Peter Moody
7d5b0be716
The ssh-agent protocol allows the usage of keys and certs added to a given agent to be constrained in certain ways. The only constraints currently supported are lifetime (keys expire after some number of seconds) and confirmation (the agent requires user confirmation before performing any operations with the private key). Change-Id: Idba5760db929805bf3da43fdcaca53ae6c479ca4 Reviewed-on: https://go-review.googlesource.com/12260 Reviewed-by: Adam Langley <agl@golang.org> Run-TryBot: Adam Langley <agl@golang.org> Reviewed-by: Peter Moody <pmoody@uber.com>
60 lines
1.5 KiB
Go
60 lines
1.5 KiB
Go
// Copyright 2014 The Go Authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style
|
|
// license that can be found in the LICENSE file.
|
|
|
|
// +build darwin dragonfly freebsd linux netbsd openbsd
|
|
|
|
package test
|
|
|
|
import (
|
|
"bytes"
|
|
"testing"
|
|
|
|
"golang.org/x/crypto/ssh"
|
|
"golang.org/x/crypto/ssh/agent"
|
|
)
|
|
|
|
func TestAgentForward(t *testing.T) {
|
|
server := newServer(t)
|
|
defer server.Shutdown()
|
|
conn := server.Dial(clientConfig())
|
|
defer conn.Close()
|
|
|
|
keyring := agent.NewKeyring()
|
|
if err := keyring.Add(agent.AddedKey{PrivateKey: testPrivateKeys["dsa"]}); err != nil {
|
|
t.Fatalf("Error adding key: %s", err)
|
|
}
|
|
if err := keyring.Add(agent.AddedKey{
|
|
PrivateKey: testPrivateKeys["dsa"],
|
|
ConfirmBeforeUse: true,
|
|
LifetimeSecs: 3600,
|
|
}); err != nil {
|
|
t.Fatalf("Error adding key with constraints: %s", err)
|
|
}
|
|
pub := testPublicKeys["dsa"]
|
|
|
|
sess, err := conn.NewSession()
|
|
if err != nil {
|
|
t.Fatalf("NewSession: %v", err)
|
|
}
|
|
if err := agent.RequestAgentForwarding(sess); err != nil {
|
|
t.Fatalf("RequestAgentForwarding: %v", err)
|
|
}
|
|
|
|
if err := agent.ForwardToAgent(conn, keyring); err != nil {
|
|
t.Fatalf("SetupForwardKeyring: %v", err)
|
|
}
|
|
out, err := sess.CombinedOutput("ssh-add -L")
|
|
if err != nil {
|
|
t.Fatalf("running ssh-add: %v, out %s", err, out)
|
|
}
|
|
key, _, _, _, err := ssh.ParseAuthorizedKey(out)
|
|
if err != nil {
|
|
t.Fatalf("ParseAuthorizedKey(%q): %v", out, err)
|
|
}
|
|
|
|
if !bytes.Equal(key.Marshal(), pub.Marshal()) {
|
|
t.Fatalf("got key %s, want %s", ssh.MarshalAuthorizedKey(key), ssh.MarshalAuthorizedKey(pub))
|
|
}
|
|
}
|