Fix for Net::SSH Continues to attempt authentication when notified it is not allowed

6 files changed, 30 insertions, 7 deletions

diff --git a/lib/net/ssh/authentication/key_manager.rb b/lib/net/ssh/authentication/key_manager.rb
index c96e18c..7a0692f 100644
--- a/lib/net/ssh/authentication/key_manager.rb
+++ b/lib/net/ssh/authentication/key_manager.rb
@@ -135,7 +135,7 @@ module Net
           if info[:key].nil? && info[:from] == :file
             begin
               info[:key] = KeyFactory.load_private_key(info[:file], options[:passphrase])
-            rescue Exception => e 
+            rescue Exception, OpenSSL::OpenSSLError => e 
               raise KeyManagerError, "the given identity is known, but the private key could not be loaded: #{e.class} (#{e.message})"
             end
           end
diff --git a/lib/net/ssh/authentication/methods/hostbased.rb b/lib/net/ssh/authentication/methods/hostbased.rb
index 43c3eac..610b64e 100644
--- a/lib/net/ssh/authentication/methods/hostbased.rb
+++ b/lib/net/ssh/authentication/methods/hostbased.rb
@@ -51,6 +51,10 @@ module Net
                   return true
                 when USERAUTH_FAILURE
                   info { "hostbased failed (#{identity.fingerprint})" }
+
+                  raise Net::SSH::Authentication::DisallowedMethod unless
+                    message[:authentications].split(/,/).include? 'hostbased'
+
                   return false
                 else
                   raise Net::SSH::Exception, "unexpected server response to USERAUTH_REQUEST: #{message.type} (#{message.inspect})"
diff --git a/lib/net/ssh/authentication/methods/keyboard_interactive.rb b/lib/net/ssh/authentication/methods/keyboard_interactive.rb
index 1ab2459..bf17e4d 100644
--- a/lib/net/ssh/authentication/methods/keyboard_interactive.rb
+++ b/lib/net/ssh/authentication/methods/keyboard_interactive.rb
@@ -27,6 +27,10 @@ module Net
                 return true
               when USERAUTH_FAILURE
                 debug { "keyboard-interactive failed" }
+
+                raise Net::SSH::Authentication::DisallowedMethod unless
+                  message[:authentications].split(/,/).include? 'keyboard-interactive'
+
                 return false
               when USERAUTH_INFO_REQUEST
                 name = message.read_string
diff --git a/lib/net/ssh/authentication/methods/password.rb b/lib/net/ssh/authentication/methods/password.rb
index 9b1c095..ad1eed7 100644
--- a/lib/net/ssh/authentication/methods/password.rb
+++ b/lib/net/ssh/authentication/methods/password.rb
@@ -23,6 +23,10 @@ module Net
                 return true
               when USERAUTH_FAILURE
                 debug { "password failed" }
+
+                raise Net::SSH::Authentication::DisallowedMethod unless
+                  message[:authentications].split(/,/).include? 'password'
+
                 return false
               when USERAUTH_PASSWD_CHANGEREQ
                 debug { "password change request received, failing" }
diff --git a/lib/net/ssh/authentication/methods/publickey.rb b/lib/net/ssh/authentication/methods/publickey.rb
index b453def..d06af5c 100644
--- a/lib/net/ssh/authentication/methods/publickey.rb
+++ b/lib/net/ssh/authentication/methods/publickey.rb
@@ -70,6 +70,10 @@ module Net
                       return true
                     when USERAUTH_FAILURE
                       debug { "publickey failed (#{identity.fingerprint})" }
+
+                      raise Net::SSH::Authentication::DisallowedMethod unless
+                        message[:authentications].split(/,/).include? 'publickey'
+
                       return false
                     else
                       raise Net::SSH::Exception,
diff --git a/lib/net/ssh/authentication/session.rb b/lib/net/ssh/authentication/session.rb
index 8e7d3df..180ae46 100644
--- a/lib/net/ssh/authentication/session.rb
+++ b/lib/net/ssh/authentication/session.rb
@@ -9,6 +9,10 @@ require 'net/ssh/authentication/methods/keyboard_interactive'
 
 module Net; module SSH; module Authentication
 
+  # Raised if the current authentication method is not allowed
+  class DisallowedMethod < Net::SSH::Exception
+  end
+
   # Represents an authentication session. It manages the authentication of
   # a user over an established connection (the "transport" object, see
   # Net::SSH::Transport::Session).
@@ -59,13 +63,16 @@ module Net; module SSH; module Authentication
       attempted = []
 
       @auth_methods.each do |name|
-        next unless @allowed_auth_methods.include?(name)
-        attempted << name
+        begin
+          next unless @allowed_auth_methods.include?(name)
+          attempted << name
 
-        debug { "trying #{name}" }
-        method = Methods.const_get(name.split(/\W+/).map { |p| p.capitalize }.join).new(self, :key_manager => key_manager)
+          debug { "trying #{name}" }
+          method = Methods.const_get(name.split(/\W+/).map { |p| p.capitalize }.join).new(self, :key_manager => key_manager)
 
-        return true if method.authenticate(next_service, username, password)
+          return true if method.authenticate(next_service, username, password)
+        rescue Net::SSH::Authentication::DisallowedMethod
+        end
       end
 
       error { "all authorization methods failed (tried #{attempted.join(', ')})" }
@@ -131,4 +138,4 @@ module Net; module SSH; module Authentication
         Array(options[:key_data])
       end
   end
-end; end; end
\ No newline at end of file
+end; end; end