feat(core): bulk-up public ssh key validation

* validation of public ssh keys in the attributes now also includes a call of ssh-keygen
* this should catch some edge case invalid keys
* extracted the validation method to RPC to call from WUI

DEPLOYMENT NOTE: the `ssh-keygen` tool has to be available on instance machines

Author: xflord

perun-base/src/main/java/cz/metacentrum/perun/core/api/exceptions/SSHKeyNotValidException.java

@@ -0,0 +1,34 @@
+package cz.metacentrum.perun.core.api.exceptions;
+
+/**
+ * Validation of SSH key failed for some reason
+ *
+ * @author David Flor <[email protected]>
+ */
+public class SSHKeyNotValidException extends PerunException {
+
+	/**
+	 * Simple constructor with a message
+	 * @param message message with details about the cause
+	 */
+	public SSHKeyNotValidException(String message) {
+		super(message);
+	}
+
+	/**
+	 * Constructor with a message and Throwable object
+	 * @param message message with details about the cause
+	 * @param cause Throwable that caused throwing of this exception
+	 */
+	public SSHKeyNotValidException(String message, Throwable cause) {
+		super(message, cause);
+	}
+
+	/**
+	 * Constructor with a Throwable object
+	 * @param cause Throwable that caused throwing of this exception
+	 */
+	public SSHKeyNotValidException(Throwable cause) {
+		super(cause);
+	}
+}

perun-core/src/main/java/cz/metacentrum/perun/core/api/UsersManager.java

@@ -25,6 +25,7 @@
 import cz.metacentrum.perun.core.api.exceptions.RelationExistsException;
 import cz.metacentrum.perun.core.api.exceptions.RelationNotExistsException;
 import cz.metacentrum.perun.core.api.exceptions.ResourceNotExistsException;
+import cz.metacentrum.perun.core.api.exceptions.SSHKeyNotValidException;
 import cz.metacentrum.perun.core.api.exceptions.ServiceNotExistsException;
 import cz.metacentrum.perun.core.api.exceptions.SpecificUserAlreadyRemovedException;
 import cz.metacentrum.perun.core.api.exceptions.SpecificUserExpectedException;
@@ -1337,6 +1338,15 @@ List<RichUser> findRichUsersWithoutSpecificVoWithAttributes(PerunSession sess, V
 	 */
 	String validatePreferredEmailChange(PerunSession sess, User user, String token) throws PrivilegeException, UserNotExistsException, WrongAttributeAssignmentException, AttributeNotExistsException, WrongReferenceAttributeValueException, WrongAttributeValueException;
 
+	/**
+	 * Validate ssh public key, throws exception if validation fails
+	 *
+	 * @param sess sess
+	 * @param sshKey ssh public key to verify
+	 * @throws SSHKeyNotValidException when validation fails
+	 */
+	void validateSSHKey(PerunSession sess, String sshKey) throws SSHKeyNotValidException;
+
 	/**
 	 * Return list of email addresses of user, which are
 	 * awaiting validation and are inside time window

perun-core/src/main/java/cz/metacentrum/perun/core/bl/UsersManagerBl.java

@@ -45,6 +45,7 @@
 import cz.metacentrum.perun.core.api.exceptions.PasswordStrengthFailedException;
 import cz.metacentrum.perun.core.api.exceptions.RelationExistsException;
 import cz.metacentrum.perun.core.api.exceptions.RelationNotExistsException;
+import cz.metacentrum.perun.core.api.exceptions.SSHKeyNotValidException;
 import cz.metacentrum.perun.core.api.exceptions.SpecificUserAlreadyRemovedException;
 import cz.metacentrum.perun.core.api.exceptions.SpecificUserOwnerAlreadyRemovedException;
 import cz.metacentrum.perun.core.api.exceptions.UserAlreadyRemovedException;
@@ -1519,6 +1520,15 @@ void deletePassword(PerunSession sess, User user, String loginNamespace)
 	 */
 	String validatePreferredEmailChange(PerunSession sess, User user, String token) throws WrongAttributeValueException, WrongAttributeAssignmentException, AttributeNotExistsException, WrongReferenceAttributeValueException;
 
+	/**
+	 * Validate ssh public key, throws exception if validation fails
+	 *
+	 * @param sess sess
+	 * @param sshKey ssh public key to verify
+	 * @throws SSHKeyNotValidException when validation fails
+	 */
+	void validateSSHKey(PerunSession sess, String sshKey) throws SSHKeyNotValidException;
+
 	/**
 	 * Return list of email addresses of user, which are
 	 * awaiting validation and are inside time window

perun-core/src/main/java/cz/metacentrum/perun/core/blImpl/UsersManagerBlImpl.java

@@ -70,6 +70,7 @@
 import cz.metacentrum.perun.core.api.exceptions.PasswordStrengthFailedException;
 import cz.metacentrum.perun.core.api.exceptions.RelationExistsException;
 import cz.metacentrum.perun.core.api.exceptions.RelationNotExistsException;
+import cz.metacentrum.perun.core.api.exceptions.SSHKeyNotValidException;
 import cz.metacentrum.perun.core.api.exceptions.SpecificUserAlreadyRemovedException;
 import cz.metacentrum.perun.core.api.exceptions.SpecificUserOwnerAlreadyRemovedException;
 import cz.metacentrum.perun.core.api.exceptions.UserAlreadyRemovedException;
@@ -92,6 +93,7 @@
 import cz.metacentrum.perun.core.bl.PerunBl;
 import cz.metacentrum.perun.core.bl.UsersManagerBl;
 import cz.metacentrum.perun.core.impl.PerunSessionImpl;
+import cz.metacentrum.perun.core.impl.SSHValidator;
 import cz.metacentrum.perun.core.impl.Utils;
 import cz.metacentrum.perun.core.impl.modules.pwdmgr.GenericPasswordManagerModule;
 import cz.metacentrum.perun.core.implApi.UsersManagerImplApi;
@@ -1910,6 +1912,11 @@ public String validatePreferredEmailChange(PerunSession sess, User user, String
 		return email;
 	}
 
+	@Override
+	public void validateSSHKey(PerunSession sess, String sshKey) throws SSHKeyNotValidException {
+		Utils.validateSSHPublicKey(sshKey);
+	}
+
 	@Override
 	public List<String> getPendingPreferredEmailChanges(PerunSession sess, User user) throws WrongAttributeAssignmentException, AttributeNotExistsException {
 

perun-core/src/main/java/cz/metacentrum/perun/core/entry/UsersManagerEntry.java

@@ -58,6 +58,7 @@
 import cz.metacentrum.perun.core.api.exceptions.RelationExistsException;
 import cz.metacentrum.perun.core.api.exceptions.RelationNotExistsException;
 import cz.metacentrum.perun.core.api.exceptions.ResourceNotExistsException;
+import cz.metacentrum.perun.core.api.exceptions.SSHKeyNotValidException;
 import cz.metacentrum.perun.core.api.exceptions.ServiceNotExistsException;
 import cz.metacentrum.perun.core.api.exceptions.SpecificUserAlreadyRemovedException;
 import cz.metacentrum.perun.core.api.exceptions.SpecificUserExpectedException;
@@ -1560,6 +1561,13 @@ public String validatePreferredEmailChange(PerunSession sess, User user, String
 		return getPerunBl().getUsersManagerBl().validatePreferredEmailChange(sess, user, token);
 	}
 
+	@Override
+	public void validateSSHKey(PerunSession sess, String sshKey) throws SSHKeyNotValidException {
+		Utils.checkPerunSession(sess);
+
+		getPerunBl().getUsersManagerBl().validateSSHKey(sess, sshKey);
+	}
+
 	@Override
 	public List<String> getPendingPreferredEmailChanges(PerunSession sess, User user) throws PrivilegeException, UserNotExistsException, WrongAttributeAssignmentException, AttributeNotExistsException {