From 4767f6924dc3343d4399211c8dc4d74be9b6fc90 Mon Sep 17 00:00:00 2001
From: Richard Kosegi <richard.kosegi@gmail.com>
Date: Sun, 28 Apr 2024 08:35:21 +0200
Subject: [PATCH] Add support for ed25519 ssh keys

Let's use bouncycastle lib to handle public key encoding

Fixes #79
---
 pom.xml                                       |  5 +++
 .../jenkins/plugins/hetzner/Helper.java       | 35 ++++++++++++-------
 .../jenkins/plugins/hetzner/HelperTest.java   |  9 ++++-
 src/test/resources/id_ed25519                 |  7 ++++
 src/test/resources/id_ed25519.pub             |  1 +
 5 files changed, 43 insertions(+), 14 deletions(-)
 create mode 100644 src/test/resources/id_ed25519
 create mode 100644 src/test/resources/id_ed25519.pub

diff --git a/pom.xml b/pom.xml
index e3aadae..ecaa177 100644
--- a/pom.xml
+++ b/pom.xml
@@ -119,6 +119,11 @@
             <groupId>com.google.guava</groupId>
             <artifactId>guava</artifactId>
         </dependency>
+        <dependency>
+            <groupId>org.jenkins-ci.plugins</groupId>
+            <artifactId>bouncycastle-api</artifactId>
+            <version>2.20</version>
+        </dependency>
         <dependency>
             <groupId>cloud.dnation.integration</groupId>
             <artifactId>hetzner-cloud-client-java</artifactId>
diff --git a/src/main/java/cloud/dnation/jenkins/plugins/hetzner/Helper.java b/src/main/java/cloud/dnation/jenkins/plugins/hetzner/Helper.java
index 23e38ee..c15283d 100644
--- a/src/main/java/cloud/dnation/jenkins/plugins/hetzner/Helper.java
+++ b/src/main/java/cloud/dnation/jenkins/plugins/hetzner/Helper.java
@@ -26,17 +26,20 @@
 import lombok.Getter;
 import lombok.RequiredArgsConstructor;
 import lombok.experimental.UtilityClass;
+import net.i2p.crypto.eddsa.EdDSAPublicKey;
+import org.bouncycastle.crypto.params.AsymmetricKeyParameter;
+import org.bouncycastle.crypto.params.Ed25519PublicKeyParameters;
+import org.bouncycastle.crypto.params.RSAKeyParameters;
+import org.bouncycastle.crypto.util.OpenSSHPublicKeyUtil;
 import org.slf4j.Logger;
 import retrofit2.Response;
 
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
-import java.io.ByteArrayOutputStream;
-import java.io.DataOutputStream;
 import java.io.IOException;
 import java.io.PrintStream;
-import java.nio.charset.StandardCharsets;
 import java.security.KeyPair;
+import java.security.PublicKey;
 import java.security.interfaces.RSAPublicKey;
 import java.time.Duration;
 import java.time.LocalDateTime;
@@ -60,6 +63,7 @@
 public class Helper {
     private static final Pattern LABEL_VALUE_RE = Pattern.compile("^(?![0-9]+$)(?!-)[a-zA-Z0-9-_.]{0,63}(?<!-)$");
     private static final String SSH_RSA = "ssh-rsa";
+    private static final String SSH_ED25519 = "ssh-ed25519";
 
     /**
      * Extract public key from SSH private key.
@@ -71,16 +75,21 @@ public class Helper {
      */
     public static String getSSHPublicKeyFromPrivate(String privateKey, @Nullable String password) throws IOException {
         final KeyPair pair = PEMDecoder.decodeKeyPair(privateKey.toCharArray(), password);
-        final RSAPublicKey pubKey = (RSAPublicKey) pair.getPublic();
-        final ByteArrayOutputStream bos = new ByteArrayOutputStream();
-        final DataOutputStream dos = new DataOutputStream(bos);
-        dos.writeInt(SSH_RSA.getBytes(StandardCharsets.ISO_8859_1).length);
-        dos.write(SSH_RSA.getBytes(StandardCharsets.ISO_8859_1));
-        dos.writeInt(pubKey.getPublicExponent().toByteArray().length);
-        dos.write(pubKey.getPublicExponent().toByteArray());
-        dos.writeInt(pubKey.getModulus().toByteArray().length);
-        dos.write(pubKey.getModulus().toByteArray());
-        return SSH_RSA + " " + Base64.getEncoder().encodeToString(bos.toByteArray());
+        final PublicKey pk = pair.getPublic();
+        final String prefix;
+        final AsymmetricKeyParameter keyParam;
+        if (pk instanceof EdDSAPublicKey) {
+            final EdDSAPublicKey edpk = (EdDSAPublicKey) pk;
+            prefix = SSH_ED25519;
+            keyParam = new Ed25519PublicKeyParameters(edpk.getAbyte(), 0);
+        } else if (pk instanceof RSAPublicKey) {
+            final RSAPublicKey rsapk = (RSAPublicKey)pk;
+            prefix = SSH_RSA;
+            keyParam = new RSAKeyParameters(false, rsapk.getModulus(), rsapk.getPublicExponent());
+        } else {
+            throw new IllegalArgumentException("PublicKey type not recognized: " + pk.getClass());
+        }
+        return prefix + " " + Base64.getEncoder().encodeToString(OpenSSHPublicKeyUtil.encodePublicKey(keyParam));
     }
 
     /**
diff --git a/src/test/java/cloud/dnation/jenkins/plugins/hetzner/HelperTest.java b/src/test/java/cloud/dnation/jenkins/plugins/hetzner/HelperTest.java
index 6137289..114dab1 100644
--- a/src/test/java/cloud/dnation/jenkins/plugins/hetzner/HelperTest.java
+++ b/src/test/java/cloud/dnation/jenkins/plugins/hetzner/HelperTest.java
@@ -27,12 +27,19 @@
 
 public class HelperTest {
     @Test
-    public void testExtractPublicKey() throws IOException {
+    public void testExtractPublicKeyRSA() throws IOException {
         final String pubKeyStr = TestHelper.resourceAsString("id_rsa.pub");
         final String privKeyStr = TestHelper.resourceAsString("id_rsa");
         assertEquals(pubKeyStr, Helper.getSSHPublicKeyFromPrivate(privKeyStr, null));
     }
 
+    @Test
+    public void testExtractPublicKeyED25519() throws IOException {
+        final String pubKeyStr = TestHelper.resourceAsString("id_ed25519.pub");
+        final String privKeyStr = TestHelper.resourceAsString("id_ed25519");
+        assertEquals(pubKeyStr, Helper.getSSHPublicKeyFromPrivate(privKeyStr, null));
+    }
+
     private static LocalDateTime time(String str) {
         return LocalDateTime.from(DateTimeFormatter.ISO_DATE_TIME.parse(str + "+02:00"));
     }
diff --git a/src/test/resources/id_ed25519 b/src/test/resources/id_ed25519
new file mode 100644
index 0000000..748a861
--- /dev/null
+++ b/src/test/resources/id_ed25519
@@ -0,0 +1,7 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+QyNTUxOQAAACDcbIqDY9hFJb9+/yKhPpZZZnjTwyGLSmlnZirb5ps1YAAAAJACffNsAn3z
+bAAAAAtzc2gtZWQyNTUxOQAAACDcbIqDY9hFJb9+/yKhPpZZZnjTwyGLSmlnZirb5ps1YA
+AAAEAc7nxaUJgtIKaS0nNK+fTleBeF3o1kNajufRxpKIU0fNxsioNj2EUlv37/IqE+lllm
+eNPDIYtKaWdmKtvmmzVgAAAAB2plbmtpbnMBAgMEBQY=
+-----END OPENSSH PRIVATE KEY-----
diff --git a/src/test/resources/id_ed25519.pub b/src/test/resources/id_ed25519.pub
new file mode 100644
index 0000000..09c674f
--- /dev/null
+++ b/src/test/resources/id_ed25519.pub
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINxsioNj2EUlv37/IqE+lllmeNPDIYtKaWdmKtvmmzVg
\ No newline at end of file