gitoria

6.3 KB

1. // lib/sshkeys.hl — SSH KEYS for git over SSH (ticket gitoria#7; docs/git-backend.md "Credentials"). A logged-in user pastes a
2. // PUBLIC key; the sshd container (docker/sshd) asks this app which user a key belongs to (`/__git/keys`, lib/api.hl gitKeys → keyLine), so a new
3. // key works at once and no authorized_keys file is edited. Only the public key is stored — nothing secret.
4. // sshKeysTable pk @id index !key, user { user (users @id), name, type, key (base64), fingerprint, created } storage/mpackdb/sshkeys.db
5. // The key is checked by `ssh-keygen -l -f` (the real parser): one line, an allowed type, a real key, RSA at least 2048 bits.
6. import { MPackDB } from 'hl:mpackdb'
7. import { run } from 'hl:proc'
8. import { now } from 'hl:time'
9. import { writeFile, remove, exists } from 'hl:fs'
10. import { randomBytes } from 'hl:crypto'
11. import { NL, storageDir, countOfList, firstOf, plainError, envOr, newestFirst, localStamp } from './util.hl'
12. import { userRecord } from './users.hl'
13. import { tmpDir } from './git.hl'
15. static sshKeysTable = new MPackDB(file = storageDir + '/sshkeys.db', primaryKey = '@id', indexes = ['!key', 'user'])
16. static maxKeys = 20
17. // SSH is offered only when the sshd container is set up: the shared secret it uses to ask this app is in the environment
18. static sshSecret = envOr('GITORIA_SSH_SECRET', '')
19. static sshPort = envOr('GITORIA_SSH_PORT', '2222')
20. // the host name in SSH clone addresses: repo addresses go through Cloudflare's proxy, which does not pass SSH, so
21. // production sets a DNS-only name (GITORIA_SSH_HOST=ssh.gitoria.worldapi.org); empty = the page's own host (dev, gates)
22. static sshHost = envOr('GITORIA_SSH_HOST', '')
23. static sshEnabled = sshSecret != ''
24. static allowedTypes = ['ssh-ed25519', 'ecdsa-sha2-nistp256', 'ecdsa-sha2-nistp384', 'ecdsa-sha2-nistp521', 'ssh-rsa', '[email protected]', '[email protected]']
26. // the address to clone from over SSH: `git@host:slug.git` on port 22, else the ssh:// form with the port
27. static sshUrl = (host, slug) => {
28. h = sshHost != '' ? sshHost : host
29. if (sshPort == '22') { return 'git@' + h + ':' + slug + '.git' }
30. return 'ssh://git@' + h + ':' + sshPort + '/' + slug + '.git'
31. }
33. static isKeyBase64 = (s) => {
34. if (s.length < 20 || s.length > 1200) { return false }
35. let i = 0
36. while (i < s.length) {
37. let c = s.charCodeAt(i)
38. if (!((c >= 48 && c <= 57) || (c >= 65 && c <= 90) || (c >= 97 && c <= 122) || c == 43 || c == 47 || c == 61)) { return false }
39. i = i + 1
40. }
41. return true
42. }
44. static rowOfKey = (k) => { return { id = k.id name = k.name fingerprint = k.fingerprint created = localStamp(k.created) createdMs = k.created } }
46. // a user's keys, newest first
47. static keyRows = (userId) => {
48. out = []
49. all = sshKeysTable.find('user', userId)
50. if (countOfList(all) == 0) { return out }
51. for (k of all) { out.push(rowOfKey(k)) }
52. return newestFirst(out)
53. }
55. // `ssh-keygen -l` on the key: → { bits, fingerprint } or null when it is not a key
56. static inspectKey = (type, key) => {
57. file = tmpDir() + '/' + randomBytes(12, 'hex') + '.pub'
58. writeFile(file, type + ' ' + key + NL, 384)
59. r = run(['ssh-keygen', '-l', '-f', file], { timeout = 10 })
60. if (exists(file)) { remove(file) }
61. if (r == null || r.exit != 0 || r.lines.length == 0) { return null }
62. parts = r.lines[0].split(' ')
63. if (parts.length < 2 || !parts[1].startsWith('SHA256:')) { return null }
64. return { bits = toNumber(parts[0]) fingerprint = parts[1] }
65. }
67. // a new key: { row } or { error }. `text` is the line from the .pub file: `<type> <base64> [comment]`
68. static addKey = (userId, name, text) => {
69. u = userRecord(userId)
70. if (u == null) { return { error = 'log in with ident (top right) first' } }
71. n = name == null ? '' : ('' + name).trim()
72. bad = plainError(n, 60, 'the key name')
73. if (bad != null) { return { error = bad } }
74. if (n == '') { return { error = 'give the key a name (for example the computer it is for)' } }
75. if (text == null || hlTypeName(text) != 'String' || text.length > 2000) { return { error = 'paste the public key (the .pub file)' } }
76. t = text.trim()
77. if (t.startsWith('-----')) { return { error = 'that is a PRIVATE key — never paste it. Paste the .pub file: ssh-keygen -y -f ~/.ssh/id_ed25519' } }
78. if (t.includes(NL)) { return { error = 'paste one public key, on one line' } }
79. parts = t.split(' ')
80. let type = parts[0]
81. if (parts.length < 2 || !allowedTypes.includes(type)) { return { error = 'not a public key of a supported type (ssh-ed25519, ssh-rsa, ecdsa, sk-…)' } }
82. let key = parts[1]
83. if (!isKeyBase64(key)) { return { error = 'the key text is not valid' } }
84. info = inspectKey(type, key)
85. if (info == null) { return { error = 'the key text is not valid' } }
86. if (type == 'ssh-rsa' && info.bits < 2048) { return { error = 'RSA keys need at least 2048 bits' } }
87. if (countOfList(sshKeysTable.find('key', key)) > 0) { return { error = 'that key is already added' } }
88. if (countOfList(sshKeysTable.find('user', u.id)) >= maxKeys) { return { error = 'you have ' + maxKeys + ' keys already — remove one first' } }
89. id = sshKeysTable.put({ user = u.id name = n type = type key = key fingerprint = info.fingerprint created = now() })
90. if (id == null) { return { error = 'could not store the key: ' + sshKeysTable.lastError() } }
91. return { row = rowOfKey(sshKeysTable.fetch(id)) }
92. }
94. // remove one of the user's own keys (works at once: the sshd container asks again on every login)
95. static revokeKey = (userId, keyId) => {
96. if (userId == null || keyId == null || hlTypeName(keyId) != 'String') { return { error = 'no such key' } }
97. k = sshKeysTable.fetch(keyId)
98. if (k == null || k.user != userId) { return { error = 'no such key' } }
99. sshKeysTable.delete(keyId)
100. return { ok = true }
101. }
103. // the user a key belongs to (users @id) or null
104. static userOfKey = (type, key) => {
105. if (type == null || key == null || hlTypeName(type) != 'String' || hlTypeName(key) != 'String' || !isKeyBase64(key)) { return null }
106. k = firstOf(sshKeysTable.find('key', key))
107. if (k == null || k.type != type) { return null }
108. return k.user
109. }
111. // what the sshd container's AuthorizedKeysCommand gets for a key (lib/api.hl gitKeys): the authorized_keys line of a known
112. // user's key — forced command `gitoria-shell <user id>`, nothing else allowed — or '' for an unknown one
113. static keyLine = (type, key) => {
114. userId = userOfKey(type, key)
115. if (userId == null || userRecord(userId) == null) { return '' }
116. return 'restrict,command="/usr/local/bin/gitoria-shell ' + userId + '" ' + type + ' ' + key + NL
117. }