[bug#62461] Additional ssh configuration options.

[bug#62461] Additional ssh configuration options.

[Nicolas Graves via Guix-patches via]

I'm using RDE and wanted to completely migrate RDE's ssh configuration
to Guix, now that the ssh-agent is configured.

It's not that simple, since RDE was using loosely defined alists, so I'm
only contributing options I actually use, in the next patches. 

-- 
Best regards,
Nicolas Graves

[bug#62461] [PATCH 1/3] gnu: home-openssh-configuration: Add field add-keys-to-agent.

[Nicolas Graves via Guix-patches via]

---
 gnu/home/services/ssh.scm | 44 +++++++++++++++++++++++++++++++--------
 1 file changed, 35 insertions(+), 9 deletions(-)

diff --git a/gnu/home/services/ssh.scm b/gnu/home/services/ssh.scm
index 01917a29cd..4ab2adb292 100644
--- a/gnu/home/services/ssh.scm
+++ b/gnu/home/services/ssh.scm
@@ -1,6 +1,7 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2022 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2023 Janneke Nieuwenhuizen <janneke@gnu.org>
+;;; Copyright © 2023 Nicolas Graves <ngraves@ngraves.fr>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -39,6 +40,7 @@ (define-module (gnu home services ssh)
             home-openssh-configuration-authorized-keys
             home-openssh-configuration-known-hosts
             home-openssh-configuration-hosts
+            home-openssh-configuration-add-keys-to-agent
             home-ssh-agent-configuration
 
             openssh-host
@@ -185,17 +187,41 @@ (define (openssh-host-name-field? field)
 (define-record-type* <home-openssh-configuration>
   home-openssh-configuration make-home-openssh-configuration
   home-openssh-configuration?
-  (authorized-keys home-openssh-configuration-authorized-keys ;list of file-like
-                   (default '()))
-  (known-hosts     home-openssh-configuration-known-hosts ;unspec | list of file-like
-                   (default *unspecified*))
-  (hosts           home-openssh-configuration-hosts   ;list of <openssh-host>
-                   (default '())))
+  (authorized-keys   home-openssh-configuration-authorized-keys ;list of file-like
+                     (default '()))
+  (known-hosts       home-openssh-configuration-known-hosts ;unspec | list of file-like
+                     (default *unspecified*))
+  (hosts             home-openssh-configuration-hosts   ;list of <openssh-host>
+                     (default '()))
+  (add-keys-to-agent home-openssh-configuration-add-keys-to-agent ;string with limited values
+                     (default "no")))
+
+(define (serialize-add-keys-to-agent value)
+  (define (is-valid-time-string? str)
+    (and (> (string-length str) 0)
+         (eq?
+          (cdr (vector-ref
+                (string-match "\
+[0-9]+|([0-9]+[Ww])?([0-9]+[Dd])?([0-9]+[Hh])?([0-9]+[Mm])?([0-9]+[Ss])?" str)
+                1))
+          (string-length str))))
+
+  (string-append "AddKeysToAgent "
+                 (cond ((member value '("yes" "no" "confirm" "ask")) value)
+                       ((is-valid-time-string? value) value)
+                       ((and (string-prefix? "confirm" value)
+                             (is-valid-time-string?
+                              (cdr (string-split value #\ )))) value)
+                       ;; The 'else' branch is unreachable.
+                       (else (raise (condition (&error)))))))
 
 (define (openssh-configuration->string config)
-  (string-join (map serialize-openssh-host
-                    (home-openssh-configuration-hosts config))
-               "\n"))
+  (string-join
+   (cons* (serialize-add-keys-to-agent
+           (home-openssh-configuration-add-keys-to-agent config))
+          (map serialize-openssh-host
+               (home-openssh-configuration-hosts config)))
+   "\n"))
 
 (define* (file-join name files #:optional (delimiter " "))
   "Return a file in the store called @var{name} that is the concatenation
-- 
2.39.2

[bug#62461] [PATCH 2/3] gnu: openssh-host: Add option match-criteria.

[Nicolas Graves via Guix-patches via]

---
 gnu/home/services/ssh.scm | 49 ++++++++++++++++++++++++++++++++++-----
 1 file changed, 43 insertions(+), 6 deletions(-)

diff --git a/gnu/home/services/ssh.scm b/gnu/home/services/ssh.scm
index 4ab2adb292..0bd79e4322 100644
--- a/gnu/home/services/ssh.scm
+++ b/gnu/home/services/ssh.scm
@@ -45,6 +45,7 @@ (define-module (gnu home services ssh)
 
             openssh-host
             openssh-host-host-name
+            openssh-host-match-criteria
             openssh-host-identity-file
             openssh-host-name
             openssh-host-port
@@ -116,13 +117,39 @@ (define (serialize-string-list field lst)
 
 (define-maybe string-list)
 
+(define ssh-match-keywords
+  '("canonical" "final" "exec" "host" "originalhost" "user" "localuser"))
+
+(define (match-criteria? str)
+  ;; Rule out the case of "all" keyword.
+  (if (member str '("all"
+                    "canonical all"
+                    "final all"))
+      #t
+      (let* ((first (string-take str (string-index str #\ )))
+             (keyword (if (string-prefix? "!" first)
+                          (string-drop first 1)
+                          first)))
+        (member keyword ssh-match-keywords))))
+
+(define-maybe match-criteria)
+
 (define-configuration openssh-host
   (name
-   (string)
-   "Name of this host declaration.")
+   maybe-string
+   "Name of this host declaration.  A @code{openssh-host} must define only
+@code{name} or @code{match-criteria}.  Use host-name \"*\" for top-level
+options.")
   (host-name
    maybe-string
    "Host name---e.g., @code{\"foo.example.org\"} or @code{\"192.168.1.2\"}.")
+  (match-criteria ;TODO implement stricter match-criteria rules
+   maybe-match-criteria
+   "A string where the first element is all or one of
+@code{ssh-match-keywords}.  The rest of the elements are arguments for the
+keyword, or other criteria.  A @code{openssh-host} must define only
+@code{name} or @code{match-criteria}.  Other host configuration options will
+apply to all hosts matching @code{match-criteria}.")
   (address-family
    maybe-address-family
    "Address family to use when connecting to this host: one of
@@ -171,17 +198,27 @@ (define-configuration openssh-host
 @file{~/.ssh/config}."))
 
 (define (serialize-openssh-host config)
-  (define (openssh-host-name-field? field)
-    (eq? (configuration-field-name field) 'name))
+  (define (openssh-host-name-or-match-field? field)
+    (or (eq? (configuration-field-name field) 'name)
+        (eq? (configuration-field-name field) 'match-criteria)))
 
   (string-append
-   "Host " (openssh-host-name config) "\n"
+   (if (maybe-value-set? (openssh-host-name config))
+       (if (maybe-value-set? (openssh-host-match-criteria config))
+           (error
+            "You must either define name or match-criteria, not both.")
+           (string-append "Host " (openssh-host-name config) "\n"))
+       (if (maybe-value-set? (openssh-host-match-criteria config))
+           (string-append
+            "Match " (string-join (openssh-host-match-criteria config) " ") "\n")
+           (error
+            "You must either define name or match-criteria once.")))
    (string-concatenate
     (map (lambda (field)
            ((configuration-field-serializer field)
             (configuration-field-name field)
             ((configuration-field-getter field) config)))
-         (remove openssh-host-name-field?
+         (remove openssh-host-name-or-match-field?
                  openssh-host-fields)))))
 
 (define-record-type* <home-openssh-configuration>
-- 
2.39.2

[bug#62461] Additional ssh configuration options.

[Ludovic Courtès]

Nicolas Graves <ngraves@ngraves.fr> skribis:

> ---
>  gnu/home/services/ssh.scm | 49 ++++++++++++++++++++++++++++++++++-----
>  1 file changed, 43 insertions(+), 6 deletions(-)

[...]

> +(define ssh-match-keywords
> +  '("canonical" "final" "exec" "host" "originalhost" "user" "localuser"))

Should it be symbols?

>  (define-configuration openssh-host
>    (name
> -   (string)
> -   "Name of this host declaration.")
> +   maybe-string
> +   "Name of this host declaration.  A @code{openssh-host} must define only
> +@code{name} or @code{match-criteria}.  Use host-name \"*\" for top-level
> +options.")

“Use host name @code{\"*\"} for …”

> +  (match-criteria ;TODO implement stricter match-criteria rules
> +   maybe-match-criteria
> +   "A string where the first element is all or one of
> +@code{ssh-match-keywords}.  The rest of the elements are arguments for the

How about: “When specified, this string denotes the set of hosts to
which the entry applies, superseding the @code{host-name} field.  Its
first element must be all or one of…”

>    (string-append
> -   "Host " (openssh-host-name config) "\n"
> +   (if (maybe-value-set? (openssh-host-name config))
> +       (if (maybe-value-set? (openssh-host-match-criteria config))
> +           (error
> +            "You must either define name or match-criteria, not both.")
> +           (string-append "Host " (openssh-host-name config) "\n"))
> +       (if (maybe-value-set? (openssh-host-match-criteria config))
> +           (string-append
> +            "Match " (string-join (openssh-host-match-criteria config) " ") "\n")
> +           (error
> +            "You must either define name or match-criteria once.")))

Please report errors as lowercase messages with:

  (raise (formatted-message (G_ "…") …))

You can also use ‘&fix-hint’ to provide an additional hint, if needed.

Ludo’.

[bug#62461] Additional ssh configuration options.

[Nicolas Graves via Guix-patches via]

On 2023-04-01 09:59, Ludovic Courtès wrote:

>> +(define ssh-match-keywords
>> +  '("canonical" "final" "exec" "host" "originalhost" "user" "localuser"))
>
> Should it be symbols?

Could be. But we would then need a conversion from string to symbol
because the original match string which is split can include
spaces. Will switch if it doesn't introduce more complexity. 

Thanks for your other remarks, I'll take them into account and send a
new version.

-- 
Best regards,
Nicolas Graves

[bug#62461] [PATCH 3/3] gnu: ssh: Export configuration predicates.

[Nicolas Graves via Guix-patches via]

---
 gnu/home/services/ssh.scm | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/gnu/home/services/ssh.scm b/gnu/home/services/ssh.scm
index 0bd79e4322..a0cff86d61 100644
--- a/gnu/home/services/ssh.scm
+++ b/gnu/home/services/ssh.scm
@@ -41,7 +41,9 @@ (define-module (gnu home services ssh)
             home-openssh-configuration-known-hosts
             home-openssh-configuration-hosts
             home-openssh-configuration-add-keys-to-agent
+            home-openssh-configuration?
             home-ssh-agent-configuration
+            home-ssh-agent-configuration?
 
             openssh-host
             openssh-host-host-name
-- 
2.39.2

[bug#62461] Additional ssh configuration options.

[Ludovic Courtès]

Nicolas Graves <ngraves@ngraves.fr> skribis:

> ---
>  gnu/home/services/ssh.scm | 2 ++
>  1 file changed, 2 insertions(+)

LGTM!

BTW, for each of the first two patches, could you update ‘doc/guix.texi’
accordingly?

Thanks in advance!

Ludo’.

[bug#62461] Additional ssh configuration options.

[Ludovic Courtès]

Hi Nicolas,

Nice work!

Nicolas Graves <ngraves@ngraves.fr> skribis:

> ---
>  gnu/home/services/ssh.scm | 44 +++++++++++++++++++++++++++++++--------
>  1 file changed, 35 insertions(+), 9 deletions(-)

Bonus point if you add a ChangeLog-style commit log.  :-)

> +(define (serialize-add-keys-to-agent value)
> +  (define (is-valid-time-string? str)
> +    (and (> (string-length str) 0)
> +         (eq?
> +          (cdr (vector-ref
> +                (string-match "\
> +[0-9]+|([0-9]+[Ww])?([0-9]+[Dd])?([0-9]+[Hh])?([0-9]+[Mm])?([0-9]+[Ss])?" str)
> +                1))
> +          (string-length str))))

In general please use ‘match’ instead of car/cdr/cadddr (info "(guix)
Data Types and Pattern Matching").

That said, the result of ‘string-match’ is meant to be accessed with
‘match:substring’, not with ‘vector-ref’ (info "(guile) Match
Structures").

Nitpick: you can remove ‘is-’ from the name.

> +  (string-append "AddKeysToAgent "
> +                 (cond ((member value '("yes" "no" "confirm" "ask")) value)
> +                       ((is-valid-time-string? value) value)
> +                       ((and (string-prefix? "confirm" value)
> +                             (is-valid-time-string?
> +                              (cdr (string-split value #\ )))) value)
> +                       ;; The 'else' branch is unreachable.
> +                       (else (raise (condition (&error)))))))

I guess the ‘else’ branch is reachable if one uses the wrong value?
Should it instead be:

  (raise (formatted-message (G_ "~s: invalid 'add-keys-to-agent' value")
                            value))

?

Ludo’.

[bug#62461] [PATCH v2 1/4] gnu: home-openssh-configuration: Add field add-keys-to-agent.

[Nicolas Graves via Guix-patches via]

---
 doc/guix.texi             | 14 +++++++++++++
 gnu/home/services/ssh.scm | 44 +++++++++++++++++++++++++++++++--------
 2 files changed, 49 insertions(+), 9 deletions(-)

diff --git a/doc/guix.texi b/doc/guix.texi
index 5973ea86cc..daefe63074 100644
--- a/doc/guix.texi
+++ b/doc/guix.texi
@@ -42601,6 +42601,20 @@ Concretely, these files are concatenated and made available as
 running on this machine, then it @emph{may} take this file into account:
 this is what @command{sshd} does by default, but be aware that it can
 also be configured to ignore it.
+
+@item @code{add-keys-to-agent} (default: @code{``no''})
+This string specifies whether keys should be automatically added to a
+running ssh-agent.  If this option is set to @code{``yes''} and a key is
+loaded from a file, the key and its passphrase are added to the agent
+with the default lifetime, as if by @code{ssh-add}.  If this option is
+set to @code{``ask''}, @code{ssh} will require confirmation.  If this
+option is set to @code{``confirm''}, each use of the key must be
+confirmed.  If this option is set to @code{``no''}, no keys are added to
+the agent.  Alternately, this option may be specified as a time interval
+to specify the key's lifetime in @code{ssh-agent}, after which it will
+automatically be removed.  The argument must be @code{``no''},
+@code{``yes''}, @code{``confirm''} (optionally followed by a time
+interval), @code{``ask''} or a time interval.
 @end table
 @end deftp
 
diff --git a/gnu/home/services/ssh.scm b/gnu/home/services/ssh.scm
index 01917a29cd..4ab2adb292 100644
--- a/gnu/home/services/ssh.scm
+++ b/gnu/home/services/ssh.scm
@@ -1,6 +1,7 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2022 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2023 Janneke Nieuwenhuizen <janneke@gnu.org>
+;;; Copyright © 2023 Nicolas Graves <ngraves@ngraves.fr>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -39,6 +40,7 @@ (define-module (gnu home services ssh)
             home-openssh-configuration-authorized-keys
             home-openssh-configuration-known-hosts
             home-openssh-configuration-hosts
+            home-openssh-configuration-add-keys-to-agent
             home-ssh-agent-configuration
 
             openssh-host
@@ -185,17 +187,41 @@ (define (openssh-host-name-field? field)
 (define-record-type* <home-openssh-configuration>
   home-openssh-configuration make-home-openssh-configuration
   home-openssh-configuration?
-  (authorized-keys home-openssh-configuration-authorized-keys ;list of file-like
-                   (default '()))
-  (known-hosts     home-openssh-configuration-known-hosts ;unspec | list of file-like
-                   (default *unspecified*))
-  (hosts           home-openssh-configuration-hosts   ;list of <openssh-host>
-                   (default '())))
+  (authorized-keys   home-openssh-configuration-authorized-keys ;list of file-like
+                     (default '()))
+  (known-hosts       home-openssh-configuration-known-hosts ;unspec | list of file-like
+                     (default *unspecified*))
+  (hosts             home-openssh-configuration-hosts   ;list of <openssh-host>
+                     (default '()))
+  (add-keys-to-agent home-openssh-configuration-add-keys-to-agent ;string with limited values
+                     (default "no")))
+
+(define (serialize-add-keys-to-agent value)
+  (define (is-valid-time-string? str)
+    (and (> (string-length str) 0)
+         (eq?
+          (cdr (vector-ref
+                (string-match "\
+[0-9]+|([0-9]+[Ww])?([0-9]+[Dd])?([0-9]+[Hh])?([0-9]+[Mm])?([0-9]+[Ss])?" str)
+                1))
+          (string-length str))))
+
+  (string-append "AddKeysToAgent "
+                 (cond ((member value '("yes" "no" "confirm" "ask")) value)
+                       ((is-valid-time-string? value) value)
+                       ((and (string-prefix? "confirm" value)
+                             (is-valid-time-string?
+                              (cdr (string-split value #\ )))) value)
+                       ;; The 'else' branch is unreachable.
+                       (else (raise (condition (&error)))))))
 
 (define (openssh-configuration->string config)
-  (string-join (map serialize-openssh-host
-                    (home-openssh-configuration-hosts config))
-               "\n"))
+  (string-join
+   (cons* (serialize-add-keys-to-agent
+           (home-openssh-configuration-add-keys-to-agent config))
+          (map serialize-openssh-host
+               (home-openssh-configuration-hosts config)))
+   "\n"))
 
 (define* (file-join name files #:optional (delimiter " "))
   "Return a file in the store called @var{name} that is the concatenation
-- 
2.39.2

[bug#62461] [PATCH v2 2/4] gnu: openssh-host: Add option match-criteria.

[Nicolas Graves via Guix-patches via]

---
 doc/guix.texi             | 12 ++++++++-
 gnu/home/services/ssh.scm | 52 ++++++++++++++++++++++++++++++++++-----
 2 files changed, 57 insertions(+), 7 deletions(-)

diff --git a/doc/guix.texi b/doc/guix.texi
index daefe63074..6c8302e990 100644
--- a/doc/guix.texi
+++ b/doc/guix.texi
@@ -42625,11 +42625,21 @@ Available @code{openssh-host} fields are:
 
 @table @asis
 @item @code{name} (type: string)
-Name of this host declaration.
+Name of this host declaration.  A @code{openssh-host} must define only
+@code{name} or @code{match-criteria}.  Use host-name @code{\"*\"} for
+top-level options.
 
 @item @code{host-name} (type: maybe-string)
 Host name---e.g., @code{"foo.example.org"} or @code{"192.168.1.2"}.
 
+@item @code{match-criteria} (type: maybe-match-criteria)
+When specified, this string denotes the set of hosts to which the entry
+applies, superseding the @code{host-name} field.  Its first element must be
+all or one of @code{ssh-match-keywords}.  The rest of the elements are
+arguments for the keyword, or other criteria.  A @code{openssh-host} must
+define only @code{name} or @code{match-criteria}.  Other host configuration
+options will apply to all hosts matching @code{match-criteria}.
+
 @item @code{address-family} (type: address-family)
 Address family to use when connecting to this host: one of
 @code{AF_INET} (for IPv4 only), @code{AF_INET6} (for IPv6 only), or
diff --git a/gnu/home/services/ssh.scm b/gnu/home/services/ssh.scm
index 4ab2adb292..b0c5a2db71 100644
--- a/gnu/home/services/ssh.scm
+++ b/gnu/home/services/ssh.scm
@@ -45,6 +45,7 @@ (define-module (gnu home services ssh)
 
             openssh-host
             openssh-host-host-name
+            openssh-host-match-criteria
             openssh-host-identity-file
             openssh-host-name
             openssh-host-port
@@ -116,13 +117,40 @@ (define (serialize-string-list field lst)
 
 (define-maybe string-list)
 
+(define ssh-match-keywords
+  '(canonical final exec host originalhost user localuser))
+
+(define (match-criteria? str)
+  ;; Rule out the case of "all" keyword.
+  (if (member str '("all"
+                    "canonical all"
+                    "final all"))
+      #t
+      (let* ((first (string-take str (string-index str #\ )))
+             (keyword (string->symbol (if (string-prefix? "!" first)
+                                          (string-drop first 1)
+                                          first))))
+        (memq keyword ssh-match-keywords))))
+
+(define-maybe match-criteria)
+
 (define-configuration openssh-host
   (name
-   (string)
-   "Name of this host declaration.")
+   maybe-string
+   "Name of this host declaration.  A @code{openssh-host} must define only
+@code{name} or @code{match-criteria}.  Use host-name @code{\"*\"} for
+top-level options.")
   (host-name
    maybe-string
    "Host name---e.g., @code{\"foo.example.org\"} or @code{\"192.168.1.2\"}.")
+  (match-criteria ;TODO implement stricter match-criteria rules
+   maybe-match-criteria
+   "When specified, this string denotes the set of hosts to which the entry
+applies, superseding the @code{host-name} field.  Its first element must be
+all or one of @code{ssh-match-keywords}.  The rest of the elements are
+arguments for the keyword, or other criteria.  A @code{openssh-host} must
+define only @code{name} or @code{match-criteria}.  Other host configuration
+options will apply to all hosts matching @code{match-criteria}.")
   (address-family
    maybe-address-family
    "Address family to use when connecting to this host: one of
@@ -171,17 +199,29 @@ (define-configuration openssh-host
 @file{~/.ssh/config}."))
 
 (define (serialize-openssh-host config)
-  (define (openssh-host-name-field? field)
-    (eq? (configuration-field-name field) 'name))
+  (define (openssh-host-name-or-match-field? field)
+    (or (eq? (configuration-field-name field) 'name)
+        (eq? (configuration-field-name field) 'match-criteria)))
 
   (string-append
-   "Host " (openssh-host-name config) "\n"
+   (if (maybe-value-set? (openssh-host-name config))
+       (if (maybe-value-set? (openssh-host-match-criteria config))
+           (raise
+            (formatted-message
+             (G_ "You must either define name or match-criteria, not both.")))
+           (string-append "Host " (openssh-host-name config) "\n"))
+       (if (maybe-value-set? (openssh-host-match-criteria config))
+           (string-append
+            "Match " (string-join (openssh-host-match-criteria config) " ") "\n")
+           (raise
+            (formatted-message
+             (G_ "You must either define name or match-criteria once.")))))
    (string-concatenate
     (map (lambda (field)
            ((configuration-field-serializer field)
             (configuration-field-name field)
             ((configuration-field-getter field) config)))
-         (remove openssh-host-name-field?
+         (remove openssh-host-name-or-match-field?
                  openssh-host-fields)))))
 
 (define-record-type* <home-openssh-configuration>
-- 
2.39.2

[bug#62461] [PATCH v2 3/4] gnu: ssh: Export configuration predicates.

[Nicolas Graves via Guix-patches via]

---
 gnu/home/services/ssh.scm | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/gnu/home/services/ssh.scm b/gnu/home/services/ssh.scm
index b0c5a2db71..c92b0dda4f 100644
--- a/gnu/home/services/ssh.scm
+++ b/gnu/home/services/ssh.scm
@@ -41,7 +41,9 @@ (define-module (gnu home services ssh)
             home-openssh-configuration-known-hosts
             home-openssh-configuration-hosts
             home-openssh-configuration-add-keys-to-agent
+            home-openssh-configuration?
             home-ssh-agent-configuration
+            home-ssh-agent-configuration?
 
             openssh-host
             openssh-host-host-name
-- 
2.39.2

[bug#62461] [PATCH v2 4/4] gnu: ssh: Export home-ssh-agent variables.

[Nicolas Graves via Guix-patches via]

---
 gnu/home/services/ssh.scm | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/gnu/home/services/ssh.scm b/gnu/home/services/ssh.scm
index c92b0dda4f..d2142cfb0a 100644
--- a/gnu/home/services/ssh.scm
+++ b/gnu/home/services/ssh.scm
@@ -42,7 +42,11 @@ (define-module (gnu home services ssh)
             home-openssh-configuration-hosts
             home-openssh-configuration-add-keys-to-agent
             home-openssh-configuration?
+
             home-ssh-agent-configuration
+            home-ssh-agent-openssh
+            home-ssh-agent-socket-directory
+            home-ssh-agent-extra-options
             home-ssh-agent-configuration?
 
             openssh-host
-- 
2.39.2

[bug#62461] Additional ssh configuration options.

[Ludovic Courtès]

Hi Nicolas,

Apologies for the late reply.

It seems some of the suggestions I made didn’t make it into v2, namely:

  https://issues.guix.gnu.org/62461#5
  https://issues.guix.gnu.org/62461#6

Could you take a look?

I’m sorry that it too so long; please feel free to ping me on IRC once
you’ve sent a new version.

Thanks,
Ludo’.

[bug#62461] [PATCH v3 1/4] gnu: home-openssh-configuration: Add field add-keys-to-agent.

[Nicolas Graves via Guix-patches via]

---
 doc/guix.texi             | 14 ++++++++++++
 gnu/home/services/ssh.scm | 48 +++++++++++++++++++++++++++++++--------
 2 files changed, 53 insertions(+), 9 deletions(-)

diff --git a/doc/guix.texi b/doc/guix.texi
index f620d0eb35..d5f81f6fcd 100644
--- a/doc/guix.texi
+++ b/doc/guix.texi
@@ -43102,6 +43102,20 @@ Secure Shell
 running on this machine, then it @emph{may} take this file into account:
 this is what @command{sshd} does by default, but be aware that it can
 also be configured to ignore it.
+
+@item @code{add-keys-to-agent} (default: @code{``no''})
+This string specifies whether keys should be automatically added to a
+running ssh-agent.  If this option is set to @code{``yes''} and a key is
+loaded from a file, the key and its passphrase are added to the agent
+with the default lifetime, as if by @code{ssh-add}.  If this option is
+set to @code{``ask''}, @code{ssh} will require confirmation.  If this
+option is set to @code{``confirm''}, each use of the key must be
+confirmed.  If this option is set to @code{``no''}, no keys are added to
+the agent.  Alternately, this option may be specified as a time interval
+to specify the key's lifetime in @code{ssh-agent}, after which it will
+automatically be removed.  The argument must be @code{``no''},
+@code{``yes''}, @code{``confirm''} (optionally followed by a time
+interval), @code{``ask''} or a time interval.
 @end table
 @end deftp
 
diff --git a/gnu/home/services/ssh.scm b/gnu/home/services/ssh.scm
index 628dc743ae..2de78eb1c4 100644
--- a/gnu/home/services/ssh.scm
+++ b/gnu/home/services/ssh.scm
@@ -1,6 +1,7 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2022 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2023 Janneke Nieuwenhuizen <janneke@gnu.org>
+;;; Copyright © 2023 Nicolas Graves <ngraves@ngraves.fr>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -42,6 +43,7 @@ (define-module (gnu home services ssh)
             home-openssh-configuration-authorized-keys
             home-openssh-configuration-known-hosts
             home-openssh-configuration-hosts
+            home-openssh-configuration-add-keys-to-agent
             home-ssh-agent-configuration
 
             openssh-host
@@ -248,17 +250,45 @@ (define (serialize-openssh-host config)
 (define-record-type* <home-openssh-configuration>
   home-openssh-configuration make-home-openssh-configuration
   home-openssh-configuration?
-  (authorized-keys home-openssh-configuration-authorized-keys ;list of file-like
-                   (default #f))
-  (known-hosts     home-openssh-configuration-known-hosts ;unspec | list of file-like
-                   (default *unspecified*))
-  (hosts           home-openssh-configuration-hosts   ;list of <openssh-host>
-                   (default '())))
+  (authorized-keys   home-openssh-configuration-authorized-keys ;list of file-like
+                     (default #f))
+  (known-hosts       home-openssh-configuration-known-hosts ;unspec | list of file-like
+                     (default *unspecified*))
+  (hosts             home-openssh-configuration-hosts   ;list of <openssh-host>
+                     (default '()))
+  (add-keys-to-agent home-openssh-configuration-add-keys-to-agent ;string with limited values
+                     (default "no")))
+
+(define (serialize-add-keys-to-agent value)
+  (define (valid-time-string? str)
+    (and (> (string-length str) 0)
+         (equal?
+          str
+          (match:substring
+           (string-match "\
+[0-9]+|([0-9]+[Ww])?([0-9]+[Dd])?([0-9]+[Hh])?([0-9]+[Mm])?([0-9]+[Ss])?"
+                         str)))))
+
+  (string-append "AddKeysToAgent "
+                 (cond ((member value '("yes" "no" "confirm" "ask")) value)
+                       ((valid-time-string? value) value)
+                       ((and (string-prefix? "confirm" value)
+                             (valid-time-string?
+                              (cdr (string-split value #\ )))) value)
+                       ;; The 'else' branch is unreachable.
+                       (else
+                        (raise
+                         (formatted-message
+                          (G_ "~s: invalid 'add-keys-to-agent' value")
+                          value))))))
 
 (define (openssh-configuration->string config)
-  (string-join (map serialize-openssh-host
-                    (home-openssh-configuration-hosts config))
-               "\n"))
+  (string-join
+   (cons* (serialize-add-keys-to-agent
+           (home-openssh-configuration-add-keys-to-agent config))
+          (map serialize-openssh-host
+               (home-openssh-configuration-hosts config)))
+   "\n"))
 
 (define* (file-join name files #:optional (delimiter " "))
   "Return a file in the store called @var{name} that is the concatenation

base-commit: eed55a6544d5bda2245ec853e5fa4b28e1865bea
prerequisite-patch-id: a057b35ab55298bad50caab186b3e692a25230e1
prerequisite-patch-id: fb9054f780e6f97b92f00fdbe56058d1188ccf0a
prerequisite-patch-id: ca2f2591980b80c5cf27846e59e323bdc5a06b00
prerequisite-patch-id: ae5ad13b181ebb3c31d529af50622e3b78641442
prerequisite-patch-id: 34ed6acb0a1e5f79b5f6d18a6d4ef70cd97bf7ad
prerequisite-patch-id: 10d52b209b6e9c771050eef67ce566e79ab55c49
prerequisite-patch-id: e78e2a6daf59564caf5d2affe04ea7dde07f76c6
prerequisite-patch-id: 6aad4df7b83bfd5c2da38d9c2f80fba749f607b5
prerequisite-patch-id: da6a2d63ebb0ba1abb0b7c569d353724d900f95f
prerequisite-patch-id: 6279cff75e76e262f6ec82518db1fdf4c1810303
prerequisite-patch-id: 44453fcf2f2c38212a47d45d43ddcfa98167fabe
prerequisite-patch-id: 641eae2fa3842045ebe6072ad78214002f818221
prerequisite-patch-id: c19de9ee8c57210cbffc79945e69a858639f39bf
prerequisite-patch-id: 9833a747398a641803e203f8293382f55ad24ed1
prerequisite-patch-id: 94d5340918e3626726b6d32d93bf47425751898f
prerequisite-patch-id: e18164416e2c070b0b71f770c90d4c04af2635c1
prerequisite-patch-id: 31e98ea035053a965e87ad0164030cf909922d9e
prerequisite-patch-id: a1cf1f5c4a0ff2804fac986a69ffbc0328300afe
prerequisite-patch-id: 2a54e276f79fb57113a0be11e1ea2c07fdc2727d
prerequisite-patch-id: a463de1ba17ecb39588dfbd46c3bc5f9e0fb1b1c
prerequisite-patch-id: 3188de66dfc4bcb71f90601822428701528f4a98
prerequisite-patch-id: 6c93f771a1eca0747fd92a770fe750e2f15d8e52
prerequisite-patch-id: 12b76e9c2751da73ed64c9489b15f74ff17568cf
prerequisite-patch-id: eb618ab7b10483d917c308a38792af98baa517e2
prerequisite-patch-id: a471a4b7839bfb0ee9a3fd53ed962d729d38bd94
prerequisite-patch-id: 5e58202cc87a257c78033dafa62ffae4383e3718
prerequisite-patch-id: cd7f69695aa47b7e1b1160841fe842a3acd160e7
prerequisite-patch-id: b542cf4087eeee1ee3f7fc03b7c39896417bc7b5
prerequisite-patch-id: 843773f53ca319821185f9f9bc43ad905f081ee7
prerequisite-patch-id: a2dfb2fba1e1a3c8e270823022b6f462d27f17c8
-- 
2.40.1

[bug#62461] [PATCH v3 2/4] gnu: openssh-host: Add option match-criteria.

[Nicolas Graves via Guix-patches via]

---
 doc/guix.texi             | 12 +++++++-
 gnu/home/services/ssh.scm | 58 ++++++++++++++++++++++++++++++++++-----
 2 files changed, 62 insertions(+), 8 deletions(-)

diff --git a/doc/guix.texi b/doc/guix.texi
index d5f81f6fcd..a3d5f8446d 100644
--- a/doc/guix.texi
+++ b/doc/guix.texi
@@ -43126,11 +43126,21 @@ Secure Shell
 
 @table @asis
 @item @code{name} (type: string)
-Name of this host declaration.
+Name of this host declaration.  A @code{openssh-host} must define only
+@code{name} or @code{match-criteria}.  Use host-name @code{\"*\"} for
+top-level options.
 
 @item @code{host-name} (type: maybe-string)
 Host name---e.g., @code{"foo.example.org"} or @code{"192.168.1.2"}.
 
+@item @code{match-criteria} (type: maybe-match-criteria)
+When specified, this string denotes the set of hosts to which the entry
+applies, superseding the @code{host-name} field.  Its first element must be
+all or one of @code{ssh-match-keywords}.  The rest of the elements are
+arguments for the keyword, or other criteria.  A @code{openssh-host} must
+define only @code{name} or @code{match-criteria}.  Other host configuration
+options will apply to all hosts matching @code{match-criteria}.
+
 @item @code{address-family} (type: maybe-address-family)
 Address family to use when connecting to this host: one of
 @code{AF_INET} (for IPv4 only), @code{AF_INET6} (for IPv6 only).
diff --git a/gnu/home/services/ssh.scm b/gnu/home/services/ssh.scm
index 2de78eb1c4..017bbbc2dd 100644
--- a/gnu/home/services/ssh.scm
+++ b/gnu/home/services/ssh.scm
@@ -48,6 +48,7 @@ (define-module (gnu home services ssh)
 
             openssh-host
             openssh-host-host-name
+            openssh-host-match-criteria
             openssh-host-identity-file
             openssh-host-name
             openssh-host-port
@@ -95,7 +96,11 @@ (define (serialize-address-family field family)
                      (cond ((= family AF_INET) "inet")
                            ((= family AF_INET6) "inet6")
                            ;; The 'else' branch is unreachable.
-                           (else (raise (condition (&error)))))
+                           (else
+                            (raise
+                             (formatted-message
+                              (G_ "~s: invalid 'address-family' value")
+                              value))))
                      "\n")
       ""))
 
@@ -173,13 +178,40 @@ (define (sanitize-proxy-command properties)
     (configuration-field-error (source-properties->location properties) 'proxy-command value))
   value))
 
+(define ssh-match-keywords
+  '(canonical final exec host originalhost user localuser))
+
+(define (match-criteria? str)
+  ;; Rule out the case of "all" keyword.
+  (if (member str '("all"
+                    "canonical all"
+                    "final all"))
+      #t
+      (let* ((first (string-take str (string-index str #\ )))
+             (keyword (string->symbol (if (string-prefix? "!" first)
+                                          (string-drop first 1)
+                                          first))))
+        (memq keyword ssh-match-keywords))))
+
+(define-maybe match-criteria)
+
 (define-configuration openssh-host
   (name
-   (string)
-   "Name of this host declaration.")
+   maybe-string
+   "Name of this host declaration.  A @code{openssh-host} must define only
+@code{name} or @code{match-criteria}.  Use host-name @code{\"*\"} for
+top-level options.")
   (host-name
    maybe-string
    "Host name---e.g., @code{\"foo.example.org\"} or @code{\"192.168.1.2\"}.")
+  (match-criteria ;TODO implement stricter match-criteria rules
+   maybe-match-criteria
+   "When specified, this string denotes the set of hosts to which the entry
+applies, superseding the @code{host-name} field.  Its first element must be
+all or one of @code{ssh-match-keywords}.  The rest of the elements are
+arguments for the keyword, or other criteria.  A @code{openssh-host} must
+define only @code{name} or @code{match-criteria}.  Other host configuration
+options will apply to all hosts matching @code{match-criteria}.")
   (address-family
    maybe-address-family
    "Address family to use when connecting to this host: one of
@@ -234,17 +266,29 @@ (define-configuration openssh-host
 @file{~/.ssh/config}."))
 
 (define (serialize-openssh-host config)
-  (define (openssh-host-name-field? field)
-    (eq? (configuration-field-name field) 'name))
+  (define (openssh-host-name-or-match-field? field)
+    (or (eq? (configuration-field-name field) 'name)
+        (eq? (configuration-field-name field) 'match-criteria)))
 
   (string-append
-   "Host " (openssh-host-name config) "\n"
+   (if (maybe-value-set? (openssh-host-name config))
+       (if (maybe-value-set? (openssh-host-match-criteria config))
+           (raise
+            (formatted-message
+             (G_ "You must either define name or match-criteria, not both.")))
+           (string-append "Host " (openssh-host-name config) "\n"))
+       (if (maybe-value-set? (openssh-host-match-criteria config))
+           (string-append
+            "Match " (string-join (openssh-host-match-criteria config) " ") "\n")
+           (raise
+            (formatted-message
+             (G_ "You must either define name or match-criteria once.")))))
    (string-concatenate
     (map (lambda (field)
            ((configuration-field-serializer field)
             (configuration-field-name field)
             ((configuration-field-getter field) config)))
-         (remove openssh-host-name-field?
+         (remove openssh-host-name-or-match-field?
                  openssh-host-fields)))))
 
 (define-record-type* <home-openssh-configuration>
-- 
2.40.1

[bug#62461] [PATCH v3 3/4] gnu: ssh: Export configuration predicates.

[Nicolas Graves via Guix-patches via]

---
 gnu/home/services/ssh.scm | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/gnu/home/services/ssh.scm b/gnu/home/services/ssh.scm
index 017bbbc2dd..4ff3395e06 100644
--- a/gnu/home/services/ssh.scm
+++ b/gnu/home/services/ssh.scm
@@ -44,7 +44,9 @@ (define-module (gnu home services ssh)
             home-openssh-configuration-known-hosts
             home-openssh-configuration-hosts
             home-openssh-configuration-add-keys-to-agent
+            home-openssh-configuration?
             home-ssh-agent-configuration
+            home-ssh-agent-configuration?
 
             openssh-host
             openssh-host-host-name
-- 
2.40.1

[bug#62461] [PATCH v3 4/4] gnu: ssh: Export home-ssh-agent variables.

[Nicolas Graves via Guix-patches via]

---
 gnu/home/services/ssh.scm | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/gnu/home/services/ssh.scm b/gnu/home/services/ssh.scm
index 4ff3395e06..3053a88fad 100644
--- a/gnu/home/services/ssh.scm
+++ b/gnu/home/services/ssh.scm
@@ -45,7 +45,11 @@ (define-module (gnu home services ssh)
             home-openssh-configuration-hosts
             home-openssh-configuration-add-keys-to-agent
             home-openssh-configuration?
+
             home-ssh-agent-configuration
+            home-ssh-agent-openssh
+            home-ssh-agent-socket-directory
+            home-ssh-agent-extra-options
             home-ssh-agent-configuration?
 
             openssh-host
-- 
2.40.1

bug#62461: Additional ssh configuration options.

[Ludovic Courtès]

Hi Nicolas,

I have finally installed v3, thanks!

Please note that despite previous round trips this was a time-consuming
task: adding commit logs (they would have guided review), chasing
unbound variables (#:use-module (ice-9 regex) was missing), tweaking
error messages for consistency (lower-case, no period), etc.  Please
keep that in mind for the next series.  :-)

Thanks again!

Ludo’.

[bug#62461] Additional ssh configuration options.

[Josselin Poiret via Guix-patches via]

[-- Attachment #1: Type: text/plain, Size: 487 bytes --]

Hi Nicolas and Ludo,

Ludovic Courtès <ludo@gnu.org> writes:

> Hi Nicolas,
>
> I have finally installed v3, thanks!

I'm noticing that guile is now throwing a warning for the `(define-maybe
match-criteria)` line.  I don't know anything about the fancy
configuration framework, but Brian tells me that a quick fix could be to
change define-maybe to define-maybe/no-serialization.  Nicolas, can you
have a look?  I'd be happy to push the fix.

Best,
-- 
Josselin Poiret

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 682 bytes --]

[bug#62461] Additional ssh configuration options.

[Nicolas Graves via Guix-patches via]

On 2023-07-04 22:17, Josselin Poiret via Guix-patches via wrote:

> Hi Nicolas and Ludo,
>
> Ludovic Courtès <ludo@gnu.org> writes:
>
>> Hi Nicolas,
>>
>> I have finally installed v3, thanks!
>
> I'm noticing that guile is now throwing a warning for the `(define-maybe
> match-criteria)` line.  I don't know anything about the fancy
> configuration framework, but Brian tells me that a quick fix could be to
> change define-maybe to define-maybe/no-serialization.  Nicolas, can you
> have a look?  I'd be happy to push the fix.

Hi Josselin !

Sorry for the late answer. This is done in the recent patch 64777, which
also fixed the serialization (the ssh match is a string in this version,
not a list).

>
> Best,

-- 
Best regards,
Nicolas Graves