Merge commit from fork

Author: mjc

russh/src/auth.rs

@@ -226,14 +226,23 @@ pub enum Method {
 #[doc(hidden)]
 #[derive(Debug)]
 pub struct AuthRequest {
+    initial_methods: MethodSet,
     pub methods: MethodSet,
     #[cfg_attr(target_arch = "wasm32", allow(dead_code))]
     pub partial_success: bool,
     pub current: Option<CurrentRequest>,
+    pub(crate) principal: Option<AuthPrincipal>,
     #[cfg_attr(target_arch = "wasm32", allow(dead_code))]
     pub rejection_count: usize,
 }
 
+#[doc(hidden)]
+#[derive(Debug)]
+pub(crate) struct AuthPrincipal {
+    user: String,
+    service: String,
+}
+
 #[doc(hidden)]
 #[derive(Debug)]
 pub enum CurrentRequest {
@@ -252,22 +261,53 @@ pub enum CurrentRequest {
 }
 
 impl AuthRequest {
+    pub(crate) fn server(methods: MethodSet) -> Self {
+        Self {
+            initial_methods: methods.clone(),
+            methods,
+            partial_success: false,
+            current: None,
+            principal: None,
+            rejection_count: 0,
+        }
+    }
+
     pub(crate) fn new(method: &Method) -> Self {
         match method {
             Method::KeyboardInteractive { submethods } => Self {
+                initial_methods: MethodSet::all(),
                 methods: MethodSet::all(),
                 partial_success: false,
                 current: Some(CurrentRequest::KeyboardInteractive {
                     submethods: submethods.to_string(),
                 }),
+                principal: None,
                 rejection_count: 0,
             },
             _ => Self {
+                initial_methods: MethodSet::all(),
                 methods: MethodSet::all(),
                 partial_success: false,
                 current: None,
+                principal: None,
                 rejection_count: 0,
             },
         }
     }
+
+    pub(crate) fn bind_or_reset_principal(&mut self, user: &str, service: &str) -> bool {
+        match &self.principal {
+            Some(bound) if bound.user == user && bound.service == service => false,
+            _ => {
+                self.principal = Some(AuthPrincipal {
+                    user: user.to_owned(),
+                    service: service.to_owned(),
+                });
+                self.methods = self.initial_methods.clone();
+                self.partial_success = false;
+                self.current = None;
+                true
+            }
+        }
+    }
 }

russh/src/server/encrypted.rs

@@ -333,12 +333,7 @@ fn server_accept_service(
         })
     }
 
-    Ok(AuthRequest {
-        methods,
-        partial_success: false, // not used immediately anway.
-        current: None,
-        rejection_count: 0,
-    })
+    Ok(AuthRequest::server(methods))
 }
 
 impl Encrypted {
@@ -359,6 +354,18 @@ impl Encrypted {
         debug!("name: {user:?} {service_name:?} {method:?}",);
 
         if service_name == "ssh-connection" {
+            {
+                let auth_request = if let EncryptedState::WaitingAuthRequest(ref mut a) = self.state
+                {
+                    a
+                } else {
+                    unreachable!()
+                };
+                if auth_request.bind_or_reset_principal(&user, &service_name) {
+                    auth_user.clear();
+                }
+            }
+
             if method == "password" {
                 let auth_request = if let EncryptedState::WaitingAuthRequest(ref mut a) = self.state
                 {

russh/tests/auth_state_reset.rs

@@ -0,0 +1,91 @@
+use std::sync::Arc;
+use std::time::Duration;
+
+use russh::client;
+use russh::keys::PrivateKey;
+use russh::{MethodKind, MethodSet, server};
+
+struct AcceptTestServerKey;
+
+impl client::Handler for AcceptTestServerKey {
+    type Error = russh::Error;
+
+    async fn check_server_key(
+        &mut self,
+        _server_public_key: &russh::keys::ssh_key::PublicKey,
+    ) -> Result<bool, Self::Error> {
+        Ok(true)
+    }
+}
+
+struct RemainingMethodsUserSwitchServer;
+
+impl server::Handler for RemainingMethodsUserSwitchServer {
+    type Error = russh::Error;
+
+    async fn auth_none(&mut self, user: &str) -> Result<server::Auth, Self::Error> {
+        if user == "alice" {
+            Ok(server::Auth::Reject {
+                proceed_with_methods: Some(MethodSet::from(&[MethodKind::Password][..])),
+                partial_success: true,
+            })
+        } else {
+            Ok(server::Auth::reject())
+        }
+    }
+}
+
+#[tokio::test]
+async fn auth_does_not_carry_remaining_methods_across_username_change() {
+    let mut server_config = server::Config::default();
+    server_config.inactivity_timeout = None;
+    server_config.auth_rejection_time = Duration::from_millis(1);
+    server_config.auth_rejection_time_initial = Some(Duration::from_millis(1));
+    server_config.keys.push(
+        PrivateKey::random(&mut rand::rng(), russh::keys::ssh_key::Algorithm::Ed25519).unwrap(),
+    );
+    let server_config = Arc::new(server_config);
+
+    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+    let addr = listener.local_addr().unwrap();
+    let server = tokio::spawn(async move {
+        let (socket, _) = listener.accept().await.unwrap();
+        let running = server::run_stream(server_config, socket, RemainingMethodsUserSwitchServer)
+            .await
+            .unwrap();
+        running.await
+    });
+
+    let mut session = client::connect(
+        Arc::new(client::Config::default()),
+        addr,
+        AcceptTestServerKey,
+    )
+    .await
+    .unwrap();
+
+    let alice = session.authenticate_none("alice").await.unwrap();
+    assert!(
+        matches!(
+            alice,
+            client::AuthResult::Failure {
+                ref remaining_methods,
+                ..
+            } if *remaining_methods == MethodSet::from(&[MethodKind::Password][..])
+        ),
+        "unexpected Alice auth result: {alice:?}"
+    );
+
+    let bob = session.authenticate_none("bob").await.unwrap();
+    if let client::AuthResult::Failure {
+        remaining_methods, ..
+    } = bob
+    {
+        assert!(
+            remaining_methods.contains(&MethodKind::PublicKey),
+            "server reused Alice's narrowed remaining methods for Bob: {remaining_methods:?}"
+        );
+    }
+
+    server.abort();
+}