HAXY

▄▀▀▄ ▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀ ▄▄▀▀▀▀▀▀ ▄▄▄ ▄▀▀▀▀▀▀▀▀▀▀▀▀▀▄ ▄▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▄ ▄▀▀▀▀▀▀▀▀▀▀▀▀▀▀▄▀▀▀▄ ▄▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▄▄ ▄▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▄▄ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▄ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀ ▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀ ▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀ ▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀ ▄▀▀ ▄▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀ ▀▀▀ ▀▀▀▀▀▀▄ ▀▀▀▀▀▀▀▀ ▀▀▀ ▀▀▀▀▀▀▀ ▀▀▀▀▀▀ ▀▀▀ ▀▀▀▀▀▀ ▀▀▀▀▀▀ ▀▀▀ ▀▀▀▀▀▀▀ ▀▀▀▀▀▀▄ ▀▀▀ ▀▀▀▀▀▀ ▀▀▀▀▀▀▀ ▀▀▀ ▀▀▀▀▀ ▀▀▀▀▀ ▀▀▀ ▀▀▀▀ ▀▀▀▀ ▄▀▀ ▄▀▀▀▀ ▀▀▀▀ ▀▀▀ ▀▀▀▀▀ ▀▀▀▀▄ ▀▀▀ ▄▀▀▀▀ ▀▀▀▀▀ ▀▀▀ ▀▀▀▀▀▀ ▀▀▀▀▀ ▀▀▀ ▀▀▀▀▀▀▀ ▀▀▀▀▀ ▀▀ ▄▀▀▀▀▀▀▀ ▀▀▀▀▄ ▀▀▀▀▀▀▀ ▀▀▀▀▀

╭─────────────╮ │scroll to top│ ╰─────────────╯ ╭ serve_ssh.zig ────────────────────────────────────────────────╮ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ ╰───────────────────────────────────────────────────────────────╯

╭────╮ ╭ clone ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ╮ │http│ ssh │ │ ╰────╯ ╰ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ╯

.. embed/ event/ test/ ui/ command.zig diff3.zig event.zig fork.zig lib.zig main.zig main_wasm.zig patch.zig serve.zig serve_common.zig serve_http.zig ╭─────────────────────────────────╮ │serve_ssh.zig │ ╰─────────────────────────────────╯ serve_ssh_protocol.zig test.zig testnet.zig try.zig ui.zig web.zig

540 return .denied; 541 } 542 543 fn keyBelongsToUser( 544 moment: evt.AdminDB.HashMap(.read_only), 545 arena: *std.heap.ArenaAllocator, 546 user_id: []const u8, 547 fingerprint: *const [ssh.fingerprint_len]u8, 548 ) !bool { 549 const user = (try evt.User.readById(evt.AdminDB, evt.admin_repo_opts.hash, moment, arena, user_id)) orelse return false; 550 return !user.removed and isKeyInAuthorizedKeys(user.event.ssh_keys, fingerprint); 551 } 552 553 fn isKeyInAuthorizedKeys(ssh_keys: []const u8, fingerprint: *const [ssh.fingerprint_len]u8) bool { 554 var it = std.mem.splitScalar(u8, ssh_keys, '\n'); 555 while (it.next()) |line| { 556 const fp = fingerprintOfAuthorizedKey(line) orelse continue; 557 if (std.mem.eql(u8, &fp, fingerprint)) return true; 558 } 559 return false; 560 } 561 562 // the SHA256 fingerprint of one authorized_keys line, or null if the line is 563 // blank or not a parseable "<type> <base64> [comment]" entry 564 fn fingerprintOfAuthorizedKey(line: []const u8) ?[ssh.fingerprint_len]u8 { 565 var it = std.mem.tokenizeAny(u8, line, " \t\r"); 566 _ = it.next() orelse return null; // key type 567 const blob_b64 = it.next() orelse return null; 568 569 const decoder = std.base64.standard.Decoder; 570 const blob_len = decoder.calcSizeForSlice(blob_b64) catch return null; 571 var blob_buf: [4096]u8 = undefined; 572 if (blob_len > blob_buf.len) return null; 573 decoder.decode(blob_buf[0..blob_len], blob_b64) catch return null; 574 575 return ssh.formatFingerprint(blob_buf[0..blob_len]); 576 } 577 578 fn writeError(sess: *ssh.SessionCtx, comptime msg: []const u8) !void { 579 const body = "ERR haxy ssh: " ++ msg; 580 var packet: [body.len + 4]u8 = undefined; 581 const line = try std.fmt.bufPrint(&packet, "{x:0>4}{s}", .{ packet.len, body }); 582 try sess.writeBytes(line); 583 try sess.exit(1); 584 } 585 586 test "parseGitCommand rejects malformed input" { 587 const allocator = std.testing.allocator; 588 try std.testing.expectError(error.InvalidCommand, parseGitCommand(allocator, "git-upload-pack")); 589 try std.testing.expectError(error.UnsupportedService, parseGitCommand(allocator, "ls -la")); 590 try std.testing.expectError(error.UnsupportedService, parseGitCommand(allocator, "git-fake-pack 'repo'")); 591 } 592 593 test "parseGitCommand happy paths" { 594 const allocator = std.testing.allocator; 595 596 { 597 const parsed = try parseGitCommand(allocator, "git-upload-pack 'some-repo'"); 598 defer parsed.deinit(allocator); 599 try std.testing.expectEqual(GitService.upload_pack, parsed.service); 600 try std.testing.expectEqualStrings("some-repo", parsed.dir); 601 } 602 { 603 const parsed = try parseGitCommand(allocator, "git-receive-pack 'user/proj'"); 604 defer parsed.deinit(allocator); 605 try std.testing.expectEqual(GitService.receive_pack, parsed.service); 606 try std.testing.expectEqualStrings("user/proj", parsed.dir); 607 } 608 { 609 const parsed = try parseGitCommand(allocator, "git-upload-pack repo"); 610 defer parsed.deinit(allocator); 611 try std.testing.expectEqual(GitService.upload_pack, parsed.service); 612 try std.testing.expectEqualStrings("repo", parsed.dir); 613 } 614 } 615