Bump version to 1.0.23

internal/sshmanager/testconn.go

@@ -3,6 +3,8 @@ package sshmanager
 import (
 	"bytes"
 	"context"
+	"crypto/sha256"
+	"encoding/base64"
 	"fmt"
 	"net"
 	"os"
@@ -36,19 +38,30 @@ func TestSSHConnection(ctx context.Context, host string, port int, user, privKey
 		auths = append(auths, ssh.PublicKeys(signer))
 	}
 
-	hostKeyPolicy := ssh.InsecureIgnoreHostKey()
-	if strictHostKeyChecking && knownHostsPath != "" {
-		hostKeyCallback, err := getHostKeyCallback(knownHostsPath, host, port)
-		if err != nil {
-			return &ConnResult{Success: false, Error: fmt.Sprintf("known_hosts: %v", err)}, nil
+	var capturedFingerprint string
+	hostKeyCallback := func(hostname string, remote net.Addr, key ssh.PublicKey) error {
+		h := sha256.Sum256(key.Marshal())
+		capturedFingerprint = "SHA256:" + base64.RawStdEncoding.EncodeToString(h[:])
+		if strictHostKeyChecking && knownHostsPath != "" {
+			kh, err := GetKnownHost(filepath.Dir(knownHostsPath), host, port)
+			if err != nil {
+				return fmt.Errorf("checking known_hosts: %w", err)
+			}
+			if kh == nil {
+				return fmt.Errorf("host key not found in known_hosts: %s", hostname)
+			}
+			wantFP := kh.Fingerprint
+			if capturedFingerprint != wantFP {
+				return fmt.Errorf("host key mismatch: got %s, want %s", capturedFingerprint, wantFP)
+			}
 		}
-		hostKeyPolicy = hostKeyCallback
+		return nil
 	}
 
 	cfg := &ssh.ClientConfig{
 		User:            user,
 		Auth:            auths,
-		HostKeyCallback: hostKeyPolicy,
+		HostKeyCallback: hostKeyCallback,
 		Timeout:         10 * time.Second,
 	}
 
@@ -59,20 +72,22 @@ func TestSSHConnection(ctx context.Context, host string, port int, user, privKey
 	if err != nil {
 		if strings.Contains(err.Error(), "known_hosts") || strings.Contains(err.Error(), "host key") {
 			return &ConnResult{
-				Success: false,
-				Error:   fmt.Sprintf("host key verification failed: %v", err),
+				Success:     false,
+				Error:       fmt.Sprintf("host key verification failed: %v", err),
+				Fingerprint: capturedFingerprint,
 			}, nil
 		}
 		return &ConnResult{
-			Success: false,
-			Error:   fmt.Sprintf("connection failed: %v", err),
+			Success:     false,
+			Error:       fmt.Sprintf("connection failed: %v", err),
+			Fingerprint: capturedFingerprint,
 		}, nil
 	}
 	defer conn.Close()
 
 	session, err := conn.NewSession()
 	if err != nil {
-		return &ConnResult{Success: false, Error: fmt.Sprintf("session: %v", err)}, nil
+		return &ConnResult{Success: false, Error: fmt.Sprintf("session: %v", err), Fingerprint: capturedFingerprint}, nil
 	}
 	defer session.Close()
 
@@ -82,26 +97,15 @@ func TestSSHConnection(ctx context.Context, host string, port int, user, privKey
 
 	if err := session.Run("echo ok && uname -a"); err != nil {
 		return &ConnResult{
-			Success: false,
-			Error:   fmt.Sprintf("exec: %v, stderr: %s", err, stderr.String()),
+			Success:     false,
+			Error:       fmt.Sprintf("exec: %v, stderr: %s", err, stderr.String()),
+			Fingerprint: capturedFingerprint,
 		}, nil
 	}
 
 	return &ConnResult{
-		Success: true,
-		Output:  stdout.String(),
+		Success:     true,
+		Output:      stdout.String(),
+		Fingerprint: capturedFingerprint,
 	}, nil
 }
-
-func getHostKeyCallback(knownHostsPath, host string, port int) (ssh.HostKeyCallback, error) {
-	return ssh.HostKeyCallback(func(hostname string, remote net.Addr, key ssh.PublicKey) error {
-		kh, err := GetKnownHost(filepath.Dir(knownHostsPath), host, port)
-		if err != nil {
-			return fmt.Errorf("checking known_hosts: %w", err)
-		}
-		if kh == nil {
-			return fmt.Errorf("host key not found in known_hosts: %s", hostname)
-		}
-		return nil
-	}), nil
-}