ssh: T3789: add custom validator for base64 encoded CLI data

SSH keys used for remote login are supplied as base64 encoded data on the CLI.
The key is not validated, thus an invalid copy/pasted key will render the login
useless. This commit adds a custom and re-usable validator which check if the
data is properly base64 encoded.

2 files changed, 31 insertions, 1 deletions

diff --git a/interface-definitions/system-login.xml.in b/interface-definitions/system-login.xml.in
index fb34b7199..3c2c7dfa5 100644
--- a/interface-definitions/system-login.xml.in
+++ b/interface-definitions/system-login.xml.in
@@ -52,7 +52,10 @@
                     <children>
                       <leafNode name="key">
                         <properties>
-                          <help>Public key value (base64-encoded)</help>
+                          <help>Public key value (Base64 encoded)</help>
+                          <constraint>
+                            <validator name="base64"/>
+                          </constraint>
                         </properties>
                       </leafNode>
                       <leafNode name="options">
diff --git a/src/validators/base64 b/src/validators/base64
new file mode 100755
index 000000000..e2b1e730d
--- /dev/null
+++ b/src/validators/base64
@@ -0,0 +1,27 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2021 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import base64
+from sys import argv
+
+if __name__ == '__main__':
+    if len(argv) != 2:
+        exit(1)
+    try:
+        base64.b64decode(argv[1])
+    except:
+        exit(1)
+    exit(0)