automatically expire certs from the agent

TES/tes/tunnelstat/__init__.py

@@ -53,9 +53,15 @@ class SSHSession:
         certf = open(keyname+'-cert.pub',mode='w')
         certf.write(cert)
         certf.close()
+        p = subprocess.Popen([self.sshkeygen,'-L','-f','-'],stdin=subprocess.PIPE,stdout=subprocess.PIPE,stderr=subprocess.PIPE)
+        keygenout,keygenerr = p.communicate(l)
+        # Examine the cert to determine its expiry. Use the -t flag to automatically remove from the ssh-agent when the cert expires
+        certcontents = SSHSession.parse_cert_contents(keygenout.decode().splitlines())
+        endtime = datetime.datetime.strptime(certcontents['Valid'][0].split()[3],"%Y-%m-%dT%H:%M:%S")
+        delta = endtime - datetime.datetime.now() # I *think* the output of ssh-keygen -L is in the current timezone even though I assume the certs validity is in UTC
         env = os.environ.copy()
         env['SSH_AUTH_SOCK'] = self.socket
-        cmd = [self.sshadd]
+        cmd = [self.sshadd,'-t',delta.totalseconds]
         cmd.append(keyname)
         p = subprocess.Popen(cmd,stdout=subprocess.PIPE,stderr=subprocess.PIPE,env=env)
         (stdout,stderr) = p.communicate()
@@ -86,8 +92,6 @@ class SSHSession:
                 keygenout,keygenerr = p.communicate(l)
                 certcontents = SSHSession.parse_cert_contents(keygenout.decode().splitlines())
                 res.append(certcontents)
-            else: 
-                res.append({'pubkey':l.decode()})
         return res
 
     @staticmethod