gitpane 1.0.0__py3-none-any.whl

gitpane/account/ssh_askpass.py

@@ -0,0 +1,216 @@
+"""Exchange one bounded SSH prompt over an authenticated, same-user local socket."""
+
+from __future__ import annotations
+
+import ctypes
+import io
+import json
+import os
+import platform
+import shlex
+import socket
+import struct
+import sys
+import zipfile
+from ctypes import wintypes
+from typing import TYPE_CHECKING
+
+from PySide6.QtCore import QCoreApplication, QElapsedTimer
+from PySide6.QtNetwork import QLocalSocket
+
+from gitpane.config import (
+    LINUX_PLATFORM,
+    MACOS_PLATFORM,
+    MODULE_OPTION,
+    SSH_IPC_CONNECT_TIMEOUT_MS,
+    SSH_IPC_LIMIT_BYTES,
+    SSH_PROMPT_LIMIT_BYTES,
+    SSH_PROMPT_TIMEOUT_MS,
+    SSH_RESPONSE_LIMIT_BYTES,
+    WINDOWS_PLATFORM,
+    application_module_interpreter_options,
+)
+from gitpane.process.process_group import WINDOWLESS_INTERPRETER_BASENAME
+
+if TYPE_CHECKING:
+    from collections.abc import Callable
+
+# struct ucred of <sys/socket.h>: process id, user id, group id.
+LINUX_PEER_CREDENTIAL_FORMAT = "3i"
+LINUX_PEER_CREDENTIAL_PROCESS_ID_INDEX = 0
+LINUX_PEER_CREDENTIAL_USER_ID_INDEX = 1
+# Workaround: Python exposes neither SOL_LOCAL nor LOCAL_PEERPID on macOS, only LOCAL_PEERCRED. Their values come
+# from <sys/un.h>, where Apple has kept them unchanged since LOCAL_PEERPID appeared.
+MACOS_LOCAL_SOCKET_LEVEL = 0
+MACOS_LOCAL_PEER_PROCESS_ID_OPTION = 2
+# pid_t, a C int.
+MACOS_PEER_PROCESS_ID_FORMAT = "i"
+MACOS_PEER_PROCESS_ID_INDEX = 0
+# struct xucred of <sys/ucred.h>: version, user id, group count, then the NGROUPS (16) group ids.
+MACOS_PEER_CREDENTIAL_FORMAT = "IIh16I"
+MACOS_PEER_CREDENTIAL_USER_ID_INDEX = 1
+OTHER_USER_PEER_MESSAGE = "SSH prompt peer belongs to another user"
+
+
+def _windows_peer_process_id(descriptor: int, server: bool) -> int:
+    """Ask Windows which process holds the other end of the named pipe: the server for a client, the client for a server."""
+    kernel = ctypes.WinDLL("kernel32", use_last_error=True)
+    function = kernel.GetNamedPipeServerProcessId if server else kernel.GetNamedPipeClientProcessId
+    function.argtypes = [wintypes.HANDLE, ctypes.POINTER(wintypes.ULONG)]
+    function.restype = wintypes.BOOL
+    process_id = wintypes.ULONG()
+    if not function(descriptor, ctypes.byref(process_id)):
+        raise ctypes.WinError(ctypes.get_last_error())
+    return process_id.value
+
+
+def _refuse_other_user(user_id: int) -> None:
+    """Refuse a peer run by another user: its process id alone would not prove it belongs to this session."""
+    if user_id != os.getuid():
+        raise OSError(OTHER_USER_PEER_MESSAGE)
+
+
+def _linux_peer_process_id(descriptor: int, server: bool) -> int:
+    """Read the peer process and user Linux records on a connected local socket (SO_PEERCRED)."""
+    with socket.socket(fileno=os.dup(descriptor)) as native_socket:
+        credentials = native_socket.getsockopt(socket.SOL_SOCKET, socket.SO_PEERCRED, struct.calcsize(LINUX_PEER_CREDENTIAL_FORMAT))
+    credential_fields = struct.unpack(LINUX_PEER_CREDENTIAL_FORMAT, credentials)
+    _refuse_other_user(credential_fields[LINUX_PEER_CREDENTIAL_USER_ID_INDEX])
+    return credential_fields[LINUX_PEER_CREDENTIAL_PROCESS_ID_INDEX]
+
+
+def _macos_peer_process_id(descriptor: int, server: bool) -> int:
+    """Read the peer process (LOCAL_PEERPID) and user (LOCAL_PEERCRED) macOS records on a connected local socket."""
+    credential_option = getattr(socket, "LOCAL_PEERCRED", None)
+    if credential_option is None:
+        raise OSError("This Python does not expose LOCAL_PEERCRED, so the local socket peer cannot be identified")
+    with socket.socket(fileno=os.dup(descriptor)) as native_socket:
+        process_id_data = native_socket.getsockopt(MACOS_LOCAL_SOCKET_LEVEL, MACOS_LOCAL_PEER_PROCESS_ID_OPTION, struct.calcsize(MACOS_PEER_PROCESS_ID_FORMAT))
+        credentials = native_socket.getsockopt(MACOS_LOCAL_SOCKET_LEVEL, credential_option, struct.calcsize(MACOS_PEER_CREDENTIAL_FORMAT))
+    _refuse_other_user(struct.unpack(MACOS_PEER_CREDENTIAL_FORMAT, credentials)[MACOS_PEER_CREDENTIAL_USER_ID_INDEX])
+    return struct.unpack(MACOS_PEER_PROCESS_ID_FORMAT, process_id_data)[MACOS_PEER_PROCESS_ID_INDEX]
+
+
+PEER_PROCESS_ID_READER_BY_PLATFORM: dict[str, Callable[[int, bool], int]] = {
+    WINDOWS_PLATFORM: _windows_peer_process_id,
+    LINUX_PLATFORM: _linux_peer_process_id,
+    MACOS_PLATFORM: _macos_peer_process_id,
+}
+
+
+def peer_process_id_reader(platform: str) -> Callable[[int, bool], int]:
+    """Choose how ``platform`` names the process at the other end of a local socket.
+
+    A system with no known reading raises OSError, which every socket owner treats as a refused peer, so a peer is
+    never accepted on a system where the operating system cannot prove who it is.
+    """
+    platform_key = LINUX_PLATFORM if platform.startswith(LINUX_PLATFORM) else platform
+    reader = PEER_PROCESS_ID_READER_BY_PLATFORM.get(platform_key)
+    if reader is None:
+        raise OSError(f"Cannot identify a local socket peer on {platform}")
+    return reader
+
+
+def peer_process_id(connection: QLocalSocket, *, server: bool = False, platform: str = sys.platform) -> int:
+    """Read the OS peer identity so a guessed socket name cannot impersonate an operation."""
+    return peer_process_id_reader(platform)(int(connection.socketDescriptor()), server)
+
+
+def askpass_module_name() -> str:
+    """Answer the module name the SSH helper launcher passes to -m and the Windows archive imports.
+
+    It is read from the module as the import system loaded it, so a move that rewrites the import cannot leave a stale
+    name in the launcher, and it stays right when this module runs itself through -m, where __name__ is __main__.
+    """
+    if __spec__ is None:
+        raise OSError("The SSH helper module was not loaded by the import system, so its name is unknown.")
+    return __spec__.name
+
+
+def askpass_bootstrap_text() -> str:
+    """Answer the Python text the Windows SSH helper archive runs: import the helper's entry point and exit with its status."""
+    return "from " + askpass_module_name() + " import " + main.__name__ + "\nraise SystemExit(" + main.__name__ + "())\n"
+
+
+def create_launcher(directory: str) -> str:
+    """Create an owned windowless launcher that imports only the installed application.
+
+    The launcher starts the Python of the installation without the Python variables the interpreter reads itself
+    (PYTHONPATH, PYTHONHOME...) or the folder it starts from on the import path, so only the installed GitPane, wherever
+    pip put it, can be imported. The site module still reads PYTHONUSERBASE, which moves the user's site-packages
+    folder; that folder is left out altogether when the running GitPane runs without it.
+    """
+    bootstrap = askpass_bootstrap_text()
+    interpreter_options = application_module_interpreter_options(bool(sys.flags.no_user_site))
+    filename = os.path.join(directory, "askpass.exe" if os.name == "nt" else "askpass")
+    if os.name == "nt":
+        # OpenSSH calls an executable directly, so a batch file cannot safely forward arbitrary prompts.
+        # The bundled distlib launcher starts the Python named on its shebang line, with the options written there.
+        from importlib.resources import files
+        launcher_basename = "w64-arm.exe" if platform.machine().lower() == "arm64" else "w64.exe" if struct.calcsize("P") == 8 else "w32.exe"
+        launcher = files("gitpane").joinpath("vendor", launcher_basename).read_bytes()
+        python_filename = os.path.join(os.path.dirname(sys.executable), WINDOWLESS_INTERPRETER_BASENAME)
+        archive = io.BytesIO()
+        with zipfile.ZipFile(archive, "w") as content:
+            content.writestr("__main__.py", bootstrap)
+        shebang = '#!"' + python_filename + '" ' + " ".join(interpreter_options) + "\n"
+        data = launcher + shebang.encode("utf-8") + archive.getvalue()
+    else:
+        start_command = shlex.join([sys.executable, *interpreter_options, MODULE_OPTION, askpass_module_name()])
+        data = ("#!/bin/sh\nexec " + start_command + ' "$@"\n').encode("utf-8")
+    with open(filename, "xb") as stream:
+        stream.write(data)
+    os.chmod(filename, 0o700)
+    return filename
+
+
+def main() -> int:
+    """Return one private answer to OpenSSH stdout, refusing malformed or expired exchanges."""
+    application = QCoreApplication.instance() or QCoreApplication(sys.argv)
+    prompt_index = 1
+    if len(sys.argv) != prompt_index + 1:
+        return 1
+    prompt = sys.argv[prompt_index]
+    if len(prompt.encode("utf-8")) > SSH_PROMPT_LIMIT_BYTES or "\0" in prompt:
+        return 1
+    connection = QLocalSocket()
+    try:
+        connection.connectToServer(os.environ["GITPANE_SSH_PIPE"])
+        if not connection.waitForConnected(SSH_IPC_CONNECT_TIMEOUT_MS):
+            return 1
+        if peer_process_id(connection, server=True) != int(os.environ["GITPANE_SSH_OWNER_PID"]):
+            return 1
+        request_by_key = {"nonce": os.environ["GITPANE_SSH_NONCE"], "operation": os.environ["GITPANE_SSH_OPERATION"],
+                          "prompt": prompt, "hint": os.environ.get("SSH_ASKPASS_PROMPT", "")}
+        connection.write(json.dumps(request_by_key).encode("utf-8") + b"\n")
+        if not connection.waitForBytesWritten(SSH_IPC_CONNECT_TIMEOUT_MS):
+            return 1
+        deadline = QElapsedTimer()
+        deadline.start()
+        response = bytearray()
+        while deadline.elapsed() < SSH_PROMPT_TIMEOUT_MS:
+            response.extend(bytes(connection.readAll()))
+            if len(response) > SSH_IPC_LIMIT_BYTES:
+                return 1
+            if b"\n" in response:
+                response_by_key = json.loads(response)
+                answer = response_by_key.get("answer")
+                if not isinstance(answer, str) or len(answer.encode("utf-8")) > SSH_RESPONSE_LIMIT_BYTES or any(character in answer for character in "\r\n\0"):
+                    return 1
+                if sys.stdout is None:
+                    return 1
+                sys.stdout.buffer.write(answer.encode("utf-8") + b"\n")
+                sys.stdout.buffer.flush()
+                return 0
+            if not connection.waitForReadyRead(max(1, SSH_PROMPT_TIMEOUT_MS - deadline.elapsed())):
+                return 1
+        return 1
+    except (OSError, ValueError, KeyError, TypeError):
+        return 1
+    finally:
+        connection.abort()
+        del application
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

gitpane/account/ssh_prompt.py

@@ -0,0 +1,222 @@
+"""Own bounded SSH prompt sockets until their supervised operation has drained."""
+
+from __future__ import annotations
+
+import hmac
+import json
+import os
+import secrets
+import tempfile
+from dataclasses import dataclass
+from typing import TYPE_CHECKING
+
+from PySide6.QtCore import QObject, QTimer, Signal
+from PySide6.QtNetwork import QLocalServer, QLocalSocket
+
+from gitpane.account.ssh_askpass import create_launcher, peer_process_id
+from gitpane.config import (
+    SSH_IPC_CONNECT_TIMEOUT_MS,
+    SSH_IPC_LIMIT_BYTES,
+    SSH_NONCE_BYTES,
+    SSH_PENDING_CONNECTION_LIMIT,
+    SSH_PROMPT_COUNT_LIMIT,
+    SSH_PROMPT_LIMIT_BYTES,
+    SSH_PROMPT_TIMEOUT_MS,
+    SSH_RESPONSE_LIMIT_BYTES,
+)
+from gitpane.process.process_runner import ProcessStatus
+
+if TYPE_CHECKING:
+    from collections.abc import Callable
+
+    from gitpane.process.process_runner import ProcessRequest, ProcessRunner
+
+
+@dataclass(frozen=True)
+class SshQuestion:
+    """Expose prompt text and a private reply callback without carrying credentials in signals."""
+
+    operation_id: str
+    description: str
+    text: str
+    confirmation: bool
+    answer: Callable[[str | None], None]
+
+
+class SshPromptBridge(QObject):
+    """Authenticate native descendants before opening asynchronous credential questions."""
+
+    question_requested = Signal(object)
+    dismissed = Signal()
+
+    def __init__(self, request: ProcessRequest, runner: ProcessRunner, is_current: Callable[[], bool], parent: QObject | None = None,
+                 *, timeout_ms: int = SSH_PROMPT_TIMEOUT_MS) -> None:
+        """Create a same-user named pipe or filesystem socket for exactly one operation."""
+        super().__init__(parent)
+        self.request = request
+        self.runner = runner
+        self.is_current = is_current
+        self.timeout_ms = timeout_ms
+        self.nonce = secrets.token_hex(SSH_NONCE_BYTES)
+        self.closed = False
+        self.refused = False
+        self.prompt_count = 0
+        self.connection_by_socket: dict[QLocalSocket, bytearray] = {}
+        self.timer_by_socket: dict[QLocalSocket, QTimer] = {}
+        self.pending_socket: QLocalSocket | None = None
+        self.directory = tempfile.TemporaryDirectory(prefix="gitpane-ssh-")
+        self.server = QLocalServer(self)
+        self.server.setSocketOptions(QLocalServer.SocketOption.UserAccessOption)
+        self.server.setMaxPendingConnections(SSH_PENDING_CONNECTION_LIMIT)
+        pipe_name = "gitpane-ssh-" + secrets.token_hex(SSH_NONCE_BYTES) if os.name == "nt" else os.path.join(self.directory.name, "socket")
+        try:
+            self.launcher_filename = create_launcher(self.directory.name)
+            if not self.server.listen(pipe_name):
+                raise OSError("Could not open private SSH prompt channel: " + self.server.errorString())
+        except Exception:
+            self.directory.cleanup()
+            raise
+        self.server.newConnection.connect(self._accept)
+        self.timer = QTimer(self)
+        self.timer.setSingleShot(True)
+        self.timer.timeout.connect(self._expire_prompt)
+
+    def environment(self) -> dict[str, str]:
+        """Supply only this operation's capability and exact helper executable to its child."""
+        return {"SSH_ASKPASS": self.launcher_filename, "GIT_ASKPASS": self.launcher_filename, "SSH_ASKPASS_REQUIRE": "force", "DISPLAY": "gitpane:0",
+                "GITPANE_SSH_PIPE": self.server.fullServerName(), "GITPANE_SSH_NONCE": self.nonce,
+                "GITPANE_SSH_OPERATION": self.request.operation_id, "GITPANE_SSH_OWNER_PID": str(os.getpid())}
+
+    def refuse(self) -> None:
+        """Refuse pending and future questions without releasing process ownership early."""
+        self.refused = True
+        self.timer.stop()
+        self.pending_socket = None
+        for connection in tuple(self.connection_by_socket):
+            connection.abort()
+        self.dismissed.emit()
+
+    def close(self) -> None:
+        """Remove only owned IPC resources after the runner reports complete drainage."""
+        if self.closed:
+            return
+        self.closed = True
+        self.refuse()
+        self.server.close()
+        self.server.newConnection.disconnect()
+        self.timer.timeout.disconnect()
+        self.nonce = ""
+        self.directory.cleanup()
+        # Callbacks retain the service; releasing its last reference during Qt teardown
+        # must not let the parent delete this bridge again while its destructor is active.
+        self.setParent(None)
+        self.deleteLater()
+
+    def _accept(self) -> None:
+        """Bound peers and authenticate their kernel-reported process identity first."""
+        while self.server.hasPendingConnections():
+            connection = self.server.nextPendingConnection()
+            connection.setReadBufferSize(SSH_IPC_LIMIT_BYTES + 1)
+            try:
+                active = self.runner.active_by_id.get(self.request.request_id)
+                if (self.closed or self.refused or not self.is_current() or active is None or active.status != ProcessStatus.RUNNING
+                        or active.request.operation_id != self.request.operation_id or active.group is None
+                        or len(self.connection_by_socket) >= SSH_PENDING_CONNECTION_LIMIT
+                        or not active.group.contains_process(peer_process_id(connection))):
+                    raise ValueError("Unrecognized SSH prompt peer")
+            except (OSError, ValueError, AttributeError):
+                connection.abort()
+                connection.deleteLater()
+                continue
+            self.connection_by_socket[connection] = bytearray()
+            connection.readyRead.connect(lambda current=connection: self._read(current))
+            connection.disconnected.connect(lambda current=connection: self._disconnected(current))
+            timer = QTimer(connection)
+            timer.setSingleShot(True)
+            timer.timeout.connect(lambda current=connection: self._expire_handshake(current))
+            self.timer_by_socket[connection] = timer
+            timer.start(SSH_IPC_CONNECT_TIMEOUT_MS)
+            self._read(connection)
+
+    def _expire_handshake(self, connection: QLocalSocket) -> None:
+        """Disconnect peers that do not provide their authenticated question in time."""
+        if connection in self.connection_by_socket and connection is not self.pending_socket:
+            connection.abort()
+
+    def _expire_prompt(self) -> None:
+        """Stop an unanswered operation while preserving its bridge through process drainage."""
+        self.refuse()
+        self.runner.cancel(self.request.request_id)
+
+    def _disconnected(self, connection: QLocalSocket) -> None:
+        """Release a departed peer and dismiss any question waiting on its socket."""
+        self.connection_by_socket.pop(connection, None)
+        timer = self.timer_by_socket.pop(connection, None)
+        if timer is not None:
+            timer.stop()
+            timer.timeout.disconnect()
+        connection.readyRead.disconnect()
+        connection.disconnected.disconnect()
+        if self.pending_socket is connection:
+            self.pending_socket = None
+            self.timer.stop()
+            self.dismissed.emit()
+        connection.deleteLater()
+
+    def _read(self, connection: QLocalSocket) -> None:
+        """Validate one framed prompt, nonce and operation before it reaches any widget."""
+        content = self.connection_by_socket.get(connection)
+        if content is None:
+            return
+        content.extend(bytes(connection.readAll()))
+        if len(content) > SSH_IPC_LIMIT_BYTES or connection is self.pending_socket:
+            connection.abort()
+            return
+        if b"\n" not in content:
+            return
+        try:
+            data_by_key = json.loads(content)
+            if not isinstance(data_by_key, dict):
+                raise TypeError("Invalid SSH question")
+            nonce = data_by_key.get("nonce")
+            prompt = data_by_key.get("prompt")
+            hint = data_by_key.get("hint", "")
+            if (not isinstance(nonce, str) or not hmac.compare_digest(nonce, self.nonce) or data_by_key.get("operation") != self.request.operation_id
+                    or not isinstance(prompt, str) or not prompt or len(prompt.encode("utf-8")) > SSH_PROMPT_LIMIT_BYTES or "\0" in prompt
+                    or hint not in {"", "confirm", "none"} or self.pending_socket is not None or self.prompt_count >= SSH_PROMPT_COUNT_LIMIT
+                    or self.refused or not self.is_current()):
+                raise ValueError("Invalid SSH question")
+            if "REMOTE HOST IDENTIFICATION HAS CHANGED" in prompt.upper():
+                raise ValueError("Changed host keys require native SSH configuration repair")
+        except (ValueError, UnicodeError, TypeError):
+            connection.abort()
+            return
+        self.prompt_count += 1
+        self.timer_by_socket[connection].stop()
+        self.pending_socket = connection
+        confirmation = hint == "confirm" or "are you sure you want to continue connecting" in prompt.lower()
+        question = SshQuestion(self.request.operation_id, self.request.operation, prompt, confirmation, lambda answer: self._answer(connection, confirmation, answer))
+        self.timer.start(self.timeout_ms)
+        self.question_requested.emit(question)
+
+    def _answer(self, connection: QLocalSocket, confirmation: bool, answer: str | None) -> None:
+        """Write a bounded answer only to the still-current authenticated requesting process."""
+        if self.closed or self.refused or connection is not self.pending_socket:
+            return
+        if not self.is_current() or answer is None:
+            self.refuse()
+            self.runner.cancel(self.request.request_id)
+            return
+        if not isinstance(answer, str) or len(answer.encode("utf-8")) > SSH_RESPONSE_LIMIT_BYTES or any(character in answer for character in "\r\n\0"):
+            self.refuse()
+            return
+        if confirmation and answer not in {"yes", "no"}:
+            self.refuse()
+            return
+        if not confirmation:
+            self.runner.protect_secret(self.request.request_id, answer)
+        self.timer.stop()
+        self.pending_socket = None
+        connection.write(json.dumps({"answer": answer}).encode("utf-8") + b"\n")
+        connection.disconnectFromServer()
+        self.dismissed.emit()