communicator: don't set bastion cert if key is set#174
Merged
Conversation
Contributor
Author
|
Tests are done, this PR can be reviewed. |
3681f1e to
e2d8faf
Compare
nywilken
reviewed
Apr 27, 2023
When attempting to set the bastion key/certificate for authenticating with the bastion, we generally fallback to the ones defined by the SSH configuration. However, if the bastion SSH key is set, and not the certificate, but the SSH connection's are, since the conditions are separate, we end-up in a situation where the bastion's SSH key uses the one from the config, and the certificate fall backs to the one from the SSH connection. This in turn fails, as the certificate's public key matches the private key from the SSH connection, and not the bastion's. To avoid a situation like this, we only fallback to the SSH connection's certificate if the bastion's SSH key isn't set.
e2d8faf to
abd0c21
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When attempting to set the bastion key/certificate for authenticating with the bastion, we generally fallback to the ones defined by the SSH configuration.
However, if the bastion SSH key is set, and not the certificate, but the SSH connection's are, since the conditions are separate, we end-up in a situation where the bastion's SSH key uses the one from the config, and the certificate fall backs to the one from the SSH connection.
This in turn fails, as the certificate's public key matches the private key from the SSH connection, and not the bastion's.
To avoid a situation like this, we only fallback to the SSH connection's certificate if the bastion's SSH key isn't set.
Closes #173