HAXY

▀ ▄▄▄ ▀ ▀▀ ▄▀ ▀▀▀▀▀▄ ▀▀▀▀▀▀▀▀▀▄ ▀▀▀▀▀▀▀ ▄▀▀▀▀▀▀▀▀▀▀▄▀ ▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▄ ▀▀▀▀▀▀▀▀▀ ▄▀▀▀▀▀▀▀▀▀▀▀▀▀▄ ▀▀▀▀▀▀▀▀▀▀ ▀▀▄▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▄ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▄▀▀▀▀▀▀▀▀▀▀ ▀▀ ▀▀▀▀▀▄▀▀▀▀▀▀▄▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▄▀ ▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀ ▄▄ ▀▀▀ ▀▀▀▀▀▀▀▀▀ ▀ ▀▀▀▀ ▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀ ▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▄▀ ▄▀▀ ▀▀▀▀▀▀▀▀▀▀▄▀▄ ▄▀▀▀▀▀▀▀▀▄▀▀▀▀▀▀▀▀▀▄▄ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▄ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▄▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▄▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▄▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▄▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▄▄ ▀▀▀▀▀▀▀▀▀▀▀▀▀▄▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▄▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀

╭─────────────╮ │scroll to top│ ╰─────────────╯ ╭ serve_ssh.zig ────────────────────────────────────────────────╮ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ ╰───────────────────────────────────────────────────────────────╯

╭────╮ ╭ clone ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ╮ │http│ ssh │ │ ╰────╯ ╰ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ╯

.. embed/ event/ test/ ui/ command.zig event.zig lib.zig main.zig main_wasm.zig serve.zig serve_common.zig serve_http.zig ╭─────────────────────────────────╮ │serve_ssh.zig │ ╰─────────────────────────────────╯ serve_ssh_protocol.zig test.zig testnet.zig try.zig ui.zig web.zig

339 var arena = std.heap.ArenaAllocator.init(allocator); 340 defer arena.deinit(); 341 342 const user = (try evt.User.readByName(io, allocator, admin_repo_path, &arena, owner_name)) orelse return false; 343 344 var it = std.mem.splitScalar(u8, user.ssh_keys, '\n'); 345 while (it.next()) |line| { 346 const fp = fingerprintOfAuthorizedKey(line) orelse continue; 347 if (std.mem.eql(u8, &fp, fingerprint)) return true; 348 } 349 return false; 350 } 351 352 // the SHA256 fingerprint of one authorized_keys line, or null if the line is 353 // blank or not a parseable "<type> <base64> [comment]" entry 354 fn fingerprintOfAuthorizedKey(line: []const u8) ?[ssh.fingerprint_len]u8 { 355 var it = std.mem.tokenizeAny(u8, line, " \t\r"); 356 _ = it.next() orelse return null; // key type 357 const blob_b64 = it.next() orelse return null; 358 359 const decoder = std.base64.standard.Decoder; 360 const blob_len = decoder.calcSizeForSlice(blob_b64) catch return null; 361 var blob_buf: [4096]u8 = undefined; 362 if (blob_len > blob_buf.len) return null; 363 decoder.decode(blob_buf[0..blob_len], blob_b64) catch return null; 364 365 return ssh.formatFingerprint(blob_buf[0..blob_len]); 366 } 367 368 // write an error to the client's stderr and exit non-zero. stderr (not stdout) 369 // because the git exec sessions that call this carry the pack protocol on 370 // stdout, where stray text breaks the client's pkt-line parser. 371 fn writeError(sess: *ssh.SessionCtx, comptime msg: []const u8) !void { 372 try sess.writeStderr("haxy ssh: " ++ msg ++ "\n"); 373 try sess.exit(1); 374 } 375 376 test "parseGitCommand rejects malformed input" { 377 const allocator = std.testing.allocator; 378 try std.testing.expectError(error.InvalidCommand, parseGitCommand(allocator, "git-upload-pack")); 379 try std.testing.expectError(error.UnsupportedService, parseGitCommand(allocator, "ls -la")); 380 try std.testing.expectError(error.UnsupportedService, parseGitCommand(allocator, "git-fake-pack 'repo'")); 381 } 382 383 test "parseGitCommand happy paths" { 384 const allocator = std.testing.allocator; 385 386 { 387 const parsed = try parseGitCommand(allocator, "git-upload-pack 'some-repo'"); 388 defer parsed.deinit(allocator); 389 try std.testing.expectEqual(GitService.upload_pack, parsed.service); 390 try std.testing.expectEqualStrings("some-repo", parsed.dir); 391 } 392 { 393 const parsed = try parseGitCommand(allocator, "git-receive-pack 'user/proj'"); 394 defer parsed.deinit(allocator); 395 try std.testing.expectEqual(GitService.receive_pack, parsed.service); 396 try std.testing.expectEqualStrings("user/proj", parsed.dir); 397 } 398 { 399 const parsed = try parseGitCommand(allocator, "git-upload-pack repo"); 400 defer parsed.deinit(allocator); 401 try std.testing.expectEqual(GitService.upload_pack, parsed.service); 402 try std.testing.expectEqualStrings("repo", parsed.dir); 403 } 404 } 405