Skip to content

Commit 42ee18b

Browse files
drakkangopherbot
authored andcommitted
ssh: return ServerAuthError after too many auth failures
if a client is disconnected due to too many authentication attempts we should return a ServerAuthError instead of a generic error. Some users check the error returned by NewServerConn to determine whether or not a client attempted to authenticate. Fixes golang/go#69191 Change-Id: If68fcecdefd6c810fe9df8256b1216e320d8a916 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/566398 Reviewed-by: Filippo Valsorda <filippo@golang.org> Reviewed-by: Tim King <taking@google.com> Auto-Submit: Nicola Murino <nicola.murino@gmail.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Carlos Amedee <carlos@golang.org>
1 parent 9e92970 commit 42ee18b

File tree

2 files changed

+20
-9
lines changed

2 files changed

+20
-9
lines changed

ssh/client_auth_test.go

+18-7
Original file line numberDiff line numberDiff line change
@@ -641,17 +641,28 @@ func TestClientAuthMaxAuthTries(t *testing.T) {
641641
defer c1.Close()
642642
defer c2.Close()
643643

644-
go newServer(c1, serverConfig)
645-
_, _, _, err = NewClientConn(c2, "", clientConfig)
646-
if tries > 2 {
647-
if err == nil {
644+
errCh := make(chan error, 1)
645+
646+
go func() {
647+
_, err := newServer(c1, serverConfig)
648+
errCh <- err
649+
}()
650+
_, _, _, cliErr := NewClientConn(c2, "", clientConfig)
651+
srvErr := <-errCh
652+
653+
if tries > serverConfig.MaxAuthTries {
654+
if cliErr == nil {
648655
t.Fatalf("client: got no error, want %s", expectedErr)
649-
} else if err.Error() != expectedErr.Error() {
656+
} else if cliErr.Error() != expectedErr.Error() {
650657
t.Fatalf("client: got %s, want %s", err, expectedErr)
651658
}
659+
var authErr *ServerAuthError
660+
if !errors.As(srvErr, &authErr) {
661+
t.Errorf("expected ServerAuthError, got: %v", srvErr)
662+
}
652663
} else {
653-
if err != nil {
654-
t.Fatalf("client: got %s, want no error", err)
664+
if cliErr != nil {
665+
t.Fatalf("client: got %s, want no error", cliErr)
655666
}
656667
}
657668
}

ssh/server.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -510,8 +510,8 @@ userAuthLoop:
510510
if err := s.transport.writePacket(Marshal(discMsg)); err != nil {
511511
return nil, err
512512
}
513-
514-
return nil, discMsg
513+
authErrs = append(authErrs, discMsg)
514+
return nil, &ServerAuthError{Errors: authErrs}
515515
}
516516

517517
var userAuthReq userAuthRequestMsg

0 commit comments

Comments
 (0)