aboutsummaryrefslogtreecommitdiff
path: root/ssh
AgeCommit message (Collapse)Author
2023-08-28crypto/ssh: return error from NewClientConn with "%w"client-wrap-error.mailedShulhan
By returning error with %w, the caller can check and convert the error using errors.As, for example to knownhosts.KeyError. Change-Id: I0529e2e935cd8075f87aa6f6049cee3323f82c06
2023-07-31ssh: fix call to Fatalf from a non-test goroutineNicola Murino
Also fix some redundant type declarations. Change-Id: Iad2950b67b1ec2e2590c59393b8ad15421ed3add GitHub-Last-Rev: 41cf552f11387208491dee7b867050475043b25e GitHub-Pull-Request: golang/crypto#263 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/505798 Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Reviewed-by: David Chase <drchase@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Auto-Submit: Dmitri Shuralyov <dmitshur@google.com> Reviewed-by: Filippo Valsorda <filippo@golang.org> Run-TryBot: Filippo Valsorda <filippo@golang.org>
2023-07-31ssh: add diffie-hellman-group16-sha512 kexNicola Murino
This group is disabled by default because it is a bit slower than the others. The group18-sha512 variant is too slow to include. Benchstat results including diffie-hellman-group18-sha512: name time/op Kexes/diffie-hellman-group-exchange-sha256-12 22.6ms ± 9% Kexes/diffie-hellman-group18-sha512-12 1.15s ±11% Kexes/ecdh-sha2-nistp384-12 3.91ms ± 6% Kexes/ecdh-sha2-nistp256-12 304µs ± 5% Kexes/curve25519-sha256@libssh.org-12 413µs ± 7% Kexes/ecdh-sha2-nistp521-12 11.6ms ±13% Kexes/curve25519-sha256-12 361µs ± 5% Kexes/diffie-hellman-group-exchange-sha1-12 22.9ms ± 9% Kexes/diffie-hellman-group1-sha1-12 3.59ms ± 6% Kexes/diffie-hellman-group14-sha1-12 22.1ms ±11% Kexes/diffie-hellman-group14-sha256-12 21.6ms ± 8% Kexes/diffie-hellman-group16-sha512-12 138ms ± 9% name alloc/op Kexes/diffie-hellman-group-exchange-sha256-12 67.8kB ± 1% Kexes/diffie-hellman-group18-sha512-12 243kB ± 9% Kexes/ecdh-sha2-nistp384-12 13.9kB ± 0% Kexes/ecdh-sha2-nistp256-12 12.1kB ± 0% Kexes/curve25519-sha256@libssh.org-12 8.22kB ± 0% Kexes/ecdh-sha2-nistp521-12 16.5kB ± 0% Kexes/curve25519-sha256-12 8.22kB ± 0% Kexes/diffie-hellman-group-exchange-sha1-12 67.5kB ± 0% Kexes/diffie-hellman-group1-sha1-12 34.9kB ± 0% Kexes/diffie-hellman-group14-sha1-12 61.9kB ± 0% Kexes/diffie-hellman-group14-sha256-12 62.0kB ± 0% Kexes/diffie-hellman-group16-sha512-12 117kB ± 0% name allocs/op Kexes/diffie-hellman-group-exchange-sha256-12 314 ± 0% Kexes/diffie-hellman-group18-sha512-12 271 ± 4% Kexes/ecdh-sha2-nistp384-12 243 ± 0% Kexes/ecdh-sha2-nistp256-12 213 ± 0% Kexes/curve25519-sha256@libssh.org-12 168 ± 0% Kexes/ecdh-sha2-nistp521-12 245 ± 0% Kexes/curve25519-sha256-12 168 ± 0% Kexes/diffie-hellman-group-exchange-sha1-12 314 ± 0% Kexes/diffie-hellman-group1-sha1-12 255 ± 0% Kexes/diffie-hellman-group14-sha1-12 255 ± 0% Kexes/diffie-hellman-group14-sha256-12 255 ± 0% Kexes/diffie-hellman-group16-sha512-12 256 ± 0% Change-Id: Id119401fda7e417675325f37e3d442e70585206c Reviewed-on: https://go-review.googlesource.com/c/crypto/+/506839 Run-TryBot: Filippo Valsorda <filippo@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Cherry Mui <cherryyz@google.com> Auto-Submit: Filippo Valsorda <filippo@golang.org> Reviewed-by: David Chase <drchase@google.com> Reviewed-by: Filippo Valsorda <filippo@golang.org>
2023-07-31ssh: ignore invalid MACs and KEXs just like we do for ciphersNicola Murino
Tighter validation could cause backwards incompatibility issues, eg configurations with valid and invalid MACs, KEXs, ciphers currently work if a supported algorithm is negotiated and that's also the scenario of removing support for an existing algorithm. Fixes golang/go#39397 Change-Id: If90253ba89e1d8f732cc1e1c3d24fe0a1e2dac71 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/512175 Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> Reviewed-by: Filippo Valsorda <filippo@golang.org> Reviewed-by: Han-Wen Nienhuys <hanwen@google.com> Auto-Submit: Filippo Valsorda <filippo@golang.org> Reviewed-by: David Chase <drchase@google.com> TryBot-Result: Gopher Robot <gobot@golang.org>
2023-07-14ssh: prefer sha256 based RSA key algorithmsNicola Murino
sha256 is more optimized than sha512 in Go and is secure enough so prefer sha256 over sha512. Change-Id: I3fcf7457791e3ef4539e97049aa905dcd293499d Reviewed-on: https://go-review.googlesource.com/c/crypto/+/507556 Reviewed-by: Filippo Valsorda <filippo@golang.org> Reviewed-by: Cherry Mui <cherryyz@google.com> Run-TryBot: Filippo Valsorda <filippo@golang.org> Auto-Submit: Filippo Valsorda <filippo@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Roland Shoemaker <roland@golang.org>
2023-07-13ssh: disable client agent tests on WindowsNicola Murino
ssh-agent is implemented as a Windows service and exposed on a named pipe. We don't currently support it. See golang/go#60981 Change-Id: Iebdc42db30b37a87ac0766231b16aff3f17b3f56 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/509035 Run-TryBot: Heschi Kreinick <heschi@google.com> Reviewed-by: Cherry Mui <cherryyz@google.com> Reviewed-by: Heschi Kreinick <heschi@google.com> Auto-Submit: Heschi Kreinick <heschi@google.com> TryBot-Result: Gopher Robot <gobot@golang.org>
2023-07-11fix TestValidTerminalMode: missing output from echo SHELL $SHELLBoshi Lian
add leading `echo` to have better compatibility before ``` go test -run ^TestValidTerminalMode -v === RUN TestValidTerminalMode session_test.go:261: echo SHELL $SHELL && stty -a && exit: Last login: Thu Jul 6 12:24:38 2023 from 192.168.200.1 SHELL /bin/bashubuntu:~$ speed 38400 baud; rows 80; columns 40; line = 0; intr = ^C; quit = ^\; erase = ^?; kill = ^U; eof = ^D; eol = <undef>; eol2 = <undef>; swtch = <undef>; start = ^Q; stop = ^S; susp = ^Z; rprnt = ^R; werase = ^W; lnext = ^V; discard = ^O; min = 1; time = 0; -parenb -parodd -cmspar cs8 -hupcl -cstopb cread -clocal -crtscts -ignbrk -brkint -ignpar -parmrk -inpck -istrip -inlcr -igncr icrnl ixon -ixoff -iuclc -ixany -imaxbel -iutf8 opost -olcuc -ocrnl onlcr -onocr -onlret -ofill -ofdel nl0 cr0 tab0 bs0 vt0 ff0 isig icanon iexten -echo echoe echok -echonl -noflsh -xcase -tostop -echoprt echoctl echoke -flusho -extproc logout session_test.go:266: missing output from echo SHELL $SHELL ``` after ``` go test -run ^TestValidTerminalMode -v === RUN TestValidTerminalMode session_test.go:261: echo SHELL $SHELL && stty -a && exit: Last login: Thu Jul 6 12:24:38 2023 from 192.168.200.1 bolian@ubuntu:~$ SHELL /bin/bash speed 38400 baud; rows 80; columns 40; line = 0; intr = ^C; quit = ^\; erase = ^?; kill = ^U; eof = ^D; eol = <undef>; eol2 = <undef>; swtch = <undef>; start = ^Q; stop = ^S; susp = ^Z; rprnt = ^R; werase = ^W; lnext = ^V; discard = ^O; min = 1; time = 0; -parenb -parodd -cmspar cs8 -hupcl -cstopb cread -clocal -crtscts -ignbrk -brkint -ignpar -parmrk -inpck -istrip -inlcr -igncr icrnl ixon -ixoff -iuclc -ixany -imaxbel -iutf8 opost -olcuc -ocrnl onlcr -onocr -onlret -ofill -ofdel nl0 cr0 tab0 bs0 vt0 ff0 isig icanon iexten -echo echoe echok -echonl -noflsh -xcase -tostop -echoprt echoctl echoke -flusho -extproc logout --- PASS: TestValidTerminalMode (0.06s) ``` Change-Id: If60c040edb8c78a7d86bf58a6be47636d9e8f173 GitHub-Last-Rev: a2cc1b1af09e47df82fcb8685d829dfed945e8b0 GitHub-Pull-Request: golang/crypto#264 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/508115 Reviewed-by: Heschi Kreinick <heschi@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Run-TryBot: Heschi Kreinick <heschi@google.com> Auto-Submit: Heschi Kreinick <heschi@google.com> Reviewed-by: Bryan Mills <bcmills@google.com>
2023-07-10ssh: fix RSA certificate and public key authentication with older clientsNicola Murino
After adding support for rsa-sha2-256/512 on the server side some edge cases started to arise with old clients: 1) public key authentication with gpg-agent < 2.2.6 fails because we receive ssh-rsa as signature format and rsa-sha2-256 or rsa-sha2-512 as algorithm. This is a bug in gpg-agent fixed in this commit: https://github.com/gpg/gnupg/commit/80b775bdbb852aa4a80292c9357e5b1876110c00 2) certificate authentication fails with OpenSSH 7.2-7.7 because we receive ssh-rsa-cert-v01@openssh.com as algorithm and rsa-sha2-256 or rsa-sha2-512 as signature format. This patch is based on CL 412854 and has been tested with every version of OpenSSH from 7.1 to 7.9 and OpenSSH 9.3. Fixes golang/go#53391 Change-Id: Id71f596f73d84efb5c76d6d5388432cccad3e3b1 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/506835 Auto-Submit: Filippo Valsorda <filippo@golang.org> Reviewed-by: Filippo Valsorda <filippo@golang.org> Run-TryBot: Filippo Valsorda <filippo@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Roland Shoemaker <roland@golang.org>
2023-07-05ssh: prefer sha256 based MAC algorithmsNicola Murino
sha256 is more optimized than sha512 in Go and is secure enough so prefer sha256 over sha512. Fixes golang/go#61138 Change-Id: I7658808655367f1ab5f4ac8b52e6b20bd30ebf87 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/507555 Run-TryBot: Filippo Valsorda <filippo@golang.org> Reviewed-by: Filippo Valsorda <filippo@golang.org> Auto-Submit: Filippo Valsorda <filippo@golang.org> Reviewed-by: Joedian Reid <joedian@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
2023-06-22ssh: add hmac-sha2-512Stan Hu
This adds support for hmac-sha2-512 to ensure compatibility with SSH clients that request this MAC algorithm. This rebases https://github.com/golang/crypto/pull/18. Change-Id: Ia103c10a8b7e2e8dde556d5c36550eb5fa6bc1f6 GitHub-Last-Rev: 987ccae2bc7ae5e90a482d8797351c39dcb9bf33 GitHub-Pull-Request: golang/crypto#257 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/501455 Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Commit-Queue: Han-Wen Nienhuys <hanwen@google.com> Auto-Submit: Dmitri Shuralyov <dmitshur@google.com> Reviewed-by: Han-Wen Nienhuys <hanwen@google.com> Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gopher Robot <gobot@golang.org>
2023-06-15ssh/test: set a timeout and WaitDelay on sshd subcommandsBryan C. Mills
This uses a copy of testenv.Command copied from the main repo, with light edits to allow the testenv helpers to build with Go 1.19. The testenv helper revealed an exec.Command leak in TestCertLogin, so we also fix that leak and simplify server cleanup using testing.T.Cleanup. For golang/go#60099. Fixes golang/go#60343. Change-Id: I7f79fcdb559498b987ee7689972ac53b83870aaf Reviewed-on: https://go-review.googlesource.com/c/crypto/+/496935 Auto-Submit: Bryan Mills <bcmills@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Roland Shoemaker <roland@golang.org> Run-TryBot: Bryan Mills <bcmills@google.com>
2023-06-05Add support for "hmac-sha2-512-etm@openssh.com"Stefan Klein
Change-Id: I0203881afd7ad72e68f76650817451d7e292c91b GitHub-Last-Rev: 42b4119e1987e7a46aa06a2b142d5fd3ef6f216a GitHub-Pull-Request: golang/crypto#129 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/226982 Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> Reviewed-by: Han-Wen Nienhuys <hanwen@google.com> Auto-Submit: Han-Wen Nienhuys <hanwen@google.com> Reviewed-by: David Chase <drchase@google.com> TryBot-Result: Gopher Robot <gobot@golang.org>
2023-05-04ssh/test: enable on solarisTobias Klauser
Change-Id: Icf9c867e64ef68f6f46dd7d4cec07cf7c315c2ad Reviewed-on: https://go-review.googlesource.com/c/crypto/+/490155 Reviewed-by: Bryan Mills <bcmills@google.com> Reviewed-by: Ian Lance Taylor <iant@google.com> Run-TryBot: Tobias Klauser <tobias.klauser@gmail.com> TryBot-Result: Gopher Robot <gobot@golang.org> Auto-Submit: Tobias Klauser <tobias.klauser@gmail.com>
2023-04-18ssh: skip unsupported tests on wasip1Tobias Klauser
Updates golang/go#32840 Updates golang/go#58141 Change-Id: Ib4425c1743d417920745205586af250dbf80c7e4 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/485695 Auto-Submit: Tobias Klauser <tobias.klauser@gmail.com> Reviewed-by: Bryan Mills <bcmills@google.com> Run-TryBot: Tobias Klauser <tobias.klauser@gmail.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Ian Lance Taylor <iant@google.com>
2023-04-17ssh/test: skip TestValidTerminalMode on non-Bourne shellsBryan C. Mills
Fixes golang/go#38037. Change-Id: Ide77dddc9f57b3f0318a419a1474e11215623b64 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/485175 Run-TryBot: Bryan Mills <bcmills@google.com> Commit-Queue: Bryan Mills <bcmills@google.com> Auto-Submit: Bryan Mills <bcmills@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Roland Shoemaker <roland@golang.org>
2023-03-20all: fix some commentscui fliter
Change-Id: Ia0410f1f3bb0a9ee68c6dbe1e6f62f65f9e00955 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/477755 Reviewed-by: Ian Lance Taylor <iant@google.com> Auto-Submit: Ian Lance Taylor <iant@google.com> Reviewed-by: Roland Shoemaker <roland@golang.org> Auto-Submit: Roland Shoemaker <roland@golang.org> Run-TryBot: shuang cui <imcusg@gmail.com> Run-TryBot: Ian Lance Taylor <iant@google.com> TryBot-Result: Gopher Robot <gobot@golang.org>
2023-03-13ssh: document that ParseRawPrivateKey supports Ed25519 keysAnmol Sethi
From CL 173457 and CL 235358. Change-Id: Ia46ab9c7e2c57472df3126ddc7050f0068fcaab9 GitHub-Last-Rev: c38e379355602fe4ff11ff65f98c296d5c326281 GitHub-Pull-Request: golang/crypto#146 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/241282 Auto-Submit: Han-Wen Nienhuys <hanwen@google.com> Reviewed-by: Bryan Mills <bcmills@google.com> Reviewed-by: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Run-TryBot: Han-Wen Nienhuys <hanwen@google.com>
2023-02-15ssh: add support for aes256-gcm@openssh.comNicola Murino
Change-Id: I91caf3bda3dfd00c050f5ebf23c2a35a04c5762b GitHub-Last-Rev: 6e71340e7960b5b6f71f7b96eeeaf8dfb268e306 GitHub-Pull-Request: golang/crypto#127 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/223518 Auto-Submit: Filippo Valsorda <filippo@golang.org> Run-TryBot: Filippo Valsorda <filippo@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Roland Shoemaker <roland@golang.org> Reviewed-by: Filippo Valsorda <filippo@golang.org> Reviewed-by: Han-Wen Nienhuys <hanwen@google.com>
2023-01-30all: fix some commentscui fliter
Change-Id: I11030ee466c8cac6855ce4fe2cf72e0b8d7029f8 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/463796 Auto-Submit: Ian Lance Taylor <iant@google.com> Reviewed-by: Michael Knyszek <mknyszek@google.com> Run-TryBot: Ian Lance Taylor <iant@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Ian Lance Taylor <iant@google.com>
2022-12-12ssh: ensure that handshakeTransport goroutines have finished before Close ↵Bryan C. Mills
returns This fixes a data race in the tests for x/crypto/ssh, which expects to be able to examine a transport's read and write counters without locking after closing it. (Given the number of goroutines, channels, and mutexes used in this package, I wouldn't be surprised if other concurrency bugs remain. I would suggest simplifying the concurrency in this package, but I don't intend to follow up on that myself at the moment.) Fixes golang/go#56957. Change-Id: Ib1f1390b66707c66a3608e48f3f52483cff3c1f5 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/456758 Reviewed-by: Roland Shoemaker <roland@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Auto-Submit: Bryan Mills <bcmills@google.com> Run-TryBot: Bryan Mills <bcmills@google.com>
2022-11-12ssh: support rsa-sha2-256/512 on the server sideFilippo Valsorda
This lets clients know we support rsa-sha2-256/512 signatures from ssh-rsa public keys. OpenSSH prefers to break the connection rather than attempting trial and error, apparently. We don't enable support for the "ext-info-s" because we're not interested in any client->server extensions. This also replaces isAcceptableAlgo which was rejecting the rsa-sha2-256/512-cert-v01@openssh.com public key algorithms. Tested with OpenSSH 9.1 on macOS Ventura. Fixes golang/go#49269 Updates golang/go#49952 Co-authored-by: Nicola Murino <nicola.murino@gmail.com> Co-authored-by: Kristin Davidson <kdavidson@atlassian.com> Change-Id: I4955c3b12bb45575e9977ac657bb5805b49d00c3 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/447757 Run-TryBot: Filippo Valsorda <filippo@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Roland Shoemaker <roland@golang.org> Reviewed-by: Nicola Murino <nicola.murino@gmail.com> Reviewed-by: Michael Knyszek <mknyszek@google.com>
2022-11-04ssh: fix typoPark Zhou
Change-Id: I560d7f5a62161cd88361a9fe9982d36f8e25e5af Reviewed-on: https://go-review.googlesource.com/c/crypto/+/447475 Reviewed-by: Ian Lance Taylor <iant@google.com> Auto-Submit: Ian Lance Taylor <iant@google.com> Reviewed-by: Than McIntosh <thanm@google.com> Run-TryBot: Ian Lance Taylor <iant@google.com> TryBot-Result: Gopher Robot <gobot@golang.org>
2022-10-12all: use automatic RFC linkingAxel Wagner
pkgsite automatically links /RFC \d+/ to the mentioned RFC. Insert a bunch of spaces into doc-comments for that to match. Change-Id: I01834d7573428563f21c37e43316442e148dd8c4 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/442055 Reviewed-by: Joedian Reid <joedian@golang.org> Run-TryBot: Ian Lance Taylor <iant@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Ian Lance Taylor <iant@google.com> Auto-Submit: Ian Lance Taylor <iant@google.com>
2022-10-12all: fix a few function names on commentscui fliter
Change-Id: Iac9c8f06b874e62b56f634dede8757b87514f421 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/442135 Run-TryBot: Ian Lance Taylor <iant@google.com> Auto-Submit: Ian Lance Taylor <iant@google.com> Reviewed-by: Ian Lance Taylor <iant@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Joedian Reid <joedian@golang.org>
2022-10-10ssh: add ServerConfig.NoClientAuthCallbackBrad Fitzpatrick
It was possible to accept auth type "none" before, but not dynamically at runtime as a function of the ConnMetadata like the other auth types' callback hooks. Fixes golang/go#51994 Change-Id: I83ea80901d4977d8f78523e3d1e16e0a7df5b172 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/395314 Reviewed-by: Roland Shoemaker <roland@golang.org> Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Julie Qiu <julieqiu@google.com>
2022-10-05all: replace bytes.Compare with bytes.Equalcui fliter
Change-Id: I911366b91ff2a1d02d7de202a166d876fb873142 GitHub-Last-Rev: f50e00376856fb9da36bb98ed0cdfd96c2f3b304 GitHub-Pull-Request: golang/crypto#233 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/438536 TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Reviewed-by: Ian Lance Taylor <iant@google.com> Run-TryBot: Ian Lance Taylor <iant@google.com> Auto-Submit: Ian Lance Taylor <iant@google.com>
2022-09-19all: replace io/ioutil with io and os packagecui fliter
For golang/go#45557 Change-Id: I447530cc66896aef7a8d528ccb8d095b80e3cf47 GitHub-Last-Rev: 5f385ff46487ac318bd1147cdbbd26bb0ffd0426 GitHub-Pull-Request: golang/crypto#230 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/430797 Auto-Submit: Ian Lance Taylor <iant@google.com> Reviewed-by: Ian Lance Taylor <iant@google.com> Reviewed-by: Meng Zhuo <mzh@golangcn.org> Run-TryBot: Ian Lance Taylor <iant@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Cherry Mui <cherryyz@google.com>
2022-08-26ssh/agent: match OpenSSH extensionAgentMsg, not IETF draftedef
The OpenSSH wire format just suffixes the raw extension body, without a nested string. Fixes golang/go#51689 Change-Id: Ic224cedb934ba0563abca9a45a6be1c67769ed6d Reviewed-on: https://go-review.googlesource.com/c/crypto/+/412154 Reviewed-by: Roland Shoemaker <roland@golang.org> Run-TryBot: Filippo Valsorda <filippo@golang.org> Run-TryBot: hopehook <hopehook@qq.com> Reviewed-by: Daniel Lublin <daniel@lublin.se> Auto-Submit: Filippo Valsorda <filippo@golang.org> Reviewed-by: Filippo Valsorda <filippo@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: David Chase <drchase@google.com>
2022-05-13ssh/agent: fix non-RSA certificatesFilippo Valsorda
The type of ssh.PublicKey.Type can be a certificate type, while the algorithm passed to SignWithAlgorithm is going to be an underlying algorithm. Fixes golang/go#52185 Change-Id: I0f7c46defa83d1fd64a3c1e861734650b20cca21 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/404614 TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Heschi Kreinick <heschi@google.com> Reviewed-by: Roland Shoemaker <roland@golang.org> Auto-Submit: Filippo Valsorda <filippo@golang.org> Run-TryBot: Filippo Valsorda <filippo@golang.org>
2022-04-11all: gofmtRuss Cox
Gofmt to update doc comments to the new formatting. For golang/go#51082. Change-Id: I076031b6613691eefbb0f21739366e3fd2011ec9 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/399356 Run-TryBot: Russ Cox <rsc@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Auto-Submit: Russ Cox <rsc@golang.org> Reviewed-by: Ian Lance Taylor <iant@google.com>
2022-03-21ssh: send ext-info-c only oncePeter Verraedt
In accordance to RFC8308, send ext-info-c only during the first key exchange. Some server implementations such as OpenSSH 7 will send an extInfoMsg message each time when ext-info-c is received. This results in a closed connection, as our client does not expect this message while handling the mux. See https://bugzilla.mindrot.org/show_bug.cgi?id=2929 regarding the behaviour of OpenSSH if it sees ext-info-c in later key exchanges. Fixes golang/go#51808 Change-Id: Id94f1ef73cec6147136246b0b6048b57db92660d GitHub-Last-Rev: fcfe5ed37306136219854031abc809e0dc9b3124 GitHub-Pull-Request: golang/crypto#208 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/394134 Reviewed-by: Filippo Valsorda <filippo@golang.org> Run-TryBot: Filippo Valsorda <filippo@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Trust: Roland Shoemaker <roland@golang.org>
2022-03-15ssh: support rsa-sha2-256/512 for client certificatesFilippo Valsorda
The server-sig-algs logic was not working for certificate algorithms. Follow-up on CL 392394. Tested with OpenSSH 8.8 configured with PubkeyAcceptedKeyTypes -ssh-rsa-cert-v01@openssh.com Updates golang/go#39885 For golang/go#49952 Change-Id: Ic230dd6f98e96b7938acbd0128ab37d33b70abe5 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/392974 Trust: Filippo Valsorda <filippo@golang.org> Run-TryBot: Filippo Valsorda <filippo@golang.org> Reviewed-by: Roland Shoemaker <roland@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org>
2022-03-14ssh: support rsa-sha2-256/512 for client authenticationFilippo Valsorda
CL 220037 had implemented support for host authentication using rsa-sha2-256/512, but not client public key authentication. OpenSSH disabled the SHA-1 based ssh-rsa by default in version 8.8 (after pre-announcing it in versions 8.2, 8.3, 8.4, 8.5, 8.6, and 8.7) although some distributions re-enable it. GitHub will start rejecting ssh-rsa for keys uploaded before November 2, 2021 on March 15, 2022. https://github.blog/2021-09-01-improving-git-protocol-security-github/ The server side already worked, as long as the client selected one of the SHA-2 algorithms, because the signature flowed freely to Verify. There was however nothing verifying that the signature algorithm matched the advertised one. The comment suggested the check was being performed, but it got lost back in CL 86190043. Not a security issue because the signature had to pass the callback's Verify method regardless, and both values were checked to be acceptable. Tested with OpenSSH 8.8 configured with "PubkeyAcceptedKeyTypes -ssh-rsa" and no application-side changes. The Signers returned by ssh/agent (when backed by an agent client) didn't actually implement AlgorithmSigner but ParameterizedSigner, an interface defined in an earlier version of CL 123955. Updates golang/go#49269 Fixes golang/go#39885 For golang/go#49952 Change-Id: I13b41db8041f1112a70f106c55f077b904b12cb8 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/392394 Trust: Filippo Valsorda <filippo@golang.org> Run-TryBot: Filippo Valsorda <filippo@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Roland Shoemaker <roland@golang.org>
2022-03-14ssh: send (and rename) keyboard-interactive name field to the clientFilippo Valsorda
The server side implementation was not actually populating the SSH_MSG_USERAUTH_INFO_REQUEST field with the KeyboardInteractiveChallenge argument, although the client side was deserializing it and passing it to the KeyboardInteractiveChallenge callback. Anyway, the first field of SSH_MSG_USERAUTH_INFO_REQUEST is "name", not "user". Maybe the confusion was due to the first field of SSH_MSG_USERAUTH_REQUEST being the user. RFC 4256, Section 3.3, says this about it One possibility is to use the name field (possibly prefixed with the application's name) as the title of a dialog window in which the prompt(s) are presented. and examples include "CRYPTOCard Authentication", "Password Authentication", and "Password Expired". Co-authored-by: Kevin Wallace <kevin@pentabarf.net> Change-Id: Ic6ec0dfea2122704603c44f42898a980689a15c9 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/372234 Trust: Filippo Valsorda <filippo@golang.org> Run-TryBot: Filippo Valsorda <filippo@golang.org> Reviewed-by: Roland Shoemaker <roland@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org>
2022-03-14ssh: don't advertise rsa-sha2 algorithms if we can't use themFilippo Valsorda
The server implementation looks at the HostKeys to advertise and negotiate host key signature algorithms. A fundamental issue of the Signer and AlgorithmSigner interfaces is that they don't expose the supported signature algorithms, so really the server has to guess. Currently, it would guess exclusively based on the PublicKey.Type, regardless of whether the host key implemented AlgorithmSigner. This means that a legacy Signer that only supports ssh-rsa still led the server to negotiate rsa-sha2 algorithms. The server would then fail to find a suitable host key to make the signature and crash. This won't happen if only Signers from this package are used, but if a custom Signer that doesn't support SignWithAlgorithm() but returns "ssh-rsa" from PublicKey().Type() is used as a HostKey, the server is vulnerable to DoS. The only workable rules to determine what to advertise seems to be: 1. a pure Signer will always Sign with the PublicKey.Type 2. an AlgorithmSigner supports all algorithms associated with the PublicKey.Type Rule number two means that we can't add new supported algorithms in the future, which is not great, but it's too late to fix that. rsaSigner was breaking rule number one, and although it would have been fine where it's used, I didn't want to break our own interface contract. It's unclear why we had separate test key entries for rsa-sha2 algorithms, since we can use the ssh-rsa key for those. The only test that used them, TestCertTypes, seemed broken: the init was actually failing at making the corresponding signers rsaSigners, and indeed the test for the SHA-256 signer expected and checked a SHA-512 signature. Pending CVE For golang/go#49952 Change-Id: Ie658eefcadd87906e63fc7faae8249376aa96c79 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/392355 Trust: Filippo Valsorda <filippo@golang.org> Run-TryBot: Filippo Valsorda <filippo@golang.org> Reviewed-by: Roland Shoemaker <roland@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org>
2022-03-14ssh: deprecate and replace SigAlgo constantsFilippo Valsorda
RFC 8332, Section 2 sets up two overlapping namespaces: public key formats and public key algorithms. * The formats are what we currently have KeyAlgo constants for, and they appear in PublicKey.Type. * The algorithms are the set of both KeyAlgo and SigAlgo constants, and they appear in Signature.Format (amongst other places). This is incoherent, because that means Signature.Format can be both a KeyAlgo (like KeyAlgoECDSA256) or a SigAlgo (like SigAlgoRSASHA2256). One solution would be to duplicate all the KeyAlgo constants into the SigAlgo namespace, but that would be confusing because applications are currently using KeyAlgos where they'd be supposed to use the new SigAlgos (while we can't deprecate the KeyAlgos because they are still necessary for the PublicKey.Type namespace). Instead, drop the separate namespaces, and use KeyAlgos throughout. There are simply some KeyAlgos that can't be a PublicKey.Type. Take the opportunity to fix the stuttering SHA22565/SHA2512 names. It's totally ok to call those hashes SHA-256 and SHA-512 without the family infix. For golang/go#49952 Change-Id: Ia1fce3912a7e60aa70a88f75ed311be331fd19d5 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/392354 Trust: Filippo Valsorda <filippo@golang.org> Run-TryBot: Filippo Valsorda <filippo@golang.org> Reviewed-by: Roland Shoemaker <roland@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org>
2022-03-14ssh: fix diffie-hellman-group-exchange g and K bounds checksFilippo Valsorda
The previous code if gex.g.Cmp(one) != 1 && gex.g.Cmp(pMinusOne) != -1 { deobfuscates to the classic mistake if g <= 1 && g >= p - 1 { which is never true. What the code actually intended to do is if gex.g.Cmp(one) != 1 || gex.g.Cmp(pMinusOne) != -1 { or more readably and consistently with the diffieHellman method if gex.g.Cmp(one) <= 0 || gex.g.Cmp(pMinusOne) >= 0 { Now, is this a security issue? The incorrect checks apply to g and k, but not what we call Y and the spec calls f. RFC 4419 says: Either side MUST NOT send or accept e or f values that are not in the range [1, p-1]. If this condition is violated, the key exchange fails. To prevent confinement attacks, they MUST accept the shared secret K only if 1 < K < p - 1. Note that RFC 8268, Section 4 updates the equivalent RFC 4253 statement (although not the RFC 4419 one) about e and f, but we are already doing the correct full check there. DH Public Key values MUST be checked and both conditions: 1 < e < p-1 1 < f < p-1 MUST be true. Values not within these bounds MUST NOT be sent or accepted by either side. If either one of these conditions is violated, then the key exchange fails. This simple check ensures that: o The remote peer behaves properly. o The local system is not forced into the two-element subgroup. The check on K seems like a proxy for checking a number of ways to fix the DH output (for example by manipulating g) to one of 0, 1, or -1. This should not be meaningful to security for two reasons: - all parameters end up in the "transcript" hash that will get signed by the server's host key, and if the attacker controls the host key's signature, they have the ability to MitM without resorting to confinement attacks - the client secret is ephemeral, so leaking bits of it by forcing it into small sub-groups does not gain the attacker anything, as the secret does not get reused Indeed, this is the same explanation of why it's ok not to check that p is indeed a (safe) prime, which even OpenSSH omits. Building an equivalent attack by manipulating p instead of g is left as an exercise to the reader. For the future, this is a case study in why we should not add complexity even when it looks easy enough to do. CL 174257 added the diffie-hellman-group-exchange kex. That introduced a data race (arguably a security issue), which was fixed in CL 222078. Then it was too slow, which led to CL 252337 that removed the primalty check, which required a full analysis of whether it's safe to skip it, and checking against other implementations. Now we find there's a bug and we have to do another security analysis that not even the RFC bothered to do in order to decide if it's a security issue. My decision in https://github.com/golang/go/issues/17230#issuecomment-489163656 does not look like the right one in hindsight. While at it, clean up the code some - drop useless bit size bounds logic in the server stub that get ignored by the rest of the function - make p and g local variables instead of method fields, since they are not persistent state (this was originally a data race which was fixed in CL 222078 by making Client not a pointer receiver) Updates golang/go#17230 Change-Id: I4b1c68537109f627ccd75ec381dcfab57ce1768c Reviewed-on: https://go-review.googlesource.com/c/crypto/+/392015 Trust: Filippo Valsorda <filippo@golang.org> Run-TryBot: Filippo Valsorda <filippo@golang.org> Reviewed-by: Roland Shoemaker <roland@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org>
2022-03-14ssh: add diffie-hellman-group14-sha256 kexFilippo Valsorda
RFC 9142 made diffie-hellman-group14-sha256 from RFC 8268 a MUST, and it's strictly better than diffie-hellman-group14-sha1, which we already have, and trivial to add. > The method of key exchange used for the name "diffie-hellman- > group14-sha256" is the same as that for "diffie-hellman-group14-sha1" > except that the SHA256 hash algorithm is used. Ignore the bigger groups which have a meaningful performance cost, and don't share the same interoperability benefit. Adapted from CL 387994. Fixes golang/go#31731 Co-authored-by: Nicola Murino <nicola.murino@gmail.com> Change-Id: Id4ce345a2065840f193986739ea890f105a1e929 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/392014 Trust: Filippo Valsorda <filippo@golang.org> Run-TryBot: Filippo Valsorda <filippo@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Roland Shoemaker <roland@golang.org>
2022-03-14ssh: support new curve25519-sha256 kex nameМихаил Патин
RFC 8731 standardized curve25519-sha256@libssh.org as curve25519-sha256, and some systems only advertise support for the new name. Fixes golang/go#48756 Change-Id: Ice35874cd8c07ad48752686ac368bf11ab793f77 Co-authored-by: Filippo Valsorda <filippo@golang.org> Reviewed-on: https://go-review.googlesource.com/c/crypto/+/385394 Trust: Filippo Valsorda <filippo@golang.org> Run-TryBot: Filippo Valsorda <filippo@golang.org> Trust: Matt Layher <mdlayher@gmail.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Roland Shoemaker <roland@golang.org>
2022-03-13ssh: add IUTF8 constant from RFC 8160Brad Fitzpatrick
Change-Id: I65ac40d86c4f0ee5552cd2e167ac91a735f6c56e Reviewed-on: https://go-review.googlesource.com/c/crypto/+/392134 Trust: Brad Fitzpatrick <bradfitz@golang.org> Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> Reviewed-by: David Crawshaw <crawshaw@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Maisem Ali <maisem@tailscale.com>
2022-03-12ssh: ignore MAC if AEAD ciphers negotiatedRoland Shoemaker
If the server/client cipher chosen is one of the two AEAD ciphers that we support (aes128-gcm@openssh.com and chacha20-poly1305@openssh.com), don't attempt to find a common MAC algorithm in findAgreedAlgorithms. Similarly in newPacketCipher, don't attempt to generate a MAC key if we are using a AEAD cipher. Fixes golang/go#51406 Change-Id: Id48ae72f052cb0a0c597b32e9901a0f218e4161f Reviewed-on: https://go-review.googlesource.com/c/crypto/+/389214 Trust: Roland Shoemaker <roland@golang.org> Run-TryBot: Roland Shoemaker <roland@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Filippo Valsorda <filippo@golang.org>
2022-03-07ssh: fix typocuishuang
Change-Id: I5832916eb921d2d18e3082cd04520e22e2b04127 GitHub-Last-Rev: c0999b83439a5f0ff57b740c18f47d81028e552a GitHub-Pull-Request: golang/crypto#207 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/390414 Reviewed-by: Roland Shoemaker <roland@golang.org> Trust: Carlos Amedee <carlos@golang.org> Run-TryBot: Ian Lance Taylor <iant@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org>
2022-02-13crypto/ssh: don't send the last auth failure message if disconnectingRoland Shoemaker
If we are going to send the disconnect message and close the connection, because we have exhausted the number of authentication attempts, don't send the final authentication failure message. This behavior matches that of OpenSSH. Fixes golang/go#51149 Change-Id: I43b2de2e854f789161cd7fd6c05876661adfb2c1 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/385236 Trust: Roland Shoemaker <roland@golang.org> Run-TryBot: Roland Shoemaker <roland@golang.org> Auto-Submit: Roland Shoemaker <roland@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Ian Lance Taylor <iant@golang.org>
2022-02-09ssh: accept WSAECONNABORTED in TestClientAuthMaxAuthTriesPublicKeyIan Lance Taylor
Fixes golang/go#50805 Change-Id: Icdd2835b1626240faf61936288f279570c873158 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/381614 Trust: Ian Lance Taylor <iant@golang.org> Run-TryBot: Ian Lance Taylor <iant@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Roland Shoemaker <roland@golang.org>
2022-02-09acme, sha3, ssh: fix the typosHowJmay
Change-Id: I2287ab3492c105791b03f40d45b5dff5a56aa32a GitHub-Last-Rev: 02cdf82d8b1604fc47b656172b102a48a70e6f05 GitHub-Pull-Request: golang/crypto#183 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/319269 Trust: Alberto Donizetti <alb.donizetti@gmail.com> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2022-01-26ssh/agent: fix TestMalformedRequestsRoland Shoemaker
Use a net.Pipe, rather than setting up a local TCP connection, for testing malformed SSH requests, since we don't need the complex intricacies of a real connection to test this protocol behavior. Fixes golang/go#50161 Change-Id: I5e46c42041ddd03b06725469216b82b801990e64 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/371874 Reviewed-by: Bryan Mills <bcmills@google.com> Trust: Roland Shoemaker <roland@golang.org> Run-TryBot: Roland Shoemaker <roland@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org>
2021-12-02ssh: don't assume packet plaintext sizeRoland Shoemaker
When reading GCM and ChaChaPoly1305 packets, don't make assumptions about the size of the enciphered plaintext. This fixes two panics caused by standards non-compliant malformed packets. Thanks to Rod Hynes, Psiphon Inc. for reporting this issue. Fixes golang/go#49932 Fixes CVE-2021-43565 Change-Id: I660cff39d197e0d04ec44d11d792b22d954df2ef Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1262659 Reviewed-by: Katie Hockman <katiehockman@google.com> Reviewed-by: Julie Qiu <julieqiu@google.com> Reviewed-on: https://go-review.googlesource.com/c/crypto/+/368814 Trust: Roland Shoemaker <roland@golang.org> Trust: Katie Hockman <katie@golang.org> Run-TryBot: Roland Shoemaker <roland@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Julie Qiu <julie@golang.org> Reviewed-by: Katie Hockman <katie@golang.org>
2021-11-15ssh: support RSA SHA-2 (RFC8332) signaturesHans Nielsen
This change adds support for RSA SHA-2 based signatures for host keys and certificates. It also switches the default certificate signature algorithm for RSA to use SHA-512. This is implemented by treating ssh.Signer specially when the key type is `ssh-rsa` by also allowing SHA-256 and SHA-512 signatures. Fixes golang/go#37278 Change-Id: I2ee1ac4ae4c9c1de441a2d6cf1e806357ef18910 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/220037 Trust: Jason A. Donenfeld <Jason@zx2c4.com> Run-TryBot: Jason A. Donenfeld <Jason@zx2c4.com> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Jason A. Donenfeld <Jason@zx2c4.com> Reviewed-by: Roland Shoemaker <roland@golang.org>
2021-09-15poly1305: deprecate public packageFilippo Valsorda
Fixes golang/go#36646 Change-Id: Ic19dd2171c84472fc9d3f44803224b87fc5c0417 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/345649 Trust: Filippo Valsorda <filippo@golang.org> Trust: Katie Hockman <katie@golang.org> Run-TryBot: Filippo Valsorda <filippo@golang.org> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Roland Shoemaker <roland@golang.org> Reviewed-by: Katie Hockman <katie@golang.org>
2021-05-06ssh: return missing user field in NewClientConnpovsister
Fix golang/go#45249 Change-Id: I27ef2976586ad481d832c6e46695a91f1bb50373 GitHub-Last-Rev: 9f631b80925719a0fb77576f7983cd7c8d0b5056 GitHub-Pull-Request: golang/crypto#180 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/304990 Reviewed-by: Emmanuel Odeke <emmanuel@orijtech.com> Reviewed-by: Katie Hockman <katie@golang.org> Trust: Emmanuel Odeke <emmanuel@orijtech.com> Trust: Katie Hockman <katie@golang.org> Run-TryBot: Emmanuel Odeke <emmanuel@orijtech.com> TryBot-Result: Go Bot <gobot@golang.org>
generated by cgit v1.3-5-g9baa (git 2.53.0) at 2026-04-17 14:22:32 +0000