Implement decoding certificates in PublicCredential

Signed-off-by: Wiktor Kwapisiewicz <wiktor@metacode.biz>
See: #98
Co-authored-by: Sasha F <cornflake.matchbox397@icantbelieveitsnotgmail.com>

Author: wiktor-k

src/proto/message/credential.rs

@@ -140,8 +140,27 @@ impl Decode for PublicCredential {
     type Error = Error;
 
     fn decode(reader: &mut impl Reader) -> core::result::Result<Self, Self::Error> {
-        // TODO: implement parsing certificates
-        Ok(Self::Key(KeyData::decode(reader)?))
+        // full blob can be passed to Certificate::decode or
+        // KeyData::decode, both of which expect to read the algorithm
+        // string themselves.
+        let alg = String::decode(reader)?;
+
+        let remaining_len = reader.remaining_len();
+        let mut buf = Vec::with_capacity(4 + alg.len() + remaining_len);
+        alg.encode(&mut buf)?;
+        let mut tail = vec![0u8; remaining_len];
+        reader.read(&mut tail)?;
+        buf.extend_from_slice(&tail);
+
+        let mut slice: &[u8] = &buf;
+
+        if Algorithm::new_certificate(&alg).is_ok() {
+            let cert = Certificate::decode(&mut slice)?;
+            Ok(Self::Cert(Box::new(cert)))
+        } else {
+            let key = KeyData::decode(&mut slice)?;
+            Ok(Self::Key(key))
+        }
     }
 }
 

src/proto/message/request.rs

@@ -148,3 +148,71 @@ impl Encode for Request {
         Ok(())
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use ssh_key::Algorithm;
+    use testresult::TestResult;
+
+    use super::*;
+    use crate::proto::{PublicCredential, Response};
+
+    #[test]
+    fn sign_with_cert() -> TestResult {
+        let req =
+            Request::decode(&mut &std::fs::read("tests/messages/req-sign-with-cert.bin")?[..])?;
+        let Request::SignRequest(req) = req else {
+            panic!("expected SignRequest");
+        };
+        let PublicCredential::Cert(cert) = req.pubkey else {
+            panic!("expected certificate");
+        };
+        assert_eq!(cert.algorithm(), Algorithm::Rsa { hash: None });
+        Ok(())
+    }
+
+    #[test]
+    fn sign_with_pubkey() -> TestResult {
+        let req = Request::decode(&mut &std::fs::read("tests/messages/req-sign-request.bin")?[..])?;
+        let Request::SignRequest(req) = req else {
+            panic!("expected SignRequest");
+        };
+        let PublicCredential::Key(cert) = req.pubkey else {
+            panic!("expected key");
+        };
+        assert_eq!(cert.algorithm(), Algorithm::Rsa { hash: None });
+        Ok(())
+    }
+
+    #[test]
+    fn resp_identities_with_cert() -> TestResult {
+        let resp = Response::decode(
+            &mut &std::fs::read("tests/messages/resp-identities-with-cert.bin")?[..],
+        )?;
+        let Response::IdentitiesAnswer(resp) = resp else {
+            panic!("expected IdentitiesAnswer");
+        };
+        assert_eq!(resp.len(), 4);
+        let PublicCredential::Cert(cert) = &resp[3].pubkey else {
+            panic!("expected certificate");
+        };
+        assert_eq!(cert.algorithm(), Algorithm::Rsa { hash: None });
+        Ok(())
+    }
+
+    #[test]
+    fn resp_identities_with_key() -> TestResult {
+        let resp = Response::decode(
+            &mut &std::fs::read("tests/messages/resp-identities-answer.bin")?[..],
+        )?;
+        let Response::IdentitiesAnswer(resp) = resp else {
+            panic!("expected IdentitiesAnswer");
+        };
+        assert_eq!(resp.len(), 1);
+        let PublicCredential::Key(key) = &resp[0].pubkey else {
+            panic!("expected key");
+        };
+        assert_eq!(key.algorithm(), Algorithm::Rsa { hash: None });
+        Ok(())
+    }
+}