lili/amodem
1
0
Fork 0
mirror of https://github.com/romanz/amodem.git synced 2026-03-17 07:05:59 +08:00
Code Issues Packages Projects Releases Wiki Activity

ssh: decouple identity from device

Browse Source
This commit is contained in:
Roman Zeyde
2016-11-03 22:00:43 +02:00
parent 6f6e7c0bcc
commit 9123cef810
3 changed files with 25 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
trezor_agent/__main__.py
View File

@@ -93,13 +93,11 @@ def git_host(remote_name, attributes):
return '{user}@{host}'.format(**match.groupdict())
def run_server(conn, public_key, command, debug, timeout):
def run_server(conn, public_keys, command, debug, timeout):
"""Common code for run_agent and run_git below."""
try:
signer = conn.sign_ssh_challenge
public_key = formats.import_public_key(public_key)
log.info('using SSH public key: %s', public_key['fingerprint'])
handler = protocol.Handler(keys=[public_key], signer=signer,
handler = protocol.Handler(keys=public_keys, signer=signer,
debug=debug)
with server.serve(handler=handler, timeout=timeout) as env:
return server.run_process(command=command, environ=env)
@@ -125,12 +123,15 @@ def run_agent(client_factory=client.Client):
args = create_agent_parser().parse_args()
util.setup_logging(verbosity=args.verbose)
d = device.detect(identity_str=args.identity,
curve_name=args.ecdsa_curve_name)
conn = client_factory(device=d)
conn = client_factory(device=device.detect())
identities = [device.interface.Identity(identity_str=args.identity,
curve_name=args.ecdsa_curve_name)]
for identity in identities:
identity.identity_dict['proto'] = 'ssh'
command = args.command
public_key = conn.get_public_key()
public_keys = [conn.get_public_key(i) for i in identities]
if args.connect:
command = ssh_args(args.identity) + args.command
@@ -142,10 +143,14 @@ def run_agent(client_factory=client.Client):
log.debug('using shell: %r', command)
if not command:
sys.stdout.write(public_key)
for pk in public_keys:
sys.stdout.write(pk)
return
return run_server(conn=conn, public_key=public_key, command=command,
public_keys = [formats.import_public_key(pk) for pk in public_keys]
for pk, identity in zip(public_keys, identities):
pk['identity'] = identity
return run_server(conn=conn, public_keys=public_keys, command=command,
debug=args.debug, timeout=args.timeout)

18
trezor_agent/client.py
View File

@@ -16,34 +16,34 @@ class Client(object):
def __init__(self, device):
"""Connect to hardware device."""
device.identity_dict['proto'] = 'ssh'
self.device = device
def get_public_key(self):
def get_public_key(self, identity):
"""Get SSH public key from the device."""
with self.device:
pubkey = self.device.pubkey()
pubkey = self.device.pubkey(identity)
vk = formats.decompress_pubkey(pubkey=pubkey,
curve_name=self.device.curve_name)
curve_name=identity.curve_name)
return formats.export_public_key(vk=vk,
label=self.device.identity_str())
label=str(identity))
def sign_ssh_challenge(self, blob):
def sign_ssh_challenge(self, blob, identity):
"""Sign given blob using a private key on the device."""
msg = _parse_ssh_blob(blob)
log.debug('%s: user %r via %r (%r)',
msg['conn'], msg['user'], msg['auth'], msg['key_type'])
log.debug('nonce: %r', msg['nonce'])
log.debug('fingerprint: %s', msg['public_key']['fingerprint'])
fp = msg['public_key']['fingerprint']
log.debug('fingerprint: %s', fp)
log.debug('hidden challenge size: %d bytes', len(blob))
log.info('please confirm user "%s" login to "%s" using %s...',
msg['user'].decode('ascii'), self.device.identity_str(),
msg['user'].decode('ascii'), identity,
self.device)
with self.device:
return self.device.sign(blob=blob)
return self.device.sign(blob=blob, identity=identity)
def _parse_ssh_blob(data):

2
trezor_agent/protocol.py
View File

@@ -140,7 +140,7 @@ class Handler(object):
label = key['name'].decode('ascii') # label should be a string
log.debug('signing %d-byte blob with "%s" key', len(blob), label)
try:
signature = self.signer(blob=blob)
signature = self.signer(blob=blob, identity=key['identity'])
except IOError:
return failure()
log.debug('signature: %r', signature)