Commit 1428e0e4 authored by Nick Thomas's avatar Nick Thomas

Look up SSH keys by SHA256 fingerprint, not MD5 fingerprint

This change takes GitLab one step closer to being FIPS-compliant, and
means git operations over SSH can work in a FIPS-enforcing environment.

GitLab Shell sends the full SSH key to GitLab, and we have the SHA256
fingerprint stored in the database already, so which fingerprint we use
to look up the key is an implementation detail; the tests (correctly,
IMO) don't mandate a particular form.

The next step for FIPS compliance on this feature is to stop generating
MD5 fingerprints when SSH keys are added.

Changelog: fixed
parent f3dd89e5
......@@ -165,9 +165,9 @@ module API
# Check whether an SSH key is known to GitLab
#
get '/authorized_keys', feature_category: :source_code_management do
fingerprint = Gitlab::InsecureKeyFingerprint.new(params.fetch(:key)).fingerprint
fingerprint = Gitlab::InsecureKeyFingerprint.new(params.fetch(:key)).fingerprint_sha256
key = Key.find_by_fingerprint(fingerprint)
key = Key.find_by_fingerprint_sha256(fingerprint)
not_found!('Key') if key.nil?
present key, with: Entities::SSHKey
end
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment