99 lines
3.0 KiB
Go
99 lines
3.0 KiB
Go
package input
|
|
|
|
import (
|
|
"time"
|
|
|
|
"golang.org/x/crypto/ssh"
|
|
|
|
"git.maze.io/maze/conduit/ssh/sshutil"
|
|
)
|
|
|
|
// Certificate represents a [ssh.Certificate].
|
|
type Certificate struct {
|
|
Nonce []byte `json:"nonce"`
|
|
Key *PublicKey `json:"key"`
|
|
Serial uint64 `json:"serial"`
|
|
CertType uint32 `json:"type"`
|
|
KeyId string `json:"key_id"`
|
|
ValidPrincipals []string `json:"valid_principals"`
|
|
ValidAfter *time.Time `json:"valid_after"`
|
|
ValidBefore *time.Time `json:"valid_before"`
|
|
SignatureKey *PublicKey `json:"signature_key"`
|
|
Signature []byte `json:"signature"`
|
|
SignatureFormat string `json:"signature_format"`
|
|
}
|
|
|
|
// NewCertificate converts an [ssh.Certificate] to [Certificate] input.
|
|
func NewCertificate(cert *ssh.Certificate) *Certificate {
|
|
if cert == nil {
|
|
return nil
|
|
}
|
|
c := &Certificate{
|
|
Nonce: cert.Nonce,
|
|
Key: NewPublicKey(cert.Key),
|
|
Serial: cert.Serial,
|
|
CertType: cert.CertType,
|
|
KeyId: cert.KeyId,
|
|
ValidPrincipals: cert.ValidPrincipals,
|
|
SignatureKey: NewPublicKey(cert.SignatureKey),
|
|
}
|
|
if cert.ValidAfter > 0 {
|
|
t := time.Unix(int64(cert.ValidAfter), 0)
|
|
c.ValidAfter = &t
|
|
}
|
|
if cert.ValidBefore > 0 {
|
|
t := time.Unix(int64(cert.ValidBefore), 0)
|
|
c.ValidBefore = &t
|
|
}
|
|
|
|
if cert.Signature != nil {
|
|
c.Signature = cert.Signature.Blob
|
|
c.SignatureFormat = cert.Signature.Format
|
|
}
|
|
return c
|
|
}
|
|
|
|
// ConnMetadata is a Rego input that represents a [ssh.ConnMetadata].
|
|
type ConnMetadata struct {
|
|
User string `json:"user"` // User is the user ID for this connection.
|
|
SessionID []byte `json:"session_id"` // SessionID is the session hash, also denoted by H.
|
|
ClientVersion string `json:"client_version"` // ClientVersion is the client's version.
|
|
ServerVersion string `json:"server_version"` // ServerVersion is the server's version
|
|
RemoteAddr *Addr `json:"remote_addr"` // RemoteAddr is the remote address for this connection.
|
|
LocalAddr *Addr `json:"local_addr"` // LocalAddr is the local address for this connection.
|
|
}
|
|
|
|
// NewConnMetadata converts an [ssh.ConnMetadata] to [ConnMetadata] input.
|
|
func NewConnMetadata(meta ssh.ConnMetadata) *ConnMetadata {
|
|
if meta == nil {
|
|
return nil
|
|
}
|
|
return &ConnMetadata{
|
|
User: meta.User(),
|
|
SessionID: meta.SessionID(),
|
|
ClientVersion: string(meta.ClientVersion()),
|
|
ServerVersion: string(meta.ServerVersion()),
|
|
RemoteAddr: NewAddr(meta.RemoteAddr()),
|
|
LocalAddr: NewAddr(meta.LocalAddr()),
|
|
}
|
|
}
|
|
|
|
// PublicKey represents a [ssh.PublicKey].
|
|
type PublicKey struct {
|
|
Type string `json:"type"`
|
|
Bits int `json:"bits"`
|
|
Fingerprint string `json:"fingerprint"`
|
|
}
|
|
|
|
// NewPublicKey converts an [ssh.PublicKey] to [PublicKey] input.
|
|
func NewPublicKey(key ssh.PublicKey) *PublicKey {
|
|
if key == nil {
|
|
return nil
|
|
}
|
|
return &PublicKey{
|
|
Type: sshutil.KeyType(key),
|
|
Bits: sshutil.KeyBits(key),
|
|
Fingerprint: ssh.FingerprintSHA256(key),
|
|
}
|
|
}
|