Edoardo Spadolini
4e5a26183e
ssh: close net.Conn on all NewServerConn errors
...
This PR ensures that the net.Conn passed to ssh.NewServerConn is closed
on all error return paths, not just after a failed handshake. This matches
the behavior of ssh.NewClientConn.
Change-Id: Id8a51d10ae8d575cbbe26f2ef6b37de7cca840ec
GitHub-Last-Rev: 81bb2e58a881a9a85935740bda06b034b32a8ce3
GitHub-Pull-Request: golang/crypto#279
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/549095
Run-TryBot: Nicola Murino <nicola.murino@gmail.com >
Auto-Submit: Nicola Murino <nicola.murino@gmail.com >
Reviewed-by: Roland Shoemaker <roland@golang.org >
Reviewed-by: Nicola Murino <nicola.murino@gmail.com >
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com >
Reviewed-by: Michael Pratt <mpratt@google.com >
TryBot-Result: Gopher Robot <gobot@golang.org >
2023-12-14 18:23:28 +00:00
Will Mortensen
fdfe1f8531
ssh: defer channel window adjustment
...
Sending a window adjustment after every read is unnecessarily chatty,
especially with a series of small reads like with TTY interactions.
Copy OpenSSH's logic for deferring these, which seemingly hasn't changed
since 2007. Note that since channelWindowSize and c.maxIncomingPayload
are currently constants here, the two checks could be combined into a
single check for c.myWindow < 2 MiB - 96 KiB (with the current values
of the constants).
Fixes golang/go#57424 .
Change-Id: Ifcef5be76fcc3f0b1a6dc396096bed9c50d64f21
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/459915
Reviewed-by: Nicola Murino <nicola.murino@gmail.com >
Reviewed-by: Michael Knyszek <mknyszek@google.com >
Run-TryBot: Nicola Murino <nicola.murino@gmail.com >
Auto-Submit: Nicola Murino <nicola.murino@gmail.com >
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com >
Commit-Queue: Nicola Murino <nicola.murino@gmail.com >
TryBot-Result: Gopher Robot <gobot@golang.org >
2023-11-27 17:27:49 +00:00
Pavel Repin
7e6fbd82c8
ssh: wrap errors from client handshake
...
When an error is returned by a user defined host key callback,
it is now possible to handle it using standard Go mechanisms
such as errors.Is or errors.As.
Fixes golang/go#61309
Change-Id: I4269c5f8eacd8e7e8d85070ad249f0e27777b15f
GitHub-Last-Rev: d2a34d5c8225d6aaaee287ce3ea8b218fbe210d4
GitHub-Pull-Request: golang/crypto#266
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/508876
Run-TryBot: Nicola Murino <nicola.murino@gmail.com >
Auto-Submit: Dmitri Shuralyov <dmitshur@golang.org >
Reviewed-by: Muhammad Shulhan <m.shulhan@gmail.com >
Reviewed-by: Michael Knyszek <mknyszek@google.com >
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com >
Reviewed-by: Nicola Murino <nicola.murino@gmail.com >
TryBot-Result: Gopher Robot <gobot@golang.org >
2023-11-27 17:24:46 +00:00
Heschi Kreinick
325b735346
ssh/test: skip TestSSHCLIAuth on Windows
...
It's failing with a file permissions error:
sign_and_send_pubkey: signing using rsa-sha2-512 SHA256:Anr3LjZK8YVpjrxu79myrW9Hrb/wpcMNpVvTq/RcBm8\r\nBad permissions. Try removing permissions for user: UNKNOWN\\\\UNKNOWN (S-1-15-2-2) on file C:/b/s/w/ir/x/t/TestSSHCLIAuth1586735692/001/rsa.
For golang/go#64403
Change-Id: Iece8eac4a1ac349f9f7a273ac7389315cb96568e
Cq-Include-Trybots: luci.golang.try:x_crypto-gotip-windows-amd64-longtest,x_crypto-go1.21-windows-amd64-longtest,x_crypto-go1.20-windows-amd64-longtest
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/545135
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com >
Reviewed-by: Nicola Murino <nicola.murino@gmail.com >
Auto-Submit: Heschi Kreinick <heschi@google.com >
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com >
2023-11-27 16:29:38 +00:00
Randy Reddig
b2d7c26edb
ssh: add (*Client).DialContext method
...
This change adds DialContext to ssh.Client, which opens a TCP-IP
connection tunneled over the SSH connection. This is useful for
proxying network connections, e.g. setting
(net/http.Transport).DialContext.
Fixes golang/go#20288 .
Change-Id: I110494c00962424ea803065535ebe2209364ac27
GitHub-Last-Rev: 3176984a71a9a1422702e3a071340ecfff71ff62
GitHub-Pull-Request: golang/crypto#260
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/504735
Run-TryBot: Nicola Murino <nicola.murino@gmail.com >
Run-TryBot: Han-Wen Nienhuys <hanwen@google.com >
Auto-Submit: Nicola Murino <nicola.murino@gmail.com >
Reviewed-by: Han-Wen Nienhuys <hanwen@google.com >
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com >
TryBot-Result: Gopher Robot <gobot@golang.org >
Reviewed-by: Nicola Murino <nicola.murino@gmail.com >
Commit-Queue: Nicola Murino <nicola.murino@gmail.com >
2023-11-27 15:35:52 +00:00
Nicola Murino
1c17e20020
ssh: fix certificate authentication with OpenSSH 7.2-7.7
...
OpenSSH 7.2-7.7 advertises support for rsa-sha2-256 and rsa-sha2-512
in the "server-sig-algs" extension but doesn't support these
algorithms for certificate authentication, so if the server rejects
the key try to use the obtained algorithm as if "server-sig-algs" had
not been implemented.
Fixes golang/go#58371
Change-Id: Id49960d3dedd32a21e2c6c2689b1696e05398286
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/510155
Reviewed-by: Filippo Valsorda <filippo@golang.org >
Run-TryBot: Nicola Murino <nicola.murino@gmail.com >
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com >
Reviewed-by: Michael Knyszek <mknyszek@google.com >
TryBot-Result: Gopher Robot <gobot@golang.org >
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com >
Auto-Submit: Nicola Murino <nicola.murino@gmail.com >
2023-11-23 17:23:14 +00:00
Matt Dainty
1cf1811d71
ssh: use the correct token from the client
...
This fixes the case where AcceptSecContext is always called with the
first token sent by the client instead of the most recently sent one.
Previously, despite being being read from the client and unmarshalled,
it was never actually used.
Fixes golang/go#43875
Change-Id: I1967d9a107af03d6778a9437b48e785d61710ee5
GitHub-Last-Rev: 0d58e4d50014fac0a9ea1eef85489172137eb8aa
GitHub-Pull-Request: golang/crypto#176
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/286252
Run-TryBot: Filippo Valsorda <filippo@golang.org >
Auto-Submit: Filippo Valsorda <filippo@golang.org >
TryBot-Result: Gopher Robot <gobot@golang.org >
Reviewed-by: Matthew Dempsky <mdempsky@google.com >
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com >
Run-TryBot: Nicola Murino <nicola.murino@gmail.com >
Reviewed-by: Nicola Murino <nicola.murino@gmail.com >
Reviewed-by: Filippo Valsorda <filippo@golang.org >
Reviewed-by: Than McIntosh <thanm@google.com >
2023-11-11 11:26:14 +00:00
Bryan C. Mills
ff15cd57d1
ssh: eliminate some goroutine leaks in tests and examples
...
This should fix the "Log in goroutine" panic seen in
https://build.golang.org/log/e42bf69fc002113dbccfe602a6c67fd52e8f31df ,
as well as a few other related leaks. It also helps to verify that
none of the functions under test deadlock unexpectedly.
See https://go.dev/wiki/CodeReviewComments#goroutine-lifetimes .
Updates golang/go#58901 .
Change-Id: Ica943444db381ae1accb80b101ea646e28ebf4f9
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/541095
Auto-Submit: Bryan Mills <bcmills@google.com >
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com >
Reviewed-by: Nicola Murino <nicola.murino@gmail.com >
Reviewed-by: Heschi Kreinick <heschi@google.com >
2023-11-09 17:49:15 +00:00
Nicola Murino
eb61739cd9
ssh: allow to configure public key auth algorithms on the server side
...
Fixes golang/go#61244
Change-Id: I29b43e379cf0cdb07b0d6935666491b997157e73
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/510775
TryBot-Result: Gopher Robot <gobot@golang.org >
Reviewed-by: Bryan Mills <bcmills@google.com >
Commit-Queue: Nicola Murino <nicola.murino@gmail.com >
Run-TryBot: Nicola Murino <nicola.murino@gmail.com >
Auto-Submit: Nicola Murino <nicola.murino@gmail.com >
Reviewed-by: Han-Wen Nienhuys <hanwen@google.com >
2023-11-08 19:10:19 +00:00
Nicola Murino
42c83fffff
ssh: try harder to detect incorrect passwords for legacy PEM encryption
...
Because of deficiencies in the format, DecryptPEMBlock does not always
detect an incorrect password. In these cases decrypted DER bytes is
random noise. If the parsing of the key returns an asn1.StructuralError
we return x509.IncorrectPasswordError.
Fixes golang/go#62265
Change-Id: Ib8b845f2bd01662c1f1421d35859a32ac5b78da7
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/538835
Reviewed-by: Heschi Kreinick <heschi@google.com >
Reviewed-by: Filippo Valsorda <filippo@golang.org >
Auto-Submit: Filippo Valsorda <filippo@golang.org >
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com >
Reviewed-by: Cherry Mui <cherryyz@google.com >
2023-11-08 18:01:48 +00:00
Nicola Murino
cf8dcb0f7d
ssh: add test case against ssh CLI
...
These tests try to ensure better compatibility of our server implementation
with the ssh CLI.
With these tests in place:
1) before merging CL 447757 we would have noticed that our server
implementation was broken with OpenSSH 8.8+
2) after merging CL 447757 we would have noticed that our server
implementation was broken with OpenSSH 7.2-7.7
The ssh CLI from $PATH is used by default, but can be overridden using
the SSH_CLI_PATH environment variable.
Change-Id: I93d64be41c7613132b0364afac8397f57c2dcbca
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/506837
TryBot-Result: Gopher Robot <gobot@golang.org >
Reviewed-by: Benny Siegert <bsiegert@gmail.com >
Reviewed-by: Han-Wen Nienhuys <hanwen@google.com >
Run-TryBot: Nicola Murino <nicola.murino@gmail.com >
2023-10-24 07:12:59 +00:00
Dmitri Shuralyov
8779cbd1c9
all: update go directive to 1.18
...
Done with:
go get go@1.18
go mod tidy
go fix ./...
Using go1.21.3.
Also update avo to v0.5.0 in the curve25519/internal/field/_asm module.
It's newer and produces no diff in the generated code.
For golang/go#60268 .
Change-Id: I9bd771ee8561595d7f68aaca76df6e3e33d35013
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/534141
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com >
Reviewed-by: Damien Neil <dneil@google.com >
Auto-Submit: Dmitri Shuralyov <dmitshur@golang.org >
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com >
2023-10-11 22:02:22 +00:00
Nicola Murino
2aeefc3f8a
ssh: add support for SSH_AGENT_CONSTRAIN_EXTENSION with id 255
...
it was changed in the following draft
https://datatracker.ietf.org/doc/html/draft-miller-ssh-agent-03
The id 3 is now used for SSH_AGENT_CONSTRAIN_MAXSIGN key constraint,
an OpenSSH extension to the protocol that we do not currently support.
Instead, we added a compatibility layer for
SSH_AGENT_CONSTRAIN_EXTENSION with ID 3.
Fixes golang/go#62311
Change-Id: I421aee92aee9e693e43f66e6a5515c055333cb9b
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/525355
Reviewed-by: Matthew Dempsky <mdempsky@google.com >
Run-TryBot: Nicola Murino <nicola.murino@gmail.com >
Reviewed-by: Filippo Valsorda <filippo@golang.org >
TryBot-Result: Gopher Robot <gobot@golang.org >
Reviewed-by: Than McIntosh <thanm@google.com >
2023-10-11 10:27:03 +00:00
Nicola Murino
833695f0a5
ssh: add server side support for ping@openssh.com protocol extension
...
Fixes golang/go#62390
Change-Id: Ie4dc577fb55b45a0c26a9e2dc5903af2bd382e00
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/524775
TryBot-Result: Gopher Robot <gobot@golang.org >
Reviewed-by: Matthew Dempsky <mdempsky@google.com >
Reviewed-by: Than McIntosh <thanm@google.com >
Run-TryBot: Nicola Murino <nicola.murino@gmail.com >
Reviewed-by: Filippo Valsorda <filippo@golang.org >
2023-10-04 16:04:50 +00:00
Sebastiaan van Stijn
b665ba6f6f
all: use crypto/ed25519 instead of golang.org/x/crypto/ed25519
...
This is a follow-up to CL 317169, which dropped go1.12 compatibility,
and made the golang.org/x/crypto/ed25519 package an alias / wrapper for
crypto/ed25519 in stdlib.
This patch updates uses within this repository to use stdlib instead of
depending on the wrapper. With this patch applied, the only remaining
use of the wrapper is in ed25519_test, which appears to be in place to
verify compatibility of the wrapper itself.
Change-Id: I0195396102a75ae20bdd82ca8ab59855c0eb5cea
GitHub-Last-Rev: 24dbec563cbd84bc47bdc7736b0245fc83dd3353
GitHub-Pull-Request: golang/crypto#238
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/448238
Reviewed-by: Bryan Mills <bcmills@google.com >
Run-TryBot: Nicola Murino <nicola.murino@gmail.com >
Reviewed-by: Nicola Murino <nicola.murino@gmail.com >
TryBot-Result: Gopher Robot <gobot@golang.org >
Reviewed-by: Joedian Reid <joedian@golang.org >
Reviewed-by: Roland Shoemaker <roland@golang.org >
Reviewed-by: Than McIntosh <thanm@google.com >
2023-09-27 14:30:17 +00:00
Nicola Murino
a1aeb9b34e
ssh: add test cases for compatibility with old (buggy) clients
...
Improved test cases for CL 506835.
Change-Id: If4a98ae4a7b39d2e59b203d10080b71283e1a80e
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/525735
TryBot-Result: Gopher Robot <gobot@golang.org >
Reviewed-by: Matthew Dempsky <mdempsky@google.com >
Run-TryBot: Filippo Valsorda <filippo@golang.org >
Reviewed-by: Ian Lance Taylor <iant@google.com >
Reviewed-by: Filippo Valsorda <filippo@golang.org >
Auto-Submit: Filippo Valsorda <filippo@golang.org >
2023-09-20 18:10:32 +00:00
Nicola Murino
28c53ff63c
ssh: add MultiAlgorithmSigner
...
MultiAlgorithmSigner allows to restrict client-side, server-side and
certificate signing algorithms.
Fixes golang/go#52132
Fixes golang/go#36261
Change-Id: I295092f1bba647327aaaf294f110e9157d294159
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/508398
Reviewed-by: Filippo Valsorda <filippo@golang.org >
Run-TryBot: Filippo Valsorda <filippo@golang.org >
Reviewed-by: Ian Lance Taylor <iant@google.com >
Auto-Submit: Filippo Valsorda <filippo@golang.org >
TryBot-Result: Gopher Robot <gobot@golang.org >
Reviewed-by: Matthew Dempsky <mdempsky@google.com >
2023-09-20 18:10:30 +00:00
Mariano Cano
d359caa4a3
ssh: support for marshaling keys using the OpenSSH format
...
This adds methods to marshal private keys, encrypted and unencrypted
to the OpenSSH format.
Fixes golang/go#37132
Change-Id: I1a95301f789ce04858e6b147748c6e8b7700384b
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/218620
Run-TryBot: Roland Shoemaker <roland@golang.org >
TryBot-Result: Gopher Robot <gobot@golang.org >
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com >
Reviewed-by: Cherry Mui <cherryyz@google.com >
Reviewed-by: Roland Shoemaker <roland@golang.org >
Auto-Submit: Roland Shoemaker <roland@golang.org >
2023-09-05 20:25:46 +00:00
Nicola Murino
c5370d2cc6
ssh: check the declared public key algo against decoded one
...
This check will ensure we don't accept e.g. ssh-rsa-cert-v01@openssh.com
algorithm with ssh-rsa public key type.
The algorithm and public key type must be consistent: both must be
certificate algorithms, or neither.
Change-Id: I1d75074fb4d6db3a8796408e98ddffe577a96ab1
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/506836
TryBot-Result: Gopher Robot <gobot@golang.org >
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com >
Reviewed-by: Cherry Mui <cherryyz@google.com >
Auto-Submit: Filippo Valsorda <filippo@golang.org >
Reviewed-by: Filippo Valsorda <filippo@golang.org >
Run-TryBot: Filippo Valsorda <filippo@golang.org >
2023-09-05 16:18:45 +00:00
Nicola Murino
edc325d13a
ssh: fix call to Fatalf from a non-test goroutine
...
Also fix some redundant type declarations.
Change-Id: Iad2950b67b1ec2e2590c59393b8ad15421ed3add
GitHub-Last-Rev: 41cf552f11387208491dee7b867050475043b25e
GitHub-Pull-Request: golang/crypto#263
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/505798
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com >
Reviewed-by: David Chase <drchase@google.com >
TryBot-Result: Gopher Robot <gobot@golang.org >
Auto-Submit: Dmitri Shuralyov <dmitshur@google.com >
Reviewed-by: Filippo Valsorda <filippo@golang.org >
Run-TryBot: Filippo Valsorda <filippo@golang.org >
2023-07-31 18:14:41 +00:00
Nicola Murino
eab9315960
ssh: add diffie-hellman-group16-sha512 kex
...
This group is disabled by default because it is a bit slower than
the others.
The group18-sha512 variant is too slow to include.
Benchstat results including diffie-hellman-group18-sha512:
name time/op
Kexes/diffie-hellman-group-exchange-sha256-12 22.6ms ± 9%
Kexes/diffie-hellman-group18-sha512-12 1.15s ±11%
Kexes/ecdh-sha2-nistp384-12 3.91ms ± 6%
Kexes/ecdh-sha2-nistp256-12 304µs ± 5%
Kexes/curve25519-sha256@libssh.org-12 413µs ± 7%
Kexes/ecdh-sha2-nistp521-12 11.6ms ±13%
Kexes/curve25519-sha256-12 361µs ± 5%
Kexes/diffie-hellman-group-exchange-sha1-12 22.9ms ± 9%
Kexes/diffie-hellman-group1-sha1-12 3.59ms ± 6%
Kexes/diffie-hellman-group14-sha1-12 22.1ms ±11%
Kexes/diffie-hellman-group14-sha256-12 21.6ms ± 8%
Kexes/diffie-hellman-group16-sha512-12 138ms ± 9%
name alloc/op
Kexes/diffie-hellman-group-exchange-sha256-12 67.8kB ± 1%
Kexes/diffie-hellman-group18-sha512-12 243kB ± 9%
Kexes/ecdh-sha2-nistp384-12 13.9kB ± 0%
Kexes/ecdh-sha2-nistp256-12 12.1kB ± 0%
Kexes/curve25519-sha256@libssh.org-12 8.22kB ± 0%
Kexes/ecdh-sha2-nistp521-12 16.5kB ± 0%
Kexes/curve25519-sha256-12 8.22kB ± 0%
Kexes/diffie-hellman-group-exchange-sha1-12 67.5kB ± 0%
Kexes/diffie-hellman-group1-sha1-12 34.9kB ± 0%
Kexes/diffie-hellman-group14-sha1-12 61.9kB ± 0%
Kexes/diffie-hellman-group14-sha256-12 62.0kB ± 0%
Kexes/diffie-hellman-group16-sha512-12 117kB ± 0%
name allocs/op
Kexes/diffie-hellman-group-exchange-sha256-12 314 ± 0%
Kexes/diffie-hellman-group18-sha512-12 271 ± 4%
Kexes/ecdh-sha2-nistp384-12 243 ± 0%
Kexes/ecdh-sha2-nistp256-12 213 ± 0%
Kexes/curve25519-sha256@libssh.org-12 168 ± 0%
Kexes/ecdh-sha2-nistp521-12 245 ± 0%
Kexes/curve25519-sha256-12 168 ± 0%
Kexes/diffie-hellman-group-exchange-sha1-12 314 ± 0%
Kexes/diffie-hellman-group1-sha1-12 255 ± 0%
Kexes/diffie-hellman-group14-sha1-12 255 ± 0%
Kexes/diffie-hellman-group14-sha256-12 255 ± 0%
Kexes/diffie-hellman-group16-sha512-12 256 ± 0%
Change-Id: Id119401fda7e417675325f37e3d442e70585206c
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/506839
Run-TryBot: Filippo Valsorda <filippo@golang.org >
TryBot-Result: Gopher Robot <gobot@golang.org >
Reviewed-by: Cherry Mui <cherryyz@google.com >
Auto-Submit: Filippo Valsorda <filippo@golang.org >
Reviewed-by: David Chase <drchase@google.com >
Reviewed-by: Filippo Valsorda <filippo@golang.org >
2023-07-31 17:46:52 +00:00
Nicola Murino
ddfa82138e
ssh: ignore invalid MACs and KEXs just like we do for ciphers
...
Tighter validation could cause backwards incompatibility issues, eg
configurations with valid and invalid MACs, KEXs, ciphers currently work
if a supported algorithm is negotiated and that's also the scenario of
removing support for an existing algorithm.
Fixes golang/go#39397
Change-Id: If90253ba89e1d8f732cc1e1c3d24fe0a1e2dac71
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/512175
Run-TryBot: Han-Wen Nienhuys <hanwen@google.com >
Reviewed-by: Filippo Valsorda <filippo@golang.org >
Reviewed-by: Han-Wen Nienhuys <hanwen@google.com >
Auto-Submit: Filippo Valsorda <filippo@golang.org >
Reviewed-by: David Chase <drchase@google.com >
TryBot-Result: Gopher Robot <gobot@golang.org >
2023-07-31 15:35:32 +00:00
Nicola Murino
3f8f0645c2
ssh: prefer sha256 based RSA key algorithms
...
sha256 is more optimized than sha512 in Go and is secure enough
so prefer sha256 over sha512.
Change-Id: I3fcf7457791e3ef4539e97049aa905dcd293499d
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/507556
Reviewed-by: Filippo Valsorda <filippo@golang.org >
Reviewed-by: Cherry Mui <cherryyz@google.com >
Run-TryBot: Filippo Valsorda <filippo@golang.org >
Auto-Submit: Filippo Valsorda <filippo@golang.org >
TryBot-Result: Gopher Robot <gobot@golang.org >
Reviewed-by: Roland Shoemaker <roland@golang.org >
2023-07-14 16:27:34 +00:00
Nicola Murino
5df3b59941
ssh: disable client agent tests on Windows
...
ssh-agent is implemented as a Windows service and exposed on a
named pipe. We don't currently support it.
See golang/go#60981
Change-Id: Iebdc42db30b37a87ac0766231b16aff3f17b3f56
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/509035
Run-TryBot: Heschi Kreinick <heschi@google.com >
Reviewed-by: Cherry Mui <cherryyz@google.com >
Reviewed-by: Heschi Kreinick <heschi@google.com >
Auto-Submit: Heschi Kreinick <heschi@google.com >
TryBot-Result: Gopher Robot <gobot@golang.org >
2023-07-13 13:29:36 +00:00
Boshi Lian
2e82bdd171
fix TestValidTerminalMode: missing output from echo SHELL $SHELL
...
add leading `echo` to have better compatibility
before
```
go test -run ^TestValidTerminalMode -v
=== RUN TestValidTerminalMode
session_test.go:261: echo SHELL $SHELL && stty -a && exit:
Last login: Thu Jul 6 12:24:38 2023 from 192.168.200.1
SHELL /bin/bashubuntu:~$
speed 38400 baud; rows 80; columns 40;
line = 0;
intr = ^C; quit = ^\; erase = ^?;
kill = ^U; eof = ^D; eol = <undef>;
eol2 = <undef>; swtch = <undef>;
start = ^Q; stop = ^S; susp = ^Z;
rprnt = ^R; werase = ^W; lnext = ^V;
discard = ^O; min = 1; time = 0;
-parenb -parodd -cmspar cs8 -hupcl
-cstopb cread -clocal -crtscts
-ignbrk -brkint -ignpar -parmrk -inpck
-istrip -inlcr -igncr icrnl ixon -ixoff
-iuclc -ixany -imaxbel -iutf8
opost -olcuc -ocrnl onlcr -onocr -onlret
-ofill -ofdel nl0 cr0 tab0 bs0 vt0 ff0
isig icanon iexten -echo echoe echok
-echonl -noflsh -xcase -tostop -echoprt
echoctl echoke -flusho -extproc
logout
session_test.go:266: missing output from echo SHELL $SHELL
```
after
```
go test -run ^TestValidTerminalMode -v
=== RUN TestValidTerminalMode
session_test.go:261: echo SHELL $SHELL && stty -a && exit:
Last login: Thu Jul 6 12:24:38 2023 from 192.168.200.1
bolian@ubuntu:~$
SHELL /bin/bash
speed 38400 baud; rows 80; columns 40;
line = 0;
intr = ^C; quit = ^\; erase = ^?;
kill = ^U; eof = ^D; eol = <undef>;
eol2 = <undef>; swtch = <undef>;
start = ^Q; stop = ^S; susp = ^Z;
rprnt = ^R; werase = ^W; lnext = ^V;
discard = ^O; min = 1; time = 0;
-parenb -parodd -cmspar cs8 -hupcl
-cstopb cread -clocal -crtscts
-ignbrk -brkint -ignpar -parmrk -inpck
-istrip -inlcr -igncr icrnl ixon -ixoff
-iuclc -ixany -imaxbel -iutf8
opost -olcuc -ocrnl onlcr -onocr -onlret
-ofill -ofdel nl0 cr0 tab0 bs0 vt0 ff0
isig icanon iexten -echo echoe echok
-echonl -noflsh -xcase -tostop -echoprt
echoctl echoke -flusho -extproc
logout
--- PASS: TestValidTerminalMode (0.06s)
```
Change-Id: If60c040edb8c78a7d86bf58a6be47636d9e8f173
GitHub-Last-Rev: a2cc1b1af09e47df82fcb8685d829dfed945e8b0
GitHub-Pull-Request: golang/crypto#264
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/508115
Reviewed-by: Heschi Kreinick <heschi@google.com >
TryBot-Result: Gopher Robot <gobot@golang.org >
Run-TryBot: Heschi Kreinick <heschi@google.com >
Auto-Submit: Heschi Kreinick <heschi@google.com >
Reviewed-by: Bryan Mills <bcmills@google.com >
2023-07-11 16:17:43 +00:00
Nicola Murino
64e0e99383
ssh: fix RSA certificate and public key authentication with older clients
...
After adding support for rsa-sha2-256/512 on the server side some edge
cases started to arise with old clients:
1) public key authentication with gpg-agent < 2.2.6 fails because we
receive ssh-rsa as signature format and rsa-sha2-256 or rsa-sha2-512
as algorithm.
This is a bug in gpg-agent fixed in this commit:
https://github.com/gpg/gnupg/commit/80b775bdbb852aa4a80292c9357e5b1876110c00
2) certificate authentication fails with OpenSSH 7.2-7.7 because we
receive ssh-rsa-cert-v01@openssh.com as algorithm and rsa-sha2-256
or rsa-sha2-512 as signature format.
This patch is based on CL 412854 and has been tested with every version
of OpenSSH from 7.1 to 7.9 and OpenSSH 9.3.
Fixes golang/go#53391
Change-Id: Id71f596f73d84efb5c76d6d5388432cccad3e3b1
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/506835
Auto-Submit: Filippo Valsorda <filippo@golang.org >
Reviewed-by: Filippo Valsorda <filippo@golang.org >
Run-TryBot: Filippo Valsorda <filippo@golang.org >
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com >
TryBot-Result: Gopher Robot <gobot@golang.org >
Reviewed-by: Roland Shoemaker <roland@golang.org >
2023-07-10 19:57:54 +00:00
Nicola Murino
23b1b90df2
ssh: prefer sha256 based MAC algorithms
...
sha256 is more optimized than sha512 in Go and is secure enough
so prefer sha256 over sha512.
Fixes golang/go#61138
Change-Id: I7658808655367f1ab5f4ac8b52e6b20bd30ebf87
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/507555
Run-TryBot: Filippo Valsorda <filippo@golang.org >
Reviewed-by: Filippo Valsorda <filippo@golang.org >
Auto-Submit: Filippo Valsorda <filippo@golang.org >
Reviewed-by: Joedian Reid <joedian@golang.org >
TryBot-Result: Gopher Robot <gobot@golang.org >
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com >
2023-07-05 20:33:07 +00:00
Stan Hu
64c3993f5c
ssh: add hmac-sha2-512
...
This adds support for hmac-sha2-512 to ensure compatibility with SSH clients that request this MAC algorithm.
This rebases https://github.com/golang/crypto/pull/18 .
Change-Id: Ia103c10a8b7e2e8dde556d5c36550eb5fa6bc1f6
GitHub-Last-Rev: 987ccae2bc7ae5e90a482d8797351c39dcb9bf33
GitHub-Pull-Request: golang/crypto#257
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/501455
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com >
Commit-Queue: Han-Wen Nienhuys <hanwen@google.com >
Auto-Submit: Dmitri Shuralyov <dmitshur@google.com >
Reviewed-by: Han-Wen Nienhuys <hanwen@google.com >
Run-TryBot: Han-Wen Nienhuys <hanwen@google.com >
TryBot-Result: Gopher Robot <gobot@golang.org >
2023-06-22 14:36:59 +00:00
Bryan C. Mills
0ff60057bb
ssh/test: set a timeout and WaitDelay on sshd subcommands
...
This uses a copy of testenv.Command copied from the main repo, with
light edits to allow the testenv helpers to build with Go 1.19.
The testenv helper revealed an exec.Command leak in TestCertLogin, so
we also fix that leak and simplify server cleanup using
testing.T.Cleanup.
For golang/go#60099 .
Fixes golang/go#60343 .
Change-Id: I7f79fcdb559498b987ee7689972ac53b83870aaf
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/496935
Auto-Submit: Bryan Mills <bcmills@google.com >
TryBot-Result: Gopher Robot <gobot@golang.org >
Reviewed-by: Roland Shoemaker <roland@golang.org >
Run-TryBot: Bryan Mills <bcmills@google.com >
2023-06-15 16:06:57 +00:00
Stefan Klein
16222386f4
Add support for "hmac-sha2-512-etm@openssh.com"
...
Change-Id: I0203881afd7ad72e68f76650817451d7e292c91b
GitHub-Last-Rev: 42b4119e1987e7a46aa06a2b142d5fd3ef6f216a
GitHub-Pull-Request: golang/crypto#129
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/226982
Run-TryBot: Han-Wen Nienhuys <hanwen@google.com >
Reviewed-by: Han-Wen Nienhuys <hanwen@google.com >
Auto-Submit: Han-Wen Nienhuys <hanwen@google.com >
Reviewed-by: David Chase <drchase@google.com >
TryBot-Result: Gopher Robot <gobot@golang.org >
2023-06-05 16:42:04 +00:00
Tobias Klauser
3ef8056490
ssh/test: enable on solaris
...
Change-Id: Icf9c867e64ef68f6f46dd7d4cec07cf7c315c2ad
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/490155
Reviewed-by: Bryan Mills <bcmills@google.com >
Reviewed-by: Ian Lance Taylor <iant@google.com >
Run-TryBot: Tobias Klauser <tobias.klauser@gmail.com >
TryBot-Result: Gopher Robot <gobot@golang.org >
Auto-Submit: Tobias Klauser <tobias.klauser@gmail.com >
2023-05-04 16:27:40 +00:00
Tobias Klauser
a8cc953517
ssh: skip unsupported tests on wasip1
...
Updates golang/go#32840
Updates golang/go#58141
Change-Id: Ib4425c1743d417920745205586af250dbf80c7e4
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/485695
Auto-Submit: Tobias Klauser <tobias.klauser@gmail.com >
Reviewed-by: Bryan Mills <bcmills@google.com >
Run-TryBot: Tobias Klauser <tobias.klauser@gmail.com >
TryBot-Result: Gopher Robot <gobot@golang.org >
Reviewed-by: Ian Lance Taylor <iant@google.com >
2023-04-18 17:07:48 +00:00
Bryan C. Mills
7d6d3f5d4a
ssh/test: skip TestValidTerminalMode on non-Bourne shells
...
Fixes golang/go#38037 .
Change-Id: Ide77dddc9f57b3f0318a419a1474e11215623b64
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/485175
Run-TryBot: Bryan Mills <bcmills@google.com >
Commit-Queue: Bryan Mills <bcmills@google.com >
Auto-Submit: Bryan Mills <bcmills@google.com >
TryBot-Result: Gopher Robot <gobot@golang.org >
Reviewed-by: Roland Shoemaker <roland@golang.org >
2023-04-17 17:20:41 +00:00
cui fliter
018c28f8a1
all: fix some comments
...
Change-Id: Ia0410f1f3bb0a9ee68c6dbe1e6f62f65f9e00955
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/477755
Reviewed-by: Ian Lance Taylor <iant@google.com >
Auto-Submit: Ian Lance Taylor <iant@google.com >
Reviewed-by: Roland Shoemaker <roland@golang.org >
Auto-Submit: Roland Shoemaker <roland@golang.org >
Run-TryBot: shuang cui <imcusg@gmail.com >
Run-TryBot: Ian Lance Taylor <iant@google.com >
TryBot-Result: Gopher Robot <gobot@golang.org >
2023-03-20 20:33:29 +00:00
Anmol Sethi
c6a20f9984
ssh: document that ParseRawPrivateKey supports Ed25519 keys
...
From CL 173457 and CL 235358.
Change-Id: Ia46ab9c7e2c57472df3126ddc7050f0068fcaab9
GitHub-Last-Rev: c38e379355602fe4ff11ff65f98c296d5c326281
GitHub-Pull-Request: golang/crypto#146
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/241282
Auto-Submit: Han-Wen Nienhuys <hanwen@google.com >
Reviewed-by: Bryan Mills <bcmills@google.com >
Reviewed-by: Han-Wen Nienhuys <hanwen@google.com >
TryBot-Result: Gopher Robot <gobot@golang.org >
Run-TryBot: Han-Wen Nienhuys <hanwen@google.com >
2023-03-13 12:45:00 +00:00
Nicola Murino
ebe92624d1
ssh: add support for aes256-gcm@openssh.com
...
Change-Id: I91caf3bda3dfd00c050f5ebf23c2a35a04c5762b
GitHub-Last-Rev: 6e71340e7960b5b6f71f7b96eeeaf8dfb268e306
GitHub-Pull-Request: golang/crypto#127
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/223518
Auto-Submit: Filippo Valsorda <filippo@golang.org >
Run-TryBot: Filippo Valsorda <filippo@golang.org >
TryBot-Result: Gopher Robot <gobot@golang.org >
Reviewed-by: Roland Shoemaker <roland@golang.org >
Reviewed-by: Filippo Valsorda <filippo@golang.org >
Reviewed-by: Han-Wen Nienhuys <hanwen@google.com >
2023-02-15 20:22:00 +00:00
cui fliter
59ff47295c
all: fix some comments
...
Change-Id: I11030ee466c8cac6855ce4fe2cf72e0b8d7029f8
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/463796
Auto-Submit: Ian Lance Taylor <iant@google.com >
Reviewed-by: Michael Knyszek <mknyszek@google.com >
Run-TryBot: Ian Lance Taylor <iant@google.com >
TryBot-Result: Gopher Robot <gobot@golang.org >
Reviewed-by: Ian Lance Taylor <iant@google.com >
2023-01-30 18:50:24 +00:00
Bryan C. Mills
23edec0b38
ssh: ensure that handshakeTransport goroutines have finished before Close returns
...
This fixes a data race in the tests for x/crypto/ssh, which expects to
be able to examine a transport's read and write counters without
locking after closing it.
(Given the number of goroutines, channels, and mutexes used in this
package, I wouldn't be surprised if other concurrency bugs remain.
I would suggest simplifying the concurrency in this package, but I
don't intend to follow up on that myself at the moment.)
Fixes golang/go#56957 .
Change-Id: Ib1f1390b66707c66a3608e48f3f52483cff3c1f5
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/456758
Reviewed-by: Roland Shoemaker <roland@golang.org >
TryBot-Result: Gopher Robot <gobot@golang.org >
Auto-Submit: Bryan Mills <bcmills@google.com >
Run-TryBot: Bryan Mills <bcmills@google.com >
2022-12-12 22:32:12 +00:00
6fad3dfc18
ssh: support rsa-sha2-256/512 on the server side
...
This lets clients know we support rsa-sha2-256/512 signatures from
ssh-rsa public keys. OpenSSH prefers to break the connection rather than
attempting trial and error, apparently.
We don't enable support for the "ext-info-s" because we're not
interested in any client->server extensions.
This also replaces isAcceptableAlgo which was rejecting the
rsa-sha2-256/512-cert-v01@openssh.com public key algorithms.
Tested with OpenSSH 9.1 on macOS Ventura.
Fixes golang/go#49269
Updates golang/go#49952
Co-authored-by: Nicola Murino <nicola.murino@gmail.com >
Co-authored-by: Kristin Davidson <kdavidson@atlassian.com >
Change-Id: I4955c3b12bb45575e9977ac657bb5805b49d00c3
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/447757
Run-TryBot: Filippo Valsorda <filippo@golang.org >
TryBot-Result: Gopher Robot <gobot@golang.org >
Reviewed-by: Roland Shoemaker <roland@golang.org >
Reviewed-by: Nicola Murino <nicola.murino@gmail.com >
Reviewed-by: Michael Knyszek <mknyszek@google.com >
2022-11-12 16:25:23 +00:00
Park Zhou
334521b960
ssh: fix typo
...
Change-Id: I560d7f5a62161cd88361a9fe9982d36f8e25e5af
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/447475
Reviewed-by: Ian Lance Taylor <iant@google.com >
Auto-Submit: Ian Lance Taylor <iant@google.com >
Reviewed-by: Than McIntosh <thanm@google.com >
Run-TryBot: Ian Lance Taylor <iant@google.com >
TryBot-Result: Gopher Robot <gobot@golang.org >
2022-11-04 14:06:20 +00:00
Axel Wagner
56aed06173
all: use automatic RFC linking
...
pkgsite automatically links /RFC \d+/ to the mentioned RFC. Insert a
bunch of spaces into doc-comments for that to match.
Change-Id: I01834d7573428563f21c37e43316442e148dd8c4
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/442055
Reviewed-by: Joedian Reid <joedian@golang.org >
Run-TryBot: Ian Lance Taylor <iant@google.com >
TryBot-Result: Gopher Robot <gobot@golang.org >
Reviewed-by: Ian Lance Taylor <iant@google.com >
Auto-Submit: Ian Lance Taylor <iant@google.com >
2022-10-12 13:47:37 +00:00
cui fliter
9be5aaad42
all: fix a few function names on comments
...
Change-Id: Iac9c8f06b874e62b56f634dede8757b87514f421
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/442135
Run-TryBot: Ian Lance Taylor <iant@google.com >
Auto-Submit: Ian Lance Taylor <iant@google.com >
Reviewed-by: Ian Lance Taylor <iant@google.com >
TryBot-Result: Gopher Robot <gobot@golang.org >
Reviewed-by: Joedian Reid <joedian@golang.org >
2022-10-12 13:45:58 +00:00
Brad Fitzpatrick
d6f0a8c073
ssh: add ServerConfig.NoClientAuthCallback
...
It was possible to accept auth type "none" before, but not dynamically
at runtime as a function of the ConnMetadata like the other auth types'
callback hooks.
Fixes golang/go#51994
Change-Id: I83ea80901d4977d8f78523e3d1e16e0a7df5b172
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/395314
Reviewed-by: Roland Shoemaker <roland@golang.org >
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org >
TryBot-Result: Gopher Robot <gobot@golang.org >
Reviewed-by: Julie Qiu <julieqiu@google.com >
2022-10-10 15:29:10 +00:00
cui fliter
4161e89ecf
all: replace bytes.Compare with bytes.Equal
...
Change-Id: I911366b91ff2a1d02d7de202a166d876fb873142
GitHub-Last-Rev: f50e00376856fb9da36bb98ed0cdfd96c2f3b304
GitHub-Pull-Request: golang/crypto#233
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/438536
TryBot-Result: Gopher Robot <gobot@golang.org >
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com >
Reviewed-by: Ian Lance Taylor <iant@google.com >
Run-TryBot: Ian Lance Taylor <iant@google.com >
Auto-Submit: Ian Lance Taylor <iant@google.com >
2022-10-05 02:52:14 +00:00
cui fliter
35f4265a4b
all: replace io/ioutil with io and os package
...
For golang/go#45557
Change-Id: I447530cc66896aef7a8d528ccb8d095b80e3cf47
GitHub-Last-Rev: 5f385ff46487ac318bd1147cdbbd26bb0ffd0426
GitHub-Pull-Request: golang/crypto#230
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/430797
Auto-Submit: Ian Lance Taylor <iant@google.com >
Reviewed-by: Ian Lance Taylor <iant@google.com >
Reviewed-by: Meng Zhuo <mzh@golangcn.org >
Run-TryBot: Ian Lance Taylor <iant@google.com >
TryBot-Result: Gopher Robot <gobot@golang.org >
Reviewed-by: Cherry Mui <cherryyz@google.com >
2022-09-19 17:36:07 +00:00
edef
bd7e27e617
ssh/agent: match OpenSSH extensionAgentMsg, not IETF draft
...
The OpenSSH wire format just suffixes the raw extension body,
without a nested string.
Fixes golang/go#51689
Change-Id: Ic224cedb934ba0563abca9a45a6be1c67769ed6d
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/412154
Reviewed-by: Roland Shoemaker <roland@golang.org >
Run-TryBot: Filippo Valsorda <filippo@golang.org >
Run-TryBot: hopehook <hopehook@qq.com >
Reviewed-by: Daniel Lublin <daniel@lublin.se >
Auto-Submit: Filippo Valsorda <filippo@golang.org >
Reviewed-by: Filippo Valsorda <filippo@golang.org >
TryBot-Result: Gopher Robot <gobot@golang.org >
Reviewed-by: David Chase <drchase@google.com >
2022-08-26 18:10:53 +00:00
Filippo Valsorda
46612604a0
ssh/agent: fix non-RSA certificates
...
The type of ssh.PublicKey.Type can be a certificate type, while the
algorithm passed to SignWithAlgorithm is going to be an underlying
algorithm.
Fixes golang/go#52185
Change-Id: I0f7c46defa83d1fd64a3c1e861734650b20cca21
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/404614
TryBot-Result: Gopher Robot <gobot@golang.org >
Reviewed-by: Heschi Kreinick <heschi@google.com >
Reviewed-by: Roland Shoemaker <roland@golang.org >
Auto-Submit: Filippo Valsorda <filippo@golang.org >
Run-TryBot: Filippo Valsorda <filippo@golang.org >
2022-05-13 21:02:58 +00:00
Russ Cox
7b82a4e95d
all: gofmt
...
Gofmt to update doc comments to the new formatting.
For golang/go#51082 .
Change-Id: I076031b6613691eefbb0f21739366e3fd2011ec9
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/399356
Run-TryBot: Russ Cox <rsc@golang.org >
TryBot-Result: Gopher Robot <gobot@golang.org >
Auto-Submit: Russ Cox <rsc@golang.org >
Reviewed-by: Ian Lance Taylor <iant@google.com >
2022-04-11 22:02:26 +00:00
Peter Verraedt
2c7772ba30
ssh: send ext-info-c only once
...
In accordance to RFC8308, send ext-info-c only during the first key
exchange. Some server implementations such as OpenSSH 7 will send an
extInfoMsg message each time when ext-info-c is received. This results
in a closed connection, as our client does not expect this message while
handling the mux.
See https://bugzilla.mindrot.org/show_bug.cgi?id=2929 regarding the
behaviour of OpenSSH if it sees ext-info-c in later key exchanges.
Fixes golang/go#51808
Change-Id: Id94f1ef73cec6147136246b0b6048b57db92660d
GitHub-Last-Rev: fcfe5ed37306136219854031abc809e0dc9b3124
GitHub-Pull-Request: golang/crypto#208
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/394134
Reviewed-by: Filippo Valsorda <filippo@golang.org >
Run-TryBot: Filippo Valsorda <filippo@golang.org >
TryBot-Result: Gopher Robot <gobot@golang.org >
Trust: Roland Shoemaker <roland@golang.org >
2022-03-21 15:39:16 +00:00
Filippo Valsorda
3147a52a75
ssh: support rsa-sha2-256/512 for client certificates
...
The server-sig-algs logic was not working for certificate algorithms.
Follow-up on CL 392394.
Tested with OpenSSH 8.8 configured with
PubkeyAcceptedKeyTypes -ssh-rsa-cert-v01@openssh.com
Updates golang/go#39885
For golang/go#49952
Change-Id: Ic230dd6f98e96b7938acbd0128ab37d33b70abe5
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/392974
Trust: Filippo Valsorda <filippo@golang.org >
Run-TryBot: Filippo Valsorda <filippo@golang.org >
Reviewed-by: Roland Shoemaker <roland@golang.org >
TryBot-Result: Gopher Robot <gobot@golang.org >
2022-03-15 16:07:06 +00:00
Edoardo Spadolini
Will Mortensen
Pavel Repin
Heschi Kreinick
Randy Reddig
Nicola Murino
Matt Dainty
Bryan C. Mills
Dmitri Shuralyov
Sebastiaan van Stijn
Mariano Cano
Boshi Lian
Stan Hu
Stefan Klein
Tobias Klauser
cui fliter
Anmol Sethi
Park Zhou
Axel Wagner
Brad Fitzpatrick
edef
Russ Cox
Peter Verraedt