net-ssh 8.0.0 → 8.0.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fc22933c7ce50930b6118479820acb8d978d855baade0499b94065d7e245c016
-  data.tar.gz: 3340e9bd30ac3781da55ffdc0362626e32ad8b0c2db0b2352bf879dc6fe743bc
+  metadata.gz: 96690db72c35721670d94d15faf150030ae24a696b2eecc9f9b174eadaa892a2
+  data.tar.gz: b5d55d232f256442dfdc344b6a18384872fdc1f7c2d7ced93f7e6dec1890f02c
 SHA512:
-  metadata.gz: 226a157e20beb49c008e4a3eb3e15a93ea23b7d0b2935f3c0fa4111d4e43815f6a77b0ef2f22e2bab7123f9410f99655459dc42b94c30ce63a295be77dc3b2ce
-  data.tar.gz: fb9269c31afc40374ef1b30cc58008d916cf41f3a633596e2fb04f924917f33e966c3b556df56f3cb10fbc24190d956ac9b59b2d57cb7b23204bded86f5316c6
+  metadata.gz: e6ebb241e5088fd5b25402bafca4c6152e56da239a3e6bb0124ab84b9944ba7bb91506c6aef17bcb84e021f92335440d8e08f1fce4726189179d65c61150098f
+  data.tar.gz: ff9a4c3de691cce2a5cf9e1bb6a647b98663351ab6f896198ee519c6f040e0b767382ad499b7d3907446e52afbc98f485df2a126612da78aaba2d76fc80e563f

data/.rubocop.yml

@@ -20,3 +20,7 @@ Layout/LineLength:
 
 Style/EmptyLiteral:
   Enabled: false
+
+# CI runs the suite with RUBYOPT=--enable=frozen-string-literal instead of a magic comment in every file.
+Style/FrozenStringLiteralComment:
+  Enabled: false

data/.rubocop_todo.yml

@@ -587,13 +587,6 @@ Style/FormatString:
     - 'lib/net/ssh/authentication/pageant.rb'
     - 'lib/net/ssh/loggable.rb'
 
-# Offense count: 174
-# This cop supports safe auto-correction (--auto-correct).
-# Configuration parameters: EnforcedStyle.
-# SupportedStyles: always, always_true, never
-Style/FrozenStringLiteralComment:
-  Enabled: false
-
 # Offense count: 1
 # This cop supports safe auto-correction (--auto-correct).
 Style/GlobalStdStream:

data/CHANGES.txt

@@ -1,3 +1,12 @@
+=== 8.0.2
+
+  * Fixed `Session#close` raising `EOFError: cannot send data if channel has declared eof` when a forwarded connection still had unread data from its local client; data net-ssh had already read is still sent before the EOF and, as in OpenSSH, the rest is dropped; a regression in 8.0.0 [#1066, #1067]
+
+=== 8.0.1
+
+  * Fixed `unexpected packet type 94 during initial key exchange` (or 93) when channel data arrives during a client-initiated re-key, which broke bulk transfers at the first re-key (e.g. with `rekey_limit`, or after about 1 GB); a regression in 7.3.5 and 8.0.0 [#1063]
+  * `control_master: :auto` now ignores `forward_agent` (logged at info level) instead of raising ArgumentError, and logs the ignored connection options at info instead of warn level, so it works with sshkit (Kamal, Capistrano), which always passes `forward_agent: true`, `keys`, `known_hosts` and `keepalive` [#1062]
+
 === 8.0.0
 
   * No changes since 8.0.0 rc5.

data/lib/net/ssh/multiplex.rb

@@ -32,13 +32,9 @@ module Net
       VALUES = [:auto, false, nil].freeze
 
       def self.validate_options!(options)
-        unless VALUES.include?(options[:control_master])
-          raise ArgumentError, "control_master must be :auto or false, got #{options[:control_master].inspect}"
-        end
-        return unless options[:control_master] && options[:forward_agent]
+        return if VALUES.include?(options[:control_master])
 
-        raise ArgumentError, "forward_agent can't be used with control_master: the ControlMaster serves agent requests " \
-                             "from its own agent only if it has ForwardAgent enabled itself, and rejects them otherwise"
+        raise ArgumentError, "control_master must be :auto or false, got #{options[:control_master].inspect}"
       end
 
       # Returns a Connection::Session running through the ControlMaster for
@@ -55,7 +51,7 @@ module Net
         return nil unless socket
 
         logger.info { "control_master: using ControlMaster at #{path}" }
-        warn_master_owned(logger, explicit)
+        log_master_owned(logger, explicit)
         begin
           transport = ProxyTransport.new(socket, host: host, control_path: path, options: options)
           Connection::Session.new(transport, session_options(logger, options))
@@ -108,23 +104,23 @@ module Net
         ControlPath.jump_host(proxy.jump_proxies)
       end
 
-      def self.warn_master_owned(logger, explicit)
+      def self.log_master_owned(logger, explicit)
         bypassed = explicit & MASTER_OWNED_OPTIONS
         return if bypassed.empty?
 
-        logger.warn { "control_master: ignoring #{bypassed.join(', ')}, the ControlMaster's own settings apply" }
+        logger.info { "control_master: ignoring #{bypassed.join(', ')}, the ControlMaster's own settings apply" }
       end
 
       # Keepalive is a global request, which the master doesn't allow; it
-      # watches its own connection anyway. ForwardAgent from ssh_config is
-      # dropped for the reason given in validate_options!.
+      # watches its own connection anyway. The master serves agent requests
+      # from its own agent only if it has ForwardAgent enabled itself.
       def self.session_options(logger, options)
         logger.info { "control_master: keepalive is left to the ControlMaster" } if options[:keepalive]
         logger.info { "control_master: ignoring ForwardAgent, the ControlMaster's own ForwardAgent setting applies" } if options[:forward_agent]
         options.merge(keepalive: false, forward_agent: false)
       end
 
-      private_class_method :open_proxy, :socket_path, :jump_host, :warn_master_owned, :session_options
+      private_class_method :open_proxy, :socket_path, :jump_host, :log_master_owned, :session_options
     end
   end
 end

data/lib/net/ssh/service/forward.rb

@@ -346,6 +346,10 @@ module Net
               ch.info { "#{type} forwarded connection closed" }
               session.stop_listening_to(socket)
               ch.close
+            elsif ch.eof?
+              # Like OpenSSH's chan_shutdown_read: data already read still goes out before CHANNEL_EOF, the rest is dropped.
+              ch.output.append(socket.read_available) if socket.available > 0
+              session.pause_reading(socket)
             else
               if socket.available > 0
                 data = socket.read_available(8192)
@@ -376,6 +380,8 @@ module Net
           end
 
           channel.on_process do |ch|
+            next if ch.eof?
+
             data = ch[:socket].read(8192)
             if data
               ch.debug { "read #{data.length} bytes from client, sending over #{type} forwarded connection" }

data/lib/net/ssh/transport/session.rb

@@ -228,7 +228,8 @@ module Net
 
             else
               return packet if algorithms.allow?(packet)
-              raise Net::SSH::Exception, "unexpected packet type #{packet.type} during initial key exchange" unless algorithms.initialized?
+              # Algorithms#rekey! clears initialized?, so the session id is what marks the first key exchange as done.
+              raise Net::SSH::Exception, "unexpected packet type #{packet.type} during initial key exchange" unless algorithms.session_id
 
               push(packet)
             end

data/lib/net/ssh/version.rb

@@ -52,7 +52,7 @@ module Net
       MINOR = 0
 
       # The tiny component of this version of the Net::SSH library
-      TINY  = 0
+      TINY  = 2
 
       # The prerelease component of this version of the Net::SSH library
       # nil allowed

data/lib/net/ssh.rb

@@ -125,21 +125,21 @@ module Net
     #   for setting up a connection (:keys, :key_data, :password, :passphrase,
     #   :auth_methods, :verify_host_key, :known_hosts, :host_key, :kex,
     #   :encryption, :hmac, :compression, :rekey_*, :proxy, :keepalive and the
-    #   like); explicitly passed ones are named in a logger warning. Over the
+    #   like); explicitly passed ones are named at info level. Over the
     #   master, remote port forwarding (Service::Forward#remote and
     #   #cancel_remote) raises Net::SSH::NotSupportedOverControlMaster, as the
     #   master consumes the global request reply, so success, failure and the
     #   port allocated for port 0 can't be observed; other global requests
     #   raise it too. Agent and X11 forwarding requests raise it
-    #   too, and :forward_agent can't be combined with it, because the master
-    #   serves them from its own agent or display only if it has ForwardAgent
-    #   or ForwardX11 enabled itself, and rejects them otherwise. Keepalive and
-    #   rekeying are left to the master. ssh_config's ControlMaster is
-    #   ignored, only this option enables it. An invalid ControlPath raises
-    #   ArgumentError. A missing or stale socket is logged at info level, a
-    #   socket that can't be used (another owner, refused, wrong protocol,
-    #   timed out) at warn level. Has no effect on Windows. Defaults to
-    #   +false+.
+    #   too, and :forward_agent is ignored (logged at info level), because the
+    #   master serves them from its own agent or display only if it has
+    #   ForwardAgent or ForwardX11 enabled itself, and rejects them otherwise.
+    #   Keepalive and rekeying are left to the master. ssh_config's
+    #   ControlMaster is ignored, only this option enables it. An invalid
+    #   ControlPath raises ArgumentError. A missing or stale socket is logged
+    #   at info level, a socket that can't be used (another owner, refused,
+    #   wrong protocol, timed out) at warn level. Has no effect on Windows.
+    #   Defaults to +false+.
     # * :control_path => the ControlMaster socket to use with
     #   :control_master, with the same ~, ${ENV} and % tokens as ssh_config's
     #   ControlPath (%C, %d, %h, %i, %j, %k, %L, %l, %n, %p, %r, %u, %%).
@@ -154,7 +154,8 @@ module Net
     #   files. Defaults to +true+.
     # * :encryption => the encryption cipher (or ciphers) to use
     # * :forward_agent => set to true if you want the SSH agent connection to
-    #   be forwarded
+    #   be forwarded. Ignored for a session through a ControlMaster (see
+    #   :control_master).
     # * :known_hosts => a custom object holding known hosts records.
     #   It must implement #search_for and `add` in a similiar manner as KnownHosts.
     # * :global_known_hosts_file => the location of the global known hosts

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: net-ssh
 version: !ruby/object:Gem::Version
-  version: 8.0.0
+  version: 8.0.2
 platform: ruby
 authors:
 - Jamis Buck
@@ -32,7 +32,7 @@ cert_chain:
   ufHf4AX2UIkJbh7zCPkiNCqIr7MSWLNFG/9lOlHYsEJM8XujT1ofPobYx6YSFx/C
   7HBrI7UX7awt6UvBZebhcHzyMHxg/B5PVQllPA==
   -----END CERTIFICATE-----
-date: 2026-10-21 00:00:00.000000000 Z
+date: 2026-10-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: logger