dsh-remote 0.8.18 → 0.8.20

package/lib/hostkey.js

@@ -3,6 +3,8 @@
 // ssh2 v1.17) is unit-tested against the REAL wire shape — the v0.6.7 bug
 // class ("mock object hid a contract drift") must not regress.
 import { createHash } from 'node:crypto'
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs'
+import path from 'node:path'
 
 /**
  * Extract the SSH host-key algorithm name from a raw SSH host-key blob
@@ -34,6 +36,64 @@ export function keyFingerprint(key) {
   return createHash('sha256').update(blob).digest('base64')
 }
 
+export function loadKnownHosts(file) {
+  if (!file) return {}
+  try {
+    const j = JSON.parse(readFileSync(file, 'utf8'))
+    if (j && typeof j === 'object' && !Array.isArray(j)) return j
+  } catch {}
+  return {}
+}
+
+export function isHostKeyKnown(file, host, port) {
+  return Object.prototype.hasOwnProperty.call(loadKnownHosts(file), `${host}:${port}`)
+}
+
+/** Build an ssh2 `hostVerifier` bound to the current config + known_hosts file. */
+export function createHostKeyGuard(config, knownHostsFile) {
+  const id = () => `${config.host}:${config.port}`
+  const mode = config.hostKeyMode === 'verify' || config.hostKeyMode === 'off'
+    ? config.hostKeyMode
+    : 'accept-new'
+  const read = () => loadKnownHosts(knownHostsFile)
+  const write = (kh) => {
+    if (!knownHostsFile) return
+    try { mkdirSync(path.dirname(knownHostsFile), { recursive: true }) } catch {}
+    writeFileSync(knownHostsFile, JSON.stringify(kh, null, 2))
+  }
+  const guard = {
+    mode,
+    lastError: null,
+    knownHosts: read,
+    forgetHost() {
+      const kh = read()
+      delete kh[id()]
+      write(kh)
+    },
+    verifier(key) {
+      if (mode === 'off') return true
+      const fp = keyFingerprint(key)
+      const kh = read()
+      const stored = kh[id()]
+      if (stored) {
+        if (stored.fingerprint === fp) return true
+        guard.lastError =
+          `host key for ${id()} CHANGED (stored ${stored.fingerprint}, received ${fp}) — ` +
+          'possible man-in-the-middle; run /remote-forget-key to re-trust if this is expected'
+        return false
+      }
+      if (mode === 'verify') {
+        guard.lastError = `unknown host key for ${id()} (hostKeyMode=verify) — trust it first with accept-new`
+        return false
+      }
+      kh[id()] = { algo: blobAlgorithm(key) || (key && key.algo) || 'unknown', fingerprint: fp, firstSeen: new Date().toISOString() }
+      write(kh)
+      return true
+    },
+  }
+  return guard
+}
+
 /** Build a fake-but-wire-shaped host-key blob for tests:
  * `string(algo) string(32 bytes)`. */
 export function makeKeyBlob(algo, seed) {