Nicola Murino b27e1504e3 ssh: don't close the connection on an unparseable public key ...

In the server's publickey authentication path, a public key blob that
ParsePublicKey could not decode caused serverAuthenticate to return an
error, tearing down the whole connection. A key we cannot parse is part
of an individual authentication attempt, not a transport-level framing
error, so it must fail only that attempt. This lets the client fall
back to other keys or authentication methods.

Updates golang/go#80075

Change-Id: I8d882d08bb50eb33e0054d9d9c2bd9e0b3039443
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/795420
Reviewed-by: David Chase <drchase@google.com>
LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Michael Pratt <mpratt@google.com>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
Auto-Submit: Nicola Murino <nicola.murino@gmail.com>

2026-07-13 12:20:29 -07:00

..

agent

ssh/agent: enforce strict limits on DSA key parameters

2026-06-30 10:06:28 -07:00

internal/bcrypt_pbkdf

ssh: support encrypted OpenSSH private keys

2020-02-04 10:40:54 +00:00

knownhosts

ssh/knownhosts: reject lines with multiple or unknown markers

2026-06-02 00:24:36 -07:00

terminal

ssh/terminal: replace with a golang.org/x/term wrapper

2020-11-16 15:36:03 +00:00

test

ssh/test: isolate CLI tests from user SSH config and agent

2026-06-02 00:25:33 -07:00

testdata

ssh: fix error message on unsupported cipher

2025-11-12 10:42:48 -08:00

benchmark_test.go

ssh: fix call to Fatalf from a non-test goroutine

2023-07-31 18:14:41 +00:00

buffer_test.go

go.crypto/ssh: import gosshnew.

2014-04-09 13:57:52 -07:00

buffer.go

ssh: remove unused buffer.eof return value

2017-09-25 11:19:01 +00:00

certs_test.go

ssh: enforce user presence verification for security keys

2026-05-21 17:03:20 -07:00

certs.go

ssh: enforce user presence verification for security keys

2026-05-21 17:03:20 -07:00

channel_test.go

ssh: fix infinite loop on large channel writes due to integer overflow

2026-05-21 17:03:23 -07:00

channel.go

ssh: initialize new channels fully before adding them to chanList

2026-07-12 08:19:12 -07:00

cipher_test.go

ssh: expose negotiated algorithms

2025-05-15 10:44:04 -07:00

cipher.go

ssh: fix incorrect operator order

2026-05-21 17:03:25 -07:00

client_auth_test.go

ssh: don't close the connection on an unparseable public key

2026-07-13 12:20:29 -07:00

client_auth.go

ssh: add AuthCallback to ClientConfig

2026-05-21 19:36:57 -07:00

client_test.go

ssh: export supported algorithms

2025-05-15 10:43:30 -07:00

client.go

ssh: add openssh controlmaster socket support

2026-05-21 19:39:36 -07:00

common_test.go

ssh: return clearer error when signature algorithm is used as key format

2025-09-15 23:32:56 -07:00

common.go

ssh: add support for FIPS mode

2025-09-27 12:36:52 -07:00

connection.go

ssh: add openssh controlmaster socket support

2026-05-21 19:39:36 -07:00

control_test.go

ssh: add openssh controlmaster socket support

2026-05-21 19:39:36 -07:00

control.go

ssh: add openssh controlmaster socket support

2026-05-21 19:39:36 -07:00

doc.go

ssh: add support for FIPS mode

2025-09-27 12:36:52 -07:00

example_test.go

all: fix some typos in comment

2025-10-08 13:58:26 -07:00

handshake_test.go

all: fix some typos in comment

2025-10-08 13:58:26 -07:00

handshake.go

ssh: remove custom contains, use slices.Contains

2025-09-15 23:33:16 -07:00

kex_test.go

ssh: improve DH GEX group selection using PreferredBits

2026-06-02 00:23:03 -07:00

kex.go

ssh: improve DH GEX group selection using PreferredBits

2026-06-02 00:23:03 -07:00

keys_test.go

ssh: verify declared key type matches decoded key in authorized_keys

2026-06-30 10:24:32 -07:00

keys.go

ssh: verify declared key type matches decoded key in authorized_keys

2026-06-30 10:24:32 -07:00

mac.go

ssh: add support for FIPS mode

2025-09-27 12:36:52 -07:00

mempipe_test.go

ssh: defer channel window adjustment

2023-11-27 17:27:49 +00:00

messages_test.go

ssh: sanitize client disconnect messages

2026-06-29 10:23:17 -07:00

messages.go

ssh: sanitize client disconnect messages

2026-06-29 10:23:17 -07:00

mlkem.go

ssh: remove Go 1.24 build tag for ML-KEM kex

2025-08-26 00:42:33 -07:00

mux_test.go

ssh: initialize new channels fully before adding them to chanList

2026-07-12 08:19:12 -07:00

mux.go

ssh: initialize new channels fully before adding them to chanList

2026-07-12 08:19:12 -07:00

server_multi_auth_test.go

ssh: fix data race in the doClientServerAuth test helper

2026-07-12 08:19:29 -07:00

server_test.go

ssh: document and test source-address behavior for non-IP transports

2026-07-12 08:19:47 -07:00

server.go

ssh: don't close the connection on an unparseable public key

2026-07-13 12:20:29 -07:00

session_test.go

ssh: prevent malformed exit-status panic

2026-05-25 19:49:21 -07:00

session.go

ssh: prevent malformed exit-status panic

2026-05-25 19:49:21 -07:00

ssh_gss_test.go

ssh: curb GSSAPI DoS risk by limiting number of specified OIDs

2025-11-19 11:28:37 -08:00

ssh_gss.go

ssh: curb GSSAPI DoS risk by limiting number of specified OIDs

2025-11-19 11:28:37 -08:00

streamlocal.go

ssh: allow to bind to a hostname in remote forwarding

2025-11-12 10:42:45 -08:00

tcpip_test.go

ssh: add (*Client).DialContext method

2023-11-27 15:35:52 +00:00

tcpip.go

ssh: allow to bind to a hostname in remote forwarding

2025-11-12 10:42:45 -08:00

testdata_test.go

ssh: don't advertise rsa-sha2 algorithms if we can't use them

2022-03-14 23:46:59 +00:00

transport_test.go

ssh: fix protocol version exchange (for multi-line)

2018-01-11 10:11:23 +00:00

transport.go

ssh: add support for FIPS mode

2025-09-27 12:36:52 -07:00