1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
|
Author: Daniel F. Dickinson <cshored@thecshore.com>
Date: Sun Jan 27 01:04:25 2019 -0500
gitolite: Eliminate the need for ssh-keygen dependency
Previously gitolite used ssh-keygen to generate fingerprints
from OpenSSH keys to ensure non-duplication of keys when
processing them to create / manage user ssh access to the
git repositories. This ends up depending on openssl,
which is large and unnecessary when we are running on an
embedded distro such as OpenWrt.
Signed-off-by: Daniel F. Dickinson <cshored@thecshore.com>
--- a/src/lib/Gitolite/Common.pm
+++ b/src/lib/Gitolite/Common.pm
@@ -26,6 +26,8 @@ package Gitolite::Common;
use Exporter 'import';
use File::Path qw(mkpath);
use File::Temp qw(tempfile);
+use MIME::Base64 qw(decode_base64);
+use Digest::SHA qw(sha256_base64);
use Carp qw(carp cluck croak confess);
use strict;
@@ -352,43 +354,82 @@ sub logger_plus_stderr {
}
# ----------------------------------------------------------------------
+# Decode OpenSSH key
+# If the key cannot be parsed it will be undef
+# Returns (algorithm_name, algo_data1, algo_data2, ...)
+sub ssh_decode_key($) {
+ my $key = shift;
+ my $keydata = decode_base64($key);
+ my @keyparts = ();
+ my $partlen;
+ my $algorithm;
+ my $data;
+ my $pos = 0;
+ $partlen = unpack('N', substr $keydata, $pos, 4) or return undef;
+ $algorithm = substr $keydata, $pos + 4, $partlen or return undef;
+ $pos = $pos + 4 + $partlen;
+ while ( $pos <= length($keydata) ) {
+ $partlen = unpack('N', substr $keydata, $pos, 4) or last;
+ $data = unpack('s>*', substr $keydata, $pos + 4, 4) or last;
+ $pos = $pos + 4 + $partlen;
+ push @keyparts, $data;
+ }
+ return ( $algorithm, @keyparts );
+}
+
+# ----------------------------------------------------------------------
+# Parse OpenSSH line
+# If the file cannot be parsed it will be undef
+# Returns (restrictions, algorithm, PEMkey, comment)
+sub ssh_parse_line($) {
+ my $ssh_line = shift;
+ my @ssh_parts = split / /, $ssh_line, 5;
+ if (scalar @ssh_parts < 4) {
+ @ssh_parts = ('', @ssh_parts);
+ }
+ if (scalar @ssh_parts > 4) {
+ @ssh_parts = @ssh_parts[0,3]
+ }
+ if (scalar @ssh_parts < 4) {
+ @ssh_parts = undef;
+ }
+ return ( @ssh_parts );
+}
+
+# ----------------------------------------------------------------------
+# Get the SSH fingerprint of a line of text
+# If the fingerprint cannot be parsed, it will be undef
+# In a scalar context, returns the fingerprint
+# In a list context, returns (fingerprint, output) where output
+# is the parsed input line (less algorithm)
+sub ssh_fingerprint_line($) {
+ my $ssh_line = shift;
+ my @parsed_line = ssh_parse_line($ssh_line) or return undef;
+ my @ssh_parts = ssh_decode_key($parsed_line[2]) or return undef;
+ ( $parsed_line[1] eq $ssh_parts[0] ) or die "algorithm mismatch: $parsed_line[1] vs. $ssh_parts[0]";
+ my $fp = sha256_base64(join(' ', @ssh_parts[1,-1]));
+ return wantarray ? ($fp, join(' ', @ssh_parts[1,-1])) : $fp;
+}
+
+# ----------------------------------------------------------------------
# Get the SSH fingerprint of a file
# If the fingerprint cannot be parsed, it will be undef
# In a scalar context, returns the fingerprint
# In a list context, returns (fingerprint, output) where output
-# is the raw output of the ssh-keygen command
-sub ssh_fingerprint_file {
+# is the raw input line
+sub ssh_fingerprint_file($) {
my $in = shift;
-f $in or die "file not found: $in\n";
my $fh;
- open( $fh, "ssh-keygen -l -f $in 2>&1 |" ) or die "could not fork: $!\n";
+ open( $fh, $in ) or die "could not open $in: $!\n";
my $output = <$fh>;
chomp $output;
- # dbg("fp = $fp");
close $fh;
# Return a valid fingerprint or undef
- my $fp = undef;
- if($output =~ /((?:MD5:)?(?:[0-9a-f]{2}:){15}[0-9a-f]{2})/i or
- $output =~ m{((?:RIPEMD|SHA)\d+:[A-Za-z0-9+/=]+)}i) {
- $fp = $1;
- }
+ my $fp = ssh_fingerprint_line($output);
return wantarray ? ($fp, $output) : $fp;
}
-# Get the SSH fingerprint of a line of text
-# If the fingerprint cannot be parsed, it will be undef
-# In a scalar context, returns the fingerprint
-# In a list context, returns (fingerprint, output) where output
-# is the raw output of the ssh-keygen command
-sub ssh_fingerprint_line {
- my ( $fh, $fn ) = tempfile();
- print $fh shift() . "\n";
- close $fh;
- my ($fp,$output) = ssh_fingerprint_file($fn);
- unlink $fn;
- return wantarray ? ($fp,$output) : $fp;
-}
-
# ----------------------------------------------------------------------
# bare-minimum subset of 'Tsh' (see github.com/sitaramc/tsh)
|