Class: Net::SSH::HostKeyEntries::CertAuthority

Inherits:
Object
  • Object
show all
Defined in:
lib/net/ssh/known_hosts.rb

Overview

@cert-authority entry

Instance Method Summary collapse

Constructor Details

#initialize(key, comment: nil) ⇒ CertAuthority

Returns a new instance of CertAuthority.



52
53
54
55
 
# File 'lib/net/ssh/known_hosts.rb', line 52

def initialize(key, comment: nil)
  @key = key
  @comment = comment
end

Instance Method Details

#critical_options_supported?(server_key) ⇒ Boolean

Returns true if every critical option in the certificate is one we can enforce. net-ssh enforces none, so any critical option is unsupported and, as OpenSSH does, must cause the certificate to be rejected.

Returns:

  • (Boolean) 


92
93
94
 
# File 'lib/net/ssh/known_hosts.rb', line 92

def critical_options_supported?(server_key)
  server_key.critical_options.empty?
end

#matches_key?(server_key) ⇒ Boolean

Returns:

  • (Boolean) 


57
58
59
60
61
62
63
 
# File 'lib/net/ssh/known_hosts.rb', line 57

def matches_key?(server_key)
  if ssh_types.include?(server_key.ssh_type)
    server_key.signature_valid? && (server_key.signature_key.to_blob == @key.to_blob)
  else
    false
  end
end

#matches_principal?(server_key, hostname) ⇒ Boolean

Returns true if the certificate lists no principals (unrestricted) or if the given hostname matches a listed principal. Host-certificate principals are shell-glob patterns, matching OpenSSH, whose sshkey_cert_check_host passes wildcard_pattern=1 so principals like "*.example.com" are matched with match_pattern rather than strcmp.

Returns:

  • (Boolean) 


70
71
72
73
 
# File 'lib/net/ssh/known_hosts.rb', line 70

def matches_principal?(server_key, hostname)
  server_key.valid_principals.empty? ||
    server_key.valid_principals.any? { |principal| File.fnmatch(principal, hostname) }
end

#matches_type?(server_key) ⇒ Boolean

Returns true if the certificate is a host certificate. A user certificate (type :user) must never authenticate a host.

Returns:

  • (Boolean) 


85
86
87
 
# File 'lib/net/ssh/known_hosts.rb', line 85

def matches_type?(server_key)
  server_key.type == :host
end

#matches_validity?(server_key) ⇒ Boolean

Returns true if the certificate's validity window covers the current time.

Returns:

  • (Boolean) 


76
77
78
79
80
81
 
# File 'lib/net/ssh/known_hosts.rb', line 76

def matches_validity?(server_key)
  return false if server_key.valid_after && server_key.valid_after > Time.now
  return false if server_key.valid_before && server_key.valid_before < Time.now

  true
end

#ssh_types ⇒ Object 



41
42
43
44
45
46
47
48
49
50
 
# File 'lib/net/ssh/known_hosts.rb', line 41

def ssh_types
  %w[
    ecdsa-sha2-nistp256-cert-v01@openssh.com
    ecdsa-sha2-nistp384-cert-v01@openssh.com
    ecdsa-sha2-nistp521-cert-v01@openssh.com
    ssh-ed25519-cert-v01@openssh.com
    ssh-rsa-cert-v01@openssh.com
    ssh-rsa-cert-v00@openssh.com
  ]
end