Page MenuHomeVyOS Platform
Create Task
Maniphest T9251

Ansible vyos.vyos.vyos_user: public key `type` choices reject the sk-* types VyOS accepts
Closed, ResolvedPublicBUG
Actions

Description

The Ansible module vyos.vyos.vyos_user constrains public_keys[].type to a fixed list of key types, and VyOS enforces its own list on the same node. The two are out of sync: T4750 added sk-ecdsa-sha2-nistp256@openssh.com and sk-ssh-ed25519@openssh.com in November 2022, and the module's list was never updated.

Failing task:

- vyos.vyos.vyos_user:
    name: vyos
    public_keys:
      - name: user@host
        key: AAAAInNr...
        type: sk-ecdsa-sha2-nistp256@openssh.com

Error:

value of type must be one of: ssh-dss, ssh-rsa, ecdsa-sha2-nistp256, ecdsa-sha2-nistp384, ssh-ed25519, ecdsa-sha2-nistp521, got: sk-ecdsa-sha2-nistp256@openssh.com found in public_keys

The equivalent set lines commit without complaint:

set system login user vyos authentication public-keys user@host key 'AAAAInNr...'
set system login user vyos authentication public-keys user@host type 'sk-ecdsa-sha2-nistp256@openssh.com'

VyOS's list, from vyos-1x, interface-definitions/system_login.xml.in:

(ssh-dss|ssh-rsa|ecdsa-sha2-nistp256|ecdsa-sha2-nistp384|ecdsa-sha2-nistp521|ssh-ed25519|sk-ecdsa-sha2-nistp256@openssh.com|sk-ssh-ed25519@openssh.com)

The list appears twice in plugins/modules/vyos_user.py, so a fix touches both: the type entry in public_key_spec, and the matching choices list in the DOCUMENTATION block.

Details

Version
vyos.vyos 6.0.0, VyOS 1.5 rolling
Is it a breaking change?
Perfectly compatible
Issue type
Bug (incorrect behavior)

Related Objects

Event Timeline

mson created this task.Thu, Aug 27, 7:02 AM
mson added a comment.Thu, Aug 27, 7:05 AM

FYI, this is meant for VyOS Ansible Collection but the "Submit Bug Report" link from the home page populates the form with the VyOS Rolling tag, and I was not able to update it.

Viacheslav renamed this task from vyos.vyos.vyos_user: public key `type` choices reject the sk-* types VyOS accepts to Ansible vyos.vyos.vyos_user: public key `type` choices reject the sk-* types VyOS accepts.Thu, Aug 27, 1:14 PM
Viacheslav triaged this task as Normal priority.
Viacheslav added a subscriber: evgmol.
evgmol claimed this task.EditedSat, Aug 29, 9:17 PM

@mson thanks for submitting this!
You mentioned a fix - is there a PR for this, or you want someone to look into this and fix, please?

Thank you

mson added a comment.Sat, Aug 29, 9:30 PM

Sorry for the confusion, no PR opened for this. I figured I'd include relevant information for a potential fix. I can open a PR with the changes to plugins/modules/vyos_user.py if I'm not missing anything.

evgmol added a comment.Sat, Aug 29, 9:39 PM

Thanks,
yes, usually if you have a fix - you fork the vyos.vyos, branch it, implement the fix and raise a PR that VyOS Gurus review and make it merge at some point.
Alternatively, you submit a bug or feature request, and other collaborators can try and implement it.

mson added a comment.Sat, Aug 29, 10:24 PM

Ok, thank you! For some reason I thought this projected wanted an issue created before opening any PRs, but I see that isn't the case in the contributing docs. Should I reference this issue in my PR?

evgmol added a comment.Sat, Aug 29, 10:28 PM

You are right - Public task first, then PR with the T task reference

evgmol added a comment.Sat, Aug 29, 10:43 PM

I will help formatting the PR if anything, dont woryy

pasik subscribed.Sun, Aug 30, 1:08 PM
evgmol added a comment.Tue, Sep 8, 10:30 PM

Thank you for your contribution
I fixed and approved it and left some comments for any future PRs

I will wait for one more approval and merge it.

evgmol changed the task status from Open to Needs testing.Tue, Sep 8, 10:30 PM
Viacheslav subscribed.Fri, Sep 11, 9:34 AM

Merged

evgmol closed this task as Resolved.Fri, Sep 11, 10:07 AM