The new emergency SSH relays use the following procedure for authentication:
- Send an XHR for <relay>/challenge?u=<username> (returns XSSI-prefixed JSON)
- Sign the challenge using the SSH Agent (undocumented API, supported only by gnubbyd)
- Make a websocket request to <relay>/?ssh-fe-challenge=<challenge>&ssh-fe-signature=<signature>&...
There's an additional pair of query parameters currently being added to specify the destination hostname and IP address. I haven't got the names as of yet. b/67952203
In order to make this all work we need to make the username and ssh-agent connection available to the GoogleRelay impl, and vapier@ noted that some currently synchronous code may need to be refactored to be async.
More concrete details coming as I have them.
Comment 1 by vapier@chromium.org
, Oct 18 2017