1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
|
package sshkeys_test
import (
"crypto/rand"
"testing"
"github.com/ScaleFT/sshkeys"
"github.com/ScaleFT/sshkeys/testdata"
"github.com/stretchr/testify/require"
"golang.org/x/crypto/ssh"
)
func testSigners(t *testing.T, name string, a ssh.Signer, b ssh.Signer) {
require.Equal(t, a.PublicKey().Marshal(), b.PublicKey().Marshal())
sign := []byte("hello world")
sig, err := a.Sign(rand.Reader, sign)
require.NoError(t, err, "signer failed for %s", name)
err = b.PublicKey().Verify(sign, sig)
require.NoError(t, err, "verify failed for %s", name)
}
func TestMarshalOldFormat(t *testing.T) {
password := []byte("gopher")
for _, k := range testdata.PEMEncryptedKeys {
// ed25519 is only specified in the new format
if k.Name == "ed25519-openssh-encrypted-aes256-cbc" || k.Name == "ed25519-openssh-encrypted-aes256-ctr" {
continue
}
t.Run(k.Name, func(t *testing.T) {
pk, err := sshkeys.ParseEncryptedRawPrivateKey(k.PEMBytes, []byte(k.EncryptionKey))
require.NoError(t, err, "error parsing %s", k.Name)
require.NotNil(t, pk, "nil return from parsing %s", k.Name)
signer, err := ssh.NewSignerFromKey(pk)
require.NoError(t, err)
data, err := sshkeys.Marshal(pk, &sshkeys.MarshalOptions{
Passphrase: password,
Format: sshkeys.FormatClassicPEM,
})
require.NoError(t, err)
require.NotNil(t, data, "nil return from marshaling %s", k.Name)
pk2, err := sshkeys.ParseEncryptedRawPrivateKey(data, password)
require.NoError(t, err, "error from parsing %s", k.Name)
require.NotNil(t, pk2, "nil return from parsing %s", k.Name)
signer2, err := ssh.NewSignerFromKey(pk2)
require.NoError(t, err)
testSigners(t, k.Name, signer, signer2)
})
}
}
func TestMarshalNewFormat(t *testing.T) {
password := []byte("gopher")
for _, k := range testdata.PEMEncryptedKeys {
if k.Name == "dsa-encrypted-aes256-cbc" {
continue
}
t.Run(k.Name, func(t *testing.T) {
pk, err := sshkeys.ParseEncryptedRawPrivateKey(k.PEMBytes, []byte(k.EncryptionKey))
require.NoError(t, err, "error parsing %s", k.Name)
require.NotNil(t, pk, "nil return from parsing %s", k.Name)
signer, err := ssh.NewSignerFromKey(pk)
require.NoError(t, err)
data, err := sshkeys.Marshal(pk, &sshkeys.MarshalOptions{
Passphrase: password,
Format: sshkeys.FormatOpenSSHv1,
})
require.NoError(t, err)
require.NotNil(t, data, "nil return from marshaling %s", k.Name)
pk2, err := sshkeys.ParseEncryptedRawPrivateKey(data, password)
require.NoError(t, err, "error from parsing %s", k.Name)
require.NotNil(t, pk2, "nil return from parsing %s", k.Name)
signer2, err := ssh.NewSignerFromKey(pk2)
require.NoError(t, err)
testSigners(t, k.Name, signer, signer2)
})
}
}
|
