bdy 1.9.17-dev → 1.9.19-dev

package/distTs/package.json

@@ -1,7 +1,7 @@
 {
   "name": "bdy",
   "preferGlobal": false,
-  "version": "1.9.17-dev",
+  "version": "1.9.19-dev",
   "type": "commonjs",
   "license": "MIT",
   "scripts": {

package/distTs/src/agent.js

@@ -217,13 +217,13 @@ class Agent extends events_1.default {
                     const tunnel = tt.find((tunnel) => data.id === tunnel.id);
                     if (!tunnel) {
                         this.addTunnel(new tunnel_js_1.default({
+                            ...data,
+                            sshHostKey,
                             agent: {
                                 id: this.id,
                                 host: this.host,
                                 token: this.token
                             },
-                            ...data,
-                            sshHostKey,
                         }));
                     }
                     else if (tunnel.hasChanged(data)) {

package/distTs/src/api/buddy.js

@@ -118,9 +118,9 @@ class ApiBuddyClass {
         });
         logger_js_1.default.info((0, texts_js_1.LOG_TUNNEL_REGISTERED)(config.id));
         return new tunnel_js_1.default({
-            agent: { id: agentId, host, token },
             ...config,
             sshHostKey,
+            agent: { id: agentId, host, token },
         });
     }
     async removeTunnel(agentId, tunnelId, host, token) {

package/distTs/src/server/ssh.js

@@ -6,6 +6,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const events_1 = __importDefault(require("events"));
 const ssh2_1 = __importDefault(require("ssh2"));
 const logger_js_1 = __importDefault(require("../logger.js"));
+const crypto_1 = require("crypto");
 const child_process_1 = require("child_process");
 const sftp_1 = __importDefault(require("./sftp"));
 const buddy_1 = __importDefault(require("../api/buddy"));
@@ -31,27 +32,70 @@ class ServerSsh extends events_1.default {
     handleSshTunnel(stream) {
         this.server.injectSocket(stream);
     }
+    checkValueSafe(input, allowed) {
+        const autoReject = input.length !== allowed.length;
+        if (autoReject)
+            allowed = input;
+        const isMatch = (0, crypto_1.timingSafeEqual)(input, allowed);
+        return (!autoReject && isMatch);
+    }
+    async verifyKey(ctx) {
+        try {
+            logger_js_1.default.info('1');
+            const { keys } = await buddy_1.default.fetchAgentKeys(this.agent.id, this.agent.host, this.agent.token);
+            for (let i = 0; i < keys.length; i += 1) {
+                logger_js_1.default.info('2');
+                const publicKey = ssh2_1.default.utils.parseKey(keys[i]);
+                if (ctx.key.algo !== publicKey.type)
+                    continue;
+                logger_js_1.default.info('3');
+                if (!this.checkValueSafe(ctx.key.data, publicKey.getPublicSSH()))
+                    continue;
+                logger_js_1.default.info('4');
+                if (ctx.signature && !publicKey.verify(ctx.blob, ctx.signature))
+                    continue;
+                logger_js_1.default.info('5');
+                return true;
+            }
+        }
+        catch (err) {
+            logger_js_1.default.info('6');
+            logger_js_1.default.info(err);
+            // do nothing
+        }
+        logger_js_1.default.info('7');
+        return false;
+    }
     processClient(client) {
         client.setNoDelay();
         client.on('authentication', async (ctx) => {
-            if (ctx.method !== 'password') {
-                logger_js_1.default.info(this.agent);
-                logger_js_1.default.info(ctx);
-                const keys = await buddy_1.default.fetchAgentKeys(this.agent.id, this.agent.host, this.agent.token);
-                // todo handle keys
-                logger_js_1.default.info(keys);
-                ctx.reject(['password']);
+            const allowed = ['publickey', 'password'];
+            if (!allowed.includes(ctx.method)) {
+                ctx.reject(allowed);
                 return;
             }
-            if (ctx.username !== this.login) {
-                ctx.reject();
+            if (ctx.method === 'password') {
+                if (!this.checkValueSafe(Buffer.from(ctx.username), Buffer.from(this.login))) {
+                    ctx.reject();
+                    return;
+                }
+                if (!this.checkValueSafe(Buffer.from(ctx.password), Buffer.from(this.password))) {
+                    ctx.reject();
+                    return;
+                }
+                ctx.accept();
                 return;
             }
-            if (ctx.password !== this.password) {
-                ctx.reject();
+            if (ctx.method === 'publickey') {
+                const verified = await this.verifyKey(ctx);
+                if (!verified) {
+                    ctx.reject();
+                    return;
+                }
+                ctx.accept();
                 return;
             }
-            ctx.accept();
+            ctx.reject();
         });
         client.on('close', () => {
             client.removeAllListeners();

package/distTs/src/tunnel.js

@@ -26,9 +26,6 @@ class Tunnel extends events_1.default {
         if (!sshHostKey)
             sshHostKey = (0, utils_js_1.createSshHostKey)();
         this.agent = agent;
-        // todo remove
-        logger_js_1.default.info(this.agent);
-        logger_js_1.default.trace();
         this.id = id;
         this.sshHostKey = sshHostKey;
         this.create({

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "bdy",
   "preferGlobal": false,
-  "version": "1.9.17-dev",
+  "version": "1.9.19-dev",
   "type": "commonjs",
   "license": "MIT",
   "scripts": {