Veröffentlichte Quellen

CH-J Tools

Durchsuchen Sie Verzeichnisse und Dateien einer bestimmten Anwendungsausgabe.

Quellen als ZIP herunterladen

CH-J / Server Manager 872 Dateien

core-20261030T220507Z-61e4558d889f Hinzugefügt: 31.10.2026, 00:29 · Erstellt: 30.10.2026, 23:05

keys.rs Hinzugefügt: Datum nicht erfasst 3,2 KB · 69 Zeilen

Code Datei herunterladen

1//! Private-key loading for SSH authentication (OpenSSH, PKCS#1/#5/#8 PEM, PuTTY PPK) and

2//! the public-key fingerprint used for lockout protection in Users.

4use crate::core::error::{CoreError, CoreResult};

5use base64::Engine;

6use russh::keys::PrivateKey;

7use sha2::{Digest, Sha256};

8use std::path::Path;

10pub const MAX_KEY_BYTES: u64 = 2 * 1024 * 1024;

12pub fn read_private_key_file(path: &str) -> CoreResult<String> {

13 if path.to_lowercase().ends_with(".pub") {

14 return Err(CoreError::new("PUBLIC_KEY_SELECTED", "Select a private key, not a .pub file."));

15 }

    let meta = std::fs::metadata(path).map_err(|_| CoreError::new("PRIVATE_KEY_NOT_FOUND", "The private key file cannot be read."))?;

17 if !meta.is_file() || meta.len() == 0 || meta.len() > MAX_KEY_BYTES {

18 return Err(CoreError::new("PRIVATE_KEY_INVALID", "The private key file is invalid or too large."));

19 }

    let bytes = std::fs::read(path).map_err(|_| CoreError::new("PRIVATE_KEY_NOT_FOUND", "The private key file cannot be read."))?;

    String::from_utf8(bytes).map_err(|_| CoreError::new("PRIVATE_KEY_INVALID", "The private key file is not a supported text key format."))

22}

24pub fn decode_private_key(text: &str, passphrase: Option<&str>) -> CoreResult<PrivateKey> {

25 let passphrase = passphrase.filter(|p| !p.is_empty());

26 match russh::keys::decode_secret_key(text, passphrase) {

27 Ok(key) => Ok(key),

        Err(russh::keys::Error::KeyIsEncrypted) => Err(CoreError::new("PRIVATE_KEY_PASSPHRASE_REQUIRED", "The private key is encrypted; enter its passphrase.")),

29 Err(error) => Err(CoreError::new(

30 if passphrase.is_some() { "PRIVATE_KEY_PASSPHRASE_INVALID" } else { "PRIVATE_KEY_UNSUPPORTED" },

31 format!("Cannot parse privateKey: {error}"),

32 )),

33 }

34}

36pub fn fingerprint_of_blob(blob: &[u8]) -> String {

37 format!("SHA256:{}", base64::engine::general_purpose::STANDARD_NO_PAD.encode(Sha256::digest(blob)))

38}

40/// `SHA256:…` fingerprint of the public half of a private key file (or its `.pub`).

41pub fn public_key_fingerprint_for_private_key(path: &str) -> Option<String> {

42 if let Ok(text) = std::fs::read_to_string(path) {

43 // Public half of an OpenSSH container is readable without the passphrase.

44 if let Ok(key) = ssh_key_public_from_openssh(&text) {

45 return Some(fingerprint_of_blob(&key));

46 }

47 if let Ok(key) = russh::keys::decode_secret_key(&text, None) {

48 if let Ok(blob) = key.public_key().to_bytes() {

49 return Some(fingerprint_of_blob(&blob));

50 }

51 }

52 }

53 let public = std::fs::read_to_string(format!("{path}.pub")).ok()?;

54 let blob = base64::engine::general_purpose::STANDARD.decode(public.split_whitespace().nth(1)?).ok()?;

55 (!blob.is_empty()).then(|| fingerprint_of_blob(&blob))

56}

58fn ssh_key_public_from_openssh(text: &str) -> CoreResult<Vec<u8>> {

59 let key = russh::keys::ssh_key::PrivateKey::from_openssh(text.trim()).map_err(|e| CoreError::plain(e.to_string()))?;

60 key.public_key().to_bytes().map_err(|e| CoreError::plain(e.to_string()))

61}

63pub fn sha256_hex(blob: &[u8]) -> String {

64 hex::encode(Sha256::digest(blob))

65}

67pub fn exists(path: &str) -> bool {

68 Path::new(path).is_file()

69}

SHA-256

d7db26c953019511f6769c206e6fd5aa7568925bbf78a86673ad06022db81cb5

CH-J Proprietary Software License 1.14 · Die Quellen werden unter der CH-J Proprietary Software License 1.14 bereitgestellt. Ihre Verfügbarkeit ändert die Lizenzbedingungen nicht und gewährt keine zusätzlichen Rechte.

SHA-256 des Archivs

77380d4805485ffa4027fbe7858b5836f197a4aa9d52358a43e2d12d018744df