From 60e158ad30c226555794539d96f0f104f43395f7 Mon Sep 17 00:00:00 2001 From: Mike Nolta Date: Thu, 14 May 2026 09:51:25 -0400 Subject: [PATCH] ssh/test: isolate CLI tests from user SSH config and agent Pass -F none and -o IdentityAgent=none to ssh(1) invocations in the CLI tests. Without these flags, a user's ~/.ssh/config can enable Control{Master,Persist}, which causes the ssh process to fork a background daemon that holds stdout/stderr pipes open, preventing CombinedOutput from ever returning. The agent flag prevents keys loaded in the user's SSH agent from being offered to the server before the test key, which would exhaust MaxAuthTries and cause a disconnect. Fixes golang/go#79411 Change-Id: Id5b073e6df661006183d000928d7ef6e6096b933 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/777900 Reviewed-by: Mark Freeman Reviewed-by: Daniel McCarney Reviewed-by: David Chase LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com --- ssh/test/sshcli_test.go | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/ssh/test/sshcli_test.go b/ssh/test/sshcli_test.go index 4537394..1bd4381 100644 --- a/ssh/test/sshcli_test.go +++ b/ssh/test/sshcli_test.go @@ -90,7 +90,8 @@ func TestSSHCLIAuth(t *testing.T) { } // test public key authentication. - cmd := testenv.Command(t, sshCLI, "-vvv", "-i", keyPrivPath, "-o", "StrictHostKeyChecking=no", + cmd := testenv.Command(t, sshCLI, "-F", "none", "-vvv", "-i", keyPrivPath, + "-o", "StrictHostKeyChecking=no", "-o", "IdentityAgent=none", "-p", port, "testpubkey@127.0.0.1", "true") out, err := cmd.CombinedOutput() if err != nil { @@ -99,7 +100,8 @@ func TestSSHCLIAuth(t *testing.T) { // Test SSH user certificate authentication. // The username must match one of the principals included in the certificate. // The certificate "rsa-user-testcertificate" has "testcertificate" as principal. - cmd = testenv.Command(t, sshCLI, "-vvv", "-i", keyPrivPath, "-o", "StrictHostKeyChecking=no", + cmd = testenv.Command(t, sshCLI, "-F", "none", "-vvv", "-i", keyPrivPath, + "-o", "StrictHostKeyChecking=no", "-o", "IdentityAgent=none", "-p", port, "testcertificate@127.0.0.1", "true") out, err = cmd.CombinedOutput() if err != nil { @@ -121,7 +123,7 @@ func TestSSHCLIKeyExchanges(t *testing.T) { keyExchanges := append(ssh.SupportedAlgorithms().KeyExchanges, ssh.InsecureAlgorithms().KeyExchanges...) for _, kex := range keyExchanges { t.Run(kex, func(t *testing.T) { - cmd := testenv.Command(t, sshCLI, "-Q", "kex") + cmd := testenv.Command(t, sshCLI, "-F", "none", "-Q", "kex") out, err := cmd.CombinedOutput() if err != nil { t.Fatalf("%s failed to check if the KEX is supported, error: %v, command output %q", kex, err, string(out)) @@ -154,7 +156,8 @@ func TestSSHCLIKeyExchanges(t *testing.T) { t.Fatalf("unable to get server port: %v", err) } - cmd = testenv.Command(t, sshCLI, "-vvv", "-i", keyPrivPath, "-o", "StrictHostKeyChecking=no", + cmd = testenv.Command(t, sshCLI, "-F", "none", "-vvv", "-i", keyPrivPath, + "-o", "StrictHostKeyChecking=no", "-o", "IdentityAgent=none", "-o", fmt.Sprintf("KexAlgorithms=%s", kex), "-p", port, "testpubkey@127.0.0.1", "true") out, err = cmd.CombinedOutput() if err != nil {