Repository navigation
fix: Reject security-key policies the server cannot enforce - #343
Merged
Merged
Conversation
inureyes
added
priority:high
Parse no-touch-required and verify-required in authorized_keys and reject matching SK user keys unless neither presence nor verification is required. russh does not expose signature flags to the authentication callback, so accepting other policies would silently bypass their requirements. Cover both SK algorithms, ordinary keys, and per-entry policy in actual handler callback tests. Removing the guard makes both regression tests fail; restoring it passes. Document the restriction and the signature-flag enforcement follow-up. Refs #338.
Reject immediately when the first matching authorized_keys entry requires an unsupported touch or verification policy. Continuing to a later duplicate allowed a no-touch-required entry to weaken the first entry's policy. Update handler regressions and documentation for duplicate ordering and unrelated keys. Focused tests pass, and restoring the previous continue behavior fails the duplicate-entry regression. Refs #338.
inureyes
force-pushed
the
fix/issue-338-sk-touch-policy
branch
from
October 22, 2026 14:19
13f5d3a to
0d70b64
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
bssh-server now rejects security-key user authentication unless the first matching authorized_keys entry explicitly has
no-touch-requiredwithoutverify-required. russh does not expose signature UP/UV flags to the callback, so the server cannot enforce the default touch policy or user verification. Later duplicate entries cannot weaken the first matching entry’s policy. Ordinary keys retain their behavior, and rejected SK policies are logged at info level.Both SK algorithms are covered through the actual
SshHandler::auth_publickeycallback, including all option combinations and duplicate/unrelated entries. Security and OpenSSH compatibility documentation explains the restriction and the pending signature-flag enforcement work.Validation: focused handler regression tests pass; removing the policy guard makes both tests fail, and restoring it passes again. A separate mutation restoring duplicate-entry fallthrough fails the first-match regression. Formatting and library/focused-test Clippy checks pass. These policy tests need no authenticator because the rejection is based on authorized-key policy, not hardware behavior.
Closes #338