Support auth using SSH Agent keys. #281
Conversation
| { | ||
| string? sshAuthSock = Environment.GetEnvironmentVariable("SSH_AUTH_SOCK"); | ||
|
|
||
| if (OperatingSystem.IsWindows()) |
There was a problem hiding this comment.
@jborean93 (assuming you have a Windows machine/VM) is this something you'd want to look into?
There was a problem hiding this comment.
Will try it out and get back to you.
There was a problem hiding this comment.
On Windows it looks like it doesn't use a socket at all but rather a named pipe called openssh-ssh-agent. You can use NamedPipeClientStream to connect to it
using var agentPipe = new NamedPipeClientStream("openssh-ssh-agent");
await agentPipe.ConnectAsync();
...There's probably some considerations needed around
- Whether any custom PipeOption is needed, like
Asynchronous - Whether we should specify TokenImpersonationLevel.Anonymous or
Identificationto stop the service from pretending to be us- I'm not aware of any reason why it would need to do so but it's worth looking into
The pipe implements a Stream and not a Socket which will have some work needed to fit into the existing API model.
There was a problem hiding this comment.
The pipe implements a Stream and not a Socket which will have some work needed to fit into the existing API model.
For this, you can change SocketSshConnection to accept a Stream instead of Socket and for the Socket-case create a NetworkStream. These changes will be useful for proxy jumping. Feel free to rename the class (e.g. StreamSshConnection).
|
Nice, I was planning on looking at this during the Christmas break but you've beaten me to it. I'll try out the changes on Windows to see what platform differences are there (if any). |
| private const uint SSH_AGENT_RSA_SHA2_256 = 2; | ||
| private const uint SSH_AGENT_RSA_SHA2_512 = 4; | ||
|
|
||
| private static EndPoint? _defaultEndPoint; |
There was a problem hiding this comment.
@jborean93 for adding the named pipe support, we can probably change this from using an EndPoint to use a string. On Windows we will then assume this string is a named pipe address and on non-Windows it is a unix socket path.
… through PreferredAuthentications.
|
@jborean93 I've merged this and created some issues to tackle remaining things. #288 is for the Windows support. #284 is also important. I think you may be interested in working on this as well. If you have an interest in working on any of the other issues, add a comment to it. |
Fixes #213.
cc @jborean93