From 44392467e52555b22e2dd4c0c53fbad0fd3a907c Mon Sep 17 00:00:00 2001 From: Randall Winkhart Date: Wed, 18 Oct 2023 15:14:20 -0400 Subject: [PATCH] Require identity to be passed to whitelist_verify() (for extension support with custom SSH keys) Former-commit-id: 9db42722585f1fb707d5144e828cefddfcbf5137 Former-commit-id: 1e79c49459b49eb422788eba315a6d9c6e09f9a1 --- lib/sshyp.py | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/lib/sshyp.py b/lib/sshyp.py index 620452a..8d4481e 100755 --- a/lib/sshyp.py +++ b/lib/sshyp.py @@ -148,7 +148,7 @@ def decrypt(_entry_dir, _quick_verify=None, _quick_pass=None): # check quick-unlock status, fetch passphrase if _quick_verify: - _quick_pass = whitelist_verify(port, username_ssh, ip, client_device_id) + _quick_pass = whitelist_verify(port, username_ssh, ip, client_device_id, identity) else: if _quick_pass is None: _quick_pass = False @@ -184,14 +184,14 @@ def decrypt(_entry_dir, _quick_verify=None, _quick_pass=None): # checks the user's whitelist status and fetches the full gpg key password if possible -def whitelist_verify(_port, _username_ssh, _ip, _client_device_id): +def whitelist_verify(_port, _username_ssh, _ip, _client_device_id, _identity): try: run(('gpg', '--pinentry-mode', 'cancel', '-qd', '--output', '/dev/null', f"{home}/.config/sshyp/lock.gpg"), stderr=DEVNULL, check=True) return False except CalledProcessError: _i, _full_password = 0, '' - _server_whitelist = run(('ssh', '-i', identity, '-p', _port, f"{_username_ssh}@{_ip}", + _server_whitelist = run(('ssh', '-i', _identity, '-p', _port, f"{_username_ssh}@{_ip}", f'python3 -c \'from os import listdir; print(*listdir("/home/{_username_ssh}' f'/.config/sshyp/whitelist"))\''), stdout=PIPE, text=True).stdout.rstrip().split() for _device_id in _server_whitelist: @@ -199,7 +199,7 @@ def whitelist_verify(_port, _username_ssh, _ip, _client_device_id): from getpass import getpass _quick_unlock_password = getpass(prompt='\nquick-unlock pin: ') _quick_unlock_password_excluded = \ - run(('ssh', '-i', identity, '-p', _port, f"{_username_ssh}@{_ip}", + run(('ssh', '-i', _identity, '-p', _port, f"{_username_ssh}@{_ip}", f"gpg --pinentry-mode loopback --passphrase '{_quick_unlock_password}' " f"-qd ~/.config/sshyp/excluded.gpg"), stdout=PIPE, text=True).stdout.rstrip() while _i < len(_quick_unlock_password_excluded):