Crate biscuit_ssh_core 

Authorization core of biscuit-ssh, shared by the certificate issuer, the bastion and the client.

A Biscuit token grants right(server, user) facts and may carry checks restricting how they are used. The Verifier describes each access attempt with facts (time, source address, target, command, SSH key) and lets the token’s checks and the verifier policies decide. The fact names form a public contract documented in vocabulary.

Re-exports

pub use vocabulary::Restriction;

pub use vocabulary::Right;

Modules

bastion_login

How the bastion asks for the token over keyboard-interactive, shared by the bastion and the client.

vocabulary

The Datalog vocabulary: the public contract between the token issuer, token holders and verifiers. Renaming a fact or changing its arity breaks every token in circulation.

Structs

AccessRequest

Everything the verifier knows about an access attempt.

Authorization

A successful authorization: the request it was granted for, and for how long.

BlockInfo

One block of a token, as shown to humans.

Command

A command to force on the SSH session: printable, single line, at most 1024 bytes.

Name

A server or account name: 1 to 64 characters among [A-Za-z0-9._-], not starting with - (so it can never be read as a command-line option).

Network

An IP network with its host bits cleared, displayed as addr/prefix (e.g. 10.0.0.0/8, 2001:db8::/32).

RevocationList

Revoked block identifiers, as lowercase hex strings.

Verifier

Decides whether a token allows an access request, and for how long.

Enums

Error

Why a request or a token was rejected.

KeyPair

pair of cryptographic keys used to sign a token’s block

Mode

How the access will be enforced, exposed to tokens as mode(...).

PrivateKey

the private part of a KeyPair

PublicKey

the public part of a KeyPair

Constants

DEFAULT_POLICY

Grants a request when the token holds the matching right in its authority block. Facts added by attenuation blocks are not visible to verifier policies, so a holder cannot grant themselves new rights.

MAX_LIFETIME

Longest lifetime Verifier::authorize accepts, as it evaluates the token once per second of it.

MAX_TOKEN_LEN

Longest accepted token, in base64 characters. Real tokens are a few hundred bytes per block; the limit bounds parsing work on hostile input.

Functions

attenuate

Appends a block adding restrictions to token.

failed_checks

The token’s own checks refusing request, as a hint to explain a refusal to the token holder.

granted_rights

The rights granted by the authority block of token, sorted, once its signature is checked against root_key. Restrictions are not evaluated.

inspect

Decodes token without verifying its signature, to show its content.

mint

Creates a token signed by the root key, granting rights under restrictions.