dustin
/
sshca
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

server: host: Remove alias request parameter 

I realized that allowing hosts to request certificates for arbitrary
aliases sort of defeats the purpose of the authentication process.  If a
host successfully authenticates, there would be nothing stopping it from
requesting a certificate for another host.  I will have to come up with
a different way of specifying aliases.  Probably something like a JSON
map containing pre-assigned aliases for hosts that will need them.
master
Dustin 2023-11-04 16:32:22 -05:00
parent 87d37aebaf
commit a0f6119d60
1 changed files with 1 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/server/host.rs
View File

@ -84,7 +84,6 @@ impl IntoResponse for SignKeyError {
struct SignKeyRequest { struct SignKeyRequest {
hostname: String, hostname: String,
pubkey: Vec<u8>, pubkey: Vec<u8>,
aliases: Vec<String>,
} }
pub(super) async fn sign_host_cert( pub(super) async fn sign_host_cert(
@ -100,7 +99,6 @@ pub(super) async fn sign_host_cert(
Some("pubkey") => { Some("pubkey") => {
body.pubkey = field.bytes().await?.into(); body.pubkey = field.bytes().await?.into();
} }
Some("alias") => body.aliases.push(field.text().await?),
Some("hostname") => body.hostname = field.text().await?, Some("hostname") => body.hostname = field.text().await?,
Some(n) => { Some(n) => {
warn!("Client request included unsupported field {:?}", n); warn!("Client request included unsupported field {:?}", n);
@ -111,7 +109,6 @@ pub(super) async fn sign_host_cert(
if body.pubkey.is_empty() { if body.pubkey.is_empty() {
return Err(SignKeyError::NoKey); return Err(SignKeyError::NoKey);
} }
let aliases: Vec<_> = body.aliases.iter().map(String::as_ref).collect();
let config = &ctx.config; let config = &ctx.config;
let duration = Duration::from_secs(config.ca.host.cert_duration); let duration = Duration::from_secs(config.ca.host.cert_duration);
@ -140,7 +137,7 @@ pub(super) async fn sign_host_cert(
hostname hostname
); );
let cert = let cert =
ca::sign_cert(&hostname, &pubkey, duration, &privkey, &aliases)?; ca::sign_cert(&hostname, &pubkey, duration, &privkey, &[])?;
info!( info!(
"Signed {} key for {}", "Signed {} key for {}",
pubkey.algorithm().as_str(), pubkey.algorithm().as_str(),