HAXY

▄▄ ▀▀▀▄ ▄▄ ▀▀▀▀▀▄ ▄▀▀▀▀ ▀▀▀▀▀▀ ▄▀▀▀▀▀▀ ▀▀▀▀▀▀ ▀ ▀ ▄▀▀▀▀▀▀ ▀▀▀▀▀▀ ▄▀ ▄▀ ▄▀▀▀▀▀▀▀▀ ▀▀▀▄▄ ▀▀▀▀▀▀ ▀▀ ▀▄▀▀ ▄▀ ▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▄ ▀▀▀▀▀▄ ▄▀▀▀▀▀▀▀ ▄ ▄▀▄▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▄ ▄▀▀▀▀▀▀▀▀▀▀▄ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▄ ▀ ▀▀▀▀▀▀ ▄▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀ ▄▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▄▀▀▀▀▀▀▀▀▀▀▀▀▀▀▄ ▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▄ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▄▄▄▀▀▀▀▄▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▄▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▄ ▀▀▀▀▀▀▀▀▀▀▀▀▀▄▀▀▀▀▀▀▀▀▀▀▄ ▄▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▄▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▄▄ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▄▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀ ▀▀▀▀▀▀▀▀▄ ▀▀▀ ▀▀▀▀▀▀▀▀ ▀▀▀ ▀▀▀ ▀▀▀▀▀ ▀▀ ▀▀▀▀▀▀ ▀▀▀▄▀▄ ▄▄▄▀▀ ▀▀▀▀▀▀ ▀▀▄▀▀▀▀▀▀▀ ▀▀▀▀▀▄▀▀▀▀▀ ▀▀▀▀▀▄ ▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▄▀ ▄▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀ ▀

╭─────────────╮ │scroll to top│ ╰─────────────╯ ╭ serve_ssh.zig ────────────────────────────────────────────────╮ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ ╰───────────────────────────────────────────────────────────────╯

╭────╮ ╭ clone ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ╮ │http│ ssh │ │ ╰────╯ ╰ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ╯

.. embed/ event/ test/ ui/ command.zig event.zig lib.zig main.zig main_wasm.zig serve.zig serve_common.zig serve_http.zig ╭─────────────────────────────────╮ │serve_ssh.zig │ ╰─────────────────────────────────╯ serve_ssh_protocol.zig test.zig testnet.zig try.zig ui.zig web.zig

303 } 304 305 // flush whatever the pack op buffered into our writer adapter 306 session_writer.interface.flush() catch {}; 307 } 308 309 fn parseGitCommand(allocator: std.mem.Allocator, command: []const u8) !ParsedGitCommand { 310 var tokens = try std.process.Args.IteratorGeneral(.{ .single_quotes = true }).init(allocator, command); 311 defer tokens.deinit(); 312 313 const service_token = tokens.next() orelse return error.InvalidCommand; 314 const dir_token = tokens.next() orelse return error.InvalidCommand; 315 316 const service: GitService = 317 if (std.mem.eql(u8, service_token, "git-upload-pack") or std.mem.eql(u8, service_token, "upload-pack")) 318 .upload_pack 319 else if (std.mem.eql(u8, service_token, "git-receive-pack") or std.mem.eql(u8, service_token, "receive-pack")) 320 .receive_pack 321 else 322 return error.UnsupportedService; 323 324 return .{ .service = service, .dir = try allocator.dupe(u8, dir_token) }; 325 } 326 327 // true if `fingerprint` matches one of the named user's registered SSH keys 328 fn isKeyAuthorized( 329 io: std.Io, 330 allocator: std.mem.Allocator, 331 admin_repo_path: []const u8, 332 owner_name: []const u8, 333 fingerprint: *const [ssh.fingerprint_len]u8, 334 ) !bool { 335 var arena = std.heap.ArenaAllocator.init(allocator); 336 defer arena.deinit(); 337 338 const user = (try evt.User.readByName(io, allocator, admin_repo_path, &arena, owner_name)) orelse return false; 339 340 var it = std.mem.splitScalar(u8, user.ssh_keys, '\n'); 341 while (it.next()) |line| { 342 const fp = fingerprintOfAuthorizedKey(line) orelse continue; 343 if (std.mem.eql(u8, &fp, fingerprint)) return true; 344 } 345 return false; 346 } 347 348 // the SHA256 fingerprint of one authorized_keys line, or null if the line is 349 // blank or not a parseable "<type> <base64> [comment]" entry 350 fn fingerprintOfAuthorizedKey(line: []const u8) ?[ssh.fingerprint_len]u8 { 351 var it = std.mem.tokenizeAny(u8, line, " \t\r"); 352 _ = it.next() orelse return null; // key type 353 const blob_b64 = it.next() orelse return null; 354 355 const decoder = std.base64.standard.Decoder; 356 const blob_len = decoder.calcSizeForSlice(blob_b64) catch return null; 357 var blob_buf: [4096]u8 = undefined; 358 if (blob_len > blob_buf.len) return null; 359 decoder.decode(blob_buf[0..blob_len], blob_b64) catch return null; 360 361 return ssh.formatFingerprint(blob_buf[0..blob_len]); 362 } 363 364 // write an error to the client's stderr and exit non-zero. stderr (not stdout) 365 // because the git exec sessions that call this carry the pack protocol on 366 // stdout, where stray text breaks the client's pkt-line parser. 367 fn writeError(sess: *ssh.SessionCtx, comptime msg: []const u8) !void { 368 try sess.writeStderr("haxy ssh: " ++ msg ++ "\n"); 369 try sess.exit(1); 370 } 371 372 test "parseGitCommand rejects malformed input" { 373 const allocator = std.testing.allocator; 374 try std.testing.expectError(error.InvalidCommand, parseGitCommand(allocator, "git-upload-pack")); 375 try std.testing.expectError(error.UnsupportedService, parseGitCommand(allocator, "ls -la")); 376 try std.testing.expectError(error.UnsupportedService, parseGitCommand(allocator, "git-fake-pack 'repo'")); 377 } 378 379 test "parseGitCommand happy paths" { 380 const allocator = std.testing.allocator; 381 382 { 383 const parsed = try parseGitCommand(allocator, "git-upload-pack 'some-repo'"); 384 defer parsed.deinit(allocator); 385 try std.testing.expectEqual(GitService.upload_pack, parsed.service); 386 try std.testing.expectEqualStrings("some-repo", parsed.dir); 387 } 388 { 389 const parsed = try parseGitCommand(allocator, "git-receive-pack 'user/proj'"); 390 defer parsed.deinit(allocator); 391 try std.testing.expectEqual(GitService.receive_pack, parsed.service); 392 try std.testing.expectEqualStrings("user/proj", parsed.dir); 393 } 394 { 395 const parsed = try parseGitCommand(allocator, "git-upload-pack repo"); 396 defer parsed.deinit(allocator); 397 try std.testing.expectEqual(GitService.upload_pack, parsed.service); 398 try std.testing.expectEqualStrings("repo", parsed.dir); 399 } 400 } 401