tailscale

History

Andrew Lytvynov 29e98e18f8 ssh/tailssh: use a local error instead of gossh.ErrDenied (#10743 ) ErrDenied was added in [our fork of x/crypto/ssh](`acc6f8fe8d`) to short-circuit auth attempts once one fails. In the case of our callbacks, this error is returned when SSH policy check determines that a connection should not be allowed. Both `NoClientAuthCallback` and `PublicKeyHandler` check the policy and will fail anyway. The `fakePasswordHandler` returns true only if `NoClientAuthCallback` succeeds the policy check, so it checks it indirectly too. The difference here is that a client might attempt all 2-3 auth methods instead of just `none` but will fail to authenticate regardless. Updates #8593 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>	2024-01-05 08:02:42 -08:00
..
tailssh	ssh/tailssh: use a local error instead of gossh.ErrDenied (#10743 )	2024-01-05 08:02:42 -08:00

ssh/tailssh: use a local error instead of gossh.ErrDenied (#10743 )

ErrDenied was added in [our fork of
x/crypto/ssh](acc6f8fe8d)
to short-circuit auth attempts once one fails.

In the case of our callbacks, this error is returned when SSH policy
check determines that a connection should not be allowed. Both
`NoClientAuthCallback` and `PublicKeyHandler` check the policy and will
fail anyway. The `fakePasswordHandler` returns true only if
`NoClientAuthCallback` succeeds the policy check, so it checks it
indirectly too.

The difference here is that a client might attempt all 2-3 auth methods
instead of just `none` but will fail to authenticate regardless.

Updates #8593

Signed-off-by: Andrew Lytvynov <awly@tailscale.com>

2024-01-05 08:02:42 -08:00

tailssh ssh/tailssh: use a local error instead of gossh.ErrDenied (#10743 ) 2024-01-05 08:02:42 -08:00