Repository navigation
internal: enforce accepted-key list in userauth - #1355
ejohnstown wants to merge 1 commit into
Conversation
6d700a2 to
06d4e83
Compare
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #1355
Scan targets checked: wolfssh-src, wolfssh-bugs
Coverage: 2 of 2 in-scope changed file(s) opened by the reviewer
Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)
This review was generated automatically by Fenrir. Reported findings require changes before merge.
Review tier: Lite
DoUserAuthRequestPublicKey() refuses a public key algorithm whose name is not on algoListKeyAccepted, the list the server advertises in server-sig-algs (RFC 8308 section 3.1). A NULL list leaves only the compiled-in check. - Match by name: the three OpenSSH RSA certificate names share one ID - Require an RSA certificate signature to use the hash its name carries - Advertise ssh-rsa-cert-v01 only where an ssh-rsa signature is accepted - Add TestUserAuthPkHonorsAcceptedList and TestUserAuthOsshRsaCertHonorsAcceptedList to the regress tests Issue: F-16810
06d4e83 to
6544781
Compare
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #1355
Scan targets checked: wolfssh-src, wolfssh-bugs
Coverage: 2 of 2 in-scope changed file(s) opened by the reviewer
Fenrir result: Approved ✅
No new issues found in the changed files.
Advisory only — this automated result does not count as a GitHub approval.
Review tier: Lite
Fenrir's latest completed scan found no issues; clearing the prior automated change request.
The server refuses public-key userauth with an algorithm missing from
algoListKeyAccepted, the list it advertises in server-sig-algs
(RFC 8308 Section 3.1). A NULL list keeps the compiled-in check.
RSA certificate names share one ID
ssh-rsa-cert-v01 is advertised only where ssh-rsa is accepted
TestUserAuthOsshRsaCertHonorsAcceptedList
Issue: F-16810