aboutsummaryrefslogtreecommitdiff
path: root/ssh/handshake.go
AgeCommit message (Collapse)Author
2025-09-15ssh: remove custom contains, use slices.ContainsNicola Murino
Change-Id: If4784469e7285675bdd51399a76bdc16f0036a2e Reviewed-on: https://go-review.googlesource.com/c/crypto/+/703635 Reviewed-by: Mark Freeman <markfreeman@google.com> Reviewed-by: Sean Liao <sean@liao.dev> Reviewed-by: Michael Knyszek <mknyszek@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2025-05-15ssh: expose negotiated algorithmsNicola Murino
Fixes golang/go#58523 Fixes golang/go#46638 Change-Id: Ic64bd2fdd6e9ec96acac3ed4be842e2fbb15231d Reviewed-on: https://go-review.googlesource.com/c/crypto/+/538235 Reviewed-by: Filippo Valsorda <filippo@golang.org> Auto-Submit: Nicola Murino <nicola.murino@gmail.com> Reviewed-by: Michael Knyszek <mknyszek@google.com> Reviewed-by: Cherry Mui <cherryyz@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2025-05-15ssh: export supported algorithmsNicola Murino
Fixes golang/go#61537 Change-Id: If3478121e3ae445391e3faeceeb889d75e9e3214 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/531935 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Nicola Murino <nicola.murino@gmail.com> Reviewed-by: Cherry Mui <cherryyz@google.com> Reviewed-by: Michael Knyszek <mknyszek@google.com> Reviewed-by: Filippo Valsorda <filippo@golang.org>
2025-04-03ssh: use the configured rand in kex initNicola Murino
Change-Id: I4f89c395886b9dd07b584d1fcf1a0f2df215b91b Reviewed-on: https://go-review.googlesource.com/c/crypto/+/644435 Reviewed-by: Filippo Valsorda <filippo@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Carlos Amedee <carlos@golang.org> Reviewed-by: Carlos Amedee <carlos@golang.org>
2025-02-24ssh: limit the size of the internal packet queue while waiting for KEXv0.35.0Nicola Murino
In the SSH protocol, clients and servers execute the key exchange to generate one-time session keys used for encryption and authentication. The key exchange is performed initially after the connection is established and then periodically after a configurable amount of data. While a key exchange is in progress, we add the received packets to an internal queue until we receive SSH_MSG_KEXINIT from the other side. This can result in high memory usage if the other party is slow to respond to the SSH_MSG_KEXINIT packet, or memory exhaustion if a malicious client never responds to an SSH_MSG_KEXINIT packet during a large file transfer. We now limit the internal queue to 64 packets: this means 2MB with the typical 32KB packet size. When the internal queue is full we block further writes until the pending key exchange is completed or there is a read or write error. Thanks to Yuichi Watanabe for reporting this issue. Change-Id: I1ce2214cc16e08b838d4bc346c74c72addafaeec Reviewed-on: https://go-review.googlesource.com/c/crypto/+/652135 Reviewed-by: Neal Patel <nealpatel@google.com> Auto-Submit: Gopher Robot <gobot@golang.org> Reviewed-by: Roland Shoemaker <roland@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2025-01-18ssh: add ServerConfig.PreAuthConnCallback, ServerPreAuthConn (banner) interfaceBrad Fitzpatrick
Fixes golang/go#68688 Change-Id: Id5f72b32c61c9383a26ec182339486a432c7cdf5 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/613856 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Nicola Murino <nicola.murino@gmail.com> Reviewed-by: Jonathan Amsterdam <jba@google.com> Reviewed-by: Nicola Murino <nicola.murino@gmail.com> Reviewed-by: Roland Shoemaker <roland@golang.org>
2023-12-18ssh: implement strict KEX protocol changesv0.17.0Roland Shoemaker
Implement the "strict KEX" protocol changes, as described in section 1.9 of the OpenSSH PROTOCOL file (as of OpenSSH version 9.6/9.6p1). Namely this makes the following changes: * Both the server and the client add an additional algorithm to the initial KEXINIT message, indicating support for the strict KEX mode. * When one side of the connection sees the strict KEX extension algorithm, the strict KEX mode is enabled for messages originating from the other side of the connection. If the sequence number for the side which requested the extension is not 1 (indicating that it has already received non-KEXINIT packets), the connection is terminated. * When strict kex mode is enabled, unexpected messages during the handshake are considered fatal. Additionally when a key change occurs (on the receipt of the NEWKEYS message) the message sequence numbers are reset. Thanks to Fabian Bäumer, Marcus Brinkmann, and Jörg Schwenk from Ruhr University Bochum for reporting this issue. Fixes CVE-2023-48795 Fixes golang/go#64784 Change-Id: I96b53afd2bd2fb94d2b6f2a46a5dacf325357604 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/550715 Reviewed-by: Nicola Murino <nicola.murino@gmail.com> Reviewed-by: Tatiana Bradley <tatianabradley@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Run-TryBot: Roland Shoemaker <roland@golang.org> Reviewed-by: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2023-11-08ssh: allow to configure public key auth algorithms on the server sidev0.15.0Nicola Murino
Fixes golang/go#61244 Change-Id: I29b43e379cf0cdb07b0d6935666491b997157e73 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/510775 TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Bryan Mills <bcmills@google.com> Commit-Queue: Nicola Murino <nicola.murino@gmail.com> Run-TryBot: Nicola Murino <nicola.murino@gmail.com> Auto-Submit: Nicola Murino <nicola.murino@gmail.com> Reviewed-by: Han-Wen Nienhuys <hanwen@google.com>
2023-10-04ssh: add server side support for ping@openssh.com protocol extensionNicola Murino
Fixes golang/go#62390 Change-Id: Ie4dc577fb55b45a0c26a9e2dc5903af2bd382e00 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/524775 TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Matthew Dempsky <mdempsky@google.com> Reviewed-by: Than McIntosh <thanm@google.com> Run-TryBot: Nicola Murino <nicola.murino@gmail.com> Reviewed-by: Filippo Valsorda <filippo@golang.org>
2023-09-20ssh: add MultiAlgorithmSignerNicola Murino
MultiAlgorithmSigner allows to restrict client-side, server-side and certificate signing algorithms. Fixes golang/go#52132 Fixes golang/go#36261 Change-Id: I295092f1bba647327aaaf294f110e9157d294159 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/508398 Reviewed-by: Filippo Valsorda <filippo@golang.org> Run-TryBot: Filippo Valsorda <filippo@golang.org> Reviewed-by: Ian Lance Taylor <iant@google.com> Auto-Submit: Filippo Valsorda <filippo@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Matthew Dempsky <mdempsky@google.com>
2022-12-12ssh: ensure that handshakeTransport goroutines have finished before Close ↵Bryan C. Mills
returns This fixes a data race in the tests for x/crypto/ssh, which expects to be able to examine a transport's read and write counters without locking after closing it. (Given the number of goroutines, channels, and mutexes used in this package, I wouldn't be surprised if other concurrency bugs remain. I would suggest simplifying the concurrency in this package, but I don't intend to follow up on that myself at the moment.) Fixes golang/go#56957. Change-Id: Ib1f1390b66707c66a3608e48f3f52483cff3c1f5 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/456758 Reviewed-by: Roland Shoemaker <roland@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Auto-Submit: Bryan Mills <bcmills@google.com> Run-TryBot: Bryan Mills <bcmills@google.com>
2022-11-12ssh: support rsa-sha2-256/512 on the server sideFilippo Valsorda
This lets clients know we support rsa-sha2-256/512 signatures from ssh-rsa public keys. OpenSSH prefers to break the connection rather than attempting trial and error, apparently. We don't enable support for the "ext-info-s" because we're not interested in any client->server extensions. This also replaces isAcceptableAlgo which was rejecting the rsa-sha2-256/512-cert-v01@openssh.com public key algorithms. Tested with OpenSSH 9.1 on macOS Ventura. Fixes golang/go#49269 Updates golang/go#49952 Co-authored-by: Nicola Murino <nicola.murino@gmail.com> Co-authored-by: Kristin Davidson <kdavidson@atlassian.com> Change-Id: I4955c3b12bb45575e9977ac657bb5805b49d00c3 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/447757 Run-TryBot: Filippo Valsorda <filippo@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Roland Shoemaker <roland@golang.org> Reviewed-by: Nicola Murino <nicola.murino@gmail.com> Reviewed-by: Michael Knyszek <mknyszek@google.com>
2022-03-21ssh: send ext-info-c only oncePeter Verraedt
In accordance to RFC8308, send ext-info-c only during the first key exchange. Some server implementations such as OpenSSH 7 will send an extInfoMsg message each time when ext-info-c is received. This results in a closed connection, as our client does not expect this message while handling the mux. See https://bugzilla.mindrot.org/show_bug.cgi?id=2929 regarding the behaviour of OpenSSH if it sees ext-info-c in later key exchanges. Fixes golang/go#51808 Change-Id: Id94f1ef73cec6147136246b0b6048b57db92660d GitHub-Last-Rev: fcfe5ed37306136219854031abc809e0dc9b3124 GitHub-Pull-Request: golang/crypto#208 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/394134 Reviewed-by: Filippo Valsorda <filippo@golang.org> Run-TryBot: Filippo Valsorda <filippo@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Trust: Roland Shoemaker <roland@golang.org>
2022-03-14ssh: support rsa-sha2-256/512 for client authenticationFilippo Valsorda
CL 220037 had implemented support for host authentication using rsa-sha2-256/512, but not client public key authentication. OpenSSH disabled the SHA-1 based ssh-rsa by default in version 8.8 (after pre-announcing it in versions 8.2, 8.3, 8.4, 8.5, 8.6, and 8.7) although some distributions re-enable it. GitHub will start rejecting ssh-rsa for keys uploaded before November 2, 2021 on March 15, 2022. https://github.blog/2021-09-01-improving-git-protocol-security-github/ The server side already worked, as long as the client selected one of the SHA-2 algorithms, because the signature flowed freely to Verify. There was however nothing verifying that the signature algorithm matched the advertised one. The comment suggested the check was being performed, but it got lost back in CL 86190043. Not a security issue because the signature had to pass the callback's Verify method regardless, and both values were checked to be acceptable. Tested with OpenSSH 8.8 configured with "PubkeyAcceptedKeyTypes -ssh-rsa" and no application-side changes. The Signers returned by ssh/agent (when backed by an agent client) didn't actually implement AlgorithmSigner but ParameterizedSigner, an interface defined in an earlier version of CL 123955. Updates golang/go#49269 Fixes golang/go#39885 For golang/go#49952 Change-Id: I13b41db8041f1112a70f106c55f077b904b12cb8 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/392394 Trust: Filippo Valsorda <filippo@golang.org> Run-TryBot: Filippo Valsorda <filippo@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Roland Shoemaker <roland@golang.org>
2022-03-14ssh: don't advertise rsa-sha2 algorithms if we can't use themFilippo Valsorda
The server implementation looks at the HostKeys to advertise and negotiate host key signature algorithms. A fundamental issue of the Signer and AlgorithmSigner interfaces is that they don't expose the supported signature algorithms, so really the server has to guess. Currently, it would guess exclusively based on the PublicKey.Type, regardless of whether the host key implemented AlgorithmSigner. This means that a legacy Signer that only supports ssh-rsa still led the server to negotiate rsa-sha2 algorithms. The server would then fail to find a suitable host key to make the signature and crash. This won't happen if only Signers from this package are used, but if a custom Signer that doesn't support SignWithAlgorithm() but returns "ssh-rsa" from PublicKey().Type() is used as a HostKey, the server is vulnerable to DoS. The only workable rules to determine what to advertise seems to be: 1. a pure Signer will always Sign with the PublicKey.Type 2. an AlgorithmSigner supports all algorithms associated with the PublicKey.Type Rule number two means that we can't add new supported algorithms in the future, which is not great, but it's too late to fix that. rsaSigner was breaking rule number one, and although it would have been fine where it's used, I didn't want to break our own interface contract. It's unclear why we had separate test key entries for rsa-sha2 algorithms, since we can use the ssh-rsa key for those. The only test that used them, TestCertTypes, seemed broken: the init was actually failing at making the corresponding signers rsaSigners, and indeed the test for the SHA-256 signer expected and checked a SHA-512 signature. Pending CVE For golang/go#49952 Change-Id: Ie658eefcadd87906e63fc7faae8249376aa96c79 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/392355 Trust: Filippo Valsorda <filippo@golang.org> Run-TryBot: Filippo Valsorda <filippo@golang.org> Reviewed-by: Roland Shoemaker <roland@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org>
2022-03-14ssh: deprecate and replace SigAlgo constantsFilippo Valsorda
RFC 8332, Section 2 sets up two overlapping namespaces: public key formats and public key algorithms. * The formats are what we currently have KeyAlgo constants for, and they appear in PublicKey.Type. * The algorithms are the set of both KeyAlgo and SigAlgo constants, and they appear in Signature.Format (amongst other places). This is incoherent, because that means Signature.Format can be both a KeyAlgo (like KeyAlgoECDSA256) or a SigAlgo (like SigAlgoRSASHA2256). One solution would be to duplicate all the KeyAlgo constants into the SigAlgo namespace, but that would be confusing because applications are currently using KeyAlgos where they'd be supposed to use the new SigAlgos (while we can't deprecate the KeyAlgos because they are still necessary for the PublicKey.Type namespace). Instead, drop the separate namespaces, and use KeyAlgos throughout. There are simply some KeyAlgos that can't be a PublicKey.Type. Take the opportunity to fix the stuttering SHA22565/SHA2512 names. It's totally ok to call those hashes SHA-256 and SHA-512 without the family infix. For golang/go#49952 Change-Id: Ia1fce3912a7e60aa70a88f75ed311be331fd19d5 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/392354 Trust: Filippo Valsorda <filippo@golang.org> Run-TryBot: Filippo Valsorda <filippo@golang.org> Reviewed-by: Roland Shoemaker <roland@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org>
2021-11-15ssh: support RSA SHA-2 (RFC8332) signaturesHans Nielsen
This change adds support for RSA SHA-2 based signatures for host keys and certificates. It also switches the default certificate signature algorithm for RSA to use SHA-512. This is implemented by treating ssh.Signer specially when the key type is `ssh-rsa` by also allowing SHA-256 and SHA-512 signatures. Fixes golang/go#37278 Change-Id: I2ee1ac4ae4c9c1de441a2d6cf1e806357ef18910 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/220037 Trust: Jason A. Donenfeld <Jason@zx2c4.com> Run-TryBot: Jason A. Donenfeld <Jason@zx2c4.com> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Jason A. Donenfeld <Jason@zx2c4.com> Reviewed-by: Roland Shoemaker <roland@golang.org>
2019-04-18ssh: invert algorithm choices on the serverHan-Wen Nienhuys
At the protocol level, SSH lets client and server specify different algorithms for the read and write half of the connection. This has never worked correctly, as Client-to-Server was always interpreted as the "write" side, even if we were the server. This has never been a problem because, apparently, there are no clients that insist on different algorithm choices running against Go SSH servers. Since the SSH package does not expose a mechanism to specify algorithms for read/write separately, there is end-to-end for this change, so add a unittest instead. Change-Id: Ie3aa781630a3bb7a3b0e3754cb67b3ce12581544 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/172538 Reviewed-by: Filippo Valsorda <filippo@golang.org> Run-TryBot: Filippo Valsorda <filippo@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
2017-11-13ssh: add support for bannersTugdual Saunier
According to RFC 4252 section 5.4, the banner is sent between the ssh-connection request and responding to user authentication. Original support for server sending banner by joshua stein <jcs@jcs.org> Fixes golang/go#19567 Change-Id: I729b3c8e5fd2c0068609d1590b61e92f40d87ea4 Reviewed-on: https://go-review.googlesource.com/71790 Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Han-Wen Nienhuys <hanwen@google.com>
2017-10-23Revert "ssh: add support for banners"Han-Wen Nienhuys
This reverts commit ed5229da99e3a6df35c756cd64b6982d19505d86. Reason for revert: missing language tag in banner message breaks auth against other implementations. Change-Id: I18ac5b3fe3b4693688b82ff4b0db02dab739c45b Reviewed-on: https://go-review.googlesource.com/72381 Reviewed-by: Han-Wen Nienhuys <hanwen@google.com> Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
2017-10-18ssh: add support for bannersTugdual Saunier
According to RFC 4252 section 5.4, the banner is sent between the ssh-connection request and responding to user authentication. Original support for server sending banner by joshua stein <jcs@jcs.org> Fixes golang/go#19567 Change-Id: I68944a7f4711c0623759f6a59023e8e45a8781aa Reviewed-on: https://go-review.googlesource.com/65271 Reviewed-by: Han-Wen Nienhuys <hanwen@google.com> Run-TryBot: Han-Wen Nienhuys <hanwen@google.com>
2017-04-13ssh: fix reset{Read,Write}Thresholds for initial setupHan-Wen Nienhuys
Fixes a nil pointer dereference that slipped through buildbots because it was introduced by the last two commits. Change-Id: Ib269e910956cd8b3b46e217b03fde1b61572260a Reviewed-on: https://go-review.googlesource.com/40530 Reviewed-by: Han-Wen Nienhuys <hanwen@google.com> Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
2017-04-13ssh: set rekeying thresholds on construction Han-Wen Nienhuys
The normal handshake kicks off with a waitSession(), which guarantees that we never attempt to send data before the first kex is completed, but ensuring readPacketsLeft > 0 and writePacketsLeft > 0 helps understand that thresholds can never cause spurious rekeying at the start of a connection. Change-Id: If5bcafcda0c7d16fd21f22c664101ac5f5b487d7 Reviewed-on: https://go-review.googlesource.com/38696 Reviewed-by: Adam Langley <agl@golang.org> Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
2017-03-30ssh: handle error from prepareKeyChange.Han-Wen Nienhuys
Fixes #18850. Change-Id: Id3ae89233f9e95ec3238462bf2ecda3e0c515f88 Reviewed-on: https://go-review.googlesource.com/36051 Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Adam Langley <agl@golang.org>
2017-03-30ssh: require host key checking in the ClientConfigHan-Wen Nienhuys
This change breaks existing behavior. Before, a missing ClientConfig.HostKeyCallback would cause host key checking to be disabled. In this configuration, establishing a connection to any host just works, so today, most SSH client code in the wild does not perform any host key checks. This makes it easy to perform a MITM attack: * SSH installations that use keyboard-interactive or password authentication can be attacked with MITM, thereby stealing passwords. * Clients that use public-key authentication with agent forwarding are also vulnerable: the MITM server could allow the login to succeed, and then immediately ask the agent to authenticate the login to the real server. * Clients that use public-key authentication without agent forwarding are harder to attack unnoticedly: an attacker cannot authenticate the login to the real server, so it cannot in general present a convincing server to the victim. Now, a missing HostKeyCallback will cause the handshake to fail. This change also provides InsecureIgnoreHostKey() and FixedHostKey(key) as ready made host checkers. A simplistic parser for OpenSSH's known_hosts file is given as an example. This change does not provide a full-fledged parser, as it has complexity (wildcards, revocation, hashed addresses) that will need further consideration. When introduced, the host checking feature maintained backward compatibility at the expense of security. We have decided this is not the right tradeoff for the SSH library. Fixes golang/go#19767 Change-Id: I45fc7ba9bd1ea29c31ec23f115cdbab99913e814 Reviewed-on: https://go-review.googlesource.com/38701 Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2017-02-06ssh: prevent double kex at connection start, 2nd tryHan-Wen Nienhuys
The previous attempt would fail in the following scenario: * select picks "first" kex from requestKex * read loop receives a remote kex, posts on requestKex (which is now empty) [*] for sending out a response, and sends pendingKex on startKex. * select picks pendingKex from startKex, and proceeds to run the key exchange. * the posting on requestKex in [*] now triggers a second key exchange. Fixes #18861. Change-Id: I443e82f1d04c7f17d1485fdb87072b9feec26aa8 Reviewed-on: https://go-review.googlesource.com/36055 Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Han-Wen Nienhuys <hanwen@google.com>
2017-02-02ssh: reset buffered packets after sendingHan-Wen Nienhuys
Since encryption messes up the packets, the wrongly retained packets look like noise and cause application protocol errors or panics in the SSH library. This normally triggers very rarely: the mandatory key exchange doesn't have parallel writes, so this failure condition would be setup on the first key exchange, take effect only after the second key exchange. Fortunately, the tests against openssh exercise this. This change adds also adds a unittest. Fixes #18850. Change-Id: I656c8b94bfb265831daa118f4d614a2f0c65d2af Reviewed-on: https://go-review.googlesource.com/36056 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
2017-01-30ssh: rationalize rekeying decisions.Han-Wen Nienhuys
1) Always force a key exchange if we exchange 2^31 packets. In the past this might not happen if RekeyThreshold was set to a very large interval. 2) Follow recommendations from RFC 4344 for block ciphers. For AES, we can encrypt 2^(blocksize/4) blocks under the same keys. On modern hardware, the previous default of 1Gb could force a key exchange within ~10 seconds. Since the key exchange takes 3 roundtrips (send kex init, send DH init, send NEW_KEYS), this is relatively expensive on high-latency links. Change-Id: I1297124a307c541b7bf22d814d136ec0c6d8ed97 Reviewed-on: https://go-review.googlesource.com/35410 Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Adam Langley <agl@golang.org>
2017-01-30ssh: make sure we execute the initial key exchange only onceHan-Wen Nienhuys
The initial kex is started from both sides simultaneously, and before, we could consume the the incoming kex request before we consumed from our internal channel. This would result in initiating a key exchange just after completing the initial one, which is not only an extra delay, but also an error when using OpenSSH (OpenSSH does not support key exchanges during user authentication). Change-Id: Ia7e0748ea2bca80ae97d187bcf2931ab6422276b Reviewed-on: https://go-review.googlesource.com/35851 Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Adam Langley <agl@golang.org>
2017-01-23ssh: soft code internal channel size for testing purposesHan-Wen Nienhuys
Change-Id: I2ee0ed4ba82d2d156a7896551dea04b28cdeceb0 Reviewed-on: https://go-review.googlesource.com/35184 Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Adam Langley <agl@golang.org>
2017-01-16ssh: rewrite (re)keying logic.Han-Wen Nienhuys
Use channels and a dedicated write loop for managing the rekeying process. This lets us collect packets to be written while a key exchange is in progress. Previously, the read loop ran the key exchange, and writers would block if a key exchange was going on. If a reader wrote back a packet while processing a read packet, it could block, stopping the read loop, thus causing a deadlock. Such coupled read/writes are inherent with handling requests that want a response (eg. keepalive, opening/closing channels etc.). The buffered channels (most channels have capacity 16) papered over these problems, but under load SSH connections would occasionally deadlock. Fixes #18439. Change-Id: I7c14ff4991fa3100a5d36025125d0cf1119c471d Reviewed-on: https://go-review.googlesource.com/35012 Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Han-Wen Nienhuys <hanwen@google.com>
2016-09-20ssh: properly handle wrong guess for FirstKexFollows in serverKaleb Elwert
In the initial key exchange, a client has the option of sending a guessed key exchange packet. This guess is considered wrong (RFC 4253 Section 7) if "the kex algorithm and/or the host key algorithm is guessed wrong (server and client have different preferred algorithm), or if any of the other algorithms cannot be agreed upon...". The library should be checking the first algorithm in the supported algorithms, not the agreed algorithm. It also needs to check both the kex algorithm and the host key algorithm. Fixes golang/go#16962 Change-Id: I6b62b1f5b39731326280571d373635085135a2a1 Reviewed-on: https://go-review.googlesource.com/28750 Reviewed-by: Han-Wen Nienhuys <hanwen@google.com> Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
2016-05-18x/crypto/ssh: return msgNewKeys for a short-circuited first kex.Han-Wen Nienhuys
If one of both sides is slow, the first kex completes implicitly. The first kex also produces msgNewKeys, and this must be read to ensure that the authentication code is not confused by it. Before this fix, the problem could be reproduced by inserting a sleep just before the requestInitialKeyChange call. Fixes #15198 Change-Id: I602db5dd37b2d8556c88ab4cdb693ccf90147a3d Reviewed-on: https://go-review.googlesource.com/23137 Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> Reviewed-by: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
2016-05-10x/crypto/ssh: hide msgNewKeys in the transport layer.Han-Wen Nienhuys
This ensures that extraneous key exchanges cannot confuse application level code. Change-Id: I1a333e2b7b46f1e484406a79db7a949294e79c6d Reviewed-on: https://go-review.googlesource.com/22417 Reviewed-by: Han-Wen Nienhuys <hanwen@google.com> Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> Reviewed-by: Adam Langley <agl@golang.org>
2016-05-03x/crypto/ssh: also log data packets when debugHandshake is setHan-Wen Nienhuys
Change-Id: Ibb26269608e506e8a676c276f847d77fe7014ceb Reviewed-on: https://go-review.googlesource.com/22514 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
2016-04-26x/crypto/ssh: fix subsequent key exchanges.Han-Wen Nienhuys
In https://go-review.googlesource.com/#/c/21606/ , kexResult.SessionID was erroneously not set for all but the first key exchange. The unittests did not catch this, as server and client make the same mistake, but OpenSSH notices corrupted data and kills the connection. Fixes #15445. Change-Id: If98249b37d81efaa2ebefc836df0b150feba1256 Reviewed-on: https://go-review.googlesource.com/22418 Reviewed-by: Adam Langley <agl@golang.org> Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
2016-04-12x/crypto/ssh: make sure the initial key exchange happens once.Han-Wen Nienhuys
This is done by running the key exchange and setting the session ID under mutex. If the first exchange encounters an already set session ID, then do nothing. This fixes a race condition: On setting up the connection, both sides sent a kexInit to initiate the first (mandatory) key exchange. If one side was faster, the faster side might have completed the key exchange, before the slow side had a chance to send a kexInit. The slow side would send a kexInit which would trigger a second key exchange. The resulting confirmation message (msgNewKeys) would confuse the authentication loop. This fix removes sessionID from the transport struct. This fix also deletes the unused interface rekeyingTransport. Fixes #15066 Change-Id: I7f303bce5d3214c9bdd58f52d21178a185871d90 Reviewed-on: https://go-review.googlesource.com/21606 Reviewed-by: Adam Langley <agl@golang.org> Reviewed-by: Han-Wen Nienhuys <hanwen@google.com>
2015-08-29crypto/ssh: clearer error messages when "no ciphers in common"Thomas Desrosiers
The error message reported by the ssh client when it can't find a "cipher" in common between the client and server was overly vague. This adds more detailed error messages to findAgreedAlgorithms so that the user can more easily identify which of the components can't reach agreement. Change-Id: I4d985e92fea964793213e5600b52b3141e712000 Reviewed-on: https://go-review.googlesource.com/13817 Reviewed-by: Adam Langley <agl@golang.org>
2015-08-17crypto/ssh: fix deadlock during error condition.Han-Wen Nienhuys
Unblock writers if a read error occurs while writers are blocked on a pending key change. Add test to check for deadlocks in error paths in handshake.go Fixes golang/go#11992. Change-Id: Id098bd9fec3d4fe83daeb2b7f935e5647c19afd3 Reviewed-on: https://go-review.googlesource.com/13594 Reviewed-by: Adam Langley <agl@golang.org>
2015-08-04crypto/ssh: allow client to specify host key algorithms.hanwen
Fixes golang/go#11722. Change-Id: I4fa2a1db14050151f9269427ca35cf7ebd21440a Reviewed-on: https://go-review.googlesource.com/12907 Reviewed-by: Adam Langley <agl@golang.org>
2015-07-30ssh: fix deadlock during error pathDave Cheney
Fixes golang/go#11882 If an error occurs during handshakeTransport.writePacket the lock may not be released. Fix this by using defer rather than manually unlocking in all paths. Change-Id: I0010284b4f7d99907c86b4c0e140ab6cf37b0441 Reviewed-on: https://go-review.googlesource.com/12888 Reviewed-by: Adam Langley <agl@golang.org>
2014-04-09go.crypto/ssh: import gosshnew.Adam Langley
See https://groups.google.com/d/msg/Golang-nuts/AoVxQ4bB5XQ/i8kpMxdbVlEJ R=hanwen CC=golang-codereviews https://golang.org/cl/86190043
generated by cgit v1.3 (git 2.53.0) at 2026-04-15 08:25:53 +0000