Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

x/crypto/ssh: Client Auth: handle partial success correctly when processing userAuthFailure responses #23461

Closed
samiponkanen opened this issue Jan 17, 2018 · 1 comment
Closed

x/crypto/ssh: Client Auth: handle partial success correctly when processing userAuthFailure responses #23461

samiponkanen opened this issue Jan 17, 2018 · 1 comment
Labels
FrozenDueToAge
Milestone
Unreleased

Comments

@samiponkanen
Copy link

GO ssh library client does not handle correctly the partial success flag in SSH_MSG_USERAUTH_FAILURE authentication responses.

There seems to be some code in client_auth.go to handle this case when public key authentication is used. Password and keyboard-interactive authentication used with the RetryableAuthMethod wrapper do not handle such authentication responses correctly. Also the bookkeeping of failed authentication methods in clientAuthenticate() does not work correctly when authentication steps complete with partial success.

What version of Go are you using (go version)?

go version go1.9.2 linux/amd64

Does this issue reproduce with the latest release?

Yes

What operating system and processor architecture are you using (go env)?

GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOOS="linux"

What did you do?

  1. Configure go ssh library client with RetryableAuthMethod(PasswordCallback) and PublicKeysCallback authentication methods. Use maxTries >= 2 with the RetryableAuthMethod.

  2. Configure openssh server with multi-auth: /etc/ssh/sshd_config:
    AuthenticationMethods password,publickey

  3. Connect client to server. Return the correct password when PasswordCallback() is called.

What did you expect to see?

Expected to see first PasswordCallback() getting called once and then PublicKeysCallback() getting called.

What did you see instead?

PasswordCallback() is always called two times, regardless if the returned password is correct or incorrect.

This happens because retryableAuthMethod.auth() does not exit from the loop when underlying auth method fails with userAuthFailure but PartialSuccess set to true.
@gopherbot gopherbot added this to the Unreleased milestone Jan 17, 2018
@gopherbot
Copy link

Change https://golang.org/cl/88035 mentions this issue: ssh: fix support for partial success authentication responses in client

@golang golang locked and limited conversation to collaborators Feb 8, 2019
bored-engineer pushed a commit to bored-engineer/ssh that referenced this issue Oct 13, 2019
@samiponkanen @hanwen
ssh: fix support for partial success authentication responses in client
fdfab3e 
The existing client side authentication does not handle correctly
the partial success flag in SSH_MSG_USERAUTH_FAILURE authentication
responses.

This commit fixes two problems in ssh library:
1) RetryableAuthMethod() now breaks out from the retry loop and
   returns  when underlying auth method fails with partial success
   set to true.
2) Book keeping of tried (and failed) auth methods in
   clientAuthenticate() does not mark an auth method failed if it
   fails with partial success set to true.

Fixes golang/go#23461

Change-Id: Ib2e1a1d54bfe2549496199bb2f66ebbce58d130d
Reviewed-on: https://go-review.googlesource.com/88035
Reviewed-by: Han-Wen Nienhuys <hanwen@google.com>
Run-TryBot: Han-Wen Nienhuys <hanwen@google.com>
bored-engineer pushed a commit to bored-engineer/ssh that referenced this issue Oct 13, 2019
@samiponkanen @hanwen
ssh: fix support for partial success authentication responses in client
d397755 
The existing client side authentication does not handle correctly
the partial success flag in SSH_MSG_USERAUTH_FAILURE authentication
responses.

This commit fixes two problems in ssh library:
1) RetryableAuthMethod() now breaks out from the retry loop and
   returns  when underlying auth method fails with partial success
   set to true.
2) Book keeping of tried (and failed) auth methods in
   clientAuthenticate() does not mark an auth method failed if it
   fails with partial success set to true.

Fixes golang/go#23461

Change-Id: Ib2e1a1d54bfe2549496199bb2f66ebbce58d130d
Reviewed-on: https://go-review.googlesource.com/88035
Reviewed-by: Han-Wen Nienhuys <hanwen@google.com>
Run-TryBot: Han-Wen Nienhuys <hanwen@google.com>
bored-engineer pushed a commit to bored-engineer/ssh that referenced this issue Oct 13, 2019
@samiponkanen @hanwen
ssh: fix support for partial success authentication responses in client
a66270f 
The existing client side authentication does not handle correctly
the partial success flag in SSH_MSG_USERAUTH_FAILURE authentication
responses.

This commit fixes two problems in ssh library:
1) RetryableAuthMethod() now breaks out from the retry loop and
   returns  when underlying auth method fails with partial success
   set to true.
2) Book keeping of tried (and failed) auth methods in
   clientAuthenticate() does not mark an auth method failed if it
   fails with partial success set to true.

Fixes golang/go#23461

Change-Id: Ib2e1a1d54bfe2549496199bb2f66ebbce58d130d
Reviewed-on: https://go-review.googlesource.com/88035
Reviewed-by: Han-Wen Nienhuys <hanwen@google.com>
Run-TryBot: Han-Wen Nienhuys <hanwen@google.com>
c-expert-zigbee pushed a commit to c-expert-zigbee/crypto_go that referenced this issue Mar 28, 2022
@samiponkanen @hanwen
ssh: fix support for partial success authentication responses in client
f5d696f 
The existing client side authentication does not handle correctly
the partial success flag in SSH_MSG_USERAUTH_FAILURE authentication
responses.

This commit fixes two problems in ssh library:
1) RetryableAuthMethod() now breaks out from the retry loop and
   returns  when underlying auth method fails with partial success
   set to true.
2) Book keeping of tried (and failed) auth methods in
   clientAuthenticate() does not mark an auth method failed if it
   fails with partial success set to true.

Fixes golang/go#23461

Change-Id: Ib2e1a1d54bfe2549496199bb2f66ebbce58d130d
Reviewed-on: https://go-review.googlesource.com/88035
Reviewed-by: Han-Wen Nienhuys <hanwen@google.com>
Run-TryBot: Han-Wen Nienhuys <hanwen@google.com>
c-expert-zigbee pushed a commit to c-expert-zigbee/crypto_go that referenced this issue Mar 29, 2022
@samiponkanen @hanwen
ssh: fix support for partial success authentication responses in client
1e56e2b 
The existing client side authentication does not handle correctly
the partial success flag in SSH_MSG_USERAUTH_FAILURE authentication
responses.

This commit fixes two problems in ssh library:
1) RetryableAuthMethod() now breaks out from the retry loop and
   returns  when underlying auth method fails with partial success
   set to true.
2) Book keeping of tried (and failed) auth methods in
   clientAuthenticate() does not mark an auth method failed if it
   fails with partial success set to true.

Fixes golang/go#23461

Change-Id: Ib2e1a1d54bfe2549496199bb2f66ebbce58d130d
Reviewed-on: https://go-review.googlesource.com/88035
Reviewed-by: Han-Wen Nienhuys <hanwen@google.com>
Run-TryBot: Han-Wen Nienhuys <hanwen@google.com>
LewiGoddard pushed a commit to LewiGoddard/crypto that referenced this issue Feb 16, 2023
@samiponkanen @hanwen
ssh: fix support for partial success authentication responses in client
f9d2f71 
The existing client side authentication does not handle correctly
the partial success flag in SSH_MSG_USERAUTH_FAILURE authentication
responses.

This commit fixes two problems in ssh library:
1) RetryableAuthMethod() now breaks out from the retry loop and
   returns  when underlying auth method fails with partial success
   set to true.
2) Book keeping of tried (and failed) auth methods in
   clientAuthenticate() does not mark an auth method failed if it
   fails with partial success set to true.

Fixes golang/go#23461

Change-Id: Ib2e1a1d54bfe2549496199bb2f66ebbce58d130d
Reviewed-on: https://go-review.googlesource.com/88035
Reviewed-by: Han-Wen Nienhuys <hanwen@google.com>
Run-TryBot: Han-Wen Nienhuys <hanwen@google.com>
BiiChris pushed a commit to BiiChris/crypto that referenced this issue Sep 15, 2023
@samiponkanen @hanwen
ssh: fix support for partial success authentication responses in client
422e38d 
The existing client side authentication does not handle correctly
the partial success flag in SSH_MSG_USERAUTH_FAILURE authentication
responses.

This commit fixes two problems in ssh library:
1) RetryableAuthMethod() now breaks out from the retry loop and
   returns  when underlying auth method fails with partial success
   set to true.
2) Book keeping of tried (and failed) auth methods in
   clientAuthenticate() does not mark an auth method failed if it
   fails with partial success set to true.

Fixes golang/go#23461

Change-Id: Ib2e1a1d54bfe2549496199bb2f66ebbce58d130d
Reviewed-on: https://go-review.googlesource.com/88035
Reviewed-by: Han-Wen Nienhuys <hanwen@google.com>
Run-TryBot: Han-Wen Nienhuys <hanwen@google.com>
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
FrozenDueToAge
Projects
None yet
Milestone
Unreleased
Development

No branches or pull requests
2 participants
@gopherbot @samiponkanen