T7557: Workaround for upstream paramiko bug

Author: sarthurdev

debian/vyos-1x.postinst

@@ -278,3 +278,7 @@ fi
 if systemctl is-active --quiet vyos-domain-resolver; then
     systemctl restart vyos-domain-resolver
 fi
+
+# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1108434
+sed -i 's/OpenSSH_(?:\[1-6\]|/OpenSSH_(?:[1-6]\\.|/g' /usr/lib/python3/dist-packages/paramiko/auth_handler.py
+rm -rf /usr/lib/python3/dist-packages/paramiko/__pycache__

smoketest/scripts/cli/base_vyostest_shim.py

@@ -153,13 +153,19 @@ def getFRRconfig(self, string=None, end='$', endsection='^!',
 
         @staticmethod
         def ssh_send_cmd(command, username, password, key_filename=None,
-                         hostname='localhost'):
+                         hostname='localhost', certificate=None):
             """ SSH command execution helper """
             # Try to login via SSH
             ssh_client = paramiko.SSHClient()
             ssh_client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
+            pkey = None
+            if key_filename:
+                with open(key_filename, 'r') as f:
+                    pkey = paramiko.RSAKey.from_private_key(f)
+                if certificate:
+                    pkey.load_certificate(certificate)
             ssh_client.connect(hostname=hostname, username=username,
-                               password=password, key_filename=key_filename)
+                               password=password, pkey=pkey)
             _, stdout, stderr = ssh_client.exec_command(command)
             output = stdout.read().decode().strip()
             error = stderr.read().decode().strip()

smoketest/scripts/cli/test_service_ssh.py

@@ -449,12 +449,13 @@ def test_ssh_trusted_user_ca(self):
 
         # Verify functionality by logging into the system using signed user key
         key_filename = f'/tmp/{test_user}'
+        user_cert_str = cert_user_signed.replace('\n', '')
         write_file(key_filename, cert_user_key, mode=0o600)
-        write_file(f'{key_filename}-cert.pub', cert_user_signed.replace('\n', ''))
 
         # Login with proper credentials
         output, error = self.ssh_send_cmd(test_command, test_user, password=None,
-                                          key_filename=key_filename)
+                                          key_filename=key_filename,
+                                          certificate=user_cert_str)
         # Verify login
         self.assertFalse(error)
         self.assertEqual(output, cmd(test_command))
@@ -471,7 +472,8 @@ def test_ssh_trusted_user_ca(self):
 
         # Login with proper credentials
         output, error = self.ssh_send_cmd(test_command, test_user, password=None,
-                                          key_filename=key_filename)
+                                          key_filename=key_filename,
+                                          certificate=user_cert_str)
         # Verify login
         self.assertFalse(error)
         self.assertEqual(output, cmd(test_command))