code review 91010050: go.crypto/ssh/agent: fix darwin test failures.

go.crypto/ssh/agent: fix darwin test failures.

Darwin lacks ssh-agent support for ECDSA keys and RSA certs.

[dfc, 2014-05-02 17:40:07]

Hello hanwen@google.com, jonathan.mark.pittman@gmail.com, agl@golang.org (cc:
golang-codereviews@googlegroups.com),

I'd like you to review this change to
https://code.google.com/p/go.crypto

[dfc, 2014-05-05 03:01:51]

ping

[jmp, 2014-05-05 05:10:51]

On 2014/05/05 03:01:51, dfc wrote:
> ping

Does the built-in Darwin agent support certs at all?  I may have to test this,
but I thought it did support certs.  Last time I checked, I do remember ecdsa
keys were left out.  So that part makes sense.

[hanwen-google, 2014-05-05 09:24:01]

Is there a way to make this less ad-hoc?

Maybe using "ssh-add" inserting keys to see whic keytypes are supported?

[jmp, 2014-05-06 02:57:50]

Darwin Aeschylus.local 13.1.0 Darwin Kernel Version 13.1.0: Wed Apr  2 23:52:02
PDT 2014; root:xnu-2422.92.1~2/RELEASE_X86_64 x86_64

OpenSSH_6.2p2, OSSLShim 0.9.8r 8 Dec 2011

I am able to add ssh certificates to the ssh agent if they are using rsa or dsa
keys.  If ECDSA is involved at all (even for the signature key), I cannot add
them.  For example, I have an id_rsa_2048 signed by another rsa key as well as
signed by a dsa key.  I can add the private key and the certificate just fine
with either of those configurations.  However, I have that same key signed by an
ecdsa key.  When I try to add the private key and the ecdsa signed certificate,
it fails on me.

jonathanpittman$ ssh-add id_rsa_2048
Identity added: id_rsa_2048 (id_rsa_2048)
key_from_blob: remaining bytes in key blob 81
cert_parse: Invalid signature key type unknown (10)
key_from_blob: can't parse cert data

So, back to what I said before.  RSA & DSA seem fine.  ECDSA appears to be the
only issues with ssh-agent on mac os x right now.  With that in mind, I don't
think the first bit about rsa certificates is necessary, but the ecdsa stuff may
be necessary if you are using the ssh-agent on OS X.

[jmp, 2014-05-06 03:00:29]

On 2014/05/06 02:57:50, jmp wrote:
> Darwin Aeschylus.local 13.1.0 Darwin Kernel Version 13.1.0: Wed Apr  2
23:52:02
> PDT 2014; root:xnu-2422.92.1~2/RELEASE_X86_64 x86_64
> 
> OpenSSH_6.2p2, OSSLShim 0.9.8r 8 Dec 2011
> 
> I am able to add ssh certificates to the ssh agent if they are using rsa or
dsa
> keys.  If ECDSA is involved at all (even for the signature key), I cannot add
> them.  For example, I have an id_rsa_2048 signed by another rsa key as well as
> signed by a dsa key.  I can add the private key and the certificate just fine
> with either of those configurations.  However, I have that same key signed by
an
> ecdsa key.  When I try to add the private key and the ecdsa signed
certificate,
> it fails on me.
> 
> jonathanpittman$ ssh-add id_rsa_2048
> Identity added: id_rsa_2048 (id_rsa_2048)
> key_from_blob: remaining bytes in key blob 81
> cert_parse: Invalid signature key type unknown (10)
> key_from_blob: can't parse cert data
> 
> So, back to what I said before.  RSA & DSA seem fine.  ECDSA appears to be the
> only issues with ssh-agent on mac os x right now.  With that in mind, I don't
> think the first bit about rsa certificates is necessary, but the ecdsa stuff
may
> be necessary if you are using the ssh-agent on OS X.

BTW, passing looks something like this...

jonathanpittman$ ssh-add id_dsa_1024
Identity added: id_dsa_1024 (id_dsa_1024)
Certificate added: id_dsa_1024-cert.pub (gopher@golang)

[gobot, 2014-08-19 01:52:25]

R=close (assigned by dave@cheney.net)