh-sha2-nistp521
                   ecdh-sha2-nistp384
                   ecdh-sha2-nistp256
                   diffie-hellman-group-exchange-sha256
-                  diffie-hellman-group14-sha256
-                  diffie-hellman-group14-sha1],
+                  diffie-hellman-group14-sha256],
 
           encryption: %w[aes256-ctr
                          aes192-ctr
@@ -51,8 +48,18 @@ module Net
                          aes128-gcm@openssh.com],
 
           hmac: %w[hmac-sha2-512-etm@openssh.com hmac-sha2-256-etm@openssh.com
+                   hmac-sha1-etm@openssh.com
                    hmac-sha2-512 hmac-sha2-256
-                   hmac-sha1]
+                   hmac-sha1],
+
+          pubkey_algorithms: %w[ssh-ed25519-cert-v01@openssh.com
+                                ecdsa-sha2-nistp256-cert-v01@openssh.com ecdsa-sha2-nistp384-cert-v01@openssh.com
+                                ecdsa-sha2-nistp521-cert-v01@openssh.com
+                                rsa-sha2-512-cert-v01@openssh.com rsa-sha2-256-cert-v01@openssh.com
+                                ssh-ed25519
+                                ecdsa-sha2-nistp256 ecdsa-sha2-nistp384 ecdsa-sha2-nistp521] +
+                             [Authentication::SecurityKey::SK_SSH_ED25519, Authentication::SecurityKey::SK_ECDSA_SHA2_NISTP256] +
+                             %w[rsa-sha2-512 rsa-sha2-256]
         }.freeze
 
         if Net::SSH::Transport::ChaCha20Poly1305CipherLoader::LOADED
@@ -76,10 +83,12 @@ module Net
 
         # Define all algorithms, with the deprecated, supported by Net::SSH.
         ALGORITHMS = {
-          host_key: DEFAULT_ALGORITHMS[:host_key] + %w[ssh-dss],
+          host_key: DEFAULT_ALGORITHMS[:host_key] +
+                    %w[ssh-rsa-cert-v01@openssh.com ssh-rsa-cert-v00@openssh.com ssh-rsa ssh-dss],
 
           kex: DEFAULT_ALGORITHMS[:kex] +
-               %w[diffie-hellman-group-exchange-sha1
+               %w[diffie-hellman-group14-sha1
+                  diffie-hellman-group-exchange-sha1
                   diffie-hellman-group1-sha1],
 
           encryption: DEFAULT_ALGORITHMS[:encryption] +
@@ -98,10 +107,20 @@ module Net
                    hmac-md5 hmac-md5-96
                    none],
 
+          pubkey_algorithms: DEFAULT_ALGORITHMS[:pubkey_algorithms] + %w[ssh-rsa-cert-v01@openssh.com ssh-rsa ssh-dss],
+
           compression: %w[none zlib@openssh.com zlib],
           language: %w[]
         }.freeze
 
+        # Not added by append_all_supported_algorithms; only used when named explicitly.
+        EXPLICIT_ONLY_ALGORITHMS = {
+          encryption: %w[none],
+          hmac: %w[none]
+        }.freeze
+
+        DEPRECATED_HOST_KEY = 'ssh-rsa-cert-v00@openssh.com'.freeze
+
         # The underlying transport layer session that supports this object
         attr_reader :session
 
@@ -269,11 +288,16 @@ module Net
 
           ALGORITHMS.each do |algorithm, supported|
             algorithms[algorithm] = compose_algorithm_list(
-              supported, options[algorithm] || DEFAULT_ALGORITHMS[algorithm],
-              options[:append_all_supported_algorithms]
+              supported,
+              DEFAULT_ALGORITHMS[algorithm],
+              options[algorithm] || DEFAULT_ALGORITHMS[algorithm],
+              options[:append_all_supported_algorithms],
+              supported - EXPLICIT_ONLY_ALGORITHMS.fetch(algorithm, [])
             )
           end
 
+          warn_deprecated_host_key if host_key_explicitly_named?(DEPRECATED_HOST_KEY)
+
           # for convention, make sure our list has the same keys as the server
           # list
 
@@ -287,7 +311,11 @@ module Net
             # existing known key for the host has preference.
 
             existing_keys = session.host_keys
-            host_keys = existing_keys.flat_map { |key| key.respond_to?(:ssh_types) ? key.ssh_types : [key.ssh_type] }.uniq
+            host_keys = existing_keys.flat_map { |key| key.respond_to?(:ssh_types) ? key.ssh_types : [key.ssh_type] }
+            # A known ssh-rsa key also verifies with rsa-sha2-*, and must not re-enable disabled SHA-1 algorithms.
+            disabled_sha1 = %w[ssh-rsa ssh-rsa-cert-v01@openssh.com ssh-rsa-cert-v00@openssh.com] - algorithms[:host_key]
+            host_keys = host_keys.flat_map { |type| type == 'ssh-rsa' ? %w[rsa-sha2-512 rsa-sha2-256 ssh-rsa] : [type] }
+            host_keys = (host_keys - disabled_sha1).uniq
             algorithms[:host_key].each do |name|
               host_keys << name unless host_keys.include?(name)
             end
@@ -296,21 +324,27 @@ module Net
         end
 
         # Composes the list of algorithms by taking supported algorithms and matching with supplied options.
-        def compose_algorithm_list(supported, option, append_all_supported_algorithms = false)
+        def compose_algorithm_list(supported, defaults, option, append_all_supported_algorithms = false, appendable = supported)
           return supported.dup unless option
 
           list = []
           option = Array(option).compact.uniq
 
-          if option.first && option.first.start_with?('+', '-')
-            list = supported.dup
-
-            appends = option.select { |opt| opt.start_with?('+') }.map { |opt| opt[1..-1] }
-            deletions = option.select { |opt| opt.start_with?('-') }.map { |opt| opt[1..-1] }
+          if option.first && option.first.start_with?('+', '-', '^')
+            ops = { '^' => [], '+' => [], '-' => [] }
+            cur_list = nil
+            option.each do |cur_opt|
+              if ops.key?(cur_opt[0])
+                cur_list = ops[cur_opt[0]]
+                cur_opt = cur_opt[1..-1]
+              end
+              cur_list << cur_opt
+            end
 
-            list.concat(appends)
+            list = ops['^'] + defaults + ops['+']
+            list.concat(appendable) if append_all_supported_algorithms
 
-            deletions.each do |opt|
+            ops['-'].each do |opt|
               if opt.include?('*')
                 opt_escaped = Regexp.escape(opt)
                 algo_re = /\A#{opt_escaped.gsub('\*', '[A-Za-z\d\-@\.]*')}\z/
@@ -325,7 +359,7 @@ module Net
             list = option
 
             if append_all_supported_algorithms
-              supported.each { |name| list << name unless list.include?(name) }
+              appendable.each { |name| list << name unless list.include?(name) }
             end
           end
 
@@ -341,6 +375,19 @@ module Net
           list
         end
 
+        def host_key_explicitly_named?(name)
+          algorithms[:host_key].include?(name) &&
+            Array(options[:host_key]).any? { |opt| opt.to_s.delete_prefix('+').delete_prefix('^') == name }
+        end
+
+        def warn_deprecated_host_key
+          return if @deprecated_host_key_warned
+
+          @deprecated_host_key_warned = true
+          Kernel.warn("#{DEPRECATED_HOST_KEY} is deprecated and will be removed in a future version; " \
+                      "net-ssh cannot parse v00 certificates, use ssh-rsa-cert-v01@openssh.com or a modern host key type instead")
+        end
+
         # Parses a KEXINIT packet from the server.
         def parse_server_algorithm_packet(packet)
           data = { raw: packet.content }
@@ -398,6 +445,7 @@ module Net
         def negotiate_algorithms
           @kex                = negotiate(:kex)
           @host_key           = negotiate(:host_key)
+          warn_deprecated_host_key if @host_key == DEPRECATED_HOST_KEY
           @encryption_client  = negotiate(:encryption_client)
           @encryption_server  = negotiate(:encryption_server)
           @hmac_client        = negotiate(:hmac_client)

data/lib/net/ssh/transport/hmac/sha1_etm.rb

@@ -0,0 +1,12 @@
+require 'net/ssh/transport/hmac/abstract'
+
+module Net::SSH::Transport::HMAC
+  # The SHA1 Encrypt-Then-Mac HMAC algorithm. This has a mac and
+  # key length of 20, and uses the SHA1 digest algorithm.
+  class SHA1_Etm < Abstract
+    etm          true
+    mac_length   20
+    key_length   20
+    digest_class OpenSSL::Digest::SHA1
+  end
+end

data/lib/net/ssh/transport/hmac.rb

@@ -9,6 +9,7 @@ require 'net/ssh/transport/hmac/sha2_512'
 require 'net/ssh/transport/hmac/sha2_512_96'
 require 'net/ssh/transport/hmac/sha2_256_etm'
 require 'net/ssh/transport/hmac/sha2_512_etm'
+require 'net/ssh/transport/hmac/sha1_etm'
 require 'net/ssh/transport/hmac/ripemd160'
 require 'net/ssh/transport/hmac/none'
 
@@ -27,6 +28,7 @@ module Net::SSH::Transport::HMAC
     'hmac-sha2-512-96' => SHA2_512_96,
     'hmac-sha2-256-etm@openssh.com' => SHA2_256_Etm,
     'hmac-sha2-512-etm@openssh.com' => SHA2_512_Etm,
+    'hmac-sha1-etm@openssh.com' => SHA1_Etm,
     'hmac-ripemd160' => RIPEMD160,
     'hmac-ripemd160@openssh.com' => RIPEMD160,
     'none' => None

data/lib/net/ssh/transport/kex/diffie_hellman_group1_sha1.rb

@@ -102,6 +102,7 @@ module Net
             result[:key_blob] = buffer.read_string
             result[:server_key] = Net::SSH::Buffer.new(result[:key_blob]).read_key
             result[:server_dh_pubkey] = buffer.read_bignum
+            validate_server_dh_pubkey(result[:server_dh_pubkey])
             result[:shared_secret] = OpenSSL::BN.new(dh.compute_key(result[:server_dh_pubkey]), 2)
 
             sig_buffer = Net::SSH::Buffer.new(buffer.read_string)
@@ -115,6 +116,13 @@ module Net
 
             return result
           end
+
+          # Rejects degenerate values that would let the server force a
+          # predictable shared secret, as OpenSSH's dh_pub_is_valid.
+          def validate_server_dh_pubkey(pub)
+            valid = pub > 1 && pub < dh.p - 1 && pub.to_i.to_s(2).count("1") >= 4
+            raise Net::SSH::Exception, "server's DH public value is invalid" unless valid
+          end
         end
       end
     end

data/lib/net/ssh/transport/kex/diffie_hellman_group_exchange_sha1.rb

@@ -6,26 +6,43 @@ module Net::SSH::Transport::Kex
   # A key-exchange service implementing the
   # "diffie-hellman-group-exchange-sha1" key-exchange algorithm.
   class DiffieHellmanGroupExchangeSHA1 < DiffieHellmanGroup1SHA1
-    MINIMUM_BITS      = 1024
+    MINIMUM_BITS      = 2048
     MAXIMUM_BITS      = 8192
+    CISCO_MAXIMUM_NEED_BITS = 4096
 
     private
 
-    # Compute the number of bits needed for the given number of bytes.
+    # Computes the minimum, preferred and maximum group sizes to request,
+    # like OpenSSH's kexgex_client.
     def compute_need_bits
-      # for Compatibility: OpenSSH requires (need_bits * 2 + 1) length of parameter
-      need_bits = data[:need_bytes] * 8 * 2 + 1
-
       data[:minimum_dh_bits] ||= MINIMUM_BITS
+      data[:maximum_dh_bits] = [MAXIMUM_BITS, data[:minimum_dh_bits]].max
+      data[:need_bits] = estimate_group_bits(data[:need_bytes] * 8).clamp(data[:minimum_dh_bits], maximum_need_bits)
+    end
 
-      if need_bits < data[:minimum_dh_bits]
-        need_bits = data[:minimum_dh_bits]
-      elsif need_bits > MAXIMUM_BITS
-        need_bits = MAXIMUM_BITS
-      end
+    # Some Cisco servers fail instead of returning their 4096-bit group when asked for more (OpenSSH bz#2209).
+    def maximum_need_bits
+      return data[:maximum_dh_bits] unless cisco_server?
+
+      [CISCO_MAXIMUM_NEED_BITS, data[:minimum_dh_bits]].max
+    end
+
+    def cisco_server?
+      data[:server_version_string].to_s.match?(/\ASSH-[\d.]+-Cisco-1\./)
+    end
 
-      data[:need_bits] = need_bits
-      data[:need_bytes] = need_bits / 8
+    # Group size giving at least the given bits of security (NIST SP 800-57),
+    # as OpenSSH's dh_estimate.
+    def estimate_group_bits(security_bits)
+      if security_bits <= 112
+        2048
+      elsif security_bits <= 128
+        3072
+      elsif security_bits <= 192
+        7680
+      else
+        8192
+      end
     end
 
     # Returns the DH key parameters for the given session.
@@ -34,7 +51,7 @@ module Net::SSH::Transport::Kex
 
       # request the DH key parameters for the given number of bits.
       buffer = Net::SSH::Buffer.from(:byte, KEXDH_GEX_REQUEST, :long, data[:minimum_dh_bits],
-                                     :long, data[:need_bits], :long, MAXIMUM_BITS)
+                                     :long, data[:need_bits], :long, data[:maximum_dh_bits])
       connection.send_message(buffer)
 
       buffer = connection.next_message
@@ -43,9 +60,22 @@ module Net::SSH::Transport::Kex
       p = buffer.read_bignum
       g = buffer.read_bignum
 
+      validate_group(p, g)
+
       [p, g]
     end
 
+    def validate_group(prime, generator)
+      bits = prime.num_bits
+      if bits < data[:minimum_dh_bits]
+        raise Net::SSH::Exception,
+              "server's DH group is #{bits} bits, below the minimum of #{data[:minimum_dh_bits]}; " \
+              "pass minimum_dh_bits: #{bits} to allow it"
+      end
+      raise Net::SSH::Exception, "server's DH group is #{bits} bits, above the maximum of #{data[:maximum_dh_bits]}" if bits > data[:maximum_dh_bits]
+      raise Net::SSH::Exception, "server's DH group generator is invalid" unless generator > 1 && generator < prime - 1
+    end
+
     # Returns the INIT/REPLY constants used by this algorithm.
     def get_message_types
       [KEXDH_GEX_INIT, KEXDH_GEX_REPLY]
@@ -60,9 +90,9 @@ module Net::SSH::Transport::Kex
                             data[:client_algorithm_packet],
                             data[:server_algorithm_packet],
                             result[:key_blob]
-      response.write_long MINIMUM_BITS,
+      response.write_long data[:minimum_dh_bits],
                           data[:need_bits],
-                          MAXIMUM_BITS
+                          data[:maximum_dh_bits]
       response.write_bignum dh.p, dh.g, dh.pub_key,
                             result[:server_dh_pubkey],
                             result[:shared_secret]

data/lib/net/ssh/transport/openssl.rb

@@ -1,4 +1,5 @@
 require 'openssl'
+require 'net/ssh/errors'
 require 'net/ssh/authentication/pub_key_fingerprint'
 
 module OpenSSL
@@ -178,7 +179,7 @@ module OpenSSL
 
           return key
         rescue OpenSSL::PKey::ECError
-          raise NotImplementedError, "unsupported key type `#{type}'"
+          raise Net::SSH::UnsupportedKeyType, "unsupported key type `ecdsa-sha2-#{curve_name_in_type}'"
         end
       end
 

data/lib/net/ssh/transport/session.rb

@@ -107,6 +107,10 @@ module Net
           end
         end
 
+        def pubkey_algorithms
+          algorithms[:pubkey_algorithms]
+        end
+
         # Returns the host (and possibly IP address) in a format compatible with
         # SSH known-host files.
         def host_as_string
@@ -313,22 +317,12 @@ module Net
           socket.setsockopt(Socket::IPPROTO_TCP, Socket::TCP_NODELAY, 1)
         end
 
-        # Compatibility verifier which allows users to keep using
-        # custom verifier code without adding new :verify_signature
-        # method.
-        class CompatibleVerifier
-          def initialize(verifier)
-            @verifier = verifier
-          end
-
-          def verify(arguments)
-            @verifier.verify(arguments)
-          end
-
-          def verify_signature(&block)
-            yield
-          end
-        end
+        REMOVED_VERIFY_HOST_KEY_VALUES = {
+          false => :never,
+          true => :accept_new_or_local_tunnel,
+          very: :accept_new,
+          secure: :always
+        }.freeze
 
         # Instantiates a new host-key verification class, based on the value of
         # the parameter.
@@ -343,46 +337,29 @@ module Net
         #
         # If the argument happens to respond to :verify and :verify_signature,
         # it is returned directly. Otherwise, an exception is raised.
-        #
-        # Values false, true, and :very were deprecated in
-        # [#595](https://github.com/net-ssh/net-ssh/pull/595)
         def select_host_key_verifier(verifier)
           case verifier
-          when false
-            Kernel.warn('verify_host_key: false is deprecated, use :never')
-            Net::SSH::Verifiers::Never.new
           when :never then
             Net::SSH::Verifiers::Never.new
-          when true
-            Kernel.warn('verify_host_key: true is deprecated, use :accept_new_or_local_tunnel')
-            Net::SSH::Verifiers::AcceptNewOrLocalTunnel.new
           when :accept_new_or_local_tunnel, nil then
             Net::SSH::Verifiers::AcceptNewOrLocalTunnel.new
-          when :very
-            Kernel.warn('verify_host_key: :very is deprecated, use :accept_new')
-            Net::SSH::Verifiers::AcceptNew.new
           when :accept_new then
             Net::SSH::Verifiers::AcceptNew.new
-          when :secure then
-            Kernel.warn('verify_host_key: :secure is deprecated, use :always')
-            Net::SSH::Verifiers::Always.new
           when :always then
             Net::SSH::Verifiers::Always.new
+          when *REMOVED_VERIFY_HOST_KEY_VALUES.keys
+            raise ArgumentError,
+                  "verify_host_key: #{verifier.inspect} has been removed, use #{REMOVED_VERIFY_HOST_KEY_VALUES[verifier].inspect}"
           else
-            if verifier.respond_to?(:verify)
-              if verifier.respond_to?(:verify_signature)
-                verifier
-              else
-                Kernel.warn("Warning: verifier without :verify_signature is deprecated")
-                CompatibleVerifier.new(verifier)
-              end
-            else
-              raise(
-                ArgumentError,
-                "Invalid argument to :verify_host_key (or deprecated " \
-                ":paranoid): #{verifier.inspect}"
-              )
+            raise ArgumentError, "Invalid argument to :verify_host_key: #{verifier.inspect}" unless verifier.respond_to?(:verify)
+
+            unless verifier.respond_to?(:verify_signature)
+              raise ArgumentError,
+                    "verify_host_key verifier #{verifier.inspect} must implement verify_signature(&block): " \
+                    "yield to the block, which checks the server's host key signature, and return its result"
             end
+
+            verifier
           end
         end
       end

data/lib/net/ssh/verifiers/always.rb

@@ -51,9 +51,6 @@ module Net
         # implement them (Net::SSH::HostKeyEntries::CertAuthority). Non-certificate
         # entries do not respond to these predicates and are left untouched.
         def verify_certificate!(entry, host_keys, arguments)
-          # Plain keys carry no certificate constraints, and respond_to? on this delegator prints a deprecation warning (#1026).
-          return if entry.is_a?(Net::SSH::HostKeyEntries::PubKey)
-
           cert = arguments[:key]
 
           if entry.respond_to?(:matches_validity?) && !entry.matches_validity?(cert)

data/lib/net/ssh/version.rb

@@ -56,7 +56,7 @@ module Net
 
       # The prerelease component of this version of the Net::SSH library
       # nil allowed
-      PRE   = "rc3"
+      PRE   = "rc5"
 
       # The current version of the Net::SSH library as a Version instance
       CURRENT = new(*[MAJOR, MINOR, TINY, PRE].compact)