From 9123cef81024b7c6db09744ab94d6f42207d7ad3 Mon Sep 17 00:00:00 2001 From: Roman Zeyde Date: Thu, 3 Nov 2016 22:00:43 +0200 Subject: [PATCH] ssh: decouple identity from device --- trezor_agent/__main__.py | 25 +++++++++++++++---------- trezor_agent/client.py | 18 +++++++++--------- trezor_agent/protocol.py | 2 +- 3 files changed, 25 insertions(+), 20 deletions(-) diff --git a/trezor_agent/__main__.py b/trezor_agent/__main__.py index 0a291c3..f526060 100644 --- a/trezor_agent/__main__.py +++ b/trezor_agent/__main__.py @@ -93,13 +93,11 @@ def git_host(remote_name, attributes): return '{user}@{host}'.format(**match.groupdict()) -def run_server(conn, public_key, command, debug, timeout): +def run_server(conn, public_keys, command, debug, timeout): """Common code for run_agent and run_git below.""" try: signer = conn.sign_ssh_challenge - public_key = formats.import_public_key(public_key) - log.info('using SSH public key: %s', public_key['fingerprint']) - handler = protocol.Handler(keys=[public_key], signer=signer, + handler = protocol.Handler(keys=public_keys, signer=signer, debug=debug) with server.serve(handler=handler, timeout=timeout) as env: return server.run_process(command=command, environ=env) @@ -125,12 +123,15 @@ def run_agent(client_factory=client.Client): args = create_agent_parser().parse_args() util.setup_logging(verbosity=args.verbose) - d = device.detect(identity_str=args.identity, - curve_name=args.ecdsa_curve_name) - conn = client_factory(device=d) + conn = client_factory(device=device.detect()) + identities = [device.interface.Identity(identity_str=args.identity, + curve_name=args.ecdsa_curve_name)] + for identity in identities: + identity.identity_dict['proto'] = 'ssh' command = args.command - public_key = conn.get_public_key() + + public_keys = [conn.get_public_key(i) for i in identities] if args.connect: command = ssh_args(args.identity) + args.command @@ -142,10 +143,14 @@ def run_agent(client_factory=client.Client): log.debug('using shell: %r', command) if not command: - sys.stdout.write(public_key) + for pk in public_keys: + sys.stdout.write(pk) return - return run_server(conn=conn, public_key=public_key, command=command, + public_keys = [formats.import_public_key(pk) for pk in public_keys] + for pk, identity in zip(public_keys, identities): + pk['identity'] = identity + return run_server(conn=conn, public_keys=public_keys, command=command, debug=args.debug, timeout=args.timeout) diff --git a/trezor_agent/client.py b/trezor_agent/client.py index 2e5b074..30dfb40 100644 --- a/trezor_agent/client.py +++ b/trezor_agent/client.py @@ -16,34 +16,34 @@ class Client(object): def __init__(self, device): """Connect to hardware device.""" - device.identity_dict['proto'] = 'ssh' self.device = device - def get_public_key(self): + def get_public_key(self, identity): """Get SSH public key from the device.""" with self.device: - pubkey = self.device.pubkey() + pubkey = self.device.pubkey(identity) vk = formats.decompress_pubkey(pubkey=pubkey, - curve_name=self.device.curve_name) + curve_name=identity.curve_name) return formats.export_public_key(vk=vk, - label=self.device.identity_str()) + label=str(identity)) - def sign_ssh_challenge(self, blob): + def sign_ssh_challenge(self, blob, identity): """Sign given blob using a private key on the device.""" msg = _parse_ssh_blob(blob) log.debug('%s: user %r via %r (%r)', msg['conn'], msg['user'], msg['auth'], msg['key_type']) log.debug('nonce: %r', msg['nonce']) - log.debug('fingerprint: %s', msg['public_key']['fingerprint']) + fp = msg['public_key']['fingerprint'] + log.debug('fingerprint: %s', fp) log.debug('hidden challenge size: %d bytes', len(blob)) log.info('please confirm user "%s" login to "%s" using %s...', - msg['user'].decode('ascii'), self.device.identity_str(), + msg['user'].decode('ascii'), identity, self.device) with self.device: - return self.device.sign(blob=blob) + return self.device.sign(blob=blob, identity=identity) def _parse_ssh_blob(data): diff --git a/trezor_agent/protocol.py b/trezor_agent/protocol.py index e1a763f..987bece 100644 --- a/trezor_agent/protocol.py +++ b/trezor_agent/protocol.py @@ -140,7 +140,7 @@ class Handler(object): label = key['name'].decode('ascii') # label should be a string log.debug('signing %d-byte blob with "%s" key', len(blob), label) try: - signature = self.signer(blob=blob) + signature = self.signer(blob=blob, identity=key['identity']) except IOError: return failure() log.debug('signature: %r', signature)