parse ssh keysign binary data

2 files changed, 110 insertions, 5 deletions

diff --git a/Makefile b/Makefile
index 927f567..55bb8d8 100644
--- a/Makefile
+++ b/Makefile
@@ -19,13 +19,13 @@ allowed = <(printf '"%s" ' $(quoted_identity); cat $(key).pub)
 
 apt_dep_bins = /usr/bin/ssh-keygen /usr/sbin/sshd /usr/bin/basez
 apt_deps = openssh-client openssh-server basez
-#apt_dep_bins += /usr/bin/sipcalc
-#apt_deps += sipcalc
+apt_dep_bins += /usr/bin/poke # /usr/bin/sipcalc
+apt_deps += poke # sipcalc
 
 .PHONY: testall clean install
-.PHONY: validate check-novalidate find-principals verify
+.PHONY: validate check-novalidate find-principals verify sigdump
 
-testall: $(signature) check-novalidate find-principals verify
+testall: $(signature) check-novalidate find-principals verify sigdump
 validate: $(signature) verify
 
 $(dir $(target)):
@@ -50,6 +50,12 @@ find-principals: $(signature) | /usr/bin/ssh-keygen
         ssh-keygen -n file -s $(signature) -f $(allowed) \
           -Y $@ < $(target)
 
+%.sig.bin: %.sig | /usr/bin/poke
+        grep -v -e '^-' $< | base64 -d > $@
+
+sigdump: $(signature).bin | /usr/bin/basez
+        ./src/ssh-keysign.pk $<
+
 verify: | /usr/bin/ssh-keygen /usr/bin/basez
         ssh-keygen -n file -I $(quoted_identity) -f $(allowed) -s $(signature) \
           -Y $@ < $(target)
@@ -59,7 +65,6 @@ verify: | /usr/bin/ssh-keygen /usr/bin/basez
           sed -ne 's/^ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI/I/p' | \
           basez -d | tail -c32 | basez -x
 
-
 /usr/bin/apt:
         $(warning Please install OpenSSH through your system package manager.)
         @false
diff --git a/src/ssh-keysign.pk b/src/ssh-keysign.pk
new file mode 100755
index 0000000..1c17110
--- /dev/null
+++ b/src/ssh-keysign.pk
@@ -0,0 +1,100 @@
+#!/usr/bin/poke -L
+!#
+
+type SSH_String =
+struct
+{
+   uint<32> size;
+   byte[size] data;
+};
+
+type SSH_Publickey =
+struct
+{
+   SSH_String key_type : catos(key_type.data) == "ssh-ed25519";
+   SSH_String key_data : key_data.size == 32;
+};
+
+type SSH_Signature =
+struct
+{
+   SSH_String sig_type : catos(sig_type.data) == "ssh-ed25519";
+   SSH_String sig_data;
+};
+
+type SSH_Signature_String =
+struct
+{
+   uint<32> size;
+   union {
+     SSH_Signature sig;
+     byte[size] raw;
+   } data;
+};
+
+type SSH_Publickey_String =
+struct
+{
+   uint<32> size;
+   union {
+     SSH_Publickey key;
+     byte[size] raw;
+   } data;
+};
+
+type SSH_Signature =
+struct
+{
+   uint<32> size;
+   byte[size] data;
+};
+
+type SSH_Signature_Blob =
+struct
+{
+   byte[6] MAGIC_PREAMBLE : catos(MAGIC_PREAMBLE) == "SSHSIG";
+   uint<32> SIG_VERSION : SIG_VERSION == 1;
+   SSH_Publickey_String publickey;
+   SSH_String namespace;
+   SSH_String reserved;
+   SSH_String hash_algorithm;
+   SSH_Signature_String signature;
+};
+
+if (!(argv'length in [1]))
+  {
+    print("Usage: ssh-keysign.pk FILE\n");
+    exit(1);
+  }
+
+var file_name = argv[0];
+
+try
+  {
+    var fd = open (file_name, IOS_M_RDONLY);
+    var sig = SSH_Signature_Blob @ fd : 0#B;
+    printf("%s: %s (%i32d bytes)\n", "publickey",
+           catos(sig.publickey.data.key.key_type.data),
+           sig.publickey.data.key.key_data.size);
+    printf("%s: %s\n", "namespace",
+           catos(sig.namespace.data));
+    printf("%s: <%i32d bytes>\n", "reserved",
+           sig.reserved.size);
+    printf("%s: %s\n", "hash_algorithm",
+           catos(sig.hash_algorithm.data));
+    printf("%s: %s (%i32d bytes)\n", "signature",
+           catos(sig.signature.data.sig.sig_type.data),
+           sig.signature.data.sig.sig_data.size);
+    close (fd);
+  }
+catch (Exception e)
+  {
+    if (e == E_constraint)
+      printf ("error: invalid input: `%s'\n", file_name);
+    else if (e == E_io)
+      printf ("error: couldn't open file `%s'\n", file_name);
+    else
+      raise e;
+
+    exit (1);
+  }