Wala shell

Advanced PHP File Manager

Server IP: 127.0.0.1 | PHP Version: 8.3.30 | Domains Hosted: 54

Name	Size	Last Modified	Actions
📁 ..	-	2025-05-25 12:27
📄 client.go // Copyright 2012 The Go Authors. All rights reserved. // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file. // Package agent implements the ssh-agent protocol, and provides both // a client and a server. The client can talk to a standard ssh-agent // that uses UNIX sockets, and one could implement an alternative // ssh-agent process using the sample server. // // References: // // [PROTOCOL.agent]: https://tools.ietf.org/html/draft-miller-ssh-agent-00 package agent import ( "bytes" "crypto/dsa" "crypto/ecdsa" "crypto/ed25519" "crypto/elliptic" "crypto/rsa" "encoding/base64" "encoding/binary" "errors" "fmt" "io" "math/big" "sync" "golang.org/x/crypto/ssh" ) // SignatureFlags represent additional flags that can be passed to the signature // requests an defined in [PROTOCOL.agent] section 4.5.1. type SignatureFlags uint32 // SignatureFlag values as defined in [PROTOCOL.agent] section 5.3. const ( SignatureFlagReserved SignatureFlags = 1 << iota SignatureFlagRsaSha256 SignatureFlagRsaSha512 ) // Agent represents the capabilities of an ssh-agent. type Agent interface { // List returns the identities known to the agent. List() ([]Key, error) // Sign has the agent sign the data using a protocol 2 key as defined // in [PROTOCOL.agent] section 2.6.2. Sign(key ssh.PublicKey, data []byte) (ssh.Signature, error) // Add adds a private key to the agent. Add(key AddedKey) error // Remove removes all identities with the given public key. Remove(key ssh.PublicKey) error // RemoveAll removes all identities. RemoveAll() error // Lock locks the agent. Sign and Remove will fail, and List will empty an empty list. Lock(passphrase []byte) error // Unlock undoes the effect of Lock Unlock(passphrase []byte) error // Signers returns signers for all the known keys. Signers() ([]ssh.Signer, error) } type ExtendedAgent interface { Agent // SignWithFlags signs like Sign, but allows for additional flags to be sent/received SignWithFlags(key ssh.PublicKey, data []byte, flags SignatureFlags) (ssh.Signature, error) // Extension processes a custom extension request. Standard-compliant agents are not // required to support any extensions, but this method allows agents to implement // vendor-specific methods or add experimental features. See [PROTOCOL.agent] section 4.7. // If agent extensions are unsupported entirely this method MUST return an // ErrExtensionUnsupported error. Similarly, if just the specific extensionType in // the request is unsupported by the agent then ErrExtensionUnsupported MUST be // returned. // // In the case of success, since [PROTOCOL.agent] section 4.7 specifies that the contents // of the response are unspecified (including the type of the message), the complete // response will be returned as a []byte slice, including the "type" byte of the message. Extension(extensionType string, contents []byte) ([]byte, error) } // ConstraintExtension describes an optional constraint defined by users. type ConstraintExtension struct { // ExtensionName consist of a UTF-8 string suffixed by the // implementation domain following the naming scheme defined // in Section 4.2 of RFC 4251, e.g. "foo@example.com". ExtensionName string // ExtensionDetails contains the actual content of the extended // constraint. ExtensionDetails []byte } // AddedKey describes an SSH key to be added to an Agent. type AddedKey struct { // PrivateKey must be a rsa.PrivateKey, dsa.PrivateKey, // ed25519.PrivateKey or ecdsa.PrivateKey, which will be inserted into the // agent. PrivateKey interface{} // Certificate, if not nil, is communicated to the agent and will be // stored with the key. Certificate ssh.Certificate // Comment is an optional, free-form string. Comment string // LifetimeSecs, if not zero, is the number of seconds that the // agent will store the key for. LifetimeSecs uint32 // ConfirmBeforeUse, if true, requests that the agent confirm with the // user before each use of this key. ConfirmBeforeUse bool // ConstraintExtensions are the experimental or private-use constraints // defined by users. ConstraintExtensions []ConstraintExtension } // See [PROTOCOL.agent], section 3. const ( agentRequestV1Identities = 1 agentRemoveAllV1Identities = 9 // 3.2 Requests from client to agent for protocol 2 key operations agentAddIdentity = 17 agentRemoveIdentity = 18 agentRemoveAllIdentities = 19 agentAddIDConstrained = 25 // 3.3 Key-type independent requests from client to agent agentAddSmartcardKey = 20 agentRemoveSmartcardKey = 21 agentLock = 22 agentUnlock = 23 agentAddSmartcardKeyConstrained = 26 // 3.7 Key constraint identifiers agentConstrainLifetime = 1 agentConstrainConfirm = 2 // Constraint extension identifier up to version 2 of the protocol. A // backward incompatible change will be required if we want to add support // for SSH_AGENT_CONSTRAIN_MAXSIGN which uses the same ID. agentConstrainExtensionV00 = 3 // Constraint extension identifier in version 3 and later of the protocol. agentConstrainExtension = 255 ) // maxAgentResponseBytes is the maximum agent reply size that is accepted. This // is a sanity check, not a limit in the spec. const maxAgentResponseBytes = 16 << 20 // Agent messages: // These structures mirror the wire format of the corresponding ssh agent // messages found in [PROTOCOL.agent]. // 3.4 Generic replies from agent to client const agentFailure = 5 type failureAgentMsg struct{} const agentSuccess = 6 type successAgentMsg struct{} // See [PROTOCOL.agent], section 2.5.2. const agentRequestIdentities = 11 type requestIdentitiesAgentMsg struct{} // See [PROTOCOL.agent], section 2.5.2. const agentIdentitiesAnswer = 12 type identitiesAnswerAgentMsg struct { NumKeys uint32 `sshtype:"12"` Keys []byte `ssh:"rest"` } // See [PROTOCOL.agent], section 2.6.2. const agentSignRequest = 13 type signRequestAgentMsg struct { KeyBlob []byte `sshtype:"13"` Data []byte Flags uint32 } // See [PROTOCOL.agent], section 2.6.2. // 3.6 Replies from agent to client for protocol 2 key operations const agentSignResponse = 14 type signResponseAgentMsg struct { SigBlob []byte `sshtype:"14"` } type publicKey struct { Format string Rest []byte `ssh:"rest"` } // 3.7 Key constraint identifiers type constrainLifetimeAgentMsg struct { LifetimeSecs uint32 `sshtype:"1"` } type constrainExtensionAgentMsg struct { ExtensionName string `sshtype:"255\|3"` ExtensionDetails []byte // Rest is a field used for parsing, not part of message Rest []byte `ssh:"rest"` } // See [PROTOCOL.agent], section 4.7 const agentExtension = 27 const agentExtensionFailure = 28 // ErrExtensionUnsupported indicates that an extension defined in // [PROTOCOL.agent] section 4.7 is unsupported by the agent. Specifically this // error indicates that the agent returned a standard SSH_AGENT_FAILURE message // as the result of a SSH_AGENTC_EXTENSION request. Note that the protocol // specification (and therefore this error) does not distinguish between a // specific extension being unsupported and extensions being unsupported entirely. var ErrExtensionUnsupported = errors.New("agent: extension unsupported") type extensionAgentMsg struct { ExtensionType string `sshtype:"27"` // NOTE: this matches OpenSSH's PROTOCOL.agent, not the IETF draft [PROTOCOL.agent], // so that it matches what OpenSSH actually implements in the wild. Contents []byte `ssh:"rest"` } // Key represents a protocol 2 public key as defined in // [PROTOCOL.agent], section 2.5.2. type Key struct { Format string Blob []byte Comment string } func clientErr(err error) error { return fmt.Errorf("agent: client error: %v", err) } // String returns the storage form of an agent key with the format, base64 // encoded serialized key, and the comment if it is not empty. func (k Key) String() string { s := string(k.Format) + " " + base64.StdEncoding.EncodeToString(k.Blob) if k.Comment != "" { s += " " + k.Comment } return s } // Type returns the public key type. func (k Key) Type() string { return k.Format } // Marshal returns key blob to satisfy the ssh.PublicKey interface. func (k Key) Marshal() []byte { return k.Blob } // Verify satisfies the ssh.PublicKey interface. func (k Key) Verify(data []byte, sig ssh.Signature) error { pubKey, err := ssh.ParsePublicKey(k.Blob) if err != nil { return fmt.Errorf("agent: bad public key: %v", err) } return pubKey.Verify(data, sig) } type wireKey struct { Format string Rest []byte `ssh:"rest"` } func parseKey(in []byte) (out Key, rest []byte, err error) { var record struct { Blob []byte Comment string Rest []byte `ssh:"rest"` } if err := ssh.Unmarshal(in, &record); err != nil { return nil, nil, err } var wk wireKey if err := ssh.Unmarshal(record.Blob, &wk); err != nil { return nil, nil, err } return &Key{ Format: wk.Format, Blob: record.Blob, Comment: record.Comment, }, record.Rest, nil } // client is a client for an ssh-agent process. type client struct { // conn is typically a net.UnixConn conn io.ReadWriter // mu is used to prevent concurrent access to the agent mu sync.Mutex } // NewClient returns an Agent that talks to an ssh-agent process over // the given connection. func NewClient(rw io.ReadWriter) ExtendedAgent { return &client{conn: rw} } // call sends an RPC to the agent. On success, the reply is // unmarshaled into reply and replyType is set to the first byte of // the reply, which contains the type of the message. func (c client) call(req []byte) (reply interface{}, err error) { buf, err := c.callRaw(req) if err != nil { return nil, err } reply, err = unmarshal(buf) if err != nil { return nil, clientErr(err) } return reply, nil } // callRaw sends an RPC to the agent. On success, the raw // bytes of the response are returned; no unmarshalling is // performed on the response. func (c client) callRaw(req []byte) (reply []byte, err error) { c.mu.Lock() defer c.mu.Unlock() msg := make([]byte, 4+len(req)) binary.BigEndian.PutUint32(msg, uint32(len(req))) copy(msg[4:], req) if _, err = c.conn.Write(msg); err != nil { return nil, clientErr(err) } var respSizeBuf [4]byte if _, err = io.ReadFull(c.conn, respSizeBuf[:]); err != nil { return nil, clientErr(err) } respSize := binary.BigEndian.Uint32(respSizeBuf[:]) if respSize > maxAgentResponseBytes { return nil, clientErr(errors.New("response too large")) } buf := make([]byte, respSize) if _, err = io.ReadFull(c.conn, buf); err != nil { return nil, clientErr(err) } return buf, nil } func (c client) simpleCall(req []byte) error { resp, err := c.call(req) if err != nil { return err } if _, ok := resp.(successAgentMsg); ok { return nil } return errors.New("agent: failure") } func (c client) RemoveAll() error { return c.simpleCall([]byte{agentRemoveAllIdentities}) } func (c client) Remove(key ssh.PublicKey) error { req := ssh.Marshal(&agentRemoveIdentityMsg{ KeyBlob: key.Marshal(), }) return c.simpleCall(req) } func (c client) Lock(passphrase []byte) error { req := ssh.Marshal(&agentLockMsg{ Passphrase: passphrase, }) return c.simpleCall(req) } func (c client) Unlock(passphrase []byte) error { req := ssh.Marshal(&agentUnlockMsg{ Passphrase: passphrase, }) return c.simpleCall(req) } // List returns the identities known to the agent. func (c client) List() ([]Key, error) { // see [PROTOCOL.agent] section 2.5.2. req := []byte{agentRequestIdentities} msg, err := c.call(req) if err != nil { return nil, err } switch msg := msg.(type) { case identitiesAnswerAgentMsg: if msg.NumKeys > maxAgentResponseBytes/8 { return nil, errors.New("agent: too many keys in agent reply") } keys := make([]Key, msg.NumKeys) data := msg.Keys for i := uint32(0); i < msg.NumKeys; i++ { var key Key var err error if key, data, err = parseKey(data); err != nil { return nil, err } keys[i] = key } return keys, nil case failureAgentMsg: return nil, errors.New("agent: failed to list keys") } panic("unreachable") } // Sign has the agent sign the data using a protocol 2 key as defined // in [PROTOCOL.agent] section 2.6.2. func (c client) Sign(key ssh.PublicKey, data []byte) (ssh.Signature, error) { return c.SignWithFlags(key, data, 0) } func (c client) SignWithFlags(key ssh.PublicKey, data []byte, flags SignatureFlags) (ssh.Signature, error) { req := ssh.Marshal(signRequestAgentMsg{ KeyBlob: key.Marshal(), Data: data, Flags: uint32(flags), }) msg, err := c.call(req) if err != nil { return nil, err } switch msg := msg.(type) { case signResponseAgentMsg: var sig ssh.Signature if err := ssh.Unmarshal(msg.SigBlob, &sig); err != nil { return nil, err } return &sig, nil case failureAgentMsg: return nil, errors.New("agent: failed to sign challenge") } panic("unreachable") } // unmarshal parses an agent message in packet, returning the parsed // form and the message type of packet. func unmarshal(packet []byte) (interface{}, error) { if len(packet) < 1 { return nil, errors.New("agent: empty packet") } var msg interface{} switch packet[0] { case agentFailure: return new(failureAgentMsg), nil case agentSuccess: return new(successAgentMsg), nil case agentIdentitiesAnswer: msg = new(identitiesAnswerAgentMsg) case agentSignResponse: msg = new(signResponseAgentMsg) case agentV1IdentitiesAnswer: msg = new(agentV1IdentityMsg) default: return nil, fmt.Errorf("agent: unknown type tag %d", packet[0]) } if err := ssh.Unmarshal(packet, msg); err != nil { return nil, err } return msg, nil } type rsaKeyMsg struct { Type string `sshtype:"17\|25"` N big.Int E big.Int D big.Int Iqmp big.Int // IQMP = Inverse Q Mod P P big.Int Q big.Int Comments string Constraints []byte `ssh:"rest"` } type dsaKeyMsg struct { Type string `sshtype:"17\|25"` P big.Int Q big.Int G big.Int Y big.Int X big.Int Comments string Constraints []byte `ssh:"rest"` } type ecdsaKeyMsg struct { Type string `sshtype:"17\|25"` Curve string KeyBytes []byte D big.Int Comments string Constraints []byte `ssh:"rest"` } type ed25519KeyMsg struct { Type string `sshtype:"17\|25"` Pub []byte Priv []byte Comments string Constraints []byte `ssh:"rest"` } // Insert adds a private key to the agent. func (c client) insertKey(s interface{}, comment string, constraints []byte) error { var req []byte switch k := s.(type) { case rsa.PrivateKey: if len(k.Primes) != 2 { return fmt.Errorf("agent: unsupported RSA key with %d primes", len(k.Primes)) } k.Precompute() req = ssh.Marshal(rsaKeyMsg{ Type: ssh.KeyAlgoRSA, N: k.N, E: big.NewInt(int64(k.E)), D: k.D, Iqmp: k.Precomputed.Qinv, P: k.Primes[0], Q: k.Primes[1], Comments: comment, Constraints: constraints, }) case dsa.PrivateKey: req = ssh.Marshal(dsaKeyMsg{ Type: ssh.KeyAlgoDSA, P: k.P, Q: k.Q, G: k.G, Y: k.Y, X: k.X, Comments: comment, Constraints: constraints, }) case ecdsa.PrivateKey: nistID := fmt.Sprintf("nistp%d", k.Params().BitSize) req = ssh.Marshal(ecdsaKeyMsg{ Type: "ecdsa-sha2-" + nistID, Curve: nistID, KeyBytes: elliptic.Marshal(k.Curve, k.X, k.Y), D: k.D, Comments: comment, Constraints: constraints, }) case ed25519.PrivateKey: req = ssh.Marshal(ed25519KeyMsg{ Type: ssh.KeyAlgoED25519, Pub: []byte(k)[32:], Priv: []byte(k), Comments: comment, Constraints: constraints, }) // This function originally supported only ed25519.PrivateKey, however the // general idiom is to pass ed25519.PrivateKey by value, not by pointer. // We still support the pointer variant for backwards compatibility. case ed25519.PrivateKey: req = ssh.Marshal(ed25519KeyMsg{ Type: ssh.KeyAlgoED25519, Pub: []byte(k)[32:], Priv: []byte(k), Comments: comment, Constraints: constraints, }) default: return fmt.Errorf("agent: unsupported key type %T", s) } // if constraints are present then the message type needs to be changed. if len(constraints) != 0 { req[0] = agentAddIDConstrained } resp, err := c.call(req) if err != nil { return err } if _, ok := resp.(successAgentMsg); ok { return nil } return errors.New("agent: failure") } type rsaCertMsg struct { Type string `sshtype:"17\|25"` CertBytes []byte D big.Int Iqmp big.Int // IQMP = Inverse Q Mod P P big.Int Q big.Int Comments string Constraints []byte `ssh:"rest"` } type dsaCertMsg struct { Type string `sshtype:"17\|25"` CertBytes []byte X big.Int Comments string Constraints []byte `ssh:"rest"` } type ecdsaCertMsg struct { Type string `sshtype:"17\|25"` CertBytes []byte D big.Int Comments string Constraints []byte `ssh:"rest"` } type ed25519CertMsg struct { Type string `sshtype:"17\|25"` CertBytes []byte Pub []byte Priv []byte Comments string Constraints []byte `ssh:"rest"` } // Add adds a private key to the agent. If a certificate is given, // that certificate is added instead as public key. func (c client) Add(key AddedKey) error { var constraints []byte if secs := key.LifetimeSecs; secs != 0 { constraints = append(constraints, ssh.Marshal(constrainLifetimeAgentMsg{secs})...) } if key.ConfirmBeforeUse { constraints = append(constraints, agentConstrainConfirm) } cert := key.Certificate if cert == nil { return c.insertKey(key.PrivateKey, key.Comment, constraints) } return c.insertCert(key.PrivateKey, cert, key.Comment, constraints) } func (c client) insertCert(s interface{}, cert ssh.Certificate, comment string, constraints []byte) error { var req []byte switch k := s.(type) { case rsa.PrivateKey: if len(k.Primes) != 2 { return fmt.Errorf("agent: unsupported RSA key with %d primes", len(k.Primes)) } k.Precompute() req = ssh.Marshal(rsaCertMsg{ Type: cert.Type(), CertBytes: cert.Marshal(), D: k.D, Iqmp: k.Precomputed.Qinv, P: k.Primes[0], Q: k.Primes[1], Comments: comment, Constraints: constraints, }) case dsa.PrivateKey: req = ssh.Marshal(dsaCertMsg{ Type: cert.Type(), CertBytes: cert.Marshal(), X: k.X, Comments: comment, Constraints: constraints, }) case ecdsa.PrivateKey: req = ssh.Marshal(ecdsaCertMsg{ Type: cert.Type(), CertBytes: cert.Marshal(), D: k.D, Comments: comment, Constraints: constraints, }) case ed25519.PrivateKey: req = ssh.Marshal(ed25519CertMsg{ Type: cert.Type(), CertBytes: cert.Marshal(), Pub: []byte(k)[32:], Priv: []byte(k), Comments: comment, Constraints: constraints, }) // This function originally supported only ed25519.PrivateKey, however the // general idiom is to pass ed25519.PrivateKey by value, not by pointer. // We still support the pointer variant for backwards compatibility. case ed25519.PrivateKey: req = ssh.Marshal(ed25519CertMsg{ Type: cert.Type(), CertBytes: cert.Marshal(), Pub: []byte(k)[32:], Priv: []byte(k), Comments: comment, Constraints: constraints, }) default: return fmt.Errorf("agent: unsupported key type %T", s) } // if constraints are present then the message type needs to be changed. if len(constraints) != 0 { req[0] = agentAddIDConstrained } signer, err := ssh.NewSignerFromKey(s) if err != nil { return err } if !bytes.Equal(cert.Key.Marshal(), signer.PublicKey().Marshal()) { return errors.New("agent: signer and cert have different public key") } resp, err := c.call(req) if err != nil { return err } if _, ok := resp.(successAgentMsg); ok { return nil } return errors.New("agent: failure") } // Signers provides a callback for client authentication. func (c client) Signers() ([]ssh.Signer, error) { keys, err := c.List() if err != nil { return nil, err } var result []ssh.Signer for _, k := range keys { result = append(result, &agentKeyringSigner{c, k}) } return result, nil } type agentKeyringSigner struct { agent client pub ssh.PublicKey } func (s agentKeyringSigner) PublicKey() ssh.PublicKey { return s.pub } func (s agentKeyringSigner) Sign(rand io.Reader, data []byte) (ssh.Signature, error) { // The agent has its own entropy source, so the rand argument is ignored. return s.agent.Sign(s.pub, data) } func (s agentKeyringSigner) SignWithAlgorithm(rand io.Reader, data []byte, algorithm string) (ssh.Signature, error) { if algorithm == "" \|\| algorithm == underlyingAlgo(s.pub.Type()) { return s.Sign(rand, data) } var flags SignatureFlags switch algorithm { case ssh.KeyAlgoRSASHA256: flags = SignatureFlagRsaSha256 case ssh.KeyAlgoRSASHA512: flags = SignatureFlagRsaSha512 default: return nil, fmt.Errorf("agent: unsupported algorithm %q", algorithm) } return s.agent.SignWithFlags(s.pub, data, flags) } var _ ssh.AlgorithmSigner = &agentKeyringSigner{} // certKeyAlgoNames is a mapping from known certificate algorithm names to the // corresponding public key signature algorithm. // // This map must be kept in sync with the one in certs.go. var certKeyAlgoNames = map[string]string{ ssh.CertAlgoRSAv01: ssh.KeyAlgoRSA, ssh.CertAlgoRSASHA256v01: ssh.KeyAlgoRSASHA256, ssh.CertAlgoRSASHA512v01: ssh.KeyAlgoRSASHA512, ssh.CertAlgoDSAv01: ssh.KeyAlgoDSA, ssh.CertAlgoECDSA256v01: ssh.KeyAlgoECDSA256, ssh.CertAlgoECDSA384v01: ssh.KeyAlgoECDSA384, ssh.CertAlgoECDSA521v01: ssh.KeyAlgoECDSA521, ssh.CertAlgoSKECDSA256v01: ssh.KeyAlgoSKECDSA256, ssh.CertAlgoED25519v01: ssh.KeyAlgoED25519, ssh.CertAlgoSKED25519v01: ssh.KeyAlgoSKED25519, } // underlyingAlgo returns the signature algorithm associated with algo (which is // an advertised or negotiated public key or host key algorithm). These are // usually the same, except for certificate algorithms. func underlyingAlgo(algo string) string { if a, ok := certKeyAlgoNames[algo]; ok { return a } return algo } // Calls an extension method. It is up to the agent implementation as to whether or not // any particular extension is supported and may always return an error. Because the // type of the response is up to the implementation, this returns the bytes of the // response and does not attempt any type of unmarshalling. func (c client) Extension(extensionType string, contents []byte) ([]byte, error) { req := ssh.Marshal(extensionAgentMsg{ ExtensionType: extensionType, Contents: contents, }) buf, err := c.callRaw(req) if err != nil { return nil, err } if len(buf) == 0 { return nil, errors.New("agent: failure; empty response") } // [PROTOCOL.agent] section 4.7 indicates that an SSH_AGENT_FAILURE message // represents an agent that does not support the extension if buf[0] == agentFailure { return nil, ErrExtensionUnsupported } if buf[0] == agentExtensionFailure { return nil, errors.New("agent: generic extension failure") } return buf, nil }	23.19 KB	2025-05-25 12:27
📄 client_test.go // Copyright 2012 The Go Authors. All rights reserved. // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file. package agent import ( "bytes" "crypto/rand" "errors" "io" "net" "os" "os/exec" "path/filepath" "runtime" "strconv" "strings" "testing" "time" "golang.org/x/crypto/ssh" ) // startOpenSSHAgent executes ssh-agent, and returns an Agent interface to it. func startOpenSSHAgent(t testing.T) (client ExtendedAgent, socket string, cleanup func()) { if testing.Short() { // ssh-agent is not always available, and the key // types supported vary by platform. t.Skip("skipping test due to -short") } if runtime.GOOS == "windows" { t.Skip("skipping on windows, we don't support connecting to the ssh-agent via a named pipe") } bin, err := exec.LookPath("ssh-agent") if err != nil { t.Skip("could not find ssh-agent") } cmd := exec.Command(bin, "-s") cmd.Env = []string{} // Do not let the user's environment influence ssh-agent behavior. cmd.Stderr = new(bytes.Buffer) out, err := cmd.Output() if err != nil { t.Fatalf("%s failed: %v\n%s", strings.Join(cmd.Args, " "), err, cmd.Stderr) } // Output looks like: // // SSH_AUTH_SOCK=/tmp/ssh-P65gpcqArqvH/agent.15541; export SSH_AUTH_SOCK; // SSH_AGENT_PID=15542; export SSH_AGENT_PID; // echo Agent pid 15542; fields := bytes.Split(out, []byte(";")) line := bytes.SplitN(fields[0], []byte("="), 2) line[0] = bytes.TrimLeft(line[0], "\n") if string(line[0]) != "SSH_AUTH_SOCK" { t.Fatalf("could not find key SSH_AUTH_SOCK in %q", fields[0]) } socket = string(line[1]) line = bytes.SplitN(fields[2], []byte("="), 2) line[0] = bytes.TrimLeft(line[0], "\n") if string(line[0]) != "SSH_AGENT_PID" { t.Fatalf("could not find key SSH_AGENT_PID in %q", fields[2]) } pidStr := line[1] pid, err := strconv.Atoi(string(pidStr)) if err != nil { t.Fatalf("Atoi(%q): %v", pidStr, err) } conn, err := net.Dial("unix", string(socket)) if err != nil { t.Fatalf("net.Dial: %v", err) } ac := NewClient(conn) return ac, socket, func() { proc, _ := os.FindProcess(pid) if proc != nil { proc.Kill() } conn.Close() os.RemoveAll(filepath.Dir(socket)) } } func startAgent(t testing.T, agent Agent) (client ExtendedAgent, cleanup func()) { c1, c2, err := netPipe() if err != nil { t.Fatalf("netPipe: %v", err) } go ServeAgent(agent, c2) return NewClient(c1), func() { c1.Close() c2.Close() } } // startKeyringAgent uses Keyring to simulate a ssh-agent Server and returns a client. func startKeyringAgent(t testing.T) (client ExtendedAgent, cleanup func()) { return startAgent(t, NewKeyring()) } func testOpenSSHAgent(t testing.T, key interface{}, cert ssh.Certificate, lifetimeSecs uint32) { agent, _, cleanup := startOpenSSHAgent(t) defer cleanup() testAgentInterface(t, agent, key, cert, lifetimeSecs) } func testKeyringAgent(t testing.T, key interface{}, cert ssh.Certificate, lifetimeSecs uint32) { agent, cleanup := startKeyringAgent(t) defer cleanup() testAgentInterface(t, agent, key, cert, lifetimeSecs) } func testAgentInterface(t testing.T, agent ExtendedAgent, key interface{}, cert ssh.Certificate, lifetimeSecs uint32) { signer, err := ssh.NewSignerFromKey(key) if err != nil { t.Fatalf("NewSignerFromKey(%T): %v", key, err) } // The agent should start up empty. if keys, err := agent.List(); err != nil { t.Fatalf("RequestIdentities: %v", err) } else if len(keys) > 0 { t.Fatalf("got %d keys, want 0: %v", len(keys), keys) } // Attempt to insert the key, with certificate if specified. var pubKey ssh.PublicKey if cert != nil { err = agent.Add(AddedKey{ PrivateKey: key, Certificate: cert, Comment: "comment", LifetimeSecs: lifetimeSecs, }) pubKey = cert } else { err = agent.Add(AddedKey{PrivateKey: key, Comment: "comment", LifetimeSecs: lifetimeSecs}) pubKey = signer.PublicKey() } if err != nil { t.Fatalf("insert(%T): %v", key, err) } // Did the key get inserted successfully? if keys, err := agent.List(); err != nil { t.Fatalf("List: %v", err) } else if len(keys) != 1 { t.Fatalf("got %v, want 1 key", keys) } else if keys[0].Comment != "comment" { t.Fatalf("key comment: got %v, want %v", keys[0].Comment, "comment") } else if !bytes.Equal(keys[0].Blob, pubKey.Marshal()) { t.Fatalf("key mismatch") } // Can the agent make a valid signature? data := []byte("hello") sig, err := agent.Sign(pubKey, data) if err != nil { t.Logf("sign failed with key type %q", pubKey.Type()) // In integration tests ssh-rsa (SHA1 signatures) may be disabled for // security reasons, we check SHA-2 variants later. if pubKey.Type() != ssh.KeyAlgoRSA && pubKey.Type() != ssh.CertAlgoRSAv01 { t.Fatalf("Sign(%s): %v", pubKey.Type(), err) } } else { if err := pubKey.Verify(data, sig); err != nil { t.Logf("verify failed with key type %q", pubKey.Type()) if pubKey.Type() != ssh.KeyAlgoRSA { t.Fatalf("Verify(%s): %v", pubKey.Type(), err) } } } // For tests on RSA keys, try signing with SHA-256 and SHA-512 flags if pubKey.Type() == ssh.KeyAlgoRSA { sshFlagTest := func(flag SignatureFlags, expectedSigFormat string) { sig, err = agent.SignWithFlags(pubKey, data, flag) if err != nil { t.Fatalf("SignWithFlags(%s): %v", pubKey.Type(), err) } if sig.Format != expectedSigFormat { t.Fatalf("Signature format didn't match expected value: %s != %s", sig.Format, expectedSigFormat) } if err := pubKey.Verify(data, sig); err != nil { t.Fatalf("Verify(%s): %v", pubKey.Type(), err) } } sshFlagTest(SignatureFlagRsaSha256, ssh.KeyAlgoRSASHA256) sshFlagTest(SignatureFlagRsaSha512, ssh.KeyAlgoRSASHA512) } // If the key has a lifetime, is it removed when it should be? if lifetimeSecs > 0 { time.Sleep(time.Secondtime.Duration(lifetimeSecs) + 100time.Millisecond) keys, err := agent.List() if err != nil { t.Fatalf("List: %v", err) } if len(keys) > 0 { t.Fatalf("key not expired") } } } func TestMalformedRequests(t testing.T) { keyringAgent := NewKeyring() testCase := func(t testing.T, requestBytes []byte, wantServerErr bool) { c, s := net.Pipe() defer c.Close() defer s.Close() go func() { _, err := c.Write(requestBytes) if err != nil { t.Errorf("Unexpected error writing raw bytes on connection: %v", err) } c.Close() }() err := ServeAgent(keyringAgent, s) if err == nil { t.Error("ServeAgent should have returned an error to malformed input") } else { if (err != io.EOF) != wantServerErr { t.Errorf("ServeAgent returned expected error: %v", err) } } } var testCases = []struct { name string requestBytes []byte wantServerErr bool }{ {"Empty request", []byte{}, false}, {"Short header", []byte{0x00}, true}, {"Empty body", []byte{0x00, 0x00, 0x00, 0x00}, true}, {"Short body", []byte{0x00, 0x00, 0x00, 0x01}, false}, } for _, tc := range testCases { t.Run(tc.name, func(t testing.T) { testCase(t, tc.requestBytes, tc.wantServerErr) }) } } func TestAgent(t testing.T) { for _, keyType := range []string{"rsa", "ecdsa", "ed25519"} { testOpenSSHAgent(t, testPrivateKeys[keyType], nil, 0) testKeyringAgent(t, testPrivateKeys[keyType], nil, 0) } } func TestCert(t testing.T) { cert := &ssh.Certificate{ Key: testPublicKeys["rsa"], ValidBefore: ssh.CertTimeInfinity, CertType: ssh.UserCert, } cert.SignCert(rand.Reader, testSigners["ecdsa"]) testOpenSSHAgent(t, testPrivateKeys["rsa"], cert, 0) testKeyringAgent(t, testPrivateKeys["rsa"], cert, 0) } // netListener creates a localhost network listener. func netListener() (net.Listener, error) { listener, err := net.Listen("tcp", "127.0.0.1:0") if err != nil { listener, err = net.Listen("tcp", "[::1]:0") if err != nil { return nil, err } } return listener, nil } // netPipe is analogous to net.Pipe, but it uses a real net.Conn, and // therefore is buffered (net.Pipe deadlocks if both sides start with // a write.) func netPipe() (net.Conn, net.Conn, error) { listener, err := netListener() if err != nil { return nil, nil, err } defer listener.Close() c1, err := net.Dial("tcp", listener.Addr().String()) if err != nil { return nil, nil, err } c2, err := listener.Accept() if err != nil { c1.Close() return nil, nil, err } return c1, c2, nil } func TestServerResponseTooLarge(t testing.T) { a, b, err := netPipe() if err != nil { t.Fatalf("netPipe: %v", err) } done := make(chan struct{}) defer func() { <-done }() defer a.Close() defer b.Close() var response identitiesAnswerAgentMsg response.NumKeys = 1 response.Keys = make([]byte, maxAgentResponseBytes+1) agent := NewClient(a) go func() { defer close(done) n, err := b.Write(ssh.Marshal(response)) if n < 4 { if runtime.GOOS == "plan9" { if e1, ok := err.(net.OpError); ok { if e2, ok := e1.Err.(os.PathError); ok { switch e2.Err.Error() { case "Hangup", "i/o on hungup channel": // syscall.Pwrite returns -1 in this case even when some data did get written. return } } } } t.Errorf("At least 4 bytes (the response size) should have been successfully written: %d < 4: %v", n, err) } }() _, err = agent.List() if err == nil { t.Fatal("Did not get error result") } if err.Error() != "agent: client error: response too large" { t.Fatal("Did not get expected error result") } } func TestAuth(t testing.T) { agent, _, cleanup := startOpenSSHAgent(t) defer cleanup() a, b, err := netPipe() if err != nil { t.Fatalf("netPipe: %v", err) } defer a.Close() defer b.Close() if err := agent.Add(AddedKey{PrivateKey: testPrivateKeys["rsa"], Comment: "comment"}); err != nil { t.Errorf("Add: %v", err) } serverConf := ssh.ServerConfig{} serverConf.AddHostKey(testSigners["rsa"]) serverConf.PublicKeyCallback = func(c ssh.ConnMetadata, key ssh.PublicKey) (ssh.Permissions, error) { if bytes.Equal(key.Marshal(), testPublicKeys["rsa"].Marshal()) { return nil, nil } return nil, errors.New("pubkey rejected") } go func() { conn, _, _, err := ssh.NewServerConn(a, &serverConf) if err != nil { t.Errorf("NewServerConn error: %v", err) return } conn.Close() }() conf := ssh.ClientConfig{ HostKeyCallback: ssh.InsecureIgnoreHostKey(), } conf.Auth = append(conf.Auth, ssh.PublicKeysCallback(agent.Signers)) conn, _, _, err := ssh.NewClientConn(b, "", &conf) if err != nil { t.Fatalf("NewClientConn: %v", err) } conn.Close() } func TestLockOpenSSHAgent(t testing.T) { agent, _, cleanup := startOpenSSHAgent(t) defer cleanup() testLockAgent(agent, t) } func TestLockKeyringAgent(t testing.T) { agent, cleanup := startKeyringAgent(t) defer cleanup() testLockAgent(agent, t) } func testLockAgent(agent Agent, t testing.T) { if err := agent.Add(AddedKey{PrivateKey: testPrivateKeys["rsa"], Comment: "comment 1"}); err != nil { t.Errorf("Add: %v", err) } if err := agent.Add(AddedKey{PrivateKey: testPrivateKeys["ecdsa"], Comment: "comment ecdsa"}); err != nil { t.Errorf("Add: %v", err) } if keys, err := agent.List(); err != nil { t.Errorf("List: %v", err) } else if len(keys) != 2 { t.Errorf("Want 2 keys, got %v", keys) } passphrase := []byte("secret") if err := agent.Lock(passphrase); err != nil { t.Errorf("Lock: %v", err) } if keys, err := agent.List(); err != nil { t.Errorf("List: %v", err) } else if len(keys) != 0 { t.Errorf("Want 0 keys, got %v", keys) } signer, _ := ssh.NewSignerFromKey(testPrivateKeys["rsa"]) if _, err := agent.Sign(signer.PublicKey(), []byte("hello")); err == nil { t.Fatalf("Sign did not fail") } if err := agent.Remove(signer.PublicKey()); err == nil { t.Fatalf("Remove did not fail") } if err := agent.RemoveAll(); err == nil { t.Fatalf("RemoveAll did not fail") } if err := agent.Unlock(nil); err == nil { t.Errorf("Unlock with wrong passphrase succeeded") } if err := agent.Unlock(passphrase); err != nil { t.Errorf("Unlock: %v", err) } if err := agent.Remove(signer.PublicKey()); err != nil { t.Fatalf("Remove: %v", err) } if keys, err := agent.List(); err != nil { t.Errorf("List: %v", err) } else if len(keys) != 1 { t.Errorf("Want 1 keys, got %v", keys) } } func testOpenSSHAgentLifetime(t testing.T) { agent, _, cleanup := startOpenSSHAgent(t) defer cleanup() testAgentLifetime(t, agent) } func testKeyringAgentLifetime(t testing.T) { agent, cleanup := startKeyringAgent(t) defer cleanup() testAgentLifetime(t, agent) } func testAgentLifetime(t testing.T, agent Agent) { for _, keyType := range []string{"rsa", "dsa", "ecdsa"} { // Add private keys to the agent. err := agent.Add(AddedKey{ PrivateKey: testPrivateKeys[keyType], Comment: "comment", LifetimeSecs: 1, }) if err != nil { t.Fatalf("add: %v", err) } // Add certs to the agent. cert := &ssh.Certificate{ Key: testPublicKeys[keyType], ValidBefore: ssh.CertTimeInfinity, CertType: ssh.UserCert, } cert.SignCert(rand.Reader, testSigners[keyType]) err = agent.Add(AddedKey{ PrivateKey: testPrivateKeys[keyType], Certificate: cert, Comment: "comment", LifetimeSecs: 1, }) if err != nil { t.Fatalf("add: %v", err) } } time.Sleep(1100 time.Millisecond) if keys, err := agent.List(); err != nil { t.Errorf("List: %v", err) } else if len(keys) != 0 { t.Errorf("Want 0 keys, got %v", len(keys)) } } type keyringExtended struct { keyring } func (r keyringExtended) Extension(extensionType string, contents []byte) ([]byte, error) { if extensionType != "my-extension@example.com" { return []byte{agentExtensionFailure}, nil } return append([]byte{agentSuccess}, contents...), nil } func TestAgentExtensions(t *testing.T) { agent, _, cleanup := startOpenSSHAgent(t) defer cleanup() _, err := agent.Extension("my-extension@example.com", []byte{0x00, 0x01, 0x02}) if err == nil { t.Fatal("should have gotten agent extension failure") } agent, cleanup = startAgent(t, &keyringExtended{}) defer cleanup() result, err := agent.Extension("my-extension@example.com", []byte{0x00, 0x01, 0x02}) if err != nil { t.Fatalf("agent extension failure: %v", err) } if len(result) != 4 \|\| !bytes.Equal(result, []byte{agentSuccess, 0x00, 0x01, 0x02}) { t.Fatalf("agent extension result invalid: %v", result) } _, err = agent.Extension("bad-extension@example.com", []byte{0x00, 0x01, 0x02}) if err == nil { t.Fatal("should have gotten agent extension failure") } }	14.29 KB	2025-05-25 12:27
📄 example_test.go // Copyright 2016 The Go Authors. All rights reserved. // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file. package agent_test import ( "log" "net" "os" "golang.org/x/crypto/ssh" "golang.org/x/crypto/ssh/agent" ) func ExampleNewClient() { // ssh-agent(1) provides a UNIX socket at $SSH_AUTH_SOCK. socket := os.Getenv("SSH_AUTH_SOCK") conn, err := net.Dial("unix", socket) if err != nil { log.Fatalf("Failed to open SSH_AUTH_SOCK: %v", err) } agentClient := agent.NewClient(conn) config := &ssh.ClientConfig{ User: "gopher", Auth: []ssh.AuthMethod{ // Use a callback rather than PublicKeys so we only consult the // agent once the remote server wants it. ssh.PublicKeysCallback(agentClient.Signers), }, HostKeyCallback: ssh.InsecureIgnoreHostKey(), } sshc, err := ssh.Dial("tcp", "localhost:22", config) if err != nil { log.Fatal(err) } // Use sshc... sshc.Close() }	962 B	2025-05-25 12:27
📄 forward.go // Copyright 2014 The Go Authors. All rights reserved. // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file. package agent import ( "errors" "io" "net" "sync" "golang.org/x/crypto/ssh" ) // RequestAgentForwarding sets up agent forwarding for the session. // ForwardToAgent or ForwardToRemote should be called to route // the authentication requests. func RequestAgentForwarding(session ssh.Session) error { ok, err := session.SendRequest("auth-agent-req@openssh.com", true, nil) if err != nil { return err } if !ok { return errors.New("forwarding request denied") } return nil } // ForwardToAgent routes authentication requests to the given keyring. func ForwardToAgent(client ssh.Client, keyring Agent) error { channels := client.HandleChannelOpen(channelType) if channels == nil { return errors.New("agent: already have handler for " + channelType) } go func() { for ch := range channels { channel, reqs, err := ch.Accept() if err != nil { continue } go ssh.DiscardRequests(reqs) go func() { ServeAgent(keyring, channel) channel.Close() }() } }() return nil } const channelType = "auth-agent@openssh.com" // ForwardToRemote routes authentication requests to the ssh-agent // process serving on the given unix socket. func ForwardToRemote(client ssh.Client, addr string) error { channels := client.HandleChannelOpen(channelType) if channels == nil { return errors.New("agent: already have handler for " + channelType) } conn, err := net.Dial("unix", addr) if err != nil { return err } conn.Close() go func() { for ch := range channels { channel, reqs, err := ch.Accept() if err != nil { continue } go ssh.DiscardRequests(reqs) go forwardUnixSocket(channel, addr) } }() return nil } func forwardUnixSocket(channel ssh.Channel, addr string) { conn, err := net.Dial("unix", addr) if err != nil { return } var wg sync.WaitGroup wg.Add(2) go func() { io.Copy(conn, channel) conn.(net.UnixConn).CloseWrite() wg.Done() }() go func() { io.Copy(channel, conn) channel.CloseWrite() wg.Done() }() wg.Wait() conn.Close() channel.Close() }	2.16 KB	2025-05-25 12:27
📄 keyring.go // Copyright 2014 The Go Authors. All rights reserved. // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file. package agent import ( "bytes" "crypto/rand" "crypto/subtle" "errors" "fmt" "sync" "time" "golang.org/x/crypto/ssh" ) type privKey struct { signer ssh.Signer comment string expire time.Time } type keyring struct { mu sync.Mutex keys []privKey locked bool passphrase []byte } var errLocked = errors.New("agent: locked") // NewKeyring returns an Agent that holds keys in memory. It is safe // for concurrent use by multiple goroutines. func NewKeyring() Agent { return &keyring{} } // RemoveAll removes all identities. func (r keyring) RemoveAll() error { r.mu.Lock() defer r.mu.Unlock() if r.locked { return errLocked } r.keys = nil return nil } // removeLocked does the actual key removal. The caller must already be holding the // keyring mutex. func (r keyring) removeLocked(want []byte) error { found := false for i := 0; i < len(r.keys); { if bytes.Equal(r.keys[i].signer.PublicKey().Marshal(), want) { found = true r.keys[i] = r.keys[len(r.keys)-1] r.keys = r.keys[:len(r.keys)-1] continue } else { i++ } } if !found { return errors.New("agent: key not found") } return nil } // Remove removes all identities with the given public key. func (r keyring) Remove(key ssh.PublicKey) error { r.mu.Lock() defer r.mu.Unlock() if r.locked { return errLocked } return r.removeLocked(key.Marshal()) } // Lock locks the agent. Sign and Remove will fail, and List will return an empty list. func (r keyring) Lock(passphrase []byte) error { r.mu.Lock() defer r.mu.Unlock() if r.locked { return errLocked } r.locked = true r.passphrase = passphrase return nil } // Unlock undoes the effect of Lock func (r keyring) Unlock(passphrase []byte) error { r.mu.Lock() defer r.mu.Unlock() if !r.locked { return errors.New("agent: not locked") } if 1 != subtle.ConstantTimeCompare(passphrase, r.passphrase) { return fmt.Errorf("agent: incorrect passphrase") } r.locked = false r.passphrase = nil return nil } // expireKeysLocked removes expired keys from the keyring. If a key was added // with a lifetimesecs contraint and seconds >= lifetimesecs seconds have // elapsed, it is removed. The caller must be holding the keyring mutex. func (r keyring) expireKeysLocked() { for _, k := range r.keys { if k.expire != nil && time.Now().After(k.expire) { r.removeLocked(k.signer.PublicKey().Marshal()) } } } // List returns the identities known to the agent. func (r keyring) List() ([]Key, error) { r.mu.Lock() defer r.mu.Unlock() if r.locked { // section 2.7: locked agents return empty. return nil, nil } r.expireKeysLocked() var ids []Key for _, k := range r.keys { pub := k.signer.PublicKey() ids = append(ids, &Key{ Format: pub.Type(), Blob: pub.Marshal(), Comment: k.comment}) } return ids, nil } // Insert adds a private key to the keyring. If a certificate // is given, that certificate is added as public key. Note that // any constraints given are ignored. func (r keyring) Add(key AddedKey) error { r.mu.Lock() defer r.mu.Unlock() if r.locked { return errLocked } signer, err := ssh.NewSignerFromKey(key.PrivateKey) if err != nil { return err } if cert := key.Certificate; cert != nil { signer, err = ssh.NewCertSigner(cert, signer) if err != nil { return err } } p := privKey{ signer: signer, comment: key.Comment, } if key.LifetimeSecs > 0 { t := time.Now().Add(time.Duration(key.LifetimeSecs) * time.Second) p.expire = &t } // If we already have a Signer with the same public key, replace it with the // new one. for idx, k := range r.keys { if bytes.Equal(k.signer.PublicKey().Marshal(), p.signer.PublicKey().Marshal()) { r.keys[idx] = p return nil } } r.keys = append(r.keys, p) return nil } // Sign returns a signature for the data. func (r keyring) Sign(key ssh.PublicKey, data []byte) (ssh.Signature, error) { return r.SignWithFlags(key, data, 0) } func (r keyring) SignWithFlags(key ssh.PublicKey, data []byte, flags SignatureFlags) (ssh.Signature, error) { r.mu.Lock() defer r.mu.Unlock() if r.locked { return nil, errLocked } r.expireKeysLocked() wanted := key.Marshal() for _, k := range r.keys { if bytes.Equal(k.signer.PublicKey().Marshal(), wanted) { if flags == 0 { return k.signer.Sign(rand.Reader, data) } else { if algorithmSigner, ok := k.signer.(ssh.AlgorithmSigner); !ok { return nil, fmt.Errorf("agent: signature does not support non-default signature algorithm: %T", k.signer) } else { var algorithm string switch flags { case SignatureFlagRsaSha256: algorithm = ssh.KeyAlgoRSASHA256 case SignatureFlagRsaSha512: algorithm = ssh.KeyAlgoRSASHA512 default: return nil, fmt.Errorf("agent: unsupported signature flags: %d", flags) } return algorithmSigner.SignWithAlgorithm(rand.Reader, data, algorithm) } } } } return nil, errors.New("not found") } // Signers returns signers for all the known keys. func (r keyring) Signers() ([]ssh.Signer, error) { r.mu.Lock() defer r.mu.Unlock() if r.locked { return nil, errLocked } r.expireKeysLocked() s := make([]ssh.Signer, 0, len(r.keys)) for _, k := range r.keys { s = append(s, k.signer) } return s, nil } // The keyring does not support any extensions func (r keyring) Extension(extensionType string, contents []byte) ([]byte, error) { return nil, ErrExtensionUnsupported }	5.51 KB	2025-05-25 12:27
📄 keyring_test.go // Copyright 2015 The Go Authors. All rights reserved. // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file. package agent import "testing" func addTestKey(t testing.T, a Agent, keyName string) { err := a.Add(AddedKey{ PrivateKey: testPrivateKeys[keyName], Comment: keyName, }) if err != nil { t.Fatalf("failed to add key %q: %v", keyName, err) } } func removeTestKey(t testing.T, a Agent, keyName string) { err := a.Remove(testPublicKeys[keyName]) if err != nil { t.Fatalf("failed to remove key %q: %v", keyName, err) } } func validateListedKeys(t testing.T, a Agent, expectedKeys []string) { listedKeys, err := a.List() if err != nil { t.Fatalf("failed to list keys: %v", err) return } if len(listedKeys) != len(expectedKeys) { t.Fatalf("expeted %d key, got %d", len(expectedKeys), len(listedKeys)) return } actualKeys := make(map[string]bool) for _, key := range listedKeys { actualKeys[key.Comment] = true } matchedKeys := make(map[string]bool) for _, expectedKey := range expectedKeys { if !actualKeys[expectedKey] { t.Fatalf("expected key %q, but was not found", expectedKey) } else { matchedKeys[expectedKey] = true } } for actualKey := range actualKeys { if !matchedKeys[actualKey] { t.Fatalf("key %q was found, but was not expected", actualKey) } } } func TestKeyringAddingAndRemoving(t testing.T) { keyNames := []string{"dsa", "ecdsa", "rsa", "user"} // add all test private keys k := NewKeyring() for _, keyName := range keyNames { addTestKey(t, k, keyName) } validateListedKeys(t, k, keyNames) // remove a key in the middle keyToRemove := keyNames[1] keyNames = append(keyNames[:1], keyNames[2:]...) removeTestKey(t, k, keyToRemove) validateListedKeys(t, k, keyNames) // remove all keys err := k.RemoveAll() if err != nil { t.Fatalf("failed to remove all keys: %v", err) } validateListedKeys(t, k, []string{}) } func TestAddDuplicateKey(t *testing.T) { keyNames := []string{"rsa", "user"} k := NewKeyring() for _, keyName := range keyNames { addTestKey(t, k, keyName) } validateListedKeys(t, k, keyNames) // Add the keys again. for _, keyName := range keyNames { addTestKey(t, k, keyName) } validateListedKeys(t, k, keyNames) // Add an existing key with an updated comment. keyName := keyNames[0] addedKey := AddedKey{ PrivateKey: testPrivateKeys[keyName], Comment: "comment updated", } err := k.Add(addedKey) if err != nil { t.Fatalf("failed to add key %q: %v", keyName, err) } // Check the that key is found and the comment was updated. keys, err := k.List() if err != nil { t.Fatalf("failed to list keys: %v", err) } if len(keys) != len(keyNames) { t.Fatalf("expected %d keys, got %d", len(keyNames), len(keys)) } isFound := false for _, key := range keys { if key.Comment == addedKey.Comment { isFound = true } } if !isFound { t.Fatal("key with the updated comment not found") } }	2.93 KB	2025-05-25 12:27
📄 server.go // Copyright 2012 The Go Authors. All rights reserved. // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file. package agent import ( "crypto/dsa" "crypto/ecdsa" "crypto/ed25519" "crypto/elliptic" "crypto/rsa" "encoding/binary" "errors" "fmt" "io" "log" "math/big" "golang.org/x/crypto/ssh" ) // server wraps an Agent and uses it to implement the agent side of // the SSH-agent, wire protocol. type server struct { agent Agent } func (s server) processRequestBytes(reqData []byte) []byte { rep, err := s.processRequest(reqData) if err != nil { if err != errLocked { // TODO(hanwen): provide better logging interface? log.Printf("agent %d: %v", reqData[0], err) } return []byte{agentFailure} } if err == nil && rep == nil { return []byte{agentSuccess} } return ssh.Marshal(rep) } func marshalKey(k Key) []byte { var record struct { Blob []byte Comment string } record.Blob = k.Marshal() record.Comment = k.Comment return ssh.Marshal(&record) } // See [PROTOCOL.agent], section 2.5.1. const agentV1IdentitiesAnswer = 2 type agentV1IdentityMsg struct { Numkeys uint32 `sshtype:"2"` } type agentRemoveIdentityMsg struct { KeyBlob []byte `sshtype:"18"` } type agentLockMsg struct { Passphrase []byte `sshtype:"22"` } type agentUnlockMsg struct { Passphrase []byte `sshtype:"23"` } func (s server) processRequest(data []byte) (interface{}, error) { switch data[0] { case agentRequestV1Identities: return &agentV1IdentityMsg{0}, nil case agentRemoveAllV1Identities: return nil, nil case agentRemoveIdentity: var req agentRemoveIdentityMsg if err := ssh.Unmarshal(data, &req); err != nil { return nil, err } var wk wireKey if err := ssh.Unmarshal(req.KeyBlob, &wk); err != nil { return nil, err } return nil, s.agent.Remove(&Key{Format: wk.Format, Blob: req.KeyBlob}) case agentRemoveAllIdentities: return nil, s.agent.RemoveAll() case agentLock: var req agentLockMsg if err := ssh.Unmarshal(data, &req); err != nil { return nil, err } return nil, s.agent.Lock(req.Passphrase) case agentUnlock: var req agentUnlockMsg if err := ssh.Unmarshal(data, &req); err != nil { return nil, err } return nil, s.agent.Unlock(req.Passphrase) case agentSignRequest: var req signRequestAgentMsg if err := ssh.Unmarshal(data, &req); err != nil { return nil, err } var wk wireKey if err := ssh.Unmarshal(req.KeyBlob, &wk); err != nil { return nil, err } k := &Key{ Format: wk.Format, Blob: req.KeyBlob, } var sig ssh.Signature var err error if extendedAgent, ok := s.agent.(ExtendedAgent); ok { sig, err = extendedAgent.SignWithFlags(k, req.Data, SignatureFlags(req.Flags)) } else { sig, err = s.agent.Sign(k, req.Data) } if err != nil { return nil, err } return &signResponseAgentMsg{SigBlob: ssh.Marshal(sig)}, nil case agentRequestIdentities: keys, err := s.agent.List() if err != nil { return nil, err } rep := identitiesAnswerAgentMsg{ NumKeys: uint32(len(keys)), } for _, k := range keys { rep.Keys = append(rep.Keys, marshalKey(k)...) } return rep, nil case agentAddIDConstrained, agentAddIdentity: return nil, s.insertIdentity(data) case agentExtension: // Return a stub object where the whole contents of the response gets marshaled. var responseStub struct { Rest []byte `ssh:"rest"` } if extendedAgent, ok := s.agent.(ExtendedAgent); !ok { // If this agent doesn't implement extensions, [PROTOCOL.agent] section 4.7 // requires that we return a standard SSH_AGENT_FAILURE message. responseStub.Rest = []byte{agentFailure} } else { var req extensionAgentMsg if err := ssh.Unmarshal(data, &req); err != nil { return nil, err } res, err := extendedAgent.Extension(req.ExtensionType, req.Contents) if err != nil { // If agent extensions are unsupported, return a standard SSH_AGENT_FAILURE // message as required by [PROTOCOL.agent] section 4.7. if err == ErrExtensionUnsupported { responseStub.Rest = []byte{agentFailure} } else { // As the result of any other error processing an extension request, // [PROTOCOL.agent] section 4.7 requires that we return a // SSH_AGENT_EXTENSION_FAILURE code. responseStub.Rest = []byte{agentExtensionFailure} } } else { if len(res) == 0 { return nil, nil } responseStub.Rest = res } } return responseStub, nil } return nil, fmt.Errorf("unknown opcode %d", data[0]) } func parseConstraints(constraints []byte) (lifetimeSecs uint32, confirmBeforeUse bool, extensions []ConstraintExtension, err error) { for len(constraints) != 0 { switch constraints[0] { case agentConstrainLifetime: lifetimeSecs = binary.BigEndian.Uint32(constraints[1:5]) constraints = constraints[5:] case agentConstrainConfirm: confirmBeforeUse = true constraints = constraints[1:] case agentConstrainExtension, agentConstrainExtensionV00: var msg constrainExtensionAgentMsg if err = ssh.Unmarshal(constraints, &msg); err != nil { return 0, false, nil, err } extensions = append(extensions, ConstraintExtension{ ExtensionName: msg.ExtensionName, ExtensionDetails: msg.ExtensionDetails, }) constraints = msg.Rest default: return 0, false, nil, fmt.Errorf("unknown constraint type: %d", constraints[0]) } } return } func setConstraints(key AddedKey, constraintBytes []byte) error { lifetimeSecs, confirmBeforeUse, constraintExtensions, err := parseConstraints(constraintBytes) if err != nil { return err } key.LifetimeSecs = lifetimeSecs key.ConfirmBeforeUse = confirmBeforeUse key.ConstraintExtensions = constraintExtensions return nil } func parseRSAKey(req []byte) (AddedKey, error) { var k rsaKeyMsg if err := ssh.Unmarshal(req, &k); err != nil { return nil, err } if k.E.BitLen() > 30 { return nil, errors.New("agent: RSA public exponent too large") } priv := &rsa.PrivateKey{ PublicKey: rsa.PublicKey{ E: int(k.E.Int64()), N: k.N, }, D: k.D, Primes: []big.Int{k.P, k.Q}, } priv.Precompute() addedKey := &AddedKey{PrivateKey: priv, Comment: k.Comments} if err := setConstraints(addedKey, k.Constraints); err != nil { return nil, err } return addedKey, nil } func parseEd25519Key(req []byte) (AddedKey, error) { var k ed25519KeyMsg if err := ssh.Unmarshal(req, &k); err != nil { return nil, err } priv := ed25519.PrivateKey(k.Priv) addedKey := &AddedKey{PrivateKey: &priv, Comment: k.Comments} if err := setConstraints(addedKey, k.Constraints); err != nil { return nil, err } return addedKey, nil } func parseDSAKey(req []byte) (AddedKey, error) { var k dsaKeyMsg if err := ssh.Unmarshal(req, &k); err != nil { return nil, err } priv := &dsa.PrivateKey{ PublicKey: dsa.PublicKey{ Parameters: dsa.Parameters{ P: k.P, Q: k.Q, G: k.G, }, Y: k.Y, }, X: k.X, } addedKey := &AddedKey{PrivateKey: priv, Comment: k.Comments} if err := setConstraints(addedKey, k.Constraints); err != nil { return nil, err } return addedKey, nil } func unmarshalECDSA(curveName string, keyBytes []byte, privScalar big.Int) (priv ecdsa.PrivateKey, err error) { priv = &ecdsa.PrivateKey{ D: privScalar, } switch curveName { case "nistp256": priv.Curve = elliptic.P256() case "nistp384": priv.Curve = elliptic.P384() case "nistp521": priv.Curve = elliptic.P521() default: return nil, fmt.Errorf("agent: unknown curve %q", curveName) } priv.X, priv.Y = elliptic.Unmarshal(priv.Curve, keyBytes) if priv.X == nil \|\| priv.Y == nil { return nil, errors.New("agent: point not on curve") } return priv, nil } func parseEd25519Cert(req []byte) (AddedKey, error) { var k ed25519CertMsg if err := ssh.Unmarshal(req, &k); err != nil { return nil, err } pubKey, err := ssh.ParsePublicKey(k.CertBytes) if err != nil { return nil, err } priv := ed25519.PrivateKey(k.Priv) cert, ok := pubKey.(ssh.Certificate) if !ok { return nil, errors.New("agent: bad ED25519 certificate") } addedKey := &AddedKey{PrivateKey: &priv, Certificate: cert, Comment: k.Comments} if err := setConstraints(addedKey, k.Constraints); err != nil { return nil, err } return addedKey, nil } func parseECDSAKey(req []byte) (AddedKey, error) { var k ecdsaKeyMsg if err := ssh.Unmarshal(req, &k); err != nil { return nil, err } priv, err := unmarshalECDSA(k.Curve, k.KeyBytes, k.D) if err != nil { return nil, err } addedKey := &AddedKey{PrivateKey: priv, Comment: k.Comments} if err := setConstraints(addedKey, k.Constraints); err != nil { return nil, err } return addedKey, nil } func parseRSACert(req []byte) (AddedKey, error) { var k rsaCertMsg if err := ssh.Unmarshal(req, &k); err != nil { return nil, err } pubKey, err := ssh.ParsePublicKey(k.CertBytes) if err != nil { return nil, err } cert, ok := pubKey.(ssh.Certificate) if !ok { return nil, errors.New("agent: bad RSA certificate") } // An RSA publickey as marshaled by rsaPublicKey.Marshal() in keys.go var rsaPub struct { Name string E big.Int N big.Int } if err := ssh.Unmarshal(cert.Key.Marshal(), &rsaPub); err != nil { return nil, fmt.Errorf("agent: Unmarshal failed to parse public key: %v", err) } if rsaPub.E.BitLen() > 30 { return nil, errors.New("agent: RSA public exponent too large") } priv := rsa.PrivateKey{ PublicKey: rsa.PublicKey{ E: int(rsaPub.E.Int64()), N: rsaPub.N, }, D: k.D, Primes: []big.Int{k.Q, k.P}, } priv.Precompute() addedKey := &AddedKey{PrivateKey: &priv, Certificate: cert, Comment: k.Comments} if err := setConstraints(addedKey, k.Constraints); err != nil { return nil, err } return addedKey, nil } func parseDSACert(req []byte) (AddedKey, error) { var k dsaCertMsg if err := ssh.Unmarshal(req, &k); err != nil { return nil, err } pubKey, err := ssh.ParsePublicKey(k.CertBytes) if err != nil { return nil, err } cert, ok := pubKey.(ssh.Certificate) if !ok { return nil, errors.New("agent: bad DSA certificate") } // A DSA publickey as marshaled by dsaPublicKey.Marshal() in keys.go var w struct { Name string P, Q, G, Y big.Int } if err := ssh.Unmarshal(cert.Key.Marshal(), &w); err != nil { return nil, fmt.Errorf("agent: Unmarshal failed to parse public key: %v", err) } priv := &dsa.PrivateKey{ PublicKey: dsa.PublicKey{ Parameters: dsa.Parameters{ P: w.P, Q: w.Q, G: w.G, }, Y: w.Y, }, X: k.X, } addedKey := &AddedKey{PrivateKey: priv, Certificate: cert, Comment: k.Comments} if err := setConstraints(addedKey, k.Constraints); err != nil { return nil, err } return addedKey, nil } func parseECDSACert(req []byte) (AddedKey, error) { var k ecdsaCertMsg if err := ssh.Unmarshal(req, &k); err != nil { return nil, err } pubKey, err := ssh.ParsePublicKey(k.CertBytes) if err != nil { return nil, err } cert, ok := pubKey.(ssh.Certificate) if !ok { return nil, errors.New("agent: bad ECDSA certificate") } // An ECDSA publickey as marshaled by ecdsaPublicKey.Marshal() in keys.go var ecdsaPub struct { Name string ID string Key []byte } if err := ssh.Unmarshal(cert.Key.Marshal(), &ecdsaPub); err != nil { return nil, err } priv, err := unmarshalECDSA(ecdsaPub.ID, ecdsaPub.Key, k.D) if err != nil { return nil, err } addedKey := &AddedKey{PrivateKey: priv, Certificate: cert, Comment: k.Comments} if err := setConstraints(addedKey, k.Constraints); err != nil { return nil, err } return addedKey, nil } func (s server) insertIdentity(req []byte) error { var record struct { Type string `sshtype:"17\|25"` Rest []byte `ssh:"rest"` } if err := ssh.Unmarshal(req, &record); err != nil { return err } var addedKey AddedKey var err error switch record.Type { case ssh.KeyAlgoRSA: addedKey, err = parseRSAKey(req) case ssh.KeyAlgoDSA: addedKey, err = parseDSAKey(req) case ssh.KeyAlgoECDSA256, ssh.KeyAlgoECDSA384, ssh.KeyAlgoECDSA521: addedKey, err = parseECDSAKey(req) case ssh.KeyAlgoED25519: addedKey, err = parseEd25519Key(req) case ssh.CertAlgoRSAv01: addedKey, err = parseRSACert(req) case ssh.CertAlgoDSAv01: addedKey, err = parseDSACert(req) case ssh.CertAlgoECDSA256v01, ssh.CertAlgoECDSA384v01, ssh.CertAlgoECDSA521v01: addedKey, err = parseECDSACert(req) case ssh.CertAlgoED25519v01: addedKey, err = parseEd25519Cert(req) default: return fmt.Errorf("agent: not implemented: %q", record.Type) } if err != nil { return err } return s.agent.Add(*addedKey) } // ServeAgent serves the agent protocol on the given connection. It // returns when an I/O error occurs. func ServeAgent(agent Agent, c io.ReadWriter) error { s := &server{agent} var length [4]byte for { if _, err := io.ReadFull(c, length[:]); err != nil { return err } l := binary.BigEndian.Uint32(length[:]) if l == 0 { return fmt.Errorf("agent: request size is 0") } if l > maxAgentResponseBytes { // We also cap requests. return fmt.Errorf("agent: request too large: %d", l) } req := make([]byte, l) if _, err := io.ReadFull(c, req); err != nil { return err } repData := s.processRequestBytes(req) if len(repData) > maxAgentResponseBytes { return fmt.Errorf("agent: reply too large: %d bytes", len(repData)) } binary.BigEndian.PutUint32(length[:], uint32(len(repData))) if _, err := c.Write(length[:]); err != nil { return err } if _, err := c.Write(repData); err != nil { return err } } }	13.31 KB	2025-05-25 12:27
📄 server_test.go // Copyright 2012 The Go Authors. All rights reserved. // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file. package agent import ( "crypto" "crypto/rand" "fmt" pseudorand "math/rand" "reflect" "strings" "testing" "golang.org/x/crypto/ssh" ) func TestServer(t testing.T) { c1, c2, err := netPipe() if err != nil { t.Fatalf("netPipe: %v", err) } defer c1.Close() defer c2.Close() client := NewClient(c1) go ServeAgent(NewKeyring(), c2) testAgentInterface(t, client, testPrivateKeys["rsa"], nil, 0) } func TestLockServer(t testing.T) { testLockAgent(NewKeyring(), t) } func TestSetupForwardAgent(t testing.T) { a, b, err := netPipe() if err != nil { t.Fatalf("netPipe: %v", err) } defer a.Close() defer b.Close() _, socket, cleanup := startOpenSSHAgent(t) defer cleanup() serverConf := ssh.ServerConfig{ NoClientAuth: true, } serverConf.AddHostKey(testSigners["rsa"]) incoming := make(chan ssh.ServerConn, 1) go func() { conn, _, _, err := ssh.NewServerConn(a, &serverConf) incoming <- conn if err != nil { t.Errorf("NewServerConn error: %v", err) return } }() conf := ssh.ClientConfig{ HostKeyCallback: ssh.InsecureIgnoreHostKey(), } conn, chans, reqs, err := ssh.NewClientConn(b, "", &conf) if err != nil { t.Fatalf("NewClientConn: %v", err) } client := ssh.NewClient(conn, chans, reqs) if err := ForwardToRemote(client, socket); err != nil { t.Fatalf("SetupForwardAgent: %v", err) } server := <-incoming if server == nil { t.Fatal("Unable to get server") } ch, reqs, err := server.OpenChannel(channelType, nil) if err != nil { t.Fatalf("OpenChannel(%q): %v", channelType, err) } go ssh.DiscardRequests(reqs) agentClient := NewClient(ch) testAgentInterface(t, agentClient, testPrivateKeys["rsa"], nil, 0) conn.Close() } func TestV1ProtocolMessages(t testing.T) { c1, c2, err := netPipe() if err != nil { t.Fatalf("netPipe: %v", err) } defer c1.Close() defer c2.Close() c := NewClient(c1) go ServeAgent(NewKeyring(), c2) testV1ProtocolMessages(t, c.(client)) } func testV1ProtocolMessages(t testing.T, c client) { reply, err := c.call([]byte{agentRequestV1Identities}) if err != nil { t.Fatalf("v1 request all failed: %v", err) } if msg, ok := reply.(agentV1IdentityMsg); !ok \|\| msg.Numkeys != 0 { t.Fatalf("invalid request all response: %#v", reply) } reply, err = c.call([]byte{agentRemoveAllV1Identities}) if err != nil { t.Fatalf("v1 remove all failed: %v", err) } if _, ok := reply.(successAgentMsg); !ok { t.Fatalf("invalid remove all response: %#v", reply) } } func verifyKey(sshAgent Agent) error { keys, err := sshAgent.List() if err != nil { return fmt.Errorf("listing keys: %v", err) } if len(keys) != 1 { return fmt.Errorf("bad number of keys found. expected 1, got %d", len(keys)) } buf := make([]byte, 128) if _, err := rand.Read(buf); err != nil { return fmt.Errorf("rand: %v", err) } sig, err := sshAgent.Sign(keys[0], buf) if err != nil { return fmt.Errorf("sign: %v", err) } if err := keys[0].Verify(buf, sig); err != nil { return fmt.Errorf("verify: %v", err) } return nil } func addKeyToAgent(key crypto.PrivateKey) error { sshAgent := NewKeyring() if err := sshAgent.Add(AddedKey{PrivateKey: key}); err != nil { return fmt.Errorf("add: %v", err) } return verifyKey(sshAgent) } func TestKeyTypes(t testing.T) { for k, v := range testPrivateKeys { if err := addKeyToAgent(v); err != nil { t.Errorf("error adding key type %s, %v", k, err) } if err := addCertToAgentSock(v, nil); err != nil { t.Errorf("error adding key type %s, %v", k, err) } } } func addCertToAgentSock(key crypto.PrivateKey, cert ssh.Certificate) error { a, b, err := netPipe() if err != nil { return err } agentServer := NewKeyring() go ServeAgent(agentServer, a) agentClient := NewClient(b) if err := agentClient.Add(AddedKey{PrivateKey: key, Certificate: cert}); err != nil { return fmt.Errorf("add: %v", err) } return verifyKey(agentClient) } func addCertToAgent(key crypto.PrivateKey, cert ssh.Certificate) error { sshAgent := NewKeyring() if err := sshAgent.Add(AddedKey{PrivateKey: key, Certificate: cert}); err != nil { return fmt.Errorf("add: %v", err) } return verifyKey(sshAgent) } func TestCertTypes(t testing.T) { for keyType, key := range testPublicKeys { cert := &ssh.Certificate{ ValidPrincipals: []string{"gopher1"}, ValidAfter: 0, ValidBefore: ssh.CertTimeInfinity, Key: key, Serial: 1, CertType: ssh.UserCert, SignatureKey: testPublicKeys["rsa"], Permissions: ssh.Permissions{ CriticalOptions: map[string]string{}, Extensions: map[string]string{}, }, } if err := cert.SignCert(rand.Reader, testSigners["rsa"]); err != nil { t.Fatalf("signcert: %v", err) } if err := addCertToAgent(testPrivateKeys[keyType], cert); err != nil { t.Fatalf("%v", err) } if err := addCertToAgentSock(testPrivateKeys[keyType], cert); err != nil { t.Fatalf("%v", err) } } } func TestParseConstraints(t *testing.T) { // Test LifetimeSecs var msg = constrainLifetimeAgentMsg{pseudorand.Uint32()} lifetimeSecs, _, _, err := parseConstraints(ssh.Marshal(msg)) if err != nil { t.Fatalf("parseConstraints: %v", err) } if lifetimeSecs != msg.LifetimeSecs { t.Errorf("got lifetime %v, want %v", lifetimeSecs, msg.LifetimeSecs) } // Test ConfirmBeforeUse _, confirmBeforeUse, _, err := parseConstraints([]byte{agentConstrainConfirm}) if err != nil { t.Fatalf("%v", err) } if !confirmBeforeUse { t.Error("got comfirmBeforeUse == false") } // Test ConstraintExtensions var data []byte var expect []ConstraintExtension for i := 0; i < 10; i++ { var ext = ConstraintExtension{ ExtensionName: fmt.Sprintf("name%d", i), ExtensionDetails: []byte(fmt.Sprintf("details: %d", i)), } expect = append(expect, ext) if i%2 == 0 { data = append(data, agentConstrainExtension) } else { data = append(data, agentConstrainExtensionV00) } data = append(data, ssh.Marshal(ext)...) } _, _, extensions, err := parseConstraints(data) if err != nil { t.Fatalf("%v", err) } if !reflect.DeepEqual(expect, extensions) { t.Errorf("got extension %v, want %v", extensions, expect) } // Test Unknown Constraint _, _, _, err = parseConstraints([]byte{128}) if err == nil \|\| !strings.Contains(err.Error(), "unknown constraint") { t.Errorf("unexpected error: %v", err) } }	6.4 KB	2025-05-25 12:27
📄 testdata_test.go // Copyright 2014 The Go Authors. All rights reserved. // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE file. // IMPLEMENTATION NOTE: To avoid a package loop, this file is in three places: // ssh/, ssh/agent, and ssh/test/. It should be kept in sync across all three // instances. package agent import ( "crypto/rand" "fmt" "golang.org/x/crypto/ssh" "golang.org/x/crypto/ssh/testdata" ) var ( testPrivateKeys map[string]interface{} testSigners map[string]ssh.Signer testPublicKeys map[string]ssh.PublicKey ) func init() { var err error n := len(testdata.PEMBytes) testPrivateKeys = make(map[string]interface{}, n) testSigners = make(map[string]ssh.Signer, n) testPublicKeys = make(map[string]ssh.PublicKey, n) for t, k := range testdata.PEMBytes { testPrivateKeys[t], err = ssh.ParseRawPrivateKey(k) if err != nil { panic(fmt.Sprintf("Unable to parse test key %s: %v", t, err)) } testSigners[t], err = ssh.NewSignerFromKey(testPrivateKeys[t]) if err != nil { panic(fmt.Sprintf("Unable to create signer for test key %s: %v", t, err)) } testPublicKeys[t] = testSigners[t].PublicKey() } // Create a cert and sign it for use in tests. testCert := &ssh.Certificate{ Nonce: []byte{}, // To pass reflect.DeepEqual after marshal & parse, this must be non-nil ValidPrincipals: []string{"gopher1", "gopher2"}, // increases test coverage ValidAfter: 0, // unix epoch ValidBefore: ssh.CertTimeInfinity, // The end of currently representable time. Reserved: []byte{}, // To pass reflect.DeepEqual after marshal & parse, this must be non-nil Key: testPublicKeys["ecdsa"], SignatureKey: testPublicKeys["rsa"], Permissions: ssh.Permissions{ CriticalOptions: map[string]string{}, Extensions: map[string]string{}, }, } testCert.SignCert(rand.Reader, testSigners["rsa"]) testPrivateKeys["cert"] = testPrivateKeys["ecdsa"] testSigners["cert"], err = ssh.NewCertSigner(testCert, testSigners["ecdsa"]) if err != nil { panic(fmt.Sprintf("Unable to create certificate signer: %v", err)) } }	2.17 KB	2025-05-25 12:27

Terminal