aboutsummaryrefslogtreecommitdiff
path: root/ssh/server.go
AgeCommit message (Collapse)Author
2023-12-14ssh: close net.Conn on all NewServerConn errorsEdoardo Spadolini
This PR ensures that the net.Conn passed to ssh.NewServerConn is closed on all error return paths, not just after a failed handshake. This matches the behavior of ssh.NewClientConn. Change-Id: Id8a51d10ae8d575cbbe26f2ef6b37de7cca840ec GitHub-Last-Rev: 81bb2e58a881a9a85935740bda06b034b32a8ce3 GitHub-Pull-Request: golang/crypto#279 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/549095 Run-TryBot: Nicola Murino <nicola.murino@gmail.com> Auto-Submit: Nicola Murino <nicola.murino@gmail.com> Reviewed-by: Roland Shoemaker <roland@golang.org> Reviewed-by: Nicola Murino <nicola.murino@gmail.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Michael Pratt <mpratt@google.com> TryBot-Result: Gopher Robot <gobot@golang.org>
2023-11-11ssh: use the correct token from the clientMatt Dainty
This fixes the case where AcceptSecContext is always called with the first token sent by the client instead of the most recently sent one. Previously, despite being being read from the client and unmarshalled, it was never actually used. Fixes golang/go#43875 Change-Id: I1967d9a107af03d6778a9437b48e785d61710ee5 GitHub-Last-Rev: 0d58e4d50014fac0a9ea1eef85489172137eb8aa GitHub-Pull-Request: golang/crypto#176 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/286252 Run-TryBot: Filippo Valsorda <filippo@golang.org> Auto-Submit: Filippo Valsorda <filippo@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Matthew Dempsky <mdempsky@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Run-TryBot: Nicola Murino <nicola.murino@gmail.com> Reviewed-by: Nicola Murino <nicola.murino@gmail.com> Reviewed-by: Filippo Valsorda <filippo@golang.org> Reviewed-by: Than McIntosh <thanm@google.com>
2023-11-08ssh: allow to configure public key auth algorithms on the server sidev0.15.0Nicola Murino
Fixes golang/go#61244 Change-Id: I29b43e379cf0cdb07b0d6935666491b997157e73 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/510775 TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Bryan Mills <bcmills@google.com> Commit-Queue: Nicola Murino <nicola.murino@gmail.com> Run-TryBot: Nicola Murino <nicola.murino@gmail.com> Auto-Submit: Nicola Murino <nicola.murino@gmail.com> Reviewed-by: Han-Wen Nienhuys <hanwen@google.com>
2023-09-05ssh: check the declared public key algo against decoded oneNicola Murino
This check will ensure we don't accept e.g. ssh-rsa-cert-v01@openssh.com algorithm with ssh-rsa public key type. The algorithm and public key type must be consistent: both must be certificate algorithms, or neither. Change-Id: I1d75074fb4d6db3a8796408e98ddffe577a96ab1 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/506836 TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Reviewed-by: Cherry Mui <cherryyz@google.com> Auto-Submit: Filippo Valsorda <filippo@golang.org> Reviewed-by: Filippo Valsorda <filippo@golang.org> Run-TryBot: Filippo Valsorda <filippo@golang.org>
2023-07-10ssh: fix RSA certificate and public key authentication with older clientsNicola Murino
After adding support for rsa-sha2-256/512 on the server side some edge cases started to arise with old clients: 1) public key authentication with gpg-agent < 2.2.6 fails because we receive ssh-rsa as signature format and rsa-sha2-256 or rsa-sha2-512 as algorithm. This is a bug in gpg-agent fixed in this commit: https://github.com/gpg/gnupg/commit/80b775bdbb852aa4a80292c9357e5b1876110c00 2) certificate authentication fails with OpenSSH 7.2-7.7 because we receive ssh-rsa-cert-v01@openssh.com as algorithm and rsa-sha2-256 or rsa-sha2-512 as signature format. This patch is based on CL 412854 and has been tested with every version of OpenSSH from 7.1 to 7.9 and OpenSSH 9.3. Fixes golang/go#53391 Change-Id: Id71f596f73d84efb5c76d6d5388432cccad3e3b1 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/506835 Auto-Submit: Filippo Valsorda <filippo@golang.org> Reviewed-by: Filippo Valsorda <filippo@golang.org> Run-TryBot: Filippo Valsorda <filippo@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Roland Shoemaker <roland@golang.org>
2022-11-12ssh: support rsa-sha2-256/512 on the server sideFilippo Valsorda
This lets clients know we support rsa-sha2-256/512 signatures from ssh-rsa public keys. OpenSSH prefers to break the connection rather than attempting trial and error, apparently. We don't enable support for the "ext-info-s" because we're not interested in any client->server extensions. This also replaces isAcceptableAlgo which was rejecting the rsa-sha2-256/512-cert-v01@openssh.com public key algorithms. Tested with OpenSSH 9.1 on macOS Ventura. Fixes golang/go#49269 Updates golang/go#49952 Co-authored-by: Nicola Murino <nicola.murino@gmail.com> Co-authored-by: Kristin Davidson <kdavidson@atlassian.com> Change-Id: I4955c3b12bb45575e9977ac657bb5805b49d00c3 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/447757 Run-TryBot: Filippo Valsorda <filippo@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Roland Shoemaker <roland@golang.org> Reviewed-by: Nicola Murino <nicola.murino@gmail.com> Reviewed-by: Michael Knyszek <mknyszek@google.com>
2022-10-10ssh: add ServerConfig.NoClientAuthCallbackBrad Fitzpatrick
It was possible to accept auth type "none" before, but not dynamically at runtime as a function of the ConnMetadata like the other auth types' callback hooks. Fixes golang/go#51994 Change-Id: I83ea80901d4977d8f78523e3d1e16e0a7df5b172 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/395314 Reviewed-by: Roland Shoemaker <roland@golang.org> Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Julie Qiu <julieqiu@google.com>
2022-03-14ssh: support rsa-sha2-256/512 for client authenticationFilippo Valsorda
CL 220037 had implemented support for host authentication using rsa-sha2-256/512, but not client public key authentication. OpenSSH disabled the SHA-1 based ssh-rsa by default in version 8.8 (after pre-announcing it in versions 8.2, 8.3, 8.4, 8.5, 8.6, and 8.7) although some distributions re-enable it. GitHub will start rejecting ssh-rsa for keys uploaded before November 2, 2021 on March 15, 2022. https://github.blog/2021-09-01-improving-git-protocol-security-github/ The server side already worked, as long as the client selected one of the SHA-2 algorithms, because the signature flowed freely to Verify. There was however nothing verifying that the signature algorithm matched the advertised one. The comment suggested the check was being performed, but it got lost back in CL 86190043. Not a security issue because the signature had to pass the callback's Verify method regardless, and both values were checked to be acceptable. Tested with OpenSSH 8.8 configured with "PubkeyAcceptedKeyTypes -ssh-rsa" and no application-side changes. The Signers returned by ssh/agent (when backed by an agent client) didn't actually implement AlgorithmSigner but ParameterizedSigner, an interface defined in an earlier version of CL 123955. Updates golang/go#49269 Fixes golang/go#39885 For golang/go#49952 Change-Id: I13b41db8041f1112a70f106c55f077b904b12cb8 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/392394 Trust: Filippo Valsorda <filippo@golang.org> Run-TryBot: Filippo Valsorda <filippo@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Roland Shoemaker <roland@golang.org>
2022-03-14ssh: send (and rename) keyboard-interactive name field to the clientFilippo Valsorda
The server side implementation was not actually populating the SSH_MSG_USERAUTH_INFO_REQUEST field with the KeyboardInteractiveChallenge argument, although the client side was deserializing it and passing it to the KeyboardInteractiveChallenge callback. Anyway, the first field of SSH_MSG_USERAUTH_INFO_REQUEST is "name", not "user". Maybe the confusion was due to the first field of SSH_MSG_USERAUTH_REQUEST being the user. RFC 4256, Section 3.3, says this about it One possibility is to use the name field (possibly prefixed with the application's name) as the title of a dialog window in which the prompt(s) are presented. and examples include "CRYPTOCard Authentication", "Password Authentication", and "Password Expired". Co-authored-by: Kevin Wallace <kevin@pentabarf.net> Change-Id: Ic6ec0dfea2122704603c44f42898a980689a15c9 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/372234 Trust: Filippo Valsorda <filippo@golang.org> Run-TryBot: Filippo Valsorda <filippo@golang.org> Reviewed-by: Roland Shoemaker <roland@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org>
2022-03-14ssh: don't advertise rsa-sha2 algorithms if we can't use themFilippo Valsorda
The server implementation looks at the HostKeys to advertise and negotiate host key signature algorithms. A fundamental issue of the Signer and AlgorithmSigner interfaces is that they don't expose the supported signature algorithms, so really the server has to guess. Currently, it would guess exclusively based on the PublicKey.Type, regardless of whether the host key implemented AlgorithmSigner. This means that a legacy Signer that only supports ssh-rsa still led the server to negotiate rsa-sha2 algorithms. The server would then fail to find a suitable host key to make the signature and crash. This won't happen if only Signers from this package are used, but if a custom Signer that doesn't support SignWithAlgorithm() but returns "ssh-rsa" from PublicKey().Type() is used as a HostKey, the server is vulnerable to DoS. The only workable rules to determine what to advertise seems to be: 1. a pure Signer will always Sign with the PublicKey.Type 2. an AlgorithmSigner supports all algorithms associated with the PublicKey.Type Rule number two means that we can't add new supported algorithms in the future, which is not great, but it's too late to fix that. rsaSigner was breaking rule number one, and although it would have been fine where it's used, I didn't want to break our own interface contract. It's unclear why we had separate test key entries for rsa-sha2 algorithms, since we can use the ssh-rsa key for those. The only test that used them, TestCertTypes, seemed broken: the init was actually failing at making the corresponding signers rsaSigners, and indeed the test for the SHA-256 signer expected and checked a SHA-512 signature. Pending CVE For golang/go#49952 Change-Id: Ie658eefcadd87906e63fc7faae8249376aa96c79 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/392355 Trust: Filippo Valsorda <filippo@golang.org> Run-TryBot: Filippo Valsorda <filippo@golang.org> Reviewed-by: Roland Shoemaker <roland@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org>
2022-03-14ssh: deprecate and replace SigAlgo constantsFilippo Valsorda
RFC 8332, Section 2 sets up two overlapping namespaces: public key formats and public key algorithms. * The formats are what we currently have KeyAlgo constants for, and they appear in PublicKey.Type. * The algorithms are the set of both KeyAlgo and SigAlgo constants, and they appear in Signature.Format (amongst other places). This is incoherent, because that means Signature.Format can be both a KeyAlgo (like KeyAlgoECDSA256) or a SigAlgo (like SigAlgoRSASHA2256). One solution would be to duplicate all the KeyAlgo constants into the SigAlgo namespace, but that would be confusing because applications are currently using KeyAlgos where they'd be supposed to use the new SigAlgos (while we can't deprecate the KeyAlgos because they are still necessary for the PublicKey.Type namespace). Instead, drop the separate namespaces, and use KeyAlgos throughout. There are simply some KeyAlgos that can't be a PublicKey.Type. Take the opportunity to fix the stuttering SHA22565/SHA2512 names. It's totally ok to call those hashes SHA-256 and SHA-512 without the family infix. For golang/go#49952 Change-Id: Ia1fce3912a7e60aa70a88f75ed311be331fd19d5 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/392354 Trust: Filippo Valsorda <filippo@golang.org> Run-TryBot: Filippo Valsorda <filippo@golang.org> Reviewed-by: Roland Shoemaker <roland@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org>
2022-03-07ssh: fix typocuishuang
Change-Id: I5832916eb921d2d18e3082cd04520e22e2b04127 GitHub-Last-Rev: c0999b83439a5f0ff57b740c18f47d81028e552a GitHub-Pull-Request: golang/crypto#207 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/390414 Reviewed-by: Roland Shoemaker <roland@golang.org> Trust: Carlos Amedee <carlos@golang.org> Run-TryBot: Ian Lance Taylor <iant@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org>
2022-02-13crypto/ssh: don't send the last auth failure message if disconnectingRoland Shoemaker
If we are going to send the disconnect message and close the connection, because we have exhausted the number of authentication attempts, don't send the final authentication failure message. This behavior matches that of OpenSSH. Fixes golang/go#51149 Change-Id: I43b2de2e854f789161cd7fd6c05876661adfb2c1 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/385236 Trust: Roland Shoemaker <roland@golang.org> Run-TryBot: Roland Shoemaker <roland@golang.org> Auto-Submit: Roland Shoemaker <roland@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Ian Lance Taylor <iant@golang.org>
2021-11-15ssh: support RSA SHA-2 (RFC8332) signaturesHans Nielsen
This change adds support for RSA SHA-2 based signatures for host keys and certificates. It also switches the default certificate signature algorithm for RSA to use SHA-512. This is implemented by treating ssh.Signer specially when the key type is `ssh-rsa` by also allowing SHA-256 and SHA-512 signatures. Fixes golang/go#37278 Change-Id: I2ee1ac4ae4c9c1de441a2d6cf1e806357ef18910 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/220037 Trust: Jason A. Donenfeld <Jason@zx2c4.com> Run-TryBot: Jason A. Donenfeld <Jason@zx2c4.com> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Jason A. Donenfeld <Jason@zx2c4.com> Reviewed-by: Roland Shoemaker <roland@golang.org>
2020-12-16ssh: disallow gssapi-with-mic if GSSAPIWithMICConfig is not setRoland Shoemaker
The ability to trigger the 'gssapi-with-mic' authentication method is not properly gated by the presence of the GSSAPIWithMICConfig field of the ServerConfig type. If this field is not set and a client sends a 'gssapi-with-mic' request, regardless of if the server advertises it, the server will panic. This issue was discovered and reported by Joern Schneewesiz, GitLab Security Research Team. Fixes CVE-2020-29652 Change-Id: Ie25de2766e442c8ab46680aae3ac89b0823cdeed Reviewed-on: https://go-review.googlesource.com/c/crypto/+/278852 Trust: Roland Shoemaker <roland@golang.org> Run-TryBot: Roland Shoemaker <roland@golang.org> Reviewed-by: Filippo Valsorda <filippo@golang.org> TryBot-Result: Go Bot <gobot@golang.org>
2019-12-02ssh: add sk-ecdsa-sha2-nistp256 and sk-ed25519Sebastian Kinne
This adds server-side support for the newly introduced OpenSSH keytypes sk-ecdsa-sha2-nistp256@openssh.com and sk-ed25519@openssh.com (including their corresponding certificates), which are backed by U2F/FIDO2 tokens. Change-Id: I53d5ed3d0457ae4758ee986055e187ee5787a2d1 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/208017 Reviewed-by: Han-Wen Nienhuys <hanwen@google.com> Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
2019-06-17ssh: add diffie-hellman-group-exchange-sha256Lucas Bremgartner
Add the diffie-hellman-group-exchange-sha256 defined in RFC 4419 to the list of supported key exchange algorithms for ssh. The server half is only a minimal implementation to satisfy the automated tests. Fixes golang/go#17230 Change-Id: I25880a564347fd9b4738dd2ed1e347cd5d2e21bb GitHub-Last-Rev: 9f0b8d02c0c96e9baf00cdf1cf063ff834245443 GitHub-Pull-Request: golang/crypto#87 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/174257 Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Han-Wen Nienhuys <hanwen@google.com>
2019-05-10ssh/gss: support kerberos authentication for ssh server and clientyanweizhi
Change-Id: I20e3356476dc50402dd34d2b39ad030c1e63a9ef Reviewed-on: https://go-review.googlesource.com/c/crypto/+/170919 Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Han-Wen Nienhuys <hanwen@google.com>
2018-11-06ssh: return specific error for invalid signature algorithmHan-Wen Nienhuys
Previously, this would return the default error "no auth passed yet". Not only is the new error more specific, it makes it easier to verify the control flow of server authentication code. Change-Id: I6c8de4e3f91da74274acbe9d87ec4f6158b4a94f Reviewed-on: https://go-review.googlesource.com/c/142897 Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2018-10-12ssh: fix typo in error messagemkishere
Fix typo in error message when keyboard-interactive auth not supported by server and client requests it Change-Id: Iedb72625852f03552481d85cce2119765cfba320 GitHub-Last-Rev: ee47092daf8c40fe3e0e166e7370556819457af6 GitHub-Pull-Request: golang/crypto#59 Reviewed-on: https://go-review.googlesource.com/c/141658 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2018-02-26ssh: fix error variable naming convention, add docsBrad Fitzpatrick
Follow up to CL 96336 Change-Id: I038f3901919c5136273e5df051bc6e958082f830 Reviewed-on: https://go-review.googlesource.com/96415 Reviewed-by: Han-Wen Nienhuys <hanwen@google.com> Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
2018-02-22ssh: use a variable rather than type for NoAuthErrorHan-Wen Nienhuys
Change-Id: Ib61e0bc7d953cefde0436f77fe6a610201043c85 Reviewed-on: https://go-review.googlesource.com/96336 Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Spencer Tung <spencertung@google.com> Reviewed-by: Han-Wen Nienhuys <hanwen@google.com>
2018-02-19Adding a unique error when no authentication method has been passed inSpencer Tung
yet. Since ServerAuthError returns all errors collected during the userAuthLoop, it will always include the generic error "no auth passed yet" (assuming the connection fails). Change-Id: I5f6c67f3f0762b023618178d4028600d2b6c9253 Reviewed-on: https://go-review.googlesource.com/92737 Reviewed-by: Han-Wen Nienhuys <hanwen@google.com> Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
2017-12-18ssh: accept ed25519 certsPeter Moody
Change-Id: I1cb0146c4b741f6d489edcf86412001ffc007f4f Reviewed-on: https://go-review.googlesource.com/82256 Reviewed-by: Han-Wen Nienhuys <hanwen@google.com> Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
2017-11-28crypto/ssh: only show banner onceSam Whited
Only show the SSH banner once, even if the client attempts authentication with the "none" type and resets the authentication attempts. Change-Id: I1a7aacb50abf00233ed4d06c60808aaf51a9d7be Reviewed-on: https://go-review.googlesource.com/78544 Run-TryBot: Sam Whited <sam@samwhited.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Han-Wen Nienhuys <hanwen@google.com>
2017-11-13ssh: add support for bannersTugdual Saunier
According to RFC 4252 section 5.4, the banner is sent between the ssh-connection request and responding to user authentication. Original support for server sending banner by joshua stein <jcs@jcs.org> Fixes golang/go#19567 Change-Id: I729b3c8e5fd2c0068609d1590b61e92f40d87ea4 Reviewed-on: https://go-review.googlesource.com/71790 Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Han-Wen Nienhuys <hanwen@google.com>
2017-10-23Revert "ssh: add support for banners"Han-Wen Nienhuys
This reverts commit ed5229da99e3a6df35c756cd64b6982d19505d86. Reason for revert: missing language tag in banner message breaks auth against other implementations. Change-Id: I18ac5b3fe3b4693688b82ff4b0db02dab739c45b Reviewed-on: https://go-review.googlesource.com/72381 Reviewed-by: Han-Wen Nienhuys <hanwen@google.com> Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
2017-10-18ssh: add support for bannersTugdual Saunier
According to RFC 4252 section 5.4, the banner is sent between the ssh-connection request and responding to user authentication. Original support for server sending banner by joshua stein <jcs@jcs.org> Fixes golang/go#19567 Change-Id: I68944a7f4711c0623759f6a59023e8e45a8781aa Reviewed-on: https://go-review.googlesource.com/65271 Reviewed-by: Han-Wen Nienhuys <hanwen@google.com> Run-TryBot: Han-Wen Nienhuys <hanwen@google.com>
2017-08-07ssh: fix documentation on ServerConfig.PublicKeyCallbackArtyom Pervukhin
Fix leftovers from the old days to match today's method signature. Fixes golang/go#21325 Change-Id: Iac5d49bc7cf9e80d07e21148b5e6e1b9bbb59d74 Reviewed-on: https://go-review.googlesource.com/53472 Reviewed-by: Han-Wen Nienhuys <hanwen@google.com> Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
2017-07-03ssh: return authErr array if all authentication attempts failSpencer Tung
Change-Id: I4d6cab266410a8c7960073665eddf8935693087f Reviewed-on: https://go-review.googlesource.com/44332 Reviewed-by: Han-Wen Nienhuys <hanwen@google.com> Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
2017-06-19ssh: clarify intended use of Permissions.Han-Wen Nienhuys
The Permissions struct should be used to pass information from authentication callback to server application. Fixes golang/go#20094. Change-Id: I5542b657d053452327260707a24925286546bfdd Reviewed-on: https://go-review.googlesource.com/45311 Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2017-05-08ssh: change the local copy of the ServerConfig passed to NewServerConnCatalin Nicutar
Otherwise callers are forced to serialize access to the ServerConfig. Change-Id: Id36f4d2877ea28b18447ef777d3839b21136c22f Reviewed-on: https://go-review.googlesource.com/42821 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
2017-04-10ssh: support MaxAuthTries on ServerConfigJames Myers
This change breaks backwards compatibility. MaxAuthTries specifies the maximum number of authentication attempts permitted per connection. If set to a negative number, the server will allow unlimited authentication attempts. MaxAuthTries defaults to 6 if not specified, which is a backwards incompatible change. On exceeding maximum authentication attempts, the server will send a disconnect message to the client. This configuration property mirrors a similar property in sshd_config and prevents bad actors from continuously trying authentication. Change-Id: Ic77d2c29ee2fd2ae5c764becf7df91d29d03131b Reviewed-on: https://go-review.googlesource.com/35230 Reviewed-by: Han-Wen Nienhuys <hanwen@google.com> Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
2017-02-02ssh: Support multiple source-addresses, don't require IPv4 in tests.Heschi Kreinick
The ssh tests currently require 127.0.0.1 to work which isn't necessarily available everywhere. To fix the source-address tests, support comma-separated source-address values per the PROTOCOL.certkeys file: Comma-separated list of source addresses from which this certificate is accepted for authentication. Addresses are specified in CIDR format (nn.nn.nn.nn/nn or hhhh::hhhh/nn). If this option is not present then certificates may be presented from any source address. Change-Id: I87536ff81ffa005c073da103021ebc0dfb12b620 Reviewed-on: https://go-review.googlesource.com/36110 Reviewed-by: Han-Wen Nienhuys <hanwen@google.com> Run-TryBot: Heschi Kreinick <heschi@google.com>
2017-01-16ssh: rewrite (re)keying logic.Han-Wen Nienhuys
Use channels and a dedicated write loop for managing the rekeying process. This lets us collect packets to be written while a key exchange is in progress. Previously, the read loop ran the key exchange, and writers would block if a key exchange was going on. If a reader wrote back a packet while processing a read packet, it could block, stopping the read loop, thus causing a deadlock. Such coupled read/writes are inherent with handling requests that want a response (eg. keepalive, opening/closing channels etc.). The buffered channels (most channels have capacity 16) papered over these problems, but under load SSH connections would occasionally deadlock. Fixes #18439. Change-Id: I7c14ff4991fa3100a5d36025125d0cf1119c471d Reviewed-on: https://go-review.googlesource.com/35012 Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Han-Wen Nienhuys <hanwen@google.com>
2016-12-15crypto/ssh: use net.IP.Equal instead of bytes.EqualPéter Szilágyi
A net.IP may be represented by both by a 4 as well as a 16 byte long byte slice. Because of this, it is not safe to compare IP addresses using bytes.Equal as the same IP address using a different internal representation will produce mismatches. Change-Id: I0d228771cf363ccfb9532f8bc2a2fc8eff61f6e9 Reviewed-on: https://go-review.googlesource.com/34450 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
2016-08-24crypto/ssh: keep user in ConnMetadata if NoClientAuth is usedSven Blumenstein
The current behaviour of the crypto/ssh server implementation is to remove the username from ConnMetadata if the connection is done without authentication (NoClientAuth). This appears to be a bug. This behaviour is different from other SSH server implementations like for example Paramiko (Python) which keeps the username. Additionally RFC4252 (https://www.ietf.org/rfc/rfc4252.txt) section 5 states the username has to be included in every USERAUTH message. Change-Id: I27fa50db92eb535e90fe088453faa6f2a76ee31f Reviewed-on: https://go-review.googlesource.com/27612 Reviewed-by: Han-Wen Nienhuys <hanwen@google.com> Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
2016-05-12x/crypto/ssh: add support for ed25519 keysMartin Garton
Added support for parsing the "new" openssh private key format. (ed25519 keys only in this format for now) Signing and verifying functions now work with ed25519 keys. ed25519 can now be accepted by the server to authenticate a client. ed25519 can now be accepted by a client as a server host key. Related documentation used: https://www.ietf.org/archive/id/draft-bjh21-ssh-ed25519-02.txt Change-Id: I84385f24d666fea08de21f980f78623f7bff8007 Reviewed-on: https://go-review.googlesource.com/22512 Reviewed-by: Han-Wen Nienhuys <hanwen@google.com> Run-TryBot: Han-Wen Nienhuys <hanwen@google.com>
2016-05-10x/crypto/ssh: hide msgNewKeys in the transport layer.Han-Wen Nienhuys
This ensures that extraneous key exchanges cannot confuse application level code. Change-Id: I1a333e2b7b46f1e484406a79db7a949294e79c6d Reviewed-on: https://go-review.googlesource.com/22417 Reviewed-by: Han-Wen Nienhuys <hanwen@google.com> Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> Reviewed-by: Adam Langley <agl@golang.org>
2016-04-12x/crypto/ssh: make sure the initial key exchange happens once.Han-Wen Nienhuys
This is done by running the key exchange and setting the session ID under mutex. If the first exchange encounters an already set session ID, then do nothing. This fixes a race condition: On setting up the connection, both sides sent a kexInit to initiate the first (mandatory) key exchange. If one side was faster, the faster side might have completed the key exchange, before the slow side had a chance to send a kexInit. The slow side would send a kexInit which would trigger a second key exchange. The resulting confirmation message (msgNewKeys) would confuse the authentication loop. This fix removes sessionID from the transport struct. This fix also deletes the unused interface rekeyingTransport. Fixes #15066 Change-Id: I7f303bce5d3214c9bdd58f52d21178a185871d90 Reviewed-on: https://go-review.googlesource.com/21606 Reviewed-by: Adam Langley <agl@golang.org> Reviewed-by: Han-Wen Nienhuys <hanwen@google.com>
2015-09-28x/crypto/ssh: Add protocol version to ServerVersionLewin Bormann
280be00 introduced custom server versions; however, at least OpenSSH clients do not accept a server version that doesn't start with a protocol version like "SSH-2.0-"; this is not documented in this library, and automatically adding it in case that the user did not does no harm. Change-Id: Iafc23b23160a8277b10cbf29778dc64a96351bd7 Reviewed-on: https://go-review.googlesource.com/14018 Reviewed-by: Adam Langley <agl@golang.org>
2015-05-11x/crypto/ssh: bail early if a server has no auth methods configured.Han-Wen Nienhuys
Change-Id: I58fdfbe00fcc4ca09da9699edcc181cc512feef7 Reviewed-on: https://go-review.googlesource.com/9807 Reviewed-by: JP Sugarbroad <jpsugar@google.com> Reviewed-by: Adam Langley <agl@golang.org>
2015-02-04ssh: return session ID in ConnMeta.SessionID.Han-Wen Nienhuys
SessionID() returned nil previously. Fixes #9761. Change-Id: I53d2b347571d21eab2d913c2228e85997a84f757 Reviewed-on: https://go-review.googlesource.com/3872 Reviewed-by: Adam Langley <agl@golang.org>
2015-01-06ssh: add ServerConfig.ServerVersion optionKristopher Watts
The SSH server does not allow for setting a version string in the same manner as the client. This update adds a ServerVersion member to the ServerConfig structure which when set, causes the server to use that member instead of the default version string. This allows building an golang based SSH server which can present any version string the user wishes. It also adds an else statement to the client assignment of the ClientVersion to avoid an allocation when using a user defined ClientVersion. Change-Id: I43d97cfd5a174f2c68f53c5b4e267539ef21937b Reviewed-on: https://go-review.googlesource.com/1860 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2014-05-12go.crypto/ssh: use permissions from public key cache when accepting a key.Adam Langley
Fixes golang/go#7913. LGTM=hanwen R=hanwen CC=golang-codereviews https://golang.org/cl/96220043
2014-04-09go.crypto/ssh: import gosshnew.Adam Langley
See https://groups.google.com/d/msg/Golang-nuts/AoVxQ4bB5XQ/i8kpMxdbVlEJ R=hanwen CC=golang-codereviews https://golang.org/cl/86190043
2013-10-25go.crypto/ssh: in {Server,Client}Conn, read session ID fromHan-Wen Nienhuys
transport layer. R=agl, dave CC=golang-dev https://golang.org/cl/15870044
2013-10-25go.crypto/ssh: ensure {Server,Client}Conn do not expose io.ReadWriterDave Cheney
Transport should not be a ReadWriter. It can only write packets, i.e. no partial reads or writes. Furthermore, you can currently do ClientConn.Write() while the connection is live, which sends raw bytes over the connection. Doing so will confuse the transports because the data is not encrypted. As a consequence, ClientConn and ServerConn stop being a net.Conn Finally, ensure that {Server,Client}Conn implement LocalAddr and RemoteAddr methods that previously were exposed by an embedded net.Conn field. R=hanwen CC=golang-dev https://golang.org/cl/16610043
2013-10-17go.crypto/ssh: put version exchange in functionHan-Wen Nienhuys
R=golang-dev, dave, jpsugar, agl CC=golang-dev https://golang.org/cl/14641044
2013-10-10go.crypto/ssh: cosmetic only spelling fixesJonathan Pittman
R=agl, hanwen CC=dave, golang-dev, jpsugar https://golang.org/cl/14430055
generated by cgit v1.3 (git 2.53.0) at 2026-04-15 05:02:01 +0000