Agent is unusable if any of the upstream agents responds with SSH certificates

[danielkza]

• Add an SSH certificate to my Mac's default ssh agent:

SSH_AUTH_SOCK=/private/tmp/com.apple.launchd.SEp6pPmbU2/Listeners ssh-add -l
256 SHA256:xxx xxx (ECDSA-CERT)

• Configure ssh-agent-mux with a trivial config of only one agent to mux:

listen_path = "/tmp/ssh-agent-mux-502.sock"
log_level = "info"
agent_sock_paths = [
  "/private/tmp/com.apple.launchd.SEp6pPmbU2/Listeners",
]

ssh-add -l no longer works:

SSH_AUTH_SOCK=/tmp/ssh-agent-mux-502.sock ssh-add -l
error fetching identities: incomplete message

Not much useful information in the logs:

$ RUST_LOG=trace ssh-agent-mux
INFO [ssh_agent_mux] Starting agent for 1 upstream agents; listening on </tmp/ssh-agent-mux-502.sock>
DEBUG [ssh_agent_mux] Upstream agent sockets: ["/private/tmp/com.apple.launchd.SEp6pPmbU2/Listeners"]
INFO [ssh_agent_lib::agent] Listening; socket = SelfDeletingUnixListener { path: "/tmp/ssh-agent-mux-502.sock", listener: PollEvented { io: Some(UnixListener { fd: FileDesc(OwnedFd { fd: 9 }), local: "/tmp/ssh-agent-mux-502.sock" (pathname) }) } }
DEBUG [ssh_agent_lib::agent] Request: RequestIdentities
TRACE [ssh_agent_mux] incoming: request_identities
DEBUG [ssh_agent_mux] Refreshing identities
TRACE [ssh_agent_mux] Connected to upstream agent on socket: /private/tmp/com.apple.launchd.SEp6pPmbU2/Listeners
TRACE [ssh_agent_mux] Got 1 identities from /private/tmp/com.apple.launchd.SEp6pPmbU2/Listeners
DEBUG [ssh_agent_lib::agent] Response: IdentitiesAnswer([Identity { pubkey: Other(OpaquePublicKey { algorithm: Other(AlgorithmName { id: "ecdsa-sha2-nistp256-cert-v01@openssh.com" }), key: OpaquePublicKeyBytes([redacted]) }), comment: "nistp256" }])

[overhacked]

I'll look into this and see why it's failing. My oversight not adding certificates to the test suite!

[overhacked]

Have done some investigation and opened a pull request RustCrypto/SSH#449 to fix the upstream issue. Currently ssh-key doesn't handle certificates in the agent response. Once the upstream issue is merged and released, I'll be able to fix this issue.

[christian-blades-cb]

Looks like the fix landed in ssh-key v0.7.0-rc.6, but 0.7.x doesn't have a stable release yet.