跳到主要内容

8. 协议编号 (Protocol Numbers)

第 8 节的协议编号表原样保留如下. 这些表定义 SSH Agent Protocol 中客户端到 agent 的请求消息类型编号、agent 到客户端的响应消息类型编号、保留消息编号、密钥约束标识符和签名标志.

表中的 SSH_AGENTC_* 名称表示客户端发往 agent 的请求消息, SSH_AGENT_* 名称表示 agent 返回客户端的响应消息. 数字值属于线上协议常量, 必须按表中数值编码和解析, 不应翻译或重新分配. 保留范围用于旧版 SSH protocol version 1、消息编号 0 和 Private Use 扩展.

约束标识符只在密钥约束中使用, 不作为消息编号发送. 签名标志出现在 SSH_AGENTC_SIGN_REQUEST 消息中, 通过对零个或多个标志进行逻辑 OR 形成位字段. 实现者应区分"消息类型编号"、"约束标识符"和"签名标志", 不能把这些数值空间混用.

解析实现应先读取 packet length 和 message type, 再按对应消息结构解释后续字段. 如果接收到未知 message type, 应按本协议的错误处理逻辑返回失败或忽略扩展, 不能把未知编号自动映射到私有扩展. 对 240-255 的 Private Use 范围, 只有双方明确约定语义时才可使用, 通用实现不应把这些值作为标准消息暴露给用户.

签名 flag 的值是位掩码而不是连续编号. 因此, 0x00000002 和 0x00000004 可以组合, 但保留值 1 不应被重新解释. 约束编号 255 表示进入扩展约束名称空间, 与 message number 255 的 Private Use 含义不同; 实现时最好在代码中使用不同枚举或类型, 以降低误用风险.

以下 text 块保留 RFC 原始表格和周边文字. 表格中的常量、编号、十六进制值和规范性关键词用于精确实现, 因此不翻译; 上文中文说明用于帮助读者理解这些值所属的编号空间.

8.  Protocol Numbers

8.1.  Message Type Numbers

   The following numbers are used as message types for requests from the
   client to the agent.

             +------------------------------------------+----+
             | SSH_AGENTC_REQUEST_IDENTITIES            | 11 |
             +------------------------------------------+----+
             | SSH_AGENTC_SIGN_REQUEST                  | 13 |
             +------------------------------------------+----+
             | SSH_AGENTC_ADD_IDENTITY                  | 17 |
             +------------------------------------------+----+
             | SSH_AGENTC_REMOVE_IDENTITY               | 18 |
             +------------------------------------------+----+
             | SSH_AGENTC_REMOVE_ALL_IDENTITIES         | 19 |
             +------------------------------------------+----+
             | SSH_AGENTC_ADD_SMARTCARD_KEY             | 20 |
             +------------------------------------------+----+
             | SSH_AGENTC_REMOVE_SMARTCARD_KEY          | 21 |
             +------------------------------------------+----+
             | SSH_AGENTC_LOCK                          | 22 |
             +------------------------------------------+----+
             | SSH_AGENTC_UNLOCK                        | 23 |
             +------------------------------------------+----+
             | SSH_AGENTC_ADD_ID_CONSTRAINED            | 25 |
             +------------------------------------------+----+
             | SSH_AGENTC_ADD_SMARTCARD_KEY_CONSTRAINED | 26 |
             +------------------------------------------+----+
             | SSH_AGENTC_EXTENSION                     | 27 |
             +------------------------------------------+----+

                                  Table 1

   The following numbers are used as message types for replies from the
   agent to the client.

                   +------------------------------+----+
                   | SSH_AGENT_FAILURE            | 5  |
                   +------------------------------+----+
                   | SSH_AGENT_SUCCESS            | 6  |
                   +------------------------------+----+
                   | SSH_AGENT_IDENTITIES_ANSWER  | 12 |
                   +------------------------------+----+
                   | SSH_AGENT_SIGN_RESPONSE      | 14 |
                   +------------------------------+----+
                   | SSH_AGENT_EXTENSION_FAILURE  | 28 |
                   +------------------------------+----+
                   | SSH_AGENT_EXTENSION_RESPONSE | 29 |
                   +------------------------------+----+

                                  Table 2

8.1.1.  Reserved Message Type Numbers

   The following message type numbers are reserved for implementations
   that implement support for the legacy SSH protocol version 1: 1-4,
   7-10, 15-16, and 24 (inclusive).  These message numbers MAY be used
   by an implementation supporting the legacy protocol but MUST NOT be
   reused otherwise.

   Message number 0 is also reserved and MUST NOT be used.

   The range of message numbers 240-255 is reserved for Private Use
   extensions to the agent protocol and MUST NOT be used by generic
   implementations (see [RFC8126] for more information on Private Use).

8.2.  Constraint Identifiers

   The following numbers are used to identify key constraints.  These
   are only used in key constraints and are not sent as message numbers.

                  +-------------------------------+-----+
                  | SSH_AGENT_CONSTRAIN_LIFETIME  | 1   |
                  +-------------------------------+-----+
                  | SSH_AGENT_CONSTRAIN_CONFIRM   | 2   |
                  +-------------------------------+-----+
                  | SSH_AGENT_CONSTRAIN_EXTENSION | 255 |
                  +-------------------------------+-----+

                                  Table 3

   The constraint identifier 0 is reserved.

8.3.  Signature Flags

   The following numbers may be present in signature request
   (SSH_AGENTC_SIGN_REQUEST) messages.  These flags form a bit field by
   taking the logical OR of zero or more flags.

                  +------------------------+------------+
                  | SSH_AGENT_RSA_SHA2_256 | 0x00000002 |
                  +------------------------+------------+
                  | SSH_AGENT_RSA_SHA2_512 | 0x00000004 |
                  +------------------------+------------+

                                  Table 4

   The flag value 1 is reserved for historical implementations.
最后于 更新