WIP: ssh-agent: Implement destination constraints

[kgraefe]

This change implements loading ssh-agent destination constraints from KeeAgent.settings into the ssh-agent. For now there is no UI so configuration must be done in KeePass2/KeeAgent.

The ssh-agent constrain extension is described at 1. However, I found it partly misleading:

• in the constaint array each constraint is enveloped where in the keyspec arrays the keyspec are just appended to the constraint.
• each constraint and host has an additional string field reserved for future use. The actual structure has been obtained from openssh ssh-add source code 2.

TODO:

• GUI
• Test against a SSH host with host key signed by a CA
• Update this PR message

Fixes #9801

Screenshots

Testing strategy

Type of change

• ✅ New feature (change that adds functionality)

[droidmonkey]

What does this actually do / why does this matter?

[kgraefe]

What does this actually do / why does this matter?

It allows restricting access to the SSH agent when forwarded another host.

Let's say I ssh into a development machine on a client side client-dev and I need to forward the agent to access client's Git server client-git. Without the restriction an admin on the dev machine could use my forwarded agent to ssh into my Github account. With the restriction I can configure the SSH agent forwarded to client-dev to only sign requests from client-git and to disallow signing request from everything else.

Currently I'm using multiple SSH agents with different keys per client. But that's cumbersome and of course it's not supported by KeepassXC so it prevents me from keeping my SSH keys in KeepassXC.

see also the specification

[droidmonkey]

Does does the ca in "is_ca" refer to Certificate Authority?

[kgraefe]

Does does the ca in "is_ca" refer to Certificate Authority?

yes. I have not done this myself but apparently instead of relying on long-living host keys that are manually confirmed on first contact, you can use short-living host keys that are signed by a CA. In order to verify the host key you need the CA's public key. So if is_ca == true the keyblob does not contain the host key but the CA key.

[kgraefe]

CI fails because openssh-client in Ubuntu 18.04 is too old and does not support destination constraints (requires OpenSSH 8.9, has 8.2). :-\ In general it is the desired behavior to fail instead of loading the key without the constraints in place.

However, how should I proceed with this? I can think of either

• omitting the tests or somehow guard them against the SSH client version,
• updating the Docker container to Ubuntu 22.04 LTS or
• manually install newer openssh-client into the Docker container.