crypto/ssh: only show banner once

Only show the SSH banner once, even if the client attempts
authentication with the "none" type and resets the authentication
attempts.

Change-Id: I1a7aacb50abf00233ed4d06c60808aaf51a9d7be
Reviewed-on: https://go-review.googlesource.com/78544
Run-TryBot: Sam Whited <sam@samwhited.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Han-Wen Nienhuys <hanwen@google.com>

ssh/client_test.go

@@ -89,7 +89,9 @@ func TestBannerCallback(t *testing.T) {
 	defer c2.Close()
 
 	serverConf := &ServerConfig{
-		NoClientAuth: true,
+		PasswordCallback: func(conn ConnMetadata, password []byte) (*Permissions, error) {
+			return &Permissions{}, nil
+		},
 		BannerCallback: func(conn ConnMetadata) string {
 			return "Hello World"
 		},
@@ -98,10 +100,15 @@ func TestBannerCallback(t *testing.T) {
 	go NewServerConn(c1, serverConf)
 
 	var receivedBanner string
+	var bannerCount int
 	clientConf := ClientConfig{
+		Auth: []AuthMethod{
+			Password("123"),
+		},
 		User:            "user",
 		HostKeyCallback: InsecureIgnoreHostKey(),
 		BannerCallback: func(message string) error {
+			bannerCount++
 			receivedBanner = message
 			return nil
 		},
@@ -112,6 +119,10 @@ func TestBannerCallback(t *testing.T) {
 		t.Fatal(err)
 	}
 
+	if bannerCount != 1 {
+		t.Errorf("got %d banners; want 1", bannerCount)
+	}
+
 	expected := "Hello World"
 	if receivedBanner != expected {
 		t.Fatalf("got %s; want %s", receivedBanner, expected)

ssh/server.go

@@ -316,6 +316,7 @@ func (s *connection) serverAuthenticate(config *ServerConfig) (*Permissions, err
 
 	authFailures := 0
 	var authErrs []error
+	var displayedBanner bool
 
 userAuthLoop:
 	for {
@@ -348,7 +349,8 @@ userAuthLoop:
 
 		s.user = userAuthReq.User
 
-		if authFailures == 0 && config.BannerCallback != nil {
+		if !displayedBanner && config.BannerCallback != nil {
+			displayedBanner = true
 			msg := config.BannerCallback(s)
 			if msg != "" {
 				bannerMsg := &userAuthBannerMsg{