// CheckHostKey checks a host key certificate. This method can be
// plugged into ClientConfig.HostKeyCallback.
14123
func (c *CertChecker) CheckHostKey(addr string, remote net.Addr, key PublicKey) error {
	cert, ok := key.(*Certificate)
	if !ok {
		if c.HostKeyFallback != nil {
			return c.HostKeyFallback(addr, remote, key)
		}
		return errors.New("ssh: non-certificate host key")
	}
	if cert.CertType != HostCert {
		return fmt.Errorf("ssh: certificate presented as a host key has type %d", cert.CertType)
	}

	return c.CheckCert(addr, cert)
}
158297
func (_m *ClientInterface) GetHost(hostID string) (*host.Host, error) {
	ret := _m.Called(hostID)

	var r0 *host.Host
	if rf, ok := ret.Get(0).(func(string) *host.Host); ok {
		r0 = rf(hostID)
	} else {
		if ret.Get(0) != nil {
			r0 = ret.Get(0).(*host.Host)
		}
	}

	var r1 error
	if rf, ok := ret.Get(1).(func(string) error); ok {
		r1 = rf(hostID)
	} else {
		r1 = ret.Error(1)
	}

	return r0, r1
}
126838
func (a *LocalKeyAgent) GetKey() (*Key, error) {
	return a.keyStore.GetKey(a.proxyHost, a.username)
}
440536
func (a *LocalKeyAgent) CheckHostSignature(addr string, remote net.Addr, key ssh.PublicKey) error {
	certChecker := utils.CertChecker{
		CertChecker: ssh.CertChecker{
			IsHostAuthority: a.checkHostCertificate,
			HostKeyFallback: a.checkHostKey,
		},
	}
	err := certChecker.CheckHostKey(addr, remote, key)
	if err != nil {
		a.log.Debugf("Host validation failed: %v.", err)
		return trace.Wrap(err)
	}
	a.log.Debugf("Validated host %v.", addr)
	return nil
}
329250
func (s *keyCheckV1) Check(key string) (res *http.Response, err error) {
	req, err := http.NewRequest("GET", s.target, nil)
	req.Header.Add(HeaderKeyName, key)
	res, err = s.client.Do(req)
	return
}
45246
func (kc *HostKeyChecker) GetHostKeyAlgorithms(addr string) []string {
	var results []string
	remoteAddr, err := kc.addrToHostPort(addr)
	if err != nil {
		log.Errorf("Failed to parse address %v: %v", addr, err)
		return nil
	}

	hostKeys, err := kc.m.GetHostKeys()

	_, ok := err.(*os.PathError)
	if err != nil && !ok {
		log.Errorf("Failed to read known_hosts file %v: %v", kc.m.String(), err)
		return nil
	}

	for pattern, keys := range hostKeys {
		if !matchHost(remoteAddr, pattern) {
			remoteIP, err := net.ResolveTCPAddr("tcp", addr)
			if err != nil {
				log.Errorf("Failed to resolve TCP address %v: %v", addr, err)
				continue
			}
			ipAddr, err := kc.addrToHostPort(remoteIP.String())
			if err != nil {
				log.Errorf("Failed to parse address %v: %v", remoteIP.String(), err)
				continue
			}
			if !matchHost(ipAddr, pattern) {
				continue
			}
		}
		for _, hostKey := range keys {
			results = append(results, hostKey.Type())
		}
	}

	return results
}
1251041
func (s *ServerConfig) AddHostKey(key Signer) {
	for i, k := range s.hostKeys {
		if k.PublicKey().Type() == key.PublicKey().Type() {
			s.hostKeys[i] = key
			return
		}
	}

	s.hostKeys = append(s.hostKeys, key)
}
911899
func CheckIfHostExistsAndLoad(api libmachine.API, machineName string) (*host.Host, error) {
	exists, err := api.Exists(machineName)
	if err != nil {
		return nil, errors.Wrapf(err, "Error checking that machine exists: %s", machineName)
	}
	if !exists {
		return nil, errors.Errorf("Machine does not exist for api.Exists(%s)", machineName)
	}

	host, err := api.Load(machineName)
	if err != nil {
		return nil, errors.Wrapf(err, "Error loading store for: %s", machineName)
	}
	return host, nil
}
229238
func checkCache(method string, url string, bctx BuiltinContext) ast.Value {
	key := getCtxKey(method, url)

	val, ok := bctx.Cache.Get(key)
	if ok {
		return val.(ast.Value)
	}
	return nil
}
92735
func NewHostCertificateCache(keygen sshca.Authority, authClient auth.ClientI) (*certificateCache, error) {
	cache, err := ttlmap.New(defaults.HostCertCacheSize)
	if err != nil {
		return nil, trace.Wrap(err)
	}

	return &certificateCache{
		keygen:     keygen,
		cache:      cache,
		authClient: authClient,
	}, nil
}
959912
func (_class HostClass) SendDebugKeys(sessionID SessionRef, host HostRef, keys string) (_err error) {
	_method := "host.send_debug_keys"
	_sessionIDArg, _err := convertSessionRefToXen(fmt.Sprintf("%s(%s)", _method, "session_id"), sessionID)
	if _err != nil {
		return
	}
	_hostArg, _err := convertHostRefToXen(fmt.Sprintf("%s(%s)", _method, "host"), host)
	if _err != nil {
		return
	}
	_keysArg, _err := convertStringToXen(fmt.Sprintf("%s(%s)", _method, "keys"), keys)
	if _err != nil {
		return
	}
	_, _err =  _class.client.APICall(_method, _sessionIDArg, _hostArg, _keysArg)
	return
}
233469
func (d *ResourceDiff) checkKey(key, caller string, nested bool) error {
	var schema *Schema
	if nested {
		keyParts := strings.Split(key, ".")
		schemaL := addrToSchema(keyParts, d.schema)
		if len(schemaL) > 0 {
			schema = schemaL[len(schemaL)-1]
		}
	} else {
		s, ok := d.schema[key]
		if ok {
			schema = s
		}
	}
	if schema == nil {
		return fmt.Errorf("%s: invalid key: %s", caller, key)
	}
	if !schema.Computed {
		return fmt.Errorf("%s only operates on computed keys - %s is not one", caller, key)
	}
	return nil
}
639280
func (_class HostCPUClass) GetHost(sessionID SessionRef, self HostCPURef) (_retval HostRef, _err error) {
	_method := "host_cpu.get_host"
	_sessionIDArg, _err := convertSessionRefToXen(fmt.Sprintf("%s(%s)", _method, "session_id"), sessionID)
	if _err != nil {
		return
	}
	_selfArg, _err := convertHostCPURefToXen(fmt.Sprintf("%s(%s)", _method, "self"), self)
	if _err != nil {
		return
	}
	_result, _err := _class.client.APICall(_method, _sessionIDArg, _selfArg)
	if _err != nil {
		return
	}
	_retval, _err = convertHostRefToGo(_method + " -> ", _result.Value)
	return
}
1113926
func getClientCertForHost(c *Client, host string) *tls.Certificate {
	hostSslKey, _ := c.uc.Get("http", fmt.Sprintf("https://%v/", host), "sslKey")
	hostSslCert, _ := c.uc.Get("http", fmt.Sprintf("https://%v/", host), "sslCert")

	cert, err := ioutil.ReadFile(hostSslCert)
	if err != nil {
		tracerx.Printf("Error reading client cert file %q: %v", hostSslCert, err)
		return nil
	}
	key, err := ioutil.ReadFile(hostSslKey)
	if err != nil {
		tracerx.Printf("Error reading client key file %q: %v", hostSslKey, err)
		return nil
	}

	block, _ := pem.Decode(key)
	if x509.IsEncryptedPEMBlock(block) {
		key, err = decryptPEMBlock(c, block, hostSslKey, key)
		if err != nil {
			tracerx.Printf("Unable to decrypt client key file %q: %v", hostSslKey, err)
			return nil
		}
	}

	certobj, err := tls.X509KeyPair(cert, key)
	if err != nil {
		tracerx.Printf("Error reading client cert/key %v", err)
		return nil
	}
	return &certobj
}
475971
func (s *UpdateServerInput) SetHostKey(v string) *UpdateServerInput {
	s.HostKey = &v
	return s
}
1098425
func (sp *StandardProvider) Check() error {
	if sp.Paths.KeyFile == "" && sp.Paths.CertFile == "" {
		return nil
	}

	if sp.Paths.KeyFile == "" {
		return ErrMissingKeyPath
	}

	if sp.Paths.CertFile == "" {
		return ErrMissingCertPath
	}

	return nil
}
1141123
func (c *Client) AuthenticateHost(hostID string) (string, int64, error) {
	req := HostAuthenticationRequest{
		HostID:    hostID,
		Timestamp: time.Now().UTC().Unix(),
	}
	sig, err := auth.SignAsDelegate(req.toMessage())
	if err != nil {
		return "", 0, err
	}
	req.Signature = sig
	var response HostAuthenticationResponse
	if err := c.call("AuthenticateHost", req, &response); err != nil {
		return "", 0, err
	}
	return response.Token, response.Expires, nil
}