Skip to content

Commit

Permalink
Reject unsupported key types instead of failing (#352)
Browse files Browse the repository at this point in the history
Currently russh doesn't support ED25519/ECDSA-SK keys, but OpenSSH will
attempt to use them anyway. Key parse will then fail, killing the
session.

This should be treated as-if auth_publickey_offered rejects the key.
  • Loading branch information
nbdd0121 authored Sep 22, 2024
1 parent 451e74b commit f587d13
Showing 1 changed file with 3 additions and 1 deletion.
4 changes: 3 additions & 1 deletion russh/src/server/encrypted.rs
Original file line number Diff line number Diff line change
Expand Up @@ -519,7 +519,9 @@ impl Encrypted {
Ok(())
}
}
Err(russh_keys::Error::CouldNotReadKey) | Err(russh_keys::Error::KeyIsCorrupt) => {
Err(russh_keys::Error::CouldNotReadKey)
| Err(russh_keys::Error::KeyIsCorrupt)
| Err(russh_keys::Error::UnsupportedKeyType { .. }) => {
reject_auth_request(until, &mut self.write, auth_request).await;
Ok(())
}
Expand Down

0 comments on commit f587d13

Please sign in to comment.