194c44c
use std::str::FromStr;
use models::users::user;
use russh::keys::PublicKey;
use russh::keys::ssh_key::HashAlg;
use russh::server::Auth;
use sea_orm::EntityTrait;
use crate::share::errors::GitError;
use crate::ssh::handler::GitSshHandler;
impl GitSshHandler {
/// Resolve the account owning `public_key` through KenOAuth. The SSH
/// username is ignored: GitData virtual accounts (`git@host`) identify
/// users by key, and KenOAuth owns the key → user mapping.
async fn find_user_by_public_key(
&self,
public_key: &PublicKey,
) -> Result<Option<user::Model>, GitError> {
let git = &self.service.smart.git;
let Some(client) = git.state.kenauth.as_ref() else {
return Err(GitError::Internal(
"kenoauth is not configured for ssh authentication".into(),
));
};
let principal = match client.lookup_ssh_key(&public_key.to_string()).await {
Ok(Some(principal)) => principal,
Ok(None) => return Ok(None),
Err(error) => {
tracing::warn!(%error, "ssh key lookup failed");
return Ok(None);
}
};
let user = user::Entity::find_by_id(principal.user_id)
.one(git.db_read())
.await?;
Ok(user.filter(|row| row.is_active))
}
pub async fn auth_publickey_offered_impl(
&mut self,
user: &str,
public_key: &PublicKey,
) -> Result<Auth, russh::Error> {
let fingerprint = public_key.fingerprint(HashAlg::Sha256).to_string();
if self.over_capacity {
tracing::debug!(user, %fingerprint, "publickey offer rejected: server over capacity");
return Ok(Auth::reject());
}
if user.is_empty() || public_key.to_string().len() < 32 {
tracing::debug!(user, %fingerprint, "publickey offer rejected: malformed request");
return Ok(Auth::reject());
}
match self.find_user_by_public_key(public_key).await {
Ok(Some(_)) => {
tracing::debug!(user, %fingerprint, "publickey offer matched a known key");
Ok(Auth::Accept)
}
Ok(None) => {
tracing::info!(user, %fingerprint, client = ?self.client_addr, "publickey offer rejected: key not registered");
Ok(Auth::reject())
}
Err(error) => {
tracing::warn!(user, %fingerprint, "ssh auth lookup failed: {error}");
Err(russh::Error::NotAuthenticated)
}
}
}
pub async fn auth_publickey_impl(
&mut self,
user: &str,
public_key: &PublicKey,
) -> Result<Auth, russh::Error> {
let fingerprint = public_key.fingerprint(HashAlg::Sha256).to_string();
if self.over_capacity {
tracing::debug!(user, %fingerprint, "publickey auth rejected: server over capacity");
return Ok(Auth::reject());
}
if user.is_empty() || public_key.to_string().len() < 32 {
tracing::debug!(user, %fingerprint, "publickey auth rejected: malformed request");
return Ok(Auth::reject());
}
match self.find_user_by_public_key(public_key).await {
Ok(Some(found)) => {
if found.is_restricted || found.prohibit_login {
tracing::warn!(
user,
user_id = %found.uid,
%fingerprint,
"publickey auth rejected: user restricted or login prohibited"
);
return Ok(Auth::reject());
}
tracing::info!(
user,
user_id = %found.uid,
%fingerprint,
client = ?self.client_addr,
"ssh publickey auth accepted"
);
self.operator = Some(found);
Ok(Auth::Accept)
}
Ok(None) => {
tracing::info!(user, %fingerprint, client = ?self.client_addr, "publickey auth rejected: key not registered");
Ok(Auth::reject())
}
Err(error) => {
tracing::warn!(user, %fingerprint, "ssh auth lookup failed: {error}");
Err(russh::Error::NotAuthenticated)
}
}
}
}