8000 plumbing: re-add support for cert-authorities using skeema's HostKeyDB · go-git/go-git@61916be · GitHub
[go: up one dir, main page]
Skip to content

Commit 61916be

Browse files
Javier-varezJavier-varez
committed
plumbing: re-add support for cert-authorities using skeema's HostKeyDB
1 parent 863c621 commit 61916be

File tree

3 files changed

+117
-24
lines changed

3 files changed

+117
-24
lines changed

‎plumbing/transport/ssh/auth_method.go

Lines changed: 21 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -230,11 +230,23 @@ func (a *PublicKeysCallback) ClientConfig() (*ssh.ClientConfig, error) {
230230
// ~/.ssh/known_hosts
231231
// /etc/ssh/ssh_known_hosts
232232
func NewKnownHostsCallback(files ...string) (ssh.HostKeyCallback, error) {
233-
kh, err := newKnownHosts(files...)
234-
return ssh.HostKeyCallback(kh), err
233+
kh, err := NewKnownHostsDb(files...)
234+
return kh.HostKeyCallback(), err
235235
}
236236

237-
func newKnownHosts(files ...string) (knownhosts.HostKeyCallback, error) {
237+
// NewKnownHostsDb returns knownhosts.HostKeyDB based on a file based on a
238+
// known_hosts file. http://man.openbsd.org/sshd#SSH_KNOWN_HOSTS_FILE_FORMAT
239+
//
240+
// If list of files is empty, then it will be read from the SSH_KNOWN_HOSTS
241+
// environment variable, example:
242+
//
243+
// /home/foo/custom_known_hosts_file:/etc/custom_known/hosts_file
244+
//
245+
// If SSH_KNOWN_HOSTS 10000 is not set the following file locations will be used:
246+
//
247+
// ~/.ssh/known_hosts
248+
// /etc/ssh/ssh_known_hosts
249+
func NewKnownHostsDb(files ...string) (*knownhosts.HostKeyDB, error) {
238250
var err error
239251

240252
if len(files) == 0 {
@@ -247,7 +259,7 @@ func newKnownHosts(files ...string) (knownhosts.HostKeyCallback, error) {
247259
return nil, err
248260
}
249261

250-
return knownhosts.New(files...)
262+
return knownhosts.NewDB(files...)
251263
}
252264

253265
func getDefaultKnownHostsFiles() ([]string, error) {
@@ -292,21 +304,16 @@ func filterKnownHostsFiles(files ...string) ([]string, error) {
292304
// configure HostKeyCallback into a ssh.ClientConfig.
293305
type HostKeyCallbackHelper struct {
294306
// HostKeyCallback is the function type used for verifying server keys.
295-
// If nil default callback will be create using NewKnownHostsCallback
307+
// If nil, a default callback will be created using NewKnownHostsDb
296308
// without argument.
297309
HostKeyCallback ssh.HostKeyCallback
310+
298311
}
299312

300-
// SetHostKeyCallback sets the field HostKeyCallback in the given cfg. If
301-
// HostKeyCallback is empty a default callback is created using
302-
// NewKnownHostsCallback.
313+
// SetHostKeyCallback sets the field HostKeyCallback in the given cfg.
314+
// If the host key callback is empty it is left empty. It will be handled
315+
// by the dial method by falling back to knownhosts.
303316
func (m *HostKeyCallbackHelper) SetHostKeyCallback(cfg *ssh.ClientConfig) (*ssh.ClientConfig, error) {
304-
var err error
305-
if m.HostKeyCallback == nil {
306-
if m.HostKeyCallback, err = NewKnownHostsCallback(); err != nil {
307-
return cfg, err
308-
}
309-
}
310317

311318
cfg.HostKeyCallback = m.HostKeyCallback
312319
return cfg, nil

‎plumbing/transport/ssh/auth_method_test.go

Lines changed: 88 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ import (
55
"fmt"
66
"os"
77
"runtime"
8+
"slices"
89
"strings"
910

1011
"github.com/go-git/go-billy/v5/osfs"
@@ -18,7 +19,8 @@ import (
1819
type (
1920
SuiteCommon struct{}
2021

21-
mockKnownHosts struct{}
22+
mockKnownHosts struct{}
23+
mockKnownHostsWithCert struct{}
2224
)
2325

2426
func (mockKnownHosts) host() string { return "github.com" }
@@ -27,6 +29,19 @@ func (mockKnownHosts) knownHosts() []byte {
2729
}
2830
func (mockKnownHosts) Network() string { return "tcp" }
2931
func (mockKnownHosts) String() string { return "github.com:22" }
32+
func (mockKnownHosts) Algorithms() []string {
33+
return []string{ssh.KeyAlgoRSA, ssh.KeyAlgoRSASHA256, ssh.KeyAlgoRSASHA512}
34+
}
35+
36+
func (mockKnownHostsWithCert) host() string { return "github.com" }
37+
func (mockKnownHostsWithCert) knownHosts() []byte {
38+
return []byte(`@cert-authority github.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==`)
39+
}
40+
func (mockKnownHostsWithCert) Network() string { return "tcp" }
41+
func (mockKnownHostsWithCert) String() string { return "github.com:22" }
42+
func (mockKnownHostsWithCert) Algorithms() []string {
43+
return []string{ssh.CertAlgoRSASHA512v01, ssh.CertAlgoRSASHA256v01, ssh.CertAlgoRSAv01}
44+
}
3045

3146
var _ = Suite(&SuiteCommon{})
3247

@@ -230,3 +245,75 @@ func (*SuiteCommon) TestNewKnownHostsCallback(c *C) {
230245
err = clb(mock.String(), mock, hostKey)
231246
c.Assert(err, IsNil)
232247
}
248+
249+
func (*SuiteCommon) TestNewKnownHostsDbWithoutCert(c *C) {
250+
if runtime.GOOS == "js" {
251+
c.Skip("not available in wasm")
252+
}
253+
254+
var mock = mockKnownHosts{}
255+
256+
f, err := util.TempFile(osfs.Default, "", "known-hosts")
257+
c.Assert(err, IsNil)
258+
259+
_, err = f.Write(mock.knownHosts())
260+
c.Assert(err, IsNil)
261+
262+
err = f.Close()
263+
c.Assert(err, IsNil)
264+
265+
defer util.RemoveAll(osfs.Default, f.Name())
266+
267+
f, err = osfs.Default.Open(f.Name())
268+
c.Assert(err, IsNil)
269+
270+
defer f.Close()
271+
272+
db, err := NewKnownHostsDb(f.Name())
273+
c.Assert(err, IsNil)
274+
275+
algos := db.HostKeyAlgorithms(mock.String())
276+
c.Assert(algos, HasLen, len(mock.Algorithms()))
277+
278+
for _, algorithm := range mock.Algorithms() {
279+
if !slices.Contains(algos, algorithm) {
280+
c.Error("algos does not contain ", algorithm)
281+
}
282+
}
283+
}
284+
285+
func (*SuiteCommon) TestNewKnownHostsDbWithCert(c *C) {
286+
if runtime.GOOS == "js" {
287+
c.Skip("not available in wasm")
288+
}
289+
290+
var mock = mockKnownHostsWithCert{}
291+
292+
f, err := util.TempFile(osfs.Default, "", "known-hosts")
293+
c.Assert(err, IsNil)
294+
295+
_, err = f.Write(mock.knownHosts())
296+
c.Assert(err, IsNil)
297+
298+
err = f.Close()
299+
c.Assert(err, IsNil)
300+
301+
defer util.RemoveAll(osfs.Default, f.Name())
302+
303+
f, err = osfs.Default.Open(f.Name())
304+
c.Assert(err, IsNil)
305+
306+
defer f.Close()
307+
308+
db, err := NewKnownHostsDb(f.Name())
309+
c.Assert(err, IsNil)
310+
311+
algos := db.HostKeyAlgorithms(mock.String())
312+
c.Assert(algos, HasLen, len(mock.Algorithms()))
313+
314+
for _, algorithm := range mock.Algorithms() {
315+
if !slices.Contains(algos, algorithm) {
316+
c.Error("algos does not contain ", algorithm)
317+
}
318+
}
319+
}

‎plumbing/transport/ssh/common.go

Lines changed: 8 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,6 @@ import (
1111

1212
"github.com/go-git/go-git/v5/plumbing/transport"
1313
"github.com/go-git/go-git/v5/plumbing/transport/internal/common"
14-
"github.com/skeema/knownhosts"
1514

1615
"github.com/kevinburke/ssh_config"
1716
"golang.org/x/crypto/ssh"
@@ -127,17 +126,17 @@ func (c *command) connect() error {
127126
}
128127
hostWithPort := c.getHostWithPort()
129128
if config.HostKeyCallback == nil {
130-
kh, err := newKnownHosts()
129+
db, err := NewKnownHostsDb()
131130
if err != nil {
132131
return err
133132
}
134-
config.HostKeyCallback = kh.HostKeyCallback()
135-
config.HostKeyAlgorithms = kh.HostKeyAlgorithms(hostWithPort)
136-
} else if len(config.HostKeyAlgorithms) == 0 {
137-
// Set the HostKeyAlgorithms based on HostKeyCallback.
138-
// For background see https://github.com/go-git/go-git/issues/411 as well as
139-
// https://github.com/golang/go/issues/29286 for root cause.
140-
config.HostKeyAlgorithms = knownhosts.HostKeyAlgorithms(config.HostKeyCallback, hostWithPort)
133+
config.HostKeyCallback = db.HostKeyCallback()
134+
config.HostKeyAlgorithms = db.HostKeyAlgorithms(hostWithPort)
135+
} else {
136+
// If the user gave a custom HostKeyCallback, we do not try to detect host key algorithms
137+
// based on knownhosts functionality, as the user may be requesting a FixedKey or using a
138+
// different key approval strategy. In that case, the user is responsible for populating
139+
// HostKeyAlgorithms appropriately
141140
}
142141

143142
overrideConfig(c.config, config)

0 commit comments

Comments
 (0)
0