SSH host certificates are expected to contain hostnames only,
not "host:port" format.
This change allows Go clients to connect to OpenSSH servers that
use host certificates.
Note, this change will break any clients that use ssh.NewClientConn()
with an `addr` that is not in `host:port` format (they will see a
"missing port in address" error).
Fixes bug 20273.
Change-Id: I5a306c6b7b419a737e1f0f9c5ca8c585e21a45a4
Reviewed-on: https://go-review.googlesource.com/43475
Reviewed-by: Han-Wen Nienhuys <hanwen@google.com>
Run-TryBot: Han-Wen Nienhuys <hanwen@google.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Added support for parsing the "new" openssh private key format.
(ed25519 keys only in this format for now)
Signing and verifying functions now work with ed25519 keys.
ed25519 can now be accepted by the server to authenticate a client.
ed25519 can now be accepted by a client as a server host key.
Related documentation used:
https://www.ietf.org/archive/id/draft-bjh21-ssh-ed25519-02.txt
Change-Id: I84385f24d666fea08de21f980f78623f7bff8007
Reviewed-on: https://go-review.googlesource.com/22512
Reviewed-by: Han-Wen Nienhuys <hanwen@google.com>
Run-TryBot: Han-Wen Nienhuys <hanwen@google.com>
Make x/crypto/ssh tests compatible with recent OpenSSH versions.
This means not using rsa keys shorter than 1024 bits any more, and
explicitly enabling all key types in the OpenSSH config, since some
are now disabled by default.
Tested against OpenSSH_7.2p2 and now passes.
Change-Id: I607bf15f063d4833b0876393d6845a4f507f48af
Reviewed-on: https://go-review.googlesource.com/22840
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
This proposal effectively disables all the ssh/test tests when run with the -short flag supplied.
For developers and users of this package, there should be no change unless they are in the habbit of always supplying -short, which I belive is untrue.
For the CI dashboard the effect should be that these tests, which are really not portable enough to run reliably on all our various builders, are disabled.
LGTM=adg
R=adg, agl, hanwen
CC=golang-codereviews
https://golang.org/cl/125860043
This obviates custom code to emulate a thread-safe connection.
Use this for testing that listeners close if the connection breaks.
R=dave, agl, fullung
CC=golang-dev
https://golang.org/cl/11781043
Fixesgolang/go#5138.
Fixesgolang/go#4703.
This appears to pass my stress tests with and without the -race detector, but I'd like to see others hit it with their machines.
R=golang-dev, fullung, huin, kardianos, agl
CC=golang-dev
https://golang.org/cl/9929043
If cgo is disabled (such as it appears to be on a subset of builders),
username() panics, and s.cmd is nil; let's not panic while recovering
from a different panic.
R=golang-dev, dave
CC=golang-dev
https://golang.org/cl/8820043
user.Current() currently requires cgo - if an error is returned
attempt to get the username from the environment.
R=golang-dev, minux.ma, bradfitz, dave
CC=golang-dev
https://golang.org/cl/6819113
Fixesgolang/go#4285.
Adding a new cipher that is supported by the remote end, but not supported by our client causes that cipher to be considered a valid candidate. This fails later in setupKeys when there is no cipherModes configuration.
In summary, unsupported ciphers cannot be willed into existence by adding them to the client config. This change enforces this.
R=golang-dev, agl
CC=golang-dev
https://golang.org/cl/6780047
This proposal is an attempt to improve the state of functional testing in the ssh package. The previous functional tests required the user to give away some personal details, like their password and private key to run the tests, and so were probably not run as frequently as they should.
R=agl, gustav.paul, kardianos, fullung
CC=golang-dev
https://golang.org/cl/6601043
Adam Eijdenberg
Akihiro Suda
Martin Garton
Andrew Gerrand
Dave Cheney
Mikio Hara
David du Colombier
Adam Langley
Han-Wen Nienhuys
David Symonds
Albert Strasheim
Alex Brainman
Joel Sing
Ian Lance Taylor