HAXY

▄▀▀▄ ▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀ ▄▄▀▀▀▀▀▀ ▄▄▄ ▄▀▀▀▀▀▀▀▀▀▀▀▀▀▄ ▄▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▄ ▄▀▀▀▀▀▀▀▀▀▀▀▀▀▀▄▀▀▀▄ ▄▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▄▄ ▄▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▄▄ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▄ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀ ▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀ ▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀ ▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀ ▄▀▀ ▄▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀ ▀▀▀ ▀▀▀▀▀▀▄ ▀▀▀▀▀▀▀▀ ▀▀▀ ▀▀▀▀▀▀▀ ▀▀▀▀▀▀ ▀▀▀ ▀▀▀▀▀▀ ▀▀▀▀▀▀ ▀▀▀ ▀▀▀▀▀▀▀ ▀▀▀▀▀▀▄ ▀▀▀ ▀▀▀▀▀▀ ▀▀▀▀▀▀▀ ▀▀▀ ▀▀▀▀▀ ▀▀▀▀▀ ▀▀▀ ▀▀▀▀ ▀▀▀▀ ▄▀▀ ▄▀▀▀▀ ▀▀▀▀ ▀▀▀ ▀▀▀▀▀ ▀▀▀▀▄ ▀▀▀ ▄▀▀▀▀ ▀▀▀▀▀ ▀▀▀ ▀▀▀▀▀▀ ▀▀▀▀▀ ▀▀▀ ▀▀▀▀▀▀▀ ▀▀▀▀▀ ▀▀ ▄▀▀▀▀▀▀▀ ▀▀▀▀▄ ▀▀▀▀▀▀▀ ▀▀▀▀▀

╭─────────────╮ │scroll to top│ ╰─────────────╯ ╭ serve_ssh.zig ────────────────────────────────────────────────╮ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ │ ╰───────────────────────────────────────────────────────────────╯

╭────╮ ╭ clone ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ╮ │http│ ssh │ │ ╰────╯ ╰ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ╯

.. embed/ event/ test/ ui/ command.zig event.zig lib.zig main.zig main_wasm.zig serve.zig serve_common.zig serve_http.zig ╭─────────────────────────────────╮ │serve_ssh.zig │ ╰─────────────────────────────────╯ serve_ssh_protocol.zig test.zig testnet.zig try.zig ui.zig web.zig

332 admin_repo_path: []const u8, 333 owner_name: []const u8, 334 fingerprint: *const [ssh.fingerprint_len]u8, 335 ) !bool { 336 var arena = std.heap.ArenaAllocator.init(allocator); 337 defer arena.deinit(); 338 339 const user = (try evt.User.readByName(io, allocator, admin_repo_path, &arena, owner_name)) orelse return false; 340 341 var it = std.mem.splitScalar(u8, user.ssh_keys, '\n'); 342 while (it.next()) |line| { 343 const fp = fingerprintOfAuthorizedKey(line) orelse continue; 344 if (std.mem.eql(u8, &fp, fingerprint)) return true; 345 } 346 return false; 347 } 348 349 // the SHA256 fingerprint of one authorized_keys line, or null if the line is 350 // blank or not a parseable "<type> <base64> [comment]" entry 351 fn fingerprintOfAuthorizedKey(line: []const u8) ?[ssh.fingerprint_len]u8 { 352 var it = std.mem.tokenizeAny(u8, line, " \t\r"); 353 _ = it.next() orelse return null; // key type 354 const blob_b64 = it.next() orelse return null; 355 356 const decoder = std.base64.standard.Decoder; 357 const blob_len = decoder.calcSizeForSlice(blob_b64) catch return null; 358 var blob_buf: [4096]u8 = undefined; 359 if (blob_len > blob_buf.len) return null; 360 decoder.decode(blob_buf[0..blob_len], blob_b64) catch return null; 361 362 return ssh.formatFingerprint(blob_buf[0..blob_len]); 363 } 364 365 // write an error to the client's stderr and exit non-zero. stderr (not stdout) 366 // because the git exec sessions that call this carry the pack protocol on 367 // stdout, where stray text breaks the client's pkt-line parser. 368 fn writeError(sess: *ssh.SessionCtx, msg: []const u8) !void { 369 var buf: [256]u8 = undefined; 370 const text = try std.fmt.bufPrint(&buf, "haxy ssh: {s}\n", .{msg}); 371 try sess.writeStderr(text); 372 try sess.exit(1); 373 } 374 375 test "parseGitCommand rejects malformed input" { 376 const allocator = std.testing.allocator; 377 try std.testing.expectError(error.InvalidCommand, parseGitCommand(allocator, "git-upload-pack")); 378 try std.testing.expectError(error.UnsupportedService, parseGitCommand(allocator, "ls -la")); 379 try std.testing.expectError(error.UnsupportedService, parseGitCommand(allocator, "git-fake-pack 'repo'")); 380 } 381 382 test "parseGitCommand happy paths" { 383 const allocator = std.testing.allocator; 384 385 { 386 const parsed = try parseGitCommand(allocator, "git-upload-pack 'some-repo'"); 387 defer parsed.deinit(allocator); 388 try std.testing.expectEqual(GitService.upload_pack, parsed.service); 389 try std.testing.expectEqualStrings("some-repo", parsed.dir); 390 } 391 { 392 const parsed = try parseGitCommand(allocator, "git-receive-pack 'user/proj'"); 393 defer parsed.deinit(allocator); 394 try std.testing.expectEqual(GitService.receive_pack, parsed.service); 395 try std.testing.expectEqualStrings("user/proj", parsed.dir); 396 } 397 { 398 const parsed = try parseGitCommand(allocator, "git-upload-pack repo"); 399 defer parsed.deinit(allocator); 400 try std.testing.expectEqual(GitService.upload_pack, parsed.service); 401 try std.testing.expectEqualStrings("repo", parsed.dir); 402 } 403 } 404