get-host-keys command is working

The command fetches and validates the host key of a self-authenticating
cryptonomic url.  Then it tries to log in on the server and obtain proof
of all the system's other host keys.

That way, we can use SSH to share the RSA key that Strongswan needs.
But still use ed25519 for the primary identity in the URL.

This is the functionality that needs to be incorporated into
'cryptonomic-vpn' to make ed25519.cryptonomic.net urls work.

2 files changed, 89 insertions, 26 deletions

diff --git a/get-host-keys b/get-host-keys
new file mode 100755
index 0000000..f55b6cd
--- /dev/null
+++ b/get-host-keys
@@ -0,0 +1,89 @@
+#!/bin/sh
+die()
+{
+    printf "Error: %s\n" "$*" >&2
+    exit 1
+}
+
+b16_to_b32()
+{
+    printf %s "$1" | basez -x -d | basez -j -l | tr -d =
+}
+
+to_domain_suffix()
+{
+    local hashtype=2
+    local keystring keytype sshfp_b16 sshfp_b32
+    [ -f "$1" ] || return
+    [ -s "$1" ] || return
+    sshfp_raw=$(ssh-keygen -r . -f "$1" | grep -E -e "^. IN SSHFP [0-9]+ $hashtype ")
+    case "$sshfp_raw" in
+        '. IN SSHFP 1 '*) keytype=1; keystring=rsa ;;
+        '. IN SSHFP 4 '*) keytype=4; keystring=ed25519 ;;
+        *) return 1 ;;
+    esac
+    sshfp_b16=$(printf '%s' "$sshfp_raw" | sed -ne "s/^. IN SSHFP $keytype $hashtype //p") &&
+        [ "$sshfp_b16" ] || die "could not determine ssh client fingerprint"
+    sshfp_b32=$(b16_to_b32 "$sshfp_b16")
+
+    printf %s.%s.%s "$sshfp_b32" "$keystring" cryptonomic.net | tail -c64
+}
+
+crypto_validate_hostname()
+{
+    local host="$1" t r
+    t=$(mktemp)
+    case "$host" in
+        *.ed25519.cryptonomic.net)
+            ssh-keyscan -t ed25519 "$host" 2>/dev/null | while read h keytype keydata comment
+            do
+                case "$h $keytype" in
+                    "$host ssh-ed25519")
+                        echo "$keytype $keydata" >> "$t"
+                        break
+                        ;;
+                esac
+            done ;;
+        *) die "unsupported hostname: $host" ;;
+    esac
+    if validated=$(to_domain_suffix "$t")
+    then
+        case "$host" in
+            "$validated" | *."$validated" )
+                read line < "$t"
+                echo "$host $line"
+                rm -f "$t"
+                return 0
+                ;;
+        esac
+    fi
+    rm -f "$t"
+    false
+}
+
+set -e
+_TEMP_DIR_=$(mktemp -d)
+cd "$_TEMP_DIR_"
+trap 'rm -rf "$_TEMP_DIR_"' EXIT
+host=${1:-borges}
+
+# ssh-keygen -F "${host#*@}" | grep -v '^#' > ssh_known_hosts 2>/dev/null
+# touch ssh_known_hosts.stamp -r ssh_known_hosts
+
+line=$(crypto_validate_hostname "$host") || die "could not validate hostname cryptographically"
+
+echo "$line" > ssh_known_hosts
+cp ssh_known_hosts ssh_known_hosts~
+
+ssh \
+    -F /dev/null \
+    -o GlobalKnownHostsFile=$PWD/ssh_known_hosts \
+    -o UserKnownHostsFile=$PWD/ssh_known_hosts \
+    -o UpdateHostKeys=yes \
+    -o PasswordAuthentication=no \
+    -o StrictHostKeyChecking=yes \
+    -n -T \
+    "$host" >/dev/null 2>&1
+
+cat ssh_known_hosts
+
diff --git a/notes/update-host-keys b/notes/update-host-keys
deleted file mode 100755
index 4ef0e0b..0000000
--- a/notes/update-host-keys
+++ /dev/null
@@ -1,26 +0,0 @@
-#!/bin/sh
-set -e
-_TEMP_DIR_=$(mktemp -d)
-cd "$_TEMP_DIR_"
-trap 'rm -rf "$_TEMP_DIR_"' EXIT
-host=${1:-borges}
-ssh-keygen -F "${host#*@}" | grep -v '^#' > ssh_known_hosts 2>/dev/null
-touch ssh_known_hosts.stamp -r ssh_known_hosts
-
-ssh()
-{
-    command ssh \
-        -F /dev/null \
-        -o GlobalKnownHostsFile=$PWD/ssh_known_hosts \
-        -o UserKnownHostsFile=$PWD/ssh_known_hosts \
-        -o UpdateHostKeys=yes \
-        -o PasswordAuthentication=no \
-        -o StrictHostKeyChecking=yes \
-        "$@"
-}
-
-have=ecdsa-sha2-nistp256
-want=rsa-sha2-256
-ssh -q -n "$host" || true
-
-cat ssh_known_hosts