diff options
| -rw-r--r-- | block/ssh.c | 3 | ||||
| -rw-r--r-- | qapi/block-core.json | 3 | ||||
| -rwxr-xr-x | tests/qemu-iotests/207 | 54 | ||||
| -rw-r--r-- | tests/qemu-iotests/207.out | 25 |
4 files changed, 84 insertions, 1 deletions
diff --git a/block/ssh.c b/block/ssh.c index b51a031620..d008caf059 100644 --- a/block/ssh.c +++ b/block/ssh.c @@ -442,6 +442,9 @@ static int check_host_key(BDRVSSHState *s, SshHostKeyCheck *hkc, Error **errp) } else if (hkc->u.hash.type == SSH_HOST_KEY_CHECK_HASH_TYPE_SHA1) { return check_host_key_hash(s, hkc->u.hash.hash, SSH_PUBLICKEY_HASH_SHA1, errp); + } else if (hkc->u.hash.type == SSH_HOST_KEY_CHECK_HASH_TYPE_SHA256) { + return check_host_key_hash(s, hkc->u.hash.hash, + SSH_PUBLICKEY_HASH_SHA256, errp); } g_assert_not_reached(); break; diff --git a/qapi/block-core.json b/qapi/block-core.json index a54f37dbef..3114ba69bb 100644 --- a/qapi/block-core.json +++ b/qapi/block-core.json @@ -3190,11 +3190,12 @@ # # @md5: The given hash is an md5 hash # @sha1: The given hash is an sha1 hash +# @sha256: The given hash is an sha256 hash # # Since: 2.12 ## { 'enum': 'SshHostKeyCheckHashType', - 'data': [ 'md5', 'sha1' ] } + 'data': [ 'md5', 'sha1', 'sha256' ] } ## # @SshHostKeyHash: diff --git a/tests/qemu-iotests/207 b/tests/qemu-iotests/207 index f9f3fd7131..0f5c4bc8a0 100755 --- a/tests/qemu-iotests/207 +++ b/tests/qemu-iotests/207 @@ -73,6 +73,9 @@ with iotests.FilePath('t.img') as disk_path, \ iotests.log("=== Test host-key-check options ===") iotests.log("") + iotests.log("--- no host key checking --") + iotests.log("") + vm.launch() blockdev_create(vm, { 'driver': 'ssh', 'location': { @@ -90,6 +93,9 @@ with iotests.FilePath('t.img') as disk_path, \ iotests.img_info_log(remote_path) + iotests.log("--- known_hosts key checking --") + iotests.log("") + vm.launch() blockdev_create(vm, { 'driver': 'ssh', 'location': { @@ -115,6 +121,7 @@ with iotests.FilePath('t.img') as disk_path, \ # Mappings of base64 representations to digests md5_keys = {} sha1_keys = {} + sha256_keys = {} for key in keys: md5_keys[key] = subprocess.check_output( @@ -125,6 +132,10 @@ with iotests.FilePath('t.img') as disk_path, \ 'echo %s | base64 -d | sha1sum -b | cut -d" " -f1' % key, shell=True).rstrip().decode('ascii') + sha256_keys[key] = subprocess.check_output( + 'echo %s | base64 -d | sha256sum -b | cut -d" " -f1' % key, + shell=True).rstrip().decode('ascii') + vm.launch() # Find correct key first @@ -150,6 +161,9 @@ with iotests.FilePath('t.img') as disk_path, \ vm.shutdown() iotests.notrun('Did not find a key that fits 127.0.0.1') + iotests.log("--- explicit md5 key checking --") + iotests.log("") + blockdev_create(vm, { 'driver': 'ssh', 'location': { 'path': disk_path, @@ -164,6 +178,7 @@ with iotests.FilePath('t.img') as disk_path, \ } }, 'size': 2097152 }) + blockdev_create(vm, { 'driver': 'ssh', 'location': { 'path': disk_path, @@ -182,6 +197,9 @@ with iotests.FilePath('t.img') as disk_path, \ iotests.img_info_log(remote_path) + iotests.log("--- explicit sha1 key checking --") + iotests.log("") + vm.launch() blockdev_create(vm, { 'driver': 'ssh', 'location': { @@ -215,6 +233,42 @@ with iotests.FilePath('t.img') as disk_path, \ iotests.img_info_log(remote_path) + iotests.log("--- explicit sha256 key checking --") + iotests.log("") + + vm.launch() + blockdev_create(vm, { 'driver': 'ssh', + 'location': { + 'path': disk_path, + 'server': { + 'host': '127.0.0.1', + 'port': '22' + }, + 'host-key-check': { + 'mode': 'hash', + 'type': 'sha256', + 'hash': 'wrong', + } + }, + 'size': 2097152 }) + blockdev_create(vm, { 'driver': 'ssh', + 'location': { + 'path': disk_path, + 'server': { + 'host': '127.0.0.1', + 'port': '22' + }, + 'host-key-check': { + 'mode': 'hash', + 'type': 'sha256', + 'hash': sha256_keys[matching_key], + } + }, + 'size': 4194304 }) + vm.shutdown() + + iotests.img_info_log(remote_path) + # # Invalid path and user # diff --git a/tests/qemu-iotests/207.out b/tests/qemu-iotests/207.out index 1239d9d648..aeb8569d77 100644 --- a/tests/qemu-iotests/207.out +++ b/tests/qemu-iotests/207.out @@ -16,6 +16,8 @@ virtual size: 4 MiB (4194304 bytes) === Test host-key-check options === +--- no host key checking -- + {"execute": "blockdev-create", "arguments": {"job-id": "job0", "options": {"driver": "ssh", "location": {"host-key-check": {"mode": "none"}, "path": "TEST_DIR/PID-t.img", "server": {"host": "127.0.0.1", "port": "22"}}, "size": 8388608}}} {"return": {}} {"execute": "job-dismiss", "arguments": {"id": "job0"}} @@ -25,6 +27,8 @@ image: TEST_IMG file format: IMGFMT virtual size: 8 MiB (8388608 bytes) +--- known_hosts key checking -- + {"execute": "blockdev-create", "arguments": {"job-id": "job0", "options": {"driver": "ssh", "location": {"host-key-check": {"mode": "known_hosts"}, "path": "TEST_DIR/PID-t.img", "server": {"host": "127.0.0.1", "port": "22"}}, "size": 4194304}}} {"return": {}} {"execute": "job-dismiss", "arguments": {"id": "job0"}} @@ -34,6 +38,8 @@ image: TEST_IMG file format: IMGFMT virtual size: 4 MiB (4194304 bytes) +--- explicit md5 key checking -- + {"execute": "blockdev-create", "arguments": {"job-id": "job0", "options": {"driver": "ssh", "location": {"host-key-check": {"hash": "wrong", "mode": "hash", "type": "md5"}, "path": "TEST_DIR/PID-t.img", "server": {"host": "127.0.0.1", "port": "22"}}, "size": 2097152}}} {"return": {}} Job failed: remote host key does not match host_key_check 'wrong' @@ -49,6 +55,8 @@ image: TEST_IMG file format: IMGFMT virtual size: 8 MiB (8388608 bytes) +--- explicit sha1 key checking -- + {"execute": "blockdev-create", "arguments": {"job-id": "job0", "options": {"driver": "ssh", "location": {"host-key-check": {"hash": "wrong", "mode": "hash", "type": "sha1"}, "path": "TEST_DIR/PID-t.img", "server": {"host": "127.0.0.1", "port": "22"}}, "size": 2097152}}} {"return": {}} Job failed: remote host key does not match host_key_check 'wrong' @@ -64,6 +72,23 @@ image: TEST_IMG file format: IMGFMT virtual size: 4 MiB (4194304 bytes) +--- explicit sha256 key checking -- + +{"execute": "blockdev-create", "arguments": {"job-id": "job0", "options": {"driver": "ssh", "location": {"host-key-check": {"hash": "wrong", "mode": "hash", "type": "sha256"}, "path": "TEST_DIR/PID-t.img", "server": {"host": "127.0.0.1", "port": "22"}}, "size": 2097152}}} +{"return": {}} +Job failed: remote host key does not match host_key_check 'wrong' +{"execute": "job-dismiss", "arguments": {"id": "job0"}} +{"return": {}} + +{"execute": "blockdev-create", "arguments": {"job-id": "job0", "options": {"driver": "ssh", "location": {"host-key-check": {"hash": "HASH", "mode": "hash", "type": "sha256"}, "path": "TEST_DIR/PID-t.img", "server": {"host": "127.0.0.1", "port": "22"}}, "size": 4194304}}} +{"return": {}} +{"execute": "job-dismiss", "arguments": {"id": "job0"}} +{"return": {}} + +image: TEST_IMG +file format: IMGFMT +virtual size: 4 MiB (4194304 bytes) + === Invalid path and user === {"execute": "blockdev-create", "arguments": {"job-id": "job0", "options": {"driver": "ssh", "location": {"host-key-check": {"mode": "none"}, "path": "/this/is/not/an/existing/path", "server": {"host": "127.0.0.1", "port": "22"}}, "size": 4194304}}} |