mirror of
https://github.com/opentofu/opentofu.git
synced 2024-12-28 18:01:01 -06:00
a0568e544f
* provider/triton: Move to joyent/triton-go This commit moves the Triton provider to the new joyent/triton-go library from gosdc. This has a number of advantages - not least that requests can be signed using an SSH agent without having to keep unencrypted key material in memory. Schema has been maintained for all resources, and several tests have been added and acceptance tests repaired - in some cases by fixing bugs in the underlying resources. After applying this patch, all acceptance tests pass: ``` go generate $(go list ./... | grep -v /terraform/vendor/) 2017/03/30 13:48:33 Generated command/internal_plugin_list.go TF_ACC=1 go test ./builtin/providers/triton -v -timeout 120m === RUN TestProvider --- PASS: TestProvider (0.00s) === RUN TestProvider_impl --- PASS: TestProvider_impl (0.00s) === RUN TestAccTritonFabric_basic --- PASS: TestAccTritonFabric_basic (15.11s) === RUN TestAccTritonFirewallRule_basic --- PASS: TestAccTritonFirewallRule_basic (1.48s) === RUN TestAccTritonFirewallRule_update --- PASS: TestAccTritonFirewallRule_update (1.55s) === RUN TestAccTritonFirewallRule_enable --- PASS: TestAccTritonFirewallRule_enable (1.52s) === RUN TestAccTritonKey_basic --- PASS: TestAccTritonKey_basic (11.76s) === RUN TestAccTritonKey_noKeyName --- PASS: TestAccTritonKey_noKeyName (11.20s) === RUN TestAccTritonMachine_basic --- PASS: TestAccTritonMachine_basic (82.19s) === RUN TestAccTritonMachine_dns --- PASS: TestAccTritonMachine_dns (173.36s) === RUN TestAccTritonMachine_nic --- PASS: TestAccTritonMachine_nic (167.82s) === RUN TestAccTritonMachine_addNIC --- PASS: TestAccTritonMachine_addNIC (192.11s) === RUN TestAccTritonMachine_firewall --- PASS: TestAccTritonMachine_firewall (188.53s) === RUN TestAccTritonMachine_metadata --- PASS: TestAccTritonMachine_metadata (614.57s) === RUN TestAccTritonVLAN_basic --- PASS: TestAccTritonVLAN_basic (0.93s) === RUN TestAccTritonVLAN_update --- PASS: TestAccTritonVLAN_update (1.50s) PASS ok github.com/hashicorp/terraform/builtin/providers/triton 1463.621s ``` * provider/triton: Update docs for provider config * deps: Vendor github.com/joyent/triton-go/... * deps: Remove github.com/joyent/gosdc
105 lines
2.7 KiB
Go
105 lines
2.7 KiB
Go
package authentication
|
|
|
|
import (
|
|
"crypto/md5"
|
|
"errors"
|
|
"fmt"
|
|
"net"
|
|
"os"
|
|
"strings"
|
|
|
|
"github.com/hashicorp/errwrap"
|
|
"golang.org/x/crypto/ssh"
|
|
"golang.org/x/crypto/ssh/agent"
|
|
)
|
|
|
|
type SSHAgentSigner struct {
|
|
formattedKeyFingerprint string
|
|
keyFingerprint string
|
|
accountName string
|
|
keyIdentifier string
|
|
|
|
agent agent.Agent
|
|
key ssh.PublicKey
|
|
}
|
|
|
|
func NewSSHAgentSigner(keyFingerprint, accountName string) (*SSHAgentSigner, error) {
|
|
sshAgentAddress := os.Getenv("SSH_AUTH_SOCK")
|
|
if sshAgentAddress == "" {
|
|
return nil, errors.New("SSH_AUTH_SOCK is not set")
|
|
}
|
|
|
|
conn, err := net.Dial("unix", sshAgentAddress)
|
|
if err != nil {
|
|
return nil, errwrap.Wrapf("Error dialing SSH agent: {{err}}", err)
|
|
}
|
|
|
|
ag := agent.NewClient(conn)
|
|
|
|
keys, err := ag.List()
|
|
if err != nil {
|
|
return nil, errwrap.Wrapf("Error listing keys in SSH Agent: %s", err)
|
|
}
|
|
|
|
keyFingerprintMD5 := strings.Replace(keyFingerprint, ":", "", -1)
|
|
|
|
var matchingKey ssh.PublicKey
|
|
for _, key := range keys {
|
|
h := md5.New()
|
|
h.Write(key.Marshal())
|
|
fp := fmt.Sprintf("%x", h.Sum(nil))
|
|
|
|
if fp == keyFingerprintMD5 {
|
|
matchingKey = key
|
|
}
|
|
}
|
|
|
|
if matchingKey == nil {
|
|
return nil, fmt.Errorf("No key in the SSH Agent matches fingerprint: %s", keyFingerprint)
|
|
}
|
|
|
|
formattedKeyFingerprint := formatPublicKeyFingerprint(matchingKey, true)
|
|
|
|
return &SSHAgentSigner{
|
|
formattedKeyFingerprint: formattedKeyFingerprint,
|
|
keyFingerprint: keyFingerprint,
|
|
accountName: accountName,
|
|
agent: ag,
|
|
key: matchingKey,
|
|
keyIdentifier: fmt.Sprintf("/%s/keys/%s", accountName, formattedKeyFingerprint),
|
|
}, nil
|
|
}
|
|
|
|
func (s *SSHAgentSigner) Sign(dateHeader string) (string, error) {
|
|
const headerName = "date"
|
|
|
|
signature, err := s.agent.Sign(s.key, []byte(fmt.Sprintf("%s: %s", headerName, dateHeader)))
|
|
if err != nil {
|
|
return "", errwrap.Wrapf("Error signing date header: {{err}}", err)
|
|
}
|
|
|
|
keyFormat, err := keyFormatToKeyType(signature.Format)
|
|
if err != nil {
|
|
return "", errwrap.Wrapf("Error reading signature: {{err}}", err)
|
|
}
|
|
|
|
var authSignature httpAuthSignature
|
|
switch keyFormat {
|
|
case "rsa":
|
|
authSignature, err = newRSASignature(signature.Blob)
|
|
if err != nil {
|
|
return "", errwrap.Wrapf("Error reading signature: {{err}}", err)
|
|
}
|
|
case "ecdsa":
|
|
authSignature, err = newECDSASignature(signature.Blob)
|
|
if err != nil {
|
|
return "", errwrap.Wrapf("Error reading signature: {{err}}", err)
|
|
}
|
|
default:
|
|
return "", fmt.Errorf("Unsupported algorithm from SSH agent: %s", signature.Format)
|
|
}
|
|
|
|
return fmt.Sprintf(authorizationHeaderFormat, s.keyIdentifier,
|
|
authSignature.SignatureType(), headerName, authSignature.String()), nil
|
|
}
|