Skip to content

Commit 768fda7

Browse files
pjbgfpjbgf
authored
Merge pull request #1482 from Javier-varez/add-cert-auth-support-v5.x
plumbing: add cert auth support to `releases/v5.x`
2 parents 863c621 + ba9d693 commit 768fda7

File tree

4 files changed

+151
-32
lines changed

4 files changed

+151
-32
lines changed

‎plumbing/transport/ssh/auth_method.go‎

Lines changed: 32 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ func (a *KeyboardInteractive) String() string {
5454
}
5555

5656
func (a *KeyboardInteractive) ClientConfig() (*ssh.ClientConfig, error) {
57-
return a.SetHostKeyCallback(&ssh.ClientConfig{
57+
return a.SetHostKeyCallbackAndAlgorithms(&ssh.ClientConfig{
5858
User: a.User,
5959
Auth: []ssh.AuthMethod{
6060
a.Challenge,
@@ -78,7 +78,7 @@ func (a *Password) String() string {
7878
}
7979

8080
func (a *Password) ClientConfig() (*ssh.ClientConfig, error) {
81-
return a.SetHostKeyCallback(&ssh.ClientConfig{
81+
return a.SetHostKeyCallbackAndAlgorithms(&ssh.ClientConfig{
8282
User: a.User,
8383
Auth: []ssh.AuthMethod{ssh.Password(a.Password)},
8484
})
@@ -101,7 +101,7 @@ func (a *PasswordCallback) String() string {
101101
}
102102

103103
func (a *PasswordCallback) ClientConfig() (*ssh.ClientConfig, error) {
104-
return a.SetHostKeyCallback(&ssh.ClientConfig{
104+
return a.SetHostKeyCallbackAndAlgorithms(&ssh.ClientConfig{
105105
User: a.User,
106106
Auth: []ssh.AuthMethod{ssh.PasswordCallback(a.Callback)},
107107
})
@@ -150,7 +150,7 @@ func (a *PublicKeys) String() string {
150150
}
151151

152152
func (a *PublicKeys) ClientConfig() (*ssh.ClientConfig, error) {
153-
return a.SetHostKeyCallback(&ssh.ClientConfig{
153+
return a.SetHostKeyCallbackAndAlgorithms(&ssh.ClientConfig{
154154
User: a.User,
155155
Auth: []ssh.AuthMethod{ssh.PublicKeys(a.Signer)},
156156
})
@@ -211,7 +211,7 @@ func (a *PublicKeysCallback) String() string {
211211
}
212212

213213
func (a *PublicKeysCallback) ClientConfig() (*ssh.ClientConfig, error) {
214-
return a.SetHostKeyCallback(&ssh.ClientConfig{
214+
return a.SetHostKeyCallbackAndAlgorithms(&ssh.ClientConfig{
215215
User: a.User,
216216
Auth: []ssh.AuthMethod{ssh.PublicKeysCallback(a.Callback)},
217217
})
@@ -230,11 +230,23 @@ func (a *PublicKeysCallback) ClientConfig() (*ssh.ClientConfig, error) {
230230
// ~/.ssh/known_hosts
231231
// /etc/ssh/ssh_known_hosts
232232
func NewKnownHostsCallback(files ...string) (ssh.HostKeyCallback, error) {
233-
kh, err := newKnownHosts(files...)
234-
return ssh.HostKeyCallback(kh), err
233+
kh, err := NewKnownHostsDb(files...)
234+
return kh.HostKeyCallback(), err
235235
}
236236

237-
func newKnownHosts(files ...string) (knownhosts.HostKeyCallback, error) {
237+
// NewKnownHostsDb returns knownhosts.HostKeyDB based on a file based on a
238+
// known_hosts file. http://man.openbsd.org/sshd#SSH_KNOWN_HOSTS_FILE_FORMAT
239+
//
240+
// If list of files is empty, then it will be read from the SSH_KNOWN_HOSTS
241+
// environment variable, example:
242+
//
243+
// /home/foo/custom_known_hosts_file:/etc/custom_known/hosts_file
244+
//
245+
// If SSH_KNOWN_HOSTS is not set the following file locations will be used:
246+
//
247+
// ~/.ssh/known_hosts
248+
// /etc/ssh/ssh_known_hosts
249+
func NewKnownHostsDb(files ...string) (*knownhosts.HostKeyDB, error) {
238250
var err error
239251

240252
if len(files) == 0 {
@@ -247,7 +259,7 @@ func newKnownHosts(files ...string) (knownhosts.HostKeyCallback, error) {
247259
return nil, err
248260
}
249261

250-
return knownhosts.New(files...)
262+
return knownhosts.NewDB(files...)
251263
}
252264

253265
func getDefaultKnownHostsFiles() ([]string, error) {
@@ -289,25 +301,23 @@ func filterKnownHostsFiles(files ...string) ([]string, error) {
289301
}
290302

291303
// HostKeyCallbackHelper is a helper that provides common functionality to
292-
// configure HostKeyCallback into a ssh.ClientConfig.
304+
// configure HostKeyCallback and HostKeyAlgorithms into a ssh.ClientConfig.
293305
type HostKeyCallbackHelper struct {
294306
// HostKeyCallback is the function type used for verifying server keys.
295-
// If nil default callback will be create using NewKnownHostsCallback
307+
// If nil, a default callback will be created using NewKnownHostsDb
296308
// without argument.
297309
HostKeyCallback ssh.HostKeyCallback
298-
}
299310

300-
// SetHostKeyCallback sets the field HostKeyCallback in the given cfg. If
301-
// HostKeyCallback is empty a default callback is created using
302-
// NewKnownHostsCallback.
303-
func (m *HostKeyCallbackHelper) SetHostKeyCallback(cfg *ssh.ClientConfig) (*ssh.ClientConfig, error) {
304-
var err error
305-
if m.HostKeyCallback == nil {
306-
if m.HostKeyCallback, err = NewKnownHostsCallback(); err != nil {
307-
return cfg, err
308-
}
309-
}
311+
// HostKeyAlgorithms is a list of supported host key algorithms that will
312+
// be used for host key verification.
313+
HostKeyAlgorithms []string
314+
}
310315

316+
// SetHostKeyCallbackAndAlgorithms sets the field HostKeyCallback and HostKeyAlgorithms in the given cfg.
317+
// If the host key callback or algorithms is empty it is left empty. It will be handled by the dial method,
318+
// falling back to knownhosts.
319+
func (m *HostKeyCallbackHelper) SetHostKeyCallbackAndAlgorithms(cfg *ssh.ClientConfig) (*ssh.ClientConfig, error) {
311320
cfg.HostKeyCallback = m.HostKeyCallback
321+
cfg.HostKeyAlgorithms = m.HostKeyAlgorithms
312322
return cfg, nil
313323
}

‎plumbing/transport/ssh/auth_method_test.go‎

Lines changed: 88 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ import (
55
"fmt"
66
"os"
77
"runtime"
8+
"slices"
89
"strings"
910

1011
"github.com/go-git/go-billy/v5/osfs"
@@ -18,7 +19,8 @@ import (
1819
type (
1920
SuiteCommon struct{}
2021

21-
mockKnownHosts struct{}
22+
mockKnownHosts struct{}
23+
mockKnownHostsWithCert struct{}
2224
)
2325

2426
func (mockKnownHosts) host() string { return "github.com" }
@@ -27,6 +29,19 @@ func (mockKnownHosts) knownHosts() []byte {
2729
}
2830
func (mockKnownHosts) Network() string { return "tcp" }
2931
func (mockKnownHosts) String() string { return "github.com:22" }
32+
func (mockKnownHosts) Algorithms() []string {
33+
return []string{ssh.KeyAlgoRSA, ssh.KeyAlgoRSASHA256, ssh.KeyAlgoRSASHA512}
34+
}
35+
36+
func (mockKnownHostsWithCert) host() string { return "github.com" }
37+
func (mockKnownHostsWithCert) knownHosts() []byte {
38+
return []byte(`@cert-authority github.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==`)
39+
}
40+
func (mockKnownHostsWithCert) Network() string { return "tcp" }
41+
func (mockKnownHostsWithCert) String() string { return "github.com:22" }
42+
func (mockKnownHostsWithCert) Algorithms() []string {
43+
return []string{ssh.CertAlgoRSASHA512v01, ssh.CertAlgoRSASHA256v01, ssh.CertAlgoRSAv01}
44+
}
3045

3146
var _ = Suite(&SuiteCommon{})
3247

@@ -230,3 +245,75 @@ func (*SuiteCommon) TestNewKnownHostsCallback(c *C) {
230245
err = clb(mock.String(), mock, hostKey)
231246
c.Assert(err, IsNil)
232247
}
248+
249+
func (*SuiteCommon) TestNewKnownHostsDbWithoutCert(c *C) {
250+
if runtime.GOOS == "js" {
251+
c.Skip("not available in wasm")
252+
}
253+
254+
var mock = mockKnownHosts{}
255+
256+
f, err := util.TempFile(osfs.Default, "", "known-hosts")
257+
c.Assert(err, IsNil)
258+
259+
_, err = f.Write(mock.knownHosts())
260+
c.Assert(err, IsNil)
261+
262+
err = f.Close()
263+
c.Assert(err, IsNil)
264+
265+
defer util.RemoveAll(osfs.Default, f.Name())
266+
267+
f, err = osfs.Default.Open(f.Name())
268+
c.Assert(err, IsNil)
269+
270+
defer f.Close()
271+
272+
db, err := NewKnownHostsDb(f.Name())
273+
c.Assert(err, IsNil)
274+
275+
algos := db.HostKeyAlgorithms(mock.String())
276+
c.Assert(algos, HasLen, len(mock.Algorithms()))
277+
278+
for _, algorithm := range mock.Algorithms() {
279+
if !slices.Contains(algos, algorithm) {
280+
c.Error("algos does not contain ", algorithm)
281+
}
282+
}
283+
}
284+
285+
func (*SuiteCommon) TestNewKnownHostsDbWithCert(c *C) {
286+
if runtime.GOOS == "js" {
287+
c.Skip("not available in wasm")
288+
}
289+
290+
var mock = mockKnownHostsWithCert{}
291+
292+
f, err := util.TempFile(osfs.Default, "", "known-hosts")
293+
c.Assert(err, IsNil)
294+
295+
_, err = f.Write(mock.knownHosts())
296+
c.Assert(err, IsNil)
297+
298+
err = f.Close()
299+
c.Assert(err, IsNil)
300+
301+
defer util.RemoveAll(osfs.Default, f.Name())
302+
303+
f, err = osfs.Default.Open(f.Name())
304+
c.Assert(err, IsNil)
305+
306+
defer f.Close()
307+
308+
db, err := NewKnownHostsDb(f.Name())
309+
c.Assert(err, IsNil)
310+
311+
algos := db.HostKeyAlgorithms(mock.String())
312+
c.Assert(algos, HasLen, len(mock.Algorithms()))
313+
314+
for _, algorithm := range mock.Algorithms() {
315+
if !slices.Contains(algos, algorithm) {
316+
c.Error("algos does not contain ", algorithm)
317+
}
318+
}
319+
}

‎plumbing/transport/ssh/common.go‎

Lines changed: 8 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,6 @@ import (
1111

1212
"github.com/go-git/go-git/v5/plumbing/transport"
1313
"github.com/go-git/go-git/v5/plumbing/transport/internal/common"
14-
"github.com/skeema/knownhosts"
1514

1615
"github.com/kevinburke/ssh_config"
1716
"golang.org/x/crypto/ssh"
@@ -127,17 +126,17 @@ func (c *command) connect() error {
127126
}
128127
hostWithPort := c.getHostWithPort()
129128
if config.HostKeyCallback == nil {
130-
kh, err := newKnownHosts()
129+
db, err := NewKnownHostsDb()
131130
if err != nil {
132131
return err
133132
}
134-
config.HostKeyCallback = kh.HostKeyCallback()
135-
config.HostKeyAlgorithms = kh.HostKeyAlgorithms(hostWithPort)
136-
} else if len(config.HostKeyAlgorithms) == 0 {
137-
// Set the HostKeyAlgorithms based on HostKeyCallback.
138-
// For background see https://github.com/go-git/go-git/issues/411 as well as
139-
// https://github.com/golang/go/issues/29286 for root cause.
140-
config.HostKeyAlgorithms = knownhosts.HostKeyAlgorithms(config.HostKeyCallback, hostWithPort)
133+
config.HostKeyCallback = db.HostKeyCallback()
134+
config.HostKeyAlgorithms = db.HostKeyAlgorithms(hostWithPort)
135+
} else {
136+
// If the user gave a custom HostKeyCallback, we do not try to detect host key algorithms
137+
// based on knownhosts functionality, as the user may be requesting a FixedKey or using a
138+
// different key approval strategy. In that case, the user is responsible for populating
139+
// HostKeyAlgorithms appropriately
141140
}
142141

143142
overrideConfig(c.config, config)

‎plumbing/transport/ssh/common_test.go‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -129,12 +129,35 @@ func (s *SuiteCommon) TestFixedHostKeyCallback(c *C) {
129129
c.Assert(err, IsNil)
130130
c.Assert(auth, NotNil)
131131
auth.HostKeyCallback = stdssh.FixedHostKey(hostKey.PublicKey())
132+
auth.HostKeyAlgorithms = []string{"ssh-ed25519"}
132133
ep := uploadPack.newEndpoint(c, "bar.git")
133134
ps, err := uploadPack.Client.NewUploadPackSession(ep, auth)
134135
c.Assert(err, IsNil)
135136
c.Assert(ps, NotNil)
136137
}
137138

139+
func (s *SuiteCommon) TestFixedHostKeyCallbackUnexpectedAlgorithm(c *C) {
140+
hostKey, err := stdssh.ParsePrivateKey(testdata.PEMBytes["ed25519"])
141+
c.Assert(err, IsNil)
142+
uploadPack := &UploadPackSuite{
143+
opts: []ssh.Option{
144+
ssh.HostKeyPEM(testdata.PEMBytes["rsa"]),
145+
},
146+
}
147+
uploadPack.SetUpSuite(c)
148+
// Use the default client, which does not have a host key callback
149+
uploadPack.Client = DefaultClient
150+
auth, err := NewPublicKeys("foo", testdata.PEMBytes["rsa"], "")
151+
c.Assert(err, IsNil)
152+
c.Assert(auth, NotNil)
153+
auth.HostKeyCallback = stdssh.FixedHostKey(hostKey.PublicKey())
154+
auth.HostKeyAlgorithms = []string{"ssh-ed25519"}
155+
ep := uploadPack.newEndpoint(c, "bar.git")
156+
ps, err := uploadPack.Client.NewUploadPackSession(ep, auth)
157+
c.Assert(err, NotNil)
158+
c.Assert(ps, IsNil)
159+
}
160+
138161
func (s *SuiteCommon) TestFailHostKeyCallback(c *C) {
139162
uploadPack := &UploadPackSuite{
140163
opts: []ssh.Option{

0 commit comments

Comments
 (0)