From 58d40e211f63e69e092e1a7d09589a0271bca357 Mon Sep 17 00:00:00 2001 From: Thomas Miceli Date: Mon, 1 May 2023 02:55:34 +0200 Subject: [PATCH] Fix SSH pubkey detection --- internal/models/sshkey.go | 6 +++--- internal/models/user.go | 13 ++++++------- internal/ssh/git_ssh.go | 12 +++--------- internal/ssh/run.go | 13 ++++++------- internal/web/settings.go | 3 ++- templates/pages/settings.html | 2 +- 6 files changed, 21 insertions(+), 28 deletions(-) diff --git a/internal/models/sshkey.go b/internal/models/sshkey.go index d4b9b20..2dcdabc 100644 --- a/internal/models/sshkey.go +++ b/internal/models/sshkey.go @@ -48,7 +48,7 @@ func GetSSHKeyByID(sshKeyId uint) (*SSHKey, error) { return sshKey, err } -func GetSSHKeyByContent(sshKeyContent string) (*SSHKey, error) { +func SSHKeyDoesExists(sshKeyContent string) (*SSHKey, error) { sshKey := new(SSHKey) err := db. Where("content like ?", sshKeyContent+"%"). @@ -65,9 +65,9 @@ func (sshKey *SSHKey) Delete() error { return db.Delete(&sshKey).Error } -func SSHKeyLastUsedNow(sshKeyID uint) error { +func SSHKeyLastUsedNow(sshKeyContent string) error { return db.Model(&SSHKey{}). - Where("id = ?", sshKeyID). + Where("content = ?", sshKeyContent). Update("last_used_at", time.Now().Unix()).Error } diff --git a/internal/models/user.go b/internal/models/user.go index 9b0cabe..73682e2 100644 --- a/internal/models/user.go +++ b/internal/models/user.go @@ -81,15 +81,14 @@ func GetUserById(userId uint) (*User, error) { return user, err } -func GetUserBySSHKeyID(sshKeyId uint) (*User, error) { - user := new(User) +func SSHKeyExistsForUser(sshKey string, userId uint) (*SSHKey, error) { + key := new(SSHKey) err := db. - Preload("SSHKeys"). - Joins("join ssh_keys on users.id = ssh_keys.user_id"). - Where("ssh_keys.id = ?", sshKeyId). - First(&user).Error + Where("content = ?", sshKey). + Where("user_id = ?", userId). + First(&key).Error - return user, err + return key, err } func GetUserByProvider(id string, provider string) (*User, error) { diff --git a/internal/ssh/git_ssh.go b/internal/ssh/git_ssh.go index 8a18381..376d336 100644 --- a/internal/ssh/git_ssh.go +++ b/internal/ssh/git_ssh.go @@ -12,7 +12,7 @@ import ( "strings" ) -func runGitCommand(ch ssh.Channel, gitCmd string, keyID uint, ip string) error { +func runGitCommand(ch ssh.Channel, gitCmd string, key string, ip string) error { verb, args := parseCommand(gitCmd) if !strings.HasPrefix(verb, "git-") { verb = "" @@ -43,7 +43,7 @@ func runGitCommand(ch ssh.Channel, gitCmd string, keyID uint, ip string) error { } if verb == "receive-pack" || requireLogin == "1" { - user, err := models.GetUserBySSHKeyID(keyID) + pubKey, err := models.SSHKeyExistsForUser(key, gist.UserID) if err != nil { if errors.Is(err, gorm.ErrRecordNotFound) { log.Warn().Msg("Invalid SSH authentication attempt from " + ip) @@ -52,15 +52,9 @@ func runGitCommand(ch ssh.Channel, gitCmd string, keyID uint, ip string) error { errorSsh("Failed to get user by SSH key id", err) return errors.New("internal server error") } - - if user.ID != gist.UserID { - log.Warn().Msg("Invalid SSH authentication attempt from " + ip) - return errors.New("unauthorized") - } + _ = models.SSHKeyLastUsedNow(pubKey.Content) } - _ = models.SSHKeyLastUsedNow(keyID) - repositoryPath := git.RepositoryPath(gist.User.Username, gist.Uuid) cmd := exec.Command("git", verb, repositoryPath) diff --git a/internal/ssh/run.go b/internal/ssh/run.go index 15c7f7b..a4edf7a 100644 --- a/internal/ssh/run.go +++ b/internal/ssh/run.go @@ -12,7 +12,6 @@ import ( "os" "os/exec" "path/filepath" - "strconv" "strings" "syscall" ) @@ -24,7 +23,8 @@ func Start() { sshConfig := &ssh.ServerConfig{ PublicKeyCallback: func(conn ssh.ConnMetadata, key ssh.PublicKey) (*ssh.Permissions, error) { - pkey, err := models.GetSSHKeyByContent(strings.TrimSpace(string(ssh.MarshalAuthorizedKey(key)))) + strKey := strings.TrimSpace(string(ssh.MarshalAuthorizedKey(key))) + _, err := models.SSHKeyDoesExists(strKey) if err != nil { if !errors.Is(err, gorm.ErrRecordNotFound) { return nil, err @@ -33,7 +33,7 @@ func Start() { log.Warn().Msg("Invalid SSH authentication attempt from " + conn.RemoteAddr().String()) return nil, errors.New("unknown public key") } - return &ssh.Permissions{Extensions: map[string]string{"key-id": strconv.Itoa(int(pkey.ID))}}, nil + return &ssh.Permissions{Extensions: map[string]string{"key": strKey}}, nil }, } @@ -71,13 +71,12 @@ func listen(serverConfig *ssh.ServerConfig) { } go ssh.DiscardRequests(reqs) - keyID, _ := strconv.Atoi(sConn.Permissions.Extensions["key-id"]) - go handleConnexion(channels, uint(keyID), sConn.RemoteAddr().String()) + go handleConnexion(channels, sConn.Permissions.Extensions["key"], sConn.RemoteAddr().String()) }() } } -func handleConnexion(channels <-chan ssh.NewChannel, keyID uint, ip string) { +func handleConnexion(channels <-chan ssh.NewChannel, key string, ip string) { for channel := range channels { if channel.ChannelType() != "session" { _ = channel.Reject(ssh.UnknownChannelType, "Unknown channel type") @@ -109,7 +108,7 @@ func handleConnexion(channels <-chan ssh.NewChannel, keyID uint, ip string) { payloadCmd = payloadCmd[i:] } - if err = runGitCommand(ch, payloadCmd, keyID, ip); err != nil { + if err = runGitCommand(ch, payloadCmd, key, ip); err != nil { _, _ = ch.Stderr().Write([]byte("Opengist: " + err.Error() + "\r\n")) } _, _ = ch.SendRequest("exit-status", false, []byte{0, 0, 0, 0}) diff --git a/internal/web/settings.go b/internal/web/settings.go index 795cb68..8317e31 100644 --- a/internal/web/settings.go +++ b/internal/web/settings.go @@ -74,11 +74,12 @@ func sshKeysProcess(ctx echo.Context) error { key.UserID = user.ID - _, _, _, _, err := ssh.ParseAuthorizedKey([]byte(key.Content)) + pubKey, _, _, _, err := ssh.ParseAuthorizedKey([]byte(key.Content)) if err != nil { addFlash(ctx, "Invalid SSH key", "error") return redirect(ctx, "/settings") } + key.Content = strings.TrimSpace(string(ssh.MarshalAuthorizedKey(pubKey))) if err := key.Create(); err != nil { return errorRes(500, "Cannot add SSH key", err) diff --git a/templates/pages/settings.html b/templates/pages/settings.html index ca6c824..3bbfebe 100644 --- a/templates/pages/settings.html +++ b/templates/pages/settings.html @@ -83,7 +83,7 @@ Add SSH Key

- Used only to push gists using Git via SSH + Used only to pull/push gists using Git via SSH