#	$OpenBSD: agent.sh,v 1.26 2026/06/15 06:36:52 djm Exp $
#	Placed in the Public Domain.

tid="simple agent test"
> $OBJ/ssh-add.log

# cross-project configuration
if test "$sshd_type" != "pkix" ; then
	for t in '' d ; do
		mv $OBJ/ssh${t}_proxy $OBJ/ssh${t}_proxy.orig
		(
		grep -v "PubkeyAcceptedAlgorithms"  $OBJ/ssh${t}_proxy.orig
		echo "PubkeyAcceptedAlgorithms *,ssh-dss*"
		) > $OBJ/ssh${t}_proxy
	done
fi


SSH_AUTH_SOCK=/nonexistent ${SSHADD} -l > /dev/null 2>&1
if [ $? -ne 2 ]; then
	fail "ssh-add -l did not fail with exit code 2"
fi

trace "start agent, args ${EXTRA_AGENT_ARGS} -s"
eval `${SSHAGENT} ${EXTRA_AGENT_ARGS} -s` > /dev/null
r=$?
if [ $r -ne 0 ]; then
	fatal "could not start ssh-agent: exit code $r"
fi

eval `${SSHAGENT} ${EXTRA_AGENT_ARGS} -s | sed 's/SSH_/FW_SSH_/g'` > /dev/null
r=$?
if [ $r -ne 0 ]; then
	fatal "could not start second ssh-agent: exit code $r"
fi

${SSHADD} -l > /dev/null 2>&1
if [ $? -ne 1 ]; then
	fail "ssh-add -l did not fail with exit code 1"
fi

rm -f $OBJ/user_ca_key $OBJ/user_ca_key.pub
${SSHKEYGEN} -q -N '' -t ed25519 -f $OBJ/user_ca_key \
	|| fatal "ssh-keygen failed"

trace "overwrite authorized keys"
printf '' > $OBJ/authorized_keys_$USER

for t in $SSH_KEYTYPES ; do
	# generate user key for agent
	AK=$OBJ/agent-key.$t
	rm -f $AK*
	${SSHKEYGEN} -q -N '' -t $t -f $AK ||\
		 fatal "ssh-keygen for $t failed"
	# Make a certificate for each too.
	custom_cert=`has_custom_cert $t`
	if $custom_cert ; then
	${SSHKEYGEN} -qs $OBJ/user_ca_key -I "$t cert" \
		-n estragon $AK.pub || fatal "$t ca sign failed"
	fi

	# add to authorized keys
	cat $AK.pub >> $OBJ/authorized_keys_$USER
	# add private key to agent
	${SSHADD} -vvv $AK >>$OBJ/ssh-add.log 2>&1
	r=$?
	if [ $r -ne 0 ]; then
		fail "add $t key to first agent failed, exit code $r"
	fi
	# add private key to second agent
	SSH_AUTH_SOCK=$FW_SSH_AUTH_SOCK ${SSHADD} $AK > /dev/null 2>&1
	r=$?
	if [ $r -ne 0 ]; then
		fail "add $t key to second agent failed, exit code $r"
	fi
	# Move private key to ensure that we aren't accidentally using it.
	# Keep the corresponding public keys/certs around for later use.
	mv -f $AK $AK-private
	cp -f $AK.pub $AK-private.pub
	$custom_cert && \
	cp -f $AK-cert.pub $AK-private-cert.pub
done

# Remove explicit identity directives from ssh_proxy
mv $OBJ/ssh_proxy $OBJ/ssh_proxy_bak
grep -vi identityfile $OBJ/ssh_proxy_bak > $OBJ/ssh_proxy

${SSHADD} -l > /dev/null 2>&1
r=$?
if [ $r -ne 0 ]; then
	fail "ssh-add -l failed: exit code $r"
fi
# the same for full pubkey output
${SSHADD} -L > /dev/null 2>&1
r=$?
if [ $r -ne 0 ]; then
	fail "ssh-add -L failed: exit code $r"
fi

trace "simple connect via agent"
${SSH} -F $OBJ/ssh_proxy somehost exit 52
r=$?
if [ $r -ne 52 ]; then
	fail "ssh connect with failed (exit code $r)"
fi

for t in $SSH_KEYTYPES ; do
	trace "connect via agent using $t key"
	AK=$OBJ/agent-key.$t
	${SSH} -F $OBJ/ssh_proxy -i $AK.pub -oIdentitiesOnly=yes \
		somehost exit 52
	r=$?
	if [ $r -ne 52 ]; then
		fail "ssh connect with $t failed (exit code $r)"
	fi
done

trace "agent forwarding"
${SSH} -A -F $OBJ/ssh_proxy somehost ${SSHADD} -l > /dev/null 2>&1
r=$?
if [ $r -ne 0 ]; then
	fail "ssh-add -l via agent fwd failed (exit code $r)"
fi
${SSH} "-oForwardAgent=$SSH_AUTH_SOCK" -F $OBJ/ssh_proxy somehost ${SSHADD} -l > /dev/null 2>&1
r=$?
if [ $r -ne 0 ]; then
	fail "ssh-add -l via agent path fwd failed (exit code $r)"
fi
${SSH} -A -F $OBJ/ssh_proxy somehost \
	"${SSH} -F $OBJ/ssh_proxy somehost exit 52"
r=$?
if [ $r -ne 52 ]; then
	fail "agent fwd failed (exit code $r)"
fi

trace "agent forwarding different agent"
${SSH} "-oForwardAgent=$FW_SSH_AUTH_SOCK" -F $OBJ/ssh_proxy somehost ${SSHADD} -l > /dev/null 2>&1
r=$?
if [ $r -ne 0 ]; then
	fail "ssh-add -l via agent path fwd of different agent failed (exit code $r)"
fi
${SSH} '-oForwardAgent=$FW_SSH_AUTH_SOCK' -F $OBJ/ssh_proxy somehost ${SSHADD} -l > /dev/null 2>&1
r=$?
if [ $r -ne 0 ]; then
	fail "ssh-add -l via agent path env fwd of different agent failed (exit code $r)"
fi

# Remove keys from forwarded agent, ssh-add on remote machine should now fail.
SSH_AUTH_SOCK=$FW_SSH_AUTH_SOCK ${SSHADD} -D > /dev/null 2>&1
r=$?
if [ $r -ne 0 ]; then
	fail "ssh-add -D failed: exit code $r"
fi
${SSH} '-oForwardAgent=$FW_SSH_AUTH_SOCK' -F $OBJ/ssh_proxy somehost ${SSHADD} -l > /dev/null 2>&1
r=$?
if [ $r -ne 1 ]; then
	fail "ssh-add -l with different agent did not fail with exit code 1 (exit code $r)"
fi

(printf 'cert-authority,principals="estragon" '; cat $OBJ/user_ca_key.pub) \
	> $OBJ/authorized_keys_$USER
for t in $SSH_KEYTYPES ; do
	custom_cert=`has_custom_cert $t`
	$custom_cert || continue
	trace "connect via agent using $t key"
	AK=$OBJ/agent-key.$t
	${SSH} -F $OBJ/ssh_proxy -i $AK.pub \
		-oCertificateFile=$AK-cert.pub \
		-oIdentitiesOnly=yes somehost exit 52
	r=$?
	if [ $r -ne 52 ]; then
		fail "ssh connect with $t failed (exit code $r)"
	fi
done

## Deletion tests.

trace "delete all agent keys using -D"
${SSHADD} -D > /dev/null 2>&1
r=$?
if [ $r -ne 0 ]; then
	fail "ssh-add -D failed: exit code $r"
fi
# make sure they're gone
${SSHADD} -l > /dev/null 2>&1
r=$?
if [ $r -ne 1 ]; then
	fail "ssh-add -l returned unexpected exit code: $r"
fi
trace "readd keys"
# re-add keys/certs to agent
for t in $SSH_KEYTYPES ; do
	AK=$OBJ/agent-key.$t
	${SSHADD} -vvv $AK-private >>$OBJ/ssh-add.log 2>&1 || \
		fail "add $t key to agent failed, exit code $?"
done
# make sure they are there
${SSHADD} -l > /dev/null 2>&1
r=$?
if [ $r -ne 0 ]; then
	fail "ssh-add -l failed: exit code $r"
fi

trace "delete all agent keys using SIGUSR1"
kill -s USR1 $SSH_AGENT_PID
r=$?
if [ $r -ne 0 ]; then
	fail "kill -s USR1 failed: exit code $r"
fi
# make sure they're gone
${SSHADD} -l > /dev/null 2>&1
r=$?
if [ $r -ne 1 ]; then
	fail "ssh-add -l returned unexpected exit code: $r"
fi
# re-add keys/certs to agent
for t in $SSH_KEYTYPES ; do
	AK=$OBJ/agent-key.$t
	${SSHADD} $AK-private >/dev/null 2>&1 || \
		fail "add $t key to agent failed, exit code $?"
done
# make sure they are there
${SSHADD} -l > /dev/null 2>&1
r=$?
if [ $r -ne 0 ]; then
	fail "ssh-add -l failed: exit code $r"
fi

check_key_absent() {
	${SSHADD} -L | grep "^$1 " >/dev/null
	if [ $? -eq 0 ]; then
		fail "$1 key unexpectedly present"
	fi
}
check_key_present() {
	${SSHADD} -L | grep "^$1 " >/dev/null
	if [ $? -ne 0 ]; then
		fail "$1 key missing from agent"
	fi
}

# delete the ed25519 key
AK=$OBJ/agent-key.ssh-ed25519
trace "delete single key by file"
${SSHADD} -qdk $AK || fail "ssh-add -d ed25519 failed"
check_key_absent ssh-ed25519
check_key_present ssh-ed25519-cert-v01@openssh.com
# Put key/cert back.
${SSHADD} $AK-private >/dev/null 2>&1 || \
	fail "ssh-add failed exit code $?"
check_key_present ssh-ed25519
# Delete both key and certificate.
trace "delete key/cert by file"
${SSHADD} -qd $AK || fail "ssh-add -d ed25519 failed"
check_key_absent ssh-ed25519
check_key_absent ssh-ed25519-cert-v01@openssh.com
# Put key/cert back.
${SSHADD} $AK-private >/dev/null 2>&1 || \
	fail "ssh-add failed exit code $?"
check_key_present ssh-ed25519
# Delete certificate via stdin
${SSHADD} -qd - < $AK-cert.pub || fail "ssh-add -d - failed"
check_key_present ssh-ed25519
check_key_absent ssh-ed25519-cert-v01@openssh.com
# Delete key via stdin
${SSHADD} -qd - < $AK.pub || fail "ssh-add -d - failed"
check_key_absent ssh-ed25519
check_key_absent ssh-ed25519-cert-v01@openssh.com

trace "kill agent"
${SSHAGENT} -k > /dev/null
SSH_AGENT_PID=$FW_SSH_AGENT_PID ${SSHAGENT} -k > /dev/null
