ssh: don't close the connection on an unparseable public key

In the server's publickey authentication path, a public key blob that
ParsePublicKey could not decode caused serverAuthenticate to return an
error, tearing down the whole connection. A key we cannot parse is part
of an individual authentication attempt, not a transport-level framing
error, so it must fail only that attempt. This lets the client fall
back to other keys or authentication methods.

Updates golang/go#80075

Change-Id: I8d882d08bb50eb33e0054d9d9c2bd9e0b3039443
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/795420
Reviewed-by: David Chase <drchase@google.com>
LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Michael Pratt <mpratt@google.com>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
Auto-Submit: Nicola Murino <nicola.murino@gmail.com>

This commit is contained in:

Nicola Murino

2026-07-13 12:20:29 -07:00

committed by

Gopher Robot

parent c1a3b97d70

commit b27e1504e3

2 changed files with 38 additions and 1 deletions

									
										ssh/server.go
									
		+2
		-1
	
												View File
												
				@@ -796,7 +796,8 @@ userAuthLoop:

							pubKey, err := ParsePublicKey(pubKeyData)

							if err != nil {

								return nil, err

								authErr = err

								break

							}

							candidate, ok := cache.get(s.user, pubKeyData)