net-ssh 8.1.0 → 8.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8a3eb4e5ac79bff25a68aaecd501c437bf0145a7458c8edd00f90e3b9ae14641
-  data.tar.gz: cabb7b40f56ed19ca61a1a09eccff1745618a62e258a9c2ba1804fdfbf02c44b
+  metadata.gz: 07eacca644427ed0543e1a428d7075c1d5fd4a0da378e83959dcd312cd7f3500
+  data.tar.gz: eb50984faecccca334a68cd2b8fc04a749010e85e3cad2acb5e868b44bd168e6
 SHA512:
-  metadata.gz: e748a76a0dff8328c8d12da44f8372814c15260fa04f428459145f626cbde231173475d0b8547f907f0d5c983e4abf9ca8f23ef0eb26469a0558d259ee7997e1
-  data.tar.gz: c54425a607b9056a9bbd15985791911948a86548a1a6b0f8894aa193dc35aa703a2435ad25c11a0b7c622a7b6605d4815dcd8006864f311c8c0443b8a02acd63
+  metadata.gz: 0eab425719d3294df5ece8aff6758c4a627a67b366b661d1a4475b9979c5dea5e614ab583f559fd3a4d36ccd7d8f0cb35776e99a955007830a6ed0b3b37c04bb
+  data.tar.gz: 4c5a4eaeff4882604a01156bf22322d81c864f26b0637cb0400554206c514aa137a00f9b83ed637001a7ffb4ef599d49d512862963b1dd1041db6886dae44754

data/CHANGES.txt

@@ -1,3 +1,7 @@
+=== 8.1.1
+
+  * Security: refuse host keys marked `@revoked` in known_hosts, and certificates of such a key or signed by it, by raising the new `Net::SSH::HostKeyRevoked`, which `remember_host!` can't override; these lines were loaded as trusted keys, so every verifier except `:never` accepted the revoked key [GHSA-hjwv-j52r-xcg7]
+
 === 8.1.0
 
   * BREAKING: Publickey auth offers each RSA key and certificate once, with the first `pubkey_algorithms` entry the server lists in RFC 8308 `server-sig-algs`, as OpenSSH does, so refused RSA keys no longer use up `MaxAuthTries` two or three at a time. Servers that send no `server-sig-algs` (OpenSSH 7.1 and older, some other servers) are offered RSA keys only as `ssh-rsa`, and only when it's enabled (e.g. `pubkey_algorithms: %w[+ssh-rsa]`); by default RSA keys are skipped there instead of being tried with rsa-sha2-512/256; OpenSSH 7.2 to 9.5 servers that accept only `ssh-rsa` still list rsa-sha2-* in `server-sig-algs`, so they need `ssh-rsa` first (`pubkey_algorithms: %w[^ssh-rsa]`) [#886, #1077]

data/lib/net/ssh/errors.rb

@@ -120,5 +120,15 @@ module Net
     # you want to proceed anyway, simply call the remember_host! method on the
     # exception, and then retry.
     class HostKeyUnknown < HostKeyError; end
+
+    # Raised when the key given by the host, or the CA that signed its
+    # certificate, is marked @revoked in a known hosts file. A revoked key must
+    # never be accepted, so unlike the other host key errors this one can't be
+    # overridden: #remember_host! just raises it again.
+    class HostKeyRevoked < HostKeyError
+      def remember_host!
+        raise self
+      end
+    end
   end
 end

data/lib/net/ssh/known_hosts.rb

@@ -103,6 +103,22 @@ module Net
           server_key.critical_options.empty?
         end
       end
+
+      # @revoked entry
+      class Revoked
+        def initialize(key, comment: nil)
+          @key = key
+          @comment = comment
+        end
+
+        # Returns true for the revoked key itself and for any certificate that
+        # wraps it or is signed by it, matching OpenSSH's check_key_not_revoked.
+        def matches_key?(server_key)
+          keys = [server_key]
+          keys += [server_key.key, server_key.signature_key] if server_key.respond_to?(:signature_key)
+          keys.any? { |key| key.ssh_type == @key.ssh_type && key.to_blob == @key.to_blob }
+        end
+      end
     end
 
     # Represents the result of a search in known hosts
@@ -111,11 +127,17 @@ module Net
       include Enumerable
       attr_reader :host
 
-      def initialize(host_keys, host, known_hosts, options = {})
+      def initialize(host_keys, host, known_hosts, options = {}, revoked_keys = [])
         @host_keys = host_keys
         @host = host
         @known_hosts = known_hosts
         @options = options
+        @revoked_keys = revoked_keys
+      end
+
+      # Returns true if a @revoked known-hosts entry for this host matches +key+.
+      def revoked?(key)
+        @revoked_keys.any? { |entry| entry.matches_key?(key) }
       end
 
       def add_host_key(key)
@@ -161,11 +183,14 @@ module Net
         # Searches all known host files (see KnownHosts.hostfiles) for all keys
         # of the given host. Returns an enumerable of keys found.
         def search_for(host, options = {})
-          HostKeys.new(search_in(hostfiles(options), host, options), host, self, options)
+          files = hostfiles(options)
+          revoked_keys = files.flat_map { |file| KnownHosts.new(file).revoked_keys_for(host) }
+          HostKeys.new(search_in(files, host, options), host, self, options, revoked_keys)
         end
 
         # Search for all known keys for the given host, in every file given in
-        # the +files+ array. Returns the list of keys.
+        # the +files+ array. Returns the list of keys. @revoked entries are not
+        # included.
         def search_in(files, host, options = {})
           files.flat_map { |file| KnownHosts.new(file).keys_for(host, options) }
         end
@@ -229,46 +254,50 @@ module Net
       #   "[net.ssh.test]:5555"
       #   "[1,2,3,4]:5555"
       #   "[net.ssh.test]:5555,[1.2.3.4]:5555
+      #
+      # @revoked entries are not included, see revoked_keys_for.
       def keys_for(host, options = {})
         keys = []
-        return keys unless File.readable?(source)
-
         entries = host.split(/,/)
         host_name = entries[0]
         host_ip = entries[1]
 
-        File.open(source) do |file|
-          file.each_line do |line|
-            if line.start_with?('@')
-              marker, hosts, type, key_content, comment = line.split(' ')
-            else
-              marker = nil
-              hosts, type, key_content, comment = line.split(' ')
-            end
+        each_entry do |marker, hostlist, key_content, comment|
+          next if marker == "@revoked"
 
-            # Skip empty line or one that is commented
-            next if hosts.nil? || hosts.start_with?('#')
+          found = hostlist.any? { |pattern| match(host_name, pattern) } || known_host_hash?(hostlist, entries)
+          next unless found
 
-            hostlist = hosts.split(',')
+          found = hostlist.include?(host_ip) if options[:check_host_ip] && entries.size > 1 && hostlist.size > 1
+          next unless found
 
-            next unless SUPPORTED_TYPE.include?(type)
+          raw_key = read_key(key_content)
+
+          keys <<
+            if marker == "@cert-authority"
+              HostKeyEntries::CertAuthority.new(raw_key, comment: comment)
+            else
+              HostKeyEntries::PubKey.new(raw_key, comment: comment)
+            end
+        end
 
-            found = hostlist.any? { |pattern| match(host_name, pattern) } || known_host_hash?(hostlist, entries)
-            next unless found
+        keys
+      end
 
-            found = hostlist.include?(host_ip) if options[:check_host_ip] && entries.size > 1 && hostlist.size > 1
-            next unless found
+      # Returns the @revoked entries for the given host, which takes the same
+      # formats as keys_for. An entry matching any of the comma-separated names
+      # counts, so :check_host_ip can't narrow a revocation.
+      def revoked_keys_for(host)
+        keys = []
+        entries = host.split(/,/)
 
-            blob = key_content.unpack("m*").first
-            raw_key = Net::SSH::Buffer.new(blob).read_key
+        each_entry do |marker, hostlist, key_content, comment|
+          next unless marker == "@revoked"
 
-            keys <<
-              if marker == "@cert-authority"
-                HostKeyEntries::CertAuthority.new(raw_key, comment: comment)
-              else
-                HostKeyEntries::PubKey.new(raw_key, comment: comment)
-              end
-          end
+          found = entries.any? { |entry| hostlist.any? { |pattern| match(entry, pattern) } }
+          next unless found || known_host_hash?(hostlist, entries)
+
+          keys << HostKeyEntries::Revoked.new(read_key(key_content), comment: comment)
         end
 
         keys
@@ -313,6 +342,32 @@ module Net
           file.puts "#{host} #{key.ssh_type} #{blob}"
         end
       end
+
+      private
+
+      # Yields the marker, host patterns, key and comment of each usable line.
+      def each_entry
+        return unless File.readable?(source)
+
+        File.open(source) do |file|
+          file.each_line do |line|
+            fields = line.split(' ')
+            marker = fields.shift if fields.first&.start_with?('@')
+            hosts, type, key_content, comment = fields
+
+            # Skip empty line or one that is commented
+            next if hosts.nil? || hosts.start_with?('#')
+
+            next unless SUPPORTED_TYPE.include?(type)
+
+            yield marker, hosts.split(','), key_content, comment
+          end
+        end
+      end
+
+      def read_key(key_content)
+        Net::SSH::Buffer.new(key_content.unpack("m*").first).read_key
+      end
     end
   end
 end

data/lib/net/ssh/verifiers/accept_new_or_local_tunnel.rb

@@ -7,11 +7,13 @@ module Net
       # verify a connection if the server is the localhost and the port is a
       # nonstandard port number. Those two conditions will typically mean the
       # connection is being tunnelled through a forwarded port, so the known-hosts
-      # file will not be helpful (in general).
+      # file will not be helpful (in general). A key marked @revoked is refused
+      # either way.
       class AcceptNewOrLocalTunnel < AcceptNew
         # Tries to determine if the connection is being tunnelled, and if so,
         # returns true. Otherwise, performs the standard strict verification.
         def verify(arguments)
+          refuse_revoked!(arguments)
           return true if tunnelled?(arguments)
 
           super

data/lib/net/ssh/verifiers/always.rb

@@ -10,10 +10,13 @@ module Net
       # (HostKeyUnknown). This is in contrast to the "Strict" class, which will
       # silently add the key to your known_hosts file. If the server does appear at
       # least once, but the key given does not match any known for the server, an
-      # exception will be raised (HostKeyMismatch).
+      # exception will be raised (HostKeyMismatch). A key marked @revoked in a
+      # host file is always refused (HostKeyRevoked).
       # Otherwise, this returns true.
       class Always
         def verify(arguments)
+          refuse_revoked!(arguments)
+
           host_keys = arguments[:session].host_keys
 
           # We've never seen this host before, so raise an exception.
@@ -47,6 +50,18 @@ module Net
 
         private
 
+        # Custom :known_hosts objects may return a host_keys collection with no
+        # revocation support.
+        def refuse_revoked!(arguments)
+          host_keys = arguments[:session].host_keys
+          return unless host_keys.respond_to?(:revoked?) && host_keys.revoked?(arguments[:key])
+
+          exception = HostKeyRevoked.new("fingerprint #{arguments[:fingerprint]} " +
+                                         "is revoked for #{host_keys.host.inspect}")
+          exception.data = arguments
+          raise exception
+        end
+
         # Enforces the @cert-authority certificate constraints for entries that
         # implement them (Net::SSH::HostKeyEntries::CertAuthority). Non-certificate
         # entries do not respond to these predicates and are left untouched.

data/lib/net/ssh/verifiers/never.rb

@@ -3,7 +3,8 @@ module Net
     module Verifiers
       # This host key verifier simply allows every key it sees, without
       # any verification. This is simple, but very insecure because it
-      # exposes you to MiTM attacks.
+      # exposes you to MiTM attacks. It does not read the known hosts files,
+      # so it accepts keys marked @revoked as well.
       class Never
         # Returns true.
         def verify(arguments)

data/lib/net/ssh/version.rb

@@ -52,7 +52,7 @@ module Net
       MINOR = 1
 
       # The tiny component of this version of the Net::SSH library
-      TINY  = 0
+      TINY  = 1
 
       # The prerelease component of this version of the Net::SSH library
       # nil allowed

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: net-ssh
 version: !ruby/object:Gem::Version
-  version: 8.1.0
+  version: 8.1.1
 platform: ruby
 authors:
 - Jamis Buck
@@ -32,7 +32,7 @@ cert_chain:
   ufHf4AX2UIkJbh7zCPkiNCqIr7MSWLNFG/9lOlHYsEJM8XujT1ofPobYx6YSFx/C
   7HBrI7UX7awt6UvBZebhcHzyMHxg/B5PVQllPA==
   -----END CERTIFICATE-----
-date: 2026-11-02 00:00:00.000000000 Z
+date: 2026-11-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: logger

metadata.gz.sig

@@ -1 +1 @@
-!�o���!Uљ��w̱ˋM�!�#:�u,�oP�\f ��+,�2��a���tT���_�6J�hՍu�YLVI;��Ÿ�t����^�94(��M�
+����K�#��إ�TJ�q�3v|�6e`�gI;f�s�"O)�R��/�?��