Merge branch 'master' into 3.0.0

tomaswolf · tomaswolf · commit 9ef3d786a85b · 2025-08-27T21:02:44.000+02:00
diff --git a/sshd-common/src/main/java/org/apache/sshd/common/config/keys/KeyUtils.java b/sshd-common/src/main/java/org/apache/sshd/common/config/keys/KeyUtils.java
@@ -1039,6 +1039,7 @@ public static boolean compareSkEcdsaKeys(SkEcdsaPublicKey k1, SkEcdsaPublicKey k
         }
         return Objects.equals(k1.getAppName(), k2.getAppName())
                 && Objects.equals(k1.isNoTouchRequired(), k2.isNoTouchRequired())
+                && Objects.equals(k1.isVerifyRequired(), k2.isVerifyRequired())
                 && compareECKeys(k1.getDelegatePublicKey(), k2.getDelegatePublicKey());
     }
 
@@ -1050,6 +1051,7 @@ public static boolean compareSkEd25519Keys(SkED25519PublicKey k1, SkED25519Publi
         }
         return Objects.equals(k1.getAppName(), k2.getAppName())
                 && Objects.equals(k1.isNoTouchRequired(), k2.isNoTouchRequired())
+                && Objects.equals(k1.isVerifyRequired(), k2.isVerifyRequired())
                 && SecurityUtils.compareEDDSAPPublicKeys(k1.getDelegatePublicKey(), k2.getDelegatePublicKey());
     }
 
diff --git a/sshd-common/src/main/java/org/apache/sshd/common/config/keys/impl/SkECDSAPublicKeyEntryDecoder.java b/sshd-common/src/main/java/org/apache/sshd/common/config/keys/impl/SkECDSAPublicKeyEntryDecoder.java
@@ -48,6 +48,7 @@ public class SkECDSAPublicKeyEntryDecoder extends AbstractPublicKeyEntryDecoder<
     public static final SkECDSAPublicKeyEntryDecoder INSTANCE = new SkECDSAPublicKeyEntryDecoder();
 
     private static final String NO_TOUCH_REQUIRED_HEADER = "no-touch-required";
+    private static final String VERIFY_REQUIRED_HEADER = "verify-required";
 
     public SkECDSAPublicKeyEntryDecoder() {
         super(SkEcdsaPublicKey.class, PrivateKey.class, Collections.singleton(KEY_TYPE));
@@ -62,9 +63,10 @@ public SkEcdsaPublicKey decodePublicKey(
         }
 
         boolean noTouchRequired = parseBooleanHeader(headers, NO_TOUCH_REQUIRED_HEADER, false);
+        boolean verifyRequired = parseBooleanHeader(headers, VERIFY_REQUIRED_HEADER, false);
         ECPublicKey ecPublicKey = ECDSAPublicKeyEntryDecoder.INSTANCE.decodePublicKey(ECCurves.nistp256, keyData);
         String appName = KeyEntryResolver.decodeString(keyData, MAX_APP_NAME_LENGTH);
-        return new SkEcdsaPublicKey(appName, noTouchRequired, ecPublicKey);
+        return new SkEcdsaPublicKey(appName, noTouchRequired, verifyRequired, ecPublicKey);
     }
 
     @Override
diff --git a/sshd-common/src/main/java/org/apache/sshd/common/config/keys/impl/SkED25519PublicKeyEntryDecoder.java b/sshd-common/src/main/java/org/apache/sshd/common/config/keys/impl/SkED25519PublicKeyEntryDecoder.java
@@ -51,6 +51,7 @@ public class SkED25519PublicKeyEntryDecoder extends AbstractPublicKeyEntryDecode
     public static final SkED25519PublicKeyEntryDecoder INSTANCE = new SkED25519PublicKeyEntryDecoder();
 
     private static final String NO_TOUCH_REQUIRED_HEADER = "no-touch-required";
+    private static final String VERIFY_REQUIRED_HEADER = "verify-required";
 
     public SkED25519PublicKeyEntryDecoder() {
         super(SkED25519PublicKey.class, PrivateKey.class, Collections.singleton(KEY_TYPE));
@@ -65,10 +66,11 @@ public SkED25519PublicKey decodePublicKey(
         }
 
         boolean noTouchRequired = parseBooleanHeader(headers, NO_TOUCH_REQUIRED_HEADER, false);
+        boolean verifyRequired = parseBooleanHeader(headers, VERIFY_REQUIRED_HEADER, false);
         PublicKey pk = SecurityUtils.getEDDSAPublicKeyEntryDecoder().decodePublicKey(session, KeyPairProvider.SSH_ED25519,
                 keyData, headers);
         String appName = KeyEntryResolver.decodeString(keyData, MAX_APP_NAME_LENGTH);
-        return new SkED25519PublicKey(appName, noTouchRequired, pk);
+        return new SkED25519PublicKey(appName, noTouchRequired, verifyRequired, pk);
     }
 
     @Override
diff --git a/sshd-common/src/main/java/org/apache/sshd/common/config/keys/u2f/SecurityKeyPublicKey.java b/sshd-common/src/main/java/org/apache/sshd/common/config/keys/u2f/SecurityKeyPublicKey.java
@@ -23,9 +23,12 @@
 import org.apache.sshd.common.config.keys.SshPublicKey;
 
 public interface SecurityKeyPublicKey<K extends PublicKey> extends SshPublicKey {
+
     String getAppName();
 
     boolean isNoTouchRequired();
 
+    boolean isVerifyRequired();
+
     K getDelegatePublicKey();
 }
diff --git a/sshd-common/src/main/java/org/apache/sshd/common/config/keys/u2f/SkED25519PublicKey.java b/sshd-common/src/main/java/org/apache/sshd/common/config/keys/u2f/SkED25519PublicKey.java
@@ -34,11 +34,26 @@ public class SkED25519PublicKey implements SecurityKeyPublicKey<PublicKey> {
 
     private final String appName;
     private final boolean noTouchRequired;
+    private final boolean verifyRequired;
     private final PublicKey delegatePublicKey;
 
+    /**
+     * Creates a new instance.
+     *
+     * @param      appName           application name
+     * @param      noTouchRequired   whether the "no-touch-required" flag was present in authorized_keys
+     * @param      delegatePublicKey the underlying real public key
+     * @deprecated                   use {@link #SkED25519PublicKey(String, boolean, boolean, PublicKey)} instead
+     */
+    @Deprecated
     public SkED25519PublicKey(String appName, boolean noTouchRequired, PublicKey delegatePublicKey) {
+        this(appName, noTouchRequired, false, delegatePublicKey);
+    }
+
+    public SkED25519PublicKey(String appName, boolean noTouchRequired, boolean verifyRequired, PublicKey delegatePublicKey) {
         this.appName = appName;
         this.noTouchRequired = noTouchRequired;
+        this.verifyRequired = verifyRequired;
         ValidateUtils.checkTrue(KeyPairProvider.SSH_ED25519.equals(KeyUtils.getKeyType(delegatePublicKey)),
                 "Key is not an ed25519 key");
         this.delegatePublicKey = delegatePublicKey;
@@ -74,6 +89,11 @@ public boolean isNoTouchRequired() {
         return noTouchRequired;
     }
 
+    @Override
+    public boolean isVerifyRequired() {
+        return verifyRequired;
+    }
+
     @Override
     public PublicKey getDelegatePublicKey() {
         return delegatePublicKey;
@@ -84,6 +104,7 @@ public String toString() {
         return getClass().getSimpleName()
                + "[appName=" + getAppName()
                + ", noTouchRequired=" + isNoTouchRequired()
+               + ", verifyRequired=" + isVerifyRequired()
                + ", delegatePublicKey=" + getDelegatePublicKey()
                + "]";
     }
diff --git a/sshd-common/src/main/java/org/apache/sshd/common/config/keys/u2f/SkEcdsaPublicKey.java b/sshd-common/src/main/java/org/apache/sshd/common/config/keys/u2f/SkEcdsaPublicKey.java
@@ -31,11 +31,26 @@ public class SkEcdsaPublicKey implements SecurityKeyPublicKey<ECPublicKey> {
 
     private final String appName;
     private final boolean noTouchRequired;
+    private final boolean verifyRequired;
     private final ECPublicKey delegatePublicKey;
 
+    /**
+     * Creates a new instance.
+     *
+     * @param      appName           application name
+     * @param      noTouchRequired   whether the "no-touch-required" flag was present in authorized_keys
+     * @param      delegatePublicKey the underlying real public key
+     * @deprecated                   use {@link #SkEcdsaPublicKey(String, boolean, boolean, ECPublicKey)} instead
+     */
+    @Deprecated
     public SkEcdsaPublicKey(String appName, boolean noTouchRequired, ECPublicKey delegatePublicKey) {
+        this(appName, noTouchRequired, false, delegatePublicKey);
+    }
+
+    public SkEcdsaPublicKey(String appName, boolean noTouchRequired, boolean verifyRequired, ECPublicKey delegatePublicKey) {
         this.appName = appName;
         this.noTouchRequired = noTouchRequired;
+        this.verifyRequired = verifyRequired;
         this.delegatePublicKey = delegatePublicKey;
     }
 
@@ -69,6 +84,11 @@ public boolean isNoTouchRequired() {
         return noTouchRequired;
     }
 
+    @Override
+    public boolean isVerifyRequired() {
+        return verifyRequired;
+    }
+
     @Override
     public ECPublicKey getDelegatePublicKey() {
         return delegatePublicKey;
@@ -79,6 +99,7 @@ public String toString() {
         return getClass().getSimpleName()
                + "[appName=" + getAppName()
                + ", noTouchRequired=" + isNoTouchRequired()
+               + ", verifyRequired=" + isVerifyRequired()
                + ", delegatePublicKey=" + getDelegatePublicKey()
                + "]";
     }
diff --git a/sshd-common/src/main/java/org/apache/sshd/common/signature/AbstractSecurityKeySignature.java b/sshd-common/src/main/java/org/apache/sshd/common/signature/AbstractSecurityKeySignature.java
@@ -23,14 +23,18 @@
 import java.security.MessageDigest;
 import java.security.PrivateKey;
 import java.security.PublicKey;
+import java.security.SignatureException;
 
 import org.apache.sshd.common.config.keys.u2f.SecurityKeyPublicKey;
 import org.apache.sshd.common.session.SessionContext;
 import org.apache.sshd.common.util.buffer.ByteArrayBuffer;
 import org.apache.sshd.common.util.security.SecurityUtils;
 
 public abstract class AbstractSecurityKeySignature implements Signature {
-    private static final int FLAG_USER_PRESENCE = 0x01;
+
+    private static final int FLAG_USER_PRESENCE = 1 << 0;
+
+    private static final int FLAG_VERIFIED = 1 << 2;
 
     private final String keyType;
     private SecurityKeyPublicKey<?> publicKey;
@@ -76,14 +80,17 @@ public boolean verify(SessionContext session, byte[] sig) throws Exception {
         byte flags = data.getByte();
         long counter = data.getUInt();
 
-        // Return false if we don't understand the flags
-        if ((flags & ~FLAG_USER_PRESENCE) != 0) {
-            return false;
-        }
         // Check user-presence flag is present if required by the public key
         if ((flags & FLAG_USER_PRESENCE) != FLAG_USER_PRESENCE && !publicKey.isNoTouchRequired()) {
             return false;
         }
+        if ((flags & FLAG_VERIFIED) != FLAG_VERIFIED && publicKey.isVerifyRequired()) {
+            return false;
+        }
+
+        if (data.available() > 0) {
+            throw new SignatureException("Unexpected trailing data in signature");
+        }
 
         // Re-encode signature in a format to match the delegate
         ByteArrayBuffer encoded = new ByteArrayBuffer();
diff --git a/sshd-common/src/main/java/org/apache/sshd/common/util/buffer/keys/SkECBufferPublicKeyParser.java b/sshd-common/src/main/java/org/apache/sshd/common/util/buffer/keys/SkECBufferPublicKeyParser.java
@@ -43,6 +43,6 @@ public SkEcdsaPublicKey getRawPublicKey(String keyType, Buffer buffer) throws Ge
         // with an appname on the end
         ECPublicKey ecPublicKey = ECBufferPublicKeyParser.INSTANCE.getRawPublicKey(ECCurves.nistp256.getKeyType(), buffer);
         String appName = buffer.getString();
-        return new SkEcdsaPublicKey(appName, false, ecPublicKey);
+        return new SkEcdsaPublicKey(appName, false, false, ecPublicKey);
     }
 }
diff --git a/sshd-common/src/main/java/org/apache/sshd/common/util/buffer/keys/SkED25519BufferPublicKeyParser.java b/sshd-common/src/main/java/org/apache/sshd/common/util/buffer/keys/SkED25519BufferPublicKeyParser.java
@@ -43,6 +43,6 @@ public SkED25519PublicKey getRawPublicKey(String keyType, Buffer buffer) throws
         // the end
         PublicKey publicKey = ED25519BufferPublicKeyParser.INSTANCE.getRawPublicKey(KeyPairProvider.SSH_ED25519, buffer);
         String appName = buffer.getString();
-        return new SkED25519PublicKey(appName, false, publicKey);
+        return new SkED25519PublicKey(appName, false, false, publicKey);
     }
 }
diff --git a/sshd-core/src/main/java/org/apache/sshd/server/auth/pubkey/AuthorizedKeyEntriesPublickeyAuthenticator.java b/sshd-core/src/main/java/org/apache/sshd/server/auth/pubkey/AuthorizedKeyEntriesPublickeyAuthenticator.java
@@ -61,8 +61,7 @@ public AuthorizedKeyEntriesPublickeyAuthenticator(Object id, ServerSession sessi
         } else {
             resolvedKeys = new HashMap<>(numEntries);
             for (AuthorizedKeyEntry e : entries) {
-                Map<String, String> headers = e.getLoginOptions();
-                PublicKey k = e.resolvePublicKey(session, headers, fallbackResolver);
+                PublicKey k = e.resolvePublicKey(session, Collections.emptyMap(), fallbackResolver);
                 if (k != null) {
                     resolvedKeys.put(e, k);
                 }
diff --git a/sshd-core/src/main/java/org/apache/sshd/server/auth/pubkey/UserAuthPublicKey.java b/sshd-core/src/main/java/org/apache/sshd/server/auth/pubkey/UserAuthPublicKey.java
@@ -31,8 +31,11 @@
 import org.apache.sshd.common.NamedResource;
 import org.apache.sshd.common.RuntimeSshException;
 import org.apache.sshd.common.SshConstants;
+import org.apache.sshd.common.config.keys.AuthorizedKeyEntry;
 import org.apache.sshd.common.config.keys.KeyUtils;
 import org.apache.sshd.common.config.keys.OpenSshCertificate;
+import org.apache.sshd.common.config.keys.PublicKeyEntryResolver;
+import org.apache.sshd.common.config.keys.u2f.SecurityKeyPublicKey;
 import org.apache.sshd.common.net.InetAddressRange;
 import org.apache.sshd.common.signature.Signature;
 import org.apache.sshd.common.signature.SignatureFactoriesManager;
@@ -126,14 +129,16 @@ public Boolean doAuth(Buffer buffer, boolean init) throws Exception {
             log.debug("doAuth({}@{}) verify key type={}, factories={}, fingerprint={}",
                     username, session, alg, NamedResource.getNames(factories), KeyUtils.getFingerPrint(key));
         }
-        Signature verifier = ValidateUtils.checkNotNull(
+        final Signature verifier = ValidateUtils.checkNotNull(
                 NamedFactory.create(factories, alg),
                 "No verifier located for algorithm=%s",
                 alg);
-        verifier.initVerifier(session, verifyKey);
         buffer.wpos(oldLim);
 
-        byte[] sig = hasSig ? buffer.getBytes() : null;
+        final byte[] sig = hasSig ? buffer.getBytes() : null;
+        if (buffer.available() > 0) {
+            throw new SignatureException("Unexpected trailing data after signature");
+        }
         PublickeyAuthenticator authenticator = session.getPublickeyAuthenticator();
         if (authenticator == null) {
             if (debugEnabled) {
@@ -167,6 +172,15 @@ public Boolean doAuth(Buffer buffer, boolean init) throws Exception {
             return null;
         }
 
+        if (verifyKey instanceof SecurityKeyPublicKey<?>) {
+            AuthorizedKeyEntry entry = session.getAttribute(AuthorizedKeyEntriesPublickeyAuthenticator.AUTHORIZED_KEY);
+            if (entry != null) {
+                // Use the key including the options defined in the entry.
+                verifyKey = entry.resolvePublicKey(session, entry.getLoginOptions(), PublicKeyEntryResolver.FAILING);
+            }
+        }
+        verifier.initVerifier(session, verifyKey);
+
         buffer.rpos(oldPos);
         buffer.wpos(oldPos + 4 + len);
         if (!verifySignature(session, username, alg, key, buffer, verifier, sig)) {
@@ -182,7 +196,7 @@ public Boolean doAuth(Buffer buffer, boolean init) throws Exception {
     }
 
     protected void verifyCertificateSignature(ServerSession session, OpenSshCertificate cert) throws Exception {
-        if (!OpenSshCertificate.verifySignature(cert, session.getSignatureFactories())) {
+        if (!OpenSshCertificate.verifySignature(cert, SignatureFactoriesManager.resolveSignatureFactories(this, session))) {
             throw new CertificateException(
                     "CA signature verification failed for key type=" + cert.getKeyType() + " of key ID=" + cert.getId());
         }
diff --git a/sshd-core/src/test/java/org/apache/sshd/server/auth/AuthorizedKeyEntriesPublickeyAuthenticatorTest.java b/sshd-core/src/test/java/org/apache/sshd/server/auth/AuthorizedKeyEntriesPublickeyAuthenticatorTest.java
@@ -0,0 +1,71 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.sshd.server.auth;
+
+import java.security.KeyPair;
+import java.security.KeyPairGenerator;
+import java.security.interfaces.ECPublicKey;
+import java.util.Collections;
+import java.util.stream.Stream;
+
+import org.apache.sshd.common.config.keys.AuthorizedKeyEntry;
+import org.apache.sshd.common.config.keys.PublicKeyEntry;
+import org.apache.sshd.common.config.keys.PublicKeyEntryResolver;
+import org.apache.sshd.common.config.keys.u2f.SkEcdsaPublicKey;
+import org.apache.sshd.common.util.ValidateUtils;
+import org.apache.sshd.server.auth.pubkey.AuthorizedKeyEntriesPublickeyAuthenticator;
+import org.apache.sshd.util.test.BaseTestSupport;
+import org.junit.jupiter.api.Tag;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.Arguments;
+import org.junit.jupiter.params.provider.MethodSource;
+
+@Tag("NoIoTestCase")
+class AuthorizedKeyEntriesPublickeyAuthenticatorTest extends BaseTestSupport {
+
+    private static Stream<Arguments> options() {
+        return Stream.of(Arguments.of("", ""), //
+                Arguments.of("no-touch-required", ""), //
+                Arguments.of("verify-required", ""), //
+                Arguments.of("no-touch-required", "verify-required") //
+        );
+    }
+
+    @ParameterizedTest(name = "match {0} {1}")
+    @MethodSource("options")
+    void testMatch(String first, String second) throws Exception {
+        KeyPairGenerator gen = KeyPairGenerator.getInstance("EC");
+        gen.initialize(256);
+        KeyPair pair = gen.generateKeyPair();
+        ECPublicKey key = ValidateUtils.checkInstanceOf(pair.getPublic(), ECPublicKey.class, "Expected an EC key");
+        SkEcdsaPublicKey pubKey = new SkEcdsaPublicKey("ssh", false, false, key);
+        String line = first;
+        if (!second.isEmpty()) {
+            line += ',' + second;
+        }
+        if (!line.isEmpty()) {
+            line = line + ' ';
+        }
+        line += PublicKeyEntry.toString(pubKey);
+        AuthorizedKeyEntry entry = AuthorizedKeyEntry.parseAuthorizedKeyEntry(line);
+        AuthorizedKeyEntriesPublickeyAuthenticator auth = new AuthorizedKeyEntriesPublickeyAuthenticator("test", null,
+                Collections.singletonList(entry), PublicKeyEntryResolver.FAILING);
+        assertTrue(auth.authenticate("user", pubKey, null));
+    }
+}
diff --git a/sshd-core/src/test/java/org/apache/sshd/server/auth/UserAuthPublicKeySkTest.java b/sshd-core/src/test/java/org/apache/sshd/server/auth/UserAuthPublicKeySkTest.java

Original file line number	Diff line number	Diff line change
`@@ -1039,6 +1039,7 @@ public static boolean compareSkEcdsaKeys(SkEcdsaPublicKey k1, SkEcdsaPublicKey k`
`1039`	`1039`	`}`
`1040`	`1040`	`return Objects.equals(k1.getAppName(), k2.getAppName())`
`1041`	`1041`	`&& Objects.equals(k1.isNoTouchRequired(), k2.isNoTouchRequired())`
	`1042`	`+ && Objects.equals(k1.isVerifyRequired(), k2.isVerifyRequired())`
`1042`	`1043`	`&& compareECKeys(k1.getDelegatePublicKey(), k2.getDelegatePublicKey());`
`1043`	`1044`	`}`
`1044`	`1045`
`@@ -1050,6 +1051,7 @@ public static boolean compareSkEd25519Keys(SkED25519PublicKey k1, SkED25519Publi`
`1050`	`1051`	`}`
`1051`	`1052`	`return Objects.equals(k1.getAppName(), k2.getAppName())`
`1052`	`1053`	`&& Objects.equals(k1.isNoTouchRequired(), k2.isNoTouchRequired())`
	`1054`	`+ && Objects.equals(k1.isVerifyRequired(), k2.isVerifyRequired())`
`1053`	`1055`	`&& SecurityUtils.compareEDDSAPPublicKeys(k1.getDelegatePublicKey(), k2.getDelegatePublicKey());`
`1054`	`1056`	`}`
`1055`	`1057`
Original file line number	Diff line number	Diff line change
`@@ -43,6 +43,6 @@ public SkEcdsaPublicKey getRawPublicKey(String keyType, Buffer buffer) throws Ge`
`43`	`43`	`// with an appname on the end`
`44`	`44`	`ECPublicKey ecPublicKey = ECBufferPublicKeyParser.INSTANCE.getRawPublicKey(ECCurves.nistp256.getKeyType(), buffer);`
`45`	`45`	`String appName = buffer.getString();`
`46`		`- return new SkEcdsaPublicKey(appName, false, ecPublicKey);`
	`46`	`+ return new SkEcdsaPublicKey(appName, false, false, ecPublicKey);`
`47`	`47`	`}`
`48`	`48`	`}`
Original file line number	Diff line number	Diff line change
`@@ -43,6 +43,6 @@ public SkED25519PublicKey getRawPublicKey(String keyType, Buffer buffer) throws`
`43`	`43`	`// the end`
`44`	`44`	`PublicKey publicKey = ED25519BufferPublicKeyParser.INSTANCE.getRawPublicKey(KeyPairProvider.SSH_ED25519, buffer);`
`45`	`45`	`String appName = buffer.getString();`
`46`		`- return new SkED25519PublicKey(appName, false, publicKey);`
	`46`	`+ return new SkED25519PublicKey(appName, false, false, publicKey);`
`47`	`47`	`}`
`48`	`48`	`}`