aboutsummaryrefslogtreecommitdiff
path: root/ssh/agent/client_test.go
AgeCommit message (Collapse)Author
2025-12-02ssh/agent: fix flaky test by ensuring a writeable home directoryMichael Stapelberg
This fixes flakiness observed inside Google (b/465393996). Change-Id: Ic3decc3206b470cddf22c441b0cf92bb2bebb075 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/724002 Reviewed-by: Roland Shoemaker <roland@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2025-09-09ssh/agent: return an error for unexpected message typesNicola Murino
Previously, receiving an unexpected message type in response to a key listing or a signing request could cause a panic due to a failed type assertion. This change adds a default case to the type switch in order to detect and explicitly handle unknown or invalid message types, returning a descriptive error instead of crashing. Fixes golang/go#75178 Change-Id: Icbc3432adc79fe3c56b1ff23c6724d7a6f710f3a Reviewed-on: https://go-review.googlesource.com/c/crypto/+/700295 Reviewed-by: Roland Shoemaker <roland@golang.org> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Michael Pratt <mpratt@google.com> Reviewed-by: Jakub Ciolek <jakub@ciolek.dev>
2024-07-22ssh: don't use dsa keys in integration testsNicola Murino
DSA has been disabled by default since OpenSSH 9.8, so tests fail with newer versions of OpenSSH Change-Id: I57b9abde8845cd05116a637a21cbbb8af740b2e0 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/599955 Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Auto-Submit: Nicola Murino <nicola.murino@gmail.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Roland Shoemaker <roland@golang.org>
2024-02-14ssh/test: don't use DSA keys in integrations tests, update test RSA keyNicola Murino
on RHEL 9 OpenSSH does not support DSA keys and RSA keys with size less than 2048 bits, furthermore signing with ssh-rsa (SHA-1 signatures) and ssh-dss is not allowed, therefore: 1) replaced the 1024-bit RSA key used in the test with a new 2048-bit one 2) removed DSA key from itegration tests 3) allowed signature errors using ssh-rsa in agent integration tests, we also check SHA-2 variants that are not skipped Fixes golang/go#65581 Change-Id: I54bf997b61ef4d91d38eb624275737ba7291bb20 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/562755 Reviewed-by: Roland Shoemaker <roland@golang.org> Reviewed-by: David Chase <drchase@google.com> Reviewed-by: Filippo Valsorda <filippo@golang.org> Auto-Submit: Nicola Murino <nicola.murino@gmail.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
2023-07-31ssh: fix call to Fatalf from a non-test goroutineNicola Murino
Also fix some redundant type declarations. Change-Id: Iad2950b67b1ec2e2590c59393b8ad15421ed3add GitHub-Last-Rev: 41cf552f11387208491dee7b867050475043b25e GitHub-Pull-Request: golang/crypto#263 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/505798 Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> Reviewed-by: David Chase <drchase@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Auto-Submit: Dmitri Shuralyov <dmitshur@google.com> Reviewed-by: Filippo Valsorda <filippo@golang.org> Run-TryBot: Filippo Valsorda <filippo@golang.org>
2023-07-13ssh: disable client agent tests on WindowsNicola Murino
ssh-agent is implemented as a Windows service and exposed on a named pipe. We don't currently support it. See golang/go#60981 Change-Id: Iebdc42db30b37a87ac0766231b16aff3f17b3f56 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/509035 Run-TryBot: Heschi Kreinick <heschi@google.com> Reviewed-by: Cherry Mui <cherryyz@google.com> Reviewed-by: Heschi Kreinick <heschi@google.com> Auto-Submit: Heschi Kreinick <heschi@google.com> TryBot-Result: Gopher Robot <gobot@golang.org>
2022-03-14ssh: deprecate and replace SigAlgo constantsFilippo Valsorda
RFC 8332, Section 2 sets up two overlapping namespaces: public key formats and public key algorithms. * The formats are what we currently have KeyAlgo constants for, and they appear in PublicKey.Type. * The algorithms are the set of both KeyAlgo and SigAlgo constants, and they appear in Signature.Format (amongst other places). This is incoherent, because that means Signature.Format can be both a KeyAlgo (like KeyAlgoECDSA256) or a SigAlgo (like SigAlgoRSASHA2256). One solution would be to duplicate all the KeyAlgo constants into the SigAlgo namespace, but that would be confusing because applications are currently using KeyAlgos where they'd be supposed to use the new SigAlgos (while we can't deprecate the KeyAlgos because they are still necessary for the PublicKey.Type namespace). Instead, drop the separate namespaces, and use KeyAlgos throughout. There are simply some KeyAlgos that can't be a PublicKey.Type. Take the opportunity to fix the stuttering SHA22565/SHA2512 names. It's totally ok to call those hashes SHA-256 and SHA-512 without the family infix. For golang/go#49952 Change-Id: Ia1fce3912a7e60aa70a88f75ed311be331fd19d5 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/392354 Trust: Filippo Valsorda <filippo@golang.org> Run-TryBot: Filippo Valsorda <filippo@golang.org> Reviewed-by: Roland Shoemaker <roland@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org>
2022-01-26ssh/agent: fix TestMalformedRequestsRoland Shoemaker
Use a net.Pipe, rather than setting up a local TCP connection, for testing malformed SSH requests, since we don't need the complex intricacies of a real connection to test this protocol behavior. Fixes golang/go#50161 Change-Id: I5e46c42041ddd03b06725469216b82b801990e64 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/371874 Reviewed-by: Bryan Mills <bcmills@google.com> Trust: Roland Shoemaker <roland@golang.org> Run-TryBot: Roland Shoemaker <roland@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org>
2019-11-28ssh/agent: fix TestServerResponseTooLarge on Plan 9Fazlul Shahriar
First, modify the test to report a better error by waiting for the Marshal+Write goroutine to finish before returning from the test. If we return too early, a failure inside that goroutine can generate a panic. Second, we workaround plan9 not returning the actual number of bytes written on the connection in case of a hangup (due to closed connection). I've verified that syscall.Pwrite returns -1 on hangup in this particular case even when some data did get written. Fixes golang/go#35888 Change-Id: I7998cff926295f0d577b125c137021a9adc1be5a Reviewed-on: https://go-review.googlesource.com/c/crypto/+/209298 Reviewed-by: Han-Wen Nienhuys <hanwen@google.com> Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
2019-11-19ssh/agent: clear the environment when starting ssh-agent in client_testBryan C. Mills
Certain environment variables can influence the behavior of ssh-agent, causing the test to fail. Avoid that influence by using a consistent environment. This fixes a locally-observed test failure for me. Change-Id: I0f5e8d643199519f88e80825335ee8e6eb08e3af Reviewed-on: https://go-review.googlesource.com/c/crypto/+/207901 Run-TryBot: Bryan C. Mills <bcmills@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Han-Wen Nienhuys <hanwen@google.com>
2019-02-25ssh/agent: add checking for empty SSH requestsIan Haken
Previously empty SSH requests would cause a panic. Change-Id: I8443fee50891b3d2b3b62ac01fb0b9e96244241f GitHub-Last-Rev: 64f00d2bf2ee722f53e68b6bd4f70c722d7694bd GitHub-Pull-Request: golang/crypto#58 Reviewed-on: https://go-review.googlesource.com/c/140237 Reviewed-by: Han-Wen Nienhuys <hanwen@google.com> Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
2019-01-31all: fix ineffectual assignmentsMichael Cook
audited using ineffassign tool from github.com/gordonklaus/ineffassign go generate does not generate any changes Change-Id: Iabbec9ec1aae39081289d503d79fd7b4caadf17b GitHub-Last-Rev: acd17cce410e9c68ce3c87b5546261be9153e3ea GitHub-Pull-Request: golang/crypto#70 Reviewed-on: https://go-review.googlesource.com/c/155942 Reviewed-by: Filippo Valsorda <filippo@golang.org>
2018-10-30ssh/agent: Fix error returned from agent responses that are too big.Ian Haken
Make sure a meaningful error is returned when the SSH agent client receives a response that is too big. Change-Id: Ied68b2c559a61dede2f3112c4c8143babd385f48 GitHub-Last-Rev: ad65e1b423bb00f2501dfde84040469aef4ee2df GitHub-Pull-Request: golang/crypto#61 Reviewed-on: https://go-review.googlesource.com/c/143058 Reviewed-by: Han-Wen Nienhuys <hanwen@google.com> Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
2018-10-29ssh: support SSH agent signature flags and custom extensionsIan Haken
This commit implements two new features. To preserve backwards compatibility the new methods are added to an `ExtendedAgent` interface which extends `Agent`. The client code implements `ExtendedAgent` (which extends Agent) so you can call these additional methods against SSH agents such as the OpenSSH agent. The ServeAgent method still accepts Agent but will attempt to upcast the agent to `ExtendedAgent` as needed, so if you supply an ExtendedAgent implementation you can implement these additional methods (which keyring does). The first feature is supporting the standard flags that can be passed to SSH Sign requests, requesting that RSA signatures use SHA-256 or SHA-512. See section 4.5.1 of the SSH agent protocol draft: https://tools.ietf.org/html/draft-miller-ssh-agent-02 The second feature is supporting calling custom extensions from clients and implementing custom extensions from servers. See section 4.7 of the SSH agent protocol draft: https://tools.ietf.org/html/draft-miller-ssh-agent-02 Change-Id: I0f74feb893762c27e921ec37604d3a46434ee6ef GitHub-Last-Rev: 2e23fd01c0e95b664e8507682f0bd5bd61d4c146 GitHub-Pull-Request: golang/crypto#53 Reviewed-on: https://go-review.googlesource.com/c/123955 Reviewed-by: Han-Wen Nienhuys <hanwen@google.com> Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
2017-09-15all: fix article typosnamusyaka
a -> an Change-Id: I95a940df64cb825887b75a80eadc822095b49781 Reviewed-on: https://go-review.googlesource.com/63991 Run-TryBot: Alex Vaghin <ddos@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Alex Vaghin <ddos@google.com>
2017-08-08ssh/agent: use right message to unlock agent, with related integration testsGh0u1L5
Change-Id: Ie2e7618be63179fb65b8eea60684254712149a77 Reviewed-on: https://go-review.googlesource.com/50810 Reviewed-by: Han-Wen Nienhuys <hanwen@google.com> Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
2017-05-03crypto/ssh: fix tests on Go 1.7 on OpenBSD and WindowsBrad Fitzpatrick
Dialing the 0.0.0.0 address (as returned by net.Addr().String() for a net.Listen("tcp", ":1") address) is not yet guaranteed to work. It's currently OS-dependent. For some reason it works on Go 1.8+, but it hasn't yet been defined to work reliably. Fix the tests for now (since we need to support older Go releases), even if this might work in the future. Updates golang/go#18806 Change-Id: I2f0476b1d4f2673ab64ffedfa733f2d92fceb6ff Reviewed-on: https://go-review.googlesource.com/42496 Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Han-Wen Nienhuys <hanwen@google.com>
2017-03-30ssh: require host key checking in the ClientConfigHan-Wen Nienhuys
This change breaks existing behavior. Before, a missing ClientConfig.HostKeyCallback would cause host key checking to be disabled. In this configuration, establishing a connection to any host just works, so today, most SSH client code in the wild does not perform any host key checks. This makes it easy to perform a MITM attack: * SSH installations that use keyboard-interactive or password authentication can be attacked with MITM, thereby stealing passwords. * Clients that use public-key authentication with agent forwarding are also vulnerable: the MITM server could allow the login to succeed, and then immediately ask the agent to authenticate the login to the real server. * Clients that use public-key authentication without agent forwarding are harder to attack unnoticedly: an attacker cannot authenticate the login to the real server, so it cannot in general present a convincing server to the victim. Now, a missing HostKeyCallback will cause the handshake to fail. This change also provides InsecureIgnoreHostKey() and FixedHostKey(key) as ready made host checkers. A simplistic parser for OpenSSH's known_hosts file is given as an example. This change does not provide a full-fledged parser, as it has complexity (wildcards, revocation, hashed addresses) that will need further consideration. When introduced, the host checking feature maintained backward compatibility at the expense of security. We have decided this is not the right tradeoff for the SSH library. Fixes golang/go#19767 Change-Id: I45fc7ba9bd1ea29c31ec23f115cdbab99913e814 Reviewed-on: https://go-review.googlesource.com/38701 Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2017-02-06ssh/agent: fix another test to not require IPv4.Heschi Kreinick
Missed a copy/paste of netPipe in change 36110. Change-Id: I1a850dd9273d71fadc0519cf4cb2a2de6ecae4c2 Reviewed-on: https://go-review.googlesource.com/36259 Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Han-Wen Nienhuys <hanwen@google.com>
2016-09-22x/crypto/ssh/agent: honor constraints on keys in the keyring.Peter Moody
If a key is added to an agent keyring with constraints, honor them. This will remove keys when they've been on the keyring for LifetimeSecs seconds or longer and will ask the user to confirm a signing operation if ConfirmBeforeUse is set. Change-Id: I633713c5f78b13a628a5d752f11b306b6e16a2ef Reviewed-on: https://go-review.googlesource.com/28956 Reviewed-by: Han-Wen Nienhuys <hanwen@google.com> Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
2016-06-06x/crypto/ssh: set constraints when adding certs to the agentNiall Sheridan
Fixes golang/go#15953 Change-Id: Ia36b5422bef14609d512c3f5055a3bffad18ce0f Reviewed-on: https://go-review.googlesource.com/23752 Reviewed-by: Han-Wen Nienhuys <hanwen@google.com> Run-TryBot: Han-Wen Nienhuys <hanwen@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
2016-05-18ssh: allow adding ed25519 keys to the agentNiall Sheridan
Fixes golang/go#15701 Change-Id: I561701e38b9d434ef44448bdbcfab203f3c31d99 Reviewed-on: https://go-review.googlesource.com/23141 Reviewed-by: Han-Wen Nienhuys <hanwen@google.com> Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
2015-07-16crypto/ssh: allow identities to be constrained.Peter Moody
The ssh-agent protocol allows the usage of keys and certs added to a given agent to be constrained in certain ways. The only constraints currently supported are lifetime (keys expire after some number of seconds) and confirmation (the agent requires user confirmation before performing any operations with the private key). Change-Id: Idba5760db929805bf3da43fdcaca53ae6c479ca4 Reviewed-on: https://go-review.googlesource.com/12260 Reviewed-by: Adam Langley <agl@golang.org> Run-TryBot: Adam Langley <agl@golang.org> Reviewed-by: Peter Moody <pmoody@uber.com>
2014-11-10go.crypto: use golang.org/x/... import pathsAndrew Gerrand
LGTM=bradfitz R=rsc, bradfitz CC=golang-codereviews https://golang.org/cl/167190043
2014-08-13go.crypto/ssh: skip tests that start ssh-agent.Han-Wen Nienhuys
Also stops leaking /tmp/ directories. Fixes golang/go#8489. LGTM=dave, minux R=dave, minux, agl CC=golang-codereviews https://golang.org/cl/124010043
2014-04-15go.crypto/ssh/agent: add key type to testAgentInterface failure messages.Han-Wen Nienhuys
R=agl, dave, jpsugar CC=golang-codereviews https://golang.org/cl/88260043
2014-04-09go.crypto/ssh: import gosshnew.Adam Langley
See https://groups.google.com/d/msg/Golang-nuts/AoVxQ4bB5XQ/i8kpMxdbVlEJ R=hanwen CC=golang-codereviews https://golang.org/cl/86190043
generated by cgit v1.3 (git 2.53.0) at 2026-04-15 09:51:14 +0000