aboutsummaryrefslogtreecommitdiff
path: root/ssh/client.go
AgeCommit message (Collapse)Author
2023-11-27ssh: wrap errors from client handshakePavel Repin
When an error is returned by a user defined host key callback, it is now possible to handle it using standard Go mechanisms such as errors.Is or errors.As. Fixes golang/go#61309 Change-Id: I4269c5f8eacd8e7e8d85070ad249f0e27777b15f GitHub-Last-Rev: d2a34d5c8225d6aaaee287ce3ea8b218fbe210d4 GitHub-Pull-Request: golang/crypto#266 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/508876 Run-TryBot: Nicola Murino <nicola.murino@gmail.com> Auto-Submit: Dmitri Shuralyov <dmitshur@golang.org> Reviewed-by: Muhammad Shulhan <m.shulhan@gmail.com> Reviewed-by: Michael Knyszek <mknyszek@google.com> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Reviewed-by: Nicola Murino <nicola.murino@gmail.com> TryBot-Result: Gopher Robot <gobot@golang.org>
2022-03-14ssh: don't advertise rsa-sha2 algorithms if we can't use themFilippo Valsorda
The server implementation looks at the HostKeys to advertise and negotiate host key signature algorithms. A fundamental issue of the Signer and AlgorithmSigner interfaces is that they don't expose the supported signature algorithms, so really the server has to guess. Currently, it would guess exclusively based on the PublicKey.Type, regardless of whether the host key implemented AlgorithmSigner. This means that a legacy Signer that only supports ssh-rsa still led the server to negotiate rsa-sha2 algorithms. The server would then fail to find a suitable host key to make the signature and crash. This won't happen if only Signers from this package are used, but if a custom Signer that doesn't support SignWithAlgorithm() but returns "ssh-rsa" from PublicKey().Type() is used as a HostKey, the server is vulnerable to DoS. The only workable rules to determine what to advertise seems to be: 1. a pure Signer will always Sign with the PublicKey.Type 2. an AlgorithmSigner supports all algorithms associated with the PublicKey.Type Rule number two means that we can't add new supported algorithms in the future, which is not great, but it's too late to fix that. rsaSigner was breaking rule number one, and although it would have been fine where it's used, I didn't want to break our own interface contract. It's unclear why we had separate test key entries for rsa-sha2 algorithms, since we can use the ssh-rsa key for those. The only test that used them, TestCertTypes, seemed broken: the init was actually failing at making the corresponding signers rsaSigners, and indeed the test for the SHA-256 signer expected and checked a SHA-512 signature. Pending CVE For golang/go#49952 Change-Id: Ie658eefcadd87906e63fc7faae8249376aa96c79 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/392355 Trust: Filippo Valsorda <filippo@golang.org> Run-TryBot: Filippo Valsorda <filippo@golang.org> Reviewed-by: Roland Shoemaker <roland@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org>
2022-03-14ssh: deprecate and replace SigAlgo constantsFilippo Valsorda
RFC 8332, Section 2 sets up two overlapping namespaces: public key formats and public key algorithms. * The formats are what we currently have KeyAlgo constants for, and they appear in PublicKey.Type. * The algorithms are the set of both KeyAlgo and SigAlgo constants, and they appear in Signature.Format (amongst other places). This is incoherent, because that means Signature.Format can be both a KeyAlgo (like KeyAlgoECDSA256) or a SigAlgo (like SigAlgoRSASHA2256). One solution would be to duplicate all the KeyAlgo constants into the SigAlgo namespace, but that would be confusing because applications are currently using KeyAlgos where they'd be supposed to use the new SigAlgos (while we can't deprecate the KeyAlgos because they are still necessary for the PublicKey.Type namespace). Instead, drop the separate namespaces, and use KeyAlgos throughout. There are simply some KeyAlgos that can't be a PublicKey.Type. Take the opportunity to fix the stuttering SHA22565/SHA2512 names. It's totally ok to call those hashes SHA-256 and SHA-512 without the family infix. For golang/go#49952 Change-Id: Ia1fce3912a7e60aa70a88f75ed311be331fd19d5 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/392354 Trust: Filippo Valsorda <filippo@golang.org> Run-TryBot: Filippo Valsorda <filippo@golang.org> Reviewed-by: Roland Shoemaker <roland@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org>
2021-11-15ssh: support RSA SHA-2 (RFC8332) signaturesHans Nielsen
This change adds support for RSA SHA-2 based signatures for host keys and certificates. It also switches the default certificate signature algorithm for RSA to use SHA-512. This is implemented by treating ssh.Signer specially when the key type is `ssh-rsa` by also allowing SHA-256 and SHA-512 signatures. Fixes golang/go#37278 Change-Id: I2ee1ac4ae4c9c1de441a2d6cf1e806357ef18910 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/220037 Trust: Jason A. Donenfeld <Jason@zx2c4.com> Run-TryBot: Jason A. Donenfeld <Jason@zx2c4.com> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Jason A. Donenfeld <Jason@zx2c4.com> Reviewed-by: Roland Shoemaker <roland@golang.org>
2021-05-06ssh: return missing user field in NewClientConnpovsister
Fix golang/go#45249 Change-Id: I27ef2976586ad481d832c6e46695a91f1bb50373 GitHub-Last-Rev: 9f631b80925719a0fb77576f7983cd7c8d0b5056 GitHub-Pull-Request: golang/crypto#180 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/304990 Reviewed-by: Emmanuel Odeke <emmanuel@orijtech.com> Reviewed-by: Katie Hockman <katie@golang.org> Trust: Emmanuel Odeke <emmanuel@orijtech.com> Trust: Katie Hockman <katie@golang.org> Run-TryBot: Emmanuel Odeke <emmanuel@orijtech.com> TryBot-Result: Go Bot <gobot@golang.org>
2018-10-29all: fix typosIgor Zhilianin
Change-Id: I62cbcfcd0be5f6a74d93b85b24ff7607533bb239 GitHub-Last-Rev: 9967869e706e9fe7d13964bb32b30a44ba640869 GitHub-Pull-Request: golang/crypto#64 Reviewed-on: https://go-review.googlesource.com/c/145240 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2018-05-14ssh: don't start goroutines handling forwarded connections until neededBrad Fitzpatrick
The extra goroutines were distracting while debugging something else, especially as I wasn't using that feature. This also saves a bit of memory. Change-Id: Ia6489e64bbd3d5a6ff699a25018676d8ff8bd2e4 Reviewed-on: https://go-review.googlesource.com/112635 Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Han-Wen Nienhuys <hanwen@google.com>
2017-11-13ssh: add support for bannersTugdual Saunier
According to RFC 4252 section 5.4, the banner is sent between the ssh-connection request and responding to user authentication. Original support for server sending banner by joshua stein <jcs@jcs.org> Fixes golang/go#19567 Change-Id: I729b3c8e5fd2c0068609d1590b61e92f40d87ea4 Reviewed-on: https://go-review.googlesource.com/71790 Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Han-Wen Nienhuys <hanwen@google.com>
2017-10-23Revert "ssh: add support for banners"Han-Wen Nienhuys
This reverts commit ed5229da99e3a6df35c756cd64b6982d19505d86. Reason for revert: missing language tag in banner message breaks auth against other implementations. Change-Id: I18ac5b3fe3b4693688b82ff4b0db02dab739c45b Reviewed-on: https://go-review.googlesource.com/72381 Reviewed-by: Han-Wen Nienhuys <hanwen@google.com> Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
2017-10-18ssh: add support for bannersTugdual Saunier
According to RFC 4252 section 5.4, the banner is sent between the ssh-connection request and responding to user authentication. Original support for server sending banner by joshua stein <jcs@jcs.org> Fixes golang/go#19567 Change-Id: I68944a7f4711c0623759f6a59023e8e45a8781aa Reviewed-on: https://go-review.googlesource.com/65271 Reviewed-by: Han-Wen Nienhuys <hanwen@google.com> Run-TryBot: Han-Wen Nienhuys <hanwen@google.com>
2017-04-10ssh: support forwarding of Unix domain socket connectionsAkihiro Suda
This commit implements OpenSSH streamlocal extension, providing the equivalent of `ssh -L local.sock:remote.sock`. Change-Id: Idd6287d5a5669c643132bba770c3b4194615e84d Reviewed-on: https://go-review.googlesource.com/38614 Reviewed-by: Han-Wen Nienhuys <hanwen@google.com> Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
2017-03-30ssh: require host key checking in the ClientConfigHan-Wen Nienhuys
This change breaks existing behavior. Before, a missing ClientConfig.HostKeyCallback would cause host key checking to be disabled. In this configuration, establishing a connection to any host just works, so today, most SSH client code in the wild does not perform any host key checks. This makes it easy to perform a MITM attack: * SSH installations that use keyboard-interactive or password authentication can be attacked with MITM, thereby stealing passwords. * Clients that use public-key authentication with agent forwarding are also vulnerable: the MITM server could allow the login to succeed, and then immediately ask the agent to authenticate the login to the real server. * Clients that use public-key authentication without agent forwarding are harder to attack unnoticedly: an attacker cannot authenticate the login to the real server, so it cannot in general present a convincing server to the victim. Now, a missing HostKeyCallback will cause the handshake to fail. This change also provides InsecureIgnoreHostKey() and FixedHostKey(key) as ready made host checkers. A simplistic parser for OpenSSH's known_hosts file is given as an example. This change does not provide a full-fledged parser, as it has complexity (wildcards, revocation, hashed addresses) that will need further consideration. When introduced, the host checking feature maintained backward compatibility at the expense of security. We have decided this is not the right tradeoff for the SSH library. Fixes golang/go#19767 Change-Id: I45fc7ba9bd1ea29c31ec23f115cdbab99913e814 Reviewed-on: https://go-review.googlesource.com/38701 Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2017-01-23ssh: soft code internal channel size for testing purposesHan-Wen Nienhuys
Change-Id: I2ee0ed4ba82d2d156a7896551dea04b28cdeceb0 Reviewed-on: https://go-review.googlesource.com/35184 Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Adam Langley <agl@golang.org>
2017-01-16ssh: rewrite (re)keying logic.Han-Wen Nienhuys
Use channels and a dedicated write loop for managing the rekeying process. This lets us collect packets to be written while a key exchange is in progress. Previously, the read loop ran the key exchange, and writers would block if a key exchange was going on. If a reader wrote back a packet while processing a read packet, it could block, stopping the read loop, thus causing a deadlock. Such coupled read/writes are inherent with handling requests that want a response (eg. keepalive, opening/closing channels etc.). The buffered channels (most channels have capacity 16) papered over these problems, but under load SSH connections would occasionally deadlock. Fixes #18439. Change-Id: I7c14ff4991fa3100a5d36025125d0cf1119c471d Reviewed-on: https://go-review.googlesource.com/35012 Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Han-Wen Nienhuys <hanwen@google.com>
2016-05-10x/crypto/ssh: hide msgNewKeys in the transport layer.Han-Wen Nienhuys
This ensures that extraneous key exchanges cannot confuse application level code. Change-Id: I1a333e2b7b46f1e484406a79db7a949294e79c6d Reviewed-on: https://go-review.googlesource.com/22417 Reviewed-by: Han-Wen Nienhuys <hanwen@google.com> Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> Reviewed-by: Adam Langley <agl@golang.org>
2016-04-12x/crypto/ssh: make sure the initial key exchange happens once.Han-Wen Nienhuys
This is done by running the key exchange and setting the session ID under mutex. If the first exchange encounters an already set session ID, then do nothing. This fixes a race condition: On setting up the connection, both sides sent a kexInit to initiate the first (mandatory) key exchange. If one side was faster, the faster side might have completed the key exchange, before the slow side had a chance to send a kexInit. The slow side would send a kexInit which would trigger a second key exchange. The resulting confirmation message (msgNewKeys) would confuse the authentication loop. This fix removes sessionID from the transport struct. This fix also deletes the unused interface rekeyingTransport. Fixes #15066 Change-Id: I7f303bce5d3214c9bdd58f52d21178a185871d90 Reviewed-on: https://go-review.googlesource.com/21606 Reviewed-by: Adam Langley <agl@golang.org> Reviewed-by: Han-Wen Nienhuys <hanwen@google.com>
2016-03-27x/crypto/ssh: Add timeout for dialingJulian Kornberger
Fixes golang/go#14941 Change-Id: I2b3a976d451d311519fab6cdabdc98a4a4752e31 Reviewed-on: https://go-review.googlesource.com/21136 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2015-08-04crypto/ssh: allow client to specify host key algorithms.hanwen
Fixes golang/go#11722. Change-Id: I4fa2a1db14050151f9269427ca35cf7ebd21440a Reviewed-on: https://go-review.googlesource.com/12907 Reviewed-by: Adam Langley <agl@golang.org>
2015-02-04ssh: return session ID in ConnMeta.SessionID.Han-Wen Nienhuys
SessionID() returned nil previously. Fixes #9761. Change-Id: I53d2b347571d21eab2d913c2228e85997a84f757 Reviewed-on: https://go-review.googlesource.com/3872 Reviewed-by: Adam Langley <agl@golang.org>
2015-01-06ssh: add ServerConfig.ServerVersion optionKristopher Watts
The SSH server does not allow for setting a version string in the same manner as the client. This update adds a ServerVersion member to the ServerConfig structure which when set, causes the server to use that member instead of the default version string. This allows building an golang based SSH server which can present any version string the user wishes. It also adds an else statement to the client assignment of the ClientVersion to avoid an allocation when using a user defined ClientVersion. Change-Id: I43d97cfd5a174f2c68f53c5b4e267539ef21937b Reviewed-on: https://go-review.googlesource.com/1860 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2014-09-16go.crypto/ssh: clean up address parsing in forward code.Han-Wen Nienhuys
LGTM=agl R=agl, dave, jpsugar CC=golang-codereviews https://golang.org/cl/134700043
2014-04-09go.crypto/ssh: import gosshnew.Adam Langley
See https://groups.google.com/d/msg/Golang-nuts/AoVxQ4bB5XQ/i8kpMxdbVlEJ R=hanwen CC=golang-codereviews https://golang.org/cl/86190043
2013-11-01go.crypto/ssh: Increase window size.Jakob Borg
Increase window size for channels (session and tcpip) to 64 * max packet size (32 KB), which is the same value that OpenSSH uses. Also breaks out the relevant harcoded constants into named constants in channel.go. Fixes golang/go#6675. R=golang-dev, dave, hanwen, agl CC=golang-dev https://golang.org/cl/18120043
2013-10-25go.crypto/ssh: in {Server,Client}Conn, read session ID fromHan-Wen Nienhuys
transport layer. R=agl, dave CC=golang-dev https://golang.org/cl/15870044
2013-10-25go.crypto/ssh: ensure {Server,Client}Conn do not expose io.ReadWriterDave Cheney
Transport should not be a ReadWriter. It can only write packets, i.e. no partial reads or writes. Furthermore, you can currently do ClientConn.Write() while the connection is live, which sends raw bytes over the connection. Doing so will confuse the transports because the data is not encrypted. As a consequence, ClientConn and ServerConn stop being a net.Conn Finally, ensure that {Server,Client}Conn implement LocalAddr and RemoteAddr methods that previously were exposed by an embedded net.Conn field. R=hanwen CC=golang-dev https://golang.org/cl/16610043
2013-10-17go.crypto/ssh: put version exchange in functionHan-Wen Nienhuys
R=golang-dev, dave, jpsugar, agl CC=golang-dev https://golang.org/cl/14641044
2013-10-10go.crypto/ssh: cosmetic only spelling fixesJonathan Pittman
R=agl, hanwen CC=dave, golang-dev, jpsugar https://golang.org/cl/14430055
2013-10-08go.crypto/ssh: move interpretation of msgNewKeys intoHan-Wen Nienhuys
transport. Sending the msgNewKeys packet and setting up the key material now happen under a lock, preventing races with concurrent writers. R=kardianos, agl, jpsugar, hanwenn CC=golang-dev https://golang.org/cl/14476043
2013-09-24go.crypto/ssh: separate kex algorithms into kexAlgorithm class.Han-Wen Nienhuys
Adds readPacket() to conn, and renames conn to packetConn. Key exchanges operate on packetConn, so they can be unittested. R=agl, jpsugar, dave CC=golang-dev https://golang.org/cl/13352055
2013-09-13go.crypto/ssh: introduce PublicKey interface type.Han-Wen Nienhuys
Public functions affected: -AgentKey.Key -AgentClient.SignRequest -ClientKeyring.Key -MarshalPublicKey -ParsePublicKey R=agl, jpsugar, jmpittman CC=golang-dev https://golang.org/cl/13642043
2013-09-09go.crypto/ssh: Begin adding server side support for more than RSA for client ↵Jonathan Pittman
key auth R=agl, dave, hanwen CC=ekg, golang-dev https://golang.org/cl/13528044
2013-08-28go.crypto/ssh: implement ECDH.Han-Wen Nienhuys
Implement elliptic-curve Diffie-Hellman, including host key signature verification. Moves host key cryptographic verification to ClientConn.handshake(), so RSA host keys are also verified. Fixes golang/go#6158. R=dave, agl CC=golang-dev https://golang.org/cl/13021045
2013-08-27crypto/ssh: Allow customization of the client version.JP Sugarbroad
R=agl, golang-dev, dave CC=golang-dev https://golang.org/cl/13176044
2013-07-26go.crypto/ssh: add workaround for broken port forwarding inHan-Wen Nienhuys
OpenSSH 5. Tested with OpenSSH_5.9 R=agl, dave CC=golang-dev https://golang.org/cl/11921043
2013-07-22go.crypto/ssh: close channel feeding tcpListener.Han-Wen Nienhuys
Close both on closing the listener, and on closing the connection. Test the former case. R=dave CC=golang-dev https://golang.org/cl/11349043
2013-06-21go.crypto/ssh: add hook for host key checking.Han-Wen Nienhuys
R=dave, agl CC=gobot, golang-dev https://golang.org/cl/9922043
2013-06-11go.crypto/ssh: fix and test port forwarding.Han-Wen Nienhuys
Set maxPacket in forwarded connection, and use the requested port number as key in forwardList. R=golang-dev, agl, dave CC=golang-dev https://golang.org/cl/9753044
2013-06-06go.crypto/ssh: add a error return to decode(), and avoid casting decode() ↵Han-Wen Nienhuys
output. R=dave, kardianos, agl CC=gobot, golang-dev https://golang.org/cl/9738053
2013-04-26go.crypto/ssh: More error reporting improvements.David Symonds
R=golang-dev, kardianos, dave CC=golang-dev https://golang.org/cl/8596047
2012-12-18go.crypto/ssh: support OpenSSH keepalivesEric Milliken
Fixes golang/go#4552. R=minux.ma, agl CC=golang-dev https://golang.org/cl/6948059
2012-12-10go.crypto/ssh: run gofmtAdam Langley
gofmt got better at removing trailing whitespace. R=golang-dev, rsc CC=golang-dev https://golang.org/cl/6929044
2012-10-09go.crypto: various: fix appengine compatibilityDave Cheney
Fixes golang/go#4102. R=russross, minux.ma, rsc, agl CC=golang-dev https://golang.org/cl/6623053
2012-09-05go.crypto/ssh: assorted close related fixesDave Cheney
Fixes golang/go#3810. Fixes chanWriter Write after close behaviour bug. Fixes serverChan writePacket after close bug. Addresses final comments by agl on 6405064, plus various cleanups. R=agl, kardianos, gustav.paul, fullung CC=golang-dev https://golang.org/cl/6479056
2012-08-24go.crypto/ssh: prevent channel writes after CloseDave Cheney
Fixes golang/go#3810. This change introduces an atomic boolean to guard the close of the clientChan. Previously the client code was quite lax with the ordering of the close messages and could allow window adjustment or EOF messages to leak after Close had been signaled. Consolidating the changes to the serverChan will be handled in a following CL. R=agl, kardianos, gustav.paul CC=golang-dev https://golang.org/cl/6405064
2012-08-11go.crypto/ssh: cosmetic: move remaining channel code into channel.goDave Cheney
This CL scratches an itch by moving the remaining channel related code into channel.go. R=agl CC=golang-dev https://golang.org/cl/6454126
2012-08-09go.crypto/ssh: never send more data than maxpacketDave Cheney
RFC 4254 s5.2 is clear that a client must never send a data packet larger than the value of maximum packet supplied by the remote side during channel setup. The client was not honoring this value, in fact it wasn't even recording it. Thanks to Albert Strasheim for the bug report. R=agl, fullung CC=golang-dev https://golang.org/cl/6448128
2012-07-20go.crypto/ssh: use binary.BigEndian throughoutDave Cheney
A small cleanup. R=agl, gustav.paul CC=golang-dev https://golang.org/cl/6406043
2012-07-17go.crypto/ssh: avoid recover() when handling invalid channel idsDave Cheney
This proposal removes the use of recover() to catch invalid channel ids sent from the remote side. The recover() unfortuntaly makes debugging harder as it obscures other panic causes. Another source of panic()s exists inside marshal.go, which will be handled with in a later CL. R=agl, gustav.paul CC=golang-dev https://golang.org/cl/6404046
2012-05-16go.crypto/ssh: introduce a circular buffer for chanReaderDave Cheney
R=agl, gustav.paul, kardianos CC=golang-dev https://golang.org/cl/6207051
2012-05-11go.crypto/ssh: make {client,server}Chan use common window managementDave Cheney
R=agl, gustav.paul, kardianos CC=golang-dev https://golang.org/cl/6208043
generated by cgit v1.3 (git 2.53.0) at 2026-04-15 05:06:25 +0000