aboutsummaryrefslogtreecommitdiff
path: root/ssh/client_auth_test.go
AgeCommit message (Collapse)Author
2023-07-10ssh: fix RSA certificate and public key authentication with older clientsNicola Murino
After adding support for rsa-sha2-256/512 on the server side some edge cases started to arise with old clients: 1) public key authentication with gpg-agent < 2.2.6 fails because we receive ssh-rsa as signature format and rsa-sha2-256 or rsa-sha2-512 as algorithm. This is a bug in gpg-agent fixed in this commit: https://github.com/gpg/gnupg/commit/80b775bdbb852aa4a80292c9357e5b1876110c00 2) certificate authentication fails with OpenSSH 7.2-7.7 because we receive ssh-rsa-cert-v01@openssh.com as algorithm and rsa-sha2-256 or rsa-sha2-512 as signature format. This patch is based on CL 412854 and has been tested with every version of OpenSSH from 7.1 to 7.9 and OpenSSH 9.3. Fixes golang/go#53391 Change-Id: Id71f596f73d84efb5c76d6d5388432cccad3e3b1 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/506835 Auto-Submit: Filippo Valsorda <filippo@golang.org> Reviewed-by: Filippo Valsorda <filippo@golang.org> Run-TryBot: Filippo Valsorda <filippo@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Roland Shoemaker <roland@golang.org>
2022-11-12ssh: support rsa-sha2-256/512 on the server sideFilippo Valsorda
This lets clients know we support rsa-sha2-256/512 signatures from ssh-rsa public keys. OpenSSH prefers to break the connection rather than attempting trial and error, apparently. We don't enable support for the "ext-info-s" because we're not interested in any client->server extensions. This also replaces isAcceptableAlgo which was rejecting the rsa-sha2-256/512-cert-v01@openssh.com public key algorithms. Tested with OpenSSH 9.1 on macOS Ventura. Fixes golang/go#49269 Updates golang/go#49952 Co-authored-by: Nicola Murino <nicola.murino@gmail.com> Co-authored-by: Kristin Davidson <kdavidson@atlassian.com> Change-Id: I4955c3b12bb45575e9977ac657bb5805b49d00c3 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/447757 Run-TryBot: Filippo Valsorda <filippo@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Roland Shoemaker <roland@golang.org> Reviewed-by: Nicola Murino <nicola.murino@gmail.com> Reviewed-by: Michael Knyszek <mknyszek@google.com>
2022-03-14ssh: support rsa-sha2-256/512 for client authenticationFilippo Valsorda
CL 220037 had implemented support for host authentication using rsa-sha2-256/512, but not client public key authentication. OpenSSH disabled the SHA-1 based ssh-rsa by default in version 8.8 (after pre-announcing it in versions 8.2, 8.3, 8.4, 8.5, 8.6, and 8.7) although some distributions re-enable it. GitHub will start rejecting ssh-rsa for keys uploaded before November 2, 2021 on March 15, 2022. https://github.blog/2021-09-01-improving-git-protocol-security-github/ The server side already worked, as long as the client selected one of the SHA-2 algorithms, because the signature flowed freely to Verify. There was however nothing verifying that the signature algorithm matched the advertised one. The comment suggested the check was being performed, but it got lost back in CL 86190043. Not a security issue because the signature had to pass the callback's Verify method regardless, and both values were checked to be acceptable. Tested with OpenSSH 8.8 configured with "PubkeyAcceptedKeyTypes -ssh-rsa" and no application-side changes. The Signers returned by ssh/agent (when backed by an agent client) didn't actually implement AlgorithmSigner but ParameterizedSigner, an interface defined in an earlier version of CL 123955. Updates golang/go#49269 Fixes golang/go#39885 For golang/go#49952 Change-Id: I13b41db8041f1112a70f106c55f077b904b12cb8 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/392394 Trust: Filippo Valsorda <filippo@golang.org> Run-TryBot: Filippo Valsorda <filippo@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Roland Shoemaker <roland@golang.org>
2022-02-09ssh: accept WSAECONNABORTED in TestClientAuthMaxAuthTriesPublicKeyIan Lance Taylor
Fixes golang/go#50805 Change-Id: Icdd2835b1626240faf61936288f279570c873158 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/381614 Trust: Ian Lance Taylor <iant@golang.org> Run-TryBot: Ian Lance Taylor <iant@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Roland Shoemaker <roland@golang.org>
2019-06-17ssh: add diffie-hellman-group-exchange-sha256Lucas Bremgartner
Add the diffie-hellman-group-exchange-sha256 defined in RFC 4419 to the list of supported key exchange algorithms for ssh. The server half is only a minimal implementation to satisfy the automated tests. Fixes golang/go#17230 Change-Id: I25880a564347fd9b4738dd2ed1e347cd5d2e21bb GitHub-Last-Rev: 9f0b8d02c0c96e9baf00cdf1cf063ff834245443 GitHub-Pull-Request: golang/crypto#87 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/174257 Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Han-Wen Nienhuys <hanwen@google.com>
2019-05-10ssh/gss: support kerberos authentication for ssh server and clientyanweizhi
Change-Id: I20e3356476dc50402dd34d2b39ad030c1e63a9ef Reviewed-on: https://go-review.googlesource.com/c/crypto/+/170919 Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Han-Wen Nienhuys <hanwen@google.com>
2019-04-11ssh: remove testing.T from ExampleRetryableAuthMethodHan-Wen Nienhuys
Change-Id: I9cb821827b16d60b0a8c4fff9caec78748f3a495 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/171677 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2018-11-06ssh: return specific error for invalid signature algorithmHan-Wen Nienhuys
Previously, this would return the default error "no auth passed yet". Not only is the new error more specific, it makes it easier to verify the control flow of server authentication code. Change-Id: I6c8de4e3f91da74274acbe9d87ec4f6158b4a94f Reviewed-on: https://go-review.googlesource.com/c/142897 Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2018-02-26ssh: fix error variable naming convention, add docsBrad Fitzpatrick
Follow up to CL 96336 Change-Id: I038f3901919c5136273e5df051bc6e958082f830 Reviewed-on: https://go-review.googlesource.com/96415 Reviewed-by: Han-Wen Nienhuys <hanwen@google.com> Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
2018-02-22ssh: use a variable rather than type for NoAuthErrorHan-Wen Nienhuys
Change-Id: Ib61e0bc7d953cefde0436f77fe6a610201043c85 Reviewed-on: https://go-review.googlesource.com/96336 Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Spencer Tung <spencertung@google.com> Reviewed-by: Han-Wen Nienhuys <hanwen@google.com>
2018-02-19Adding a unique error when no authentication method has been passed inSpencer Tung
yet. Since ServerAuthError returns all errors collected during the userAuthLoop, it will always include the generic error "no auth passed yet" (assuming the connection fails). Change-Id: I5f6c67f3f0762b023618178d4028600d2b6c9253 Reviewed-on: https://go-review.googlesource.com/92737 Reviewed-by: Han-Wen Nienhuys <hanwen@google.com> Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
2017-07-10ssh: fix a formatting bug in a testSpencer Tung
Change-Id: I34cc1a5a8c59c5e4c0313d7a41c3f31cdbad9e98 Reviewed-on: https://go-review.googlesource.com/47933 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2017-07-06ssh: fix if/else returns to adhere to Go style guidelinesSpencer Tung
Change-Id: Iea55e6397c49046d7d3e0eb66a392f1779d91802 Reviewed-on: https://go-review.googlesource.com/47050 Reviewed-by: Han-Wen Nienhuys <hanwen@google.com> Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
2017-07-03ssh: return authErr array if all authentication attempts failSpencer Tung
Change-Id: I4d6cab266410a8c7960073665eddf8935693087f Reviewed-on: https://go-review.googlesource.com/44332 Reviewed-by: Han-Wen Nienhuys <hanwen@google.com> Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
2017-05-02ssh/knownhosts: add IsHostAuthority.Peter Moody
This is a breaking change. This adds a new hostkey callback which takes the hostname field restrictions into account when validating host certificates. Prior to this, a known_hosts file with the following entry @cert-authority *.example.com ssh-rsa <example.com public key> would, when passed to knownhosts.New() generate an ssh.HostKeyCallback that would accept all host certificates signed by the example.com public key, no matter what host the client was connecting to. After this change, that known_hosts entry can only be used to validate host certificates presented when connecting to hosts under *.example.com This also renames IsAuthority to IsUserAuthority to make its intended purpose more clear. Change-Id: I7188a53fdd40a8c0bc21983105317b3498f567bb Reviewed-on: https://go-review.googlesource.com/41751 Reviewed-by: Han-Wen Nienhuys <hanwen@google.com> Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
2017-04-10ssh: support MaxAuthTries on ServerConfigJames Myers
This change breaks backwards compatibility. MaxAuthTries specifies the maximum number of authentication attempts permitted per connection. If set to a negative number, the server will allow unlimited authentication attempts. MaxAuthTries defaults to 6 if not specified, which is a backwards incompatible change. On exceeding maximum authentication attempts, the server will send a disconnect message to the client. This configuration property mirrors a similar property in sshd_config and prevents bad actors from continuously trying authentication. Change-Id: Ic77d2c29ee2fd2ae5c764becf7df91d29d03131b Reviewed-on: https://go-review.googlesource.com/35230 Reviewed-by: Han-Wen Nienhuys <hanwen@google.com> Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
2017-03-30ssh: require host key checking in the ClientConfigHan-Wen Nienhuys
This change breaks existing behavior. Before, a missing ClientConfig.HostKeyCallback would cause host key checking to be disabled. In this configuration, establishing a connection to any host just works, so today, most SSH client code in the wild does not perform any host key checks. This makes it easy to perform a MITM attack: * SSH installations that use keyboard-interactive or password authentication can be attacked with MITM, thereby stealing passwords. * Clients that use public-key authentication with agent forwarding are also vulnerable: the MITM server could allow the login to succeed, and then immediately ask the agent to authenticate the login to the real server. * Clients that use public-key authentication without agent forwarding are harder to attack unnoticedly: an attacker cannot authenticate the login to the real server, so it cannot in general present a convincing server to the victim. Now, a missing HostKeyCallback will cause the handshake to fail. This change also provides InsecureIgnoreHostKey() and FixedHostKey(key) as ready made host checkers. A simplistic parser for OpenSSH's known_hosts file is given as an example. This change does not provide a full-fledged parser, as it has complexity (wildcards, revocation, hashed addresses) that will need further consideration. When introduced, the host checking feature maintained backward compatibility at the expense of security. We have decided this is not the right tradeoff for the SSH library. Fixes golang/go#19767 Change-Id: I45fc7ba9bd1ea29c31ec23f115cdbab99913e814 Reviewed-on: https://go-review.googlesource.com/38701 Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2017-02-02ssh: Support multiple source-addresses, don't require IPv4 in tests.Heschi Kreinick
The ssh tests currently require 127.0.0.1 to work which isn't necessarily available everywhere. To fix the source-address tests, support comma-separated source-address values per the PROTOCOL.certkeys file: Comma-separated list of source addresses from which this certificate is accepted for authentication. Addresses are specified in CIDR format (nn.nn.nn.nn/nn or hhhh::hhhh/nn). If this option is not present then certificates may be presented from any source address. Change-Id: I87536ff81ffa005c073da103021ebc0dfb12b620 Reviewed-on: https://go-review.googlesource.com/36110 Reviewed-by: Han-Wen Nienhuys <hanwen@google.com> Run-TryBot: Heschi Kreinick <heschi@google.com>
2017-01-13ssh: make client auth tests less chatty.Han-Wen Nienhuys
Change-Id: Ib35ce0e7437e32a3fa24a9330c479306b7fa6880 Reviewed-on: https://go-review.googlesource.com/35011 Reviewed-by: Adam Langley <agl@golang.org>
2016-09-29x/crypto/ssh: ParsePrivateKey errors out with encrypted private keysEmmanuel Odeke
RSA and DSA keys if encrypted have the phrase ENCRYPTED in their Proc-Type block header according to RFC 1421 Section 4.6.1.1. This CL checks for that phrase and errors out if we encounter it, since we don't yet have decryption of encrypted private keys. Fixes golang/go#6650 Change-Id: I5b157716a2f93557d289af5f62994234a2e7a0ed Reviewed-on: https://go-review.googlesource.com/29676 Reviewed-by: Han-Wen Nienhuys <hanwen@google.com> Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
2016-08-24crypto/ssh: keep user in ConnMetadata if NoClientAuth is usedSven Blumenstein
The current behaviour of the crypto/ssh server implementation is to remove the username from ConnMetadata if the connection is done without authentication (NoClientAuth). This appears to be a bug. This behaviour is different from other SSH server implementations like for example Paramiko (Python) which keeps the username. Additionally RFC4252 (https://www.ietf.org/rfc/rfc4252.txt) section 5 states the username has to be included in every USERAUTH message. Change-Id: I27fa50db92eb535e90fe088453faa6f2a76ee31f Reviewed-on: https://go-review.googlesource.com/27612 Reviewed-by: Han-Wen Nienhuys <hanwen@google.com> Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
2016-07-17ssh: disable known-flaky test from the Go build dashboardBrad Fitzpatrick
This failure is tracked already. Remove it from the dashboard while it's fixed so it doesn't hide more interesting failures. Updates golang/go#15198 Change-Id: Ib48d1e37ac97914ac082b2602c812151147393e4 Reviewed-on: https://go-review.googlesource.com/24986 Reviewed-by: Ian Lance Taylor <iant@golang.org>
2016-07-06x/crypto: fix typosMartin Hamrle
The typos were found by misspell tool. Change-Id: I120740f12f7ba48330749ebf84050a7b98e01016 Reviewed-on: https://go-review.googlesource.com/24725 Reviewed-by: Ian Lance Taylor <iant@golang.org> Run-TryBot: Ian Lance Taylor <iant@golang.org>
2016-07-04x/crypto/ssh: Add support for retryable authenticationJamie Beverly
Adds a new AuthMethod called "RetryableAuthMethod" which decorates any other authmethod, allowing it to be retried up to maxTries before aborting. Fixes #16077 Change-Id: Ie310c24643e53dca4fa452750a69936674906484 Reviewed-on: https://go-review.googlesource.com/24156 Reviewed-by: Han-Wen Nienhuys <hanwen@google.com> Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
2015-08-29crypto/ssh: clearer error messages when "no ciphers in common"Thomas Desrosiers
The error message reported by the ssh client when it can't find a "cipher" in common between the client and server was overly vague. This adds more detailed error messages to findAgreedAlgorithms so that the user can more easily identify which of the components can't reach agreement. Change-Id: I4d985e92fea964793213e5600b52b3141e712000 Reviewed-on: https://go-review.googlesource.com/13817 Reviewed-by: Adam Langley <agl@golang.org>
2014-05-12go.crypto/ssh: use permissions from public key cache when accepting a key.Adam Langley
Fixes golang/go#7913. LGTM=hanwen R=hanwen CC=golang-codereviews https://golang.org/cl/96220043
2014-05-12go.crypto/ssh: try authentication methods in ClientConfig order.Han-Wen Nienhuys
LGTM=jpsugar, agl R=agl, jpsugar CC=golang-codereviews https://golang.org/cl/92240045
2014-04-09go.crypto/ssh: import gosshnew.Adam Langley
See https://groups.google.com/d/msg/Golang-nuts/AoVxQ4bB5XQ/i8kpMxdbVlEJ R=hanwen CC=golang-codereviews https://golang.org/cl/86190043
2013-10-24go.crypto/ssh: only close connection if it was open in TestClientUnsupportedKex.Han-Wen Nienhuys
R=dave CC=golang-dev https://golang.org/cl/15450046
2013-09-19go.crypto/ssh: introduce Signer method, an abstraction ofHan-Wen Nienhuys
private keys. R=agl, jpsugar, jonathan.mark.pittman CC=golang-dev https://golang.org/cl/13338044
2013-09-13go.crypto/ssh: introduce PublicKey interface type.Han-Wen Nienhuys
Public functions affected: -AgentKey.Key -AgentClient.SignRequest -ClientKeyring.Key -MarshalPublicKey -ParsePublicKey R=agl, jpsugar, jmpittman CC=golang-dev https://golang.org/cl/13642043
2013-09-09go.crypto/ssh: Begin adding server side support for more than RSA for client ↵Jonathan Pittman
key auth R=agl, dave, hanwen CC=ekg, golang-dev https://golang.org/cl/13528044
2013-09-05go.crypto/ssh: remove misleading marshalPrivRSA.Han-Wen Nienhuys
Properly capitalize publicKey throughout. R=golang-dev CC=agl, dave, golang-dev, jpsugar https://golang.org/cl/13415046
2013-08-28go.crypto/ssh: implement ECDH.Han-Wen Nienhuys
Implement elliptic-curve Diffie-Hellman, including host key signature verification. Moves host key cryptographic verification to ClientConn.handshake(), so RSA host keys are also verified. Fixes golang/go#6158. R=dave, agl CC=golang-dev https://golang.org/cl/13021045
2013-06-06go.crypto/ssh: implement keyboard-interactive auth (RFC 4256), bothHan-Wen Nienhuys
on client and server-side. R=dave, agl CC=gobot, golang-dev https://golang.org/cl/9853050
2012-12-10go.crypto/ssh: run gofmtAdam Langley
gofmt got better at removing trailing whitespace. R=golang-dev, rsc CC=golang-dev https://golang.org/cl/6929044
2012-10-30go.crypto/ssh: never negotiate unsupported ciphersDave Cheney
Fixes golang/go#4285. Adding a new cipher that is supported by the remote end, but not supported by our client causes that cipher to be considered a valid candidate. This fails later in setupKeys when there is no cipherModes configuration. In summary, unsupported ciphers cannot be willed into existence by adding them to the client config. This change enforces this. R=golang-dev, agl CC=golang-dev https://golang.org/cl/6780047
2012-08-18go.crypto/ssh: fix misplaced deferDave Cheney
Fixes golang/go#3972. R=golang-dev, agl, r CC=golang-dev https://golang.org/cl/6448166
2012-04-20ssh: cosmetic cleanupsAdam Langley
These are the cosmetic cleanups from the bits of code that I rereviewed. 1) stringLength now takes a int; the length of the string. Too many callers were allocating with stringLength([]byte(s)) and stringLength only needs to call len(). 2) agent.go now has sendAndReceive to remove logic that was duplicated. 3) We now reject negative DH values 4) We now reject empty packets rather than crashing. R=dave, jonathan.mark.pittman CC=golang-dev https://golang.org/cl/6061052
2012-03-27go.crypto/ssh: fix example in documentationFazlul Shahriar
R=golang-dev, dave CC=golang-dev https://golang.org/cl/5905048
2012-02-27go.crypto/ssh: improve support for MAC algorithmsDave Cheney
Also, add support for hmac-sha1. At the suggestion of AGL hmac-md5, and hmac-md5-96 support was not included. Fixes golang/go#3095. R=golang-dev, agl, huin CC=golang-dev https://golang.org/cl/5696065
2012-02-23ssh: use *rsa.PublicKey or *dsa.PublicKey in interfaces.Adam Langley
Everywhere else in the code base, when we have an interface{} which is a stand in for a public key, we use *foo.PublicKey rather than foo.PublicKey. This change makes ssh reflect that. R=dave, r CC=golang-dev https://golang.org/cl/5686067
2012-01-30go.crypto/ssh: add User to ServerConn and pass *ServerConn to callbacks.Daniel Theophanes
R=golang-dev, dave, agl CC=golang-dev https://golang.org/cl/5577070
2012-01-25go.crypto: initial codeRuss Cox
Manual edits to README. Moved from main Go repository, deleted Makefiles, ran gofix -r go1rename. Tested with: go test code.google.com/p/go.crypto/... R=golang-dev, bradfitz CC=golang-dev https://golang.org/cl/5564059
generated by cgit v1.3 (git 2.53.0) at 2026-04-15 08:50:54 +0000