[BEEEP|PM27032] Clean ssh agent rewrite

apps/desktop/desktop_native/Cargo.toml

@@ -8,6 +8,7 @@ members = [
     "napi",
     "process_isolation",
     "proxy",
+    "ssh_agent",
     "windows_plugin_authenticator"
 ]
 
@@ -55,7 +56,7 @@ security-framework = "=3.5.0"
 security-framework-sys = "=2.15.0"
 serde = "=1.0.209"
 serde_json = "=1.0.127"
-sha2 = "=0.10.8"
+sha2 = "=0.10.9"
 simplelog = "=0.12.2"
 ssh-encoding = "=0.2.0"
 ssh-key = { version = "=0.6.7", default-features = false }

apps/desktop/desktop_native/core/Cargo.toml

@@ -55,6 +55,20 @@ tracing = { workspace = true }
 typenum = { workspace = true }
 zeroizing-alloc = { workspace = true }
 
+[target.'cfg(target_os = "linux")'.dependencies]
+ashpd = { workspace = true }
+libc = { workspace = true }
+oo7 = { workspace = true }
+
+zbus = { workspace = true, optional = true }
+zbus_polkit = { workspace = true, optional = true }
+
+[target.'cfg(target_os = "macos")'.dependencies]
+core-foundation = { workspace = true, optional = true }
+desktop_objc = { path = "../objc" }
+security-framework = { workspace = true, optional = true }
+security-framework-sys = { workspace = true, optional = true }
+
 [target.'cfg(windows)'.dependencies]
 widestring = { workspace = true, optional = true }
 windows = { workspace = true, features = [
@@ -74,19 +88,5 @@ windows-future = { workspace = true }
 [target.'cfg(windows)'.dev-dependencies]
 keytar = { workspace = true }
 
-[target.'cfg(target_os = "macos")'.dependencies]
-core-foundation = { workspace = true, optional = true }
-security-framework = { workspace = true, optional = true }
-security-framework-sys = { workspace = true, optional = true }
-desktop_objc = { path = "../objc" }
-
-[target.'cfg(target_os = "linux")'.dependencies]
-oo7 = { workspace = true }
-libc = { workspace = true }
-ashpd = { workspace = true }
-
-zbus = { workspace = true, optional = true }
-zbus_polkit = { workspace = true, optional = true }
-
 [lints]
 workspace = true

apps/desktop/desktop_native/napi/Cargo.toml

@@ -24,6 +24,7 @@ napi = { workspace = true, features = ["async"] }
 napi-derive = { workspace = true }
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }
+ssh_agent = { path = "../ssh_agent" }
 tokio = { workspace = true }
 tokio-stream = { workspace = true }
 tokio-util = { workspace = true }

apps/desktop/desktop_native/napi/index.d.ts

@@ -236,3 +236,29 @@ export declare namespace autotype {
   export function getForegroundWindowTitle(): string
   export function typeInput(input: Array<number>, keyboardShortcut: Array<string>): void
 }
+export declare namespace sshagent_v2 {
+  export interface PrivateKey {
+    privateKey: string
+    name: string
+    cipherId: string
+  }
+  export interface SshKey {
+    privateKey: string
+    publicKey: string
+    keyFingerprint: string
+  }
+  export interface SshUiRequest {
+    cipherId?: string
+    isList: boolean
+    processName: string
+    isForwarding: boolean
+    namespace?: string
+  }
+  export function serve(callback: (err: Error | null, arg: SshUiRequest) => any): Promise<SshAgentState>
+  export function stop(agentState: SshAgentState): void
+  export function isRunning(agentState: SshAgentState): boolean
+  export function setKeys(agentState: SshAgentState, newKeys: Array<PrivateKey>): void
+  export function lock(agentState: SshAgentState): void
+  export function clearKeys(agentState: SshAgentState): void
+  export class SshAgentState {   }
+}

apps/desktop/desktop_native/napi/src/lib.rs

@@ -1053,3 +1053,194 @@ pub mod autotype {
         })
     }
 }
+
+#[napi]
+pub mod sshagent_v2 {
+    use std::sync::Arc;
+
+    use napi::{
+        bindgen_prelude::Promise,
+        threadsafe_function::{ErrorStrategy::CalleeHandled, ThreadsafeFunction},
+    };
+    use ssh_agent::agent::{ui_requester, PlatformListener};
+    use ssh_agent::{
+        self,
+        agent::{ui_requester::UiRequestMessage, BitwardenDesktopAgent},
+        memory::UnlockedSshItem,
+        protocol::types::KeyPair,
+    };
+    use tokio::{self, sync::Mutex};
+    use tracing::{error, info};
+
+    #[napi]
+    pub struct SshAgentState {
+        agent: BitwardenDesktopAgent,
+    }
+
+    #[napi(object)]
+    pub struct PrivateKey {
+        pub private_key: String,
+        pub name: String,
+        pub cipher_id: String,
+    }
+
+    #[napi(object)]
+    pub struct SshKey {
+        pub private_key: String,
+        pub public_key: String,
+        pub key_fingerprint: String,
+    }
+
+    #[napi(object)]
+    pub struct SshUIRequest {
+        pub cipher_id: Option<String>,
+        pub is_list: bool,
+        pub process_name: String,
+        pub is_forwarding: bool,
+        pub namespace: Option<String>,
+    }
+
+    #[allow(clippy::unused_async)] // FIXME: Remove unused async!
+    #[napi]
+    pub async fn serve(
+        callback: ThreadsafeFunction<SshUIRequest, CalleeHandled>,
+    ) -> napi::Result<SshAgentState> {
+        let (auth_request_tx, mut auth_request_rx) =
+            tokio::sync::mpsc::channel::<ssh_agent::agent::ui_requester::UiRequestMessage>(32);
+        let (auth_response_tx, auth_response_rx) =
+            tokio::sync::broadcast::channel::<(u32, bool)>(32);
+        let auth_response_tx_arc = Arc::new(Mutex::new(auth_response_tx));
+        let ui_requester =
+            ui_requester::UiRequester::new(auth_request_tx, Arc::new(Mutex::new(auth_response_rx)));
+
+        tokio::spawn(async move {
+            let _ = ui_requester;
+
+            while let Some(request) = auth_request_rx.recv().await {
+                let cloned_response_tx_arc = auth_response_tx_arc.clone();
+                let cloned_callback = callback.clone();
+                tokio::spawn(async move {
+                    let auth_response_tx_arc = cloned_response_tx_arc;
+                    let callback = cloned_callback;
+
+                    let js_request = match request.clone() {
+                        UiRequestMessage::ListRequest {
+                            request_id: _,
+                            connection_info,
+                        } => SshUIRequest {
+                            cipher_id: None,
+                            is_list: true,
+                            process_name: connection_info.peer_info().process_name().to_string(),
+                            is_forwarding: connection_info.is_forwarding(),
+                            namespace: None,
+                        },
+                        UiRequestMessage::AuthRequest {
+                            request_id: _,
+                            connection_info,
+                            cipher_id,
+                        } => SshUIRequest {
+                            cipher_id: Some(cipher_id),
+                            is_list: false,
+                            process_name: connection_info.peer_info().process_name().to_string(),
+                            is_forwarding: connection_info.is_forwarding(),
+                            namespace: None,
+                        },
+                        UiRequestMessage::SignRequest {
+                            request_id: _,
+                            connection_info,
+                            cipher_id,
+                            namespace,
+                        } => SshUIRequest {
+                            cipher_id: Some(cipher_id),
+                            is_list: false,
+                            process_name: connection_info.peer_info().process_name().to_string(),
+                            is_forwarding: connection_info.is_forwarding(),
+                            namespace: Some(namespace),
+                        },
+                    };
+
+                    let promise_result: Result<Promise<bool>, napi::Error> =
+                        callback.call_async(Ok(js_request)).await;
+                    match promise_result {
+                        Ok(promise_result) => match promise_result.await {
+                            Ok(result) => {
+                                let _ = auth_response_tx_arc
+                                    .lock()
+                                    .await
+                                    .send((request.id(), result))
+                                    .expect("should be able to send auth response to agent");
+                            }
+                            Err(e) => {
+                                error!(error = %e, "Calling UI callback promise was rejected");
+                                let _ = auth_response_tx_arc
+                                    .lock()
+                                    .await
+                                    .send((request.id(), false))
+                                    .expect("should be able to send auth response to agent");
+                            }
+                        },
+                        Err(e) => {
+                            error!(error = %e, "Calling UI callback could not create promise");
+                            let _ = auth_response_tx_arc
+                                .lock()
+                                .await
+                                .send((request.id(), false))
+                                .expect("should be able to send auth response to agent");
+                        }
+                    }
+                });
+            }
+        });
+
+        let agent = BitwardenDesktopAgent::new(ui_requester);
+        let agent_copy = agent.clone();
+        PlatformListener::spawn_listeners(agent_copy);
+
+        Ok(SshAgentState { agent })
+    }
+
+    #[napi]
+    pub fn stop(agent_state: &mut SshAgentState) -> napi::Result<()> {
+        info!("Stopping SSH Agent");
+        agent_state.agent.stop();
+        Ok(())
+    }
+
+    #[napi]
+    pub fn is_running(agent_state: &mut SshAgentState) -> bool {
+        agent_state.agent.is_running()
+    }
+
+    #[napi]
+    pub fn set_keys(
+        agent_state: &mut SshAgentState,
+        new_keys: Vec<PrivateKey>,
+    ) -> napi::Result<()> {
+        agent_state.agent.set_keys(
+            new_keys
+                .iter()
+                .filter_map(|k| {
+                    let private_key =
+                        ssh_agent::protocol::types::PrivateKey::try_from(k.private_key.clone())
+                            .ok()?;
+                    Some(UnlockedSshItem::new(
+                        KeyPair::new(private_key, k.name.clone()),
+                        k.cipher_id.clone(),
+                    ))
+                })
+                .collect(),
+        );
+        Ok(())
+    }
+
+    #[napi]
+    pub fn lock(agent_state: &mut SshAgentState) -> napi::Result<()> {
+        agent_state.agent.lock();
+        Ok(())
+    }
+
+    #[napi]
+    pub fn clear_keys(agent_state: &mut SshAgentState) -> napi::Result<()> {
+        set_keys(agent_state, vec![])
+    }
+}

apps/desktop/desktop_native/ssh_agent/Cargo.toml

@@ -0,0 +1,54 @@
+[package]
+name = "ssh_agent"
+edition = { workspace = true }
+license = { workspace = true }
+version = { workspace = true }
+publish = { workspace = true }
+
+[features]
+default = ["dep:windows"]
+manual_test = []
+
+[target.'cfg(windows)'.dependencies]
+windows = { workspace = true, features = [
+    "Win32_System_Pipes",
+], optional = true }
+windows-future = { workspace = true }
+
+[dependencies]
+anyhow = { workspace = true }
+base64 = { workspace = true }
+block-padding = { version = "=0.4.0-rc.4" }
+byteorder = { workspace = true }
+bytes = { workspace = true }
+ed25519 = { workspace = true, features = ["pkcs8"] }
+ed25519-dalek = { version = "2.2.0", features = ["rand_core"] }
+futures = { workspace = true }
+homedir = { workspace = true }
+inout = { version = "=0.2.0-rc.6" }
+log = { workspace = true }
+num_enum = "0.7.4"
+p256 = "0.13.2"
+p384 = "0.13.1"
+p521 = "0.13.3"
+pin-project = { workspace = true }
+rsa = { version = "=0.10.0-rc.8", features = ["sha2"] }
+sha2 = "0.10.9"
+signature = "3.0.0-rc.4"
+ssh-encoding = "=0.3.0-rc.2"
+ssh-key = { version = "=0.7.0-rc.3", features = [
+    "encryption",
+    "ed25519",
+    "rsa",
+    "ecdsa",
+    "getrandom",
+] }
+sysinfo = { workspace = true, features = ["windows"] }
+test-log = "0.2.18"
+tokio = { workspace = true, features = ["io-util", "sync", "macros", "net", "full"] }
+tokio-util = { workspace = true, features = ["codec"] }
+tracing = { workspace = true }
+tracing-subscriber.workspace = true
+
+[lints]
+workspace = true