asyncssh 2.21.1__tar.gz → 2.23.0__tar.gz

{asyncssh-2.21.1 → asyncssh-2.23.0}/.github/workflows/run_tests.yml

@@ -13,21 +13,8 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, macos-latest, windows-2022]
-        python-version: ["3.8", "3.9", "3.10", "3.11", "3.12", "3.13"]
-        include:
-          - os: macos-latest
-            python-version: "3.10"
-            openssl-version: "3"
-          - os: macos-latest
-            python-version: "3.11"
-            openssl-version: "3"
-          - os: macos-latest
-            python-version: "3.12"
-            openssl-version: "3"
-          - os: macos-latest
-            python-version: "3.13"
-            openssl-version: "3"
+        os: [ubuntu-latest, macos-latest, windows-latest]
+        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
 
     runs-on: ${{ matrix.os }}
     env:
@@ -56,6 +43,19 @@ jobs:
             asyncssh/setup.py
             asyncssh/tox.ini
 
+      - name: Fix modules path for OpenSSL on Windows
+        if: ${{ runner.os == 'Windows' }}
+        shell: pwsh
+        run: |
+          $openssl_path = ((Get-Command openssl).Path | Split-Path -Parent)
+          echo "OPENSSL_MODULES=$openssl_path" >> $env:GITHUB_ENV
+
+      - name: Verify legacy provider can be enabled in OpenSSL on Windows
+        if: ${{ runner.os == 'Windows' }}
+        shell: pwsh
+        run: |
+          openssl list -provider default -provider legacy -providers
+
       - name: Set up ccache for liboqs (Linux)
         uses: hendrikmuhs/ccache-action@v1.2
         if: ${{ runner.os == 'Linux' }}
@@ -66,15 +66,11 @@ jobs:
         if: ${{ runner.os == 'Linux' }}
         run: |
           sudo apt update
-          sudo apt install -y --no-install-recommends libnettle8 libsodium-dev libssl-dev libkrb5-dev ssh cmake ninja-build
+          sudo apt install -y --no-install-recommends libnettle8 libssl-dev libkrb5-dev ssh cmake ninja-build
 
       - name: Install macOS dependencies
         if: ${{ runner.os == 'macOS' }}
-        run: brew install nettle liboqs libsodium openssl
-
-      - name: Provide OpenSSL 3
-        if: ${{ runner.os == 'macOS' && matrix.openssl-version == '3' }}
-        run: echo "/usr/local/opt/openssl@3/bin" >> $GITHUB_PATH
+        run: brew install nettle liboqs
 
       - name: Install nettle (Windows)
         if: ${{ runner.os == 'Windows' }}

{asyncssh-2.21.1/asyncssh.egg-info → asyncssh-2.23.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: asyncssh
-Version: 2.21.1
+Version: 2.23.0
 Summary: AsyncSSH: Asynchronous SSHv2 client and server library
 Author-email: Ron Frederick <ronf@timeheart.net>
 License: EPL-2.0 OR GPL-2.0-or-later
@@ -14,17 +14,16 @@ Classifier: Intended Audience :: Developers
 Classifier: License :: OSI Approved
 Classifier: Operating System :: MacOS :: MacOS X
 Classifier: Operating System :: POSIX
-Classifier: Programming Language :: Python :: 3.8
-Classifier: Programming Language :: Python :: 3.9
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
 Classifier: Topic :: Internet
 Classifier: Topic :: Security :: Cryptography
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Classifier: Topic :: System :: Networking
-Requires-Python: >=3.6
+Requires-Python: >=3.10
 Description-Content-Type: text/x-rst
 License-File: LICENSE
 Requires-Dist: cryptography>=39.0
@@ -32,11 +31,11 @@ Requires-Dist: typing_extensions>=4.0.0
 Provides-Extra: bcrypt
 Requires-Dist: bcrypt>=3.1.3; extra == "bcrypt"
 Provides-Extra: fido2
-Requires-Dist: fido2<2,>=0.9.2; extra == "fido2"
+Requires-Dist: fido2>=2; extra == "fido2"
+Provides-Extra: ifaddr
+Requires-Dist: ifaddr>=0.2.0; extra == "ifaddr"
 Provides-Extra: gssapi
 Requires-Dist: gssapi>=1.2.0; extra == "gssapi"
-Provides-Extra: libnacl
-Requires-Dist: libnacl>=1.4.2; extra == "libnacl"
 Provides-Extra: pkcs11
 Requires-Dist: python-pkcs11>=0.7.0; extra == "pkcs11"
 Provides-Extra: pyopenssl
@@ -58,7 +57,7 @@ AsyncSSH: Asynchronous SSH for Python
 =====================================
 
 AsyncSSH is a Python package which provides an asynchronous client and
-server implementation of the SSHv2 protocol on top of the Python 3.6+
+server implementation of the SSHv2 protocol on top of the Python 3.10+
 asyncio framework.
 
 .. code:: python
@@ -148,7 +147,7 @@ License
 
 This package is released under the following terms:
 
-  Copyright (c) 2013-2024 by Ron Frederick <ronf@timeheart.net> and others.
+  Copyright (c) 2013-2025 by Ron Frederick <ronf@timeheart.net> and others.
 
   This program and the accompanying materials are made available under
   the terms of the Eclipse Public License v2.0 which accompanies this
@@ -173,8 +172,8 @@ Prerequisites
 
 To use AsyncSSH 2.0 or later, you need the following:
 
-* Python 3.6 or later
-* cryptography (PyCA) 3.1 or later
+* Python 3.10 or later
+* cryptography (PyCA) 39.0 or later
 
 Installation
 ------------
@@ -197,6 +196,9 @@ functionality:
 * Install fido2 from https://pypi.org/project/fido2 if you want support
   for key exchange and authentication with U2F/FIDO2 security keys.
 
+* Install ifaddr from https://pypi.org/project/ifaddr/ if you want
+  support for matching on local network IP addresses.
+
 * Install python-pkcs11 from https://pypi.org/project/python-pkcs11 if
   you want support for accessing PIV keys on PKCS#11 security tokens.
 
@@ -207,12 +209,6 @@ functionality:
   if you want support for the OpenSSH post-quantum key exchange
   algorithms based on ML-KEM and SNTRUP.
 
-* Install libsodium from https://github.com/jedisct1/libsodium
-  and libnacl from https://pypi.python.org/pypi/libnacl if you have
-  a version of OpenSSL older than 1.1.1b installed and you want
-  support for Curve25519 key exchange, Ed25519 keys and certificates,
-  or the Chacha20-Poly1305 cipher.
-
 * Install libnettle from http://www.lysator.liu.se/~nisse/nettle/
   if you want support for UMAC cryptographic hashes.
 
@@ -228,29 +224,28 @@ easy to install any or all of these dependencies:
 
   | bcrypt
   | fido2
+  | ifaddr
   | gssapi
-  | libnacl
   | pkcs11
   | pyOpenSSL
   | pywin32
 
-For example, to install bcrypt, fido2, gssapi, libnacl, pkcs11, and
-pyOpenSSL on UNIX, you can run:
+For example, to install bcrypt, fido2, gssapi, ifaddr, pkcs11, and pyOpenSSL
+on UNIX, you can run:
 
   ::
 
-    pip install 'asyncssh[bcrypt,fido2,gssapi,libnacl,pkcs11,pyOpenSSL]'
+    pip install 'asyncssh[bcrypt,fido2,gssapi,ifaddr,pkcs11,pyOpenSSL]'
 
-To install bcrypt, fido2, libnacl, pkcs11, pyOpenSSL, and pywin32 on
-Windows, you can run:
+To install bcrypt, fido2, ifaddr, pkcs11, pyOpenSSL, and pywin32 on Windows,
+you can run:
 
   ::
 
-    pip install 'asyncssh[bcrypt,fido2,libnacl,pkcs11,pyOpenSSL,pywin32]'
+    pip install 'asyncssh[bcrypt,fido2,ifaddr,pkcs11,pyOpenSSL,pywin32]'
 
-Note that you will still need to manually install the libsodium library
-listed above for libnacl to work correctly and/or libnettle for UMAC
-support. Unfortunately, since liboqs, libsodium, and libnettle are not
+Note that you will still need to manually install the libnettle library
+for UMAC support. Unfortunately, since liboqs and libnettle are not
 Python packages, they cannot be directly installed using pip.
 
 Installing the development branch

{asyncssh-2.21.1 → asyncssh-2.23.0}/README.rst

@@ -11,7 +11,7 @@ AsyncSSH: Asynchronous SSH for Python
 =====================================
 
 AsyncSSH is a Python package which provides an asynchronous client and
-server implementation of the SSHv2 protocol on top of the Python 3.6+
+server implementation of the SSHv2 protocol on top of the Python 3.10+
 asyncio framework.
 
 .. code:: python
@@ -101,7 +101,7 @@ License
 
 This package is released under the following terms:
 
-  Copyright (c) 2013-2024 by Ron Frederick <ronf@timeheart.net> and others.
+  Copyright (c) 2013-2025 by Ron Frederick <ronf@timeheart.net> and others.
 
   This program and the accompanying materials are made available under
   the terms of the Eclipse Public License v2.0 which accompanies this
@@ -126,8 +126,8 @@ Prerequisites
 
 To use AsyncSSH 2.0 or later, you need the following:
 
-* Python 3.6 or later
-* cryptography (PyCA) 3.1 or later
+* Python 3.10 or later
+* cryptography (PyCA) 39.0 or later
 
 Installation
 ------------
@@ -150,6 +150,9 @@ functionality:
 * Install fido2 from https://pypi.org/project/fido2 if you want support
   for key exchange and authentication with U2F/FIDO2 security keys.
 
+* Install ifaddr from https://pypi.org/project/ifaddr/ if you want
+  support for matching on local network IP addresses.
+
 * Install python-pkcs11 from https://pypi.org/project/python-pkcs11 if
   you want support for accessing PIV keys on PKCS#11 security tokens.
 
@@ -160,12 +163,6 @@ functionality:
   if you want support for the OpenSSH post-quantum key exchange
   algorithms based on ML-KEM and SNTRUP.
 
-* Install libsodium from https://github.com/jedisct1/libsodium
-  and libnacl from https://pypi.python.org/pypi/libnacl if you have
-  a version of OpenSSL older than 1.1.1b installed and you want
-  support for Curve25519 key exchange, Ed25519 keys and certificates,
-  or the Chacha20-Poly1305 cipher.
-
 * Install libnettle from http://www.lysator.liu.se/~nisse/nettle/
   if you want support for UMAC cryptographic hashes.
 
@@ -181,29 +178,28 @@ easy to install any or all of these dependencies:
 
   | bcrypt
   | fido2
+  | ifaddr
   | gssapi
-  | libnacl
   | pkcs11
   | pyOpenSSL
   | pywin32
 
-For example, to install bcrypt, fido2, gssapi, libnacl, pkcs11, and
-pyOpenSSL on UNIX, you can run:
+For example, to install bcrypt, fido2, gssapi, ifaddr, pkcs11, and pyOpenSSL
+on UNIX, you can run:
 
   ::
 
-    pip install 'asyncssh[bcrypt,fido2,gssapi,libnacl,pkcs11,pyOpenSSL]'
+    pip install 'asyncssh[bcrypt,fido2,gssapi,ifaddr,pkcs11,pyOpenSSL]'
 
-To install bcrypt, fido2, libnacl, pkcs11, pyOpenSSL, and pywin32 on
-Windows, you can run:
+To install bcrypt, fido2, ifaddr, pkcs11, pyOpenSSL, and pywin32 on Windows,
+you can run:
 
   ::
 
-    pip install 'asyncssh[bcrypt,fido2,libnacl,pkcs11,pyOpenSSL,pywin32]'
+    pip install 'asyncssh[bcrypt,fido2,ifaddr,pkcs11,pyOpenSSL,pywin32]'
 
-Note that you will still need to manually install the libsodium library
-listed above for libnacl to work correctly and/or libnettle for UMAC
-support. Unfortunately, since liboqs, libsodium, and libnettle are not
+Note that you will still need to manually install the libnettle library
+for UMAC support. Unfortunately, since liboqs and libnettle are not
 Python packages, they cannot be directly installed using pip.
 
 Installing the development branch

{asyncssh-2.21.1 → asyncssh-2.23.0}/asyncssh/agent.py

@@ -121,9 +121,7 @@ class SSHAgentKeyPair(SSHKeyPair):
         else:
             sig_algorithm = algorithm
 
-        # Neither Pageant nor the Win10 OpenSSH agent seems to support the
-        # ssh-agent protocol flags used to request RSA SHA2 signatures yet
-        if sig_algorithm == b'ssh-rsa' and sys.platform != 'win32':
+        if sig_algorithm == b'ssh-rsa':
             sig_algorithms: Sequence[bytes] = \
                 (b'rsa-sha2-256', b'rsa-sha2-512', b'ssh-rsa')
         else:

{asyncssh-2.21.1 → asyncssh-2.23.0}/asyncssh/channel.py

@@ -1,4 +1,4 @@
-# Copyright (c) 2013-2024 by Ron Frederick <ronf@timeheart.net> and others.
+# Copyright (c) 2013-2025 by Ron Frederick <ronf@timeheart.net> and others.
 #
 # This program and the accompanying materials are made available under
 # the terms of the Eclipse Public License v2.0 which accompanies this
@@ -1125,10 +1125,12 @@ class SSHClientChannel(SSHChannel, Generic[AnyStr]):
     _read_datatypes = {EXTENDED_DATA_STDERR}
 
     def __init__(self, conn: 'SSHClientConnection',
-                 loop: asyncio.AbstractEventLoop, encoding: Optional[str],
-                 errors: str, window: int, max_pktsize: int):
+                 loop: asyncio.AbstractEventLoop, utf8_decode_errors: str,
+                 encoding: Optional[str], errors: str, window: int,
+                 max_pktsize: int):
         super().__init__(conn, loop, encoding, errors, window, max_pktsize)
 
+        self._utf8_decode_errors = utf8_decode_errors
         self._exit_status: Optional[int] = None
         self._exit_signal: Optional[_ExitSignal] = None
 
@@ -1299,7 +1301,7 @@ class SSHClientChannel(SSHChannel, Generic[AnyStr]):
 
         try:
             signal = signal_bytes.decode('ascii')
-            msg = msg_bytes.decode('utf-8')
+            msg = msg_bytes.decode('utf-8', self._utf8_decode_errors)
             lang = lang_bytes.decode('ascii')
         except UnicodeDecodeError:
             raise ProtocolError('Invalid exit signal request') from None

{asyncssh-2.21.1 → asyncssh-2.23.0}/asyncssh/client.py

@@ -1,4 +1,4 @@
-# Copyright (c) 2013-2024 by Ron Frederick <ronf@timeheart.net> and others.
+# Copyright (c) 2013-2025 by Ron Frederick <ronf@timeheart.net> and others.
 #
 # This program and the accompanying materials are made available under
 # the terms of the Eclipse Public License v2.0 which accompanies this

{asyncssh-2.21.1 → asyncssh-2.23.0}/asyncssh/config.py

@@ -1,4 +1,4 @@
-# Copyright (c) 2020-2024 by Ron Frederick <ronf@timeheart.net> and others.
+# Copyright (c) 2020-2026 by Ron Frederick <ronf@timeheart.net> and others.
 #
 # This program and the accompanying materials are made available under
 # the terms of the Eclipse Public License v2.0 which accompanies this
@@ -29,14 +29,20 @@ import subprocess
 from hashlib import sha1
 from pathlib import Path, PurePath
 from subprocess import DEVNULL
-from typing import Callable, Dict, List, NoReturn, Optional, Sequence
-from typing import Set, Tuple, Union, cast
+from typing import Callable, Dict, Iterator, List, NoReturn, Optional
+from typing import Sequence, Set, Tuple, Union, cast
 
 from .constants import DEFAULT_PORT
 from .logging import logger
-from .misc import DefTuple, FilePath, ip_address
+from .misc import DefTuple, FilePath, IllegalUserName, ip_address
 from .pattern import HostPatternList, WildcardPatternList
 
+try:
+    import ifaddr
+    _ifaddr_available = True
+except ImportError: # pragma: no cover
+    _ifaddr_available = False
+
 
 ConfigPaths = Union[None, FilePath, Sequence[FilePath]]
 
@@ -52,6 +58,18 @@ def _exec(cmd: str) -> bool:
                           stdout=DEVNULL, stderr=DEVNULL).returncode == 0
 
 
+def _get_local_ips() -> Iterator[str]:
+    """Return local IP addresses of the system"""
+
+    for adapter in ifaddr.get_adapters():
+        for ip in adapter.ips:
+            if isinstance(ip.ip, tuple):
+                addr, _, scope_id = ip.ip
+                yield f'{addr}%{scope_id}' if scope_id else addr
+            else:
+                yield ip.ip
+
+
 class ConfigParseError(ValueError):
     """Configuration parsing exception"""
 
@@ -146,7 +164,7 @@ class SSHConfig:
             else:
                 path = self._default_path
 
-            paths = list(path.glob(pattern))
+            paths = list(p for p in path.glob(pattern) if p.is_file())
 
             if not paths:
                 logger.debug1(f'Config pattern "{pattern}" matched no files')
@@ -183,6 +201,10 @@ class SSHConfig:
             elif match == 'final':
                 result = cast(bool, self._final)
             else:
+                if (match == 'localnetwork' and
+                        not _ifaddr_available): # pragma: no cover
+                    self._error('Local network match requires ifaddr module')
+
                 match_val = self._match_val(match)
 
                 if match != 'exec' and match_val is None:
@@ -201,6 +223,15 @@ class SSHConfig:
                         ip = ip_address(cast(str, match_val)) \
                             if match_val else None
                         result = host_pat.matches(None, match_val, ip)
+                    elif match == 'localnetwork':
+                        host_pat = HostPatternList(arg)
+
+                        for addr in cast(Iterator[str], match_val):
+                            if host_pat.matches(None, addr, ip_address(addr)):
+                                result = True
+                                break
+                        else:
+                            result = False
                     else:
                         wild_pat = WildcardPatternList(arg)
                         result = wild_pat.matches(match_val)
@@ -514,6 +545,8 @@ class SSHClientConfig(SSHConfig):
             return self._options.get('Hostname', self._orig_host)
         elif match == 'originalhost':
             return self._orig_host
+        elif match == 'localnetwork':
+            return _get_local_ips()
         elif match == 'localuser':
             return self._local_user
         elif match == 'user':
@@ -679,6 +712,9 @@ class SSHServerConfig(SSHConfig):
     def _set_tokens(self) -> None:
         """Set the tokens available for percent expansion"""
 
+        if self._user == '..' or '/' in self._user or '\\' in self._user:
+            raise IllegalUserName('Unsafe username substitution')
+
         self._tokens.update({'u': self._user})
 
     _handlers = {option.lower(): (option, handler) for option, handler in (