Commander1024/ESP32_Serial_Swiss_Army_Knife
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Allow SSH keys on multiple accounts

Browse Source 
Update validation and duplicate checks to scope key uniqueness per
account, and clarify the console error message. Document cross-account
key assignment and authentication testing.
This commit is contained in:
Commander1024
2026-08-30 12:11:16 +02:00
parent c7d0d59f3e
commit 7a4769fdd8
3 changed files with 18 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/user_console.c
+1 -1
View File
@@ -357,7 +357,7 @@ static int add_key(const char *username)
secure_wipe(line, sizeof(line));
if (error != ESP_OK) {
if (error == USER_DATABASE_ERR_DUPLICATE_SSH_KEY) {
printf("Could not add SSH key: that public key is already assigned to an account.\n");
printf("Could not add SSH key: that public key is already assigned to this account.\n");
} else if (error == ESP_ERR_NO_MEM) {
printf("Could not add SSH key: the account already has %u keys.\n",
USER_DATABASE_MAX_SSH_KEYS_PER_USER);
src/user_database.c
+14 -29
View File
@@ -387,15 +387,9 @@ static esp_err_t validate_database(const stored_database_t *database)
sizeof(key->blob) - key->blob_length)) {
return ESP_ERR_INVALID_RESPONSE;
}
for (size_t prior_user = 0U; prior_user <= index; ++prior_user) {
size_t prior_key_limit = prior_user == index
? key_index
: USER_DATABASE_MAX_SSH_KEYS_PER_USER;
for (size_t prior_key = 0U; prior_key < prior_key_limit; ++prior_key) {
if (stored_keys_equal(key,
&database->users[prior_user].keys[prior_key])) {
return ESP_ERR_INVALID_RESPONSE;
}
for (size_t prior_key = 0U; prior_key < key_index; ++prior_key) {
if (stored_keys_equal(key, &user->keys[prior_key])) {
return ESP_ERR_INVALID_RESPONSE;
}
}
uint8_t fingerprint[USER_DATABASE_SHA256_LENGTH];
@@ -1157,29 +1151,20 @@ esp_err_t user_database_add_ssh_key(
if (error == ESP_OK) {
stored_user_t *user = &s_candidate.users[user_index];
int free_index = -1;
for (size_t candidate_user_index = 0U;
candidate_user_index < USER_DATABASE_MAX_USERS; ++candidate_user_index) {
stored_user_t *candidate_user =
&s_candidate.users[candidate_user_index];
if (candidate_user->active == 0U) {
continue;
}
for (size_t index = 0U;
index < USER_DATABASE_MAX_SSH_KEYS_PER_USER; ++index) {
stored_key_t *key = &candidate_user->keys[index];
if (candidate_user_index == (size_t)user_index &&
key->active == 0U && free_index < 0) {
for (size_t index = 0U;
index < USER_DATABASE_MAX_SSH_KEYS_PER_USER; ++index) {
stored_key_t *key = &user->keys[index];
if (key->active == 0U) {
if (free_index < 0) {
free_index = (int)index;
}
if (key->active != 0U && key->type_length == key_type_length &&
key->blob_length == key_blob_length &&
memcmp(key->type, key_type, key_type_length) == 0 &&
constant_time_equal(key->blob, key_blob, key_blob_length)) {
error = USER_DATABASE_ERR_DUPLICATE_SSH_KEY;
break;
}
continue;
}
if (error != ESP_OK) {
if (key->type_length == key_type_length &&
key->blob_length == key_blob_length &&
memcmp(key->type, key_type, key_type_length) == 0 &&
constant_time_equal(key->blob, key_blob, key_blob_length)) {
error = USER_DATABASE_ERR_DUPLICATE_SSH_KEY;
break;
}
}