Class: Net::SSH::Authentication::Certificate

Inherits:
Object
  • Object
show all
Defined in:
lib/net/ssh/authentication/certificate.rb

Overview

Class for representing an SSH certificate.

cvsweb.openbsd.org/cgi-bin/cvsweb/~checkout~/src/usr.bin/ssh/PROTOCOL.certkeys?rev=1.10&content-type=text/plain

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Instance Attribute Details

#critical_options ⇒ Object

Returns the value of attribute critical_options.



18
19
20
 
# File 'lib/net/ssh/authentication/certificate.rb', line 18

def critical_options
  @critical_options
end

#extensions ⇒ Object

Returns the value of attribute extensions.



19
20
21
 
# File 'lib/net/ssh/authentication/certificate.rb', line 19

def extensions
  @extensions
end

#key ⇒ Object

Returns the value of attribute key.



11
12
13
 
# File 'lib/net/ssh/authentication/certificate.rb', line 11

def key
  @key
end

#key_id ⇒ Object

Returns the value of attribute key_id.



14
15
16
 
# File 'lib/net/ssh/authentication/certificate.rb', line 14

def key_id
  @key_id
end

#nonce ⇒ Object

Returns the value of attribute nonce.



10
11
12
 
# File 'lib/net/ssh/authentication/certificate.rb', line 10

def nonce
  @nonce
end

#reserved ⇒ Object

Returns the value of attribute reserved.



20
21
22
 
# File 'lib/net/ssh/authentication/certificate.rb', line 20

def reserved
  @reserved
end

#serial ⇒ Object

Returns the value of attribute serial.



12
13
14
 
# File 'lib/net/ssh/authentication/certificate.rb', line 12

def serial
  @serial
end

#signature ⇒ Object

Returns the value of attribute signature.



22
23
24
 
# File 'lib/net/ssh/authentication/certificate.rb', line 22

def signature
  @signature
end

#signature_key ⇒ Object

Returns the value of attribute signature_key.



21
22
23
 
# File 'lib/net/ssh/authentication/certificate.rb', line 21

def signature_key
  @signature_key
end

#type ⇒ Object

Returns the value of attribute type.



13
14
15
 
# File 'lib/net/ssh/authentication/certificate.rb', line 13

def type
  @type
end

#valid_after ⇒ Object

Returns the value of attribute valid_after.



16
17
18
 
# File 'lib/net/ssh/authentication/certificate.rb', line 16

def valid_after
  @valid_after
end

#valid_before ⇒ Object

Returns the value of attribute valid_before.



17
18
19
 
# File 'lib/net/ssh/authentication/certificate.rb', line 17

def valid_before
  @valid_before
end

#valid_principals ⇒ Object

Returns the value of attribute valid_principals.



15
16
17
 
# File 'lib/net/ssh/authentication/certificate.rb', line 15

def valid_principals
  @valid_principals
end

Class Method Details

.read_certblob(buffer, type) ⇒ Object

Read a certificate blob associated with a key of the given type.



25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
 
# File 'lib/net/ssh/authentication/certificate.rb', line 25

def self.read_certblob(buffer, type)
  cert = Certificate.new
  cert.nonce = buffer.read_string
  cert.key = buffer.read_keyblob(type)
  cert.serial = buffer.read_int64
  cert.type = type_symbol(buffer.read_long)
  cert.key_id = buffer.read_string
  cert.valid_principals = buffer.read_buffer.read_all(&:read_string)
  cert.valid_after = Time.at(buffer.read_int64)
  
  cert.valid_before = if RUBY_PLATFORM == "java"
                        # 0x20c49ba5e353f7 = 0x7fffffffffffffff/1000, the largest value possible for JRuby
                        # JRuby Time.at multiplies the arg by 1000, and then stores it in a signed long.
                        # 0x20c49ba5e353f7 = 292278994-08-17 01:12:55 -0600
                        Time.at([0x20c49ba5e353f7, buffer.read_int64].min)
                      else
                        Time.at(buffer.read_int64)
                      end

  cert.critical_options = read_options(buffer)
  cert.extensions = read_options(buffer)
  cert.reserved = buffer.read_string
  cert.signature_key = buffer.read_buffer.read_key
  cert.signature = buffer.read_string
  cert
end

Instance Method Details

#fingerprint ⇒ Object 



80
81
82
 
# File 'lib/net/ssh/authentication/certificate.rb', line 80

def fingerprint
  key.fingerprint
end

#sign(key, sign_nonce = nil) ⇒ Object 



96
97
98
99
 
# File 'lib/net/ssh/authentication/certificate.rb', line 96

def sign(key, sign_nonce=nil)
  cert = clone
  cert.sign!(key, sign_nonce)
end

#sign!(key, sign_nonce = nil) ⇒ Object

Signs the certificate with key.



85
86
87
88
89
90
91
92
93
94
 
# File 'lib/net/ssh/authentication/certificate.rb', line 85

def sign!(key, sign_nonce=nil)
  # ssh-keygen uses 32 bytes of nonce.
  self.nonce = sign_nonce || SecureRandom.random_bytes(32)
  self.signature_key = key
  self.signature = Net::SSH::Buffer.from(
    :string, key.ssh_signature_type,
    :mstring, key.ssh_do_sign(to_blob_without_signature)
  ).to_s
  self
end

#signature_valid? ⇒ Boolean

Checks whether the certificate’s signature was signed by signature key.

Returns:

  • (Boolean) 


102
103
104
105
106
 
# File 'lib/net/ssh/authentication/certificate.rb', line 102

def signature_valid?
  buffer = Buffer.new(signature)
  buffer.read_string # skip signature format
  signature_key.ssh_do_verify(buffer.read_string, to_blob_without_signature)
end

#ssh_do_sign(data) ⇒ Object 



68
69
70
 
# File 'lib/net/ssh/authentication/certificate.rb', line 68

def ssh_do_sign(data)
  key.ssh_do_sign(data)
end

#ssh_do_verify(sig, data) ⇒ Object 



72
73
74
 
# File 'lib/net/ssh/authentication/certificate.rb', line 72

def ssh_do_verify(sig, data)
  key.ssh_do_verify(sig, data)
end

#ssh_signature_type ⇒ Object 



56
57
58
 
# File 'lib/net/ssh/authentication/certificate.rb', line 56

def ssh_signature_type
  key.ssh_type
end

#ssh_type ⇒ Object 



52
53
54
 
# File 'lib/net/ssh/authentication/certificate.rb', line 52

def ssh_type
  key.ssh_type + "[email protected]"
end

#to_blob ⇒ Object

Serializes the certificate (and key).



61
62
63
64
65
66
 
# File 'lib/net/ssh/authentication/certificate.rb', line 61

def to_blob
  Buffer.from(
    :raw, to_blob_without_signature,
    :string, signature
  ).to_s
end

#to_pem ⇒ Object 



76
77
78
 
# File 'lib/net/ssh/authentication/certificate.rb', line 76

def to_pem
  key.to_pem
end