Initial import

policy/input/ssh.go

@@ -0,0 +1,98 @@
+package input
+
+import (
+	"time"
+
+	"golang.org/x/crypto/ssh"
+
+	"git.maze.io/maze/conduit/ssh/sshutil"
+)
+
+// Certificate represents a [ssh.Certificate].
+type Certificate struct {
+	Nonce           []byte     `json:"nonce"`
+	Key             *PublicKey `json:"key"`
+	Serial          uint64     `json:"serial"`
+	CertType        uint32     `json:"type"`
+	KeyId           string     `json:"key_id"`
+	ValidPrincipals []string   `json:"valid_principals"`
+	ValidAfter      *time.Time `json:"valid_after"`
+	ValidBefore     *time.Time `json:"valid_before"`
+	SignatureKey    *PublicKey `json:"signature_key"`
+	Signature       []byte     `json:"signature"`
+	SignatureFormat string     `json:"signature_format"`
+}
+
+// NewCertificate converts an [ssh.Certificate] to [Certificate] input.
+func NewCertificate(cert *ssh.Certificate) *Certificate {
+	if cert == nil {
+		return nil
+	}
+	c := &Certificate{
+		Nonce:           cert.Nonce,
+		Key:             NewPublicKey(cert.Key),
+		Serial:          cert.Serial,
+		CertType:        cert.CertType,
+		KeyId:           cert.KeyId,
+		ValidPrincipals: cert.ValidPrincipals,
+		SignatureKey:    NewPublicKey(cert.SignatureKey),
+	}
+	if cert.ValidAfter > 0 {
+		t := time.Unix(int64(cert.ValidAfter), 0)
+		c.ValidAfter = &t
+	}
+	if cert.ValidBefore > 0 {
+		t := time.Unix(int64(cert.ValidBefore), 0)
+		c.ValidBefore = &t
+	}
+
+	if cert.Signature != nil {
+		c.Signature = cert.Signature.Blob
+		c.SignatureFormat = cert.Signature.Format
+	}
+	return c
+}
+
+// ConnMetadata is a Rego input that represents a [ssh.ConnMetadata].
+type ConnMetadata struct {
+	User          string `json:"user"`           // User is the user ID for this connection.
+	SessionID     []byte `json:"session_id"`     // SessionID is the session hash, also denoted by H.
+	ClientVersion string `json:"client_version"` // ClientVersion is the client's version.
+	ServerVersion string `json:"server_version"` // ServerVersion is the server's version
+	RemoteAddr    *Addr  `json:"remote_addr"`    // RemoteAddr is the remote address for this connection.
+	LocalAddr     *Addr  `json:"local_addr"`     // LocalAddr is the local address for this connection.
+}
+
+// NewConnMetadata converts an [ssh.ConnMetadata] to [ConnMetadata] input.
+func NewConnMetadata(meta ssh.ConnMetadata) *ConnMetadata {
+	if meta == nil {
+		return nil
+	}
+	return &ConnMetadata{
+		User:          meta.User(),
+		SessionID:     meta.SessionID(),
+		ClientVersion: string(meta.ClientVersion()),
+		ServerVersion: string(meta.ServerVersion()),
+		RemoteAddr:    NewAddr(meta.RemoteAddr()),
+		LocalAddr:     NewAddr(meta.LocalAddr()),
+	}
+}
+
+// PublicKey represents a [ssh.PublicKey].
+type PublicKey struct {
+	Type        string `json:"type"`
+	Bits        int    `json:"bits"`
+	Fingerprint string `json:"fingerprint"`
+}
+
+// NewPublicKey converts an [ssh.PublicKey] to [PublicKey] input.
+func NewPublicKey(key ssh.PublicKey) *PublicKey {
+	if key == nil {
+		return nil
+	}
+	return &PublicKey{
+		Type:        sshutil.KeyType(key),
+		Bits:        sshutil.KeyBits(key),
+		Fingerprint: ssh.FingerprintSHA256(key),
+	}
+}