From: Phillip Smyth <phillip.smyth(a)codethink.co.uk&gt; Added ED25519 support. config.lua: Changed the manual keytype check into a function call from util.lua usercommand: Changed the manual keytype check into a function call from util.lua util.lua: Added a keycheck function that returns true if an invalid keytype is detected library.yarn: Added implementation of createsshkey which uses ED25519 as a parameter 02-commands-sshkey.yarn: Modified the "ssh key basics" Scenario to create a second key of type ED25519 and test it --- lib/gitano/config.lua | 11 +++++------ lib/gitano/sssc | 8 ++++++++ lib/gitano/sssc.pub | 1 + lib/gitano/usercommand.lua | 9 +++------ lib/gitano/util.lua | 16 +++++++++++++++- testing/.library.yarn.swp | Bin 0 -> 16384 bytes testing/02-commands-sshkey.yarn | 8 +++++++- testing/keys/testinstance@newkey_Ed25519 | 7 +++++++ testing/keys/testinstance(a)newkey_Ed25519.pub | 1 + testing/library.yarn | 6 +++++- 10 files changed, 52 insertions(+), 15 deletions(-) create mode 100644 lib/gitano/sssc create mode 100644 lib/gitano/sssc.pub create mode 100644 testing/.library.yarn.swp create mode 100644 testing/keys/testinstance@newkey_Ed25519 create mode 100644 testing/keys/testinstance(a)newkey_Ed25519.pub diff --git a/lib/gitano/config.lua b/lib/gitano/config.lua index 7227866..b42bfba 100644 --- a/lib/gitano/config.lua +++ b/lib/gitano/config.lua @@ -39,6 +39,7 @@ local log = require 'gitano.log' local lace = require 'gitano.lace' local i18n = require 'gitano.i18n' local pat = require 'gitano.patterns' +local util = require 'gitano.util' local luxio = require 'luxio' local sio = require 'luxio.simple' local clod = require 'clod' @@ -163,12 +164,10 @@ local function parse_admin_config(commit) if not (keytype and keydata and keytag) then return nil, i18n.expand("ERROR_BAD_KEY_SMELL", {filename=filename}) end - if (keytype ~= "ssh-rsa") and (keytype ~= "ssh-dss") and - (keytype ~= "ecdsa-sha2-nistp256") and - (keytype ~= "ecdsa-sha2-nistp384") and - (keytype ~= "ecdsa-sha2-nistp521") then - return nil, i18n.expand("ERROR_BAD_KEY_TYPE", - {keytype=keytype, filename=filename}) + + if util.ssh_type_is_invalid(keytype) then + return nil, i18n.expand("ERROR_BAD_KEY_TYPE", + {keytype=keytype, filename=filename}) end if all_keys[this_key] then diff --git a/lib/gitano/sssc b/lib/gitano/sssc new file mode 100644 index 0000000..fc7698f --- /dev/null +++ b/lib/gitano/sssc @@ -0,0 +1,8 @@ +-----BEGIN OPENSSH PRIVATE KEY----- +b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jYmMAAAAGYmNyeXB0AAAAGAAAABB9boSOPS ++mgFH73l4a0IuEAAAAEAAAAAEAAAAzAAAAC3NzaC1lZDI1NTE5AAAAIIrdZLaik3mrc173 +N+GlqEjroqCbDUNmtVHDWrF74W85AAAAoKS76JOFvqS6YW/J0jFgbcURVWT0Tjfd+Z+qS/ +uMt+5DDkzAE1f/Z69Fc3GB03tN7TVlnEeVDkPhFk+BmCddef9vg7c1pOeU1ENtGc+5KAVP +MVmurIQEu9r9qUJjntz61joGnF+WdOUFMGrv79lyciInB9F7ObEpB/XksWLX5V/+PFdBFF +gdmvs3hAbkANNYlpvao0w0kyD/HZOfh7kkykY= +-----END OPENSSH PRIVATE KEY----- diff --git a/lib/gitano/sssc.pub b/lib/gitano/sssc.pub new file mode 100644 index 0000000..3fe440d --- /dev/null +++ b/lib/gitano/sssc.pub @@ -0,0 +1 @@ +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIrdZLaik3mrc173N+GlqEjroqCbDUNmtVHDWrF74W85 phillipsmyth@ct-lt-577 diff --git a/lib/gitano/usercommand.lua b/lib/gitano/usercommand.lua index af7141c..9c005a0 100644 --- a/lib/gitano/usercommand.lua +++ b/lib/gitano/usercommand.lua @@ -218,12 +218,9 @@ local function builtin_sshkey_run(conf, _, cmdline, env) "did not smell like an OpenSSH v2 key") return "exit", 1 end - - if (keytype ~= "ssh-rsa") and (keytype ~= "ssh-dss") and - (keytype ~= "ecdsa-sha2-nistp256") and - (keytype ~= "ecdsa-sha2-nistp384") and - (keytype ~= "ecdsa-sha2-nistp521") then - log.error("Unknown key type", keytype) + + if util.ssh_type_is_invalid(keytype) then + log.error("Unknown key type", keytype) return "exit", 1 end diff --git a/lib/gitano/util.lua b/lib/gitano/util.lua index 76183e3..7e34178 100644 --- a/lib/gitano/util.lua +++ b/lib/gitano/util.lua @@ -584,6 +584,18 @@ local function unlockfile(fh) fh:close() end +local function ssh_type_is_invalid(keytype) + if (keytype ~= "ssh-rsa") and + (keytype ~= "ssh-dss") and + (keytype ~= "ecdsa-sha2-nistp256") and + (keytype ~= "ecdsa-sha2-nistp384") and + (keytype ~= "ecdsa-sha2-nistp521") and + (keytype ~= "ssh-ed25519") then + return true + end + return false +end + return { parse_cmdline = _parse_cmdline, @@ -623,4 +635,6 @@ return { lockfile = lockfile, unlockfile = unlockfile, -} + ssh_type_is_invalid = ssh_type_is_invalid, +} + diff --git a/testing/.library.yarn.swp b/testing/.library.yarn.swp new file mode 100644 index 0000000000000000000000000000000000000000..d62016e23f879bce2d16cc3524354d628a282ced GIT binary patch literal 16384 zcmeHNZ)_Y#6`#^T%b&DWiufZ?nQUFvPP})vlMtGJu4x>{YU~92oHR;8Zhbd*xANZZ zu{&qy(gH$izd)-(L4sC%DMBg&AyFX^5-LbYs8Xr;KqdaPLVSP*0(=1pz5orsH#57p zdv|v13W|_+m0#|BJM-qf-<x^w&Fn6Zot~ZJA1aJ7T(>dy{VTsb``+6QvA^wStkrNm z&uvA`j%?8F^{$GvJ!$XTk1iWtpGXTVR^-_D-eTRAjvo}Ih@|V+i=Mk2I$@{KaYBDX zS^3SJft-P@GO(TPnHX0~{Z4BqzkSEjRt4nka|Ut-at3k+at3k+at3k+at3k+{*M`u zt!?a+(Em-whDGyvL(k_mbCt~R@n_ubHFN(ybN_2S{ckjX&za9Z_1rgq<{vo&IRiNZ zIRiNZIRiNZIRiNZIRiNZIRiNZIRpO%2AnEmLy-F@ZRGL%Ki>aexs|b>0^bF`19-p( zfS=vM*u%hn;Och9{s24$oC3B1zk3H`zXhHLz5#q4_!Mv+7z1tuUVJ-a&j1U+9l-D3 z#@G|U5^x9bZs1+Ot8ZoOC%_B9H-XOrj{_eDuHDSoYrv0zuK-U2X8{`+1zxy`vCjif z0G|WKfvazUzQB{f31A!;1HSrZ=m;zUBfvA;7<&+y2mXwMi{}9e90axj|H5I(KY@P$ zSAkyuKL<VnTmg^I0$%_g1Blnp0GqlvuA0l}gD!e0f?Gp#Q>FWkU)*Ey!`!l%x`Y3Y zSVKprN>fK?7mAUr25o8aiR^D846TD)HiWM_xivmCQ!4R_7x*F(J8mUkC%RwvcE9ek z_|St|g%2Ls&28HcY%i!d9==vZOEwP28t%6~&d;l%X6H_wn4X)SFD>#j$EWA{@Hxl6 ze1ZNOv+udEYh-kiw<EmnG3dsyxYQCAdKrY*9M@}y0<A|TmDUkDe3W0<J;I&j>o8w) zWrHhK`0)Aa?vas6OoQHwEr?bSxiSbl+^JMV6u~2)G0ivqdE^NA=qI-4SE80t^Z1H6 z$kGWd;~Q{a%ZZ}3s-cKFwnEpJHE!J%f#YH2oVt*vS-0Z|e~80z7f&smES)?YMGfu8 zu<ciZX4COwk#O)ijF&W}3Dc0W#V@300gY>!!CLL*7161=p75P!cS=Cjc<{Z}i1m6X z$r=uoF%EaCRk*3<v^~iW85)$)DNEvkvpniqMXI+W5h_7(!<4dntb6rqL=j#os-*0> zJK~|hge5C23~d#wVzubEJrBmg)_!+qe@wi+6>U}93dV&_+WrA5@71#?)wb=smz0s+ z){G2KEvcE=)0<vX7j3=Vz<tCW?u#`|VP-|@MtU7NoLq(F?TKo3d8$^71vLsOT8isO zZdLFZ^$u5og@NZqyxmd_l<98Zb98VxnWg%Sa)?Iwknt^_FD@RZL2(CDIqt@$xEDz3 zOg@dEIrM=X^8Z@Htu(kB`FBfR)-RCRPPOU!WiA807KAIxmQm>8MqJUQ*LtOuax96m z8$napCc=&v3-DCY{54U)@}QNFnjNmM{graY!1zXLM#O>}a$2vD<hhk~nT3lepdpOA z^wJx-J2fMEW>0oyY;~6K1_lDz(LfiIBE)#7C9=N9jY+;G&6E`>o(50a>#Nf@Xx{=E z@AHWsD>doXGZy8Jo_kS&^F>Sr={DgwS0Z9Ggx9LIJ(^L=f;-Ee$V@KsZX^nY0xMxP z#Ium*sx5=SEAzH=Jy&*=94v~6BT_qcfuyz~_|p9B18Oc~QDV~9-Bn0$h~|LAl}co6 zjzmyqL|ZK=SyxDB$-I%m39G@HPjRq{uf4uFHakCc;>1}c1xr{*ORN+mN1sziEh|-t zkm%Q$88abyxkK4aC4&f7)2pAh{%wodF)eko`H_sE>px+L3OB|M_5BUde^dEg1&&C_ zb}RP23ZRLb6U7r(Fyf>?-lQ4kTWTB+(JMGvxoOd=QD2;J5DfL)<+0`)E)6y#d=VnW z$F0q3YYJa7hBAr5aiB_HET2&X<fx&(2w5pGT@R||5O%A?HN5;xOW)+ea%@%^v7$tY zh5j{LK?qGHa+2^7I9RGf+RU<A=d^4o_zG%IISfB^IBGsp4mktr^B}Au#mRsj3qmd& z{AhBZ(zm<tbs`L?x3bN`y0w%IIvsbZAVV0dx*^JHDt}{x%=#lWP0S+cEeF*!rBRb) zxwDEgT*W`6jxtS@a)A+n;FRd&d>-+}LwyInNLL5}FP<RsRi3Bv3-?hAIFKBWmsBfF zP(2C4r~q_S>#<<e#5$N9=_-M^!Z=M*v`GO~Zx2Qhy_j%7Y*ax_8@d#`DPE$&gq~-x zQBXrWk}reVQNBj*^*K2NWsBo?xZiFrgMZjTftpD{9>yE#s;nSU{XE7MLOI15uZ04M zzuUMLgzOB>5vbym95Nnx!6$Fi+wL$@IXtDj($5LulQ39Cp;a{{8e@kCU#tY7+`L1t z<Y^|^p`EtP?Ois=3Rft?t3Pb}2&4V~d$7-KVBbso|2cfn^+W9S9|E=mf5l$^FThj4 z8Q?eA=f4EJ2s{gX3wQ)L1Dpm%fg1n@yoCM!mw+z<0(d|0KHv)W{f_~U0(D>l7zb_! zuF&2ecn)X+9&j&k3$PvdHTM7C1I_{u0Q-PDfgQk2z~8a|{}J$Q;M2fm;3O~!yc4*F zvw%MWuK+ItUj{nBCEy<5c3=na3eE<806Ygg4Lkxo4D1D71z#@%zXIs|fcUEe`IR$} zGmtaT%Ro|O)mwF(oH=0=(cZRk*o6WDyG(t;hRt2ify96<r{3O>94bJE&*4mM%0A}U zH98nWk~RCtve~#ITT_nHMGozWv2W>1&^n<aFP3NKmrl)GJbrR+y39k=0#uAN(4P(s zQC%Sou|=1TS18X@65~<Zm4fnG6dxgEgqY+?*$um(r0&susT{aYWp`?Z-!D2iDnl9< z9*$G0YEOk)AhqSe;6e(2HO1uM$}&DcMDgb1e8E&A=;?-mugk^6Red58=@aYhIaAX6 zC95(61<P<@_lQ<q(bscg*PRNz223q3F3ru(&zOx9)t|b$(XItA!799EbkHLdmtDVD zbG%3>X*hS`o`ZT16-7OCn(9YUX$0IlF|}C23FFKGZ5lQkN;?}T7!ox~sLv2lF2UjE z2eU!c{ihcetOH73wkuAivt88>nXV_7N&~yPezqt5o#{9`Z~Bo|n8M~fhZK)D0{TqH zY0E|sx|c=uBGun1v+tiiyJ$?Vx!8&qQunY=K5Fh&s@;>IKHrz<jN2SmbKysAVWuXj zl{r9C$Ml(B=xh<^yK4VM3dmpuMPm9O-&qw^)aUp)iqEFZkw<d{^(D8{hgwmpb)TL( zaHw^wM!^J9?bT^|GAZlW19AIfys#P76<ew8o1%h7fTgWA)|XypsG?;@&q&OUEsbEN zfSSVxxxh^3GHi=vCTu)-YT!YmCSiA=9jVn!u_7gF9U~HPS*6XK?bS3Tez53nDA<fE zvSV(EsA_<{9GO@Nuw_H!>V~M4rLj8dIZ=Enx{k@$A3nBzgRx_e#RIFO&v;-2p~0(Z zpes{T(%6UxNPSa29%!(I0|m!s43KIb@7&dW2n4yQm7P%6D>yzY)sMOcNDiCa#&e^1 z<4F$y<2u32H9Xf!f<9cR!pn6ZvlxZ;&?Ax_*}Y|nqJE;MR-ss?XQ8qP<L)#`gdWDE z90z61Y?VP98{Yn#{Yz%>L3`#ohJMsB==q^4P9}#7yG-KUfWSA7s{a{Dx>nP4{2Lp5 B@^AnE literal 0 HcmV?d00001 diff --git a/testing/02-commands-sshkey.yarn b/testing/02-commands-sshkey.yarn index da8a309..fc024b4 100644 --- a/testing/02-commands-sshkey.yarn +++ b/testing/02-commands-sshkey.yarn @@ -24,15 +24,20 @@ This information is also shown in `sshkey list`. New keys can be added. - GIVEN testinstance has keys called newkey + GIVEN testinstance has keys called newkey + AND testinstance has keys called edkey of type Ed25519 WHEN testinstance uses their ssh public key called newkey as stdin AND testinstance adminkey runs sshkey add newkey + THEN the output contains SSH authorised key file updated + WHEN testinstance uses their ssh public key called edkey as stdin + AND testinstance adminkey runs sshkey add edkey THEN the output contains SSH authorised key file updated Verify the new keys are listed for the user. WHEN testinstance adminkey runs sshkey list THEN the output contains newkey + AND the output contains edkey We can delete the old key and proceed with the new key in future. @@ -44,6 +49,7 @@ We can delete the old key and proceed with the new key in future. FINALLY the instance is torn down + SSH key tracking ---------------- diff --git a/testing/keys/testinstance@newkey_Ed25519 b/testing/keys/testinstance@newkey_Ed25519 new file mode 100644 index 0000000..369d60b --- /dev/null +++ b/testing/keys/testinstance@newkey_Ed25519 @@ -0,0 +1,7 @@ +-----BEGIN OPENSSH PRIVATE KEY----- +b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW +QyNTUxOQAAACAwGjSnIXXiyuszXalOR24kstP2q5z/eUz3czF1Co6FjgAAAKCJ+h3Zifod +2QAAAAtzc2gtZWQyNTUxOQAAACAwGjSnIXXiyuszXalOR24kstP2q5z/eUz3czF1Co6Fjg +AAAECwQpGPDj/DisyXljioqnTv+MdCuBc9SKDBco/qOQ3gZDAaNKchdeLK6zNdqU5HbiSy +0/arnP95TPdzMXUKjoWOAAAAG3Rlc3RpbnN0YW5jZS1FZDI1NTE5QG5ld2tleQEC +-----END OPENSSH PRIVATE KEY----- diff --git a/testing/keys/testinstance(a)newkey_Ed25519.pub b/testing/keys/testinstance(a)newkey_Ed25519.pub new file mode 100644 index 0000000..94ff2bc --- /dev/null +++ b/testing/keys/testinstance(a)newkey_Ed25519.pub @@ -0,0 +1 @@ +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDAaNKchdeLK6zNdqU5HbiSy0/arnP95TPdzMXUKjoWO testinstance-Ed25519@newkey diff --git a/testing/library.yarn b/testing/library.yarn index cc03122..85e1523 100644 --- a/testing/library.yarn +++ b/testing/library.yarn @@ -43,9 +43,13 @@ SSH keys. Sometimes it's helpful to be able to work with these... IMPLEMENTS GIVEN a unix user called ([a-z][a-z0-9]*) $GTT createunixuser "$MATCH_1" - IMPLEMENTS GIVEN ([a-z][a-z0-9]*) has keys called ([a-z][a-z0-9]*) + IMPLEMENTS GIVEN ([a-z][a-z0-9]*) has keys called ([a-z][a-z0-9]*) $GTT createsshkey "$MATCH_1" "$MATCH_2" + IMPLEMENTS GIVEN ([a-z][a-z0-9]*) has keys called ([a-z][a-z0-9]*) of type ([a-z][a-z0-9]*)? + $GTT createsshkey "$MATCH_1" "$MATCH_2" "$MATCH_3" + + IMPLEMENTS WHEN ([a-z][a-z0-9]*) uses their ssh public key called ([a-z][a-z0-9]*) as stdin cp "$DATADIR/user-home-$MATCH_1/.ssh/$MATCH_2.pub" "$DATADIR/stdin" -- 2.11.0