Skip to content

Commit

Permalink
ssh: add support for SSH_AGENT_CONSTRAIN_EXTENSION with id 255
Browse files Browse the repository at this point in the history
it was changed in the following draft

https://datatracker.ietf.org/doc/html/draft-miller-ssh-agent-03

The id 3 is now used for SSH_AGENT_CONSTRAIN_MAXSIGN key constraint,
an OpenSSH extension to the protocol that we do not currently support.
Instead, we added a compatibility layer for
SSH_AGENT_CONSTRAIN_EXTENSION with ID 3.

Fixes golang/go#62311

Change-Id: I421aee92aee9e693e43f66e6a5515c055333cb9b
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/525355
Reviewed-by: Matthew Dempsky <[email protected]>
Run-TryBot: Nicola Murino <[email protected]>
Reviewed-by: Filippo Valsorda <[email protected]>
TryBot-Result: Gopher Robot <[email protected]>
Reviewed-by: Than McIntosh <[email protected]>
  • Loading branch information
drakkan authored and FiloSottile committed Oct 11, 2023
1 parent e3cc52e commit 2aeefc3
Show file tree
Hide file tree
Showing 3 changed files with 15 additions and 6 deletions.
13 changes: 9 additions & 4 deletions ssh/agent/client.go
Original file line number Diff line number Diff line change
Expand Up @@ -141,9 +141,14 @@ const (
agentAddSmartcardKeyConstrained = 26

// 3.7 Key constraint identifiers
agentConstrainLifetime = 1
agentConstrainConfirm = 2
agentConstrainExtension = 3
agentConstrainLifetime = 1
agentConstrainConfirm = 2
// Constraint extension identifier up to version 2 of the protocol. A
// backward incompatible change will be required if we want to add support
// for SSH_AGENT_CONSTRAIN_MAXSIGN which uses the same ID.
agentConstrainExtensionV00 = 3
// Constraint extension identifier in version 3 and later of the protocol.
agentConstrainExtension = 255
)

// maxAgentResponseBytes is the maximum agent reply size that is accepted. This
Expand Down Expand Up @@ -205,7 +210,7 @@ type constrainLifetimeAgentMsg struct {
}

type constrainExtensionAgentMsg struct {
ExtensionName string `sshtype:"3"`
ExtensionName string `sshtype:"255|3"`
ExtensionDetails []byte

// Rest is a field used for parsing, not part of message
Expand Down
2 changes: 1 addition & 1 deletion ssh/agent/server.go
Original file line number Diff line number Diff line change
Expand Up @@ -208,7 +208,7 @@ func parseConstraints(constraints []byte) (lifetimeSecs uint32, confirmBeforeUse
case agentConstrainConfirm:
confirmBeforeUse = true
constraints = constraints[1:]
case agentConstrainExtension:
case agentConstrainExtension, agentConstrainExtensionV00:
var msg constrainExtensionAgentMsg
if err = ssh.Unmarshal(constraints, &msg); err != nil {
return 0, false, nil, err
Expand Down
6 changes: 5 additions & 1 deletion ssh/agent/server_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -243,7 +243,11 @@ func TestParseConstraints(t *testing.T) {
ExtensionDetails: []byte(fmt.Sprintf("details: %d", i)),
}
expect = append(expect, ext)
data = append(data, agentConstrainExtension)
if i%2 == 0 {
data = append(data, agentConstrainExtension)
} else {
data = append(data, agentConstrainExtensionV00)
}
data = append(data, ssh.Marshal(ext)...)
}
_, _, extensions, err := parseConstraints(data)
Expand Down

0 comments on commit 2aeefc3

Please sign in to comment.