Add support for SSH certs

Cargo.toml

@@ -27,9 +27,10 @@ tokio = { version = "1", optional = true, features = ["rt", "net"] }
 tokio-util = { version = "0.7.1", optional = true, features = ["codec"] }
 service-binding = { version = "^2" }
 ssh-encoding = { version = "0.2.0" }
-ssh-key = { version = "0.6.4", features = ["rsa", "alloc"] }
+ssh-key = { version = "0.6.6", features = ["rsa", "alloc"] }
 thiserror = "1.0.58"
 #uuid = { version = "1.8.0", features = ["v4"] }
+subtle = { version = "2", default-features = false }
 
 [features]
 default = ["agent"]
@@ -47,7 +48,7 @@ tokio = { version = "1", features = ["macros", "rt-multi-thread"] }
 sha1 = { version = "0.10.5", default-features = false, features = ["oid"] }
 testresult = "0.4.0"
 hex-literal = "0.4.1"
-ssh-key = { version = "0.6.4", features = ["p256"] }
+ssh-key = { version = "0.6.6", features = ["p256"] }
 p256 = { version = "0.13.2" }
 const-str = "0.5.7"
 rstest = "0.18.2"

examples/key_storage.rs

@@ -11,8 +11,8 @@ use sha1::Sha1;
 #[cfg(windows)]
 use ssh_agent_lib::agent::NamedPipeListener as Listener;
 use ssh_agent_lib::agent::{Agent, Session};
-use ssh_agent_lib::proto::extension::SessionBind;
-use ssh_agent_lib::proto::message::{self, Message, SignRequest};
+use ssh_agent_lib::proto::extension::{RestrictDestination, SessionBind};
+use ssh_agent_lib::proto::message::{self, Credential, Message, SignRequest};
 use ssh_agent_lib::proto::{signature, AddIdentityConstrained, KeyConstraint};
 use ssh_key::{
     private::{KeypairData, PrivateKey},
@@ -126,34 +126,39 @@ impl KeyStorage {
                 Ok(Message::Success)
             }
             Message::AddIdentity(identity) => {
-                let privkey = PrivateKey::try_from(identity.privkey).unwrap();
-                self.identity_add(Identity {
-                    pubkey: PublicKey::from(&privkey),
-                    privkey,
-                    comment: identity.comment,
-                });
+                if let Credential::Key { privkey, comment } = identity.credential {
+                    let privkey = PrivateKey::try_from(privkey).unwrap();
+                    self.identity_add(Identity {
+                        pubkey: PublicKey::from(&privkey),
+                        privkey,
+                        comment,
+                    });
+                }
                 Ok(Message::Success)
             }
             Message::AddIdConstrained(AddIdentityConstrained {
                 identity,
                 constraints,
             }) => {
-                eprintln!("Would use these constraints: {constraints:#?}");
+                eprintln!("Adding identity {identity:#?} with constraints {constraints:#?}");
                 for constraint in constraints {
                     if let KeyConstraint::Extension(name, mut details) = constraint {
                         if name == "[email protected]" {
-                            if let Ok(destination_constraint) = details.parse::<SessionBind>() {
-                                eprintln!("Destination constraint: {destination_constraint:?}");
-                            }
+                            let destination_constraint = details
+                                .parse::<RestrictDestination>()
+                                .expect("to parse destination constraint");
+                            eprintln!("Destination constraint: {destination_constraint:?}");
                         }
                     }
                 }
-                let privkey = PrivateKey::try_from(identity.privkey).unwrap();
-                self.identity_add(Identity {
-                    pubkey: PublicKey::from(&privkey),
-                    privkey,
-                    comment: identity.comment,
-                });
+                if let Credential::Key { privkey, comment } = identity.credential {
+                    let privkey = PrivateKey::try_from(privkey).unwrap();
+                    self.identity_add(Identity {
+                        pubkey: PublicKey::from(&privkey),
+                        privkey,
+                        comment,
+                    });
+                }
                 Ok(Message::Success)
             }
             Message::SignRequest(request) => {

src/proto.rs

@@ -1,10 +1,12 @@
 pub mod error;
 pub mod extension;
 pub mod message;
+pub mod privatekey;
 pub mod signature;
 
 pub use self::error::*;
 pub use self::message::*;
+pub use self::privatekey::*;
 pub use self::signature::*;
 
 pub type MpInt = Vec<u8>;

src/proto/extension.rs

@@ -205,6 +205,16 @@ mod tests {
             [0, 0, 0, 0], // reserved, not in the spec, authfd.c:495
         );
 
+        let destination_constraint = RestrictDestination::decode(&mut buffer)?;
+        eprintln!("Destination constraint: {destination_constraint:?}");
+
+        let mut buffer: &[u8] = &[
+            0, 0, 0, 102, 0, 0, 0, 12, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 78, 0, 0, 0, 0,
+            0, 0, 0, 10, 103, 105, 116, 104, 117, 98, 46, 99, 111, 109, 0, 0, 0, 0, 0, 0, 0, 51, 0,
+            0, 0, 11, 115, 115, 104, 45, 101, 100, 50, 53, 53, 49, 57, 0, 0, 0, 32, 227, 42, 170,
+            121, 21, 206, 185, 180, 73, 209, 186, 80, 234, 42, 40, 187, 26, 110, 1, 249, 11, 218,
+            36, 90, 45, 29, 135, 105, 125, 24, 162, 101, 0, 0, 0, 0, 0,
+        ];
         let destination_constraint = RestrictDestination::decode(&mut buffer)?;
         eprintln!("Destination constraint: {destination_constraint:?}");
         Ok(())