ssh/agent/server.go - crypto - Git at Google

 // Copyright 2012 The Go Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.

 package agent

 import (
 	"crypto/dsa"
 	"crypto/ecdsa"
 	"crypto/elliptic"
 	"crypto/rsa"
 	"encoding/binary"
 	"errors"
 	"fmt"
 	"io"
 	"log"
 	"math/big"

 	"golang.org/x/crypto/ed25519"
 	"golang.org/x/crypto/ssh"
 )

 // Server wraps an Agent and uses it to implement the agent side of
 // the SSH-agent, wire protocol.
 type server struct {
 	agent Agent
 }

 func (s *server) processRequestBytes(reqData []byte) []byte {
 	rep, err := s.processRequest(reqData)
 	if err != nil {
 		if err != errLocked {
 			// TODO(hanwen): provide better logging interface?
 			log.Printf("agent %d: %v", reqData[0], err)
 		}
 		return []byte{agentFailure}
 	}

 	if err == nil && rep == nil {
 		return []byte{agentSuccess}
 	}

 	return ssh.Marshal(rep)
 }

 func marshalKey(k *Key) []byte {
 	var record struct {
 		Blob    []byte
 		Comment string
 	}
 	record.Blob = k.Marshal()
 	record.Comment = k.Comment

 	return ssh.Marshal(&record)
 }

 // See [PROTOCOL.agent], section 2.5.1.
 const agentV1IdentitiesAnswer = 2

 type agentV1IdentityMsg struct {
 	Numkeys uint32 `sshtype:"2"`
 }

 type agentRemoveIdentityMsg struct {
 	KeyBlob []byte `sshtype:"18"`
 }

 type agentLockMsg struct {
 	Passphrase []byte `sshtype:"22"`
 }

 type agentUnlockMsg struct {
 	Passphrase []byte `sshtype:"23"`
 }

 func (s *server) processRequest(data []byte) (interface{}, error) {
 	switch data[0] {
 	case agentRequestV1Identities:
 		return &agentV1IdentityMsg{0}, nil

 	case agentRemoveAllV1Identities:
 		return nil, nil

 	case agentRemoveIdentity:
 		var req agentRemoveIdentityMsg
 		if err := ssh.Unmarshal(data, &req); err != nil {
 			return nil, err
 		}

 		var wk wireKey
 		if err := ssh.Unmarshal(req.KeyBlob, &wk); err != nil {
 			return nil, err
 		}

 		return nil, s.agent.Remove(&Key{Format: wk.Format, Blob: req.KeyBlob})

 	case agentRemoveAllIdentities:
 		return nil, s.agent.RemoveAll()

 	case agentLock:
 		var req agentLockMsg
 		if err := ssh.Unmarshal(data, &req); err != nil {
 			return nil, err
 		}

 		return nil, s.agent.Lock(req.Passphrase)

 	case agentUnlock:
 		var req agentUnlockMsg
 		if err := ssh.Unmarshal(data, &req); err != nil {
 			return nil, err
 		}
 		return nil, s.agent.Unlock(req.Passphrase)

 	case agentSignRequest:
 		var req signRequestAgentMsg
 		if err := ssh.Unmarshal(data, &req); err != nil {
 			return nil, err
 		}

 		var wk wireKey
 		if err := ssh.Unmarshal(req.KeyBlob, &wk); err != nil {
 			return nil, err
 		}

 		k := &Key{
 			Format: wk.Format,
 			Blob:   req.KeyBlob,
 		}

 		var sig *ssh.Signature
 		var err error
 		if extendedAgent, ok := s.agent.(ExtendedAgent); ok {
 			sig, err = extendedAgent.SignWithFlags(k, req.Data, SignatureFlags(req.Flags))
 		} else {
 			sig, err = s.agent.Sign(k, req.Data)
 		}

 		if err != nil {
 			return nil, err
 		}
 		return &signResponseAgentMsg{SigBlob: ssh.Marshal(sig)}, nil

 	case agentRequestIdentities:
 		keys, err := s.agent.List()
 		if err != nil {
 			return nil, err
 		}

 		rep := identitiesAnswerAgentMsg{
 			NumKeys: uint32(len(keys)),
 		}
 		for _, k := range keys {
 			rep.Keys = append(rep.Keys, marshalKey(k)...)
 		}
 		return rep, nil

 	case agentAddIDConstrained, agentAddIdentity:
 		return nil, s.insertIdentity(data)

 	case agentExtension:
 		// Return a stub object where the whole contents of the response gets marshaled.
 		var responseStub struct {
 			Rest []byte `ssh:"rest"`
 		}

 		if extendedAgent, ok := s.agent.(ExtendedAgent); !ok {
 			// If this agent doesn't implement extensions, [PROTOCOL.agent] section 4.7
 			// requires that we return a standard SSH_AGENT_FAILURE message.
 			responseStub.Rest = []byte{agentFailure}
 		} else {
 			var req extensionAgentMsg
 			if err := ssh.Unmarshal(data, &req); err != nil {
 				return nil, err
 			}
 			res, err := extendedAgent.Extension(req.ExtensionType, req.Contents)
 			if err != nil {
 				// If agent extensions are unsupported, return a standard SSH_AGENT_FAILURE
 				// message as required by [PROTOCOL.agent] section 4.7.
 				if err == ErrExtensionUnsupported {
 					responseStub.Rest = []byte{agentFailure}
 				} else {
 					// As the result of any other error processing an extension request,
 					// [PROTOCOL.agent] section 4.7 requires that we return a
 					// SSH_AGENT_EXTENSION_FAILURE code.
 					responseStub.Rest = []byte{agentExtensionFailure}
 				}
 			} else {
 				if len(res) == 0 {
 					return nil, nil
 				}
 				responseStub.Rest = res
 			}
 		}

 		return responseStub, nil
 	}

 	return nil, fmt.Errorf("unknown opcode %d", data[0])
 }

 func parseConstraints(constraints []byte) (lifetimeSecs uint32, confirmBeforeUse bool, extensions []ConstraintExtension, err error) {
 	for len(constraints) != 0 {
 		switch constraints[0] {
 		case agentConstrainLifetime:
 			lifetimeSecs = binary.BigEndian.Uint32(constraints[1:5])
 			constraints = constraints[5:]
 		case agentConstrainConfirm:
 			confirmBeforeUse = true
 			constraints = constraints[1:]
 		case agentConstrainExtension:
 			var msg constrainExtensionAgentMsg
 			if err = ssh.Unmarshal(constraints, &msg); err != nil {
 				return 0, false, nil, err
 			}
 			extensions = append(extensions, ConstraintExtension{
 				ExtensionName:    msg.ExtensionName,
 				ExtensionDetails: msg.ExtensionDetails,
 			})
 			constraints = msg.Rest
 		default:
 			return 0, false, nil, fmt.Errorf("unknown constraint type: %d", constraints[0])
 		}
 	}
 	return
 }

 func setConstraints(key *AddedKey, constraintBytes []byte) error {
 	lifetimeSecs, confirmBeforeUse, constraintExtensions, err := parseConstraints(constraintBytes)
 	if err != nil {
 		return err
 	}

 	key.LifetimeSecs = lifetimeSecs
 	key.ConfirmBeforeUse = confirmBeforeUse
 	key.ConstraintExtensions = constraintExtensions
 	return nil
 }

 func parseRSAKey(req []byte) (*AddedKey, error) {
 	var k rsaKeyMsg
 	if err := ssh.Unmarshal(req, &k); err != nil {
 		return nil, err
 	}
 	if k.E.BitLen() > 30 {
 		return nil, errors.New("agent: RSA public exponent too large")
 	}
 	priv := &rsa.PrivateKey{
 		PublicKey: rsa.PublicKey{
 			E: int(k.E.Int64()),
 			N: k.N,
 		},
 		D:      k.D,
 		Primes: []*big.Int{k.P, k.Q},
 	}
 	priv.Precompute()

 	addedKey := &AddedKey{PrivateKey: priv, Comment: k.Comments}
 	if err := setConstraints(addedKey, k.Constraints); err != nil {
 		return nil, err
 	}
 	return addedKey, nil
 }

 func parseEd25519Key(req []byte) (*AddedKey, error) {
 	var k ed25519KeyMsg
 	if err := ssh.Unmarshal(req, &k); err != nil {
 		return nil, err
 	}
 	priv := ed25519.PrivateKey(k.Priv)

 	addedKey := &AddedKey{PrivateKey: &priv, Comment: k.Comments}
 	if err := setConstraints(addedKey, k.Constraints); err != nil {
 		return nil, err
 	}
 	return addedKey, nil
 }

 func parseDSAKey(req []byte) (*AddedKey, error) {
 	var k dsaKeyMsg
 	if err := ssh.Unmarshal(req, &k); err != nil {
 		return nil, err
 	}
 	priv := &dsa.PrivateKey{
 		PublicKey: dsa.PublicKey{
 			Parameters: dsa.Parameters{
 				P: k.P,
 				Q: k.Q,
 				G: k.G,
 			},
 			Y: k.Y,
 		},
 		X: k.X,
 	}

 	addedKey := &AddedKey{PrivateKey: priv, Comment: k.Comments}
 	if err := setConstraints(addedKey, k.Constraints); err != nil {
 		return nil, err
 	}
 	return addedKey, nil
 }

 func unmarshalECDSA(curveName string, keyBytes []byte, privScalar *big.Int) (priv *ecdsa.PrivateKey, err error) {
 	priv = &ecdsa.PrivateKey{
 		D: privScalar,
 	}

 	switch curveName {
 	case "nistp256":
 		priv.Curve = elliptic.P256()
 	case "nistp384":
 		priv.Curve = elliptic.P384()
 	case "nistp521":
 		priv.Curve = elliptic.P521()
 	default:
 		return nil, fmt.Errorf("agent: unknown curve %q", curveName)
 	}

 	priv.X, priv.Y = elliptic.Unmarshal(priv.Curve, keyBytes)
 	if priv.X == nil || priv.Y == nil {
 		return nil, errors.New("agent: point not on curve")
 	}

 	return priv, nil
 }

 func parseEd25519Cert(req []byte) (*AddedKey, error) {
 	var k ed25519CertMsg
 	if err := ssh.Unmarshal(req, &k); err != nil {
 		return nil, err
 	}
 	pubKey, err := ssh.ParsePublicKey(k.CertBytes)
 	if err != nil {
 		return nil, err
 	}
 	priv := ed25519.PrivateKey(k.Priv)
 	cert, ok := pubKey.(*ssh.Certificate)
 	if !ok {
 		return nil, errors.New("agent: bad ED25519 certificate")
 	}

 	addedKey := &AddedKey{PrivateKey: &priv, Certificate: cert, Comment: k.Comments}
 	if err := setConstraints(addedKey, k.Constraints); err != nil {
 		return nil, err
 	}
 	return addedKey, nil
 }

 func parseECDSAKey(req []byte) (*AddedKey, error) {
 	var k ecdsaKeyMsg
 	if err := ssh.Unmarshal(req, &k); err != nil {
 		return nil, err
 	}

 	priv, err := unmarshalECDSA(k.Curve, k.KeyBytes, k.D)
 	if err != nil {
 		return nil, err
 	}

 	addedKey := &AddedKey{PrivateKey: priv, Comment: k.Comments}
 	if err := setConstraints(addedKey, k.Constraints); err != nil {
 		return nil, err
 	}
 	return addedKey, nil
 }

 func parseRSACert(req []byte) (*AddedKey, error) {
 	var k rsaCertMsg
 	if err := ssh.Unmarshal(req, &k); err != nil {
 		return nil, err
 	}

 	pubKey, err := ssh.ParsePublicKey(k.CertBytes)
 	if err != nil {
 		return nil, err
 	}

 	cert, ok := pubKey.(*ssh.Certificate)
 	if !ok {
 		return nil, errors.New("agent: bad RSA certificate")
 	}

 	// An RSA publickey as marshaled by rsaPublicKey.Marshal() in keys.go
 	var rsaPub struct {
 		Name string
 		E    *big.Int
 		N    *big.Int
 	}
 	if err := ssh.Unmarshal(cert.Key.Marshal(), &rsaPub); err != nil {
 		return nil, fmt.Errorf("agent: Unmarshal failed to parse public key: %v", err)
 	}

 	if rsaPub.E.BitLen() > 30 {
 		return nil, errors.New("agent: RSA public exponent too large")
 	}

 	priv := rsa.PrivateKey{
 		PublicKey: rsa.PublicKey{
 			E: int(rsaPub.E.Int64()),
 			N: rsaPub.N,
 		},
 		D:      k.D,
 		Primes: []*big.Int{k.Q, k.P},
 	}
 	priv.Precompute()

 	addedKey := &AddedKey{PrivateKey: &priv, Certificate: cert, Comment: k.Comments}
 	if err := setConstraints(addedKey, k.Constraints); err != nil {
 		return nil, err
 	}
 	return addedKey, nil
 }

 func parseDSACert(req []byte) (*AddedKey, error) {
 	var k dsaCertMsg
 	if err := ssh.Unmarshal(req, &k); err != nil {
 		return nil, err
 	}
 	pubKey, err := ssh.ParsePublicKey(k.CertBytes)
 	if err != nil {
 		return nil, err
 	}
 	cert, ok := pubKey.(*ssh.Certificate)
 	if !ok {
 		return nil, errors.New("agent: bad DSA certificate")
 	}

 	// A DSA publickey as marshaled by dsaPublicKey.Marshal() in keys.go
 	var w struct {
 		Name       string
 		P, Q, G, Y *big.Int
 	}
 	if err := ssh.Unmarshal(cert.Key.Marshal(), &w); err != nil {
 		return nil, fmt.Errorf("agent: Unmarshal failed to parse public key: %v", err)
 	}

 	priv := &dsa.PrivateKey{
 		PublicKey: dsa.PublicKey{
 			Parameters: dsa.Parameters{
 				P: w.P,
 				Q: w.Q,
 				G: w.G,
 			},
 			Y: w.Y,
 		},
 		X: k.X,
 	}

 	addedKey := &AddedKey{PrivateKey: priv, Certificate: cert, Comment: k.Comments}
 	if err := setConstraints(addedKey, k.Constraints); err != nil {
 		return nil, err
 	}
 	return addedKey, nil
 }

 func parseECDSACert(req []byte) (*AddedKey, error) {
 	var k ecdsaCertMsg
 	if err := ssh.Unmarshal(req, &k); err != nil {
 		return nil, err
 	}

 	pubKey, err := ssh.ParsePublicKey(k.CertBytes)
 	if err != nil {
 		return nil, err
 	}
 	cert, ok := pubKey.(*ssh.Certificate)
 	if !ok {
 		return nil, errors.New("agent: bad ECDSA certificate")
 	}

 	// An ECDSA publickey as marshaled by ecdsaPublicKey.Marshal() in keys.go
 	var ecdsaPub struct {
 		Name string
 		ID   string
 		Key  []byte
 	}
 	if err := ssh.Unmarshal(cert.Key.Marshal(), &ecdsaPub); err != nil {
 		return nil, err
 	}

 	priv, err := unmarshalECDSA(ecdsaPub.ID, ecdsaPub.Key, k.D)
 	if err != nil {
 		return nil, err
 	}

 	addedKey := &AddedKey{PrivateKey: priv, Certificate: cert, Comment: k.Comments}
 	if err := setConstraints(addedKey, k.Constraints); err != nil {
 		return nil, err
 	}
 	return addedKey, nil
 }

 func (s *server) insertIdentity(req []byte) error {
 	var record struct {
 		Type string `sshtype:"17|25"`
 		Rest []byte `ssh:"rest"`
 	}

 	if err := ssh.Unmarshal(req, &record); err != nil {
 		return err
 	}

 	var addedKey *AddedKey
 	var err error

 	switch record.Type {
 	case ssh.KeyAlgoRSA:
 		addedKey, err = parseRSAKey(req)
 	case ssh.KeyAlgoDSA:
 		addedKey, err = parseDSAKey(req)
 	case ssh.KeyAlgoECDSA256, ssh.KeyAlgoECDSA384, ssh.KeyAlgoECDSA521:
 		addedKey, err = parseECDSAKey(req)
 	case ssh.KeyAlgoED25519:
 		addedKey, err = parseEd25519Key(req)
 	case ssh.CertAlgoRSAv01:
 		addedKey, err = parseRSACert(req)
 	case ssh.CertAlgoDSAv01:
 		addedKey, err = parseDSACert(req)
 	case ssh.CertAlgoECDSA256v01, ssh.CertAlgoECDSA384v01, ssh.CertAlgoECDSA521v01:
 		addedKey, err = parseECDSACert(req)
 	case ssh.CertAlgoED25519v01:
 		addedKey, err = parseEd25519Cert(req)
 	default:
 		return fmt.Errorf("agent: not implemented: %q", record.Type)
 	}

 	if err != nil {
 		return err
 	}
 	return s.agent.Add(*addedKey)
 }

 // ServeAgent serves the agent protocol on the given connection. It
 // returns when an I/O error occurs.
 func ServeAgent(agent Agent, c io.ReadWriter) error {
 	s := &server{agent}

 	var length [4]byte
 	for {
 		if _, err := io.ReadFull(c, length[:]); err != nil {
 			return err
 		}
 		l := binary.BigEndian.Uint32(length[:])
 		if l == 0 {
 			return fmt.Errorf("agent: request size is 0")
 		}
 		if l > maxAgentResponseBytes {
 			// We also cap requests.
 			return fmt.Errorf("agent: request too large: %d", l)
 		}

 		req := make([]byte, l)
 		if _, err := io.ReadFull(c, req); err != nil {
 			return err
 		}

 		repData := s.processRequestBytes(req)
 		if len(repData) > maxAgentResponseBytes {
 			return fmt.Errorf("agent: reply too large: %d bytes", len(repData))
 		}

 		binary.BigEndian.PutUint32(length[:], uint32(len(repData)))
 		if _, err := c.Write(length[:]); err != nil {
 			return err
 		}
 		if _, err := c.Write(repData); err != nil {
 			return err
 		}
 	}
 }
	// Copyright 2012 The Go Authors. All rights reserved.
	// Use of this source code is governed by a BSD-style
	// license that can be found in the LICENSE file.

	package agent

	import (
	"crypto/dsa"
	"crypto/ecdsa"
	"crypto/elliptic"
	"crypto/rsa"
	"encoding/binary"
	"errors"
	"fmt"
	"io"
	"log"
	"math/big"

	"golang.org/x/crypto/ed25519"
	"golang.org/x/crypto/ssh"
	)

	// Server wraps an Agent and uses it to implement the agent side of
	// the SSH-agent, wire protocol.
	type server struct {
	agent Agent
	}

	func (s *server) processRequestBytes(reqData []byte) []byte {
	rep, err := s.processRequest(reqData)
	if err != nil {
	if err != errLocked {
	// TODO(hanwen): provide better logging interface?
	log.Printf("agent %d: %v", reqData[0], err)
	}
	return []byte{agentFailure}
	}

	if err == nil && rep == nil {
	return []byte{agentSuccess}
	}

	return ssh.Marshal(rep)
	}

	func marshalKey(k *Key) []byte {
	var record struct {
	Blob []byte
	Comment string
	}
	record.Blob = k.Marshal()
	record.Comment = k.Comment

	return ssh.Marshal(&record)
	}

	// See [PROTOCOL.agent], section 2.5.1.
	const agentV1IdentitiesAnswer = 2

	type agentV1IdentityMsg struct {
	Numkeys uint32 `sshtype:"2"`
	}

	type agentRemoveIdentityMsg struct {
	KeyBlob []byte `sshtype:"18"`
	}

	type agentLockMsg struct {
	Passphrase []byte `sshtype:"22"`
	}

	type agentUnlockMsg struct {
	Passphrase []byte `sshtype:"23"`
	}

	func (s *server) processRequest(data []byte) (interface{}, error) {
	switch data[0] {
	case agentRequestV1Identities:
	return &agentV1IdentityMsg{0}, nil

	case agentRemoveAllV1Identities:
	return nil, nil

	case agentRemoveIdentity:
	var req agentRemoveIdentityMsg
	if err := ssh.Unmarshal(data, &req); err != nil {
	return nil, err
	}

	var wk wireKey
	if err := ssh.Unmarshal(req.KeyBlob, &wk); err != nil {
	return nil, err
	}

	return nil, s.agent.Remove(&Key{Format: wk.Format, Blob: req.KeyBlob})

	case agentRemoveAllIdentities:
	return nil, s.agent.RemoveAll()

	case agentLock:
	var req agentLockMsg
	if err := ssh.Unmarshal(data, &req); err != nil {
	return nil, err
	}

	return nil, s.agent.Lock(req.Passphrase)

	case agentUnlock:
	var req agentUnlockMsg
	if err := ssh.Unmarshal(data, &req); err != nil {
	return nil, err
	}
	return nil, s.agent.Unlock(req.Passphrase)

	case agentSignRequest:
	var req signRequestAgentMsg
	if err := ssh.Unmarshal(data, &req); err != nil {
	return nil, err
	}

	var wk wireKey
	if err := ssh.Unmarshal(req.KeyBlob, &wk); err != nil {
	return nil, err
	}

	k := &Key{
	Format: wk.Format,
	Blob: req.KeyBlob,
	}

	var sig *ssh.Signature
	var err error
	if extendedAgent, ok := s.agent.(ExtendedAgent); ok {
	sig, err = extendedAgent.SignWithFlags(k, req.Data, SignatureFlags(req.Flags))
	} else {
	sig, err = s.agent.Sign(k, req.Data)
	}

	if err != nil {
	return nil, err
	}
	return &signResponseAgentMsg{SigBlob: ssh.Marshal(sig)}, nil

	case agentRequestIdentities:
	keys, err := s.agent.List()
	if err != nil {
	return nil, err
	}

	rep := identitiesAnswerAgentMsg{
	NumKeys: uint32(len(keys)),
	}
	for _, k := range keys {
	rep.Keys = append(rep.Keys, marshalKey(k)...)
	}
	return rep, nil

	case agentAddIDConstrained, agentAddIdentity:
	return nil, s.insertIdentity(data)

	case agentExtension:
	// Return a stub object where the whole contents of the response gets marshaled.
	var responseStub struct {
	Rest []byte `ssh:"rest"`
	}

	if extendedAgent, ok := s.agent.(ExtendedAgent); !ok {
	// If this agent doesn't implement extensions, [PROTOCOL.agent] section 4.7
	// requires that we return a standard SSH_AGENT_FAILURE message.
	responseStub.Rest = []byte{agentFailure}
	} else {
	var req extensionAgentMsg
	if err := ssh.Unmarshal(data, &req); err != nil {
	return nil, err
	}
	res, err := extendedAgent.Extension(req.ExtensionType, req.Contents)
	if err != nil {
	// If agent extensions are unsupported, return a standard SSH_AGENT_FAILURE
	// message as required by [PROTOCOL.agent] section 4.7.
	if err == ErrExtensionUnsupported {
	responseStub.Rest = []byte{agentFailure}
	} else {
	// As the result of any other error processing an extension request,
	// [PROTOCOL.agent] section 4.7 requires that we return a
	// SSH_AGENT_EXTENSION_FAILURE code.
	responseStub.Rest = []byte{agentExtensionFailure}
	}
	} else {
	if len(res) == 0 {
	return nil, nil
	}
	responseStub.Rest = res
	}
	}

	return responseStub, nil
	}

	return nil, fmt.Errorf("unknown opcode %d", data[0])
	}

	func parseConstraints(constraints []byte) (lifetimeSecs uint32, confirmBeforeUse bool, extensions []ConstraintExtension, err error) {
	for len(constraints) != 0 {
	switch constraints[0] {
	case agentConstrainLifetime:
	lifetimeSecs = binary.BigEndian.Uint32(constraints[1:5])
	constraints = constraints[5:]
	case agentConstrainConfirm:
	confirmBeforeUse = true
	constraints = constraints[1:]
	case agentConstrainExtension:
	var msg constrainExtensionAgentMsg
	if err = ssh.Unmarshal(constraints, &msg); err != nil {
	return 0, false, nil, err
	}
	extensions = append(extensions, ConstraintExtension{
	ExtensionName: msg.ExtensionName,
	ExtensionDetails: msg.ExtensionDetails,
	})
	constraints = msg.Rest
	default:
	return 0, false, nil, fmt.Errorf("unknown constraint type: %d", constraints[0])
	}
	}
	return
	}

	func setConstraints(key *AddedKey, constraintBytes []byte) error {
	lifetimeSecs, confirmBeforeUse, constraintExtensions, err := parseConstraints(constraintBytes)
	if err != nil {
	return err
	}

	key.LifetimeSecs = lifetimeSecs
	key.ConfirmBeforeUse = confirmBeforeUse
	key.ConstraintExtensions = constraintExtensions
	return nil
	}

	func parseRSAKey(req []byte) (*AddedKey, error) {
	var k rsaKeyMsg
	if err := ssh.Unmarshal(req, &k); err != nil {
	return nil, err
	}
	if k.E.BitLen() > 30 {
	return nil, errors.New("agent: RSA public exponent too large")
	}
	priv := &rsa.PrivateKey{
	PublicKey: rsa.PublicKey{
	E: int(k.E.Int64()),
	N: k.N,
	},
	D: k.D,
	Primes: []*big.Int{k.P, k.Q},
	}
	priv.Precompute()

	addedKey := &AddedKey{PrivateKey: priv, Comment: k.Comments}
	if err := setConstraints(addedKey, k.Constraints); err != nil {
	return nil, err
	}
	return addedKey, nil
	}

	func parseEd25519Key(req []byte) (*AddedKey, error) {
	var k ed25519KeyMsg
	if err := ssh.Unmarshal(req, &k); err != nil {
	return nil, err
	}
	priv := ed25519.PrivateKey(k.Priv)

	addedKey := &AddedKey{PrivateKey: &priv, Comment: k.Comments}
	if err := setConstraints(addedKey, k.Constraints); err != nil {
	return nil, err
	}
	return addedKey, nil
	}

	func parseDSAKey(req []byte) (*AddedKey, error) {
	var k dsaKeyMsg
	if err := ssh.Unmarshal(req, &k); err != nil {
	return nil, err
	}
	priv := &dsa.PrivateKey{
	PublicKey: dsa.PublicKey{
	Parameters: dsa.Parameters{
	P: k.P,
	Q: k.Q,
	G: k.G,
	},
	Y: k.Y,
	},
	X: k.X,
	}

	addedKey := &AddedKey{PrivateKey: priv, Comment: k.Comments}
	if err := setConstraints(addedKey, k.Constraints); err != nil {
	return nil, err
	}
	return addedKey, nil
	}

	func unmarshalECDSA(curveName string, keyBytes []byte, privScalar big.Int) (priv ecdsa.PrivateKey, err error) {
	priv = &ecdsa.PrivateKey{
	D: privScalar,
	}

	switch curveName {
	case "nistp256":
	priv.Curve = elliptic.P256()
	case "nistp384":
	priv.Curve = elliptic.P384()
	case "nistp521":
	priv.Curve = elliptic.P521()
	default:
	return nil, fmt.Errorf("agent: unknown curve %q", curveName)
	}

	priv.X, priv.Y = elliptic.Unmarshal(priv.Curve, keyBytes)
	if priv.X == nil \|\| priv.Y == nil {
	return nil, errors.New("agent: point not on curve")
	}

	return priv, nil
	}

	func parseEd25519Cert(req []byte) (*AddedKey, error) {
	var k ed25519CertMsg
	if err := ssh.Unmarshal(req, &k); err != nil {
	return nil, err
	}
	pubKey, err := ssh.ParsePublicKey(k.CertBytes)
	if err != nil {
	return nil, err
	}
	priv := ed25519.PrivateKey(k.Priv)
	cert, ok := pubKey.(*ssh.Certificate)
	if !ok {
	return nil, errors.New("agent: bad ED25519 certificate")
	}

	addedKey := &AddedKey{PrivateKey: &priv, Certificate: cert, Comment: k.Comments}
	if err := setConstraints(addedKey, k.Constraints); err != nil {
	return nil, err
	}
	return addedKey, nil
	}

	func parseECDSAKey(req []byte) (*AddedKey, error) {
	var k ecdsaKeyMsg
	if err := ssh.Unmarshal(req, &k); err != nil {
	return nil, err
	}

	priv, err := unmarshalECDSA(k.Curve, k.KeyBytes, k.D)
	if err != nil {
	return nil, err
	}

	addedKey := &AddedKey{PrivateKey: priv, Comment: k.Comments}
	if err := setConstraints(addedKey, k.Constraints); err != nil {
	return nil, err
	}
	return addedKey, nil
	}

	func parseRSACert(req []byte) (*AddedKey, error) {
	var k rsaCertMsg
	if err := ssh.Unmarshal(req, &k); err != nil {
	return nil, err
	}

	pubKey, err := ssh.ParsePublicKey(k.CertBytes)
	if err != nil {
	return nil, err
	}

	cert, ok := pubKey.(*ssh.Certificate)
	if !ok {
	return nil, errors.New("agent: bad RSA certificate")
	}

	// An RSA publickey as marshaled by rsaPublicKey.Marshal() in keys.go
	var rsaPub struct {
	Name string
	E *big.Int
	N *big.Int
	}
	if err := ssh.Unmarshal(cert.Key.Marshal(), &rsaPub); err != nil {
	return nil, fmt.Errorf("agent: Unmarshal failed to parse public key: %v", err)
	}

	if rsaPub.E.BitLen() > 30 {
	return nil, errors.New("agent: RSA public exponent too large")
	}

	priv := rsa.PrivateKey{
	PublicKey: rsa.PublicKey{
	E: int(rsaPub.E.Int64()),
	N: rsaPub.N,
	},
	D: k.D,
	Primes: []*big.Int{k.Q, k.P},
	}
	priv.Precompute()

	addedKey := &AddedKey{PrivateKey: &priv, Certificate: cert, Comment: k.Comments}
	if err := setConstraints(addedKey, k.Constraints); err != nil {
	return nil, err
	}
	return addedKey, nil
	}

	func parseDSACert(req []byte) (*AddedKey, error) {
	var k dsaCertMsg
	if err := ssh.Unmarshal(req, &k); err != nil {
	return nil, err
	}
	pubKey, err := ssh.ParsePublicKey(k.CertBytes)
	if err != nil {
	return nil, err
	}
	cert, ok := pubKey.(*ssh.Certificate)
	if !ok {
	return nil, errors.New("agent: bad DSA certificate")
	}

	// A DSA publickey as marshaled by dsaPublicKey.Marshal() in keys.go
	var w struct {
	Name string
	P, Q, G, Y *big.Int
	}
	if err := ssh.Unmarshal(cert.Key.Marshal(), &w); err != nil {
	return nil, fmt.Errorf("agent: Unmarshal failed to parse public key: %v", err)
	}

	priv := &dsa.PrivateKey{
	PublicKey: dsa.PublicKey{
	Parameters: dsa.Parameters{
	P: w.P,
	Q: w.Q,
	G: w.G,
	},
	Y: w.Y,
	},
	X: k.X,
	}

	addedKey := &AddedKey{PrivateKey: priv, Certificate: cert, Comment: k.Comments}
	if err := setConstraints(addedKey, k.Constraints); err != nil {
	return nil, err
	}
	return addedKey, nil
	}

	func parseECDSACert(req []byte) (*AddedKey, error) {
	var k ecdsaCertMsg
	if err := ssh.Unmarshal(req, &k); err != nil {
	return nil, err
	}

	pubKey, err := ssh.ParsePublicKey(k.CertBytes)
	if err != nil {
	return nil, err
	}
	cert, ok := pubKey.(*ssh.Certificate)
	if !ok {
	return nil, errors.New("agent: bad ECDSA certificate")
	}

	// An ECDSA publickey as marshaled by ecdsaPublicKey.Marshal() in keys.go
	var ecdsaPub struct {
	Name string
	ID string
	Key []byte
	}
	if err := ssh.Unmarshal(cert.Key.Marshal(), &ecdsaPub); err != nil {
	return nil, err
	}

	priv, err := unmarshalECDSA(ecdsaPub.ID, ecdsaPub.Key, k.D)
	if err != nil {
	return nil, err
	}

	addedKey := &AddedKey{PrivateKey: priv, Certificate: cert, Comment: k.Comments}
	if err := setConstraints(addedKey, k.Constraints); err != nil {
	return nil, err
	}
	return addedKey, nil
	}

	func (s *server) insertIdentity(req []byte) error {
	var record struct {
	Type string `sshtype:"17\|25"`
	Rest []byte `ssh:"rest"`
	}

	if err := ssh.Unmarshal(req, &record); err != nil {
	return err
	}

	var addedKey *AddedKey
	var err error

	switch record.Type {
	case ssh.KeyAlgoRSA:
	addedKey, err = parseRSAKey(req)
	case ssh.KeyAlgoDSA:
	addedKey, err = parseDSAKey(req)
	case ssh.KeyAlgoECDSA256, ssh.KeyAlgoECDSA384, ssh.KeyAlgoECDSA521:
	addedKey, err = parseECDSAKey(req)
	case ssh.KeyAlgoED25519:
	addedKey, err = parseEd25519Key(req)
	case ssh.CertAlgoRSAv01:
	addedKey, err = parseRSACert(req)
	case ssh.CertAlgoDSAv01:
	addedKey, err = parseDSACert(req)
	case ssh.CertAlgoECDSA256v01, ssh.CertAlgoECDSA384v01, ssh.CertAlgoECDSA521v01:
	addedKey, err = parseECDSACert(req)
	case ssh.CertAlgoED25519v01:
	addedKey, err = parseEd25519Cert(req)
	default:
	return fmt.Errorf("agent: not implemented: %q", record.Type)
	}

	if err != nil {
	return err
	}
	return s.agent.Add(*addedKey)
	}

	// ServeAgent serves the agent protocol on the given connection. It
	// returns when an I/O error occurs.
	func ServeAgent(agent Agent, c io.ReadWriter) error {
	s := &server{agent}

	var length [4]byte
	for {
	if _, err := io.ReadFull(c, length[:]); err != nil {
	return err
	}
	l := binary.BigEndian.Uint32(length[:])
	if l == 0 {
	return fmt.Errorf("agent: request size is 0")
	}
	if l > maxAgentResponseBytes {
	// We also cap requests.
	return fmt.Errorf("agent: request too large: %d", l)
	}

	req := make([]byte, l)
	if _, err := io.ReadFull(c, req); err != nil {
	return err
	}

	repData := s.processRequestBytes(req)
	if len(repData) > maxAgentResponseBytes {
	return fmt.Errorf("agent: reply too large: %d bytes", len(repData))
	}

	binary.BigEndian.PutUint32(length[:], uint32(len(repData)))
	if _, err := c.Write(length[:]); err != nil {
	return err
	}
	if _, err := c.Write(repData); err != nil {
	return err
	}
	}
	}