ssh: reject source-address critical option on host certificates

[waterWang]

Fixes golang/go#80872

Problem

x/crypto/ssh clients will accept a host certificate containing a source-address critical option, which OpenSSH rejects. The source-address option should only apply to user certificates, not host certificates.

Root cause

In certs.go, CheckCert() unconditionally skips the source-address critical option with the comment "sourceAddressCriticalOption will be enforced by serverAuthenticate", regardless of whether the certificate is a user or host certificate.

For user certificates this is correct — the server-side authentication dispatch loop enforces the source-address restriction. But for host certificates, source-address is an unsupported critical option that should be rejected.

Fix

Check cert.CertType in the critical options loop: if source-address appears on a HostCert, return an error instead of skipping it. User certificates continue to skip it as before, preserving the existing server-side enforcement path.

Changes

• ssh/certs.go: add HostCert type check for source-address critical option

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.