feat: Add certificate authentication and advanced port forwarding options#52
Merged
Conversation
Implements Phase 2 of SSH config parser enhancements with support for: - CertificateFile: SSH certificate-based PKI authentication - CASignatureAlgorithms: CA signature algorithm validation - GatewayPorts: Remote port forwarding control (yes/no/clientspecified) - ExitOnForwardFailure: Terminate on port forwarding failures - PermitRemoteOpen: Security controls for remote forwarding - HostbasedAuthentication: Host-based authentication support - HostbasedAcceptedAlgorithms: Algorithm list for host-based auth All options support both "Option Value" and "Option=Value" syntax. Includes comprehensive test coverage (32 new tests, >95% coverage). Resolves #44
inureyes
added
type:enhancement
Member
Author
🔍 Security & Performance Review🚀 Review Status: In ProgressStarting comprehensive security and performance analysis of certificate authentication and port forwarding options... I'll be analyzing:
Updates will be posted as issues are identified and fixed. |
Member
Author
🔍 Security & Performance Review📊 Analysis Summary
🎯 Prioritized Fix Roadmap🔴 CRITICALNo critical security vulnerabilities found 🟠 HIGH
🟡 MEDIUM
🟢 LOW
📝 Analysis Details✅ Security Strengths Found:
🔧 Issues Requiring Fixes:
📝 Progress Log
|
…uthentication - Priority: HIGH Security Fixes: - Prevent unbounded accumulation of certificate_files during config merging (cap at 100) - Prevent unbounded accumulation of permit_remote_open entries (cap at 1000) - Add deduplication to prevent duplicate entries during merging - Block sensitive system paths (/etc/passwd, /etc/shadow, etc.) as certificate files - Add validation to prevent private keys from being used as certificates - Limit algorithm lists to 50 entries to prevent memory exhaustion - Filter empty algorithm entries from malformed input Performance Improvements: - Deduplication reduces memory usage when multiple Host blocks match - Algorithm list limits prevent excessive memory allocation - Early termination when limits are reached Added comprehensive test coverage for all security fixes and edge cases.
Member
Author
🔍 Security & Performance Review📊 Analysis Summary
🎯 Prioritized Fix Roadmap🔴 CRITICALNo critical security vulnerabilities found 🟠 HIGH
🟡 MEDIUM
🟢 LOW
📝 Progress Log
✨ Review CompleteAll identified security vulnerabilities and performance issues have been successfully addressed. The PR is now production-ready with enhanced security hardening. |
Split the 1706-line parser.rs file into a well-organized module structure with clear separation of concerns. Each file is now under 350 lines (except tests), making the codebase more maintainable and easier to navigate. New structure: - parser/mod.rs (36 lines) - Module declarations and re-exports - parser/core.rs (314 lines) - Main parsing logic and state machine - parser/helpers.rs (27 lines) - Helper utilities (parse_yes_no) - parser/tests.rs (927 lines) - All existing tests preserved - parser/options/ - Option parsing by category (10 modules): - mod.rs (106 lines) - Main dispatcher routing to category parsers - basic.rs (54 lines) - Basic options (hostname, user, port) - authentication.rs (128 lines) - Authentication options - security.rs (124 lines) - Security and cryptographic options - forwarding.rs (105 lines) - Port forwarding options - connection.rs (113 lines) - Connection settings and timeouts - proxy.rs (49 lines) - Proxy configuration - control.rs (56 lines) - Control socket options - environment.rs (66 lines) - Environment variable handling - ui.rs (68 lines) - UI and logging options Benefits: - Improved maintainability: Easy to locate and modify specific options - Better organization: Logical grouping by functionality - Reduced file sizes: No file exceeds 350 lines (except tests) - Clear boundaries: Each module has a single, well-defined responsibility All 244 tests pass. No functional changes.
Added 21 new tests to improve coverage for certificate authentication and advanced port forwarding options. New test files: - resolver_tests.rs (14 tests) - Configuration merging logic * CertificateFile merging and deduplication * PermitRemoteOpen merging and deduplication * Algorithm list override behavior * Option priority across multiple Host blocks * 100-entry limit for CertificateFile - integration_tests/phase2_integration_test.rs (7 tests) - E2E scenarios * Include + certificate options * Include + forwarding options * Match + certificate options * Match + forwarding options * Complex Include/Match/Host combinations * Nested includes with all new options * Real-world configuration scenarios Test coverage improved from 244 to 265 tests (+21 tests, +8.6%). All tests pass successfully.
Renamed phase2_integration_test.rs to certificate_forwarding_integration_test.rs for better clarity and long-term maintainability. Rationale: - "phase2" is a temporary development stage reference - New name clearly indicates what features are tested: * Certificate-based authentication (CertificateFile, CASignatureAlgorithms) * Host-based authentication (HostbasedAuthentication, HostbasedAcceptedAlgorithms) * Advanced port forwarding (GatewayPorts, ExitOnForwardFailure, PermitRemoteOpen) - Improves searchability and code navigation - Future-proof naming that won't become obsolete Changes: - Renamed: phase2_integration_test.rs → certificate_forwarding_integration_test.rs - Updated module import in mod.rs - Enhanced file documentation with feature descriptions All 265 tests still pass.
inureyes
added a commit
that referenced
this pull request
Oct 23, 2025
Update all documentation files to reflect the new certificate authentication and advanced port forwarding options added in PR #52: Certificate Authentication Options: - CertificateFile: SSH certificate files for PKI auth (max 100) - CASignatureAlgorithms: CA signature algorithms (max 50) - HostbasedAuthentication: Enable/disable host-based auth - HostbasedAcceptedAlgorithms: Accepted algorithms (max 50) Port Forwarding Control Options: - GatewayPorts: Control remote forwarding (yes/no/clientspecified) - ExitOnForwardFailure: Terminate on forwarding failure - PermitRemoteOpen: Allowed forwarding destinations (max 1000) Files Updated: - docs/man/bssh.1: Added SSH CONFIGURATION OPTIONS section - README.md: Added SSH Configuration Support section with examples - CHANGELOG.md: Updated Unreleased section with Phase 2 features - ARCHITECTURE.md: Added Supported SSH Configuration Options subsection All security features, limits, and best practices are documented. Examples demonstrate real-world usage scenarios.
inureyes
added a commit
that referenced
this pull request
Oct 23, 2025
…53) Update all documentation files to reflect the new certificate authentication and advanced port forwarding options added in PR #52: Certificate Authentication Options: - CertificateFile: SSH certificate files for PKI auth (max 100) - CASignatureAlgorithms: CA signature algorithms (max 50) - HostbasedAuthentication: Enable/disable host-based auth - HostbasedAcceptedAlgorithms: Accepted algorithms (max 50) Port Forwarding Control Options: - GatewayPorts: Control remote forwarding (yes/no/clientspecified) - ExitOnForwardFailure: Terminate on forwarding failure - PermitRemoteOpen: Allowed forwarding destinations (max 1000) Files Updated: - docs/man/bssh.1: Added SSH CONFIGURATION OPTIONS section - README.md: Added SSH Configuration Support section with examples - CHANGELOG.md: Updated Unreleased section with Phase 2 features - ARCHITECTURE.md: Added Supported SSH Configuration Options subsection All security features, limits, and best practices are documented. Examples demonstrate real-world usage scenarios.
inureyes
added
status:done
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Implements Phase 2 of SSH config parser enhancements (#44) with support for certificate-based PKI authentication and advanced port forwarding control options commonly used in enterprise and production environments.
Changes
New SSH Config Options (7 total)
Certificate Authentication:
CertificateFile- Specifies SSH certificate files for PKI authenticationCASignatureAlgorithms- Controls trusted CA signature algorithms for certificate validationPort Forwarding Control:
GatewayPorts- Controls whether remote port forwardings bind to wildcard addresses (yes/no/clientspecified)ExitOnForwardFailure- Terminates SSH connection if port forwarding failsPermitRemoteOpen- Security control restricting which remote hosts can be connected via port forwardingHost-based Authentication:
HostbasedAuthentication- Enable host-based authenticationHostbasedAcceptedAlgorithms- Specify accepted algorithms for host-based authenticationImplementation Details
Option ValueandOption=ValuesyntaxFiles Modified
src/ssh/ssh_config/types.rs- Added 7 new fields to SshHostConfigsrc/ssh/ssh_config/parser.rs- Added parsing logic for all new optionssrc/ssh/ssh_config/resolver.rs- Added merge logic for new fieldssrc/ssh/ssh_config/mod.rs- Added integration testsTest Coverage
Testing Scenarios Covered
✅ Basic parsing of all 7 options
✅ Option=Value syntax for all options
✅ Empty value error handling
✅ Invalid value validation (GatewayPorts)
✅ Multiple declarations (accumulation for Vec fields)
✅ Space-separated and comma-separated values
✅ Configuration merging across Host blocks
✅ Integration with resolver
Compatibility
Resolves #44