opensource/cloudpods
3
0
Fork 0
mirror of https://github.com/yunionio/cloudpods.git synced 2026-09-24 16:03:43 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(region): support more scheme keypair (#23211)

Browse Source
This commit is contained in:
屈轩
2025-09-03 11:01:00 +08:00
committed by GitHub
parent f40095bd46
commit 944267af35
6 changed files with 96 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/apis/compute/keypair.go
+4
View File
@@ -18,6 +18,10 @@ import "yunion.io/x/onecloud/pkg/apis"
var KEYPAIR_SCHEMAS = []string{
KEYPAIRE_SCHEME_RSA,
// OpenSSH deprecated DSA keys
//KEYPAIRE_SCHEME_DSA,
KEYPAIRE_SCHEME_ECDSA,
KEYPAIRE_SCHEME_ED25519,
}
type KeypairCreateInput struct {
pkg/apis/compute/keypair_const.go
+4 -2
View File
@@ -15,6 +15,8 @@
package compute
const (
KEYPAIRE_SCHEME_RSA = "RSA"
KEYPAIRE_SCHEME_DSA = "DSA"
KEYPAIRE_SCHEME_RSA = "RSA"
KEYPAIRE_SCHEME_DSA = "DSA"
KEYPAIRE_SCHEME_ECDSA = "ECDSA"
KEYPAIRE_SCHEME_ED25519 = "ED25519"
)
pkg/compute/models/keypairs.go
+17 -12
View File
@@ -24,7 +24,6 @@ import (
"yunion.io/x/pkg/errors"
"yunion.io/x/pkg/gotypes"
"yunion.io/x/pkg/util/rbacscope"
"yunion.io/x/pkg/utils"
"yunion.io/x/sqlchemy"
"yunion.io/x/onecloud/pkg/apis"
@@ -230,24 +229,34 @@ func (self *SKeypair) GetLinkedGuestsCount() (int, error) {
return GuestManager.Query().Equals("keypair_id", self.Id).CountWithError()
}
func (manager *SKeypairManager) ValidateCreateData(ctx context.Context, userCred mcclient.TokenCredential, ownerId mcclient.IIdentityProvider, query jsonutils.JSONObject, input api.KeypairCreateInput) (api.KeypairCreateInput, error) {
func (manager *SKeypairManager) ValidateCreateData(
ctx context.Context,
userCred mcclient.TokenCredential,
ownerId mcclient.IIdentityProvider,
query jsonutils.JSONObject,
input *api.KeypairCreateInput,
) (*api.KeypairCreateInput, error) {
input.PublicKey = strings.TrimSpace(input.PublicKey)
if len(input.PublicKey) == 0 {
if len(input.Scheme) == 0 {
input.Scheme = api.KEYPAIRE_SCHEME_RSA
}
if !utils.IsInStringArray(input.Scheme, api.KEYPAIR_SCHEMAS) {
return input, httperrors.NewInputParameterError("Unsupported scheme %s", input.Scheme)
}
var err error
if input.Scheme == api.KEYPAIRE_SCHEME_RSA {
switch input.Scheme {
case api.KEYPAIRE_SCHEME_RSA:
input.PrivateKey, input.PublicKey, err = seclib2.GenerateRSASSHKeypair()
} else {
case api.KEYPAIRE_SCHEME_DSA:
input.PrivateKey, input.PublicKey, err = seclib2.GenerateDSASSHKeypair()
case api.KEYPAIRE_SCHEME_ECDSA:
input.PrivateKey, input.PublicKey, err = seclib2.GenerateECDSASHAP521SSHKeypair()
case api.KEYPAIRE_SCHEME_ED25519:
input.PrivateKey, input.PublicKey, err = seclib2.GenerateED25519SSHKeypair()
default:
return nil, httperrors.NewInputParameterError("Unsupported scheme %s", input.Scheme)
}
if err != nil {
return input, httperrors.NewGeneralError(errors.Wrapf(err, "Generate%sSSHKeypair", input.Scheme))
return nil, httperrors.NewGeneralError(errors.Wrapf(err, "Generate%sSSHKeypair", input.Scheme))
}
}
pubKey, _, _, _, err := ssh.ParseAuthorizedKey([]byte(input.PublicKey))
@@ -255,11 +264,7 @@ func (manager *SKeypairManager) ValidateCreateData(ctx context.Context, userCred
return input, httperrors.NewInputParameterError("invalid public error: %v", err)
}
// 只允许上传RSA格式密钥。PS: AWS只支持RSA格式。
input.Scheme = seclib2.GetPublicKeyScheme(pubKey)
if input.Scheme != api.KEYPAIRE_SCHEME_RSA {
return input, httperrors.NewInputParameterError("Unsupported scheme %s", input.Scheme)
}
input.Fingerprint = ssh.FingerprintLegacyMD5(pubKey)
input.UserResourceCreateInput, err = manager.SUserResourceBaseManager.ValidateCreateData(ctx, userCred, ownerId, query, input.UserResourceCreateInput)
pkg/mcclient/options/compute/keypairs.go
+2 -1
View File
@@ -22,6 +22,7 @@ import (
type KeypairList struct {
options.BaseListOptions
Scheme string `help:"Scheme of keypair, default is RSA" choices:"RSA|DSA|ECDSA|ED25519"`
}
func (self *KeypairList) Params() (jsonutils.JSONObject, error) {
@@ -30,7 +31,7 @@ func (self *KeypairList) Params() (jsonutils.JSONObject, error) {
type KeypairCreate struct {
NAME string `help:"Name of keypair to be created"`
Scheme string `help:"Scheme of keypair, default is RSA" choices:"RSA" default:"RSA"`
Scheme string `help:"Scheme of keypair, default is RSA" choices:"RSA|DSA|ECDSA|ED25519" default:"RSA"`
PublicKey string `help:"Publickey of keypair"`
Desc string `help:"Short description of keypair"`
}
pkg/util/seclib2/ssh.go
+57 -13
View File
@@ -15,7 +15,11 @@
package seclib2
import (
"crypto"
"crypto/dsa"
"crypto/ecdsa"
"crypto/ed25519"
"crypto/elliptic"
"crypto/rand"
"crypto/rsa"
"crypto/x509"
@@ -25,14 +29,13 @@ import (
"golang.org/x/crypto/ssh"
"yunion.io/x/log"
"yunion.io/x/pkg/errors"
)
func GenerateRSASSHKeypair() (string, string, error) {
privateKey, err := rsa.GenerateKey(rand.Reader, 2048)
if err != nil {
log.Errorf("generate rsa key error %s", err)
return "", "", err
return "", "", errors.Wrapf(err, "generate rsa key")
}
privateKeyPEM := &pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(privateKey)}
@@ -40,7 +43,51 @@ func GenerateRSASSHKeypair() (string, string, error) {
pub, err := exportSshPublicKey(&privateKey.PublicKey)
if err != nil {
return "", "", err
return "", "", errors.Wrapf(err, "export ssh public key")
}
publicStr := string(pub)
return privateStr, publicStr, nil
}
func GenerateED25519SSHKeypair() (string, string, error) {
publicKey, privateKey, err := ed25519.GenerateKey(rand.Reader)
if err != nil {
return "", "", errors.Wrapf(err, "generate ed25519 key")
}
pemBlock, err := ssh.MarshalPrivateKey(crypto.PrivateKey(privateKey), "")
if err != nil {
return "", "", errors.Wrapf(err, "marshal pkix private key")
}
privateStr := string(pem.EncodeToMemory(pemBlock))
pub, err := exportSshPublicKey(publicKey)
if err != nil {
return "", "", errors.Wrapf(err, "export ssh public key")
}
publicStr := string(pub)
return privateStr, publicStr, nil
}
func GenerateECDSASHAP521SSHKeypair() (string, string, error) {
privateKey, err := ecdsa.GenerateKey(elliptic.P521(), rand.Reader)
if err != nil {
return "", "", errors.Wrapf(err, "generate ecdsa key")
}
pemBlock, err := ssh.MarshalPrivateKey(crypto.PrivateKey(privateKey), "")
if err != nil {
return "", "", errors.Wrapf(err, "marshal pkix private key")
}
privateStr := string(pem.EncodeToMemory(pemBlock))
pub, err := exportSshPublicKey(&privateKey.PublicKey)
if err != nil {
return "", "", errors.Wrapf(err, "export ssh public key")
}
publicStr := string(pub)
@@ -53,13 +100,11 @@ func GenerateDSASSHKeypair() (string, string, error) {
params := &privateKey.Parameters
err := dsa.GenerateParameters(params, rand.Reader, dsa.L1024N160)
if err != nil {
log.Errorf("generateParameter error %s", err)
return "", "", err
return "", "", errors.Wrapf(err, "generate dsa key")
}
err = dsa.GenerateKey(&privateKey, rand.Reader)
if err != nil {
log.Errorf("generate key error %s", err)
return "", "", err
return "", "", errors.Wrapf(err, "generate dsa key")
}
type DsaASN1 struct {
@@ -80,8 +125,7 @@ func GenerateDSASSHKeypair() (string, string, error) {
privBytes, err := asn1.Marshal(k)
if err != nil {
log.Errorf("asn1 marshal error %s", err)
return "", "", err
return "", "", errors.Wrapf(err, "asn1 marshal")
}
privateKeyPEM := &pem.Block{Type: "DSA PRIVATE KEY", Bytes: privBytes}
@@ -89,7 +133,7 @@ func GenerateDSASSHKeypair() (string, string, error) {
pub, err := exportSshPublicKey(&privateKey.PublicKey)
if err != nil {
return "", "", err
return "", "", errors.Wrapf(err, "export ssh public key")
}
publicStr := string(pub)
@@ -104,8 +148,8 @@ func GetPublicKeyScheme(pubkey ssh.PublicKey) string {
return "DSA"
case ssh.KeyAlgoECDSA256, ssh.KeyAlgoECDSA384, ssh.KeyAlgoECDSA521:
return "ECDSA"
// case ssh.KeyAlgoED25519:
// return "ED"
case ssh.KeyAlgoED25519:
return "ED25519"
}
return "UNKNOWN"
}
pkg/util/seclib2/ssh_test.go
+12
View File
@@ -35,6 +35,18 @@ func TestGenerateDSASSHKeypair(t *testing.T) {
t.Logf("%s", pub)
}
func TestGenerateECDSASHAP521SSHKeypair(t *testing.T) {
priv, pub, _ := GenerateECDSASHAP521SSHKeypair()
t.Logf("%s", priv)
t.Logf("%s", pub)
}
func TestGenerateED25519SSHKeypair(t *testing.T) {
priv, pub, _ := GenerateED25519SSHKeypair()
t.Logf("%s", priv)
t.Logf("%s", pub)
}
func getPublicKeyPem(privateKey string) ([]byte, error) {
block, _ := pem.Decode([]byte(privateKey))
if block == nil {