39d7e6b
use std::str::FromStr;
use models::users::user;
use models::users::user_ssh_keys;
use russh::keys::PublicKey;
use russh::keys::ssh_key::HashAlg;
use russh::server::Auth;
use sea_orm::{ColumnTrait, EntityTrait, QueryFilter, Set};
use time::OffsetDateTime;
use tokio::task;
use uuid::Uuid;
use crate::ssh::handler::GitSshHandler;
struct SshKeyUser {
user: user::Model,
key_id: Uuid,
}
fn key_content_matches(content: &str, public_key: &PublicKey) -> bool {
match PublicKey::from_str(content.trim()) {
// Compare fingerprints: OpenSSH may offer RSA keys under rsa-sha2-*
// algorithm names, so direct equality against a stored ssh-rsa line
// can fail even for the same key material.
Ok(p) => p.fingerprint(HashAlg::Sha256) == public_key.fingerprint(HashAlg::Sha256),
Err(_) => content.trim() == public_key.to_string().trim(),
}
}
impl GitSshHandler {
/// Resolve the account owning `public_key`. The SSH username is tried
/// first for exact-name accounts, then authentication falls back to a
/// global key match so virtual accounts (e.g. `git@host`, matching the
/// `ssh_clone_user` in clone URLs) identify users by key like GitHub.
async fn find_user_by_public_key(
&self,
username: &str,
public_key: &PublicKey,
) -> Result<Option<SshKeyUser>, sea_orm::DbErr> {
let db = self.service.smart.git.db_read();
if let Some(found) = self.find_user_key_by_name(db, username, public_key).await? {
return Ok(Some(found));
}
let keys = user_ssh_keys::Entity::find().all(db).await?;
for key in keys {
if !key_content_matches(key.content.as_str(), public_key) {
continue;
}
let Some(user) = user::Entity::find_by_id(key.user_id).one(db).await? else {
continue;
};
if !user.is_active {
continue;
}
return Ok(Some(SshKeyUser {
user,
key_id: key.id,
}));
}
Ok(None)
}
async fn find_user_key_by_name(
&self,
db: &sea_orm::DatabaseConnection,
username: &str,
public_key: &PublicKey,
) -> Result<Option<SshKeyUser>, sea_orm::DbErr> {
let Some(user) = user::Entity::find()
.filter(user::Column::LowerName.eq(username.to_lowercase()))
.one(db)
.await?
else {
return Ok(None);
};
if !user.is_active {
return Ok(None);
}
let keys = user_ssh_keys::Entity::find()
.filter(user_ssh_keys::Column::UserId.eq(user.uid))
.all(db)
.await?;
for key in keys {
if key_content_matches(key.content.as_str(), public_key) {
return Ok(Some(SshKeyUser {
user,
key_id: key.id,
}));
}
}
Ok(None)
}
fn update_key_last_used(&self, key_id: Uuid) {
let db = self.service.smart.git.state.database.clone();
let now = OffsetDateTime::now_utc();
task::spawn(async move {
let _ = user_ssh_keys::Entity::update_many()
.set(user_ssh_keys::ActiveModel {
id: Set(key_id),
last_used_at: Set(Some(now)),
..Default::default()
})
.filter(user_ssh_keys::Column::Id.eq(key_id))
.exec(db.write())
.await;
});
}
pub async fn auth_publickey_offered_impl(
&mut self,
user: &str,
public_key: &PublicKey,
) -> Result<Auth, russh::Error> {
let fingerprint = public_key.fingerprint(HashAlg::Sha256).to_string();
if self.over_capacity {
tracing::debug!(user, %fingerprint, "publickey offer rejected: server over capacity");
return Ok(Auth::reject());
}
if user.is_empty() || public_key.to_string().len() < 32 {
tracing::debug!(user, %fingerprint, "publickey offer rejected: malformed request");
return Ok(Auth::reject());
}
match self.find_user_by_public_key(user, public_key).await {
Ok(Some(_)) => {
tracing::debug!(user, %fingerprint, "publickey offer matched a known key");
Ok(Auth::Accept)
}
Ok(None) => {
tracing::info!(user, %fingerprint, client = ?self.client_addr, "publickey offer rejected: key not registered");
Ok(Auth::reject())
}
Err(e) => {
tracing::warn!(user, %fingerprint, "ssh auth lookup failed: {e}");
Err(russh::Error::NotAuthenticated)
}
}
}
pub async fn auth_publickey_impl(
&mut self,
user: &str,
public_key: &PublicKey,
) -> Result<Auth, russh::Error> {
let fingerprint = public_key.fingerprint(HashAlg::Sha256).to_string();
if self.over_capacity {
tracing::debug!(user, %fingerprint, "publickey auth rejected: server over capacity");
return Ok(Auth::reject());
}
if user.is_empty() || public_key.to_string().len() < 32 {
tracing::debug!(user, %fingerprint, "publickey auth rejected: malformed request");
return Ok(Auth::reject());
}
match self.find_user_by_public_key(user, public_key).await {
Ok(Some(found)) => {
if found.user.is_restricted || found.user.prohibit_login {
tracing::warn!(
user,
user_id = %found.user.uid,
%fingerprint,
"publickey auth rejected: user restricted or login prohibited"
);
return Ok(Auth::reject());
}
let key_id = found.key_id;
tracing::info!(
user,
user_id = %found.user.uid,
key_id = %key_id,
%fingerprint,
client = ?self.client_addr,
"ssh publickey auth accepted"
);
self.operator = Some(found.user);
self.update_key_last_used(key_id);
Ok(Auth::Accept)
}
Ok(None) => {
tracing::info!(user, %fingerprint, client = ?self.client_addr, "publickey auth rejected: key not registered");
Ok(Auth::reject())
}
Err(e) => {
tracing::warn!(user, %fingerprint, "ssh auth lookup failed: {e}");
Err(russh::Error::NotAuthenticated)
}
}
}
}