GNOME Bugzilla – Bug 775981
gnome-keyring should wrap stock ssh-agent
Last modified: 2018-03-19 15:02:12 UTC
The gnome-keyring SSH functionality enables the following: * Automatic loading and unlocking of keys * Prompting in the UI However we should not need to reimplement the ssh-agent to accomplish this. We can simply wrap the real ssh-agent.
Here are two work in progress branches which try to implement this. However I have not made much progress on them in over a year, and would encourage interested parties to complete the work: https://git.gnome.org/browse/gcr/log/?h=ssh-askpass https://git.gnome.org/browse/gnome-keyring/log/?h=ssh-wip The two work together. In addition the GCR work is reusable by other parts of GCR that interact with SSH commands.
Although the fix for bug 641082 was a big step forward (thanks Jakub!), I worry that there would be a disappointment if we shipped it without support for Ed25519. Currently it's waiting for the EdDSA mechanism being defined in the new PKCS #11 standard, but as far as I know there is no concrete schedule. So I revisited this approach; the prior work by Stef basically works after a few adjustments on top of it: https://git.gnome.org/browse/gcr/log/?h=wip/dueno/ssh-askpass https://git.gnome.org/browse/gnome-keyring/log/?h=wip/dueno/ssh-agent I am going to attach a squashed version.
Created attachment 365505 [details] [review] ssh-agent: use stock ssh-agent This patch removes our own implementation of ssh-agent and switches to using the ssh-agent program provided by OpenSSH. We can't simply drop the ssh-agent functionality from gnome-keyring, as it enables the following: * Automatic loading and unlocking of keys * Prompting in the UI Instead we wrap the ssh-agent program as a subprocess and augment the protocol as we need. Signed-off-by: Stef Walter <stefw@gnome.org> Signed-off-by: Daiki Ueno <dueno@src.gnome.org>
Created attachment 368468 [details] [review] login: Add non-varargs version of gkd_login_*_password() functions Those functions could be used in GkdLoginInteraction where the fields are stored in a table.
Created attachment 368469 [details] [review] login: Add GkdLoginInteraction API This decorates underlying GTlsInteraction with a capability of retrieving/storing passwords in the login keyring.
Created attachment 368470 [details] [review] egg: Import mock-interaction.[ch] from gcr
Created attachment 368471 [details] [review] configure: Require GLib 2.44
Created attachment 368472 [details] [review] configure: Require gcr 3.27.3
Created attachment 368473 [details] [review] ssh-agent: Use stock ssh-agent This patch removes our own implementation of ssh-agent and switches to using the ssh-agent program provided by OpenSSH. We can't simply drop the ssh-agent functionality from gnome-keyring, as it enables the following: * Automatic loading and unlocking of keys * Prompting in the UI Instead we wrap the ssh-agent program as a subprocess and augment the protocol as we need. Signed-off-by: Stef Walter <stefw@gnome.org> Signed-off-by: Daiki Ueno <dueno@src.gnome.org>
Though the integration tests are still lacking (in particular, the login keyring integration is not tested at all), I have managed to increase the unit test coverage to ~90% for daemon/ssh-agent/*. Here are the copr repositories for testing: https://copr.fedorainfracloud.org/coprs/ueno/gcr-ssh-askpass/ https://copr.fedorainfracloud.org/coprs/ueno/gnome-keyring/
Created attachment 368476 [details] [review] ssh-agent: Use stock ssh-agent This patch removes our own implementation of ssh-agent and switches to using the ssh-agent program provided by OpenSSH. We can't simply drop the ssh-agent functionality from gnome-keyring, as it enables the following: * Automatic loading and unlocking of keys * Prompting in the UI Instead we wrap the ssh-agent program as a subprocess and augment the protocol as we need. Signed-off-by: Stef Walter <stefw@gnome.org> Signed-off-by: Daiki Ueno <dueno@src.gnome.org> -- And indeed there were issues in interacting with the login keyring. This should fix those. The Copr builds have been updated already.
Created attachment 368551 [details] [review] login: Add GkdLoginInteraction API This decorates underlying GTlsInteraction with a capability of retrieving/storing passwords in the login keyring. -- In comment 11, I mistakenly squash the fix to a different commit; it should be squashed to this one instead.
Created attachment 368552 [details] [review] ssh-agent: Use stock ssh-agent This patch removes our own implementation of ssh-agent and switches to using the ssh-agent program provided by OpenSSH. We can't simply drop the ssh-agent functionality from gnome-keyring, as it enables the following: * Automatic loading and unlocking of keys * Prompting in the UI Instead we wrap the ssh-agent program as a subprocess and augment the protocol as we need. Signed-off-by: Stef Walter <stefw@gnome.org> Signed-off-by: Daiki Ueno <dueno@src.gnome.org> -- Re-squashed and added more tests.
Created attachment 369257 [details] [review] ssh-agent: Add GkdSshAgentInteraction API This could be used by the new implementation of ssh-agent, through the GcrSshAskpass and GkdLoginInteraction.
Created attachment 369258 [details] [review] ssh-agent: Use stock ssh-agent This patch removes our own implementation of ssh-agent and switches to using the ssh-agent program provided by OpenSSH. We can't simply drop the ssh-agent functionality from gnome-keyring, as it enables the following: * Automatic loading and unlocking of keys * Prompting in the UI Instead we wrap the ssh-agent program as a subprocess and augment the protocol as we need. Co-authored-by: Daiki Ueno <dueno@src.gnome.org>
Attachment 368468 [details] pushed as 5f7ab25 - login: Add non-varargs version of gkd_login_*_password() functions Attachment 368470 [details] pushed as 9ec7de5 - egg: Import mock-interaction.[ch] from gcr Attachment 368471 [details] pushed as 162a180 - configure: Require GLib 2.44 Attachment 368551 [details] pushed as 6628894 - login: Add GkdLoginInteraction API Attachment 369257 [details] pushed as 5cbfcd6 - ssh-agent: Add GkdSshAgentInteraction API Attachment 369258 [details] pushed as 8db2b97 - ssh-agent: Use stock ssh-agent
Is this fix targeted for any release?
I have released 3.27.92 with this change so it will be in 3.28 unless there is any critical problem. Testing would be highly appreciated: https://mail.gnome.org/archives/release-team/2018-February/msg00095.html
Comment on attachment 368472 [details] [review] configure: Require gcr 3.27.3 Forgot to attach, but this is obsoleted by: https://git.gnome.org/browse/gnome-keyring/commit/?id=43f9d81d9a0b3279bb3d7e0a8dc495169b69ddb0
The patches here probably cause Bug 794361.