Nicola Murino b9229ecc70 ssh: reject a present but empty source-address critical option ...

checkSourceAddressCriticalOption treated a source-address critical
option with an empty value as if the option was absent, allowing
authentication from any address. A callback (or certificate authority)
building the value dynamically from an empty allowlist would intend to
deny all sources, not to lift the restriction. This also contradicts
the documented contract that the option is validated whenever it is
present, and differs from OpenSSH, where an empty address list matches
nothing.

Change-Id: I1c0de27cbcab8817a7ff446019c25cd19957a7d7
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/797041
LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: David Chase <drchase@google.com>
Reviewed-by: Junyang Shao <shaojunyang@google.com>
Reviewed-by: Filippo Valsorda <filippo@golang.org>

2026-07-12 08:19:43 -07:00

..

agent

ssh/agent: enforce strict limits on DSA key parameters

2026-06-30 10:06:28 -07:00

internal/bcrypt_pbkdf

ssh: support encrypted OpenSSH private keys

2020-02-04 10:40:54 +00:00

knownhosts

ssh/knownhosts: reject lines with multiple or unknown markers

2026-06-02 00:24:36 -07:00

terminal

ssh/terminal: replace with a golang.org/x/term wrapper

2020-11-16 15:36:03 +00:00

test

ssh/test: isolate CLI tests from user SSH config and agent

2026-06-02 00:25:33 -07:00

testdata

ssh: fix error message on unsupported cipher

2025-11-12 10:42:48 -08:00

benchmark_test.go

ssh: fix call to Fatalf from a non-test goroutine

2023-07-31 18:14:41 +00:00

buffer_test.go

go.crypto/ssh: import gosshnew.

2014-04-09 13:57:52 -07:00

buffer.go

ssh: remove unused buffer.eof return value

2017-09-25 11:19:01 +00:00

certs_test.go

ssh: enforce user presence verification for security keys

2026-05-21 17:03:20 -07:00

certs.go

ssh: enforce user presence verification for security keys

2026-05-21 17:03:20 -07:00

channel_test.go

ssh: fix infinite loop on large channel writes due to integer overflow

2026-05-21 17:03:23 -07:00

channel.go

ssh: initialize new channels fully before adding them to chanList

2026-07-12 08:19:12 -07:00

cipher_test.go

ssh: expose negotiated algorithms

2025-05-15 10:44:04 -07:00

cipher.go

ssh: fix incorrect operator order

2026-05-21 17:03:25 -07:00

client_auth_test.go

ssh: reject incomplete gssapi-with-mic configurations

2026-06-02 00:25:39 -07:00

client_auth.go

ssh: add AuthCallback to ClientConfig

2026-05-21 19:36:57 -07:00

client_test.go

ssh: export supported algorithms

2025-05-15 10:43:30 -07:00

client.go

ssh: add openssh controlmaster socket support

2026-05-21 19:39:36 -07:00

common_test.go

ssh: return clearer error when signature algorithm is used as key format

2025-09-15 23:32:56 -07:00

common.go

ssh: add support for FIPS mode

2025-09-27 12:36:52 -07:00

connection.go

ssh: add openssh controlmaster socket support

2026-05-21 19:39:36 -07:00

control_test.go

ssh: add openssh controlmaster socket support

2026-05-21 19:39:36 -07:00

control.go

ssh: add openssh controlmaster socket support

2026-05-21 19:39:36 -07:00

doc.go

ssh: add support for FIPS mode

2025-09-27 12:36:52 -07:00

example_test.go

all: fix some typos in comment

2025-10-08 13:58:26 -07:00

handshake_test.go

all: fix some typos in comment

2025-10-08 13:58:26 -07:00

handshake.go

ssh: remove custom contains, use slices.Contains

2025-09-15 23:33:16 -07:00

kex_test.go

ssh: improve DH GEX group selection using PreferredBits

2026-06-02 00:23:03 -07:00

kex.go

ssh: improve DH GEX group selection using PreferredBits

2026-06-02 00:23:03 -07:00

keys_test.go

ssh: verify declared key type matches decoded key in authorized_keys

2026-06-30 10:24:32 -07:00

keys.go

ssh: verify declared key type matches decoded key in authorized_keys

2026-06-30 10:24:32 -07:00

mac.go

ssh: add support for FIPS mode

2025-09-27 12:36:52 -07:00

mempipe_test.go

ssh: defer channel window adjustment

2023-11-27 17:27:49 +00:00

messages_test.go

ssh: sanitize client disconnect messages

2026-06-29 10:23:17 -07:00

messages.go

ssh: sanitize client disconnect messages

2026-06-29 10:23:17 -07:00

mlkem.go

ssh: remove Go 1.24 build tag for ML-KEM kex

2025-08-26 00:42:33 -07:00

mux_test.go

ssh: initialize new channels fully before adding them to chanList

2026-07-12 08:19:12 -07:00

mux.go

ssh: initialize new channels fully before adding them to chanList

2026-07-12 08:19:12 -07:00

server_multi_auth_test.go

ssh: fix data race in the doClientServerAuth test helper

2026-07-12 08:19:29 -07:00

server_test.go

ssh: reject a present but empty source-address critical option

2026-07-12 08:19:43 -07:00

server.go

ssh: reject a present but empty source-address critical option

2026-07-12 08:19:43 -07:00

session_test.go

ssh: prevent malformed exit-status panic

2026-05-25 19:49:21 -07:00

session.go

ssh: prevent malformed exit-status panic

2026-05-25 19:49:21 -07:00

ssh_gss_test.go

ssh: curb GSSAPI DoS risk by limiting number of specified OIDs

2025-11-19 11:28:37 -08:00

ssh_gss.go

ssh: curb GSSAPI DoS risk by limiting number of specified OIDs

2025-11-19 11:28:37 -08:00

streamlocal.go

ssh: allow to bind to a hostname in remote forwarding

2025-11-12 10:42:45 -08:00

tcpip_test.go

ssh: add (*Client).DialContext method

2023-11-27 15:35:52 +00:00

tcpip.go

ssh: allow to bind to a hostname in remote forwarding

2025-11-12 10:42:45 -08:00

testdata_test.go

ssh: don't advertise rsa-sha2 algorithms if we can't use them

2022-03-14 23:46:59 +00:00

transport_test.go

ssh: fix protocol version exchange (for multi-line)

2018-01-11 10:11:23 +00:00

transport.go

ssh: add support for FIPS mode

2025-09-27 12:36:52 -07:00