diff options
| author | Edoardo Spadolini <edoardo.spadolini@gmail.com> | 2023-12-12 13:04:53 +0000 |
|---|---|---|
| committer | Gopher Robot <gobot@golang.org> | 2023-12-14 18:23:28 +0000 |
| commit | 4e5a26183ecb4f9a0f85c8f8dbe7982885435436 (patch) | |
| tree | 592794717997b1904815161cf67d5f7c7aa7e069 /ssh/server.go | |
| parent | 152cdb1503ebc13bc0fbb68f92ee189ebf9e3d00 (diff) | |
| download | go-x-crypto-4e5a26183ecb4f9a0f85c8f8dbe7982885435436.tar.xz | |
ssh: close net.Conn on all NewServerConn errors
This PR ensures that the net.Conn passed to ssh.NewServerConn is closed
on all error return paths, not just after a failed handshake. This matches
the behavior of ssh.NewClientConn.
Change-Id: Id8a51d10ae8d575cbbe26f2ef6b37de7cca840ec
GitHub-Last-Rev: 81bb2e58a881a9a85935740bda06b034b32a8ce3
GitHub-Pull-Request: golang/crypto#279
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/549095
Run-TryBot: Nicola Murino <nicola.murino@gmail.com>
Auto-Submit: Nicola Murino <nicola.murino@gmail.com>
Reviewed-by: Roland Shoemaker <roland@golang.org>
Reviewed-by: Nicola Murino <nicola.murino@gmail.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Michael Pratt <mpratt@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Diffstat (limited to 'ssh/server.go')
| -rw-r--r-- | ssh/server.go | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/ssh/server.go b/ssh/server.go index 7f0c236..c2dfe32 100644 --- a/ssh/server.go +++ b/ssh/server.go @@ -213,6 +213,7 @@ func NewServerConn(c net.Conn, config *ServerConfig) (*ServerConn, <-chan NewCha } else { for _, algo := range fullConf.PublicKeyAuthAlgorithms { if !contains(supportedPubKeyAuthAlgos, algo) { + c.Close() return nil, nil, nil, fmt.Errorf("ssh: unsupported public key authentication algorithm %s", algo) } } @@ -220,6 +221,7 @@ func NewServerConn(c net.Conn, config *ServerConfig) (*ServerConn, <-chan NewCha // Check if the config contains any unsupported key exchanges for _, kex := range fullConf.KeyExchanges { if _, ok := serverForbiddenKexAlgos[kex]; ok { + c.Close() return nil, nil, nil, fmt.Errorf("ssh: unsupported key exchange %s for server", kex) } } |