aboutsummaryrefslogtreecommitdiff
path: root/ssh/agent/client.go
AgeCommit message (Collapse)Author
2025-09-09ssh/agent: return an error for unexpected message typesNicola Murino
Previously, receiving an unexpected message type in response to a key listing or a signing request could cause a panic due to a failed type assertion. This change adds a default case to the type switch in order to detect and explicitly handle unknown or invalid message types, returning a descriptive error instead of crashing. Fixes golang/go#75178 Change-Id: Icbc3432adc79fe3c56b1ff23c6724d7a6f710f3a Reviewed-on: https://go-review.googlesource.com/c/crypto/+/700295 Reviewed-by: Roland Shoemaker <roland@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Michael Pratt <mpratt@google.com> Reviewed-by: Jakub Ciolek <jakub@ciolek.dev>
2025-05-15ssh: export supported algorithmsNicola Murino
Fixes golang/go#61537 Change-Id: If3478121e3ae445391e3faeceeb889d75e9e3214 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/531935 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Nicola Murino <nicola.murino@gmail.com> Reviewed-by: Cherry Mui <cherryyz@google.com> Reviewed-by: Michael Knyszek <mknyszek@google.com> Reviewed-by: Filippo Valsorda <filippo@golang.org>
2024-06-26all: bump go.mod version and drop compatibility shimsFilippo Valsorda
Also, remove the legacy import annotations. Fixes golang/go#68147 Change-Id: Ibfcc9322f27224c0ba92ea42cd56912a7d8783fd Reviewed-on: https://go-review.googlesource.com/c/crypto/+/594256 Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Auto-Submit: Filippo Valsorda <filippo@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Roland Shoemaker <roland@golang.org>
2023-10-11ssh: add support for SSH_AGENT_CONSTRAIN_EXTENSION with id 255Nicola Murino
it was changed in the following draft https://datatracker.ietf.org/doc/html/draft-miller-ssh-agent-03 The id 3 is now used for SSH_AGENT_CONSTRAIN_MAXSIGN key constraint, an OpenSSH extension to the protocol that we do not currently support. Instead, we added a compatibility layer for SSH_AGENT_CONSTRAIN_EXTENSION with ID 3. Fixes golang/go#62311 Change-Id: I421aee92aee9e693e43f66e6a5515c055333cb9b Reviewed-on: https://go-review.googlesource.com/c/crypto/+/525355 Reviewed-by: Matthew Dempsky <mdempsky@google.com> Run-TryBot: Nicola Murino <nicola.murino@gmail.com> Reviewed-by: Filippo Valsorda <filippo@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Than McIntosh <thanm@google.com>
2023-09-27all: use crypto/ed25519 instead of golang.org/x/crypto/ed25519Sebastiaan van Stijn
This is a follow-up to CL 317169, which dropped go1.12 compatibility, and made the golang.org/x/crypto/ed25519 package an alias / wrapper for crypto/ed25519 in stdlib. This patch updates uses within this repository to use stdlib instead of depending on the wrapper. With this patch applied, the only remaining use of the wrapper is in ed25519_test, which appears to be in place to verify compatibility of the wrapper itself. Change-Id: I0195396102a75ae20bdd82ca8ab59855c0eb5cea GitHub-Last-Rev: 24dbec563cbd84bc47bdc7736b0245fc83dd3353 GitHub-Pull-Request: golang/crypto#238 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/448238 Reviewed-by: Bryan Mills <bcmills@google.com> Run-TryBot: Nicola Murino <nicola.murino@gmail.com> Reviewed-by: Nicola Murino <nicola.murino@gmail.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Joedian Reid <joedian@golang.org> Reviewed-by: Roland Shoemaker <roland@golang.org> Reviewed-by: Than McIntosh <thanm@google.com>
2022-10-12all: use automatic RFC linkingAxel Wagner
pkgsite automatically links /RFC \d+/ to the mentioned RFC. Insert a bunch of spaces into doc-comments for that to match. Change-Id: I01834d7573428563f21c37e43316442e148dd8c4 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/442055 Reviewed-by: Joedian Reid <joedian@golang.org> Run-TryBot: Ian Lance Taylor <iant@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Ian Lance Taylor <iant@google.com> Auto-Submit: Ian Lance Taylor <iant@google.com>
2022-10-05all: replace bytes.Compare with bytes.Equalcui fliter
Change-Id: I911366b91ff2a1d02d7de202a166d876fb873142 GitHub-Last-Rev: f50e00376856fb9da36bb98ed0cdfd96c2f3b304 GitHub-Pull-Request: golang/crypto#233 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/438536 TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Reviewed-by: Ian Lance Taylor <iant@google.com> Run-TryBot: Ian Lance Taylor <iant@google.com> Auto-Submit: Ian Lance Taylor <iant@google.com>
2022-08-26ssh/agent: match OpenSSH extensionAgentMsg, not IETF draftedef
The OpenSSH wire format just suffixes the raw extension body, without a nested string. Fixes golang/go#51689 Change-Id: Ic224cedb934ba0563abca9a45a6be1c67769ed6d Reviewed-on: https://go-review.googlesource.com/c/crypto/+/412154 Reviewed-by: Roland Shoemaker <roland@golang.org> Run-TryBot: Filippo Valsorda <filippo@golang.org> Run-TryBot: hopehook <hopehook@qq.com> Reviewed-by: Daniel Lublin <daniel@lublin.se> Auto-Submit: Filippo Valsorda <filippo@golang.org> Reviewed-by: Filippo Valsorda <filippo@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: David Chase <drchase@google.com>
2022-05-13ssh/agent: fix non-RSA certificatesFilippo Valsorda
The type of ssh.PublicKey.Type can be a certificate type, while the algorithm passed to SignWithAlgorithm is going to be an underlying algorithm. Fixes golang/go#52185 Change-Id: I0f7c46defa83d1fd64a3c1e861734650b20cca21 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/404614 TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Heschi Kreinick <heschi@google.com> Reviewed-by: Roland Shoemaker <roland@golang.org> Auto-Submit: Filippo Valsorda <filippo@golang.org> Run-TryBot: Filippo Valsorda <filippo@golang.org>
2022-04-11all: gofmtRuss Cox
Gofmt to update doc comments to the new formatting. For golang/go#51082. Change-Id: I076031b6613691eefbb0f21739366e3fd2011ec9 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/399356 Run-TryBot: Russ Cox <rsc@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Auto-Submit: Russ Cox <rsc@golang.org> Reviewed-by: Ian Lance Taylor <iant@google.com>
2022-03-14ssh: support rsa-sha2-256/512 for client authenticationFilippo Valsorda
CL 220037 had implemented support for host authentication using rsa-sha2-256/512, but not client public key authentication. OpenSSH disabled the SHA-1 based ssh-rsa by default in version 8.8 (after pre-announcing it in versions 8.2, 8.3, 8.4, 8.5, 8.6, and 8.7) although some distributions re-enable it. GitHub will start rejecting ssh-rsa for keys uploaded before November 2, 2021 on March 15, 2022. https://github.blog/2021-09-01-improving-git-protocol-security-github/ The server side already worked, as long as the client selected one of the SHA-2 algorithms, because the signature flowed freely to Verify. There was however nothing verifying that the signature algorithm matched the advertised one. The comment suggested the check was being performed, but it got lost back in CL 86190043. Not a security issue because the signature had to pass the callback's Verify method regardless, and both values were checked to be acceptable. Tested with OpenSSH 8.8 configured with "PubkeyAcceptedKeyTypes -ssh-rsa" and no application-side changes. The Signers returned by ssh/agent (when backed by an agent client) didn't actually implement AlgorithmSigner but ParameterizedSigner, an interface defined in an earlier version of CL 123955. Updates golang/go#49269 Fixes golang/go#39885 For golang/go#49952 Change-Id: I13b41db8041f1112a70f106c55f077b904b12cb8 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/392394 Trust: Filippo Valsorda <filippo@golang.org> Run-TryBot: Filippo Valsorda <filippo@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Roland Shoemaker <roland@golang.org>
2020-04-06ssh/agent: handle ed25519.PrivateKey by value in AddedKeyAlex Gaynor
Also document that ed25519 is supported. Change-Id: Ibc4f44069eae4ff1aad27f22fc651a2f7611679d GitHub-Last-Rev: ee2ce0ae9900b11e1fa891e3587b111168f708c9 GitHub-Pull-Request: golang/crypto#119 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/219506 Reviewed-by: Filippo Valsorda <filippo@golang.org> Run-TryBot: Filippo Valsorda <filippo@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
2018-10-30ssh/agent: Fix error returned from agent responses that are too big.Ian Haken
Make sure a meaningful error is returned when the SSH agent client receives a response that is too big. Change-Id: Ied68b2c559a61dede2f3112c4c8143babd385f48 GitHub-Last-Rev: ad65e1b423bb00f2501dfde84040469aef4ee2df GitHub-Pull-Request: golang/crypto#61 Reviewed-on: https://go-review.googlesource.com/c/143058 Reviewed-by: Han-Wen Nienhuys <hanwen@google.com> Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
2018-10-29ssh: support SSH agent signature flags and custom extensionsIan Haken
This commit implements two new features. To preserve backwards compatibility the new methods are added to an `ExtendedAgent` interface which extends `Agent`. The client code implements `ExtendedAgent` (which extends Agent) so you can call these additional methods against SSH agents such as the OpenSSH agent. The ServeAgent method still accepts Agent but will attempt to upcast the agent to `ExtendedAgent` as needed, so if you supply an ExtendedAgent implementation you can implement these additional methods (which keyring does). The first feature is supporting the standard flags that can be passed to SSH Sign requests, requesting that RSA signatures use SHA-256 or SHA-512. See section 4.5.1 of the SSH agent protocol draft: https://tools.ietf.org/html/draft-miller-ssh-agent-02 The second feature is supporting calling custom extensions from clients and implementing custom extensions from servers. See section 4.7 of the SSH agent protocol draft: https://tools.ietf.org/html/draft-miller-ssh-agent-02 Change-Id: I0f74feb893762c27e921ec37604d3a46434ee6ef GitHub-Last-Rev: 2e23fd01c0e95b664e8507682f0bd5bd61d4c146 GitHub-Pull-Request: golang/crypto#53 Reviewed-on: https://go-review.googlesource.com/c/123955 Reviewed-by: Han-Wen Nienhuys <hanwen@google.com> Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
2018-04-23ssh/agent: update documentation linkAgniva De Sarker
Fixes golang/go#24982 Change-Id: I81c646b92230bdcbc7f08de535dd657e86bb03ce Reviewed-on: https://go-review.googlesource.com/108775 Reviewed-by: Han-Wen Nienhuys <hanwen@google.com> Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
2017-11-28all: fix errors reported by vet, golintKevin Burke
None are "wrong" per se, but there are a lot of good suggestions and in one case a docstring that was not present in godoc due to the presence of an extra newline. Changed "Id" in struct properties to "ID" in some non-exported structs. Removed a trailing period from some error messages; I believe the exact contents of error strings are not covered by the Go compatibility promise. Change-Id: I7c620582dc247396f72c52d38c909ccc0ec87b83 Reviewed-on: https://go-review.googlesource.com/80145 Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2017-07-26ssh/agent: parse constraints when adding keysGh0u1L5
Change-Id: I264fc3e3e441d6e5ff7c5aa624eee1018cf9e4de Reviewed-on: https://go-review.googlesource.com/50811 Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Han-Wen Nienhuys <hanwen@google.com>
2016-06-24agent: add agent server support for ed25519 keys.Peter Moody
the client library already supports them. Fixes golang/go#16096 Change-Id: Iaa117ee31f706301e8b24c2775f5a604ef005440 Reviewed-on: https://go-review.googlesource.com/24285 Reviewed-by: Adam Langley <agl@golang.org>
2016-06-12crypto/ssh: minor comment change (trivial)Dmitry Savintsev
Fixed a function comment. Change-Id: I1185c0c849abbb8244c6282fa6036fa6939c3309 Reviewed-on: https://go-review.googlesource.com/23971 Reviewed-by: Han-Wen Nienhuys <hanwen@google.com> Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
2016-06-06x/crypto/ssh: set constraints when adding certs to the agentNiall Sheridan
Fixes golang/go#15953 Change-Id: Ia36b5422bef14609d512c3f5055a3bffad18ce0f Reviewed-on: https://go-review.googlesource.com/23752 Reviewed-by: Han-Wen Nienhuys <hanwen@google.com> Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
2016-05-18ssh: allow adding ed25519 keys to the agentNiall Sheridan
Fixes golang/go#15701 Change-Id: I561701e38b9d434ef44448bdbcfab203f3c31d99 Reviewed-on: https://go-review.googlesource.com/23141 Reviewed-by: Han-Wen Nienhuys <hanwen@google.com> Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
2016-05-12x/crypto/ssh: add support for ed25519 keysMartin Garton
Added support for parsing the "new" openssh private key format. (ed25519 keys only in this format for now) Signing and verifying functions now work with ed25519 keys. ed25519 can now be accepted by the server to authenticate a client. ed25519 can now be accepted by a client as a server host key. Related documentation used: https://www.ietf.org/archive/id/draft-bjh21-ssh-ed25519-02.txt Change-Id: I84385f24d666fea08de21f980f78623f7bff8007 Reviewed-on: https://go-review.googlesource.com/22512 Reviewed-by: Han-Wen Nienhuys <hanwen@google.com> Run-TryBot: Han-Wen Nienhuys <hanwen@google.com>
2016-04-25x/crypto/ssh: support more keytypes in the agent.Peter Moody
This allows the golang ssh-agent to support the full suite of keys the library accepts. Currently constraints are ignored. Change-Id: I7d48c78e9a355582eb54788571a483a736c3d3ef Reviewed-on: https://go-review.googlesource.com/21536 Reviewed-by: Han-Wen Nienhuys <hanwen@google.com> Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
2016-04-20x/crypto/ssh/agent: Support v1 remove all messageMark Severson
Some ssh-agent clients expect the server to support remove all messages for protocols 1 & 2 and error if protocol 1 support is missing. This adds a null-op implementation of the remove all message in similar fashion to the existing list all message support. Fixes golang/go#15159 Change-Id: I9389885d89c9147f3e10850893bba6ed7d0a4e82 Reviewed-on: https://go-review.googlesource.com/21468 Reviewed-by: Han-Wen Nienhuys <hanwen@google.com> Run-TryBot: Han-Wen Nienhuys <hanwen@google.com>
2016-02-26x/crypto/ssh/agent: add a client example and tweak package doc.Han-Wen Nienhuys
Change-Id: I373fdbb6351d71b12fcfed31cf4b08975a443294 Reviewed-on: https://go-review.googlesource.com/19894 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Reviewed-by: Adam Langley <agl@golang.org> Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
2015-07-16crypto/ssh: allow identities to be constrained.Peter Moody
The ssh-agent protocol allows the usage of keys and certs added to a given agent to be constrained in certain ways. The only constraints currently supported are lifetime (keys expire after some number of seconds) and confirmation (the agent requires user confirmation before performing any operations with the private key). Change-Id: Idba5760db929805bf3da43fdcaca53ae6c479ca4 Reviewed-on: https://go-review.googlesource.com/12260 Reviewed-by: Adam Langley <agl@golang.org> Run-TryBot: Adam Langley <agl@golang.org> Reviewed-by: Peter Moody <pmoody@uber.com>
2015-07-14crypto/ssh: fix a comment (trivial)Dmitry Savintsev
Comment in Agent made to conform the godoc style. Change-Id: I4e1e8ce1a15ca346715fae257ae2178f5093d40d Reviewed-on: https://go-review.googlesource.com/12183 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2015-04-16crypto/ssh: fix the links to the SSH protocol documentsDmitry Savintsev
Minor change - updated the links to the ssh PROTOCOL.* docs. Currently the [PROTOCOL...] links in References on top of https://godoc.org/golang.org/x/crypto/ssh and https://godoc.org/golang.org/x/crypto/ssh/agent take you to the top-level directory list on http://cvsweb.openbsd.org/cgi-bin/cvsweb/ instead of directly to the respective document pages. Change-Id: Ifd3f0bc2ef393ab02f023c13b93340fdb0a05af3 Reviewed-on: https://go-review.googlesource.com/8963 Reviewed-by: Adam Langley <agl@golang.org>
2014-12-09crypto: add import comments.David Symonds
Change-Id: I33240faf1b8620d0cd600de661928d8e422ebdbc Reviewed-on: https://go-review.googlesource.com/1235 Reviewed-by: Andrew Gerrand <adg@golang.org>
2014-11-10go.crypto: use golang.org/x/... import pathsAndrew Gerrand
LGTM=bradfitz R=rsc, bradfitz CC=golang-codereviews https://golang.org/cl/167190043
2014-04-15go.crypto/ssh/agent: prefix errors with "agent".Han-Wen Nienhuys
R=agl, dave, jpsugar CC=golang-codereviews https://golang.org/cl/87810047
2014-04-09go.crypto/ssh: import gosshnew.Adam Langley
See https://groups.google.com/d/msg/Golang-nuts/AoVxQ4bB5XQ/i8kpMxdbVlEJ R=hanwen CC=golang-codereviews https://golang.org/cl/86190043
generated by cgit v1.3 (git 2.53.0) at 2026-04-15 10:14:59 +0000