block/ssh: add support for sha256 host key fingerprints
Currently the SSH block driver supports MD5 and SHA1 for host key fingerprints. This is a cryptographically sensitive operation and so these hash algorithms are inadequate by modern standards. This adds support for SHA256 which has been supported in libssh since the 0.8.1 release. Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Message-Id: <20210622115156.138458-1-berrange@redhat.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Acked-by: Richard W.M. Jones <rjones@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
This commit is contained in:
parent
7170170866
commit
bf783261f0
|
@ -442,6 +442,9 @@ static int check_host_key(BDRVSSHState *s, SshHostKeyCheck *hkc, Error **errp)
|
||||||
} else if (hkc->u.hash.type == SSH_HOST_KEY_CHECK_HASH_TYPE_SHA1) {
|
} else if (hkc->u.hash.type == SSH_HOST_KEY_CHECK_HASH_TYPE_SHA1) {
|
||||||
return check_host_key_hash(s, hkc->u.hash.hash,
|
return check_host_key_hash(s, hkc->u.hash.hash,
|
||||||
SSH_PUBLICKEY_HASH_SHA1, errp);
|
SSH_PUBLICKEY_HASH_SHA1, errp);
|
||||||
|
} else if (hkc->u.hash.type == SSH_HOST_KEY_CHECK_HASH_TYPE_SHA256) {
|
||||||
|
return check_host_key_hash(s, hkc->u.hash.hash,
|
||||||
|
SSH_PUBLICKEY_HASH_SHA256, errp);
|
||||||
}
|
}
|
||||||
g_assert_not_reached();
|
g_assert_not_reached();
|
||||||
break;
|
break;
|
||||||
|
|
|
@ -3190,11 +3190,12 @@
|
||||||
#
|
#
|
||||||
# @md5: The given hash is an md5 hash
|
# @md5: The given hash is an md5 hash
|
||||||
# @sha1: The given hash is an sha1 hash
|
# @sha1: The given hash is an sha1 hash
|
||||||
|
# @sha256: The given hash is an sha256 hash
|
||||||
#
|
#
|
||||||
# Since: 2.12
|
# Since: 2.12
|
||||||
##
|
##
|
||||||
{ 'enum': 'SshHostKeyCheckHashType',
|
{ 'enum': 'SshHostKeyCheckHashType',
|
||||||
'data': [ 'md5', 'sha1' ] }
|
'data': [ 'md5', 'sha1', 'sha256' ] }
|
||||||
|
|
||||||
##
|
##
|
||||||
# @SshHostKeyHash:
|
# @SshHostKeyHash:
|
||||||
|
|
|
@ -73,6 +73,9 @@ with iotests.FilePath('t.img') as disk_path, \
|
||||||
iotests.log("=== Test host-key-check options ===")
|
iotests.log("=== Test host-key-check options ===")
|
||||||
iotests.log("")
|
iotests.log("")
|
||||||
|
|
||||||
|
iotests.log("--- no host key checking --")
|
||||||
|
iotests.log("")
|
||||||
|
|
||||||
vm.launch()
|
vm.launch()
|
||||||
blockdev_create(vm, { 'driver': 'ssh',
|
blockdev_create(vm, { 'driver': 'ssh',
|
||||||
'location': {
|
'location': {
|
||||||
|
@ -90,6 +93,9 @@ with iotests.FilePath('t.img') as disk_path, \
|
||||||
|
|
||||||
iotests.img_info_log(remote_path)
|
iotests.img_info_log(remote_path)
|
||||||
|
|
||||||
|
iotests.log("--- known_hosts key checking --")
|
||||||
|
iotests.log("")
|
||||||
|
|
||||||
vm.launch()
|
vm.launch()
|
||||||
blockdev_create(vm, { 'driver': 'ssh',
|
blockdev_create(vm, { 'driver': 'ssh',
|
||||||
'location': {
|
'location': {
|
||||||
|
@ -115,6 +121,7 @@ with iotests.FilePath('t.img') as disk_path, \
|
||||||
# Mappings of base64 representations to digests
|
# Mappings of base64 representations to digests
|
||||||
md5_keys = {}
|
md5_keys = {}
|
||||||
sha1_keys = {}
|
sha1_keys = {}
|
||||||
|
sha256_keys = {}
|
||||||
|
|
||||||
for key in keys:
|
for key in keys:
|
||||||
md5_keys[key] = subprocess.check_output(
|
md5_keys[key] = subprocess.check_output(
|
||||||
|
@ -125,6 +132,10 @@ with iotests.FilePath('t.img') as disk_path, \
|
||||||
'echo %s | base64 -d | sha1sum -b | cut -d" " -f1' % key,
|
'echo %s | base64 -d | sha1sum -b | cut -d" " -f1' % key,
|
||||||
shell=True).rstrip().decode('ascii')
|
shell=True).rstrip().decode('ascii')
|
||||||
|
|
||||||
|
sha256_keys[key] = subprocess.check_output(
|
||||||
|
'echo %s | base64 -d | sha256sum -b | cut -d" " -f1' % key,
|
||||||
|
shell=True).rstrip().decode('ascii')
|
||||||
|
|
||||||
vm.launch()
|
vm.launch()
|
||||||
|
|
||||||
# Find correct key first
|
# Find correct key first
|
||||||
|
@ -150,6 +161,9 @@ with iotests.FilePath('t.img') as disk_path, \
|
||||||
vm.shutdown()
|
vm.shutdown()
|
||||||
iotests.notrun('Did not find a key that fits 127.0.0.1')
|
iotests.notrun('Did not find a key that fits 127.0.0.1')
|
||||||
|
|
||||||
|
iotests.log("--- explicit md5 key checking --")
|
||||||
|
iotests.log("")
|
||||||
|
|
||||||
blockdev_create(vm, { 'driver': 'ssh',
|
blockdev_create(vm, { 'driver': 'ssh',
|
||||||
'location': {
|
'location': {
|
||||||
'path': disk_path,
|
'path': disk_path,
|
||||||
|
@ -164,6 +178,7 @@ with iotests.FilePath('t.img') as disk_path, \
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
'size': 2097152 })
|
'size': 2097152 })
|
||||||
|
|
||||||
blockdev_create(vm, { 'driver': 'ssh',
|
blockdev_create(vm, { 'driver': 'ssh',
|
||||||
'location': {
|
'location': {
|
||||||
'path': disk_path,
|
'path': disk_path,
|
||||||
|
@ -182,6 +197,9 @@ with iotests.FilePath('t.img') as disk_path, \
|
||||||
|
|
||||||
iotests.img_info_log(remote_path)
|
iotests.img_info_log(remote_path)
|
||||||
|
|
||||||
|
iotests.log("--- explicit sha1 key checking --")
|
||||||
|
iotests.log("")
|
||||||
|
|
||||||
vm.launch()
|
vm.launch()
|
||||||
blockdev_create(vm, { 'driver': 'ssh',
|
blockdev_create(vm, { 'driver': 'ssh',
|
||||||
'location': {
|
'location': {
|
||||||
|
@ -215,6 +233,42 @@ with iotests.FilePath('t.img') as disk_path, \
|
||||||
|
|
||||||
iotests.img_info_log(remote_path)
|
iotests.img_info_log(remote_path)
|
||||||
|
|
||||||
|
iotests.log("--- explicit sha256 key checking --")
|
||||||
|
iotests.log("")
|
||||||
|
|
||||||
|
vm.launch()
|
||||||
|
blockdev_create(vm, { 'driver': 'ssh',
|
||||||
|
'location': {
|
||||||
|
'path': disk_path,
|
||||||
|
'server': {
|
||||||
|
'host': '127.0.0.1',
|
||||||
|
'port': '22'
|
||||||
|
},
|
||||||
|
'host-key-check': {
|
||||||
|
'mode': 'hash',
|
||||||
|
'type': 'sha256',
|
||||||
|
'hash': 'wrong',
|
||||||
|
}
|
||||||
|
},
|
||||||
|
'size': 2097152 })
|
||||||
|
blockdev_create(vm, { 'driver': 'ssh',
|
||||||
|
'location': {
|
||||||
|
'path': disk_path,
|
||||||
|
'server': {
|
||||||
|
'host': '127.0.0.1',
|
||||||
|
'port': '22'
|
||||||
|
},
|
||||||
|
'host-key-check': {
|
||||||
|
'mode': 'hash',
|
||||||
|
'type': 'sha256',
|
||||||
|
'hash': sha256_keys[matching_key],
|
||||||
|
}
|
||||||
|
},
|
||||||
|
'size': 4194304 })
|
||||||
|
vm.shutdown()
|
||||||
|
|
||||||
|
iotests.img_info_log(remote_path)
|
||||||
|
|
||||||
#
|
#
|
||||||
# Invalid path and user
|
# Invalid path and user
|
||||||
#
|
#
|
||||||
|
|
|
@ -16,6 +16,8 @@ virtual size: 4 MiB (4194304 bytes)
|
||||||
|
|
||||||
=== Test host-key-check options ===
|
=== Test host-key-check options ===
|
||||||
|
|
||||||
|
--- no host key checking --
|
||||||
|
|
||||||
{"execute": "blockdev-create", "arguments": {"job-id": "job0", "options": {"driver": "ssh", "location": {"host-key-check": {"mode": "none"}, "path": "TEST_DIR/PID-t.img", "server": {"host": "127.0.0.1", "port": "22"}}, "size": 8388608}}}
|
{"execute": "blockdev-create", "arguments": {"job-id": "job0", "options": {"driver": "ssh", "location": {"host-key-check": {"mode": "none"}, "path": "TEST_DIR/PID-t.img", "server": {"host": "127.0.0.1", "port": "22"}}, "size": 8388608}}}
|
||||||
{"return": {}}
|
{"return": {}}
|
||||||
{"execute": "job-dismiss", "arguments": {"id": "job0"}}
|
{"execute": "job-dismiss", "arguments": {"id": "job0"}}
|
||||||
|
@ -25,6 +27,8 @@ image: TEST_IMG
|
||||||
file format: IMGFMT
|
file format: IMGFMT
|
||||||
virtual size: 8 MiB (8388608 bytes)
|
virtual size: 8 MiB (8388608 bytes)
|
||||||
|
|
||||||
|
--- known_hosts key checking --
|
||||||
|
|
||||||
{"execute": "blockdev-create", "arguments": {"job-id": "job0", "options": {"driver": "ssh", "location": {"host-key-check": {"mode": "known_hosts"}, "path": "TEST_DIR/PID-t.img", "server": {"host": "127.0.0.1", "port": "22"}}, "size": 4194304}}}
|
{"execute": "blockdev-create", "arguments": {"job-id": "job0", "options": {"driver": "ssh", "location": {"host-key-check": {"mode": "known_hosts"}, "path": "TEST_DIR/PID-t.img", "server": {"host": "127.0.0.1", "port": "22"}}, "size": 4194304}}}
|
||||||
{"return": {}}
|
{"return": {}}
|
||||||
{"execute": "job-dismiss", "arguments": {"id": "job0"}}
|
{"execute": "job-dismiss", "arguments": {"id": "job0"}}
|
||||||
|
@ -34,6 +38,8 @@ image: TEST_IMG
|
||||||
file format: IMGFMT
|
file format: IMGFMT
|
||||||
virtual size: 4 MiB (4194304 bytes)
|
virtual size: 4 MiB (4194304 bytes)
|
||||||
|
|
||||||
|
--- explicit md5 key checking --
|
||||||
|
|
||||||
{"execute": "blockdev-create", "arguments": {"job-id": "job0", "options": {"driver": "ssh", "location": {"host-key-check": {"hash": "wrong", "mode": "hash", "type": "md5"}, "path": "TEST_DIR/PID-t.img", "server": {"host": "127.0.0.1", "port": "22"}}, "size": 2097152}}}
|
{"execute": "blockdev-create", "arguments": {"job-id": "job0", "options": {"driver": "ssh", "location": {"host-key-check": {"hash": "wrong", "mode": "hash", "type": "md5"}, "path": "TEST_DIR/PID-t.img", "server": {"host": "127.0.0.1", "port": "22"}}, "size": 2097152}}}
|
||||||
{"return": {}}
|
{"return": {}}
|
||||||
Job failed: remote host key does not match host_key_check 'wrong'
|
Job failed: remote host key does not match host_key_check 'wrong'
|
||||||
|
@ -49,6 +55,8 @@ image: TEST_IMG
|
||||||
file format: IMGFMT
|
file format: IMGFMT
|
||||||
virtual size: 8 MiB (8388608 bytes)
|
virtual size: 8 MiB (8388608 bytes)
|
||||||
|
|
||||||
|
--- explicit sha1 key checking --
|
||||||
|
|
||||||
{"execute": "blockdev-create", "arguments": {"job-id": "job0", "options": {"driver": "ssh", "location": {"host-key-check": {"hash": "wrong", "mode": "hash", "type": "sha1"}, "path": "TEST_DIR/PID-t.img", "server": {"host": "127.0.0.1", "port": "22"}}, "size": 2097152}}}
|
{"execute": "blockdev-create", "arguments": {"job-id": "job0", "options": {"driver": "ssh", "location": {"host-key-check": {"hash": "wrong", "mode": "hash", "type": "sha1"}, "path": "TEST_DIR/PID-t.img", "server": {"host": "127.0.0.1", "port": "22"}}, "size": 2097152}}}
|
||||||
{"return": {}}
|
{"return": {}}
|
||||||
Job failed: remote host key does not match host_key_check 'wrong'
|
Job failed: remote host key does not match host_key_check 'wrong'
|
||||||
|
@ -64,6 +72,23 @@ image: TEST_IMG
|
||||||
file format: IMGFMT
|
file format: IMGFMT
|
||||||
virtual size: 4 MiB (4194304 bytes)
|
virtual size: 4 MiB (4194304 bytes)
|
||||||
|
|
||||||
|
--- explicit sha256 key checking --
|
||||||
|
|
||||||
|
{"execute": "blockdev-create", "arguments": {"job-id": "job0", "options": {"driver": "ssh", "location": {"host-key-check": {"hash": "wrong", "mode": "hash", "type": "sha256"}, "path": "TEST_DIR/PID-t.img", "server": {"host": "127.0.0.1", "port": "22"}}, "size": 2097152}}}
|
||||||
|
{"return": {}}
|
||||||
|
Job failed: remote host key does not match host_key_check 'wrong'
|
||||||
|
{"execute": "job-dismiss", "arguments": {"id": "job0"}}
|
||||||
|
{"return": {}}
|
||||||
|
|
||||||
|
{"execute": "blockdev-create", "arguments": {"job-id": "job0", "options": {"driver": "ssh", "location": {"host-key-check": {"hash": "HASH", "mode": "hash", "type": "sha256"}, "path": "TEST_DIR/PID-t.img", "server": {"host": "127.0.0.1", "port": "22"}}, "size": 4194304}}}
|
||||||
|
{"return": {}}
|
||||||
|
{"execute": "job-dismiss", "arguments": {"id": "job0"}}
|
||||||
|
{"return": {}}
|
||||||
|
|
||||||
|
image: TEST_IMG
|
||||||
|
file format: IMGFMT
|
||||||
|
virtual size: 4 MiB (4194304 bytes)
|
||||||
|
|
||||||
=== Invalid path and user ===
|
=== Invalid path and user ===
|
||||||
|
|
||||||
{"execute": "blockdev-create", "arguments": {"job-id": "job0", "options": {"driver": "ssh", "location": {"host-key-check": {"mode": "none"}, "path": "/this/is/not/an/existing/path", "server": {"host": "127.0.0.1", "port": "22"}}, "size": 4194304}}}
|
{"execute": "blockdev-create", "arguments": {"job-id": "job0", "options": {"driver": "ssh", "location": {"host-key-check": {"mode": "none"}, "path": "/this/is/not/an/existing/path", "server": {"host": "127.0.0.1", "port": "22"}}, "size": 4194304}}}
|
||||||
|
|
Loading…
Reference in New Issue