40 lines
1.2 KiB
Go
40 lines
1.2 KiB
Go
package service
|
|
|
|
import (
|
|
"context"
|
|
"crypto/ed25519"
|
|
"crypto/rand"
|
|
"crypto/sha256"
|
|
"encoding/hex"
|
|
"strings"
|
|
"testing"
|
|
|
|
"golang.org/x/crypto/ssh"
|
|
|
|
"pve-confsync/internal/config"
|
|
"pve-confsync/internal/pve/pvetest"
|
|
)
|
|
|
|
// A node that presents another SSH host key than the recorded one is refused,
|
|
// until the new key is explicitly trusted.
|
|
func TestCheckSSHHostKeyMismatch(t *testing.T) {
|
|
s := pvetest.New("9.1.4")
|
|
defer s.Close()
|
|
pub, _, _ := ed25519.GenerateKey(rand.Reader)
|
|
other, _ := ssh.NewPublicKey(pub)
|
|
sum := sha256.Sum256(s.Certificate().Raw)
|
|
host, port := s.SSHAddr()
|
|
cl := config.Cluster{Name: "c", URL: s.URL, User: "root@pam", Password: pvetest.Password,
|
|
Fingerprint: hex.EncodeToString(sum[:]), SSHHost: host, SSHPort: port,
|
|
SSHHostKey: strings.TrimSpace(string(ssh.MarshalAuthorizedKey(other)))}
|
|
|
|
res := CheckCluster(context.Background(), cl, false, false)
|
|
if res.OK || !res.SSHMismatch || !res.API || res.SSHHostKey != "" || !strings.Contains(res.Error, "host key") {
|
|
t.Fatalf("mismatch expected: %+v", res)
|
|
}
|
|
res = CheckCluster(context.Background(), cl, false, true)
|
|
if !res.OK || res.SSHHostKey != s.SSHHostKey() {
|
|
t.Fatalf("trusted key expected: %+v", res)
|
|
}
|
|
}
|