Skip to content

Commit 40517c7

Browse files
HouseKHouseK
committed
ssh: add (*Client).DialContext method
This change adds DialContext to ssh.Client, which opens a TCP-IP connection tunneled over the SSH connection. This is useful for proxying network connections, e.g. setting (net/http.Transport).DialContext. Fixes golang/go#20288. Change-Id: I110494c00962424ea803065535ebe2209364ac27 GitHub-Last-Rev: 3176984 GitHub-Pull-Request: golang#260 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/504735 Run-TryBot: Nicola Murino <[email protected]> Run-TryBot: Han-Wen Nienhuys <[email protected]> Auto-Submit: Nicola Murino <[email protected]> Reviewed-by: Han-Wen Nienhuys <[email protected]> Reviewed-by: Dmitri Shuralyov <[email protected]> TryBot-Result: Gopher Robot <[email protected]> Reviewed-by: Nicola Murino <[email protected]> Commit-Queue: Nicola Murino <[email protected]>
2 parents 127a3e6 + 152cdb1 commit 40517c7

36 files changed

+947
-179
lines changed

‎argon2/blamka_amd64.s

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -199,8 +199,8 @@ TEXT ·mixBlocksSSE2(SB), 4, $0-32
199199
MOVQ out+0(FP), DX
200200
MOVQ a+8(FP), AX
201201
MOVQ b+16(FP), BX
202-
MOVQ a+24(FP), CX
203-
MOVQ $128, BP
202+
MOVQ c+24(FP), CX
203+
MOVQ $128, DI
204204

205205
loop:
206206
MOVOU 0(AX), X0
@@ -213,7 +213,7 @@ loop:
213213
ADDQ $16, BX
214214
ADDQ $16, CX
215215
ADDQ $16, DX
216-
SUBQ $2, BP
216+
SUBQ $2, DI
217217
JA loop
218218
RET
219219

@@ -222,8 +222,8 @@ TEXT ·xorBlocksSSE2(SB), 4, $0-32
222222
MOVQ out+0(FP), DX
223223
MOVQ a+8(FP), AX
224224
MOVQ b+16(FP), BX
225-
MOVQ a+24(FP), CX
226-
MOVQ $128, BP
225+
MOVQ c+24(FP), CX
226+
MOVQ $128, DI
227227

228228
loop:
229229
MOVOU 0(AX), X0
@@ -238,6 +238,6 @@ loop:
238238
ADDQ $16, BX
239239
ADDQ $16, CX
240240
ADDQ $16, DX
241-
SUBQ $2, BP
241+
SUBQ $2, DI
242242
JA loop
243243
RET

‎blake2b/blake2bAVX2_amd64.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
// Use of this source code is governed by a BSD-style
33
// license that can be found in the LICENSE file.
44

5-
//go:build go1.7 && amd64 && gc && !purego
5+
//go:build amd64 && gc && !purego
66

77
package blake2b
88

‎blake2b/blake2bAVX2_amd64.s

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
// Use of this source code is governed by a BSD-style
33
// license that can be found in the LICENSE file.
44

5-
//go:build go1.7 && amd64 && gc && !purego
5+
//go:build amd64 && gc && !purego
66

77
#include "textflag.h"
88

‎blake2b/blake2b_amd64.go

Lines changed: 0 additions & 24 deletions
This file was deleted.

‎blake2b/register.go

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,6 @@
22
// Use of this source code is governed by a BSD-style
33
// license that can be found in the LICENSE file.
44

5-
//go:build go1.9
6-
75
package blake2b
86

97
import (

‎chacha20poly1305/chacha20poly1305_amd64.s

Lines changed: 22 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -183,11 +183,31 @@ GLOBL ·andMask<>(SB), (NOPTR+RODATA), $240
183183
#define shiftD1Right BYTE $0x66; BYTE $0x45; BYTE $0x0f; BYTE $0x3a; BYTE $0x0f; BYTE $0xd2; BYTE $0x04 // PALIGNR $4, X10, X10
184184
#define shiftD2Right BYTE $0x66; BYTE $0x45; BYTE $0x0f; BYTE $0x3a; BYTE $0x0f; BYTE $0xdb; BYTE $0x04 // PALIGNR $4, X11, X11
185185
#define shiftD3Right BYTE $0x66; BYTE $0x45; BYTE $0x0f; BYTE $0x3a; BYTE $0x0f; BYTE $0xff; BYTE $0x04 // PALIGNR $4, X15, X15
186+
186187
// Some macros
188+
189+
// ROL rotates the uint32s in register R left by N bits, using temporary T.
190+
#define ROL(N, R, T) \
191+
MOVO R, T; PSLLL $(N), T; PSRLL $(32-(N)), R; PXOR T, R
192+
193+
// ROL16 rotates the uint32s in register R left by 16, using temporary T if needed.
194+
#ifdef GOAMD64_v2
195+
#define ROL16(R, T) PSHUFB ·rol16<>(SB), R
196+
#else
197+
#define ROL16(R, T) ROL(16, R, T)
198+
#endif
199+
200+
// ROL8 rotates the uint32s in register R left by 8, using temporary T if needed.
201+
#ifdef GOAMD64_v2
202+
#define ROL8(R, T) PSHUFB ·rol8<>(SB), R
203+
#else
204+
#define ROL8(R, T) ROL(8, R, T)
205+
#endif
206+
187207
#define chachaQR(A, B, C, D, T) \
188-
PADDD B, A; PXOR A, D; PSHUFB ·rol16<>(SB), D \
208+
PADDD B, A; PXOR A, D; ROL16(D, T) \
189209
PADDD D, C; PXOR C, B; MOVO B, T; PSLLL $12, T; PSRLL $20, B; PXOR T, B \
190-
PADDD B, A; PXOR A, D; PSHUFB ·rol8<>(SB), D \
210+
PADDD B, A; PXOR A, D; ROL8(D, T) \
191211
PADDD D, C; PXOR C, B; MOVO B, T; PSLLL $7, T; PSRLL $25, B; PXOR T, B
192212

193213
#define chachaQR_AVX2(A, B, C, D, T) \

‎cryptobyte/asn1.go

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -733,13 +733,14 @@ func (s *String) ReadOptionalASN1OctetString(out *[]byte, outPresent *bool, tag
733733
return true
734734
}
735735

736-
// ReadOptionalASN1Boolean sets *out to the value of the next ASN.1 BOOLEAN or,
737-
// if the next bytes are not an ASN.1 BOOLEAN, to the value of defaultValue.
738-
// It reports whether the operation was successful.
739-
func (s *String) ReadOptionalASN1Boolean(out *bool, defaultValue bool) bool {
736+
// ReadOptionalASN1Boolean attempts to read an optional ASN.1 BOOLEAN
737+
// explicitly tagged with tag into out and advances. If no element with a
738+
// matching tag is present, it sets "out" to defaultValue instead. It reports
739+
// whether the read was successful.
740+
func (s *String) ReadOptionalASN1Boolean(out *bool, tag asn1.Tag, defaultValue bool) bool {
740741
var present bool
741742
var child String
742-
if !s.ReadOptionalASN1(&child, &present, asn1.BOOLEAN) {
743+
if !s.ReadOptionalASN1(&child, &present, tag) {
743744
return false
744745
}
745746

@@ -748,7 +749,7 @@ func (s *String) ReadOptionalASN1Boolean(out *bool, defaultValue bool) bool {
748749
return true
749750
}
750751

751-
return s.ReadASN1Boolean(out)
752+
return child.ReadASN1Boolean(out)
752753
}
753754

754755
func (s *String) readASN1(out *String, outTag *asn1.Tag, skipHeader bool) bool {

‎cryptobyte/asn1_test.go

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -115,6 +115,28 @@ func TestReadASN1OptionalInteger(t *testing.T) {
115115
}
116116
}
117117

118+
const defaultBool = false
119+
120+
var optionalBoolTestData = []readASN1Test{
121+
{"empty", []byte{}, 0xa0, true, false},
122+
{"invalid", []byte{0xa1, 0x3, 0x1, 0x2, 0x7f}, 0xa1, false, defaultBool},
123+
{"missing", []byte{0xa1, 0x3, 0x1, 0x1, 0x7f}, 0xa0, true, defaultBool},
124+
{"present", []byte{0xa1, 0x3, 0x1, 0x1, 0xff}, 0xa1, true, true},
125+
}
126+
127+
func TestReadASN1OptionalBoolean(t *testing.T) {
128+
for _, test := range optionalBoolTestData {
129+
t.Run(test.name, func(t *testing.T) {
130+
in := String(test.in)
131+
var out bool
132+
ok := in.ReadOptionalASN1Boolean(&out, test.tag, defaultBool)
133+
if ok != test.ok || ok && out != test.out.(bool) {
134+
t.Errorf("in.ReadOptionalASN1Boolean() = %v, want %v; out = %v, want %v", ok, test.ok, out, test.out)
135+
}
136+
})
137+
}
138+
}
139+
118140
func TestReadASN1IntegerSigned(t *testing.T) {
119141
testData64 := []struct {
120142
in []byte

‎curve25519/internal/field/_asm/go.mod

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ require (
99

1010
require (
1111
golang.org/x/mod v0.8.0 // indirect
12-
golang.org/x/sys v0.13.0 // indirect
12+
golang.org/x/sys v0.14.0 // indirect
1313
golang.org/x/tools v0.6.0 // indirect
1414
)
1515

‎curve25519/internal/field/_asm/go.sum

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -26,21 +26,21 @@ golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBc
2626
golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
2727
golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
2828
golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
29-
golang.org/x/sys v0.13.0 h1:Af8nKPmuFypiUBjVoU9V20FiaFXOcuZI21p0ycVYYGE=
30-
golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
29+
golang.org/x/sys v0.14.0 h1:Vz7Qs629MkJkGyHxUlRHizWJRG2j8fbQKjELVSNhy7Q=
30+
golang.org/x/sys v0.14.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
3131
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
3232
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
3333
golang.org/x/term v0.1.0/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
3434
golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
3535
golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
36-
golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U=
36+
golang.org/x/term v0.14.0/go.mod h1:TySc+nGkYR6qt8km8wUhuFRTVSMIX3XPR58y2lC8vww=
3737
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
3838
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
3939
golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
4040
golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
4141
golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
4242
golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
43-
golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
43+
golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
4444
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
4545
golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
4646
golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=

‎go.mod

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,8 @@ go 1.18
44

55
require (
66
golang.org/x/net v0.10.0 // tagx:ignore
7-
golang.org/x/sys v0.13.0
8-
golang.org/x/term v0.13.0
7+
golang.org/x/sys v0.15.0
8+
golang.org/x/term v0.15.0
99
)
1010

11-
require golang.org/x/text v0.13.0 // indirect
11+
require golang.org/x/text v0.14.0 // indirect

‎go.sum

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
golang.org/x/net v0.10.0 h1:X2//UzNDwYmtCLn7To6G58Wr6f5ahEAQgKNzv9Y951M=
22
golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
3-
golang.org/x/sys v0.13.0 h1:Af8nKPmuFypiUBjVoU9V20FiaFXOcuZI21p0ycVYYGE=
4-
golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
5-
golang.org/x/term v0.13.0 h1:bb+I9cTfFazGW51MZqBVmZy7+JEJMouUHTUSKVQLBek=
6-
golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U=
7-
golang.org/x/text v0.13.0 h1:ablQoSUd0tRdKxZewP80B+BaqeKJuVhuRxj/dkrun3k=
8-
golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
3+
golang.org/x/sys v0.15.0 h1:h48lPFYpsTvQJZF4EKyI4aLHaev3CxivZmv7yZig9pc=
4+
golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
5+
golang.org/x/term v0.15.0 h1:y/Oo/a/q3IXu26lQgl04j/gjuBDOBlx7X6Om1j2CPW4=
6+
golang.org/x/term v0.15.0/go.mod h1:BDl952bC7+uMoWR75FIrCDx79TPU9oHkTZ9yRbYOrX0=
7+
golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
8+
golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=

‎hkdf/hkdf.go

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,9 @@ func (f *hkdf) Read(p []byte) (int, error) {
5656

5757
// Fill the rest of the buffer
5858
for len(p) > 0 {
59-
f.expander.Reset()
59+
if f.counter > 1 {
60+
f.expander.Reset()
61+
}
6062
f.expander.Write(f.prev)
6163
f.expander.Write(f.info)
6264
f.expander.Write([]byte{f.counter})

‎sha3/keccakf_amd64.s

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -319,9 +319,9 @@
319319
MOVQ rDi, _si(oState); \
320320
MOVQ rDo, _so(oState) \
321321

322-
// func keccakF1600(state *[25]uint64)
322+
// func keccakF1600(a *[25]uint64)
323323
TEXT ·keccakF1600(SB), 0, $200-8
324-
MOVQ state+0(FP), rpState
324+
MOVQ a+0(FP), rpState
325325

326326
// Convert the user state into an internal state
327327
NOTQ _be(rpState)

‎ssh/channel.go

Lines changed: 20 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -187,9 +187,11 @@ type channel struct {
187187
pending *buffer
188188
extPending *buffer
189189

190-
// windowMu protects myWindow, the flow-control window.
191-
windowMu sync.Mutex
192-
myWindow uint32
190+
// windowMu protects myWindow, the flow-control window, and myConsumed,
191+
// the number of bytes consumed since we last increased myWindow
192+
windowMu sync.Mutex
193+
myWindow uint32
194+
myConsumed uint32
193195

194196
// writeMu serializes calls to mux.conn.writePacket() and
195197
// protects sentClose and packetPool. This mutex must be
@@ -332,14 +334,24 @@ func (ch *channel) handleData(packet []byte) error {
332334
return nil
333335
}
334336

335-
func (c *channel) adjustWindow(n uint32) error {
337+
func (c *channel) adjustWindow(adj uint32) error {
336338
c.windowMu.Lock()
337-
// Since myWindow is managed on our side, and can never exceed
338-
// the initial window setting, we don't worry about overflow.
339-
c.myWindow += uint32(n)
339+
// Since myConsumed and myWindow are managed on our side, and can never
340+
// exceed the initial window setting, we don't worry about overflow.
341+
c.myConsumed += adj
342+
var sendAdj uint32
343+
if (channelWindowSize-c.myWindow > 3*c.maxIncomingPayload) ||
344+
(c.myWindow < channelWindowSize/2) {
345+
sendAdj = c.myConsumed
346+
c.myConsumed = 0
347+
c.myWindow += sendAdj
348+
}
340349
c.windowMu.Unlock()
350+
if sendAdj == 0 {
351+
return nil
352+
}
341353
return c.sendMessage(windowAdjustMsg{
342-
AdditionalBytes: uint32(n),
354+
AdditionalBytes: sendAdj,
343355
})
344356
}
345357

‎ssh/client.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,7 @@ func NewClientConn(c net.Conn, addr string, config *ClientConfig) (Conn, <-chan
8282

8383
if err := conn.clientHandshake(addr, &fullConf); err != nil {
8484
c.Close()
85-
return nil, nil, nil, fmt.Errorf("ssh: handshake failed: %v", err)
85+
return nil, nil, nil, fmt.Errorf("ssh: handshake failed: %w", err)
8686
}
8787
conn.mux = newMux(conn.transport)
8888
return conn, conn.mux.incomingChannels, conn.mux.incomingRequests, nil

‎ssh/client_auth.go

Lines changed: 19 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -307,7 +307,10 @@ func (cb publicKeyCallback) auth(session []byte, user string, c packetConn, rand
307307
}
308308
var methods []string
309309
var errSigAlgo error
310-
for _, signer := range signers {
310+
311+
origSignersLen := len(signers)
312+
for idx := 0; idx < len(signers); idx++ {
313+
signer := signers[idx]
311314
pub := signer.PublicKey()
312315
as, algo, err := pickSignatureAlgorithm(signer, extensions)
313316
if err != nil && errSigAlgo == nil {
@@ -321,6 +324,21 @@ func (cb publicKeyCallback) auth(session []byte, user string, c packetConn, rand
321324
if err != nil {
322325
return authFailure, nil, err
323326
}
327+
// OpenSSH 7.2-7.7 advertises support for rsa-sha2-256 and rsa-sha2-512
328+
// in the "server-sig-algs" extension but doesn't support these
329+
// algorithms for certificate authentication, so if the server rejects
330+
// the key try to use the obtained algorithm as if "server-sig-algs" had
331+
// not been implemented if supported from the algorithm signer.
332+
if !ok && idx < origSignersLen && isRSACert(algo) && algo != CertAlgoRSAv01 {
333+
if contains(as.Algorithms(), KeyAlgoRSA) {
334+
// We retry using the compat algorithm after all signers have
335+
// been tried normally.
336+
signers = append(signers, &multiAlgorithmSigner{
337+
AlgorithmSigner: as,
338+
supportedAlgorithms: []string{KeyAlgoRSA},
339+
})
340+
}
341+
}
324342
if !ok {
325343
continue
326344
}

0 commit comments

Comments
 (0)