ssh: reject incomplete gssapi-with-mic configurations#345
Conversation
|
This PR (HEAD: 9336922) has been imported to Gerrit for code review. Please visit Gerrit at https://go-review.googlesource.com/c/crypto/+/773460. Important tips:
|
|
Message from Gopher Robot: Patch Set 1: (1 comment) Please don’t reply on this GitHub thread. Visit golang.org/cl/773460. |
|
Message from Gopher Robot: Patch Set 1: Congratulations on opening your first change. Thank you for your contribution! Next steps: Most changes in the Go project go through a few rounds of revision. This can be During May-July and Nov-Jan the Go project is in a code freeze, during which Please don’t reply on this GitHub thread. Visit golang.org/cl/773460. |
|
Message from Nicola Murino: Patch Set 2: Commit-Queue+1 (2 comments) Please don’t reply on this GitHub thread. Visit golang.org/cl/773460. |
|
Message from Go LUCI: Patch Set 2: Dry run: CV is trying the patch. Bot data: {"action":"start","triggered_at":"2026-05-03T18:44:17Z","revision":"c8130c1bec774d04b995e0018b97b5785fd0d6d2"} Please don’t reply on this GitHub thread. Visit golang.org/cl/773460. |
|
Message from Nicola Murino: Patch Set 2: -Commit-Queue (Performed by <GERRIT_ACCOUNT_60063> on behalf of <GERRIT_ACCOUNT_35201>) Please don’t reply on this GitHub thread. Visit golang.org/cl/773460. |
|
Message from Go LUCI: Patch Set 2: This CL has passed the run Please don’t reply on this GitHub thread. Visit golang.org/cl/773460. |
|
Message from Go LUCI: Patch Set 2: LUCI-TryBot-Result+1 Please don’t reply on this GitHub thread. Visit golang.org/cl/773460. |
|
This PR (HEAD: 0267bda) has been imported to Gerrit for code review. Please visit Gerrit at https://go-review.googlesource.com/c/crypto/+/773460. Important tips:
|
|
Message from Filippo Valsorda: Patch Set 3: Code-Review+2 Please don’t reply on this GitHub thread. Visit golang.org/cl/773460. |
|
Message from povcfe: Patch Set 3: Code-Review+1 (3 comments) Please don’t reply on this GitHub thread. Visit golang.org/cl/773460. |
Make the runtime gssapi-with-mic guard match the existing
configuration and method advertisement checks.
An incomplete GSSAPIWithMICConfig can be treated as unavailable when
building the advertised auth method list, while still remaining
reachable from the runtime auth dispatcher. Treat incomplete
configurations as not configured.
This change introduces a single internal completeness check for
GSSAPIWithMICConfig and uses it for the startup authentication
validation, the runtime gssapi-with-mic dispatch guard, and the
advertised authentication method list.
The change also adds a regression test. The test configures a server
with a normal PasswordCallback, a GSSAPIWithMICConfig with Server set,
and AllowLogin intentionally unset. It then uses a custom client auth
method that explicitly sends a USERAUTH_REQUEST with Method set to
gssapi-with-mic even though the server does not advertise that method,
and verifies that authentication fails cleanly with
"ssh: gssapi-with-mic auth not configured".
No golang/go issue reference is available yet.