[GITEA] Restrict certificate type for builtin SSH server

- While doing some sanity checks over OpenSSH's code for how they
handle certificates authentication. I stumbled on an condition that
checks the certificate type is really an user certificate on the
server-side authentication. This checks seems to be a formality and just
for the sake of good domain seperation, because an user and host
certificate don't differ in their generation, verification or flags that
can be included.
- Add this check to the builtin SSH server to stay close to the
unwritten SSH specification.
- This is an breaking change for setups where the builtin SSH server is
being used and for some reason host certificates were being used for
authentication.

(cherry picked from commit 74c88c3217)
(cherry picked from commit 40df1875da)
(cherry picked from commit 07152e9a9d)
This commit is contained in:
Gusted 2023-08-01 00:29:34 +02:00 committed by Earl Warren
parent 3fe019ca3c
commit 7bc135732d
No known key found for this signature in database
GPG key ID: 0579CB2928A78A00

View file

@ -191,6 +191,12 @@ func publicKeyHandler(ctx ssh.Context, key ssh.PublicKey) bool {
return false
}
if cert.CertType != gossh.UserCert {
log.Warn("Certificate Rejected: Not a user certificate")
log.Warn("Failed authentication attempt from %s", ctx.RemoteAddr())
return false
}
// look for the exact principal
principalLoop:
for _, principal := range cert.ValidPrincipals {