twitst4tz

fingerprint.js (5530B)

---

 // Copyright 2018 Joyent, Inc.
 
 module.exports = Fingerprint;
 
 var assert = require('assert-plus');
 var Buffer = require('safer-buffer').Buffer;
 var algs = require('./algs');
 var crypto = require('crypto');
 var errs = require('./errors');
 var Key = require('./key');
 var PrivateKey = require('./private-key');
 var Certificate = require('./certificate');
 var utils = require('./utils');
 
 var FingerprintFormatError = errs.FingerprintFormatError;
 var InvalidAlgorithmError = errs.InvalidAlgorithmError;
 
 function Fingerprint(opts) {
 	assert.object(opts, 'options');
 	assert.string(opts.type, 'options.type');
 	assert.buffer(opts.hash, 'options.hash');
 	assert.string(opts.algorithm, 'options.algorithm');
 
 	this.algorithm = opts.algorithm.toLowerCase();
 	if (algs.hashAlgs[this.algorithm] !== true)
 		throw (new InvalidAlgorithmError(this.algorithm));
 
 	this.hash = opts.hash;
 	this.type = opts.type;
 	this.hashType = opts.hashType;
 }
 
 Fingerprint.prototype.toString = function (format) {
 	if (format === undefined) {
 		if (this.algorithm === 'md5' || this.hashType === 'spki')
 			format = 'hex';
 		else
 			format = 'base64';
 	}
 	assert.string(format);
 
 	switch (format) {
 	case 'hex':
 		if (this.hashType === 'spki')
 			return (this.hash.toString('hex'));
 		return (addColons(this.hash.toString('hex')));
 	case 'base64':
 		if (this.hashType === 'spki')
 			return (this.hash.toString('base64'));
 		return (sshBase64Format(this.algorithm,
 		    this.hash.toString('base64')));
 	default:
 		throw (new FingerprintFormatError(undefined, format));
 	}
 };
 
 Fingerprint.prototype.matches = function (other) {
 	assert.object(other, 'key or certificate');
 	if (this.type === 'key' && this.hashType !== 'ssh') {
 		utils.assertCompatible(other, Key, [1, 7], 'key with spki');
 		if (PrivateKey.isPrivateKey(other)) {
 			utils.assertCompatible(other, PrivateKey, [1, 6],
 			    'privatekey with spki support');
 		}
 	} else if (this.type === 'key') {
 		utils.assertCompatible(other, Key, [1, 0], 'key');
 	} else {
 		utils.assertCompatible(other, Certificate, [1, 0],
 		    'certificate');
 	}
 
 	var theirHash = other.hash(this.algorithm, this.hashType);
 	var theirHash2 = crypto.createHash(this.algorithm).
 	    update(theirHash).digest('base64');
 
 	if (this.hash2 === undefined)
 		this.hash2 = crypto.createHash(this.algorithm).
 		    update(this.hash).digest('base64');
 
 	return (this.hash2 === theirHash2);
 };
 
 /*JSSTYLED*/
 var base64RE = /^[A-Za-z0-9+\/=]+$/;
 /*JSSTYLED*/
 var hexRE = /^[a-fA-F0-9]+$/;
 
 Fingerprint.parse = function (fp, options) {
 	assert.string(fp, 'fingerprint');
 
 	var alg, hash, enAlgs;
 	if (Array.isArray(options)) {
 		enAlgs = options;
 		options = {};
 	}
 	assert.optionalObject(options, 'options');
 	if (options === undefined)
 		options = {};
 	if (options.enAlgs !== undefined)
 		enAlgs = options.enAlgs;
 	if (options.algorithms !== undefined)
 		enAlgs = options.algorithms;
 	assert.optionalArrayOfString(enAlgs, 'algorithms');
 
 	var hashType = 'ssh';
 	if (options.hashType !== undefined)
 		hashType = options.hashType;
 	assert.string(hashType, 'options.hashType');
 
 	var parts = fp.split(':');
 	if (parts.length == 2) {
 		alg = parts[0].toLowerCase();
 		if (!base64RE.test(parts[1]))
 			throw (new FingerprintFormatError(fp));
 		try {
 			hash = Buffer.from(parts[1], 'base64');
 		} catch (e) {
 			throw (new FingerprintFormatError(fp));
 		}
 	} else if (parts.length > 2) {
 		alg = 'md5';
 		if (parts[0].toLowerCase() === 'md5')
 			parts = parts.slice(1);
 		parts = parts.map(function (p) {
 			while (p.length < 2)
 				p = '0' + p;
 			if (p.length > 2)
 				throw (new FingerprintFormatError(fp));
 			return (p);
 		});
 		parts = parts.join('');
 		if (!hexRE.test(parts) || parts.length % 2 !== 0)
 			throw (new FingerprintFormatError(fp));
 		try {
 			hash = Buffer.from(parts, 'hex');
 		} catch (e) {
 			throw (new FingerprintFormatError(fp));
 		}
 	} else {
 		if (hexRE.test(fp)) {
 			hash = Buffer.from(fp, 'hex');
 		} else if (base64RE.test(fp)) {
 			hash = Buffer.from(fp, 'base64');
 		} else {
 			throw (new FingerprintFormatError(fp));
 		}
 
 		switch (hash.length) {
 		case 32:
 			alg = 'sha256';
 			break;
 		case 16:
 			alg = 'md5';
 			break;
 		case 20:
 			alg = 'sha1';
 			break;
 		case 64:
 			alg = 'sha512';
 			break;
 		default:
 			throw (new FingerprintFormatError(fp));
 		}
 
 		/* Plain hex/base64: guess it's probably SPKI unless told. */
 		if (options.hashType === undefined)
 			hashType = 'spki';
 	}
 
 	if (alg === undefined)
 		throw (new FingerprintFormatError(fp));
 
 	if (algs.hashAlgs[alg] === undefined)
 		throw (new InvalidAlgorithmError(alg));
 
 	if (enAlgs !== undefined) {
 		enAlgs = enAlgs.map(function (a) { return a.toLowerCase(); });
 		if (enAlgs.indexOf(alg) === -1)
 			throw (new InvalidAlgorithmError(alg));
 	}
 
 	return (new Fingerprint({
 		algorithm: alg,
 		hash: hash,
 		type: options.type || 'key',
 		hashType: hashType
 	}));
 };
 
 function addColons(s) {
 	/*JSSTYLED*/
 	return (s.replace(/(.{2})(?=.)/g, '$1:'));
 }
 
 function base64Strip(s) {
 	/*JSSTYLED*/
 	return (s.replace(/=*$/, ''));
 }
 
 function sshBase64Format(alg, h) {
 	return (alg.toUpperCase() + ':' + base64Strip(h));
 }
 
 Fingerprint.isFingerprint = function (obj, ver) {
 	return (utils.isCompatible(obj, Fingerprint, ver));
 };
 
 /*
  * API versions for Fingerprint:
  * [1,0] -- initial ver
  * [1,1] -- first tagged ver
  * [1,2] -- hashType and spki support
  */
 Fingerprint.prototype._sshpkApiVersion = [1, 2];
 
 Fingerprint._oldVersionDetect = function (obj) {
 	assert.func(obj.toString);
 	assert.func(obj.matches);
 	return ([1, 0]);
 };