external/secretive
1
0
Fork 0
mirror of https://github.com/maxgoedjen/secretive.git synced 2026-09-19 14:48:01 +02:00
Code Issues Projects Releases Wiki Activity

Return empty bind response on parse throw

Browse Source
This commit is contained in:
Max Goedjen
2026-09-15 22:09:51 -07:00
parent fddffcebd1
commit f0d6abda40
1 changed files with 50 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Sources/Packages/Sources/SSHProtocolKit/SSHAgentInputParser.swift
+50 -46
View File
@@ -142,60 +142,64 @@ extension SSHAgentInputParser {
case SSHAgent.ProtocolExtension.OpenSSHExtension.domain: case SSHAgent.ProtocolExtension.OpenSSHExtension.domain:
switch name { switch name {
case SSHAgent.ProtocolExtension.OpenSSHExtension.sessionBind(.empty).name: case SSHAgent.ProtocolExtension.OpenSSHExtension.sessionBind(.empty).name:
let hostkeyBlob = try reader.readNextChunkAsSubReader() do {
let hostKeyType = try hostkeyBlob.readNextChunkAsString() let hostkeyBlob = try reader.readNextChunkAsSubReader()
let hostKeyData = try hostkeyBlob.readNextChunk() let hostKeyType = try hostkeyBlob.readNextChunkAsString()
let sessionID = try reader.readNextChunk() let hostKeyData = try hostkeyBlob.readNextChunk()
let signatureBlob = try reader.readNextChunkAsSubReader() let sessionID = try reader.readNextChunk()
_ = try signatureBlob.readNextChunk() // key type again let signatureBlob = try reader.readNextChunkAsSubReader()
let signature = try signatureBlob.readNextChunk() _ = try signatureBlob.readNextChunk() // key type again
let forwarding = try reader.readNextByteAsBool() let signature = try signatureBlob.readNextChunk()
switch hostKeyType { let forwarding = try reader.readNextByteAsBool()
case "ssh-ed25519": switch hostKeyType {
let hostKey = try CryptoKit.Curve25519.Signing.PublicKey(rawRepresentation: hostKeyData) case "ssh-ed25519":
guard hostKey.isValidSignature(signature, for: sessionID) else { let hostKey = try CryptoKit.Curve25519.Signing.PublicKey(rawRepresentation: hostKeyData)
throw AgentParsingError.incorrectSignature
}
case "ecdsa-sha2-nistp256":
let hostKey = try CryptoKit.P256.Signing.PublicKey(rawRepresentation: hostKeyData)
guard hostKey.isValidSignature(try .init(rawRepresentation: signature), for: sessionID) else {
throw AgentParsingError.incorrectSignature
}
case "ecdsa-sha2-nistp384":
let hostKey = try CryptoKit.P384.Signing.PublicKey(rawRepresentation: hostKeyData)
guard hostKey.isValidSignature(try .init(rawRepresentation: signature), for: sessionID) else {
throw AgentParsingError.incorrectSignature
}
case "ssh-mldsa-65":
if #available(macOS 26.0, *) {
let hostKey = try CryptoKit.MLDSA65.PublicKey(rawRepresentation: hostKeyData)
guard hostKey.isValidSignature(signature, for: sessionID) else { guard hostKey.isValidSignature(signature, for: sessionID) else {
throw AgentParsingError.incorrectSignature throw AgentParsingError.incorrectSignature
} }
} else { case "ecdsa-sha2-nistp256":
throw AgentParsingError.unhandledRequest let hostKey = try CryptoKit.P256.Signing.PublicKey(rawRepresentation: hostKeyData)
} guard hostKey.isValidSignature(try .init(rawRepresentation: signature), for: sessionID) else {
case "ssh-mldsa-87":
if #available(macOS 26.0, *) {
let hostKey = try CryptoKit.MLDSA65.PublicKey(rawRepresentation: hostKeyData)
guard hostKey.isValidSignature(signature, for: sessionID) else {
throw AgentParsingError.incorrectSignature throw AgentParsingError.incorrectSignature
} }
} else { case "ecdsa-sha2-nistp384":
let hostKey = try CryptoKit.P384.Signing.PublicKey(rawRepresentation: hostKeyData)
guard hostKey.isValidSignature(try .init(rawRepresentation: signature), for: sessionID) else {
throw AgentParsingError.incorrectSignature
}
case "ssh-mldsa-65":
if #available(macOS 26.0, *) {
let hostKey = try CryptoKit.MLDSA65.PublicKey(rawRepresentation: hostKeyData)
guard hostKey.isValidSignature(signature, for: sessionID) else {
throw AgentParsingError.incorrectSignature
}
} else {
throw AgentParsingError.unhandledRequest
}
case "ssh-mldsa-87":
if #available(macOS 26.0, *) {
let hostKey = try CryptoKit.MLDSA65.PublicKey(rawRepresentation: hostKeyData)
guard hostKey.isValidSignature(signature, for: sessionID) else {
throw AgentParsingError.incorrectSignature
}
} else {
throw AgentParsingError.unhandledRequest
}
case "ssh-rsa":
throw AgentParsingError.unhandledRequest
default:
throw AgentParsingError.unhandledRequest throw AgentParsingError.unhandledRequest
} }
case "ssh-rsa": let context = SSHAgent.ProtocolExtension.OpenSSHExtension.SessionBindContext(
throw AgentParsingError.unhandledRequest hostKey: hostKeyData,
default: sessionID: sessionID,
throw AgentParsingError.unhandledRequest signature: signature,
forwarding: forwarding
)
return .openSSH(.sessionBind(context))
} catch {
return .openSSH(.sessionBind(.empty))
} }
let context = SSHAgent.ProtocolExtension.OpenSSHExtension.SessionBindContext(
hostKey: hostKeyData,
sessionID: sessionID,
signature: signature,
forwarding: forwarding
)
return .openSSH(.sessionBind(context))
default: default:
return .openSSH(.unknown(String(name))) return .openSSH(.unknown(String(name)))
} }