This is done by running the key exchange and setting the session ID
under mutex. If the first exchange encounters an already set session
ID, then do nothing.
This fixes a race condition:
On setting up the connection, both sides sent a kexInit to initiate
the first (mandatory) key exchange. If one side was faster, the
faster side might have completed the key exchange, before the slow
side had a chance to send a kexInit. The slow side would send a
kexInit which would trigger a second key exchange. The resulting
confirmation message (msgNewKeys) would confuse the authentication
loop.
This fix removes sessionID from the transport struct.
This fix also deletes the unused interface rekeyingTransport.
Fixes#15066
Change-Id: I7f303bce5d3214c9bdd58f52d21178a185871d90
Reviewed-on: https://go-review.googlesource.com/21606
Reviewed-by: Adam Langley <agl@golang.org>
Reviewed-by: Han-Wen Nienhuys <hanwen@google.com>
To facilitate testing of methods in other GOOSs we need plan9 to
be able to build and run the test without a errors due to
undefined methods.
Fixesgolang/go#15195
Change-Id: Ida334676f92db6fb4652af3e3a9f6bc13a96052c
Reviewed-on: https://go-review.googlesource.com/21711
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
Previously, only V4 signatures were allowed in PGP messages,
and attempts to digest a message with a V3 signature would
yield an `errors.StructuralError("LiteralData not followed by Signature")`.
This patch fixes this shortcoming, by trying to consume either
signature type and verifying accordingly.
Change-Id: I27c8ea781b75b0f7dfc42c01e7de40f3323e9579
Reviewed-on: https://go-review.googlesource.com/14794
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
When parsing a truncated clearsigned message (one that includes the
opening header but no armored data), the existing implementation of
clearsign.Decode() hangs in an infinite loop. This commit changes
Decode() to detect the end of the buffer and return as if no
clearsigned message was found.
Change-Id: Ibc85b29a08d22868470f48fe300bf8fcb4749768
Reviewed-on: https://go-review.googlesource.com/17693
Reviewed-by: Adam Langley <agl@golang.org>
Previously, OCSP errors (like “malformed request”, not “that certificate
is revoked”) were intended to result in a Response being returned with
Status set to ServerFailed. However, since an “optional” tag was missing
in the ASN.1, a parse error was actually returned.
This CL changes that behaviour so that ParseResponse will now return an
error for these responses. That error will be a ResponseError, allowing
callers to find the exact error code.
Change-Id: I4f8ae5ba39203c2c204fb1d65471d1427bf68b25
Reviewed-on: https://go-review.googlesource.com/18944
Reviewed-by: Adam Langley <agl@golang.org>
When writing keys that contain ElGamal subkeys, the openpgp
package would previously return an error.
Change-Id: I1c487f4a9cfb92b40e99e9be6aa4ed5928e36dbe
Reviewed-on: https://go-review.googlesource.com/18254
Reviewed-by: Adam Langley <agl@golang.org>
Some current uses of OCSP require extensions. In particular, Certificate
Transparency (RFC 6962) can use an OCSP extension to carry a Signed
Certificate Timestamp. This patch adds support for OCSP extensions (in
particular, singleExtensions), by adding Extensions and ExtraExtensions
fields with the same semantics as in x509.Certificate.
As a side-effect, trying to parse a response with a critical extension
will now return an error, just like parsing a certificate.
This change does not enable extensions in OCSP requests, just responses.
Change-Id: I5918f26ea1bb9d1ece96e85a6bb7691c7c017467
Reviewed-on: https://go-review.googlesource.com/18202
Reviewed-by: Adam Langley <agl@golang.org>
The Remove method for the keyring sliced the internal keys list
incorrectly when removing a key. This caused the wrong key to be removed
or sometimes multiple keys were removed. Additionally, if the key to be
removed was the last key, the method never returned.
Fixesgolang/go#13628
Change-Id: I0facbcb8f8b65709222067ce37ea26e3fb5ba8e8
Reviewed-on: https://go-review.googlesource.com/17870
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
We have clang-format these days to eliminate any worries about C-code
formatting.
Change-Id: I86433d99f786ac4091c39eb4a41422c5a18d4d4a
Reviewed-on: https://go-review.googlesource.com/16937
Reviewed-by: Andrew Gerrand <adg@golang.org>
The test for this package contains a test case (disabled by default)
that exercises the code against libotr (the reference implementation).
Since that test was written, libotr has updated to version 4 which
contains non-backwards-compatible API changes.
This change updates the test harness for version 4 of libotr.
Change-Id: Ib40c899c609cc827903ae18fd80476d179bf0a33
Reviewed-on: https://go-review.googlesource.com/16936
Reviewed-by: Andrew Gerrand <adg@golang.org>
Since the test against libotr (disabled by default) runs forever, any
errors should be fatal otherwise they'll never be noticed.
Change-Id: Idf07dd963260f140be1950afcbd04331b56bd627
Reviewed-on: https://go-review.googlesource.com/16935
Reviewed-by: Andrew Gerrand <adg@golang.org>
The OTR implementation had a bug where key slots would not be marked as
unused after a rehandshake. Since handshaking resets the key ids, some
key slots would be left over with much higher key ids. These key slots
would lead to an error when the code ran out of slots.
Fixesagl/xmpp-client#96.
Change-Id: I013bbc4eaf0616373ab52f14b7f7757c353983ca
Reviewed-on: https://go-review.googlesource.com/16934
Reviewed-by: Andrew Gerrand <adg@golang.org>
cound -> could
Also change fmt.Errorf -> errors.New for consistency.
Change-Id: I0b6900a76b70cd37ab2e8d61327868b46366ec64
Reviewed-on: https://go-review.googlesource.com/11235
Reviewed-by: Adam Langley <agl@golang.org>
* The other side is left hanging, waiting for their chance to do the
comparison.
Change-Id: I186933ebb53a30e190414c5572206851681e0a37
Reviewed-on: https://go-review.googlesource.com/15260
Reviewed-by: Adam Langley <agl@golang.org>
A bug in the PBKDF implementation in the pkcs12 package caused certain
inputs to produce the wrong output. In step 6C, we treat Ij as a big.Int
of v bytes and compute Ij + B + 1. The resulting big.Int can have
leading zero bytes, such that Ij.Bytes() produces a byte array that is
smaller than v bytes. In this case we must zero-pad the output to make
Ijb properly sized.
Change-Id: I6e672e6f6bbbd5bea419355d318db289731bb174
Reviewed-on: https://go-review.googlesource.com/16520
Reviewed-by: Adam Langley <agl@golang.org>
SymmetricKeyEncrypted cached the results of decryption so, if a bad
password was given, ReadMessage would prompt forever because a later,
correct password wouldn't override the cached decryption.
The SymmetricKeyEncrypted object can't know whether a given passphrase
is correct so it should never have been a mutable object in the first
place. This change makes it so that it doesn't cache anything.
Fixes#9315
Change-Id: Ic2b75f7f60a575e2182ac7e5c5d4198597c5d0a2
Reviewed-on: https://go-review.googlesource.com/14038
Reviewed-by: Andrew Gerrand <adg@golang.org>
Reviewed-by: Adam Langley <agl@golang.org>
280be00 introduced custom server versions; however, at least OpenSSH
clients do not accept a server version that doesn't start with a
protocol version like "SSH-2.0-"; this is not documented in this
library, and automatically adding it in case that the user did not does
no harm.
Change-Id: Iafc23b23160a8277b10cbf29778dc64a96351bd7
Reviewed-on: https://go-review.googlesource.com/14018
Reviewed-by: Adam Langley <agl@golang.org>
This adds a NewSignerFromSigner to crypto/ssh which takes a
crypto.Signer and turns it into an ssh.Signer, helpful if, e.g., your
crypto.Signer is backed by some sort of hardware device.
The interfaces are very similar - the biggest differences are that a
crypto.Signer accepts hashed data, while an ssh.Signer does not, and
some differences in encoding for DSA and ECDSA signatures.
This also adjusts NewSignerFromKey to use NewSignerFromSigner where
possible, dropping the rsaPrivateKey and ecdsaPrivateKey types in
favor of wrappedSigner. (However, because *dsa.PrivateKey is not a
crypto.Signer, we still have to keep dsaPrivateKey)
Change-Id: Ia2e20ece9c9d3844b4e5a64c1a7d997178ec8781
Reviewed-on: https://go-review.googlesource.com/10953
Reviewed-by: Adam Langley <agl@golang.org>
Change parseECDSA() to unmarshal the key's contents into a struct
representing the wire format, consistent with the parseRSA() and
parseDSA(), to make the code more readable and its intent clearer.
Change-Id: Iea85630107ac0b3e681807d2278390c8c50ce141
Reviewed-on: https://go-review.googlesource.com/13663
Reviewed-by: Han-Wen Nienhuys <hanwenn@gmail.com>
Reviewed-by: Adam Langley <agl@golang.org>
clearsign.Encode currently creates bad signatures for inputs containing
lines that that consist of only whitespace (gpg --verify and
clearsign.Decode both agree the signature is bad).
RFC 4880 section 7.1 says trailing whitespace is removed when generating
the signature. The previous code correctly handled this for the case of
not being at the beginning of the line by buffering the whitespace.
The previous code had incorrect behavior for the case of being at the
beginning of a line. It was only special-casing dashes and newlines,
directly hashing all other characters.
This happened to work for lines that had leading whitespace followed by
non-whitespace characters, since in that case the leading whitespace is
not trailing.
However, this behavior is incorrect for whitespace-only lines: The
previous code would incorrectly add the first whitespace character to
the hash, when instead it should have been dropped.
This commit moves the whitespace check so that it always happens,
regardless of whether we are at the beginning of a line.
This adds a few tests to capture the expected behavior. The last three
tests fail without the included code change.
Change-Id: I17848b8aaad6f7a4cee414d486be236f7edddd0b
Reviewed-on: https://go-review.googlesource.com/13681
Reviewed-by: Adam Langley <agl@golang.org>
The error message reported by the ssh client when it can't find a
"cipher" in common between the client and server was overly vague. This
adds more detailed error messages to findAgreedAlgorithms so that the
user can more easily identify which of the components can't reach
agreement.
Change-Id: I4d985e92fea964793213e5600b52b3141e712000
Reviewed-on: https://go-review.googlesource.com/13817
Reviewed-by: Adam Langley <agl@golang.org>
In the initial patch enabling generation of OCSP responses, the Reason
field in the revokedInfo struct used for serializing responses was set
to type int. That type maps to the ASN.1 type INTEGER, not ENUMERATED,
as required by RFC 6960. As a result, if you serialize an OCSP
resonse with the Reason field populated, then it will be rejected as
malformed by compliant OCSP parsers.
This patch changes the type of the Reason field in revokedInfo to
asn1.Enumerated. It leaves the RevocationReason field in the public
Response struct as int, and converts between the two. The patch
also adds constant for the defined revocation reasons.
Change-Id: I97205319503f447cde12d9a0bb0bd1a8db7a66ee
Reviewed-on: https://go-review.googlesource.com/13964
Reviewed-by: Adam Langley <agl@golang.org>
The current ARM implementation assumes that the input message
is memory aligned and so it can cause alignment fault when it
is not enabled. Also it may generate incorrect outputs in ARMv5.
This change fixes this issue by temporarily copying the input
to a local aligned space. Although there may be a better way
to handle unaligned access, this would be a safe way in all
ARM versions.
This change also added a test and benchmarks with unaligned
data. The benchmark result on RasberryPI 2 is
Benchmark64 2000000 812 ns/op 78.81 MB/s
Benchmark1K 200000 7809 ns/op 131.12 MB/s
Benchmark64Unaligned 2000000 967 ns/op 66.13 MB/s
Benchmark1KUnaligned 200000 10316 ns/op 99.26 MB/s
Change-Id: I189cc1b7bb6c67a04c9877271fb27326f2896e82
Reviewed-on: https://go-review.googlesource.com/12797
Reviewed-by: Adam Langley <agl@golang.org>
Unblock writers if a read error occurs while writers are blocked on a
pending key change.
Add test to check for deadlocks in error paths in handshake.go
Fixesgolang/go#11992.
Change-Id: Id098bd9fec3d4fe83daeb2b7f935e5647c19afd3
Reviewed-on: https://go-review.googlesource.com/13594
Reviewed-by: Adam Langley <agl@golang.org>
The current implementation is not compliant with the ASN.1 structure
for an OCSP response in RFC 6960. In the RFC, the "revoked" field is
marked "implicit". The "explicit" tag in the current struct causes
the encoder to emit an additional SEQUENCE, which cases some parsers
(notably OpenSSL) to reject OCSP responses as malformed. This patch
simply removes the "explicit" tag, so that the emitted DER is
compliant with the RFC.
Change-Id: Ifa65a73a8d24f08fe3c2794309df772edc8bb114
Reviewed-on: https://go-review.googlesource.com/13572
Reviewed-by: Adam Langley <agl@golang.org>
If the channel open request failed, a nil channel would be provided to
DiscardRequests, which would never return.
We return the error early to avoid this goroutine leak.
Change-Id: I4c0e0a7698f7623c042f2a04941b8c50e8031d33
Reviewed-on: https://go-review.googlesource.com/13390
Reviewed-by: Dave Cheney <dave@cheney.net>
Update golang/go#11811
The increased default concurrency in Go 1.5 showed up a test flake in
the TestHostKeyCert test. Under load, when the client provided incorrect
data, both sides would race to tear down the connection, which would often
lead to the server side, running in its own goroutine to see an unexpected
EOF or connection reset.
Fix this flake (and the incorrect use of t.Fatalf) by passing the error back
to the main goroutine for inspection. This also lets us ignore the expected
error in the unsuccessful path
Change-Id: I5a95c6d240479e9d537f34177e5ca8023b1b08e9
Reviewed-on: https://go-review.googlesource.com/12916
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Fixesgolang/go#11882
If an error occurs during handshakeTransport.writePacket the lock may not be
released. Fix this by using defer rather than manually unlocking in all paths.
Change-Id: I0010284b4f7d99907c86b4c0e140ab6cf37b0441
Reviewed-on: https://go-review.googlesource.com/12888
Reviewed-by: Adam Langley <agl@golang.org>
parseRSAPrivateKey calls rsa.PrivateKey.Precompute which triggers
divide-by-zero panic if either p or q is 1. Sanity check the parsed
values by calling rsa.PrivateKey.Validate.
Fixesgolang/go#11505
Change-Id: Ia6c9eccca0cfa49aaa58716e708c557a788bb204
Reviewed-on: https://go-review.googlesource.com/12356
Reviewed-by: Adam Langley <agl@golang.org>
Han-Wen Nienhuys
John Schnake
Maxwell Krohn
Julian Kornberger
Lynn Boger
Jacob H. Haven
Adam Langley
Benjamin Wester
Peter Moody
Sami Commerot
Brad Fitzpatrick
Richard Barnes
Mark Severson
Carl Jackson
Jonathan Boulle
Arlo Breault
Cedric Staub
Paul Meyer
Lewin Bormann
Evan Broder
Reinaldo de Souza Jr
Matt Bostock
SeanBurford
Peter Tseng
Thomas Desrosiers
Jungho Ahn
Eric Garrido
Dave Cheney
David du Colombier
Dhiru Kholia
Michael Gehring