sshpk - npm Package Compare versions

Comparing version 1.5.0 to 1.5.1

lib/algs.js

@@ -21,2 +21,3 @@ // Copyright 2015 Joyent, Inc.
 };
+algInfo['curve25519'] = algInfo['ed25519'];
 
@@ -37,2 +38,3 @@ var algPrivInfo = {
 };
+algPrivInfo['curve25519'] = algPrivInfo['ed25519'];
 
@@ -39,0 +41,0 @@ var hashAlgs = {

lib/ed-compat.js

@@ -27,3 +27,3 @@ // Copyright 2015 Joyent, Inc.
 }
-util.inherits(stream.Writable, Verifier);
+util.inherits(Verifier, stream.Writable);
 
@@ -67,3 +67,3 @@ Verifier.prototype._write = function (chunk, enc, cb) {
 }
-util.inherits(stream.Writable, Signer);
+util.inherits(Signer, stream.Writable);
 
@@ -70,0 +70,0 @@ Signer.prototype._write = function (chunk, enc, cb) {

lib/formats/rfc4253.js

@@ -31,2 +31,4 @@ // Copyright 2015 Joyent, Inc.
 		return ('ed25519');
+	else if (alg === 'ssh-curve25519')
+		return ('curve25519');
 	else if (alg.match(/^ecdsa-sha2-/))
@@ -46,2 +48,4 @@ return ('ecdsa');
 		return ('ssh-ed25519');
+	else if (key.type === 'curve25519')
+		return ('ssh-curve25519');
 	else if (key.type === 'ecdsa')
@@ -112,2 +116,7 @@ return ('ecdsa-sha2-' + key.part.curve.data.toString());
 
+	if (partial && typeof (partial) === 'object') {
+		partial.remainder = sshbuf.remainder();
+		partial.consumed = sshbuf._offset;
+	}
+
 	return (new Constructor(key));
@@ -114,0 +123,0 @@ }

lib/formats/ssh-private.js

@@ -68,6 +68,6 @@ // Copyright 2015 Joyent, Inc.
 
-	var key = rfc4253.readPartial('private', buf.remainder());
+	var ret = {};
+	var key = rfc4253.readInternal(ret, 'private', buf.remainder());
 
-	var len = key.toBuffer('rfc4253').length;
-	buf.skip(len);
+	buf.skip(ret.consumed);
 
@@ -74,0 +74,0 @@ var comment = buf.readString();

lib/formats/ssh.js

@@ -19,3 +19,3 @@ // Copyright 2015 Joyent, Inc.
 /*JSSTYLED*/
-var SSHKEY_RE2 = /^([a-z0-9-]+)[ \t]+([a-zA-Z0-9+\/ \t\n]+[=]*)/;
+var SSHKEY_RE2 = /^([a-z0-9-]+)[ \t]+([a-zA-Z0-9+\/ \t\n]+[=]*)(.*)$/;
 
@@ -46,2 +46,3 @@ function read(buf) {
 	var key;
+	var ret = {};
 	if (m[4]) {
@@ -55,6 +56,6 @@ try {
 			kbuf = new Buffer(m[2], 'base64');
-			key = rfc4253.readPartial('public', kbuf);
+			key = rfc4253.readInternal(ret, 'public', kbuf);
 		}
 	} else {
-		key = rfc4253.readPartial('public', kbuf);
+		key = rfc4253.readInternal(ret, 'public', kbuf);
 	}
@@ -64,5 +65,35 @@
 
-	if (m[4] && m[4].length > 0)
+	if (m[4] && m[4].length > 0) {
 		key.comment = m[4];
 
+	} else if (ret.consumed) {
+		/*
+		 * Now the magic: trying to recover the key comment when it's
+		 * gotten conjoined to the key or otherwise shenanigan'd.
+		 *
+		 * Work out how much base64 we used, then drop all non-base64
+		 * chars from the beginning up to this point in the the string.
+		 * Then offset in this and try to make up for missing = chars.
+		 */
+		var data = m[2] + m[3];
+		var realOffset = Math.ceil(ret.consumed / 3) * 4;
+		data = data.slice(0, realOffset - 2). /*JSSTYLED*/
+		    replace(/[^a-zA-Z0-9+\/=]/g, '') +
+		    data.slice(realOffset - 2);
+
+		var padding = ret.consumed % 3;
+		if (padding > 0 &&
+		    data.slice(realOffset - 1, realOffset) !== '=')
+			realOffset--;
+		while (data.slice(realOffset, realOffset + 1) === '=')
+			realOffset++;
+
+		/* Finally, grab what we think is the comment & clean it up. */
+		var trailer = data.slice(realOffset);
+		trailer = trailer.replace(/[\r\n]/g, ' ').
+		    replace(/^\s+/, '');
+		if (trailer.match(/^[a-zA-Z0-9]/))
+			key.comment = trailer;
+	}
+
 	return (key);
@@ -69,0 +100,0 @@ }

lib/key.js

@@ -147,2 +147,5 @@ // Copyright 2015 Joyent, Inc.
 		return (new edCompat.Verifier(this, hashAlgo));
+	if (this.type === 'curve25519')
+		throw (new Error('Curve25519 keys are not suitable for ' +
+		    'signing or verification'));
 
@@ -149,0 +152,0 @@ var v, nm, err;

lib/private-key.js

@@ -12,3 +12,5 @@ // Copyright 2015 Joyent, Inc.
 var util = require('util');
+var utils = require('./utils');
 var edCompat = require('./ed-compat');
+var ed;
 
@@ -74,2 +76,52 @@ var Key = require('./key');
 
+PrivateKey.prototype.derive = function (newType, newSize) {
+	assert.string(newType, 'type');
+	assert.optionalNumber(newSize, 'size');
+	var priv, pub;
+
+	if (this.type === 'ed25519' && newType === 'curve25519') {
+		if (ed === undefined)
+			ed = require('jodid25519');
+
+		priv = this.part.r.data;
+		if (priv[0] === 0x00)
+			priv = priv.slice(1);
+		priv = priv.slice(0, 32);
+
+		pub = ed.dh.publicKey(priv);
+		priv = utils.mpNormalize(Buffer.concat([priv, pub]));
+
+		return (new PrivateKey({
+			type: 'curve25519',
+			parts: [
+				{ name: 'R', data: utils.mpNormalize(pub) },
+				{ name: 'r', data: priv }
+			]
+		}));
+	} else if (this.type === 'curve25519' && newType === 'ed25519') {
+		if (ed === undefined)
+			ed = require('jodid25519');
+
+		priv = this.part.r.data;
+		if (priv[0] === 0x00)
+			priv = priv.slice(1);
+		priv = priv.slice(0, 32);
+
+		pub = ed.eddsa.publicKey(priv.toString('binary'));
+		pub = new Buffer(pub, 'binary');
+
+		priv = utils.mpNormalize(Buffer.concat([priv, pub]));
+
+		return (new PrivateKey({
+			type: 'ed25519',
+			parts: [
+				{ name: 'R', data: utils.mpNormalize(pub) },
+				{ name: 'r', data: priv }
+			]
+		}));
+	}
+	throw (new Error('Key derivation not supported from ' + this.type +
+	    ' to ' + newType));
+};
+
 PrivateKey.prototype.createVerify = function (hashAlgo) {
@@ -87,2 +139,5 @@ return (this.toPublic().createVerify(hashAlgo));
 		return (new edCompat.Signer(this, hashAlgo));
+	if (this.type === 'curve25519')
+		throw (new Error('Curve25519 keys are not suitable for ' +
+		    'signing or verification'));
 
@@ -133,3 +188,3 @@ var v, nm, err;
 		var k = formats[format].read(data);
-		assert.ok(k instanceof PrivateKey);
+		assert.ok(k instanceof PrivateKey, 'key is not a private key');
 		if (!k.comment)
@@ -136,0 +191,0 @@ k.comment = name;

package.json

 {
   "name": "sshpk",
-  "version": "1.5.0",
+  "version": "1.5.1",
   "description": "A library for finding and using SSH public keys",
@@ -5,0 +5,0 @@ "main": "lib/index.js",

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

86499

increased by3.95%

Lines of code

2350

increased by3.84%

No dependency changes