fix: native parsing of ssh certificate key (#6953)
Some checks are pending
/ release (push) Waiting to run
testing / backend-checks (push) Has been skipped
testing / frontend-checks (push) Has been skipped
testing / test-unit (push) Has been skipped
testing / test-e2e (push) Has been skipped
testing / test-mysql (push) Has been skipped
testing / test-pgsql (push) Has been skipped
testing / test-sqlite (push) Has been skipped
testing / test-remote-cacher (redis) (push) Has been skipped
testing / test-remote-cacher (valkey) (push) Has been skipped
testing / test-remote-cacher (garnet) (push) Has been skipped
testing / test-remote-cacher (redict) (push) Has been skipped
testing / security-check (push) Has been skipped

- In the case of parsing an public SSH certificate key, use the underlying key type instead of the certificate type. This means `ed25519-cert-v01` would be seen as `ed25519` type and thus correctly parsed. Certificates do not
change the keysize or otherwise parsing of the key.
- Add unit test.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/6953
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
Co-authored-by: Gusted <postmaster@gusted.xyz>
Co-committed-by: Gusted <postmaster@gusted.xyz>
This commit is contained in:
Gusted 2025-02-15 15:42:57 +00:00 committed by Earl Warren
parent 39378fce09
commit d3a125aad0
2 changed files with 7 additions and 1 deletions

View file

@ -219,8 +219,13 @@ func SSHNativeParsePublicKey(keyLine string) (string, int, error) {
return "", 0, fmt.Errorf("ParsePublicKey: %w", err)
}
pkeyType := pkey.Type()
if certPkey, ok := pkey.(*ssh.Certificate); ok {
pkeyType = certPkey.Key.Type()
}
// The ssh library can parse the key, so next we find out what key exactly we have.
switch pkey.Type() {
switch pkeyType {
case ssh.KeyAlgoDSA:
rawPub := struct {
Name string