Implement http signatures support for the API (#17565)
Fixes #12338 This allows use to talk to the API with our ssh certificate (and/or ssh-agent) without needing to fetch an API key or tokens. It will just automatically work when users have added their ssh principal in gitea. This needs client code in tea Update: also support normal pubkeys ref: https://tools.ietf.org/html/draft-cavage-http-signatures Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: zeripath <art27@cantab.net> Signed-off-by: Andrew Thornton <art27@cantab.net>tokarchuk/v1.17
Wim
3 years ago
committed by
GitHub
parent
48be5e77e5
commit
e528e2b435
@ -0,0 +1,137 @@ |
|||||||
|
// Copyright 2022 The Gitea Authors. All rights reserved.
|
||||||
|
// Use of this source code is governed by a MIT-style
|
||||||
|
// license that can be found in the LICENSE file.
|
||||||
|
|
||||||
|
package integrations |
||||||
|
|
||||||
|
import ( |
||||||
|
"encoding/base64" |
||||||
|
"fmt" |
||||||
|
"net/http" |
||||||
|
"net/url" |
||||||
|
"testing" |
||||||
|
|
||||||
|
api "code.gitea.io/gitea/modules/structs" |
||||||
|
|
||||||
|
"github.com/go-fed/httpsig" |
||||||
|
"golang.org/x/crypto/ssh" |
||||||
|
) |
||||||
|
|
||||||
|
const ( |
||||||
|
httpsigPrivateKey = `-----BEGIN OPENSSH PRIVATE KEY----- |
||||||
|
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABFwAAAAdzc2gtcn |
||||||
|
NhAAAAAwEAAQAAAQEAqjmQeb5Eb1xV7qbNf9ErQ0XRvKZWzUsLFhJzZz+Ab7q8WtPs91vQ |
||||||
|
fBiypw4i8OTG6WzDcgZaV8Ndxn7iHnIstdA1k89MVG4stydymmwmk9+mrCMNsu5OmdIy9F |
||||||
|
AZ61RDcKuf5VG2WKkmeK0VO+OMJIYfE1C6czNeJ6UAmcIOmhGxvjMI83XUO9n0ftwTwayp |
||||||
|
+XU5prvKx/fTvlPjbraPNU4OzwPjVLqXBzpoXYhBquPaZYFRVyvfFZLObYsmy+BrsxcloM |
||||||
|
l+9w4P0ATJ9njB7dRDL+RrN4uhhYSihqOK4w4vaiOj1+aA0eC0zXunEfLXfGIVQ/FhWcCy |
||||||
|
5f72mMiKnQAAA9AxSmzFMUpsxQAAAAdzc2gtcnNhAAABAQCqOZB5vkRvXFXups1/0StDRd |
||||||
|
G8plbNSwsWEnNnP4Bvurxa0+z3W9B8GLKnDiLw5MbpbMNyBlpXw13GfuIeciy10DWTz0xU |
||||||
|
biy3J3KabCaT36asIw2y7k6Z0jL0UBnrVENwq5/lUbZYqSZ4rRU744wkhh8TULpzM14npQ |
||||||
|
CZwg6aEbG+MwjzddQ72fR+3BPBrKn5dTmmu8rH99O+U+Nuto81Tg7PA+NUupcHOmhdiEGq |
||||||
|
49plgVFXK98Vks5tiybL4GuzFyWgyX73Dg/QBMn2eMHt1EMv5Gs3i6GFhKKGo4rjDi9qI6 |
||||||
|
PX5oDR4LTNe6cR8td8YhVD8WFZwLLl/vaYyIqdAAAAAwEAAQAAAQBz+nyBNi2SYir6SxPA |
||||||
|
flcnoq5gBkUl4ndPNosCUbXEakpi5/mQHzJRGtK+F1efIYCVEdGoIsPy/90onNKbQ9dKmO |
||||||
|
2oI5kx/U7iCzJ+HCm8nqkEp21x+AP9scWdx+Wg/OxmG8j5iU7f4X+gwOyyvTqCuA78Lgia |
||||||
|
7Oi9wiJCoIEqXr6dRYGJzfASwKA2dj995HzATexleLSD5fQCmZTF+Vh5OQ5WmE+c53JdZS |
||||||
|
T3Plie/P/smgSWBtf1fWr6JL2+EBsqQsIK1Jo7r/7rxsz+ILoVfnneNQY4QSa9W+t6ZAI+ |
||||||
|
caSA0Guv7vC92ewjlMVlwKa3XaEjMJb5sFlg1r6TYMwBAAAAgQDQwXvgSXNaSHIeH53/Ab |
||||||
|
t4BlNibtxK8vY8CZFloAKXkjrivKSlDAmQCM0twXOweX2ScPjE+XlSMV4AUsv/J6XHGHci |
||||||
|
W3+PGIBfc/fQRBpiyhzkoXYDVrlkSKHffCnAqTUQlYkhr0s7NkZpEeqPE0doAUs4dK3Iqb |
||||||
|
zdtz8e5BPXZwAAAIEA4U/JskIu5Oge8Is2OLOhlol0EJGw5JGodpFyhbMC+QYK9nYqy7wI |
||||||
|
a6mZ2EfOjjwIZD/+wYyulw6cRve4zXwgzUEXLIKp8/H3sYvJK2UMeP7y68sQFqGxbm6Rnh |
||||||
|
tyBBSaJQnOXVOFf9gqZGCyO/J0Illg3AXTuC8KS/cxwasC38EAAACBAMFo/6XQoR6E3ynj |
||||||
|
VBaz2SilWqQBixUyvcNz8LY73IIDCecoccRMFSEKhWtvlJijxvFbF9M8g9oKAVPuub4V5r |
||||||
|
CGmwVPEd5yt4C2iyV0PhLp1PA2/i42FpCSnHaz/EXSz6ncTZcOMMuDqUbgUUpQg4VSUDl9 |
||||||
|
fhTNAzWwZoQ91aHdAAAAFHUwMDIyMTQ2QGljdHMtcC1ueC03AQIDBAUG |
||||||
|
-----END OPENSSH PRIVATE KEY-----` |
||||||
|
httpsigCertificate = `ssh-rsa-cert-v01@openssh.com AAAAHHNzaC1yc2EtY2VydC12MDFAb3BlbnNzaC5jb20AAAAgiR7SU8gmZLhopx4Y03nOXVuAb+4fyMcJYjMGcE1Z2oEAAAADAQABAAABAQCqOZB5vkRvXFXups1/0StDRdG8plbNSwsWEnNnP4Bvurxa0+z3W9B8GLKnDiLw5MbpbMNyBlpXw13GfuIeciy10DWTz0xUbiy3J3KabCaT36asIw2y7k6Z0jL0UBnrVENwq5/lUbZYqSZ4rRU744wkhh8TULpzM14npQCZwg6aEbG+MwjzddQ72fR+3BPBrKn5dTmmu8rH99O+U+Nuto81Tg7PA+NUupcHOmhdiEGq49plgVFXK98Vks5tiybL4GuzFyWgyX73Dg/QBMn2eMHt1EMv5Gs3i6GFhKKGo4rjDi9qI6PX5oDR4LTNe6cR8td8YhVD8WFZwLLl/vaYyIqdAAAAAAAAAAEAAAABAAAABXVzZXIxAAAACQAAAAV1c2VyMQAAAABimoIOAAAAAMCWkRMAAAAAAAAAggAAABVwZXJtaXQtWDExLWZvcndhcmRpbmcAAAAAAAAAF3Blcm1pdC1hZ2VudC1mb3J3YXJkaW5nAAAAAAAAABZwZXJtaXQtcG9ydC1mb3J3YXJkaW5nAAAAAAAAAApwZXJtaXQtcHR5AAAAAAAAAA5wZXJtaXQtdXNlci1yYwAAAAAAAAAAAAABlwAAAAdzc2gtcnNhAAAAAwEAAQAAAYEAm+AwtXTBZyeqV1qOxjMU3Ibc5iR2M3zerGfRQDxUeIozC3xpIvqJbzjDuRapdf8hpxn2xC0GtUusuLIUr4/+Svs1BUnJhF2H9xnK/O0aopS5MpNekUvnBzQdbvO8Ux2xE2mt58giXhkEaXeCEODSqG++OZsA2e40AR/AGRJ4OdDofMvH4vLJAQQc2mKdYpYL8xu+NC+7nsenx1etpsqtEl3gmvqCVI6t9uhVPMvlbGt9h/AN3u7ToF2T3bdk1TZbcdkvR9ljvETIuy32ksAETX8tc7vm30edK+nn/GMeWCgjM+MFm9Uh1NRkvNNJozo5SJy0DkWETTJUsEdfry5VQ3IjqhWqQ0m4/mDlTmsEdEdWqpUiqWZLd9w7jgT8fanuglZyIu2fj8fyqjPjiws5S2P0Uvi28UKQ1nH01UYj/kuakU3BNzN1IqDf3tARP9fjKV/dCBqb1ZAOtyC2GyhGuGzNwEi+woUwq+sTeV0/hqVSb3hSitXHzcfRMRyOK82BAAABlAAAAAxyc2Etc2hhMi01MTIAAAGAMBfgZFvz4BdxriGKYd6eRhMo6hf+I8S9uzNRsflJXHuA+HR9ExIm/Q9JjKmfThQzNyGGBOBILaDU205SAJuG+kk3SieSQDd75ZQd8YmNlCc+516AriOsTiyVCupnf3I2euTjMZqEZbJcBbkBljppTOWQVN7xxE8QakDfGhg0+RjJE9wYOTmkKpDBfII5Nw8V5DoOD7kNEpXYqHdy/8lVxpqUYNIP1J0dNP4f6qBcZcM1PDA12q8zwIGqSNNjf2UXY/Nr8nv9CnK4fB8NDOPKTBa4cm48BGbvM/X0l6dYKswuZ9Np8lw+y6+GxTgznGCrkzMmuEV4FzSq4xHp41H2L2MTwUkwYaeyG1VP6aWkvn6zPkSxaaJDfQX7CAFe17IhIGXR0UPLjKjh35nDLzMWb/W6/W1lK9YkZNHXSf7Z9m9MUAZN7yQgOggGsuYEW4imZxvZizMd+fdDu9mbhr0FDis89I7MSJDnyYRE9FXS7p3QpppBwGcss/9yV3JV3Bjc` |
||||||
|
) |
||||||
|
|
||||||
|
func TestHTTPSigPubKey(t *testing.T) { |
||||||
|
// Add our public key to user1
|
||||||
|
defer prepareTestEnv(t)() |
||||||
|
session := loginUser(t, "user1") |
||||||
|
token := url.QueryEscape(getTokenForLoggedInUser(t, session)) |
||||||
|
keysURL := fmt.Sprintf("/api/v1/user/keys?token=%s", token) |
||||||
|
keyType := "ssh-rsa" |
||||||
|
keyContent := "AAAAB3NzaC1yc2EAAAADAQABAAABAQCqOZB5vkRvXFXups1/0StDRdG8plbNSwsWEnNnP4Bvurxa0+z3W9B8GLKnDiLw5MbpbMNyBlpXw13GfuIeciy10DWTz0xUbiy3J3KabCaT36asIw2y7k6Z0jL0UBnrVENwq5/lUbZYqSZ4rRU744wkhh8TULpzM14npQCZwg6aEbG+MwjzddQ72fR+3BPBrKn5dTmmu8rH99O+U+Nuto81Tg7PA+NUupcHOmhdiEGq49plgVFXK98Vks5tiybL4GuzFyWgyX73Dg/QBMn2eMHt1EMv5Gs3i6GFhKKGo4rjDi9qI6PX5oDR4LTNe6cR8td8YhVD8WFZwLLl/vaYyIqd" |
||||||
|
rawKeyBody := api.CreateKeyOption{ |
||||||
|
Title: "test-key", |
||||||
|
Key: keyType + " " + keyContent, |
||||||
|
} |
||||||
|
req := NewRequestWithJSON(t, "POST", keysURL, rawKeyBody) |
||||||
|
session.MakeRequest(t, req, http.StatusCreated) |
||||||
|
|
||||||
|
// parse our private key and create the httpsig request
|
||||||
|
sshSigner, _ := ssh.ParsePrivateKey([]byte(httpsigPrivateKey)) |
||||||
|
keyID := ssh.FingerprintSHA256(sshSigner.PublicKey()) |
||||||
|
|
||||||
|
// create the request
|
||||||
|
req = NewRequest(t, "GET", "/api/v1/admin/users") |
||||||
|
|
||||||
|
signer, _, err := httpsig.NewSSHSigner(sshSigner, httpsig.DigestSha512, []string{httpsig.RequestTarget, "(created)", "(expires)"}, httpsig.Signature, 10) |
||||||
|
if err != nil { |
||||||
|
t.Fatal(err) |
||||||
|
} |
||||||
|
|
||||||
|
// sign the request
|
||||||
|
err = signer.SignRequest(keyID, req, nil) |
||||||
|
if err != nil { |
||||||
|
t.Fatal(err) |
||||||
|
} |
||||||
|
|
||||||
|
// make the request
|
||||||
|
MakeRequest(t, req, http.StatusOK) |
||||||
|
} |
||||||
|
|
||||||
|
func TestHTTPSigCert(t *testing.T) { |
||||||
|
// Add our public key to user1
|
||||||
|
defer prepareTestEnv(t)() |
||||||
|
session := loginUser(t, "user1") |
||||||
|
|
||||||
|
csrf := GetCSRF(t, session, "/user/settings/keys") |
||||||
|
req := NewRequestWithValues(t, "POST", "/user/settings/keys", map[string]string{ |
||||||
|
"_csrf": csrf, |
||||||
|
"content": "user1", |
||||||
|
"title": "principal", |
||||||
|
"type": "principal", |
||||||
|
}) |
||||||
|
|
||||||
|
session.MakeRequest(t, req, http.StatusSeeOther) |
||||||
|
pkcert, _, _, _, err := ssh.ParseAuthorizedKey([]byte(httpsigCertificate)) |
||||||
|
if err != nil { |
||||||
|
t.Fatal(err) |
||||||
|
} |
||||||
|
|
||||||
|
// parse our private key and create the httpsig request
|
||||||
|
sshSigner, _ := ssh.ParsePrivateKey([]byte(httpsigPrivateKey)) |
||||||
|
keyID := "gitea" |
||||||
|
|
||||||
|
// create our certificate signer using the ssh signer and our certificate
|
||||||
|
certSigner, err := ssh.NewCertSigner(pkcert.(*ssh.Certificate), sshSigner) |
||||||
|
if err != nil { |
||||||
|
t.Fatal(err) |
||||||
|
} |
||||||
|
|
||||||
|
// create the request
|
||||||
|
req = NewRequest(t, "GET", "/api/v1/admin/users") |
||||||
|
|
||||||
|
// add our cert to the request
|
||||||
|
certString := base64.RawStdEncoding.EncodeToString(pkcert.(*ssh.Certificate).Marshal()) |
||||||
|
req.Header.Add("x-ssh-certificate", certString) |
||||||
|
|
||||||
|
signer, _, err := httpsig.NewSSHSigner(certSigner, httpsig.DigestSha512, []string{httpsig.RequestTarget, "(created)", "(expires)", "x-ssh-certificate"}, httpsig.Signature, 10) |
||||||
|
if err != nil { |
||||||
|
t.Fatal(err) |
||||||
|
} |
||||||
|
|
||||||
|
// sign the request
|
||||||
|
err = signer.SignRequest(keyID, req, nil) |
||||||
|
if err != nil { |
||||||
|
t.Fatal(err) |
||||||
|
} |
||||||
|
|
||||||
|
// make the request
|
||||||
|
MakeRequest(t, req, http.StatusOK) |
||||||
|
} |
||||||
@ -0,0 +1,217 @@ |
|||||||
|
// Copyright 2021 The Gitea Authors. All rights reserved.
|
||||||
|
// Use of this source code is governed by a MIT-style
|
||||||
|
// license that can be found in the LICENSE file.
|
||||||
|
|
||||||
|
package auth |
||||||
|
|
||||||
|
import ( |
||||||
|
"bytes" |
||||||
|
"encoding/base64" |
||||||
|
"errors" |
||||||
|
"fmt" |
||||||
|
"net/http" |
||||||
|
"strings" |
||||||
|
|
||||||
|
asymkey_model "code.gitea.io/gitea/models/asymkey" |
||||||
|
user_model "code.gitea.io/gitea/models/user" |
||||||
|
"code.gitea.io/gitea/modules/log" |
||||||
|
"code.gitea.io/gitea/modules/setting" |
||||||
|
|
||||||
|
"github.com/go-fed/httpsig" |
||||||
|
"golang.org/x/crypto/ssh" |
||||||
|
) |
||||||
|
|
||||||
|
// Ensure the struct implements the interface.
|
||||||
|
var ( |
||||||
|
_ Method = &HTTPSign{} |
||||||
|
_ Named = &HTTPSign{} |
||||||
|
) |
||||||
|
|
||||||
|
// HTTPSign implements the Auth interface and authenticates requests (API requests
|
||||||
|
// only) by looking for http signature data in the "Signature" header.
|
||||||
|
// more information can be found on https://github.com/go-fed/httpsig
|
||||||
|
type HTTPSign struct{} |
||||||
|
|
||||||
|
// Name represents the name of auth method
|
||||||
|
func (h *HTTPSign) Name() string { |
||||||
|
return "httpsign" |
||||||
|
} |
||||||
|
|
||||||
|
// Verify extracts and validates HTTPsign from the Signature header of the request and returns
|
||||||
|
// the corresponding user object on successful validation.
|
||||||
|
// Returns nil if header is empty or validation fails.
|
||||||
|
func (h *HTTPSign) Verify(req *http.Request, w http.ResponseWriter, store DataStore, sess SessionStore) *user_model.User { |
||||||
|
sigHead := req.Header.Get("Signature") |
||||||
|
if len(sigHead) == 0 { |
||||||
|
return nil |
||||||
|
} |
||||||
|
|
||||||
|
var ( |
||||||
|
publicKey *asymkey_model.PublicKey |
||||||
|
err error |
||||||
|
) |
||||||
|
|
||||||
|
if len(req.Header.Get("X-Ssh-Certificate")) != 0 { |
||||||
|
// Handle Signature signed by SSH certificates
|
||||||
|
if len(setting.SSH.TrustedUserCAKeys) == 0 { |
||||||
|
return nil |
||||||
|
} |
||||||
|
|
||||||
|
publicKey, err = VerifyCert(req) |
||||||
|
if err != nil { |
||||||
|
log.Debug("VerifyCert on request from %s: failed: %v", req.RemoteAddr, err) |
||||||
|
log.Warn("Failed authentication attempt from %s", req.RemoteAddr) |
||||||
|
return nil |
||||||
|
} |
||||||
|
} else { |
||||||
|
// Handle Signature signed by Public Key
|
||||||
|
publicKey, err = VerifyPubKey(req) |
||||||
|
if err != nil { |
||||||
|
log.Debug("VerifyPubKey on request from %s: failed: %v", req.RemoteAddr, err) |
||||||
|
log.Warn("Failed authentication attempt from %s", req.RemoteAddr) |
||||||
|
return nil |
||||||
|
} |
||||||
|
} |
||||||
|
|
||||||
|
u, err := user_model.GetUserByID(publicKey.OwnerID) |
||||||
|
if err != nil { |
||||||
|
log.Error("GetUserByID: %v", err) |
||||||
|
return nil |
||||||
|
} |
||||||
|
|
||||||
|
store.GetData()["IsApiToken"] = true |
||||||
|
|
||||||
|
log.Trace("HTTP Sign: Logged in user %-v", u) |
||||||
|
|
||||||
|
return u |
||||||
|
} |
||||||
|
|
||||||
|
func VerifyPubKey(r *http.Request) (*asymkey_model.PublicKey, error) { |
||||||
|
verifier, err := httpsig.NewVerifier(r) |
||||||
|
if err != nil { |
||||||
|
return nil, fmt.Errorf("httpsig.NewVerifier failed: %s", err) |
||||||
|
} |
||||||
|
|
||||||
|
keyID := verifier.KeyId() |
||||||
|
|
||||||
|
publicKeys, err := asymkey_model.SearchPublicKey(0, keyID) |
||||||
|
if err != nil { |
||||||
|
return nil, err |
||||||
|
} |
||||||
|
|
||||||
|
if len(publicKeys) == 0 { |
||||||
|
return nil, fmt.Errorf("no public key found for keyid %s", keyID) |
||||||
|
} |
||||||
|
|
||||||
|
sshPublicKey, _, _, _, err := ssh.ParseAuthorizedKey([]byte(publicKeys[0].Content)) |
||||||
|
if err != nil { |
||||||
|
return nil, err |
||||||
|
} |
||||||
|
|
||||||
|
if err := doVerify(verifier, []ssh.PublicKey{sshPublicKey}); err != nil { |
||||||
|
return nil, err |
||||||
|
} |
||||||
|
|
||||||
|
return publicKeys[0], nil |
||||||
|
} |
||||||
|
|
||||||
|
// VerifyCert verifies the validity of the ssh certificate and returns the publickey of the signer
|
||||||
|
// We verify that the certificate is signed with the correct CA
|
||||||
|
// We verify that the http request is signed with the private key (of the public key mentioned in the certificate)
|
||||||
|
func VerifyCert(r *http.Request) (*asymkey_model.PublicKey, error) { |
||||||
|
// Get our certificate from the header
|
||||||
|
bcert, err := base64.RawStdEncoding.DecodeString(r.Header.Get("x-ssh-certificate")) |
||||||
|
if err != nil { |
||||||
|
return nil, err |
||||||
|
} |
||||||
|
|
||||||
|
pk, err := ssh.ParsePublicKey(bcert) |
||||||
|
if err != nil { |
||||||
|
return nil, err |
||||||
|
} |
||||||
|
|
||||||
|
// Check if it's really a ssh certificate
|
||||||
|
cert, ok := pk.(*ssh.Certificate) |
||||||
|
if !ok { |
||||||
|
return nil, fmt.Errorf("no certificate found") |
||||||
|
} |
||||||
|
|
||||||
|
c := &ssh.CertChecker{ |
||||||
|
IsUserAuthority: func(auth ssh.PublicKey) bool { |
||||||
|
marshaled := auth.Marshal() |
||||||
|
|
||||||
|
for _, k := range setting.SSH.TrustedUserCAKeysParsed { |
||||||
|
if bytes.Equal(marshaled, k.Marshal()) { |
||||||
|
return true |
||||||
|
} |
||||||
|
} |
||||||
|
|
||||||
|
return false |
||||||
|
}, |
||||||
|
} |
||||||
|
|
||||||
|
// check the CA of the cert
|
||||||
|
if !c.IsUserAuthority(cert.SignatureKey) { |
||||||
|
return nil, fmt.Errorf("CA check failed") |
||||||
|
} |
||||||
|
|
||||||
|
// Create a verifier
|
||||||
|
verifier, err := httpsig.NewVerifier(r) |
||||||
|
if err != nil { |
||||||
|
return nil, fmt.Errorf("httpsig.NewVerifier failed: %s", err) |
||||||
|
} |
||||||
|
|
||||||
|
// now verify that this request was signed with the private key that matches the certificate public key
|
||||||
|
if err := doVerify(verifier, []ssh.PublicKey{cert.Key}); err != nil { |
||||||
|
return nil, err |
||||||
|
} |
||||||
|
|
||||||
|
// Now for each of the certificate valid principals
|
||||||
|
for _, principal := range cert.ValidPrincipals { |
||||||
|
// Look in the db for the public key
|
||||||
|
publicKey, err := asymkey_model.SearchPublicKeyByContentExact(r.Context(), principal) |
||||||
|
if asymkey_model.IsErrKeyNotExist(err) { |
||||||
|
// No public key matches this principal - try the next principal
|
||||||
|
continue |
||||||
|
} else if err != nil { |
||||||
|
// this error will be a db error therefore we can't solve this and we should abort
|
||||||
|
log.Error("SearchPublicKeyByContentExact: %v", err) |
||||||
|
return nil, err |
||||||
|
} |
||||||
|
|
||||||
|
// Validate the cert for this principal
|
||||||
|
if err := c.CheckCert(principal, cert); err != nil { |
||||||
|
// however, because principal is a member of ValidPrincipals - if this fails then the certificate itself is invalid
|
||||||
|
return nil, err |
||||||
|
} |
||||||
|
|
||||||
|
// OK we have a public key for a principal matching a valid certificate whose key has signed this request.
|
||||||
|
return publicKey, nil |
||||||
|
} |
||||||
|
|
||||||
|
// No public key matching a principal in the certificate is registered in gitea
|
||||||
|
return nil, fmt.Errorf("no valid principal found") |
||||||
|
} |
||||||
|
|
||||||
|
// doVerify iterates across the provided public keys attempting the verify the current request against each key in turn
|
||||||
|
func doVerify(verifier httpsig.Verifier, sshPublicKeys []ssh.PublicKey) error { |
||||||
|
for _, publicKey := range sshPublicKeys { |
||||||
|
cryptoPubkey := publicKey.(ssh.CryptoPublicKey).CryptoPublicKey() |
||||||
|
|
||||||
|
var algos []httpsig.Algorithm |
||||||
|
|
||||||
|
switch { |
||||||
|
case strings.HasPrefix(publicKey.Type(), "ssh-ed25519"): |
||||||
|
algos = []httpsig.Algorithm{httpsig.ED25519} |
||||||
|
case strings.HasPrefix(publicKey.Type(), "ssh-rsa"): |
||||||
|
algos = []httpsig.Algorithm{httpsig.RSA_SHA1, httpsig.RSA_SHA256, httpsig.RSA_SHA512} |
||||||
|
} |
||||||
|
for _, algo := range algos { |
||||||
|
if err := verifier.Verify(cryptoPubkey, algo); err == nil { |
||||||
|
return nil |
||||||
|
} |
||||||
|
} |
||||||
|
} |
||||||
|
|
||||||
|
return errors.New("verification failed") |
||||||
|
} |
||||||
Loading…
Reference in new issue