2 files changed, 89 insertions, 26 deletions

diff --git a/get-host-keys b/get-host-keys
new file mode 100755
index 0000000..f55b6cd
--- /dev/null
+++ b/get-host-keys
@@ -0,0 +1,89 @@
+#!/bin/sh
+die()
+{
+    printf "Error: %s\n" "$*" >&2
+    exit 1
+}
+
+b16_to_b32()
+{
+    printf %s "$1" | basez -x -d | basez -j -l | tr -d =
+}
+
+to_domain_suffix()
+{
+    local hashtype=2
+    local keystring keytype sshfp_b16 sshfp_b32
+    [ -f "$1" ] || return
+    [ -s "$1" ] || return
+    sshfp_raw=$(ssh-keygen -r . -f "$1" | grep -E -e "^. IN SSHFP [0-9]+ $hashtype ")
+    case "$sshfp_raw" in
+        '. IN SSHFP 1 '*) keytype=1; keystring=rsa ;;
+        '. IN SSHFP 4 '*) keytype=4; keystring=ed25519 ;;
+        *) return 1 ;;
+    esac
+    sshfp_b16=$(printf '%s' "$sshfp_raw" | sed -ne "s/^. IN SSHFP $keytype $hashtype //p") &&
+        [ "$sshfp_b16" ] || die "could not determine ssh client fingerprint"
+    sshfp_b32=$(b16_to_b32 "$sshfp_b16")
+
+    printf %s.%s.%s "$sshfp_b32" "$keystring" cryptonomic.net | tail -c64
+}
+
+crypto_validate_hostname()
+{
+    local host="$1" t r
+    t=$(mktemp)
+    case "$host" in
+        *.ed25519.cryptonomic.net)
+            ssh-keyscan -t ed25519 "$host" 2>/dev/null | while read h keytype keydata comment
+            do
+                case "$h $keytype" in
+                    "$host ssh-ed25519")
+                        echo "$keytype $keydata" >> "$t"
+                        break
+                        ;;
+                esac
+            done ;;
+        *) die "unsupported hostname: $host" ;;
+    esac
+    if validated=$(to_domain_suffix "$t")
+    then
+        case "$host" in
+            "$validated" | *."$validated" )
+                read line < "$t"
+                echo "$host $line"
+                rm -f "$t"
+                return 0
+                ;;
+        esac
+    fi
+    rm -f "$t"
+    false
+}
+
+set -e
+_TEMP_DIR_=$(mktemp -d)
+cd "$_TEMP_DIR_"
+trap 'rm -rf "$_TEMP_DIR_"' EXIT
+host=${1:-borges}
+
+# ssh-keygen -F "${host#*@}" | grep -v '^#' > ssh_known_hosts 2>/dev/null
+# touch ssh_known_hosts.stamp -r ssh_known_hosts
+
+line=$(crypto_validate_hostname "$host") || die "could not validate hostname cryptographically"
+
+echo "$line" > ssh_known_hosts
+cp ssh_known_hosts ssh_known_hosts~
+
+ssh \
+    -F /dev/null \
+    -o GlobalKnownHostsFile=$PWD/ssh_known_hosts \
+    -o UserKnownHostsFile=$PWD/ssh_known_hosts \
+    -o UpdateHostKeys=yes \
+    -o PasswordAuthentication=no \
+    -o StrictHostKeyChecking=yes \
+    -n -T \
+    "$host" >/dev/null 2>&1
+
+cat ssh_known_hosts
+
diff --git a/notes/update-host-keys b/notes/update-host-keys
deleted file mode 100755
index 4ef0e0b..0000000
--- a/notes/update-host-keys
+++ /dev/null
@@ -1,26 +0,0 @@
-#!/bin/sh
-set -e
-_TEMP_DIR_=$(mktemp -d)
-cd "$_TEMP_DIR_"
-trap 'rm -rf "$_TEMP_DIR_"' EXIT
-host=${1:-borges}
-ssh-keygen -F "${host#*@}" | grep -v '^#' > ssh_known_hosts 2>/dev/null
-touch ssh_known_hosts.stamp -r ssh_known_hosts
-
-ssh()
-{
-    command ssh \
-        -F /dev/null \
-        -o GlobalKnownHostsFile=$PWD/ssh_known_hosts \
-        -o UserKnownHostsFile=$PWD/ssh_known_hosts \
-        -o UpdateHostKeys=yes \
-        -o PasswordAuthentication=no \
-        -o StrictHostKeyChecking=yes \
-        "$@"
-}
-
-have=ecdsa-sha2-nistp256
-want=rsa-sha2-256
-ssh -q -n "$host" || true
-
-cat ssh_known_hosts