sign.go

package keyring

import (
	"fmt"
	"golang.org/x/crypto/ssh"
)

type SignType byte

const (
	SignTypeUserAuthRequest SignType = 50
)

type SignInfo struct {
	Session string
	Type    SignType
	User    string
	Service string
	Context string
	Content any
}

type SignPublicKeyHostBound struct {
	HasSignature bool
	Pkalg        string
	PublicKey    ssh.PublicKey
	HostKey      ssh.PublicKey
}

func ParseSignData(contents []byte) (*SignInfo, error) {
	var raw struct {
		Session  []byte
		AuthType byte
		User     string
		Service  string
		Context  string
		Contents []byte `ssh:"rest"`
	}
	err := ssh.Unmarshal(contents, &raw)
	if err != nil {
		return nil, err
	}
	var r = &SignInfo{
		Session: fmt.Sprintf("%x", raw.Session),
		Type:    SignType(raw.AuthType),
		User:    raw.User,
		Service: raw.Service,
		Context: raw.Context,
	}
	if r.Type == SignTypeUserAuthRequest {
		switch r.Service {
		case "ssh-connection":
			switch r.Context {
			case "publickey-hostbound-v00@openssh.com":
				r.Content, err = parseSignPublicKeyHostBound(raw.Contents)
			}
		}
	}
	return r, err
}

func parseSignPublicKeyHostBound(contents []byte) (*SignPublicKeyHostBound, error) {
	var raw struct {
		HasSignature bool
		Pkalg        string
		PublicKey    []byte
		HostKey      []byte
	}
	err := ssh.Unmarshal(contents, &raw)
	if err != nil {
		return nil, err
	}
	var r = &SignPublicKeyHostBound{
		HasSignature: raw.HasSignature,
		Pkalg:        raw.Pkalg,
	}
	if r.PublicKey, err = ssh.ParsePublicKey(raw.PublicKey); err != nil {
		return nil, err
	}
	if r.HostKey, err = ssh.ParsePublicKey(raw.HostKey); err != nil {
		return nil, err
	}
	return nil, nil
}