A list subcommand for the CLI

You can now run `ssh-cert-authority list`

It presents, somewhat half-assedly, a list of pending, un-expired
certificates. The --show-all flag will also show fully signed or expired
certs. Kinda fancy.

Author: bobveznat

list_requests.go

@@ -0,0 +1,110 @@
+package main
+
+import (
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"github.com/cloudtools/ssh-cert-authority/util"
+	"github.com/codegangsta/cli"
+	"golang.org/x/crypto/ssh"
+	"io/ioutil"
+	"net/http"
+	"os"
+	"time"
+)
+
+func listCertFlags() []cli.Flag {
+	home := os.Getenv("HOME")
+	if home == "" {
+		home = "/"
+	}
+	configPath := home + "/.ssh_ca/signer_config.json"
+
+	return []cli.Flag{
+		cli.StringFlag{
+			Name:  "environment",
+			Value: "",
+			Usage: "An environment name (e.g. prod)",
+		},
+		cli.StringFlag{
+			Name:  "config-file",
+			Value: configPath,
+			Usage: "Path to config.json",
+		},
+		cli.BoolFlag{
+			Name:  "show-all",
+			Usage: "Show certs that have already been signed as well",
+		},
+	}
+}
+
+func listCerts(c *cli.Context) {
+
+	configPath := c.String("config-file")
+	environment := c.String("environment")
+	showAll := c.Bool("show-all")
+
+	allConfig := make(map[string]ssh_ca_util.RequesterConfig)
+	err := ssh_ca_util.LoadConfig(configPath, &allConfig)
+	wrongTypeConfig, err := ssh_ca_util.GetConfigForEnv(environment, &allConfig)
+	if err != nil {
+		fmt.Println(err)
+		os.Exit(1)
+	}
+	config := wrongTypeConfig.(ssh_ca_util.RequesterConfig)
+
+	getResp, err := http.Get(config.SignerUrl + "cert/requests")
+	if err != nil {
+		fmt.Println("Didn't get a valid response", err)
+		os.Exit(1)
+	}
+	getRespBuf, err := ioutil.ReadAll(getResp.Body)
+	if err != nil {
+		fmt.Println("Error reading response body", err)
+		os.Exit(1)
+	}
+	getResp.Body.Close()
+	if getResp.StatusCode != 200 {
+		fmt.Println("Error getting listing of certs", string(getRespBuf))
+		os.Exit(1)
+	}
+
+	certs := make(certRequestResponse)
+	json.Unmarshal(getRespBuf, &certs)
+	for requestID, respElement := range certs {
+		if showAll || !respElement.Signed {
+			rawCert, err := base64.StdEncoding.DecodeString(respElement.CertBlob)
+			if err != nil {
+				fmt.Println("Trouble base64 decoding response:", err, respElement.CertBlob)
+				os.Exit(1)
+			}
+			pubKey, err := ssh.ParsePublicKey(rawCert)
+			if err != nil {
+				fmt.Println("Trouble parsing response:", err)
+				os.Exit(1)
+			}
+			cert := *pubKey.(*ssh.Certificate)
+			env, ok := cert.Extensions["environment@cloudtools.github.io"]
+			if !ok {
+				env = "unknown env"
+			}
+			expired := int64(cert.ValidBefore)-int64(time.Now().Unix()) < 1
+			if !expired || showAll {
+				expiredMsg := ""
+				if expired {
+					expiredMsg = ", \033[91mexpired\033[0m"
+				}
+				fmt.Printf("%d %s[%s, %d/%d%s]: %s - %s\n",
+					respElement.Serial,
+					requestID,
+					env,
+					respElement.NumSignatures,
+					respElement.SignaturesRequired,
+					expiredMsg,
+					cert.KeyId,
+					cert.Extensions["reason@cloudtools.github.io"],
+				)
+			}
+		}
+	}
+}

main.go

@@ -34,6 +34,13 @@ func main() {
 			Usage:   "Get a certificate",
 			Action:  getCert,
 		},
+		{
+			Name:    "list",
+			Aliases: []string{"l"},
+			Flags:   listCertFlags(),
+			Usage:   "List pending requests on the server",
+			Action:  listCerts,
+		},
 		{
 			Name:   "runserver",
 			Flags:  signdFlags(),

sign_certd.go

@@ -268,15 +268,21 @@ func (h *certRequestHandler) validateCert(cert *ssh.Certificate, authorizedSigne
 }
 
 type listResponseElement struct {
-	Signed   bool
-	CertBlob string
+	Signed             bool
+	CertBlob           string
+	NumSignatures      int
+	SignaturesRequired int
+	Serial             uint64
 }
 type certRequestResponse map[string]listResponseElement
 
-func newResponseElement(certBlob string, signed bool) listResponseElement {
+func newResponseElement(certBlob string, signed bool, numSignatures, signaturesRequired int, serial uint64) listResponseElement {
 	var element listResponseElement
 	element.CertBlob = certBlob
 	element.Signed = signed
+	element.NumSignatures = numSignatures
+	element.SignaturesRequired = signaturesRequired
+	element.Serial = serial
 	return element
 }
 
@@ -303,10 +309,10 @@ func (h *certRequestHandler) listPendingRequests(rw http.ResponseWriter, req *ht
 		req.RemoteAddr, certRequestID)
 
 	foundSomething := false
-	results := make(map[string]listResponseElement)
+	results := make(certRequestResponse)
 	for k, v := range h.state {
 		encodedCert := base64.StdEncoding.EncodeToString(v.request.Marshal())
-		element := newResponseElement(encodedCert, v.certSigned)
+		element := newResponseElement(encodedCert, v.certSigned, len(v.signatures), h.Config[v.environment].NumberSignersRequired, v.request.Serial)
 		// Two ways to use this URL. If caller specified a certRequestId
 		// then we return only that one. Otherwise everything.
 		if certRequestID == "" {