Merge pull request #85 from wiktor-k/wiktor/support-certs-everywhere

Add messages with certs

Author: wiktor-k

.justfile

@@ -83,7 +83,7 @@ fix:
     # try to fix rustc issues
     cargo fix --allow-staged
     # try to fix clippy issues
-    cargo clippy --fix --allow-staged
+    cargo clippy --fix --allow-staged --allow-dirty
 
     # fmt must be last as clippy's changes may break formatting
     cargo +nightly fmt --all

examples/agent-socket-info.rs

@@ -27,7 +27,7 @@ impl Session for AgentSocketInfo {
     async fn request_identities(&mut self) -> Result<Vec<Identity>, AgentError> {
         Ok(vec![Identity {
             // this is just a dummy key, the comment is important
-            pubkey: KeyData::Ed25519(ssh_key::public::Ed25519PublicKey([0; 32])),
+            pubkey: KeyData::Ed25519(ssh_key::public::Ed25519PublicKey([0; 32])).into(),
             comment: self.comment.clone(),
         }])
     }

examples/key-storage.rs

@@ -12,8 +12,8 @@ use ssh_agent_lib::agent::{listen, Session};
 use ssh_agent_lib::error::AgentError;
 use ssh_agent_lib::proto::extension::{QueryResponse, RestrictDestination, SessionBind};
 use ssh_agent_lib::proto::{
-    message, signature, AddIdentity, AddIdentityConstrained, AddSmartcardKeyConstrained,
-    Credential, Extension, KeyConstraint, RemoveIdentity, SignRequest, SmartcardKey,
+    message, signature, AddIdentity, AddIdentityConstrained, AddSmartcardKeyConstrained, Extension,
+    KeyConstraint, PrivateCredential, RemoveIdentity, SignRequest, SmartcardKey,
 };
 use ssh_key::{
     private::{KeypairData, PrivateKey},
@@ -74,7 +74,7 @@ impl KeyStorage {
 #[crate::async_trait]
 impl Session for KeyStorage {
     async fn sign(&mut self, sign_request: SignRequest) -> Result<Signature, AgentError> {
-        let pubkey: PublicKey = sign_request.pubkey.clone().into();
+        let pubkey: PublicKey = sign_request.pubkey.key_data().clone().into();
 
         if let Some(identity) = self.identity_from_pubkey(&pubkey) {
             match identity.privkey.key_data() {
@@ -122,15 +122,15 @@ impl Session for KeyStorage {
         let mut identities = vec![];
         for identity in self.identities.lock().unwrap().iter() {
             identities.push(message::Identity {
-                pubkey: identity.pubkey.key_data().clone(),
+                pubkey: identity.pubkey.key_data().clone().into(),
                 comment: identity.comment.clone(),
             })
         }
         Ok(identities)
     }
 
     async fn add_identity(&mut self, identity: AddIdentity) -> Result<(), AgentError> {
-        if let Credential::Key { privkey, comment } = identity.credential {
+        if let PrivateCredential::Key { privkey, comment } = identity.credential {
             let privkey = PrivateKey::try_from(privkey).map_err(AgentError::other)?;
             self.identity_add(Identity {
                 pubkey: PublicKey::from(&privkey),
@@ -161,7 +161,7 @@ impl Session for KeyStorage {
                     info!("Destination constraint: {destination:?}");
                 }
 
-                if let Credential::Key { privkey, comment } = identity.credential.clone() {
+                if let PrivateCredential::Key { privkey, comment } = identity.credential.clone() {
                     let privkey = PrivateKey::try_from(privkey).map_err(AgentError::other)?;
                     self.identity_add(Identity {
                         pubkey: PublicKey::from(&privkey),

examples/random-key.rs

@@ -10,7 +10,7 @@ use sha1::Sha1;
 use ssh_agent_lib::agent::NamedPipeListener as Listener;
 use ssh_agent_lib::agent::{listen, Session};
 use ssh_agent_lib::error::AgentError;
-use ssh_agent_lib::proto::{signature, Identity, SignRequest};
+use ssh_agent_lib::proto::{signature, Identity, PublicCredential, SignRequest};
 use ssh_key::private::RsaKeypair;
 use ssh_key::HashAlg;
 use ssh_key::{
@@ -41,7 +41,10 @@ impl RandomKey {
 impl Session for RandomKey {
     async fn sign(&mut self, sign_request: SignRequest) -> Result<Signature, AgentError> {
         let private_key = self.private_key.lock().unwrap();
-        if PublicKey::from(private_key.deref()).key_data() != &sign_request.pubkey {
+        let PublicCredential::Key(pubkey) = sign_request.pubkey else {
+            return Err(std::io::Error::other("Key not found").into());
+        };
+        if PublicKey::from(private_key.deref()).key_data() != &pubkey {
             return Err(std::io::Error::other("Key not found").into());
         }
 
@@ -85,7 +88,7 @@ impl Session for RandomKey {
     async fn request_identities(&mut self) -> Result<Vec<Identity>, AgentError> {
         let identity = self.private_key.lock().unwrap();
         Ok(vec![Identity {
-            pubkey: PublicKey::from(identity.deref()).into(),
+            pubkey: PublicCredential::Key(PublicKey::from(identity.deref()).into()),
             comment: identity.comment().into(),
         }])
     }

src/proto/message.rs

@@ -1,6 +1,7 @@
 //! Agent protocol message structures.
 
 mod add_remove;
+mod credential;
 mod extension;
 mod identity;
 mod request;
@@ -9,7 +10,8 @@ mod sign;
 mod unparsed;
 
 pub use self::{
-    add_remove::*, extension::*, identity::*, request::*, response::*, sign::*, unparsed::*,
+    add_remove::*, credential::*, extension::*, identity::*, request::*, response::*, sign::*,
+    unparsed::*,
 };
 #[doc(hidden)]
 /// For compatibility with pre-0.5.0 type alias in this module

src/proto/message/add_remove.rs

@@ -1,15 +1,14 @@
 //! Add a key to an agent with or without constraints and supporting data types.
 
 mod constrained;
-mod credential;
 
 pub use constrained::*;
-pub use credential::*;
 use secrecy::ExposeSecret as _;
 use secrecy::SecretString;
 use ssh_encoding::{self, CheckedSum, Decode, Encode, Reader, Writer};
 use ssh_key::public::KeyData;
 
+use super::PrivateCredential;
 use crate::proto::{Error, Result};
 
 /// Add a key to an agent.
@@ -20,14 +19,14 @@ use crate::proto::{Error, Result};
 #[derive(Clone, PartialEq, Debug)]
 pub struct AddIdentity {
     /// A credential (private & public key, or private key / certificate) to add to the agent
-    pub credential: Credential,
+    pub credential: PrivateCredential,
 }
 
 impl Decode for AddIdentity {
     type Error = Error;
 
     fn decode(reader: &mut impl Reader) -> Result<Self> {
-        let credential = Credential::decode(reader)?;
+        let credential = PrivateCredential::decode(reader)?;
 
         Ok(Self { credential })
     }

…c/proto/message/add_remove/credential.rs src/proto/message/credential.rssrc/proto/message/add_remove/credential.rs renamed to src/proto/message/credential.rs src/proto/message/add_remove/credential.rs renamed to src/proto/message/credential.rs

@@ -1,8 +1,9 @@
 //! A container for a public / private key pair, or a certificate / private key.
 
-use core::str::FromStr;
+use std::str::FromStr as _;
 
 use ssh_encoding::{self, CheckedSum, Decode, Encode, Reader, Writer};
+use ssh_key::public::KeyData;
 use ssh_key::{certificate::Certificate, private::KeypairData, Algorithm};
 
 use crate::proto::{Error, PrivateKeyData, Result};
@@ -16,7 +17,7 @@ use crate::proto::{Error, PrivateKeyData, Result};
 /// This structure covers both types of identities a user may
 /// send to an agent as part of a [`Request::AddIdentity`](crate::proto::Request::AddIdentity) message.
 #[derive(Clone, PartialEq, Debug)]
-pub enum Credential {
+pub enum PrivateCredential {
     /// A public/private key pair
     Key {
         /// Public/private key pair data
@@ -42,37 +43,39 @@ pub enum Credential {
     },
 }
 
-impl Decode for Credential {
+impl Decode for PrivateCredential {
     type Error = Error;
 
     fn decode(reader: &mut impl Reader) -> Result<Self> {
         let alg = String::decode(reader)?;
         let cert_alg = Algorithm::new_certificate(&alg);
 
         if let Ok(algorithm) = cert_alg {
-            let certificate = reader.read_prefixed(|reader| {
-                let cert = Certificate::decode(reader)?;
-                Ok::<_, Error>(cert)
-            })?;
+            let certificate = reader
+                .read_prefixed(|reader| {
+                    let cert = Certificate::decode(reader)?;
+                    Ok::<_, Error>(cert)
+                })?
+                .into();
             let privkey = PrivateKeyData::decode_as(reader, algorithm.clone())?;
             let comment = String::decode(reader)?;
 
-            Ok(Credential::Cert {
+            Ok(PrivateCredential::Cert {
                 algorithm,
-                certificate: Box::new(certificate),
+                certificate,
                 privkey,
                 comment,
             })
         } else {
             let algorithm = Algorithm::from_str(&alg).map_err(ssh_encoding::Error::from)?;
             let privkey = KeypairData::decode_as(reader, algorithm)?;
             let comment = String::decode(reader)?;
-            Ok(Credential::Key { privkey, comment })
+            Ok(PrivateCredential::Key { privkey, comment })
         }
     }
 }
 
-impl Encode for Credential {
+impl Encode for PrivateCredential {
     fn encoded_len(&self) -> ssh_encoding::Result<usize> {
         match self {
             Self::Key { privkey, comment } => {
@@ -113,3 +116,62 @@ impl Encode for Credential {
         }
     }
 }
+
+#[derive(Debug, PartialEq, Eq, Clone)]
+/// Represents a public credential.
+pub enum PublicCredential {
+    /// Plain public key.
+    Key(KeyData),
+    /// Signed public key.
+    Cert(Box<Certificate>),
+}
+
+impl PublicCredential {
+    /// Returns a reference to the [KeyData].
+    pub fn key_data(&self) -> &KeyData {
+        match self {
+            Self::Key(key) => key,
+            Self::Cert(cert) => cert.public_key(),
+        }
+    }
+}
+
+impl Decode for PublicCredential {
+    type Error = Error;
+
+    fn decode(reader: &mut impl Reader) -> core::result::Result<Self, Self::Error> {
+        // TODO: implement parsing certificates
+        Ok(Self::Key(KeyData::decode(reader)?))
+    }
+}
+
+impl Encode for PublicCredential {
+    fn encoded_len(&self) -> std::result::Result<usize, ssh_encoding::Error> {
+        match self {
+            Self::Key(pubkey) => pubkey.encoded_len(),
+            Self::Cert(certificate) => certificate.encoded_len(),
+        }
+    }
+
+    fn encode(
+        &self,
+        writer: &mut impl ssh_encoding::Writer,
+    ) -> std::result::Result<(), ssh_encoding::Error> {
+        match self {
+            Self::Key(pubkey) => pubkey.encode(writer),
+            Self::Cert(certificate) => certificate.encode(writer),
+        }
+    }
+}
+
+impl From<KeyData> for PublicCredential {
+    fn from(value: KeyData) -> Self {
+        Self::Key(value)
+    }
+}
+
+impl From<Certificate> for PublicCredential {
+    fn from(value: Certificate) -> Self {
+        Self::Cert(value.into())
+    }
+}

src/proto/message/identity.rs

@@ -1,8 +1,8 @@
 //! Data returned to the client when listing keys.
 
 use ssh_encoding::{self, CheckedSum, Decode, Encode, Reader, Writer};
-use ssh_key::public::KeyData;
 
+use super::PublicCredential;
 use crate::proto::{Error, Result};
 
 /// Data returned to the client when listing keys.
@@ -13,7 +13,7 @@ use crate::proto::{Error, Result};
 #[derive(Clone, PartialEq, Debug)]
 pub struct Identity {
     /// A standard public-key encoding of an underlying key.
-    pub pubkey: KeyData,
+    pub pubkey: PublicCredential,
 
     /// A human-readable comment
     pub comment: String,
@@ -36,7 +36,7 @@ impl Decode for Identity {
     type Error = Error;
 
     fn decode(reader: &mut impl Reader) -> Result<Self> {
-        let pubkey = reader.read_prefixed(KeyData::decode)?;
+        let pubkey = reader.read_prefixed(PublicCredential::decode)?;
         let comment = String::decode(reader)?;
 
         Ok(Self { pubkey, comment })

src/proto/message/sign.rs

@@ -1,8 +1,8 @@
 //! Signature request with data to be signed with a key in an agent.
 
 use ssh_encoding::{self, CheckedSum, Decode, Encode, Reader, Writer};
-use ssh_key::public::KeyData;
 
+use super::PublicCredential;
 use crate::proto::{Error, Result};
 
 /// Signature request with data to be signed with a key in an agent.
@@ -13,7 +13,7 @@ use crate::proto::{Error, Result};
 #[derive(Clone, PartialEq, Debug)]
 pub struct SignRequest {
     /// The public key portion of the [`Identity`](super::Identity) in the agent to sign the data with
-    pub pubkey: KeyData,
+    pub pubkey: PublicCredential,
 
     /// Binary data to be signed
     pub data: Vec<u8>,
@@ -27,7 +27,7 @@ impl Decode for SignRequest {
     type Error = Error;
 
     fn decode(reader: &mut impl Reader) -> Result<Self> {
-        let pubkey = reader.read_prefixed(KeyData::decode)?;
+        let pubkey = reader.read_prefixed(PublicCredential::decode)?;
         let data = Vec::decode(reader)?;
         let flags = u32::decode(reader)?;